@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/dist/user-data-rights/handlers/my-audit-log.query.js

@@ -4,10 +4,10 @@ import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { redactPiiCiphertext } from "../../shared/index.js";
-// DSGVO Art. 15 Selbstauskunft — User reads HIS OWN audit-log.
-// WHERE createdBy = ctx.user.id ist hard-coded (kein userId-Param,
-// anti-cross-user-Snooping). KEIN tenantId-Filter: User hat Anspruch
-// auf account-weite Sicht ueber alle Memberships — analog Forget-Pfad.
+// GDPR Art. 15 self-disclosure: users may read only their own audit log.
+// `createdBy = ctx.user.id` is hard-coded to prevent cross-user snooping;
+// no `tenantId` filter is applied because the user is entitled to an
+// account-wide view across all memberships, as in the forget path.
 const MAX_LIMIT = 100;
 const MY_AUDIT_LOG_REASON = "reads the caller's own events across all tenant memberships, bounded by createdBy = caller";
 export const myAuditLogQuery = defineQueryHandler({

package/dist/user-data-rights/handlers/request-deletion-by-email.write.d.ts

@@ -5,12 +5,12 @@ export type SendDeletionVerificationEmailFn = (args: {
     readonly expiresAt: string;
 }) => Promise<void>;
 export type RequestDeletionByEmailOptions = {
-    /** HMAC-Secret zum Signieren des Verify-Tokens. Ohne Secret ist der Flow
-     *  deaktiviert (Handler antwortet still mit success, kein Link). */
+    /** HMAC secret used to sign the verification token. Without a secret, the flow
+     *  is disabled (the handler silently responds with success and no link). */
     readonly deletionTokenSecret?: string;
-    /** Basis-URL des Apex-Confirm-Screens, z.B.
-     *  "https://app.example.com/delete-account/confirm". Der Handler hängt das
-     *  Token als URL-Fragment an (`#token=<token>`, fw#1554). Ohne URL kein Link. */
+    /** Base URL of the Apex confirmation screen, e.g.
+     *  "https://app.example.com/delete-account/confirm". The handler appends the
+     *  token as a URL fragment (`#token=<token>`). Without a URL, no link is sent. */
     readonly deletionVerifyUrl?: string;
     readonly sendDeletionVerificationEmail?: SendDeletionVerificationEmailFn;
 };

