@cosmicdrift/kumiko-samples 0.387.0 → 0.389.0

package/packages/bundled-features/src/tenant-lifecycle/stages.ts

@@ -163,6 +163,35 @@ async function runTenantDataHooks(ctx: DestructionStageCtx): Promise<StageRunOut
   return total.outcome();
 }
 
+// A user key outlives the tenant while the user still belongs to another live tenant:
+// erasing it would tombstone the key and break every later PII write for that user.
+async function userIdsWithoutOtherLiveTenant(
+  ctx: DestructionStageCtx,
+  userIds: readonly string[],
+): Promise<readonly string[]> {
+  // skip: no members, nothing to look up.
+  if (userIds.length === 0) return [];
+  const otherMemberships = (
+    await selectMany<{ userId: string; tenantId: string }>(ctx.db, tenantMembershipsTable, {
+      userId: { in: [...userIds] },
+    })
+  ).filter((membership) => membership.tenantId !== ctx.tenantId);
+  // skip: every member belongs to this tenant only.
+  if (otherMemberships.length === 0) return userIds;
+  const otherTenants = await selectMany<{ id: string; status: string }>(ctx.db, tenantTable, {
+    id: { in: [...new Set(otherMemberships.map((membership) => membership.tenantId))] },
+  });
+  const liveTenantIds = new Set(
+    otherTenants.filter((tenant) => tenant.status !== "destroyed").map((tenant) => tenant.id),
+  );
+  const retainedUserIds = new Set(
+    otherMemberships
+      .filter((membership) => liveTenantIds.has(membership.tenantId))
+      .map((membership) => membership.userId),
+  );
+  return userIds.filter((userId) => !retainedUserIds.has(userId));
+}
+
 async function eraseSubjectKeys(ctx: DestructionStageCtx): Promise<StageRunOutcome> {
   const kms = configuredPiiSubjectKms();
   if (!kms) {
@@ -177,7 +206,12 @@ async function eraseSubjectKeys(ctx: DestructionStageCtx): Promise<StageRunOutco
   const subjects: SubjectId[] = [
     { kind: "tenant", tenantId: ctx.tenantId },
     tenantRecordSubject,
-    ...memberships.map((m) => ({ kind: "user" as const, userId: m.userId })),
+    ...(
+      await userIdsWithoutOtherLiveTenant(
+        ctx,
+        memberships.map((m) => m.userId),
+      )
+    ).map((userId) => ({ kind: "user" as const, userId })),
   ];
   for (const subject of subjects) {
     await kms.eraseKey(subject, {

package/packages/bundled-features/src/tier-engine/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "set-tenant-tier no longer accepts source default",
+    "detail": "The source field of set-tenant-tier is limited to manual and billing. The value default is reserved for the signup default tier and made a manual grant look like a billing row that the next sync overwrites."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/packages/bundled-features/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -59,7 +59,10 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
         .min(1)
         .max(50)
         .refine((t) => !opts.validTiers || opts.validTiers.has(t), { message: "unknown tier" }),
-      source: z.enum(TierAssignmentSources).default(TierAssignmentSources.manual),
+      // `default` is reserved for the signup default tier; the billing sync treats it like `billing`.
+      source: z
+        .enum([TierAssignmentSources.manual, TierAssignmentSources.billing])
+        .default(TierAssignmentSources.manual),
     }),
     access: { roles: ["SystemAdmin"] },
     agent: { risk: "high" },

package/packages/bundled-features/src/tier-engine/web/constants.ts

@@ -3,6 +3,8 @@
 // category in the kumiko isolation model (runtime may import client, client
 // may only import client) — otherwise the runtime isolation guard throws on
 // the client imports. Same pattern as text-content/constants.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+
 // Feature name
 export const TIER_ENGINE_FEATURE = "tier-engine" as const;
 
