@cosmicdrift/kumiko-bundled-features 0.167.1 → 0.170.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.167.1",
+  "version": "0.170.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -119,16 +119,17 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.167.1",
-    "@cosmicdrift/kumiko-framework": "0.167.1",
-    "@cosmicdrift/kumiko-headless": "0.167.1",
-    "@cosmicdrift/kumiko-renderer": "0.167.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.167.1",
-    "@cosmicdrift/kumiko-types": "0.167.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.170.0",
+    "@cosmicdrift/kumiko-framework": "0.170.0",
+    "@cosmicdrift/kumiko-headless": "0.170.0",
+    "@cosmicdrift/kumiko-renderer": "0.170.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.170.0",
+    "@cosmicdrift/kumiko-types": "0.170.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",
     "@node-rs/argon2": "^2.0.2",
+    "@types/mailparser": "^3.4.6",
     "@types/nodemailer": "^8.0.0",
     "clsx": "^2.1.1",
     "lucide-react": "^1.14.0",
@@ -150,7 +151,6 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@types/mailparser": "^3.4.6",
     "@types/qrcode": "^1.5.5"
   }
 }

package/src/auth-email-password/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.165.1",
+    "type": "breaking",
+    "title": "makeAuthGate / makeSessionAuthGate take a single LoginRouteOptions object (fw#1545).",
+    "detail": "The four positional args (LoginComponent, loginProps, MfaVerifyComponent, MfaSetupComponent) did not scale past two optional MFA params. Shipped in the stranded 2.0.0 major and carried into the 0.165.1 line.",
+    "migration": "Rewrite call sites as makeAuthGate({ loginScreen, loginScreenProps, mfaVerifyScreen, mfaSetupScreen }). Type-check catches every occurrence."
+  },
+  {
+    "version": "0.167.1",
+    "type": "improvement",
+    "title": "accountLockout is reachable through runProdApp/runDevApp (fw#1627).",
+    "detail": "accountLockout was an option on createAuthEmailPasswordFeature, but both wrappers mount auth-email-password themselves and their auth options only knew accountUnlock — an app on either entrypoint had no way to turn brute-force protection on. RunProdAppAuthOptions and RunDevAppAuthOptions now carry accountLockout and composeFeatures passes it through.",
+    "migration": "Opt-in, nothing breaks without it. Two things to know before relying on it: without ctx.redis the lockout is silently skipped in login.write.ts — no error, no warning, no protection — so treat Redis as a deploy invariant, and prove the lockout with a behavioural test instead of assuming the mount is enough."
+  },
   {
     "version": "0.162.0",
     "type": "improvement",

package/src/auth-email-password/seeding.ts

@@ -190,6 +190,9 @@ export type SeedAdminOptions = {
    *  membership-Rollen. Typischer use-case: `["SystemAdmin"]` für
    *  einen Plattform-Operator. Default: leer. */
   readonly globalRoles?: readonly string[];
+  /** Initial-emailVerified-Flag — Default false (unverified),
+   *  gleicher Mechanismus wie seedUserWithPassword.emailVerified. */
+  readonly emailVerified?: boolean;
   readonly by?: SessionUser;
 };
 
@@ -213,6 +216,7 @@ export async function seedAdmin(
     password: options.password,
     displayName: options.displayName,
     ...(options.globalRoles !== undefined && { roles: options.globalRoles }),
+    ...(options.emailVerified !== undefined && { emailVerified: options.emailVerified }),
     by,
   });
 

package/src/auth-foundation/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.165.1",
+    "type": "improvement",
+    "title": "validateSessionStoreMultiplicity accepts zero sessionStore providers (fw#1547).",
+    "detail": "A machine-API-only deployment (PAT-bearer auth, no browser sessions) can mount auth-foundation without also mounting sessions."
+  },
+  {
+    "version": "0.161.0",
+    "type": "improvement",
+    "title": "tenantResolver/tenantExistence extension points, sessionStore without auth.sessions (fw#1372-1375).",
+    "detail": "Auth-foundation migration: tenant resolution and tenant-existence become extension points, sessionStore is wired without going through auth.sessions, AnonymousAccessConfig is slimmed down. See the auth-foundation-providers recipe."
+  },
   {
     "version": "0.165.0",
     "type": "fix",

