@cosmicdrift/kumiko-bundled-features 0.360.0 → 0.362.0

package/dist/audit/handlers/details.query.d.ts

@@ -11,7 +11,7 @@ export declare const detailsQuery: import("@cosmicdrift/kumiko-types/define-hand
     aggregateType: string;
     version: number;
     type: string;
-    payload: Record<string, unknown>;
+    payload: unknown;
     metadata: Record<string, unknown>;
     createdAt: unknown;
     createdBy: string;

package/dist/audit/handlers/details.query.js

@@ -6,6 +6,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import * as z from "zod";
+import { redactPiiCiphertext } from "../../shared/index.js";
 import { AUDIT_SCOPE_VALUES } from "../constants.js";
 import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
 export const detailsQuery = defineQueryHandler({
@@ -34,7 +35,7 @@ export const detailsQuery = defineQueryHandler({
             aggregateType: row.aggregateType,
             version: row.version,
             type: row.type,
-            payload: row.payload,
+            payload: redactPiiCiphertext(row.payload),
             metadata: row.metadata,
             createdAt: row.createdAt,
             createdBy: row.createdBy,

package/dist/audit/handlers/list.query.d.ts

@@ -29,7 +29,7 @@ export declare const listQuery: import("@cosmicdrift/kumiko-types/define-handler
         aggregateType: string;
         version: number;
         type: string;
-        payload: Record<string, unknown>;
+        payload: unknown;
         metadata: Record<string, unknown>;
         createdAt: unknown;
         createdBy: string;

package/dist/audit/handlers/list.query.js

@@ -9,15 +9,14 @@
 // A SystemAdmin can pass scope "system" to read the app-instance system events
 // (e.g. app.started); no other cross-tenant read exists.
 //
-// Sensitive field-values are ciphertext inside the event payload (the log
-// carries them encrypted); stripSensitive only strips the event echo. This
-// query returns payloads as stored, so a sensitive value surfaces as ciphertext,
-// never as plaintext.
+// Event payloads hold PII as subject-KMS ciphertext; it is replaced by
+// REDACTED_PII_PLACEHOLDER before returning, since the API leak guard refuses ciphertext.
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
+import { redactPiiCiphertext } from "../../shared/index.js";
 import { AUDIT_SCOPE_VALUES } from "../constants.js";
 import { resolveAuditScopeFilter } from "./resolve-audit-tenant.js";
 const MAX_LIMIT = 100;
@@ -102,7 +101,7 @@ export const listQuery = defineQueryHandler({
             aggregateType: r.aggregateType,
             version: r.version,
             type: r.type,
-            payload: r.payload,
+            payload: redactPiiCiphertext(r.payload),
             metadata: r.metadata,
             createdAt: r.createdAt,
             createdBy: r.createdBy,

package/dist/auth-email-password/web/auth-client.d.ts

@@ -135,6 +135,8 @@ export type CurrentUserProfile = {
     readonly email: string;
     readonly displayName: string;
     readonly locale?: string;
+    /** Effective IANA zone (user override, else tenant, else UTC). */
+    readonly effectiveTimeZone?: string;
     readonly globalRoles: readonly string[];
 };
 export declare function fetchCurrentUser(): Promise<CurrentUserProfile | null>;

package/dist/auth-email-password/web/auth-client.js

@@ -295,6 +295,9 @@ export async function fetchCurrentUser() {
         email: body.data.email,
         displayName: body.data.displayName,
         ...(body.data.locale !== undefined && { locale: body.data.locale }),
+        ...(body.data.effectiveTimeZone !== undefined && {
+            effectiveTimeZone: body.data.effectiveTimeZone,
+        }),
         globalRoles: parseRoles(body.data.roles),
     };
 }

package/dist/auth-email-password/web/session.js

@@ -10,8 +10,8 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // unter `<SessionProvider>`; der `useSession()`-Hook liefert den State
 // und die Transitions.
 import { readCsrfToken } from "@cosmicdrift/kumiko-dispatcher-live";
-import { useSessionEndedSignal } from "@cosmicdrift/kumiko-renderer";
-import { createContext, useCallback, useContext, useEffect, useState } from "react";
+import { CurrentUserProvider, useSessionEndedSignal, } from "@cosmicdrift/kumiko-renderer";
+import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from "react";
 import { AuthRequestError, fetchCurrentUser, fetchTenants, login as loginApi, logout as logoutApi, switchTenant as switchTenantApi, } from "./auth-client.js";
 // Exported so screens that render on BOTH authenticated and anonymous public
 // routes (e.g. InviteAcceptScreen) can read `.status` without requiring a
@@ -154,7 +154,23 @@ export function SessionProvider({ children, postLogoutUrl, }) {
         }
     }, []);
     const api = { ...state, login, logout, switchTenant, refresh: doRefresh };
-    return _jsx(SessionContext.Provider, { value: api, children: children });
+    // Keyed on the primitives, not the profile object: every refresh (tenant
+    // switch, session bootstrap retry) builds a new profile object, and a new
+    // CurrentUser reference would re-seed a create form and drop typed input.
+    const profile = state.user;
+    const userId = profile?.id;
+    const userEmail = profile?.email;
+    const userDisplayName = profile?.displayName;
+    const userTimeZone = profile?.effectiveTimeZone;
+    const currentUser = useMemo(() => userId === undefined || userEmail === undefined || userDisplayName === undefined
+        ? undefined
+        : {
+            id: userId,
+            email: userEmail,
+            displayName: userDisplayName,
+            ...(userTimeZone !== undefined && { timeZone: userTimeZone }),
+        }, [userId, userEmail, userDisplayName, userTimeZone]);
+    return (_jsx(SessionContext.Provider, { value: api, children: _jsx(CurrentUserProvider, { user: currentUser, children: children }) }));
 }
 export function useSession() {
     const ctx = useContext(SessionContext);

