@cosmicdrift/kumiko-bundled-features 0.112.0 → 0.113.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.112.0",
+  "version": "0.113.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -95,11 +95,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.112.0",
-    "@cosmicdrift/kumiko-framework": "0.112.0",
-    "@cosmicdrift/kumiko-headless": "0.112.0",
-    "@cosmicdrift/kumiko-renderer": "0.112.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.112.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.113.1",
+    "@cosmicdrift/kumiko-framework": "0.113.1",
+    "@cosmicdrift/kumiko-headless": "0.113.1",
+    "@cosmicdrift/kumiko-renderer": "0.113.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.113.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/handlers/login.write.ts

@@ -21,7 +21,7 @@ import {
   noMembership,
 } from "../errors";
 import { clearLockoutState, getLockoutState, recordFailedAttempt } from "../lockout-store";
-import { verifyPassword } from "../password-hashing";
+import { verifyDummyPassword, verifyPassword } from "../password-hashing";
 
 export type LoginHandlerOptions = {
   // When true, a valid (email + password) login fails with email_not_verified
@@ -74,6 +74,9 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       // Uniform response on any credential mismatch (no user, wrong password,
       // soft-deleted user) — prevents email enumeration.
       if (!found?.passwordHash || found.isDeleted) {
+        // Burn the same argon2 verify cost as the hit path so response
+        // latency doesn't reveal whether the email is registered (#774).
+        await verifyDummyPassword(event.payload.password);
         return invalidCredentials();
       }
 

package/src/auth-email-password/password-hashing.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
+
+const medianMs = async (fn: () => Promise<unknown>, runs = 5): Promise<number> => {
+  const samples: number[] = [];
+  for (let i = 0; i < runs; i++) {
+    const start = performance.now();
+    await fn();
+    samples.push(performance.now() - start);
+  }
+  samples.sort((a, b) => a - b);
+  return samples[Math.floor(samples.length / 2)] ?? 0;
+};
+
+// #774: the login no-user path must cost the same argon2 latency as a real
+// verify, otherwise response timing leaks whether an email is registered.
+describe("verifyDummyPassword (anti-enumeration timing)", () => {
+  test("resolves to void, never matches", async () => {
+    expect(await verifyDummyPassword("whatever")).toBeUndefined();
+  });
+
+  test("burns real argon2 cost, comparable to a failed verify (not a no-op)", async () => {
+    const realHash = await hashPassword("correct-horse-battery");
+    // warm the lazily-cached dummy hash so we time the verify, not the one-off hash
+    await verifyDummyPassword("warmup");
+
+    const realMs = await medianMs(() => verifyPassword(realHash, "wrong-password"));
+    const dummyMs = await medianMs(() => verifyDummyPassword("wrong-password"));
+
+    // A skipped miss-path (the bug) is sub-millisecond; a real argon2 verify
+    // is ~20ms. A half-of-real floor is a wide, non-flaky bound that still
+    // fails hard if the dummy verify is ever removed.
+    expect(dummyMs).toBeGreaterThan(realMs * 0.5);
+  });
+});

package/src/auth-email-password/password-hashing.ts

@@ -42,3 +42,14 @@ export async function verifyPassword(hashString: string, password: string): Prom
     return false;
   }
 }
+
+// Anti-enumeration timing equaliser (#774). The login handler runs this on
+// the no-user / no-hash path so a missing account costs the same argon2
+// latency as a real verify — otherwise response timing leaks whether an
+// email is registered. Derived from hashPassword once and cached, so it
+// always tracks HASH_OPTIONS; the password never matches, result discarded.
+let dummyHash: Promise<string> | undefined;
+export async function verifyDummyPassword(password: string): Promise<void> {
+  dummyHash ??= hashPassword("anti-enumeration-dummy");
+  await verifyPassword(await dummyHash, password);
+}