package/dist/user-data-rights/handlers/request-deletion-by-email.write.js

@@ -3,13 +3,13 @@ import * as z from "zod";
 import { USER_STATUS, userTable } from "../../user/index.js";
 import { signDeletionToken } from "../deletion-token.js";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
-// TTL des Verify-Links. 60 min — lang genug für einen Mail-Roundtrip,
-// kurz genug dass ein abgefangener Link nicht ewig gültig ist.
+// Verification-link TTL: 60 minutes — long enough for an email round trip,
+// but short enough that an intercepted link does not remain valid indefinitely.
 const DELETION_VERIFY_TTL_MINUTES = 60;
 // Token goes in the URL fragment, not a query param — fragments never leave
 // the browser (not sent to the server, so they never land in proxy/access
 // logs, unlike `?token=`). Same convention as the export-download link
-// (feature.ts, issue #1271). Preserves any existing query params on `base`
+// (feature.ts). Preserves any existing query params on `base`
 // (`?lang=de` stays a query param; only the token is a fragment).
 const APPEND_LIFECYCLE_EVENT_REASON = "appends the user lifecycle event on the SYSTEM_TENANT_ID user stream";
 export function buildDeletionVerifyUrl(base, token) {
@@ -17,14 +17,14 @@ export function buildDeletionVerifyUrl(base, token) {
     url.hash = `token=${encodeURIComponent(token)}`;
     return url.toString();
 }
-// Anonymer Apex-Flow Schritt 1: "Account-Löschung beantragen" per Email.
-// DSGVO-relevant gerade wenn der User sich NICHT mehr einloggen kann
-// (Lockout). Email → Magic-Link → confirm-deletion-by-token.
+// Anonymous Apex flow step 1: request account deletion by email.
+// This is especially relevant for GDPR when the user can no longer log in
+// (lockout). Email → magic link → confirm-deletion-by-token.
 //
-// Enumeration-safe (content): antwortet IMMER mit derselben success-Shape,
-// egal ob die Email existiert, der User aktiv ist oder der Flow konfiguriert
-// ist. Ein Link wird nur für einen existierenden, aktiven User generiert.
-// Timing-Safety hängt am non-blocking Callback (siehe Type-Doc oben).
+// Enumeration-safe (content): always returns the same success shape,
+// regardless of whether the email exists, the user is active, or the flow is
+// configured. A link is generated only for an existing, active user.
+// Timing safety depends on the non-blocking callback (see the type doc above).
 export function createRequestDeletionByEmailHandler(opts = {}) {
     return defineWriteHandler({
         name: "request-deletion-by-email",
@@ -33,7 +33,7 @@ export function createRequestDeletionByEmailHandler(opts = {}) {
         description: "Mails an account-deletion verification link to the given address, for a user who wants to be erased but can no longer log in; it answers identically whether or not the address belongs to an active account and never returns the link.",
         // Mails a deletion link to any address the caller names.
         agent: { risk: "high" },
-        // Defense-in-depth gegen Email-Probing auf dem anonymen Endpoint.
+        // Defense in depth against email probing on the anonymous endpoint.
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
         escapeHatch: {
             grants: ["unsafeRaw", "globalWrites"],
@@ -41,7 +41,8 @@ export function createRequestDeletionByEmailHandler(opts = {}) {
         },
         handler: async (event, ctx) => {
             const success = { isSuccess: true, data: { kind: "requested" } };
-            // not-configured-safe: ohne Secret/URL kein Link, aber gleiche Antwort.
+            // Safe when not configured: without a secret or URL, no link is sent, but the response is
+            // unchanged.
             if (!opts.deletionTokenSecret || !opts.deletionVerifyUrl)
                 return success;
             const userRow = await ctx.db
@@ -53,9 +54,9 @@ export function createRequestDeletionByEmailHandler(opts = {}) {
             if (!userRow || userRow["status"] !== USER_STATUS.Active || !userRow["email"]) {
                 return success;
             }
-            // Replay-Schutz (#354/1): pro Antrag eine frische requestId, die auf der
-            // user-Row landet und in die Token-HMAC-Purpose gefaltet wird. cancel
-            // nullt sie → ein nach Cancel nachgespieltes Token verifiziert nicht mehr.
+            // Replay protection: each request gets a fresh requestId, which is stored on
+            // the user row and incorporated into the token HMAC purpose. cancel
+            // nulls it, so a token replayed after cancellation no longer verifies.
             const requestId = crypto.randomUUID();
             await updateUserLifecycle(ctx.db.unsafeRaw(), userRow["id"], {
                 pendingDeletionRequestId: requestId,

package/dist/user-data-rights/handlers/request-deletion.write.d.ts

@@ -11,8 +11,8 @@ export type SendDeletionRequestedEmailFn = (args: {
 }) => Promise<void>;
 export type RequestDeletionOptions = {
     readonly sendDeletionRequestedEmail?: SendDeletionRequestedEmailFn;
-    /** Branding fuer die Default-Mail wenn kein sendDeletionRequestedEmail
-     *  gesetzt ist + mail-foundation gemountet ist. */
+    /** Branding for the default email when sendDeletionRequestedEmail is not set
+     *  and mail-foundation is mounted. */
     readonly mailDefaults?: GdprMailDefaults;
 };
 export declare function createRequestDeletionHandler(opts?: RequestDeletionOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-deletion", z.ZodObject<{}, z.core.$strip>, {

