@cosmicdrift/kumiko-bundled-features 0.208.3 → 0.209.1

package/src/jobs/job-run-table.ts

@@ -1,6 +1,6 @@
 import {
-  buildEntityTable,
   defineUnmanagedTable,
+  deriveEntityTableMeta,
   type EntityTableMeta,
   instant,
   table as pgTable,
@@ -17,28 +17,29 @@ import {
 export type JobRunStatus = "queued" | "running" | "completed" | "failed";
 export type JobLogLevel = "info" | "warn" | "error";
 
-// jobRun is a system-scoped events-only aggregate: every job execution is
-// its own stream, driven entirely by BullMQ-callbacks (onJobStart /
-// -Complete / -Failed) via the low-level append() path. Three domain-
-// events cover the lifecycle:
-//   - `jobs:event:run-started`   (when BullMQ picks a job off its queue)
-//   - `jobs:event:run-completed` (duration + batched log entries)
-//   - `jobs:event:run-failed`    (error + duration + batched log entries)
+// jobRun is a system-scoped direct-write store (#2243): every job execution
+// writes straight into jobRunsTable / jobRunLogsTable from the BullMQ
+// callbacks (onJobStart / -Complete / -Failed, see job-run-logger.ts) —
+// no event-store detour. Pre-#2243 this was an events-only aggregate
+// replayed through two inline projections; that generated two permanent
+// `kumiko_events` rows per run for data that is itself already the
+// system of record (no other consumer replays or MSP-subscribes to it).
 //
-// Logs ride the completed/failed event as an array — "Option B" from the
-// design discussion: one event per run instead of N events per log line,
-// no log duplication across status transitions. The inline projection
-// expands the batch into N rows in jobRunLogsTable, keeping the pre-ES
-// detail-query-shape intact.
+// Logs are batched onto the completed/failed callback as an array —
+// "Option B" from the original design discussion: one write per run
+// instead of one write per log line, no log duplication across status
+// transitions. job-run-logger.ts expands the batch into N rows in
+// jobRunLogsTable.
 //
-// Entity-derived table — Phase 3b of drizzle-replacement. Earlier this was
-// a hand-written pgTable; the entity-form is the single source for both
-// the drizzle-table (query API) and the future EntityTableMeta-based
-// migration generator. status/$type<JobRunStatus> ist nicht im entity-
-// schema modelliert — Drizzle's column-type ist text mit CHECK-Constraint
-// als App-Boundary (gleicher Pattern wie template-resolver kind/scope).
+// Entity-derived table (query API + migration meta share one field
+// definition). status/$type<JobRunStatus> is not modeled in the entity
+// schema — the column type is text, with the status union enforced at the
+// app boundary (same pattern as template-resolver kind/scope).
+// `table: "store_job_runs"` (not `read_*`) because this is no longer a
+// rebuildable projection — `defineUnmanagedTable`/`deriveEntityTableMeta`
+// reject the `read_` prefix for `source: "unmanaged"` (#1208/#1220).
 export const jobRunEntity = createEntity({
-  table: "read_job_runs",
+  table: "store_job_runs",
   fields: {
     jobName: createTextField({ required: true }),
     bullJobId: createTextField({ required: true }),
@@ -53,7 +54,14 @@ export const jobRunEntity = createEntity({
   },
 });
 
-export const jobRunsTable = buildEntityTable("job-run", jobRunEntity);
+// Plain EntityTableMeta, NOT a branded EntityTable (buildEntityTable would
+// mark it executor-only): job-run is an unmanaged direct-write store, so
+// onJobStart/-Complete/-Failed need to write via ctx.db/insertOne directly
+// (same pattern as sessions/schema/user-session.ts).
+export const jobRunsTable: EntityTableMeta = deriveEntityTableMeta("job-run", jobRunEntity, {
+  source: "unmanaged",
+});
+export const jobRunsTableMeta = jobRunsTable;
 
 // Child projection keyed by the jobRun aggregate id. Pre-ES used a serial
 // PK + integer runId; post-ES runId is still exposed but now holds the
@@ -68,13 +76,13 @@ export const jobRunLogsTable = pgTable("store_job_run_logs", {
   timestamp: instant("timestamp").notNull(),
 });
 