package/src/auth-email-password/web/__tests__/use-url-token.test.tsx

@@ -0,0 +1,29 @@
+import { describe, expect, test } from "bun:test";
+import { renderHook } from "@testing-library/react";
+import { useUrlToken } from "../auth-form-primitives";
+
+// #774: magic-link tokens must not linger in browser history / Referer.
+// useUrlToken reads the token once, then scrubs the param via replaceState.
+// (dom.preload resets window.location to http://localhost/ after each test.)
+describe("useUrlToken (magic-link history hygiene)", () => {
+  test("reads ?token= and strips it from the URL, keeping other params", () => {
+    window.history.replaceState(null, "", "http://localhost/reset?token=secret-abc&keep=1");
+    const { result } = renderHook(() => useUrlToken());
+    expect(result.current).toBe("secret-abc");
+    expect(window.location.search).toBe("?keep=1");
+  });
+
+  test("no token param → URL untouched", () => {
+    window.history.replaceState(null, "", "http://localhost/reset?keep=1");
+    const { result } = renderHook(() => useUrlToken());
+    expect(result.current).toBe("");
+    expect(window.location.search).toBe("?keep=1");
+  });
+
+  test("explicit override short-circuits both URL read and scrub", () => {
+    window.history.replaceState(null, "", "http://localhost/reset?token=url-token");
+    const { result } = renderHook(() => useUrlToken("prop-token"));
+    expect(result.current).toBe("prop-token");
+    expect(window.location.search).toBe("?token=url-token");
+  });
+});

package/src/auth-email-password/web/auth-form-primitives.tsx

@@ -17,7 +17,7 @@
 
 import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
 import { BareFormProvider, cn } from "@cosmicdrift/kumiko-renderer-web";
-import { createContext, type ReactNode, useContext } from "react";
+import { createContext, type ReactNode, useContext, useEffect, useState } from "react";
 
 // Wrappt die zentrierte Auth-Card in ihre Umgebung. Default = Fullscreen-
 // zentriert (Standalone-Auth-Page). Eine Apex-/Marketing-Chrome reicht über
@@ -106,3 +106,20 @@ export function parseUrlToken(paramName = "token"): string {
   if (typeof window === "undefined") return "";
   return new URLSearchParams(window.location.search).get(paramName) ?? "";
 }
+
+// Reads the magic-link token from `?<paramName>=` once on mount, then strips
+// that param from the URL via history.replaceState so the single-use token
+// doesn't linger in browser history / Referer (#774). An explicit `override`
+// (server-injected token) short-circuits both the URL read and the scrub.
+export function useUrlToken(override?: string, paramName = "token"): string {
+  const [token] = useState(() => override ?? parseUrlToken(paramName));
+  useEffect(() => {
+    if (override !== undefined) return;
+    if (typeof window === "undefined") return;
+    const url = new URL(window.location.href);
+    if (!url.searchParams.has(paramName)) return;
+    url.searchParams.delete(paramName);
+    window.history.replaceState(window.history.state, "", url.toString());
+  }, [override, paramName]);
+  return token;
+}

package/src/auth-email-password/web/invite-accept-screen.tsx

@@ -19,7 +19,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useContext, useState } from "react";
 import { csrfHeader } from "./auth-client";
-import { AuthCard, authMutedLinkClass, parseUrlToken } from "./auth-form-primitives";
+import { AuthCard, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
 import { SessionContext, UNAUTHENTICATED } from "./session";
 
 export type InviteAcceptScreenProps = {
@@ -47,7 +47,7 @@ export function InviteAcceptScreen({
   // <SessionProvider> ancestor. Read the context directly and fall back to
   // the anonymous state when no provider wraps this screen (632/1).
   const session = useContext(SessionContext) ?? UNAUTHENTICATED;
-  const [token] = useState(() => tokenProp ?? parseUrlToken());
+  const token = useUrlToken(tokenProp);
   const [mode, setMode] = useState<Mode>(() =>
     session.status === "authenticated" ? "loggedin" : "anon-existing",
   );

package/src/auth-email-password/web/reset-password-screen.tsx

@@ -5,20 +5,15 @@
 // Code (anti-enumeration); UI zeigt unified "Link ungültig oder
 // abgelaufen"-message.
 //
-// Token-Quelle ist read-once: wir lesen via parseUrlToken() einmalig
-// im useState-Initializer. Apps die das anders brauchen (server-
-// injected Token-Prop, andere Parameter-Namen) reichen einen
-// expliziten `token` als Prop durch.
+// Token-Quelle ist read-once via useUrlToken(): liest `?token=...` beim
+// Mount und scrubbt den Param danach aus der URL (#774). Apps die das
+// anders brauchen (server-injected Token-Prop) reichen `token` als Prop
+// durch — dann bleibt die URL unangetastet.
 
