@cosmicdrift/kumiko-samples 0.388.0 → 0.389.0

package/packages/bundled-features/src/template-resolver/handlers/layout-source.query.ts

@@ -1,5 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { filterDeliveredTo } from "../api.ts";
 import { type LayoutRegions, readLayoutRegions } from "../layout-regions.ts";
@@ -14,6 +15,7 @@ import {
 } from "../template-draft.ts";
 import { type MailLayoutMeta, readMailLayoutMeta } from "../template-meta.ts";
 import { FALLBACK_LOCALE } from "../web/constants.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { localeSchema, templateSlugSchema } from "./shared.ts";
 import { parseStoredJson } from "./template-gates.ts";
 
@@ -66,20 +68,29 @@ function layoutFormat(row: WorkingRow): "html" | "mjml" | null {
   return row.contentFormat === "html" || row.contentFormat === "mjml" ? row.contentFormat : null;
 }
 
+type EditScope = "tenant" | "system";
+
 function pickEditedRows(
   rows: readonly TemplateResourceRow[],
-  user: { readonly tenantId: string; readonly roles: readonly string[] },
+  caller: { readonly tenantId: string; readonly roles: readonly string[] },
+  scope: EditScope,
   locale: string | undefined,
 ): {
   readonly tenantRow: WorkingRow | null;
   readonly systemRow: WorkingRow | null;
 } {
-  const tenantRow = user.roles.includes("SystemAdmin")
-    ? null
-    : pickByLocale(
-        rows.filter((row) => row.scope === "tenant"),
-        locale,
-      );
+  // A SystemAdmin editing the tenant layout sees the system version like a tenant does: served only, no draft.
+  const user =
+    scope === "system"
+      ? caller
+      : { ...caller, roles: caller.roles.filter((role) => role !== "SystemAdmin") };
+  const tenantRow =
+    scope === "system"
+      ? null
+      : pickByLocale(
+          rows.filter((row) => row.scope === "tenant"),
+          locale,
+        );
   const systemRow = pickByLocale(
     rows.filter((row) => row.scope === "system" && !isHiddenSystemDraft(user, row)),
     locale,
@@ -136,13 +147,21 @@ export const layoutSourceQuery = defineQueryHandler({
     kind: z.enum(["mail-layout", "pdf-layout"]),
     slug: templateSlugSchema.default("default"),
     locale: localeSchema.optional(),
+    scope: z.enum(["tenant", "system"]).optional(),
   }),
   access: { roles: ["TenantAdmin", "SystemAdmin"] },
   description:
-    "Reads the layout the caller edits: the tenant's own version and the system version of one layout slug (each the open draft if there is one, else the stored version, with `active` naming the served version), the header, signature and footer regions of the effective html version, and the locale a save has to use; a SystemAdmin edits the system version and also receives its mjml source. Use it to load the layout editor.",
+    "Reads the layout the caller edits: the tenant's own version and the system version of one layout slug (each the open draft if there is one, else the stored version, with `active` naming the served version), the header, signature and footer regions of the effective html version, and the locale a save has to use; a SystemAdmin edits the system version by default and also receives its mjml source; scope tenant loads the SystemAdmin's own tenant layout instead, and scope system is refused for everyone else. Use it to load the layout editor.",
   handler: async (query, ctx): Promise<LayoutSourceResponse> => {
     const { kind, slug, locale } = query.payload;
-    const isSystemAdmin = query.user.roles.includes("SystemAdmin");
+    const callerIsSystemAdmin = query.user.roles.includes("SystemAdmin");
+    const scope = query.payload.scope ?? (callerIsSystemAdmin ? "system" : "tenant");
+    if (scope === "system" && !callerIsSystemAdmin) {
+      throw new AccessDeniedError({
+        i18nKey: "errors.access.denied",
+        details: { reason: TemplateResolverErrors.systemAdminRequired },
+      });
+    }
     const policy = deliveryPolicyOf(ctx.registry);
     const rows = await filterDeliveredTo(
       ctx.db,
@@ -150,7 +169,13 @@ export const layoutSourceQuery = defineQueryHandler({
       query.user,
       await selectMany<TemplateResourceRow>(ctx.db, templateResourcesTable, { kind, slug }),
     );
-    const { tenantRow, systemRow } = pickEditedRows(rows, query.user, locale);
-    return buildLayoutSource({ kind, locale, isSystemAdmin, tenantRow, systemRow });
+    const { tenantRow, systemRow } = pickEditedRows(rows, query.user, scope, locale);
+    return buildLayoutSource({
+      kind,
+      locale,
+      isSystemAdmin: scope === "system",
+      tenantRow,
+      systemRow,
+    });
   },
 });

