@cosmicdrift/kumiko-bundled-features 0.360.0 → 0.361.0

package/dist/audit/handlers/details.query.d.ts

@@ -11,7 +11,7 @@ export declare const detailsQuery: import("@cosmicdrift/kumiko-types/define-hand
     aggregateType: string;
     version: number;
     type: string;
-    payload: Record<string, unknown>;
+    payload: unknown;
     metadata: Record<string, unknown>;
     createdAt: unknown;
     createdBy: string;

package/dist/audit/handlers/details.query.js

@@ -6,6 +6,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import * as z from "zod";
+import { redactPiiCiphertext } from "../../shared/index.js";
 import { AUDIT_SCOPE_VALUES } from "../constants.js";
 import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
 export const detailsQuery = defineQueryHandler({
@@ -34,7 +35,7 @@ export const detailsQuery = defineQueryHandler({
             aggregateType: row.aggregateType,
             version: row.version,
             type: row.type,
-            payload: row.payload,
+            payload: redactPiiCiphertext(row.payload),
             metadata: row.metadata,
             createdAt: row.createdAt,
             createdBy: row.createdBy,

package/dist/audit/handlers/list.query.d.ts

@@ -29,7 +29,7 @@ export declare const listQuery: import("@cosmicdrift/kumiko-types/define-handler
         aggregateType: string;
         version: number;
         type: string;
-        payload: Record<string, unknown>;
+        payload: unknown;
         metadata: Record<string, unknown>;
         createdAt: unknown;
         createdBy: string;

package/dist/audit/handlers/list.query.js

@@ -9,15 +9,14 @@
 // A SystemAdmin can pass scope "system" to read the app-instance system events
 // (e.g. app.started); no other cross-tenant read exists.
 //
-// Sensitive field-values are ciphertext inside the event payload (the log
-// carries them encrypted); stripSensitive only strips the event echo. This
-// query returns payloads as stored, so a sensitive value surfaces as ciphertext,
-// never as plaintext.
+// Event payloads hold PII as subject-KMS ciphertext; it is replaced by
+// REDACTED_PII_PLACEHOLDER before returning, since the API leak guard refuses ciphertext.
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
+import { redactPiiCiphertext } from "../../shared/index.js";
 import { AUDIT_SCOPE_VALUES } from "../constants.js";
 import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
 const MAX_LIMIT = 100;
@@ -102,7 +101,7 @@ export const listQuery = defineQueryHandler({
             aggregateType: r.aggregateType,
             version: r.version,
             type: r.type,
-            payload: r.payload,
+            payload: redactPiiCiphertext(r.payload),
             metadata: r.metadata,
             createdAt: r.createdAt,
             createdBy: r.createdBy,

package/dist/auth-email-password/web/auth-client.d.ts

@@ -135,6 +135,8 @@ export type CurrentUserProfile = {
     readonly email: string;
     readonly displayName: string;
     readonly locale?: string;
+    /** Effective IANA zone (user override, else tenant, else UTC). */
+    readonly effectiveTimeZone?: string;
     readonly globalRoles: readonly string[];
 };
 export declare function fetchCurrentUser(): Promise<CurrentUserProfile | null>;

package/dist/auth-email-password/web/auth-client.js

@@ -295,6 +295,9 @@ export async function fetchCurrentUser() {
         email: body.data.email,
         displayName: body.data.displayName,
         ...(body.data.locale !== undefined && { locale: body.data.locale }),
+        ...(body.data.effectiveTimeZone !== undefined && {
+            effectiveTimeZone: body.data.effectiveTimeZone,
+        }),
         globalRoles: parseRoles(body.data.roles),
     };
 }

