@cosmicdrift/kumiko-bundled-features 0.165.0 → 2.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.165.0",
+  "version": "2.0.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -38,6 +38,7 @@
     "./custom-fields": "./src/custom-fields/index.ts",
     "./custom-fields/web": "./src/custom-fields/web/index.ts",
     "./tags": "./src/tags/index.ts",
+    "./tenant-settings": "./src/tenant-settings/index.ts",
     "./tags/web": "./src/tags/web/index.ts",
     "./folders": "./src/folders/index.ts",
     "./folders/web": "./src/folders/web/index.ts",
@@ -118,11 +119,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.165.0",
-    "@cosmicdrift/kumiko-framework": "0.165.0",
-    "@cosmicdrift/kumiko-headless": "0.165.0",
-    "@cosmicdrift/kumiko-renderer": "0.165.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.165.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "2.0.0",
+    "@cosmicdrift/kumiko-framework": "2.0.0",
+    "@cosmicdrift/kumiko-headless": "2.0.0",
+    "@cosmicdrift/kumiko-renderer": "2.0.0",
+    "@cosmicdrift/kumiko-renderer-web": "2.0.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",
@@ -146,6 +147,9 @@
     "README.md",
     "LICENSE"
   ],
+  "peerDependencies": {
+    "@cosmicdrift/kumiko-types": "^2.0.0"
+  },
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/mailparser": "^3.4.6",