package/packages/bundled-features/src/template-resolver/handlers/overview.query.ts

@@ -1,5 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { createI18n } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
 import {
@@ -16,7 +17,11 @@ import {
   parseTemplateDraft,
   servedVersionOf,
 } from "../template-draft.ts";
-import { mayEditTemplate, type TemplateEditPolicy } from "../template-edit-policy.ts";
+import {
+  mayEditTemplate,
+  type TemplateEditPolicy,
+  templateEditAccess,
+} from "../template-edit-policy.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 import { collectTemplateUsage, type EffectiveMailLayoutSlugs } from "../template-usage.ts";
 import {
@@ -204,7 +209,15 @@ function splitDocumentSlug(slug: string): { feature: string; notification: strin
     : { feature: slug.slice(0, separator), notification: slug.slice(separator + 1) };
 }
 
-function compareBy(field: SortField, a: OverviewRow, b: OverviewRow): number {
+type ShownTitle = (row: OverviewRow) => string;
+
+function compareBy(
+  field: SortField,
+  a: OverviewRow,
+  b: OverviewRow,
+  shownTitle: ShownTitle,
+): number {
+  if (field === "title") return shownTitle(a).localeCompare(shownTitle(b));
   return String(a[field]).localeCompare(String(b[field]));
 }
 
@@ -351,11 +364,17 @@ function filterRows(
   search: string | undefined,
   filters: readonly OverviewFilter[],
   layoutSlug: string | undefined,
+  shownTitle: ShownTitle,
 ): OverviewRow[] {
   const needle = search?.trim().toLowerCase() ?? "";
   return rows.filter((row) => {
     if (layoutSlug !== undefined && row.layoutSlug !== layoutSlug) return false;
-    if (needle !== "" && !`${row.title} ${row.slug}`.toLowerCase().includes(needle)) return false;
+    if (
+      needle !== "" &&
+      !`${shownTitle(row)} ${row.title} ${row.slug}`.toLowerCase().includes(needle)
+    ) {
+      return false;
+    }
     return filters.every((filter) => filter.value.includes(String(row[filter.field])));
   });
 }
@@ -379,7 +398,7 @@ export function makeOverviewQuery(policy: TemplateEditPolicy) {
       offset: z.number().int().min(0).optional(),
       totalCount: z.boolean().optional(),
     }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
+    access: templateEditAccess(policy.tenantEditable),
     description:
       "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; templates of notifications registered with `systemOnly` are listed for SystemAdmins only, and a TenantAdmin sees only the templates the app lists in tenantEditable; a tenant override of a template that is not listed is not delivered, so the row shows the system version with `lockedOverride` true (SystemAdmin only); use it to browse and filter all templates at a glance.",
     handler: async (query, ctx) => {
@@ -419,17 +438,23 @@ export function makeOverviewQuery(policy: TemplateEditPolicy) {
             ),
           )
         : rowsWithUsage;
+      // A seeded title can be an i18n key; search and sort must see what the admin sees.
+      const i18n = createI18n(ctx.registry, { defaultLocale: "en" });
+      const shownTitle: ShownTitle = (row) => i18n.t(row.title, ctx.locale);
       const filtered = filterRows(
         overviewRows,
         payload.search,
         payload.filters ?? [],
         payload.layoutSlug,
+        shownTitle,
       );
 
