@cosmicdrift/kumiko-samples 0.387.0 → 0.389.0

package/packages/bundled-features/src/template-resolver/seeding.ts

@@ -85,10 +85,19 @@ export type SeedSystemTemplateOptions = {
   readonly ifExists?: SeedIfExists;
 };
 
+// Namespace prefix plus path, no whitespace: keeps free text from passing as a key that the UI
+// would then show raw.
+const I18N_KEY_FORMAT = /^[^\s:]+:\S+$/;
+
 function seedTitleColumn(opts: SeedSystemTemplateOptions, label: string): string | null {
   if (opts.title !== undefined && opts.titleI18nKey !== undefined) {
     throw new Error(`${label} rejected: set either title or titleI18nKey, not both`);
   }
+  if (opts.titleI18nKey !== undefined && !I18N_KEY_FORMAT.test(opts.titleI18nKey)) {
+    throw new Error(
+      `${label} rejected: titleI18nKey "${opts.titleI18nKey}" is not a "namespace:key" i18n key`,
+    );
+  }
   return opts.titleI18nKey ?? opts.title ?? null;
 }
 
@@ -167,21 +176,20 @@ export async function seedSystemTemplate(
       current?.title === rowFields.title &&
       current?.variableSchema === rowFields.variableSchema &&
       current?.meta === rowFields.meta &&
-      current?.status === rowFields.status &&
       current?.parentTemplateId === rowFields.parentTemplateId &&
       (linkedResources === undefined || current?.linkedResources === linkedResources)
     ) {
       return { id: String(row.id) };
     }
-    const result = await executor.update(
-      {
-        id: row.id,
-        version: row.version,
-        changes: { ...rowFields, ...activeStampChanges(row) },
-      },
-      by,
-      tdb,
-    );
+    // An archived system row is a SystemAdmin decision (reversible with publish-system) that a
+    // pod-boot re-seed must not undo; content still follows the code. The seed replaces the
+    // content, so an open draft on the old content is dropped with it.
+    const { status: _status, ...contentFields } = rowFields;
+    const changes =
+      current?.status === "archived"
+        ? { ...contentFields, status: "archived" as const, draft: null }
+        : { ...rowFields, ...activeStampChanges(row), draft: null };
+    const result = await executor.update({ id: row.id, version: row.version, changes }, by, tdb);
     if (!result.isSuccess) {
       throw new Error(`seedSystemTemplate update failed: ${JSON.stringify(result)}`);
     }
@@ -292,8 +300,10 @@ async function seedSystemTemplateBundleWithResources(
       `${label}: bundles with resources need a file provider; pass opts.dispatcher (the dispatcher of the seed deps) so the files are stored through the import-bundle-system write`,
     );
   }
-  if ((opts.ifExists ?? "skip") === "skip") {
-    const existingIds: Record<string, string> = {};
+  const skipExisting = (opts.ifExists ?? "skip") === "skip";
+  const existingIds: Record<string, string> = {};
+  let bundleToImport = bundle;
+  if (skipExisting) {
     for (const locale of Object.keys(bundle.locales)) {
       const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
         tenantId: SYSTEM_TENANT_ID,
@@ -306,16 +316,24 @@ async function seedSystemTemplateBundleWithResources(
     if (Object.keys(existingIds).length === Object.keys(bundle.locales).length) {
       return { ids: existingIds };
     }
+    // import-bundle-system always overwrites, so only the missing locales go in: a
+    // hand-edited system row of an already seeded locale must survive the new-locale boot.
+    bundleToImport = {
+      ...bundle,
+      locales: Object.fromEntries(
+        Object.entries(bundle.locales).filter(([locale]) => !(locale in existingIds)),
+      ),
+    };
   }
   const result = await dispatcher.write(
     TemplateResolverHandlers.importBundleSystem,
-    { bundle },
+    { bundle: bundleToImport },
     opts.by ?? createSystemUser(SYSTEM_TENANT_ID, ["SystemAdmin"]),
   );
   if (!result.isSuccess) {
     throw new Error(`${label} failed: ${result.error.code}: ${result.error.message}`);
   }
-  return { ids: importedIds(result.data) };
+  return { ids: { ...existingIds, ...importedIds(result.data) } };
 }
 