package/dist/auth-email-password/web/session.js

@@ -10,8 +10,8 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // unter `<SessionProvider>`; der `useSession()`-Hook liefert den State
 // und die Transitions.
 import { readCsrfToken } from "@cosmicdrift/kumiko-dispatcher-live";
-import { useSessionEndedSignal } from "@cosmicdrift/kumiko-renderer";
-import { createContext, useCallback, useContext, useEffect, useState } from "react";
+import { CurrentUserProvider, useSessionEndedSignal, } from "@cosmicdrift/kumiko-renderer";
+import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from "react";
 import { AuthRequestError, fetchCurrentUser, fetchTenants, login as loginApi, logout as logoutApi, switchTenant as switchTenantApi, } from "./auth-client.js";
 // Exported so screens that render on BOTH authenticated and anonymous public
 // routes (e.g. InviteAcceptScreen) can read `.status` without requiring a
@@ -154,7 +154,23 @@ export function SessionProvider({ children, postLogoutUrl, }) {
         }
     }, []);
     const api = { ...state, login, logout, switchTenant, refresh: doRefresh };
-    return _jsx(SessionContext.Provider, { value: api, children: children });
+    // Keyed on the primitives, not the profile object: every refresh (tenant
+    // switch, session bootstrap retry) builds a new profile object, and a new
+    // CurrentUser reference would re-seed a create form and drop typed input.
+    const profile = state.user;
+    const userId = profile?.id;
+    const userEmail = profile?.email;
+    const userDisplayName = profile?.displayName;
+    const userTimeZone = profile?.effectiveTimeZone;
+    const currentUser = useMemo(() => userId === undefined || userEmail === undefined || userDisplayName === undefined
+        ? undefined
+        : {
+            id: userId,
+            email: userEmail,
+            displayName: userDisplayName,
+            ...(userTimeZone !== undefined && { timeZone: userTimeZone }),
+        }, [userId, userEmail, userDisplayName, userTimeZone]);
+    return (_jsx(SessionContext.Provider, { value: api, children: _jsx(CurrentUserProvider, { user: currentUser, children: children }) }));
 }
 export function useSession() {
     const ctx = useContext(SessionContext);

package/dist/cap-counter/index.d.ts

@@ -7,5 +7,6 @@ export { capCounterEntity } from "./entity.js";
 export { capCounterFeature } from "./feature.js";
 export { readPayloadField } from "./payload-field.js";
 export { type CapGuardContext, type CapLimitContext, createStockCapGuard, type StockCapGuard, type StockCapSpec, } from "./stock-cap-guard.js";
+export { capReservationsTable, capReservationsTableMeta } from "./tables.js";
 export { createValueCapGuard, type ValueCapGuard, type ValueCapSpec, } from "./value-cap-guard.js";
 export { type CalendarCapDef, type CalendarCapResolver, type RollingCapDef, type RollingCapResolver, withCapEnforcement, withRollingCapEnforcement, } from "./with-cap-enforcement.js";

package/dist/cap-counter/index.js

@@ -8,5 +8,6 @@ export { capCounterEntity } from "./entity.js";
 export { capCounterFeature } from "./feature.js";
 export { readPayloadField } from "./payload-field.js";
 export { createStockCapGuard, } from "./stock-cap-guard.js";
+export { capReservationsTable, capReservationsTableMeta } from "./tables.js";
 export { createValueCapGuard, } from "./value-cap-guard.js";
 export { withCapEnforcement, withRollingCapEnforcement, } from "./with-cap-enforcement.js";

