@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/cap-counter/__tests__/cap-list.boot.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, test } from "bun:test";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { CAP_COUNTER_LIST_SCREEN_ID } from "../constants";
+import { capCounterFeature } from "../feature";
+
+describe("cap-counter list screen + handler access alignment", () => {
+  const features = [capCounterFeature];
+
+  test("boot-validates with cap-list screen registered", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("cap-list screen is entityList, SystemAdmin-gated", () => {
+    const screen = capCounterFeature.screens[CAP_COUNTER_LIST_SCREEN_ID];
+    expect(screen?.type).toBe("entityList");
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(["SystemAdmin"]);
+    }
+  });
+
+  test("cap-counter list query shares SystemAdmin access", () => {
+    expect(rolesOf(capCounterFeature.queryHandlers["cap-counter:list"]?.access)).toEqual([
+      "SystemAdmin",
+    ]);
+  });
+});

package/src/cap-counter/__tests__/cap-list.security.integration.test.ts

@@ -0,0 +1,53 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { CAP_COUNTER_LIST_SCREEN_ID, CapCounterQueries } from "../constants";
+import { capCounterEntity } from "../entity";
+import { capCounterFeature } from "../feature";
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [capCounterFeature],
+  });
+  await unsafeCreateEntityTable(stack.db, capCounterEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("cap-counter access matrix", () => {
+  test("cap-list screen and list query are SystemAdmin-only", () => {
+    expect(rolesOf(stack.registry.getQueryHandler(CapCounterQueries.list)?.access)).toEqual([
+      "SystemAdmin",
+    ]);
+    const screen = capCounterFeature.screens[CAP_COUNTER_LIST_SCREEN_ID];
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(["SystemAdmin"]);
+    }
+  });
+});
+
+describe("cap-counter list HTTP access", () => {
+  test("SystemAdmin can list counters", async () => {
+    const admin = createTestUser({ id: 41, roles: ["SystemAdmin"] });
+    const res = await stack.http.queryOk<{ rows: readonly unknown[] }>(
+      CapCounterQueries.list,
+      {},
+      admin,
+    );
+    expect(Array.isArray(res.rows)).toBe(true);
+  });
+
+  test("TenantAdmin gets 403 on list", async () => {
+    const user = createTestUser({ id: 42, roles: ["TenantAdmin"] });
+    expect((await stack.http.query(CapCounterQueries.list, {}, user)).status).toBe(403);
+  });
+});

package/src/cap-counter/__tests__/entity-ddl.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, test } from "bun:test";
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { capCounterEntity } from "../entity";
+
+function pgTypeOf(table: unknown, dbName: string): string | undefined {
+  const cols = (table as { columns?: ReadonlyArray<{ name: string; pgType?: string }> }).columns;
+  return cols?.find((c) => c.name === dbName)?.pgType;
+}
+
+describe("capCounterEntity — DDL (#1205 regression)", () => {
+  test("value column is bigint, not double precision", () => {
+    const table = buildEntityTable("cap-counter", capCounterEntity);
+    expect(pgTypeOf(table, "value")).toBe("bigint");
+  });
+});

package/src/cap-counter/__tests__/with-cap-enforcement.integration.test.ts

@@ -170,10 +170,11 @@ describe("withCapEnforcement — calendar", () => {
     const beforeBlocked = await readCounter(admin, "newsletter-cap", PERIOD);
     expect(beforeBlocked!["value"]).toBe(6);
 
-    // 7. send: pre-call sieht value=6 ≥ hard=6 → CapExceededError, der
-    // dispatcher wickelt's als internal_error mit causeName=CapExceededError.
+    // 7. send: pre-call sieht value=6 ≥ hard=6 → CapExceededError (extends
+    // KumikoError) → dispatcher mapped auto auf 429 + cap_exceeded.
     const error = await stack.http.writeErr(NEWSLETTER_QN, { to: "blocked@x.de" }, admin);
-    expect(JSON.stringify(error)).toMatch(/CapExceededError/);
+    expect(error.code).toBe("cap_exceeded");
+    expect(error.httpStatus).toBe(429);
 