       const sortField: SortField =
         payload.sort !== undefined && isSortField(payload.sort) ? payload.sort : "modifiedAt";
       const direction = (payload.sortDirection ?? "desc") === "desc" ? -1 : 1;
-      filtered.sort((a, b) => direction * compareBy(sortField, a, b) || a.id.localeCompare(b.id));
+      filtered.sort(
+        (a, b) => direction * compareBy(sortField, a, b, shownTitle) || a.id.localeCompare(b.id),
+      );
 
       const offset = payload.offset ?? 0;
       return {

package/packages/bundled-features/src/template-resolver/handlers/patch-draft.write.ts

@@ -40,7 +40,7 @@ export function makePatchDraftWrite(policy: TemplateEditPolicy) {
     }),
     access: templateEditAccess(policy.tenantEditable),
     description:
-      "Changes a mail or PDF document template with structured operations instead of a full rewrite and saves the result as the caller's tenant draft (never published, an active version keeps being served until publish): insertBlock after a block id (null = at the start; paragraph, heading, image, button, divider, pageBreak), replaceText inside one block (the text must occur exactly once), removeBlock, setResource on an image block, setMeta (flat merge, null removes a key) and setVariable (adds, replaces or with null removes a variable definition; refused when a notification declares the variables). Block ids and base come from document-blocks and refer to the state that was read; if the template changed since, the call fails with version_conflict and nothing is written. A patch that removes a required placeholder is refused. A TenantAdmin may patch only templates the app lists in tenantEditable, otherwise SystemAdmin only. Returns the written row.",
+      "Changes a mail or PDF document template with structured operations instead of a full rewrite and saves the result as the caller's tenant draft (never published, an active version keeps being served until publish): insertBlock after a block id (null = at the start; paragraph, heading, image, button, divider, pageBreak), replaceText inside one block (the text must occur exactly once within one formatting run and cannot contain a {{placeholder}}: a find across a formatting change fails with text_spans_formatting, a find with a placeholder with placeholder_not_replaceable, and the formatting of the replaced text is kept), removeBlock, setResource on an image block, setMeta (flat merge, null removes a key) and setVariable (adds, replaces or with null removes a variable definition; refused when a notification declares the variables). Block ids and base come from document-blocks and refer to the state that was read; if the template changed since, the call fails with version_conflict and nothing is written. A patch that removes a required placeholder is refused. A TenantAdmin may patch only templates the app lists in tenantEditable, otherwise SystemAdmin only. Returns the written row.",
     handler: async (event, ctx) => {
       const { slug, kind, locale, base, ops } = event.payload;
       const refused = refuseTemplateEdit(policy, event.user, { slug, kind });

package/packages/bundled-features/src/template-resolver/handlers/send-test-status.query.ts

@@ -1,5 +1,6 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { type TemplateEditPolicy, templateEditAccess } from "../template-edit-policy.ts";
 import {
   emailChannelOf,
   resolveTestMailAddress,
@@ -10,22 +11,24 @@ export type SendTestStatus =
   | { readonly canSend: true; readonly reason: null }
   | { readonly canSend: false; readonly reason: "no_channel" | "no_address" };
 
