@cosmicdrift/kumiko-bundled-features 0.174.0 → 0.174.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.174.0",
+  "version": "0.174.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -122,12 +122,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.174.0",
-    "@cosmicdrift/kumiko-framework": "0.174.0",
-    "@cosmicdrift/kumiko-headless": "0.174.0",
-    "@cosmicdrift/kumiko-renderer": "0.174.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.174.0",
-    "@cosmicdrift/kumiko-types": "0.174.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.174.1",
+    "@cosmicdrift/kumiko-framework": "0.174.1",
+    "@cosmicdrift/kumiko-headless": "0.174.1",
+    "@cosmicdrift/kumiko-renderer": "0.174.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.174.1",
+    "@cosmicdrift/kumiko-types": "0.174.1",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-email-password/__tests__/login-gates.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { USER_STATUS } from "../../user";
 import type { AuthUserRow } from "../auth-user-row";
+import { accountRestricted, emailNotVerified, invalidCredentials } from "../errors";
 import {
   gateBuildSession,
   gateEnforceAccountStatus,
@@ -21,7 +22,7 @@ describe("login.write gates (fw#1284)", () => {
   test("gateEnforceEmailVerified rejects when strict and unverified", () => {
     const g = gateEnforceEmailVerified(row({ emailVerified: false }), true);
     expect(g.ok).toBe(false);
-    if (!g.ok) expect(g.result.isSuccess).toBe(false);
+    if (!g.ok) expect(g.result).toEqual(emailNotVerified());
   });
 
   test("gateEnforceEmailVerified passes when not strict", () => {
@@ -31,16 +32,21 @@ describe("login.write gates (fw#1284)", () => {
   test("gateEnforceAccountStatus rejects restricted", () => {
     const g = gateEnforceAccountStatus(row({ status: USER_STATUS.Restricted }));
     expect(g.ok).toBe(false);
+    if (!g.ok) expect(g.result).toEqual(accountRestricted());
   });
 
   test("gateEnforceAccountStatus rejects deletion_requested as invalid_creds shape", () => {
     const g = gateEnforceAccountStatus(row({ status: USER_STATUS.DeletionRequested }));
     expect(g.ok).toBe(false);
-    if (!g.ok) {
-      expect(g.result.isSuccess).toBe(false);
-      // anti-enumeration — same family as invalid credentials
-      expect(g.result).toMatchObject({ isSuccess: false });
-    }
+    // anti-enumeration — same payload as invalid credentials, not a
+    // distinguishable "account deleted" error.
+    if (!g.ok) expect(g.result).toEqual(invalidCredentials());
+  });
+
+  test("gateEnforceAccountStatus rejects deleted as invalid_creds shape", () => {
+    const g = gateEnforceAccountStatus(row({ status: USER_STATUS.Deleted }));
+    expect(g.ok).toBe(false);
+    if (!g.ok) expect(g.result).toEqual(invalidCredentials());
   });
 
   test("gateEnforceAccountStatus passes active", () => {

package/src/auth-email-password/seeding.ts

@@ -190,8 +190,10 @@ export type SeedAdminOptions = {
    *  membership-Rollen. Typischer use-case: `["SystemAdmin"]` für
    *  einen Plattform-Operator. Default: leer. */
   readonly globalRoles?: readonly string[];
-  /** Initial-emailVerified-Flag — Default false (unverified),
-   *  gleicher Mechanismus wie seedUserWithPassword.emailVerified. */
+  /** Initial emailVerified state — defaults to false (unverified). Same
+   *  mechanism as seedUserWithPassword.emailVerified. Re-running the seed
+   *  against an already-seeded row reconciles this flag too (true → sets
+   *  it via a real `.updated` event; never flips true → false). */
   readonly emailVerified?: boolean;
   readonly by?: SessionUser;
 };

package/src/auth-mfa/__tests__/token-secrets.test.ts

@@ -30,6 +30,25 @@ describe("resolveMfaTokenSecrets", () => {
     );
   });
 
+  test("an empty-string override falls back to derivation instead of an empty key", () => {
+    const resolved = resolveMfaTokenSecrets(JWT_SECRET, {
+      setupTokenSecret: "",
+      challengeTokenSecret: "",
+    });
+
+    expect(resolved).toEqual(resolveMfaTokenSecrets(JWT_SECRET));
+    expect(resolved.setupTokenSecret).not.toBe("");
+  });
+
+  test("a whitespace-only override falls back to derivation too", () => {
+    const resolved = resolveMfaTokenSecrets(JWT_SECRET, {
+      setupTokenSecret: "   ",
+      challengeTokenSecret: "\t",
+    });
+
+    expect(resolved).toEqual(resolveMfaTokenSecrets(JWT_SECRET));
+  });
+
   test("rotating the master rotates both", () => {
     const before = resolveMfaTokenSecrets(JWT_SECRET);
     const after = resolveMfaTokenSecrets(`${JWT_SECRET}-rotated`);

package/src/auth-mfa/handlers/reencrypt.job.ts

@@ -38,8 +38,12 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import type { JobHandlerFn, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { type EnvelopeCipher, isStoredEnvelope } from "@cosmicdrift/kumiko-framework/secrets";
-import { type ChunkedMigrationStopReason, runChunkedMigration } from "../../shared";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  type ChunkedMigrationStopReason,
+  classifyStoredEnvelope,
+  runChunkedMigration,
+} from "../../shared";
 import { userMfaEntity, userMfaTable } from "../schema/user-mfa";
 
 const DEFAULT_BATCH_SIZE = 100;
@@ -66,22 +70,6 @@ export type MfaReencryptJobResult = {
   readonly stoppedReason: ChunkedMigrationStopReason;
 };
 
-type EnvelopeClassification = "rotate" | "current" | "unrecognized";
-
-// After PII peel (when configured), values must be current-cipher envelopes.
-// Non-JSON / non-envelope is not a supported legacy decrypt path — fail the
-// row instead of treating it as "needs rotate" (#1541, mirrors config #1513).
-function classifyEnvelope(value: string, targetVersion: number): EnvelopeClassification {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    return "unrecognized";
-  }
-  if (!isStoredEnvelope(parsed)) return "unrecognized";
-  return parsed.kekVersion === targetVersion ? "current" : "rotate";
-}
-
 export const mfaReencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
   const payload = rawPayload as MfaReencryptJobPayload; // @cast-boundary engine-payload
   const maybeCipher = configuredEntityFieldEncryption();
@@ -166,8 +154,11 @@ export const mfaReencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<vo
       envelopeValues = unwrapped as { totpSecret: string; recoveryCodes: string }; // @cast-boundary engine-payload
     }
 
