@cosmicdrift/kumiko-bundled-features 0.165.2 → 0.165.4

package/src/seo/changes.json

@@ -0,0 +1,20 @@
+[
+  {
+    "version": "0.147.3",
+    "type": "fix",
+    "title": "`managed-pages`' `GET {basePath}/:slug` render route and `seo`'s `sitemap.xml`/`llms.txt`…",
+    "detail": "`managed-pages`' `GET {basePath}/:slug` render route and `seo`'s `sitemap.xml`/`llms.txt` routes now use the `systemQuery` in-process dispatch (introduced for `legal-pages` in the `resolverTrust` fix) instead of an internal `app.fetch` self-request with a forged `X-Tenant` header. That self-fetch carried no `Host` header (Host is only implied by the request URL, never stored in `Headers`), so a host-based `anonymousAccess.tenantResolver` reading only the header resolved `null` for the inner request. Under `resolverTrust: \"authoritative\"` there is no client-tenant fallback for a `null` resolution, so the route failed with `tenant_required` (503 \"page unavailable\" / empty sitemap entries) even for a legitimate, correctly-routed visitor. `systemQuery` forces the already host-resolved tenant in-process — no header round-trip, nothing that can go missing. Consumers running `managed-pages` or `seo` with `resolverTrust: \"authoritative\"` should upgrade — the render/discovery routes were not reliably servable under that mode before this fix. - @cosmicdrift/kumiko-framework@0.147.3 - @cosmicdrift/kumiko-dispatcher-live@0.147.3 - @cosmicdrift/kumiko-headless@0.147.3 - @cosmicdrift/kumiko-renderer@0.147.3 - @cosmicdrift/kumiko-renderer-web@0.147.3"
+  },
+  {
+    "version": "0.146.2",
+    "type": "fix",
+    "title": "seo: fix legal-pages/managed-pages URLs downgrading to http:// in sitemap.xml/llms.txt be…",
+    "detail": "seo: fix legal-pages/managed-pages URLs downgrading to http:// in sitemap.xml/llms.txt behind a TLS-terminating reverse proxy (#979 follow-up) — `requestHost()` trusted the raw request URL's scheme, which reflects the proxy's internal (plain HTTP) hop, not what the client actually used. Now prefers `x-forwarded-proto` when present, falling back to the raw URL scheme only for plain local dev without a proxy in front. Found by checking the sitemap.xml of the two production apps (cashcolt.kumiko.rocks, publicstatus.eu) that mount `seo` — both showed `http://` legal-pages entries next to correctly `https://` app-supplied entries (those app callbacks hardcode `https://` themselves, masking the bug). - @cosmicdrift/kumiko-framework@0.146.2 - @cosmicdrift/kumiko-dispatcher-live@0.146.2 - @cosmicdrift/kumiko-headless@0.146.2 - @cosmicdrift/kumiko-renderer@0.146.2 - @cosmicdrift/kumiko-renderer-web@0.146.2"
+  },
+  {
+    "version": "0.146.0",
+    "type": "improvement",
+    "title": "seo: neues bundled-feature für SEO/AEO/GEO-Site-Discovery (#979) — `createSeoFeature` mou…",
+    "detail": "seo: neues bundled-feature für SEO/AEO/GEO-Site-Discovery (#979) — `createSeoFeature` mountet GET /sitemap.xml, /llms.txt und optional /robots.txt (merged aus app-eigenem Callback + legal-pages + managed-pages), plus die additive OG/JSON-LD-Erweiterung für `wrapInLayout` und die pure `organizationSchema`/`webPageSchema`/`faqPageSchema`-Builder für `ApexHead.schemaJson`. `managed-pages` bekommt dafür die neue anonyme `by-tenant-published`-Query. War Teil von #979, hatte aber kein Changeset — daher hier nachgereicht, damit die Version tatsächlich published wird."
+  }
+]

package/src/sessions/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.165.0",
+    "type": "improvement",
+    "title": "Revoke handlers emit session-revoked event",
+    "detail": "Session revocation now appends a session-revoked event to the aggregate stream — other features can react to it (e.g. cache invalidation)."
+  }
+]

