@cosmicdrift/kumiko-bundled-features 0.105.1 → 0.108.0

package/src/auth-email-password/web/invite-accept-screen.tsx

@@ -17,10 +17,10 @@
 // auch zu loggedInHref damit der invitee in seinem neuen Tenant landet.
 
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
-import { type FormEvent, type ReactNode, useState } from "react";
+import { type FormEvent, type ReactNode, useContext, useState } from "react";
 import { csrfHeader } from "./auth-client";
 import { AuthCard, authMutedLinkClass, parseUrlToken } from "./auth-form-primitives";
-import { useSession } from "./session";
+import { SessionContext, UNAUTHENTICATED } from "./session";
 
 export type InviteAcceptScreenProps = {
   readonly title?: string;
@@ -42,7 +42,11 @@ export function InviteAcceptScreen({
 }: InviteAcceptScreenProps): ReactNode {
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner } = usePrimitives();
-  const session = useSession();
+  // NOT useSession(): InviteAcceptScreen is a public route (anon invite-links
+  // are the documented use case) — useSession() throws without a
+  // <SessionProvider> ancestor. Read the context directly and fall back to
+  // the anonymous state when no provider wraps this screen (632/1).
+  const session = useContext(SessionContext) ?? UNAUTHENTICATED;
   const [token] = useState(() => tokenProp ?? parseUrlToken());
   const [mode, setMode] = useState<Mode>(() =>
     session.status === "authenticated" ? "loggedin" : "anon-existing",

package/src/auth-email-password/web/session.tsx

@@ -44,7 +44,11 @@ export type SessionApi = SessionState & {
   readonly switchTenant: (tenantId: string) => Promise<void>;
 };
 
-const UNAUTHENTICATED: SessionState = {
+// Exported so screens that render on BOTH authenticated and anonymous public
+// routes (e.g. InviteAcceptScreen) can read `.status` without requiring a
+// <SessionProvider> ancestor — see useContext(SessionContext) ?? UNAUTHENTICATED
+// in invite-accept-screen.tsx (632/1).
+export const UNAUTHENTICATED: SessionState = {
   status: "unauthenticated",
   user: null,
   activeTenantId: null,

package/src/auth-email-password/web/user-menu.tsx

@@ -64,7 +64,7 @@ export function UserMenu({ children, variant = "pill" }: UserMenuProps): ReactNo
     <DropdownMenuContent align="end" aria-label={t("auth.user.menu.label")}>
       <DropdownMenuLabel className="text-xs">
         <div className="font-medium text-foreground truncate">{displayName}</div>
-        <div className="truncate">{user.email}</div>
+        {hasName && <div className="truncate">{user.email}</div>}
       </DropdownMenuLabel>
       <DropdownMenuSeparator />
       {children}

package/src/config/__tests__/deserialize-value.test.ts

@@ -1,12 +1,9 @@
 import { describe, expect, test } from "bun:test";
 import { deserializeValue } from "../resolver";
 
-// deserializeValue is the read boundary for every config value: the DB stores
-// the JSON-encoded raw string, this turns it back into a typed primitive per the
-// key's declared `type`. The coercion has non-obvious paths worth pinning so a
-// refactor can't quietly change them: a stored value whose JSON type disagrees
-// with the declared type is NOT rejected — it is coerced (number via Number(),
-// boolean only via literal true / the string "true", text via String()).
+// Type mismatches are coerced, not rejected (number via Number(), boolean
+// only via literal true/"true", text via String()) — pinned so a refactor
+// can't quietly change that.
 
 describe("deserializeValue", () => {
   test("null raw short-circuits to undefined before any parse", () => {

package/src/custom-fields/__tests__/custom-fields.integration.test.ts

@@ -22,6 +22,10 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createProjectionStateTable,
+  rebuildProjection,
+} from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   createTestUser,
   setupTestStack,
@@ -84,6 +88,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, fieldDefinitionEntity);
   await unsafeCreateEntityTable(stack.db, propertyEntity);
   await createEventsTable(stack.db);
+  await createProjectionStateTable(stack.db);
 });
 