package/dist/cap-counter/index.d.ts

@@ -7,5 +7,6 @@ export { capCounterEntity } from "./entity.js";
 export { capCounterFeature } from "./feature.js";
 export { readPayloadField } from "./payload-field.js";
 export { type CapGuardContext, type CapLimitContext, createStockCapGuard, type StockCapGuard, type StockCapSpec, } from "./stock-cap-guard.js";
+export { capReservationsTable, capReservationsTableMeta } from "./tables.js";
 export { createValueCapGuard, type ValueCapGuard, type ValueCapSpec, } from "./value-cap-guard.js";
 export { type CalendarCapDef, type CalendarCapResolver, type RollingCapDef, type RollingCapResolver, withCapEnforcement, withRollingCapEnforcement, } from "./with-cap-enforcement.js";

package/dist/cap-counter/index.js

@@ -8,5 +8,6 @@ export { capCounterEntity } from "./entity.js";
 export { capCounterFeature } from "./feature.js";
 export { readPayloadField } from "./payload-field.js";
 export { createStockCapGuard, } from "./stock-cap-guard.js";
+export { capReservationsTable, capReservationsTableMeta } from "./tables.js";
 export { createValueCapGuard, } from "./value-cap-guard.js";
 export { withCapEnforcement, withRollingCapEnforcement, } from "./with-cap-enforcement.js";

package/dist/data-retention/run-retention-cleanup.js

@@ -39,7 +39,7 @@
 // einzelnen Page — sonst verstopfen erledigte Rows das batchLimit-Fenster.
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { collectPiiSubjectFields, configuredPiiSubjectKms, isSelfPiiField, resolveSubjectForField, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, entityHasAnonymizableSubjectField, } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefEntity, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
@@ -149,7 +149,7 @@ async function forgetRowAndEraseKeys(args) {
 }
 const NO_FILE_FIELDS = { singleFields: [], multiFields: [] };
 // file/image = single-column fields (fileRef-id lives directly in the entity
-// row); files/images = plural, no column, resolved via file_refs. Same set
+// row); files/images = plural, resolved via file_refs. Same set
 // as boot-validator/entity-handler.ts FILE_FIELD_TYPES and engine's
 // isFileField — inlined here rather than importing across the package
 // barrel since this module already needs the single/multi split, not just
@@ -169,8 +169,8 @@ function planFileFields(fields) {
         : NO_FILE_FIELDS;
 }
 // Every fileRef-id a row's file/image/files/images-fields reference: single
-// fields hold the id in their own column, plural fields have no column and
-// resolve via file_refs (tenantId, entityType, entityId, fieldName).
+// fields hold the id in their own column, plural fields resolve
+// via file_refs (tenantId, entityType, entityId, fieldName).
 async function collectFileRefIds(db, tenantId, entityName, row, plan) {
     const ids = new Set();
     for (const field of plan.singleFields) {
@@ -536,7 +536,7 @@ export async function runRetentionCleanup(args) {
                     break;
                 }
                 const executor = createEventStoreExecutor(proj.table, entity, { entityName });
-                softDeleted += await purgeMatchingRows(db, proj.table, { ...where, isDeleted: false }, batchLimit, (id) => executor.delete({ id }, systemUser, tdb));
+                softDeleted += await purgeMatchingRows(db, proj.table, { ...where, isDeleted: false }, batchLimit, (id) => executor.delete({ id }, systemUser, tdb, { writePurpose: WritePurposes.retention }));
                 break;
             }
             // blockDelete = Legal-Hold: rows stay untouched during keepFor (the
@@ -560,7 +560,10 @@ export async function runRetentionCleanup(args) {
                     break;
                 }
                 const executor = createEventStoreExecutor(proj.table, entity, { entityName });
-                anonymized += await anonymizeMatchingRows(db, proj.table, where, batchLimit, targets, (id, changes) => executor.update({ id, changes }, systemUser, tdb, { skipOptimisticLock: true }));
+                anonymized += await anonymizeMatchingRows(db, proj.table, where, batchLimit, targets, (id, changes) => executor.update({ id, changes }, systemUser, tdb, {
+                    skipOptimisticLock: true,
+                    writePurpose: WritePurposes.retention,
+                }));
                 break;
             }
         }

package/dist/document-ingest-foundation/aggregate-id.d.ts

@@ -0,0 +1 @@
+export declare function documentIngestAggregateId(tenantId: string, fileRefId: string): string;

