@cosmicdrift/kumiko-bundled-features 0.359.0 → 0.361.0

package/dist/audit/handlers/details.query.d.ts

@@ -11,7 +11,7 @@ export declare const detailsQuery: import("@cosmicdrift/kumiko-types/define-hand
     aggregateType: string;
     version: number;
     type: string;
-    payload: Record<string, unknown>;
+    payload: unknown;
     metadata: Record<string, unknown>;
     createdAt: unknown;
     createdBy: string;

package/dist/audit/handlers/details.query.js

@@ -6,6 +6,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import * as z from "zod";
+import { redactPiiCiphertext } from "../../shared/index.js";
 import { AUDIT_SCOPE_VALUES } from "../constants.js";
 import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
 export const detailsQuery = defineQueryHandler({
@@ -34,7 +35,7 @@ export const detailsQuery = defineQueryHandler({
             aggregateType: row.aggregateType,
             version: row.version,
             type: row.type,
-            payload: row.payload,
+            payload: redactPiiCiphertext(row.payload),
             metadata: row.metadata,
             createdAt: row.createdAt,
             createdBy: row.createdBy,

package/dist/audit/handlers/list.query.d.ts

@@ -29,7 +29,7 @@ export declare const listQuery: import("@cosmicdrift/kumiko-types/define-handler
         aggregateType: string;
         version: number;
         type: string;
-        payload: Record<string, unknown>;
+        payload: unknown;
         metadata: Record<string, unknown>;
         createdAt: unknown;
         createdBy: string;

package/dist/audit/handlers/list.query.js

@@ -9,15 +9,14 @@
 // A SystemAdmin can pass scope "system" to read the app-instance system events
 // (e.g. app.started); no other cross-tenant read exists.
 //
-// Sensitive field-values are ciphertext inside the event payload (the log
-// carries them encrypted); stripSensitive only strips the event echo. This
-// query returns payloads as stored, so a sensitive value surfaces as ciphertext,
-// never as plaintext.
+// Event payloads hold PII as subject-KMS ciphertext; it is replaced by
+// REDACTED_PII_PLACEHOLDER before returning, since the API leak guard refuses ciphertext.
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
+import { redactPiiCiphertext } from "../../shared/index.js";
 import { AUDIT_SCOPE_VALUES } from "../constants.js";
 import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
 const MAX_LIMIT = 100;
@@ -102,7 +101,7 @@ export const listQuery = defineQueryHandler({
             aggregateType: r.aggregateType,
             version: r.version,
             type: r.type,
-            payload: r.payload,
+            payload: redactPiiCiphertext(r.payload),
             metadata: r.metadata,
             createdAt: r.createdAt,
             createdBy: r.createdBy,

package/dist/auth-email-password/web/auth-client.d.ts

@@ -135,6 +135,8 @@ export type CurrentUserProfile = {
     readonly email: string;
     readonly displayName: string;
     readonly locale?: string;
+    /** Effective IANA zone (user override, else tenant, else UTC). */
+    readonly effectiveTimeZone?: string;
     readonly globalRoles: readonly string[];
 };
 export declare function fetchCurrentUser(): Promise<CurrentUserProfile | null>;

package/dist/auth-email-password/web/auth-client.js

@@ -295,6 +295,9 @@ export async function fetchCurrentUser() {
         email: body.data.email,
         displayName: body.data.displayName,
         ...(body.data.locale !== undefined && { locale: body.data.locale }),
+        ...(body.data.effectiveTimeZone !== undefined && {
+            effectiveTimeZone: body.data.effectiveTimeZone,
+        }),
         globalRoles: parseRoles(body.data.roles),
     };
 }

package/dist/auth-email-password/web/session.js

@@ -10,8 +10,8 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // unter `<SessionProvider>`; der `useSession()`-Hook liefert den State
 // und die Transitions.
 import { readCsrfToken } from "@cosmicdrift/kumiko-dispatcher-live";
-import { useSessionEndedSignal } from "@cosmicdrift/kumiko-renderer";
-import { createContext, useCallback, useContext, useEffect, useState } from "react";
+import { CurrentUserProvider, useSessionEndedSignal, } from "@cosmicdrift/kumiko-renderer";
+import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from "react";
 import { AuthRequestError, fetchCurrentUser, fetchTenants, login as loginApi, logout as logoutApi, switchTenant as switchTenantApi, } from "./auth-client.js";
 // Exported so screens that render on BOTH authenticated and anonymous public
 // routes (e.g. InviteAcceptScreen) can read `.status` without requiring a
@@ -154,7 +154,23 @@ export function SessionProvider({ children, postLogoutUrl, }) {
         }
     }, []);
     const api = { ...state, login, logout, switchTenant, refresh: doRefresh };
-    return _jsx(SessionContext.Provider, { value: api, children: children });
+    // Keyed on the primitives, not the profile object: every refresh (tenant
+    // switch, session bootstrap retry) builds a new profile object, and a new
+    // CurrentUser reference would re-seed a create form and drop typed input.
+    const profile = state.user;
+    const userId = profile?.id;
+    const userEmail = profile?.email;
+    const userDisplayName = profile?.displayName;
+    const userTimeZone = profile?.effectiveTimeZone;
+    const currentUser = useMemo(() => userId === undefined || userEmail === undefined || userDisplayName === undefined
+        ? undefined
+        : {
+            id: userId,
+            email: userEmail,
+            displayName: userDisplayName,
+            ...(userTimeZone !== undefined && { timeZone: userTimeZone }),
+        }, [userId, userEmail, userDisplayName, userTimeZone]);
+    return (_jsx(SessionContext.Provider, { value: api, children: _jsx(CurrentUserProvider, { user: currentUser, children: children }) }));
 }
 export function useSession() {
     const ctx = useContext(SessionContext);

package/dist/billing-foundation/consumer-protection/termination-pages.d.ts

@@ -1,4 +1,4 @@
-import type { AnonymousExtraRoute } from "@cosmicdrift/kumiko-framework/api";
+import { type AnonymousExtraRoute } from "@cosmicdrift/kumiko-framework/api";
 import { type PublicPageWrapLayout } from "../../page-render/index.js";
 import type { ConsentLocale } from "./consent-text.js";
 export type ContractTerminationRoutesOptions = {