package/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -1,3 +1,4 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
@@ -58,14 +59,21 @@ export const revokeAllForUserWrite = defineWriteHandler({
         userId: event.payload.userId,
         sessionIds: updated.map((row) => row.id),
       });
+      const reqCtx = requestContext.get();
       await append(ctx.db.raw, {
         aggregateId: generateId(),
         aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
         tenantId: SYSTEM_TENANT_ID,
         expectedVersion: 0,
         type: SESSION_REVOKED_EVENT_QN,
+        eventVersion: ctx.registry.getEvent(SESSION_REVOKED_EVENT_QN)?.version ?? 1,
         payload,
-        metadata: { userId: event.user.id },
+        metadata: {
+          userId: event.user.id,
+          ...(reqCtx?.requestId ? { requestId: reqCtx.requestId } : {}),
+          ...(reqCtx?.correlationId ? { correlationId: reqCtx.correlationId } : {}),
+          ...(reqCtx?.causationId ? { causationId: reqCtx.causationId } : {}),
+        },
       });
     }
 

package/src/shared/changes.json

@@ -0,0 +1 @@
+[]

package/src/step-dispatcher/changes.json

@@ -0,0 +1 @@
+[]

package/src/subscription-mollie/changes.json

@@ -0,0 +1 @@
+[]

package/src/subscription-stripe/changes.json

@@ -0,0 +1 @@
+[]

package/src/tags/changes.json

@@ -0,0 +1 @@
+[]

package/src/template-resolver/changes.json

@@ -0,0 +1 @@
+[]

package/src/tenant/changes.json

@@ -0,0 +1,27 @@
+[
+  {
+    "version": "0.165.0",
+    "type": "fix",
+    "title": "resolveRawDb: removed redundant null check",
+    "detail": "CodeQL flagged db !== null after if (!db) — truthiness already excludes null. Internal cleanup, no API break."
+  },
+  {
+    "version": "0.165.0",
+    "type": "fix",
+    "title": "Seed hook: explicit SessionUser typing",
+    "detail": "Fixed tenant seeding type annotation — prevents implicit any propagation in seed handlers."
+  },
+  {
+    "version": "0.165.0",
+    "type": "fix",
+    "title": "Seed afterCommit + real tenant rescope",
+    "detail": "ScheduleAfterCommit now available on HandlerContext — fireEntityPostSave queues after TX commit instead of mid-transaction. DB/notify/hasFeature/_tenantId are correctly rescoped when targeting an entity's tenant.",
+    "migration": "Only affects custom seed handlers using fireEntityPostSave — now afterCommit-compatible."
+  },
+  {
+    "version": "0.163.0",
+    "type": "improvement",
+    "title": "tenant: seedTenant fires entity postSave hooks (#1463).",
+    "detail": "tenant: seedTenant fires entity postSave hooks (#1463). `seedTenant` writes through the raw event-store executor, which never fired postSave hooks — self-signup (`provisionSignupAccount` → `signup-confirm`) silently skipped feature-registered entity hooks like tier-engine's auto-default-tier and app-level auto-default-compliance, leaving new tenants without a tier/compliance row. `seedTenant` and `provisionSignupAccount` take a new optional `hooks: { registry, context }` param; passing it fires the same entity-scoped postSave hooks the dispatcher would, without the full dispatch roundtrip. Existing call-sites are unaffected — the param is optional and append-only."
+  }
+]

package/src/tenant-lifecycle/changes.json

@@ -0,0 +1 @@
+[]

package/src/tenant-settings/changes.json

@@ -0,0 +1 @@
+[]

package/src/text-content/changes.json

@@ -0,0 +1,14 @@
+[
+  {
+    "version": "0.165.0",
+    "type": "fix",
+    "title": "Legal pages seed: SYSTEM_USER instead of tenant user",
+    "detail": "Seed now runs as SYSTEM_USER and skips identical re-seeds — prevents unnecessary DB writes."
+  },
+  {
+    "version": "0.130.2",
+    "type": "fix",
+    "title": "Content-Tree + Config-Nav Sysadmin-Shell polish: - text-content: Leaf-Knoten tragen jetzt…",
+    "detail": "Content-Tree + Config-Nav Sysadmin-Shell polish: - text-content: Leaf-Knoten tragen jetzt ein `file`-Icon statt eines Dots; der Editor läuft auf der Page-Shell (`Form`-Primitive mit Card statt des entfernten `FormPanelShell`). - Sidebar-Nav bekommt ein Suchfeld, das den Baum live filtert (Treffer + ihre Ancestors bleiben, zugeklappte Ordner öffnen für die Suche). - Ordner-Knoten zeigen `folder-open` wenn ausgeklappt. - NAV_ICONS um `server`, `mail`, `lock`, `hash`, `download`, `folder-open` ergänzt — SMTP-/Config-Nav-Kinder (z.B. „Email-Versand\") rendern damit ein Icon statt blank. - Verschachtelte Provider-Ordner (Content-Tree) rendern ihre Kinder in einem `<ul>` (valides HTML + Einrück-Stufe pro Tiefe) statt `<li>`-in-`<li>`. - Platform-Overview: `user:query:user:list` in der Allowlist (behebt den Overview-Crash). - @cosmicdrift/kumiko-renderer-web@0.130.2 - @cosmicdrift/kumiko-renderer@0.130.2 - @cosmicdrift/kumiko-framework@0.130.2 - @cosmicdrift/kumiko-dispatcher-live@0.130.2 - @cosmicdrift/kumiko-headless@0.130.2"
+  }
+]