package/dist/document-ingest-foundation/aggregate-id.js

@@ -0,0 +1,8 @@
+import { v5 as uuidv5 } from "uuid";
+// Fixed UUID namespace for document-ingest stream derivation. Frozen: changing
+// it re-keys every existing ingest stream.
+const DOCUMENT_INGEST_NAMESPACE = "5c1e8b7a-3d94-4f2a-b6e0-9a7d1c4f8e23";
+// @wrapper-known uuid-domain
+export function documentIngestAggregateId(tenantId, fileRefId) {
+    return uuidv5(`${tenantId}|${fileRefId}`, DOCUMENT_INGEST_NAMESPACE);
+}

package/dist/document-ingest-foundation/events.js

@@ -1,6 +1,8 @@
 import * as z from "zod";
 // documentIngest — own aggregate-type for the ingest-request stream, one
-// stream per fileRef (aggregateId = fileRefId). Not backed by an r.entity;
+// stream per fileRef with aggregateId derived from the fileRefId
+// (documentIngestAggregateId), never the fileRefId itself: foreign events on
+// the fileRef stream would break the fileRef's optimistic lock. Not backed by an r.entity;
 // this is a pure saga-anchor event (kumiko-framework#1497) that the Phase-2
 // worker job (kumiko-enterprise LiteParse provider) subscribes to.
 export const DOCUMENT_INGEST_AGGREGATE_TYPE = "document-ingest";

package/dist/document-ingest-foundation/feature.js

@@ -7,6 +7,7 @@ import { entityEventName } from "@cosmicdrift/kumiko-framework/db";
 import { access, createTenantConfig, defineFeature, EXT_TENANT_DATA, } from "@cosmicdrift/kumiko-framework/engine";
 import { normalizeMimeType } from "@cosmicdrift/kumiko-framework/files";
 import * as z from "zod";
+import { documentIngestAggregateId } from "./aggregate-id.js";
 import { validateDocumentIngestProviderWiring } from "./boot-checks.js";
 import { documentExtractEntity } from "./entity.js";
 import { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
@@ -36,8 +37,9 @@ const fileRefIngestFieldsSchema = z.object({
 // delete→restore round-trip re-requests ingest instead of leaving the file
 // without an extract.
 async function requestIngestForFileRef(event, fileRef, ctx) {
+    const ingestAggregateId = documentIngestAggregateId(event.tenantId, event.aggregateId);
     const skip = (reason) => ctx.unsafeAppendEvent({
-        aggregateId: event.aggregateId,
+        aggregateId: ingestAggregateId,
         aggregateType: DOCUMENT_INGEST_AGGREGATE_TYPE,
         type: DOCUMENT_INGEST_SKIPPED_EVENT_QN,
         payload: {
@@ -66,7 +68,7 @@ async function requestIngestForFileRef(event, fileRef, ctx) {
         return;
     }
     await ctx.unsafeAppendEvent({
-        aggregateId: event.aggregateId,
+        aggregateId: ingestAggregateId,
         aggregateType: DOCUMENT_INGEST_AGGREGATE_TYPE,
         type: DOCUMENT_INGEST_REQUESTED_EVENT_QN,
         payload: {

package/dist/document-ingest-foundation/index.d.ts

@@ -1,3 +1,4 @@
+export { documentIngestAggregateId } from "./aggregate-id.js";
 export { type DocumentExtractMeta, documentExtractEntity, documentExtractsTable, type IngestPage, } from "./entity.js";
 export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
 export { documentIngestFoundationFeature } from "./feature.js";

package/dist/document-ingest-foundation/index.js

@@ -1,4 +1,5 @@
 // Public API of the document-ingest-foundation bundled-feature.
+export { documentIngestAggregateId } from "./aggregate-id.js";
 export { documentExtractEntity, documentExtractsTable, } from "./entity.js";
 export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
 export { documentIngestFoundationFeature } from "./feature.js";

package/dist/folders-user-data/hooks.js

@@ -3,6 +3,7 @@
 // consumers without the user-data-rights pipeline don't pull a hard dependency.
 // Mirrors credit-user-data — standard tenant-scoped pattern, no name-stripping
 // (a folder name is tenant data, not per-user PII).
+import { WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createEntityExecutor, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { folderAssignmentEntity, folderEntity } from "../folders/index.js";
 const { table: folderTable, executor: folderExecutor } = createEntityExecutor("folder", folderEntity);
@@ -48,7 +49,9 @@ function tenantScopedDelete(table, executor) {
         const systemUser = createSystemUser(ctx.tenantId);
         const rows = await ctx.db.selectMany(table, { tenantId: ctx.tenantId });
         for (const row of rows) {
-            await executor.delete({ id: row.id }, systemUser, ctx.db);
+            await executor.delete({ id: row.id }, systemUser, ctx.db, {
+                writePurpose: WritePurposes.erasure,
+            });
         }
     };
 }

