@cosmicdrift/kumiko-bundled-features 0.274.0 → 0.276.0

package/src/secrets/handlers/rotate.job.ts

@@ -24,7 +24,7 @@ import {
   type DbConnection,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
-import type { JobHandlerFn, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { JobContext, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import {
   decodeStoredEnvelope,
@@ -55,7 +55,11 @@ export type RotateJobResult = {
   readonly stoppedReason: ChunkedMigrationStopReason;
 };
 
-export const rotateJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
+export async function rotateJob(
+  rawPayload: Record<string, unknown>,
+  ctx: JobContext,
+  db: DbConnection,
+): Promise<void> {
   const payload = rawPayload as RotateJobPayload; // @cast-boundary engine-payload
   if (!ctx.masterKeyProvider) {
     throw new InternalError({
@@ -64,12 +68,6 @@ export const rotateJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> =>
     });
   }
   const provider = ctx.masterKeyProvider;
-  if (!ctx.db) {
-    throw new InternalError({
-      message: "[secrets:rotate] ctx.db missing — job context requires a database connection.",
-    });
-  }
-  const db = ctx.db as DbConnection; // @cast-boundary db-operator
   const batchSize = payload.batchSize ?? DEFAULT_BATCH_SIZE;
   const maxFailures = payload.maxFailures ?? DEFAULT_MAX_FAILURES;
   const deadline = payload.maxDurationMs
@@ -165,4 +163,4 @@ export const rotateJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> =>
     stoppedReason: outcome.stoppedReason,
   };
   ctx.log?.info?.(`[secrets:rotate] complete: ${JSON.stringify(result)}`);
-};
+}

package/src/sessions/__tests__/cleanup.integration.test.ts

@@ -114,7 +114,7 @@ describe("sessions cleanup job — purge expired/revoked rows", () => {
     });
     expect(await countSessions()).toBe(2);
 
-    await cleanupJob({}, jobCtx());
+    await cleanupJob({}, jobCtx(), stack.db);
 
     expect(await countSessions()).toBe(1);
     const [remaining] = await selectMany(stack.db, userSessionTable);
@@ -130,7 +130,7 @@ describe("sessions cleanup job — purge expired/revoked rows", () => {
     });
     expect(await countSessions()).toBe(1);
 
-    await cleanupJob({}, jobCtx());
+    await cleanupJob({}, jobCtx(), stack.db);
 
     expect(await countSessions()).toBe(0);
   });
@@ -144,7 +144,7 @@ describe("sessions cleanup job — purge expired/revoked rows", () => {
     });
 
     // Default 30d window: 10d-old revoked row stays
-    await cleanupJob({}, jobCtx());
+    await cleanupJob({}, jobCtx(), stack.db);
 
     expect(await countSessions()).toBe(1);
   });
@@ -158,7 +158,7 @@ describe("sessions cleanup job — purge expired/revoked rows", () => {
     });
 
     // Tight 3d window: the 5d row goes
-    await cleanupJob({ olderThanDays: 3 }, jobCtx());
+    await cleanupJob({ olderThanDays: 3 }, jobCtx(), stack.db);
 
     expect(await countSessions()).toBe(0);
   });
@@ -174,7 +174,7 @@ describe("sessions cleanup job — purge expired/revoked rows", () => {
     }
     expect(await countSessions()).toBe(7);
 
-    await cleanupJob({ olderThanDays: 30, batchSize: 2 }, jobCtx());
+    await cleanupJob({ olderThanDays: 30, batchSize: 2 }, jobCtx(), stack.db);
 
     expect(await countSessions()).toBe(0);
   });