-    const totpClass = classifyEnvelope(envelopeValues.totpSecret, targetVersion);
-    const recoveryClass = classifyEnvelope(envelopeValues.recoveryCodes, targetVersion);
+    // After PII peel (when configured), values must be current-cipher
+    // envelopes — non-JSON/non-envelope is not a supported legacy decrypt
+    // path (#1541, mirrors config #1513).
+    const totpClass = classifyStoredEnvelope(envelopeValues.totpSecret, targetVersion);
+    const recoveryClass = classifyStoredEnvelope(envelopeValues.recoveryCodes, targetVersion);
     if (totpClass === "unrecognized" || recoveryClass === "unrecognized") {
       ctx.log?.warn?.(
         `[auth-mfa:reencrypt] row ${row.id} has a field that is not a current-cipher envelope, not re-encryptable`,

package/src/auth-mfa/token-secrets.ts

@@ -10,19 +10,19 @@ export type ResolvedMfaTokenSecrets = {
   readonly challengeTokenSecret: string;
 };
 
-// The two HKDF purposes auth-mfa needs. They live here rather than at each
-// call site because an app typically resolves them twice — once in the prod
-// entrypoint against a validated JWT_SECRET, once in the dev server against
-// its fallback — and a purpose string that drifts between those two files
-// invalidates every token issued by the other.
-//
-// Setup and challenge stay separate on purpose: a setup token proves "this
-// user is enrolling a factor", a challenge token proves "this user passed
-// step one of login". Sharing one key would let the first be replayed as the
-// second.
+// Shared here (not per call site) so the purpose string can't drift between
+// prod/dev entrypoints. Setup and challenge stay separate: sharing one key
+// would let a setup token be replayed as a login-challenge token.
 const SETUP_TOKEN_PURPOSE = "mfa-setup-token-v1";
 const CHALLENGE_TOKEN_PURPOSE = "mfa-challenge-token-v1";
 
+// A blank or whitespace-only override is treated as absent — an empty env
+// var (MFA_SETUP_TOKEN_SECRET="") must fall back to derivation, not sign
+// tokens with an empty/near-empty HMAC key (fw#1623).
+function resolveSecret(override: string | undefined, fallback: () => string): string {
+  return override !== undefined && override.trim() !== "" ? override : fallback();
+}
+
 /** Derives both MFA token secrets from the app's master secret. Pass explicit
  *  overrides only when a deployment needs its own key for one of them —
  *  otherwise deriving keeps a single env var authoritative. */
@@ -31,9 +31,11 @@ export function resolveMfaTokenSecrets(
   overrides: MfaTokenSecretOverrides = {},
 ): ResolvedMfaTokenSecrets {
   return {
-    setupTokenSecret:
-      overrides.setupTokenSecret ?? derivePurposeSecret(masterSecret, SETUP_TOKEN_PURPOSE),
-    challengeTokenSecret:
-      overrides.challengeTokenSecret ?? derivePurposeSecret(masterSecret, CHALLENGE_TOKEN_PURPOSE),
+    setupTokenSecret: resolveSecret(overrides.setupTokenSecret, () =>
+      derivePurposeSecret(masterSecret, SETUP_TOKEN_PURPOSE),
+    ),
+    challengeTokenSecret: resolveSecret(overrides.challengeTokenSecret, () =>
+      derivePurposeSecret(masterSecret, CHALLENGE_TOKEN_PURPOSE),
+    ),
   };
 }

package/src/billing-foundation/subscription-tier-sync.ts

@@ -116,9 +116,16 @@ export function createSubscriptionTierSync<TTier extends string>(
           tenantId: targetTenantId,
         });
         if (!result.isSuccess) return result;
+        // The primary write already committed — a webhook caller (Stripe/
+        // PayPal) that sees isSuccess:false here retries the whole event,
+        // re-running an already-succeeded side effect. Log the tier-sync
+        // failure instead of masking the primary write's success.
         const syncError = await syncTierFromSubscription(targetTenantId);
         if (syncError) {
-          return { isSuccess: false, error: syncError };
+          // biome-ignore lint/suspicious/noConsole: operator visibility for a post-commit sync failure
+          console.warn(
+            `[subscription-tier-sync] tier sync failed for tenant ${targetTenantId} after successful webhook write: ${syncError.code} ${syncError.message}`,
+          );
         }
         return result;
       },