 afterAll(async () => {
@@ -919,3 +924,63 @@ describe("custom-fields integration — update-tenant-field (Bug-Bash D2)", () =
     expect(causeMessage).toContain("update-tenant-field");
   });
 });
+
+describe("custom-fields integration — official host-entity rebuild (#759)", () => {
+  test("rebuildProjection replays customField.set/cleared + fieldDefinition.deleted", async () => {
+    await defineField("property", "color", "text");
+    await defineField("property", "doomed", "text");
+    const propId = "dddddddd-dddd-4000-8000-00000000000d";
+    await createProperty(propId, "RebuildOfficial");
+    await setCustomField("property", propId, "color", "blue");
+    await setCustomField("property", propId, "doomed", "bye");
+    // fieldDef-delete cascade removes the key — the rebuild must preserve the
+    // removal (fieldDefinition.deleted rides the extra "field-definition" source).
+    await stack.http.writeOk(
+      "custom-fields:write:delete-tenant-field",
+      { entityName: "property", fieldKey: "doomed" },
+      admin,
+    );
+    await stack.eventDispatcher?.runOnce();
+
+    let row = (await listProperties()).rows.find((r) => r["id"] === propId);
+    expect(row?.["color"]).toBe("blue");
+    expect(row?.["doomed"]).toBeUndefined();
+
+    // The routine schema-migration path: full official rebuild of the host
+    // entity's implicit projection. Pre-#759 this reset every custom_fields
+    // jsonb to its default '{}' with no recovery path.
+    const result = await rebuildProjection("property-test:projection:property-entity", {
+      db: stack.db,
+      registry: stack.registry,
+    });
+    expect(result.eventsProcessed).toBeGreaterThan(0);
+
+    row = (await listProperties()).rows.find((r) => r["id"] === propId);
+    expect(row?.["name"]).toBe("RebuildOfficial");
+    expect(row?.["color"]).toBe("blue");
+    expect(row?.["doomed"]).toBeUndefined();
+  });
+
+  test("clear-custom-field removal survives the official rebuild", async () => {
+    await defineField("property", "flag", "text");
+    await defineField("property", "keep", "text");
+    const propId = "eeeeeeee-eeee-4000-8000-00000000000e";
+    await createProperty(propId, "ClearSurvives");
+    await setCustomField("property", propId, "flag", "on");
+    await setCustomField("property", propId, "keep", "yes");
+    await clearCustomField("property", propId, "flag");
+    await stack.eventDispatcher?.runOnce();
+
+    await rebuildProjection("property-test:projection:property-entity", {
+      db: stack.db,
+      registry: stack.registry,
+    });
+
+    const row = (await listProperties()).rows.find((r) => r["id"] === propId);
+    // Kontrollfeld beweist dass der Rebuild die set-Events real replayt hat —
+    // ein leeres {} wuerde "flag undefined" trivial erfuellen.
+    expect(row?.["keep"]).toBe("yes");
+    expect(row?.["flag"]).toBeUndefined();
+    expect(row?.["name"]).toBe("ClearSurvives");
+  });
+});

package/src/custom-fields/__tests__/user-data-rights.integration.test.ts

@@ -22,7 +22,7 @@
 //     (strip runs, host nulls the owner).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   buildEntityTable,
   createEventStoreExecutor,
@@ -46,6 +46,7 @@ import {
   TestUsers,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
@@ -241,7 +242,7 @@ async function readRow(id: string): Promise<Record<string, unknown> | undefined>
 // the export runner iterates their data. Status active = NOT picked up by
 // runForgetCleanup.
 async function seedActiveUserWithMembership(): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: admin.id,
     tenantId: TENANT,
     email: `admin@example.com`,
@@ -258,7 +259,7 @@ async function seedActiveUserWithMembership(): Promise<void> {
 // Seed the acting admin as DeletionRequested + grace expired so
 // runForgetCleanup picks them up, with a membership in TENANT.
 async function seedForgetUserWithMembership(): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: admin.id,
     tenantId: TENANT,
     email: `admin@example.com`,