-// **Unmanaged table** — bewusst KEIN createEntity. Begründung:
-//   - serial PK (kein uuid) — pre-ES legacy, kompatibilität mit existing rows
-//   - KEIN tenant_id — child-Tabelle von jobRun, tenant-context lebt am parent
-//   - keine base-columns (kein version/inserted_at/inserted_by_id) — append-
-//     only log, kein in-place-update, keine Audit-Spalten gewünscht
-// pgTable bleibt source-of-truth für Query-API; Phase 4 leitet das pgTable
-// aus dieser Meta ab.
+// **Unmanaged table** — deliberately no createEntity. Reasoning:
+//   - serial PK (not uuid) — pre-ES legacy, compatible with existing rows
+//   - no tenant_id — child table of jobRun, tenant context lives on the parent
+//   - no base columns (no version/inserted_at/inserted_by_id) — append-only
+//     log, no in-place update, no audit columns needed
+// pgTable stays the source of truth for the query API; this meta mirrors it
+// for migration generation.
 export const jobRunLogsTableMeta: EntityTableMeta = defineUnmanagedTable({
   tableName: "store_job_run_logs",
   columns: [

package/src/sessions/__tests__/session-last-seen.integration.test.ts

@@ -0,0 +1,165 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { Temporal } from "temporal-polyfill";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { LAST_SEEN_REFRESH_MS } from "../constants";
+import { createSessionsFeature } from "../feature";
+import { userSessionEntity, userSessionTable } from "../schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../session-callbacks";
+import { sessionCallbacksFromLateBound } from "../testing";
+import { makeSessionHelpers } from "./test-helpers";
+
+// Proves the #2220 lastSeenAt refresh: sessionChecker stamps a coarse
+// activity marker on the session row, but only once per LAST_SEEN_REFRESH_MS
+// rather than on every authenticated request.
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+
+const TENANT: TenantId = testTenantId(1);
+
+async function readLastSeenAt(sid: string): Promise<Temporal.Instant | null> {
+  const rows = await selectMany<{ lastSeenAt: Temporal.Instant | null }>(
+    stack.db,
+    userSessionTable,
+    { id: sid },
+  );
+  return rows[0]?.lastSeenAt ?? null;
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature(),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  const creator = bound.asAuthConfig().sessionCreator;
+  if (!creator) throw new Error("sessionCreator missing from bound auth config");
+  sessionCreator = creator;
+  h = makeSessionHelpers(stack, TENANT, sessionCreator);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
+});
+
+describe("sessionChecker — lastSeenAt refresh", () => {
+  test("freshly created session has lastSeenAt set, not null", async () => {
+    await h.seedUser("fresh@example.com", "pw-long-enough");
+    const { sid } = await h.login("fresh@example.com", "pw-long-enough");
+
+    const lastSeenAt = await readLastSeenAt(sid);
+    expect(lastSeenAt).not.toBeNull();
+    // Sanity: stamped at creation time, not far in the past/future.
+    const driftMs = Math.abs(
+      Temporal.Now.instant().epochMilliseconds - (lastSeenAt?.epochMilliseconds ?? 0),
+    );
+    expect(driftMs).toBeLessThan(10_000);
+  });
+
+  test("null lastSeenAt is refreshed to a fresh value on check", async () => {
+    const { userId } = await h.seedUser("null-refresh@example.com", "pw-long-enough");
+    const { sid } = await h.login("null-refresh@example.com", "pw-long-enough");
+
+    await updateRows(stack.db, userSessionTable, { lastSeenAt: null }, { id: sid });
+    expect(await readLastSeenAt(sid)).toBeNull();
+
+    await callbacks.get().sessionChecker(sid, userId);
+
+    const refreshed = await readLastSeenAt(sid);
+    expect(refreshed).not.toBeNull();
+    const driftMs = Math.abs(
+      Temporal.Now.instant().epochMilliseconds - (refreshed?.epochMilliseconds ?? 0),
+    );
+    expect(driftMs).toBeLessThan(10_000);
+  });
+
+  test("lastSeenAt older than LAST_SEEN_REFRESH_MS is refreshed to a fresh value on check", async () => {
+    const { userId } = await h.seedUser("stale-refresh@example.com", "pw-long-enough");
+    const { sid } = await h.login("stale-refresh@example.com", "pw-long-enough");
+
+    const stale = Temporal.Now.instant().subtract({ milliseconds: LAST_SEEN_REFRESH_MS + 1_000 });
+    await updateRows(stack.db, userSessionTable, { lastSeenAt: stale }, { id: sid });
+    expect((await readLastSeenAt(sid))?.epochMilliseconds).toBe(stale.epochMilliseconds);
+
+    await callbacks.get().sessionChecker(sid, userId);
+
+    const refreshed = await readLastSeenAt(sid);
+    expect(refreshed?.epochMilliseconds).toBeGreaterThan(stale.epochMilliseconds);
+    const driftMs = Math.abs(
+      Temporal.Now.instant().epochMilliseconds - (refreshed?.epochMilliseconds ?? 0),
+    );
+    expect(driftMs).toBeLessThan(10_000);
+  });
+
+  test("lastSeenAt younger than LAST_SEEN_REFRESH_MS is left unchanged on check", async () => {
+    const { userId } = await h.seedUser("recent-noop@example.com", "pw-long-enough");
+    const { sid } = await h.login("recent-noop@example.com", "pw-long-enough");
+
+    const recent = Temporal.Now.instant().subtract({ milliseconds: 1_000 });
+    await updateRows(stack.db, userSessionTable, { lastSeenAt: recent }, { id: sid });
+    const before = await readLastSeenAt(sid);
+    expect(before?.epochMilliseconds).toBe(recent.epochMilliseconds);
+
+    await callbacks.get().sessionChecker(sid, userId);
+
+    const after = await readLastSeenAt(sid);
+    expect(after?.epochMilliseconds).toBe(before?.epochMilliseconds);
+  });
+});