package/src/sessions/feature.ts

@@ -3,7 +3,7 @@ import {
   type SessionStore,
   type SessionStoreProvider,
 } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
-import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import { type DbConnection, deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { cleanupJob } from "./handlers/cleanup.job";
 import { detailQuery } from "./handlers/detail.query";
@@ -83,141 +83,155 @@ export function bindAutoRevokeFromFeature(
 // Not system-scoped: sessions live per tenant, and the handlers should only
 // see rows in the caller's active tenant.
 export function createSessionsFeature(options?: SessionsFeatureOptions): FeatureDefinition {
-  return defineFeature("sessions", (r) => {
-    r.describe(
-      "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
-    );
-    r.uiHints({
-      displayLabel: "Sessions · Server-side Logout",
-      category: "identity",
-      recommended: false,
-    });
-    // sessionChecker reads read_users on every authenticated request (status
-    // gate for locked accounts) — make that a boot-time dependency so a
-    // sessions-without-user wiring fails validateBoot instead of 500ing live.
-    // auth-foundation owns EXT_SESSION_STORE, which the useExtension below
-    // registers against.
-    r.requires("user", "auth-foundation");
-    // store_user_sessions is a hot-path direct-write store: sessionCreator
-    // inserts and the revoke handlers update rows WITHOUT emitting lifecycle
-    // events (the row columns ARE the audit trail). Registering it as
-    // r.entity would make it a rebuildable implicit projection whose replay
-    // finds zero session events and swaps an empty shadow over the live
-    // table — wiping every active session on the next projection rebuild
-    // (#498/#494). r.storeTable keeps the migration DDL but opts the
-    // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
-    // which are direct-write stores too.
-    r.storeTable(
-      deriveEntityTableMeta("user-session", userSessionEntity, { source: "unmanaged" }),
-      {
-        reason: "read_side.user_sessions_direct_write",
-        // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
-        piiEncryptedOnWrite: true,
-      },
-    );
+  return defineFeature(
+    "sessions",
+    (r) => {
+      r.describe(
+        "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
+      );
+      r.uiHints({
+        displayLabel: "Sessions · Server-side Logout",
+        category: "identity",
+        recommended: false,
+      });
+      // sessionChecker reads read_users on every authenticated request (status
+      // gate for locked accounts) — make that a boot-time dependency so a
+      // sessions-without-user wiring fails validateBoot instead of 500ing live.
+      // auth-foundation owns EXT_SESSION_STORE, which the useExtension below
+      // registers against.
+      r.requires("user", "auth-foundation");
+      // store_user_sessions is a hot-path direct-write store: sessionCreator
+      // inserts and the revoke handlers update rows WITHOUT emitting lifecycle
+      // events (the row columns ARE the audit trail). Registering it as
+      // r.entity would make it a rebuildable implicit projection whose replay
+      // finds zero session events and swaps an empty shadow over the live
+      // table — wiping every active session on the next projection rebuild
+      // (#498/#494). r.storeTable keeps the migration DDL but opts the
+      // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
+      // which are direct-write stores too.
+      r.storeTable(
+        deriveEntityTableMeta("user-session", userSessionEntity, { source: "unmanaged" }),
+        {
+          reason: "read_side.user_sessions_direct_write",
+          // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
+          piiEncryptedOnWrite: true,
+        },
+      );
 
-    // Self-registers as auth-foundation's sessionStore provider (#1371) —
-    // wraps the same createSessionCallbacks() used by the manual
-    // buildServer({ auth: { ... } }) wiring above; a future issue (#1372)
-    // removes that manual wiring once the middleware resolves generically
-    // via resolveSessionStore().
-    r.useExtension(EXT_SESSION_STORE, "default", {
-      build: (deps): SessionStore => {
-        const callbacks = createSessionCallbacks({
-          db: deps.db,
-          ...(options?.expiresInMs !== undefined && { expiresInMs: options.expiresInMs }),
-        });
-        return {
-          creator: callbacks.sessionCreator,
-          revoker: callbacks.sessionRevoker,
-          checker: callbacks.sessionChecker,
-          massRevoker: callbacks.sessionMassRevoker,
-          revokeAllOthers: callbacks.sessionRevokeAllOthers,
-        };
-      },
-    } satisfies SessionStoreProvider);
+      // Self-registers as auth-foundation's sessionStore provider (#1371) —
+      // wraps the same createSessionCallbacks() used by the manual
+      // buildServer({ auth: { ... } }) wiring above; a future issue (#1372)
+      // removes that manual wiring once the middleware resolves generically
+      // via resolveSessionStore().
+      r.useExtension(EXT_SESSION_STORE, "default", {
+        build: (deps): SessionStore => {
+          const callbacks = createSessionCallbacks({
+            db: deps.db,
+            ...(options?.expiresInMs !== undefined && { expiresInMs: options.expiresInMs }),
+          });
+          return {
+            creator: callbacks.sessionCreator,
+            revoker: callbacks.sessionRevoker,
+            checker: callbacks.sessionChecker,
+            massRevoker: callbacks.sessionMassRevoker,
+            revokeAllOthers: callbacks.sessionRevokeAllOthers,
+          };
+        },
+      } satisfies SessionStoreProvider);
 
