@cosmicdrift/kumiko-samples 0.404.1 → 0.405.0

package/packages/bundled-features/src/subscription-stripe/plugin-methods.ts

@@ -17,12 +17,14 @@
 
 import { createHash } from "node:crypto";
 import {
+  createTtlPriceCache,
   KNOWN_RECURRING_INTERVALS,
   type ProviderPrice,
   type ProviderSubscriptionSnapshot,
   type RecurringInterval,
   SubscriptionCancelTimings,
   type SubscriptionProviderPlugin,
+  type TtlPriceCache,
 } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
@@ -332,10 +334,7 @@ function mapStripePrice(price: Stripe.Price): ProviderPrice {
 // requests the billing-plans catalog re-renders on every page load. Keyed by
 // priceId alone: Stripe priceIds are account-wide unique. Failed lookups are
 // never cached, so a transient Stripe outage self-heals on the next call.
-export type StripePriceCache = {
-  readonly get: (priceId: string) => Stripe.Price | undefined;
-  readonly set: (priceId: string, price: Stripe.Price) => void;
-};
+export type StripePriceCache = TtlPriceCache<Stripe.Price>;
 
 export type StripePriceCacheOptions = {
   readonly ttlMs?: number;
@@ -343,24 +342,10 @@ export type StripePriceCacheOptions = {
 };
 
 export function createStripePriceCache({
-  ttlMs = 600_000,
+  ttlMs,
   now = () => Date.now(),
 }: StripePriceCacheOptions = {}): StripePriceCache {
-  const store = new Map<string, { readonly price: Stripe.Price; readonly expiresAt: number }>();
-  return {
-    get: (priceId) => {
-      const entry = store.get(priceId);
-      if (!entry) return undefined;
-      if (entry.expiresAt <= now()) {
-        store.delete(priceId);
-        return undefined;
-      }
-      return entry.price;
-    },
-    set: (priceId, price) => {
-      store.set(priceId, { price, expiresAt: now() + ttlMs });
-    },
-  };
+  return createTtlPriceCache<Stripe.Price>({ ttlMs, now });
 }
 
 /** Fills `cache` for every priceId not already resolved — the only place

package/packages/bundled-features/src/subscription-stripe/runtime.ts

@@ -25,6 +25,7 @@
 //     un-audited framework-internal path). The foundation builds and passes
 //     this SecretsContext as the 3rd webhook arg.
 
+import { parseStoredSecret } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import {
   type ConfigKeyHandle,
@@ -33,7 +34,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { FeatureDisabledError, UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
 import Stripe from "stripe";
 import { SUBSCRIPTION_STRIPE_FEATURE } from "./constants.ts";
 
@@ -63,22 +63,6 @@ export type StripeRuntimeDeps = {
   readonly fallback: { readonly apiKey?: string; readonly webhookSecret?: string };
 };
 