@@ -24,10 +26,8 @@ export const TierAssignmentSources = {
 export type TierAssignmentSource =
   (typeof TierAssignmentSources)[keyof typeof TierAssignmentSources];
 
-const TIER_ASSIGNMENT_SOURCE_VALUES: readonly string[] = Object.values(TierAssignmentSources);
-
 export function isTierAssignmentSource(value: unknown): value is TierAssignmentSource {
-  return typeof value === "string" && TIER_ASSIGNMENT_SOURCE_VALUES.includes(value);
+  return isOneOf(Object.values(TierAssignmentSources), value);
 }
 
 // Qualified query handler names.

package/packages/bundled-features/src/user/feature.ts

@@ -19,6 +19,7 @@ import { userEditScreen, userListScreen } from "./screens.ts";
 // Membership + tenant-specific roles live in the tenant feature.
 export function createUserFeature(): FeatureDefinition {
   return defineFeature("user", (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Manages the cross-tenant user identity: the `read_users` table holds each user's email, `displayName`, global `roles`, `emailVerified` flag, and lifecycle `status` (active / restricted / deletionRequested / deleted). Because users exist above any individual tenant, the feature runs with `r.systemScope()` \u2014 membership and tenant-specific roles live in the `tenant` feature instead. Add this feature whenever your app needs a persistent, tenant-agnostic user record that auth and GDPR pipelines can reference.",
     );

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "USER_DATA_RIGHTS_FEATURE is exported from the barrel",
+    "detail": "The feature name constant that lived in web/constants.ts is now part of the public barrel."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Complete, exported handler name constants",
+    "detail": "UserDataRightsHandlers now covers all eight write handlers and UserDataRightsQueries all five explicit query handlers, and both are exported from user-data-rights and user-data-rights/web. A test compares them with the feature's registered handlers."
+  },
   {
     "version": "0.384.0",
     "type": "fix",

package/packages/bundled-features/src/user-data-rights/feature.ts

@@ -188,6 +188,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
   let warnedMissingMailDelivery = false;
   const showDeletion = opts.privacyCenterShowDeletion ?? true;
   return defineFeature("user-data-rights", (r) => {
+    r.adoptsBundledLists();
     r.describe(
       'Implements GDPR Art. 15 (access / `my-audit-log` query), Art. 17 (erasure / `request-deletion` + `cancel-deletion`, plus the anonymous email-verified `request-deletion-by-email` + `confirm-deletion-by-token` flow for lockout-safe self-service, + cron cleanup with grace period), Art. 18 (restriction / `restrict-account` + `lift-restriction`), and Art. 20 (portability / async `request-export` \u2192 ZIP via `file-foundation`, Magic-Link download) as first-class HTTP handlers and cron jobs. Each domain feature opts in by calling `r.useExtension(EXT_USER_DATA, "<entity>", { export, delete })` \u2014 the feature then orchestrates the export and forget pipelines across all registered hooks automatically. When `mail-foundation` and a `mail-transport-*` are mounted, it also sends the four GDPR notifications (export ready/failed, deletion requested/executed) itself with no app callback code, rendered in each recipient’s locale. Requires `user`, `data-retention`, `compliance-profiles`, and `sessions`.',
     );

package/packages/bundled-features/src/user-data-rights/index.ts

@@ -31,4 +31,9 @@ export {
   exportJobEntity,
   exportJobsTable,
 } from "./schema/export-job.ts";
-export { TENANT_MODEL_CONFIG_KEY } from "./web/constants.ts";
+export {
+  TENANT_MODEL_CONFIG_KEY,
+  USER_DATA_RIGHTS_FEATURE,
+  UserDataRightsHandlers,
+  UserDataRightsQueries,
+} from "./web/constants.ts";

package/packages/bundled-features/src/user-data-rights/run-export-jobs.ts

@@ -21,7 +21,6 @@ import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 // storage indefinitely.
 
