@cosmicdrift/kumiko-bundled-features 0.113.1 → 1.0.0

package/src/custom-fields/handlers/update-tenant-field.write.ts

@@ -65,16 +65,6 @@ export const updateTenantFieldHandler: WriteHandlerDef = {
     // values already written to host rows by past sets (set-custom-field only
     // routes the PII-safe path at write time). To change sensitivity, delete +
     // re-define (the honest cut — same rationale as the type guard above).
-    //
-    // 527/2 — even that "honest cut" is incomplete: it clears the projection
-    // row, but kumiko_events is immutable, so historical customField.set
-    // events from the field's non-sensitive era keep their plaintext values
-    // in the log forever. There is no event-payload redaction mechanism for
-    // this today (EventStoreExecutor.forget() hard-deletes a projection row
-    // and is rebuild-safe, but doesn't touch or redact past event payloads).
-    // A tenant that genuinely needs those values erased needs an operator-run
-    // data-retention pass over the raw event log — not something this
-    // handler, or delete-and-redefine, can give them.
     const currentSensitive = parseSerializedField(existing["serializedField"])?.sensitive === true;
     const requestedSensitive = payload.serializedField.sensitive === true;
     if (currentSensitive !== requestedSensitive) {

package/src/custom-fields/wire-for-entity.ts

@@ -1,4 +1,4 @@
-import { type DbRunner, extractTableName } from "@cosmicdrift/kumiko-framework/db";
+import { extractTableName } from "@cosmicdrift/kumiko-framework/db";
 import {
   createJsonbField,
   type FeatureRegistrar,
@@ -6,8 +6,7 @@ import {
   type JsonbFieldDef,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import type { StoredEvent } from "@cosmicdrift/kumiko-framework/event-store";
-import { CUSTOM_FIELDS_EXTENSION, FIELD_DEFINITION_AGGREGATE_TYPE } from "./constants";
+import { CUSTOM_FIELDS_EXTENSION } from "./constants";
 import {
   clearCustomFieldKey,
   removeCustomFieldKeyForTenant,
@@ -37,9 +36,8 @@ export function customFieldsField(): JsonbFieldDef {
 
 // Vollständige integration der custom-fields-Bundle für eine spezifische
 // host-entity. Eine einzige Aufruf-Stelle pro consumer registriert ALLE
-// wiring-Aspekte: extension-tracking, MSP für value-projection, rebuild-
-// replay via extendEntityProjection, postQuery-hook für API-flatten,
-// search-payload-extension für indexable customFields.
+// wiring-Aspekte: extension-tracking, MSP für value-projection, postQuery-
+// hook für API-flatten, search-payload-extension für indexable customFields.
 //
 // Consumer-side:
 //
@@ -63,20 +61,15 @@ export function customFieldsField(): JsonbFieldDef {
 //      emittiert haben. Updated entityTable.customFields jsonb über
 //      jsonb_set / jsonb-key-removal.
 //
-//   3. r.extendEntityProjection — hängt dieselben apply-Handler in die
-//      implicit projection der host-entity, damit rebuildProjection die
-//      customField-Events mit-replayt. Ohne das fällt customFields bei
-//      jedem Entity-Rebuild (Schema-Migration!) auf `{}` zurück (#759).
-//
-//   4. r.entityHook("postQuery", entity, flatten-fn) — bei JEDEM Read auf
+//   3. r.entityHook("postQuery", entity, flatten-fn) — bei JEDEM Read auf
 //      diese entity wird `row.customFields` jsonb auf root-level expanded
 //      damit die API-response wie Stammfelder aussieht.
 //
-//   5. r.searchPayloadExtension(entity, contributor) — searchable
+//   4. r.searchPayloadExtension(entity, contributor) — searchable
 //      customFields-keys werden flach ins Meilisearch-Index-Doc beigetragen
 //      (F3-wiring).
 //
-//   6. fieldDefinition.deleted-Event-Handler im selben MSP — bei delete
+//   5. fieldDefinition.deleted-Event-Handler im selben MSP — bei delete
 //      einer fieldDefinition werden orphan values aus allen entity-rows
 //      entfernt (key-removal pro fieldKey).
 export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
@@ -94,112 +87,80 @@ export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
   const clearedEventType = customFieldsFeature.exports.clearedEvent.name;
   const fieldDefDeletedType = customFieldsFeature.exports.fieldDefinitionDeletedEvent.name;
 
