@cosmicdrift/kumiko-bundled-features 0.307.0 → 0.309.0

package/src/user/__tests__/user-global-tenancy.integration.test.ts

@@ -13,7 +13,7 @@ import {
   TestUsers,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { UserHandlers } from "../constants";
 import { createUserFeature } from "../feature";
 import { userEntity, userTable } from "../schema/user";

package/src/user/handlers/create.write.ts

@@ -14,7 +14,7 @@ import {
 import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { UserErrors } from "../constants";
 import { rolesInputSchema } from "../roles-input-schema";
 import { userEntity, userTable } from "../schema/user";

package/src/user/handlers/find-for-auth.query.ts

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { userTable } from "../schema/user";
 
 // Privileged auth lookup: returns the full user row — including passwordHash —

package/src/user/handlers/me.query.ts

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { userEntity, userTable } from "../schema/user";
 
 const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });

package/src/user/handlers/update.write.ts

@@ -7,7 +7,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/errors";
 import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
-import { z } from "zod";
+import * as z from "zod";
 import { UserErrors } from "../constants";
 import { rolesInputSchema } from "../roles-input-schema";
 import { userEntity, userTable } from "../schema/user";

package/src/user/roles-input-schema.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 /** Accept string[] or a JSON-encoded string[]; reject bare non-JSON strings. */
 export const rolesInputSchema = z.union([

package/src/user/seeding.ts

@@ -71,26 +71,8 @@ export async function seedUser(
   // liefert die Projection-Row als Record<string, unknown>.
   if (existing) {
     const id = existing["id"] as string;
-    // Reconcile emailVerified on an already-seeded row: a persistent dev DB
-    // (or a re-run bootstrap) can carry a User seeded before this flag
-    // existed or before it flipped to true — without this, "seed with
-    // emailVerified: true" only ever takes effect on the very first insert
-    // and the flag silently does nothing on every re-run after (#1687).
-    // Goes through the executor (a real `.updated` event), never a direct
-    // write.
-    if (options.emailVerified === true && existing["emailVerified"] !== true) {
-      const result = await userExecutor.update(
-        { id, version: existing["version"] as number, changes: { emailVerified: true } },
-        by,
-        tdb,
-      );
-      // version_conflict = a concurrent write already changed the row —
-      // fine for a seed helper, don't fail the whole seed run over it.
-      if (!result.isSuccess && result.error.code !== "version_conflict") {
-        throw new Error(
-          `seedUser emailVerified reconcile failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
-        );
-      }
+    if (options.emailVerified === true) {
+      await reconcileSeededUserEmailVerified(db, existing, by);
     }
     return { id };
   }
@@ -116,6 +98,33 @@ export async function seedUser(
   return { id: extractId(result.data, "seedUser") };
 }
 
+// A re-run seed onto a row created before emailVerified flipped to true must
+// still set it (#1687) — via the executor, so it lands as a real `.updated` event.
+export async function reconcileSeededUserEmailVerified(
+  db: DbConnection,
+  existingRow: Record<string, unknown>,
+  by: SessionUser,
+): Promise<void> {
+  // skip: already verified, nothing to reconcile
+  if (existingRow["emailVerified"] === true) return;
+  // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
+  // liefert die Projection-Row als Record<string, unknown>.
+  const id = existingRow["id"] as string;
+  const tdb = createTenantDb(db, by.tenantId, "system");
+  const result = await userExecutor.update(
+    { id, version: existingRow["version"] as number, changes: { emailVerified: true } },
+    by,
+    tdb,
+  );
+  // version_conflict = a concurrent write already changed the row —
+  // fine for a seed helper, don't fail the whole seed run over it.
+  if (!result.isSuccess && result.error.code !== "version_conflict") {
+    throw new Error(
+      `reconcileSeededUserEmailVerified failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
+    );
+  }
+}
+
 // Extrahiert die `id`-Spalte aus dem executor.create-Result. Der
 // Executor liefert ein Record<string, unknown> (die Projection-Row), in
 // das die DB die Aggregat-id reinschreibt — wir prüfen runtime statt

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -9,7 +9,7 @@ import {
   validateBoot,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
-import { z } from "zod";
+import * as z from "zod";
 import { authFoundationFeature } from "../../auth-foundation";
 import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
 import { createConfigFeature } from "../../config/feature";