 function importedIds(data: unknown): Record<string, string> {
@@ -424,12 +442,14 @@ export async function seedTextBlock(
     row: { id: string; version: number },
     current: TemplateResourceRow | null | undefined,
   ): Promise<{ id: string }> => {
+    // No folder option keeps the row's folder, so a re-seed cannot drop it from the content tree.
+    const folder = opts.folder === undefined ? (current?.folder ?? null) : fields.folder;
     // Skip no-op updates so a legal re-seed on every pod boot does not bump
     // version/modifiedAt (ETag, "last changed", event-store growth).
     if (
       current?.title === fields.title &&
       current?.content === fields.content &&
-      current?.folder === fields.folder
+      current?.folder === folder
     ) {
       return { id: String(row.id) };
     }
@@ -440,7 +460,7 @@ export async function seedTextBlock(
         changes: {
           title: fields.title,
           content: fields.content,
-          folder: fields.folder,
+          folder,
           // A re-seed must not revive an archived block; only a served one gets a new served version.
           ...(current?.status === "active" && servedStampChanges(row)),
         },
@@ -515,7 +535,11 @@ export type LegalContentBlock = {
 export async function seedLegalContentFromJson(
   db: DbConnection,
   blocks: readonly LegalContentBlock[],
-  opts: { readonly tenantId?: TenantId; readonly by?: SessionUser } = {},
+  opts: {
+    readonly tenantId?: TenantId;
+    readonly by?: SessionUser;
+    readonly folder?: string;
+  } = {},
 ): Promise<void> {
   const tenantId = opts.tenantId ?? SYSTEM_TENANT_ID;
   const by = opts.by ?? createSystemUser(tenantId);
@@ -526,6 +550,7 @@ export async function seedLegalContentFromJson(
       locale: block.locale,
       title: block.title,
       content: block.content,
+      ...(opts.folder !== undefined && { folder: opts.folder }),
       ifExists: "update",
       by,
     });

package/packages/bundled-features/src/template-resolver/store-template-resource.ts

@@ -19,7 +19,7 @@ import {
   type UploadedFileBytes,
   uploadFileBytesBeforeTransaction,
 } from "@cosmicdrift/kumiko-framework/files";
-import { fileContextForTenant } from "../file-foundation/index.ts";
+import { fileContextForTenant, readFileRefContent } from "../file-foundation/index.ts";
 import { extensionForResourceContentType, requireForTenant } from "../shared/index.ts";
 import {
   DEFAULT_RESOURCE_MAX_BYTES,
@@ -29,13 +29,13 @@ import {
 import { executor } from "./handlers/shared.ts";
 import {
   attachmentEntriesOf,
+  isFileAttachmentEntry,
   type LinkedResourceEntry,
   parseLinkedResourceEntries,
   templatePdfAttachmentLinkSchema,
 } from "./linked-resources.ts";
 import { normalizeResourceImage } from "./resource-image.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.ts";
-import { readTemplateResource } from "./template-resources.ts";
 import { ACTIVE_TEMPLATE_STATUS, SYSTEM_TENANT_ID } from "./web/constants.ts";
 import { TemplateResolverErrors } from "./web/qualified-names.ts";
 
@@ -87,6 +87,10 @@ function keyInUse(): WriteResult<never> {
   );
 }
 
+function isImageKey(links: Readonly<Record<string, LinkedResourceEntry>>, key: string) {
+  return typeof links[key] === "string";
+}
+
 function isAttachmentKey(links: Readonly<Record<string, LinkedResourceEntry>>, key: string) {
   const occupant = links[key];
   return occupant !== undefined && typeof occupant !== "string";
@@ -265,6 +269,20 @@ export async function releaseAll(releases: readonly Release[]): Promise<void> {
   if (rejected?.status === "rejected") throw rejected.reason;
 }
 