     // Drift-Pin: handler darf NICHT gelaufen sein (sendCallCount unverändert)
     expect(sendCallCount).toBe(6);
@@ -231,7 +232,8 @@ describe("withRollingCapEnforcement — rolling", () => {
     expect(sendCallCount).toBe(6);
 
     const error = await stack.http.writeErr(NEWSLETTER_ROLLING_QN, { to: "blocked@x.de" }, admin);
-    expect(JSON.stringify(error)).toMatch(/CapExceededError/);
+    expect(error.code).toBe("cap_exceeded");
+    expect(error.httpStatus).toBe(429);
     expect(sendCallCount).toBe(6); // handler wurde NICHT erneut aufgerufen
   });
 
@@ -270,7 +272,8 @@ describe("withRollingCapEnforcement — rolling", () => {
     expect(sendCallCount).toBe(7);
 
     const blocked = await stack.http.writeErr(NEWSLETTER_ROLLING_QN, { to: "blocked@x.de" }, admin);
-    expect(JSON.stringify(blocked)).toMatch(/CapExceededError/);
+    expect(blocked.code).toBe("cap_exceeded");
+    expect(blocked.httpStatus).toBe(429);
     expect(sendCallCount).toBe(7); // wrapper hat den blockierten handler NICHT gerufen
   });
 });

package/src/cap-counter/constants.ts

@@ -1,6 +1,8 @@
 // Feature name
 export const CAP_COUNTER_FEATURE = "cap-counter" as const;
 
+export const CAP_COUNTER_LIST_SCREEN_ID = "cap-list" as const;
+
 // Aggregate types — calendar-period-Counter benutzt CRUD-Events der
 // projection-row. Rolling-Window-Counter benutzt einen eigenen
 // aggregate-type mit custom increment-events (no projection — der

package/src/cap-counter/enforce-cap.ts

@@ -1,4 +1,5 @@
 import { createEntityExecutor, type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import { KumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { rollingCapAggregateId } from "./aggregate-id";
 import {
@@ -81,8 +82,8 @@ export type EnforceCapResult =
  *
  * **Throws** `CapExceededError` when value ≥ hard-threshold. Pre-save
  * hooks call this BEFORE the actual write — the throw rolls back the
- * transaction, the dispatcher maps the error to HTTP 429 with the
- * upgrade-hint shape (see CapExceededError below).
+ * transaction; `CapExceededError` extends `KumikoError` so the dispatcher
+ * auto-maps it to HTTP 429 (see CapExceededError below).
  *
  * **Sync read implication:** the counter reflects the state at this
  * exact transaction. Two parallel writes can each see "value < hard"
@@ -222,30 +223,26 @@ export async function enforceRollingCap(
 // =============================================================================
 
 /**
- * Thrown by enforceCap when value ≥ hard-threshold. Includes enough
- * context for the HTTP layer to render an actionable 429 — `code`
- * matches the framework's error-contract pattern (kebab + scope).
- *
- * Caller-side mapping example (in your dispatcher error-handler):
- *   if (err instanceof CapExceededError) {
- *     return c.json(
- *       { error: { code: err.code, message: err.message, capName: err.capName, ... } },
- *       429,
- *     );
- *   }
+ * Thrown by enforceCap/enforceRollingCap when value ≥ hard-threshold.
+ * Extends `KumikoError` — the dispatcher auto-maps this to HTTP 429
+ * with `code: "cap_exceeded"`, no caller-side catch needed.
  */
-export class CapExceededError extends Error {
+export class CapExceededError extends KumikoError {
   readonly code = "cap_exceeded" as const;
+  readonly httpStatus = 429;
+
   constructor(
     readonly capName: string,
     readonly limit: number,
     readonly currentValue: number,
     readonly tolerance: CapToleranceProfile,
   ) {
-    super(
-      `Cap "${capName}" exceeded: current=${currentValue}, limit=${limit}, hard-threshold=${limit * tolerance.hard}. Upgrade tier or wait for next period reset.`,
-    );
-    this.name = "CapExceededError";
+    super({
+      message: `Cap "${capName}" exceeded: current=${currentValue}, limit=${limit}, hard-threshold=${limit * tolerance.hard}. Upgrade tier or wait for next period reset.`,
+      i18nKey: "errors.cap.exceeded",
+      i18nParams: { capName, limit, currentValue },
+      details: { capName, limit, currentValue, tolerance },
+    });
   }
 }
 

package/src/cap-counter/entity.ts

@@ -1,6 +1,6 @@
 import {
+  createBigIntField,
   createEntity,
-  createNumberField,
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -40,8 +40,8 @@ import {
 export const capCounterEntity = createEntity({
   table: "read_cap_counters",
   fields: {
-    capName: createTextField({ required: true, maxLength: 100 }),
-    value: createNumberField({ required: true, default: 0 }),
+    capName: createTextField({ required: true, maxLength: 100, sortable: true, searchable: true }),
+    value: createBigIntField({ required: true, default: 0 }),
     periodStart: createTimestampField({ required: true }),
     lastSoftWarnedAt: createTimestampField(),
   },

package/src/cap-counter/feature.ts

@@ -47,7 +47,11 @@
 // vom Framework-Default (Base-Column tenantId).
 