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { resetPassword } from "./auth-client";
-import {
-  AuthCard,
-  authButtonClass,
-  authMutedLinkClass,
-  parseUrlToken,
-} from "./auth-form-primitives";
+import { AuthCard, authButtonClass, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
 
 export type ResetPasswordScreenProps = {
   readonly title?: string;
@@ -37,7 +32,7 @@ export function ResetPasswordScreen({
 }: ResetPasswordScreenProps): ReactNode {
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner } = usePrimitives();
-  const [token] = useState(() => tokenProp ?? parseUrlToken());
+  const token = useUrlToken(tokenProp);
   const [newPassword, setNewPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
   const [submitting, setSubmitting] = useState(false);

package/src/auth-email-password/web/signup-complete-screen.tsx

@@ -6,9 +6,9 @@
 // Server JWT + Cookies (Auto-Login!) und liefert tenantKey für den
 // Post-Signup-Redirect.
 //
-// Token-Quelle ist read-once: parseUrlToken im useState-Initializer.
-// Apps die einen anderen URL-Param nutzen, reichen `token` als Prop
-// durch.
+// Token-Quelle ist read-once via useUrlToken: liest `?token=...` beim
+// Mount und scrubbt den Param danach aus der URL (#774). Apps die einen
+// server-injected Token nutzen, reichen `token` als Prop durch.
 //
 // Nach success: redirect via window.location.assign zu loggedInHref.
 // Default-Pattern ist "/<tenantKey>/" — die App reicht ein Template
@@ -18,7 +18,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { confirmSignup } from "./auth-client";
-import { AuthCard, authMutedLinkClass, parseUrlToken } from "./auth-form-primitives";
+import { AuthCard, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
 
 export type SignupCompleteScreenProps = {
   readonly title?: string;
@@ -44,7 +44,7 @@ export function SignupCompleteScreen({
 }: SignupCompleteScreenProps): ReactNode {
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner } = usePrimitives();
-  const [token] = useState(() => tokenProp ?? parseUrlToken());
+  const token = useUrlToken(tokenProp);
   const [password, setPassword] = useState("");
   const [confirmPassword, setConfirmPassword] = useState("");
   const [submitting, setSubmitting] = useState(false);

package/src/auth-email-password/web/user-menu.tsx

@@ -33,7 +33,9 @@ export type UserMenuProps = {
    *  controlliert der Caller — wir packen nur den Frame drumrum. */
   readonly children?: ReactNode;
   /** "pill" (Default) = kompakter Topbar-Trigger; "sidebar" = volle NavUser-
-   *  Row (Avatar + Name + Email) für den `sidebarFooter`-Slot der App-Shell. */
+   *  Row (Avatar + Name + Email) für den `sidebarFooter`-Slot der App-Shell.
+   *  Requires a `SidebarProvider` ancestor (547/3) — the default App-Shell
+   *  `sidebarFooter` slot already provides one. */
   readonly variant?: UserMenuVariant;
 };
 

package/src/auth-email-password/web/verify-email-screen.tsx

@@ -13,12 +13,7 @@
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useEffect, useRef, useState } from "react";
 import { verifyEmail } from "./auth-client";
-import {
-  AuthCard,
-  authButtonClass,
-  authMutedLinkClass,
-  parseUrlToken,
-} from "./auth-form-primitives";
+import { AuthCard, authButtonClass, authMutedLinkClass, useUrlToken } from "./auth-form-primitives";
 
 export type VerifyEmailScreenProps = {
   readonly title?: string;
@@ -36,7 +31,7 @@ export function VerifyEmailScreen({
   loginHref = "/login",
 }: VerifyEmailScreenProps): ReactNode {
   const t = useTranslation();
-  const [token] = useState(() => tokenProp ?? parseUrlToken());
+  const token = useUrlToken(tokenProp);
   const [status, setStatus] = useState<Status>(token === "" ? "missing-token" : "verifying");
   const startedRef = useRef(false);
 

package/src/custom-fields/events.ts

@@ -15,6 +15,12 @@ export const customFieldSetSchema = z.object({
   // self-projected into the host row by the write handler and must never enter
   // the immutable log. Non-sensitive sets always carry the value.
   value: z.unknown().optional(),
+  // Explicit protocol marker (527/1) — `value === undefined` alone is also a
+  // valid-looking "clear" shape; `_sensitive` names the reason so a future
+  // reader can't mistake one for the other. Optional so historical events
+  // (persisted before this field existed) still parse: apply-side readers
+  // keep `value === undefined` as their actual branch condition.
+  _sensitive: z.literal(true).optional(),
 });
 export type CustomFieldSetPayload = z.infer<typeof customFieldSetSchema>;
 