package/src/cap-counter/__tests__/stock-cap-guard.integration.test.ts

@@ -0,0 +1,98 @@
+// Regression test for the tenant-scope override bug: checkStockCap used to
+// spread `spec.where` AFTER the injected `tenantId`, so a `where` object
+// carrying its own `tenantId` key silently overrode the caller's real tenant
+// and the count ran against the wrong tenant's rows.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEntityExecutor, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { capCounterEntity } from "../entity";
+import { createStockCapGuard } from "../stock-cap-guard";
+
+const { executor, table: capCounterTable } = createEntityExecutor("cap-counter", capCounterEntity);
+
+let stack: TestStack;
+let db: DbConnection;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [] });
+  db = stack.db;
+  await unsafeCreateEntityTable(db, capCounterEntity, "cap-counter");
+  await createEventsTable(db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(db, [capCounterTable, eventsTable]);
+});
+
+function seedUser(tenantId: ReturnType<typeof testTenantId>): SessionUser {
+  return { id: "seed-user", tenantId, roles: ["SystemAdmin"] };
+}
+
+async function seedCounterRow(tenantId: ReturnType<typeof testTenantId>): Promise<void> {
+  const result = await executor.create(
+    { tenantId, capName: "x", value: 0, periodStart: "2026-07-01T00:00:00Z" },
+    seedUser(tenantId),
+    createTenantDb(db, tenantId),
+  );
+  if (!result.isSuccess) throw new Error(`seed failed: ${JSON.stringify(result)}`);
+}
+
+describe("checkStockCap tenant scoping", () => {
+  test("spec.where cannot override the caller's real tenantId", async () => {
+    const realTenant = testTenantId(1);
+    const otherTenant = testTenantId(2);
+
+    // 5 rows live under otherTenant — realTenant has none.
+    for (let i = 0; i < 5; i++) {
+      await seedCounterRow(otherTenant);
+    }
+
+    const guard = createStockCapGuard(async () => ({}));
+    const failure = await guard.checkStockCap(db, realTenant, {
+      table: capCounterTable,
+      limit: () => 1,
+      // A where object that (accidentally or maliciously) carries its own
+      // tenantId must NOT be able to redirect the count to another tenant.
+      where: { tenantId: otherTenant, capName: "x" },
+      code: "cap-exceeded",
+      i18nKey: "cap.exceeded",
+      field: "capName",
+    });
+
+    // realTenant has zero matching rows — must not see otherTenant's 5.
+    expect(failure).toBeNull();
+  });
+
+  test("still enforces the cap for the caller's own tenant", async () => {
+    const tenant = testTenantId(1);
+    for (let i = 0; i < 2; i++) {
+      await seedCounterRow(tenant);
+    }
+
+    const guard = createStockCapGuard(async () => ({}));
+    const failure = await guard.checkStockCap(db, tenant, {
+      table: capCounterTable,
+      limit: () => 1,
+      where: { capName: "x" },
+      code: "cap-exceeded",
+      i18nKey: "cap.exceeded",
+      field: "capName",
+    });
+
+    expect(failure).not.toBeNull();
+  });
+});

package/src/cap-counter/stock-cap-guard.ts

@@ -39,7 +39,7 @@ export function createStockCapGuard<TCaps>(
     spec: StockCapSpec<TCaps>,
   ): Promise<WriteFailure | null> {
     const caps = await resolveTierCaps(db, tenantId);
-    const current = await countWhere(db, spec.table, { tenantId, ...spec.where });
+    const current = await countWhere(db, spec.table, { ...spec.where, tenantId });
     const { state, limit } = enforceStockCap({
       current,
       limit: spec.limit(caps),

package/src/config/handlers/reencrypt.job.ts

@@ -25,8 +25,12 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import type { JobHandlerFn, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { type EnvelopeCipher, isStoredEnvelope } from "@cosmicdrift/kumiko-framework/secrets";
-import { type ChunkedMigrationStopReason, runChunkedMigration } from "../../shared";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  type ChunkedMigrationStopReason,
+  classifyStoredEnvelope,
+  runChunkedMigration,
+} from "../../shared";
 import { configValueEntity, configValuesTable } from "../table";
 
 const DEFAULT_MAX_FAILURES = 10;
@@ -49,21 +53,6 @@ export type ReencryptJobResult = {
   readonly stoppedReason: ChunkedMigrationStopReason;
 };
 
-type RowClassification = "rotate" | "current" | "unrecognized";
-
-function classifyRow(value: string, targetVersion: number): RowClassification {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    // not JSON at all — no supported format decrypts this; let
-    // cipher.decrypt reject it and count the row as failed.
-    return "unrecognized";
-  }
-  if (!isStoredEnvelope(parsed)) return "unrecognized";
-  return parsed.kekVersion === targetVersion ? "current" : "rotate";
-}
-
 export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
   const payload = rawPayload as ReencryptJobPayload; // @cast-boundary engine-payload
   const maybeCipher = ctx.configEncryption;
@@ -148,7 +137,7 @@ export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void>
 
   async function migrateRow(row: ConfigRow): Promise<"migrated" | "skipped" | "failed"> {
     if (row.value === null || row.value === undefined) return "skipped";
-    const classification = classifyRow(row.value, targetVersion);
+    const classification = classifyStoredEnvelope(row.value, targetVersion);
     if (classification === "current") {
       alreadyCurrent++;
       return "skipped";

package/src/delivery/delivery-service.ts

@@ -488,7 +488,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
             tenantId,
             notificationType,
             channel: "*",
-            recipientId: null,
+            recipientId: options.recipientId ?? null,
             recipientAddress: null,
             status: "skipped",
             error: "duplicate_idempotency_key",

package/src/document-ingest-foundation/__tests__/feature.integration.test.ts

@@ -89,6 +89,14 @@ async function loadIngestRequestedEvents(): Promise<{ payload: Record<string, un
   return rows as { payload: Record<string, unknown> }[];
 }
 
+async function loadIngestSkippedEvents(): Promise<{ payload: Record<string, unknown> }[]> {
+  const rows = await asRawClient(stack.db).unsafe(
+    `SELECT payload FROM kumiko_events WHERE type = $1`,
+    ["document-ingest-foundation:event:document-ingest-skipped"],
+  );
+  return rows as { payload: Record<string, unknown> }[];
+}
+
 describe("fileRef.created → documentIngest.requested", () => {
   test("PDF upload requests ingest with the fileRef pointer, no binary", async () => {
     const { id, storageKey } = await uploadFile("invoice.pdf", pdfBytes, "application/pdf");
@@ -97,12 +105,13 @@ describe("fileRef.created → documentIngest.requested", () => {
 
     const rows = await loadIngestRequestedEvents();
     expect(rows).toHaveLength(1);
-    const payload = rows[0]?.payload;
-    expect(payload?.["fileRefId"]).toBe(id);
-    expect(payload?.["storageKey"]).toBe(storageKey);
-    expect(payload?.["mimeType"]).toBe("application/pdf");
-    expect(payload?.["data"]).toBeUndefined();
-    expect(payload?.["binary"]).toBeUndefined();
+    expect(rows[0]?.payload).toEqual({
+      fileRefId: id,
+      storageKey,
+      fileName: "invoice.pdf",
+      mimeType: "application/pdf",
+      size: pdfBytes.length,
+    });
   });
 
   test("image/png upload also requests ingest (Phase-1 mime allowlist)", async () => {
@@ -113,19 +122,32 @@ describe("fileRef.created → documentIngest.requested", () => {
     expect(await loadIngestRequestedEvents()).toHaveLength(1);
   });
 
