@k2b/cloud 0.6.0-rc.0 → 0.7.0

package/src/services/legal-consent.ts

@@ -42,7 +42,7 @@ export const legalConsent = {
       groupsAdmin,
       allowPendingLegalConsent: true,
     });
-    if (!user || isAccountExpired(user.accountExpires) || !(await isAccountCategoryAllowed(user))) return null;
+    if (!user || isAccountExpired(user.accountExpires)) return null;
     const [row] = await sql<{ pending: boolean }[]>`
       SELECT legal_pending AND NOT EXISTS (SELECT 1 FROM auth.legal_acceptances WHERE user_id = ${user.id}::uuid) AS pending
       FROM auth.session_families WHERE sid = ${claims.sid}::uuid

package/src/services/logging/index.ts

@@ -1,3 +1,4 @@
+import { readWebVitals } from "./web-vitals";
 import { sql } from "bun";
 import type { PaginationParams } from "../../contracts/shared";
 import { escapeLikePattern, parsePgJsonRecord, toPgTextArray } from "../postgres";
@@ -129,7 +130,7 @@ function write(params: WriteParams): void {
       ${params.level},
       ${params.source},
       ${params.message},
-      ${safeMetadata ? JSON.stringify(safeMetadata) : null}::jsonb
+      (${safeMetadata ? JSON.stringify(safeMetadata) : null}::text)::jsonb
     )
   `.catch((err: Error) => console.error("[logging] DB write failed:", err.message));
 }
@@ -194,7 +195,7 @@ const list = async (
       WHERE source = ${filterSource}
         AND (${filterLevel}::text IS NULL OR level = ${filterLevel})
         AND (${filterSinceHours}::int IS NULL OR created_at >= now() - (${filterSinceHours}::int * INTERVAL '1 hour'))
-        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\')
+        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\\')
     `;
 
     dataRows = await sql`
@@ -203,7 +204,7 @@ const list = async (
       WHERE source = ${filterSource}
         AND (${filterLevel}::text IS NULL OR level = ${filterLevel})
         AND (${filterSinceHours}::int IS NULL OR created_at >= now() - (${filterSinceHours}::int * INTERVAL '1 hour'))
-        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\')
+        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\\')
       ORDER BY created_at DESC
       LIMIT ${perPage} OFFSET ${offset}
     `;
@@ -214,7 +215,7 @@ const list = async (
       WHERE source = ANY(${filterSourcesLiteral}::text[])
         AND (${filterLevel}::text IS NULL OR level = ${filterLevel})
         AND (${filterSinceHours}::int IS NULL OR created_at >= now() - (${filterSinceHours}::int * INTERVAL '1 hour'))
-        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\')
+        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\\')
     `;
 
     dataRows = await sql`
@@ -223,7 +224,7 @@ const list = async (
       WHERE source = ANY(${filterSourcesLiteral}::text[])
         AND (${filterLevel}::text IS NULL OR level = ${filterLevel})
         AND (${filterSinceHours}::int IS NULL OR created_at >= now() - (${filterSinceHours}::int * INTERVAL '1 hour'))
-        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\')
+        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\\')
       ORDER BY created_at DESC
       LIMIT ${perPage} OFFSET ${offset}
     `;
@@ -233,7 +234,7 @@ const list = async (
       FROM logging.entries
       WHERE (${filterLevel}::text IS NULL OR level = ${filterLevel})
         AND (${filterSinceHours}::int IS NULL OR created_at >= now() - (${filterSinceHours}::int * INTERVAL '1 hour'))
-        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\')
+        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\\')
     `;
 
