@cosmicdrift/kumiko-bundled-features 0.165.0 → 0.165.2

package/src/tenant-lifecycle/handlers/cancel-destruction.write.ts

@@ -2,8 +2,8 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
+import { isWithinGracePeriod } from "../../shared";
 import { type TenantLifecycleStatus, tenantEntity, tenantTable } from "../../tenant";
 import { DESTRUCTION_CANCELLED_EVENT_QN } from "../constants";
 import { invalidateTenantLifecycleGate } from "../lifecycle-gate";
@@ -33,11 +33,7 @@ export const cancelDestructionWrite = defineWriteHandler({
       );
     }
 
-    const gracePeriodEnd = row.gracePeriodEnd;
-    const inGrace =
-      gracePeriodEnd != null &&
-      Temporal.Instant.compare(gracePeriodEnd, getTemporal().Now.instant()) > 0;
-    if (!inGrace) {
+    if (!isWithinGracePeriod(row.gracePeriodEnd)) {
       return writeFailure(
         new UnprocessableError("grace_period_expired", {
           details: { reason: "grace_period_expired" },

package/src/tenant-settings/__tests__/tenant-settings.integration.test.ts

@@ -0,0 +1,94 @@
+// Package-level cases the recipe does NOT cover: unknown field at define time,
+// and missing tenant-settings mount fails loud when currency is omitted.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  configValuesTable,
+  createConfigAccessorFactory,
+  createConfigFeature,
+  createConfigResolver,
+} from "@cosmicdrift/kumiko-bundled-features/config";
+import {
+  createEntity,
+  createMoneyField,
+  createSelectField,
+  createTextField,
+  defineFeature,
+  type SessionUser,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  pushEntityProjectionTables,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { defineCreateWithTenantDefaults } from "../tenant-defaults";
+
+const invoiceEntity = createEntity({
+  table: "read_invoices",
+  fields: {
+    title: createTextField({ required: true }),
+    amount: createMoneyField({ required: true }),
+    language: createSelectField({ options: ["en", "de"] as const }),
+  },
+});
+
+const ACCESS = { roles: ["Admin"] } as const;
+
+test("defineCreateWithTenantDefaults throws on an unknown currency field", () => {
+  expect(() =>
+    defineCreateWithTenantDefaults("invoice", invoiceEntity, {
+      access: ACCESS,
+      currencyFields: ["notARealField"],
+    }),
+  ).toThrow(/unknown field "notARealField"/);
+});
+
+describe("without tenant-settings mount", () => {
+  const invoiceFeature = defineFeature("invoice", (r) => {
+    r.entity("invoice", invoiceEntity);
+    r.writeHandler(
+      defineCreateWithTenantDefaults("invoice", invoiceEntity, {
+        access: ACCESS,
+        currencyFields: ["amount"],
+        localeField: "language",
+      }),
+    );
+  });
+
+  const tenantId = testTenantId(1);
+  const admin: SessionUser = { id: "admin-1", tenantId, roles: ["Admin"] };
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    // config feature only — no createTenantSettingsFeature()
+    stack = await setupTestStack({
+      features: [createConfigFeature(), invoiceFeature],
+      extraContext: ({ registry }) => ({
+        configResolver: resolver,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+      }),
+    });
+    await unsafePushTables(stack.db, { configValuesTable });
+    await unsafeCreateEntityTable(stack.db, invoiceEntity);
+    await createEventsTable(stack.db);
+    await pushEntityProjectionTables(stack, stack.registry);
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  test("omitting money.currency fails loud (no silent feature-default fill)", async () => {
+    const err = await stack.http.writeErr(
+      "invoice:write:invoice:create",
+      { title: "Invoice", amount: { amount: 1000 } },
+      admin,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(400);
+  });
+});