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
-import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEventStoreExecutor,
@@ -44,7 +43,7 @@ import {
 import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { resolveProfileForTenant } from "../compliance-profiles/index.ts";
-import { decryptStoredPii } from "../shared/index.ts";
+import { decryptStoredUserEmail } from "../shared/index.ts";
 import { userTable } from "../user/index.ts";
 import { selectExportJobsForStorageCleanup } from "./db/queries/export-jobs.ts";
 import { runUserExport, type UserExportBundle } from "./run-user-export.ts";
@@ -822,8 +821,8 @@ async function lookupUserContact(
     locale: string | null;
   } | null;
   if (!row?.email) return null;
-  const email = await decryptStoredPii(row.email, "email", "user-data-rights:export-ready");
-  if (email === PII_ERASED_SENTINEL) return null;
+  const email = await decryptStoredUserEmail(row.email, "user-data-rights:export-ready");
+  if (email === null) return null;
   return { email, locale: row.locale ?? null };
 }
 

package/packages/bundled-features/src/user-data-rights/run-forget-cleanup.ts

@@ -518,7 +518,8 @@ async function processUser(args: {
       // is what makes this crash-safe: eraseKey-throw → tx rollback → user
       // stays DeletionRequested → next run retries; flip-throw after a
       // successful erase → retry re-runs the idempotent hooks and eraseKey
-      // (contractually a no-op on an erased/unknown subject). Erasing after
+      // (idempotent: a repeat erase keeps the original tombstone, an unknown
+      // subject gets one). Erasing after
       // the flip instead would risk a permanent silent miss: user already
       // Deleted, no run ever picks him up again, key stays live.
       if (kms) {

package/packages/bundled-features/src/user-data-rights/web/constants.ts

@@ -27,6 +27,8 @@ export const UserDataRightsQueries = {
   exportStatus: "user-data-rights:query:export-status",
   myAuditLog: "user-data-rights:query:my-audit-log",
   downloadByJob: "user-data-rights:query:download-by-job",
+  downloadByToken: "user-data-rights:query:download-by-token",
+  listDownloadAttempts: "user-data-rights:query:list-download-attempts",
 } as const;
 
 // App-level config: tenant-occupancy model. "single-user" tells the forget
@@ -39,8 +41,12 @@ export const TENANT_MODEL_CONFIG_KEY = "user-data-rights:config:tenant-model" as
 export const UserDataRightsHandlers = {
   requestExport: "user-data-rights:write:request-export",
   requestDeletion: "user-data-rights:write:request-deletion",
+  requestDeletionByEmail: "user-data-rights:write:request-deletion-by-email",
+  confirmDeletionByToken: "user-data-rights:write:confirm-deletion-by-token",
   cancelDeletion: "user-data-rights:write:cancel-deletion",
   restrictAccount: "user-data-rights:write:restrict-account",
+  liftRestriction: "user-data-rights:write:lift-restriction",
+  runForgetCleanup: "user-data-rights:write:run-forget-cleanup",
 } as const;
 
 // Foreign QN: the lifecycle status (active / deletionRequested / restricted)

package/packages/bundled-features/src/user-data-rights/web/index.ts

@@ -7,6 +7,7 @@
 export { type UserDataRightsClientOptions, userDataRightsClient } from "./client-plugin.tsx";
 export type { ConfirmAccountDeletionScreenProps } from "./confirm-deletion-screen.tsx";
 export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.tsx";
+export { UserDataRightsHandlers, UserDataRightsQueries } from "./constants.ts";
 export { defaultTranslations } from "./default-translations.ts";
 export { formatDate } from "./privacy-center-screen.tsx";
 export { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.tsx";