+// Failure paths: a failing release must not replace the upload error the caller needs to see.
+export async function releaseAfterFailure(
+  ctx: HandlerContext,
+  releases: readonly Release[],
+): Promise<void> {
+  try {
+    await releaseAll(releases);
+  } catch (releaseError) {
+    ctx.log?.warn("template upload rollback: releasing stored files failed", {
+      error: releaseError instanceof Error ? releaseError.message : String(releaseError),
+    });
+  }
+}
+
 // `upload` is absent for a rendered-PDF link, which carries no file.
 export type PreparedLinkedResourceCopy = {
   readonly key: string;
@@ -272,6 +290,44 @@ export type PreparedLinkedResourceCopy = {
   readonly upload?: UploadedFileBytes;
 };
 
+// The source row's own fileName is personal data and may be ciphertext, so the copy is named from
+// the link entry or the key.
+function copiedFileName(key: string, entry: LinkedResourceEntry, contentType: string): string {
+  if (typeof entry !== "string" && isFileAttachmentEntry(entry)) return entry.fileName;
+  return `${key}.${extensionForResourceContentType(contentType) ?? "bin"}`;
+}
+
+function sourceUnreadable(): WriteResult<never> {
+  return writeFailure(
+    new UnprocessableError(TemplateResolverErrors.resourceSourceUnreadable, {
+      i18nKey: "templateResolver.errors.resource.sourceUnreadable",
+    }),
+  );
+}
+
+// Undefined: the fileRef row exists but its bytes cannot be read, which must not look like a
+// deleted file. The provider is chosen by the tenant of the fileRef, not by the caller's.
+async function readCopySource(
+  ctx: HandlerContext,
+  fileRefId: string,
+): Promise<{ contentType: string; bytes: Uint8Array } | null | undefined> {
+  try {
+    const found = await readFileRefContent({
+      db: ctx.db,
+      filesForTenant: (tid) => fileContextForTenant(ctx, ctx.user.tenantId, tid),
+      fileRefId,
+      allowedTenantIds: [SYSTEM_TENANT_ID, ctx.user.tenantId],
+    });
+    return found === null ? null : { contentType: found.contentType, bytes: found.content };
+  } catch (cause) {
+    ctx.log?.warn("template copy: source file could not be read", {
+      fileRefId,
+      errorClass: cause instanceof Error ? cause.name : typeof cause,
+    });
+    return undefined;
+  }
+}
+
 // beforeTransaction half: copies the file behind every entry into the target tenant's storage, so a
 // template copied from the system default keeps working once the tenant exports it or measures its
 // attachments. An entry whose source file is gone is left out: it could not be resolved at render
@@ -291,24 +347,30 @@ export async function prepareLinkedResourceCopiesBeforeTransaction(args: {
         copies.push({ key, entry });
         continue;
       }
-      const file = await readTemplateResource(
-        ctx,
-        typeof entry === "string" ? entry : entry.fileRefId,
-      );
-      if (file === null) continue;
+      const source = await readCopySource(ctx, typeof entry === "string" ? entry : entry.fileRefId);
+      if (source === undefined) {
+        await releaseAfterFailure(ctx, releases);
+        return sourceUnreadable();
+      }
+      // skip: the source fileRef is deleted or unknown, so there is nothing to copy
+      if (source === null) continue;
       const uploaded = await uploadToTenant(
         { ctx, user, tenantId },
-        { fileName: file.fileName, mimeType: file.contentType, data: file.bytes },
+        {
+          fileName: copiedFileName(key, entry, source.contentType),
+          mimeType: source.contentType,
+          data: source.bytes,
+        },
       );
       if (!uploaded.isSuccess) {
-        await releaseAll(releases);
+        await releaseAfterFailure(ctx, releases);
         return uploaded;
       }
       if (uploaded.release) releases.push(uploaded.release);
       copies.push({ key, entry, upload: uploaded.data });
     }
   } catch (cause) {
-    await releaseAll(releases);
+    await releaseAfterFailure(ctx, releases);
     throw cause;
   }
   return { isSuccess: true, data: copies, release: () => releaseAll(releases) };
@@ -481,8 +543,7 @@ async function checkAttachmentTarget(args: {
   if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
     return attachmentLimitFailure();
   }
-  const occupant = linked[key];
-  if (occupant !== undefined && typeof occupant === "string") return keyInUse();
+  if (isImageKey(linked, key)) return keyInUse();
   return { isSuccess: true, data: { row, linked } };
 }
 
