@cosmicdrift/kumiko-framework 0.167.0 → 0.167.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.167.0",
+  "version": "0.167.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -182,7 +182,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.167.0",
+    "@cosmicdrift/kumiko-types": "0.167.1",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.12.27",
@@ -198,7 +198,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.167.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.167.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/jwt.test.ts

@@ -82,6 +82,18 @@ describe("createJwtHelper.verify — payload validation (KF-2)", () => {
       .sign(new TextEncoder().encode(SECRET));
     await expect(jwt.verify(token)).rejects.toThrow(/sub/);
   });
+
+  // fw#1636 — SessionUser.timezone must survive the sign/verify roundtrip
+  // (jwt.sign silently drops any field it doesn't explicitly copy).
+  it("round-trips the timezone claim when set", async () => {
+    const payload = await jwt.verify(await jwt.sign({ ...user, timezone: "Asia/Tokyo" }));
+    expect(payload.timezone).toBe("Asia/Tokyo");
+  });
+
+  it("omits the timezone claim when unset", async () => {
+    const payload = await jwt.verify(await jwt.sign(user));
+    expect(payload.timezone).toBeUndefined();
+  });
 });
 
 describe("createJwtHelper — keyring form", () => {

package/src/api/auth-middleware.ts

@@ -307,6 +307,7 @@ export function authMiddleware(jwt: JwtHelper, options: AuthMiddlewareOptions =
       id: payload.sub,
       tenantId: payload.tenantId,
       roles: payload.roles,
+      ...(payload.timezone ? { timezone: payload.timezone } : {}),
       ...(payload.claims ? { claims: payload.claims } : {}),
       ...(payload.jti ? { sid: payload.jti } : {}),
     };

package/src/api/jwt.ts

@@ -10,6 +10,9 @@ export type JwtPayload = {
   sub: string;
   tenantId: TenantId;
   roles: string[];
+  // IANA zone from user.timezone, set at login — see SessionUser.timezone
+  // (fw#1636). Absent → ctx.tz.user falls back to ctx.tz.tenant.
+  timezone?: string;
   // Optional — present when a feature has registered auth claims via the
   // `r.authClaims()` hook system. Absent for stateless-JWT deployments
   // without auth-claims wiring.
@@ -106,6 +109,7 @@ export function createJwtHelper(
         tenantId: user.tenantId,
         roles: [...user.roles],
       };
+      if (user.timezone) body.timezone = user.timezone;
       if (user.claims) body.claims = { ...user.claims };
 
       const header: jose.JWTHeaderParameters = keyring.signKid
@@ -155,6 +159,9 @@ export function createJwtHelper(
         tenantId,
         roles,
       };
+      if (typeof payload["timezone"] === "string") {
+        result.timezone = payload["timezone"];
+      }
       const claims = payload["claims"];
       if (claims && typeof claims === "object") {
         result.claims = claims as DbRow;

package/src/engine/__tests__/boot-validator-pii-retention.test.ts

@@ -558,6 +558,7 @@ describe("validateBoot — retention", () => {
         createEntity({
           fields: {
             invoiceNumber: createTextField({ allowPlaintext: "is-business-data" }),
+            customerName: createTextField({ pii: true }),
           },
           retention: { keepFor: "10y", strategy: "blockDelete" },
         }),
@@ -570,6 +571,25 @@ describe("validateBoot — retention", () => {
     expect(matchingWarn).toBeDefined();
   });
 
+  test("blockDelete without any subject-annotated field stays silent (#1622)", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "lease",
+        createEntity({
+          fields: {
+            reference: createTextField({ allowPlaintext: "is-business-data" }),
+          },
+          retention: { keepFor: "10y", strategy: "blockDelete" },
+        }),
+      );
+    });
+    validateBoot([feature]);
+    const matchingWarn = warnSpy.mock.calls.find((args: unknown[]) =>
+      String(args[0]).includes('strategy="blockDelete" but no field has an anonymize-function'),
+    );
+    expect(matchingWarn).toBeUndefined();
+  });
+
   test('retention.keepFor with invalid format "30days" warns', () => {
     const feature = defineFeature("test", (r) => {
       r.entity(

package/src/engine/boot-validator/pii-retention.ts

@@ -234,11 +234,17 @@ export function validatePiiAndRetention(feature: FeatureDefinition): void {
       }
 
       if (retention.strategy === "blockDelete") {
+        // blockDelete on an entity with no subject field is the correct
+        // "never auto-delete" choice; User-Forget never reaches those rows (#1622).
+        const hasSubjectField = Object.values(fieldsByName).some((f) => {
+          const a = f as PiiAnnotations; // @cast-boundary schema-walk
+          return Boolean(a.pii || a.userOwned || a.tenantOwned);
+        });
         const hasAnonymize = Object.values(fieldsByName).some((f) => {
           const a = f as PiiAnnotations; // @cast-boundary schema-walk
           return Boolean(a.anonymize);
         });
-        if (!hasAnonymize) {
+        if (hasSubjectField && !hasAnonymize) {
           // biome-ignore lint/suspicious/noConsole: boot-time dev hint, no logger available yet
           console.warn(
             `[kumiko:boot] [Feature ${feature.name}] Entity "${entityName}" retention.strategy="blockDelete" but no field has an anonymize-function. User-Forget cannot anonymize — Forget will return error. Add { anonymize: () => null } or () => "[ANONYMIZED]" to PII fields.`,