     dataRows = await sql`
@@ -241,7 +242,7 @@ const list = async (
       FROM logging.entries
       WHERE (${filterLevel}::text IS NULL OR level = ${filterLevel})
         AND (${filterSinceHours}::int IS NULL OR created_at >= now() - (${filterSinceHours}::int * INTERVAL '1 hour'))
-        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\')
+        AND (${searchPattern}::text IS NULL OR message ILIKE ${searchPattern} ESCAPE '\\' OR metadata::text ILIKE ${searchPattern} ESCAPE '\\')
       ORDER BY created_at DESC
       LIMIT ${perPage} OFFSET ${offset}
     `;
@@ -321,8 +322,8 @@ const timeseries = async (
         AND (${level}::text IS NULL OR entries.level = ${level})
         AND (
           ${searchPattern}::text IS NULL
-          OR entries.message ILIKE ${searchPattern} ESCAPE '\'
-          OR entries.metadata::text ILIKE ${searchPattern} ESCAPE '\'
+          OR entries.message ILIKE ${searchPattern} ESCAPE '\\'
+          OR entries.metadata::text ILIKE ${searchPattern} ESCAPE '\\'
         )
       GROUP BY at, entries.level
     )
@@ -369,8 +370,8 @@ const statsBy = async (
         AND (${level}::text IS NULL OR level = ${level})
         AND (
           ${searchPattern}::text IS NULL
-          OR message ILIKE ${searchPattern} ESCAPE '\'
-          OR metadata::text ILIKE ${searchPattern} ESCAPE '\'
+          OR message ILIKE ${searchPattern} ESCAPE '\\'
+          OR metadata::text ILIKE ${searchPattern} ESCAPE '\\'
         )
       GROUP BY level
       ORDER BY count DESC, key ASC
@@ -387,8 +388,8 @@ const statsBy = async (
       AND (${level}::text IS NULL OR level = ${level})
       AND (
         ${searchPattern}::text IS NULL
-        OR message ILIKE ${searchPattern} ESCAPE '\'
-        OR metadata::text ILIKE ${searchPattern} ESCAPE '\'
+        OR message ILIKE ${searchPattern} ESCAPE '\\'
+        OR metadata::text ILIKE ${searchPattern} ESCAPE '\\'
       )
     GROUP BY source
     ORDER BY count DESC, key ASC
@@ -466,6 +467,7 @@ const summary = async (): Promise<LogSummary> => {
 
 /** Admin service object for querying/managing logs. */
 export const logging = {
+  webVitals: readWebVitals,
   list,
   getById,
   getSources,

package/src/services/logging/trace.ts

@@ -1,3 +1,4 @@
+import { getProcessApplicationId } from "../../_internal/process-identity";
 import { createHash, randomBytes } from "node:crypto";
 import type { SyncEvent } from "@k2b/sync";
 import { sql } from "bun";
@@ -1034,7 +1035,7 @@ const detailAttributes = (detail: Record<string, unknown>): TraceAttributes => {
 };
 
 /** The app hosting this process; Sync events carry no app name. */
-const processAppId = (): string | undefined => process.env.APP_ID?.trim() || undefined;
+const processAppId = getProcessApplicationId;
 
 const traceSyncEvent = async (event: SyncEvent, application?: string): Promise<void> => {
   const resource = event.resource;

