@cosmicdrift/kumiko-bundled-features 0.100.0 → 0.102.1

package/src/delivery/types.ts

@@ -2,6 +2,7 @@ import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type {
   NotifyOptions,
+  NotifyPriority,
   Registry,
   SessionUser,
   TenantId,
@@ -29,10 +30,31 @@ export type ChannelResult = {
   readonly address?: string;
 };
 
+// Output of a channel's render step, passed into send(). Only channels that
+// declare render() (email) produce one; inline channels (inApp) and channels
+// without an expensive render step (push) receive `undefined`.
+export type RenderedMessage = {
+  readonly html: string;
+  readonly subject: string;
+};
+
+// `mode` decides how the delivery-service dispatches a channel:
+//   inline — sent synchronously inside notify() (inApp: DB insert + SSE).
+//   queued — sent asynchronously via the delivery.send job; channels with a
+//            render() additionally run through delivery.render first.
+export type DeliveryChannelMode = "inline" | "queued";
+
 export type DeliveryChannel = {
   readonly name: string;
+  readonly mode: DeliveryChannelMode;
   resolve(userId: string, ctx: ChannelContext): Promise<string | null>;
-  send(address: string, message: ChannelMessage, ctx: ChannelContext): Promise<ChannelResult>;
+  render?(message: ChannelMessage, ctx: ChannelContext): Promise<RenderedMessage>;
+  send(
+    address: string,
+    message: ChannelMessage,
+    ctx: ChannelContext,
+    rendered?: RenderedMessage,
+  ): Promise<ChannelResult>;
 };
 
 // --- Notification Renderer ---
@@ -55,8 +77,9 @@ export type DeliveryLogEntry = {
   readonly channel: string;
   readonly recipientId: string | null;
   readonly recipientAddress: string | null;
-  readonly status: "sent" | "failed" | "skipped";
+  readonly status: "queued" | "sent" | "failed" | "skipped";
   readonly error: string | null;
+  readonly priority: NotifyPriority;
 };
 
 // --- Delivery Service ---

package/src/presets/__tests__/dsgvo-self-service.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import { dsgvoSelfServiceFeatures } from "../dsgvo-self-service";
+
+// Pins the DSGVO/self-service bundle: the five features in dependency order
+// (user-data-rights requires data-retention + compliance-profiles + sessions;
+// user-profile requires user-data-rights). Order is load-bearing, so it is
+// asserted explicitly.
+
+describe("dsgvoSelfServiceFeatures", () => {
+  test("returns the five features in require-order", () => {
+    const names = dsgvoSelfServiceFeatures().map((f) => f.name);
+    expect(names).toEqual([
+      "data-retention",
+      "compliance-profiles",
+      "sessions",
+      "user-data-rights",
+      "user-profile",
+    ]);
+  });
+
+  test("data-retention/compliance-profiles precede user-data-rights (dependency order holds)", () => {
+    const names = dsgvoSelfServiceFeatures().map((f) => f.name);
+    const udr = names.indexOf("user-data-rights");
+    expect(names.indexOf("data-retention")).toBeLessThan(udr);
+    expect(names.indexOf("compliance-profiles")).toBeLessThan(udr);
+    expect(names.indexOf("sessions")).toBeLessThan(udr);
+    expect(names.indexOf("user-profile")).toBeGreaterThan(udr);
+  });
+
+  test("each call yields fresh feature instances (no shared mutable state)", () => {
+    const a = dsgvoSelfServiceFeatures();
+    const b = dsgvoSelfServiceFeatures();
+    expect(a[0]).not.toBe(b[0]);
+  });
+});

package/src/presets/dsgvo-self-service.ts

@@ -0,0 +1,30 @@
+import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { createComplianceProfilesFeature } from "../compliance-profiles";
+import { createDataRetentionFeature } from "../data-retention";
+import { createSessionsFeature } from "../sessions";
+import { createUserDataRightsFeature, type UserDataRightsOptions } from "../user-data-rights";
+import { createUserProfileFeature } from "../user-profile";
+
+export type DsgvoSelfServiceOptions = {
+  /** Durchgereicht an createUserDataRightsFeature — Export-/Deletion-Mail-
+   *  Callbacks + Apex-Deletion-HMAC. Default {} (no-op Mail-Side). */
+  readonly userDataRights?: UserDataRightsOptions;
+};
+
+// DSGVO- + Account-Self-Service-Kette, die jede Kumiko-SaaS-App mountet
+// (Privacy-Center, Account-Löschung Art. 17, Export Art. 20, Sessions).
+// Die Reihenfolge IST load-bearing (Require-Order): user-data-rights braucht
+// data-retention + compliance-profiles + sessions, user-profile braucht
+// user-data-rights. Genau diese Order stand bisher in jeder App handkopiert
+// mit Erklär-Kommentar. text-content + legal-pages bleiben bewusst draußen —
+// legal-pages hat ein app-spezifisches wrapLayout, text-content ist
+// standalone Foundation; beide spreaded die App selbst dazu.
+export function dsgvoSelfServiceFeatures(opts: DsgvoSelfServiceOptions = {}): FeatureDefinition[] {
+  return [
+    createDataRetentionFeature(),
+    createComplianceProfilesFeature(),
+    createSessionsFeature(),
+    createUserDataRightsFeature(opts.userDataRights ?? {}),
+    createUserProfileFeature(),
+  ];
+}