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -4,11 +4,10 @@ import * as z from "zod";
 import { USER_STATUS } from "../../user/index.js";
 import { isGdprMailDeliveryAvailable, makeDefaultDeletionRequestedEmail, } from "../lib/default-mailers.js";
 import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
-// POST /api/user/request-deletion (S2.U5a) — DSGVO Art. 17 Forget-Antrag.
-// Flippt status=Active → deletionRequested, setzt gracePeriodEnd aus dem
-// Compliance-Profile (geteilte Logik: startDeletionGracePeriod). Account-
-// weite Semantik (1 User-Row global), siehe docs/plans/architecture/
-// user-data-rights.md "Cross-Tenant-Semantik".
+// POST /api/user/request-deletion — GDPR Art. 17 erasure request.
+// Changes status=Active → deletionRequested and sets gracePeriodEnd from the compliance
+// profile using the shared startDeletionGracePeriod logic. The operation applies to the
+// account-wide user row, so the user identity is global across tenants.
 export function createRequestDeletionHandler(opts = {}) {
     return defineWriteHandler({
         name: "request-deletion",
@@ -39,8 +38,7 @@ export function createRequestDeletionHandler(opts = {}) {
                 (ctx.notify !== undefined && isGdprMailDeliveryAvailable(ctx.registry)
                     ? makeDefaultDeletionRequestedEmail(ctx.notify, opts.mailDefaults)
                     : undefined);
-            // Best-effort Email-Notification. Send-Failure darf das Write nicht
-            // killen — siehe Type-Doc oben.
+            // Best-effort email notification: a send failure must not abort the write.
             if (send && userEmail.length > 0) {
                 try {
                     await send({
@@ -56,8 +54,8 @@ export function createRequestDeletionHandler(opts = {}) {
                     console.warn(`[user-data-rights:request-deletion] sendDeletionRequestedEmail failed userId=${event.user.id} tenantId=${event.user.tenantId} err=${err instanceof Error ? err.message : String(err)}`);
                 }
             }
-            // Response liefert den absoluten gracePeriodEnd-Timestamp damit
-            // Frontend/Audit/Cleanup-Runner alle denselben Wert lesen.
+            // Returns the absolute gracePeriodEnd timestamp so the frontend, audit, and cleanup
+            // runner all use the same value.
             return {
                 isSuccess: true,
                 data: {