package/src/sessions/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.208.2",
+    "type": "improvement",
+    "title": "Session rows track lastSeenAt, refreshed hourly",
+    "detail": "userSession now carries a lastSeenAt timestamp, set on session creation and refreshed by sessionChecker at most once per hour (LAST_SEEN_REFRESH_MS). A refresh failure is swallowed and the check still returns \"live\" — this is a coarse activity marker, not a per-request write."
+  },
   {
     "version": "0.165.1",
     "type": "fix",

package/src/sessions/constants.ts

@@ -48,5 +48,9 @@ export const DEFAULT_SESSION_CACHE_TTL_MS = 60_000;
 // MVP ships a single window; per-app overrides can come later.
 export const DEFAULT_SESSION_EXPIRY_MS = 30 * 24 * 60 * 60 * 1000;
 
+// Minimum gap between lastSeenAt writes — coarse activity tracking without a
+// write on every authenticated request.
+export const LAST_SEEN_REFRESH_MS = 3_600_000;
+
 export const SESSION_LIST_SCREEN_ID = "session-list" as const;
 export const SESSION_DETAIL_SCREEN_ID = "session-detail" as const;

package/src/sessions/feature.ts

@@ -245,10 +245,26 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       type: "projectionDetail",
       query: SessionQueries.detail,
       listScreenId: SESSION_LIST_SCREEN_ID,
+      // No write path on this screen — a "Cancel" button here would only
+      // ever discard nothing. Back-navigation still works via listScreenId
+      // above (resolveDetailBreadcrumb, renderer-web) — fw#2245.
+      hideActions: true,
       layout: {
         sections: [
           {
-            fields: ["id", "userId", "createdAt", "expiresAt", "revokedAt", "ip", "userAgent"],
+            fields: [
+              "id",
+              "userId",
+              // The shim (projection-detail-shim.ts) stamps every field as
+              // type:"text" — field.renderer is the only way this screen
+              // type reaches real per-type formatting instead of a raw ISO
+              // string (fw#2245).
+              { field: "createdAt", renderer: { format: "timestamp" } },
+              { field: "expiresAt", renderer: { format: "timestamp" } },
+              { field: "revokedAt", renderer: { format: "timestamp" } },
+              "ip",
+              "userAgent",
+            ],
           },
         ],
       },

