@cosmicdrift/kumiko-bundled-features 0.176.0 → 0.176.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.176.0",
+  "version": "0.176.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -120,12 +120,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.176.0",
-    "@cosmicdrift/kumiko-framework": "0.176.0",
-    "@cosmicdrift/kumiko-headless": "0.176.0",
-    "@cosmicdrift/kumiko-renderer": "0.176.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.176.0",
-    "@cosmicdrift/kumiko-types": "0.176.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.176.2",
+    "@cosmicdrift/kumiko-framework": "0.176.2",
+    "@cosmicdrift/kumiko-headless": "0.176.2",
+    "@cosmicdrift/kumiko-renderer": "0.176.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.176.2",
+    "@cosmicdrift/kumiko-types": "0.176.2",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -351,6 +351,37 @@ describe("invite-accept-with-login (Branch 2: anon + existing email)", () => {
     expect(memberships).toHaveLength(2);
   });
 
+  test("Bob accepts with a timezone → JWT retains the timezone", async () => {
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET timezone = $1 WHERE id = $2`,
+      ["Europe/Berlin", bobId],
+    );
+    try {
+      const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+      const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+        token,
+        email: BOB_EMAIL,
+        password: BOB_PASSWORD,
+      });
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { token?: string };
+      expect(body.token).toBeTypeOf("string");
+      if (!body.token) throw new Error("invite acceptance did not return a token");
+
+      const payload = await stack.jwt.verify(body.token);
+      expect(payload.timezone).toBe("Europe/Berlin");
+    } finally {
+      // Bob is shared across this describe block (other tests rely on his
+      // membership state persisting) — restore his timezone so later tests
+      // don't silently inherit it.
+      await asRawClient(stack.db).unsafe(
+        `UPDATE "${userTable.tableName}" SET timezone = NULL WHERE id = $1`,
+        [bobId],
+      );
+    }
+  });
+
   test("Wrong password → 422 invalid_invite_token (anti-enum)", async () => {
     const token = await inviteEmail(BOB_EMAIL, "Editor");
     const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -28,7 +28,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { decryptStoredPii, verifyPassword } from "../../shared";
+import { decryptStoredPii, sessionTimezoneField, verifyPassword } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
@@ -96,7 +96,11 @@ export function createInviteAcceptWithLoginHandler() {
         readonly role: string;
         readonly version: number;
       };
-      type UserAuthRow = { readonly id: string; readonly passwordHash: string | null };
+      type UserAuthRow = {
+        readonly id: string;
+        readonly passwordHash: string | null;
+        readonly timezone?: string | null;
+      };
 
       let committed = false;
       try {
@@ -173,6 +177,7 @@ export function createInviteAcceptWithLoginHandler() {
           // buildSessionRoles calls stripForbiddenMembershipRoles internally —
           // a reserved role on the invitation itself must never reach the session.
           roles: buildSessionRoles([], [invitationRole]),
+          ...sessionTimezoneField(userRow.timezone),
         };
 
         committed = true;

package/src/auth-email-password/handlers/login.write.ts

@@ -86,19 +86,21 @@ function ok<T>(value: T): GateOk<T> {
   return { ok: true, value };
 }
 
+type AuthenticatableUserRow = AuthUserRow & { readonly passwordHash: string };
+
 /** Uniform response on any credential miss — burns argon2 cost (#774). */
 export async function gateResolveAuthUser(
   ctx: HandlerContext,
   systemUser: SessionUser,
   email: string,
   password: string,
-): Promise<GateOutcome<AuthUserRow>> {
+): Promise<GateOutcome<AuthenticatableUserRow>> {
   const found = parseAuthUserRow(await ctx.queryAs(systemUser, UserQueries.findForAuth, { email }));
   if (!found?.passwordHash || found.isDeleted) {
     await verifyDummyPassword(password);
     return reject(invalidCredentials());
   }
-  return ok(found);
+  return ok({ ...found, passwordHash: found.passwordHash });
 }
 