package/src/__tests__/access-invalidation-consumer.integration.test.ts

@@ -0,0 +1,279 @@
+// createAccessInvalidationEventConsumer (kumiko-framework#1560) — the last
+// leg of #1524's push-based mid-stream access revocation. Proves the
+// consumer reacts to the two real event sources it's specced against:
+//
+//   - sessions:event:session-revoked (#1559), both the self-service revoke
+//     path AND the privileged, cross-tenant revoke-all-for-user (DSGVO
+//     Art.18 account-freeze, appended anchored on SYSTEM_TENANT_ID).
+//   - tenant-membership.updated / .deleted (role change / member removal),
+//     where userId is read from the previous-snapshot rather than
+//     payload.changes.
+//
+// Asserted directly against stack.sseBroker.subscribeAccessInvalidation —
+// no real SSE connection or HTTP-stream needed, mirrors how sse-broker.test.ts
+// tests the broker itself. Mid-stream teardown (the actual AccessDeniedError
+// thrown into an open dispatch-stream) is #1561's job, not this one.
+//
+// Every write below MUST go through the real write handlers (never a
+// hand-crafted StoredEvent) — that's what pins the hardcoded event-type
+// literals in system-hooks.ts to their actual bundled-features sources. A
+// future "simplification" to synthetic events would silently destroy that
+// guard.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  resetTestTables,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers } from "../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../auth-email-password/feature";
+import { createConfigFeature } from "../config";
+import { createConfigResolver } from "../config/resolver";
+import { configValuesTable } from "../config/table";
+import { makeSessionHelpers } from "../sessions/__tests__/test-helpers";
+import { SessionHandlers } from "../sessions/constants";
+import { createSessionsFeature } from "../sessions/feature";
+import { userSessionEntity, userSessionTable } from "../sessions/schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../sessions/session-callbacks";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../sessions/testing";
+import { createTenantFeature } from "../tenant";
+import { TenantHandlers } from "../tenant/constants";
+import { tenantMembershipsTable } from "../tenant/membership-table";
+import { tenantEntity } from "../tenant/schema/tenant";
+import { UserHandlers } from "../user";
+import { createUserFeature } from "../user/feature";
+import { userEntity, userTable } from "../user/schema/user";
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+const TENANT = testTenantId(1);
+
+// Collects every userId the consumer pushed an invalidation for during the
+// running test, in push order. Reset in beforeEach.
+let invalidated: string[];
+let unsubscribe: (() => void) | undefined;
+
+function trackInvalidation(userId: string): void {
+  unsubscribe = stack.sseBroker.subscribeAccessInvalidation(userId, () => {
+    invalidated.push(userId);
+  });
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature({ autoRevokeOnPasswordChange: bound.asMassRevoker() }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
+  const boundSessionCreator = bound.asAuthConfig().sessionCreator;
+  if (!boundSessionCreator) throw new Error("sessionCreator not bound — check setup order");
+  sessionCreator = boundSessionCreator;
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [
+    userTable,
+    tenantMembershipsTable,
+    userSessionTable,
+    eventsTable,
+  ]);
+  invalidated = [];
+  unsubscribe?.();
+  unsubscribe = undefined;
+});
+
+describe("access-invalidation event consumer", () => {
+  test("session-revoked (self-service revoke) pushes an invalidation for that user", async () => {
+    const { userId } = await h.seedUser("revoke1@example.com", "pw-long-enough");
+    const { token, sid } = await h.login("revoke1@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    const res = await h.authedPost("/api/write", token, {
+      type: SessionHandlers.revoke,
+      payload: { id: sid },
+    });
+    expect(res.status).toBe(200);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("session-revoked via the privileged cross-tenant revoke-all-for-user (SYSTEM_TENANT_ID) still routes on payload.userId", async () => {
+    const { userId } = await h.seedUser("revoke2@example.com", "pw-long-enough");
+    await h.login("revoke2@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    // Fresh sid per test — withMintedSession mints synchronously instead of
+    // relying on stack.http's per-userId sid cache, which would otherwise
+    // hand back a sid truncated out from under it by the next beforeEach's
+    // resetTestTables(userSessionTable).
+    const systemActor = await withMintedSession(sessionCreator, {
+      id: TestUsers.systemAdmin.id,
+      tenantId: TENANT,
+      roles: ["system"],
+    });
+    const result = await stack.http.write(
+      SessionHandlers.revokeAllForUser,
+      { userId },
+      systemActor,
+    );
+    expect(result.status).toBe(200);
+
+    // The write itself is anchored on SYSTEM_TENANT_ID (not TENANT) — this
+    // is exactly the asymmetry #1559's handoff comment warns about. If the
+    // consumer routed on event.tenantId instead of payload.userId, this
+    // event would never surface here.
+    const events = await selectMany(stack.db, eventsTable, {
+      type: "sessions:event:session-revoked",
+    });
+    expect(events.length).toBeGreaterThan(0);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("tenant-membership.updated (role change) reads userId from the previous snapshot and invalidates", async () => {
+    const { userId } = await h.seedUser("rolechange@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    const result = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId, tenantId: TENANT, roles: ["Admin"] },
+      admin,
+    );
+    expect(result).toBeTruthy();
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("tenant-membership.deleted (member removed) reads userId from the previous snapshot and invalidates", async () => {
+    const { userId } = await h.seedUser("removed@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    const result = await stack.http.writeOk(
+      TenantHandlers.removeMember,
+      { userId, tenantId: TENANT },
+      admin,
+    );
+    expect(result).toBeTruthy();
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("tenant-membership.created (new member added) does not push an invalidation", async () => {
+    // A genuine tenant-membership.created event, not h.seedUser's direct-DB
+    // seedTenantMembership bypass — go through the real addMember write
+    // handler so this negative case exercises the actual event the
+    // consumer must ignore, not just "some other unrelated event type".
+    const created = await stack.http.writeOk<{ id: string }>(
+      UserHandlers.create,
+      { email: "newmember@example.com", displayName: "newmember" },
+      TestUsers.systemAdmin,
+    );
+    trackInvalidation(created.id);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    await stack.http.writeOk(
+      TenantHandlers.addMember,
+      { userId: created.id, tenantId: TENANT, roles: ["User"] },
+      admin,
+    );
+
+    const events = await selectMany(stack.db, eventsTable, { type: "tenant-membership.created" });
+    expect(events.length).toBeGreaterThan(0);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([]);
+  });
+
+  test("password change (sessionMassRevoker) pushes an invalidation for that user", async () => {
+    const { userId } = await h.seedUser("pwchange@example.com", "old-pw-long-enough");
+    const { token } = await h.login("pwchange@example.com", "old-pw-long-enough");
+    trackInvalidation(userId);
+
+    // The industry-standard "password change signs you out everywhere" flow
+    // — goes through the sessionMassRevoker callback (feature.ts's postSave
+    // hook on passwordHash changes), NOT one of the *.write.ts handlers.
+    // This is exactly the gap a security review of #1560 caught: that
+    // callback did a raw updateMany with no event, so an already-open SSE
+    // stream survived a password change.
+    const res = await h.authedPost("/api/write", token, {
+      type: AuthHandlers.changePassword,
+      payload: { oldPassword: "old-pw-long-enough", newPassword: "new-pw-long-enough" },
+    });
+    expect(res.status).toBe(200);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("sessionRevokeAllOthers callback (used by auth-mfa, distinct from the revoke-all-others.write.ts handler) pushes an invalidation", async () => {
+    const { userId } = await h.seedUser("mfarevoke@example.com", "pw-long-enough");
+    await h.login("mfarevoke@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    // currentSid undefined → revokes every live session, mirrors how
+    // auth-mfa calls this callback directly (no dispatcher ctx available).
+    const revoked = await callbacks.get().sessionRevokeAllOthers(userId, undefined);
+    expect(revoked).toBeGreaterThan(0);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+});