package/src/sessions/schema/user-session.ts

@@ -53,6 +53,11 @@ export const userSessionEntity = createEntity({
     revokedAt: createTimestampField({
       access: { write: access.privileged },
     }),
+    // Coarse last-activity marker, refreshed at most hourly (see
+    // LAST_SEEN_REFRESH_MS) — not a per-request write.
+    lastSeenAt: createTimestampField({
+      access: { write: access.privileged },
+    }),
     // Subject is the session's user, not the session row — a user-forget
     // must shred these, so the key hangs off userId (sid-self would orphan).
     ip: createTextField({

package/src/sessions/session-callbacks.ts

@@ -19,7 +19,7 @@ import { Temporal } from "temporal-polyfill";
 import { encryptForDirectWrite } from "../shared";
 import { tenantMembershipsTable } from "../tenant";
 import { USER_STATUS, type UserStatus, userTable } from "../user";
-import { DEFAULT_SESSION_EXPIRY_MS } from "./constants";
+import { DEFAULT_SESSION_EXPIRY_MS, LAST_SEEN_REFRESH_MS } from "./constants";
 import { userSessionEntity, userSessionTable } from "./schema/user-session";
 import {
   SESSION_REVOKED_AGGREGATE_TYPE,
@@ -91,6 +91,7 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
             userId: user.id,
             createdAt: now,
             expiresAt,
+            lastSeenAt: now,
             ip: meta.ip,
             userAgent: meta.userAgent,
           },
@@ -120,6 +121,7 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
         tenantId: TenantId;
         revokedAt: unknown;
         expiresAt: { epochMilliseconds: number };
+        lastSeenAt: { epochMilliseconds: number } | null;
       }>(db, userSessionTable, { id: sid });
       if (!row) return "missing";
       // Cross-user check: if the sid belongs to someone else, treat it
@@ -133,6 +135,23 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       if (row.expiresAt.epochMilliseconds <= Temporal.Now.instant().epochMilliseconds) {
         return "expired";
       }
+
+      // Hourly, not per-request: this check runs on every authenticated
+      // request, so a write here has to stay off the hot path.
+      const nowMs = Temporal.Now.instant().epochMilliseconds;
+      if (!row.lastSeenAt || row.lastSeenAt.epochMilliseconds + LAST_SEEN_REFRESH_MS <= nowMs) {
+        try {
+          await updateMany(
+            db,
+            userSessionTable,
+            { lastSeenAt: Temporal.Now.instant() },
+            { id: sid },
+          );
+        } catch {
+          // fail-open: a refresh failure must not block the session check
+        }
+      }
+
       // Defense-in-depth: status flips (Art. 18 restrict, forget) revoke
       // sessions, but a missed revoke must not keep a locked account alive on
       // a stale sid. Fail-OPEN on a lookup miss — this is the second layer,

package/src/sessions/session-checker-fail-open.test.ts

@@ -110,6 +110,44 @@ describe("sessionChecker fail-open on user-lookup throw", () => {
   });
 });
 