package/dist/billing-foundation/consumer-protection/termination-pages.js

@@ -1,5 +1,6 @@
 // Public § 312k pages (/legal/kuendigen, /legal/cancel): form → review → confirm,
 // no JavaScript. Every echoed value goes through escapeHtml/escapeHtmlAttr.
+import { getSessionCookies } from "@cosmicdrift/kumiko-framework/api";
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { getCookie } from "hono/cookie";
 import { redirectToCanonicalPath, securePageHeaders, slashVariantOf, wrapInLayout, } from "../../page-render/index.js";
@@ -181,7 +182,6 @@ function resultPage(ctx, receivedAtIso, requestId) {
 }
 const RATE_LIMITED_CODE = "rate_limited";
 const TENANT_HEADER = "x-tenant";
-const TENANT_COOKIE = "kumiko_tenant";
 // Exactly what the anonymous tenant resolution reads. The resolver and its
 // trust rules still decide; the re-entry only sees what a direct /api/write
 // from this client would see. Never the session cookie or Authorization (the
@@ -200,9 +200,10 @@ function reentryHeaders(c) {
         if (value !== undefined)
             headers.set(name, value);
     }
-    const tenantCookie = getCookie(c, TENANT_COOKIE);
+    const tenantCookieName = getSessionCookies(c).names.tenant;
+    const tenantCookie = getCookie(c, tenantCookieName);
     if (tenantCookie !== undefined) {
-        headers.set("cookie", `${TENANT_COOKIE}=${encodeURIComponent(tenantCookie)}`);
+        headers.set("cookie", `${tenantCookieName}=${encodeURIComponent(tenantCookie)}`);
     }
     return headers;
 }

package/dist/cap-counter/index.d.ts

@@ -7,5 +7,6 @@ export { capCounterEntity } from "./entity.js";
 export { capCounterFeature } from "./feature.js";
 export { readPayloadField } from "./payload-field.js";
 export { type CapGuardContext, type CapLimitContext, createStockCapGuard, type StockCapGuard, type StockCapSpec, } from "./stock-cap-guard.js";
+export { capReservationsTable, capReservationsTableMeta } from "./tables.js";
 export { createValueCapGuard, type ValueCapGuard, type ValueCapSpec, } from "./value-cap-guard.js";
 export { type CalendarCapDef, type CalendarCapResolver, type RollingCapDef, type RollingCapResolver, withCapEnforcement, withRollingCapEnforcement, } from "./with-cap-enforcement.js";

package/dist/cap-counter/index.js

@@ -8,5 +8,6 @@ export { capCounterEntity } from "./entity.js";
 export { capCounterFeature } from "./feature.js";
 export { readPayloadField } from "./payload-field.js";
 export { createStockCapGuard, } from "./stock-cap-guard.js";
+export { capReservationsTable, capReservationsTableMeta } from "./tables.js";
 export { createValueCapGuard, } from "./value-cap-guard.js";
 export { withCapEnforcement, withRollingCapEnforcement, } from "./with-cap-enforcement.js";

package/dist/data-retention/run-retention-cleanup.js

@@ -39,7 +39,7 @@
 // einzelnen Page — sonst verstopfen erledigte Rows das batchLimit-Fenster.
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { collectPiiSubjectFields, configuredPiiSubjectKms, isSelfPiiField, resolveSubjectForField, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, entityHasAnonymizableSubjectField, } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefEntity, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
@@ -149,7 +149,7 @@ async function forgetRowAndEraseKeys(args) {
 }
 const NO_FILE_FIELDS = { singleFields: [], multiFields: [] };
 // file/image = single-column fields (fileRef-id lives directly in the entity
-// row); files/images = plural, no column, resolved via file_refs. Same set
+// row); files/images = plural, resolved via file_refs. Same set
 // as boot-validator/entity-handler.ts FILE_FIELD_TYPES and engine's
 // isFileField — inlined here rather than importing across the package
 // barrel since this module already needs the single/multi split, not just
@@ -169,8 +169,8 @@ function planFileFields(fields) {
         : NO_FILE_FIELDS;
 }
 // Every fileRef-id a row's file/image/files/images-fields reference: single
-// fields hold the id in their own column, plural fields have no column and
-// resolve via file_refs (tenantId, entityType, entityId, fieldName).
+// fields hold the id in their own column, plural fields resolve
+// via file_refs (tenantId, entityType, entityId, fieldName).
 async function collectFileRefIds(db, tenantId, entityName, row, plan) {
     const ids = new Set();
     for (const field of plan.singleFields) {
@@ -536,7 +536,7 @@ export async function runRetentionCleanup(args) {
                     break;
                 }
                 const executor = createEventStoreExecutor(proj.table, entity, { entityName });
-                softDeleted += await purgeMatchingRows(db, proj.table, { ...where, isDeleted: false }, batchLimit, (id) => executor.delete({ id }, systemUser, tdb));
+                softDeleted += await purgeMatchingRows(db, proj.table, { ...where, isDeleted: false }, batchLimit, (id) => executor.delete({ id }, systemUser, tdb, { writePurpose: WritePurposes.retention }));
                 break;
             }
             // blockDelete = Legal-Hold: rows stay untouched during keepFor (the
@@ -560,7 +560,10 @@ export async function runRetentionCleanup(args) {
                     break;
                 }
                 const executor = createEventStoreExecutor(proj.table, entity, { entityName });
-                anonymized += await anonymizeMatchingRows(db, proj.table, where, batchLimit, targets, (id, changes) => executor.update({ id, changes }, systemUser, tdb, { skipOptimisticLock: true }));
+                anonymized += await anonymizeMatchingRows(db, proj.table, where, batchLimit, targets, (id, changes) => executor.update({ id, changes }, systemUser, tdb, {
+                    skipOptimisticLock: true,
+                    writePurpose: WritePurposes.retention,
+                }));
                 break;
             }
         }

package/dist/folders-user-data/hooks.js

@@ -3,6 +3,7 @@
 // consumers without the user-data-rights pipeline don't pull a hard dependency.
 // Mirrors credit-user-data — standard tenant-scoped pattern, no name-stripping
 // (a folder name is tenant data, not per-user PII).
+import { WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createEntityExecutor, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { folderAssignmentEntity, folderEntity } from "../folders/index.js";
 const { table: folderTable, executor: folderExecutor } = createEntityExecutor("folder", folderEntity);
@@ -48,7 +49,9 @@ function tenantScopedDelete(table, executor) {
         const systemUser = createSystemUser(ctx.tenantId);
         const rows = await ctx.db.selectMany(table, { tenantId: ctx.tenantId });
         for (const row of rows) {
-            await executor.delete({ id: row.id }, systemUser, ctx.db);
+            await executor.delete({ id: row.id }, systemUser, ctx.db, {
+                writePurpose: WritePurposes.erasure,
+            });
         }
     };
 }