package/src/custom-fields/constants.ts

@@ -31,6 +31,7 @@ export const CUSTOM_FIELDS_FORM_EXTENSION_NAME = "CustomFieldsFormSection";
 // Entity-CRUD auto-events for the `field-definition` entity. registry.ts emits
 // these as `${entityName}.created`/`.updated` (dot form) — they do NOT run
 // through r.defineEvent/toKebab, so the dot MUST stay.
+export const FIELD_DEFINITION_AGGREGATE_TYPE = "field-definition";
 export const FIELD_DEFINITION_CREATED_EVENT = "field-definition.created";
 export const FIELD_DEFINITION_UPDATED_EVENT = "field-definition.updated";
 // Qualified at registration via r.defineEvent — final name is

package/src/custom-fields/handlers/delete-system-field.write.ts

@@ -1,5 +1,6 @@
 import { SYSTEM_TENANT_ID, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
+import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants";
 import { fieldDefinitionExecutor } from "../executor";
 import { customFieldsFeature } from "../feature";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas";
@@ -30,7 +31,7 @@ export const deleteSystemFieldHandler: WriteHandlerDef = {
     if (result.isSuccess) {
       await ctx.unsafeAppendEvent({
         aggregateId,
-        aggregateType: "field-definition",
+        aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
         type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
         payload: {
           entityName: payload.entityName,

package/src/custom-fields/handlers/delete-tenant-field.write.ts

@@ -1,5 +1,6 @@
 import { isSystemTenant, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
+import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants";
 import { fieldDefinitionExecutor } from "../executor";
 import { customFieldsFeature } from "../feature";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas";
@@ -38,7 +39,7 @@ export const deleteTenantFieldHandler: WriteHandlerDef = {
     if (result.isSuccess) {
       await ctx.unsafeAppendEvent({
         aggregateId,
-        aggregateType: "field-definition",
+        aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
         type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
         payload: { entityName: payload.entityName, fieldKey: payload.fieldKey, tenantId },
       });

package/src/custom-fields/web/__tests__/custom-fields-form-section.test.tsx

@@ -300,11 +300,17 @@ describe("CustomFieldsFormSection — clear-Pfad", () => {
     );
 
     const vendorInput = document.getElementById("custom-field-vendor") as HTMLInputElement;
+    const saveBtn = screen.getByTestId("custom-fields-form-save") as HTMLButtonElement;
     // Tippen + zurück auf den Bestandswert → nicht dirty, kein Write.
     await user.type(vendorInput, "2");
     await user.type(vendorInput, "{Backspace}");
-    await user.click(screen.getByTestId("custom-fields-form-save"));
-    await waitFor(() => expect(dispatchSpy).not.toHaveBeenCalled());
+    // Positiver Anker: erst abwarten, dass der Save-Button wieder disabled ist
+    // (beweist, dass die dirty-Neuberechnung durchgelaufen ist), statt direkt
+    // eine negative Assertion in waitFor zu pollen (die beim ersten Tick
+    // trivial besteht und keine ausstehenden Async-Effekte abwartet).
+    await waitFor(() => expect(saveBtn.disabled).toBe(true));
+    await user.click(saveBtn);
+    expect(dispatchSpy).not.toHaveBeenCalled();
   });
 });
 

package/src/custom-fields/wire-for-entity.ts

@@ -1,4 +1,4 @@
-import { extractTableName } from "@cosmicdrift/kumiko-framework/db";
+import { type DbRunner, extractTableName } from "@cosmicdrift/kumiko-framework/db";
 import {
   createJsonbField,
   type FeatureRegistrar,
@@ -6,7 +6,8 @@ import {
   type JsonbFieldDef,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { CUSTOM_FIELDS_EXTENSION } from "./constants";
+import type { StoredEvent } from "@cosmicdrift/kumiko-framework/event-store";
+import { CUSTOM_FIELDS_EXTENSION, FIELD_DEFINITION_AGGREGATE_TYPE } from "./constants";
 import {
   clearCustomFieldKey,
   removeCustomFieldKeyForTenant,
@@ -36,8 +37,9 @@ export function customFieldsField(): JsonbFieldDef {
 