package/packages/bundled-features/src/waitlist/changes.json

@@ -1,4 +1,40 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "A failing notifyRecipient SQL statement no longer aborts the submit",
+    "detail": "The resolver receives a ctx whose systemDb runs in a savepoint, so a failed statement is rolled back and the submit answers 200 with the entry stored. Only ctx.systemDb is savepoint-scoped; other ctx handles stay in the handler transaction."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "waitlist purge retry after a failed shred is covered",
+    "detail": "An integration test fails the second key shred of a purge, checks that the entries stay and no audit event is written, and that the retried purge erases every entry and records its audit event. No runtime change."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Waitlist import enforces the live field limits",
+    "detail": "migrateLegacyWaitlist counts a source row with a value above the live field limit as unreadable instead of importing it; importWaitlistEntry throws for it."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Link-on-signup failures, legacy re-run and purge audit order",
+    "detail": "link-on-signup throws when the entry update fails and the entry is still invited, so the consumer redelivers. The offlot legacy migration skips rows that are already imports. purge writes its audit event before shredding keys."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Admin notice language comes from adminLocale",
+    "detail": "The admin notice mail used the request locale, which is the entrant's browser language. The new adminLocale option (en, de or es, default en) sets the operator's language."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Legacy migration dry run counts the streams it would archive",
+    "detail": "The dry run now runs the read-only archive checks and reports archivedStreams without writing; the CLI prints \"would archive\" for it."
+  },
   {
     "version": "0.379.0",
     "type": "improvement",

package/packages/bundled-features/src/waitlist/feature.ts

@@ -32,6 +32,7 @@ import {
 
 export function createWaitlistFeature(opts: WaitlistOptions = {}): FeatureDefinition {
   return defineFeature(WAITLIST_FEATURE, (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
     );

package/packages/bundled-features/src/waitlist/handlers/export-purge.write.ts

@@ -74,8 +74,9 @@ export const purgeHandler = defineWriteHandler<"purge", typeof PurgeSchema, Wait
         }),
       );
     }
-    await purgeWaitlistRows(db, rows, event.user.id);
+    // Audit first: purgeWaitlistRows shreds KMS keys, which a later failure cannot roll back.
     await appendAudit(ctx, WAITLIST_PURGED_EVENT_QN, rows.length);
+    await purgeWaitlistRows(db, rows, event.user.id);
     return { isSuccess: true, data: { purged: rows.length } };
   },
 });

package/packages/bundled-features/src/waitlist/handlers/submit.write.ts

@@ -1,8 +1,14 @@
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import {
+  acquireNamespacedAdvisoryLock,
+  createSystemDbView,
+  createTenantDb,
+  runInSavepointIfSupported,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   defineWriteHandler,
   type HandlerContext,
+  type TenantId,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
@@ -25,7 +31,7 @@ import { WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS } from "../web/constants.t
 // framework's other fixed advisory-lock keys.
 const SUBMIT_LOCK_NAMESPACE = 0x776c7374;
 const SUBMIT_LOCK_REASON =
-  "takes the per-email advisory lock so parallel submits cannot both pass the duplicate check; TenantDb has no lock API";
+  "takes the per-email advisory lock so parallel submits cannot both pass the duplicate check and wraps the admin-recipient resolver in a savepoint so a failing statement cannot abort the submit transaction; TenantDb has neither API";
 
 // Logged-in callers carry no anonymous role, so every signed-in role must be listed.
 const SUBMIT_ROLES = access.roles(
@@ -73,15 +79,24 @@ async function hasOpenEntryForEmail(email: string, ctx: HandlerContext): Promise
   return found.rows.length > 0;
 }
 