package/dist/form-draft-user-data/hooks.js

@@ -2,6 +2,7 @@
 // (GDPR Art. 20 export / Art. 17 erasure). Lives apart from form-draft so
 // consumers without the user-data-rights pipeline don't pull a hard
 // dependency.
+import { WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { formDraftExecutor, formDraftTable } from "../form-draft/index.js";
 export const formDraftExportHook = async (ctx) => {
@@ -36,7 +37,9 @@ export const formDraftDeleteHook = async (ctx) => {
     const systemUser = createSystemUser(ctx.tenantId);
     const failures = [];
     for (const row of rows) {
-        const result = await formDraftExecutor.delete({ id: row.id }, systemUser, ctx.db);
+        const result = await formDraftExecutor.delete({ id: row.id }, systemUser, ctx.db, {
+            writePurpose: WritePurposes.erasure,
+        });
         if (!result.isSuccess) {
             failures.push(`${row.id}: ${result.error.message}`);
         }

package/dist/jobs/job-run-logger.js

@@ -101,6 +101,8 @@ async function encryptStartedPayload(payload, triggeredById) {
 // pg_advisory_xact_lock namespace (int4): 'tjfl' as ASCII, disjoint from the
 // framework's other fixed advisory-lock keys.
 const TENANT_JOB_FAILURE_LOCK_NAMESPACE = 0x746a666c;
+// 'tjrl': serialises the finished-row write + prune per tenant run key.
+const TENANT_JOB_RUN_LOCK_NAMESPACE = 0x746a726c;
 // fw#3079 — which row the tenant-visible failure record lives in: one per
 // (tenant, job, subject), so the next outcome of the same work replaces or
 // clears it. `subject` is null for a job that declares no subjectFields.
@@ -188,11 +190,18 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
         // skip: retry pending, the row stays active until the final attempt
         return;
     }
-    await upsertOnConflict(db, tenantJobRunsTable, { ...key, bullJobId, status: result, finishedAt: now, updatedAt: now }, { conflictKeys: ["bullJobId"], update: { status: result, finishedAt: now, updatedAt: now } });
-    await deleteMany(db, tenantJobRunsTable, {
-        ...key,
-        status: { in: ["completed", "failed"] },
-        bullJobId: { ne: bullJobId },
+    // One transaction: a reader never sees the new finished row next to the
+    // one it replaces. The per-key lock keeps two runs of the same subject that
+    // finish together from each missing the other's uncommitted row and leaving
+    // both behind.
+    await transaction(db, async (tx) => {
+        await acquireNamespacedAdvisoryLock(tx, TENANT_JOB_RUN_LOCK_NAMESPACE, JSON.stringify([key.tenantId, key.jobName, key.subject]));
+        await upsertOnConflict(tx, tenantJobRunsTable, { ...key, bullJobId, status: result, finishedAt: now, updatedAt: now }, { conflictKeys: ["bullJobId"], update: { status: result, finishedAt: now, updatedAt: now } });
+        await deleteMany(tx, tenantJobRunsTable, {
+            ...key,
+            status: { in: ["completed", "failed"] },
+            bullJobId: { ne: bullJobId },
+        });
     });
 }
 async function dropTenantRunQueued(db, bullJobId) {

package/dist/renderer-pdf/feature.d.ts

@@ -0,0 +1,4 @@
+import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type RenderRequest, type RenderResponse } from "../renderer-foundation/index.js";
+export declare function renderTablePdfRequest(req: RenderRequest): Promise<RenderResponse>;
+export declare function createRendererPdfFeature(): FeatureDefinition;

package/dist/renderer-pdf/feature.js

@@ -0,0 +1,32 @@
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { RENDERER_EXTENSION, RendererError, } from "../renderer-foundation/index.js";
+import { pdfTableDocumentSchema, renderTablePdf } from "./render-table-pdf.js";
+export async function renderTablePdfRequest(req) {
+    if (req.kind !== "document-pdf") {
+        throw new RendererError(`renderer-pdf supports only kind="document-pdf", got "${req.kind}"`, "invalid_payload");
+    }
+    const parsed = pdfTableDocumentSchema.safeParse(req.payload.variables);
+    if (!parsed.success) {
+        throw new RendererError(`renderer-pdf: payload.variables is not a table document: ${parsed.error.message}`, "invalid_payload");
+    }
+    const { pdfBytes, pageCount } = await renderTablePdf(parsed.data, {
+        ...(req.options?.format && { format: req.options.format }),
+        ...(req.options?.marginMm && { marginMm: req.options.marginMm }),
+    });
+    return { kind: "document-pdf", pdfBytes, pageCount, sizeBytes: pdfBytes.byteLength };
+}
+export function createRendererPdfFeature() {
+    return defineFeature("renderer-pdf", (r) => {
+        r.describe('Renderer plugin for `kind="document-pdf"` that draws a table document (title, meta lines, weighted columns, repeating header, page footer) as a PDF in pure JavaScript, without a browser or Puppeteer service. `payload.variables` must be a `PdfTableDocument`. Requires `renderer-foundation`; mount a Puppeteer-based plugin instead when you need HTML/CSS layouts.');
+        r.uiHints({
+            displayLabel: "Renderer · PDF tables",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires("renderer-foundation");
+        r.useExtension(RENDERER_EXTENSION, "pdf", {
+            kinds: ["document-pdf"],
+            render: (req) => renderTablePdfRequest(req),
+        });
+    });
+}

package/dist/renderer-pdf/index.d.ts

@@ -0,0 +1,2 @@
+export { createRendererPdfFeature } from "./feature.js";
+export { type PdfTableColumn, type PdfTableDocument, type PdfTableOptions, type PdfTableResult, pdfTableDocumentSchema, renderTablePdf, } from "./render-table-pdf.js";

package/dist/renderer-pdf/index.js

@@ -0,0 +1,2 @@
+export { createRendererPdfFeature } from "./feature.js";
+export { pdfTableDocumentSchema, renderTablePdf, } from "./render-table-pdf.js";