package/src/tier-engine/changes.json

@@ -0,0 +1 @@
+[]

package/src/user/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.165.3",
+    "type": "improvement",
+    "title": "user.displayName is searchable via derived Meili (fw#1610).",
+    "detail": "displayName is userOwned PII and now searchable through the decrypt-into-Meili path; forget purges the index entry with the subject key."
+  }
+]

package/src/user/schema/user.ts

@@ -79,11 +79,14 @@ export const userEntity = createEntity({
       access: { read: access.privileged, write: access.privileged },
     }),
 
-    // Profile — user-editable. Display-name is real-name in most apps,
-    // so treat as PII for DSGVO export/forget pipelines. NOT searchable:
-    // substring search on an encrypted field would require plaintext copies
-    // in the search index (boot-validator rejects the combination, #818).
-    displayName: createTextField({ required: true, maxLength: 100, pii: true }),
+    // Profile — user-editable. Real name in most apps → PII. Searchable via
+    // the derived Meili index; events/projection stay ciphertext (#1610).
+    displayName: createTextField({
+      required: true,
+      maxLength: 100,
+      pii: true,
+      searchable: true,
+    }),
     locale: createTextField({ maxLength: 10, default: "de" }),
 
     // Which tenant should this user land in on next login. Set by the login

package/src/user-data-rights/__tests__/audit-log.integration.test.ts

@@ -44,7 +44,6 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       authFoundationFeature,
       createSessionsFeature(),
-
       createUserDataRightsFeature(),
     ],
   });
@@ -128,8 +127,13 @@ describe("my-audit-log", () => {
     expect(bobLog.rows.length).toBe(1);
     // Payload-pinning beweist die Cross-User-Filterung: alice sieht nur
     // ihre Payload, bob nur seine.
-    expect((aliceLog.rows[0]?.payload as { foo: string }).foo).toBe("alice");
-    expect((bobLog.rows[0]?.payload as { foo: string }).foo).toBe("bob");
+    const aliceRow = aliceLog.rows[0];
+    const bobRow = bobLog.rows[0];
+    expect(aliceRow).toBeDefined();
+    expect(bobRow).toBeDefined();
+    if (!aliceRow || !bobRow) throw new Error("expected audit rows");
+    expect((aliceRow.payload as { foo: string }).foo).toBe("alice");
+    expect((bobRow.payload as { foo: string }).foo).toBe("bob");
   });
 
   test("Account-weite Sicht: User sieht events aus anderen Tenants (DSGVO Art. 15)", async () => {

package/src/user-data-rights/__tests__/cross-data-matrix.integration.test.ts

@@ -121,7 +121,6 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       authFoundationFeature,
       createSessionsFeature(),
-
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),
       testNotesFeature,

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -118,7 +118,6 @@ beforeAll(async () => {
       noSignedUrlProviderFeature,
       authFoundationFeature,
       createSessionsFeature(),
-
       createUserDataRightsFeature(),
     ],
     extraContext: ({ registry }) => ({

package/src/user-data-rights/__tests__/export-job-idempotency.integration.test.ts

@@ -46,7 +46,6 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       authFoundationFeature,
       createSessionsFeature(),
-
       createUserDataRightsFeature(),
     ],
   });

package/src/user-data-rights/__tests__/request-cancel-deletion.integration.test.ts

@@ -60,7 +60,6 @@ const features = [
   createComplianceProfilesFeature(),
   authFoundationFeature,
   createSessionsFeature(),
-
   createUserDataRightsFeature(),
 ];
 

package/src/user-data-rights/__tests__/request-deletion-callback.integration.test.ts