package/src/services/logging/web-vitals.ts

@@ -0,0 +1,81 @@
+import { sql } from "bun";
+import { z } from "zod";
+
+const ranges = {
+  "1h": { hours: 1, bucket: 60 },
+  "6h": { hours: 6, bucket: 300 },
+  "24h": { hours: 24, bucket: 900 },
+  "7d": { hours: 168, bucket: 3600 },
+  "30d": { hours: 720, bucket: 21600 },
+} as const;
+const querySchema = z.object({
+  range: z.enum(["1h", "6h", "24h", "7d", "30d"]).default("24h"),
+  appId: z.string().max(64).default(""),
+  route: z.string().max(200).default(""),
+  page: z.number().int().min(1).max(100000).default(1),
+});
+export type WebVitalsQuery = z.input<typeof querySchema>;
+export type WebVitalName = "LCP" | "INP" | "CLS";
+export type WebVitalMetric = { name: WebVitalName; count: number; p75: number };
+export type WebVitalsOverview = {
+  summary: WebVitalMetric[];
+  series: (WebVitalMetric & { bucket: number })[];
+  routes: (WebVitalMetric & { appId: string; route: string })[];
+  totalRoutes: number;
+  page: number;
+  perPage: number;
+};
+
+/** Admin diagnostics. Deduplicate the last valid report inside [since, until).
+ * Attribute it to its last receipt time; this is not navigation-start time.
+ * Only aggregates leave Postgres. Retention applies before this read.
+ */
+export async function readWebVitals(input: WebVitalsQuery, until = new Date()): Promise<WebVitalsOverview> {
+  const query = querySchema.parse(input);
+  const { hours, bucket } = ranges[query.range];
+  const since = new Date(until.getTime() - hours * 3600000);
+  const perPage = 50;
+  const [result] = await sql<Omit<WebVitalsOverview, "page" | "perPage">[]>`
+    WITH stored AS MATERIALIZED (
+      SELECT id, created_at,
+        logging.object_metadata(metadata) AS metadata
+      FROM logging.entries
+      WHERE source = 'web-vitals' AND level = 'info' AND created_at >= ${since} AND created_at < ${until}
+    ), candidates AS MATERIALIZED (
+      SELECT id, created_at, metadata->>'appId' AS app, metadata->>'routeTemplate' AS route,
+        metadata->>'name' AS name, metadata->>'id' AS metric_id,
+        CASE WHEN jsonb_typeof(metadata->'value') = 'number' THEN (metadata->>'value')::numeric END AS value
+      FROM stored
+      WHERE jsonb_typeof(metadata->'appId') = 'string' AND metadata->>'appId' ~ '^[a-z0-9-]{1,64}$'
+        AND jsonb_typeof(metadata->'routeTemplate') = 'string'
+        AND length(metadata->>'routeTemplate') BETWEEN 1 AND 200 AND metadata->>'routeTemplate' ~ '^/[a-zA-Z0-9_/:.*-]*$'
+        AND jsonb_typeof(metadata->'id') = 'string' AND length(metadata->>'id') BETWEEN 1 AND 100
+        AND metadata->>'name' IN ('LCP','INP','CLS')
+        AND (${query.appId} = '' OR metadata->>'appId' = ${query.appId})
+        AND (${query.route} = '' OR metadata->>'routeTemplate' = ${query.route})
+    ), latest AS MATERIALIZED (
+      SELECT DISTINCT ON (app, route, name, metric_id) app, route, name, value::double precision AS value, created_at
+      FROM candidates WHERE value >= 0 AND value <= 1.7976931348623157e308::numeric
+      ORDER BY app, route, name, metric_id, created_at DESC, id DESC
+    ), route_stats AS MATERIALIZED (
+      SELECT app, route, name, count(*)::int AS count,
+        percentile_cont(0.75) WITHIN GROUP (ORDER BY value) AS p75
+      FROM latest GROUP BY app, route, name
+    ), route_keys AS MATERIALIZED (
+      SELECT DISTINCT app, route FROM route_stats ORDER BY app, route LIMIT ${perPage} OFFSET ${(query.page - 1) * perPage}
+    )
+    SELECT
+      COALESCE((SELECT jsonb_agg(s) FROM (SELECT name, count(*)::int AS count, percentile_cont(0.75) WITHIN GROUP (ORDER BY value) AS p75 FROM latest GROUP BY name ORDER BY name) s), '[]'::jsonb) AS summary,
+      COALESCE((SELECT jsonb_agg(s ORDER BY s.bucket, s.name) FROM (SELECT name,
+        floor(extract(epoch FROM created_at) / ${bucket}) * ${bucket} * 1000 AS bucket,
+        count(*)::int AS count, percentile_cont(0.75) WITHIN GROUP (ORDER BY value) AS p75
+        FROM latest GROUP BY name, bucket) s), '[]'::jsonb) AS series,
+      COALESCE((SELECT jsonb_agg(s ORDER BY s."appId", s.route, s.name) FROM (
+        SELECT l.app AS "appId", l.route, l.name, l.count, l.p75
+        FROM route_stats l JOIN route_keys k USING (app, route)
+      ) s), '[]'::jsonb) AS routes,
+      (SELECT count(*)::int FROM (SELECT DISTINCT app, route FROM route_stats) r) AS "totalRoutes"
+  `;
+  if (!result) throw new Error("Web Vitals aggregation returned no result");
+  return { ...result, page: query.page, perPage };
+}