@@ -638,6 +699,7 @@ export async function linkTemplatePdfAttachment(args: {
   if (row.kind !== "mail") return attachmentNeedsMailTemplate();
 
   const linked = parseLinkedResourceEntries(row.linkedResources);
+  if (isImageKey(linked, key)) return keyInUse();
   if (otherAttachmentCount(linked, key) >= MAX_FILE_ATTACHMENTS_PER_TEMPLATE) {
     return attachmentLimitFailure();
   }

package/packages/bundled-features/src/template-resolver/template-delivery-policy.ts

@@ -1,6 +1,5 @@
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { isPlainObject, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { isSystemAdmin } from "./template-draft.ts";
 import { SYSTEM_TENANT_ID } from "./web/constants.ts";
 import { TEMPLATE_RESOLVER_FEATURE } from "./web/qualified-names.ts";
 
@@ -45,16 +44,6 @@ export function isRowServed(
   return row.tenantId === SYSTEM_TENANT_ID || isTenantOverrideServed(policy, row);
 }
 
-// A SystemAdmin sees every stored row, so a locked override can still be reset; everyone else
-// sees only what is delivered, which keeps a locked override out of the template-resolver queries for a TenantAdmin (the audit log keeps the history).
-export function isRowServedTo(
-  policy: TemplateDeliveryPolicy,
-  user: { readonly roles: readonly string[] },
-  row: DeliveryTarget & { readonly tenantId: string },
-): boolean {
-  return isSystemAdmin(user) || isRowServed(policy, row);
-}
-
 function isDeliveryTarget(value: unknown): value is DeliveryTarget {
   return (
     typeof propertyOf(value, "kind") === "string" && typeof propertyOf(value, "slug") === "string"

package/packages/bundled-features/src/template-resolver/template-meta.ts

@@ -6,6 +6,12 @@ import {
   type TemplateKind,
 } from "./web/constants.ts";
 import { MAIL_TONES, type MailTone } from "./web/mail-constants.ts";
+import {
+  MAIL_LAYOUT_ACCENT_LINES,
+  MAIL_LAYOUT_BUTTON_STYLES,
+  MAIL_LAYOUT_FONTS,
+  MAIL_LAYOUT_WIDTHS,
+} from "./web/mail-layout-constants.ts";
 
 // One or more kebab segments joined by ":" — notification templates are seeded
 // under their qualified name `feature:notify:name`.
@@ -89,13 +95,15 @@ const pdfMetaSchema = z
   })
   .strict();
 
-const MAIL_LAYOUT_FONTS = ["sans", "serif"] as const;
-const MAIL_LAYOUT_ACCENT_LINES = ["branding", "none"] as const;
-const MAIL_LAYOUT_BUTTON_STYLES = ["filled-rounded", "filled-square", "outline"] as const;
+const MAIL_LAYOUT_WIDTH_LITERALS = [
+  z.literal(MAIL_LAYOUT_WIDTHS[0]),
+  z.literal(MAIL_LAYOUT_WIDTHS[1]),
+  z.literal(MAIL_LAYOUT_WIDTHS[2]),
+] as const;
 
 const mailLayoutMetaSchema = z
   .object({
-    width: z.union([z.literal(560), z.literal(600), z.literal(640)]).optional(),
+    width: z.union(MAIL_LAYOUT_WIDTH_LITERALS).optional(),
     font: z.enum(MAIL_LAYOUT_FONTS).optional(),
     outerBackground: z.string().regex(HEX_COLOR_PATTERN, "must be a #rrggbb color").optional(),
     accentLine: z.enum(MAIL_LAYOUT_ACCENT_LINES).optional(),

