@cosmicdrift/kumiko-bundled-features 0.165.2 → 0.165.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.165.2",
+  "version": "0.165.4",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -119,11 +119,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.165.2",
-    "@cosmicdrift/kumiko-framework": "0.165.2",
-    "@cosmicdrift/kumiko-headless": "0.165.2",
-    "@cosmicdrift/kumiko-renderer": "0.165.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.165.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.165.4",
+    "@cosmicdrift/kumiko-framework": "0.165.4",
+    "@cosmicdrift/kumiko-headless": "0.165.4",
+    "@cosmicdrift/kumiko-renderer": "0.165.4",
+    "@cosmicdrift/kumiko-renderer-web": "0.165.4",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",
@@ -148,7 +148,7 @@
     "LICENSE"
   ],
   "peerDependencies": {
-    "@cosmicdrift/kumiko-types": "^0.165.2"
+    "@cosmicdrift/kumiko-types": "^0.165.4"
   },
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",

package/src/__tests__/access-invalidation-consumer.integration.test.ts

@@ -72,7 +72,7 @@ let invalidated: string[];
 let unsubscribe: (() => void) | undefined;
 
 function trackInvalidation(userId: string): void {
-  unsubscribe = stack.sseBroker.subscribeAccessInvalidation(userId, () => {
+  unsubscribe = stack.sseBroker.subscribeAccessInvalidation?.(userId, () => {
     invalidated.push(userId);
   });
 }

package/src/__tests__/access-invalidation-stream.integration.test.ts

@@ -53,25 +53,28 @@ const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
 const encryptionKey = randomBytes(32).toString("base64");
 const TENANT = testTenantId(1);
 
-// Gate between chunk 0 and chunk 1 so the test can revoke + drain the event
-// consumer before the stream's next pull — otherwise an eager pump would
-// race past the invalidation window.
-let releaseNextChunk: (() => void) | undefined;
-let nextChunkGate: Promise<void>;
-
-function resetGate(): void {
-  nextChunkGate = new Promise<void>((resolve) => {
-    releaseNextChunk = resolve;
+// Per-stream gate (gateId in payload) so parallel/second streams don't share
+// one module-level Promise — Map keyed by the id the test picks.
+const chunkGates = new Map<string, { promise: Promise<void>; release: () => void }>();
+
+function createGate(gateId: string): () => void {
+  let release!: () => void;
+  const promise = new Promise<void>((resolve) => {
+    release = resolve;
   });
+  chunkGates.set(gateId, { promise, release });
+  return release;
 }
 
 const streamProbeFeature = defineFeature("stream-probe", (r) => {
   r.streamHandler(
     "probe:tail",
-    z.object({}).optional(),
-    async function* () {
+    z.object({ gateId: z.string().min(1) }),
+    async function* (event) {
       yield { phase: "open" as const };
-      await nextChunkGate;
+      const gate = chunkGates.get(event.payload.gateId);
+      if (!gate) throw new Error(`missing gate ${event.payload.gateId}`);
+      await gate.promise;
       // Reached only if mid-stream access check failed to cut the generator.
       yield { phase: "should-not-reach-client" as const };
     },
@@ -144,62 +147,73 @@ beforeEach(async () => {
     userSessionTable,
     eventsTable,
   ]);
-  resetGate();
+  chunkGates.clear();
 });
 
-describe("access-invalidation mid-stream SSE teardown (#1561)", () => {
-  test("session revoke mid-stream terminates the open HTTP SSE stream", async () => {
-    await h.seedUser("stream-revoke@example.com", "pw-long-enough");
-    const { token, sid } = await h.login("stream-revoke@example.com", "pw-long-enough");
-
-    const { fetch, csrfToken } = buildLiveFetch(token);
-    const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
-
-    const iter = dispatcher
-      .stream<{ phase: string }>("stream-probe:stream:probe:tail", {})
-      [Symbol.asyncIterator]();
-
-    const first = await iter.next();
-    expect(first.done).toBe(false);
-    expect(first.value).toEqual({ phase: "open" });
+async function openProbeStream(token: string): Promise<{
+  iter: AsyncIterator<{ phase: string }>;
+  release: () => void;
+}> {
+  const gateId = generateToken();
+  const release = createGate(gateId);
+  const { fetch, csrfToken } = buildLiveFetch(token);
+  const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
+  const iter = dispatcher
+    .stream<{ phase: string }>("stream-probe:stream:probe:tail", { gateId })
+    [Symbol.asyncIterator]();
+  const first = await iter.next();
+  expect(first.done).toBe(false);
+  expect(first.value).toEqual({ phase: "open" });
+  return { iter, release };
+}
 