package/src/services/mandates/index.ts

@@ -9,6 +9,10 @@ import { parsePgJsonValue } from "../postgres";
 import { isMandatePolicyNarrowing, type MandatePolicyV1, MandatePolicyV1Schema, mandatePolicyAllows, parseMandatePolicy } from "./policy";
 
 export {
+  CapabilityGrantsSchema,
+  CapabilityGrantSchema,
+  type CapabilityGrant,
+  capabilityGrantAllows,
   isMandatePolicyNarrowing,
   MANDATE_POLICY_MAX_IDENTIFIERS,
   MANDATE_POLICY_VERSION,
@@ -176,7 +180,7 @@ const mapMandate = (row: MandateRow): Mandate => ({
   revokeReason: row.revoke_reason,
 });
 
-const selectMandate = sql`
+const selectMandate = () => sql`
   SELECT id, subject_kind, subject_user_id, subject_service_account_id,
     owner_app_id, workload_type, workload_id, policy, state, revision, expires_at,
     confirmed_at, confirmation_deadline,
@@ -224,7 +228,7 @@ const parsePolicyForWorkload = (
 
 const load = async (mandateId: string, db: SQL): Promise<Mandate | null> => {
   if (!UUID.safeParse(mandateId).success) return null;
-  const [row] = await db<MandateRow[]>`${selectMandate} WHERE id = ${mandateId}::uuid`;
+  const [row] = await db<MandateRow[]>`${selectMandate()} WHERE id = ${mandateId}::uuid`;
   return row ? mapMandate(row) : null;
 };
 
@@ -437,7 +441,7 @@ export const listMandates = async (config: {
   const where = conditions.slice(1).reduce((combined, condition) => sql`${combined} AND ${condition}`, conditions[0]!);
   const [countRows, rows] = await Promise.all([
     db<{ count: number }[]>`SELECT COUNT(*)::int AS count FROM auth.mandates WHERE ${where}`,
-    db<MandateRow[]>`${selectMandate} WHERE ${where} ORDER BY created_at DESC, id DESC LIMIT ${perPage} OFFSET ${offset}`,
+    db<MandateRow[]>`${selectMandate()} WHERE ${where} ORDER BY created_at DESC, id DESC LIMIT ${perPage} OFFSET ${offset}`,
   ]);
   const total = countRows[0]?.count ?? 0;
   return { items: rows.map(mapMandate), page, perPage, total, hasNext: page * perPage < total };
@@ -616,6 +620,8 @@ export const validateMandateIssueAuthority = async (
     targetAppId: string;
     operation: string;
     actionApproval?: "none" | "approved";
+    input?: unknown;
+    capabilityApproval?: "none" | "rememberable" | "always";
     expectedRevision?: number;
     requestId?: string;
   },
@@ -669,7 +675,15 @@ export const validateMandateIssueAuthority = async (
   } catch {
     return denyMandateIssue(err.forbidden("Mandate policy is invalid"));
   }
-  if (!mandatePolicyAllows(policy, { appId: target.data, operation: operation.data, actionApproval: input.actionApproval ?? "none" })) {
+  if (
+    !mandatePolicyAllows(policy, {
+      appId: target.data,
+      operation: operation.data,
+      actionApproval: input.actionApproval ?? "none",
+      input: input.input,
+      capabilityApproval: input.capabilityApproval,
+    })
+  ) {
     return denyMandateIssue(err.forbidden("Mandate policy does not allow this operation"));
   }
   const mandate = mapMandate(row);

package/src/services/mandates/policy.ts

@@ -25,12 +25,48 @@ const operationSchema = z.union([
   }, "Expected a canonical mandate operation"),
 ]);
 
