@cosmicdrift/kumiko-bundled-features 0.166.0 → 0.167.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.166.0",
+  "version": "0.167.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -119,11 +119,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.166.0",
-    "@cosmicdrift/kumiko-framework": "0.166.0",
-    "@cosmicdrift/kumiko-headless": "0.166.0",
-    "@cosmicdrift/kumiko-renderer": "0.166.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.166.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.167.1",
+    "@cosmicdrift/kumiko-framework": "0.167.1",
+    "@cosmicdrift/kumiko-headless": "0.167.1",
+    "@cosmicdrift/kumiko-renderer": "0.167.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.167.1",
+    "@cosmicdrift/kumiko-types": "0.167.1",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",
@@ -147,9 +148,6 @@
     "README.md",
     "LICENSE"
   ],
-  "peerDependencies": {
-    "@cosmicdrift/kumiko-types": "^0.166.0"
-  },
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/mailparser": "^3.4.6",

package/src/auth-email-password/__tests__/invite-flow-kms.integration.test.ts

@@ -13,8 +13,6 @@ import {
   decryptPiiFieldValues,
   InMemoryKmsAdapter,
   isPiiCiphertext,
-  resetBlindIndexKeyForTests,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -23,6 +21,10 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import {
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";

package/src/auth-email-password/__tests__/login-gates.test.ts

@@ -1,7 +1,17 @@
 import { describe, expect, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { USER_STATUS } from "../../user";
 import type { AuthUserRow } from "../auth-user-row";
-import { gateEnforceAccountStatus, gateEnforceEmailVerified } from "../handlers/login.write";
+import {
+  gateBuildSession,
+  gateEnforceAccountStatus,
+  gateEnforceEmailVerified,
+} from "../handlers/login.write";
+
+// resolveAuthClaims is the only ctx member gateBuildSession touches.
+const authClaimsCtx = {
+  resolveAuthClaims: async () => ({}),
+} as unknown as HandlerContext;
 
 function row(over: Partial<AuthUserRow> = {}): AuthUserRow {
   return { id: "00000000-0000-4000-8000-000000000001", passwordHash: "x", ...over };
@@ -36,4 +46,28 @@ describe("login.write gates (fw#1284)", () => {
   test("gateEnforceAccountStatus passes active", () => {
     expect(gateEnforceAccountStatus(row({ status: USER_STATUS.Active })).ok).toBe(true);
   });
+
+  test("gateBuildSession carries the user's timezone into the session", async () => {
+    const g = await gateBuildSession(
+      authClaimsCtx,
+      "00000000-0000-4000-8000-000000000001",
+      "00000000-0000-4000-8000-000000000002",
+      ["User"],
+      "Asia/Tokyo",
+    );
+    expect(g.ok).toBe(true);
+    if (g.ok) expect(g.value.session.timezone).toBe("Asia/Tokyo");
+  });
+
+  test("gateBuildSession omits timezone when the user never set one (fw#1636)", async () => {
+    const g = await gateBuildSession(
+      authClaimsCtx,
+      "00000000-0000-4000-8000-000000000001",
+      "00000000-0000-4000-8000-000000000002",
+      ["User"],
+      null,
+    );
+    expect(g.ok).toBe(true);
+    if (g.ok) expect(g.value.session.timezone).toBeUndefined();
+  });
 });

package/src/auth-email-password/auth-user-row.ts

@@ -17,6 +17,8 @@ export type AuthUserRow = {
   readonly isDeleted?: boolean | null;
   readonly emailVerified?: boolean | null;
   readonly lastActiveTenantId?: TenantId | string | null;
+  // IANA zone — threaded into SessionUser.timezone at login (fw#1636).
+  readonly timezone?: string | null;
   // JSON-encoded string[] — globale Rollen die parallel zu tenant-membership-
   // roles gelten (z.B. SystemAdmin, BillingAdmin). Caller deserialisiert via
   // parseRoles() vor dem Merge in die Session.