package/src/presets/index.ts

@@ -0,0 +1 @@
+export { type DsgvoSelfServiceOptions, dsgvoSelfServiceFeatures } from "./dsgvo-self-service";

package/src/secrets/feature.ts

@@ -20,6 +20,8 @@ import { tenantSecretEntity, tenantSecretsTable } from "./table";
  * and picks the highest as the active KEK unless
  * `KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION` pins one explicitly.
  */
+export const SECRETS_FEATURE_NAME = "secrets";
+
 export const secretsEnvSchema = z.object({
   KUMIKO_SECRETS_MASTER_KEY_V1: z
     .string()
@@ -83,7 +85,7 @@ export function requireSecretsContext(
 }
 
 export function createSecretsFeature(): FeatureDefinition {
-  return defineFeature("secrets", (r) => {
+  return defineFeature(SECRETS_FEATURE_NAME, (r) => {
     r.describe(
       "Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump.",
     );

package/src/secrets/index.ts

@@ -2,6 +2,7 @@ export {
   createSecretsContext,
   createSecretsFeature,
   requireSecretsContext,
+  SECRETS_FEATURE_NAME,
   type SecretsContext,
   type SecretsContextOptions,
   type StoredEnvelope,

package/src/text-content/__tests__/seed-legal-content.integration.test.ts

@@ -0,0 +1,61 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { type DbConnection, fetchOne } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTextContentFeature } from "../feature";
+import { type LegalContentBlock, seedLegalContentFromJson } from "../seeding";
+import { type TextBlockRow, textBlockEntity, textBlocksTable } from "../table";
+
+// Pins seedLegalContentFromJson: seeds into SYSTEM_TENANT_ID by default and
+// re-seeds with ifExists:"update" so a changed template body lands on an
+// already-seeded block (legal-drift guard — the load-bearing behaviour).
+
+let stack: TestStack;
+let db: DbConnection;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [createTextContentFeature()] });
+  db = stack.db;
+  await unsafeCreateEntityTable(db, textBlockEntity);
+  await createEventsTable(db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+function read(slug: string, lang: string) {
+  return fetchOne<TextBlockRow>(db, textBlocksTable, { tenantId: SYSTEM_TENANT_ID, slug, lang });
+}
+
+describe("seedLegalContentFromJson", () => {
+  test("seeds all blocks into SYSTEM_TENANT_ID by default", async () => {
+    const blocks: LegalContentBlock[] = [
+      { slug: "imprint", lang: "de", title: "Impressum", body: "Marc Frost" },
+      { slug: "imprint", lang: "en", title: "Imprint", body: "Marc Frost" },
+    ];
+    await seedLegalContentFromJson(db, blocks);
+
+    expect(await read("imprint", "de")).toMatchObject({ title: "Impressum", body: "Marc Frost" });
+    expect(await read("imprint", "en")).toMatchObject({ title: "Imprint", body: "Marc Frost" });
+  });
+
+  test("re-seed lifts an existing block to the new template state (ifExists:update)", async () => {
+    const v1: LegalContentBlock[] = [
+      { slug: "privacy", lang: "de", title: "Datenschutz", body: "v1" },
+    ];
+    await seedLegalContentFromJson(db, v1);
+    expect(await read("privacy", "de")).toMatchObject({ body: "v1" });
+
+    const v2: LegalContentBlock[] = [
+      { slug: "privacy", lang: "de", title: "Datenschutz", body: "v2 + Sub-Processor-Tabelle" },
+    ];
+    await seedLegalContentFromJson(db, v2);
+    expect(await read("privacy", "de")).toMatchObject({ body: "v2 + Sub-Processor-Tabelle" });
+  });
+});