-// The resolver usually reads config; run it outside the handler transaction's
-// critical section so a failing statement cannot abort the transaction that holds
-// the entry, and a slow resolver does not extend the per-email advisory lock.
+// The resolver usually reads config. It runs before the per-email advisory lock so a slow
+// resolver does not extend the lock. Postgres aborts the whole transaction after a failed
+// statement, even one whose JS error is caught here, so the resolver gets a ctx whose
+// systemDb is bound to its own savepoint: a failing statement rolls back only that.
+// Statements through any other ctx handle (ctx.query, ctx.write) stay in the handler transaction.
 async function resolveAdminRecipient(
   opts: WaitlistOptions,
   ctx: HandlerContext,
+  systemDb: NonNullable<HandlerContext["systemDb"]>,
+  tenantId: TenantId,
 ): Promise<string | null> {
   try {
-    return (await opts.notifyRecipient?.(ctx)) || null;
+    return await runInSavepointIfSupported(systemDb.unsafeRaw(SUBMIT_LOCK_REASON), async (sp) => {
+      const savepointSystemDb = createSystemDbView(
+        createTenantDb({ db: sp, tenantId, mode: "system" }),
+      );
+      return (await opts.notifyRecipient?.({ ...ctx, systemDb: savepointSystemDb })) || null;
+    });
   } catch (err) {
     ctx.log?.warn("[waitlist:submit] admin notice recipient resolution failed", {
       error: err instanceof Error ? err.message : String(err),
@@ -129,7 +144,12 @@ export function createSubmitHandler(opts: WaitlistOptions) {
           message: "waitlist:submit requires ctx.systemDb — is r.systemScope() set?",
         });
       }
-      const adminRecipient = await resolveAdminRecipient(opts, ctx);
+      const adminRecipient = await resolveAdminRecipient(
+        opts,
+        ctx,
+        ctx.systemDb,
+        event.user.tenantId,
+      );
       await acquireNamespacedAdvisoryLock(
         ctx.systemDb.unsafeRaw(SUBMIT_LOCK_REASON),
         SUBMIT_LOCK_NAMESPACE,
@@ -175,8 +195,7 @@ export function createSubmitHandler(opts: WaitlistOptions) {
             message: payload.message,
           }),
           priority: "normal",
-          // Operator-facing: the request locale, not the one the entrant picked in the form.
-          locale: resolveWaitlistMailLocale(ctx.locale),
+          locale: resolveWaitlistMailLocale(opts.adminLocale),
         });
       });
 

package/packages/bundled-features/src/waitlist/import.ts

@@ -3,7 +3,7 @@ import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.ts";
-import type { WaitlistStatus } from "./web/constants.ts";
+import { WAITLIST_FIELD_LIMITS, type WaitlistStatus } from "./web/constants.ts";
 
 export type WaitlistImportEntry = {
   /** Stable identity of the source row (e.g. `offlot:<uuid>`); the new entry id derives from it. */
@@ -38,18 +38,43 @@ export function waitlistImportId(sourceKey: string): string {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
 
+// The version nibble marks ids minted by waitlistImportId; legacy row ids are random UUIDs.
+export function isWaitlistImportId(id: string): boolean {
+  return id[14] === "5";
+}
+
+// The live submit schema caps these fields; an imported value above the cap would be
+// stored but could never pass a later update through the same payload schema.
+export function waitlistImportEntryWithinLimits(entry: WaitlistImportEntry): boolean {
+  const limited: ReadonlyArray<readonly [string | undefined, number]> = [
+    [entry.name, WAITLIST_FIELD_LIMITS.name],
+    [entry.email, WAITLIST_FIELD_LIMITS.email],
+    [entry.locale, WAITLIST_FIELD_LIMITS.locale],
+    [entry.company, WAITLIST_FIELD_LIMITS.company],
+    [entry.portfolio, WAITLIST_FIELD_LIMITS.portfolio],
+    [entry.message, WAITLIST_FIELD_LIMITS.message],
+  ];
+  return limited.every(([value, max]) => value === undefined || value.length <= max);
+}
+
 function presentOnly(fields: Record<string, unknown>): Record<string, unknown> {
   return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
 }
 