-    const revokeRes = await h.authedPost("/api/write", token, {
-      type: SessionHandlers.revoke,
-      payload: { id: sid },
+describe("access-invalidation mid-stream SSE teardown (#1561)", () => {
+  const cases = [
+    {
+      name: "session revoke mid-stream terminates the open HTTP SSE stream",
+      setup: async () => {
+        await h.seedUser("stream-revoke@example.com", "pw-long-enough");
+        const { token, sid } = await h.login("stream-revoke@example.com", "pw-long-enough");
+        return {
+          token,
+          revoke: async () => {
+            const revokeRes = await h.authedPost("/api/write", token, {
+              type: SessionHandlers.revoke,
+              payload: { id: sid },
+            });
+            expect(revokeRes.status).toBe(200);
+          },
+        };
+      },
+    },
+    {
+      name: "tenant role strip mid-stream terminates the open HTTP SSE stream",
+      setup: async () => {
+        const { userId } = await h.seedUser("stream-roles@example.com", "pw-long-enough");
+        const { token } = await h.login("stream-roles@example.com", "pw-long-enough");
+        return {
+          token,
+          revoke: async () => {
+            const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+            await stack.http.writeOk(
+              TenantHandlers.updateMemberRoles,
+              { userId, tenantId: TENANT, roles: ["Admin"] },
+              admin,
+            );
+          },
+        };
+      },
+    },
+  ] as const;
+
+  for (const c of cases) {
+    test(c.name, async () => {
+      const { token, revoke } = await c.setup();
+      const { iter, release } = await openProbeStream(token);
+      await revoke();
+      await stack.eventDispatcher?.runOnce();
+      release();
+      await expect(iter.next()).rejects.toMatchObject({ code: "access_denied" });
     });
-    expect(revokeRes.status).toBe(200);
-    await stack.eventDispatcher?.runOnce();
-
-    releaseNextChunk?.();
-
-    await expect(iter.next()).rejects.toMatchObject({ code: "access_denied" });
-  });
-
-  test("tenant role strip mid-stream terminates the open HTTP SSE stream", async () => {
-    const { userId } = await h.seedUser("stream-roles@example.com", "pw-long-enough");
-    const { token } = await h.login("stream-roles@example.com", "pw-long-enough");
-
-    const { fetch, csrfToken } = buildLiveFetch(token);
-    const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
-
-    const iter = dispatcher
-      .stream<{ phase: string }>("stream-probe:stream:probe:tail", {})
-      [Symbol.asyncIterator]();
-
-    const first = await iter.next();
-    expect(first.done).toBe(false);
-    expect(first.value).toEqual({ phase: "open" });
-
-    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
-    await stack.http.writeOk(
-      TenantHandlers.updateMemberRoles,
-      { userId, tenantId: TENANT, roles: ["Admin"] },
-      admin,
-    );
-    await stack.eventDispatcher?.runOnce();
-
-    releaseNextChunk?.();
-
-    await expect(iter.next()).rejects.toMatchObject({ code: "access_denied" });
-  });
+  }
 });

package/src/admin-shell/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.125.0",
+    "type": "improvement",
+    "title": "admin-shell: neues bundled-feature für rollen-gated Tenant- und Platform-Workspaces mit O…",
+    "detail": "admin-shell: neues bundled-feature für rollen-gated Tenant- und Platform-Workspaces mit Overview-Home-Screens, Nav-Icons und Server-i18n. Komponiert Screens aus `tenant`, `audit`, `jobs` und optional `tier-engine` — mount nach diesen Features. Overview-Queries laufen über eine fest kodierte Allowlist pro Workspace, um versehentliche Cross-Workspace-Datenzugriffe zu verhindern."
+  }
+]

package/src/agent-tools/changes.json

@@ -0,0 +1 @@
+[]