package/dist/data-retention/run-retention-cleanup.js

@@ -39,7 +39,7 @@
 // einzelnen Page — sonst verstopfen erledigte Rows das batchLimit-Fenster.
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { collectPiiSubjectFields, configuredPiiSubjectKms, isSelfPiiField, resolveSubjectForField, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, entityHasAnonymizableSubjectField, } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefEntity, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
@@ -149,7 +149,7 @@ async function forgetRowAndEraseKeys(args) {
 }
 const NO_FILE_FIELDS = { singleFields: [], multiFields: [] };
 // file/image = single-column fields (fileRef-id lives directly in the entity
-// row); files/images = plural, no column, resolved via file_refs. Same set
+// row); files/images = plural, resolved via file_refs. Same set
 // as boot-validator/entity-handler.ts FILE_FIELD_TYPES and engine's
 // isFileField — inlined here rather than importing across the package
 // barrel since this module already needs the single/multi split, not just
@@ -169,8 +169,8 @@ function planFileFields(fields) {
         : NO_FILE_FIELDS;
 }
 // Every fileRef-id a row's file/image/files/images-fields reference: single
-// fields hold the id in their own column, plural fields have no column and
-// resolve via file_refs (tenantId, entityType, entityId, fieldName).
+// fields hold the id in their own column, plural fields resolve
+// via file_refs (tenantId, entityType, entityId, fieldName).
 async function collectFileRefIds(db, tenantId, entityName, row, plan) {
     const ids = new Set();
     for (const field of plan.singleFields) {
@@ -536,7 +536,7 @@ export async function runRetentionCleanup(args) {
                     break;
                 }
                 const executor = createEventStoreExecutor(proj.table, entity, { entityName });
-                softDeleted += await purgeMatchingRows(db, proj.table, { ...where, isDeleted: false }, batchLimit, (id) => executor.delete({ id }, systemUser, tdb));
+                softDeleted += await purgeMatchingRows(db, proj.table, { ...where, isDeleted: false }, batchLimit, (id) => executor.delete({ id }, systemUser, tdb, { writePurpose: WritePurposes.retention }));
                 break;
             }
             // blockDelete = Legal-Hold: rows stay untouched during keepFor (the
@@ -560,7 +560,10 @@ export async function runRetentionCleanup(args) {
                     break;
                 }
                 const executor = createEventStoreExecutor(proj.table, entity, { entityName });
-                anonymized += await anonymizeMatchingRows(db, proj.table, where, batchLimit, targets, (id, changes) => executor.update({ id, changes }, systemUser, tdb, { skipOptimisticLock: true }));
+                anonymized += await anonymizeMatchingRows(db, proj.table, where, batchLimit, targets, (id, changes) => executor.update({ id, changes }, systemUser, tdb, {
+                    skipOptimisticLock: true,
+                    writePurpose: WritePurposes.retention,
+                }));
                 break;
             }
         }

package/dist/folders-user-data/hooks.js

@@ -3,6 +3,7 @@
 // consumers without the user-data-rights pipeline don't pull a hard dependency.
 // Mirrors credit-user-data — standard tenant-scoped pattern, no name-stripping
 // (a folder name is tenant data, not per-user PII).
+import { WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createEntityExecutor, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { folderAssignmentEntity, folderEntity } from "../folders/index.js";
 const { table: folderTable, executor: folderExecutor } = createEntityExecutor("folder", folderEntity);
@@ -48,7 +49,9 @@ function tenantScopedDelete(table, executor) {
         const systemUser = createSystemUser(ctx.tenantId);
         const rows = await ctx.db.selectMany(table, { tenantId: ctx.tenantId });
         for (const row of rows) {
-            await executor.delete({ id: row.id }, systemUser, ctx.db);
+            await executor.delete({ id: row.id }, systemUser, ctx.db, {
+                writePurpose: WritePurposes.erasure,
+            });
         }
     };
 }

package/dist/form-draft-user-data/hooks.js

@@ -2,6 +2,7 @@
 // (GDPR Art. 20 export / Art. 17 erasure). Lives apart from form-draft so
 // consumers without the user-data-rights pipeline don't pull a hard
 // dependency.
+import { WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { formDraftExecutor, formDraftTable } from "../form-draft/index.js";
 export const formDraftExportHook = async (ctx) => {
@@ -36,7 +37,9 @@ export const formDraftDeleteHook = async (ctx) => {
     const systemUser = createSystemUser(ctx.tenantId);
     const failures = [];
     for (const row of rows) {
-        const result = await formDraftExecutor.delete({ id: row.id }, systemUser, ctx.db);
+        const result = await formDraftExecutor.delete({ id: row.id }, systemUser, ctx.db, {
+            writePurpose: WritePurposes.erasure,
+        });
         if (!result.isSuccess) {
             failures.push(`${row.id}: ${result.error.message}`);
         }