-  // Geteilte apply-Bodies: die MSP liefert sie live (async cursor), die
-  // entity-projection-extension replayt sie in rebuildProjection — gleiche
-  // SQL-Helper, beide idempotent. 2-Param-Signatur ist die gemeinsame
-  // Teilmenge von MultiStreamApplyFn und SingleStreamApplyFn.
-  const applyCustomFieldSet = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
-    // skip: feuert für ALLE aggregate-types die customField.set emittieren —
-    // wir wollen nur die unserer wired host-entity. Andere consumers haben
-    // eigene Wirings für ihre Entities.
-    if (event.aggregateType !== entityName) return;
-    const payload = event.payload as CustomFieldSetPayload; // @cast-boundary engine-payload
-
-    // skip: sensitive fields self-project in the write handler (see
-    // set-custom-field) and persist a value-less event so PII never enters
-    // the log. Skipping is correct both live (the handler already wrote the
-    // row) and on replay (the value is intentionally gone, the accepted
-    // rebuild-loss). `value === undefined` stays the actual branch condition
-    // (historical events predate `_sensitive`) — the warning below is a
-    // canary (527/1): a NEW event missing both means something emitted a
-    // value-less customField.set outside the sensitive-field path.
-    if (payload.value === undefined) {
-      if (payload._sensitive !== true) {
-        // biome-ignore lint/suspicious/noConsole: boot-adjacent correctness canary, no logger available in an apply function
-        console.warn(
-          `[custom-fields] customField.set for "${payload.fieldKey}" on ${event.aggregateType}/${event.aggregateId} has no value and no _sensitive marker — skipping, but this event didn't come from the known sensitive-field path.`,
-        );
-      }
-      // skip: value-less set, handled above (warned if unexpectedly so)
-      return;
-    }
-
-    // jsonb_set: setze key auf value. Wenn key noch nicht existiert →
-    // wird angelegt (create_missing=true ist default). value muss als
-    // jsonb-literal kommen.
-    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-    await setCustomFieldValue(
-      tx,
-      tableName,
-      payload.fieldKey,
-      payload.value,
-      event.aggregateId,
-      event.tenantId,
-    );
-  };
-
-  const applyCustomFieldCleared = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
-    // skip: feuert für alle aggregate-types — nur unsere host-entity
-    // verarbeiten.
-    if (event.aggregateType !== entityName) return;
-    const payload = event.payload as CustomFieldClearedPayload; // @cast-boundary engine-payload
-
-    // jsonb minus operator (`-`) entfernt key aus jsonb-object.
-    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-    await clearCustomFieldKey(tx, tableName, payload.fieldKey, event.aggregateId, event.tenantId);
-  };
-
-  const applyFieldDefinitionDeleted = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
-    // fieldDefinition.deleted fires nur einmal pro fieldDef-delete
-    // (NICHT per-entity). Wir entfernen den key aus ALLEN rows der host-
-    // entity falls die deleted-fieldDef für diese entity galt.
-    const payload = event.payload as {
-      entityName: string;
-      fieldKey: string;
-      tenantId?: TenantId;
-    }; // @cast-boundary engine-payload
-    // skip: fieldDefinition.deleted feuert für ALLE fieldDefs cross-entity;
-    // nur wenn die deleted-fieldDef diese host-entity betraf, cleanen wir
-    // ihre Rows.
-    if (payload.entityName !== entityName) return;
-
-    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-    // Scope cleanup to the deleted definition's owning tenant. System-scope
-    // definitions apply to every tenant → cascade across all rows; tenant-
-    // scope deletions must only touch that tenant's rows, else deleting one
-    // tenant's field strips the same kebab key from every tenant (data loss).
-    // Fallback to the event's stream tenantId for events appended before the
-    // payload carried tenantId.
-    const defTenantId = payload.tenantId ?? event.tenantId;
-    if (isSystemTenant(defTenantId)) {
-      await removeCustomFieldKeyFromAllTenants(tx, tableName, payload.fieldKey);
-    } else {
-      await removeCustomFieldKeyForTenant(tx, tableName, payload.fieldKey, defTenantId);
-    }
-  };
-
   r.multiStreamProjection({
     name: `custom-fields-${entityName}-projection`,
     apply: {
-      [setEventType]: applyCustomFieldSet,
-      [clearedEventType]: applyCustomFieldCleared,
-      [fieldDefDeletedType]: applyFieldDefinitionDeleted,
-    },
-  });
+      [setEventType]: async (event, tx) => {
+        // skip: MSP feuert für ALLE aggregate-types die customField.set
+        // emittieren — wir wollen nur die unserer wired host-entity.
+        // Andere consumers haben eigene MSPs für ihre Entities.
+        if (event.aggregateType !== entityName) return;
+        const payload = event.payload as CustomFieldSetPayload; // @cast-boundary engine-payload
 
