@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/tenant/last-tenant-admin.d.ts

@@ -3,5 +3,5 @@ import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 export declare const LAST_TENANT_ADMIN_LOCK_NAMESPACE = 1952539757;
 type TenantDb = Parameters<typeof acquireNamespacedAdvisoryLock>[0];
 /** Refuse demoting/removing the last TenantAdmin for `tenantId`. */
-export declare function assertNotLastTenantAdmin(db: TenantDb, tenantId: string, userId: string): Promise<ReturnType<typeof writeFailure> | undefined>;
+export declare function assertNotLastTenantAdmin(db: TenantDb, tenantId: string, userId: string, action?: "demote" | "remove"): Promise<ReturnType<typeof writeFailure> | undefined>;
 export {};

package/dist/tenant/last-tenant-admin.js

@@ -8,14 +8,16 @@ import { tenantMembershipsTable } from "./membership-table.js";
 // (dispatcher batch wraps handlers in transaction — xact lock holds through update).
 export const LAST_TENANT_ADMIN_LOCK_NAMESPACE = 0x7461646d; // 'tadm'
 /** Refuse demoting/removing the last TenantAdmin for `tenantId`. */
-export async function assertNotLastTenantAdmin(db, tenantId, userId) {
+export async function assertNotLastTenantAdmin(db, tenantId, userId, action = "demote") {
     await acquireNamespacedAdvisoryLock(db, LAST_TENANT_ADMIN_LOCK_NAMESPACE, tenantId);
     const allMemberships = await selectMany(db, tenantMembershipsTable, { tenantId });
     const adminCount = allMemberships.filter((m) => parseRoles(m["roles"]).includes("TenantAdmin")).length;
     if (adminCount <= 1) {
         return writeFailure(new ConflictError({
-            message: "cannot demote the last tenant admin",
-            i18nKey: "tenant.errors.cannotDemoteLastTenantAdmin",
+            message: `cannot ${action} the last tenant admin`,
+            i18nKey: action === "remove"
+                ? "tenant.errors.cannotRemoveLastTenantAdmin"
+                : "tenant.errors.cannotDemoteLastTenantAdmin",
             details: {
                 reason: TenantErrors.lastTenantAdmin,
                 userId,

package/dist/tenant/membership-table.d.ts

@@ -9,6 +9,7 @@ export declare const tenantMembershipEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const tenantMembershipEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -51,6 +53,7 @@ export declare const tenantMembershipsTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -71,6 +74,7 @@ export declare const tenantMembershipsTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/tenant/schema/tenant.d.ts

@@ -11,6 +11,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -31,6 +32,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -63,7 +65,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
             readonly destroying?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -92,6 +94,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -159,6 +162,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -179,6 +183,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -211,7 +216,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
             readonly destroying?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -240,6 +245,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/tenant/seeding.d.ts

@@ -38,6 +38,10 @@ export declare function fireEntityPostSave(hooks: SeedTenantHooks | undefined, p
  * a second call for the same `id` is a no-op (no update path). Same
  * TX-semantics as the real `TenantHandlers.create`, minus the SystemAdmin-
  * access-check and minus ConflictError-on-duplicate.
+ *
+ * `hooks` run only for the call that actually creates the tenant: a call that
+ * finds the tenant/stream already present (or loses a concurrent create race)
+ * returns without firing postSave.
  */
 export declare function seedTenant(db: DbRunner, options: SeedTenantOptions, hooks?: SeedTenantHooks): Promise<{
     id: TenantId;