 /**
@@ -124,14 +126,12 @@ export async function gateEnforceLockout(
 /** Verify password; record miss / clear lockout on hit. */
 export async function gateVerifyPassword(
   ctx: HandlerContext,
-  found: AuthUserRow,
+  found: AuthenticatableUserRow,
   password: string,
   maxFailedAttempts: number,
   lockoutDurationMinutes: number,
 ): Promise<GateOutcome<undefined>> {
-  const passwordHash = found.passwordHash;
-  if (!passwordHash) return reject(invalidCredentials());
-  const passwordOk = await verifyPassword(passwordHash, password);
+  const passwordOk = await verifyPassword(found.passwordHash, password);
   if (!passwordOk) {
     if (ctx.redis) {
       await recordFailedAttempt(ctx.redis, found.id, maxFailedAttempts, lockoutDurationMinutes);

package/src/auth-mfa/__tests__/verify.integration.test.ts

@@ -14,9 +14,12 @@ import {
   expectErrorIncludes,
   seedRow,
 } from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers as AuthEmailPasswordHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -25,7 +28,7 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { base32Decode } from "../base32";
 import { AuthMfaHandlers } from "../constants";
-import { createAuthMfaFeature } from "../feature";
+import { createAuthMfaFeature, mfaStatusCheckerFromFeature } from "../feature";
 import { signMfaChallengeToken } from "../mfa-challenge-token";
 import { userMfaEntity } from "../schema/user-mfa";
 import { currentTotpCode } from "../totp";
@@ -49,18 +52,26 @@ beforeAll(async () => {
   const encryption = createTestEnvelopeCipher();
   configureEntityFieldEncryption(encryption);
   const resolver = createConfigResolver({ cipher: encryption });
+  const authMfaFeature = createAuthMfaFeature({
+    setupTokenSecret: SETUP_TOKEN_SECRET,
+    issuer: "Kumiko Test",
+    challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+  });
   stack = await setupTestStack({
     features: [
       createConfigFeature(),
       createUserFeature(),
       createTenantFeature(),
-      createAuthMfaFeature({
-        setupTokenSecret: SETUP_TOKEN_SECRET,
-        issuer: "Kumiko Test",
-        challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+      authMfaFeature,
+      createAuthEmailPasswordFeature({
+        mfaStatusChecker: mfaStatusCheckerFromFeature(authMfaFeature),
       }),
     ],
     extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthEmailPasswordHandlers.login,
+    },
   });
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
@@ -76,8 +87,10 @@ async function enableMfaFor(idSeed: number): Promise<{
   user: ReturnType<typeof createTestUser>;
   secret: Buffer;
   recoveryCodes: string[];
+  password: string;
 }> {
   const user = createTestUser({ id: idSeed, roles: ["User"] });
+  const password = `password-${idSeed}-long-enough`;
   const start = await stack.http.writeOk<{
     setupToken: string;
     otpauthUri: string;
@@ -103,14 +116,14 @@ async function enableMfaFor(idSeed: number): Promise<{
     id: user.id,
     tenantId: user.tenantId,
     email: `user-${user.id}@example.com`,
-    passwordHash: "h",
+    passwordHash: await hashPassword(password),
     displayName: `Test User ${idSeed}`,
     locale: "de",
     emailVerified: true,
     roles: "[]",
     status: USER_STATUS.Active,
   });
-  return { user, secret, recoveryCodes: start.recoveryCodes };
+  return { user, secret, recoveryCodes: start.recoveryCodes, password };
 }
 
 function challengeFor(userId: string, tenantId: TenantId): string {
@@ -131,6 +144,50 @@ describe("mfa verify — completes a two-step login", () => {
     expect(res.session.tenantId).toBe(user.tenantId);
   });
 
+  test("a password login followed by MFA verify retains the user's timezone", async () => {
+    const { user, password, secret } = await enableMfaFor(9);
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET timezone = $1 WHERE id = $2`,
+      ["Europe/Berlin", user.id],
+    );
+
+    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: `user-${user.id}@example.com`,
+      password,
+    });
+    expect(loginRes.status).toBe(200);
+    const login = (await loginRes.json()) as { challengeToken?: string };
+    expect(login.challengeToken).toBeTypeOf("string");
+    if (!login.challengeToken) throw new Error("MFA login did not return a challenge token");
+
+    const verified = await stack.http.writeOk<{ session: SessionUser }>(
+      AuthMfaHandlers.verify,
+      { challengeToken: login.challengeToken, code: currentTotpCode(secret) },
+      GUEST,
+    );
+    expect(verified.session.timezone).toBe("Europe/Berlin");
+  });
+
+  test("a password login followed by MFA verify omits an unset timezone", async () => {
+    const { user, password, secret } = await enableMfaFor(10);
+
+    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: `user-${user.id}@example.com`,
+      password,
+    });
+    expect(loginRes.status).toBe(200);
+    const login = (await loginRes.json()) as { challengeToken?: string };
+    expect(login.challengeToken).toBeTypeOf("string");
+    if (!login.challengeToken) throw new Error("MFA login did not return a challenge token");
+
+    const verified = await stack.http.writeOk<{ session: SessionUser }>(
+      AuthMfaHandlers.verify,
+      { challengeToken: login.challengeToken, code: currentTotpCode(secret) },
+      GUEST,
+    );
+    expect(verified.session.timezone).toBeUndefined();
+  });
+
   test("a wrong TOTP code is rejected", async () => {
     const { user } = await enableMfaFor(2);
     const challengeToken = challengeFor(user.id, user.tenantId);