-    // Custom domain-event for cross-instance access-invalidation (#1559).
-    // r.defineEvent registers the schema so ctx.unsafeAppendEvent (revoke,
-    // revoke-all-others) enforces it at append time. revoke-all-for-user
-    // appends via the low-level append() instead (needs to anchor on
-    // SYSTEM_TENANT_ID — see that handler for why) — append() does NOT
-    // consult the registry, so that callsite parses against
-    // sessionRevokedSchema explicitly, same guarantee via a different path.
-    // No projection: the payload IS the read, consumed directly off the
-    // event-store NOTIFY (#1560).
-    r.defineEvent(SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, { piiFields: "none" });
+      // Custom domain-event for cross-instance access-invalidation (#1559).
+      // r.defineEvent registers the schema so ctx.unsafeAppendEvent (revoke,
+      // revoke-all-others) enforces it at append time. revoke-all-for-user
+      // appends via the low-level append() instead (needs to anchor on
+      // SYSTEM_TENANT_ID — see that handler for why) — append() does NOT
+      // consult the registry, so that callsite parses against
+      // sessionRevokedSchema explicitly, same guarantee via a different path.
+      // No projection: the payload IS the read, consumed directly off the
+      // event-store NOTIFY (#1560).
+      r.defineEvent(SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, { piiFields: "none" });
 
-    const handlers = {
-      revoke: r.writeHandler(revokeWrite),
-      revokeAllOthers: r.writeHandler(revokeAllOthersWrite),
-      revokeAllForUser: r.writeHandler(revokeAllForUserWrite),
-    };
-    r.exposesApi("sessions.revokeAllForUser");
+      const handlers = {
+        revoke: r.writeHandler(revokeWrite),
+        revokeAllOthers: r.writeHandler(revokeAllOthersWrite),
+        revokeAllForUser: r.writeHandler(revokeAllForUserWrite),
+      };
+      r.exposesApi("sessions.revokeAllForUser");
 
-    const queries = {
-      mine: r.queryHandler(mineQuery),
-      list: r.queryHandler(listQuery),
-      detail: r.queryHandler(detailQuery),
-    };
+      const queries = {
+        mine: r.queryHandler(mineQuery),
+        list: r.queryHandler(listQuery),
+        detail: r.queryHandler(detailQuery),
+      };
 
-    // Retention: chunked DELETE of expired/revoked rows. Manual trigger
-    // only so dev environments don't churn. Ops wires a cron in the app's
-    // dispatcher config when running a long-lived deployment.
-    r.job("cleanup", { trigger: { manual: true } }, cleanupJob);
+      // Retention: chunked DELETE of expired/revoked rows. Manual trigger
+      // only so dev environments don't churn. Ops wires a cron in the app's
+      // dispatcher config when running a long-lived deployment.
+      r.job({
+        name: "cleanup",
+        trigger: { manual: true },
+        escapeHatch: { reason: "deletes expired session rows of every tenant" },
+        handler: (payload, ctx) =>
+          cleanupJob(
+            payload,
+            ctx,
+            ctx.db.unsafeRaw("deletes expired session rows of every tenant") as DbConnection, // @cast-boundary db-operator — jobs never run inside a DbTx
+          ),
+      });
 