package/packages/bundled-features/src/template-resolver/template-preview.ts

@@ -28,7 +28,12 @@ import {
   RendererError,
   type RendererPlugin,
 } from "../renderer-foundation/index.ts";
-import { createTemplateResolverApi, TemplateNotFoundError, type TemplateResource } from "./api.ts";
+import {
+  createTemplateResolverApi,
+  isRowDeliveredTo,
+  TemplateNotFoundError,
+  type TemplateResource,
+} from "./api.ts";
 import { collectDocumentResourceKeys } from "./compile-document-body.ts";
 import { parseStoredJson } from "./handlers/template-gates.ts";
 import { validateTemplateDraft } from "./handlers/validate.query.ts";
@@ -41,7 +46,7 @@ import {
 import { type LinkedResourceEntry, parseLinkedResourceEntries } from "./linked-resources.ts";
 import { buildDisplayHtml } from "./preview-display-html.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "./template-delivery-policy.ts";
+import { deliveryPolicyOf } from "./template-delivery-policy.ts";
 import {
   isMailTemplateMeta,
   type MailTemplateMeta,
@@ -327,7 +332,10 @@ async function loadEditedRowResources(
     { limit: 1 },
   );
   const row = rows[0];
-  if (row !== undefined && !isRowServedTo(deliveryPolicyOf(ctx.registry), user, row)) {
+  if (
+    row !== undefined &&
+    !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, row))
+  ) {
     return undefined;
   }
   return row === undefined ? undefined : parseLinkedResourceEntries(row.linkedResources);

package/packages/bundled-features/src/template-resolver/web/constants.ts

@@ -4,6 +4,8 @@
 // RenderKind identifies the consumer class of a template. Plugin renderers in
 // `renderer-foundation` match on kind; the resolver here is kind-agnostic: it
 // only loads, and the content format (markdown/mjml/html) decides who renders it.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+
 export const RENDER_KINDS = ["mail", "document-pdf", "image-snapshot"] as const;
 export type RenderKind = (typeof RENDER_KINDS)[number];
 
@@ -55,8 +57,10 @@ export const COLLECTION_REFUSED_KINDS = [
   "pdf-layout",
 ] as const satisfies readonly TemplateKind[];
 
-export function isCollectionRefusedKind(kind: string): boolean {
-  return COLLECTION_REFUSED_KINDS.some((refused) => refused === kind);
+export function isCollectionRefusedKind(
+  kind: unknown,
+): kind is (typeof COLLECTION_REFUSED_KINDS)[number] {
+  return isOneOf(COLLECTION_REFUSED_KINDS, kind);
 }
 
 export const CONTENT_FORMATS = ["markdown", "mjml", "html", "plain"] as const;
@@ -69,6 +73,7 @@ export const TEMPLATE_STATUSES = ["draft", "active", "archived"] as const;
 export type TemplateStatus = (typeof TEMPLATE_STATUSES)[number];
 export const ACTIVE_TEMPLATE_STATUS = "active" satisfies TemplateStatus;
 
+export { HEX_COLOR_PATTERN } from "./mail-layout-constants.ts";
 export {
   PDF_DEFAULT_MARGIN_MM,
   PDF_FOOTER_MARGIN_MM,
@@ -79,9 +84,6 @@ export {
   type PdfPageFormat,
 } from "./pdf-constants.ts";
 
