@cosmicdrift/kumiko-samples 0.338.0

package/packages/bundled-features/src/compliance-profiles/_internal/parse-override.ts

@@ -0,0 +1,20 @@
+import type { ComplianceProfileOverride } from "@cosmicdrift/kumiko-framework/compliance";
+import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+
+export function parseComplianceProfileOverride(
+  raw: string | null,
+  tenantId: string,
+  callerLabel: string,
+): ComplianceProfileOverride | undefined {
+  if (!raw || raw.trim() === "") return undefined;
+  let parsed: ComplianceProfileOverride | null;
+  try {
+    parsed = parseJsonOrThrow<ComplianceProfileOverride | null>(raw, "compliance override");
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    // biome-ignore lint/suspicious/noConsole: operator visibility for DB-corruption edge-case
+    console.warn(`[${callerLabel}] tenant ${tenantId}: stored override ignored. Reason: ${reason}`);
+    return undefined;
+  }
+  return parsed ?? undefined;
+}

package/packages/bundled-features/src/compliance-profiles/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.208.2",
+    "type": "improvement",
+    "title": "profile-picker screen switched from custom TSX to a declarative actionForm (fw#2222).",
+    "detail": "The 152-line custom compliance-profile-screen.tsx is gone. The picker is now an actionForm (select field submitting to the existing `compliance-profiles:write:set-profile` handler) plus an extension section for the read-only profile catalog (region + supervisory authority), now ~40 lines. Nav gained a `shield-check` icon."
+  }
+]

package/packages/bundled-features/src/compliance-profiles/constants.ts

@@ -0,0 +1,20 @@
+// @runtime client
+export const COMPLIANCE_PROFILES_FEATURE = "compliance-profiles" as const;
+
+export const ComplianceProfileHandlers = {
+  setProfile: "compliance-profiles:write:set-profile",
+} as const;
+
+export const ComplianceProfileQueries = {
+  forTenant: "compliance-profiles:query:for-tenant",
+  listProfiles: "compliance-profiles:query:list-profiles",
+  needsProfile: "compliance-profiles:query:needs-profile",
+  subProcessors: "compliance-profiles:query:sub-processors",
+} as const;
+
+export const COMPLIANCE_PROFILE_SCREEN_ID = "profile-picker" as const;
+
+// Extension-section component name for the profile-catalog block under the
+// picker's select field — registered client-side via
+// complianceProfilesClient()'s extensionSectionComponents.
+export const COMPLIANCE_PROFILE_CATALOG_EXTENSION_NAME = "ComplianceProfileCatalog" as const;