package/src/billing-foundation/__tests__/subscription-tier-sync.test.ts

@@ -0,0 +1,37 @@
+// Unit-test for effectiveTierFromSubscription. The DB-touching half
+// (syncTierFromSubscription, the wired route) is exercised via the app-level
+// test suites of its two current consumers (show-pony, publicstatus) — those
+// migrate onto this factory in a follow-up PR (infra#446), carrying their
+// existing integration coverage with them.
+
+import { describe, expect, test } from "bun:test";
+import { SubscriptionStatuses } from "../constants";
+import { effectiveTierFromSubscription } from "../subscription-tier-sync";
+
+type TestTier = "free" | "starter" | "pro";
+const isTierName = (v: string): v is TestTier => v === "free" || v === "starter" || v === "pro";
+
+describe("effectiveTierFromSubscription", () => {
+  test("active subscription with a known tier → that tier", () => {
+    expect(
+      effectiveTierFromSubscription(SubscriptionStatuses.active, "pro", isTierName, "free"),
+    ).toBe("pro");
+  });
+
+  test("trialing counts as usable", () => {
+    expect(
+      effectiveTierFromSubscription(SubscriptionStatuses.trialing, "starter", isTierName, "free"),
+    ).toBe("starter");
+  });
+
+  test("canceled/past_due/unknown status → default tier", () => {
+    expect(effectiveTierFromSubscription("canceled", "pro", isTierName, "free")).toBe("free");
+    expect(effectiveTierFromSubscription(undefined, "pro", isTierName, "free")).toBe("free");
+  });
+
+  test("unrecognized tier name → default tier", () => {
+    expect(
+      effectiveTierFromSubscription(SubscriptionStatuses.active, "enterprise", isTierName, "free"),
+    ).toBe("free");
+  });
+});

package/src/billing-foundation/index.ts

@@ -31,6 +31,13 @@ export {
 export { billingFoundationFeature } from "./feature";
 export { getSubscriptionForTenant, type SubscriptionView } from "./get-subscription-for-tenant";
 export { subscriptionsProjectionTable } from "./projection";
+export {
+  createSubscriptionTierSync,
+  effectiveTierFromSubscription,
+  SUBSCRIPTION_WEBHOOK_PATH,
+  type SubscriptionTierSyncDeps,
+  type SystemWriteResult,
+} from "./subscription-tier-sync";
 export type {
   SubscriptionEvent,
   SubscriptionProviderPlugin,