-    // Cross-feature entity hook on "user". `r.entityHook` (NOT `r.hook`) is
-    // the supported cross-feature path: entity-keyed, not prefixed by the
-    // registering feature. Fires after every successful write on any
-    // user-entity handler; we only act when one of REVOKE_TRIGGERING_FIELDS
-    // is part of the changes-delta the handler was given.
-    //
-    // Checking `changes[field] !== undefined` is cheaper and more correct
-    // than diffing data vs previous — "undefined in changes" means "the
-    // handler didn't touch this column", which is exactly the signal we
-    // want to skip on. Works for both direct user:update calls and any
-    // other handler that happens to write the column.
-    //
-    // Only `passwordHash` here: `status` changes go through
-    // updateUserLifecycle(), which writes via the event-store executor
-    // directly and never runs this postSave hook. restrict-account.write.ts
-    // already revokes sessions explicitly for that transition, and
-    // sessionChecker blocks a status-locked principal on its next request
-    // regardless.
-    const REVOKE_TRIGGERING_FIELDS = ["passwordHash"] as const;
-    let autoRevoke = options?.autoRevokeOnPasswordChange;
-    r.hook("postSave", { allOf: "user" }, async (ctx) => {
-      // skip: nothing bound — stateless-JWT deployments without a runtime
-      // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
-      if (!autoRevoke) return;
-      // skip: brand-new user, no sessions can possibly exist yet. The
-      // initial passwordHash on a user:create would trip the second guard
-      // otherwise — every registration would do a mass-revoke roundtrip
-      // for a user who literally has no rows in user_sessions.
-      if (ctx.isNew) return;
-      // skip: handler didn't touch any revoke-triggering field
-      if (!REVOKE_TRIGGERING_FIELDS.some((field) => ctx.changes[field] !== undefined)) return;
-      await autoRevoke(String(ctx.id));
-    });
+      // Cross-feature entity hook on "user". `r.entityHook` (NOT `r.hook`) is
+      // the supported cross-feature path: entity-keyed, not prefixed by the
+      // registering feature. Fires after every successful write on any
+      // user-entity handler; we only act when one of REVOKE_TRIGGERING_FIELDS
+      // is part of the changes-delta the handler was given.
+      //
+      // Checking `changes[field] !== undefined` is cheaper and more correct
+      // than diffing data vs previous — "undefined in changes" means "the
+      // handler didn't touch this column", which is exactly the signal we
+      // want to skip on. Works for both direct user:update calls and any
+      // other handler that happens to write the column.
+      //
+      // Only `passwordHash` here: `status` changes go through
+      // updateUserLifecycle(), which writes via the event-store executor
+      // directly and never runs this postSave hook. restrict-account.write.ts
+      // already revokes sessions explicitly for that transition, and
+      // sessionChecker blocks a status-locked principal on its next request
+      // regardless.
+      const REVOKE_TRIGGERING_FIELDS = ["passwordHash"] as const;
+      let autoRevoke = options?.autoRevokeOnPasswordChange;
+      r.hook("postSave", { allOf: "user" }, async (ctx) => {
+        // skip: nothing bound — stateless-JWT deployments without a runtime
+        // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
+        if (!autoRevoke) return;
+        // skip: brand-new user, no sessions can possibly exist yet. The
+        // initial passwordHash on a user:create would trip the second guard
+        // otherwise — every registration would do a mass-revoke roundtrip
+        // for a user who literally has no rows in user_sessions.
+        if (ctx.isNew) return;
+        // skip: handler didn't touch any revoke-triggering field
+        if (!REVOKE_TRIGGERING_FIELDS.some((field) => ctx.changes[field] !== undefined)) return;
+        await autoRevoke(String(ctx.id));
+      });
 
-    const bindAutoRevokeOnPasswordChange: BindAutoRevokeOnPasswordChange = (revoker) => {
-      // explicit constructor option wins over the runtime binding
-      autoRevoke ??= revoker;
-    };
+      const bindAutoRevokeOnPasswordChange: BindAutoRevokeOnPasswordChange = (revoker) => {
+        // explicit constructor option wins over the runtime binding
+        autoRevoke ??= revoker;
+      };
 
-    r.translations({ keys: SESSIONS_I18N });
+      r.translations({ keys: SESSIONS_I18N });
 
-    r.screen(sessionListScreen);
-    r.screen(sessionDetailScreen);
-    r.screen(sessionMineScreen);
-    r.nav({
-      id: "session-list",
-      label: "sessions:nav.sessionList",
-      icon: "list",
-      screen: "sessions:screen:session-list",
-      order: 10,
-    });
+      r.screen(sessionListScreen);
+      r.screen(sessionDetailScreen);
+      r.screen(sessionMineScreen);
+      r.nav({
+        id: "session-list",
+        label: "sessions:nav.sessionList",
+        icon: "list",
+        screen: "sessions:screen:session-list",
+        order: 10,
+      });
 
-    return { handlers, queries, bindAutoRevokeOnPasswordChange };
-  });
+      return { handlers, queries, bindAutoRevokeOnPasswordChange };
+    },
+    { dedupeOptions: options ?? {} },
+  );
 }

package/src/sessions/handlers/cleanup.job.ts

@@ -18,7 +18,7 @@
 // seed). Mirror of secrets/retention.job in shape.
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
+import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { deleteStaleSessionsBatch } from "../db/queries/cleanup";
 
@@ -37,15 +37,12 @@ export type SessionCleanupResult = {
   readonly stoppedReason: "empty" | "timeout" | "signal";
 };
 