package/src/tenant-settings/config.ts

@@ -0,0 +1,44 @@
+import {
+  access,
+  type ConfigKeyDefinition,
+  createTenantConfig,
+  DEFAULT_CURRENCIES,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// ISO-639-1, optional ISO-3166-1 region ("de" or "de-DE") — apps constrain
+// further via their own i18n setup; this only guards against garbage input.
+const LOCALE_PATTERN = { regex: "^[a-z]{2}(-[A-Z]{2})?$" } as const;
+
+export type TenantSettingsKeyOptions = {
+  /** Selectable currencies. Default: DEFAULT_CURRENCIES (engine). */
+  readonly currencies?: readonly string[];
+  /** Fallback when a tenant never set the key. Default: "EUR". */
+  readonly defaultCurrency?: string;
+  /** Fallback when a tenant never set the key. Default: "en". */
+  readonly defaultLocale?: string;
+  /** Who may change the tenant's settings. Default: access.admin. */
+  readonly write?: readonly string[];
+};
+
+export function buildTenantSettingsKeys(
+  opts: TenantSettingsKeyOptions = {},
+): Record<string, ConfigKeyDefinition> {
+  const write = opts.write ?? access.admin;
+  return {
+    // `mask` surfaces the key in the self-populating Settings-Hub (Tenant-
+    // Audience) without a hand-written r.screen/r.nav — see
+    // samples/recipes/managed-config for the mechanism.
+    currency: createTenantConfig("select", {
+      default: opts.defaultCurrency ?? "EUR",
+      options: opts.currencies ?? DEFAULT_CURRENCIES,
+      write,
+      mask: { title: "tenant-settings.currency", icon: "coins", order: 1 },
+    }),
+    locale: createTenantConfig("text", {
+      default: opts.defaultLocale ?? "en",
+      pattern: LOCALE_PATTERN,
+      write,
+      mask: { title: "tenant-settings.locale", icon: "languages", order: 2 },
+    }),
+  } satisfies Record<string, ConfigKeyDefinition>;
+}

package/src/tenant-settings/constants.ts

@@ -0,0 +1,16 @@
+// tenant-settings bundle constants — feature-name + qualified config names.
+//
+// Motivation (solon#P19): apps kept hard-coding a single currency/locale
+// literal per money/select field ("EUR", "de") instead of one per-tenant
+// setting — expensive to retrofit once a second tenant needs a different
+// default. This bundle is the one place that setting lives.
+
+export const TENANT_SETTINGS_FEATURE_NAME = "tenant-settings";
+
+// Qualified config key names (QN format: scope:config:name) for
+// ctx.config(...) reads. Clients reference the object instead of magic
+// strings (mirror tags' Handlers/Queries constants).
+export const TenantSettingsConfig = {
+  currency: "tenant-settings:config:currency",
+  locale: "tenant-settings:config:locale",
+} as const;

package/src/tenant-settings/feature.ts

@@ -0,0 +1,49 @@
+// tenant-settings — per-tenant Currency + Locale defaults.
+//
+// Any handler that needs a default (money-field currency, a locale-select
+// field, ...) reads it via `ctx.config(TenantSettingsConfig.currency)` /
+// `ctx.config(TenantSettingsConfig.locale)` — or use
+// `defineCreateWithTenantDefaults` (tenant-defaults.ts) to wire it into an
+// entity's create-handler without writing that plumbing by hand.
+//
+// No entities, no hand-written screen — `mask` on both keys makes them
+// surface in the self-populating Settings-Hub (Tenant-Audience) instead;
+// `buildConfigFeatureSchema` (config feature) derives the configEdit
+// screen + nav entry from the key's scope/type/mask, same mechanism as
+// samples/recipes/managed-config.
+
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { buildTenantSettingsKeys, type TenantSettingsKeyOptions } from "./config";
+import { TENANT_SETTINGS_FEATURE_NAME } from "./constants";
+
+export type TenantSettingsFeatureOptions = TenantSettingsKeyOptions;
+
+export function createTenantSettingsFeature(
+  opts: TenantSettingsFeatureOptions = {},
+): FeatureDefinition {
+  return defineFeature(TENANT_SETTINGS_FEATURE_NAME, (r) => {
+    r.requires("config");
+    r.describe(
+      "Per-tenant Currency + Locale defaults, exposed as two config keys (tenant-settings:config:currency, tenant-settings:config:locale) that surface in the self-populating Settings-Hub via `mask`. Pair with defineCreateWithTenantDefaults to auto-fill a money field's currency or a locale field on create instead of hard-coding a literal per entity.",
+    );
+    r.config({ keys: buildTenantSettingsKeys(opts) });
+    r.translations({
+      keys: {
+        "tenant-settings.currency": { de: "Standard-Währung", en: "Default Currency" },
+        "tenant-settings.locale": { de: "Standard-Sprache", en: "Default Locale" },
+        // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
+        // required by the i18n boot-validator whenever a feature masks config keys.
+        "screen:tenant-settings-system.title": {
+          de: "Tenant-Einstellungen",
+          en: "Tenant Settings",
+        },
+        "screen:tenant-settings-tenant.title": {
+          de: "Tenant-Einstellungen",
+          en: "Tenant Settings",
+        },
+      },
+    });
+  });
+}
+
+export const tenantSettingsFeature: FeatureDefinition = createTenantSettingsFeature();