package/src/audit/__tests__/audit.integration.test.ts

@@ -212,7 +212,7 @@ describe("audit: list query", () => {
     ];
     for (const [name, createdAt] of stamps) {
       const id = byName.get(name);
-      expect(id).toBeDefined();
+      if (!id) throw new Error(`missing event for ${name}`);
       await asRawClient(stack.db).unsafe(
         `UPDATE kumiko_events SET created_at = $1::timestamptz WHERE id = $2::bigint`,
         [createdAt, id],
@@ -244,7 +244,10 @@ describe("audit: list query", () => {
       admin,
     );
     expect(untilBefore.rows).toHaveLength(1);
-    expect((untilBefore.rows[0]?.payload as { name?: string }).name).toBe("before-window");
+    const untilRow = untilBefore.rows[0];
+    expect(untilRow).toBeDefined();
+    if (!untilRow) throw new Error("expected untilBefore row");
+    expect((untilRow.payload as { name?: string }).name).toBe("before-window");
   });
 
   test("rejects inverted from/to range with validation_error", async () => {

package/src/audit/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.127.0",
+    "type": "improvement",
+    "title": "Harden admin operator UI: stricter boot i18n/entityList validation, job run logger wiring…",
+    "detail": "Harden admin operator UI: stricter boot i18n/entityList validation, job run logger wiring, audit/job filters, shell breadcrumbs, and bundled entityList/i18n standards."
+  }
+]

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -133,6 +133,9 @@ beforeAll(async () => {
     password: "warmup-password-not-asserted-on",
     tenants: [],
   });
+  // Pins the authHeader sid-cache key: one create for the seed actor, then
+  // we reset. If the cache key drifts, this fails instead of leaking into tests.
+  expect(store.created).toHaveLength(1);
   store.live.clear();
   store.created.length = 0;
   store.revoked.length = 0;

package/src/auth-email-password/changes.json

@@ -0,0 +1,26 @@
+[
+  {
+    "version": "0.162.0",
+    "type": "improvement",
+    "title": "auth-email-password: runtime toggle for self-registration.",
+    "detail": "auth-email-password: runtime toggle for self-registration. A new handler-less companion feature (`auth-self-registration`, toggleable, default on) lets an operator flip self-signup off at runtime via feature-toggles without redeploying. `signup-request` silently no-ops when off (matching its always-200 anti-enumeration contract), and a new anonymous-readable query (`auth-email-password:query:signup-registration-status`) lets the public signup page hide its own link/form."
+  },
+  {
+    "version": "0.154.1",
+    "type": "fix",
+    "title": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled…",
+    "detail": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled-features/auth-email-password/web`. Every other auth screen (ForgotPasswordScreen, SignupScreen, ResetPasswordScreen, …) was already exported from the barrel with its props type; `LoginScreen` was missed. `makeAuthGate`'s second parameter is typed `LoginScreenProps`, so consumers passing a typed `loginScreenProps` override (e.g. `@cosmicdriftgamestudio/kumiko-designer`) couldn't import the type at all. - @cosmicdrift/kumiko-framework@0.154.1 - @cosmicdrift/kumiko-dispatcher-live@0.154.1 - @cosmicdrift/kumiko-headless@0.154.1 - @cosmicdrift/kumiko-renderer@0.154.1 - @cosmicdrift/kumiko-renderer-web@0.154.1"
+  },
+  {
+    "version": "0.151.0",
+    "type": "improvement",
+    "title": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly — u…",
+    "detail": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly — use the new `createLoginRoute({ loginScreenProps, mfaVerifyScreen, unaffected (they already build on the same logic internally now). Why: a raw `<LoginScreen />` render has no MFA-challenge handling unless the caller remembers to hand-wire `onMfaChallenge` + swap in a verify screen itself — exactly how kumiko-framework#266's login-time MFA step went missing in a real app's standalone apex/marketing login route (it renders outside `emailPasswordClient`'s own gate, which already handled this correctly). `createLoginRoute` is the one place this logic lives now, for both the gated and standalone cases — there's no lower-level piece left to misuse. The `apex-surface-auth` recipe is updated to match."
+  },
+  {
+    "version": "0.131.0",
+    "type": "improvement",
+    "title": "App-Mounting 2.0 Säule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, Secti…",
+    "detail": "App-Mounting 2.0 Säule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, SectionCard, StatusBadge, ProgressBar, CollapsibleSection, DetailList, ModeSwitch, StatusBarChart, TimeseriesChart, EmptyState/LoadingState/ErrorState, QueryTable) + Status-Farb-Tokens (--color-status-\\*). Neue Hooks useMutation + useDisclosure. Neues Core-Primitive Link (default/button/muted), Button-Variant \"link\", Text-Variant \"muted\"; auth-email-password nutzt sie (authButtonClass/authMutedLinkClass entfernt)."
+  }
+]

package/src/auth-email-password/web/__tests__/confirm-account-unlock-screen.test.tsx