package/dist/form-draft-user-data/hooks.js

@@ -2,6 +2,7 @@
 // (GDPR Art. 20 export / Art. 17 erasure). Lives apart from form-draft so
 // consumers without the user-data-rights pipeline don't pull a hard
 // dependency.
+import { WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { formDraftExecutor, formDraftTable } from "../form-draft/index.js";
 export const formDraftExportHook = async (ctx) => {
@@ -36,7 +37,9 @@ export const formDraftDeleteHook = async (ctx) => {
     const systemUser = createSystemUser(ctx.tenantId);
     const failures = [];
     for (const row of rows) {
-        const result = await formDraftExecutor.delete({ id: row.id }, systemUser, ctx.db);
+        const result = await formDraftExecutor.delete({ id: row.id }, systemUser, ctx.db, {
+            writePurpose: WritePurposes.erasure,
+        });
         if (!result.isSuccess) {
             failures.push(`${row.id}: ${result.error.message}`);
         }

package/dist/shared/encrypt-for-direct-write.js

@@ -1,5 +1,5 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { collectPiiSubjectFields, configuredPiiSubjectKms, encryptPiiFieldValues, KeyErasedError, } from "@cosmicdrift/kumiko-framework/crypto";
+import { collectPiiEncryptedFields, configuredPiiSubjectKms, encryptPiiFieldValues, KeyErasedError, } from "@cosmicdrift/kumiko-framework/crypto";
 import { subjectErasedConflict } from "@cosmicdrift/kumiko-framework/errors";
 // Unmanaged direct-write stores (r.unmanagedTable) skip the executor, so its
 // PII encryption never runs — every insert of subject-annotated fields must
@@ -10,7 +10,7 @@ export async function encryptForDirectWrite(entity, entityName, row, fallbackReq
     if (!kms)
         return row;
     try {
-        return await encryptPiiFieldValues(row, entity, collectPiiSubjectFields(entity), kms, { requestId: requestContext.get()?.requestId ?? fallbackRequestId }, { entityName });
+        return await encryptPiiFieldValues(row, entity, collectPiiEncryptedFields(entity), kms, { requestId: requestContext.get()?.requestId ?? fallbackRequestId }, { entityName });
     }
     catch (e) {
         if (e instanceof KeyErasedError)

package/dist/shared/index.d.ts

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
 export { requireForTenant } from "./require-for-tenant.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/index.js

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
 export { requireForTenant } from "./require-for-tenant.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/redact-pii-ciphertext.d.ts

@@ -0,0 +1,2 @@
+export declare const REDACTED_PII_PLACEHOLDER: "[[personal data]]";
+export declare function redactPiiCiphertext(value: unknown): unknown;

package/dist/shared/redact-pii-ciphertext.js

@@ -0,0 +1,14 @@
+import { isPiiCiphertext } from "@cosmicdrift/kumiko-framework/crypto";
+export const REDACTED_PII_PLACEHOLDER = "[[personal data]]";
+// Event payloads store PII fields as subject-KMS ciphertext; the API leak guard
+// rejects any response carrying it, so payload reads swap it for a placeholder.
+export function redactPiiCiphertext(value) {
+    if (isPiiCiphertext(value))
+        return REDACTED_PII_PLACEHOLDER;
+    if (Array.isArray(value))
+        return value.map(redactPiiCiphertext);
+    if (typeof value === "object" && value !== null) {
+        return Object.fromEntries(Object.entries(value).map(([key, inner]) => [key, redactPiiCiphertext(inner)]));
+    }
+    return value;
+}

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -1,6 +1,6 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { append, loadAggregate, VersionConflictError, } from "@cosmicdrift/kumiko-framework/event-store";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
@@ -95,7 +95,7 @@ async function markTenantDestroyFailed(db, tenantId) {
     await tenantCrud.update({
         id: tenantId,
         changes: { status: "destroyFailed" },
-    }, user, scopedDb, { skipOptimisticLock: true });
+    }, user, scopedDb, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     invalidateTenantLifecycleGate(tenantId);
 }
 async function haltPipelineOnAbandon(args) {
@@ -240,7 +240,7 @@ export async function runTenantDestructionSweep(args) {
         // tenant stream, so an unguarded overwrite here would silently revert the
         // cancellation. A version conflict means we lost that race — skip, the
         // tenant is no longer due and the next tick re-evaluates it.
-        const result = await tenantCrud.update({ id: tenantId, version, changes: { status: "destroying", destroyStartedAt: now } }, user, scopedDb);
+        const result = await tenantCrud.update({ id: tenantId, version, changes: { status: "destroying", destroyStartedAt: now } }, user, scopedDb, { writePurpose: WritePurposes.erasure });
         if (!result.isSuccess)
             continue;
         invalidateTenantLifecycleGate(tenantId);

package/dist/tenant-lifecycle/stages.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, extensionUsageEscapeHatchReason, isTenantDataExtensionHooks, isTenantResourceExtensionHooks, } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
@@ -132,7 +132,7 @@ async function tombstoneTenantRow(ctx) {
             destroyedAt: now,
             isEnabled: false,
         },
-    }, user, db, { skipOptimisticLock: true });
+    }, user, db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     invalidateTenantLifecycleGate(ctx.tenantId);
     return STAGE_DONE;
 }

package/dist/user/handlers/me.query.d.ts

@@ -1,2 +1,4 @@
 import * as z from "zod";
-export declare const meQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"user:me", z.ZodObject<{}, z.core.$strip>, Record<string, unknown> | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+export declare const meQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"user:me", z.ZodObject<{}, z.core.$strip>, {
+    effectiveTimeZone: string;
+} | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/user/handlers/me.query.js