package/src/tenant-settings/index.ts

@@ -0,0 +1,8 @@
+export { buildTenantSettingsKeys, type TenantSettingsKeyOptions } from "./config";
+export { TENANT_SETTINGS_FEATURE_NAME, TenantSettingsConfig } from "./constants";
+export {
+  createTenantSettingsFeature,
+  type TenantSettingsFeatureOptions,
+  tenantSettingsFeature,
+} from "./feature";
+export { defineCreateWithTenantDefaults } from "./tenant-defaults";

package/src/tenant-settings/tenant-defaults.ts

@@ -0,0 +1,72 @@
+// Wrapper around defineEntityCreateHandler: fills currency/locale fields from
+// tenant-settings config when the caller omits them — instead of repeating
+// field literals ("EUR"/"de") on every entity.
+//
+// buildInsertSchema always requires `currency` inside a money field (even when
+// the field itself is optional), so the caller cannot simply omit currency
+// without failing schema validation before the handler runs. This helper uses
+// a schema extension that makes those sub-keys optional, instead of the
+// generic defineEntityCreateHandler.
+
+import {
+  type AccessRule,
+  buildInsertSchema,
+  createEntityExecutor,
+  type EntityDefinition,
+  type WriteHandlerDef,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+import { TenantSettingsConfig } from "./constants";
+
+const OPTIONAL_CURRENCY_MONEY = z.object({ amount: z.number(), currency: z.string().optional() });
+
+export function defineCreateWithTenantDefaults(
+  entityName: string,
+  entity: EntityDefinition,
+  options: {
+    readonly access?: AccessRule;
+    /** Money field names whose `currency` is filled from tenant-settings when missing. */
+    readonly currencyFields?: readonly string[];
+    /** Field name (select/text) that receives the tenant locale when missing. */
+    readonly localeField?: string;
+  },
+): WriteHandlerDef {
+  const { executor } = createEntityExecutor(entityName, entity);
+  const relax: Record<string, z.ZodTypeAny> = {};
+  for (const field of options.currencyFields ?? []) {
+    const def = entity.fields[field];
+    if (!def) throw new Error(`defineCreateWithTenantDefaults: unknown field "${field}"`);
+    const isRequired = "required" in def && def.required === true;
+    relax[field] = isRequired ? OPTIONAL_CURRENCY_MONEY : OPTIONAL_CURRENCY_MONEY.optional();
+  }
+  const baseSchema = buildInsertSchema(entity);
+  const schema = Object.keys(relax).length > 0 ? baseSchema.extend(relax) : baseSchema;
+
+  return {
+    name: `${entityName}:create`,
+    schema,
+    ...(options.access && { access: options.access }),
+    handler: async (event, ctx) => {
+      const payload = { ...(event.payload as Record<string, unknown>) };
+
+      for (const field of options.currencyFields ?? []) {
+        const value = payload[field] as { amount?: number; currency?: string } | undefined;
+        if (value && typeof value === "object" && !value.currency) {
+          const currency = await ctx.config?.(TenantSettingsConfig.currency);
+          if (typeof currency === "string") payload[field] = { ...value, currency };
+        }
+      }
+      if (options.localeField && !payload[options.localeField]) {
+        const locale = await ctx.config?.(TenantSettingsConfig.locale);
+        if (typeof locale === "string") payload[options.localeField] = locale;
+      }
+
+      // Re-validate against the unrelaxed entity schema so config-filled
+      // values still honor select/enum field constraints (fw#1581) — and so
+      // a missing currency after failed/missing tenant-settings mount fails
+      // loud instead of inserting half-filled money rows.
+      const filled = baseSchema.parse(payload);
+      return executor.create(filled, event.user, ctx.db);
+    },
+  };
+}

package/src/text-content/__tests__/seed-legal-content.integration.test.ts

@@ -1,7 +1,7 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { type DbConnection, fetchOne } from "@cosmicdrift/kumiko-framework/db";
-import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { type DbConnection, fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   setupTestStack,
   type TestStack,
@@ -34,14 +34,19 @@ function read(slug: string, lang: string) {
 }
 