package/src/custom-fields/handlers/set-custom-field.write.ts

@@ -135,7 +135,7 @@ export const setCustomFieldHandler: WriteHandlerDef = {
       aggregateType: payload.entityName,
       type: customFieldsFeature.exports.setEvent.name,
       payload: sensitive
-        ? { fieldKey: payload.fieldKey }
+        ? { fieldKey: payload.fieldKey, _sensitive: true as const }
         : { fieldKey: payload.fieldKey, value: payload.value },
     });
 

package/src/custom-fields/handlers/update-tenant-field.write.ts

@@ -65,6 +65,16 @@ export const updateTenantFieldHandler: WriteHandlerDef = {
     // values already written to host rows by past sets (set-custom-field only
     // routes the PII-safe path at write time). To change sensitivity, delete +
     // re-define (the honest cut — same rationale as the type guard above).
+    //
+    // 527/2 — even that "honest cut" is incomplete: it clears the projection
+    // row, but kumiko_events is immutable, so historical customField.set
+    // events from the field's non-sensitive era keep their plaintext values
+    // in the log forever. There is no event-payload redaction mechanism for
+    // this today (EventStoreExecutor.forget() hard-deletes a projection row
+    // and is rebuild-safe, but doesn't touch or redact past event payloads).
+    // A tenant that genuinely needs those values erased needs an operator-run
+    // data-retention pass over the raw event log — not something this
+    // handler, or delete-and-redefine, can give them.
     const currentSensitive = parseSerializedField(existing["serializedField"])?.sensitive === true;
     const requestedSensitive = payload.serializedField.sensitive === true;
     if (currentSensitive !== requestedSensitive) {

package/src/custom-fields/wire-for-entity.ts

@@ -107,10 +107,22 @@ export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
 
     // skip: sensitive fields self-project in the write handler (see
     // set-custom-field) and persist a value-less event so PII never enters
-    // the log. Such events arrive here with value === undefined — skipping
-    // is correct both live (the handler already wrote the row) and on replay
-    // (the value is intentionally gone, the accepted rebuild-loss).
-    if (payload.value === undefined) return;
+    // the log. Skipping is correct both live (the handler already wrote the
+    // row) and on replay (the value is intentionally gone, the accepted
+    // rebuild-loss). `value === undefined` stays the actual branch condition
+    // (historical events predate `_sensitive`) — the warning below is a
+    // canary (527/1): a NEW event missing both means something emitted a
+    // value-less customField.set outside the sensitive-field path.
+    if (payload.value === undefined) {
+      if (payload._sensitive !== true) {
+        // biome-ignore lint/suspicious/noConsole: boot-adjacent correctness canary, no logger available in an apply function
+        console.warn(
+          `[custom-fields] customField.set for "${payload.fieldKey}" on ${event.aggregateType}/${event.aggregateId} has no value and no _sensitive marker — skipping, but this event didn't come from the known sensitive-field path.`,
+        );
+      }
+      // skip: value-less set, handled above (warned if unexpectedly so)
+      return;
+    }
 
     // jsonb_set: setze key auf value. Wenn key noch nicht existiert →
     // wird angelegt (create_missing=true ist default). value muss als

package/src/data-retention/__tests__/parse-override.test.ts

@@ -9,13 +9,8 @@ afterEach(() => {
   warn.mockRestore?.();
 });
 
-// parseRetentionOverrideOrNull is the read boundary for a tenant's stored
-// data-retention override (DSGVO-relevant policy in a config column). It must
-// never let a corrupt or schema-violating value reach the retention decision:
-// invalid JSON and schema drift both collapse to null (the resolver then falls
-// back to preset/entity defaults) AND surface one operator warning. The schema
-// itself is covered by override-schema.test.ts — this pins the parser's
-// defensive wrapping: empty guard, no-throw on corruption, drop-not-leak on drift.
+// DSGVO invariant: corrupt or schema-drifted overrides collapse to null +
+// warn, never leak through (schema itself is covered by override-schema.test.ts).
 