-export const sendTestStatusQuery = defineQueryHandler({
-  name: "send-test-status",
-  schema: z.object({}),
-  access: { roles: ["TenantAdmin", "SystemAdmin"] },
-  description:
-    "Tells whether send-test can reach the calling user: canSend is true when an email channel is mounted and resolves an address for the caller, otherwise reason is no_channel or no_address; the address itself is never returned.",
-  handler: async (query, ctx): Promise<SendTestStatus> => {
-    const channel = emailChannelOf(ctx.registry);
-    if (channel === undefined) return { canSend: false, reason: "no_channel" };
-    const address = await resolveTestMailAddress(
-      channel,
-      testMailChannelContext(ctx, query.user),
-      query.user,
-    );
-    return address === null
-      ? { canSend: false, reason: "no_address" }
-      : { canSend: true, reason: null };
-  },
-});
+export function makeSendTestStatusQuery(policy: TemplateEditPolicy) {
+  return defineQueryHandler({
+    name: "send-test-status",
+    schema: z.object({}),
+    access: templateEditAccess(policy.tenantEditable),
+    description:
+      "Tells whether send-test can reach the calling user: canSend is true when an email channel is mounted and resolves an address for the caller, otherwise reason is no_channel or no_address; the address itself is never returned.",
+    handler: async (query, ctx): Promise<SendTestStatus> => {
+      const channel = emailChannelOf(ctx.registry);
+      if (channel === undefined) return { canSend: false, reason: "no_channel" };
+      const address = await resolveTestMailAddress(
+        channel,
+        testMailChannelContext(ctx, query.user),
+        query.user,
+      );
+      return address === null
+        ? { canSend: false, reason: "no_address" }
+        : { canSend: true, reason: null };
+    },
+  });
+}

package/packages/bundled-features/src/template-resolver/seeding.ts

@@ -442,12 +442,14 @@ export async function seedTextBlock(
     row: { id: string; version: number },
     current: TemplateResourceRow | null | undefined,
   ): Promise<{ id: string }> => {
+    // No folder option keeps the row's folder, so a re-seed cannot drop it from the content tree.
+    const folder = opts.folder === undefined ? (current?.folder ?? null) : fields.folder;
     // Skip no-op updates so a legal re-seed on every pod boot does not bump
     // version/modifiedAt (ETag, "last changed", event-store growth).
     if (
       current?.title === fields.title &&
       current?.content === fields.content &&
-      current?.folder === fields.folder
+      current?.folder === folder
     ) {
       return { id: String(row.id) };
     }
@@ -458,7 +460,7 @@ export async function seedTextBlock(
         changes: {
           title: fields.title,
           content: fields.content,
-          folder: fields.folder,
+          folder,
           // A re-seed must not revive an archived block; only a served one gets a new served version.
           ...(current?.status === "active" && servedStampChanges(row)),
         },
@@ -533,7 +535,11 @@ export type LegalContentBlock = {
 export async function seedLegalContentFromJson(
   db: DbConnection,
   blocks: readonly LegalContentBlock[],
-  opts: { readonly tenantId?: TenantId; readonly by?: SessionUser } = {},
+  opts: {
+    readonly tenantId?: TenantId;
+    readonly by?: SessionUser;
+    readonly folder?: string;
+  } = {},
 ): Promise<void> {
   const tenantId = opts.tenantId ?? SYSTEM_TENANT_ID;
   const by = opts.by ?? createSystemUser(tenantId);
@@ -544,6 +550,7 @@ export async function seedLegalContentFromJson(
       locale: block.locale,
       title: block.title,
       content: block.content,
+      ...(opts.folder !== undefined && { folder: opts.folder }),
       ifExists: "update",
       by,
     });

package/packages/bundled-features/src/template-resolver/store-template-resource.ts

@@ -19,7 +19,7 @@ import {
   type UploadedFileBytes,
   uploadFileBytesBeforeTransaction,
 } from "@cosmicdrift/kumiko-framework/files";
-import { fileContextForTenant } from "../file-foundation/index.ts";
+import { fileContextForTenant, readFileRefContent } from "../file-foundation/index.ts";
 import { extensionForResourceContentType, requireForTenant } from "../shared/index.ts";
 import {
   DEFAULT_RESOURCE_MAX_BYTES,
@@ -29,13 +29,13 @@ import {
 import { executor } from "./handlers/shared.ts";
 import {
   attachmentEntriesOf,
+  isFileAttachmentEntry,
   type LinkedResourceEntry,
   parseLinkedResourceEntries,
   templatePdfAttachmentLinkSchema,
 } from "./linked-resources.ts";
 import { normalizeResourceImage } from "./resource-image.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.ts";
-import { readTemplateResource } from "./template-resources.ts";
 import { ACTIVE_TEMPLATE_STATUS, SYSTEM_TENANT_ID } from "./web/constants.ts";
 import { TemplateResolverErrors } from "./web/qualified-names.ts";
 