-// Colors end up inside MJML attributes, so only a strict hex is ever written there.
-export const HEX_COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;
-
 export const DEFAULT_MAIL_LAYOUT_SLUG = "default";
 export const DEFAULT_PDF_LAYOUT_SLUG = "default";
 

package/packages/bundled-features/src/template-resolver/web/i18n.ts

@@ -90,6 +90,10 @@ export const defaultTranslations: TranslationsByLocale = {
     "templateResolver.errors.patch.textNotFound": "The text {find} was not found in the block.",
     "templateResolver.errors.patch.textAmbiguous":
       "The text {find} occurs {count} times in the block; use a longer text.",
+    "templateResolver.errors.patch.textSpansFormatting":
+      "The text {find} crosses a formatting change in the block; replace each formatted part on its own.",
+    "templateResolver.errors.patch.placeholderNotReplaceable":
+      "The placeholder {find} cannot be replaced as text; set the text around it with another operation or remove the block.",
     "templateResolver.errors.patch.blockNotAllowed":
       "The block type {type} is not available in {kind} templates.",
     "templateResolver.errors.patch.blockTypeMismatch":
@@ -113,6 +117,8 @@ export const defaultTranslations: TranslationsByLocale = {
       "Your account has no email address to send the test mail to.",
     "templateResolver.errors.testMail.failed": "The test mail could not be sent.",
     "templateResolver.errors.resource.tooLarge": "The image is too large.",
+    "templateResolver.errors.resource.sourceUnreadable":
+      "A file of the source template could not be read, so nothing was copied.",
     "templateResolver.errors.resource.unsupportedImage":
       "This file is not a supported image. Use PNG, JPEG, WebP or GIF.",
     "templateResolver.errors.template.systemResourcesNeedSystemTenant":

package/packages/bundled-features/src/template-resolver/web/index.ts

@@ -16,6 +16,13 @@ export {
   PDF_DOCUMENT_BLOCKS,
 } from "./document-toolbar-blocks.ts";
 export { MAIL_TONES, type MailTone } from "./mail-constants.ts";
+export {
+  HEX_COLOR_PATTERN,
+  MAIL_LAYOUT_ACCENT_LINES,
+  MAIL_LAYOUT_BUTTON_STYLES,
+  MAIL_LAYOUT_FONTS,
+  MAIL_LAYOUT_WIDTHS,
+} from "./mail-layout-constants.ts";
 export {
   PDF_DEFAULT_MARGIN_MM,
   PDF_FOOTER_MARGIN_MM,

package/packages/bundled-features/src/template-resolver/web/mail-layout-constants.ts

@@ -0,0 +1,8 @@
+// No imports: web/ re-exports these, and template-meta.ts pulls in zod and the framework engine.
+export const MAIL_LAYOUT_WIDTHS = [560, 600, 640] as const;
+export const MAIL_LAYOUT_FONTS = ["sans", "serif"] as const;
+export const MAIL_LAYOUT_ACCENT_LINES = ["branding", "none"] as const;
+export const MAIL_LAYOUT_BUTTON_STYLES = ["filled-rounded", "filled-square", "outline"] as const;
+
+// Colors end up inside MJML attributes, so only a strict hex is ever written there.
+export const HEX_COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;

package/packages/bundled-features/src/template-resolver/web/qualified-names.ts

@@ -68,6 +68,7 @@ export const TemplateResolverErrors = {
   bundleLocalesDiffer: "bundle_locales_differ",
   resourceTooLarge: "template_resource_too_large",
   resourceUnsupportedImage: "template_resource_unsupported_image",
+  resourceSourceUnreadable: "template_resource_source_unreadable",
   attachmentUnsupportedType: "template_attachment_unsupported_type",
   attachmentLimit: "template_attachment_limit",
   attachmentInvalid: "template_attachment_invalid",

package/packages/bundled-features/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Tenant directory search contract documented",
+    "detail": "A search returns the first limit matches in tenant-key order, sorted by label afterwards; the handler description now says so."
+  },
   {
     "version": "0.383.0",
     "type": "improvement",