package/src/auth-mfa/handlers/verify.write.ts

@@ -8,7 +8,7 @@ import {
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
-import { burnToken } from "../../shared";
+import { burnToken, sessionTimezoneField } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants";
 import { findUserMfaRow } from "../db/queries";
@@ -135,7 +135,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
       const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
         id: userId,
-      })) as { roles?: string | null; status?: string } | null; // @cast-boundary engine-payload
+      })) as { roles?: string | null; status?: string; timezone?: string | null } | null; // @cast-boundary engine-payload
 
       // Re-check status + membership the way login.write.ts does after its
       // password check — the challenge token only proves "password was
@@ -168,7 +168,12 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // read-time backstop against a rebuild-resurrected role.
       const mergedRoles = buildSessionRoles(globalRoles, membership.roles);
 
-      const baseSession: SessionUser = { id: userId, tenantId, roles: mergedRoles };
+      const baseSession: SessionUser = {
+        id: userId,
+        tenantId,
+        roles: mergedRoles,
+        ...sessionTimezoneField(userRow?.timezone),
+      };
       const claims = await ctx.resolveAuthClaims(baseSession);
       const session: SessionUser =
         Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;

package/src/config/__tests__/tz-resolution.integration.test.ts

@@ -88,8 +88,13 @@ describe("buildHandlerContext ctx.tz resolution", () => {
   });
 
   test("ctx.tz.user reads SessionUser.timezone independently of tenant", async () => {
-    // Same tenant as the previous test (Europe/Berlin already set) — proves
-    // user overrides without needing to touch tenant config.
+    const admin = createTestUser({ id: 13, roles: ["Admin"] });
+    await stack.http.writeOk(
+      "config:write:set",
+      { key: "tenant:config:timezone", value: "Europe/Berlin" },
+      admin,
+    );
+
     const user = createTestUser({ id: 12, timezone: "Asia/Tokyo" });
     const res = await stack.http.writeOk<{ tenant: string; user: string }>(
       "probe:write:read-tz",

package/src/jobs/__tests__/jobs-catalog.integration.test.ts

@@ -1,39 +1,22 @@
 // Catalog + trigger hardening for #1602 — manual-only surface.
+// Real HTTP via setupTestStack — no mocks, mirrors jobs-security.integration.test.ts.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { buildServer, type JwtHelper } from "@cosmicdrift/kumiko-framework/api";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import {
-  createRegistry,
-  defineFeature,
-  type SessionUser,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
-import { createJobRunner, type JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
-import {
-  createTestDb,
-  createTestRedis,
-  type TestDb,
-  type TestRedis,
+  setupTestStack,
+  type TestStack,
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import type { Hono } from "hono";
 import { z } from "zod";
 import { JobErrors, JobHandlers, JobQueries } from "../constants";
 import { createJobsFeature } from "../feature";
-import { createJobRunLogger } from "../job-run-logger";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
-let testDb: TestDb;
-let testRedis: TestRedis;
-let db: DbConnection;
-let app: Hono;
-let jwt: JwtHelper;
-let jobRunner: JobRunner;
+let stack: TestStack;
 
 const systemAdmin = TestUsers.systemAdmin;
-const JWT_SECRET = "test-jwt-secret-for-jobs-catalog-32chars!!";
 
 const appFeature = defineFeature("catalog-app", (r) => {
   r.job(
@@ -45,115 +28,70 @@ const appFeature = defineFeature("catalog-app", (r) => {
 });
 