+describe("sessionChecker fail-open on lastSeenAt refresh throw", () => {
+  test("updateMany THROW on refresh → live (not 500)", async () => {
+    const db = {} as DbConnection;
+    const cbs = createSessionCallbacks({ db });
+    const sid = "00000000-0000-4000-8000-00000000sid5";
+    const userId = "00000000-0000-4000-8000-00000000usr5";
+    const farFutureMs = Temporal.Now.instant().add({ hours: 1 }).epochMilliseconds;
+
+    const originalUpdateMany = bunDb.updateMany;
+    const fetchSpy = spyOn(bunDb, "fetchOne").mockImplementation((async (_db, table) => {
+      if (table === userSessionTable) {
+        return {
+          userId,
+          revokedAt: null,
+          expiresAt: { epochMilliseconds: farFutureMs },
+          lastSeenAt: null,
+        };
+      }
+      if (table === userTable) {
+        throw new Error("simulated pool exhaustion");
+      }
+      throw new Error("unexpected table in sessionChecker spy");
+    }) as FetchOne);
+    const updateSpy = spyOn(bunDb, "updateMany").mockImplementation(async () => {
+      throw new Error("simulated write failure");
+    });
+
+    try {
+      expect(await cbs.sessionChecker(sid, userId)).toBe("live");
+      expect(updateSpy).toHaveBeenCalledTimes(1);
+    } finally {
+      fetchSpy.mockRestore();
+      updateSpy.mockRestore();
+      expect(bunDb.updateMany).toBe(originalUpdateMany);
+    }
+  });
+});
+
 describe("sessionChecker role re-derivation", () => {
   test("live session composes global + tenant-membership roles fresh from the DB", async () => {
     const db = {} as DbConnection;

package/src/user-data-rights/feature.ts

@@ -134,8 +134,8 @@ export type UserDataRightsOptions = {
 };
 
 export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): FeatureDefinition {
-  // One-shot operator warning (the export cron fires every minute — warn once
-  // per process, not every run). Lives in the factory scope so the cron closure
+  // One-shot operator warning (the export cron fires daily — warn once per
+  // process, not every run). Lives in the factory scope so the cron closure
   // shares it across runs.
   let warnedMissingExportUrl = false;
   return defineFeature("user-data-rights", (r) => {
@@ -401,7 +401,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     // S2.U3 Atom 3b — Worker fuer Async Export-Pipeline. Cron-getriggert.
     r.job(
       "run-export-jobs",
-      { trigger: { cron: "0 * * * * *" }, concurrency: "skip" },
+      { trigger: { cron: "0 3 * * *" }, concurrency: "skip" },
       async (_payload, ctx) => {
         if (!ctx.db || !ctx.registry) {
           throw new Error(
@@ -488,7 +488,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     // — Art.17 wuerde nie ausgefuehrt.
     r.job(
       "run-forget-cleanup",
-      { trigger: { cron: "0 * * * * *" }, concurrency: "skip" },
+      { trigger: { cron: "0 3 * * *" }, concurrency: "skip" },
       async (_payload, ctx) => {
         if (!ctx.db || !ctx.registry) {
           throw new Error(

package/src/user-data-rights-defaults/__tests__/bundled-entities.userdata-hooks.integration.test.ts

@@ -401,7 +401,7 @@ describe("delivery-attempt userData-hooks (#799)", () => {
 describe("job-run userData-hooks (#799)", () => {
   async function seedRun(id: string, triggeredById: string | null): Promise<void> {
     await asRawClient(full.db).unsafe(
-      `INSERT INTO read_job_runs
+      `INSERT INTO store_job_runs
          (id, tenant_id, job_name, bull_job_id, status, payload, attempt, started_at, triggered_by_id)
        VALUES ($1::uuid, $2, 'app:job:export', $3, 'completed', '{"scope":"mine"}', 1, now(), $4)`,
       [id, TENANT_A, `bull-${id}`, triggeredById],

