@cosmicdrift/kumiko-bundled-features 0.289.0 → 0.291.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.289.0",
+  "version": "0.291.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -133,12 +133,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.289.0",
-    "@cosmicdrift/kumiko-framework": "0.289.0",
-    "@cosmicdrift/kumiko-headless": "0.289.0",
-    "@cosmicdrift/kumiko-renderer": "0.289.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.289.0",
-    "@cosmicdrift/kumiko-types": "0.289.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.291.0",
+    "@cosmicdrift/kumiko-framework": "0.291.0",
+    "@cosmicdrift/kumiko-headless": "0.291.0",
+    "@cosmicdrift/kumiko-renderer": "0.291.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.291.0",
+    "@cosmicdrift/kumiko-types": "0.291.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -167,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.289.0",
-    "@cosmicdrift/kumiko-locale-es": "0.289.0",
+    "@cosmicdrift/kumiko-locale-de": "0.291.0",
+    "@cosmicdrift/kumiko-locale-es": "0.291.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/__tests__/query-as-member.integration.test.ts

@@ -563,6 +563,19 @@ async function readAsMemberErr(
   );
 }
 
+// The request-level teardown gate (auth-middleware) answers 410 before a
+// handler runs, so a teardown tenant can only be probed for the dispatcher's
+// own active-membership rejection through the stack's dispatcher.
+async function readAsMemberErrViaDispatcher(userId: string, targetQn: string) {
+  const result = await stack.dispatcher.write(
+    "queryasmemberprobe:write:read-as-member",
+    { userId, targetQn, payload: {} },
+    admin,
+  );
+  if (result.isSuccess) throw new Error("expected read-as-member to fail");
+  return result.error;
+}
+
 async function createNote(ownerId: string, body: string): Promise<void> {
   await stack.http.writeOk("queryasmemberprobe:write:note:create", { ownerId, body }, admin);
 }
@@ -693,7 +706,7 @@ describe("ctx.queryAsMember — AccessDenied, same generic error for every rejec
     await addMembership(userId, TENANT_A);
     await setTenantStatus(TENANT_A, "destroying");
 
-    const err = await readAsMemberErr(userId, WHOAMI_QN);
+    const err = await readAsMemberErrViaDispatcher(userId, WHOAMI_QN);
     expect(err.code).toBe("access_denied");
     expect(err.message).toBe(GENERIC_MESSAGE);
     expect(err.details).toEqual(GENERIC_DETAILS);
@@ -707,7 +720,7 @@ describe("ctx.queryAsMember — AccessDenied, same generic error for every rejec
     await addMembership(userId, TENANT_A);
     await setTenantStatus(TENANT_A, "destroyRequested");
 
-    const err = await readAsMemberErr(userId, WHOAMI_QN);
+    const err = await readAsMemberErrViaDispatcher(userId, WHOAMI_QN);
     expect(err.code).toBe("access_denied");
     expect(err.message).toBe(GENERIC_MESSAGE);
     expect(err.details).toEqual(GENERIC_DETAILS);

package/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.291.0",
+    "type": "improvement",
+    "title": "loggedInHref callbacks on SignupCompleteScreen and InviteAcceptScreen now receive the roles granted by the flow",
+    "detail": "Apps can route a freshly activated user to a screen their role can actually open, instead of a fixed path that may render Access denied. The string form of loggedInHref is unchanged; the function form gains a roles field next to the existing tenantKey/tenantId."
+  },
   {
     "version": "0.286.0",
     "type": "improvement",

package/src/auth-email-password/web/__tests__/auth-form-logic.test.ts

@@ -34,11 +34,40 @@ describe("retryAfterMinutes", () => {
 });
 
 describe("resolveLoggedInHref", () => {
+  type SignupArgs = { tenantKey: string; roles: readonly string[] };
+
   test("string href returned as-is", () => {
-    expect(resolveLoggedInHref("/", "acme")).toBe("/");
+    expect(resolveLoggedInHref<SignupArgs>("/", { tenantKey: "acme", roles: ["User"] })).toBe("/");
   });
 