package/src/billing-foundation/subscription-tier-sync.ts

@@ -0,0 +1,136 @@
+// Generic Stripe/PayPal-webhook → tier-engine sync route. Extracted from the
+// near-identical webhook-route.ts app copies in show-pony and publicstatus
+// (infra#446) — the only per-app variables were the TierName union/default
+// and the tier-assignment table handle, so both are now factory parameters.
+
+import {
+  TierEngineHandlers,
+  tierAssignmentAggregateId,
+} from "@cosmicdrift/kumiko-bundled-features/tier-engine";
+import { type DbRunner, type EntityTable, fetchOne } from "@cosmicdrift/kumiko-framework/db";
+import type { EntityDefinition, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Hono } from "hono";
+import { subscriptionAggregateId } from "./aggregate-id";
+import { SUBSCRIPTION_PROVIDER_EXTENSION, SubscriptionStatuses } from "./constants";
+import { subscriptionsProjectionTable } from "./projection";
+import type { SubscriptionProviderPlugin } from "./types";
+import { createSubscriptionWebhookHandler } from "./webhook-handler";
+
+export const SUBSCRIPTION_WEBHOOK_PATH = "/webhooks/subscription/:providerName";
+
+export type SystemWriteResult = {
+  readonly isSuccess: boolean;
+  readonly data?: unknown;
+  readonly error?: { readonly code?: string; readonly message?: string };
+};
+
+export type SubscriptionTierSyncDeps<TTier extends string> = {
+  readonly db: DbRunner;
+  readonly registry: Registry;
+  readonly dispatchSystemWrite: (args: {
+    readonly handlerQn: string;
+    readonly payload: unknown;
+    readonly tenantId: TenantId;
+  }) => Promise<SystemWriteResult>;
+  readonly tierAssignmentTable: EntityTable<EntityDefinition>;
+  readonly isTierName: (value: string) => value is TTier;
+  readonly defaultTier: TTier;
+};
+
+export function effectiveTierFromSubscription<TTier extends string>(
+  status: string | undefined,
+  tier: string | undefined,
+  isTierName: (value: string) => value is TTier,
+  defaultTier: TTier,
+): TTier {
+  const usable = status === SubscriptionStatuses.active || status === SubscriptionStatuses.trialing;
+  return usable && typeof tier === "string" && isTierName(tier) ? tier : defaultTier;
+}
+
+export function createSubscriptionTierSync<TTier extends string>(
+  deps: SubscriptionTierSyncDeps<TTier>,
+) {
+  async function syncTierFromSubscription(
+    tenantId: TenantId,
+  ): Promise<{ code: string; message: string } | null> {
+    const sub = await fetchOne<{ status?: unknown; tier?: unknown }>(
+      deps.db,
+      subscriptionsProjectionTable,
+      { id: subscriptionAggregateId(tenantId) },
+    );
+    if (!sub) return null;
+
+    const effective = effectiveTierFromSubscription(
+      typeof sub.status === "string" ? sub.status : undefined,
+      typeof sub.tier === "string" ? sub.tier : undefined,
+      deps.isTierName,
+      deps.defaultTier,
+    );
+
+    const assignment = await fetchOne<{ id?: unknown; version?: unknown; tier?: unknown }>(
+      deps.db,
+      deps.tierAssignmentTable,
+      { tenantId },
+    );
+    if (
+      !assignment ||
+      typeof assignment.id !== "string" ||
+      typeof assignment.version !== "number"
+    ) {
+      const created = await deps.dispatchSystemWrite({
+        handlerQn: TierEngineHandlers.create,
+        payload: { id: tierAssignmentAggregateId(tenantId), tier: effective },
+        tenantId,
+      });
+      if (!created.isSuccess) {
+        return {
+          code: "tier_sync_failed",
+          message: `tier-engine create with "${effective}" failed: ${created.error?.code ?? "unknown"}`,
+        };
+      }
+      return null;
+    }
+    if (assignment.tier === effective) return null;
+
+    const result = await deps.dispatchSystemWrite({
+      handlerQn: TierEngineHandlers.update,
+      payload: { id: assignment.id, version: assignment.version, changes: { tier: effective } },
+      tenantId,
+    });
+    if (!result.isSuccess) {
+      return {
+        code: "tier_sync_failed",
+        message: `tier-engine update to "${effective}" failed: ${result.error?.code ?? "unknown"}`,
+      };
+    }
+    return null;
+  }
+
+  function wireSubscriptionWebhookRoute(app: Hono): void {
+    const handler = createSubscriptionWebhookHandler({
+      dispatchWrite: async ({ handlerQn, payload, tenantId }) => {
+        const targetTenantId = tenantId as TenantId;
+        const result = await deps.dispatchSystemWrite({
+          handlerQn,
+          payload,
+          tenantId: targetTenantId,
+        });
+        if (!result.isSuccess) return result;
+        const syncError = await syncTierFromSubscription(targetTenantId);
+        if (syncError) {
+          return { isSuccess: false, error: syncError };
+        }
+        return result;
+      },
+      resolveProvider: (providerName) => {
+        const usage = deps.registry
+          .getExtensionUsages(SUBSCRIPTION_PROVIDER_EXTENSION)
+          .find((u) => u.entityName === providerName);
+        return usage?.options as SubscriptionProviderPlugin | undefined;
+      },
+    });
+    app.post(SUBSCRIPTION_WEBHOOK_PATH, handler);
+  }
+
+  return { wireSubscriptionWebhookRoute };
+}

package/src/cap-counter/index.ts

@@ -26,6 +26,11 @@ export {
 } from "./enforce-cap";
 export { capCounterEntity } from "./entity";
 export { capCounterFeature } from "./feature";
+export {
+  createStockCapGuard,
+  type StockCapGuard,
+  type StockCapSpec,
+} from "./stock-cap-guard";
 export {
   type CalendarCapDef,
   type CalendarCapResolver,