 const parse = (raw: string | null) => parseRetentionOverrideOrNull(raw, "tenant-1", "test");
 

package/src/folders/web/__tests__/tree.test.ts

@@ -55,4 +55,12 @@ describe("folderPath", () => {
   test("unknown id → empty string", () => {
     expect(folderPath(rows, "nope")).toBe("");
   });
+
+  // 658/4: a parentId cycle must terminate at the row-count cap, not loop
+  // forever or run one iteration past it.
+  test("a parentId cycle terminates instead of looping forever", () => {
+    const cyclic = [f("x", "X", "y"), f("y", "Y", "x")];
+    expect(() => folderPath(cyclic, "x")).not.toThrow();
+    expect(folderPath(cyclic, "x").split(" / ")).toHaveLength(cyclic.length);
+  });
 });

package/src/folders/web/folder-manager.tsx

@@ -47,9 +47,7 @@ export type FolderLeaf = {
   readonly label: string;
   readonly trailing?: ReactNode;
   readonly onOpen?: () => void;
-  // Overrides filing.entityType for this leaf — lets one filing tree hold leaves
-  // of mixed entity types (e.g. credits + Bausparverträge), each filed/cleared
-  // under its own type. Omit for single-type trees.
+  // Overrides filing.entityType (mixed-entity-type trees); omit for single-type trees.
   readonly entityType?: string;
 };
 

package/src/folders/web/tree.ts

@@ -31,6 +31,15 @@ export function buildFolderTree(rows: readonly FolderRow[]): readonly FolderNode
     if (siblings) siblings.push(row);
     else byParent.set(key, [row]);
   }
+  // visited guards against a parent cycle recursing forever (658/4) —
+  // currently impossible (no reparent feature yet), but cheap insurance for
+  // when one lands; a cyclic node's subtree just stops re-descending.
+  // No cycle guard needed (658/4, verified not just asserted): build() only
+  // descends via byParent[parentId] starting from roots (parentId === null
+  // or dangling) — a row in a cycle has a non-null, existing parentId by
+  // definition, so it can never be a root, and each row contributes exactly
+  // one parentId edge, so nothing outside a cycle points into it either. A
+  // pure a<->b cycle is structurally unreachable from build(null).
   const build = (parentId: string | null, depth: number): readonly FolderNode[] =>
     (byParent.get(parentId) ?? [])
       .slice()
@@ -41,12 +50,14 @@ export function buildFolderTree(rows: readonly FolderRow[]): readonly FolderNode
 
 // "Immobilie Berlin / Person Müller" for a folder id, walking parentId up.
 // Empty string if the id is unknown. The row-count cap stops a (currently
-// impossible — no reparent yet) parent cycle from spinning forever.
+// impossible — no reparent yet) parent cycle from spinning forever — `< `,
+// not `<=` (658/4): a cycle of exactly rows.length nodes must stop AT the
+// cap, not run one iteration past it.
 export function folderPath(rows: readonly FolderRow[], id: string, separator = " / "): string {
   const byId = new Map(rows.map((r) => [r.id, r]));
   const names: string[] = [];
   let current = byId.get(id);
-  for (let i = 0; current !== undefined && i <= rows.length; i += 1) {
+  for (let i = 0; current !== undefined && i < rows.length; i += 1) {
     names.unshift(current.name);
     current = current.parentId !== null ? byId.get(current.parentId) : undefined;
   }

package/src/ledger/__tests__/ledger.integration.test.ts

@@ -371,8 +371,8 @@ describe("ledger integration — confirm-schedule-period (recurring)", () => {
     scheduleId: string,
     period: string,
     amount?: number,
-  ): Promise<{ id: string }> {
-    return stack.http.writeOk<{ id: string }>(
+  ): Promise<{ id: string; alreadyBooked: boolean }> {
+    return stack.http.writeOk<{ id: string; alreadyBooked: boolean }>(
       LedgerHandlers.confirmSchedulePeriod,
       amount === undefined ? { scheduleId, period } : { scheduleId, period, amount },
       admin,
@@ -384,7 +384,10 @@ describe("ledger integration — confirm-schedule-period (recurring)", () => {
     const rent = await createAccount("Mieterträge", "income");
     const scheduleId = await createSchedule(bank, rent);
 
-    await confirm(scheduleId, "2026-01");
+    const fresh = await confirm(scheduleId, "2026-01");
+    // 684/6: fresh bookings carry alreadyBooked: false, same shape as the
+    // idempotent-path response — no "does the field even exist" check needed.
+    expect(fresh.alreadyBooked).toBe(false);
 
     const rows = await listTransactions();
     expect(rows).toHaveLength(1);
@@ -405,6 +408,8 @@ describe("ledger integration — confirm-schedule-period (recurring)", () => {
     const second = await confirm(scheduleId, "2026-01");
 
     expect(second.id).toBe(first.id);
+    expect(first.alreadyBooked).toBe(false);
+    expect(second.alreadyBooked).toBe(true);
     expect(await listTransactions()).toHaveLength(1);
   });
 