-  // Rebuild-wiring (#759): ohne das replayt rebuildProjection nur die
-  // entity-lifecycle-Events und resettet jede customFields-jsonb auf ihr
-  // Default `{}` — die Werte existieren ausschließlich als customField.set/
-  // .cleared-Events. set/cleared reiten auf dem HOST-entity-Stream
-  // (aggregateType = entityName, von source schon abgedeckt);
-  // fieldDefinition.deleted lebt auf dem "field-definition"-Stream und
-  // kommt deshalb als extra source dazu.
-  r.extendEntityProjection(entityName, {
-    sources: [FIELD_DEFINITION_AGGREGATE_TYPE],
-    apply: {
-      [setEventType]: applyCustomFieldSet,
-      [clearedEventType]: applyCustomFieldCleared,
-      [fieldDefDeletedType]: applyFieldDefinitionDeleted,
+        // skip: sensitive fields self-project in the write handler (see
+        // set-custom-field) and persist a value-less event so PII never enters
+        // the log. Such events arrive here with value === undefined — skipping
+        // is correct both live (the handler already wrote the row) and on replay
+        // (the value is intentionally gone, the accepted rebuild-loss).
+        if (payload.value === undefined) return;
+
+        // jsonb_set: setze key auf value. Wenn key noch nicht existiert →
+        // wird angelegt (create_missing=true ist default). value muss als
+        // jsonb-literal kommen.
+        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+        await setCustomFieldValue(
+          tx,
+          tableName,
+          payload.fieldKey,
+          payload.value,
+          event.aggregateId,
+          event.tenantId,
+        );
+      },
+      [clearedEventType]: async (event, tx) => {
+        // skip: MSP feuert für alle aggregate-types — nur unsere host-entity
+        // verarbeiten.
+        if (event.aggregateType !== entityName) return;
+        const payload = event.payload as CustomFieldClearedPayload; // @cast-boundary engine-payload
+
+        // jsonb minus operator (`-`) entfernt key aus jsonb-object.
+        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+        await clearCustomFieldKey(
+          tx,
+          tableName,
+          payload.fieldKey,
+          event.aggregateId,
+          event.tenantId,
+        );
+      },
+      [fieldDefDeletedType]: async (event, tx) => {
+        // fieldDefinition.deleted fires nur einmal pro fieldDef-delete
+        // (NICHT per-entity). Wir entfernen den key aus ALLEN rows der host-
+        // entity falls die deleted-fieldDef für diese entity galt.
+        const payload = event.payload as {
+          entityName: string;
+          fieldKey: string;
+          tenantId?: TenantId;
+        }; // @cast-boundary engine-payload
+        // skip: fieldDefinition.deleted feuert für ALLE fieldDefs cross-entity;
+        // nur wenn die deleted-fieldDef diese host-entity betraf, cleanen wir
+        // ihre Rows.
+        if (payload.entityName !== entityName) return;
+
+        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+        // Scope cleanup to the deleted definition's owning tenant. System-scope
+        // definitions apply to every tenant → cascade across all rows; tenant-
+        // scope deletions must only touch that tenant's rows, else deleting one
+        // tenant's field strips the same kebab key from every tenant (data loss).
+        // Fallback to the event's stream tenantId for events appended before the
+        // payload carried tenantId.
+        const defTenantId = payload.tenantId ?? event.tenantId;
+        if (isSystemTenant(defTenantId)) {
+          await removeCustomFieldKeyFromAllTenants(tx, tableName, payload.fieldKey);
+        } else {
+          await removeCustomFieldKeyForTenant(tx, tableName, payload.fieldKey, defTenantId);
+        }
+      },
     },
   });
 