package/dist/user-data-rights/handlers/request-export.write.js

@@ -1,24 +1,25 @@
-// POST /api/user/request-export (S2.U3 Atom 2) — DSGVO Art. 15 + 20 Trigger.
+// POST /api/user/request-export — GDPR Art. 15 and 20 trigger.
 //
-// User triggert Export-Job. Persistenz via createEventStoreExecutor
-// (ES-Pattern, Memory: ES kein CRUD). Idempotency-Strategie zweistufig:
+// The user triggers an export job, persisted through
+// createEventStoreExecutor (event-sourced pattern; ES has no CRUD).
+// Idempotency uses two stages:
 //
-//   1) **App-side-Pre-Check (primaerer Pfad):** fetchOne aktive Jobs
-//      (status pending|running) fuer den userId. Wenn existing,
-//      return `{jobId, isExisting: true}` — KEIN neues Event,
-//      sauberer Audit-Trail (1 Klick-Storm = 1 Event, nicht N).
+//   1) **App-side pre-check (primary path):** fetch active jobs with
+//      (status pending|running) for the userId. If one exists, return
+//      `{jobId, isExisting: true}` without creating an event, so a click
+//      storm produces one audit event rather than N.
 //
-//   2) **DB-Constraint als Race-Schutz (Sekundaerpfad):** Bei parallelem
-//      Klick zwischen fetchOne + crud.create wirft die Tx 23505 mit
-//      constraint_name === "read_export_jobs_one_active_per_user".
-//      Catch + re-fetch + return existing als isExisting=true. Race-
-//      Window <1ms, in Production extrem selten.
+//   2) **DB constraint as race protection (secondary path):** if a parallel
+//      click occurs between fetchOne and crud.create, the transaction raises
+//      23505 with constraint_name === "read_export_jobs_one_active_per_user".
+//      Catch, re-fetch, and return the existing job with isExisting=true.
 //
-// **Cross-Tenant-Semantik:** ExportJob is tenant-agnostic (1 job per userId
-// across all memberships) — the pre-check uses ctx.db.unsafeRaw (no TenantDb filter) so a click from tenant B still finds the job from tenant A.
-// `requestedFromTenantId` persistiert den Initial-Tenant aus dem
-// 1. Klick — Worker liest sein Compliance-Profile aus DIESEM Tenant
-// fuer Job-TTL/Stale/Cleanup.
+// **Cross-tenant semantics:** ExportJob is tenant-agnostic (one job per
+// userId across all memberships), so the pre-check uses ctx.db.unsafeRaw
+// (no TenantDb filter) and a click from tenant B can find the job from tenant
+// A. `requestedFromTenantId` persists the tenant from the first click; the
+// worker reads its compliance profile from this tenant for job TTL, stale
+// handling, and cleanup.
 import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
@@ -29,11 +30,11 @@ const crud = createEventStoreExecutor(exportJobsTable, exportJobEntity, {
 });
 const REQUEST_EXPORT_REASON = "export jobs are keyed by userId across all of the user's tenant memberships, not the caller's current tenant";
 /**
- * Race-Loss-Detection: createEventStoreExecutor.create catched 23505
- * intern + returnt `WriteFailure(UniqueViolationError)`, **kein throw**.
- * Wir checken den Failure-Code + constraintName um den App-side-vs-Race-
- * Pfad zu unterscheiden. Andere Failures (validation, version-conflict,
- * ...) propagieren unveraendert.
+ * `createEventStoreExecutor.create` catches 23505 internally and returns
+ * `WriteFailure(UniqueViolationError)` rather than throwing. Check the
+ * failure code and constraintName to distinguish the app-side and race
+ * paths; propagate other failures (validation, version conflicts, ...)
+ * unchanged.
  */
 function isActiveJobConflict(failure) {
     const error = failure.error; // @cast-boundary error-details
@@ -62,9 +63,9 @@ export const requestExportWrite = defineWriteHandler({
         // TenantDb-Wrapper would hide cross-tenant jobs.
         const existing = await findActiveJob(exportJobRunner, userId);
         if (existing) {
-            // Snapshot-Status (kann zwischen fetchOne + Response stale werden
-            // wenn Worker parallel den State flippt; window minimal). User
-            // pollt fuer Live-Wahrheit ueber export-status.query.
+            // The returned status is a snapshot and can become stale between fetchOne
+            // and the response if the worker changes the state concurrently. The
+            // window is minimal; clients poll export-status.query for live status.
             return {
                 isSuccess: true,
                 data: {
@@ -74,9 +75,9 @@ export const requestExportWrite = defineWriteHandler({
                 },
             };
         }
-        // Kein active Job — neuen anlegen via crud.create. requestedFromTenantId
-        // = aktueller Tenant des Users; Worker liest sein Compliance-Profile
-        // aus diesem Tenant.
+        // No active job exists, so create one through crud.create. Persist the
+        // user's current tenant in requestedFromTenantId so the worker reads the
+        // compliance profile from that tenant.
         const result = await crud.create({
             userId,
             requestedFromTenantId: event.user.tenantId,
@@ -84,16 +85,16 @@ export const requestExportWrite = defineWriteHandler({
             tenantId: event.user.tenantId,
         }, event.user, ctx.db);
         if (!result.isSuccess) {
-            // Race-Pfad: paralleler Klick hat zwischen findActiveJob + crud.create
-            // einen aktiven Job angelegt → UniqueViolationError mit unserem
-            // Constraint. Re-fetch + return existing als isExisting=true.
-            // Andere Failures (validation, version-conflict, ...) propagieren.
+            // A parallel click may create an active job between findActiveJob and
+            // crud.create, causing UniqueViolationError for our constraint. Re-fetch
+            // and return the existing job with isExisting=true. Propagate other
+            // failures (validation, version conflicts, ...) unchanged.
             if (isActiveJobConflict(result)) {
                 const winner = await findActiveJob(exportJobRunner, userId);
                 if (!winner) {
-                    // Sollte nie passieren — Constraint-Violation ohne existing
-                    // active Job hiesse der Constraint matcht etwas anderes.
-                    // Original-Failure zurueckgeben damit das auffaellt.
+                    // This should be impossible: a constraint violation without an existing
+                    // active job would mean the constraint matched something else.
+                    // Return the original failure so the inconsistency is visible.
                     return result;
                 }
                 return {
@@ -107,17 +108,17 @@ export const requestExportWrite = defineWriteHandler({
             }
             return result;
         }
-        // Happy path: neuer Job. SaveContext.id ist EntityId (number | string);
-        // exportJobEntity hat idType:"uuid" → garantiert string, String()
-        // schuetzt vor Drift falls jemand die Entity auf serial migriert.
+        // SaveContext.id is EntityId (number | string), while exportJobEntity has
+        // idType:"uuid" and therefore guarantees a string. String() protects
+        // against drift if the entity is migrated to serial.
         const created = result.data; // @cast-boundary engine-payload
         return {
             isSuccess: true,
             data: {
                 jobId: String(created.id),
-                // Snapshot: just-created → pending. Live-Wahrheit kommt ueber
-                // export-status.query, status hier ist nice-to-have fuer das
-                // initial UI-Render ("Anfrage angenommen, currently pending").
+                // This is a snapshot: a just-created job is pending. Live status comes
+                // from export-status.query; this value is only a convenience for the
+                // initial UI render ("Anfrage angenommen, currently pending").
                 status: EXPORT_JOB_STATUS.Pending,
                 isExisting: false,
             },