 // Vollständige integration der custom-fields-Bundle für eine spezifische
 // host-entity. Eine einzige Aufruf-Stelle pro consumer registriert ALLE
-// wiring-Aspekte: extension-tracking, MSP für value-projection, postQuery-
-// hook für API-flatten, search-payload-extension für indexable customFields.
+// wiring-Aspekte: extension-tracking, MSP für value-projection, rebuild-
+// replay via extendEntityProjection, postQuery-hook für API-flatten,
+// search-payload-extension für indexable customFields.
 //
 // Consumer-side:
 //
@@ -61,15 +63,20 @@ export function customFieldsField(): JsonbFieldDef {
 //      emittiert haben. Updated entityTable.customFields jsonb über
 //      jsonb_set / jsonb-key-removal.
 //
-//   3. r.entityHook("postQuery", entity, flatten-fn) — bei JEDEM Read auf
+//   3. r.extendEntityProjection — hängt dieselben apply-Handler in die
+//      implicit projection der host-entity, damit rebuildProjection die
+//      customField-Events mit-replayt. Ohne das fällt customFields bei
+//      jedem Entity-Rebuild (Schema-Migration!) auf `{}` zurück (#759).
+//
+//   4. r.entityHook("postQuery", entity, flatten-fn) — bei JEDEM Read auf
 //      diese entity wird `row.customFields` jsonb auf root-level expanded
 //      damit die API-response wie Stammfelder aussieht.
 //
-//   4. r.searchPayloadExtension(entity, contributor) — searchable
+//   5. r.searchPayloadExtension(entity, contributor) — searchable
 //      customFields-keys werden flach ins Meilisearch-Index-Doc beigetragen
 //      (F3-wiring).
 //
-//   5. fieldDefinition.deleted-Event-Handler im selben MSP — bei delete
+//   6. fieldDefinition.deleted-Event-Handler im selben MSP — bei delete
 //      einer fieldDefinition werden orphan values aus allen entity-rows
 //      entfernt (key-removal pro fieldKey).
 export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
@@ -87,80 +94,100 @@ export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
   const clearedEventType = customFieldsFeature.exports.clearedEvent.name;
   const fieldDefDeletedType = customFieldsFeature.exports.fieldDefinitionDeletedEvent.name;
 
-  r.multiStreamProjection({
-    name: `custom-fields-${entityName}-projection`,
-    apply: {
-      [setEventType]: async (event, tx) => {
-        // skip: MSP feuert für ALLE aggregate-types die customField.set
-        // emittieren — wir wollen nur die unserer wired host-entity.
-        // Andere consumers haben eigene MSPs für ihre Entities.
-        if (event.aggregateType !== entityName) return;
-        const payload = event.payload as CustomFieldSetPayload; // @cast-boundary engine-payload
+  // Geteilte apply-Bodies: die MSP liefert sie live (async cursor), die
+  // entity-projection-extension replayt sie in rebuildProjection — gleiche
+  // SQL-Helper, beide idempotent. 2-Param-Signatur ist die gemeinsame
+  // Teilmenge von MultiStreamApplyFn und SingleStreamApplyFn.
+  const applyCustomFieldSet = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
+    // skip: feuert für ALLE aggregate-types die customField.set emittieren —
+    // wir wollen nur die unserer wired host-entity. Andere consumers haben
+    // eigene Wirings für ihre Entities.
+    if (event.aggregateType !== entityName) return;
+    const payload = event.payload as CustomFieldSetPayload; // @cast-boundary engine-payload
 
-        // skip: sensitive fields self-project in the write handler (see
-        // set-custom-field) and persist a value-less event so PII never enters
-        // the log. Such events arrive here with value === undefined — skipping
-        // is correct both live (the handler already wrote the row) and on replay
-        // (the value is intentionally gone, the accepted rebuild-loss).
-        if (payload.value === undefined) return;
+    // skip: sensitive fields self-project in the write handler (see
+    // set-custom-field) and persist a value-less event so PII never enters
+    // the log. Such events arrive here with value === undefined — skipping
+    // is correct both live (the handler already wrote the row) and on replay
+    // (the value is intentionally gone, the accepted rebuild-loss).
+    if (payload.value === undefined) return;
 