package/packages/bundled-features/src/compliance-profiles/feature.ts

@@ -0,0 +1,114 @@
+import { SELECTABLE_PROFILE_KEYS } from "@cosmicdrift/kumiko-framework/compliance";
+import {
+  access,
+  defineFeature,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  COMPLIANCE_PROFILE_CATALOG_EXTENSION_NAME,
+  COMPLIANCE_PROFILE_SCREEN_ID,
+  ComplianceProfileHandlers,
+} from "./constants.js";
+import { forTenantQuery } from "./handlers/for-tenant.query.js";
+import { listProfilesQuery } from "./handlers/list-profiles.query.js";
+import { createNeedsProfileQuery } from "./handlers/needs-profile.query.js";
+import { setProfileWrite } from "./handlers/set-profile.write.js";
+import { subProcessorsQuery } from "./handlers/sub-processors.query.js";
+import { COMPLIANCE_PROFILES_I18N } from "./i18n.js";
+import { tenantComplianceProfileEntity } from "./schema/profile-selection.js";
+
+export {
+  tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
+} from "./schema/profile-selection.js";
+
+// compliance-profiles — Tenant-weite DSGVO/Compliance-Profile-Wahl.
+//
+// Pflicht beim Tenant-Onboarding (Sprint 1.5 Banner-API). Profile
+// buendelt User-Rights-Grace, Notification-Sprache, Breach-Disclosure,
+// Audit-Retention und Sub-Processor-Anforderungen.
+//
+// Cross-Feature-API: r.exposesApi("compliance.forTenant") — andere
+// Features (user-data-rights in Sprint 2, tenant-lifecycle in Sprint 5)
+// rufen den Profile-Resolver via QN-Pattern (siehe legal-pages →
+// text-content fuer Pattern-Beispiel).
+//
+// Architektur-Note: Profile-Selection lebt als separate Entity
+// (tenantComplianceProfile), nicht als config-key im tenant-Feature.
+// Begruendung in schema/profile-selection.ts.
+export type ComplianceProfilesFeatureOptions = {
+  // Access gate for the profile-picker screen and the `set-profile` write it
+  // submits to — both move together so the nav entry a role sees always
+  // matches a callable handler (#2033). Default access.admin includes
+  // TenantAdmin, who in a line-of-business app is the operator, not the
+  // platform — pass access.systemAdmin to keep this platform-only and out
+  // of their nav.
+  readonly access?: readonly string[];
+};
+
+export function createComplianceProfilesFeature(
+  options?: ComplianceProfilesFeatureOptions,
+): FeatureDefinition {
+  const resolvedAccess = options?.access ?? access.admin;
+  return defineFeature("compliance-profiles", (r) => {
+    r.describe(
+      "Lets each tenant select a compliance regime (e.g. `eu-dsgvo`, `swiss-dsg`, `de-hr-dsgvo-hgb`) that bundles user-rights grace periods, breach-disclosure deadlines, sub-processor requirements, and audit-retention rules into a single named profile. Tenant admins call `compliance-profiles:write:set-profile` to choose a profile (with optional JSON override for edge cases); other features resolve the effective profile via the `compliance.forTenant` cross-feature API. Required by `user-data-rights` \u2014 mount this feature before it.",
+    );
+    r.uiHints({
+      displayLabel: "Compliance Profiles",
+      category: "compliance",
+      recommended: false,
+    });
+    // Standalone — kein r.requires noetig: tenantId kommt aus dem User-
+    // Context, Profile-Selection ist eigene Entity, sub-processor-Liste
+    // sind Constants. Wenn S1.4+ Cross-Feature-Reads dazukommen, kommt
+    // r.requires hier rein.
+    r.entity("tenant-compliance-profile", tenantComplianceProfileEntity);
+
+    r.exposesApi("compliance.forTenant");
+
+    const handlers = {
+      setProfile: r.writeHandler({ ...setProfileWrite, access: { roles: resolvedAccess } }),
+    };
+
+    const queries = {
+      forTenant: r.queryHandler(forTenantQuery),
+      listProfiles: r.queryHandler(listProfilesQuery),
+      subProcessors: r.queryHandler(subProcessorsQuery),
+      needsProfile: r.queryHandler(createNeedsProfileQuery(resolvedAccess)),
+    };
+
+    r.screen({
+      id: COMPLIANCE_PROFILE_SCREEN_ID,
+      type: "actionForm",
+      handler: ComplianceProfileHandlers.setProfile,
+      fields: {
+        profileKey: { type: "select", options: SELECTABLE_PROFILE_KEYS, required: true },
+      },
+      layout: {
+        width: "full",
+        sections: [
+          { fields: ["profileKey"] },
+          {
+            kind: "extension",
+            title: "compliance-profiles:profile.catalog.title",
+            component: { react: { __component: COMPLIANCE_PROFILE_CATALOG_EXTENSION_NAME } },
+          },
+        ],
+      },
+      submitLabel: "compliance-profiles:profile.actions.save",
+      access: { roles: resolvedAccess },
+    });
+    r.nav({
+      id: "profile-picker",
+      label: "compliance-profiles:nav.profilePicker",
+      screen: "compliance-profiles:screen:profile-picker",
+      icon: "shield-check",
+      order: 50,
+    });
+
+    r.translations({ keys: COMPLIANCE_PROFILES_I18N });
+
+    return { handlers, queries };
+  });
+}

package/packages/bundled-features/src/compliance-profiles/handlers/for-tenant.query.ts