package/dist/shared/encrypt-for-direct-write.js

@@ -1,5 +1,5 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { collectPiiSubjectFields, configuredPiiSubjectKms, encryptPiiFieldValues, KeyErasedError, } from "@cosmicdrift/kumiko-framework/crypto";
+import { collectPiiEncryptedFields, configuredPiiSubjectKms, encryptPiiFieldValues, KeyErasedError, } from "@cosmicdrift/kumiko-framework/crypto";
 import { subjectErasedConflict } from "@cosmicdrift/kumiko-framework/errors";
 // Unmanaged direct-write stores (r.unmanagedTable) skip the executor, so its
 // PII encryption never runs — every insert of subject-annotated fields must
@@ -10,7 +10,7 @@ export async function encryptForDirectWrite(entity, entityName, row, fallbackReq
     if (!kms)
         return row;
     try {
-        return await encryptPiiFieldValues(row, entity, collectPiiSubjectFields(entity), kms, { requestId: requestContext.get()?.requestId ?? fallbackRequestId }, { entityName });
+        return await encryptPiiFieldValues(row, entity, collectPiiEncryptedFields(entity), kms, { requestId: requestContext.get()?.requestId ?? fallbackRequestId }, { entityName });
     }
     catch (e) {
         if (e instanceof KeyErasedError)

package/dist/shared/index.d.ts

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
 export { requireForTenant } from "./require-for-tenant.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/index.js

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
 export { requireForTenant } from "./require-for-tenant.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/redact-pii-ciphertext.d.ts

@@ -0,0 +1,2 @@
+export declare const REDACTED_PII_PLACEHOLDER: "[[personal data]]";
+export declare function redactPiiCiphertext(value: unknown): unknown;

package/dist/shared/redact-pii-ciphertext.js

@@ -0,0 +1,14 @@
+import { isPiiCiphertext } from "@cosmicdrift/kumiko-framework/crypto";
+export const REDACTED_PII_PLACEHOLDER = "[[personal data]]";
+// Event payloads store PII fields as subject-KMS ciphertext; the API leak guard
+// rejects any response carrying it, so payload reads swap it for a placeholder.
+export function redactPiiCiphertext(value) {
+    if (isPiiCiphertext(value))
+        return REDACTED_PII_PLACEHOLDER;
+    if (Array.isArray(value))
+        return value.map(redactPiiCiphertext);
+    if (typeof value === "object" && value !== null) {
+        return Object.fromEntries(Object.entries(value).map(([key, inner]) => [key, redactPiiCiphertext(inner)]));
+    }
+    return value;
+}

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -1,6 +1,6 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { append, loadAggregate, VersionConflictError, } from "@cosmicdrift/kumiko-framework/event-store";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
@@ -95,7 +95,7 @@ async function markTenantDestroyFailed(db, tenantId) {
     await tenantCrud.update({
         id: tenantId,
         changes: { status: "destroyFailed" },
-    }, user, scopedDb, { skipOptimisticLock: true });
+    }, user, scopedDb, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     invalidateTenantLifecycleGate(tenantId);
 }
 async function haltPipelineOnAbandon(args) {
@@ -240,7 +240,7 @@ export async function runTenantDestructionSweep(args) {
         // tenant stream, so an unguarded overwrite here would silently revert the
         // cancellation. A version conflict means we lost that race — skip, the
         // tenant is no longer due and the next tick re-evaluates it.
-        const result = await tenantCrud.update({ id: tenantId, version, changes: { status: "destroying", destroyStartedAt: now } }, user, scopedDb);
+        const result = await tenantCrud.update({ id: tenantId, version, changes: { status: "destroying", destroyStartedAt: now } }, user, scopedDb, { writePurpose: WritePurposes.erasure });
         if (!result.isSuccess)
             continue;
         invalidateTenantLifecycleGate(tenantId);