   test("function href receives tenantKey", () => {
-    expect(resolveLoggedInHref(({ tenantKey }) => `/${tenantKey}/`, "acme")).toBe("/acme/");
+    expect(
+      resolveLoggedInHref<SignupArgs>(({ tenantKey }) => `/${tenantKey}/`, {
+        tenantKey: "acme",
+        roles: [],
+      }),
+    ).toBe("/acme/");
+  });
+
+  test("function href can route on the roles the server returned", () => {
+    const byRole = ({ tenantKey, roles }: SignupArgs): string =>
+      roles.includes("SystemAdmin") ? "/a/waitlist-list" : `/${tenantKey}/vehicle-start`;
+
+    expect(resolveLoggedInHref(byRole, { tenantKey: "acme", roles: ["Dealer"] })).toBe(
+      "/acme/vehicle-start",
+    );
+    expect(resolveLoggedInHref(byRole, { tenantKey: "acme", roles: ["SystemAdmin"] })).toBe(
+      "/a/waitlist-list",
+    );
+  });
+
+  test("args object shape is per-screen — invite passes tenantId", () => {
+    expect(
+      resolveLoggedInHref(
+        ({ tenantId, roles }: { tenantId: string; roles: readonly string[] }) =>
+          `/${tenantId}/${roles[0] ?? "none"}`,
+        { tenantId: "t1", roles: ["Editor"] },
+      ),
+    ).toBe("/t1/Editor");
   });
 });

package/src/auth-email-password/web/__tests__/invite-accept-screen.test.tsx

@@ -91,6 +91,53 @@ describe("InviteAcceptScreen — logged-in branch", () => {
     });
   });
 
+  test("branch 1: loggedInHref-Function bekommt die Rolle aus der invite-accept-Response", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({ tenantId: "tenant-new", role: "Dealer", alreadyMember: false }),
+          { status: 200 },
+        ),
+    ) as unknown as typeof fetch;
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+
+    renderWithProviders(
+      <InviteAcceptScreen
+        token="tok-123"
+        loggedInHref={({ tenantId, roles }) =>
+          roles.includes("SystemAdmin") ? "/a/waitlist-list" : `/${tenantId}/vehicle-start`
+        }
+      />,
+      { session: makeSessionApi({ status: "authenticated" }) },
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Accept" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalledWith("/tenant-new/vehicle-start");
+    });
+  });
+
+  test("String-Form bleibt unverändert gültig", async () => {
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+
+    renderWithProviders(<InviteAcceptScreen token="tok-123" loggedInHref="/fixed-landing" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Accept" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalledWith("/fixed-landing");
+    });
+  });
+
   test("accept logged-in failure shows invalidInviteToken banner", async () => {
     globalThis.fetch = mock(
       async () => new Response(null, { status: 422 }),
@@ -154,6 +201,79 @@ describe("InviteAcceptScreen — anonymous branches", () => {
     });
   });
 