@@ -0,0 +1,50 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  type ComplianceProfileKey,
+  type EffectiveComplianceProfile,
+  resolveComplianceProfile,
+} from "@cosmicdrift/kumiko-framework/compliance";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { parseComplianceProfileOverride } from "../_internal/parse-override.js";
+import { tenantComplianceProfileTable } from "../schema/profile-selection.js";
+
+// Liefert das effektive Compliance-Profile fuer den aktuellen Tenant.
+// Macht den exposesApi-Marker aus feature.ts mit echtem Inhalt.
+//
+// Default-Verhalten (Edge-Case-Decision aus S1.1): kein Profile-
+// Eintrag → minimal-no-region + warning="no-profile-selected".
+// Caller (z.B. user-data-rights in Sprint 2) sieht das warning und
+// kann Onboarding-Banner triggern.
+export const forTenantQuery = defineQueryHandler({
+  name: "for-tenant",
+  schema: z.object({}),
+  access: {
+    openToAll: {
+      reason:
+        "any signed-in tenant member may read their own tenant's effective compliance " +
+        "profile; the result carries policy metadata, never PII",
+    },
+  },
+  description:
+    "Returns the effective compliance profile for the caller's tenant with any tenant override merged in, falling back to minimal-no-region plus a no-profile-selected warning when the tenant has not picked one yet.",
+  handler: async (query, ctx): Promise<EffectiveComplianceProfile> => {
+    const row = (await fetchOne(ctx.db, tenantComplianceProfileTable, {
+      tenantId: query.user.tenantId,
+    })) as { profileKey: string; override: string | null } | null; // @cast-boundary db-runner
+
+    if (!row) {
+      return resolveComplianceProfile({});
+    }
+
+    const override = parseComplianceProfileOverride(
+      row.override,
+      query.user.tenantId,
+      "compliance-profiles:for-tenant",
+    );
+    return resolveComplianceProfile({
+      selection: row.profileKey as ComplianceProfileKey, // @cast-boundary engine-payload
+      override,
+    });
+  },
+});

package/packages/bundled-features/src/compliance-profiles/handlers/list-profiles.query.ts

@@ -0,0 +1,52 @@
+import {
+  COMPLIANCE_PROFILES,
+  type ComplianceProfile,
+  type ComplianceProfileKey,
+  SELECTABLE_PROFILE_KEYS,
+} from "@cosmicdrift/kumiko-framework/compliance";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+
+// Liefert alle waehlbaren Compliance-Profile fuer das Tenant-Onboarding.
+// Pure In-Memory-Read der Constants — keine DB-Abfrage. Kein Caching
+// noetig (modulo Pre-Boot bereits aufgeloest).
+//
+// Filtert minimal-no-region raus — das ist Default-Fallback, nicht
+// auswählbar (Production soll explizite Wahl treffen).
+export const listProfilesQuery = defineQueryHandler({
+  name: "list-profiles",
+  schema: z.object({}),
+  access: {
+    openToAll: {
+      reason:
+        "any signed-in user may list the selectable compliance profiles; the data is " +
+        "static, deployment-wide reference information, not tenant- or user-specific",
+    },
+  },
+  description:
+    "Lists the compliance profiles a tenant can choose from (key, region, label, supervisory-authority contact, notification languages), for rendering the onboarding profile picker; the minimal-no-region fallback is excluded because it is not selectable.",
+  handler: async (): Promise<{ profiles: readonly ComplianceProfileSummary[] }> => {
+    return {
+      profiles: SELECTABLE_PROFILE_KEYS.map(toSummary),
+    };
+  },
+});
+
+interface ComplianceProfileSummary {
+  readonly key: ComplianceProfileKey;
+  readonly region: string;
+  readonly label: string;
+  readonly authorityContact: string;
+  readonly languages: readonly string[];
+}
+
+function toSummary(key: ComplianceProfileKey): ComplianceProfileSummary {
+  const p: ComplianceProfile = COMPLIANCE_PROFILES[key];
+  return {
+    key: p.key,
+    region: p.region,
+    label: p.label,
+    authorityContact: p.breach.authorityContact,
+    languages: p.notifications.languages,
+  };
+}

package/packages/bundled-features/src/compliance-profiles/handlers/needs-profile.query.ts