package/src/data-retention/__tests__/parse-override.test.ts

@@ -1,16 +1,13 @@
-import { afterEach, describe, expect, spyOn, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
 import { parseRetentionOverrideOrNull } from "../_internal/parse-override";
 
-// A mid-test assertion throw skips the trailing `warn.mockRestore()` in that
-// test, leaving the spy live for every test after it (551/1) — this backstop
-// restores unconditionally regardless of how the test exited.
-afterEach(() => {
-  const warn = console.warn as unknown as { mockRestore?: () => void };
-  warn.mockRestore?.();
-});
-
-// DSGVO invariant: corrupt or schema-drifted overrides collapse to null +
-// warn, never leak through (schema itself is covered by override-schema.test.ts).
+// parseRetentionOverrideOrNull is the read boundary for a tenant's stored
+// data-retention override (DSGVO-relevant policy in a config column). It must
+// never let a corrupt or schema-violating value reach the retention decision:
+// invalid JSON and schema drift both collapse to null (the resolver then falls
+// back to preset/entity defaults) AND surface one operator warning. The schema
+// itself is covered by override-schema.test.ts — this pins the parser's
+// defensive wrapping: empty guard, no-throw on corruption, drop-not-leak on drift.
 
 const parse = (raw: string | null) => parseRetentionOverrideOrNull(raw, "tenant-1", "test");
 
@@ -34,17 +31,19 @@ describe("parseRetentionOverrideOrNull", () => {
   });
 
   test("corrupt JSON returns null without throwing", () => {
-    spyOn(console, "warn").mockImplementation(() => {});
+    const warn = spyOn(console, "warn").mockImplementation(() => {});
     expect(() => parse("{not json")).not.toThrow();
     expect(parse("{not json")).toBeNull();
+    warn.mockRestore();
   });
 
   test("JSON that parses but violates the schema is dropped to null — never leaked through", () => {
-    spyOn(console, "warn").mockImplementation(() => {});
+    const warn = spyOn(console, "warn").mockImplementation(() => {});
     expect(parse('{"strategy":"delete"}')).toBeNull(); // enum drift
     expect(parse('{"keepFor":"30days"}')).toBeNull(); // keepFor format drift
     expect(parse('{"keepFor":42}')).toBeNull(); // wrong type
     expect(parse('{"unknownKey":1}')).toBeNull(); // strict() rejects extra keys
+    warn.mockRestore();
   });
 
   test("each dropped value surfaces exactly one operator warning", () => {
@@ -52,5 +51,6 @@ describe("parseRetentionOverrideOrNull", () => {
     parse("{not json");
     parse('{"strategy":"delete"}');
     expect(warn).toHaveBeenCalledTimes(2);
+    warn.mockRestore();
   });
 });

package/src/file-foundation/__tests__/file-foundation.integration.test.ts

@@ -4,7 +4,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
@@ -18,7 +18,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createMutableMasterKeyProvider,
-  createTestEnvelopeCipher,
   type MutableMasterKeyProvider,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { z } from "zod";
@@ -74,8 +73,8 @@ let providerRef: MutableMasterKeyProvider;
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(testEncryptionKey);
-  resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(testEncryptionKey);
+  resolver = createConfigResolver({ encryption });
 
   const initialKp = createEnvMasterKeyProvider({
     env: {

package/src/folders/__tests__/folders.integration.test.ts

@@ -331,7 +331,6 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
     await seedOneFolderWithAssignment();
     const ctx = {
       db: stack.db,
-      registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
       tenantModel: "multi-user" as const,
@@ -346,7 +345,6 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
     await seedOneFolderWithAssignment();
     const ctx = {
       db: stack.db,
-      registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
       tenantModel: "single-user" as const,
@@ -361,7 +359,6 @@ describe("folders-user-data — tenantScopedDelete hooks", () => {
     await seedOneFolderWithAssignment();
     const ctx = {
       db: stack.db,
-      registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
       tenantModel: "single-user" as const,