package/src/cap-counter/stock-cap-guard.ts

@@ -0,0 +1,68 @@
+// Generic stock-cap write-guard factory. Extracted from the near-identical
+// cap-guard.ts app copies in show-pony and publicstatus (infra#446) — the
+// only per-app variable was the Caps shape and how to resolve it for a
+// tenant, so both are now factory parameters.
+
+import { countWhere, type DbRunner, type WhereObject } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  UnprocessableError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { enforceStockCap } from "./enforce-cap";
+
+export type StockCapSpec<TCaps> = {
+  readonly table: Parameters<typeof countWhere>[1];
+  readonly limit: (caps: TCaps) => number;
+  readonly where?: WhereObject;
+  readonly code: string;
+  readonly i18nKey: string;
+  readonly field: string;
+};
+
+export type StockCapGuard<TCaps> = {
+  readonly checkStockCap: (
+    db: DbRunner,
+    tenantId: TenantId,
+    spec: StockCapSpec<TCaps>,
+  ) => Promise<WriteFailure | null>;
+  readonly withStockCap: (handler: WriteHandlerDef, spec: StockCapSpec<TCaps>) => WriteHandlerDef;
+};
+
+export function createStockCapGuard<TCaps>(
+  resolveTierCaps: (db: DbRunner, tenantId: TenantId) => Promise<TCaps>,
+): StockCapGuard<TCaps> {
+  async function checkStockCap(
+    db: DbRunner,
+    tenantId: TenantId,
+    spec: StockCapSpec<TCaps>,
+  ): Promise<WriteFailure | null> {
+    const caps = await resolveTierCaps(db, tenantId);
+    const current = await countWhere(db, spec.table, { tenantId, ...spec.where });
+    const { state, limit } = enforceStockCap({
+      current,
+      limit: spec.limit(caps),
+      profile: "hardSlot",
+    });
+    if (state !== "exceeded") return null;
+    return writeFailure(
+      new UnprocessableError(spec.code, {
+        i18nKey: spec.i18nKey,
+        details: { field: spec.field, reason: spec.code, current, limit },
+      }),
+    );
+  }
+
+  function withStockCap(handler: WriteHandlerDef, spec: StockCapSpec<TCaps>): WriteHandlerDef {
+    return {
+      ...handler,
+      handler: async (event, ctx) => {
+        const failure = await checkStockCap(ctx.db.raw, event.user.tenantId, spec);
+        return failure ?? handler.handler(event, ctx);
+      },
+    };
+  }
+
+  return { checkStockCap, withStockCap };
+}

package/src/crypto-shredding/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.166.0",
+    "type": "improvement",
+    "title": "resolveKmsWiring / requireKmsWiring / buildPgKmsOptions: boot-time KMS env validation (fw#1617).",
+    "detail": "The subject-keys KMS env trio was validated by four copy-pasted app-side helpers that had drifted: only one parsed PLATFORM_KEK_VERSION strictly, so \"1e21\", \"0x10\" and \"-1\" were accepted and silently produced an unreachable rotation slot. Ordering of previous vs. active version stays enforced by PgKmsAdapter."
+  },
+  {
+    "version": "0.166.0",
+    "type": "fix",
+    "title": "KmsWiringEnv accepts process.env directly (fw#1618).",
+    "detail": "All members being optional made TypeScript's weak-type detection reject ProcessEnv for having no properties in common, which forced every consumer into a cast or a six-key mapping — the boilerplate fw#1617 set out to remove."
+  },
+  {
+    "version": "0.167.0",
+    "type": "breaking",
+    "title": "Test-only reset helpers moved from /crypto to /testing (fw#1631).",
+    "detail": "resetPiiSubjectKmsForTests and resetBlindIndexKeyForTests are no longer exported by the production barrels. The functions did not change — only the export path. Why it matters beyond tidiness: resetPiiSubjectKmsForTests clears the injected KMS, after which encryptForStorage sees no adapter and writes subject-annotated fields in plaintext, with no error and no log. Reachable from a production barrel, that is one stray import away from silent plaintext PII.",
+    "migration": "Change the import in your test files: `import { resetPiiSubjectKmsForTests } from \"@cosmicdrift/kumiko-framework/testing\"` instead of `.../crypto`. Type-check catches every occurrence; nothing else changes. Apps mounting crypto-shredding typically hit this in every test that configures an InMemoryKmsAdapter."
+  },
   {
     "version": "0.165.3",
     "type": "improvement",