 import { defineEntityListHandler, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { CAP_COUNTER_FEATURE, ROLLING_INCREMENTED_EVENT_SHORT } from "./constants";
+import {
+  CAP_COUNTER_FEATURE,
+  CAP_COUNTER_LIST_SCREEN_ID,
+  ROLLING_INCREMENTED_EVENT_SHORT,
+} from "./constants";
 import { capCounterEntity } from "./entity";
 import { getCounterQuery } from "./handlers/get-counter.query";
 import { incrementCapHandler } from "./handlers/increment.write";
@@ -56,6 +60,7 @@ import {
   rollingIncrementedSchema,
 } from "./handlers/increment-rolling.write";
 import { markSoftWarnedHandler } from "./handlers/mark-soft-warned.write";
+import { CAP_COUNTER_I18N } from "./i18n";
 
 const sysadminAccess = { access: { roles: ["SystemAdmin"] } } as const;
 
@@ -91,4 +96,26 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
   // über aggregate-id).
   r.queryHandler(defineEntityListHandler("cap-counter", capCounterEntity, sysadminAccess));
   r.queryHandler(getCounterQuery);
+
+  r.screen({
+    id: CAP_COUNTER_LIST_SCREEN_ID,
+    type: "entityList",
+    entity: "cap-counter",
+    columns: ["capName", "value", "periodStart", "lastSoftWarnedAt"],
+    defaultSort: { field: "capName", dir: "asc" },
+    searchable: true,
+    access: { roles: ["SystemAdmin"] },
+  });
+  r.nav({
+    id: "cap-list",
+    label: "cap-counter:nav.cap-list",
+    screen: "cap-counter:screen:cap-list",
+    order: 60,
+  });
+  r.translations({
+    keys: {
+      ...CAP_COUNTER_I18N,
+      "cap-counter:nav.cap-list": { de: "Limits", en: "Caps" },
+    },
+  });
 });

package/src/cap-counter/i18n.ts

@@ -0,0 +1,12 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const CAP_COUNTER_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:cap-list.title": { de: "Nutzungslimits", en: "Usage caps" },
+  "cap-counter:entity:cap-counter:field:capName": { de: "Limit", en: "Cap" },
+  "cap-counter:entity:cap-counter:field:value": { de: "Wert", en: "Value" },
+  "cap-counter:entity:cap-counter:field:periodStart": { de: "Periodenstart", en: "Period start" },
+  "cap-counter:entity:cap-counter:field:lastSoftWarnedAt": {
+    de: "Letzte Soft-Warnung",
+    en: "Last soft warning",
+  },
+};

package/src/cap-counter/with-cap-enforcement.ts

@@ -87,8 +87,8 @@ export function withCapEnforcement(
     handler: async (event, ctx) => {
       const cap = await capResolver(event, ctx);
 
-      // Pre-enforce. Hard-hit throws CapExceededError; the dispatcher
-      // maps it to HTTP 429 + cap_exceeded code. Soft-hit-crossing
+      // Pre-enforce. Hard-hit throws CapExceededError (extends KumikoError,
+      // dispatcher auto-maps to HTTP 429 + cap_exceeded). Soft-hit-crossing
       // notifies via the supplied notifier + flips lastSoftWarnedAt.
       await enforceCapAndMaybeNotify(ctx, {
         capName: cap.capName,