-// backing:"secrets" config keys store their value JSON-serialized in the
-// secrets store (config:write:set → JSON.stringify). A raw SecretsContext.get
-// (the un-audited webhook path + the audited ctx read here) therefore returns
-// the JSON-quoted string and must parse it back. The factory fallback is a
-// plain env string and stays raw — so parsing is applied only to the store
-// read, never to the fallback. The error must not carry the input: the JSON
-// parser's own message would repeat the credential into logs and the 401 body.
-function parseStoredSecret(raw: string | undefined): string | undefined {
-  if (raw === undefined || raw.length === 0) return undefined;
-  const parsed = parseJsonSafe<unknown>(raw, undefined);
-  if (parsed === undefined) {
-    throw new Error("subscription-stripe credential (backing:secrets) is not valid JSON");
-  }
-  return typeof parsed === "string" && parsed.length > 0 ? parsed : undefined;
-}
-
 /** Post-tenant runtime: used by checkout/portal/cancel which carry a full
  *  HandlerContext (audited secret reads, config-gate). */
 export type StripeCtxRuntime = {
@@ -119,7 +103,7 @@ export function createStripeRuntimes(deps: StripeRuntimeDeps): StripeRuntimes {
         { secrets: ctx.services.secrets, user: ctx.user },
         SUBSCRIPTION_STRIPE_FEATURE,
       ).get(SYSTEM_TENANT_ID, deps.apiKeyHandle.name);
-      key = parseStoredSecret(got?.reveal());
+      key = parseStoredSecret("subscription-stripe", got?.reveal());
     }
     if (!key && deps.fallback.apiKey && deps.fallback.apiKey.length > 0) {
       key = deps.fallback.apiKey;
@@ -143,7 +127,7 @@ export function createStripeRuntimes(deps: StripeRuntimeDeps): StripeRuntimes {
       // No auditCtx → un-audited framework-internal read (every webhook would
       // otherwise spam the audit trail). This is the sanctioned no-ctx path.
       const got = await systemSecrets.get(SYSTEM_TENANT_ID, handle.name);
-      const value = parseStoredSecret(got?.reveal());
+      const value = parseStoredSecret("subscription-stripe", got?.reveal());
       if (value && value.length > 0) return value;
     }
     return fallback && fallback.length > 0 ? fallback : undefined;

package/packages/bundled-features/src/tags/feature.ts

@@ -27,7 +27,7 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.ts";
+import { assertNoWhereRuleInOwnershipWrite, resolveFeatureAccess } from "../shared/index.ts";
 import { createTagAssignmentEntity, tagEntity } from "./entity.ts";
 import { createTagAssignmentExecutor } from "./executor.ts";
 import { createAssignTagHandler } from "./handlers/assign-tag.write.ts";
@@ -175,12 +175,6 @@ export type TagsFeatureOptions = {
   readonly parents?: readonly string[];
 };
 
-function resolveAccess(opts: TagsFeatureOptions): AccessRule {
-  if (opts.access !== undefined) return opts.access;
-  if (opts.roles !== undefined) return { roles: opts.roles };
-  return DEFAULT_TAG_ACCESS;
-}
-
 // Backwards-compat / options wrapper. Without options returns the module-level
 // singleton (no rebuild). access/roles/toggleable/ownership build a fresh
 // feature-definition.
@@ -203,7 +197,7 @@ export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof default
     );
   }
   assertNoWhereRuleInOwnershipWrite("createTagsFeature", opts.ownership?.write);
-  const access = resolveAccess(opts);
+  const access = resolveFeatureAccess(opts, DEFAULT_TAG_ACCESS);
   return defineFeature(TAGS_FEATURE_NAME, (r) =>
     registerTags(r, access, opts.toggleable, opts.ownership, opts.parents),
   );

package/packages/bundled-features/src/tags/web/tag-manager.tsx

@@ -17,6 +17,7 @@ import {
 } from "@cosmicdrift/kumiko-renderer";
 import { pluralKey } from "@cosmicdrift/kumiko-renderer/headless";
 import { type ReactNode, useState } from "react";
+import { useDispatchedWrites } from "../../shared/web/use-dispatched-writes.ts";
 import { TagsHandlers, TagsQueries } from "./constants.ts";
 import { TagChip } from "./tag-chip.tsx";
 
@@ -117,8 +118,10 @@ export function TagManager({
   const [editColor, setEditColor] = useState("");
   const [editScope, setEditScope] = useState("");
   const [deleting, setDeleting] = useState<TagRow | null>(null);
-  const [busy, setBusy] = useState(false);
-  const [errorKey, setErrorKey] = useState<string | null>(null);
+  const refetch = async (): Promise<void> => {
+    await Promise.all([catalog.refetch(), assignments.refetch()]);
+  };
+  const { busy, errorKey, setErrorKey, writeOk, apply } = useDispatchedWrites(refetch);
 
   if (catalog.loading && catalog.data === null) {
     return (
@@ -149,29 +152,6 @@ export function TagManager({
       })
     : allTags;
 