package/src/data-retention/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.167.1",
+    "type": "fix",
+    "title": "blockDelete boot warning only fires for entities that have a subject (fw#1622).",
+    "detail": "The warning \"retention.strategy=blockDelete but no field has an anonymize-function\" checked the strategy alone. blockDelete is the legal-hold mode and therefore the obvious choice for anything under a statutory retention period — including entities that hold nothing but business data and foreign keys. Those got warned at every boot about something that cannot be satisfied: there is nothing to anonymize, and User-Forget never reaches a row without a subject. The warning made the correct declaration louder than the wrong one. It now requires at least one field annotated pii/userOwned/tenantOwned.",
+    "migration": "None. Warnings disappear for entities without subject-annotated fields; entities that do carry PII still get warned, unchanged."
+  },
   {
     "version": "0.116.0",
     "type": "improvement",

package/src/inbound-mail-foundation/entities.ts

@@ -41,7 +41,10 @@ export const mailAccountEntity = createEntity({
     // Owner + TenantAdmin (Compliance); KEIN Crypto-Subject-Wechsel in
     // V1 (Subject bleibt Tenant, siehe Header).
     ownerUserId: createTextField({ maxLength: 36 }),
-    displayName: createTextField({ maxLength: 200 }),
+    displayName: createTextField({
+      maxLength: 200,
+      allowPlaintext: "mailbox display name, tenant config not personal data",
+    }),
     // Postfach-Adresse — PII des Tenants.
     address: createTextField({ required: true, maxLength: 1000, tenantOwned: true }),
     status: createTextField({ required: true, maxLength: 30 }),

package/src/managed-pages/screens/branding-screen.ts

@@ -39,7 +39,11 @@ export function createBrandingSettingsScreen(opts: {
     },
     fields: {
       title: createTextField({ maxLength: 200 }),
-      description: createTextField({ maxLength: 500, multiline: { rows: 3 } }),
+      description: createTextField({
+        maxLength: 500,
+        multiline: { rows: 3 },
+        allowPlaintext: "tenant branding copy, business content not personal data",
+      }),
       siteUrl: createTextField({ maxLength: 2000, format: "url" }),
       accentColor: createTextField({ maxLength: 9 }),
       logoUrl: createTextField({ maxLength: 2000, format: "url" }),

package/src/secrets/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.166.0",
+    "type": "improvement",
+    "title": "derivePurposeSecret: HKDF-based per-purpose secret derivation (fw#1623).",
+    "detail": "Previously copy-pasted in four apps as deriveSubSecret. The second parameter is a domain separator, not a label — the rename says so. auth-mfa gains resolveMfaTokenSecrets, which owns the two MFA purpose strings so a prod and a dev entrypoint cannot drift apart and invalidate each other's tokens."
+  }
+]

package/src/sessions/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.165.1",
+    "type": "fix",
+    "title": "Mid-stream access revocation aborts idle SSE pulls; sseHeartbeatMs is a real buildServer option (fw#1587).",
+    "detail": "A revoked session used to keep an idle SSE stream alive until the client disconnected. clientIpOf now falls back to x-real-ip before the shared \"unknown\" bucket, so per-IP rate limits stop collapsing into one bucket behind proxies that only set that header."
+  },
   {
     "version": "0.165.0",
     "type": "improvement",

package/src/text-content/__tests__/text-content.integration.test.ts

@@ -245,6 +245,7 @@ describe("text-content :: query (openToAll)", () => {
     const otherTenant = createTestUser({
       id: 99,
       tenantId: "11111111-1111-4111-8111-111111111111",
+      roles: ["TenantAdmin"],
     });
     await seedTextBlock(db, {
       tenantId: tenantAdmin.tenantId,
@@ -257,8 +258,7 @@ describe("text-content :: query (openToAll)", () => {
       { slug: "tenant-only", lang: "de" },
       otherTenant,
     );
-    // null oder undefined je nach pipeline-shape — beides bedeutet "nicht gefunden"
-    expect(result).toBeFalsy();
+    expect(result).toBeNull();
   });
 