package/src/auth-email-password/handlers/login.write.ts

@@ -224,11 +224,13 @@ export async function gateBuildSession(
   userId: string,
   tenantId: TenantId,
   mergedRoles: readonly string[],
+  timezone?: string | null,
 ): Promise<GateOutcome<{ readonly kind: "auth-session"; readonly session: SessionUser }>> {
   const baseSession: SessionUser = {
     id: userId,
     tenantId,
     roles: mergedRoles,
+    ...(timezone !== null && timezone !== undefined && { timezone }),
   };
   const claims = await ctx.resolveAuthClaims(baseSession);
   const session: SessionUser =
@@ -294,7 +296,13 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
         return { isSuccess: true, data: mfaGate.value };
       }
 
-      const sessionGate = await gateBuildSession(ctx, found.id, chosen.tenantId, mergedRoles);
+      const sessionGate = await gateBuildSession(
+        ctx,
+        found.id,
+        chosen.tenantId,
+        mergedRoles,
+        found.timezone,
+      );
       if (!sessionGate.ok) return sessionGate.result;
       return { isSuccess: true, data: sessionGate.value };
     },

package/src/auth-mfa/__tests__/pii-subject-encryption.integration.test.ts

@@ -10,11 +10,7 @@
 // non-string userOwned field. enable-confirm failed for EVERY real deployment
 // with crypto-shredding configured, while every test here stayed green.
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import {
-  configurePiiSubjectKms,
-  InMemoryKmsAdapter,
-  resetPiiSubjectKmsForTests,
-} from "@cosmicdrift/kumiko-framework/crypto";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
 import {
   createTestUser,
@@ -23,7 +19,10 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -20,7 +20,6 @@ import {
   InMemoryKmsAdapter,
   isPiiCiphertext,
   PII_ERASED_SENTINEL,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
@@ -36,6 +35,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
 import {
   ComplianceProfileHandlers,
   createComplianceProfilesFeature,

package/src/config/__tests__/pii-encrypted.integration.test.ts

@@ -12,7 +12,6 @@ import {
   InMemoryKmsAdapter,
   isPiiCiphertext,
   PII_CIPHERTEXT_PREFIX,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   access,
@@ -27,6 +26,7 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
 import { ConfigHandlers, ConfigQueries } from "../constants";
 import { createConfigAccessorFactory, createConfigFeature } from "../feature";
 import { createConfigResolver } from "../resolver";

package/src/config/__tests__/tz-resolution.integration.test.ts

@@ -0,0 +1,101 @@
+// buildHandlerContext resolves ctx.tz.tenant from tenant:config:timezone and
+// ctx.tz.user from SessionUser.timezone (fw#1636). "tenant" here is a
+// standalone probe feature registering the same qualified config key the
+// real bundled `tenant` feature uses — decoupled from that feature's
+// entities/handlers, but exercising the identical runtime path.
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { z } from "zod";
+import { createConfigAccessorFactory, createConfigFeature } from "../feature";
+import { createConfigResolver } from "../resolver";
+import { configValuesTable } from "../table";
+
+const tenantFeature = defineFeature("tenant", (r) => {
+  r.requires("config");
+  r.config({
+    keys: {
+      timezone: createTenantConfig("select", {
+        default: "UTC",
+        options: ["UTC", "Europe/Berlin", "Asia/Tokyo"],
+        write: access.roles("Admin"),
+      }),
+    },
+  });
+});
+
+const probeFeature = defineFeature("probe", (r) => {
+  r.requires("tenant");
+  r.writeHandler(
+    "read-tz",
+    z.object({}),
+    async (_event, ctx) => ({
+      isSuccess: true,
+      data: { tenant: ctx.tz.tenant, user: ctx.tz.user },
+    }),
+    { access: { openToAll: true } },
+  );
+});
+
+describe("buildHandlerContext ctx.tz resolution", () => {
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    stack = await setupTestStack({
+      features: [createConfigFeature(), tenantFeature, probeFeature],
+      extraContext: ({ registry }) => ({
+        configResolver: resolver,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+      }),
+    });
+    await unsafePushTables(stack.db, { configValuesTable });
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  test("defaults to UTC when no tenant config value is set and SessionUser has no timezone", async () => {
+    const user = createTestUser({ id: 10 });
+    const res = await stack.http.writeOk<{ tenant: string; user: string }>(
+      "probe:write:read-tz",
+      {},
+      user,
+    );
+    expect(res).toEqual({ tenant: "UTC", user: "UTC" });
+  });
+
+  test("ctx.tz.tenant reads tenant:config:timezone", async () => {
+    const admin = createTestUser({ id: 11, roles: ["Admin"] });
+    await stack.http.writeOk(
+      "config:write:set",
+      { key: "tenant:config:timezone", value: "Europe/Berlin" },
+      admin,
+    );
+
+    const res = await stack.http.writeOk<{ tenant: string; user: string }>(
+      "probe:write:read-tz",
+      {},
+      admin,
+    );
+    expect(res).toEqual({ tenant: "Europe/Berlin", user: "Europe/Berlin" });
+  });
+
+  test("ctx.tz.user reads SessionUser.timezone independently of tenant", async () => {
+    // Same tenant as the previous test (Europe/Berlin already set) — proves
+    // user overrides without needing to touch tenant config.
+    const user = createTestUser({ id: 12, timezone: "Asia/Tokyo" });
+    const res = await stack.http.writeOk<{ tenant: string; user: string }>(
+      "probe:write:read-tz",
+      {},
+      user,
+    );
+    expect(res).toEqual({ tenant: "Europe/Berlin", user: "Asia/Tokyo" });
+  });
+});