package/dist/tenant/seeding.js

@@ -124,6 +124,10 @@ target) {
  * a second call for the same `id` is a no-op (no update path). Same
  * TX-semantics as the real `TenantHandlers.create`, minus the SystemAdmin-
  * access-check and minus ConflictError-on-duplicate.
+ *
+ * `hooks` run only for the call that actually creates the tenant: a call that
+ * finds the tenant/stream already present (or loses a concurrent create race)
+ * returns without firing postSave.
  */
 export async function seedTenant(db, options, hooks) {
     const by = options.by ?? TestUsers.systemAdmin;
@@ -146,8 +150,11 @@ export async function seedTenant(db, options, hooks) {
     const result = await tenantExecutor.create({ id: options.id, key: options.key, name: options.name }, by, tdb);
     if (!result.isSuccess) {
         // Same idempotency case as the stream-version check above, only detected
-        // one instruction later: a dispatcher cycle appended to the stream between
-        // that read and this create. Both paths return without firing postSave.
+        // one instruction later: a concurrent writer (e.g. a parallel seedTenant
+        // for the same id) created the stream between the version read above and
+        // this create; the executor confines the failed append to a savepoint, so
+        // the surrounding TX stays usable. Both paths return without firing
+        // postSave — hooks only run for the call that actually created the tenant.
         if (result.error.code === "version_conflict")
             return { id: options.id };
         throw new Error(`seedTenant failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`);

package/dist/tenant-lifecycle/boot-checks.d.ts

@@ -1,2 +1,3 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export declare function validateTenantDataHookCoverage(features: readonly FeatureDefinition[]): void;
+export declare function validateTenantDestroyHookShapes(features: readonly FeatureDefinition[]): void;

package/dist/tenant-lifecycle/boot-checks.js

@@ -1,4 +1,4 @@
-import { EXT_TENANT_DATA, } from "@cosmicdrift/kumiko-framework/engine";
+import { EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, isTenantDataExtensionHooks, isTenantResourceExtensionHooks, } from "@cosmicdrift/kumiko-framework/engine";
 import { entitiesOf } from "../shared/index.js";
 // V4: tenantOwned-entity-without-hook gate. Mirrors user-data-rights' V3
 // (validateGdprPiiHookCoverage) but for EXT_TENANT_DATA. Registered as this
@@ -34,3 +34,29 @@ export function validateTenantDataHookCoverage(features) {
         }
     }
 }
+const TENANT_RESOURCE_EXTENSIONS = new Set([
+    EXT_STORAGE_PROVIDER,
+    EXT_SEARCH_ADAPTER,
+    EXT_EXTERNAL_RESOURCE,
+    EXT_INFRA_RESOURCE,
+]);
+// Malformed destroy registrations would otherwise only throw when a tenant
+// destruction reaches the stage, possibly months after deploy, and stall the
+// whole pipeline (stages.ts keeps its own throw as defense in depth). JS
+// plugins and `as` casts slip past the type check.
+export function validateTenantDestroyHookShapes(features) {
+    for (const feature of features) {
+        for (const usage of feature.extensionUsages) {
+            const isTenantData = usage.extensionName === EXT_TENANT_DATA;
+            if (!isTenantData && !TENANT_RESOURCE_EXTENSIONS.has(usage.extensionName))
+                continue;
+            const isValid = isTenantData
+                ? isTenantDataExtensionHooks(usage.options)
+                : isTenantResourceExtensionHooks(usage.options);
+            if (isValid)
+                continue;
+            const requiredFn = isTenantData ? "destroy" : "destroyTenant";
+            throw new Error(`[kumiko:boot] ${usage.extensionName} registration for "${usage.entityName}" (feature "${feature.name}") has no ${requiredFn} function — tenant destroy would fail at this stage.`);
+        }
+    }
+}

package/dist/tenant-lifecycle/feature.js

@@ -1,5 +1,5 @@
 import { defineFeature, EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, EXT_TENANT_LIFECYCLE_STATUS, } from "@cosmicdrift/kumiko-framework/engine";
-import { validateTenantDataHookCoverage } from "./boot-checks.js";
+import { validateTenantDataHookCoverage, validateTenantDestroyHookShapes } from "./boot-checks.js";
 import { DESTRUCTION_CANCELLED_EVENT_SHORT, DESTRUCTION_REQUESTED_EVENT_SHORT, TENANT_DESTRUCTION_COMPLETED_EVENT_SHORT, TENANT_DESTRUCTION_FAILED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT, TENANT_DESTRUCTION_STARTED_EVENT_SHORT, } from "./constants.js";
 import { destructionCancelledSchema, destructionRequestedSchema, tenantDestructionCompletedSchema, tenantDestructionFailedSchema, tenantDestructionStageAbandonedSchema, tenantDestructionStageFailedSchema, tenantDestructionStageStartedSchema, tenantDestructionStageSucceededSchema, tenantDestructionStartedSchema, } from "./events.js";
 import { cancelDestructionWrite } from "./handlers/cancel-destruction.write.js";
@@ -36,6 +36,7 @@ export function createTenantLifecycleFeature() {
         // EXT_TENANT_DATA: its own mount is the trigger, matching the original
         // guard's "tenant-lifecycle mounted" gate exactly.
         r.bootCheck(({ features }) => validateTenantDataHookCoverage(features));
+        r.bootCheck(({ features }) => validateTenantDestroyHookShapes(features));
         r.defineEvent(DESTRUCTION_REQUESTED_EVENT_SHORT, destructionRequestedSchema, {
             piiFields: "none",
         });