package/packages/bundled-features/src/tenant/feature.ts

@@ -71,6 +71,7 @@ export function collectAssignableAppRoles(
 
 export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefinition {
   return defineFeature("tenant", (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Registers the three core multi-tenancy entities \u2014 `tenant`, `tenant-membership`, and `tenant-invitation` (DB tables `read_tenants`, `read_tenant_memberships`, and `read_tenant_invitations`) \u2014 along with write handlers for create/update/disable/enable/addMember/removeMember/updateMemberRoles and the matching queries. It also declares a set of per-tenant config keys (companyName, timezone, locale, SMTP credentials) and system-only keys (priceModel, maxUsers) via `r.config({ keys: { ... } })`. Use this feature in every multi-tenant app; membership resolution and invitation flows depend on it, and `auth-email-password` requires it.",
     );

package/packages/bundled-features/src/tenant/handlers/member-directory.query.ts

@@ -50,6 +50,8 @@ export const memberDirectoryQuery = definePagedQueryHandler({
     limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT),
     // Sent by the reference combobox while the user types.
     search: z.string().trim().min(1).optional(),
+    // Resolves exactly these users; callers that know their ids must not depend on the cap.
+    ids: z.array(z.string().min(1)).max(MAX_LIST_LIMIT).optional(),
   }),
   access: { roles: access.admin },
   description:
@@ -62,7 +64,8 @@ export const memberDirectoryQuery = definePagedQueryHandler({
           "tenant:query:member-directory requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
       });
     }
-    const { limit, search } = query.payload;
+    const { limit, search, ids } = query.payload;
+    if (ids?.length === 0) return { rows: [], nextCursor: null };
     // Without a search the first `limit` rows are enough; with one, every
     // candidate must be decrypted before the limit can apply.
     const scanLimit = search === undefined ? limit : SEARCH_SCAN_CAP;
@@ -71,13 +74,16 @@ export const memberDirectoryQuery = definePagedQueryHandler({
       const db = ctx.systemDb.acknowledgeCrossTenant(
         "SystemAdmin reference labels span every tenant, as user:query:user:list did",
       );
-      users = await selectMany(db, userTable, undefined, {
+      users = await selectMany(db, userTable, ids === undefined ? undefined : { id: ids }, {
         limit: scanLimit,
         orderBy: { col: "id", direction: "asc" },
       });
     } else {
       const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-      const userIds = (await loadMemberUserIds(db, query.user.tenantId)).slice(0, scanLimit);
+      const requestedIds = ids === undefined ? undefined : new Set(ids);
+      const userIds = (await loadMemberUserIds(db, query.user.tenantId))
+        .filter((id) => requestedIds === undefined || requestedIds.has(id))
+        .slice(0, scanLimit);
       users =
         userIds.length > 0
           ? await selectMany(

package/packages/bundled-features/src/tenant/handlers/team-list.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/db";
+import { isUndefinedTable, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   definePagedQueryHandler,
@@ -7,7 +7,7 @@ import {
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { errorCodeOf, isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { userSessionTable } from "../../sessions/index.ts";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.ts";
@@ -142,7 +142,7 @@ export const teamListQuery = definePagedQueryHandler({
         // ponytail: lean sample apps (admin-console) mount auth without
         // sessions — store_user_sessions never gets pushed. Integration tests
         // may seed the table without mounting the feature; prod mounts both.
-        if (errorCodeOf(err) !== "42P01") throw err;
+        if (!isUndefinedTable(err)) throw err;
       }
     }
 