package/dist/renderer-pdf/render-table-pdf.d.ts

@@ -0,0 +1,54 @@
+import * as z from "zod";
+export declare const pdfTableDocumentSchema: z.ZodObject<{
+    title: z.ZodString;
+    subtitle: z.ZodOptional<z.ZodString>;
+    meta: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        label: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strip>>>;
+    columns: z.ZodArray<z.ZodObject<{
+        header: z.ZodString;
+        weight: z.ZodOptional<z.ZodNumber>;
+        align: z.ZodOptional<z.ZodEnum<{
+            left: "left";
+            right: "right";
+        }>>;
+    }, z.core.$strip>>;
+    rows: z.ZodArray<z.ZodArray<z.ZodString>>;
+    emptyText: z.ZodOptional<z.ZodString>;
+    footerText: z.ZodOptional<z.ZodString>;
+    pageLabel: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type PdfTableColumn = {
+    readonly header: string;
+    readonly weight?: number;
+    readonly align?: "left" | "right";
+};
+export type PdfTableDocument = {
+    readonly title: string;
+    readonly subtitle?: string;
+    readonly meta?: readonly {
+        readonly label: string;
+        readonly value: string;
+    }[];
+    readonly columns: readonly PdfTableColumn[];
+    readonly rows: readonly (readonly string[])[];
+    readonly emptyText?: string;
+    readonly footerText?: string;
+    /** Template with `{page}` and `{pages}`; default `"{page} / {pages}"`. */
+    readonly pageLabel?: string;
+};
+export type PdfTableOptions = {
+    readonly format?: "A4" | "Letter";
+    readonly marginMm?: {
+        readonly top?: number;
+        readonly right?: number;
+        readonly bottom?: number;
+        readonly left?: number;
+    };
+};
+export type PdfTableResult = {
+    readonly pdfBytes: Uint8Array;
+    readonly pageCount: number;
+};
+export declare function renderTablePdf(doc: PdfTableDocument, options?: PdfTableOptions): Promise<PdfTableResult>;