-  const refetch = async (): Promise<void> => {
-    await Promise.all([catalog.refetch(), assignments.refetch()]);
-  };
-
-  const apply = async (writes: () => Promise<boolean>): Promise<void> => {
-    setBusy(true);
-    setErrorKey(null);
-    try {
-      if (await writes()) await refetch();
-    } finally {
-      setBusy(false);
-    }
-  };
-
-  const writeOk = async (type: string, payload: Record<string, unknown>): Promise<boolean> => {
-    const result = await dispatcher.write(type, payload);
-    if (!result.isSuccess) {
-      setErrorKey(result.error.i18nKey);
-      return false;
-    }
-    return true;
-  };
-
   const createTag = (): void => {
     const name = newName.trim();
     if (name === "") return;

package/packages/bundled-features/src/tags/web/tag-section.tsx

@@ -11,13 +11,9 @@
 //                   component: { react: { __component: TAGS_SECTION_EXTENSION_NAME } }
 //                   (RenderEdit passes { entityName, entityId }).
 
-import {
-  useDispatcher,
-  usePrimitives,
-  useQuery,
-  useTranslation,
-} from "@cosmicdrift/kumiko-renderer";
+import { usePrimitives, useQuery, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
+import { useDispatchedWrites } from "../../shared/web/use-dispatched-writes.ts";
 import { TagsHandlers, TagsQueries } from "./constants.ts";
 import { TagChip } from "./tag-chip.tsx";
 import { TagPicker } from "./tag-picker.tsx";
@@ -53,7 +49,6 @@ export function TagSection({
 }): ReactNode {
   const { Banner, Button, Text } = usePrimitives();
   const t = useTranslation();
-  const dispatcher = useDispatcher();
   const enabled = entityId !== null;
   const catalog = useQuery<TagListResponse>(TagsQueries.tagList, {}, { enabled });
   // entityType server-side, not just entityId: it collapses the parent-ref
@@ -69,8 +64,7 @@ export function TagSection({
     { enabled },
   );
   const [pickerOpen, setPickerOpen] = useState(false);
-  const [busy, setBusy] = useState(false);
-  const [errorKey, setErrorKey] = useState<string | null>(null);
+  const { busy, setBusy, errorKey, setErrorKey, writeOk } = useDispatchedWrites();
 
   if (entityId === null) {
     return (
@@ -105,15 +99,6 @@ export function TagSection({
     await Promise.all([catalog.refetch(), assignments.refetch()]);
   };
 
-  const writeOk = async (type: string, payload: Record<string, unknown>): Promise<boolean> => {
-    const result = await dispatcher.write(type, payload);
-    if (!result.isSuccess) {
-      setErrorKey(result.error.i18nKey);
-      return false;
-    }
-    return true;
-  };
-
   const onPicked = (next: readonly string[]): void => {
     const { added, removed } = tagSelectionDelta(assignedIds, next);
     if (added.length === 0 && removed.length === 0) return;

package/packages/bundled-features/src/template-resolver/handlers/tenant-overrides.query.ts

@@ -4,6 +4,7 @@ import {
   MAX_LIST_LIMIT,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { chunk } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
@@ -22,14 +23,6 @@ const directorySchema = z.object({
 
 type OverrideStatus = "active" | "draft";
 
-function chunksOf<T>(items: readonly T[], size: number): T[][] {
-  const chunks: T[][] = [];
-  for (let start = 0; start < items.length; start += size) {
-    chunks.push(items.slice(start, start + size));
-  }
-  return chunks;
-}
-
 type DirectoryQueryContext = {
   readonly dispatch: {
     readonly query: (name: string, payload: { ids: string[] }) => Promise<unknown>;
@@ -43,8 +36,8 @@ async function labelsFor(
   ids: ReadonlySet<string>,
 ): Promise<ReadonlyMap<string, string>> {
   const labels = new Map<string, string>();
-  for (const chunk of chunksOf([...ids], MAX_LIST_LIMIT)) {
-    const raw = await ctx.dispatch.query(queryName, { ids: chunk });
+  for (const idChunk of chunk([...ids], MAX_LIST_LIMIT)) {
+    const raw = await ctx.dispatch.query(queryName, { ids: idChunk });
     for (const row of directorySchema.parse(raw).rows) labels.set(row.id, row.label);
   }
   return labels;