package/dist/tenant-lifecycle/stages.js

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, extensionUsageEscapeHatchReason, isTenantDataExtensionHooks, isTenantResourceExtensionHooks, } from "@cosmicdrift/kumiko-framework/engine";
-import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
+import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantEntity, tenantMembershipEntity, tenantMembershipsTable, tenantTable, } from "../tenant/index.js";
 import { invalidateTenantLifecycleGate } from "./lifecycle-gate.js";
@@ -30,7 +30,7 @@ async function runTenantDataHooks(ctx) {
         const report = createEscapeHatchReporter({
             handler: `${EXT_TENANT_DATA}:${usage.entityName}`,
             tenantId: ctx.tenantId,
-            actor: ctx.actor ?? "system",
+            actor: ctx.actor ?? UNATTRIBUTED_ACTOR,
             sink: ctx.escapeHatchAuditSink,
         });
         const hookCtx = {

package/dist/tenant-settings/feature.js

@@ -21,21 +21,24 @@ export function createTenantSettingsFeature(opts = {}) {
         r.config({ keys: buildTenantSettingsKeys(opts) });
         r.translations({
             keys: {
-                "tenant-settings.currency": { en: "Default Currency" },
-                "tenant-settings.locale": { en: "Default Locale" },
+                "tenant-settings.currency": { en: "Default currency" },
+                "tenant-settings.locale": { en: "Default locale" },
                 // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
                 // required by the i18n boot-validator whenever a feature masks config keys.
-                "screen:tenant-settings-system.title": { en: "Tenant Settings" },
-                "screen:tenant-settings-tenant.title": { en: "Tenant Settings" },
+                "screen:tenant-settings-system.title": { en: "Tenant defaults" },
+                "screen:tenant-settings-tenant.title": { en: "Tenant settings" },
                 // Settings-Hub nav label + configEdit section heading (same key, both
                 // scopes fall back here — see buildConfigFeatureSchema).
-                "tenant-settings.settings": { en: "Tenant Settings" },
+                "tenant-settings.settings": { en: "Tenant settings" },
+                // Section heading below the page title (the page title is the same words as
+                // `.settings`, which RenderEdit would drop as a repeat).
+                "tenant-settings.settings.section": { en: "Currency and language" },
                 // Both currency/locale are tenant-home with admin write access, which
                 // cascades a SystemAdmin-only "set the platform default" screen up to
                 // the system audience — scoped override so its nav entry reads
                 // differently from the tenant-home entry instead of repeating the
                 // same words under both "Platform" and "Organization".
-                "tenant-settings.settings.system": { en: "Tenant Settings (Platform Default)" },
+                "tenant-settings.settings.system": { en: "Tenant defaults" },
             },
         });
     });

package/dist/tier-engine/entity.d.ts

@@ -9,6 +9,7 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/tier-engine/feature.js