package/dist/renderer-pdf/render-table-pdf.js

@@ -0,0 +1,274 @@
+import { PDFDocument, rgb, StandardFonts } from "pdf-lib";
+import * as z from "zod";
+import { RendererError } from "../renderer-foundation/index.js";
+export const pdfTableDocumentSchema = z.object({
+    title: z.string(),
+    subtitle: z.string().optional(),
+    meta: z.array(z.object({ label: z.string(), value: z.string() })).optional(),
+    columns: z
+        .array(z.object({
+        header: z.string(),
+        weight: z.number().positive().optional(),
+        align: z.enum(["left", "right"]).optional(),
+    }))
+        .min(1),
+    rows: z.array(z.array(z.string())),
+    emptyText: z.string().optional(),
+    footerText: z.string().optional(),
+    pageLabel: z.string().optional(),
+});
+const POINTS_PER_MM = 72 / 25.4;
+const PAGE_SIZE_POINTS = {
+    A4: { width: 595.28, height: 841.89 },
+    Letter: { width: 612, height: 792 },
+};
+const DEFAULT_MARGIN_MM = { top: 18, right: 15, bottom: 18, left: 15 };
+const TITLE_SIZE = 16;
+const SUBTITLE_SIZE = 11;
+const BODY_SIZE = 9;
+const FOOTER_SIZE = 8;
+const LINE_HEIGHT_FACTOR = 1.3;
+const CELL_PADDING_X = 4;
+const CELL_PADDING_Y = 3;
+const FOOTER_RESERVE = 16;
+const META_LABEL_GAP = 10;
+const BLOCK_GAP = 10;
+const REPLACEMENT_CHAR = "?";
+const ELLIPSIS = "...";
+const TEXT_COLOR = rgb(0.1, 0.1, 0.1);
+const MUTED_COLOR = rgb(0.4, 0.4, 0.4);
+const HEADER_FILL = rgb(0.92, 0.93, 0.95);
+const RULE_COLOR = rgb(0.8, 0.8, 0.82);
+function lineHeightFor(size) {
+    return size * LINE_HEIGHT_FACTOR;
+}
+function createEncodableText(font) {
+    const supported = new Set(font.getCharacterSet());
+    return (text) => {
+        let result = "";
+        for (const char of text.replace(/\t/g, " ")) {
+            const codePoint = char.codePointAt(0) ?? 0;
+            result += codePoint === 0x0a || supported.has(codePoint) ? char : REPLACEMENT_CHAR;
+        }
+        return result;
+    };
+}
+function breakLongWord(word, font, size, maxWidth) {
+    const pieces = [];
+    let current = "";
+    for (const char of word) {
+        if (current !== "" && font.widthOfTextAtSize(current + char, size) > maxWidth) {
+            pieces.push(current);
+            current = char;
+        }
+        else {
+            current += char;
+        }
+    }
+    if (current !== "")
+        pieces.push(current);
+    return pieces;
+}
+function wrapText(text, font, size, maxWidth) {
+    const lines = [];
+    for (const paragraph of text.split(/\r\n|\n|\r/)) {
+        let current = "";
+        for (const word of paragraph.split(" ").filter((w) => w !== "")) {
+            const candidate = current === "" ? word : `${current} ${word}`;
+            if (font.widthOfTextAtSize(candidate, size) <= maxWidth) {
+                current = candidate;
+                continue;
+            }
+            if (current !== "")
+                lines.push(current);
+            const pieces = font.widthOfTextAtSize(word, size) <= maxWidth
+                ? [word]
+                : breakLongWord(word, font, size, maxWidth);
+            lines.push(...pieces.slice(0, -1));
+            current = pieces[pieces.length - 1] ?? "";
+        }
+        lines.push(current);
+    }
+    return lines;
+}
+function fitSingleLine(text, font, size, maxWidth) {
+    if (font.widthOfTextAtSize(text, size) <= maxWidth)
+        return text;
+    let fitted = text;
+    while (fitted !== "" && font.widthOfTextAtSize(fitted + ELLIPSIS, size) > maxWidth) {
+        fitted = fitted.slice(0, -1);
+    }
+    return fitted + ELLIPSIS;
+}
+function resolveColumnWidths(columns, totalWidth) {
+    const totalWeight = columns.reduce((sum, column) => sum + (column.weight ?? 1), 0);
+    return columns.map((column) => (totalWidth * (column.weight ?? 1)) / totalWeight);
+}
+function assertRowShape(doc) {
+    doc.rows.forEach((row, index) => {
+        if (row.length !== doc.columns.length) {
+            throw new RendererError(`row ${index} has ${row.length} cells but the table has ${doc.columns.length} columns`, "invalid_payload");
+        }
+    });
+}
+export async function renderTablePdf(doc, options) {
+    if (doc.columns.length === 0) {
+        throw new RendererError("table needs at least one column", "invalid_payload");
+    }
+    assertRowShape(doc);
+    const pdf = await PDFDocument.create({ updateMetadata: false });
+    const fonts = {
+        regular: await pdf.embedFont(StandardFonts.Helvetica),
+        bold: await pdf.embedFont(StandardFonts.HelveticaBold),
+    };
+    const clean = createEncodableText(fonts.regular);
+    const pageSize = PAGE_SIZE_POINTS[options?.format ?? "A4"];
+    const margin = {
+        top: (options?.marginMm?.top ?? DEFAULT_MARGIN_MM.top) * POINTS_PER_MM,
+        right: (options?.marginMm?.right ?? DEFAULT_MARGIN_MM.right) * POINTS_PER_MM,
+        bottom: (options?.marginMm?.bottom ?? DEFAULT_MARGIN_MM.bottom) * POINTS_PER_MM,
+        left: (options?.marginMm?.left ?? DEFAULT_MARGIN_MM.left) * POINTS_PER_MM,
+    };
+    const contentWidth = pageSize.width - margin.left - margin.right;
+    const contentBottom = margin.bottom + FOOTER_RESERVE;
+    const columnWidths = resolveColumnWidths(doc.columns, contentWidth);
+    const bodyLineHeight = lineHeightFor(BODY_SIZE);
+    const rowSpaceOnEmptyPage = pageSize.height - margin.top - contentBottom;
+    if (rowSpaceOnEmptyPage < 4 * bodyLineHeight) {
+        throw new RendererError("margins leave no room for table rows", "invalid_payload");
+    }
+    const headerLines = doc.columns.map((column, index) => wrapText(clean(column.header), fonts.bold, BODY_SIZE, (columnWidths[index] ?? contentWidth) - 2 * CELL_PADDING_X));
+    const headerHeight = Math.max(...headerLines.map((lines) => lines.length)) * bodyLineHeight + 2 * CELL_PADDING_Y;
+    let page = pdf.addPage([pageSize.width, pageSize.height]);
+    let cursorY = pageSize.height - margin.top;
+    function drawLines(lines, font, size, left, width, topY, align, color = TEXT_COLOR) {
+        lines.forEach((line, index) => {
+            const lineWidth = font.widthOfTextAtSize(line, size);
+            const x = align === "right" ? left + width - lineWidth : left;
+            page.drawText(line, {
+                x,
+                y: topY - size - index * lineHeightFor(size),
+                size,
+                font,
+                color,
+            });
+        });
+    }
+    function drawIntroBlock() {
+        const titleLines = wrapText(clean(doc.title), fonts.bold, TITLE_SIZE, contentWidth);
+        drawLines(titleLines, fonts.bold, TITLE_SIZE, margin.left, contentWidth, cursorY, "left");
+        cursorY -= titleLines.length * lineHeightFor(TITLE_SIZE);
+        if (doc.subtitle !== undefined) {
+            const subtitleLines = wrapText(clean(doc.subtitle), fonts.regular, SUBTITLE_SIZE, contentWidth);
+            drawLines(subtitleLines, fonts.regular, SUBTITLE_SIZE, margin.left, contentWidth, cursorY, "left", MUTED_COLOR);
+            cursorY -= subtitleLines.length * lineHeightFor(SUBTITLE_SIZE);
+        }
+        const meta = doc.meta ?? [];
+        if (meta.length > 0) {
+            cursorY -= BLOCK_GAP / 2;
+            const labels = meta.map((entry) => clean(entry.label));
+            const labelWidth = Math.max(...labels.map((label) => fonts.bold.widthOfTextAtSize(label, BODY_SIZE))) +
+                META_LABEL_GAP;
+            meta.forEach((entry, index) => {
+                const valueLines = wrapText(clean(entry.value), fonts.regular, BODY_SIZE, contentWidth - labelWidth);
+                drawLines([labels[index] ?? ""], fonts.bold, BODY_SIZE, margin.left, labelWidth, cursorY, "left");
+                drawLines(valueLines, fonts.regular, BODY_SIZE, margin.left + labelWidth, contentWidth - labelWidth, cursorY, "left");
+                cursorY -= valueLines.length * bodyLineHeight;
+            });
+        }
+        cursorY -= BLOCK_GAP;
+    }
+    function drawTableHeader() {
+        page.drawRectangle({
+            x: margin.left,
+            y: cursorY - headerHeight,
+            width: contentWidth,
+            height: headerHeight,
+            color: HEADER_FILL,
+        });
+        let x = margin.left;
+        doc.columns.forEach((column, index) => {
+            const width = columnWidths[index] ?? 0;
+            drawLines(headerLines[index] ?? [], fonts.bold, BODY_SIZE, x + CELL_PADDING_X, width - 2 * CELL_PADDING_X, cursorY - CELL_PADDING_Y, column.align ?? "left");
+            x += width;
+        });
+        cursorY -= headerHeight;
+    }
+    function startContinuationPage() {
+        page = pdf.addPage([pageSize.width, pageSize.height]);
+        cursorY = pageSize.height - margin.top;
+        drawTableHeader();
+    }
+    function drawRowSlice(cellLines, from, count) {
+        const height = count * bodyLineHeight + 2 * CELL_PADDING_Y;
+        let x = margin.left;
+        doc.columns.forEach((column, index) => {
+            const width = columnWidths[index] ?? 0;
+            drawLines((cellLines[index] ?? []).slice(from, from + count), fonts.regular, BODY_SIZE, x + CELL_PADDING_X, width - 2 * CELL_PADDING_X, cursorY - CELL_PADDING_Y, column.align ?? "left");
+            x += width;
+        });
+        page.drawLine({
+            start: { x: margin.left, y: cursorY - height },
+            end: { x: margin.left + contentWidth, y: cursorY - height },
+            thickness: 0.5,
+            color: RULE_COLOR,
+        });
+        cursorY -= height;
+    }
+    function drawRow(cellLines) {
+        const lineCount = Math.max(...cellLines.map((lines) => lines.length));
+        const rowHeight = lineCount * bodyLineHeight + 2 * CELL_PADDING_Y;
+        const emptyPageSpace = pageSize.height - margin.top - headerHeight - contentBottom;
+        if (rowHeight > cursorY - contentBottom && rowHeight <= emptyPageSpace) {
+            startContinuationPage();
+        }
+        let drawn = 0;
+        while (drawn < lineCount) {
+            const fitting = Math.floor((cursorY - contentBottom - 2 * CELL_PADDING_Y) / bodyLineHeight);
+            if (fitting < 1) {
+                startContinuationPage();
+                continue;
+            }
+            const count = Math.min(fitting, lineCount - drawn);
+            drawRowSlice(cellLines, drawn, count);
+            drawn += count;
+        }
+    }
+    drawIntroBlock();
+    drawTableHeader();
+    if (doc.rows.length === 0 && doc.emptyText !== undefined) {
+        drawRow([
+            wrapText(clean(doc.emptyText), fonts.regular, BODY_SIZE, contentWidth - 2 * CELL_PADDING_X),
+        ]);
+    }
+    for (const row of doc.rows) {
+        drawRow(row.map((cell, index) => wrapText(clean(cell), fonts.regular, BODY_SIZE, (columnWidths[index] ?? contentWidth) - 2 * CELL_PADDING_X)));
+    }
+    const pages = pdf.getPages();
+    const pageLabelTemplate = doc.pageLabel ?? "{page} / {pages}";
+    const footerBaseline = margin.bottom;
+    pages.forEach((footerPage, index) => {
+        const label = clean(pageLabelTemplate
+            .replaceAll("{page}", String(index + 1))
+            .replaceAll("{pages}", String(pages.length)));
+        const labelWidth = fonts.regular.widthOfTextAtSize(label, FOOTER_SIZE);
+        if (doc.footerText !== undefined) {
+            footerPage.drawText(fitSingleLine(clean(doc.footerText.replace(/\s+/g, " ")), fonts.regular, FOOTER_SIZE, contentWidth - labelWidth - 2 * CELL_PADDING_X), {
+                x: margin.left,
+                y: footerBaseline,
+                size: FOOTER_SIZE,
+                font: fonts.regular,
+                color: MUTED_COLOR,
+            });
+        }
+        footerPage.drawText(label, {
+            x: margin.left + contentWidth - labelWidth,
+            y: footerBaseline,
+            size: FOOTER_SIZE,
+            font: fonts.regular,
+            color: MUTED_COLOR,
+        });
+    });
+    const pdfBytes = await pdf.save();
+    return { pdfBytes, pageCount: pages.length };
+}