@@ -0,0 +1,75 @@
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { ComplianceProfileKey } from "@cosmicdrift/kumiko-framework/compliance";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { tenantComplianceProfileTable } from "../schema/profile-selection.js";
+
+// Onboarding banner trigger for tenant admin.
+//
+// Sprint 1.5 — minimal API endpoint, the UI banner comes in a later UI
+// sprint. Pure read query: does an entry exist in tenantComplianceProfile
+// for the current tenant?
+//
+// If not → tenant admin must pick a profile (mandatory during onboarding).
+// Until picked, minimal-no-region runs with a warning that should surface
+// in the tenant dashboard banner.
+//
+// Access: TenantAdmin only — the banner is only relevant to tenant admins,
+// not regular members. Stays hard-coded to TenantAdmin (not the `access`
+// option of createComplianceProfilesFeature) — passing the option through
+// would widen call access by default to all three access.admin roles
+// (including SystemAdmin). Instead the handler takes `pickerReachableRoles`
+// and deliberately resolves the #2063 special case: if the *caller's*
+// roles no longer intersect the picker's `access` option, the query stops
+// reporting needsSelection — otherwise a tenant admin would be told to
+// open a screen they can't reach.
+export function createNeedsProfileQuery(pickerReachableRoles: readonly string[]) {
+  return defineQueryHandler({
+    name: "needs-profile",
+    schema: z.object({}),
+    access: { roles: [ROLES.TenantAdmin] },
+    description:
+      "Answers whether the calling tenant admin still has to pick a compliance profile, for the onboarding banner in their own tenant; reports needsSelection false once a profile exists or when the caller's roles cannot reach the picker screen.",
+    handler: async (query, ctx): Promise<NeedsProfileResponse> => {
+      const row = (await fetchOne(ctx.db, tenantComplianceProfileTable, {
+        tenantId: query.user.tenantId,
+      })) as { profileKey: ComplianceProfileKey } | null; // @cast-boundary db-runner
+
+      if (row) {
+        // S1.7 X1: minimal-no-region is no longer settable via set-profile
+        // (Zod). If Sprint 2 ships a seedComplianceProfile helper that
+        // reintroduces the migration edge case, a defensive path belongs
+        // here again — until then, every existing entry is a deliberately
+        // chosen production profile.
+        return {
+          needsSelection: false,
+          currentProfile: row.profileKey,
+        };
+      }
+
+      const callerCanReachPicker = query.user.roles.some((role) =>
+        pickerReachableRoles.includes(role),
+      );
+      if (!callerCanReachPicker) {
+        return {
+          needsSelection: false,
+          currentProfile: null,
+          reason: "picker_not_accessible_for_role",
+        };
+      }
+
+      return {
+        needsSelection: true,
+        currentProfile: null,
+        reason: "no_profile_selected",
+      };
+    },
+  });
+}
+
+interface NeedsProfileResponse {
+  readonly needsSelection: boolean;
+  readonly currentProfile: ComplianceProfileKey | null;
+  readonly reason?: "no_profile_selected" | "picker_not_accessible_for_role";
+}

package/packages/bundled-features/src/compliance-profiles/handlers/set-profile.write.ts