@@ -1,18 +1,10 @@
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { describe, expect, mock, test } from "bun:test";
 import { screen, waitFor } from "@testing-library/react";
 import { ConfirmAccountUnlockScreen } from "../confirm-account-unlock-screen";
+import { installFetchMock } from "./fetch-mock";
 import { renderWithProviders } from "./test-utils";
 
-const originalFetch = globalThis.fetch;
-
-beforeEach(() => {
-  globalThis.fetch = mock(
-    async () => new Response(null, { status: 200 }),
-  ) as unknown as typeof fetch;
-});
-afterEach(() => {
-  globalThis.fetch = originalFetch;
-});
+installFetchMock();
 
 describe("ConfirmAccountUnlockScreen", () => {
   test("ohne Token → missing-token page", () => {

package/src/auth-email-password/web/__tests__/fetch-mock.ts

@@ -0,0 +1,14 @@
+import { afterEach, beforeEach, mock } from "bun:test";
+
+/** Install a default 200-OK fetch mock; restores the pristine global after each test. */
+export function installFetchMock(): void {
+  const pristine = globalThis.fetch;
+  beforeEach(() => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 200 }),
+    ) as unknown as typeof fetch;
+  });
+  afterEach(() => {
+    globalThis.fetch = pristine;
+  });
+}

package/src/auth-email-password/web/__tests__/forgot-password-screen.test.tsx

@@ -1,18 +1,10 @@
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { describe, expect, mock, test } from "bun:test";
 import { fireEvent, screen, waitFor } from "@testing-library/react";
 import { ForgotPasswordScreen } from "../forgot-password-screen";
+import { installFetchMock } from "./fetch-mock";
 import { renderWithProviders } from "./test-utils";
 
-const originalFetch = globalThis.fetch;
-
-beforeEach(() => {
-  globalThis.fetch = mock(
-    async () => new Response(null, { status: 200 }),
-  ) as unknown as typeof fetch;
-});
-afterEach(() => {
-  globalThis.fetch = originalFetch;
-});
+installFetchMock();
 
 describe("ForgotPasswordScreen", () => {
   test("rendert title + email-input + submit-button (de)", () => {

package/src/auth-email-password/web/__tests__/request-account-unlock-screen.test.tsx

@@ -1,18 +1,10 @@
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { describe, expect, mock, test } from "bun:test";
 import { fireEvent, screen, waitFor } from "@testing-library/react";
 import { RequestAccountUnlockScreen } from "../request-account-unlock-screen";
+import { installFetchMock } from "./fetch-mock";
 import { renderWithProviders } from "./test-utils";
 
-const originalFetch = globalThis.fetch;
-
-beforeEach(() => {
-  globalThis.fetch = mock(
-    async () => new Response(null, { status: 200 }),
-  ) as unknown as typeof fetch;
-});
-afterEach(() => {
-  globalThis.fetch = originalFetch;
-});
+installFetchMock();
 
 describe("RequestAccountUnlockScreen", () => {
   test("renders title + email input + submit (de)", () => {

package/src/auth-email-password/web/__tests__/reset-password-screen.test.tsx

@@ -1,18 +1,10 @@
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { describe, expect, mock, test } from "bun:test";
 import { fireEvent, screen, waitFor } from "@testing-library/react";
 import { ResetPasswordScreen } from "../reset-password-screen";
+import { installFetchMock } from "./fetch-mock";
 import { renderWithProviders } from "./test-utils";
 
-const originalFetch = globalThis.fetch;
-
-beforeEach(() => {
-  globalThis.fetch = mock(
-    async () => new Response(null, { status: 200 }),
-  ) as unknown as typeof fetch;
-});
-afterEach(() => {
-  globalThis.fetch = originalFetch;
-});
+installFetchMock();
 
 describe("ResetPasswordScreen", () => {
   test("ohne Token in URL UND ohne token-Prop → missing-token-Page", () => {

package/src/auth-email-password/web/__tests__/verify-email-screen.test.tsx

@@ -1,18 +1,10 @@
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { describe, expect, mock, test } from "bun:test";
 import { screen, waitFor } from "@testing-library/react";
 import { VerifyEmailScreen } from "../verify-email-screen";
+import { installFetchMock } from "./fetch-mock";
 import { renderWithProviders } from "./test-utils";
 