 describe("seedLegalContentFromJson", () => {
-  test("seeds all blocks into SYSTEM_TENANT_ID by default", async () => {
+  test("seeds all blocks into SYSTEM_TENANT_ID as SYSTEM_USER", async () => {
     const blocks: LegalContentBlock[] = [
       { slug: "imprint", lang: "de", title: "Impressum", body: "Marc Frost" },
       { slug: "imprint", lang: "en", title: "Imprint", body: "Marc Frost" },
     ];
     await seedLegalContentFromJson(db, blocks);
 
-    expect(await read("imprint", "de")).toMatchObject({ title: "Impressum", body: "Marc Frost" });
+    const de = (await read("imprint", "de")) as TextBlockRow & {
+      insertedById: string;
+      modifiedById: string | null;
+    };
+    expect(de).toMatchObject({ title: "Impressum", body: "Marc Frost" });
+    expect(de.insertedById).toBe(SYSTEM_USER_ID);
     expect(await read("imprint", "en")).toMatchObject({ title: "Imprint", body: "Marc Frost" });
   });
 
@@ -56,6 +61,28 @@ describe("seedLegalContentFromJson", () => {
       { slug: "privacy", lang: "de", title: "Datenschutz", body: "v2 + Sub-Processor-Tabelle" },
     ];
     await seedLegalContentFromJson(db, v2);
-    expect(await read("privacy", "de")).toMatchObject({ body: "v2 + Sub-Processor-Tabelle" });
+    const row = (await read("privacy", "de")) as TextBlockRow & { modifiedById: string };
+    expect(row).toMatchObject({ body: "v2 + Sub-Processor-Tabelle" });
+    expect(row.modifiedById).toBe(SYSTEM_USER_ID);
+  });
+
+  test("identical re-seed is a no-op (no update event, version/modifiedAt stable)", async () => {
+    const blocks: LegalContentBlock[] = [
+      { slug: "terms", lang: "de", title: "AGB", body: "stable" },
+    ];
+    await seedLegalContentFromJson(db, blocks);
+    const before = (await read("terms", "de")) as TextBlockRow & {
+      modifiedAt: unknown;
+    };
+    expect(before).not.toBeNull();
+
+    await seedLegalContentFromJson(db, blocks);
+    const after = (await read("terms", "de")) as TextBlockRow & { modifiedAt: unknown };
+    expect(after.version).toBe(before.version);
+    expect(after.body).toBe("stable");
+    expect(after.modifiedAt).toEqual(before.modifiedAt);
+
+    const events = await selectMany(db, eventsTable, { aggregateId: String(before.id) });
+    expect(events.map((e) => e.type)).toEqual(["text-block.created"]);
   });
 });

package/src/text-content/handlers/set.write.ts

@@ -83,8 +83,8 @@ export const setWrite = defineWriteHandler({
     // umgestellt werden, sonst läuft der event-store-Lookup
     // (getStreamVersion) gegen user.tenantId statt tenantId — und findet
     // den stream nicht → version_conflict obwohl die projection-row da ist.
-    // Symmetrisch zu seedTextBlock, das TestUsers.systemAdmin (tenantId =
-    // SYSTEM_TENANT) als by verwendet.
+    // Symmetric with seedTextBlock, which defaults by to
+    // createSystemUser(tenantId) so stream lookup and projection tenant match.
     const executorUser =
       override !== undefined ? { ...event.user, tenantId: override as TenantId } : event.user; // @cast-boundary engine-bridge
 

package/src/text-content/seeding.ts

@@ -1,7 +1,7 @@
-// Test-Helper für text-content. Legt einen TextBlock direkt über den
-// Event-Store-Executor an — gleicher Pfad wie der echte set-Handler,
-// aber ohne Access-Check. Default ifExists="skip": nur fehlende Blocks
-// anlegen; opt-in update für Demo-Fixtures.
+// Boot-/test-seed helpers for text-content. Creates a TextBlock via the
+// event-store executor — same path as the real set-handler, without the
+// access check. Default ifExists="skip": only missing blocks; opt-in
+// update for demo fixtures / legal template authority.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
@@ -10,12 +10,12 @@ import {
   type DbConnection,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
+  createSystemUser,
   type SessionUser,
   SYSTEM_TENANT_ID,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import { type TextBlockRow, textBlockEntity, textBlocksTable } from "./table";
 