-// Writes through the entity executor, so events, projection and subject encryption
-// behave exactly as for a live submit. No mail, no rate limit, no duplicate-by-email
+// Writes through the entity executor, so events and projection match a live submit; subject
+// encryption applies only when the caller configured a PII KMS (the CLI wires it from env
+// and aborts without one). No mail, no rate limit, no duplicate-by-email
 // check: the source row is the truth and the id makes the call idempotent.
 export async function importWaitlistEntry(
   db: TenantDb,
   entry: WaitlistImportEntry,
   options: { readonly dryRun?: boolean } = {},
 ): Promise<WaitlistImportOutcome> {
+  if (!waitlistImportEntryWithinLimits(entry)) {
+    throw new InternalError({
+      message: `waitlist import entry ${entry.sourceKey} exceeds a field length limit`,
+    });
+  }
   const id = waitlistImportId(entry.sourceKey);
   const existing = await waitlistExecutor.detail({ id }, platformActor(), db);
   if (existing) return "skipped";

package/packages/bundled-features/src/waitlist/legacy-migrate.ts

@@ -9,6 +9,7 @@ import {
   createTenantDb,
   selectMany,
   table,
+  tableExists,
   text as textColumn,
   timestamp,
   transaction,
@@ -23,9 +24,17 @@ import {
 } from "@cosmicdrift/kumiko-framework/event-store";
 import type { DbConnection } from "@cosmicdrift/kumiko-types/db-connection";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { importWaitlistEntry, type WaitlistImportEntry, waitlistImportId } from "./import.ts";
+import {
+  importWaitlistEntry,
+  isWaitlistImportId,
+  type WaitlistImportEntry,
+  waitlistImportEntryWithinLimits,
+  waitlistImportId,
+} from "./import.ts";
 import { WAITLIST_STATUS, type WaitlistStatus } from "./web/constants.ts";
 
+const ARCHIVED_STREAMS_TABLE = "public.kumiko_archived_streams";
+
 export const LEGACY_WAITLIST_SOURCES = ["offlot", "publicstatus"] as const;
 export type LegacyWaitlistSource = (typeof LEGACY_WAITLIST_SOURCES)[number];
 
@@ -210,15 +219,19 @@ async function archiveLegacyStream(
   db: DbConnection,
   legacyId: string,
   importedId: string,
+  dryRun: boolean,
 ): Promise<number> {
   if (legacyId === importedId) return 0;
-  if (await isStreamArchived(db, SYSTEM_TENANT_ID, legacyId)) return 0;
+  // A dry run never creates the archive table, so a missing one means nothing is archived yet.
+  const archiveTableReady = !dryRun || (await tableExists(db, ARCHIVED_STREAMS_TABLE));
+  if (archiveTableReady && (await isStreamArchived(db, SYSTEM_TENANT_ID, legacyId))) return 0;
   const legacyEvents = await countWhere(db, eventsTable, {
     tenantId: SYSTEM_TENANT_ID,
     aggregateId: legacyId,
     aggregateType: LEGACY_AGGREGATE_TYPE,
   });
   if (legacyEvents === 0) return 0;
+  if (dryRun) return 1;
   await archiveStream(db, {
     tenantId: SYSTEM_TENANT_ID,
     aggregateId: legacyId,
@@ -243,11 +256,17 @@ export async function migrateLegacyWaitlist(
   let archivedStreams = 0;
   if (!options.dryRun && options.from === "offlot") await createArchivedStreamsTable(db);
   for (const row of rows) {
+    // The offlot default source is the entity table: rows a previous run imported
+    // are already migrated entries and must neither be re-imported nor archived.
+    if (options.from === "offlot" && isWaitlistImportId(String(row["id"]))) {
+      skipped += 1;
+      continue;
+    }
     const entry =
       options.from === "offlot"
         ? await mapOfflotRow(row)
         : mapPublicstatusRow(row, options.defaultLocale);
-    if (!entry) {
+    if (!entry || !waitlistImportEntryWithinLimits(entry)) {
       unreadable += 1;
       continue;
     }
@@ -257,11 +276,12 @@ export async function migrateLegacyWaitlist(
       if (outcome === "created") created += 1;
       else skipped += 1;
     });
-    if (!options.dryRun && options.from === "offlot") {
+    if (options.from === "offlot") {
       archivedStreams += await archiveLegacyStream(
         db,
         String(row["id"]),
         waitlistImportId(entry.sourceKey),
+        options.dryRun,
       );
     }
   }