-const originalFetch = globalThis.fetch;
-
-beforeEach(() => {
-  globalThis.fetch = mock(
-    async () => new Response(null, { status: 200 }),
-  ) as unknown as typeof fetch;
-});
-afterEach(() => {
-  globalThis.fetch = originalFetch;
-});
+installFetchMock();
 
 describe("VerifyEmailScreen", () => {
   test("ohne Token → missing-token-Page", () => {

package/src/auth-foundation/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.165.0",
+    "type": "fix",
+    "title": "Allow zero tokenVerifier when sessionStore present",
+    "detail": "Auth foundation now accepts zero tokenVerifier when a sessionStore is configured — prevents crash in session-store-only setups."
+  }
+]

package/src/auth-mfa/__tests__/reencrypt-job.integration.test.ts

@@ -92,10 +92,10 @@ type RawUserMfaRow = {
   version: number;
 };
 
-async function readRawRow(userId?: string): Promise<RawUserMfaRow> {
-  const rows = await selectMany<RawUserMfaRow>(stack.db, userMfaTable, userId ? { userId } : {});
+async function readRawRow(userId: string): Promise<RawUserMfaRow> {
+  const rows = await selectMany<RawUserMfaRow>(stack.db, userMfaTable, { userId });
   const row = rows[0];
-  if (!row) throw new Error("no user-mfa row");
+  if (!row) throw new Error(`no user-mfa row for ${userId}`);
   return row;
 }
 
@@ -132,7 +132,7 @@ describe("auth-mfa KEK-rotation job — kumiko-framework#266 Step 8", () => {
       user,
     );
 
-    const beforeRow = await readRawRow();
+    const beforeRow = await readRawRow(user.id);
     expect(JSON.parse(beforeRow.totpSecret).kekVersion).toBe(1);
 
     // Simulate "ops added a new master key version and flipped CURRENT=2" —
@@ -149,7 +149,7 @@ describe("auth-mfa KEK-rotation job — kumiko-framework#266 Step 8", () => {
 
     await mfaReencryptJob({}, jobCtx());
 
-    const afterJobRow = await readRawRow();
+    const afterJobRow = await readRawRow(user.id);
     expect(JSON.parse(afterJobRow.totpSecret).kekVersion).toBe(2);
 
     // The regression guard: rebuild the projection from scratch (replays
@@ -161,7 +161,7 @@ describe("auth-mfa KEK-rotation job — kumiko-framework#266 Step 8", () => {
       registry: stack.registry,
     });
 
-    const afterRebuildRow = await readRawRow();
+    const afterRebuildRow = await readRawRow(user.id);
     expect(JSON.parse(afterRebuildRow.totpSecret).kekVersion).toBe(2);
 