package/src/ledger/handlers/confirm-schedule-period.write.ts

@@ -94,7 +94,7 @@ export function createConfirmSchedulePeriodHandler(
       }
 
       const amount = payload.amount ?? Number(schedule["amount"]);
-      return transactionExecutor.create(
+      const created = await transactionExecutor.create(
         {
           id: generateId(),
           date: payload.date ?? `${payload.period}-01`,
@@ -109,6 +109,14 @@ export function createConfirmSchedulePeriodHandler(
         event.user,
         ctx.db,
       );
+      // Same shape as the idempotent-path return above (684/6) — a caller
+      // shouldn't have to check "does alreadyBooked exist" to know which
+      // branch fired.
+      if (!created.isSuccess) return created;
+      return {
+        isSuccess: true,
+        data: { ...created.data, alreadyBooked: false as const },
+      };
     },
   };
 }

package/src/legal-pages/feature.ts

@@ -26,9 +26,7 @@ type ByslugQueryBody = {
   data: { title: string; body: string | null; updatedAt: string } | null;
 };
 
-// Legal-Content ändert sich selten — ein 60s-Shared-Cache-Fenster spart den
-// Origin-Revalidate-Roundtrip (jeder 304 re-runt sonst die Content-Query),
-// ohne dass Edits spürbar stale wirken.
+// 60s-shared-cache saves the origin-revalidate roundtrip; legal-content edits are live within 60s.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 
 // legal-pages — Opt-in-Wrapper um text-content für DACH-Compliance.

package/src/managed-pages/feature.ts

@@ -28,9 +28,7 @@ import { pageEntity } from "./table";
 // Alias (publicstatus = "Admin") müssen TenantAdmin granten/mappen.
 const ADMIN_ACCESS = { roles: ["TenantAdmin", "SystemAdmin"] } as const;
 
-// Published CMS-Content ändert sich selten — ein 60s-Shared-Cache-Fenster
-// spart den Origin-Revalidate-Roundtrip (jeder 304 re-runt sonst Page- +
-// Branding-Query), Edits sind nach spätestens 60s live.
+// 60s-shared-cache saves the origin-revalidate roundtrip; CMS edits are live within 60s.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 
 // QN-Konstante als dokumentierter Public-Contract — der Render-Pfad ruft

package/src/tags/__tests__/schemas.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, test } from "bun:test";
+import { assignTagPayloadSchema } from "../schemas";
+
+// 456/3: tagAssignmentAggregateId joins tenantId/tagId/entityType/entityId
+// with "|" to derive the stream id — a literal "|" in entityType/entityId
+// could shift tuple boundaries and collide with an unrelated combination.
+describe("assignTagPayloadSchema — no pipe in entityType/entityId", () => {
+  test("accepts normal values", () => {
+    const parsed = assignTagPayloadSchema.safeParse({
+      tagId: "tag-1",
+      entityType: "credit",
+      entityId: "entity-1",
+    });
+    expect(parsed.success).toBe(true);
+  });
+
+  test("rejects a pipe in entityType", () => {
+    const parsed = assignTagPayloadSchema.safeParse({
+      tagId: "tag-1",
+      entityType: "credit|forged",
+      entityId: "entity-1",
+    });
+    expect(parsed.success).toBe(false);
+  });
+
+  test("rejects a pipe in entityId", () => {
+    const parsed = assignTagPayloadSchema.safeParse({
+      tagId: "tag-1",
+      entityType: "credit",
+      entityId: "entity|forged",
+    });
+    expect(parsed.success).toBe(false);
+  });
+});

package/src/tags/__tests__/tags.integration.test.ts

@@ -358,6 +358,11 @@ describe("tags integration — multi-tenant isolation", () => {
 // "Admin", not "TenantAdmin"). Default-mounted tags deny that same user.
 describe("tags integration — openToAll access model", () => {
   let openStack: TestStack;
+  // Dedicated stack (477/1), not the outer file's `stack` — a describe-level
+  // `--test-name-pattern` run of just this block would otherwise crash on an
+  // undefined outer `stack` instead of failing cleanly, and this block
+  // shouldn't depend on describe-execution order for its setup to exist.
+  let defaultStack: TestStack;
   // role deliberately not in DEFAULT_TAG_ROLES nor "Admin" — proves openToAll,
   // not an accidental role match.
   const unprivileged = createTestUser({ roles: ["Viewer"] });
@@ -369,10 +374,16 @@ describe("tags integration — openToAll access model", () => {
     await unsafeCreateEntityTable(openStack.db, tagEntity);
     await unsafeCreateEntityTable(openStack.db, tagAssignmentEntity);
     await createEventsTable(openStack.db);
+
+    defaultStack = await setupTestStack({ features: [tagsFeature] });
+    await unsafeCreateEntityTable(defaultStack.db, tagEntity);
+    await unsafeCreateEntityTable(defaultStack.db, tagAssignmentEntity);
+    await createEventsTable(defaultStack.db);
   });
 