-        // jsonb_set: setze key auf value. Wenn key noch nicht existiert →
-        // wird angelegt (create_missing=true ist default). value muss als
-        // jsonb-literal kommen.
-        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-        await setCustomFieldValue(
-          tx,
-          tableName,
-          payload.fieldKey,
-          payload.value,
-          event.aggregateId,
-          event.tenantId,
-        );
-      },
-      [clearedEventType]: async (event, tx) => {
-        // skip: MSP feuert für alle aggregate-types — nur unsere host-entity
-        // verarbeiten.
-        if (event.aggregateType !== entityName) return;
-        const payload = event.payload as CustomFieldClearedPayload; // @cast-boundary engine-payload
+    // jsonb_set: setze key auf value. Wenn key noch nicht existiert →
+    // wird angelegt (create_missing=true ist default). value muss als
+    // jsonb-literal kommen.
+    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+    await setCustomFieldValue(
+      tx,
+      tableName,
+      payload.fieldKey,
+      payload.value,
+      event.aggregateId,
+      event.tenantId,
+    );
+  };
 
-        // jsonb minus operator (`-`) entfernt key aus jsonb-object.
-        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-        await clearCustomFieldKey(
-          tx,
-          tableName,
-          payload.fieldKey,
-          event.aggregateId,
-          event.tenantId,
-        );
-      },
-      [fieldDefDeletedType]: async (event, tx) => {
-        // fieldDefinition.deleted fires nur einmal pro fieldDef-delete
-        // (NICHT per-entity). Wir entfernen den key aus ALLEN rows der host-
-        // entity falls die deleted-fieldDef für diese entity galt.
-        const payload = event.payload as {
-          entityName: string;
-          fieldKey: string;
-          tenantId?: TenantId;
-        }; // @cast-boundary engine-payload
-        // skip: fieldDefinition.deleted feuert für ALLE fieldDefs cross-entity;
-        // nur wenn die deleted-fieldDef diese host-entity betraf, cleanen wir
-        // ihre Rows.
-        if (payload.entityName !== entityName) return;
+  const applyCustomFieldCleared = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
+    // skip: feuert für alle aggregate-types — nur unsere host-entity
+    // verarbeiten.
+    if (event.aggregateType !== entityName) return;
+    const payload = event.payload as CustomFieldClearedPayload; // @cast-boundary engine-payload
+
+    // jsonb minus operator (`-`) entfernt key aus jsonb-object.
+    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+    await clearCustomFieldKey(tx, tableName, payload.fieldKey, event.aggregateId, event.tenantId);
+  };
+
+  const applyFieldDefinitionDeleted = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
+    // fieldDefinition.deleted fires nur einmal pro fieldDef-delete
+    // (NICHT per-entity). Wir entfernen den key aus ALLEN rows der host-
+    // entity falls die deleted-fieldDef für diese entity galt.
+    const payload = event.payload as {
+      entityName: string;
+      fieldKey: string;
+      tenantId?: TenantId;
+    }; // @cast-boundary engine-payload
+    // skip: fieldDefinition.deleted feuert für ALLE fieldDefs cross-entity;
+    // nur wenn die deleted-fieldDef diese host-entity betraf, cleanen wir
+    // ihre Rows.
+    if (payload.entityName !== entityName) return;
+
+    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+    // Scope cleanup to the deleted definition's owning tenant. System-scope
+    // definitions apply to every tenant → cascade across all rows; tenant-
+    // scope deletions must only touch that tenant's rows, else deleting one
+    // tenant's field strips the same kebab key from every tenant (data loss).
+    // Fallback to the event's stream tenantId for events appended before the
+    // payload carried tenantId.
+    const defTenantId = payload.tenantId ?? event.tenantId;
+    if (isSystemTenant(defTenantId)) {
+      await removeCustomFieldKeyFromAllTenants(tx, tableName, payload.fieldKey);
+    } else {
+      await removeCustomFieldKeyForTenant(tx, tableName, payload.fieldKey, defTenantId);
+    }
+  };
 