package/dist/tenant-lifecycle/stages.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, extensionUsageEscapeHatchReason, isTenantDataExtensionHooks, isTenantResourceExtensionHooks, } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
@@ -132,7 +132,7 @@ async function tombstoneTenantRow(ctx) {
             destroyedAt: now,
             isEnabled: false,
         },
-    }, user, db, { skipOptimisticLock: true });
+    }, user, db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     invalidateTenantLifecycleGate(ctx.tenantId);
     return STAGE_DONE;
 }

package/dist/user/handlers/me.query.d.ts

@@ -1,2 +1,4 @@
 import * as z from "zod";
-export declare const meQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"user:me", z.ZodObject<{}, z.core.$strip>, Record<string, unknown> | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+export declare const meQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"user:me", z.ZodObject<{}, z.core.$strip>, {
+    effectiveTimeZone: string;
+} | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/user/handlers/me.query.js

@@ -6,6 +6,7 @@ import { userEntity, userTable } from "../schema/user.js";
 const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
 // Returns the currently signed-in user's profile. Field-level read access
 // strips out the passwordHash automatically (configured on the entity).
+// `effectiveTimeZone` is the effective IANA zone of the caller.
 export const meQuery = defineQueryHandler({
     name: "user:me",
     schema: z.object({}),
@@ -26,6 +27,9 @@ export const meQuery = defineQueryHandler({
             throw new InternalError({ message: "user:me requires r.systemScope()" });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("user rows are tenant-agnostic identity records; self-lookup by id needs no tenant filter");
-        return crud.detail({ id: query.user.id }, query.user, db); // @wrapper-known semantic-alias
+        const row = await crud.detail({ id: query.user.id }, query.user, db);
+        // `timezone` on the row is only the stored override (often unset); clients
+        // need the effective zone (override, else tenant, else UTC) to compute "today".
+        return row === null ? row : { ...row, effectiveTimeZone: ctx.tz.user };
     },
 });

package/dist/user-data-rights/handlers/my-audit-log.query.d.ts

@@ -13,7 +13,7 @@ export declare const myAuditLogQuery: import("@cosmicdrift/kumiko-types/define-h
         aggregateType: string;
         version: number;
         type: string;
-        payload: Record<string, unknown>;
+        payload: unknown;
         createdAt: unknown;
     }[];
     nextBefore: string | null;

package/dist/user-data-rights/handlers/my-audit-log.query.js

@@ -3,6 +3,7 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
+import { redactPiiCiphertext } from "../../shared/index.js";
 // DSGVO Art. 15 Selbstauskunft — User reads HIS OWN audit-log.
 // WHERE createdBy = ctx.user.id ist hard-coded (kein userId-Param,
 // anti-cross-user-Snooping). KEIN tenantId-Filter: User hat Anspruch
@@ -63,7 +64,7 @@ export const myAuditLogQuery = defineQueryHandler({
             aggregateType: r["aggregate_type"],
             version: r["version"],
             type: r["type"],
-            payload: r["payload"],
+            payload: redactPiiCiphertext(r["payload"]),
             createdAt: r["created_at"],
         }));
         const last = serialised[serialised.length - 1];

package/dist/user-data-rights-defaults/hooks/file-ref.userdata-hook.js

@@ -1,4 +1,4 @@
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
@@ -184,6 +184,7 @@ async function severPersonLink(tdb, systemUser, rows) {
             continue;
         await crud.update({ id, changes: { insertedById: null } }, systemUser, tdb, {
             skipOptimisticLock: true,
+            writePurpose: WritePurposes.erasure,
         });
     }
 }