package/src/__tests__/access-invalidation-stream.integration.test.ts

@@ -0,0 +1,217 @@
+// #1561 — mid-stream access revocation tears down an open HTTP SSE stream.
+// Complements access-invalidation-consumer.integration.test.ts (#1560), which
+// only asserts broker.publishAccessInvalidation. Here we open a real
+// POST /api/stream via createLiveDispatcher + setupTestStack, revoke access
+// while the generator is gated between chunks, and assert the client sees
+// access_denied instead of further yields.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createLiveDispatcher } from "@cosmicdrift/kumiko-dispatcher-live";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { generateToken } from "@cosmicdrift/kumiko-framework/api";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  resetTestTables,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { z } from "zod";
+import { AuthHandlers } from "../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../auth-email-password/feature";
+import { createConfigFeature } from "../config";
+import { createConfigResolver } from "../config/resolver";
+import { configValuesTable } from "../config/table";
+import { makeSessionHelpers } from "../sessions/__tests__/test-helpers";
+import { SessionHandlers } from "../sessions/constants";
+import { createSessionsFeature } from "../sessions/feature";
+import { userSessionEntity, userSessionTable } from "../sessions/schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../sessions/session-callbacks";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../sessions/testing";
+import { createTenantFeature } from "../tenant";
+import { TenantHandlers } from "../tenant/constants";
+import { tenantMembershipsTable } from "../tenant/membership-table";
+import { tenantEntity } from "../tenant/schema/tenant";
+import { createUserFeature } from "../user/feature";
+import { userEntity, userTable } from "../user/schema/user";
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+const TENANT = testTenantId(1);
+
+// Gate between chunk 0 and chunk 1 so the test can revoke + drain the event
+// consumer before the stream's next pull — otherwise an eager pump would
+// race past the invalidation window.
+let releaseNextChunk: (() => void) | undefined;
+let nextChunkGate: Promise<void>;
+
+function resetGate(): void {
+  nextChunkGate = new Promise<void>((resolve) => {
+    releaseNextChunk = resolve;
+  });
+}
+
+const streamProbeFeature = defineFeature("stream-probe", (r) => {
+  r.streamHandler(
+    "probe:tail",
+    z.object({}).optional(),
+    async function* () {
+      yield { phase: "open" as const };
+      await nextChunkGate;
+      // Reached only if mid-stream access check failed to cut the generator.
+      yield { phase: "should-not-reach-client" as const };
+    },
+    { access: { roles: ["User"] } },
+  );
+});
+
+function buildLiveFetch(authJwt: string): {
+  readonly fetch: typeof fetch;
+  readonly csrfToken: string;
+} {
+  const csrfToken = generateToken();
+  const cookieHeader = `kumiko_auth=${authJwt}; kumiko_csrf=${csrfToken}`;
+  const fetchImpl = (async (url: unknown, init: RequestInit | undefined) => {
+    const reqInit: RequestInit = {
+      ...(init ?? {}),
+      headers: {
+        ...(init?.headers ?? {}),
+        Cookie: cookieHeader,
+      },
+    };
+    return stack.app.request(String(url), reqInit);
+  }) as unknown as typeof fetch;
+  return { fetch: fetchImpl, csrfToken };
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature({ autoRevokeOnPasswordChange: bound.asMassRevoker() }),
+      streamProbeFeature,
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
+  const boundSessionCreator = bound.asAuthConfig().sessionCreator;
+  if (!boundSessionCreator) throw new Error("sessionCreator not bound — check setup order");
+  sessionCreator = boundSessionCreator;
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [
+    userTable,
+    tenantMembershipsTable,
+    userSessionTable,
+    eventsTable,
+  ]);
+  resetGate();
+});
+
+describe("access-invalidation mid-stream SSE teardown (#1561)", () => {
+  test("session revoke mid-stream terminates the open HTTP SSE stream", async () => {
+    await h.seedUser("stream-revoke@example.com", "pw-long-enough");
+    const { token, sid } = await h.login("stream-revoke@example.com", "pw-long-enough");
+
+    const { fetch, csrfToken } = buildLiveFetch(token);
+    const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
+
+    const iter = dispatcher
+      .stream<{ phase: string }>("stream-probe:stream:probe:tail", {})
+      [Symbol.asyncIterator]();
+
+    const first = await iter.next();
+    expect(first.done).toBe(false);
+    expect(first.value).toEqual({ phase: "open" });
+
+    const revokeRes = await h.authedPost("/api/write", token, {
+      type: SessionHandlers.revoke,
+      payload: { id: sid },
+    });
+    expect(revokeRes.status).toBe(200);
+    await stack.eventDispatcher?.runOnce();
+
+    releaseNextChunk?.();
+
+    let thrown: unknown;
+    try {
+      await iter.next();
+    } catch (e) {
+      thrown = e;
+    }
+    expect(thrown).toMatchObject({ code: "access_denied" });
+  });
+
+  test("tenant role strip mid-stream terminates the open HTTP SSE stream", async () => {
+    const { userId } = await h.seedUser("stream-roles@example.com", "pw-long-enough");
+    const { token } = await h.login("stream-roles@example.com", "pw-long-enough");
+
+    const { fetch, csrfToken } = buildLiveFetch(token);
+    const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
+
+    const iter = dispatcher
+      .stream<{ phase: string }>("stream-probe:stream:probe:tail", {})
+      [Symbol.asyncIterator]();
+
+    const first = await iter.next();
+    expect(first.done).toBe(false);
+    expect(first.value).toEqual({ phase: "open" });
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId, tenantId: TENANT, roles: ["Admin"] },
+      admin,
+    );
+    await stack.eventDispatcher?.runOnce();
+
+    releaseNextChunk?.();
+
+    let thrown: unknown;
+    try {
+      await iter.next();
+    } catch (e) {
+      thrown = e;
+    }
+    expect(thrown).toMatchObject({ code: "access_denied" });
+  });
+});