@@ -290,6 +290,44 @@ export type PreparedLinkedResourceCopy = {
   readonly upload?: UploadedFileBytes;
 };
 
+// The source row's own fileName is personal data and may be ciphertext, so the copy is named from
+// the link entry or the key.
+function copiedFileName(key: string, entry: LinkedResourceEntry, contentType: string): string {
+  if (typeof entry !== "string" && isFileAttachmentEntry(entry)) return entry.fileName;
+  return `${key}.${extensionForResourceContentType(contentType) ?? "bin"}`;
+}
+
+function sourceUnreadable(): WriteResult<never> {
+  return writeFailure(
+    new UnprocessableError(TemplateResolverErrors.resourceSourceUnreadable, {
+      i18nKey: "templateResolver.errors.resource.sourceUnreadable",
+    }),
+  );
+}
+
+// Undefined: the fileRef row exists but its bytes cannot be read, which must not look like a
+// deleted file. The provider is chosen by the tenant of the fileRef, not by the caller's.
+async function readCopySource(
+  ctx: HandlerContext,
+  fileRefId: string,
+): Promise<{ contentType: string; bytes: Uint8Array } | null | undefined> {
+  try {
+    const found = await readFileRefContent({
+      db: ctx.db,
+      filesForTenant: (tid) => fileContextForTenant(ctx, ctx.user.tenantId, tid),
+      fileRefId,
+      allowedTenantIds: [SYSTEM_TENANT_ID, ctx.user.tenantId],
+    });
+    return found === null ? null : { contentType: found.contentType, bytes: found.content };
+  } catch (cause) {
+    ctx.log?.warn("template copy: source file could not be read", {
+      fileRefId,
+      errorClass: cause instanceof Error ? cause.name : typeof cause,
+    });
+    return undefined;
+  }
+}
+
 // beforeTransaction half: copies the file behind every entry into the target tenant's storage, so a
 // template copied from the system default keeps working once the tenant exports it or measures its
 // attachments. An entry whose source file is gone is left out: it could not be resolved at render
@@ -309,14 +347,20 @@ export async function prepareLinkedResourceCopiesBeforeTransaction(args: {
         copies.push({ key, entry });
         continue;
       }
-      const file = await readTemplateResource(
-        ctx,
-        typeof entry === "string" ? entry : entry.fileRefId,
-      );
-      if (file === null) continue;
+      const source = await readCopySource(ctx, typeof entry === "string" ? entry : entry.fileRefId);
+      if (source === undefined) {
+        await releaseAfterFailure(ctx, releases);
+        return sourceUnreadable();
+      }
+      // skip: the source fileRef is deleted or unknown, so there is nothing to copy
+      if (source === null) continue;
       const uploaded = await uploadToTenant(
         { ctx, user, tenantId },
-        { fileName: file.fileName, mimeType: file.contentType, data: file.bytes },
+        {
+          fileName: copiedFileName(key, entry, source.contentType),
+          mimeType: source.contentType,
+          data: source.bytes,
+        },
       );
       if (!uploaded.isSuccess) {
         await releaseAfterFailure(ctx, releases);