@@ -129,11 +129,12 @@ export function createTierEngineFeature(opts = {}) {
         // Standard-CRUD via Helper.
         r.writeHandler(defineEntityCreateHandler("tier-assignment", tierAssignmentEntity, {
             ...writeAccess,
-            description: "Creates the tier-assignment row of the caller's tenant with a tier name and its source; prefer `set-tenant-tier`, which upserts and refreshes the feature gate.",
+            // Bypasses the feature-gate refresh that set-tenant-tier performs.
+            agent: { expose: false },
         }));
         r.writeHandler(defineEntityUpdateHandler("tier-assignment", tierAssignmentEntity, {
             ...writeAccess,
-            description: "Updates an existing tier-assignment row by id; prefer `set-tenant-tier`, which resolves the tenant's row itself and refreshes the feature gate.",
+            agent: { expose: false },
         }));
         // Reads.
         r.queryHandler(defineEntityListHandler("tier-assignment", tierAssignmentEntity, {

package/dist/tier-engine/tier-resolver.d.ts

@@ -17,6 +17,7 @@ export declare function createTierResolver<TTier extends string, TCaps>(deps: Ti
             readonly filterable?: boolean;
             readonly encrypted?: boolean;
             readonly sensitive?: boolean;
+            readonly writeOnly?: boolean;
             readonly readAsInstruction?: boolean;
             readonly format?: "email" | "url" | "phone" | "password";
             readonly default?: string;
@@ -37,6 +38,7 @@ export declare function createTierResolver<TTier extends string, TCaps>(deps: Ti
             readonly filterable?: boolean;
             readonly encrypted?: boolean;
             readonly sensitive?: boolean;
+            readonly writeOnly?: boolean;
             readonly readAsInstruction?: boolean;
             readonly format?: "email" | "url" | "phone" | "password";
             readonly default?: string;

package/dist/user/command-schemas.d.ts

@@ -3,7 +3,7 @@ export declare const UserCommandSchemas: {
         email: import("zod").ZodEmail;
         passwordHash: import("zod").ZodOptional<import("zod").ZodString>;
         displayName: import("zod").ZodString;
-        locale: import("zod").ZodOptional<import("zod").ZodString>;
+        locale: import("zod").ZodOptional<import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<string, string>>>;
         timezone: import("zod").ZodOptional<import("zod").ZodString>;
         roles: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodArray<import("zod").ZodString>, import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<string[], string>>]>>;
     }, import("zod/v4/core").$strip>;
@@ -12,7 +12,7 @@ export declare const UserCommandSchemas: {
         version: import("zod").ZodNumber;
         changes: import("zod").ZodObject<{
             displayName: import("zod").ZodOptional<import("zod").ZodString>;
-            locale: import("zod").ZodOptional<import("zod").ZodString>;
+            locale: import("zod").ZodOptional<import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<string, string>>>;
             timezone: import("zod").ZodOptional<import("zod").ZodString>;
             email: import("zod").ZodOptional<import("zod").ZodEmail>;
             passwordHash: import("zod").ZodOptional<import("zod").ZodString>;

package/dist/user/handlers/create.write.d.ts

@@ -3,7 +3,7 @@ export declare const createWrite: import("@cosmicdrift/kumiko-types/define-handl
     email: z.ZodEmail;
     passwordHash: z.ZodOptional<z.ZodString>;
     displayName: z.ZodString;
-    locale: z.ZodOptional<z.ZodString>;
+    locale: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     timezone: z.ZodOptional<z.ZodString>;
     roles: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>]>>;
 }, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/user/handlers/create.write.js

@@ -2,7 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, findForbiddenRoleAssignment, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, ConflictError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
-import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
+import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -28,7 +28,13 @@ export const createWrite = defineWriteHandler({
         email: z.email(),
         passwordHash: z.string().optional(),
         displayName: z.string().min(1).max(100),
-        locale: z.string().min(2).max(10).refine(isValidLocaleTag, "invalid locale tag").optional(),
+        locale: z
+            .string()
+            .min(2)
+            .max(10)
+            .refine(isValidLocaleTag, "invalid locale tag")
+            .transform(canonicalizeLocaleTag)
+            .optional(),
         timezone: z.string().max(64).refine(isValidIanaTimeZone, "invalid IANA time zone").optional(),
         // Field-level write access (privileged) is defense-in-depth — create is
         // already system/SystemAdmin-only.