-        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-        // Scope cleanup to the deleted definition's owning tenant. System-scope
-        // definitions apply to every tenant → cascade across all rows; tenant-
-        // scope deletions must only touch that tenant's rows, else deleting one
-        // tenant's field strips the same kebab key from every tenant (data loss).
-        // Fallback to the event's stream tenantId for events appended before the
-        // payload carried tenantId.
-        const defTenantId = payload.tenantId ?? event.tenantId;
-        if (isSystemTenant(defTenantId)) {
-          await removeCustomFieldKeyFromAllTenants(tx, tableName, payload.fieldKey);
-        } else {
-          await removeCustomFieldKeyForTenant(tx, tableName, payload.fieldKey, defTenantId);
-        }
-      },
+  r.multiStreamProjection({
+    name: `custom-fields-${entityName}-projection`,
+    apply: {
+      [setEventType]: applyCustomFieldSet,
+      [clearedEventType]: applyCustomFieldCleared,
+      [fieldDefDeletedType]: applyFieldDefinitionDeleted,
+    },
+  });
+
+  // Rebuild-wiring (#759): ohne das replayt rebuildProjection nur die
+  // entity-lifecycle-Events und resettet jede customFields-jsonb auf ihr
+  // Default `{}` — die Werte existieren ausschließlich als customField.set/
+  // .cleared-Events. set/cleared reiten auf dem HOST-entity-Stream
+  // (aggregateType = entityName, von source schon abgedeckt);
+  // fieldDefinition.deleted lebt auf dem "field-definition"-Stream und
+  // kommt deshalb als extra source dazu.
+  r.extendEntityProjection(entityName, {
+    sources: [FIELD_DEFINITION_AGGREGATE_TYPE],
+    apply: {
+      [setEventType]: applyCustomFieldSet,
+      [clearedEventType]: applyCustomFieldCleared,
+      [fieldDefDeletedType]: applyFieldDefinitionDeleted,
     },
   });
 

package/src/data-retention/__tests__/parse-override.test.ts

@@ -1,6 +1,14 @@
-import { describe, expect, spyOn, test } from "bun:test";
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
 import { parseRetentionOverrideOrNull } from "../_internal/parse-override";
 
+// A mid-test assertion throw skips the trailing `warn.mockRestore()` in that
+// test, leaving the spy live for every test after it (551/1) — this backstop
+// restores unconditionally regardless of how the test exited.
+afterEach(() => {
+  const warn = console.warn as unknown as { mockRestore?: () => void };
+  warn.mockRestore?.();
+});
+
 // parseRetentionOverrideOrNull is the read boundary for a tenant's stored
 // data-retention override (DSGVO-relevant policy in a config column). It must
 // never let a corrupt or schema-violating value reach the retention decision:
@@ -31,19 +39,17 @@ describe("parseRetentionOverrideOrNull", () => {
   });
 
   test("corrupt JSON returns null without throwing", () => {
-    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    spyOn(console, "warn").mockImplementation(() => {});
     expect(() => parse("{not json")).not.toThrow();
     expect(parse("{not json")).toBeNull();
-    warn.mockRestore();
   });
 
   test("JSON that parses but violates the schema is dropped to null — never leaked through", () => {
-    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    spyOn(console, "warn").mockImplementation(() => {});
     expect(parse('{"strategy":"delete"}')).toBeNull(); // enum drift
     expect(parse('{"keepFor":"30days"}')).toBeNull(); // keepFor format drift
     expect(parse('{"keepFor":42}')).toBeNull(); // wrong type
     expect(parse('{"unknownKey":1}')).toBeNull(); // strict() rejects extra keys
-    warn.mockRestore();
   });
 
   test("each dropped value surfaces exactly one operator warning", () => {
@@ -51,6 +57,5 @@ describe("parseRetentionOverrideOrNull", () => {
     parse("{not json");
     parse('{"strategy":"delete"}');
     expect(warn).toHaveBeenCalledTimes(2);
-    warn.mockRestore();
   });
 });

package/src/data-retention/__tests__/retention-cleanup.integration.test.ts

@@ -13,12 +13,14 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { bridgeStub } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../feature";
 import { runRetentionCleanup } from "../run-retention-cleanup";
@@ -52,13 +54,37 @@ const staleEntity = createEntity({
   retention: { keepFor: "30d", strategy: "hardDelete", reference: "lastSeenAt" },
 });
 