package/packages/bundled-features/src/waitlist/link-on-signup.ts

@@ -75,22 +75,25 @@ export const linkWaitlistOnSignup: MultiStreamApplyFn = async (event, tx) => {
   if (typeof user?.email !== "string") return;
   const email = normalizeEmail(await decryptStoredPii(user.email, "email", PII_DECRYPT_REASON));
 
-  const found = await waitlistExecutor.list(
-    {
-      filter: { field: "email", op: "eq", value: email },
-      filters: [{ field: "status", op: "in", value: [WAITLIST_STATUS.Invited] }],
-    },
-    platformActor(),
-    db,
-  );
-  const invited = [...found.rows].sort(newestSubmittedFirst)[0];
+  const findInvited = async () => {
+    const found = await waitlistExecutor.list(
+      {
+        filter: { field: "email", op: "eq", value: email },
+        filters: [{ field: "status", op: "in", value: [WAITLIST_STATUS.Invited] }],
+      },
+      platformActor(),
+      db,
+    );
+    return [...found.rows].sort(newestSubmittedFirst)[0];
+  };
+  const invited = await findInvited();
   // skip: the signup email has no invited waitlist entry (open signup or stale invite).
   if (!invited) return;
   const { id, version } = invited;
   // skip: defensive guard on the row shape.
   if (typeof id !== "string" || typeof version !== "number") return;
 
-  await waitlistExecutor.update(
+  const updated = await waitlistExecutor.update(
     {
       id,
       version,
@@ -103,4 +106,11 @@ export const linkWaitlistOnSignup: MultiStreamApplyFn = async (event, tx) => {
     platformActor(),
     db,
   );
+  // skip: linked.
+  if (updated.isSuccess) return;
+  // A concurrent admin change that already moved the entry out of `invited` makes the link
+  // moot; otherwise throw so the at-least-once consumer redelivers.
+  // skip: the entry left `invited` concurrently.
+  if ((await findInvited())?.id !== id) return;
+  throw new Error(`waitlist:link-on-signup: could not link waitlist entry ${id}`);
 };

package/packages/bundled-features/src/waitlist/options.ts

@@ -22,8 +22,12 @@ export type WaitlistInviteOptions =
 export type WaitlistOptions = {
   /** Address for an admin notification mail on each new entry. Null, an empty
    *  string or an absent option sends none. Best effort, never fails the submit,
-   *  also when the resolver throws or rejects. */
+   *  also when the resolver throws or rejects. `ctx.systemDb` is bound to a savepoint, so a
+   *  failing statement through it is rolled back without aborting the submit transaction. */
   readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
+  /** Language of the admin notice mail (en, de or es; anything else falls back to en).
+   *  Not taken from the request: a submit comes from the entrant, not the operator. */
+  readonly adminLocale?: string;
   /** Default `{ mode: "own-tenant", role: "TenantAdmin" }`. */
   readonly invite?: WaitlistInviteOptions;
   /** Default: 5 submits per IP per 10 minutes. Pass `{ disabled: true, reason }`

package/packages/bundled-features/src/workflow-runner/handlers/resume-run.write.ts