package/dist/user-data-rights/handlers/restrict-account.write.js

@@ -5,15 +5,16 @@ import { USER_STATUS, userTable } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant.js";
 import { isAdminActor } from "../lib/is-admin-actor.js";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
-// POST /api/user/restrict (S2.U6) — DSGVO Art. 18 Account-Freeze.
-// Flippt status=Active → Restricted und revoked alle live sessions
-// des Users via cross-feature ctx.writeAs(sessions.revokeAllForUser).
+// POST /api/user/restrict — GDPR Art. 18 account freeze.
+// Flips status=Active → Restricted and revokes all live sessions
+// for the user via cross-feature ctx.writeAs(sessions.revokeAllForUser).
 //
-// Plan-Doc-Verhalten ("Schreib-API geblockt"):
-//   - Login geblockt: login.write.ts checked status=Restricted (Atom 3).
-//   - Active sessions: revoked durch cross-feature-call (sessions-feature
-//     muss gemountet sein). App-Author ohne sessions-feature kriegt einen
-//     Boot-Resolver-Error via r.usesApi("sessions.revokeAllForUser").
+// Write API behaviour:
+//   - Login is blocked: login.write.ts checks status=Restricted (Atom 3).
+//   - Active sessions are revoked through a cross-feature call (the
+//     sessions feature must be mounted). An app author without the
+//     sessions feature gets a boot resolver error via
+//     r.usesApi("sessions.revokeAllForUser").
 //
 // Self-service by default (userId omitted → event.user.id). An admin can
 // also target someone else's account — needed once a user is already
@@ -22,14 +23,16 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
 // themselves; only an operator path reaches it at that point.
 //
 // Tenant scope: `isAdminActor` accepts access.admin, which includes TenantAdmin
-// (tenant-scoped) even though the User-entity is global — see user-data-rights.md "Cross-Tenant-Semantik". Without a membership check, a TenantAdmin from tenant A could restrict/unrestrict a user who
-// has never been a member of tenant A. Only SystemAdmin (platform-wide)
-// skips the check; the target must have a membership row in the acting
-// admin's `event.user.tenantId` (row existence only — no active-status field).
+// (tenant-scoped) even though the User entity is global — see user-data-rights.md
+// "Cross-Tenant-Semantik". Without a membership check, a TenantAdmin from tenant A
+// could restrict or unrestrict a user who has never been a member of tenant A.
+// Only SystemAdmin (platform-wide) skips the check; the target must have a
+// membership row in the acting admin's `event.user.tenantId` (row existence only —
+// no active-status field).
 //
-// State-Transitions:
-//   Active → Restricted        ✓ (dieser Handler)
-//   Restricted → Restricted    ✗ 422 already_restricted (Idempotenz-Guard)
+// State transitions:
+//   Active → Restricted        ✓ (this handler)
+//   Restricted → Restricted    ✗ 422 already_restricted (idempotency guard)
 //   DeletionRequested → ...    ✗ 422 user_not_in_active_state
 //   Deleted → ...              ✗ 422 user_not_in_active_state
 export const restrictAccountWrite = defineWriteHandler({
@@ -83,10 +86,10 @@ export const restrictAccountWrite = defineWriteHandler({
             }));
         }
         await updateUserLifecycle(ctx.db.unsafeRaw(), targetUserId, { status: USER_STATUS.Restricted });
-        // Cross-Feature: alle live sessions revoken — sonst koennte der User
-        // mit existierendem JWT bis zur Token-Expiry weiter schreiben.
-        // ctx.writeAs(systemUser, ...) damit der privileged-Handler die
-        // System-User-Roles im access-gate hat.
+        // Cross-feature: all live sessions are revoked; otherwise the user could
+        // continue writing with an existing JWT until token expiry.
+        // ctx.writeAs(systemUser, ...) gives the privileged handler the
+        // System user roles required by its access gate.
         const systemUser = createSystemUser(event.user.tenantId);
         await ctx.writeAs(systemUser, "sessions:write:user-session:revoke-all-for-user", {
             userId: targetUserId,