+export const CapabilityGrantSchema = z
+  .object({
+    appId: CapabilityAppIdSchema.describe("Exact discovered application ID."),
+    capabilityId: CapabilityLocalIdSchema.describe("Exact local capability ID from discovery, without application prefix."),
+    kind: z.enum(["query", "action"]).describe("Discovered capability kind."),
+    fixedInput: z.record(z.string(), z.json()).default({}).describe("Exact top-level input values. Omitted fields remain unrestricted."),
+  })
+  .strict();
+export const CapabilityGrantsSchema = z.array(CapabilityGrantSchema).max(MANDATE_POLICY_MAX_IDENTIFIERS / 2);
+export type CapabilityGrant = z.output<typeof CapabilityGrantSchema>;
+
+const equalJson = (a: unknown, b: unknown): boolean => {
+  if (a === b) return true;
+  if (!a || !b || typeof a !== "object" || typeof b !== "object") return false;
+  if (Array.isArray(a) || Array.isArray(b))
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((v, i) => equalJson(v, b[i]));
+  const ak = Object.keys(a),
+    bk = Object.keys(b);
+  return ak.length === bk.length && ak.every((key) => Object.hasOwn(b, key) && equalJson(Reflect.get(a, key), Reflect.get(b, key)));
+};
+export const capabilityGrantAllows = (
+  grant: CapabilityGrant,
+  input: { appId: string; capabilityId: string; kind: "query" | "action"; input: unknown },
+): boolean =>
+  grant.appId === input.appId &&
+  grant.capabilityId === input.capabilityId &&
+  grant.kind === input.kind &&
+  Object.entries(grant.fixedInput).every(
+    ([key, value]) =>
+      input.input !== null &&
+      typeof input.input === "object" &&
+      Object.hasOwn(input.input, key) &&
+      equalJson(value, Reflect.get(input.input, key)),
+  );
+
 export const MandatePolicyV1Schema = z
   .object({
     version: z.literal(MANDATE_POLICY_VERSION),
     apps: z.union([z.literal("*"), identifierList(CapabilityAppIdSchema)]),
     operations: z.union([z.literal("*"), identifierList(operationSchema)]),
     actions: z.enum(["deny", "require_approval", "preapproved"]),
+    grants: CapabilityGrantsSchema.optional(),
   })
   .strict()
   .superRefine((policy, context) => {
@@ -70,14 +106,41 @@ const ACTION_AUTHORITY = { deny: 0, require_approval: 1, preapproved: 2 } as con
 export const isMandatePolicyNarrowing = (current: MandatePolicyV1, next: MandatePolicyV1): boolean =>
   setAllows(current.apps, next.apps) &&
   setAllows(current.operations, next.operations) &&
-  ACTION_AUTHORITY[next.actions] <= ACTION_AUTHORITY[current.actions];
+  ACTION_AUTHORITY[next.actions] <= ACTION_AUTHORITY[current.actions] &&
+  (current.grants === undefined ||
+    (next.grants !== undefined &&
+      next.grants.every((grant) =>
+        current.grants!.some((existing) => capabilityGrantAllows(existing, { ...grant, input: grant.fixedInput })),
+      )));
 
 export const mandatePolicyAllows = (
   policy: MandatePolicyV1,
-  input: { appId: string; operation: string; actionApproval: "none" | "approved" },
+  input: {
+    appId: string;
+    operation: string;
+    actionApproval: "none" | "approved";
+    input?: unknown;
+    capabilityApproval?: "none" | "rememberable" | "always";
+  },
 ): boolean => {
   if (policy.apps !== "*" && !policy.apps.includes(input.appId)) return false;
   if (policy.operations !== "*" && !policy.operations.includes(input.operation)) return false;
+  if (policy.grants !== undefined) {
+    const [operation, capabilityId] = input.operation.split(":");
+    const kind =
+      operation === "capability.query"
+        ? "query"
+        : operation === "capability.action.run" || operation === "capability.action.review"
+          ? "action"
+          : null;
+    if (
+      !kind ||
+      !capabilityId ||
+      !policy.grants.some((grant) => capabilityGrantAllows(grant, { appId: input.appId, capabilityId, kind, input: input.input }))
+    )
+      return false;
+    if (kind === "action" && input.capabilityApproval !== "none" && input.capabilityApproval !== "rememberable") return false;
+  }
   if (!input.operation.startsWith("capability.action.run:")) return true;
   if (policy.actions === "deny") return false;
   if (policy.actions === "require_approval") return input.actionApproval === "approved";

package/src/services/notifications/batches.ts

@@ -4,6 +4,7 @@ import type { Worker } from "@k2b/sync";
 import { sql } from "bun";
 import { lazySync } from "../../_internal/process-sync";
 import { markdown } from "../../shared/markdown";
+import { type AuditActor, audit } from "../audit";
 import { logger, trace } from "../logging";
 import { parsePgJsonValue, toPgTextArray, toPgUuidArray } from "../postgres";
 