package/dist/user/handlers/update.write.d.ts

@@ -4,7 +4,7 @@ export declare const updateWrite: import("@cosmicdrift/kumiko-types/define-handl
     version: z.ZodNumber;
     changes: z.ZodObject<{
         displayName: z.ZodOptional<z.ZodString>;
-        locale: z.ZodOptional<z.ZodString>;
+        locale: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
         timezone: z.ZodOptional<z.ZodString>;
         email: z.ZodOptional<z.ZodEmail>;
         passwordHash: z.ZodOptional<z.ZodString>;

package/dist/user/handlers/update.write.js

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, hasAccess } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
-import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
+import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { UserErrors } from "../constants.js";
@@ -24,7 +24,13 @@ export const updateWrite = defineWriteHandler({
         version: z.number(),
         changes: z.object({
             displayName: z.string().min(1).max(100).optional(),
-            locale: z.string().min(2).max(10).refine(isValidLocaleTag, "invalid locale tag").optional(),
+            locale: z
+                .string()
+                .min(2)
+                .max(10)
+                .refine(isValidLocaleTag, "invalid locale tag")
+                .transform(canonicalizeLocaleTag)
+                .optional(),
             timezone: z.string().max(64).refine(isValidIanaTimeZone, "invalid IANA time zone").optional(),
             email: z.email().optional(),
             passwordHash: z.string().optional(),

package/dist/user/schema/user.d.ts

@@ -38,6 +38,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -58,6 +59,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -78,6 +80,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -98,6 +101,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -127,6 +131,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -159,7 +164,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
             readonly restricted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -188,6 +193,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -210,6 +216,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -230,6 +237,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -250,6 +258,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -270,6 +279,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -299,6 +309,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -331,7 +342,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
             readonly restricted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -360,6 +371,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/user-data-rights/db/queries/export-jobs.d.ts

@@ -8,5 +8,7 @@ export type ExportJobCleanupCandidate = {
     readonly requestedFromTenantId: TenantId;
     readonly downloadStorageKey: string | null;
     readonly expiresAt: Temporal.Instant | null;
+    readonly completedAt: Temporal.Instant | null;
+    readonly startedAt: Temporal.Instant | null;
 };
 export declare function selectExportJobsForStorageCleanup(db: DbConnection, doneStatus: string, failedStatus: string): Promise<readonly ExportJobCleanupCandidate[]>;