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.308.0",
+    "type": "fix",
+    "title": "The privacy-center screen's \"restrict\" action declares an explicit icon",
+    "detail": "The boot validator now requires every projectionDetail action to resolve an icon (fw#3234); \"restrict\" resolved none from the shared id-derived map, so it now declares `icon: \"lock\"` explicitly. \"request-deletion\" needed no change — it now resolves via the shared map's new `deletion: \"trash\"` entry (@cosmicdrift/kumiko-types)."
+  },
   {
     "version": "0.289.0",
     "type": "improvement",

package/src/user-data-rights/feature.ts

@@ -406,6 +406,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       actions: [
         {
           id: "restrict",
+          icon: "lock",
           label: i18nKey("userDataRights.privacyCenter.restriction.restrict"),
           handler: UserDataRightsHandlers.restrictAccount,
           confirm: i18nKey("userDataRights.privacyCenter.restriction.dialogDescription"),

package/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -1,6 +1,6 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { isWithinGracePeriod } from "../../shared";
 import { USER_STATUS, userTable } from "../../user";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";

package/src/user-data-rights/handlers/confirm-deletion-by-token.write.ts

@@ -5,7 +5,7 @@ import {
   type HandlerContext,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { USER_STATUS, userTable } from "../../user";
 import { redeemDeletionToken } from "../deletion-token";
 import { startDeletionGracePeriod } from "./deletion-grace-period";

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -32,7 +32,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { z } from "zod";
+import * as z from "zod";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
 import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { exportDownloadTokensTable } from "../schema/download-token";

package/src/user-data-rights/handlers/download-by-token.query.ts

@@ -34,7 +34,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { z } from "zod";
+import * as z from "zod";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
 import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { exportDownloadTokensTable } from "../schema/download-token";

package/src/user-data-rights/handlers/export-status.query.ts

@@ -14,7 +14,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { z } from "zod";
+import * as z from "zod";
 import { exportJobsTable } from "../schema/export-job";
 
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;

package/src/user-data-rights/handlers/lift-restriction.write.ts

@@ -1,6 +1,6 @@
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { USER_STATUS, userTable } from "../../user";
 import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";

package/src/user-data-rights/handlers/list-download-attempts.query.ts

@@ -1,7 +1,7 @@
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { downloadAttemptsTable } from "../schema/download-attempt";
 
 // Operator-Query: invalid Download-Attempts (S2.U7).

package/src/user-data-rights/handlers/my-audit-log.query.ts

@@ -2,7 +2,7 @@ import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 
 // DSGVO Art. 15 Selbstauskunft — User reads HIS OWN audit-log.
 // WHERE createdBy = ctx.user.id ist hard-coded (kein userId-Param,

package/src/user-data-rights/handlers/request-deletion-by-email.write.ts

@@ -1,5 +1,5 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { USER_STATUS, userTable } from "../../user";
 import { signDeletionToken } from "../deletion-token";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";

package/src/user-data-rights/handlers/request-deletion.write.ts

@@ -2,7 +2,7 @@ import { createTransportForTenant } from "@cosmicdrift/kumiko-bundled-features/m
 import type { DurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { USER_STATUS } from "../../user";
 import {
   type GdprMailDefaults,

package/src/user-data-rights/handlers/request-export.write.ts

@@ -25,7 +25,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type SaveContext } from "@cosmicdrift/kumiko-framework/engine";
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { z } from "zod";
+import * as z from "zod";
 import {
   ACTIVE_JOB_CONSTRAINT,
   EXPORT_JOB_STATUS,

package/src/user-data-rights/handlers/restrict-account.write.ts

@@ -4,7 +4,7 @@ import {
   UnprocessableError,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { USER_STATUS, userTable } from "../../user";
 import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant";
 import { isAdminActor } from "../lib/is-admin-actor";

package/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -14,7 +14,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { z } from "zod";
+import * as z from "zod";
 import { resolveAppTenantModel } from "../lib/resolve-tenant-model";
 import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { runForgetCleanup, type SendDeletionExecutedEmailFn } from "../run-forget-cleanup";

package/src/user-data-rights-defaults/hooks/file-ref.userdata-hook.ts

@@ -1,5 +1,5 @@
 import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { derivativeListPrefix, isDerivativeKeyOf } from "@cosmicdrift/kumiko-framework/derivatives";
+import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import {
   createSystemUser,
   type FieldDefinition,
@@ -10,13 +10,11 @@ import {
   type UserDataHookCtx,
   type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  assertSafeStorageKey,
-  fileRefEntity,
-  fileRefsTable,
-} from "@cosmicdrift/kumiko-framework/files";
+import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { assertErased } from "../../shared";
 