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -9,15 +9,11 @@
 
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  configurePiiSubjectKms,
-  InMemoryKmsAdapter,
-  resetPiiSubjectKmsForTests,
-} from "@cosmicdrift/kumiko-framework/crypto";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { setupTestStack, type TestStack, testTenantId } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetPiiSubjectKmsForTests, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
 import { createCryptoShreddingFeature } from "../feature";
 

package/src/delivery/__tests__/delivery-pii-kms.integration.test.ts

@@ -12,7 +12,6 @@ import {
   InMemoryKmsAdapter,
   isPiiCiphertext,
   PII_ERASED_SENTINEL,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   defineFeature,
@@ -28,6 +27,7 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
 import { z } from "zod";
 import { createChannelEmailFeature } from "../../channel-email/feature";
 import { createInMemoryTransport } from "../../channel-email/types";

package/src/document-ingest-foundation/__tests__/pages-crypto-shredding.integration.test.ts

@@ -12,7 +12,6 @@ import {
   configurePiiSubjectKms,
   InMemoryKmsAdapter,
   PII_ERASED_SENTINEL,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
@@ -22,6 +21,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { documentExtractEntity, documentExtractsTable } from "../entity";
 import { readIngestPages, writeIngestPages } from "../pages";

package/src/inbound-mail-foundation/__tests__/connect-routes.integration.test.ts

@@ -7,11 +7,7 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  configurePiiSubjectKms,
-  InMemoryKmsAdapter,
-  resetPiiSubjectKmsForTests,
-} from "@cosmicdrift/kumiko-framework/crypto";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
@@ -31,6 +27,7 @@ import {
 import {
   createMutableMasterKeyProvider,
   type MutableMasterKeyProvider,
+  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { Hono } from "hono";
 import {

package/src/inbound-mail-foundation/__tests__/inbound-mail-foundation.integration.test.ts

@@ -20,7 +20,6 @@ import {
   InMemoryKmsAdapter,
   isPiiCiphertext,
   PII_ERASED_SENTINEL,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
@@ -39,7 +38,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { bridgeStub } from "@cosmicdrift/kumiko-framework/testing";
+import { bridgeStub, resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,

package/src/inbound-mail-foundation/__tests__/retention.integration.test.ts

@@ -7,11 +7,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  configurePiiSubjectKms,
-  InMemoryKmsAdapter,
-  resetPiiSubjectKmsForTests,
-} from "@cosmicdrift/kumiko-framework/crypto";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
 import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
@@ -22,6 +18,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,

package/src/inbound-mail-foundation/__tests__/watch-supervisor.integration.test.ts

@@ -6,11 +6,7 @@
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  configurePiiSubjectKms,
-  InMemoryKmsAdapter,
-  resetPiiSubjectKmsForTests,
-} from "@cosmicdrift/kumiko-framework/crypto";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -21,7 +17,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { waitFor } from "@cosmicdrift/kumiko-framework/testing";
+import { resetPiiSubjectKmsForTests, waitFor } from "@cosmicdrift/kumiko-framework/testing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,

package/src/inbound-provider-imap/__tests__/imap-foundation.integration.test.ts

@@ -16,11 +16,7 @@ import { randomBytes } from "node:crypto";
 import { connect } from "node:net";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  configurePiiSubjectKms,
-  InMemoryKmsAdapter,
-  resetPiiSubjectKmsForTests,
-} from "@cosmicdrift/kumiko-framework/crypto";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -36,6 +32,7 @@ import {
 import {
   createMutableMasterKeyProvider,
   type MutableMasterKeyProvider,
+  resetPiiSubjectKmsForTests,
   waitFor,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { createTransport } from "nodemailer";