@@ -406,7 +407,7 @@ export const createDraft = async (params: {
   subject: string;
   bodyMarkdown: string;
   selection: NotificationBatchSelection;
-  createdBy: string;
+  actor: AuditActor & { userId: string };
 }): Promise<Result<NotificationBatch>> => {
   const subject = params.subject.trim();
   const bodyMarkdown = params.bodyMarkdown.trim();
@@ -422,12 +423,24 @@ export const createDraft = async (params: {
   }
   const hash = selectionHash(selection);
   const bodyHtml = markdown.renderSync(bodyMarkdown);
-  const rows = await sql<BatchRow[]>`
-    INSERT INTO notifications.batches (subject, body_markdown, body_html, selection, selection_hash, created_by)
-    VALUES (${subject}, ${bodyMarkdown}, ${bodyHtml}, ${JSON.stringify(selection)}::jsonb, ${hash}, ${params.createdBy}::uuid)
-    RETURNING *
-  `;
-  return ok(mapBatch(rows[0]!));
+  return sql.begin(async (tx) => {
+    const rows = await tx<BatchRow[]>`
+      INSERT INTO notifications.batches (subject, body_markdown, body_html, selection, selection_hash, created_by)
+      VALUES (${subject}, ${bodyMarkdown}, ${bodyHtml}, ${JSON.stringify(selection)}::text::jsonb, ${hash}, ${params.actor.userId}::uuid)
+      RETURNING *
+    `;
+    const batch = mapBatch(rows[0]!);
+    await audit.record(
+      {
+        action: "accounts.notification_batch.create",
+        outcome: "allowed",
+        actor: params.actor,
+        target: { type: "notification_batch", id: batch.id },
+      },
+      tx,
+    );
+    return ok(batch);
+  });
 };
 
 export const get = async (id: string): Promise<NotificationBatch | null> => {
@@ -504,7 +517,7 @@ export const listRecipients = async (params: {
 
 export const finalize = async (params: {
   id: string;
-  actorUserId: string;
+  actor: AuditActor & { userId: string };
   expectedSelectionHash: string;
   expectedDeliverableCount: number;
   expectedRecipientHash: string;
@@ -568,7 +581,7 @@ export const finalize = async (params: {
       UPDATE notifications.batches
       SET
         status = 'ready',
-        finalized_by = ${params.actorUserId}::uuid,
+        finalized_by = ${params.actor.userId}::uuid,
         finalized_at = now(),
         target_count = ${candidates.length},
         deliverable_count = ${deliverableCount},
@@ -576,6 +589,16 @@ export const finalize = async (params: {
       WHERE id = ${params.id}::uuid
       RETURNING *
     `;
+    await audit.record(
+      {
+        action: "accounts.notification_batch.finalize",
+        outcome: "allowed",
+        actor: params.actor,
+        target: { type: "notification_batch", id: params.id },
+        metadata: { targetCount: candidates.length, deliverableCount },
+      },
+      tx,
+    );
     return ok(mapBatch(updated[0]!));
   });
 
@@ -584,28 +607,45 @@ export const finalize = async (params: {
   return ok({ batch: result.data, jobId });
 };
 
-export const retryFailed = async (params: { id: string }): Promise<Result<{ batch: NotificationBatch; jobId: string }>> => {
+export const retryFailed = async (params: {
+  id: string;
+  actor: AuditActor & { userId: string };
+}): Promise<Result<{ batch: NotificationBatch; jobId: string }>> => {
   const batch = await get(params.id);
   if (!batch) return fail(err.notFound("Notification batch not found"));
   if (batch.status === "draft" || batch.status === "cancelled") {
     return fail(err.conflict("Only finalized notification batches can retry recipients"));
   }
 