package/packages/bundled-features/src/tenant/handlers/decrypt-member-users.ts

@@ -0,0 +1,30 @@
+import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.ts";
+
+export type MemberUserRow = {
+  readonly id: unknown;
+  readonly email?: unknown;
+  readonly displayName?: unknown;
+};
+
+// Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
+// own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
+// one call per user unbounded and exhausts the pool once membership counts
+// exceed a handful, surfacing as "the connection was closed"; a strict
+// sequential loop caps concurrency at 1 and leaves 3 pool slots idle.
+export const KMS_POOL_CONCURRENCY = 4;
+
+export async function decryptMemberUsers(
+  users: readonly MemberUserRow[],
+  reason: string,
+): Promise<Map<string, { readonly email: string | null; readonly displayName: string | null }>> {
+  const decrypted = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
+    const email =
+      typeof user.email === "string" ? await decryptStoredPii(user.email, "email", reason) : null;
+    const displayName =
+      typeof user.displayName === "string"
+        ? await decryptStoredPii(user.displayName, "displayName", reason)
+        : null;
+    return { userId: String(user.id), email, displayName };
+  });
+  return new Map(decrypted.map((d) => [d.userId, d]));
+}

package/packages/bundled-features/src/tenant/handlers/members.query.ts

@@ -3,18 +3,9 @@ import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.ts";
 import { userTable } from "../../user/index.ts";
 import { tenantMembershipsTable } from "../membership-table.ts";
-
-type UserRow = { readonly id: unknown; readonly email?: unknown; readonly displayName?: unknown };
-
-// Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
-// own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
-// one call per user unbounded and exhausts the pool once membership counts
-// exceed a handful, surfacing as "the connection was closed"; a strict
-// sequential loop caps concurrency at 1 and leaves 3 pool slots idle.
-const KMS_POOL_CONCURRENCY = 4;
+import { decryptMemberUsers, type MemberUserRow } from "./decrypt-member-users.ts";
 
 export const membersQuery = defineQueryHandler({
   name: "members",
@@ -43,21 +34,10 @@ export const membersQuery = defineQueryHandler({
 
     const userIds = [...new Set(rows.map((row) => row["userId"]))];
     const users =
-      userIds.length > 0 ? await selectMany<UserRow>(db, userTable, { id: userIds }) : [];
+      userIds.length > 0 ? await selectMany<MemberUserRow>(db, userTable, { id: userIds }) : [];
     const userById = new Map(users.map((u) => [String(u.id), u]));
 
-    const decrypted = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
-      const email =
-        typeof user.email === "string"
-          ? await decryptStoredPii(user.email, "email", "tenant:members")
-          : null;
-      const displayName =
-        typeof user.displayName === "string"
-          ? await decryptStoredPii(user.displayName, "displayName", "tenant:members")
-          : null;
-      return { userId: String(user.id), email, displayName };
-    });
-    const decryptedByUserId = new Map(decrypted.map((d) => [d.userId, d]));
+    const decryptedByUserId = await decryptMemberUsers(users, "tenant:members");
 
     return rows.map((row) => {
       const user = userById.get(String(row["userId"]));

package/packages/bundled-features/src/tenant/handlers/team-list.query.ts

@@ -14,8 +14,11 @@ import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.ts";
 import { userTable } from "../../user/index.ts";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table.ts";
 import { tenantMembershipsTable } from "../membership-table.ts";
-
-const KMS_POOL_CONCURRENCY = 4;
+import {
+  decryptMemberUsers,
+  KMS_POOL_CONCURRENCY,
+  type MemberUserRow,
+} from "./decrypt-member-users.ts";
 
 type TeamStatus = "active" | "pending";
 