   test("by-slug works for SystemAdmin scoped to system tenant", async () => {

package/src/tier-engine/index.ts

@@ -24,4 +24,9 @@ export {
   createTierEngineFeature,
   tierEngineFeature,
 } from "./feature";
+export {
+  createTierResolver,
+  type TierResolver,
+  type TierResolverDeps,
+} from "./tier-resolver";
 export { isTrialActive, type TrialPolicy } from "./trial";

package/src/tier-engine/tier-resolver.ts

@@ -0,0 +1,36 @@
+// Generic tier-resolver factory. Extracted from the near-identical
+// tier-resolver.ts app copies in show-pony and publicstatus (infra#446) — the
+// only per-app variables were the TierName union and its caps/defaults, so
+// both are now factory parameters.
+
+import { buildEntityTable, type DbRunner, fetchOne } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { tierAssignmentEntity } from "./entity";
+
+export type TierResolverDeps<TTier extends string, TCaps> = {
+  readonly capsForTier: (tier: TTier) => TCaps;
+  readonly isTierName: (value: string) => value is TTier;
+  readonly defaultTier: TTier;
+};
+
+export function createTierResolver<TTier extends string, TCaps>(
+  deps: TierResolverDeps<TTier, TCaps>,
+) {
+  const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
+
+  async function resolveTier(db: DbRunner, tenantId: TenantId): Promise<TTier> {
+    const row = await fetchOne<{ tier?: unknown }>(db, tierAssignmentTable, { tenantId });
+    const tier = row?.tier;
+    return typeof tier === "string" && deps.isTierName(tier) ? tier : deps.defaultTier;
+  }
+
+  async function resolveTierCaps(db: DbRunner, tenantId: TenantId): Promise<TCaps> {
+    return deps.capsForTier(await resolveTier(db, tenantId));
+  }
+
+  return { tierAssignmentTable, resolveTier, resolveTierCaps };
+}
+
+export type TierResolver<TTier extends string, TCaps> = ReturnType<
+  typeof createTierResolver<TTier, TCaps>
+>;

package/src/user/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.167.1",
+    "type": "breaking",
+    "title": "user.locale no longer defaults to \"de\" (fw#1637).",
+    "detail": "The entity-level default contradicted tenant-settings' own \"en\" default and silently overrode any app or tenant locale configuration for every new user. locale now stays unset until the client or a resolution chain provides one. Consumers that already fall back with `user.locale ?? \"en\"` are unaffected in shape but now see null instead of \"de\".",
+    "migration": "Run `kumiko-schema generate` and apply — the migration emits `ALTER TABLE read_users ALTER COLUMN locale DROP DEFAULT`. Note that DROP DEFAULT only affects future inserts: existing rows keep the \"de\" the old default wrote, which no user ever chose. Your app therefore splits into pre-bump users on \"de\" and post-bump users on null, and each group resolves to a different language. Decide deliberately: either keep the old values (and state that pre-bump users stay German), or run `UPDATE read_users SET locale = NULL WHERE locale = 'de'` once so every user follows the same chain — the latter only if no UI ever let users edit the field, otherwise it erases real choices. If your app relied on the implicit German default, set an explicit fallback instead (fw#1653)."
+  },
+  {
+    "version": "0.167.1",
+    "type": "improvement",
+    "title": "user.timezone field, wired into ctx.tz (fw#1636).",
+    "detail": "The user entity gains a `timezone` field (createTzField, no default). buildHandlerContext passes it to ctx.tz.user; the fallback chain stays tenant.timezone, then \"UTC\". Before this, ctx.tz.tenant and ctx.tz.user both hardcoded \"UTC\" while the plumbing already accepted per-request values.",
+    "migration": "Run `kumiko-schema generate` and apply — the migration adds `read_users.timezone`. No backfill: an unset timezone falls through to the tenant's, exactly as before the field existed."
+  },
   {
     "version": "0.165.3",
     "type": "improvement",

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.165.1",
+    "type": "fix",
+    "title": "restrict-account runs the same cross-tenant membership check as lift-restriction (fw#1543).",
+    "detail": "Any Admin/TenantAdmin — not just SystemAdmin — could restrict a user's account and force-revoke their sessions regardless of tenant, as long as they held an admin role in some tenant. Also: the GET /user-export/by-token fallback now forwards x-forwarded-for to the internal query call, so the per-IP 30/min limit stops collapsing into one global bucket."
+  },
   {
     "version": "0.165.3",
     "type": "improvement",