 const executor = createEventStoreExecutor(textBlocksTable, textBlockEntity, {
@@ -28,10 +28,10 @@ export type SeedTextBlockOptions = {
   readonly lang: string;
   readonly title: string;
   readonly body?: string | null;
-  /** V.1.4: Folder-Pfad für Visual-Tree-Gruppierung. Optional + null =
-   *  root-node. Seed-Pfad bypasst slugSchema/folderSchema-Validation
-   *  (system-trusted), aber App-Builder sollten kebab-only nutzen damit
-   *  set.write die geseedete Row später überschreiben kann. */
+  /** V.1.4: Folder path for visual-tree grouping. Optional + null =
+   *  root node. Seed path bypasses slugSchema/folderSchema validation
+   *  (system-trusted), but app builders should keep kebab-only so
+   *  set.write can overwrite the seeded row later. */
   readonly folder?: string | null;
   readonly by?: SessionUser;
   readonly ifExists?: SeedIfExists;
@@ -41,15 +41,11 @@ export async function seedTextBlock(
   db: DbConnection,
   opts: SeedTextBlockOptions,
 ): Promise<{ id: string }> {
-  // Default-user muss user.tenantId === opts.tenantId haben, sonst
-  // landet der event-store-stream im user.tenantId-bucket aber die
-  // projection-row im opts.tenantId-bucket. Spätere echte writes via
-  // set-handler (mit korrektem tenant-context) finden den stream
-  // nicht → version_conflict. TestUsers.systemAdmin ist hardcoded
-  // testTenantId(1), nicht opts.tenantId — explizit überschreiben.
-  const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
-  // executor.create erwartet TenantDb — wrapping nötig damit die runtime-
-  // checks (tenant-scope-validation) greifen.
+  // Default actor is createSystemUser(tenantId) — same as config-seed —
+  // so prod boot seeds (legal pages) do not pull TestUsers / stack into
+  // the app bundle or stamp phantom test fixture IDs into the audit trail.
+  const by = opts.by ?? createSystemUser(opts.tenantId);
+  // executor.create expects TenantDb — wrap so runtime tenant-scope checks apply.
   const tdb = createTenantDb(db, opts.tenantId, "system");
 
   const existing = await fetchOne<TextBlockRow>(db, textBlocksTable, {
@@ -59,6 +55,7 @@ export async function seedTextBlock(
   });
 
   const folder = opts.folder ?? null;
+  const body = opts.body ?? null;
 
   return runEventStoreSeed({
     existing,
@@ -69,7 +66,7 @@ export async function seedTextBlock(
           slug: opts.slug,
           lang: opts.lang,
           title: opts.title,
-          body: opts.body ?? null,
+          body,
           folder,
           tenantId: opts.tenantId,
         },
@@ -79,9 +76,9 @@ export async function seedTextBlock(
       if (!result.isSuccess) {
         throw new Error(`seedTextBlock create failed: ${JSON.stringify(result)}`);
       }
-      // @cast-boundary db-row: executor.create result.data ist die
-      // inserted Drizzle-Row (Record<string, unknown>), projected
-      // nach INSERT/RETURNING auf TextBlockRow. Runtime-Check unten.
+      // @cast-boundary db-row: executor.create result.data is the
+      // inserted Drizzle row (Record<string, unknown>), projected
+      // after INSERT/RETURNING onto TextBlockRow. Runtime check below.
       const data = result.data as Partial<TextBlockRow>;
       if (data.id === undefined) {
         throw new Error("seedTextBlock: executor.create did not return an id");
@@ -89,11 +86,16 @@ export async function seedTextBlock(
       return { id: data.id };
     },
     update: async (row) => {
+      // Skip no-op updates so legal re-seed on every pod boot does not
+      // bump version/updatedAt (ETag / "last changed" / event-store growth).
+      if (row.title === opts.title && row.body === body && row.folder === folder) {
+        return { id: row.id };
+      }
       const result = await executor.update(
         {
           id: row.id,
           version: row.version,
-          changes: { title: opts.title, body: opts.body ?? null, folder },
+          changes: { title: opts.title, body, folder },
         },
         by,
         tdb,
@@ -113,17 +115,16 @@ export type LegalContentBlock = {
   readonly body: string;
 };
 