@@ -67,7 +67,6 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       authFoundationFeature,
       createSessionsFeature(),
-
       createUserDataRightsFeature({ sendDeletionRequestedEmail }),
     ],
   });

package/src/user-data-rights/__tests__/request-export.integration.test.ts

@@ -56,7 +56,6 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       authFoundationFeature,
       createSessionsFeature(),
-
       createUserDataRightsFeature(),
     ],
   });

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -62,7 +62,6 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       authFoundationFeature,
       createSessionsFeature(),
-
       createUserDataRightsFeature(),
     ],
   });
@@ -969,7 +968,6 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
         createComplianceProfilesFeature(),
         authFoundationFeature,
         createSessionsFeature(),
-
         createUserDataRightsFeature(),
         testFileExporter,
       ],

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -70,7 +70,6 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       authFoundationFeature,
       createSessionsFeature(),
-
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),
     ],

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -64,7 +64,6 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       authFoundationFeature,
       createSessionsFeature(),
-
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),
     ],

package/src/user-data-rights/changes.json

@@ -0,0 +1,27 @@
+[
+  {
+    "version": "0.165.3",
+    "type": "improvement",
+    "title": "Forget cleanup purges derived Meili docs for searchable subject-PII (fw#1610).",
+    "detail": "run-forget-cleanup (and the forget cron path) call purgeSearchDocumentsForSubject after crypto-shred so searchable userOwned fields do not linger in Meili as plaintext after Art. 17."
+  },
+  {
+    "version": "0.165.0",
+    "type": "breaking",
+    "title": "Export download: removed ?token= query param",
+    "detail": "GET /user-export/by-token no longer accepts the token as a query parameter. Only POST body (read from URL fragment) is supported now. Old email links with ?token= in the URL will stop working.",
+    "migration": "Replace any existing export links that use ?token= in the URL with POST-based links. The token is now only read from the URL fragment (#token), which browsers never send to the server."
+  },
+  {
+    "version": "0.122.0",
+    "type": "fix",
+    "title": "user-data-rights: export-download-token re-runs rotate the token in place on the same agg…",
+    "detail": "user-data-rights: export-download-token re-runs rotate the token in place on the same aggregate (update) instead of creating a second aggregate for the same jobId. A second `created` event without a `deleted` in between made every projection rebuild collide on the `one_per_job` unique index (fw#832). Operator recovery after a lost plain token is now just \"flip the job back to pending\" — never delete the token row read-side. - @cosmicdrift/kumiko-framework@0.122.0 - @cosmicdrift/kumiko-headless@0.122.0 - @cosmicdrift/kumiko-renderer@0.122.0 - @cosmicdrift/kumiko-dispatcher-live@0.122.0 - @cosmicdrift/kumiko-renderer-web@0.122.0"
+  },
+  {
+    "version": "0.119.0",
+    "type": "improvement",
+    "title": "Crypto-shredding phase D: forget wire.",
+    "detail": "Crypto-shredding phase D: forget wire. New `crypto-shredding` bundled feature with the `forget-subject` operator command (DPO/SystemAdmin) — erases a user/tenant subject key and appends a `subject-forgotten` audit event. `user-data-rights` forget-cleanup now erases the user's subject key inside the per-user sub-tx (crash-safe, before the status flip). Fixes `list()` returning ciphertext for camelCase encrypted/pii fields and caching plaintext rows."
+  }
+]

package/src/user-data-rights/feature.ts

@@ -309,13 +309,13 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     // afterward (a redirect doesn't undo an already-logged request) — the
     // only leak-proof fix is to never accept the token that way.
     //
-    // Path liegt AUSSERHALB /api/* weil r.httpRoute den /api-namespace nicht
-    // claimen darf (reserved fuer write/query/batch/auth/sse-dispatcher).
+    // Path sits outside /api/* — r.httpRoute must not claim the /api namespace
+    // (reserved for write/query/batch/auth/sse-dispatcher).
     //
-    // Der Session-Pfad (eingeloggter Download) braucht KEINEN httpRoute-
-    // Wrapper: der Client ruft download-by-job direkt via Dispatcher (traegt
-    // X-CSRF-Token mit) und navigiert auf die zurueckgegebene signed-URL —
-    // siehe postWithDownload im privacy-center-screen.
+    // The session path (logged-in download) needs no httpRoute wrapper: the
+    // client calls download-by-job via the Dispatcher (with X-CSRF-Token) and
+    // navigates to the returned signed URL — see postWithDownload in
+    // privacy-center-screen.
     r.httpRoute({
       method: "GET",
       path: "/user-export/by-token",
@@ -524,6 +524,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           registry: forgetRegistry,
           now: T.Now.instant(),
           tenantModel,
+          ...(ctx.searchAdapter !== undefined && { searchAdapter: ctx.searchAdapter }),
           // Same per-tenant provider resolution as the export cron — forget
           // deletes binaries from the store upload + export use.
           buildStorageProvider: makeTenantStorageProviderResolver({