-  const updated = await sql<BatchRow[]>`
-    UPDATE notifications.batch_recipients
-    SET status = 'pending', error = NULL, notification_id = NULL, sent_at = NULL, updated_at = now()
-    WHERE batch_id = ${params.id}::uuid AND status = 'error' AND recipient IS NOT NULL
-    RETURNING user_id
-  `;
-  if (updated.length === 0) {
-    return fail(err.conflict("No failed deliverable recipients can be retried"));
-  }
+  const result = await sql.begin(async (tx) => {
+    const updated = await tx<BatchRow[]>`
+      UPDATE notifications.batch_recipients
+      SET status = 'pending', error = NULL, notification_id = NULL, sent_at = NULL, updated_at = now()
+      WHERE batch_id = ${params.id}::uuid AND status = 'error' AND recipient IS NOT NULL
+      RETURNING user_id
+    `;
+    if (updated.length === 0) {
+      return fail(err.conflict("No failed deliverable recipients can be retried"));
+    }
 
-  await sql`
-    UPDATE notifications.batches
-    SET status = 'ready', completed_at = NULL, last_error = NULL
-    WHERE id = ${params.id}::uuid AND status IN ('completed_with_errors', 'failed', 'running', 'ready', 'completed')
-  `;
+    await tx`
+      UPDATE notifications.batches
+      SET status = 'ready', completed_at = NULL, last_error = NULL
+      WHERE id = ${params.id}::uuid AND status IN ('completed_with_errors', 'failed', 'running', 'ready', 'completed')
+    `;
+    await audit.record(
+      {
+        action: "accounts.notification_batch.retry_failed",
+        outcome: "allowed",
+        actor: params.actor,
+        target: { type: "notification_batch", id: params.id },
+        metadata: { recipientCount: updated.length },
+      },
+      tx,
+    );
+    return ok(null);
+  });
+  if (!result.ok) return result;
   const refreshed = await refreshBatchCounters(params.id);
   // A completing worker may already have sampled zero remaining recipients.
   // Explicit retries need their own wakeup even while that worker holds its key.
@@ -615,6 +655,7 @@ export const retryFailed = async (params: { id: string }): Promise<Result<{ batc
 
 export const retryRecipient = async (params: {
   id: string;
+  actor: AuditActor & { userId: string };
   userId: string;
 }): Promise<Result<{ batch: NotificationBatch; jobId: string }>> => {
   const batch = await get(params.id);
@@ -623,30 +664,44 @@ export const retryRecipient = async (params: {
     return fail(err.conflict("Only finalized notification batches can retry recipients"));
   }
 
-  const updated = await sql<BatchRow[]>`
-    UPDATE notifications.batch_recipients
-    SET status = 'pending', error = NULL, notification_id = NULL, sent_at = NULL, updated_at = now()
-    WHERE batch_id = ${params.id}::uuid
-      AND user_id = ${params.userId}::uuid
-      AND status = 'error'
-      AND recipient IS NOT NULL
-    RETURNING *
-  `;
-  if (!updated[0]) {
-    const existing = await sql<BatchRow[]>`
-      SELECT status, recipient
-      FROM notifications.batch_recipients
-      WHERE batch_id = ${params.id}::uuid AND user_id = ${params.userId}::uuid
+  const result = await sql.begin(async (tx) => {
+    const updated = await tx<BatchRow[]>`
+      UPDATE notifications.batch_recipients
+      SET status = 'pending', error = NULL, notification_id = NULL, sent_at = NULL, updated_at = now()
+      WHERE batch_id = ${params.id}::uuid
+        AND user_id = ${params.userId}::uuid
+        AND status = 'error'
+        AND recipient IS NOT NULL
+      RETURNING *
     `;
-    if (!existing[0]) return fail(err.notFound("Notification recipient not found"));
-    return fail(err.conflict("Only failed deliverable recipients can be retried"));
-  }
+    if (!updated[0]) {
+      const existing = await tx<BatchRow[]>`
+        SELECT status, recipient
+        FROM notifications.batch_recipients
+        WHERE batch_id = ${params.id}::uuid AND user_id = ${params.userId}::uuid
+      `;
+      if (!existing[0]) return fail(err.notFound("Notification recipient not found"));
+      return fail(err.conflict("Only failed deliverable recipients can be retried"));
+    }
 