@@ -0,0 +1,142 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  complianceProfileOverrideSchema,
+  SELECTABLE_PROFILE_KEYS,
+} from "@cosmicdrift/kumiko-framework/compliance";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  access,
+  crossTenantOverrideDenied,
+  defineWriteHandler,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  UnprocessableError,
+  validationErrorFromZod,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import {
+  tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
+} from "../schema/profile-selection.js";
+
+const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantComplianceProfileEntity, {
+  entityName: "tenant-compliance-profile",
+});
+
+// Schema engt sich auf die 3 oeffentlich waehlbaren Profile (Sprint 1.7
+// X1) — minimal-no-region ist Default-Fallback fuer "noch keine Wahl",
+// nicht eine waehlbare Production-Option. Symmetrisch zu
+// SELECTABLE_PROFILE_KEYS aus der framework/compliance-Liste.
+const profileKeySchema = z.enum(SELECTABLE_PROFILE_KEYS);
+
+// Tenant-Admin setzt Profile-Key + optional Override-JSON.
+//
+// Upsert-Verhalten: erste Wahl insert, weitere update. Idempotent —
+// wer mit gleichen Werten zweimal aufruft, kriegt das gleiche Ergebnis
+// (modulo aktualisierte Audit-Events im Event-Store).
+//
+// Cross-Tenant-Pfad: SystemAdmin kann via `tenantIdOverride` fuer einen
+// anderen Tenant schreiben (Plattform-Operator-Setup, Customer-
+// Onboarding-Migrationen). TenantAdmin's Override-Versuch → 403.
+// executorUser.tenantId muss = ziel-tenant sein damit der event-store-
+// Stream-Lookup nicht miss → version_conflict gibt (Memory:
+// feedback_event_store_tenant_consistency).
+//
+// Validation:
+//   - profileKey muss in SELECTABLE_PROFILE_KEYS sein (Zod-checked)
+//   - override (optional) muss valides JSON-Object sein
+//   - override Top-Level-Keys muessen in ALLOWED_OVERRIDE_KEYS sein
+//     — verhindert Tippfehler die deepMerge stillschweigend ignoriert
+export const setProfileWrite = defineWriteHandler({
+  name: "set-profile",
+  schema: z.object({
+    profileKey: profileKeySchema,
+    override: z.string().nullable().optional(),
+    tenantIdOverride: z.string().min(1).optional(),
+  }),
+  // SystemAdmin kann Profile fuer Customer-Setup setzen (Plattform-
+  // Operator-Pfad). TenantAdmin nur fuer eigenen Tenant.
+  access: { roles: access.admin },
+  description:
+    "Sets or replaces a tenant's compliance profile key plus an optional JSON override, for onboarding or a later region change; a system admin may target a different tenant through tenantIdOverride.",
+  handler: async (event, ctx) => {
+    const tenantOverride = event.payload.tenantIdOverride;
+    const overrideDenied = crossTenantOverrideDenied(
+      event.user,
+      tenantOverride,
+      "complianceProfiles.errors.tenantOverrideRequiresSystemAdmin",
+    );
+    if (overrideDenied) return writeFailure(overrideDenied);
+    const tenantId = (tenantOverride ?? event.user.tenantId) as TenantId; // @cast-boundary engine-payload
+    const executorUser = tenantOverride !== undefined ? { ...event.user, tenantId } : event.user;
+
+    // Override-Validation: muss parseables JSON-Object sein UND dem
+    // ComplianceProfileOverride-Schema entsprechen (S1.9 Z3 — strict-Zod
+    // mit Top-Level + Sub-Level-Whitelist via .strict()). Tippfehler
+    // wie `{ userRights: { weeks: 3 } }` werden hier rejected statt vom
+    // deepMerge silent ins Profile gespliced.
+    //
+    // Errors via writeFailure + Kumiko-Error-Klassen (S1.10 M3) statt
+    // throw — landen so mit Path-Detail im response-body statt als
+    // generic internal_error.
+    if (event.payload.override) {
+      let parsed: unknown;
+      try {
+        parsed = JSON.parse(event.payload.override);
+      } catch (e: unknown) {
+        const parseError = e instanceof Error ? e.message : String(e);
+        return writeFailure(
+          new UnprocessableError("compliance_override_invalid_json", {
+            details: { parseError },
+          }),
+        );
+      }
+      const validation = complianceProfileOverrideSchema.safeParse(parsed);
+      if (!validation.success) {
+        return writeFailure(validationErrorFromZod(validation.error));
+      }
+    }
+
+    // Upsert: existierenden Eintrag suchen
+    const existing = (await fetchOne(ctx.db, tenantComplianceProfileTable, {
+      tenantId: tenantId,
+    })) as { id: string; version: number } | null; // @cast-boundary db-runner
+
+    if (existing) {
+      const result = await crud.update(
+        {
+          id: existing.id,
+          version: existing.version,
+          changes: {
+            profileKey: event.payload.profileKey,
+            override: event.payload.override ?? null,
+          },
+        },
+        executorUser,
+        ctx.db,
+      );
+      if (!result.isSuccess) return result;
+      return {
+        isSuccess: true as const,
+        data: { profileKey: event.payload.profileKey, isNew: false },
+      };
+    }
+
+    const result = await crud.create(
+      {
+        profileKey: event.payload.profileKey,
+        override: event.payload.override ?? null,
+        tenantId,
+      },
+      executorUser,
+      ctx.db,
+    );
+    if (!result.isSuccess) return result;
+    return {
+      isSuccess: true as const,
+      data: { profileKey: event.payload.profileKey, isNew: true },
+    };
+  },
+});