@@ -6,6 +6,7 @@ import { userEntity, userTable } from "../schema/user.js";
 const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
 // Returns the currently signed-in user's profile. Field-level read access
 // strips out the passwordHash automatically (configured on the entity).
+// `effectiveTimeZone` is the effective IANA zone of the caller.
 export const meQuery = defineQueryHandler({
     name: "user:me",
     schema: z.object({}),
@@ -26,6 +27,9 @@ export const meQuery = defineQueryHandler({
             throw new InternalError({ message: "user:me requires r.systemScope()" });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("user rows are tenant-agnostic identity records; self-lookup by id needs no tenant filter");
-        return crud.detail({ id: query.user.id }, query.user, db); // @wrapper-known semantic-alias
+        const row = await crud.detail({ id: query.user.id }, query.user, db);
+        // `timezone` on the row is only the stored override (often unset); clients
+        // need the effective zone (override, else tenant, else UTC) to compute "today".
+        return row === null ? row : { ...row, effectiveTimeZone: ctx.tz.user };
     },
 });

package/dist/user-data-rights/handlers/download-by-token.query.js

@@ -48,7 +48,11 @@ export const downloadByTokenQuery = defineQueryHandler({
         })
             .optional(),
     }),
-    access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
+    // public-intake: rejected attempts store the anonymous caller's IP in the audit row.
+    access: {
+        roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"],
+        personalData: "public-intake",
+    },
     agent: { expose: false },
     // Brute-Force-Schutz fuer Token-Hash-Probing. Anonymous-Endpoint mit
     // 32-byte-Random-Token = 256 Bit Search-Space, aber rate-limit als

package/dist/user-data-rights/handlers/list-download-attempts.query.d.ts

@@ -11,5 +11,5 @@ export declare const listDownloadAttemptsQuery: import("@cosmicdrift/kumiko-type
     from: z.ZodOptional<z.ZodISODateTime>;
     to: z.ZodOptional<z.ZodISODateTime>;
 }, z.core.$strip>, {
-    rows: readonly any[];
+    rows: any[];
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/user-data-rights/handlers/list-download-attempts.query.js

@@ -2,10 +2,12 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
+import { decryptStoredPii } from "../../shared/index.js";
 import { downloadAttemptsTable } from "../schema/download-attempt.js";
 // Operator-Query: invalid Download-Attempts (S2.U7).
 // DPO-Sicht fuer Brute-Force-Detection. Tenant-isolated via WHERE.
 const MAX_LIMIT = 100;
+const REQUEST_ID = "user-data-rights:list-download-attempts";
 export const listDownloadAttemptsQuery = defineQueryHandler({
     name: "list-download-attempts",
     schema: z
@@ -42,6 +44,13 @@ export const listDownloadAttemptsQuery = defineQueryHandler({
             orderBy: { col: "attemptedAt", direction: "desc" },
             limit: p.limit,
         });
-        return { rows };
+        const decryptedRows = await Promise.all(rows.map(async (row) => ({
+            ...row,
+            ip: row.ip === null ? null : await decryptStoredPii(row.ip, "ip", REQUEST_ID),
+            userAgent: row.userAgent === null
+                ? null
+                : await decryptStoredPii(row.userAgent, "userAgent", REQUEST_ID),
+        })));
+        return { rows: decryptedRows };
     },
 });

package/dist/user-data-rights/handlers/my-audit-log.query.d.ts

@@ -13,7 +13,7 @@ export declare const myAuditLogQuery: import("@cosmicdrift/kumiko-types/define-h
         aggregateType: string;
         version: number;
         type: string;
-        payload: Record<string, unknown>;
+        payload: unknown;
         createdAt: unknown;
     }[];
     nextBefore: string | null;

package/dist/user-data-rights/handlers/my-audit-log.query.js

@@ -3,6 +3,7 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
+import { redactPiiCiphertext } from "../../shared/index.js";
 // DSGVO Art. 15 Selbstauskunft — User reads HIS OWN audit-log.
 // WHERE createdBy = ctx.user.id ist hard-coded (kein userId-Param,
 // anti-cross-user-Snooping). KEIN tenantId-Filter: User hat Anspruch
@@ -63,7 +64,7 @@ export const myAuditLogQuery = defineQueryHandler({
             aggregateType: r["aggregate_type"],
             version: r["version"],
             type: r["type"],
-            payload: r["payload"],
+            payload: redactPiiCiphertext(r["payload"]),
             createdAt: r["created_at"],
         }));
         const last = serialised[serialised.length - 1];