package/src/text-content/seeding.ts

@@ -9,7 +9,11 @@ import {
   createTenantDb,
   type DbConnection,
 } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  type SessionUser,
+  SYSTEM_TENANT_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import { type TextBlockRow, textBlockEntity, textBlocksTable } from "./table";
@@ -101,3 +105,33 @@ export async function seedTextBlock(
     },
   });
 }
+
+export type LegalContentBlock = {
+  readonly slug: string;
+  readonly lang: string;
+  readonly title: string;
+  readonly body: string;
+};
+
+// Boot-Seed für Legal-/Marketing-Texte aus einer JSON-Vorlage. `ifExists:
+// "update"` ist load-bearing: die Vorlage ist autoritativ, jeder Boot hebt
+// bestehende Blöcke auf den kompilierten Stand — sonst erreichen gesetzlich
+// vorgeschriebene Zusätze (z.B. Sub-Processor-Tabelle) bereits geseedete
+// Prod-Records nie. Genau diese Entscheidung soll keine App selbst treffen.
+export async function seedLegalContentFromJson(
+  db: DbConnection,
+  blocks: readonly LegalContentBlock[],
+  opts: { readonly tenantId?: TenantId } = {},
+): Promise<void> {
+  const tenantId = opts.tenantId ?? SYSTEM_TENANT_ID;
+  for (const block of blocks) {
+    await seedTextBlock(db, {
+      tenantId,
+      slug: block.slug,
+      lang: block.lang,
+      title: block.title,
+      body: block.body,
+      ifExists: "update",
+    });
+  }
+}

package/src/user-data-rights/web/__tests__/deletion-screens.test.tsx

@@ -51,12 +51,12 @@ function renderWith(ui: ReactElement, dispatcher: Dispatcher): ReturnType<typeof
   return within(container);
 }
 
-// SKIPPED — CI-only flake (#457): on the shared single-process happy-dom runner
-// the click never reaches React's submit handler after ~30 prior DOM test files
-// have mounted/unmounted (write is never invoked, calls stays empty). Green
-// locally and on main; not a timing issue. Un-skip once the global afterEach
-// teardown / per-file DOM isolation fix lands.
-describe.skip("RequestAccountDeletionScreen", () => {
+// CI runs this file in its own `bun test` process (own ci.yml step), NOT in the
+// shared `kumiko check` run — see bunfig.ci.toml pathIgnorePatterns. The shared
+// single-process happy-dom corrupts React event delegation after ~30 prior DOM
+// test files mount/unmount, so the click never reached the submit handler here
+// (#457). A fresh process has no such accumulation.
+describe("RequestAccountDeletionScreen", () => {
   test("Submit → write(request-deletion-by-email) + enumeration-safe Success", async () => {
     const calls: WriteCall[] = [];
     const ui = renderWith(<RequestAccountDeletionScreen />, makeDispatcher(true, calls));
@@ -78,7 +78,7 @@ describe.skip("RequestAccountDeletionScreen", () => {
   });
 });
 
-describe.skip("ConfirmAccountDeletionScreen", () => {
+describe("ConfirmAccountDeletionScreen", () => {
   test("ohne ?token → missingToken, kein Confirm-Button", () => {
     window.history.replaceState({}, "", "/delete-account/confirm");
     const ui = renderWith(<ConfirmAccountDeletionScreen />, makeDispatcher(true, []));

package/src/user-data-rights/web/__tests__/privacy-center-screen.test.tsx

@@ -114,19 +114,13 @@ async function waitForMount(view: ReturnType<typeof render>): Promise<void> {
   });
 }
 
-// QUARANTINED (#457-Klasse): diese Render-Tests laufen lokal grün (13/13 isoliert,
-// 82/88 mit allen bundled-features-web-Tests parallel), failen aber auf CI-Linux
-// unter bun-`concurrency=8`. Diagnose aus dem CI-Log: parallele Test-FILES teilen
-// sich das eine globale happy-dom `document`; der globale `afterEach` aus
-// `test-setup/dom.preload.ts` (`cleanup()` + `document.body.replaceChildren()`)
-// eines parallel laufenden Tests wischt die in-flight gerenderte DOM eines anderen
-// weg → die `await`-Assertions hier finden den Screen-Stand eines Nachbar-Tests
-// (sichtbar: alle Fails zeigen denselben active-state Screen statt der eigenen
-// Test-Daten). Nicht aus diesem File fixbar — gleiche Architektur-Flake, wegen der
-// `deletion-screens.test.tsx` im selben Verzeichnis quarantäniert ist. Un-skip,
-// sobald das framework-weite Test-Isolation-Problem (#457) gelöst ist. Die
-// QN-Drift-Pins + formatDate unten decken die CI-stabile Verdrahtungs-Korrektheit ab.
-describe.skip("PrivacyCenterScreen", () => {
+// CI runs this file in its own `bun test` process (own ci.yml step), NOT in the
+// shared `kumiko check` run — see bunfig.ci.toml pathIgnorePatterns. In the shared
+// single-process happy-dom, the global `afterEach` from `test-setup/dom.preload.ts`
+// plus accumulated global DOM/event state across ~30 prior DOM test files corrupts
+// these in-flight renders (#457-class). A fresh process has no such accumulation.
+// The QN-Drift-Pins + formatDate describes below are pure-logic and CI-stable.
+describe("PrivacyCenterScreen", () => {
   test("aktiver User: Export/Einschränken/Löschen-Sektionen, Texte übersetzt (keine rohen Keys)", async () => {
     const { view } = renderCenter({ me: activeMe });
     await waitForMount(view);