   afterAll(async () => {
     await openStack.cleanup();
+    await defaultStack.cleanup();
   });
 
   test("a non-tag-role user can create, assign, list and remove", async () => {
@@ -409,7 +420,7 @@ describe("tags integration — openToAll access model", () => {
   });
 
   test("the SAME user is denied on a default-role-mounted feature", async () => {
-    const denied = await stack.http.writeErr(
+    const denied = await defaultStack.http.writeErr(
       TagsHandlers.createTag,
       { name: "nope" },
       unprivileged,

package/src/tags/entity.ts

@@ -6,7 +6,12 @@ import { createEntity, createTextField } from "@cosmicdrift/kumiko-framework/eng
 export const tagEntity = createEntity({
   table: "read_tags",
   fields: {
-    name: createTextField({ required: true, maxLength: 64 }),
+    // Catalog labels ("urgent", "billing"), not user-identifying content —
+    // allowPlaintext silences the user-content heuristic (456/5). A tenant
+    // COULD name a tag after a person; if that becomes a real requirement,
+    // this needs a userOwned annotation + forget/export hooks in the
+    // user-data-rights pipeline (none exist for tags today).
+    name: createTextField({ required: true, maxLength: 64, allowPlaintext: "catalog-label" }),
     // Optional UI hint (hex or token). No enforcement — purely for rendering.
     color: createTextField({ maxLength: 32 }),
     // Optional entity-type scope (GitLab project-vs-group labels): empty = global

package/src/tags/schemas.ts

@@ -41,10 +41,17 @@ export const deleteTagPayloadSchema = z.object({
 export type DeleteTagPayload = z.infer<typeof deleteTagPayloadSchema>;
 
 // assign + remove share the (tag, entity) reference shape.
+// entityType/entityId are app-supplied, unlike tagId (always a real tag's
+// UUID) — tagAssignmentAggregateId joins all four with "|" to derive the
+// stream id, so a literal "|" in either could shift tuple boundaries and
+// collide with an unrelated (tenant, tag, entity) combination (456/3).
+// Rejecting it here is cheaper and non-breaking compared to changing the
+// derivation's separator, which would re-key every existing stream.
+const NO_PIPE = /^[^|]*$/;
 const entityTagRef = {
   tagId: z.string().min(1).max(64),
-  entityType: z.string().min(1).max(64),
-  entityId: z.string().min(1).max(128),
+  entityType: z.string().min(1).max(64).regex(NO_PIPE, 'entityType must not contain "|"'),
+  entityId: z.string().min(1).max(128).regex(NO_PIPE, 'entityId must not contain "|"'),
 } as const;
 
 export const assignTagPayloadSchema = z.object(entityTagRef);

package/src/tags/web/__tests__/tag-manager.test.tsx

@@ -0,0 +1,64 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { fireEvent, render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { defaultTranslations } from "../i18n";
+import { TagManager } from "../tag-manager";
+
+type TagRow = { id: string; name: string; color?: string; scope?: string; version: number };
+
+let catalogRows: readonly TagRow[] = [];
+
+beforeEach(() => {
+  catalogRows = [{ id: "t1", name: "urgent", color: "#ef4444", version: 1 }];
+});
+
+const dispatchSpy = mock(async () => ({ isSuccess: true, data: undefined }));
+
+const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
+mock.module("@cosmicdrift/kumiko-renderer", () => ({
+  ...actual_renderer,
+  useDispatcher: mock(() => ({ write: dispatchSpy, query: mock(), batch: mock() })),
+  useQuery: mock(() => ({
+    data: { rows: catalogRows },
+    loading: false,
+    error: null,
+    refetch: mock(),
+  })),
+}));
+
+function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <LocaleProvider resolver={createStaticLocaleResolver()} fallbackBundles={[defaultTranslations]}>
+      <PrimitivesProvider value={defaultPrimitives}>{children}</PrimitivesProvider>
+    </LocaleProvider>
+  );
+}
+
+// 695/4: saveEdit silently no-ops on an empty trimmed name — the Save button
+// must reflect that in its disabled state, not just in the click handler.
+describe("TagManager — edit Save button", () => {
+  test("Save is disabled once the name is cleared to empty/whitespace", () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("tag-manager-edit-btn-t1"));
+
+    const save = screen.getByTestId("tag-manager-save-t1") as HTMLButtonElement;
+    expect(save.disabled).toBe(false);
+
+    const nameInput = document.getElementById("tag-edit-name-t1") as HTMLInputElement;
+    fireEvent.change(nameInput, { target: { value: "   " } });
+    expect(save.disabled).toBe(true);
+
+    fireEvent.change(nameInput, { target: { value: "renamed" } });
+    expect(save.disabled).toBe(false);
+  });
+});