package/src/channel-email/__tests__/pii-guard.test.ts

@@ -0,0 +1,56 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { guardEmailMessage, withPiiCiphertextGuard } from "../pii-guard";
+import { createInMemoryTransport } from "../types";
+
+const CIPHERTEXT = "kumiko-pii:v1:user:6b2f4a0e-1c9d-4f3a-9d2e-00000000000a:8e2Rkjj+ww==";
+const originalNodeEnv = process.env["NODE_ENV"];
+
+afterEach(() => {
+  if (originalNodeEnv === undefined) delete process.env["NODE_ENV"];
+  else process.env["NODE_ENV"] = originalNodeEnv;
+});
+
+describe("guardEmailMessage", () => {
+  test("clean message passes through untouched", () => {
+    const msg = { to: "marc@example.com", subject: "Hi", html: "<p>Hi</p>" };
+    expect(guardEmailMessage(msg)).toBe(msg);
+  });
+
+  test("ciphertext recipient is always refused — even in production", () => {
+    process.env["NODE_ENV"] = "production";
+    expect(() => guardEmailMessage({ to: CIPHERTEXT, subject: "Hi", html: "x" })).toThrow(
+      /recipient address is a PII ciphertext/,
+    );
+  });
+
+  test("ciphertext in body fails loud outside production", () => {
+    expect(() =>
+      guardEmailMessage({ to: "marc@example.com", subject: "Hi", html: `<p>${CIPHERTEXT}</p>` }),
+    ).toThrow(/subject\/body contains a PII ciphertext/);
+  });
+
+  test("production redacts body/subject instead of throwing", () => {
+    process.env["NODE_ENV"] = "production";
+    const out = guardEmailMessage({
+      to: "marc@example.com",
+      subject: `Re: ${CIPHERTEXT}`,
+      html: `<p>${CIPHERTEXT}</p>`,
+    });
+    expect(out.subject).toBe("Re: [pii-redacted]");
+    expect(out.html).toBe("<p>[pii-redacted]</p>");
+  });
+});
+
+describe("withPiiCiphertextGuard", () => {
+  test("wrapped transport refuses a ciphertext recipient before sending", async () => {
+    const inner = createInMemoryTransport();
+    const guarded = withPiiCiphertextGuard(inner);
+    await expect(guarded.send({ to: CIPHERTEXT, subject: "x", html: "y" })).rejects.toThrow(
+      /recipient address is a PII ciphertext/,
+    );
+    expect(inner.sent).toHaveLength(0);
+
+    await guarded.send({ to: "ok@example.com", subject: "x", html: "y" });
+    expect(inner.sent).toHaveLength(1);
+  });
+});

package/src/channel-email/email-channel.ts

@@ -6,6 +6,7 @@ import type {
   NotificationRenderer,
   RenderedMessage,
 } from "../delivery";
+import { guardEmailMessage } from "./pii-guard";
 import type { EmailTransport } from "./types";
 
 export type EmailChannelOptions = {
@@ -53,7 +54,7 @@ export function createEmailChannel(options: EmailChannelOptions): DeliveryChanne
 
     async send(address, message, _ctx, rendered) {
       const { html, subject } = rendered ?? (await renderMessage(message));
-      await transport.send({ to: address, subject, html });
+      await transport.send(guardEmailMessage({ to: address, subject, html }));
       return { status: "sent", address };
     },
   };

package/src/channel-email/index.ts

@@ -1,5 +1,6 @@
 export { createEmailChannel, type EmailChannelOptions } from "./email-channel";
 export { createChannelEmailFeature } from "./feature";
+export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard";
 export {
   createSmtpTransport,
   createSmtpTransportFromEnv,

package/src/channel-email/pii-guard.ts

@@ -0,0 +1,39 @@
+import { PII_CIPHERTEXT_PREFIX } from "@cosmicdrift/kumiko-framework/crypto";
+import type { EmailMessage, EmailTransport } from "./types";
+
+const isProductionEnv = () => process.env["NODE_ENV"] === "production";
+// Version-agnostic: catches both the current PII_CIPHERTEXT_PREFIX and any
+// older/decrypt-only format version still present in unmigrated rows.
+const CIPHERTEXT_MARKER = "kumiko-pii:v";
+const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^"\s<>\\]*/g;
+
+// A PII ciphertext never belongs in an outgoing mail. A ciphertext RECIPIENT
+// is always refused (the address is garbage — better no mail than a leaked
+// blob); ciphertext in subject/body fails loud in dev and is redacted+logged
+// in prod.
+export function guardEmailMessage(message: EmailMessage): EmailMessage {
+  if (message.to.includes(CIPHERTEXT_MARKER)) {
+    throw new Error(
+      "[channel-email] refusing to send: recipient address is a PII ciphertext " +
+        `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`,
+    );
+  }
+  const leaking =
+    message.subject.includes(CIPHERTEXT_MARKER) || message.html.includes(CIPHERTEXT_MARKER);
+  if (!leaking) return message;
+  const detail =
+    "[channel-email] mail subject/body contains a PII ciphertext " +
+    `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before rendering.`;
+  if (!isProductionEnv()) throw new Error(detail);
+  // biome-ignore lint/suspicious/noConsole: operator-visibility for a redacted prod leak
+  console.error(detail);
+  return {
+    ...message,
+    subject: message.subject.replace(CIPHERTEXT_RE, "[pii-redacted]"),
+    html: message.html.replace(CIPHERTEXT_RE, "[pii-redacted]"),
+  };
+}
+
+export function withPiiCiphertextGuard(transport: EmailTransport): EmailTransport {
+  return { ...transport, send: async (message) => transport.send(guardEmailMessage(message)) };
+}