-// Boot-Seed für Legal-/Marketing-Texte aus einer JSON-Vorlage. `ifExists:
-// "update"` ist load-bearing: die Vorlage ist autoritativ, jeder Boot hebt
-// bestehende Blöcke auf den kompilierten Stand — sonst erreichen gesetzlich
-// vorgeschriebene Zusätze (z.B. Sub-Processor-Tabelle) bereits geseedete
-// Prod-Records nie. Genau diese Entscheidung soll keine App selbst treffen.
+// Boot-seed for legal/marketing copy from a JSON template. `ifExists:
+// "update"` is load-bearing: the template is authoritative — otherwise
+// legally required additions never reach already-seeded prod rows.
 export async function seedLegalContentFromJson(
   db: DbConnection,
   blocks: readonly LegalContentBlock[],
-  opts: { readonly tenantId?: TenantId } = {},
+  opts: { readonly tenantId?: TenantId; readonly by?: SessionUser } = {},
 ): Promise<void> {
   const tenantId = opts.tenantId ?? SYSTEM_TENANT_ID;
+  const by = opts.by ?? createSystemUser(tenantId);
   for (const block of blocks) {
     await seedTextBlock(db, {
       tenantId,
@@ -132,6 +133,7 @@ export async function seedLegalContentFromJson(
       title: block.title,
       body: block.body,
       ifExists: "update",
+      by,
     });
   }
 }

package/src/user/handlers/find-for-auth.query.ts

@@ -28,7 +28,7 @@ export const findForAuthQuery = defineQueryHandler({
     ),
   access: { roles: access.system },
   handler: async (query, ctx) => {
-    const where =
+    const where: { email: string } | { id: string } =
       query.payload.email !== undefined
         ? { email: query.payload.email }
         : { id: query.payload.id as string }; // @cast-boundary engine-payload

package/src/user/seeding.ts

@@ -18,6 +18,8 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+// kumiko-lint-ignore cross-feature-import shares the postSave-hooks fixture contract with tenant/seeding (#1478)
+import { fireEntityPostSave, type SeedTenantHooks } from "../tenant/seeding";
 import { userEntity, userTable } from "./schema/user";
 
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
@@ -52,6 +54,11 @@ export type SeedUserOptions = {
 export async function seedUser(
   db: DbConnection,
   options: SeedUserOptions,
+  // Optional, append-only — same rationale as tenant/seeding's seedTenant
+  // hooks param (#1478): fires user's postSave hooks (e.g. a Welcome-
+  // notification hook keyed off `allOf: "user"`) for fixtures/self-signup
+  // that opt in. Omit to keep today's hook-less behavior.
+  hooks?: SeedTenantHooks,
 ): Promise<{ id: string }> {
   const by = options.by ?? TestUsers.systemAdmin;
   // executor.create erwartet eine TenantDb (mit .insert()-API). User
@@ -81,6 +88,7 @@ export async function seedUser(
       `seedUser failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
     );
   }
+  await fireEntityPostSave(hooks, "user:seed", result.data);
   return { id: extractId(result.data, "seedUser") };
 }
 