-  test("unsupported mime type is skipped — no ingest requested", async () => {
-    await uploadFile("notes.txt", textBytes, "text/plain");
+  test("unsupported mime type is skipped — no ingest requested, skip is observable", async () => {
+    const { id, storageKey } = await uploadFile("notes.txt", textBytes, "text/plain");
 
     await stack.eventDispatcher?.runOnce();
 
     expect(await loadIngestRequestedEvents()).toHaveLength(0);
+    const skipped = await loadIngestSkippedEvents();
+    expect(skipped).toHaveLength(1);
+    // mimeType not pinned exactly: the upload route/File API append a
+    // charset suffix ("text/plain;charset=utf-8") that isn't this MSP's
+    // concern — the allowlist-miss is.
+    expect(skipped[0]?.payload).toMatchObject({
+      fileRefId: id,
+      storageKey,
+      fileName: "notes.txt",
+      reason: "unsupported-mime-type",
+    });
+    expect(String(skipped[0]?.payload["mimeType"])).toStartWith("text/plain");
   });
 
-  test("oversized file is skipped before the mime check — no ingest requested", async () => {
+  test("oversized file is skipped before the mime check — no ingest requested, skip is observable", async () => {
     // Real uploads can't exceed file-routes.ts' 10mb unconstrained-upload
     // default, well below this feature's 25mb domain cap — so an oversized
     // fileRef.created is inserted directly (bypassing the upload route) to
     // prove the MSP's own size-check fires independently of it.
+    const oversizedSize = 26 * 1024 * 1024;
     await asRawClient(stack.db).unsafe(
       `
       INSERT INTO kumiko_events
@@ -142,9 +164,13 @@ describe("fileRef.created → documentIngest.requested", () => {
           storageKey: "huge.pdf",
           fileName: "huge.pdf",
           mimeType: "application/pdf",
-          size: 26 * 1024 * 1024,
+          size: oversizedSize,
         }),
-        "{}",
+        // MSP-apply's ctx.unsafeAppendEvent stamps the new event's actor from
+        // the TRIGGERING event's metadata.userId (server.ts) — an empty
+        // metadata object here leaves it undefined and the skip-event insert
+        // rejects with "UNDEFINED_VALUE".
+        JSON.stringify({ userId: admin.id }),
         admin.id,
       ],
     );
@@ -152,5 +178,15 @@ describe("fileRef.created → documentIngest.requested", () => {
     await stack.eventDispatcher?.runOnce();
 
     expect(await loadIngestRequestedEvents()).toHaveLength(0);
+    const skipped = await loadIngestSkippedEvents();
+    expect(skipped).toHaveLength(1);
+    expect(skipped[0]?.payload).toEqual({
+      fileRefId: "00000000-0000-4000-8000-0000000000ff",
+      storageKey: "huge.pdf",
+      fileName: "huge.pdf",
+      mimeType: "application/pdf",
+      size: oversizedSize,
+      reason: "file-too-large",
+    });
   });
 });

package/src/document-ingest-foundation/__tests__/feature.test.ts

@@ -7,7 +7,7 @@
 import { describe, expect, test } from "bun:test";
 import { EXT_TENANT_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { documentExtractEntity } from "../entity";
-import { DOCUMENT_INGEST_REQUESTED_EVENT_QN } from "../events";
+import { DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_QN } from "../events";
 import { documentIngestFoundationFeature } from "../feature";
 
 describe("documentIngestFoundationFeature — shape", () => {
@@ -64,9 +64,10 @@ describe("documentIngestFoundationFeature — shape", () => {
     expect(Object.keys(documentIngestFoundationFeature.queryHandlers)).toHaveLength(0);
   });
 
-  test("registers the documentIngest.requested event under the exported QN", () => {
+  test("registers the documentIngest.requested and documentIngest.skipped events under their exported QNs", () => {
     expect(Object.keys(documentIngestFoundationFeature.events)).toEqual([
       "documentIngest.requested",
+      "documentIngest.skipped",
     ]);
     // The registry qualifies short → QN via qn(toKebab(feature), "event",
     // toKebab(short)) — pin the hand-written DOCUMENT_INGEST_REQUESTED_EVENT_QN
@@ -77,6 +78,9 @@ describe("documentIngestFoundationFeature — shape", () => {
     expect(documentIngestFoundationFeature.events["documentIngest.requested"]?.name).toBe(
       DOCUMENT_INGEST_REQUESTED_EVENT_QN,
     );
+    expect(documentIngestFoundationFeature.events["documentIngest.skipped"]?.name).toBe(
+      DOCUMENT_INGEST_SKIPPED_EVENT_QN,
+    );
   });
 
   test("registers the fileRef.created MSP", () => {

package/src/document-ingest-foundation/events.ts

@@ -23,3 +23,18 @@ export const documentIngestRequestedPayloadSchema = z.object({
   size: z.number().int().min(0),
 });
 export type DocumentIngestRequestedPayload = z.infer<typeof documentIngestRequestedPayloadSchema>;
+
+export const DOCUMENT_INGEST_SKIPPED_EVENT_SHORT = "documentIngest.skipped" as const;
+
+export const DOCUMENT_INGEST_SKIPPED_EVENT_QN =
+  "document-ingest-foundation:event:document-ingest-skipped" as const;
+
+export const documentIngestSkippedPayloadSchema = z.object({
+  fileRefId: z.string().min(1),
+  storageKey: z.string().min(1),
+  fileName: z.string().min(1),
+  mimeType: z.string().min(1),
+  size: z.number().int().min(0),
+  reason: z.enum(["file-too-large", "unsupported-mime-type"]),
+});
+export type DocumentIngestSkippedPayload = z.infer<typeof documentIngestSkippedPayloadSchema>;

package/src/document-ingest-foundation/feature.ts

@@ -24,7 +24,10 @@ import {
   DOCUMENT_INGEST_AGGREGATE_TYPE,
   DOCUMENT_INGEST_REQUESTED_EVENT_QN,
   DOCUMENT_INGEST_REQUESTED_EVENT_SHORT,
+  DOCUMENT_INGEST_SKIPPED_EVENT_QN,
+  DOCUMENT_INGEST_SKIPPED_EVENT_SHORT,
   documentIngestRequestedPayloadSchema,
+  documentIngestSkippedPayloadSchema,
 } from "./events";
 import { documentExtractTenantDestroyHook } from "./tenant-destroy-hook";
 