package/packages/bundled-features/src/compliance-profiles/handlers/sub-processors.query.ts

@@ -0,0 +1,46 @@
+import {
+  getActiveSubProcessors,
+  getPlannedSubProcessors,
+  KUMIKO_SUB_PROCESSORS,
+  type SubProcessor,
+} from "@cosmicdrift/kumiko-framework/compliance";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import * as z from "zod";
+
+// Public Sub-Processor-Liste — anonymous accessible (Memory:
+// project_anonymous_access). Matched die DSGVO Art. 28(2) Pflicht
+// dass die Liste der Auftragsverarbeiter oeffentlich einsehbar ist
+// (typisch verlinkt aus Datenschutzerklaerung + AVV).
+//
+// Format: JSON mit getrennten active/planned-Sektionen. Tenant-Admins
+// kriegen Notification ueber Aenderungen via Cron-Job (Sprint 1.5+
+// oder S9 compliance-as-product). RSS-Feed kommt in S9.
+//
+// Zwei Auflistungen statt einer flachen Liste:
+//   - `active`: aktuell eingesetzte Sub-Processors
+//   - `planned`: bekannte zukünftige Sub-Processors (Tenant-Admin-
+//     Lead-Time bevor sie aktiv werden — typisch bei AI/Stripe)
+export const subProcessorsQuery = defineQueryHandler({
+  name: "sub-processors",
+  schema: z.object({}),
+  access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
+  description:
+    "Returns the publicly readable Kumiko sub-processor list split into active and planned entries, for the GDPR Art. 28(2) disclosure a privacy policy or data-processing agreement links to.",
+  handler: async (): Promise<SubProcessorListResponse> => {
+    return {
+      active: [...getActiveSubProcessors()],
+      planned: [...getPlannedSubProcessors()],
+      generatedAt: getTemporal().Now.instant().toString(),
+      total: KUMIKO_SUB_PROCESSORS.length,
+    };
+  },
+});
+
+interface SubProcessorListResponse {
+  readonly active: readonly SubProcessor[];
+  readonly planned: readonly SubProcessor[];
+  readonly generatedAt: string;
+  readonly total: number;
+}