package/src/folders/web/__tests__/tree.test.ts

@@ -55,12 +55,4 @@ describe("folderPath", () => {
   test("unknown id → empty string", () => {
     expect(folderPath(rows, "nope")).toBe("");
   });
-
-  // 658/4: a parentId cycle must terminate at the row-count cap, not loop
-  // forever or run one iteration past it.
-  test("a parentId cycle terminates instead of looping forever", () => {
-    const cyclic = [f("x", "X", "y"), f("y", "Y", "x")];
-    expect(() => folderPath(cyclic, "x")).not.toThrow();
-    expect(folderPath(cyclic, "x").split(" / ")).toHaveLength(cyclic.length);
-  });
 });

package/src/folders/web/folder-manager.tsx

@@ -47,7 +47,9 @@ export type FolderLeaf = {
   readonly label: string;
   readonly trailing?: ReactNode;
   readonly onOpen?: () => void;
-  // Overrides filing.entityType (mixed-entity-type trees); omit for single-type trees.
+  // Overrides filing.entityType for this leaf — lets one filing tree hold leaves
+  // of mixed entity types (e.g. credits + Bausparverträge), each filed/cleared
+  // under its own type. Omit for single-type trees.
   readonly entityType?: string;
 };
 

package/src/folders/web/i18n.ts

@@ -18,6 +18,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "folders.section.working": "Speichert…",
 
     "folders.manager.loading": "Lädt…",
+    "folders.manager.empty": "Noch keine Ordner.",
     "folders.manager.newRoot": "Neuer Ordner",
     "folders.manager.add": "Anlegen",
     "folders.manager.addChild": "Unterordner",
@@ -43,6 +44,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "folders.section.working": "Saving…",
 
     "folders.manager.loading": "Loading…",
+    "folders.manager.empty": "No folders yet.",
     "folders.manager.newRoot": "New folder",
     "folders.manager.add": "Create",
     "folders.manager.addChild": "Subfolder",

package/src/folders/web/tree.ts

@@ -31,15 +31,6 @@ export function buildFolderTree(rows: readonly FolderRow[]): readonly FolderNode
     if (siblings) siblings.push(row);
     else byParent.set(key, [row]);
   }
-  // visited guards against a parent cycle recursing forever (658/4) —
-  // currently impossible (no reparent feature yet), but cheap insurance for
-  // when one lands; a cyclic node's subtree just stops re-descending.
-  // No cycle guard needed (658/4, verified not just asserted): build() only
-  // descends via byParent[parentId] starting from roots (parentId === null
-  // or dangling) — a row in a cycle has a non-null, existing parentId by
-  // definition, so it can never be a root, and each row contributes exactly
-  // one parentId edge, so nothing outside a cycle points into it either. A
-  // pure a<->b cycle is structurally unreachable from build(null).
   const build = (parentId: string | null, depth: number): readonly FolderNode[] =>
     (byParent.get(parentId) ?? [])
       .slice()
@@ -50,14 +41,12 @@ export function buildFolderTree(rows: readonly FolderRow[]): readonly FolderNode
 
 // "Immobilie Berlin / Person Müller" for a folder id, walking parentId up.
 // Empty string if the id is unknown. The row-count cap stops a (currently
-// impossible — no reparent yet) parent cycle from spinning forever — `< `,
-// not `<=` (658/4): a cycle of exactly rows.length nodes must stop AT the
-// cap, not run one iteration past it.
+// impossible — no reparent yet) parent cycle from spinning forever.
 export function folderPath(rows: readonly FolderRow[], id: string, separator = " / "): string {
   const byId = new Map(rows.map((r) => [r.id, r]));
   const names: string[] = [];
   let current = byId.get(id);
-  for (let i = 0; current !== undefined && i < rows.length; i += 1) {
+  for (let i = 0; current !== undefined && i <= rows.length; i += 1) {
     names.unshift(current.name);
     current = current.parentId !== null ? byId.get(current.parentId) : undefined;
   }