package/dist/user-data-rights/handlers/run-forget-cleanup.write.js

@@ -1,14 +1,14 @@
-// POST /userDataRights/run-forget-cleanup (S2.U5b).
+// POST /userDataRights/run-forget-cleanup.
 //
-// Cron-Trigger fuer den Forget-Cleanup-Pipeline. Der Handler wrapt nur
-// `runForgetCleanup` damit er via dispatcher (System-User) aufrufbar
-// wird — die Pipeline-Logik selbst lebt im pure-function Modul
-// `run-forget-cleanup.ts` (testbar ohne dispatcher).
+// Cron trigger for the forget-cleanup pipeline. The handler only wraps
+// `runForgetCleanup` so the dispatcher can invoke it as the system user;
+// the pipeline logic itself lives in the pure-function module
+// `run-forget-cleanup.ts`, which can be tested without the dispatcher.
 //
-// Access: privileged — nur System-Caller (cron, ops-script). Im Cron-
-// Setup laeuft der Job mit `createSystemUser(...)` als executor.
+// Access: privileged — only system callers (cron, ops script). In the cron
+// setup, the job runs with `createSystemUser(...)` as executor.
 //
-// Rueckgabe: Stats fuer Operator-Monitoring (processed-count, error-list).
+// Returns stats for operator monitoring (processed count, error list).
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/dist/user-data-rights/index.js

@@ -2,17 +2,15 @@ export { deletionTokenSecretEnvSchema } from "./env.js";
 export { createUserDataRightsFeature } from "./feature.js";
 export { denyIfTargetOutsideAdminTenant, TARGET_USER_NOT_IN_ADMIN_TENANT, } from "./lib/deny-if-target-outside-admin-tenant.js";
 export { isSystemAdminActor } from "./lib/is-admin-actor.js";
-// #494 Bestandsdaten-Reconcile — Apps rufen das einmalig vor dem Re-Enable
-// von read_users-Rebuilds (siehe lib-Doc).
+// Reconcile existing data once before re-enabling read_users rebuilds.
+// See the library documentation for the required procedure.
 export { backfillUserLifecycleEvents, updateUserLifecycle } from "./lib/update-user-lifecycle.js";
-// Runner-Exports — App-Tests dürfen export/forget deterministisch laufen
-// lassen, statt über den Job-Cron zu warten (siehe sample
-// user-data-rights-demo).
-// Shared retention→strategy mapping (single source of truth per its own
-// doc comment) — other EXT_USER_DATA delete hooks that must independently
-// consult a DIFFERENT entity's retention (e.g. notes-history-user-data's
-// host-entity check) reuse this instead of re-deriving the anonymize/delete
-// split.
+// Exported so app tests can run export/forget deterministically instead of
+// waiting for the job cron.
+// Shared retention-to-strategy mapping: other EXT_USER_DATA delete hooks that
+// independently consult a DIFFERENT entity's retention (for example,
+// notes-history-user-data's host-entity check) reuse this instead of
+// re-deriving the anonymize/delete split.
 export { policyToStrategy, runForgetCleanup } from "./run-forget-cleanup.js";
 export { runUserExport } from "./run-user-export.js";
 export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.js";