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -13,7 +13,6 @@ import {
   InMemoryKmsAdapter,
   isPiiCiphertext,
   PII_ERASED_SENTINEL,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import { createRegistry } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -24,7 +23,7 @@ import {
   type TestRedis,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetPiiSubjectKmsForTests, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { createJobsFeature } from "../feature";
 import { createJobRunLogger, JOB_RUN_STARTED_EVENT } from "../job-run-logger";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";

package/src/personal-access-tokens/__tests__/pat.integration.test.ts

@@ -7,8 +7,6 @@ import {
   configurePiiSubjectKms,
   InMemoryKmsAdapter,
   isPiiCiphertext,
-  resetBlindIndexKeyForTests,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -18,7 +16,12 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher, deleteRows } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  deleteRows,
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -7,8 +7,6 @@ import {
   configurePiiSubjectKms,
   InMemoryKmsAdapter,
   isPiiCiphertext,
-  resetBlindIndexKeyForTests,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -24,6 +22,8 @@ import {
   createLateBoundHolder,
   createTestEnvelopeCipher,
   deleteRows,
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";

package/src/tenant/__tests__/members-query-kms.integration.test.ts

@@ -11,7 +11,6 @@ import {
   configurePiiSubjectKms,
   InMemoryKmsAdapter,
   isPiiCiphertext,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -21,7 +20,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetPiiSubjectKmsForTests, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { configValuesTable } from "../../config/table";
 import { createUserFeature } from "../../user/feature";

package/src/tier-engine/compose-app.ts

@@ -84,6 +84,20 @@ export type ComposedApp<TCaps extends Readonly<Record<string, unknown>>> = {
  * delivered something the platform doesn't understand. Failing loud at boot
  * is safer than silently mounting the wrong feature-set and hoping nobody
  * notices when "Pro" turns out to mean "Free".
+ *
+ * **No production callers, and that is not rot.** This is the BOOT-TIME half
+ * of tier composition — which features get mounted at all. The RUNTIME half,
+ * which features a given tenant may see out of everything mounted, is
+ * `createTierEngineFeature`'s `resolver(tenantId) => ReadonlySet<string>`
+ * (feature.ts). Both read the same tierMap at opposite ends. Apps use the
+ * resolver today; nobody composes per-tenant feature sets at boot yet, so an
+ * app that only needs caps merges them locally rather than constructing a
+ * featureRegistry it has no other use for (kumiko-studio's
+ * `resolvePlatformCaps`, studio#154/1 → PR #162 — a deliberate, typed copy of
+ * step 4, not a workaround). Whether the boot-time half ever gets a caller is
+ * a product question: kumiko-studio's BYO pivot (Sprint 8a Phase 3a)
+ * differentiates tiers by CAPS, not by feature set. Delete this only once no
+ * app plans to differentiate by feature set — the engine is app-agnostic.
  */
 export function composeApp<TCaps extends Readonly<Record<string, unknown>>>(
   input: ComposeAppInput<TCaps>,

package/src/user/__tests__/user.integration.test.ts

@@ -64,8 +64,9 @@ describe("scenario 1: create + me", () => {
       id: created.id,
       email: "marc@example.com",
       displayName: "Marc",
-      locale: "de", // comes from the entity's default — client didn't send it
     });
+    // No entity-level default — client didn't send a locale, so it stays unset.
+    expect(me["locale"] == null).toBe(true);
   });
 
   test("normal user cannot create another user", async () => {

package/src/user/handlers/create.write.ts

@@ -2,6 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { UserErrors } from "../constants";
 import { userEntity, userTable } from "../schema/user";
@@ -23,6 +24,7 @@ export const createWrite = defineWriteHandler({
     passwordHash: z.string().optional(),
     displayName: z.string().min(1).max(100),
     locale: z.string().min(2).max(10).optional(),
+    timezone: z.string().max(64).refine(isValidIanaTimeZone, "invalid IANA time zone").optional(),
     // Globale Rollen — JSON-encoded string[]. Optional weil der Default
     // im Entity-Schema "[]" ist; setzen wenn man einen SystemAdmin (oder
     // andere globale Rollen) anlegt. Field-Access (write: privileged) auf