package/dist/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.js

@@ -1,4 +1,4 @@
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { collectErasureFailure, decryptStoredPii, mapWithConcurrency, throwIfErasureFailed, } from "../../shared/index.js";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/index.js";
@@ -95,7 +95,7 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
             else {
                 // Row-id in the pseudonym keeps the (tenantId, email) unique index
                 // collision-free when a user has invitations in several states.
-                await crud.update({ id, changes: { email: `forgotten-${id}@anonymized.invalid` } }, systemUser, ctx.db, { skipOptimisticLock: true });
+                await crud.update({ id, changes: { email: `forgotten-${id}@anonymized.invalid` } }, systemUser, ctx.db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
             }
         }
     }
@@ -115,6 +115,7 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
             continue;
         await crud.update({ id, changes: { invitedBy: INVITED_BY_ANONYMIZED } }, systemUser, ctx.db, {
             skipOptimisticLock: true,
+            writePurpose: WritePurposes.erasure,
         });
     }
     throwIfErasureFailed(failures);

package/dist/user-data-rights-defaults/hooks/user.userdata-hook.js

@@ -1,4 +1,4 @@
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "../../user/index.js";
 // Forget writes go through the executor (events), not a raw UPDATE: a
@@ -72,7 +72,7 @@ export const userDeleteHook = async (ctx, strategy) => {
                 // Frozen into the event payload, so a rebuild replays the same value.
                 deletedAt: Temporal.Now.instant(),
             },
-        }, systemUser, ctx.db, { skipOptimisticLock: true });
+        }, systemUser, ctx.db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     }
     else {
         // anonymize: PII raus, aber Row bleibt active (damit FK-References
@@ -86,6 +86,6 @@ export const userDeleteHook = async (ctx, strategy) => {
                 email: `${USER_ANONYMIZED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
                 displayName: USER_ANONYMIZED_DISPLAY_NAME,
             },
-        }, systemUser, ctx.db, { skipOptimisticLock: true });
+        }, systemUser, ctx.db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.360.0",
+  "version": "0.361.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -520,12 +520,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.360.0",
-    "@cosmicdrift/kumiko-framework": "0.360.0",
-    "@cosmicdrift/kumiko-headless": "0.360.0",
-    "@cosmicdrift/kumiko-renderer": "0.360.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.360.0",
-    "@cosmicdrift/kumiko-types": "0.360.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.361.0",
+    "@cosmicdrift/kumiko-framework": "0.361.0",
+    "@cosmicdrift/kumiko-headless": "0.361.0",
+    "@cosmicdrift/kumiko-renderer": "0.361.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.361.0",
+    "@cosmicdrift/kumiko-types": "0.361.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1059,8 +1059,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.360.0",
-    "@cosmicdrift/kumiko-locale-es": "0.360.0",
+    "@cosmicdrift/kumiko-locale-de": "0.361.0",
+    "@cosmicdrift/kumiko-locale-es": "0.361.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/src/audit/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "fix",
+    "title": "Audit log works under an active subject KMS",
+    "detail": "audit list, audit details and user-data-rights my-audit-log returned event payloads as stored. With a subject KMS configured the payload carried kumiko-pii ciphertext and the API leak guard answered 500 pii_ciphertext_leak. Every PII ciphertext string in the payload is now replaced by REDACTED_PII_PLACEHOLDER (\"[[personal data]]\"); the audit log still never shows plaintext PII."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/src/cap-counter/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "cap-counter exports capReservationsTable and capReservationsTableMeta",
+    "detail": "The reservation table store_cap_reservations was only reachable through internal imports, so kumiko-enterprise redeclared it in a test. The cap-counter entry now exports capReservationsTable and capReservationsTableMeta, following the feature-toggles pattern."
+  },
   {
     "version": "0.358.0",
     "type": "improvement",

package/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "user:me returns effectiveTimeZone, SessionProvider provides the current user",
+    "detail": "The me query adds effectiveTimeZone (ctx.tz.user), CurrentUserProfile.effectiveTimeZone is parsed by fetchCurrentUser and SessionProvider wraps its children in CurrentUserProvider."
+  },
   {
     "version": "0.354.0",
     "type": "fix",