package/src/tags/web/tag-manager.tsx

@@ -308,7 +308,7 @@ export function TagManager({
                 <div className="flex gap-2">
                   <Button
                     variant="primary"
-                    disabled={busy}
+                    disabled={busy || editName.trim() === ""}
                     onClick={() => saveEdit(tag)}
                     testId={`tag-manager-save-${tag.id}`}
                   >

package/src/user-data-rights/feature.ts

@@ -249,9 +249,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     r.queryHandler(myAuditLogQuery);
     r.queryHandler(listDownloadAttemptsQuery);
 
-    // Read-only operator inspector over the GDPR read-models (SystemAdmin).
-    // Convention list/detail handlers so entityList/entityEdit resolve by QN;
-    // the screens stay inert until an app navs them (opt-in at wire time).
+    // Read-only GDPR operator inspector (SystemAdmin) — screens stay inert until an app navs them.
     r.queryHandler(exportJobListQuery);
     r.queryHandler(exportJobDetailQuery);
     r.queryHandler(downloadAttemptListQuery);

package/src/user-data-rights/web/client-plugin.tsx

@@ -45,5 +45,10 @@ export function userDataRightsClient(
     },
   };
   if (options?.publicDeletion === undefined) return base;
-  return { ...base, gates: [makePublicDeletionGate(options.publicDeletion)] };
+  // Extend, not overwrite (570/2) — base.gates is empty today, but a spread
+  // that clobbers it instead of appending would silently drop future gates.
+  return {
+    ...base,
+    gates: [...(base.gates ?? []), makePublicDeletionGate(options.publicDeletion)],
+  };
 }

package/src/user-profile/__tests__/profile-screen.test.tsx

@@ -76,6 +76,10 @@ describe("ProfileScreen", () => {
     expect(view.getByTestId("profile-email")).toBeTruthy();
     expect(view.getByTestId("profile-password")).toBeTruthy();
     expect(view.getByTestId("profile-danger")).toBeTruthy();
+    // 607/4: page heading is <h1> (Heading variant="page") — the danger-zone
+    // title must be <h2>, not Card's default <h3>, so the levels don't skip.
+    expect(view.getByTestId("profile-danger").querySelector("h2")).not.toBeNull();
+    expect(view.getByTestId("profile-danger").querySelector("h3")).toBeNull();
     expect(view.getByTestId("profile-email-current").textContent).toContain("marc@example.com");
     expect(view.getByTestId("profile-danger-delete")).toBeTruthy();
     // Echte i18n: kein einziger roher Key im sichtbaren Text.

package/src/user-profile/web/profile-screen.tsx

@@ -246,6 +246,17 @@ function DangerZoneSection({
 }): ReactNode {
   const t = useTranslation();
   const { Button, Banner, Dialog, Card } = usePrimitives();
+  // Card.slots.title always renders <h3> — with the page's <h1> (variant="page")
+  // as this screen's only other heading, that skips <h2> (607/4). An explicit
+  // header slot with a real <h2> keeps the levels contiguous; layout mirrors
+  // DefaultCard's own default-header markup.
+  const dangerZoneHeader = (
+    <div className="flex flex-wrap items-start justify-between gap-3 px-6 pt-6 pb-4">
+      <h2 className="text-base font-semibold leading-none tracking-tight">
+        {t("profile.danger.title")}
+      </h2>
+    </div>
+  );
   const dispatcher = useDispatcher();
   const [dialogOpen, setDialogOpen] = useState(false);
   const [status, setStatus] = useState<SectionStatus>({ kind: "idle" });
@@ -290,7 +301,7 @@ function DangerZoneSection({
     <Card
       testId="profile-danger"
       className="border-destructive/40"
-      slots={{ title: t("profile.danger.title"), footer }}
+      slots={{ header: dangerZoneHeader, footer }}
     >
       <div className="flex flex-col gap-4">
         {deletionRequested ? (