+  test("branch 2/3: die Session-Rollen aus user.roles schlagen die Invitation-Rolle", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            token: "jwt",
+            user: { id: "u1", tenantId: "t1", roles: ["Dealer"] },
+            tenantId: "t1",
+            role: "SystemAdmin",
+          }),
+          { status: 200 },
+        ),
+    ) as unknown as typeof fetch;
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+
+    render(
+      <PrimitivesProvider value={defaultPrimitives}>
+        <LocaleProvider resolver={resolver} fallbackBundles={[defaultTranslations]}>
+          <InviteAcceptScreen
+            token="tok-123"
+            loggedInHref={({ tenantId, roles }) => `/${tenantId}/${roles.join("+")}`}
+          />
+        </LocaleProvider>
+      </PrimitivesProvider>,
+    );
+    fireEvent.change(screen.getByLabelText(/^Email/), { target: { value: "a@example.com" } });
+    fireEvent.change(screen.getByLabelText(/^Password/), { target: { value: "secret123" } });
+    fireEvent.click(screen.getByRole("button", { name: "Accept + sign in" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalledWith("/t1/Dealer");
+    });
+  });
+
+  test("MFA-Challenge (200 ohne Rollen) liefert eine leere Rollenliste statt undefined", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(JSON.stringify({ mfaRequired: true, challengeToken: "ch" }), { status: 200 }),
+    ) as unknown as typeof fetch;
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+    const seen: (readonly string[])[] = [];
+
+    render(
+      <PrimitivesProvider value={defaultPrimitives}>
+        <LocaleProvider resolver={resolver} fallbackBundles={[defaultTranslations]}>
+          <InviteAcceptScreen
+            token="tok-123"
+            loggedInHref={({ roles }) => {
+              seen.push(roles);
+              return "/";
+            }}
+          />
+        </LocaleProvider>
+      </PrimitivesProvider>,
+    );
+    fireEvent.change(screen.getByLabelText(/^Email/), { target: { value: "a@example.com" } });
+    fireEvent.change(screen.getByLabelText(/^Password/), { target: { value: "secret123" } });
+    fireEvent.click(screen.getByRole("button", { name: "Accept + sign in" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalled();
+    });
+    expect(seen).toEqual([[]]);
+  });
+
   test("anon failure shows invalidInviteToken banner", async () => {
     globalThis.fetch = mock(
       async () => new Response(null, { status: 422 }),

package/src/auth-email-password/web/__tests__/signup-complete-screen.test.tsx

@@ -107,6 +107,78 @@ describe("SignupCompleteScreen", () => {
     }
   });
 
+  test("loggedInHref-Function bekommt die Rollen aus der signup-confirm-Response", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            user: { id: "u1", tenantId: "t1", roles: ["Dealer"] },
+            tenantKey: "acme",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        ),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(
+      <SignupCompleteScreen
+        token="abc-token"
+        loggedInHref={({ tenantKey, roles }) =>
+          roles.includes("SystemAdmin") ? "/a/waitlist-list" : `/${tenantKey}/vehicle-start`
+        }
+      />,
+    );
+    fillPasswords("validpass1", "validpass1");
+    fireEvent.click(screen.getByRole("button", { name: "Activate account" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("link", { name: "Continue" }).getAttribute("href")).toBe(
+        "/acme/vehicle-start",
+      );
+    });
+  });
+
+  test("gleiche Function, SystemAdmin-Rolle → anderes Ziel", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            user: { id: "u1", tenantId: "t1", roles: ["SystemAdmin"] },
+            tenantKey: "acme",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        ),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(
+      <SignupCompleteScreen
+        token="abc-token"
+        loggedInHref={({ tenantKey, roles }) =>
+          roles.includes("SystemAdmin") ? "/a/waitlist-list" : `/${tenantKey}/vehicle-start`
+        }
+      />,
+    );
+    fillPasswords("validpass1", "validpass1");
+    fireEvent.click(screen.getByRole("button", { name: "Activate account" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("link", { name: "Continue" }).getAttribute("href")).toBe(
+        "/a/waitlist-list",
+      );
+    });
+  });
+
+  test("String-Form bleibt unverändert gültig und ignoriert die Rollen", async () => {
+    renderWithProviders(<SignupCompleteScreen token="abc-token" loggedInHref="/fixed-landing" />);
+    fillPasswords("validpass1", "validpass1");
+    fireEvent.click(screen.getByRole("button", { name: "Activate account" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("link", { name: "Continue" }).getAttribute("href")).toBe(
+        "/fixed-landing",
+      );
+    });
+  });
+
   test("mismatch → client-side error, kein fetch-Call", async () => {
     const fetchMock = mock(async () => new Response(null, { status: 200 }));
     globalThis.fetch = fetchMock as unknown as typeof fetch;

package/src/auth-email-password/web/auth-form-logic.ts

@@ -21,10 +21,10 @@ export function retryAfterMinutes(retryAfterSeconds?: number): number | undefine
   return Math.ceil(retryAfterSeconds / 60);
 }
 