@@ -115,11 +118,7 @@ export const teamListQuery = definePagedQueryHandler({
     const membershipRows = await selectMany(db, tenantMembershipsTable, { tenantId });
     const userIds = [...new Set(membershipRows.map((row) => String(row["userId"])))];
     const users =
-      userIds.length > 0
-        ? await selectMany<{ id: unknown; email?: unknown; displayName?: unknown }>(db, userTable, {
-            id: userIds,
-          })
-        : [];
+      userIds.length > 0 ? await selectMany<MemberUserRow>(db, userTable, { id: userIds }) : [];
 
     const lastSeenByUserId = new Map<string, Temporal.Instant>();
     if (userIds.length > 0) {
@@ -147,21 +146,10 @@ export const teamListQuery = definePagedQueryHandler({
     }
 
     // Bounded, not Promise.all/sequential-per-item: shares the KMS
-    // adapter's small dedicated pool (max 4, see members.query.ts) with the
+    // adapter's small dedicated pool (max 4, see decrypt-member-users.ts) with the
     // invitations decrypt below — the two passes run one after the other
     // (await, not Promise.all), so combined concurrency never exceeds 4.
-    const decryptedUsers = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
-      const email =
-        typeof user.email === "string"
-          ? await decryptStoredPii(user.email, "email", "tenant:team-list")
-          : null;
-      const displayName =
-        typeof user.displayName === "string"
-          ? await decryptStoredPii(user.displayName, "displayName", "tenant:team-list")
-          : null;
-      return { userId: String(user.id), email, displayName };
-    });
-    const decryptedByUserId = new Map(decryptedUsers.map((d) => [d.userId, d]));
+    const decryptedByUserId = await decryptMemberUsers(users, "tenant:team-list");
 
     const memberRows: TeamRow[] = membershipRows.map((row) => {
       const userId = String(row["userId"]);

package/packages/bundled-features/src/tenant-lifecycle/archive-and-delete-tenant-rows.ts

@@ -0,0 +1,28 @@
+import type { EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import { declareEscapeHatch, type TenantDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
+import { archiveStream } from "@cosmicdrift/kumiko-framework/event-store";
+
+export const TENANT_DESTROY_ARCHIVED_BY = "tenant-lifecycle:destroy";
+export const TENANT_DESTROY_ARCHIVE_REASON = "tenant_destroy";
+
+// Archiving first means a later projection rebuild cannot resurrect the deleted rows.
+export async function archiveAndDeleteTenantRows(
+  ctx: TenantDataHookCtx,
+  table: EntityTableMeta,
+  aggregateType: string,
+  escapeHatchReason: string,
+): Promise<readonly string[]> {
+  declareEscapeHatch({ reason: escapeHatchReason });
+  const rows = await ctx.db.selectMany<{ id: string }>(table, { tenantId: ctx.tenantId });
+  for (const row of rows) {
+    await archiveStream(ctx.db.unsafeRaw(), {
+      tenantId: ctx.tenantId,
+      aggregateId: row.id,
+      aggregateType,
+      archivedBy: TENANT_DESTROY_ARCHIVED_BY,
+      reason: TENANT_DESTROY_ARCHIVE_REASON,
+    });
+  }
+  await ctx.db.deleteMany(table, { tenantId: ctx.tenantId });
+  return rows.map((row) => row.id);
+}

package/packages/bundled-features/src/tenant-lifecycle/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.405.0",
+    "type": "improvement",
+    "title": "archiveAndDeleteTenantRows for tenant-destroy hooks",
+    "detail": "@cosmicdrift/kumiko-bundled-features/tenant-lifecycle exports archiveAndDeleteTenantRows(ctx, table, aggregateType, escapeHatchReason), which archives each row's event stream and then deletes the tenant's rows, plus the TENANT_DESTROY_ARCHIVED_BY and TENANT_DESTROY_ARCHIVE_REASON constants. inbound-mail-foundation uses the helper, billing-foundation the constants."
+  },
   {
     "version": "0.389.0",
     "type": "fix",