 beforeAll(async () => {
-  testDb = await createTestDb();
-  testRedis = await createTestRedis();
-  db = testDb.db;
-
-  const registry = createRegistry([appFeature, createJobsFeature()]);
-  await unsafePushTables(db, { jobRunsTable, jobRunLogsTable });
-  await createEventsTable(db);
-
-  const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
-  const logger = createJobRunLogger({ db, registry });
-  jobRunner = createJobRunner({
-    registry,
-    context: { db },
-    redisUrl,
-    consumerLane: "worker",
-    queueNamePrefix: `kumiko-jobs-catalog-test-${Date.now()}`,
-    ...logger,
+  stack = await setupTestStack({
+    features: [appFeature, createJobsFeature()],
+    jobs: { consumerLane: "worker", queueNamePrefix: `kumiko-jobs-catalog-test-${Date.now()}` },
   });
-  const context = { db, registry, jobRunner };
-  const server = buildServer({ registry, context, jwtSecret: JWT_SECRET });
-  app = server.app;
-  jwt = server.jwt;
-
-  await jobRunner.start();
+  await unsafePushTables(stack.db, { jobRunsTable, jobRunLogsTable });
 });
 
 afterAll(async () => {
-  await jobRunner.stop();
-  await testDb.cleanup();
-  await testRedis.cleanup();
+  await stack.cleanup();
 });
 
-async function req(
-  method: string,
-  path: string,
-  user: SessionUser,
-  body?: unknown,
-): Promise<Response> {
-  const token = await jwt.sign(user);
-  const init: RequestInit = {
-    method,
-    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-  };
-  if (body) init.body = JSON.stringify(body);
-  return app.request(path, init);
-}
-
-async function write(user: SessionUser, type: string, payload: unknown) {
-  const res = await req("POST", "/api/write", user, { type, payload });
-  return res.json();
-}
-
-async function query(user: SessionUser, type: string, payload: unknown) {
-  const res = await req("POST", "/api/query", user, { type, payload });
-  const body = await res.json();
-  if (res.status !== 200) {
-    throw new Error(`query ${type} → ${res.status}: ${JSON.stringify(body)}`);
-  }
-  return body;
-}
-
 describe("jobs:query:catalog", () => {
   test("lists only manual jobs including framework builtins", async () => {
-    const result = await query(systemAdmin, JobQueries.catalog, {});
     type CatalogRow = {
       readonly jobName: string;
       readonly perTenant: boolean;
       readonly payloadSchema: Record<string, unknown> | null;
     };
-    const rows = (result.data as { rows: readonly CatalogRow[] }).rows;
-    const names = rows.map((r) => r.jobName);
+    const result = await stack.http.queryOk<{ rows: readonly CatalogRow[] }>(
+      JobQueries.catalog,
+      {},
+      systemAdmin,
+    );
+    const names = result.rows.map((r) => r.jobName);
     expect(names).toContain("catalog-app:job:manual-echo");
     expect(names).toContain("jobs:job:reindex-entity");
     expect(names).toContain("jobs:job:projection-rebuild");
     expect(names).not.toContain("catalog-app:job:cron-only");
 
-    const echo = rows.find((r) => r.jobName === "catalog-app:job:manual-echo");
+    const echo = result.rows.find((r) => r.jobName === "catalog-app:job:manual-echo");
     expect(echo).toBeDefined();
     expect(echo?.payloadSchema).not.toBeNull();
 
-    const reindex = rows.find((r) => r.jobName === "jobs:job:reindex-entity");
+    const reindex = result.rows.find((r) => r.jobName === "jobs:job:reindex-entity");
     expect(reindex?.perTenant).toBe(true);
   });
 });
 
 describe("jobs:write:trigger hardening", () => {
   test("rejects cron-only jobs", async () => {
-    const result = await write(systemAdmin, JobHandlers.trigger, {
-      jobName: "catalog-app:job:cron-only",
-    });
-    expect(result.isSuccess).toBe(false);
-    expect(result.error?.code).toBe("unprocessable");
-    expect(result.error?.details).toMatchObject({ reason: JobErrors.notManual });
+    const err = await stack.http.writeErr(
+      JobHandlers.trigger,
+      { jobName: "catalog-app:job:cron-only" },
+      systemAdmin,
+    );
+    expect(err.code).toBe("unprocessable");
+    expect(err.details).toMatchObject({ reason: JobErrors.notManual });
   });
 