-export const cleanupJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
+export async function cleanupJob(
+  rawPayload: Record<string, unknown>,
+  ctx: JobContext,
+  db: DbConnection,
+): Promise<void> {
   const payload = rawPayload as SessionCleanupPayload; // @cast-boundary engine-payload
-  if (!ctx.db) {
-    throw new InternalError({
-      message: "[sessions:cleanup] ctx.db missing — job context requires a database connection.",
-    });
-  }
-  const db = ctx.db as DbConnection;
-
   const olderThanDaysRaw = payload.olderThanDays ?? DEFAULT_OLDER_THAN_DAYS;
   const olderThanDays = Number(olderThanDaysRaw);
   if (!Number.isFinite(olderThanDays) || olderThanDays < 0 || !Number.isInteger(olderThanDays)) {
@@ -83,4 +80,4 @@ export const cleanupJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> =
 
   const result: SessionCleanupResult = { deleted, batchesProcessed, stoppedReason };
   ctx.log?.info?.(`[sessions:cleanup] complete: ${JSON.stringify(result)}`);
-};
+}

package/src/tenant-lifecycle/feature.ts

@@ -113,25 +113,28 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
     r.writeHandler(requestDestructionWrite);
     r.writeHandler(cancelDestructionWrite);
 
-    r.job(
-      "run-tenant-destruction",
-      { trigger: { cron: "0 * * * * *" }, concurrency: "skip" },
-      async (_payload, ctx) => {
-        if (!ctx.db || !ctx.registry) {
-          throw new Error(
-            "run-tenant-destruction: ctx.db + ctx.registry required (JobContext incomplete)",
-          );
+    const RUN_TENANT_DESTRUCTION_REASON = "sweeps tenant destruction across every tenant";
+    r.job({
+      name: "run-tenant-destruction",
+      trigger: { cron: "0 * * * * *" },
+      concurrency: "skip",
+      escapeHatch: { reason: RUN_TENANT_DESTRUCTION_REASON },
+      handler: async (_payload, ctx) => {
+        if (!ctx.registry) {
+          throw new Error("run-tenant-destruction: ctx.registry required (JobContext incomplete)");
         }
         const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
         await runTenantDestructionSweep({
-          db: ctx.db as import("@cosmicdrift/kumiko-framework/db").DbConnection,
+          db: ctx.db.unsafeRaw(
+            RUN_TENANT_DESTRUCTION_REASON,
+          ) as import("@cosmicdrift/kumiko-framework/db").DbConnection, // @cast-boundary db-operator — jobs never run inside a DbTx
           registry: ctx.registry,
           now: T.Now.instant(),
           log: (message) => ctx.log?.warn(message),
           fileProviderResolver: ctx._fileProviderResolver,
         });
       },
-    );
+    });
 
     r.exposesApi("tenantLifecycle.runDestroySweep");
   });

package/src/tenant-settings/__tests__/tenant-currency-read-access.integration.test.ts

@@ -0,0 +1,50 @@
+// fw#2933: a `money` field's `currency: { kind: "tenant" }` declaration
+// resolves in the renderer via config:query:values — this pins that a
+// normal (non-admin) tenant user, not just an Admin, can read
+// tenant-settings:config:currency through that query. Real HTTP via
+// setupTestStack (never createTestDispatcher).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  configValuesTable,
+  createConfigAccessorFactory,
+  createConfigFeature,
+  createConfigResolver,
+} from "@cosmicdrift/kumiko-bundled-features/config";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { TenantSettingsConfig } from "../constants";
+import { createTenantSettingsFeature } from "../feature";
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  const resolver = createConfigResolver();
+  stack = await setupTestStack({
+    features: [createConfigFeature(), createTenantSettingsFeature({ defaultCurrency: "GBP" })],
+    extraContext: ({ registry }) => ({
+      configResolver: resolver,
+      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+    }),
+  });
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("tenant-settings currency — read access", () => {
+  test('a non-admin tenant user (roles: ["User"]) can read tenant-settings:config:currency via config:query:values', async () => {
+    const res = await stack.http.queryOk<Record<string, { value: unknown }>>(
+      "config:query:values",
+      {},
+      TestUsers.user,
+    );
+    expect(res[TenantSettingsConfig.currency]?.value).toBe("GBP");
+  });
+});