-/** Resolves post-login redirect: string template or function of tenantKey. */
-export function resolveLoggedInHref(
-  href: string | ((args: { readonly tenantKey: string }) => string),
-  tenantKey: string,
+/** Resolves post-login redirect: string template or function of the screen's args. */
+export function resolveLoggedInHref<Args>(
+  href: string | ((args: Args) => string),
+  args: Args,
 ): string {
-  return typeof href === "function" ? href({ tenantKey }) : href;
+  return typeof href === "function" ? href(args) : href;
 }

package/src/auth-email-password/web/invite-accept-screen.tsx

@@ -19,21 +19,40 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useContext, useState } from "react";
 import { csrfHeader } from "./auth-client";
+import { resolveLoggedInHref } from "./auth-form-logic";
 import { AuthCard, useUrlToken } from "./auth-form-primitives";
 import { SessionContext, UNAUTHENTICATED } from "./session";
 
 export type InviteAcceptScreenProps = {
   readonly title?: string;
   readonly token?: string;
-  /** Where to redirect on success. Default "/" — Apps mit Multi-Tenant-
-   *  Routing können `(data) => "/${data.tenantId}/"` setzen. */
-  readonly loggedInHref?: string | ((args: { tenantId: string }) => string);
+  /** Where to redirect on success. Default "/" — multi-tenant apps can pass
+   *  `(data) => "/${data.tenantId}/"`. Function-form receives the roles this
+   *  flow grants in the target tenant; branch 1 reports the invitation's
+   *  role, which for an existing member is not their full role set there. */
+  readonly loggedInHref?:
+    | string
+    | ((args: { tenantId: string; roles: readonly string[] }) => string);
   /** Login-Href für "Mit anderem Account anmelden". Default "/login". */
   readonly loginHref?: string;
 };
 
 type Mode = "loggedin" | "anon-existing" | "anon-new";
 
+// All three accept routes answer 200 with tenantId + the invitation role;
+// the two session-minting branches additionally carry the stripped session
+// roles. An MFA challenge is also a 200 and carries none of them.
+type InviteAcceptResponse = {
+  readonly tenantId: string;
+  readonly role?: string;
+  readonly user?: { readonly roles?: readonly string[] };
+};
+
+function grantedRoles(data: InviteAcceptResponse): readonly string[] {
+  if (data.user?.roles !== undefined) return data.user.roles;
+  return data.role === undefined ? [] : [data.role];
+}
+
 export function InviteAcceptScreen({
   title,
   token: tokenProp,
@@ -70,12 +89,14 @@ export function InviteAcceptScreen({
     });
     setSubmitting(false);
     if (res.ok) {
-      const data = (await res.json()) as { tenantId: string };
-      const target =
-        typeof loggedInHref === "function"
-          ? loggedInHref({ tenantId: data.tenantId })
-          : loggedInHref;
-      window.location.assign(target);
+      // @cast-boundary engine-payload — auth route JSON
+      const data = (await res.json()) as InviteAcceptResponse;
+      window.location.assign(
+        resolveLoggedInHref(loggedInHref, {
+          tenantId: data.tenantId,
+          roles: grantedRoles(data),
+        }),
+      );
       return;
     }
     setError(t("auth.errors.invalidInviteToken"));
@@ -93,12 +114,14 @@ export function InviteAcceptScreen({
     });
     setSubmitting(false);
     if (res.ok) {
-      const data = (await res.json()) as { tenantId: string };
-      const target =
-        typeof loggedInHref === "function"
-          ? loggedInHref({ tenantId: data.tenantId })
-          : loggedInHref;
-      window.location.assign(target);
+      // @cast-boundary engine-payload — auth route JSON
+      const data = (await res.json()) as InviteAcceptResponse;
+      window.location.assign(
+        resolveLoggedInHref(loggedInHref, {
+          tenantId: data.tenantId,
+          roles: grantedRoles(data),
+        }),
+      );
       return;
     }
     setError(t("auth.errors.invalidInviteToken"));
@@ -116,12 +139,14 @@ export function InviteAcceptScreen({
     });
     setSubmitting(false);
     if (res.ok) {
-      const data = (await res.json()) as { tenantId: string };
-      const target =
-        typeof loggedInHref === "function"
-          ? loggedInHref({ tenantId: data.tenantId })
-          : loggedInHref;
-      window.location.assign(target);
+      // @cast-boundary engine-payload — auth route JSON
+      const data = (await res.json()) as InviteAcceptResponse;
+      window.location.assign(
+        resolveLoggedInHref(loggedInHref, {
+          tenantId: data.tenantId,
+          roles: grantedRoles(data),
+        }),
+      );
       return;
     }
     setError(t("auth.errors.invalidInviteToken"));