package/dist/shared/encrypt-for-direct-write.js

@@ -1,5 +1,5 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { collectPiiSubjectFields, configuredPiiSubjectKms, encryptPiiFieldValues, KeyErasedError, } from "@cosmicdrift/kumiko-framework/crypto";
+import { collectPiiEncryptedFields, configuredPiiSubjectKms, encryptPiiFieldValues, KeyErasedError, } from "@cosmicdrift/kumiko-framework/crypto";
 import { subjectErasedConflict } from "@cosmicdrift/kumiko-framework/errors";
 // Unmanaged direct-write stores (r.unmanagedTable) skip the executor, so its
 // PII encryption never runs — every insert of subject-annotated fields must
@@ -10,7 +10,7 @@ export async function encryptForDirectWrite(entity, entityName, row, fallbackReq
     if (!kms)
         return row;
     try {
-        return await encryptPiiFieldValues(row, entity, collectPiiSubjectFields(entity), kms, { requestId: requestContext.get()?.requestId ?? fallbackRequestId }, { entityName });
+        return await encryptPiiFieldValues(row, entity, collectPiiEncryptedFields(entity), kms, { requestId: requestContext.get()?.requestId ?? fallbackRequestId }, { entityName });
     }
     catch (e) {
         if (e instanceof KeyErasedError)

package/dist/shared/index.d.ts

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
 export { requireForTenant } from "./require-for-tenant.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/index.js

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
 export { requireForTenant } from "./require-for-tenant.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/redact-pii-ciphertext.d.ts

@@ -0,0 +1,2 @@
+export declare const REDACTED_PII_PLACEHOLDER: "[[personal data]]";
+export declare function redactPiiCiphertext(value: unknown): unknown;

package/dist/shared/redact-pii-ciphertext.js

@@ -0,0 +1,14 @@
+import { isPiiCiphertext } from "@cosmicdrift/kumiko-framework/crypto";
+export const REDACTED_PII_PLACEHOLDER = "[[personal data]]";
+// Event payloads store PII fields as subject-KMS ciphertext; the API leak guard
+// rejects any response carrying it, so payload reads swap it for a placeholder.
+export function redactPiiCiphertext(value) {
+    if (isPiiCiphertext(value))
+        return REDACTED_PII_PLACEHOLDER;
+    if (Array.isArray(value))
+        return value.map(redactPiiCiphertext);
+    if (typeof value === "object" && value !== null) {
+        return Object.fromEntries(Object.entries(value).map(([key, inner]) => [key, redactPiiCiphertext(inner)]));
+    }
+    return value;
+}

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -1,6 +1,6 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { append, loadAggregate, VersionConflictError, } from "@cosmicdrift/kumiko-framework/event-store";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
@@ -95,7 +95,7 @@ async function markTenantDestroyFailed(db, tenantId) {
     await tenantCrud.update({
         id: tenantId,
         changes: { status: "destroyFailed" },
-    }, user, scopedDb, { skipOptimisticLock: true });
+    }, user, scopedDb, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     invalidateTenantLifecycleGate(tenantId);
 }
 async function haltPipelineOnAbandon(args) {
@@ -240,7 +240,7 @@ export async function runTenantDestructionSweep(args) {
         // tenant stream, so an unguarded overwrite here would silently revert the
         // cancellation. A version conflict means we lost that race — skip, the
         // tenant is no longer due and the next tick re-evaluates it.
-        const result = await tenantCrud.update({ id: tenantId, version, changes: { status: "destroying", destroyStartedAt: now } }, user, scopedDb);
+        const result = await tenantCrud.update({ id: tenantId, version, changes: { status: "destroying", destroyStartedAt: now } }, user, scopedDb, { writePurpose: WritePurposes.erasure });
         if (!result.isSuccess)
             continue;
         invalidateTenantLifecycleGate(tenantId);

package/dist/tenant-lifecycle/stages.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, extensionUsageEscapeHatchReason, isTenantDataExtensionHooks, isTenantResourceExtensionHooks, } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
@@ -132,7 +132,7 @@ async function tombstoneTenantRow(ctx) {
             destroyedAt: now,
             isEnabled: false,
         },
-    }, user, db, { skipOptimisticLock: true });
+    }, user, db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     invalidateTenantLifecycleGate(ctx.tenantId);
     return STAGE_DONE;
 }

package/dist/user/handlers/me.query.d.ts

@@ -1,2 +1,4 @@
 import * as z from "zod";
-export declare const meQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"user:me", z.ZodObject<{}, z.core.$strip>, Record<string, unknown> | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+export declare const meQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"user:me", z.ZodObject<{}, z.core.$strip>, {
+    effectiveTimeZone: string;
+} | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/user/handlers/me.query.js