package/dist/user-data-rights/index.d.ts

@@ -9,4 +9,5 @@ export type { SendDeletionExecutedEmailFn } from "./run-forget-cleanup.js";
 export { policyToStrategy, runForgetCleanup } from "./run-forget-cleanup.js";
 export type { UserExportBundle } from "./run-user-export.js";
 export { runUserExport } from "./run-user-export.js";
+export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.js";
 export { ACTIVE_JOB_CONSTRAINT, EXPORT_JOB_STATUS, type ExportJobStatus, exportJobEntity, exportJobsTable, } from "./schema/export-job.js";

package/dist/user-data-rights/index.js

@@ -15,4 +15,5 @@ export { backfillUserLifecycleEvents, updateUserLifecycle } from "./lib/update-u
 // split.
 export { policyToStrategy, runForgetCleanup } from "./run-forget-cleanup.js";
 export { runUserExport } from "./run-user-export.js";
+export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.js";
 export { ACTIVE_JOB_CONSTRAINT, EXPORT_JOB_STATUS, exportJobEntity, exportJobsTable, } from "./schema/export-job.js";

package/dist/user-data-rights/schema/download-attempt.js

@@ -29,23 +29,17 @@ export const downloadAttemptEntity = createEntity({
         jobId: createTextField({ personal: false, reason: "technical_reference" }),
         // User-ID wenn auth-Pfad (job). NULL bei anonymous (token-Pfad).
         attemptedByUserId: createTextField({ personal: false, reason: "pseudonymous_fk" }),
-        // No subject annotation on this buildEntityTable-managed entity:
-        // attemptedByUserId is null-by-design for the anonymous token path, so
-        // `personal: { of: "attemptedByUserId" }` would throw SubjectResolutionError
-        // on every such row once a KMS is configured
-        // (crypto/subject-resolver.ts resolveUserOwnedSubject).
-        // The job path knows the requester and an IP is personal data, so this is a
-        // deliberate waiver, not business data: a user forget does not shred these
-        // values, the 90d hardDelete below is what removes them.
+        // The anonymous token path has no owner, so those rows fall back to the tenant key;
+        // find "exact" on ip because list-download-attempts filters by IP.
         ip: createTextField({
             maxLength: 64,
-            personal: false,
-            reason: "security_audit_retention_bounded",
+            personal: { of: "attemptedByUserId", whenAbsent: "tenant" },
+            find: "exact",
         }),
         userAgent: createTextField({
             maxLength: 256,
-            personal: false,
-            reason: "security_audit_retention_bounded",
+            personal: { of: "attemptedByUserId", whenAbsent: "tenant" },
+            find: "none",
         }),
         attemptedAt: createTimestampField({ required: true }),
     },

package/dist/user-data-rights-defaults/feature.js

@@ -2,6 +2,7 @@ import { defineFeature, EXT_USER_DATA, } from "@cosmicdrift/kumiko-framework/eng
 import { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook.js";
 import { configValueDeleteHook, configValueExportHook, } from "./hooks/config-value.userdata-hook.js";
 import { deliveryAttemptDeleteHook, deliveryAttemptExportHook, } from "./hooks/delivery-attempt.userdata-hook.js";
+import { downloadAttemptDeleteHook, downloadAttemptExportHook, } from "./hooks/download-attempt.userdata-hook.js";
 import { fileRefDeleteHook, fileRefExportHook } from "./hooks/file-ref.userdata-hook.js";
 import { inAppMessageDeleteHook, inAppMessageExportHook, } from "./hooks/in-app-message.userdata-hook.js";
 import { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook.js";
@@ -33,7 +34,7 @@ import { userSessionDeleteHook, userSessionExportHook, } from "./hooks/user-sess
 // export use. See hooks/file-ref.userdata-hook.ts.
 export function createUserDataRightsDefaultsFeature() {
     return defineFeature("user-data-rights-defaults", (r) => {
-        r.describe("Registers ready-made `EXT_USER_DATA` export and delete hooks for the bundled entities that hold per-user data: `user` (delete strategy sets email to `deleted-<id>@anonymized.invalid`, nulls `passwordHash`, sets status to `Deleted`; anonymize strategy sets email to `anonymized-<id>@anonymized.invalid` without touching `passwordHash`), `fileRef` (delete removes both the DB row and the storage binary), plus — gated on the source feature being mounted — `user-session` (ip/userAgent, hard-delete), `api-token` (hard-delete = revoke), `in-app-message` (hard-delete), `tenant-invitation` (invitee email forgotten/pseudonymized, inviter link severed), `notification-preference` and user-scoped `config-value` (purged via the forget verb), plus export-only hooks for the events-only aggregates `delivery-attempt` (recipientAddress) and `job-run` (payload) whose erasure runs via crypto-shredding. Mount this alongside `user-data-rights` for standard GDPR compliance; omit it only if your app needs custom anonymization logic for these entities.");
+        r.describe("Registers ready-made `EXT_USER_DATA` export and delete hooks for the bundled entities that hold per-user data: `user` (delete strategy sets email to `deleted-<id>@anonymized.invalid`, nulls `passwordHash`, sets status to `Deleted`; anonymize strategy sets email to `anonymized-<id>@anonymized.invalid` without touching `passwordHash`), `fileRef` (delete removes both the DB row and the storage binary), plus — gated on the source feature being mounted — `user-session` (ip/userAgent, hard-delete), `api-token` (hard-delete = revoke), `in-app-message` (hard-delete), `tenant-invitation` (invitee email forgotten/pseudonymized, inviter link severed), `notification-preference` and user-scoped `config-value` (purged via the forget verb), plus export-only hooks for the events-only aggregates `delivery-attempt` (recipientAddress) and `job-run` (payload) whose erasure runs via crypto-shredding, and `download-attempt` (rejected export-download attempts of the user: result, path, source IP, user agent, time; delete purges the user's own attempts via the forget verb, token-path rows without an owner expire by retention). Mount this alongside `user-data-rights` for standard GDPR compliance; omit it only if your app needs custom anonymization logic for these entities.");
         r.uiHints({
             displayLabel: "User Data Rights · Default Hooks",
             category: "compliance",
@@ -85,6 +86,10 @@ export function createUserDataRightsDefaultsFeature() {
             export: deliveryAttemptExportHook,
             delete: deliveryAttemptDeleteHook,
         });
+        r.useExtension(EXT_USER_DATA, "download-attempt", {
+            export: downloadAttemptExportHook,
+            delete: downloadAttemptDeleteHook,
+        });
         r.useExtension(EXT_USER_DATA, "job-run", {
             export: jobRunExportHook,
             delete: jobRunDeleteHook,