+// blockDelete = Aufbewahrungspflicht (HGB/DSGVO-Presets: invoice/booking/
+// contract). Der Cleanup-Job muss diese Rows IGNORIEREN — nur user-forget
+// darf sie anonymisieren. Ein Regress im switch-Default oder im blockDelete-
+// Case, der sie trotzdem löscht, wäre schwerwiegender als ein verpasstes
+// hardDelete (Aufbewahrungspflicht-Verletzung statt nur "zu spät aufgeräumt").
+const retainedEntity = createEntity({
+  table: "read_c7_retained",
+  fields: {
+    label: createTextField({ required: true, anonymize: () => "[ANONYMIZED]" }),
+  },
+  retention: { keepFor: "30d", strategy: "blockDelete" },
+});
+
 const c7Feature = defineFeature("c7-retention-fixtures", (r) => {
   r.entity("c7-widget", widgetEntity);
   r.entity("c7-gadget", gadgetEntity);
   r.entity("c7-plain", plainEntity);
   r.entity("c7-stale", staleEntity);
+  r.entity("c7-retained", retainedEntity);
 });
 
+const noopLogger: JobContext["log"] = {
+  info() {},
+  warn() {},
+  error() {},
+  debug() {},
+  child() {
+    return noopLogger;
+  },
+};
+
 const T1 = "11111111-1111-1111-1111-111111111111";
 const T2 = "22222222-2222-2222-2222-222222222222";
 
@@ -75,6 +101,7 @@ beforeAll(async () => {
     gadgetEntity,
     plainEntity,
     staleEntity,
+    retainedEntity,
   ]) {
     await unsafeCreateEntityTable(stack.db, e);
   }
@@ -111,7 +138,13 @@ async function liveGadgetLabels(tenantId: string): Promise<string[]> {
 }
 
 beforeEach(async () => {
-  for (const t of ["read_c7_widget", "read_c7_gadget", "read_c7_plain", "read_c7_stale"]) {
+  for (const t of [
+    "read_c7_widget",
+    "read_c7_gadget",
+    "read_c7_plain",
+    "read_c7_stale",
+    "read_c7_retained",
+  ]) {
     await asRawClient(stack.db).unsafe(`DELETE FROM ${t}`);
   }
 });
@@ -185,4 +218,46 @@ describe("runRetentionCleanup :: real postgres", () => {
     });
     expect(result.hardDeleted).toBe(0);
   });
+
+  test("the registered job handler resolves ctx.systemUser.tenantId and actually cleans up (not runRetentionCleanup called directly)", async () => {
+    // cleanup-cron-registration.test.ts only pins job metadata; runRetentionCleanup
+    // tests above call it directly, bypassing the handler body entirely — a bug in
+    // the ctx.systemUser?.tenantId ?? ctx._tenantId resolution or the throw-guard
+    // would be invisible to both. Invoke the ACTUAL registered handler.
+    await seed("read_c7_widget", T1, "expired-via-handler", pastIso);
+    await seed("read_c7_widget", T1, "fresh-via-handler", withinIso);
+
+    const job = stack.registry.getJob("data-retention:job:retention-cleanup");
+    expect(job).toBeDefined();
+    if (!job) return;
+
+    const ctx: JobContext = {
+      db: stack.db,
+      registry: stack.registry,
+      systemUser: { id: "system", tenantId: T1, roles: ["all"] },
+      log: noopLogger,
+      triggeredBy: null,
+      ...bridgeStub(),
+    };
+    await job.handler({}, ctx);
+
+    expect(await labels("read_c7_widget", T1)).toEqual(["fresh-via-handler"]);
+  });
+
+  test("blockDelete: past-cutoff rows are never touched by the cleanup job", async () => {
+    await seed("read_c7_retained", T1, "should-survive", pastIso);
+
+    const result = await runRetentionCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: T1,
+      tenantPreset: null,
+      now,
+    });
+
+    expect(await labels("read_c7_retained", T1)).toEqual(["should-survive"]);
+    expect(result.hardDeleted).toBe(0);
+    expect(result.softDeleted).toBe(0);
+    expect(result.anonymizeDeferred).not.toContain("c7-retained");
+  });
 });