package/packages/bundled-features/src/template-resolver/web/i18n.ts

@@ -90,6 +90,10 @@ export const defaultTranslations: TranslationsByLocale = {
     "templateResolver.errors.patch.textNotFound": "The text {find} was not found in the block.",
     "templateResolver.errors.patch.textAmbiguous":
       "The text {find} occurs {count} times in the block; use a longer text.",
+    "templateResolver.errors.patch.textSpansFormatting":
+      "The text {find} crosses a formatting change in the block; replace each formatted part on its own.",
+    "templateResolver.errors.patch.placeholderNotReplaceable":
+      "The placeholder {find} cannot be replaced as text; set the text around it with another operation or remove the block.",
     "templateResolver.errors.patch.blockNotAllowed":
       "The block type {type} is not available in {kind} templates.",
     "templateResolver.errors.patch.blockTypeMismatch":
@@ -113,6 +117,8 @@ export const defaultTranslations: TranslationsByLocale = {
       "Your account has no email address to send the test mail to.",
     "templateResolver.errors.testMail.failed": "The test mail could not be sent.",
     "templateResolver.errors.resource.tooLarge": "The image is too large.",
+    "templateResolver.errors.resource.sourceUnreadable":
+      "A file of the source template could not be read, so nothing was copied.",
     "templateResolver.errors.resource.unsupportedImage":
       "This file is not a supported image. Use PNG, JPEG, WebP or GIF.",
     "templateResolver.errors.template.systemResourcesNeedSystemTenant":

package/packages/bundled-features/src/template-resolver/web/qualified-names.ts

@@ -68,6 +68,7 @@ export const TemplateResolverErrors = {
   bundleLocalesDiffer: "bundle_locales_differ",
   resourceTooLarge: "template_resource_too_large",
   resourceUnsupportedImage: "template_resource_unsupported_image",
+  resourceSourceUnreadable: "template_resource_source_unreadable",
   attachmentUnsupportedType: "template_attachment_unsupported_type",
   attachmentLimit: "template_attachment_limit",
   attachmentInvalid: "template_attachment_invalid",

package/packages/bundled-features/src/tenant/feature.ts

@@ -71,6 +71,7 @@ export function collectAssignableAppRoles(
 
 export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefinition {
   return defineFeature("tenant", (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Registers the three core multi-tenancy entities \u2014 `tenant`, `tenant-membership`, and `tenant-invitation` (DB tables `read_tenants`, `read_tenant_memberships`, and `read_tenant_invitations`) \u2014 along with write handlers for create/update/disable/enable/addMember/removeMember/updateMemberRoles and the matching queries. It also declares a set of per-tenant config keys (companyName, timezone, locale, SMTP credentials) and system-only keys (priceModel, maxUsers) via `r.config({ keys: { ... } })`. Use this feature in every multi-tenant app; membership resolution and invitation flows depend on it, and `auth-email-password` requires it.",
     );

package/packages/bundled-features/src/tenant/handlers/team-list.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/db";
+import { isUndefinedTable, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   definePagedQueryHandler,
@@ -7,7 +7,7 @@ import {
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { errorCodeOf, isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { userSessionTable } from "../../sessions/index.ts";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.ts";
@@ -142,7 +142,7 @@ export const teamListQuery = definePagedQueryHandler({
         // ponytail: lean sample apps (admin-console) mount auth without
         // sessions — store_user_sessions never gets pushed. Integration tests
         // may seed the table without mounting the feature; prod mounts both.
-        if (errorCodeOf(err) !== "42P01") throw err;
+        if (!isUndefinedTable(err)) throw err;
       }
     }
 

package/packages/bundled-features/src/tenant-lifecycle/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Tenant destroy keeps user keys of members in other live tenants",
+    "detail": "The subject-keys stage erases user keys only for members without a membership in another tenant whose status is not destroyed. The tenant and tenant-record keys are erased as before."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/packages/bundled-features/src/tenant-lifecycle/stages.ts

@@ -163,6 +163,35 @@ async function runTenantDataHooks(ctx: DestructionStageCtx): Promise<StageRunOut
   return total.outcome();
 }
 