package/packages/bundled-features/src/compliance-profiles/i18n.ts

@@ -0,0 +1,31 @@
+import {
+  COMPLIANCE_PROFILES,
+  SELECTABLE_PROFILE_KEYS,
+} from "@cosmicdrift/kumiko-framework/compliance";
+
+type LocalizedString = { readonly en: string };
+
+// Option labels for the actionForm's `profileKey` select — derived from
+// SELECTABLE_PROFILE_KEYS so a new selectable profile picks up its i18n
+// label automatically instead of needing a second hardcoded list here.
+const PROFILE_OPTION_KEYS: Readonly<Record<string, LocalizedString>> = Object.fromEntries(
+  SELECTABLE_PROFILE_KEYS.map((key) => [
+    `compliance-profiles:entity:__action-form__:field:profileKey:option:${key}`,
+    { en: COMPLIANCE_PROFILES[key].label },
+  ]),
+);
+
+export const COMPLIANCE_PROFILES_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:profile-picker.title": { en: "Compliance profile" },
+  "compliance-profiles:nav.profilePicker": { en: "Compliance" },
+  // Field label + option labels for the actionForm's synthesized pseudo-
+  // entity (`__action-form__`, see action-form-shim.ts) — required by the
+  // i18n boot-validator (requiredKeysFromScreen) and must live in the
+  // server-registered translations, not the client bundle's own i18n: the
+  // declarative actionForm renderer resolves these through the schema
+  // payload, not through a custom screen component's client-side t().
+  "compliance-profiles:entity:__action-form__:field:profileKey": { en: "Compliance profile" },
+  "compliance-profiles:profile.actions.save": { en: "Save profile" },
+  "compliance-profiles:profile.catalog.title": { en: "Available profiles" },
+  ...PROFILE_OPTION_KEYS,
+};

package/packages/bundled-features/src/compliance-profiles/index.ts

@@ -0,0 +1,13 @@
+export {
+  COMPLIANCE_PROFILE_SCREEN_ID,
+  COMPLIANCE_PROFILES_FEATURE,
+  ComplianceProfileHandlers,
+  ComplianceProfileQueries,
+} from "./constants.js";
+export {
+  type ComplianceProfilesFeatureOptions,
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
+} from "./feature.js";
+export { resolveProfileForTenant } from "./resolve-for-tenant.js";

package/packages/bundled-features/src/compliance-profiles/resolve-for-tenant.ts

@@ -0,0 +1,57 @@
+// Direkter Resolver-Helper fuer Bulk-Iteration ohne dispatcher-Roundtrip.
+//
+// `for-tenant`-Query (handlers/for-tenant.query.ts) ist die Cross-Feature-
+// API fuer Handler-Pfade. Worker (S2.U3 Atom 3b) lebt im JobContext
+// ohne `queryAs` — braucht direkten DB-Lookup + resolveComplianceProfile.
+//
+// Pattern matched data-retention's `resolveRetentionPolicyForTenant`.
+// Beide Pfade nutzen `resolveComplianceProfile` aus framework/compliance,
+// also kein Drift zwischen Query-API und Worker-Pfad.
+
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  type ComplianceProfileKey,
+  type EffectiveComplianceProfile,
+  resolveComplianceProfile,
+} from "@cosmicdrift/kumiko-framework/compliance";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { isTenantDb } from "../shared/index.js";
+import { parseComplianceProfileOverride } from "./_internal/parse-override.js";
+import { tenantComplianceProfileTable } from "./schema/profile-selection.js";
+
+export interface ResolveProfileForTenantArgs {
+  // data-retention's resolveTenantRetentionPreset forwards this via
+  // resolveRetentionPolicyForTenant, whose own `db` is DbRunner | TenantDb
+  // (bulk cron vs. per-hook TenantDb). This lookup is a plain tenant-scoped
+  // read either way.
+  readonly db: DbRunner | TenantDb;
+  readonly tenantId: TenantId;
+}
+
+export async function resolveProfileForTenant(
+  args: ResolveProfileForTenantArgs,
+): Promise<EffectiveComplianceProfile> {
+  const row = isTenantDb(args.db)
+    ? ((await args.db.fetchOne<{ profileKey: string; override: string | null }>(
+        tenantComplianceProfileTable,
+        { tenantId: args.tenantId },
+      )) ?? null)
+    : ((await fetchOne(args.db, tenantComplianceProfileTable, {
+        tenantId: args.tenantId,
+      })) as { profileKey: string; override: string | null } | null); // @cast-boundary db-runner
+
+  if (!row) {
+    return resolveComplianceProfile({});
+  }
+
+  const override = parseComplianceProfileOverride(
+    row.override,
+    args.tenantId,
+    "compliance-profiles:resolve-for-tenant",
+  );
+  return resolveComplianceProfile({
+    selection: row.profileKey as ComplianceProfileKey, // @cast-boundary engine-payload
+    override,
+  });
+}