@@ -229,7 +229,7 @@ function readTriggerSource(startedPayload: unknown): TriggerSource | null {
 }
 
 async function loadReferencedEvent(ctx: HandlerContext, ref: TriggerEventRef) {
-  const events = await ctx.loadAggregate(ref.aggregateId);
+  const events = await ctx.loadAggregate(ref.aggregateId, { atVersion: ref.version });
   return events.find((e) => e.id === ref.eventId);
 }
 

package/samples/apps/styleguide/src/app/client.tsx

@@ -7,6 +7,7 @@ import { styleguideClient } from "../features/demo/web";
 import { examplesClient } from "../features/examples/web";
 import { galleryClient } from "../features/gallery/web";
 import { widgetsClient } from "../features/widgets/web";
+import { workboardClient } from "../features/workboard/web";
 import { AppShell } from "./shell";
 
 // createKumikoApp fetches the schema itself from the authenticated
@@ -24,5 +25,6 @@ createKumikoApp({
     widgetsClient,
     examplesClient,
     contentClient(),
+    workboardClient,
   ],
 });

package/samples/apps/styleguide/src/app/seed.ts

@@ -1,5 +1,5 @@
 import type { SeedFn } from "@cosmicdrift/kumiko-dev-server";
-import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, createTenantDb, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 
@@ -8,9 +8,6 @@ import { demoEntity } from "../features/demo/feature";
 // Gibt der List-View echte Rows mit Status-/Flag-Vielfalt. price (money)
 // bleibt leer — der Money-Input zeigt sich im Edit-Screen, im Seed lassen wir
 // ihn weg um nicht von der money-Payload-Form abzuhängen.
-// ponytail: kein Idempotenz-Check — die Screenshot-DB ist ephemer (frisch pro
-// Boot). Beim `bun run dev` gegen die persistente Dev-DB dupliziert ein
-// Neustart die Rows; das ist hier nur eine Demo, daher egal.
 const STATUSES = ["draft", "review", "published", "archived"] as const;
 
 // Fixed across boots (unlike the framework-minted ids for every other seed
@@ -19,7 +16,12 @@ const STATUSES = ["draft", "review", "published", "archived"] as const;
 // otherwise change every run.
 export const FIRST_STYLEGUIDE_ITEM_ID = "00000000-0000-4000-8000-0000000000f1";
 
+const demoItemTable = buildEntityTable("item", demoEntity);
+
 export const seedStyleguideItems: SeedFn = async (stack) => {
+  // The first row has a fixed id, so its presence means a persistent dev DB was seeded already.
+  if (await fetchOne(stack.db, demoItemTable, { id: FIRST_STYLEGUIDE_ITEM_ID })) return;
+
   // Bypass the write-handler HTTP path for the first row — its schema has
   // no `id` field (buildInsertSchema only exposes entity fields), so an
   // explicit id would be silently stripped before reaching the executor.

package/samples/apps/styleguide/src/app/server.ts

@@ -20,6 +20,8 @@ import { examplesFeature } from "../features/examples/feature";
 import { galleryFeature } from "../features/gallery/feature";
 import { aiTextDemoFeature } from "../features/widgets/ai-text-demo";
 import { widgetsFeature } from "../features/widgets/feature";
+import { workboardFeature } from "../features/workboard/feature";
+import { seedWorkboardTasks } from "../features/workboard/seed";
 import { seedStyleguideItems } from "./seed";
 
 const configResolver = createConfigResolver();
@@ -35,6 +37,7 @@ await runDevApp({
     contentFeature,
     aiTextDemoFeature,
     aiSettingsFeature,
+    workboardFeature,
   ],
   // Aktiviert die Upload-Routes (/api/files) + ctx.files für den Avatar-
   // Stresstest. In-Memory reicht für die Demo (nicht-persistent).
@@ -43,7 +46,7 @@ await runDevApp({
   clientEntry: "./src/app/client.tsx",
   htmlPath: "./public/index.html",
   watchDirs: ["./src", "../../../packages/*/src"],
-  seeds: [seedStyleguideItems, seedAiConnections],
+  seeds: [seedStyleguideItems, seedAiConnections, seedWorkboardTasks],
   extraContext: ({ registry }) => ({
     configResolver,
     _configAccessorFactory: createConfigAccessorFactory(registry, configResolver),