package/src/user-data-rights/handlers/lift-restriction.write.ts

@@ -1,14 +1,9 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  AccessDeniedError,
-  UnprocessableError,
-  writeFailure,
-} from "@cosmicdrift/kumiko-framework/errors";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { tenantMembershipsTable } from "../../tenant";
 import { USER_STATUS, userTable } from "../../user";
-import { isSystemAdminActor } from "../lib/is-admin-actor";
+import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 
 // POST /api/user/lift-restriction (S2.U6) — DSGVO Art. 18 Reverse.
@@ -41,19 +36,8 @@ export const liftRestrictionWrite = defineWriteHandler({
   handler: async (event, ctx) => {
     const targetUserId = event.payload.userId;
 
-    if (!isSystemAdminActor(event.user)) {
-      const membership = await fetchOne(ctx.db.raw, tenantMembershipsTable, {
-        userId: targetUserId,
-        tenantId: event.user.tenantId,
-      });
-      if (!membership) {
-        return writeFailure(
-          new AccessDeniedError({
-            details: { reason: "target_user_not_in_admin_tenant" },
-          }),
-        );
-      }
-    }
+    const outside = await denyIfTargetOutsideAdminTenant(ctx.db.raw, event.user, targetUserId);
+    if (outside) return outside;
 
     const userRow = await fetchOne<{ status: string }>(ctx.db.raw, userTable, {
       id: targetUserId,

package/src/user-data-rights/handlers/restrict-account.write.ts

@@ -6,9 +6,9 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { tenantMembershipsTable } from "../../tenant";
 import { USER_STATUS, userTable } from "../../user";
-import { isAdminActor, isSystemAdminActor } from "../lib/is-admin-actor";
+import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant";
+import { isAdminActor } from "../lib/is-admin-actor";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 
 // POST /api/user/restrict (S2.U6) — DSGVO Art. 18 Account-Freeze.
@@ -56,24 +56,8 @@ export const restrictAccountWrite = defineWriteHandler({
           }),
         );
       }
-      // Same cross-tenant guard as lift-restriction.write.ts: only
-      // SystemAdmin (platform-wide) may target a user without an active
-      // membership in the caller's own tenant. Without this, a TenantAdmin
-      // from tenant A could restrict — and force-revoke the sessions of —
-      // a user who has never been a member of tenant A.
-      if (!isSystemAdminActor(event.user)) {
-        const membership = await fetchOne(ctx.db.raw, tenantMembershipsTable, {
-          userId: targetUserId,
-          tenantId: event.user.tenantId,
-        });
-        if (!membership) {
-          return writeFailure(
-            new AccessDeniedError({
-              details: { reason: "target_user_not_in_admin_tenant" },
-            }),
-          );
-        }
-      }
+      const outside = await denyIfTargetOutsideAdminTenant(ctx.db.raw, event.user, targetUserId);
+      if (outside) return outside;
     }
 
     // ctx.db.raw weil User-Entity tenant-agnostisch ist (analog

package/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -57,6 +57,7 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
         registry: ctx.registry,
         now: T.Now.instant(),
         tenantModel,
+        ...(ctx.searchAdapter !== undefined && { searchAdapter: ctx.searchAdapter }),
         buildStorageProvider: makeTenantStorageProviderResolver({
           registry: ctx.registry,
           configResolver: ctx.configResolver,

package/src/user-data-rights/lib/deny-if-target-outside-admin-tenant.ts

@@ -0,0 +1,32 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { tenantMembershipsTable } from "../../tenant";
+import { isSystemAdminActor } from "./is-admin-actor";
+
+export const TARGET_USER_NOT_IN_ADMIN_TENANT = "target_user_not_in_admin_tenant" as const;
+
+type DbRaw = Parameters<typeof fetchOne>[0];
+
+/** SystemAdmin skips; otherwise the target must have a membership in the actor's tenant. */
+export async function denyIfTargetOutsideAdminTenant(
+  db: DbRaw,
+  actor: SessionUser,
+  targetUserId: string,
+): Promise<WriteFailure | undefined> {
+  if (isSystemAdminActor(actor)) return undefined;
+  const membership = await fetchOne(db, tenantMembershipsTable, {
+    userId: targetUserId,
+    tenantId: actor.tenantId,
+  });
+  if (membership) return undefined;
+  return writeFailure(
+    new AccessDeniedError({
+      details: { reason: TARGET_USER_NOT_IN_ADMIN_TENANT },
+    }),
+  );
+}