package/dist/user-data-rights-defaults/hooks/download-attempt.userdata-hook.d.ts

@@ -0,0 +1,3 @@
+import { type UserDataDeleteHook, type UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+export declare const downloadAttemptExportHook: UserDataExportHook;
+export declare const downloadAttemptDeleteHook: UserDataDeleteHook;

package/dist/user-data-rights-defaults/hooks/download-attempt.userdata-hook.js

@@ -0,0 +1,48 @@
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
+import { downloadAttemptEntity, downloadAttemptsTable } from "../../user-data-rights/index.js";
+// Event-sourced entity: forget goes through the executor so the erasure replays
+// on rebuild and removes the projection row including ip_bidx.
+const crud = createEventStoreExecutor(downloadAttemptsTable, downloadAttemptEntity, {
+    entityName: "download-attempt",
+});
+// Only job-path attempts name a user; token-path rows have no owner and sit
+// under the tenant key. ip may be ciphertext (kumiko-pii:), which the export
+// runner's central decrypt sweep resolves.
+export const downloadAttemptExportHook = async (ctx) => {
+    const rows = await ctx.db.selectMany(downloadAttemptsTable, {
+        tenantId: ctx.tenantId,
+        attemptedByUserId: ctx.userId,
+    });
+    if (rows.length === 0)
+        return null;
+    return {
+        entity: "download-attempt",
+        rows: rows.map((r) => ({
+            result: r["result"],
+            via: r["via"],
+            ip: r["ip"],
+            userAgent: r["userAgent"],
+            attemptedAt: r["attemptedAt"],
+        })),
+    };
+};
+// Both strategies purge: key erasure alone leaves attemptedByUserId and the
+// blind index linking the user to the row until retention, and not every forget
+// path shreds the subject key.
+export const downloadAttemptDeleteHook = async (ctx) => {
+    const systemUser = createSystemUser(ctx.tenantId);
+    const rows = await ctx.db.selectMany(downloadAttemptsTable, {
+        tenantId: ctx.tenantId,
+        attemptedByUserId: ctx.userId,
+    });
+    const failures = [];
+    for (const row of rows) {
+        const id = row["id"];
+        if (typeof id !== "string")
+            continue;
+        collectErasureFailure(await crud.forget({ id }, systemUser, ctx.db), "download-attempt", id, failures);
+    }
+    throwIfErasureFailed(failures);
+};

package/dist/user-data-rights-defaults/hooks/file-ref.userdata-hook.js

@@ -1,4 +1,4 @@
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
@@ -184,6 +184,7 @@ async function severPersonLink(tdb, systemUser, rows) {
             continue;
         await crud.update({ id, changes: { insertedById: null } }, systemUser, tdb, {
             skipOptimisticLock: true,
+            writePurpose: WritePurposes.erasure,
         });
     }
 }

package/dist/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.js

@@ -1,4 +1,4 @@
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { collectErasureFailure, decryptStoredPii, mapWithConcurrency, throwIfErasureFailed, } from "../../shared/index.js";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/index.js";
@@ -95,7 +95,7 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
             else {
                 // Row-id in the pseudonym keeps the (tenantId, email) unique index
                 // collision-free when a user has invitations in several states.
-                await crud.update({ id, changes: { email: `forgotten-${id}@anonymized.invalid` } }, systemUser, ctx.db, { skipOptimisticLock: true });
+                await crud.update({ id, changes: { email: `forgotten-${id}@anonymized.invalid` } }, systemUser, ctx.db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
             }
         }
     }
@@ -115,6 +115,7 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
             continue;
         await crud.update({ id, changes: { invitedBy: INVITED_BY_ANONYMIZED } }, systemUser, ctx.db, {
             skipOptimisticLock: true,
+            writePurpose: WritePurposes.erasure,
         });
     }
     throwIfErasureFailed(failures);