   test("rejects invalid payload against job schema", async () => {
-    const result = await write(systemAdmin, JobHandlers.trigger, {
-      jobName: "catalog-app:job:manual-echo",
-      payload: {},
-    });
-    expect(result.isSuccess).toBe(false);
-    expect(result.error?.code).toBe("validation_error");
+    const err = await stack.http.writeErr(
+      JobHandlers.trigger,
+      { jobName: "catalog-app:job:manual-echo", payload: {} },
+      systemAdmin,
+    );
+    expect(err.code).toBe("validation_error");
   });
 
   test("accepts valid schema payload", async () => {
-    const result = await write(systemAdmin, JobHandlers.trigger, {
-      jobName: "catalog-app:job:manual-echo",
-      payload: { entity: "credit" },
-    });
-    expect(result.isSuccess).toBe(true);
+    const result = await stack.http.writeOk<{ jobName: string; bullJobId: string }>(
+      JobHandlers.trigger,
+      { jobName: "catalog-app:job:manual-echo", payload: { entity: "credit" } },
+      systemAdmin,
+    );
+    expect(result.jobName).toBe("catalog-app:job:manual-echo");
   });
 });

package/src/jobs/web/job-runs-screen.tsx

@@ -86,6 +86,16 @@ export function JobRunsScreen(): ReactNode {
       ? JSON.stringify(selected.payloadSchema, null, 2)
       : null;
 
+  // Switching jobs invalidates any typed payload/messages against the new
+  // job's schema — reset so a submit can't validate stale payload text
+  // against the wrong job.
+  const handleJobNameChange = (name: string): void => {
+    setJobName(name);
+    setPayloadText("{}");
+    setClientError(null);
+    setSuccessMessage(null);
+  };
+
   const onTrigger = async (): Promise<void> => {
     setClientError(null);
     setSuccessMessage(null);
@@ -168,7 +178,7 @@ export function JobRunsScreen(): ReactNode {
                 id="job-trigger-name"
                 name="job-trigger-name"
                 value={jobName}
-                onChange={setJobName}
+                onChange={handleJobNameChange}
                 options={jobOptions}
               />
             </Field>

package/src/shared/index.ts

@@ -16,5 +16,6 @@ export { isWithinGracePeriod } from "./grace-period";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
 export { mapWithConcurrency } from "./map-with-concurrency";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
+export { sessionTimezoneField } from "./session-timezone-field";
 export type { SystemQueryFn } from "./system-query";
 export { type BurnResult, burnToken, unburnToken } from "./token-burn-store";

package/src/shared/session-timezone-field.ts

@@ -0,0 +1,7 @@
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+
+export function sessionTimezoneField(
+  timezone: string | null | undefined,
+): Pick<SessionUser, "timezone"> | Record<string, never> {
+  return timezone !== null && timezone !== undefined ? { timezone } : {};
+}

package/src/template-resolver/web/__tests__/editor-read-only.test.tsx

@@ -12,6 +12,7 @@ import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
 import { act, fireEvent, render, screen } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { textBlocksClient } from "../client-plugin";
+import { defaultTranslations } from "../i18n";
 
 mock.module("@cosmicdrift/kumiko-bundled-features/auth-email-password/web", () => ({
   useShellUser: mock(),
@@ -50,11 +51,22 @@ function getEditor() {
   return Editor;
 }
 
-const localeResolver = createStaticLocaleResolver();
+const localeResolver = createStaticLocaleResolver({ locale: "de" });
 
 function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
   return (
-    <LocaleProvider resolver={localeResolver}>
+    <LocaleProvider resolver={localeResolver} fallbackBundles={[defaultTranslations]}>
+      <PrimitivesProvider value={defaultPrimitives}>{children}</PrimitivesProvider>
+    </LocaleProvider>
+  );
+}
+
+function EnglishWrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <LocaleProvider
+      resolver={createStaticLocaleResolver({ locale: "en" })}
+      fallbackBundles={[defaultTranslations]}
+    >
       <PrimitivesProvider value={defaultPrimitives}>{children}</PrimitivesProvider>
     </LocaleProvider>
   );
@@ -115,6 +127,19 @@ describe("TextContentEditor — role-based write-access", () => {
   });
 });
 