+// A user key outlives the tenant while the user still belongs to another live tenant:
+// erasing it would tombstone the key and break every later PII write for that user.
+async function userIdsWithoutOtherLiveTenant(
+  ctx: DestructionStageCtx,
+  userIds: readonly string[],
+): Promise<readonly string[]> {
+  // skip: no members, nothing to look up.
+  if (userIds.length === 0) return [];
+  const otherMemberships = (
+    await selectMany<{ userId: string; tenantId: string }>(ctx.db, tenantMembershipsTable, {
+      userId: { in: [...userIds] },
+    })
+  ).filter((membership) => membership.tenantId !== ctx.tenantId);
+  // skip: every member belongs to this tenant only.
+  if (otherMemberships.length === 0) return userIds;
+  const otherTenants = await selectMany<{ id: string; status: string }>(ctx.db, tenantTable, {
+    id: { in: [...new Set(otherMemberships.map((membership) => membership.tenantId))] },
+  });
+  const liveTenantIds = new Set(
+    otherTenants.filter((tenant) => tenant.status !== "destroyed").map((tenant) => tenant.id),
+  );
+  const retainedUserIds = new Set(
+    otherMemberships
+      .filter((membership) => liveTenantIds.has(membership.tenantId))
+      .map((membership) => membership.userId),
+  );
+  return userIds.filter((userId) => !retainedUserIds.has(userId));
+}
+
 async function eraseSubjectKeys(ctx: DestructionStageCtx): Promise<StageRunOutcome> {
   const kms = configuredPiiSubjectKms();
   if (!kms) {
@@ -177,7 +206,12 @@ async function eraseSubjectKeys(ctx: DestructionStageCtx): Promise<StageRunOutco
   const subjects: SubjectId[] = [
     { kind: "tenant", tenantId: ctx.tenantId },
     tenantRecordSubject,
-    ...memberships.map((m) => ({ kind: "user" as const, userId: m.userId })),
+    ...(
+      await userIdsWithoutOtherLiveTenant(
+        ctx,
+        memberships.map((m) => m.userId),
+      )
+    ).map((userId) => ({ kind: "user" as const, userId })),
   ];
   for (const subject of subjects) {
     await kms.eraseKey(subject, {

package/packages/bundled-features/src/user/feature.ts

@@ -19,6 +19,7 @@ import { userEditScreen, userListScreen } from "./screens.ts";
 // Membership + tenant-specific roles live in the tenant feature.
 export function createUserFeature(): FeatureDefinition {
   return defineFeature("user", (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Manages the cross-tenant user identity: the `read_users` table holds each user's email, `displayName`, global `roles`, `emailVerified` flag, and lifecycle `status` (active / restricted / deletionRequested / deleted). Because users exist above any individual tenant, the feature runs with `r.systemScope()` \u2014 membership and tenant-specific roles live in the `tenant` feature instead. Add this feature whenever your app needs a persistent, tenant-agnostic user record that auth and GDPR pipelines can reference.",
     );

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "USER_DATA_RIGHTS_FEATURE is exported from the barrel",
+    "detail": "The feature name constant that lived in web/constants.ts is now part of the public barrel."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Complete, exported handler name constants",
+    "detail": "UserDataRightsHandlers now covers all eight write handlers and UserDataRightsQueries all five explicit query handlers, and both are exported from user-data-rights and user-data-rights/web. A test compares them with the feature's registered handlers."
+  },
   {
     "version": "0.384.0",
     "type": "fix",

package/packages/bundled-features/src/user-data-rights/feature.ts

@@ -188,6 +188,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
   let warnedMissingMailDelivery = false;
   const showDeletion = opts.privacyCenterShowDeletion ?? true;
   return defineFeature("user-data-rights", (r) => {
+    r.adoptsBundledLists();
     r.describe(
       'Implements GDPR Art. 15 (access / `my-audit-log` query), Art. 17 (erasure / `request-deletion` + `cancel-deletion`, plus the anonymous email-verified `request-deletion-by-email` + `confirm-deletion-by-token` flow for lockout-safe self-service, + cron cleanup with grace period), Art. 18 (restriction / `restrict-account` + `lift-restriction`), and Art. 20 (portability / async `request-export` \u2192 ZIP via `file-foundation`, Magic-Link download) as first-class HTTP handlers and cron jobs. Each domain feature opts in by calling `r.useExtension(EXT_USER_DATA, "<entity>", { export, delete })` \u2014 the feature then orchestrates the export and forget pipelines across all registered hooks automatically. When `mail-foundation` and a `mail-transport-*` are mounted, it also sends the four GDPR notifications (export ready/failed, deletion requested/executed) itself with no app callback code, rendered in each recipient’s locale. Requires `user`, `data-retention`, `compliance-profiles`, and `sessions`.',
     );