package/packages/bundled-features/src/tenant-lifecycle/index.ts

@@ -1,3 +1,8 @@
+export {
+  archiveAndDeleteTenantRows,
+  TENANT_DESTROY_ARCHIVE_REASON,
+  TENANT_DESTROY_ARCHIVED_BY,
+} from "./archive-and-delete-tenant-rows.ts";
 export {
   TENANT_DESTRUCTION_STAGES,
   TENANT_LIFECYCLE_FEATURE,

package/packages/bundled-features/src/tier-engine/feature.ts

@@ -495,7 +495,7 @@ export function createTierEngineFeature<
       // point AND registers itself as the default plugin. Other features could
       // register there later (e.g. a future toggle-only resolver), but only one
       // plugin wins — see the "single-plugin" comment on findTierResolverUsage.
-      r.extendsRegistrar(TENANT_TIER_RESOLVER_EXT, { onRegister: () => {} });
+      r.extendsRegistrar(TENANT_TIER_RESOLVER_EXT, {});
 
       // Plugin-registration: framework's runDevApp/runProdApp picks this up
       // post-stack-setup, calls build(deps), wires effectiveFeatures.

package/packages/bundled-features/src/user-data-rights/build-hook-db.ts

@@ -0,0 +1,40 @@
+import { createTenantDb, type DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import {
+  type EscapeHatchAuditSink,
+  EXT_USER_DATA,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework/logging";
+import {
+  createEscapeHatchReporter,
+  UNATTRIBUTED_ACTOR,
+} from "@cosmicdrift/kumiko-framework/pipeline";
+
+export function buildHookDb(
+  db: DbRunner,
+  tenantId: TenantId,
+  entry: { readonly entityName: string; readonly escapeHatchReason: string | undefined },
+  args: {
+    readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
+    readonly escapeHatchAuditLog?: Logger;
+    readonly actor?: string;
+  },
+) {
+  const report = createEscapeHatchReporter({
+    handler: `${EXT_USER_DATA}:${entry.entityName}`,
+    tenantId,
+    actor: args.actor ?? UNATTRIBUTED_ACTOR,
+    sink: args.escapeHatchAuditSink,
+    log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
+  });
+  return createTenantDb({
+    db,
+    tenantId,
+    mode: "tenant",
+    grants: {
+      unsafeRaw:
+        entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+      report,
+    },
+  });
+}

package/packages/bundled-features/src/user-data-rights/handlers/request-export.write.ts

@@ -23,9 +23,9 @@
 
 import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type SaveContext } from "@cosmicdrift/kumiko-framework/engine";
-import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
+import { isUniqueConstraintFailure } from "../../shared/index.ts";
 import {
   ACTIVE_JOB_CONSTRAINT,
   EXPORT_JOB_STATUS,
@@ -40,23 +40,6 @@ const crud = createEventStoreExecutor(exportJobsTable, exportJobEntity, {
 const REQUEST_EXPORT_REASON =
   "export jobs are keyed by userId across all of the user's tenant memberships, not the caller's current tenant";
 
-/**
- * `createEventStoreExecutor.create` catches 23505 internally and returns
- * `WriteFailure(UniqueViolationError)` rather than throwing. Check the
- * failure code and constraintName to distinguish the app-side and race
- * paths; propagate other failures (validation, version conflicts, ...)
- * unchanged.
- */
-function isActiveJobConflict(failure: WriteFailure): boolean {
-  const error = failure.error as {
-    code?: string;
-    details?: { constraintName?: string };
-  }; // @cast-boundary error-details
-  return (
-    error.code === "unique_violation" && error.details?.constraintName === ACTIVE_JOB_CONSTRAINT
-  );
-}
-
 export const requestExportWrite = defineWriteHandler({
   name: "request-export",
   schema: z.object({}),
@@ -115,7 +98,7 @@ export const requestExportWrite = defineWriteHandler({
       // crud.create, causing UniqueViolationError for our constraint. Re-fetch
       // and return the existing job with isExisting=true. Propagate other
       // failures (validation, version conflicts, ...) unchanged.
-      if (isActiveJobConflict(result)) {
+      if (isUniqueConstraintFailure(result, ACTIVE_JOB_CONSTRAINT)) {
         const winner = await findActiveJob(exportJobRunner, userId);
         if (!winner) {
           // This should be impossible: a constraint violation without an existing