package/src/folders-user-data/__tests__/hooks.integration.test.ts

@@ -57,7 +57,6 @@ describe("folderAssignmentExportHook", () => {
 
     const snippet = await folderAssignmentExportHook({
       db: stack.db,
-      registry: stack.registry,
       tenantId: admin.tenantId,
       userId: admin.id,
     });

package/src/folders-user-data/index.ts

@@ -16,10 +16,10 @@ export const foldersUserDataFeature = defineFeature("folders-user-data", (r) =>
   r.describe(
     "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `folders` feature's `folder` + `folder-assignment` entities. Mounts the EXT_USER_DATA export + delete hooks so a tenant's folder tree and its entity-to-folder assignments are included in the user-data export bundle and erased on a tenant-scoped forget (single-user tenants only; multi-user + anonymize are no-ops since folder rows carry no per-user PII). Kept separate from `folders` so folder consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `folders`.",
   );
-  // user-data-rights is the hard dependency (EXT_USER_DATA host). `folders` is
-  // OPTIONAL: if it's mounted toggleable(default=false) (e.g. per-tenant via
-  // tier), a hard r.requires would throw an "effectively disabled" boot
-  // warning even though the folder entities exist and the hooks work fine.
+  // user-data-rights ist die harte Abhängigkeit (EXT_USER_DATA-Host). `folders` ist
+  // OPTIONAL: ist es toggleable(default=false) gemountet (z.B. per-Tenant via Tier),
+  // würde ein hartes r.requires eine „effectively disabled"-Boot-Warnung werfen,
+  // obwohl die folder-Entities existieren und die Hooks korrekt greifen.
   r.requires("user-data-rights");
   r.optionalRequires("folders");
   r.useExtension(EXT_USER_DATA, "folder", {

package/src/jobs/__tests__/job-system-user.integration.test.ts

@@ -1,6 +1,10 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEncryptionProvider,
+  createTenantDb,
+  type DbConnection,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createRegistry,
@@ -22,7 +26,7 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { bridgeStub, createTestEnvelopeCipher, sleep } from "@cosmicdrift/kumiko-framework/testing";
+import { bridgeStub, sleep } from "@cosmicdrift/kumiko-framework/testing";
 import { ConfigHandlers } from "../../config/constants";
 import { createConfigAccessor, createConfigFeature } from "../../config/feature";
 import { type ConfigResolver, createConfigResolver } from "../../config/resolver";
@@ -103,8 +107,8 @@ beforeAll(async () => {
   await createEventsTable(db);
   await createArchivedStreamsTable(db);
 
-  const encryption = createTestEnvelopeCipher(testEncryptionKey);
-  resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(testEncryptionKey);
+  resolver = createConfigResolver({ encryption });
 
   registry = createRegistry([configFeature, billingFeature]);
 

package/src/jobs/handlers/projection-rebuild.job.ts

@@ -6,15 +6,10 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
 import { z } from "zod";
 
-export const projectionRebuildPayloadSchema = z.object({
-  projection: z.string().min(1),
-  // Quarantine mode (#760): skip + dead-letter poison events instead of
-  // failing the whole rebuild. Operator opt-in per run.
-  skipApplyErrors: z.boolean().optional(),
-});
+export const projectionRebuildPayloadSchema = z.object({ projection: z.string().min(1) });
 
 export const projectionRebuildJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
-  const { projection, skipApplyErrors } = projectionRebuildPayloadSchema.parse(rawPayload);
+  const { projection } = projectionRebuildPayloadSchema.parse(rawPayload);
   if (!ctx.db) {
     throw new InternalError({
       message:
@@ -28,13 +23,8 @@ export const projectionRebuildJob: JobHandlerFn = async (rawPayload, ctx): Promi
     });
   }
   const db = ctx.db as DbConnection; // @cast-boundary db-operator
-  const result = await rebuildProjection(projection, {
-    db,
-    registry: ctx.registry,
-    ...(skipApplyErrors === true && { errorPolicy: { skipApplyErrors: true } }),
-  });
+  const result = await rebuildProjection(projection, { db, registry: ctx.registry });
   ctx.log?.info?.(
-    `[jobs:projection-rebuild] rebuilt ${projection}: ${result.eventsProcessed} events` +
-      `${result.eventsSkipped > 0 ? ` (${result.eventsSkipped} quarantined)` : ""} in ${result.durationMs}ms`,
+    `[jobs:projection-rebuild] rebuilt ${projection}: ${result.eventsProcessed} events in ${result.durationMs}ms`,
   );
 };