package/src/audit/__tests__/audit.integration.test.ts

@@ -20,6 +20,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { withoutAmbientTemporal } from "@cosmicdrift/kumiko-framework/testing";
 import { AuditQueries } from "../constants";
 import { createAuditFeature } from "../feature";
 
@@ -189,47 +190,61 @@ describe("audit: list query", () => {
   });
 
   test("filter by from/to date range (inclusive bounds, outside-range rows excluded)", async () => {
-    // Events are written with server-now at ms precision. Delays between
-    // writes + anchor timestamps give us clean sort-order. The anchors are
-    // captured OUTSIDE the write bursts so precision-truncation on the
-    // db side (ms) can't blur anchor vs event.
+    // Stamp created_at after writes — wall-clock setTimeout anchors race with
+    // ms-precision DB timestamps under load (#1548). Fixed Instant grid keeps
+    // from/to assertions deterministic.
     await createWidget(admin, "before-window");
-    await new Promise((r) => setTimeout(r, 50));
-    const t1 = Temporal.Now.instant();
-    await new Promise((r) => setTimeout(r, 10));
     await createWidget(admin, "in-window-1");
     await createWidget(admin, "in-window-2");
-    await new Promise((r) => setTimeout(r, 50));
-    const t2 = Temporal.Now.instant();
-    await new Promise((r) => setTimeout(r, 10));
     await createWidget(admin, "after-window");
 