package/src/pipeline/dispatch-query.ts

@@ -79,7 +79,7 @@ async function executeQueryInner(
     typeof parsed.data === "object" &&
     parsed.data !== null &&
     (parsed.data as Record<string, unknown>)["includeDeleted"] === true; // @cast-boundary validated-payload
-  const handlerContext = buildHandlerContext(ctx, type, user, tx, undefined, includeDeleted);
+  const handlerContext = await buildHandlerContext(ctx, type, user, tx, undefined, includeDeleted);
   let result = await handler.handler({ type, payload: parsed.data, user }, handlerContext);
 
   // postQuery-Hooks: fire BEFORE field-access-filter so hooks see raw data

package/src/pipeline/dispatch-shared.ts

@@ -146,14 +146,14 @@ async function appendDomainEvent(
   );
 }
 
-export function buildHandlerContext(
+export async function buildHandlerContext(
   ctx: DispatchContext,
   type: string,
   user: SessionUser,
   tx?: DbTx,
   afterCommitHooks?: AfterCommitHook[],
   includeDeleted?: boolean,
-): HandlerContext {
+): Promise<HandlerContext> {
   const { registry, appContext: context, effectiveFeatures, jobRunner } = ctx;
   const isSystem = registry.isHandlerSystemScoped(type);
   // The outer dispatcher receives a DbConnection from the server/stack;
@@ -515,13 +515,19 @@ export function buildHandlerContext(
   // HandlerContext. The spread-then-assign order matters: anything in
   // `context` can be overridden, but we want the authoritative registry
   // from the dispatcher's own closure to win.
-  // ctx.tz ist immer da. Tenant + User-Defaults kommen aus dem
-  // SessionUser sobald die Felder existieren — bis dahin "UTC". Ein
-  // app-injizierter GeoTzProvider (context.geoTzProvider) speist
-  // ctx.tz.fromCoordinates / fromAddress.
-  const tz = createTzContext(
-    context.geoTzProvider !== undefined ? { geoTz: context.geoTzProvider } : {},
-  );
+  // ctx.tz is always present. tenant reads tenant:config:timezone through
+  // the already-built `config` accessor (raw qualified-key — no import of
+  // the tenant feature, framework/pipeline stays bundled-features-free);
+  // falls back to "UTC" when config is missing or the key is unset. user
+  // comes from SessionUser.timezone (set at login), else falls back to
+  // tenant (createTzContext's own default). An app-injected GeoTzProvider
+  // (context.geoTzProvider) feeds ctx.tz.fromCoordinates / fromAddress.
+  const tenantTz = config !== undefined ? await config("tenant:config:timezone") : undefined;
+  const tz = createTzContext({
+    ...(context.geoTzProvider !== undefined ? { geoTz: context.geoTzProvider } : {}),
+    tenant: typeof tenantTz === "string" ? tenantTz : "UTC",
+    ...(user.timezone !== undefined && { user: user.timezone }),
+  });
 
   return {
     ...context,

package/src/pipeline/dispatch-stream.ts

@@ -73,7 +73,7 @@ async function* executeStreamInner(
   // await; close is fire-and-forget instead (#1563).
   let abandonedForInvalidation = false;
   try {
-    const handlerContext = buildHandlerContext(ctx, type, user);
+    const handlerContext = await buildHandlerContext(ctx, type, user);
     const chunks = handler.handler({ type, payload: parsed.data, user }, handlerContext);
     iterator = chunks[Symbol.asyncIterator]();
 

package/src/pipeline/dispatch-write.ts

@@ -348,7 +348,7 @@ async function executeWriteInner(
     }
   }
 
-  const handlerContext = buildHandlerContext(ctx, type, user, tx, afterCommitHooks);
+  const handlerContext = await buildHandlerContext(ctx, type, user, tx, afterCommitHooks);
 
   // Auto transition guard: if entity has transitions and handler doesn't skip it
   if (entityName && !handler.unsafeSkipTransitionGuard) {

package/src/time/tz-context.ts

@@ -10,9 +10,10 @@
 // Feature code should no longer call `new Date()` — the lint rule for that
 // lands in a later iteration, once all existing usages are migrated.
 //
-// `tenant` + `user` are the TZ defaults for the current request. Currently
-// both default to "UTC" — once tenant.timezone + user.timezone fields
-// exist, they get read from the request context here.
+// `tenant` + `user` are the TZ defaults for the current request — resolved
+// by buildHandlerContext (tenant:config:timezone, then SessionUser.timezone,
+// falling back to "UTC" at each step) and passed in via TzContextOptions.
+// This factory itself stays a pure default-filler.
 //
 // The pure type contracts (TzContext, TzContextOptions, LocatedTimestampJson)
 // live in @cosmicdrift/kumiko-types/tz-context — only the factories are here.