package/src/tenant-settings/constants.ts

@@ -1,3 +1,5 @@
+import { TENANT_CURRENCY_CONFIG_KEY } from "@cosmicdrift/kumiko-framework/engine";
+
 // tenant-settings bundle constants — feature-name + qualified config names.
 //
 // Motivation (solon#P19): apps kept hard-coding a single currency/locale
@@ -11,6 +13,9 @@ export const TENANT_SETTINGS_FEATURE_NAME = "tenant-settings";
 // ctx.config(...) reads. Clients reference the object instead of magic
 // strings (mirror tags' Handlers/Queries constants).
 export const TenantSettingsConfig = {
-  currency: "tenant-settings:config:currency",
+  // Shared with engine/constants.ts's TENANT_CURRENCY_CONFIG_KEY — a
+  // `money` field's `currency: { kind: "tenant" }` declaration (fw#2933)
+  // resolves against this same key.
+  currency: TENANT_CURRENCY_CONFIG_KEY,
   locale: "tenant-settings:config:locale",
 } as const;

package/src/user-data-rights/__tests__/file-binary-forget-cleanup.integration.test.ts

@@ -8,7 +8,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type JobContext, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createInMemoryFileProvider,
@@ -200,7 +200,9 @@ describe("run-forget-cleanup :: registered cron actually erases binaries (not ju
     if (!job) return;
 
     const ctx: JobContext = {
-      db,
+      db: createTenantDb(db, TENANT, "tenant", undefined, undefined, undefined, {
+        unsafeRaw: { reason: "executes overdue Art.17 forget requests across every tenant" },
+      }),
       registry: stack.registry,
       configResolver: configResolverForJobCtx,
       systemUser: { id: SYSTEM_USER_ID, tenantId: TENANT, roles: ["all"] },

package/src/user-data-rights/__tests__/mail-default-bridge.integration.test.ts

@@ -12,6 +12,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -127,7 +128,9 @@ describe("C6 default mail bridge :: forget cron sends deletion-executed without
     // EXAKT der prod-Job-Kontext: configResolver gesetzt, config undefined.
     // log required since #1572 persists incomplete[] via ctx.log.warn.
     const jobCtx = {
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT_A, "tenant", undefined, undefined, undefined, {
+        unsafeRaw: { reason: "executes overdue Art.17 forget requests across every tenant" },
+      }),
       registry: stack.registry,
       configResolver,
       log: {

package/src/user-data-rights/__tests__/run-export-jobs-cron-context.integration.test.ts

@@ -12,6 +12,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type JobContext, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
@@ -146,7 +147,9 @@ describe("run-export-jobs cron-context", () => {
 
     // EXAKT der prod-Job-Kontext: configResolver gesetzt, config undefined.
     const jobCtx = {
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT, "tenant", undefined, undefined, undefined, {
+        unsafeRaw: { reason: "processes pending export jobs across every tenant" },
+      }),
       registry: stack.registry,
       configResolver,
       _userId: SYSTEM_USER_ID,

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -19,6 +19,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
@@ -311,7 +312,13 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
     await seedMembership(CRON_USER, TENANT_A);
 
     const { log } = capturingJobLog();
-    const jobCtx = { db: stack.db, registry: stack.registry, log };
+    const jobCtx = {
+      db: createTenantDb(stack.db, TENANT_A, "tenant", undefined, undefined, undefined, {
+        unsafeRaw: { reason: "executes overdue Art.17 forget requests across every tenant" },
+      }),
+      registry: stack.registry,
+      log,
+    };
     await job?.handler({}, jobCtx as unknown as JobContext);
 
     const row = await fetchUser(CRON_USER);
@@ -348,7 +355,9 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
     const { log, warns } = capturingJobLog();
     try {
       await job?.handler({}, {
-        db: stack.db,
+        db: createTenantDb(stack.db, TENANT_A, "tenant", undefined, undefined, undefined, {
+          unsafeRaw: { reason: "executes overdue Art.17 forget requests across every tenant" },
+        }),
         registry: stack.registry,
         log,
       } as unknown as JobContext);

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -467,7 +467,9 @@ describe("run-forget-cleanup job — real glue-code, not a hand-set tenantModel"
     if (!job) return;
 
     const ctx: JobContext = {
-      db: stack.db,
+      db: createTenantDb(stack.db, TENANT, "tenant", undefined, undefined, undefined, {
+        unsafeRaw: { reason: "executes overdue Art.17 forget requests across every tenant" },
+      }),
       registry: stack.registry,
       configResolver: createConfigResolver({
         appOverrides: new Map([[TENANT_MODEL_CONFIG_KEY, "single-user"]]),