package/src/compliance-profiles/__tests__/profile-picker.boot.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { COMPLIANCE_PROFILE_SCREEN_ID, ComplianceProfileHandlers } from "../constants";
+import { createComplianceProfilesFeature } from "../feature";
+
+describe("compliance profile screen + handler access alignment", () => {
+  const features = [createComplianceProfilesFeature()];
+
+  test("boot-validates with profile-picker screen registered", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("profile-picker screen is custom, access.admin-gated", () => {
+    const feature = createComplianceProfilesFeature();
+    const screen = feature.screens[COMPLIANCE_PROFILE_SCREEN_ID];
+    expect(screen?.type).toBe("custom");
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(access.admin);
+    }
+  });
+
+  test("set-profile handler shares access.admin", () => {
+    const feature = createComplianceProfilesFeature();
+    expect(rolesOf(feature.writeHandlers["set-profile"]?.access)).toEqual([...access.admin]);
+    void ComplianceProfileHandlers;
+  });
+});

package/src/compliance-profiles/__tests__/profile-picker.security.integration.test.ts

@@ -0,0 +1,91 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { access } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  COMPLIANCE_PROFILE_SCREEN_ID,
+  ComplianceProfileHandlers,
+  ComplianceProfileQueries,
+} from "../constants";
+import { createComplianceProfilesFeature } from "../feature";
+import {
+  tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
+} from "../schema/profile-selection";
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createComplianceProfilesFeature()],
+  });
+  await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantComplianceProfileTable.tableName}"`);
+});
+
+describe("compliance-profiles access matrix", () => {
+  test("set-profile handler and screen share access.admin", () => {
+    expect(
+      rolesOf(stack.registry.getWriteHandler(ComplianceProfileHandlers.setProfile)?.access),
+    ).toEqual([...access.admin]);
+    const feature = createComplianceProfilesFeature();
+    const screen = feature.screens[COMPLIANCE_PROFILE_SCREEN_ID];
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(access.admin);
+    }
+  });
+});
+
+describe("compliance profile HTTP access", () => {
+  test("historic Admin can set a profile for own tenant", async () => {
+    const admin = createTestUser({ id: 31, roles: ["Admin"] });
+    const res = await stack.http.writeOk<{ profileKey: string; isNew: boolean }>(
+      ComplianceProfileHandlers.setProfile,
+      { profileKey: "eu-dsgvo" },
+      admin,
+    );
+    expect(res.profileKey).toBe("eu-dsgvo");
+    const current = await stack.http.queryOk<{ profile: { key: string } }>(
+      ComplianceProfileQueries.forTenant,
+      {},
+      admin,
+    );
+    expect(current.profile.key).toBe("eu-dsgvo");
+  });
+
+  test("TenantAdmin can set a profile for own tenant", async () => {
+    const admin = createTestUser({ id: 32, roles: ["TenantAdmin"] });
+    const res = await stack.http.writeOk<{ profileKey: string }>(
+      ComplianceProfileHandlers.setProfile,
+      { profileKey: "swiss-dsg" },
+      admin,
+    );
+    expect(res.profileKey).toBe("swiss-dsg");
+  });
+
+  test("regular User gets 403 on set-profile", async () => {
+    const user = createTestUser({ id: 33, roles: ["User"] });
+    expect(
+      (
+        await stack.http.write(
+          ComplianceProfileHandlers.setProfile,
+          { profileKey: "eu-dsgvo" },
+          user,
+        )
+      ).status,
+    ).toBe(403);
+  });
+});