@@ -100,6 +103,7 @@ export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) =
   );
 
   r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema);
+  r.defineEvent(DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestSkippedPayloadSchema);
 
   r.multiStreamProjection({
     name: "request-ingest",
@@ -112,10 +116,31 @@ export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) =
         if (!parsed.success) return;
         const payload = parsed.data;
 
+        const skip = (reason: "file-too-large" | "unsupported-mime-type") =>
+          ctx.unsafeAppendEvent({
+            aggregateId: event.aggregateId,
+            aggregateType: DOCUMENT_INGEST_AGGREGATE_TYPE,
+            type: DOCUMENT_INGEST_SKIPPED_EVENT_QN,
+            payload: {
+              fileRefId: event.aggregateId,
+              storageKey: payload.storageKey,
+              fileName: payload.fileName,
+              mimeType: payload.mimeType,
+              size: payload.size,
+              reason,
+            },
+          });
+
         // skip: over the fixed cap — no ingest requested, upload itself already succeeded
-        if (payload.size > MAX_FILE_BYTES) return;
+        if (payload.size > MAX_FILE_BYTES) {
+          await skip("file-too-large");
+          return;
+        }
         // skip: outside the Phase-1 mime allowlist — no ingest requested
-        if (!ALLOWED_MIME_TYPES.has(payload.mimeType)) return;
+        if (!ALLOWED_MIME_TYPES.has(payload.mimeType)) {
+          await skip("unsupported-mime-type");
+          return;
+        }
 
         await ctx.unsafeAppendEvent({
           aggregateId: event.aggregateId,

package/src/inbound-mail-foundation/watch-supervisor.ts

@@ -408,8 +408,17 @@ export function createInboundMailSupervisor(
       state.stop = stop;
       state.backoffMs = backoffInitialMs;
       // Await — fire-and-forget raced with a later auth_error mark under
-      // try-first waitFor (isWatching true before projection settled).
-      await markAccount(account, { watchState: "watching" }, "watch_supervisor");
+      // try-first waitFor (isWatching true before projection settled). Own
+      // try/catch: a projection-write hiccup here is not a sync failure —
+      // the watch itself is healthy, so it must not trigger handleSyncError's
+      // backoff/restart/auth_error handling below.
+      try {
+        await markAccount(account, { watchState: "watching" }, "watch_supervisor");
+      } catch (err) {
+        log(
+          `inbound-mail: markAccount(watching) for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
     } catch (err) {
       const keepRunning = await handleSyncError(account, err);
       if (keepRunning) scheduleRestart(err);

package/src/jobs/handlers/catalog.query.ts

@@ -1,5 +1,6 @@
 import { defineQueryHandler, type JobDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { isManualTrigger } from "../is-manual-trigger";
 
 export type ManualJobCatalogEntry = {
   readonly jobName: string;
@@ -8,10 +9,6 @@ export type ManualJobCatalogEntry = {
   readonly payloadSchema: Record<string, unknown> | null;
 };
 
-function isManualTrigger(trigger: JobDefinition["trigger"]): boolean {
-  return "manual" in trigger && trigger.manual === true;
-}
-
 function payloadSchemaJson(job: JobDefinition): Record<string, unknown> | null {
   if (job.schema === undefined) return null;
   try {

package/src/jobs/handlers/trigger.write.ts

@@ -9,6 +9,7 @@ import {
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import { z } from "zod";
 import { JobErrors } from "../constants";
+import { isManualTrigger } from "../is-manual-trigger";
 
 export const triggerWrite = defineWriteHandler({
   name: "trigger",
@@ -31,7 +32,7 @@ export const triggerWrite = defineWriteHandler({
       );
     }
 
-    if (!("manual" in jobDef.trigger) || jobDef.trigger.manual !== true) {
+    if (!isManualTrigger(jobDef.trigger)) {
       return writeFailure(
         new UnprocessableError(JobErrors.notManual, {
           i18nKey: "jobs.errors.notManual",

package/src/jobs/is-manual-trigger.ts

@@ -0,0 +1,5 @@
+import type { JobDefinition } from "@cosmicdrift/kumiko-framework/engine";
+
+export function isManualTrigger(trigger: JobDefinition["trigger"]): boolean {
+  return "manual" in trigger && trigger.manual === true;
+}

package/src/managed-pages/screens/branding-screen.ts

@@ -42,7 +42,7 @@ export function createBrandingSettingsScreen(opts: {
       description: createTextField({
         maxLength: 500,
         multiline: { rows: 3 },
-        allowPlaintext: "tenant branding copy, business content not personal data",
+        allowPlaintext: "is-business-data",
       }),
       siteUrl: createTextField({ maxLength: 2000, format: "url" }),
       accentColor: createTextField({ maxLength: 9 }),

package/src/presets/dsgvo-self-service.ts

@@ -6,19 +6,19 @@ import { createUserDataRightsFeature, type UserDataRightsOptions } from "../user
 import { createUserProfileFeature } from "../user-profile";
 
 export type DsgvoSelfServiceOptions = {
-  /** Durchgereicht an createUserDataRightsFeature — Export-/Deletion-Mail-
-   *  Callbacks + Apex-Deletion-HMAC. Default {} (no-op Mail-Side). */
+  /** Passed through to createUserDataRightsFeature — export/deletion mail
+   *  callbacks + Apex deletion HMAC. Default {} (no-op mail side). */
   readonly userDataRights?: UserDataRightsOptions;
 };
 