package/src/user-data-rights/COMPLIANCE.md

@@ -20,7 +20,7 @@ Dieses Dokument bündelt die **technischen Fakten** zur DSGVO-Pipeline
 |---------|-------------------|--------------|--------------|
 | **Art. 15 (Auskunft, light)** | `user-data-rights:query:my-audit-log` | User | Liest eigene Framework-Events aus `kumiko_events` (account-weit über alle Memberships). Filterbar nach `eventType`, `aggregateType`, `from`/`to`. Domain-Entities ohne `ctx.appendEvent` erscheinen NICHT — die kommen im Export-Bundle (Art. 20). |
 | **Art. 15 + 20 (Auskunft + Portabilität)** | `user-data-rights:write:request-export` | User | Async Job → ZIP mit user-Profil + fileRefs + alle EXT_USER_DATA-Provider-Daten (cross-tenant) + signed Magic-Link per Email. Idempotent: nur 1 active Job pro User (`ACTIVE_JOB_CONSTRAINT`). |
-| **Art. 15 + 20** | `GET /user-export/by-token?token=…` | Anonym (Magic-Link-Pfad) | Token-Hash-Lookup → 302-Redirect auf signed Storage-URL. Multi-use innerhalb TTL. Audit: `lastUsedAt`, `lastUsedFromIp`, `lastUsedUserAgent`. |
+| **Art. 15 + 20** | `GET /user-export/by-token` (interstitial) + `POST /user-export/by-token` (exchange) | Anonym (Magic-Link-Pfad) | Email-Link trägt den Token als URL-Fragment (`#token=`, nie an den Server gesendet, issue #1271); Interstitial-Script liest das Fragment client-seitig und tauscht es per POST-Body gegen die signed Storage-URL. Kein `?token=`-Query-Fallback (#1512) — Query-Param landet unveränderlich in Proxy-/Access-Logs. Multi-use innerhalb TTL. Audit: `lastUsedAt`, `lastUsedFromIp`, `lastUsedUserAgent`. |
 | **Art. 15 + 20** | `GET /user-export/by-job/:jobId` | User (Session-Auth) | UI-Klick-Pfad. Cross-tenant-same-user: User in Tenant B kann Job aus Tenant A laden wenn er der Owner ist. |
 | **Art. 17 (Löschung)** | `user-data-rights:write:request-deletion` | User | Soft-Delete: `status=DeletionRequested` + `gracePeriodEnd = now + profile.gracePeriod`. Cron `run-forget-cleanup` führt nach Grace die Anonymisierung durch. |
 | **Art. 17** | `user-data-rights:write:cancel-deletion` | User | Während Grace: status zurück auf `Active`. |

package/src/user-data-rights/__tests__/audit-log.integration.test.ts

@@ -22,6 +22,8 @@ import { createSessionsFeature } from "../../sessions";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsFeature } from "../feature";
+import { listDownloadAttemptsQuery } from "../handlers/list-download-attempts.query";
+import { myAuditLogQuery } from "../handlers/my-audit-log.query";
 import { downloadAttemptEntity, downloadAttemptsTable } from "../schema/download-attempt";
 
 const MY_AUDIT = "user-data-rights:query:my-audit-log";
@@ -158,6 +160,69 @@ describe("my-audit-log", () => {
   });
 });
 
+describe("my-audit-log — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("from/to filter works without deleting globalThis.Temporal for handler-internal state", async () => {
+    // Seed with Temporal intact — only the handler call runs ambient-free,
+    // mirroring the audit feature's #1525 regression test (going through
+    // full HTTP dispatch would also break buildHandlerContext's unrelated
+    // ctx.tz setup, which isn't what this pins down).
+    await seedEvent(alice.id, tenantA, "user.x", { from: "range-test" });
+
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const res = await myAuditLogQuery.handler(
+        {
+          payload: { limit: 50, from: "2020-01-01T00:00:00Z", to: "2030-01-01T00:00:00Z" },
+          user: alice,
+        } as Parameters<typeof myAuditLogQuery.handler>[0],
+        { db: { raw: stack.db } } as unknown as Parameters<typeof myAuditLogQuery.handler>[1],
+      );
+      expect(res.rows.length).toBeGreaterThanOrEqual(1);
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
+describe("list-download-attempts — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("from/to filter works without relying on globalThis.Temporal", async () => {
+    const T = await import("@cosmicdrift/kumiko-framework/time");
+    const now = T.getTemporal().Now.instant();
+    await seedRows(stack.db, downloadAttemptsTable, [
+      {
+        id: "33333333-3333-4333-8333-333333333333",
+        tenantId: tenantA,
+        result: "notFound",
+        via: "token",
+        tokenHash: "abc",
+        jobId: null,
+        attemptedByUserId: null,
+        ip: "1.2.3.4",
+        userAgent: "test",
+        attemptedAt: now,
+      },
+    ]);
+
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const res = await listDownloadAttemptsQuery.handler(
+        {
+          payload: { limit: 50, from: "2020-01-01T00:00:00Z", to: "2030-01-01T00:00:00Z" },
+          user: admin,
+        } as Parameters<typeof listDownloadAttemptsQuery.handler>[0],
+        { db: stack.db } as unknown as Parameters<typeof listDownloadAttemptsQuery.handler>[1],
+      );
+      expect(res.rows.length).toBeGreaterThanOrEqual(1);
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
 describe("download-attempt retention :: disk-bomb-Schutz bei Brute-Force", () => {
   test("Entity-Default ist 90d hardDelete (kein unbounded growth)", () => {
     expect(downloadAttemptEntity.retention).toBeDefined();