     // Decrypt-level proof, not just the version tag: a valid TOTP code

package/src/auth-mfa/changes.json

@@ -0,0 +1,38 @@
+[
+  {
+    "version": "0.165.0",
+    "type": "fix",
+    "title": "KEK reencrypt job: rejects unrecognized envelopes",
+    "detail": "Reencrypt job now explicitly fails on non-envelope rows instead of silently passing through."
+  },
+  {
+    "version": "0.165.0",
+    "type": "fix",
+    "title": "MFA: fail-closed when ctx.redis is missing",
+    "detail": "Verify/enable-confirm operations now fail when Redis is unreachable instead of silently accepting."
+  },
+  {
+    "version": "0.150.0",
+    "type": "fix",
+    "title": "Fix `auth-mfa`'s two-step verify + enroll flow re-checking stale state and skipping repla…",
+    "detail": "Fix `auth-mfa`'s two-step verify + enroll flow re-checking stale state and skipping replay protection that `login.write.ts` already enforces: - `verify.write.ts` minted a session from a challenge token alone, without re-checking account status or tenant membership. A user restricted/deleted, or removed from the tenant, in the ~10-minute window between password login and MFA verify still got a full session — membership loss even silently fell back to global-only roles instead of refusing. Both gates now mirror `login.write.ts`. - `enable-confirm.write.ts` never burned the setup token on success: the same token could re-enable MFA with an old secret after a `disable` (replay), and two parallel confirms both hit the executor instead of the second seeing `mfa_already_enabled`. The token is now single-use, the same as `login.write.ts`'s magic-link tokens. - `auth-mfa` was missing `r.requires(\"tenant\")` despite `verify.write.ts` dispatching `tenant:query:memberships` — a mount without `tenant` now fails at boot instead of 500ing on first login. - Recovery codes are now normalized (uppercased, punctuation-stripped) before hashing and verifying, so a code retyped lowercase or without the dash still matches — this changes the stored hash format, safe because `auth-mfa` has no deployed consumer with enrolled users yet. Also fixes `samples/apps/user-data-rights-demo`'s forget-cleanup test, which asserted on the manual `runForgetCleanup` helper instead of driving the actually-registered cron job through its real `JobContext` wrapper."
+  },
+  {
+    "version": "0.149.1",
+    "type": "fix",
+    "title": "Fix `auth-mfa` crashing on enable/regenerate for any app with per-subject crypto-shreddin…",
+    "detail": "Fix `auth-mfa` crashing on enable/regenerate for any app with per-subject crypto-shredding (`configurePiiSubjectKms`) active: `recoveryCodes` was a `jsonb` field marked `userOwned`, but the PII-encryption pipeline requires a string value for any subject-owned field — every real enable-confirm write threw `PII field \"recoveryCodes\" must be a string, got object`. `recoveryCodes` is now a `createTextField({ encrypted: true, userOwned })` (JSON-stringified at the write/read boundary), matching `totpSecret`. That exposed a second, deeper bug: a field carrying both `encrypted: true` and a subject marker is written as `PII(envelope(plaintext))`, but `decryptForRead` peeled the layers in write order instead of reverse order, so the envelope cipher choked on a still-PII-wrapped string. Fixed `event-store-executor-context.ts`'s `decryptForRead` to unwrap PII first, then envelope — and updated `auth-mfa`'s KEK-reencrypt job (which reads raw rows, bypassing `decryptForRead`) to do the same. Also: `MfaEnableScreen` now takes an optional `onEnabled` callback, fired after a successful enable-confirm — hosts that compose it inside their own MFA-status view (like kumiko-studio's account-security screen) need it to know when to refetch and swap away from the embedded enable flow. - @cosmicdrift/kumiko-framework@0.149.1 - @cosmicdrift/kumiko-headless@0.149.1 - @cosmicdrift/kumiko-renderer@0.149.1 - @cosmicdrift/kumiko-dispatcher-live@0.149.1 - @cosmicdrift/kumiko-renderer-web@0.149.1"
+  },
+  {
+    "version": "0.149.0",
+    "type": "improvement",
+    "title": "`auth-mfa/web` gains `MfaDisableDialog`, `MfaRegenerateRecoveryDialog`, and `MfaRecoveryC…",
+    "detail": "`auth-mfa/web` gains `MfaDisableDialog`, `MfaRegenerateRecoveryDialog`, and `MfaRecoveryCodesReveal` — the disable/regenerate-recovery UI deferred from the initial MFA-UI PR (kumiko-framework#266). Also fixes `MfaEnableScreen`'s error banner, which templated the raw snake_case server error code straight into the i18n key (`auth.mfa.errors.invalid_totp_code`) instead of the camelCase key actually registered (`auth.mfa.errors.invalidCode`) — extracted into a shared `mfaManageErrorKey` helper, now used by all three write-triggering components."
+  },
+  {
+    "version": "0.149.0",
+    "type": "improvement",
+    "title": "`auth-mfa` gains a `status` query (`AuthMfaQueries.status`, wire QN `auth-mfa:query:user-…",
+    "detail": "`auth-mfa` gains a `status` query (`AuthMfaQueries.status`, wire QN `auth-mfa:query:user-mfa:status`) returning `{ enabled: boolean }` for the calling user — the one thing a settings/security screen needs to decide whether to show the enrollment flow or the disable/regenerate actions. No client-side signal carried this before."
+  }
+]

package/src/auth-mfa/web/__tests__/mfa-verify-screen.test.tsx

@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { describe, expect, mock, test } from "bun:test";
 import {
   createStaticLocaleResolver,
   LocaleProvider,
@@ -7,6 +7,7 @@ import {
 import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
 import { fireEvent, type RenderResult, render, screen, waitFor } from "@testing-library/react";
 import type { ReactElement } from "react";
+import { installFetchMock } from "../../../auth-email-password/web/__tests__/fetch-mock";
 import { makeSessionApi } from "../../../auth-email-password/web/__tests__/test-utils";
 import { SessionContext } from "../../../auth-email-password/web/session";
 import { defaultTranslations } from "../i18n";
@@ -25,16 +26,7 @@ function renderScreen(ui: ReactElement, session = makeSessionApi()): RenderResul
   );
 }
 