+describe("TextContentEditor — en locale", () => {
+  test("TenantAdmin sieht englische Labels statt hartcodiertem Deutsch (#1754)", () => {
+    // biome-ignore lint/suspicious/noExplicitAny: Bun mock function
+    (useShellUser as any).mockReturnValue({ id: "u1", roles: ["TenantAdmin"] });
+    const Editor = getEditor();
+    render(<Editor target={TARGET} onClose={() => {}} />, { wrapper: EnglishWrapper });
+
+    expect(screen.getByRole("button", { name: /^save$/i })).toBeTruthy();
+    expect(screen.getByLabelText(/title/i)).toBeTruthy();
+    expect(screen.getByLabelText(/content/i)).toBeTruthy();
+  });
+});
+
 describe("TextContentEditor — handleSave", () => {
   test("reicht das geladene folder unverändert an den Write-Payload durch (#898)", async () => {
     // biome-ignore lint/suspicious/noExplicitAny: Bun mock function

package/src/template-resolver/web/client-plugin.tsx

@@ -17,10 +17,16 @@ import type {
   TreeChildrenSubscribe,
   TreeNode,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { useDispatcher, usePrimitives, useQuery } from "@cosmicdrift/kumiko-renderer";
+import {
+  useDispatcher,
+  usePrimitives,
+  useQuery,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
 import { type FormEvent, type ReactNode, useEffect, useState } from "react";
 import { TemplateResolverHandlers, TemplateResolverQueries } from "../qualified-names";
+import { defaultTranslations } from "./i18n";
 
 // Exported for the unit test — groupBlocksByFolder is a pure function.
 export type BlockSummary = {
@@ -211,6 +217,7 @@ function TextBlockEditor({
   const { Form, Field, Input, Button, Banner } = usePrimitives();
   const dispatcher = useDispatcher();
   const user = useShellUser();
+  const t = useTranslation();
   const canWrite =
     user?.roles.includes("TenantAdmin") === true || user?.roles.includes("SystemAdmin") === true;
 
@@ -254,14 +261,20 @@ function TextBlockEditor({
         ...(tenantIdOverride !== undefined && { tenantIdOverride }),
       });
       if (result.isSuccess) {
-        setSavedMsg(result.data.isNew ? "Neu angelegt." : "Gespeichert.");
+        setSavedMsg(
+          result.data.isNew
+            ? t("template-resolver.editor.created")
+            : t("template-resolver.editor.saved"),
+        );
         return;
       }
-      setSaveError(result.error.message ?? result.error.code ?? "Speichern fehlgeschlagen.");
+      setSaveError(
+        result.error.message ?? result.error.code ?? t("template-resolver.editor.saveFailed"),
+      );
     } catch (e) {
       // Network blip / dispatcher throw — otherwise submitting stays true and
       // the save button is locked forever with no feedback.
-      setSaveError(e instanceof Error ? e.message : "Netzwerkfehler beim Speichern.");
+      setSaveError(e instanceof Error ? e.message : t("template-resolver.editor.networkError"));
     } finally {
       setSubmitting(false);
     }
@@ -283,21 +296,21 @@ function TextBlockEditor({
       actions={
         canWrite ? (
           <Button type="submit" loading={submitting} disabled={disabled}>
-            {submitting ? "Speichern…" : "Speichern"}
+            {submitting ? t("template-resolver.editor.saving") : t("template-resolver.editor.save")}
           </Button>
         ) : undefined
       }
     >
-      {loading && <Banner variant="loading">Lädt aktuellen Stand…</Banner>}
+      {loading && <Banner variant="loading">{t("template-resolver.editor.loading")}</Banner>}
       {loadError !== null && (
-        <Banner variant="error">Konnte Block nicht laden: {loadError.code}</Banner>
+        <Banner variant="error">
+          {t("template-resolver.editor.loadFailed")}: {loadError.code}
+        </Banner>
       )}
       {!canWrite && !loading && (
-        <Banner variant="info">
-          Read-only — TenantAdmin- oder SystemAdmin-Rolle f&uuml;r &Auml;nderungen erforderlich.
-        </Banner>
+        <Banner variant="info">{t("template-resolver.editor.readOnly")}</Banner>
       )}
-      <Field id="text-block-title" label="Titel" required>
+      <Field id="text-block-title" label={t("template-resolver.editor.titleLabel")} required>
         <Input
           kind="text"
           id="text-block-title"
@@ -308,7 +321,7 @@ function TextBlockEditor({
           required
         />
       </Field>
-      <Field id="text-block-content" label="Inhalt">
+      <Field id="text-block-content" label={t("template-resolver.editor.contentLabel")}>
         <Input
           kind="textarea"
           id="text-block-content"
@@ -348,5 +361,6 @@ export function textBlocksClient(opts?: {
     resolvers: {
       "template-resolver:edit": TextBlockEditor,
     },
+    translations: defaultTranslations,
   };
 }