@@ -6,6 +6,7 @@ import { userEntity, userTable } from "../schema/user.js";
 const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
 // Returns the currently signed-in user's profile. Field-level read access
 // strips out the passwordHash automatically (configured on the entity).
+// `effectiveTimeZone` is the effective IANA zone of the caller.
 export const meQuery = defineQueryHandler({
     name: "user:me",
     schema: z.object({}),
@@ -26,6 +27,9 @@ export const meQuery = defineQueryHandler({
             throw new InternalError({ message: "user:me requires r.systemScope()" });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("user rows are tenant-agnostic identity records; self-lookup by id needs no tenant filter");
-        return crud.detail({ id: query.user.id }, query.user, db); // @wrapper-known semantic-alias
+        const row = await crud.detail({ id: query.user.id }, query.user, db);
+        // `timezone` on the row is only the stored override (often unset); clients
+        // need the effective zone (override, else tenant, else UTC) to compute "today".
+        return row === null ? row : { ...row, effectiveTimeZone: ctx.tz.user };
     },
 });

package/dist/user-data-rights/handlers/my-audit-log.query.d.ts

@@ -13,7 +13,7 @@ export declare const myAuditLogQuery: import("@cosmicdrift/kumiko-types/define-h
         aggregateType: string;
         version: number;
         type: string;
-        payload: Record<string, unknown>;
+        payload: unknown;
         createdAt: unknown;
     }[];
     nextBefore: string | null;

package/dist/user-data-rights/handlers/my-audit-log.query.js

@@ -3,6 +3,7 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
+import { redactPiiCiphertext } from "../../shared/index.js";
 // DSGVO Art. 15 Selbstauskunft — User reads HIS OWN audit-log.
 // WHERE createdBy = ctx.user.id ist hard-coded (kein userId-Param,
 // anti-cross-user-Snooping). KEIN tenantId-Filter: User hat Anspruch
@@ -63,7 +64,7 @@ export const myAuditLogQuery = defineQueryHandler({
             aggregateType: r["aggregate_type"],
             version: r["version"],
             type: r["type"],
-            payload: r["payload"],
+            payload: redactPiiCiphertext(r["payload"]),
             createdAt: r["created_at"],
         }));
         const last = serialised[serialised.length - 1];

package/dist/user-data-rights-defaults/hooks/file-ref.userdata-hook.js

@@ -1,4 +1,4 @@
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
@@ -184,6 +184,7 @@ async function severPersonLink(tdb, systemUser, rows) {
             continue;
         await crud.update({ id, changes: { insertedById: null } }, systemUser, tdb, {
             skipOptimisticLock: true,
+            writePurpose: WritePurposes.erasure,
         });
     }
 }

package/dist/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.js

@@ -1,4 +1,4 @@
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { collectErasureFailure, decryptStoredPii, mapWithConcurrency, throwIfErasureFailed, } from "../../shared/index.js";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/index.js";
@@ -95,7 +95,7 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
             else {
                 // Row-id in the pseudonym keeps the (tenantId, email) unique index
                 // collision-free when a user has invitations in several states.
-                await crud.update({ id, changes: { email: `forgotten-${id}@anonymized.invalid` } }, systemUser, ctx.db, { skipOptimisticLock: true });
+                await crud.update({ id, changes: { email: `forgotten-${id}@anonymized.invalid` } }, systemUser, ctx.db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
             }
         }
     }
@@ -115,6 +115,7 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
             continue;
         await crud.update({ id, changes: { invitedBy: INVITED_BY_ANONYMIZED } }, systemUser, ctx.db, {
             skipOptimisticLock: true,
+            writePurpose: WritePurposes.erasure,
         });
     }
     throwIfErasureFailed(failures);

package/dist/user-data-rights-defaults/hooks/user.userdata-hook.js

@@ -1,4 +1,4 @@
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "../../user/index.js";
 // Forget writes go through the executor (events), not a raw UPDATE: a
@@ -72,7 +72,7 @@ export const userDeleteHook = async (ctx, strategy) => {
                 // Frozen into the event payload, so a rebuild replays the same value.
                 deletedAt: Temporal.Now.instant(),
             },
-        }, systemUser, ctx.db, { skipOptimisticLock: true });
+        }, systemUser, ctx.db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     }
     else {
         // anonymize: PII raus, aber Row bleibt active (damit FK-References
@@ -86,6 +86,6 @@ export const userDeleteHook = async (ctx, strategy) => {
                 email: `${USER_ANONYMIZED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
                 displayName: USER_ANONYMIZED_DISPLAY_NAME,
             },
-        }, systemUser, ctx.db, { skipOptimisticLock: true });
+        }, systemUser, ctx.db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     }
 };

package/dist/user-profile/feature.d.ts

@@ -1,2 +1,7 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-export declare function createUserProfileFeature(): FeatureDefinition;
+export type UserProfileFeatureOptions = {
+    /** Default true. false drops the change-email handler and the email
+     *  section — for apps whose login email is managed elsewhere (SSO, admin-set). */
+    readonly allowEmailChange?: boolean;
+};
+export declare function createUserProfileFeature(options?: UserProfileFeatureOptions): FeatureDefinition;

package/dist/user-profile/feature.js

@@ -1,12 +1,14 @@
 import { defineFeature, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
 import { CHANGE_EMAIL_SECTION_EXTENSION_NAME, CHANGE_PASSWORD_SECTION_EXTENSION_NAME, PROFILE_SCREEN_ID, UserDataRightsHandlers, UserProfileQueries, } from "./constants.js";
 import { changeEmailWrite } from "./handlers/change-email.write.js";
-export function createUserProfileFeature() {
+export function createUserProfileFeature(options) {
+    const allowEmailChange = options?.allowEmailChange ?? true;
     return defineFeature("user-profile", (r) => {
         r.describe("Self-service account page (fw#2312: declarative `projectionDetail` bound to " +
             "the signed-in user's own `me` row) plus its `change-email` write handler " +
             "(re-auth via current password, uniqueness check, resets emailVerified and " +
-            "expects the app to trigger the verification flow). Change-password and " +
+            "expects the app to trigger the verification flow; opt out with " +
+            "`allowEmailChange: false`, which drops handler and section). Change-password and " +
             "change-email stay custom `EditExtensionSection` components (re-auth flows a " +
             "declarative action can't express); account deletion (user-data-rights " +
             "request/cancel with grace period) is declarative fields + actions. Apps " +
@@ -24,9 +26,7 @@ export function createUserProfileFeature() {
         r.requires("auth-email-password");
         r.requires("user-data-rights");
         r.requires("user-data-rights-defaults");
-        const handlers = {
-            changeEmail: r.writeHandler(changeEmailWrite),
-        };
+        const handlers = allowEmailChange ? { changeEmail: r.writeHandler(changeEmailWrite) } : {};
         // Boot-validator requires a "screen:<id>.title" key per r.screen(), plus
         // one entry per i18nKey()-marked dot-form label below — kept inline (not
         // imported from ./i18n) so feature.ts, part of the server barrel, stays
@@ -83,12 +83,16 @@ export function createUserProfileFeature() {
             },
             layout: {
                 sections: [
-                    {
-                        kind: "extension",
-                        title: i18nKey("profile.email.title"),
-                        component: { react: { __component: CHANGE_EMAIL_SECTION_EXTENSION_NAME } },
-                        entityName: "user",
-                    },
+                    ...(allowEmailChange
+                        ? [
+                            {
+                                kind: "extension",
+                                title: i18nKey("profile.email.title"),
+                                component: { react: { __component: CHANGE_EMAIL_SECTION_EXTENSION_NAME } },
+                                entityName: "user",
+                            },
+                        ]
+                        : []),
                     {
                         kind: "extension",
                         title: i18nKey("profile.password.title"),