package/src/auth-email-password/web/signup-complete-screen.tsx

@@ -25,8 +25,11 @@ export type SignupCompleteScreenProps = {
   readonly title?: string;
   /** Override for the URL token — server-rendered apps can pass it. Default: `?token=...`. */
   readonly token?: string;
-  /** Where to send the user after activation. Function-form receives the tenantKey. Default "/". */
-  readonly loggedInHref?: string | ((args: { tenantKey: string }) => string);
+  /** Where to send the user after activation. Function-form receives the tenantKey and the
+   *  roles granted by this flow in that tenant — for role-dependent landing targets. Default "/". */
+  readonly loggedInHref?:
+    | string
+    | ((args: { tenantKey: string; roles: readonly string[] }) => string);
   /** Href for the "already have an account?" link when the token is missing. Default "/login". */
   readonly loginHref?: string;
 };
@@ -64,7 +67,12 @@ export function SignupCompleteScreen({
       // Cookies are already set (auto-login). Show a confirmation with an
       // explicit continue button instead of navigating away silently —
       // the user otherwise gets no signal that activation worked.
-      setContinueHref(resolveLoggedInHref(loggedInHref, res.data.tenantKey));
+      setContinueHref(
+        resolveLoggedInHref(loggedInHref, {
+          tenantKey: res.data.tenantKey,
+          roles: res.data.user.roles,
+        }),
+      );
       return;
     }
     if (res.error.reason === "invalid_signup_token") {

package/src/auth-mfa/__tests__/verify.integration.test.ts

@@ -375,12 +375,16 @@ describe("mfa verify — re-checks account state the way login.write.ts does", (
     resetTenantLifecycleGateCacheForTests();
 
     try {
-      const err = await stack.http.writeErr(
+      // Via the dispatcher, not HTTP: the request-level teardown gate answers
+      // 410 before /api/write reaches the handler, and this test asserts the
+      // handler's own challenge-token gate.
+      const result = await stack.dispatcher.write(
         AuthMfaHandlers.verify,
         { challengeToken, code: currentTotpCode(secret) },
         GUEST,
       );
-      expectErrorIncludes(err, "invalid_challenge_token");
+      if (result.isSuccess) throw new Error("expected mfa verify to fail");
+      expectErrorIncludes(result.error, "invalid_challenge_token");
     } finally {
       await asRawClient(stack.db).unsafe(
         `UPDATE "${tenantTable.tableName}" SET status = $1 WHERE id = $2`,