package/src/user-data-rights/run-forget-cleanup.ts

@@ -49,6 +49,10 @@ import {
   type UserDataDeleteStrategy,
   type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  purgeSearchDocumentsForSubject,
+  type SearchAdapter,
+} from "@cosmicdrift/kumiko-framework/search";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { resolveRetentionPolicyForTenant } from "../data-retention";
 import { decryptStoredPii } from "../shared";
@@ -116,6 +120,13 @@ export interface RunForgetCleanupArgs {
    */
   readonly kms?: KmsAdapter;
 
+  /**
+   * Search adapter for purging derived Meili docs of searchable subject-PII
+   * (#1610). Same seam as forget-subject. Omitted → no search purge (apps
+   * without Meili).
+   */
+  readonly searchAdapter?: SearchAdapter;
+
   /**
    * App-level tenant-occupancy model (resolved from the `tenantModel` config by
    * the cron/handler). The pipeline refines it PER TENANT with a sole-member
@@ -235,6 +246,7 @@ export async function runForgetCleanup(
       buildStorageProvider,
       appTenantModel,
       kms,
+      searchAdapter: args.searchAdapter,
     });
     hookCallsAttempted += userResult.hookCallsAttempted;
     errors.push(...userResult.errors);
@@ -298,6 +310,7 @@ async function processUser(args: {
   buildStorageProvider?: (tenantId: TenantId) => Promise<UserDataStorageProvider | undefined>;
   appTenantModel: TenantUserModel;
   kms?: KmsAdapter;
+  searchAdapter?: SearchAdapter;
 }): Promise<ProcessUserResult> {
   const { db, registry, userId, hookEntries, buildStorageProvider, appTenantModel, kms } = args;
   const errors: ForgetCleanupError[] = [];
@@ -422,6 +435,16 @@ async function processUser(args: {
           registry.features,
           subjectIdToKey({ kind: "user", userId }),
         );
+        if (args.searchAdapter) {
+          const subject = { kind: "user" as const, userId };
+          await purgeSearchDocumentsForSubject(
+            tx,
+            registry.features,
+            args.searchAdapter,
+            subjectIdToKey(subject),
+            subject,
+          );
+        }
       }
 
       // Status-Flip in derselben Sub-Tx. Falls einer der Hooks oben

package/src/user-data-rights-defaults/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.116.0",
+    "type": "fix",
+    "title": "user-data-rights-defaults now registers EXT_USER_DATA export/delete hooks for six more bu…",
+    "detail": "user-data-rights-defaults now registers EXT_USER_DATA export/delete hooks for six more bundled entities: user-session (ip/userAgent), api-token, in-app-message, tenant-invitation, notification-preference and user-scoped config-value. Hooks no-op when the source feature isn't mounted. pii annotations added on the affected schema fields. - @cosmicdrift/kumiko-renderer-web@0.116.0 - @cosmicdrift/kumiko-framework@0.116.0 - @cosmicdrift/kumiko-dispatcher-live@0.116.0 - @cosmicdrift/kumiko-headless@0.116.0 - @cosmicdrift/kumiko-renderer@0.116.0"
+  }
+]

package/src/user-profile/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.123.2",
+    "type": "fix",
+    "title": "Consistency: user-profile's ProfileScreen adopts the shared `FormScreenShell` (centered `…",
+    "detail": "Consistency: user-profile's ProfileScreen adopts the shared `FormScreenShell` (centered `max-w-3xl` like all other settings screens, was left-aligned `max-w-5xl`). DataTable now sits on `bg-card` instead of a transparent surface — on themes with a colored page background (e.g. cream) lists previously didn't match the white cards; now they do. - @cosmicdrift/kumiko-renderer-web@0.123.2 - @cosmicdrift/kumiko-framework@0.123.2 - @cosmicdrift/kumiko-dispatcher-live@0.123.2 - @cosmicdrift/kumiko-headless@0.123.2 - @cosmicdrift/kumiko-renderer@0.123.2"
+  }
+]