-// DSGVO- + Account-Self-Service-Kette, die jede Kumiko-SaaS-App mountet
-// (Privacy-Center, Account-Löschung Art. 17, Export Art. 20, Sessions).
-// Order is load-bearing (Require-Order): user-data-rights braucht
-// data-retention + compliance-profiles + sessions, user-profile braucht
-// user-data-rights. Genau diese Order stand bisher in jeder App handkopiert
-// mit Erklär-Kommentar. text-content + legal-pages bleiben bewusst draußen —
-// legal-pages hat ein app-spezifisches wrapLayout, text-content ist
-// standalone Foundation; beide spreaded die App selbst dazu.
+// DSGVO + account self-service chain every Kumiko SaaS app mounts (privacy
+// center, account deletion Art. 17, export Art. 20, sessions). Order is
+// load-bearing (require-order): user-data-rights needs data-retention +
+// compliance-profiles + sessions, user-profile needs user-data-rights. This
+// exact order used to be hand-copied into every app with an explainer
+// comment. text-content + legal-pages stay out deliberately — legal-pages
+// has an app-specific wrapLayout, text-content is a standalone foundation;
+// both are spread in by the app itself.
 export function dsgvoSelfServiceFeatures(opts: DsgvoSelfServiceOptions = {}): FeatureDefinition[] {
   return [
     createDataRetentionFeature(),

package/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -1,6 +1,7 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
@@ -55,6 +56,14 @@ export const revokeAllForUserWrite = defineWriteHandler({
     // parse explicitly before the raw append so a shape drift fails loudly
     // here instead of landing unvalidated on the events table.
     if (updated.length > 0) {
+      const eventDef = ctx.registry.getEvent(SESSION_REVOKED_EVENT_QN);
+      if (!eventDef) {
+        return writeFailure(
+          new UnprocessableError("session_revoked_event_not_registered", {
+            details: { eventQn: SESSION_REVOKED_EVENT_QN },
+          }),
+        );
+      }
       const payload = sessionRevokedSchema.parse({
         userId: event.payload.userId,
         sessionIds: updated.map((row) => row.id),
@@ -66,7 +75,7 @@ export const revokeAllForUserWrite = defineWriteHandler({
         tenantId: SYSTEM_TENANT_ID,
         expectedVersion: 0,
         type: SESSION_REVOKED_EVENT_QN,
-        eventVersion: ctx.registry.getEvent(SESSION_REVOKED_EVENT_QN)?.version ?? 1,
+        eventVersion: eventDef.version,
         payload,
         metadata: {
           userId: event.user.id,

package/src/shared/classify-stored-envelope.ts

@@ -0,0 +1,21 @@
+import { isStoredEnvelope } from "@cosmicdrift/kumiko-framework/secrets";
+
+export type StoredEnvelopeClassification = "rotate" | "current" | "unrecognized";
+
+// Shared by every KEK-rotation job (config, auth-mfa, ...): a row whose value
+// isn't a current-cipher envelope (malformed JSON, or any pre-envelope
+// format) is never a supported re-encrypt input — classify it "unrecognized"
+// so callers fail it loudly instead of handing it to cipher.decrypt.
+export function classifyStoredEnvelope(
+  value: string,
+  targetVersion: number,
+): StoredEnvelopeClassification {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    return "unrecognized";
+  }
+  if (!isStoredEnvelope(parsed)) return "unrecognized";
+  return parsed.kekVersion === targetVersion ? "current" : "rotate";
+}

package/src/shared/index.ts

@@ -5,6 +5,10 @@ export {
   type MigrationRowOutcome,
   runChunkedMigration,
 } from "./chunked-entity-migration";
+export {
+  classifyStoredEnvelope,
+  type StoredEnvelopeClassification,
+} from "./classify-stored-envelope";
 export { decryptStoredPii } from "./decrypt-stored-pii";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write";
 export { entitiesOf } from "./entities-of";

package/src/tenant-settings/__tests__/tenant-settings.integration.test.ts

@@ -47,6 +47,15 @@ test("defineCreateWithTenantDefaults throws on an unknown currency field", () =>
   ).toThrow(/unknown field "notARealField"/);
 });
 
+test("defineCreateWithTenantDefaults throws on an unknown locale field", () => {
+  expect(() =>
+    defineCreateWithTenantDefaults("invoice", invoiceEntity, {
+      access: ACCESS,
+      localeField: "languge",
+    }),
+  ).toThrow(/unknown field "languge"/);
+});
+
 describe("without tenant-settings mount", () => {
   const invoiceFeature = defineFeature("invoice", (r) => {
     r.entity("invoice", invoiceEntity);

package/src/tenant-settings/tenant-defaults.ts

@@ -42,6 +42,9 @@ export function defineCreateWithTenantDefaults(
     const isRequired = "required" in def && def.required === true;
     relax[field] = isRequired ? OPTIONAL_CURRENCY_MONEY : OPTIONAL_CURRENCY_MONEY.optional();
   }
+  if (options.localeField && !entity.fields[options.localeField]) {
+    throw new Error(`defineCreateWithTenantDefaults: unknown field "${options.localeField}"`);
+  }
   const baseSchema = buildInsertSchema(entity);
   const schema = Object.keys(relax).length > 0 ? baseSchema.extend(relax) : baseSchema;
 

package/src/tier-engine/compose-app.ts

@@ -85,19 +85,8 @@ export type ComposedApp<TCaps extends Readonly<Record<string, unknown>>> = {
  * is safer than silently mounting the wrong feature-set and hoping nobody
  * notices when "Pro" turns out to mean "Free".
  *
- * **No production callers, and that is not rot.** This is the BOOT-TIME half
- * of tier composition — which features get mounted at all. The RUNTIME half,
- * which features a given tenant may see out of everything mounted, is
- * `createTierEngineFeature`'s `resolver(tenantId) => ReadonlySet<string>`
- * (feature.ts). Both read the same tierMap at opposite ends. Apps use the
- * resolver today; nobody composes per-tenant feature sets at boot yet, so an
- * app that only needs caps merges them locally rather than constructing a
- * featureRegistry it has no other use for (kumiko-studio's
- * `resolvePlatformCaps`, studio#154/1 → PR #162 — a deliberate, typed copy of
- * step 4, not a workaround). Whether the boot-time half ever gets a caller is
- * a product question: kumiko-studio's BYO pivot (Sprint 8a Phase 3a)
- * differentiates tiers by CAPS, not by feature set. Delete this only once no
- * app plans to differentiate by feature set — the engine is app-agnostic.
+ * **No production callers, and that is not rot** — see
+ * docs/reference/tier-composition-boot-vs-runtime.md for why.
  */
 export function composeApp<TCaps extends Readonly<Record<string, unknown>>>(
   input: ComposeAppInput<TCaps>,

package/src/user/__tests__/seed-testing.integration.test.ts

@@ -104,6 +104,31 @@ describe("seedUser", () => {
     expect(row?.["passwordHash"]).toBeNull();
   });
 