package/dist/user-data-rights/feature.js

@@ -25,7 +25,7 @@ import { isMailTransportAvailable, makeDefaultDeletionExecutedEmail, makeDefault
 import { makeTenantMailTransportResolver } from "./lib/mail-transport-resolver.js";
 import { resolveAppTenantModel } from "./lib/resolve-tenant-model.js";
 import { makeTenantStorageProviderResolver } from "./lib/storage-provider-resolver.js";
-import { EXPORT_CLEANUP_BACKLOG_AGE_METRIC, runExportJobs, } from "./run-export-jobs.js";
+import { EXPORT_CLEANUP_BACKLOG_AGE_METRIC, EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC, runExportJobs, } from "./run-export-jobs.js";
 import { runForgetCleanup, sanitizeReasonForLog, } from "./run-forget-cleanup.js";
 import { downloadAttemptEntity } from "./schema/download-attempt.js";
 import { exportDownloadTokenEntity } from "./schema/download-token.js";
@@ -156,12 +156,18 @@ export function createUserDataRightsFeature(opts = {}) {
                 "userDataRights.privacyCenter.field.gracePeriodEnd": { en: "Scheduled deletion date" },
                 "userDataRights.privacyCenter.export.title": { en: "Export your data (Art. 20)" },
                 "userDataRights.privacyCenter.restriction.title": { en: "Restrict processing (Art. 18)" },
+                "userDataRights.privacyCenter.restriction.explainer": {
+                    en: "Freeze your account: processing of your data is paused and you are signed out. Lifting the restriction afterwards is only possible via support.",
+                },
                 "userDataRights.privacyCenter.restriction.restrict": { en: "Restrict account" },
                 "userDataRights.privacyCenter.restriction.dialogTitle": { en: "Restrict your account?" },
                 "userDataRights.privacyCenter.restriction.dialogDescription": {
                     en: "You will be signed out immediately and cannot sign in again until support lifts the restriction.",
                 },
                 "userDataRights.privacyCenter.deletion.title": { en: "Delete account (Art. 17)" },
+                "userDataRights.privacyCenter.deletion.explainer": {
+                    en: "Request deletion of your account. Until the grace period ends you can cancel the deletion.",
+                },
                 "userDataRights.privacyCenter.deletion.delete": { en: "Delete account" },
                 "userDataRights.privacyCenter.deletion.cancel": { en: "Cancel deletion" },
                 "userDataRights.privacyCenter.deletion.dialogTitle": { en: "Delete your account?" },
@@ -215,7 +221,7 @@ export function createUserDataRightsFeature(opts = {}) {
                         // when `showDeletion` is false, and status covers restriction
                         // AND deletion state, so it can't hang off the optional section.
                         title: i18nKey("userDataRights.privacyCenter.restriction.title"),
-                        description: "userDataRights.privacyCenter.restriction.explainer",
+                        description: i18nKey("userDataRights.privacyCenter.restriction.explainer"),
                         fields: [
                             {
                                 field: "status",
@@ -227,7 +233,7 @@ export function createUserDataRightsFeature(opts = {}) {
                         ? [
                             {
                                 title: i18nKey("userDataRights.privacyCenter.deletion.title"),
-                                description: "userDataRights.privacyCenter.deletion.explainer",
+                                description: i18nKey("userDataRights.privacyCenter.deletion.explainer"),
                                 // gracePeriodEnd is only meaningful once a deletion is
                                 // actually pending — hide it instead of showing an empty
                                 // date when status isn't deletionRequested.
@@ -269,6 +275,8 @@ export function createUserDataRightsFeature(opts = {}) {
                             handler: UserDataRightsHandlers.cancelDeletion,
                             visible: { field: "status", eq: "deletionRequested" },
                             style: "secondary",
+                            // Declared: the id's last segment ("deletion") would otherwise resolve to the destructive trash icon.
+                            icon: "x",
                         },
                     ]
                     : []),
@@ -372,15 +380,20 @@ export function createUserDataRightsFeature(opts = {}) {
         // Surfaces a stalled export-cleanup cron: if the daily
         // pass stops running, done-status export bundles keep sitting in
         // storage past their TTL+grace with downloadStorageKey still set
-        // (unencrypted PII at rest). Emitted from the same job that cleans up
-        // (see handler below) — a dead cron makes the metric go stale too,
-        // which an `absent()` alert catches without a second liveness signal.
-        // Scope: Done-status bundles only — Failed-status cleanup candidates
-        // have no expiresAt/TTL (immediate cleanup, see storageCleanupPass).
+        // (unencrypted PII at rest). Gauges keep their last value in-process, so
+        // a dead cron does NOT make the backlog gauge absent; the last-run
+        // timestamp gauge below is the liveness signal.
+        // Scope: Done-status bundles past expiresAt+grace plus Failed-status
+        // orphans (no TTL, due from completedAt ?? startedAt; see storageCleanupPass).
         r.metric(EXPORT_CLEANUP_BACKLOG_AGE_METRIC, {
             type: "gauge",
             unit: "seconds",
-            description: "Age in seconds of the oldest done-status export bundle whose expiresAt+grace has passed but downloadStorageKey is still set. 0 when the storage-cleanup pass has no backlog.",
+            description: "Age in seconds of the oldest export bundle (done: expiresAt+grace passed; failed: orphaned ZIP since completedAt or startedAt) whose downloadStorageKey is still set. 0 when the storage-cleanup pass has no backlog.",
+        });
+        r.metric(EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC, {
+            type: "gauge",
+            unit: "seconds",
+            description: "Unix timestamp of the last export storage-cleanup pass that completed. Alert on time() minus this value exceeding the cron interval plus a buffer; the backlog-age gauge alone stays at its last value when the cron stops.",
         });
         // S2.U3 Atom 3b — Worker fuer Async Export-Pipeline. Cron-getriggert.
         const RUN_EXPORT_JOBS_REASON = "processes pending export jobs across every tenant";