package/src/compliance-profiles/constants.ts

@@ -0,0 +1,15 @@
+// @runtime client
+export const COMPLIANCE_PROFILES_FEATURE = "compliance-profiles" as const;
+
+export const ComplianceProfileHandlers = {
+  setProfile: "compliance-profiles:write:set-profile",
+} as const;
+
+export const ComplianceProfileQueries = {
+  forTenant: "compliance-profiles:query:for-tenant",
+  listProfiles: "compliance-profiles:query:list-profiles",
+  needsProfile: "compliance-profiles:query:needs-profile",
+  subProcessors: "compliance-profiles:query:sub-processors",
+} as const;
+
+export const COMPLIANCE_PROFILE_SCREEN_ID = "profile-picker" as const;

package/src/compliance-profiles/feature.ts

@@ -1,9 +1,15 @@
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  defineFeature,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { COMPLIANCE_PROFILE_SCREEN_ID } from "./constants";
 import { forTenantQuery } from "./handlers/for-tenant.query";
 import { listProfilesQuery } from "./handlers/list-profiles.query";
 import { needsProfileQuery } from "./handlers/needs-profile.query";
 import { setProfileWrite } from "./handlers/set-profile.write";
 import { subProcessorsQuery } from "./handlers/sub-processors.query";
+import { COMPLIANCE_PROFILES_I18N } from "./i18n";
 import { tenantComplianceProfileEntity } from "./schema/profile-selection";
 
 export {
@@ -54,6 +60,21 @@ export function createComplianceProfilesFeature(): FeatureDefinition {
       needsProfile: r.queryHandler(needsProfileQuery),
     };
 
+    r.screen({
+      id: COMPLIANCE_PROFILE_SCREEN_ID,
+      type: "custom",
+      renderer: { react: { __component: "ComplianceProfileScreen" } },
+      access: { roles: access.admin },
+    });
+    r.nav({
+      id: "profile-picker",
+      label: "compliance-profiles:nav.profilePicker",
+      screen: "compliance-profiles:screen:profile-picker",
+      order: 50,
+    });
+
+    r.translations({ keys: COMPLIANCE_PROFILES_I18N });
+
     return { handlers, queries };
   });
 }

package/src/compliance-profiles/handlers/set-profile.write.ts

@@ -1,4 +1,3 @@
-import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   complianceProfileOverrideSchema,
@@ -6,6 +5,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/compliance";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
+  access,
   crossTenantOverrideDenied,
   defineWriteHandler,
   type TenantId,
@@ -58,7 +58,7 @@ export const setProfileWrite = defineWriteHandler({
   }),
   // SystemAdmin kann Profile fuer Customer-Setup setzen (Plattform-
   // Operator-Pfad). TenantAdmin nur fuer eigenen Tenant.
-  access: { roles: [ROLES.TenantAdmin, ROLES.SystemAdmin] },
+  access: { roles: access.admin },
   handler: async (event, ctx) => {
     const tenantOverride = event.payload.tenantIdOverride;
     const overrideDenied = crossTenantOverrideDenied(

package/src/compliance-profiles/i18n.ts

@@ -0,0 +1,6 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const COMPLIANCE_PROFILES_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:profile-picker.title": { de: "Compliance-Profil", en: "Compliance profile" },
+  "compliance-profiles:nav.profilePicker": { de: "Compliance", en: "Compliance" },
+};

package/src/compliance-profiles/index.ts

@@ -1,3 +1,9 @@
+export {
+  COMPLIANCE_PROFILE_SCREEN_ID,
+  COMPLIANCE_PROFILES_FEATURE,
+  ComplianceProfileHandlers,
+  ComplianceProfileQueries,
+} from "./constants";
 export {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,

package/src/compliance-profiles/web/client-plugin.tsx

@@ -0,0 +1,22 @@
+// @runtime client
+import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import { COMPLIANCE_PROFILE_SCREEN_ID, COMPLIANCE_PROFILES_FEATURE } from "../constants";
+import { ComplianceProfileScreen } from "./compliance-profile-screen";
+import { defaultTranslations } from "./i18n";
+
+export type ComplianceProfilesClientOptions = {
+  readonly translations?: TranslationsByLocale;
+};
+
+export function complianceProfilesClient(
+  options?: ComplianceProfilesClientOptions,
+): ClientFeatureDefinition {
+  return {
+    name: COMPLIANCE_PROFILES_FEATURE,
+    translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+    components: {
+      [COMPLIANCE_PROFILE_SCREEN_ID]: ComplianceProfileScreen,
+    },
+  };
+}