package/src/ledger/__tests__/ledger.integration.test.ts

@@ -371,8 +371,8 @@ describe("ledger integration — confirm-schedule-period (recurring)", () => {
     scheduleId: string,
     period: string,
     amount?: number,
-  ): Promise<{ id: string; alreadyBooked: boolean }> {
-    return stack.http.writeOk<{ id: string; alreadyBooked: boolean }>(
+  ): Promise<{ id: string }> {
+    return stack.http.writeOk<{ id: string }>(
       LedgerHandlers.confirmSchedulePeriod,
       amount === undefined ? { scheduleId, period } : { scheduleId, period, amount },
       admin,
@@ -384,10 +384,7 @@ describe("ledger integration — confirm-schedule-period (recurring)", () => {
     const rent = await createAccount("Mieterträge", "income");
     const scheduleId = await createSchedule(bank, rent);
 
-    const fresh = await confirm(scheduleId, "2026-01");
-    // 684/6: fresh bookings carry alreadyBooked: false, same shape as the
-    // idempotent-path response — no "does the field even exist" check needed.
-    expect(fresh.alreadyBooked).toBe(false);
+    await confirm(scheduleId, "2026-01");
 
     const rows = await listTransactions();
     expect(rows).toHaveLength(1);
@@ -408,8 +405,6 @@ describe("ledger integration — confirm-schedule-period (recurring)", () => {
     const second = await confirm(scheduleId, "2026-01");
 
     expect(second.id).toBe(first.id);
-    expect(first.alreadyBooked).toBe(false);
-    expect(second.alreadyBooked).toBe(true);
     expect(await listTransactions()).toHaveLength(1);
   });
 

package/src/ledger/handlers/confirm-schedule-period.write.ts

@@ -13,7 +13,7 @@ import {
   transactionExecutor,
   transactionTable,
 } from "../executor";
-import { findReversedIds, isoMonth, scheduleReference } from "../recurring";
+import { isoMonth, scheduleReference } from "../recurring";
 import { type ConfirmSchedulePeriodPayload, confirmSchedulePeriodPayloadSchema } from "../schemas";
 
 // confirm-schedule-period — turn ONE projected period of a schedule into a posted,
@@ -78,13 +78,8 @@ export function createConfirmSchedulePeriodHandler(
               reference: { in: candidateIds },
             })
           : [];
-      const reversedIds = findReversedIds(
-        [...candidates, ...stornos].map((r) => ({
-          id: String(r["id"]),
-          reference: r["reference"] === null ? null : String(r["reference"]),
-        })),
-      );
-      const active = candidates.find((r) => !reversedIds.has(String(r["id"])));
+      const reversedCandidateIds = new Set(stornos.map((r) => String(r["reference"])));
+      const active = candidates.find((r) => !reversedCandidateIds.has(String(r["id"])));
       if (active) {
         const ok: WriteResult<{ id: string; alreadyBooked: true }> = {
           isSuccess: true,
@@ -94,7 +89,7 @@ export function createConfirmSchedulePeriodHandler(
       }
 
       const amount = payload.amount ?? Number(schedule["amount"]);
-      const created = await transactionExecutor.create(
+      return transactionExecutor.create(
         {
           id: generateId(),
           date: payload.date ?? `${payload.period}-01`,
@@ -109,14 +104,6 @@ export function createConfirmSchedulePeriodHandler(
         event.user,
         ctx.db,
       );
-      // Same shape as the idempotent-path return above (684/6) — a caller
-      // shouldn't have to check "does alreadyBooked exist" to know which
-      // branch fired.
-      if (!created.isSuccess) return created;
-      return {
-        isSuccess: true,
-        data: { ...created.data, alreadyBooked: false as const },
-      };
     },
   };
 }