+  test("emailVerified:true reconciled auf einem bereits geseedeten User (#1687)", async () => {
+    const first = await seedUser(stack.db, {
+      email: "frank@example.com",
+      displayName: "Frank",
+    });
+    const [rowBefore] = await selectMany(stack.db, userTable, { id: first.id });
+    expect(rowBefore?.["emailVerified"]).not.toBe(true);
+
+    const second = await seedUser(stack.db, {
+      email: "frank@example.com",
+      displayName: "Frank",
+      emailVerified: true,
+    });
+    expect(second.id).toBe(first.id);
+
+    const [rowAfter] = await selectMany(stack.db, userTable, { id: first.id });
+    expect(rowAfter?.["emailVerified"]).toBe(true);
+
+    const updated = await selectMany(stack.db, eventsTable, {
+      aggregateType: "user",
+      type: "user.updated",
+    });
+    expect(updated).toHaveLength(1);
+  });
+
   test("default `by` ist TestUsers.systemAdmin (für audit-trail)", async () => {
     const { id: userId } = await seedUser(stack.db, {
       email: "eve@example.com",

package/src/user/seeding.ts

@@ -69,7 +69,31 @@ export async function seedUser(
   const existing = await fetchOne(db, userTable, { email: options.email });
   // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
   // liefert die Projection-Row als Record<string, unknown>.
-  if (existing) return { id: existing["id"] as string };
+  if (existing) {
+    const id = existing["id"] as string;
+    // Reconcile emailVerified on an already-seeded row: a persistent dev DB
+    // (or a re-run bootstrap) can carry a User seeded before this flag
+    // existed or before it flipped to true — without this, "seed with
+    // emailVerified: true" only ever takes effect on the very first insert
+    // and the flag silently does nothing on every re-run after (#1687).
+    // Goes through the executor (a real `.updated` event), never a direct
+    // write.
+    if (options.emailVerified === true && existing["emailVerified"] !== true) {
+      const result = await userExecutor.update(
+        { id, version: existing["version"] as number, changes: { emailVerified: true } },
+        by,
+        tdb,
+      );
+      // version_conflict = a concurrent write already changed the row —
+      // fine for a seed helper, don't fail the whole seed run over it.
+      if (!result.isSuccess && result.error.code !== "version_conflict") {
+        throw new Error(
+          `seedUser emailVerified reconcile failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
+        );
+      }
+    }
+    return { id };
+  }
 
   const result = await userExecutor.create(
     {

package/src/user-data-rights/__tests__/anonymous-deletion-kms.integration.test.ts

@@ -103,7 +103,7 @@ afterEach(() => {
 
 function tokenFromLastVerifyCall(): string {
   const url = new URL(verifyCalls[0]?.verifyUrl ?? "");
-  return url.searchParams.get("token") ?? "";
+  return new URLSearchParams(url.hash.slice(1)).get("token") ?? "";
 }
 
 describe("anonymous deletion flow with active KMS", () => {

package/src/user-data-rights/__tests__/anonymous-deletion.integration.test.ts

@@ -95,7 +95,7 @@ async function seedAlice(status: string = USER_STATUS.Active, email: string = AL
 
 function tokenFromLastVerifyCall(): string {
   const url = new URL(verifyCalls[0]?.verifyUrl ?? "");
-  return url.searchParams.get("token") ?? "";
+  return new URLSearchParams(url.hash.slice(1)).get("token") ?? "";
 }
 
 async function statusOf(): Promise<string | undefined> {
@@ -118,7 +118,7 @@ describe("anonymous deletion flow", () => {
 
     expect(verifyCalls).toHaveLength(1);
     expect(verifyCalls[0]?.email).toBe(ALICE_EMAIL);
-    expect(verifyCalls[0]?.verifyUrl.startsWith(`${VERIFY_URL}?token=`)).toBe(true);
+    expect(verifyCalls[0]?.verifyUrl.startsWith(`${VERIFY_URL}#token=`)).toBe(true);
     expect(tokenFromLastVerifyCall().length).toBeGreaterThan(0);
     // Status noch NICHT geflipt — erst confirm startet die Grace-Period.
     expect(await statusOf()).toBe(USER_STATUS.Active);

package/src/user-data-rights/__tests__/request-deletion-url.test.ts

@@ -2,20 +2,23 @@ import { describe, expect, test } from "bun:test";
 import { buildDeletionVerifyUrl } from "../handlers/request-deletion-by-email.write";
 
 describe("buildDeletionVerifyUrl", () => {
-  test("appends ?token to a plain base URL", () => {
-    expect(buildDeletionVerifyUrl("https://app.example.com/delete/confirm", "tok-123")).toBe(
-      "https://app.example.com/delete/confirm?token=tok-123",
-    );
+  // fw#1554: the token goes in the URL fragment, not a query param —
+  // fragments never leave the browser, so they never land in proxy/access
+  // logs (unlike ?token=, which does).
+  test("puts the token in the URL fragment, not a query param", () => {
+    const url = buildDeletionVerifyUrl("https://app.example.com/delete/confirm", "tok-123");
+    expect(url).toBe("https://app.example.com/delete/confirm#token=tok-123");
+    expect(new URL(url).search).toBe("");
   });
 