package/packages/bundled-features/src/user-data-rights/index.ts

@@ -31,4 +31,9 @@ export {
   exportJobEntity,
   exportJobsTable,
 } from "./schema/export-job.ts";
-export { TENANT_MODEL_CONFIG_KEY } from "./web/constants.ts";
+export {
+  TENANT_MODEL_CONFIG_KEY,
+  USER_DATA_RIGHTS_FEATURE,
+  UserDataRightsHandlers,
+  UserDataRightsQueries,
+} from "./web/constants.ts";

package/packages/bundled-features/src/user-data-rights/web/constants.ts

@@ -27,6 +27,8 @@ export const UserDataRightsQueries = {
   exportStatus: "user-data-rights:query:export-status",
   myAuditLog: "user-data-rights:query:my-audit-log",
   downloadByJob: "user-data-rights:query:download-by-job",
+  downloadByToken: "user-data-rights:query:download-by-token",
+  listDownloadAttempts: "user-data-rights:query:list-download-attempts",
 } as const;
 
 // App-level config: tenant-occupancy model. "single-user" tells the forget
@@ -39,8 +41,12 @@ export const TENANT_MODEL_CONFIG_KEY = "user-data-rights:config:tenant-model" as
 export const UserDataRightsHandlers = {
   requestExport: "user-data-rights:write:request-export",
   requestDeletion: "user-data-rights:write:request-deletion",
+  requestDeletionByEmail: "user-data-rights:write:request-deletion-by-email",
+  confirmDeletionByToken: "user-data-rights:write:confirm-deletion-by-token",
   cancelDeletion: "user-data-rights:write:cancel-deletion",
   restrictAccount: "user-data-rights:write:restrict-account",
+  liftRestriction: "user-data-rights:write:lift-restriction",
+  runForgetCleanup: "user-data-rights:write:run-forget-cleanup",
 } as const;
 
 // Foreign QN: the lifecycle status (active / deletionRequested / restricted)

package/packages/bundled-features/src/user-data-rights/web/index.ts

@@ -7,6 +7,7 @@
 export { type UserDataRightsClientOptions, userDataRightsClient } from "./client-plugin.tsx";
 export type { ConfirmAccountDeletionScreenProps } from "./confirm-deletion-screen.tsx";
 export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.tsx";
+export { UserDataRightsHandlers, UserDataRightsQueries } from "./constants.ts";
 export { defaultTranslations } from "./default-translations.ts";
 export { formatDate } from "./privacy-center-screen.tsx";
 export { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.tsx";

package/packages/bundled-features/src/waitlist/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "A failing notifyRecipient SQL statement no longer aborts the submit",
+    "detail": "The resolver receives a ctx whose systemDb runs in a savepoint, so a failed statement is rolled back and the submit answers 200 with the entry stored. Only ctx.systemDb is savepoint-scoped; other ctx handles stay in the handler transaction."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "waitlist purge retry after a failed shred is covered",
+    "detail": "An integration test fails the second key shred of a purge, checks that the entries stay and no audit event is written, and that the retried purge erases every entry and records its audit event. No runtime change."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Waitlist import enforces the live field limits",
+    "detail": "migrateLegacyWaitlist counts a source row with a value above the live field limit as unreadable instead of importing it; importWaitlistEntry throws for it."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/packages/bundled-features/src/waitlist/feature.ts

@@ -32,6 +32,7 @@ import {
 
 export function createWaitlistFeature(opts: WaitlistOptions = {}): FeatureDefinition {
   return defineFeature(WAITLIST_FEATURE, (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
     );