-  await sql`
-    UPDATE notifications.batches
-    SET status = 'ready', completed_at = NULL, last_error = NULL
-    WHERE id = ${params.id}::uuid AND status IN ('completed_with_errors', 'failed', 'running', 'ready', 'completed')
-  `;
+    await tx`
+      UPDATE notifications.batches
+      SET status = 'ready', completed_at = NULL, last_error = NULL
+      WHERE id = ${params.id}::uuid AND status IN ('completed_with_errors', 'failed', 'running', 'ready', 'completed')
+    `;
+    await audit.record(
+      {
+        action: "accounts.notification_batch.retry_recipient",
+        outcome: "allowed",
+        actor: params.actor,
+        target: { type: "notification_batch", id: params.id },
+        metadata: { recipientUserId: params.userId },
+      },
+      tx,
+    );
+    return ok(null);
+  });
+  if (!result.ok) return result;
   const refreshed = await refreshBatchCounters(params.id);
   const { jobId } = await batchJob().submit({
     key: `${params.id}:retry:${crypto.randomUUID()}`,
@@ -655,17 +710,29 @@ export const retryRecipient = async (params: {
   return ok({ batch: refreshed ?? batch, jobId });
 };
 
-export const removeDraft = async (params: { id: string }): Promise<Result<{ id: string }>> => {
-  const rows = await sql<BatchRow[]>`
-    DELETE FROM notifications.batches
-    WHERE id = ${params.id}::uuid AND status = 'draft'
-    RETURNING id
-  `;
-  if (rows[0]) return ok({ id: rows[0].id as string });
-
-  const batch = await get(params.id);
-  if (!batch) return fail(err.notFound("Notification batch not found"));
-  return fail(err.conflict("Only draft notification batches can be deleted"));
+export const removeDraft = async (params: { id: string; actor: AuditActor & { userId: string } }): Promise<Result<{ id: string }>> => {
+  return sql.begin(async (tx) => {
+    const rows = await tx<BatchRow[]>`
+      DELETE FROM notifications.batches
+      WHERE id = ${params.id}::uuid AND status = 'draft'
+      RETURNING id
+    `;
+    if (rows[0]) {
+      await audit.record(
+        {
+          action: "accounts.notification_batch.delete",
+          outcome: "allowed",
+          actor: params.actor,
+          target: { type: "notification_batch", id: params.id },
+        },
+        tx,
+      );
+      return ok({ id: params.id });
+    }
+    const existing = await tx`SELECT id FROM notifications.batches WHERE id = ${params.id}::uuid`;
+    if (!existing[0]) return fail(err.notFound("Notification batch not found"));
+    return fail(err.conflict("Only draft notification batches can be deleted"));
+  });
 };
 
 export const start = async (): Promise<void> => {

package/src/services/notifications/browser.ts

@@ -152,6 +152,18 @@ const browserDriver = {
   },
   deliver: async (value: unknown) => {
     const payload: BrowserDeliveryPayload = BrowserDeliveryPayloadSchema.parse(value);
+    // A queued payload can outlive logout, disable, or rebinding this browser to another user.
+    const [endpoint] = await sql<{ id: string }[]>`
+      SELECT id FROM notifications.endpoints
+      WHERE id = ${payload.endpointId}::uuid AND channel = 'browser'
+        AND verified_at IS NOT NULL AND disabled_at IS NULL
+    `;
+    if (!endpoint) {
+      throw Object.assign(new Error("Browser notification endpoint is no longer registered"), {
+        code: "endpoint_gone",
+        retryable: false,
+      });
+    }
     await ensureWebPushConfigured();
     try {
       await sendPinnedWebPush(

package/src/services/notifications/index.ts

@@ -6,7 +6,6 @@ import { logger } from "../logging";
 import { escapeLikePattern } from "../postgres";
 import { sendEmail } from "./email";
 import "./browser";
-import { notificationLive } from "./live";
 import { notificationObservability } from "./observability";
 import { sendTypedNotification, type TypedNotificationSendResult } from "./platform";
 import { userNotifications } from "./user";
@@ -610,7 +609,6 @@ export const notifications = {
   sendAllPendingSystem,
   getStatusSummary,
   getSearchSummary,
-  live: notificationLive,
   observability: notificationObservability,
   user: userNotifications,
 };