package/dist/user-data-rights/lib/default-mailers.js

@@ -93,9 +93,9 @@ function emailChannelOf(registry) {
 }
 export function makeDefaultDeletionExecutedEmail(deps, defaults = {}) {
     return async (args) => {
-        // Der User ist global, der Mail-Transport per-Tenant — wir senden ueber den
-        // Transport des ersten Memberships. Orphan-User (0 Memberships) liefert
-        // keine Tenant-Identitaet → kein Transport aufloesbar, Mail entfaellt.
+        // The user is global, but the mail transport is tenant-specific, so use the
+        // first membership's transport. An orphan user has no tenant identity, so no
+        // transport can be resolved and the mail is omitted.
         const tenantId = args.tenantIds[0];
         if (tenantId === undefined) {
             // skip: orphan user has no tenant whose transport could send the mail

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -2,20 +2,17 @@ import { createEventStoreExecutor, createTenantDb, selectMany, } from "@cosmicdr
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
-// #494 — Lifecycle-Mutationen der user-Entity MUESSEN als `user.updated`-Event
-// laufen. Roh per updateMany geschrieben, wischt ein read_users-Rebuild sie
-// weg (er replayt nur `user.created` -> status faellt auf den Default zurueck;
-// gracePeriodEnd/pendingDeletionRequestId/Deleted gehen verloren = DSGVO-
-// Datenverlust).
+// Lifecycle mutations of the user entity MUST be emitted as `user.updated` events.
+// Writing them directly with updateMany causes a read_users rebuild to erase them
+// (it replays only `user.created`, so status falls back to its default;
+// gracePeriodEnd/pendingDeletionRequestId/Deleted are lost, causing GDPR data loss).
 //
-// Das Event MUSS in denselben (tenant_id, aggregate_id)-Stream wie
-// `user.created` landen, sonst splittet das Aggregat ueber Tenants und der
-// Rebuild rekonstruiert nichts. Die user-Entity laeuft `r.systemScope()`, ihre
-// Events landen aber auf einem konkreten Tenant-Stream (siehe
-// auth-email-password/stream-tenant.ts; Root-Cause-Fix tracked in #497). Darum:
-// Rescope auf den Stream-Tenant des Users — den des `user.created`-Events,
-// NICHT `event.user.tenantId` (das ist der aktive Tenant zur Lifecycle-Zeit und
-// kann abweichen).
+// The event MUST use the same (tenant_id, aggregate_id) stream as `user.created`,
+// otherwise the aggregate is split across tenants and cannot be reconstructed.
+// The user entity runs under `r.systemScope()`, but its events use a concrete
+// tenant stream (see auth-email-password/stream-tenant.ts). Therefore, rescope to
+// the user's stream tenant—the tenant of the `user.created` event—not
+// `event.user.tenantId`, which is the active tenant at lifecycle time and may differ.
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
 // `conn` is ctx.db.unsafeRaw() (regular handlers) or the open tx
 // (forget-cleanup sub-tx) — keeps the event append atomic with the write.
@@ -29,10 +26,10 @@ const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityNam
 // throws — those callers never checked a return value, so silently dropping
 // their write would be silent data loss.
 export async function updateUserLifecycle(conn, userId, changes, options) {
-    // user ist systemStream (#497): der Executor-Choke-Point addressiert den
-    // Stream immer auf SYSTEM_TENANT_ID — ein Rescope auf die row-tenant_id
-    // waere wirkungslos. "system"-Mode, damit loadById auch Legacy-Rows findet,
-    // deren tenant_id noch vor dem #762-Backfill-Rebuild steht.
+    // The user is a system stream: the executor choke point always addresses the
+    // stream through SYSTEM_TENANT_ID; rescoping to row-tenant_id would have no
+    // effect. Use "system" mode so loadById also finds legacy rows whose tenant_id
+    // predates the backfill rebuild.
     // skipOptimisticLock: every caller is a server-side business transition
     // (restrict/lift-restriction/grace-period/cancel/forget) that holds no row
     // version to pass as `payload.version`, which update() requires otherwise.