-const originalFetch = globalThis.fetch;
-
-beforeEach(() => {
-  globalThis.fetch = mock(
-    async () => new Response(null, { status: 200 }),
-  ) as unknown as typeof fetch;
-});
-afterEach(() => {
-  globalThis.fetch = originalFetch;
-});
+installFetchMock();
 
 describe("MfaVerifyScreen", () => {
   test("rendert Titel + Code-Feld + Submit-Button (de)", () => {

package/src/auth-mfa-user-data/changes.json

@@ -0,0 +1 @@
+[]

package/src/billing-foundation/changes.json

@@ -0,0 +1 @@
+[]

package/src/cap-counter/changes.json

@@ -0,0 +1 @@
+[]

package/src/channel-email/changes.json

@@ -0,0 +1 @@
+[]

package/src/channel-in-app/changes.json

@@ -0,0 +1 @@
+[]

package/src/channel-push/changes.json

@@ -0,0 +1 @@
+[]

package/src/compliance-profiles/changes.json

@@ -0,0 +1 @@
+[]

package/src/config/changes.json

@@ -0,0 +1,9 @@
+[
+  {
+    "version": "0.165.0",
+    "type": "breaking",
+    "title": "Reencrypt job: removed legacy-decrypt path",
+    "detail": "The old single-key format (CONFIG_ENCRYPTION_KEY) is no longer supported. The reencrypt job now classifies rows as rotate/current/unrecognized — unreadable rows are counted as failed instead of silently attempted.",
+    "migration": "If any config values still exist in the old single-key format, re-encrypt them with the current envelope format before upgrading. The job will now throw an error instead of attempting migration."
+  }
+]

package/src/crypto-shredding/changes.json

@@ -0,0 +1,14 @@
+[
+  {
+    "version": "0.165.3",
+    "type": "improvement",
+    "title": "Searchable subject-PII via derived Meili index (fw#1610).",
+    "detail": "Fields may be searchable + userOwned/tenantOwned: the search consumer decrypts into Meili (ciphertext stays at rest). Forget erases the subject key and purgeSearchDocumentsForSubject removes Meili docs (ciphertext LIKE + ownership for post-anonymize). sortable + subject remains forbidden; sensitive + searchable is rejected at boot."
+  },
+  {
+    "version": "0.119.0",
+    "type": "improvement",
+    "title": "Crypto-shredding phase D: forget wire.",
+    "detail": "Crypto-shredding phase D: forget wire. New `crypto-shredding` bundled feature with the `forget-subject` operator command (DPO/SystemAdmin) — erases a user/tenant subject key and appends a `subject-forgotten` audit event. `user-data-rights` forget-cleanup now erases the user's subject key inside the per-user sub-tx (crash-safe, before the status flip). Fixes `list()` returning ciphertext for camelCase encrypted/pii fields and caching plaintext rows."
+  }
+]

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -8,6 +8,7 @@ import {
 import { nullBlindIndexesForSubject } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
 import { z } from "zod";
 import { CRYPTO_SHREDDING_AGGREGATE_TYPE, SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
 
@@ -75,6 +76,18 @@ export const forgetSubjectWrite = defineWriteHandler({
     // adressiert das Subject tenant-übergreifend.
     await nullBlindIndexesForSubject(ctx.db.raw, ctx.registry.features, subjectKey);
 
+    // Derived search index still holds plaintext (#1610) — purge next to the
+    // blind-index sweep. No adapter → no-op (apps without search).
+    if (ctx.searchAdapter) {
+      await purgeSearchDocumentsForSubject(
+        ctx.db.raw,
+        ctx.registry.features,
+        ctx.searchAdapter,
+        subjectKey,
+        subject,
+      );
+    }
+
     await ctx.unsafeAppendEvent({
       aggregateId: raw.kind === "user" ? raw.userId : raw.tenantId,
       aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,