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -44,6 +44,7 @@ import {
 } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id";
 import {
@@ -147,6 +148,7 @@ beforeAll(async () => {
   // subscriptionsProjectionTable wird von setupTestStack automatisch
   // gepusht (r.projection mit `table`-Property → auto-push).
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
   // providerCustomerId/providerSubscriptionId are `personal: "tenant"`
   // PII-subject fields — no executor wires the KMS automatically here (raw r.projection,

package/src/billing-foundation/__tests__/subscription-tier-sync.integration.test.ts

@@ -30,6 +30,7 @@ import {
 } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import type { TierMap } from "../../tier-engine/compose-app";
 import { TierEngineHandlers } from "../../tier-engine/constants";
@@ -112,6 +113,7 @@ beforeAll(async () => {
     ],
   });
   await createEventsTable(stack.db);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await unsafePushTables(stack.db, { tier_assignments: tierAssignmentTable });
   configurePiiSubjectKms(new InMemoryKmsAdapter());

package/src/delivery/feature.ts

@@ -64,8 +64,13 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
     // apply-key is a registered domain-event (DELIVERY_ATTEMPT_EVENT).
     // recipientAddress is the real PII (email address); recipientId stays
     // plaintext — pseudonymous fk, same line as config.userId (#821).
+    // recipientId is nullable (system-triggered sends to non-users), so the
+    // address falls back to the tenant key instead of the plaintext it used
+    // to be — still shreddable, one tenant wide (fw#2776).
     r.defineEvent("attempt", deliveryAttemptSchema, {
-      piiFields: { recipientAddress: { personal: { of: "recipientId" } } },
+      piiFields: {
+        recipientAddress: { personal: { of: "recipientId", whenAbsent: "tenant" } },
+      },
     });
 
     // Inline projection that materialises every delivery attempt into

package/src/document-ingest-foundation/__tests__/feature.integration.test.ts

@@ -10,10 +10,16 @@ import {
   createInMemoryFileProvider,
   type InMemoryFileProvider,
 } from "@cosmicdrift/kumiko-framework/files";
-import { setupTestStack, type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { documentIngestFoundationFeature } from "../feature";
 
@@ -48,6 +54,7 @@ beforeAll(async () => {
     ],
     files: { storageProvider: provider },
   });
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
 });
 
 afterAll(async () => {

package/src/inbound-mail-foundation/__tests__/inbound-mail-foundation.integration.test.ts

@@ -46,6 +46,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { inboundProviderInMemoryFeature } from "../../inbound-provider-inmemory";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { inboundMessageAggregateId, mailThreadAggregateId } from "../aggregate-id";
 import { InboundMailFoundationHandlers, InboundMailFoundationQueries } from "../constants";
@@ -83,6 +84,7 @@ beforeAll(async () => {
   });
   db = stack.db;
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
   // Unmanaged direct-write stores — kein r.entity, kein Auto-Push.
   await unsafeCreateEntityTable(db, syncCursorEntity);

package/src/inbound-mail-foundation/__tests__/retention.integration.test.ts

@@ -27,6 +27,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { inboundProviderInMemoryFeature } from "../../inbound-provider-inmemory";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { inboundMessageAggregateId } from "../aggregate-id";
 import { InboundMailFoundationHandlers } from "../constants";
@@ -51,6 +52,7 @@ beforeAll(async () => {
   });
   db = stack.db;
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
   await unsafeCreateEntityTable(db, syncCursorEntity);
   await unsafeCreateEntityTable(db, seenMessageEntity);

package/src/inbound-mail-foundation/__tests__/watch-supervisor.integration.test.ts

@@ -33,6 +33,7 @@ import {
   seedInboundMessage,
 } from "../../inbound-provider-inmemory/feature";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import {
   createInboundMailSupervisor,
@@ -65,6 +66,7 @@ beforeAll(async () => {
   });
   db = stack.db;
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
   await unsafeCreateEntityTable(db, syncCursorEntity);
   await unsafeCreateEntityTable(db, seenMessageEntity);