package/dist/user-profile/index.d.ts

@@ -1,2 +1,2 @@
 export { USER_PROFILE_FEATURE, UserDataRightsHandlers, UserProfileErrors, UserProfileHandlers, UserProfileQueries, } from "./constants.js";
-export { createUserProfileFeature } from "./feature.js";
+export { createUserProfileFeature, type UserProfileFeatureOptions } from "./feature.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.359.0",
+  "version": "0.361.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -398,6 +398,10 @@
       "types": "./dist/renderer-simple/index.d.ts",
       "default": "./dist/renderer-simple/index.js"
     },
+    "./renderer-pdf": {
+      "types": "./dist/renderer-pdf/index.d.ts",
+      "default": "./dist/renderer-pdf/index.js"
+    },
     "./files-provider-s3": {
       "types": "./dist/files-provider-s3/index.d.ts",
       "default": "./dist/files-provider-s3/index.js"
@@ -516,12 +520,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.359.0",
-    "@cosmicdrift/kumiko-framework": "0.359.0",
-    "@cosmicdrift/kumiko-headless": "0.359.0",
-    "@cosmicdrift/kumiko-renderer": "0.359.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.359.0",
-    "@cosmicdrift/kumiko-types": "0.359.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.361.0",
+    "@cosmicdrift/kumiko-framework": "0.361.0",
+    "@cosmicdrift/kumiko-headless": "0.361.0",
+    "@cosmicdrift/kumiko-renderer": "0.361.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.361.0",
+    "@cosmicdrift/kumiko-types": "0.361.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -535,6 +539,7 @@
     "mailparser": "^3.9.32",
     "marked": "^18.0.3",
     "nodemailer": "^10.0.13",
+    "pdf-lib": "^1.17.1",
     "qrcode": "^1.5.4",
     "react": "^19.2.6",
     "sharp": "^0.35.5",
@@ -924,6 +929,10 @@
         "types": "./dist/renderer-simple/index.d.ts",
         "default": "./dist/renderer-simple/index.js"
       },
+      "./renderer-pdf": {
+        "types": "./dist/renderer-pdf/index.d.ts",
+        "default": "./dist/renderer-pdf/index.js"
+      },
       "./files-provider-s3": {
         "types": "./dist/files-provider-s3/index.d.ts",
         "default": "./dist/files-provider-s3/index.js"
@@ -1050,8 +1059,9 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.359.0",
-    "@cosmicdrift/kumiko-locale-es": "0.359.0",
-    "jsqr": "^1.4.0"
+    "@cosmicdrift/kumiko-locale-de": "0.361.0",
+    "@cosmicdrift/kumiko-locale-es": "0.361.0",
+    "jsqr": "^1.4.0",
+    "unpdf": "^1.8.1"
   }
 }

package/src/audit/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "fix",
+    "title": "Audit log works under an active subject KMS",
+    "detail": "audit list, audit details and user-data-rights my-audit-log returned event payloads as stored. With a subject KMS configured the payload carried kumiko-pii ciphertext and the API leak guard answered 500 pii_ciphertext_leak. Every PII ciphertext string in the payload is now replaced by REDACTED_PII_PLACEHOLDER (\"[[personal data]]\"); the audit log still never shows plaintext PII."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/src/cap-counter/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "cap-counter exports capReservationsTable and capReservationsTableMeta",
+    "detail": "The reservation table store_cap_reservations was only reachable through internal imports, so kumiko-enterprise redeclared it in a test. The cap-counter entry now exports capReservationsTable and capReservationsTableMeta, following the feature-toggles pattern."
+  },
   {
     "version": "0.358.0",
     "type": "improvement",

package/src/jobs/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.360.0",
+    "type": "fix",
+    "title": "Finished tenant job run replaces the older one atomically",
+    "detail": "recordTenantRunOutcome wrote the new completed or failed row and pruned older finished rows of the same tenant, job and subject in two separate statements, so the store briefly held two finished rows per subject, and two runs of one subject finishing together could each miss the other's row and leave both. Both writes now run in one transaction under a per-key advisory lock (namespace tjrl). jobs:query:tenant-runs already showed only the newest finished row, so its result does not change."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/src/renderer-pdf/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.360.0",
+    "type": "improvement",
+    "title": "Pure-JS PDF renderer for table documents",
+    "detail": "renderTablePdf(doc, options?) renders a PdfTableDocument (title, subtitle, meta lines, weighted columns, wrapped cells, header row repeated per page, footerText and a pageLabel template with {page} and {pages}) to PDF bytes with pdf-lib. Characters outside WinAnsi are replaced by \"?\". Identical input yields identical bytes. createRendererPdfFeature() registers it as plugin \"pdf\" for kind \"document-pdf\"; payload.variables is validated against pdfTableDocumentSchema, anything else fails with RendererError invalid_payload."
+  }
+]

package/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "user:me returns effectiveTimeZone, SessionProvider provides the current user",
+    "detail": "The me query adds effectiveTimeZone (ctx.tz.user), CurrentUserProfile.effectiveTimeZone is parsed by fetchCurrentUser and SessionProvider wraps its children in CurrentUserProvider."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/src/user-profile/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.360.0",
+    "type": "improvement",
+    "title": "change-email can be switched off",
+    "detail": "createUserProfileFeature({ allowEmailChange: false }) neither registers the change-email write handler nor shows the email section on the profile screen. Without the option nothing changes."
+  },
   {
     "version": "0.243.1",
     "type": "fix",