package/src/template-resolver/web/i18n.ts

@@ -0,0 +1,39 @@
+// @runtime client
+// Default translation bundle for the text-block editor. textBlocksClient()
+// hangs it into the LocaleProvider as a fallback bundle — apps override
+// individual keys via mergeTranslations at the createKumikoApp level.
+//
+// Keys follow `template-resolver.editor.<slug>`.
+
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+
+export const defaultTranslations: TranslationsByLocale = {
+  de: {
+    "template-resolver.editor.titleLabel": "Titel",
+    "template-resolver.editor.contentLabel": "Inhalt",
+    "template-resolver.editor.save": "Speichern",
+    "template-resolver.editor.saving": "Speichern…",
+    "template-resolver.editor.created": "Neu angelegt.",
+    "template-resolver.editor.saved": "Gespeichert.",
+    "template-resolver.editor.saveFailed": "Speichern fehlgeschlagen.",
+    "template-resolver.editor.networkError": "Netzwerkfehler beim Speichern.",
+    "template-resolver.editor.loading": "Lädt aktuellen Stand…",
+    "template-resolver.editor.loadFailed": "Konnte Block nicht laden",
+    "template-resolver.editor.readOnly":
+      "Read-only — TenantAdmin- oder SystemAdmin-Rolle für Änderungen erforderlich.",
+  },
+  en: {
+    "template-resolver.editor.titleLabel": "Title",
+    "template-resolver.editor.contentLabel": "Content",
+    "template-resolver.editor.save": "Save",
+    "template-resolver.editor.saving": "Saving…",
+    "template-resolver.editor.created": "Created.",
+    "template-resolver.editor.saved": "Saved.",
+    "template-resolver.editor.saveFailed": "Save failed.",
+    "template-resolver.editor.networkError": "Network error while saving.",
+    "template-resolver.editor.loading": "Loading current version…",
+    "template-resolver.editor.loadFailed": "Could not load block",
+    "template-resolver.editor.readOnly":
+      "Read-only — TenantAdmin or SystemAdmin role required to make changes.",
+  },
+};

package/src/tenant/__tests__/tenant-timezone-boot.integration.test.ts

@@ -0,0 +1,60 @@
+// Regression guard for fw#1648: dispatch-shared.ts hardcodes the literal
+// "tenant:config:timezone" (TENANT_TIMEZONE_CONFIG_KEY) since framework/pipeline
+// can't import the bundled `tenant` feature. tz-resolution.integration.test.ts
+// exercises that literal against a standalone probe feature, which can't see a
+// drift to the REAL tenant feature's key name — this test boots the actual
+// createTenantFeature() instead.
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { z } from "zod";
+import { createConfigAccessorFactory, createConfigFeature } from "../../config/feature";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../feature";
+
+const probeFeature = defineFeature("tz-probe", (r) => {
+  r.requires("tenant");
+  r.writeHandler(
+    "read-tz",
+    z.object({}),
+    async (_event, ctx) => ({ isSuccess: true, data: { tenant: ctx.tz.tenant } }),
+    { access: { openToAll: true } },
+  );
+});
+
+describe("ctx.tz.tenant against the real tenant feature (fw#1648)", () => {
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    stack = await setupTestStack({
+      features: [createConfigFeature(), createTenantFeature(), probeFeature],
+      extraContext: ({ registry }) => ({
+        configResolver: resolver,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+      }),
+    });
+    await unsafePushTables(stack.db, { configValuesTable });
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  test("ctx.tz.tenant reflects tenant:config:timezone set via the real tenant feature", async () => {
+    const admin = createTestUser({ id: 20, roles: ["Admin"] });
+    await stack.http.writeOk(
+      "config:write:set",
+      { key: "tenant:config:timezone", value: "Asia/Tokyo" },
+      admin,
+    );
+    const res = await stack.http.writeOk<{ tenant: string }>("tz-probe:write:read-tz", {}, admin);
+    expect(res.tenant).toBe("Asia/Tokyo");
+  });
+});