package/packages/bundled-features/src/user-data-rights/mail-notifications.ts

@@ -1,19 +1,13 @@
 import {
   type FeatureRegistrar,
-  type NotificationLocalizedTemplate,
   QnTypes,
   qn,
   type TemplateVariables,
   templateVariable,
 } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  hasMailTranslationKey,
-  listMailLocales,
-  mailT,
-  resolveMailLocale,
-} from "@cosmicdrift/kumiko-framework/i18n";
+import { mailT } from "@cosmicdrift/kumiko-framework/i18n";
 import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
-import { mailParagraph } from "../shared/index.ts";
+import { createMailLocaleTemplates, mailParagraph } from "../shared/index.ts";
 import { USER_DATA_RIGHTS_FEATURE } from "./web/constants.ts";
 
 const ALL_GDPR_MAIL_KINDS = [
@@ -49,18 +43,14 @@ function subjectKey(kind: GdprMailKind): string {
   return `gdpr.mail.${GDPR_MAIL_KINDS[kind].translationKey}.subject`;
 }
 
-const SUBJECT_KEY_BY_TYPE: ReadonlyMap<string, string> = new Map(
-  ALL_GDPR_MAIL_KINDS.map((kind) => [GdprMailNotificationTypes[kind], subjectKey(kind)]),
-);
-
-// A registered locale whose bundle lacks the subject key has no template (see
-// gdprMailLocalizedTemplate); the renderer has no locale fallback, so the
-// sender must pick a locale that has one or the mail would not go out at all.
-export function gdprMailTemplateLocale(notificationType: string, requestedLocale: string): string {
-  const locale = resolveMailLocale(requestedLocale);
-  const key = SUBJECT_KEY_BY_TYPE.get(notificationType);
-  return key !== undefined && hasMailTranslationKey(locale, key) ? locale : "en";
-}
+const mailLocaleTemplates = createMailLocaleTemplates({
+  kinds: ALL_GDPR_MAIL_KINDS,
+  notificationTypes: GdprMailNotificationTypes,
+  subjectKey,
+  bodyFor: (kind, locale) => mailBody(kind, locale),
+});
+
+export const gdprMailTemplateLocale = mailLocaleTemplates.templateLocale;
 
 const appName = () => templateVariable.text({ required: true });
 
@@ -119,33 +109,7 @@ function mailBody(kind: GdprMailKind, locale: string): string {
   }
 }
 
-// Evaluated when the registry is built, after every locale feature has
-// registered its mail translations. English always ships; another locale only
-// gets a template when it has its own subject, so a missing translation never
-// silently becomes an English mail in that locale's slot.
-export function gdprMailLocalizedTemplate(kind: GdprMailKind): () => NotificationLocalizedTemplate {
-  const kindSubjectKey = subjectKey(kind);
-  return () => {
-    const locales = [
-      "en",
-      ...listMailLocales().filter(
-        (locale) => locale !== "en" && hasMailTranslationKey(locale, kindSubjectKey),
-      ),
-    ];
-    return Object.fromEntries(
-      locales.map((locale) => [
-        locale,
-        {
-          body: mailBody(kind, locale),
-          meta: {
-            subject: mailT(locale, kindSubjectKey, { app: "{{appName}}" }),
-            category: "transactional" as const,
-          },
-        },
-      ]),
-    );
-  };
-}
+export const gdprMailLocalizedTemplate = mailLocaleTemplates.localizedTemplate;
 
 export function registerGdprMails(r: FeatureRegistrar): void {
   for (const kind of ALL_GDPR_MAIL_KINDS) {