-  test("appends &token when the base already carries query params (not a second ?)", () => {
+  test("preserves an existing query param — only the token is a fragment", () => {
     const url = buildDeletionVerifyUrl("https://app.example.com/confirm?lang=de", "tok-123");
-    expect(url).toBe("https://app.example.com/confirm?lang=de&token=tok-123");
-    expect(url.match(/\?/g)).toHaveLength(1);
+    expect(url).toBe("https://app.example.com/confirm?lang=de#token=tok-123");
   });
 
   test("URL-encodes a token with reserved characters", () => {
     const url = new URL(buildDeletionVerifyUrl("https://app.example.com/c", "a b&c=d"));
-    expect(url.searchParams.get("token")).toBe("a b&c=d");
+    const params = new URLSearchParams(url.hash.slice(1));
+    expect(params.get("token")).toBe("a b&c=d");
   });
 });

package/src/user-data-rights/feature.ts

@@ -112,8 +112,9 @@ export type UserDataRightsOptions = {
    *  by-token weist generisch ab). */
   readonly deletionTokenSecret?: string;
   /** Basis-URL des Apex-Confirm-Screens, z.B.
-   *  "https://app.example.com/delete-account/confirm". Der Handler hängt
-   *  `?token=<token>` an. Required wenn deletionTokenSecret gesetzt. */
+   *  "https://app.example.com/delete-account/confirm". Der Handler hängt das
+   *  Token als URL-Fragment an (`#token=<token>`, fw#1554). Required wenn
+   *  deletionTokenSecret gesetzt. */
   readonly deletionVerifyUrl?: string;
   /** Versand des Verify-Magic-Links (Schritt 1 des anonymen Flows).
    *  Best-effort, app-author-wired. MUSS non-blocking sein (enqueue, z.B.

package/src/user-data-rights/handlers/request-deletion-by-email.write.ts

@@ -30,18 +30,20 @@ export type RequestDeletionByEmailOptions = {
    *  deaktiviert (Handler antwortet still mit success, kein Link). */
   readonly deletionTokenSecret?: string;
   /** Basis-URL des Apex-Confirm-Screens, z.B.
-   *  "https://app.example.com/delete-account/confirm". Der Handler hängt
-   *  `?token=<token>` an. Ohne URL kein Link. */
+   *  "https://app.example.com/delete-account/confirm". Der Handler hängt das
+   *  Token als URL-Fragment an (`#token=<token>`, fw#1554). Ohne URL kein Link. */
   readonly deletionVerifyUrl?: string;
   readonly sendDeletionVerificationEmail?: SendDeletionVerificationEmailFn;
 };
 
-// URL-safe append: handles a base URL that already carries query params
-// (`?lang=de` → `?lang=de&token=…`) instead of producing an invalid
-// `?lang=de?token=…`. searchParams.set encodes the token.
+// Token goes in the URL fragment, not a query param — fragments never leave
+// the browser (not sent to the server, so they never land in proxy/access
+// logs, unlike `?token=`). Same convention as the export-download link
+// (feature.ts, issue #1271). Preserves any existing query params on `base`
+// (`?lang=de` stays a query param; only the token is a fragment).
 export function buildDeletionVerifyUrl(base: string, token: string): string {
   const url = new URL(base);
-  url.searchParams.set("token", token);
+  url.hash = `token=${encodeURIComponent(token)}`;
   return url.toString();
 }
 

package/src/user-data-rights/web/__tests__/deletion-screens.test.tsx

@@ -79,15 +79,15 @@ describe("RequestAccountDeletionScreen", () => {
 });
 
 describe("ConfirmAccountDeletionScreen", () => {
-  test("ohne ?token → missingToken, kein Confirm-Button", () => {
+  test("ohne #token → missingToken, kein Confirm-Button", () => {
     window.history.replaceState({}, "", "/delete-account/confirm");
     const ui = renderWith(<ConfirmAccountDeletionScreen />, makeDispatcher(true, []));
     expect(ui.getByText(/Kein Token/)).toBeTruthy();
     expect(ui.queryByRole("button")).toBeNull();
   });
 
-  test("mit ?token → Confirm dispatcht confirm-deletion-by-token + Success", async () => {
-    window.history.replaceState({}, "", "/delete-account/confirm?token=tok-123");
+  test("mit #token → Confirm dispatcht confirm-deletion-by-token + Success", async () => {
+    window.history.replaceState({}, "", "/delete-account/confirm#token=tok-123");
     const calls: WriteCall[] = [];
     const ui = renderWith(<ConfirmAccountDeletionScreen />, makeDispatcher(true, calls));
     fireEvent.click(ui.getByRole("button"));
@@ -98,7 +98,7 @@ describe("ConfirmAccountDeletionScreen", () => {
   });
 
   test("write-Failure → invalidToken-Banner, kein Success", async () => {
-    window.history.replaceState({}, "", "/delete-account/confirm?token=bad");
+    window.history.replaceState({}, "", "/delete-account/confirm#token=bad");
     const ui = renderWith(<ConfirmAccountDeletionScreen />, makeDispatcher(false, []));
     fireEvent.click(ui.getByRole("button"));
     await waitFor(() => expect(ui.getByText(/ungültig oder abgelaufen/)).toBeTruthy());
@@ -106,7 +106,7 @@ describe("ConfirmAccountDeletionScreen", () => {
   });
 
   test("write wirft → generischer Error-Banner, NICHT invalidToken", async () => {
-    window.history.replaceState({}, "", "/delete-account/confirm?token=tok-123");
+    window.history.replaceState({}, "", "/delete-account/confirm#token=tok-123");
     const ui = renderWith(<ConfirmAccountDeletionScreen />, makeThrowingDispatcher());
     fireEvent.click(ui.getByRole("button"));
     await waitFor(() => expect(ui.getByText(/schief gegangen/)).toBeTruthy());

package/src/user-data-rights/web/confirm-deletion-screen.tsx

@@ -1,6 +1,7 @@
 // @runtime client
 // ConfirmAccountDeletionScreen — anonymer Apex-Screen Schritt 2. Liest das
-// `?token` aus der Verify-Link-URL und dispatcht beim Bestätigen
+// Token aus dem URL-Fragment (`#token=…`, nie an den Server gesendet — landet
+// so nicht in Proxy-/Access-Logs, fw#1554) und dispatcht beim Bestätigen
 // user-data-rights:write:confirm-deletion-by-token → startet die Grace-Period.
 //
 // App mountet den Screen unter der deletionVerifyUrl-Route (z.B.
@@ -15,7 +16,7 @@ type Phase = "idle" | "submitting" | "success" | "missing" | "invalid" | "error"
 
 function readToken(): string {
   if (typeof window === "undefined") return "";
-  return new URLSearchParams(window.location.search).get("token") ?? "";
+  return new URLSearchParams(window.location.hash.slice(1)).get("token") ?? "";
 }
 
 export type ConfirmAccountDeletionScreenProps = {