package/dist/user-data-rights-defaults/hooks/user.userdata-hook.js

@@ -1,4 +1,4 @@
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, WritePurposes } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "../../user/index.js";
 // Forget writes go through the executor (events), not a raw UPDATE: a
@@ -72,7 +72,7 @@ export const userDeleteHook = async (ctx, strategy) => {
                 // Frozen into the event payload, so a rebuild replays the same value.
                 deletedAt: Temporal.Now.instant(),
             },
-        }, systemUser, ctx.db, { skipOptimisticLock: true });
+        }, systemUser, ctx.db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     }
     else {
         // anonymize: PII raus, aber Row bleibt active (damit FK-References
@@ -86,6 +86,6 @@ export const userDeleteHook = async (ctx, strategy) => {
                 email: `${USER_ANONYMIZED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
                 displayName: USER_ANONYMIZED_DISPLAY_NAME,
             },
-        }, systemUser, ctx.db, { skipOptimisticLock: true });
+        }, systemUser, ctx.db, { skipOptimisticLock: true, writePurpose: WritePurposes.erasure });
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.360.0",
+  "version": "0.362.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -520,12 +520,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.360.0",
-    "@cosmicdrift/kumiko-framework": "0.360.0",
-    "@cosmicdrift/kumiko-headless": "0.360.0",
-    "@cosmicdrift/kumiko-renderer": "0.360.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.360.0",
-    "@cosmicdrift/kumiko-types": "0.360.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.362.0",
+    "@cosmicdrift/kumiko-framework": "0.362.0",
+    "@cosmicdrift/kumiko-headless": "0.362.0",
+    "@cosmicdrift/kumiko-renderer": "0.362.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.362.0",
+    "@cosmicdrift/kumiko-types": "0.362.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1059,8 +1059,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.360.0",
-    "@cosmicdrift/kumiko-locale-es": "0.360.0",
+    "@cosmicdrift/kumiko-locale-de": "0.362.0",
+    "@cosmicdrift/kumiko-locale-es": "0.362.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/src/audit/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "fix",
+    "title": "Audit log works under an active subject KMS",
+    "detail": "audit list, audit details and user-data-rights my-audit-log returned event payloads as stored. With a subject KMS configured the payload carried kumiko-pii ciphertext and the API leak guard answered 500 pii_ciphertext_leak. Every PII ciphertext string in the payload is now replaced by REDACTED_PII_PLACEHOLDER (\"[[personal data]]\"); the audit log still never shows plaintext PII."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/src/cap-counter/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "cap-counter exports capReservationsTable and capReservationsTableMeta",
+    "detail": "The reservation table store_cap_reservations was only reachable through internal imports, so kumiko-enterprise redeclared it in a test. The cap-counter entry now exports capReservationsTable and capReservationsTableMeta, following the feature-toggles pattern."
+  },
   {
     "version": "0.358.0",
     "type": "improvement",

package/src/document-ingest-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.362.0",
+    "type": "fix",
+    "title": "document-ingest events live on their own stream",
+    "detail": "documentIngest.requested/skipped were appended to the fileRef's own event stream (aggregateId = fileRefId), so the request-ingest projection racing a save that binds a pending upload broke the fileRef's optimistic lock (409 version_conflict). They now use documentIngestAggregateId(tenantId, fileRefId); payload.fileRefId is unchanged."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "user:me returns effectiveTimeZone, SessionProvider provides the current user",
+    "detail": "The me query adds effectiveTimeZone (ctx.tz.user), CurrentUserProfile.effectiveTimeZone is parsed by fetchCurrentUser and SessionProvider wraps its children in CurrentUserProvider."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/src/user-data-rights/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.362.0",
+    "type": "fix",
+    "title": "download-attempt.ip and userAgent are encrypted personal data instead of plaintext",
+    "detail": "download-attempt.ip and userAgent are declared personal: { of: \"attemptedByUserId\", whenAbsent: \"tenant\" }, ip with find \"exact\" and userAgent with find \"none\". With a KMS configured, rows written by the logged-in job path are encrypted under the requesting user's key (a user forget makes IP and user agent unreadable), rows from the anonymous token path under the tenant key. The new ip_bidx column keeps the equality filter of list-download-attempts working across both kinds of rows, and the query now returns the decrypted values (an erased user's values come back as the erased sentinel). user-data-rights-defaults registers an EXT_USER_DATA hook for download-attempt: export lists the user's own attempts, delete purges the user's own attempts via the forget verb (projection row and blind index included, replayed on rebuild); owner-less token-path rows expire with the 90d hardDelete retention.",
+    "migration": "Apps that mount user-data-rights run kumiko-schema generate and apply: the migration adds the ip_bidx column and its index to read_download_attempts. Apps that mount user-data-rights without user-data-rights-defaults must register their own EXT_USER_DATA hook for the download-attempt entity, otherwise boot fails the PII hook coverage check. The annotation fingerprint of the boot PII backfill changes, so the first boot after the bump does one full pass: it encrypts existing download-attempt events (tenant key or user key) and rebuilds the projection including ip_bidx (KUMIKO_SKIP_PII_BACKFILL=1 turns it off)."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",