package/src/compliance-profiles/web/compliance-profile-screen.tsx

@@ -1,152 +0,0 @@
-// @runtime client
-import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
-import { FormScreenShell } from "@cosmicdrift/kumiko-renderer-web";
-import { type ReactNode, useCallback, useEffect, useState } from "react";
-import { ComplianceProfileHandlers, ComplianceProfileQueries } from "../constants";
-
-type ProfileSummary = {
-  readonly key: string;
-  readonly region: string;
-  readonly label: string;
-  readonly authorityContact: string;
-};
-
-type ListProfilesResponse = {
-  readonly profiles: readonly ProfileSummary[];
-};
-
-type CurrentProfileResponse = {
-  readonly key: string;
-  readonly label: string;
-  readonly region: string;
-  readonly warning?: string;
-};
-
-type State =
-  | { readonly kind: "loading" }
-  | { readonly kind: "error"; readonly message: string }
-  | {
-      readonly kind: "ready";
-      readonly profiles: readonly ProfileSummary[];
-      readonly current: CurrentProfileResponse | null;
-    };
-
-export function ComplianceProfileScreen(): ReactNode {
-  const t = useTranslation();
-  const { Banner, Button, Card, Field, Form, Heading, Input, Text } = usePrimitives();
-  const dispatcher = useDispatcher();
-  const [state, setState] = useState<State>({ kind: "loading" });
-  const [selected, setSelected] = useState("");
-  const [saving, setSaving] = useState(false);
-  const [actionError, setActionError] = useState<string | null>(null);
-
-  const load = useCallback(async (): Promise<void> => {
-    setState({ kind: "loading" });
-    const [profilesRes, currentRes] = await Promise.all([
-      dispatcher.query<ListProfilesResponse>(ComplianceProfileQueries.listProfiles, {}),
-      dispatcher.query<CurrentProfileResponse>(ComplianceProfileQueries.forTenant, {}),
-    ]);
-    if (!profilesRes.isSuccess) {
-      setState({ kind: "error", message: profilesRes.error.message });
-      return;
-    }
-    if (!currentRes.isSuccess) {
-      setState({ kind: "error", message: currentRes.error.message });
-      return;
-    }
-    setSelected(currentRes.data.key);
-    setState({ kind: "ready", profiles: profilesRes.data.profiles, current: currentRes.data });
-  }, [dispatcher]);
-
-  useEffect(() => {
-    void load();
-  }, [load]);
-
-  const onSave = (): void => {
-    void (async (): Promise<void> => {
-      if (selected === "") return;
-      setActionError(null);
-      setSaving(true);
-      const res = await dispatcher.write(ComplianceProfileHandlers.setProfile, {
-        profileKey: selected,
-      });
-      setSaving(false);
-      if (!res.isSuccess) {
-        setActionError(res.error.message);
-        return;
-      }
-      await load();
-    })();
-  };
-
-  if (state.kind === "loading") {
-    return (
-      <FormScreenShell testId="compliance-profile-screen">
-        <Text variant="small">{t("compliance.profile.loading")}</Text>
-      </FormScreenShell>
-    );
-  }
-
-  if (state.kind === "error") {
-    return (
-      <FormScreenShell testId="compliance-profile-screen">
-        <Banner variant="error">{state.message}</Banner>
-      </FormScreenShell>
-    );
-  }
-
-  const profileOptions = state.profiles.map((profile) => ({
-    value: profile.key,
-    label: `${profile.label} (${profile.key})`,
-  }));
-
-  return (
-    <FormScreenShell testId="compliance-profile-screen" className="flex flex-col gap-6">
-      <Heading variant="page">{t("compliance.profile.title")}</Heading>
-
-      {state.current !== null && (
-        <Banner variant="info" testId="compliance-current-profile">
-          {t("compliance.profile.current")}: {state.current.label} ({state.current.key})
-        </Banner>
-      )}
-
-      <Form
-        onSubmit={onSave}
-        actions={
-          <Button
-            type="submit"
-            variant="primary"
-            disabled={saving || selected === ""}
-            loading={saving}
-            testId="compliance-profile-save"
-          >
-            {saving ? t("compliance.profile.saving") : t("compliance.profile.save")}
-          </Button>
-        }
-      >
-        <Field id="compliance-profile-select" label={t("compliance.profile.select")} required>
-          <Input
-            kind="select"
-            id="compliance-profile-select"
-            name="compliance-profile-select"
-            value={selected}
-            onChange={setSelected}
-            options={profileOptions}
-            required
-          />
-        </Field>
-        {actionError !== null && <Banner variant="error">{actionError}</Banner>}
-      </Form>
-
-      <Card slots={{ title: t("compliance.profile.catalog") }}>
-        <ul className="flex flex-col gap-2 text-sm">
-          {state.profiles.map((profile) => (
-            <li key={profile.key} data-profile-key={profile.key}>
-              <strong>{profile.label}</strong> — {profile.region} — {profile.authorityContact}
-            </li>
-          ))}
-        </ul>
-      </Card>
-    </FormScreenShell>
-  );
-}