package/packages/bundled-features/src/tenant/handlers/tenant-directory.query.ts

@@ -27,10 +27,12 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
     limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT),
     // Sent by the reference combobox while the user types.
     search: z.string().trim().min(1).optional(),
+    // Resolves exactly these tenants; callers that know their ids must not depend on the cap.
+    ids: z.array(z.string().min(1)).max(MAX_LIST_LIMIT).optional(),
   }),
   access: { roles: access.admin },
   description:
-    "Lists tenants as id/label pairs for resolving tenant references to display names: the caller's own tenant for an admin, every tenant for a SystemAdmin.",
+    "Lists tenants as id/label pairs for resolving tenant references to display names: the caller's own tenant for an admin, every tenant for a SystemAdmin. A search returns the first `limit` matches in tenant-key order (sorted by label afterwards), not the alphabetically best matches.",
   agent: { expose: false },
   handler: async (query, ctx) => {
     if (!ctx.systemDb) {
@@ -39,14 +41,15 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
           "tenant:query:tenant-directory requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
       });
     }
-    const { limit, search } = query.payload;
+    const { limit, search, ids } = query.payload;
+    if (ids?.length === 0) return { rows: [], nextCursor: null };
     const scanLimit = search === undefined ? limit : SEARCH_SCAN_CAP;
     let tenants: readonly { id: unknown; name?: unknown }[];
     if (isSystemAdmin(query.user)) {
       const db = ctx.systemDb.acknowledgeCrossTenant(
         "SystemAdmin reference labels span every tenant, as tenant:query:tenant:list did",
       );
-      tenants = await selectMany(db, tenantTable, undefined, {
+      tenants = await selectMany(db, tenantTable, ids === undefined ? undefined : { id: ids }, {
         limit: scanLimit,
         orderBy: [
           { col: "key", direction: "asc" },
@@ -56,7 +59,7 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
     } else {
       const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
       const row = await fetchOne(db, tenantTable, { id: query.user.tenantId });
-      tenants = row ? [row] : [];
+      tenants = row && (ids === undefined || ids.includes(query.user.tenantId)) ? [row] : [];
     }
     // name is ciphertext at rest, so the SQL page is keyed by the plaintext
     // `key`; label order and search happen in memory after decrypting.

package/packages/bundled-features/src/tenant-lifecycle/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Tenant destroy keeps user keys of members in other live tenants",
+    "detail": "The subject-keys stage erases user keys only for members without a membership in another tenant whose status is not destroyed. The tenant and tenant-record keys are erased as before."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Destroy sweep keeps a minimum time slice per tenant",
+    "detail": "With many tenants in destroying state the shared tick budget no longer shrinks a tenant's slice below two seconds, so chunking hooks make progress instead of failing the stage as no-progress attempts."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/packages/bundled-features/src/tenant-lifecycle/constants.ts

@@ -62,3 +62,8 @@ export type TenantDestructionStageName = (typeof TENANT_DESTRUCTION_STAGES)[numb
 // The sweep cron fires every minute with concurrency "skip", so a tick must
 // finish well inside that window or the next one is skipped.
 export const DESTRUCTION_STAGE_TICK_BUDGET_MS = 30_000;
+
+// Lower bound of a tenant's share of the tick budget. Below it a chunking hook
+// without a guaranteed first batch processes nothing, and a no-progress stage
+// counts as a failed attempt, which would abandon the pipeline under load.
+export const DESTRUCTION_STAGE_MIN_SLICE_MS = 2_000;

package/packages/bundled-features/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -23,6 +23,7 @@ import type { SearchAdapter } from "@cosmicdrift/kumiko-framework/search";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantEntity, tenantTable } from "../tenant/index.ts";
 import {
+  DESTRUCTION_STAGE_MIN_SLICE_MS,
   DESTRUCTION_STAGE_TICK_BUDGET_MS,
   TENANT_AGGREGATE_TYPE,
   TENANT_DESTRUCTION_COMPLETED_EVENT_QN,
@@ -461,7 +462,10 @@ export async function runTenantDestructionSweep(args: {
   // window and starve the ones behind it. Each slice starts when its tenant
   // starts: anchoring to a shared tick deadline would hand tenants after an
   // overrun a zero slice, and a no-progress stage counts as a failed attempt.
-  const sliceMs = DESTRUCTION_STAGE_TICK_BUDGET_MS / Math.max(1, destroying.length);
+  const sliceMs = Math.max(
+    DESTRUCTION_STAGE_MIN_SLICE_MS,
+    DESTRUCTION_STAGE_TICK_BUDGET_MS / Math.max(1, destroying.length),
+  );
   for (const row of destroying) {
     const tenantDeadlineAt = Date.now() + sliceMs;
     try {