+const ERROR_CONTEXT = "user-data-rights-defaults:fileRef";
+
 // Forget writes go through the executor (events), not deleteMany/updateMany:
 // a projection rebuild replays the events, so the erasure survives. Eventless
 // writes are wiped/resurrected on rebuild — the Art.17 hole this fixes. Bounded:
@@ -174,52 +172,12 @@ function isPersonalFileRow(registry: Registry, row: Record<string, unknown>): bo
   return isPersonalPiiField(fieldDef);
 }
 
-// Derivatives (thumbnails/resized variants — see derivatives-context.ts) are
-// never tracked anywhere but the storage layer: they're rendered under a
-// deterministic key (deriveKey + variantSuffix) computed from the original's
-// key + a render spec, on demand, and nothing writes that key back onto the
-// FileRef row. List the original's key-prefix and keep only candidates whose
-// suffix matches the derivative grammar, anchored to the original's own
-// basename AND extension — a same-directory sibling original (a different
-// file, possibly another user's) shares the same list prefix but fails the
-// extension/suffix check and is never touched.
-async function listDerivativeKeys(
-  originalKey: string,
-  provider: UserDataStorageProvider,
-): Promise<readonly string[]> {
-  let candidates: readonly string[];
-  try {
-    candidates = await provider.list(derivativeListPrefix(originalKey));
-  } catch (err) {
-    // Wrap rather than let a raw provider error (e.g. S3 AccessDenied) surface
-    // unexplained — list() is a NEW requirement this hook added on top of
-    // delete(); a bucket policy granting only s3:DeleteObject now fails forget
-    // every run instead of just leaving derivatives behind. Name the likely
-    // cause so an operator doesn't have to guess.
-    throw new Error(
-      `[user-data-rights-defaults:fileRef] provider.list() failed while looking up derivatives of key=${originalKey} — forget/erasure requires list permission on the storage bucket (e.g. s3:ListBucket), not just delete. Original error: ${err instanceof Error ? err.message : String(err)}`,
-    );
-  }
-  const derivativeKeys: string[] = [];
-  for (const candidate of candidates) {
-    if (!isDerivativeKeyOf(originalKey, candidate)) continue;
-    try {
-      assertSafeStorageKey(candidate);
-    } catch {
-      // ponytail: a listing hit that fails the storage-key grammar can't be
-      // a real derivative (every derivative is written via a validated
-      // write()) — skip rather than pass a malformed key to delete().
-      continue;
-    }
-    derivativeKeys.push(candidate);
-  }
-  return derivativeKeys;
-}
-
 // Delete every row's binary (original + any derivatives) via the provider.
 // Returns the keys whose delete threw — the caller fails closed on a
 // non-empty list so the sub-tx rolls back and the next forget run retries
-// (delete is idempotent → converges).
+// (delete is idempotent → converges). Derivative-listing + per-key delete
+// lives in the shared derivatives helper (also used by data-retention's
+// hardDelete cleanup) so this hook no longer carries its own copy.
 async function deleteBinaries(
   rows: readonly Record<string, unknown>[],
   provider: UserDataStorageProvider,
@@ -228,18 +186,7 @@ async function deleteBinaries(
   for (const row of rows) {
     const key = row["storageKey"]; // @cast-boundary db-row
     if (typeof key !== "string" || key.length === 0) continue;
-    const keysToDelete = [key, ...(await listDerivativeKeys(key, provider))];
-    for (const k of keysToDelete) {
-      try {
-        await provider.delete(k);
-      } catch (err) {
-        // biome-ignore lint/suspicious/noConsole: operator-visibility for binary-cleanup-failure
-        console.warn(
-          `[user-data-rights-defaults:fileRef] storage delete failed key=${k} err=${err instanceof Error ? err.message : String(err)}`,
-        );
-        failedKeys.push(k);
-      }
-    }
+    failedKeys.push(...(await deleteStoredFileAndDerivatives(key, provider, ERROR_CONTEXT)));
   }
   return failedKeys;
 }

package/src/user-profile/handlers/change-email.write.ts

@@ -5,7 +5,7 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { AuthErrors } from "../../auth-email-password";
 import { decryptStoredPii, verifyPassword } from "../../shared";
 import { UserErrors, UserHandlers, UserQueries } from "../../user";

package/src/workflow-runner/__tests__/pending-projection.integration.test.ts

@@ -21,7 +21,7 @@ import {
   WORKFLOW_WAITING_TYPE,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { setupTestStack, type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { workflowRunAggregateId } from "../aggregate-id";
 import { workflowRunnerFeature } from "../feature";
 import { workflowRunPendingTable } from "../tables";

package/src/workflow-runner/handlers/resume-run.write.ts

@@ -48,7 +48,7 @@ import {
   type WriteHandlerDef,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import {
   isResumableSuspension,
   type WorkflowRunCompletedPayload,