package/src/user/handlers/update.write.ts

@@ -1,6 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, hasAccess } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { UserErrors } from "../constants";
 import { userEntity, userTable } from "../schema/user";
@@ -22,6 +23,7 @@ export const updateWrite = defineWriteHandler({
     changes: z.object({
       displayName: z.string().min(1).max(100).optional(),
       locale: z.string().min(2).max(10).optional(),
+      timezone: z.string().max(64).refine(isValidIanaTimeZone, "invalid IANA time zone").optional(),
       email: z.email().optional(),
       passwordHash: z.string().optional(),
       lastActiveTenantId: z.string().optional(),

package/src/user/i18n.ts

@@ -8,6 +8,7 @@ export const USER_I18N: Readonly<Record<string, LocalizedString>> = {
   "user:entity:user:field:status": { de: "Status", en: "Status" },
   "user:entity:user:field:emailVerified": { de: "E-Mail bestätigt", en: "Email verified" },
   "user:entity:user:field:locale": { de: "Sprache", en: "Locale" },
+  "user:entity:user:field:timezone": { de: "Zeitzone", en: "Timezone" },
   "user:entity:user:field:status:option:active": { de: "Aktiv", en: "Active" },
   "user:entity:user:field:status:option:restricted": { de: "Eingeschränkt", en: "Restricted" },
   "user:entity:user:field:status:option:deletionRequested": {

package/src/user/schema/user.ts

@@ -6,6 +6,7 @@ import {
   createSelectField,
   createTextField,
   createTimestampField,
+  createTzField,
 } from "@cosmicdrift/kumiko-framework/engine";
 
 /**
@@ -87,7 +88,11 @@ export const userEntity = createEntity({
       pii: true,
       searchable: true,
     }),
-    locale: createTextField({ maxLength: 10, default: "de" }),
+    // No default here — tenant-settings owns the app-wide locale default; see #1637.
+    locale: createTextField({ maxLength: 10 }),
+    // No default here — mirrors locale: ctx.tz falls back to tenant.timezone
+    // (then "UTC") when unset, see buildHandlerContext (fw#1636).
+    timezone: createTzField(),
 
     // Which tenant should this user land in on next login. Set by the login
     // handler (SYSTEM), read by the login flow + UI for deep-linking.

package/src/user/screens.ts

@@ -36,7 +36,7 @@ export const userEditScreen: EntityEditScreenDefinition = {
     sections: [
       {
         columns: 2,
-        fields: ["email", "displayName", "locale", "emailVerified"],
+        fields: ["email", "displayName", "locale", "timezone", "emailVerified"],
       },
     ],
   },

package/src/user-data-rights/__tests__/anonymous-deletion-kms.integration.test.ts

@@ -11,8 +11,6 @@ import {
   configurePiiSubjectKms,
   InMemoryKmsAdapter,
   isPiiCiphertext,
-  resetBlindIndexKeyForTests,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -21,7 +19,11 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+  resetTestTables,
+} from "@cosmicdrift/kumiko-framework/testing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,

package/src/user-data-rights/__tests__/export-encrypted-fields.integration.test.ts

@@ -6,11 +6,7 @@
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  buildEntityTable,
-  configureEntityFieldEncryption,
-  resetEntityFieldEncryptionCacheForTests,
-} from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
   createRegistry,
@@ -20,7 +16,10 @@ import {
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  resetEntityFieldEncryptionCacheForTests,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -21,7 +21,6 @@ import {
   configurePiiSubjectKms,
   encryptPiiFieldValues,
   InMemoryKmsAdapter,
-  resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
@@ -30,7 +29,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  resetPiiSubjectKmsForTests,
+  resetTestTables,
+  seedRow,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";

package/src/user-data-rights-defaults/hooks/user.userdata-hook.ts

@@ -46,7 +46,7 @@ export const userExportHook: UserDataExportHook = async (ctx) => {
     id: string;
     email: string;
     displayName: string;
-    locale: string;
+    locale: string | null;
     emailVerified: boolean;
   } | null; // @cast-boundary db-runner