-    // Slice strictly to the [t1, t2] window — should return exactly 2 rows.
+    const listed = await stack.http.queryOk<AuditResponse>(AuditQueries.list, {}, admin);
+    const byName = new Map(
+      listed.rows
+        .filter((r) => r.type === "widget.created")
+        .map((r) => [(r.payload as { name?: string }).name ?? "", r.id]),
+    );
+    const stamps: ReadonlyArray<readonly [string, string]> = [
+      ["before-window", "2020-06-01T12:00:00Z"],
+      ["in-window-1", "2020-06-01T12:00:10Z"],
+      ["in-window-2", "2020-06-01T12:00:20Z"],
+      ["after-window", "2020-06-01T12:00:30Z"],
+    ];
+    for (const [name, createdAt] of stamps) {
+      const id = byName.get(name);
+      expect(id).toBeDefined();
+      await asRawClient(stack.db).unsafe(
+        `UPDATE kumiko_events SET created_at = $1::timestamptz WHERE id = $2::bigint`,
+        [createdAt, id],
+      );
+    }
+
+    const tFrom = "2020-06-01T12:00:10Z";
+    const tTo = "2020-06-01T12:00:20Z";
+
     const inWindow = await stack.http.queryOk<AuditResponse>(
       AuditQueries.list,
-      { from: t1.toString(), to: t2.toString() },
+      { from: tFrom, to: tTo },
       admin,
     );
     expect(inWindow.rows).toHaveLength(2);
     const names = inWindow.rows.map((r) => (r.payload as { name?: string }).name).sort();
     expect(names).toEqual(["in-window-1", "in-window-2"]);
 
-    // From-only: everything at or after t1 → 3 rows (2 in-window + 1 after).
-    const sinceT1 = await stack.http.queryOk<AuditResponse>(
+    const sinceFrom = await stack.http.queryOk<AuditResponse>(
       AuditQueries.list,
-      { from: t1.toString() },
+      { from: tFrom },
       admin,
     );
-    expect(sinceT1.rows).toHaveLength(3);
+    expect(sinceFrom.rows).toHaveLength(3);
 
-    // To-only: everything at or before t1 → just the before-window row.
-    const untilT1 = await stack.http.queryOk<AuditResponse>(
+    const untilBefore = await stack.http.queryOk<AuditResponse>(
       AuditQueries.list,
-      { to: t1.toString() },
+      { to: "2020-06-01T12:00:00Z" },
       admin,
     );
-    expect(untilT1.rows).toHaveLength(1);
-    expect((untilT1.rows[0]?.payload as { name?: string }).name).toBe("before-window");
+    expect(untilBefore.rows).toHaveLength(1);
+    expect((untilBefore.rows[0]?.payload as { name?: string }).name).toBe("before-window");
   });
 
   test("rejects inverted from/to range with validation_error", async () => {
@@ -312,6 +327,20 @@ describe("audit: list query", () => {
     expect(updated?.metadata).toMatchObject({ userId: admin.id });
   });
 
+  test("kumiko-framework#1525: from/to filter works without relying on globalThis.Temporal", async () => {
+    await createWidget(admin, "in-range");
+    // createTzContext uses a static temporal-polyfill import, so full HTTP
+    // dispatch (buildHandlerContext → ctx.tz) is safe ambient-free.
+    const res = await withoutAmbientTemporal(() =>
+      stack.http.queryOk<AuditResponse>(
+        AuditQueries.list,
+        { limit: 50, from: "2020-01-01T00:00:00Z", to: "2030-01-01T00:00:00Z" },
+        admin,
+      ),
+    );
+    expect(res.rows.length).toBeGreaterThanOrEqual(1);
+  });
+
   test("access denied for non-admin roles", async () => {
     await createWidget(admin, "A");
     const res = await stack.http.query(AuditQueries.list, {}, regularUser);

package/src/audit/handlers/list.query.ts

@@ -14,6 +14,7 @@
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 
 const MAX_LIMIT = 100;

package/src/auth-email-password/__tests__/auth.integration.test.ts

@@ -247,6 +247,12 @@ describe("scenario 5c: change-password common-password rejection (#1340)", () =>
       signedIn,
     );
     expect(error.httpStatus).toBe(400);
+    // "errors.validation.custom" alone is generic — any .refine() failure
+    // on the schema would match. Pin the field too, so this only passes
+    // for a rejection on newPassword specifically (the common-password
+    // refine), not an unrelated validation error elsewhere in the schema.
+    expectErrorIncludes(error, "errors.validation.custom");
+    expectErrorIncludes(error, "newPassword");
 
     // Old password still works — the rejected change never landed.
     const loginRes = await stack.http.raw("POST", "/api/auth/login", {