@cosmicdrift/kumiko-bundled-features 0.113.1 → 1.0.0

package/src/subscription-stripe/__tests__/runtime.test.ts

@@ -44,24 +44,34 @@ const BILLING_LIVE_HANDLE: ConfigKeyHandle<"boolean"> = {
 
 /** Stub-SecretsContext: liest aus einer in-memory-map, matcht per
  *  qualified-name. backing:"secrets" persistiert config-Werte JSON-
- *  serialisiert — der Stub spiegelt das per Default, damit der Runtime-
- *  parseStoredSecret denselben Pfad nimmt wie gegen den echten Store.
- *  `raw: true` speichert UN-serialisiert (482/1) — um parseStoredSecret's
- *  Fehlerpfad zu treffen: ein Credential, das der Store un-JSON-kodiert
- *  zurückgibt (Korruption oder außerhalb des backing:"secrets"-Roundtrips
- *  geschrieben) muss laut failen, nicht still Müll liefern. Ignoriert
- *  auditCtx. */
-function stubSecrets(
-  values: Record<string, string>,
-  opts?: { readonly raw?: boolean },
-): SecretsContext {
+ *  serialisiert — der Stub spiegelt das, damit der Runtime-parseStoredSecret
+ *  denselben Pfad nimmt wie gegen den echten Store. Ignoriert auditCtx. */
+function stubSecrets(values: Record<string, string>): SecretsContext {
   const nameOf = (k: string | { readonly name: string }): string =>
     typeof k === "string" ? k : k.name;
   return {
     get: async (_tenantId, key) => {
       const value = values[nameOf(key)];
-      if (value === undefined) return undefined;
-      return createSecret(opts?.raw ? value : JSON.stringify(value));
+      return value === undefined ? undefined : createSecret(JSON.stringify(value));
+    },
+    has: async (_tenantId, key) => values[nameOf(key)] !== undefined,
+    set: async () => undefined,
+    delete: async () => false,
+  };
+}
+
+/** Wie stubSecrets, aber speichert den Wert ROH (kein JSON.stringify) — um
+ *  parseStoredSecret's Fehlerpfad zu treffen: ein Credential, das der Store
+ *  un-JSON-kodiert zurückgibt (Korruption oder ein außerhalb des
+ *  backing:"secrets"-Roundtrips geschriebener Wert) muss laut failen, nicht
+ *  still Müll liefern. */
+function rawSecretsStub(values: Record<string, string>): SecretsContext {
+  const nameOf = (k: string | { readonly name: string }): string =>
+    typeof k === "string" ? k : k.name;
+  return {
+    get: async (_tenantId, key) => {
+      const value = values[nameOf(key)];
+      return value === undefined ? undefined : createSecret(value); // RAW, not JSON
     },
     has: async (_tenantId, key) => values[nameOf(key)] !== undefined,
     set: async () => undefined,
@@ -154,7 +164,7 @@ describe("StripeCtxRuntime.clientForCtx", () => {
     // throw, not silently fall through to undefined/fallback.
     const rt = makeRuntimes({ apiKey: "sk_test_fallback" });
     const ctx = stubCtx({
-      secrets: stubSecrets({ [API_KEY_HANDLE.name]: "sk_test_raw_unquoted" }, { raw: true }),
+      secrets: rawSecretsStub({ [API_KEY_HANDLE.name]: "sk_test_raw_unquoted" }),
     });
     await expect(rt.ctx.clientForCtx(ctx)).rejects.toThrow(
       /Invalid JSON in subscription-stripe credential/,

package/src/subscription-stripe/__tests__/stripe-foundation.integration.test.ts

@@ -20,7 +20,7 @@ import {
   type SubscriptionProviderPlugin,
   subscriptionAggregateId,
 } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
 import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
@@ -31,7 +31,6 @@ import {
   testTenantId,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { Hono } from "hono";
 import Stripe from "stripe";
 import { configValuesTable, createConfigFeature } from "../../config";
@@ -80,8 +79,8 @@ beforeAll(async () => {
     priceToTier: PRICE_TO_TIER,
   });
 
-  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ encryption });
   const masterKeyProvider = createEnvMasterKeyProvider({
     env: {
       KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
@@ -471,8 +470,8 @@ describe("scenario 6: billing-live gate end-to-end (#104)", () => {
 
   beforeAll(async () => {
     const stripeFeature = createSubscriptionStripeFeature({ priceToTier: PRICE_TO_TIER });
-    const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
-    const resolver = createConfigResolver({ cipher: encryption });
+    const encryption = createEncryptionProvider(randomBytes(32).toString("base64"));
+    const resolver = createConfigResolver({ encryption });
     const masterKeyProvider = createEnvMasterKeyProvider({
       env: {
         KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),

package/src/tags/__tests__/tags.integration.test.ts

@@ -358,11 +358,6 @@ describe("tags integration — multi-tenant isolation", () => {
 // "Admin", not "TenantAdmin"). Default-mounted tags deny that same user.
 describe("tags integration — openToAll access model", () => {
   let openStack: TestStack;
-  // Dedicated stack (477/1), not the outer file's `stack` — a describe-level
-  // `--test-name-pattern` run of just this block would otherwise crash on an
-  // undefined outer `stack` instead of failing cleanly, and this block
-  // shouldn't depend on describe-execution order for its setup to exist.
-  let defaultStack: TestStack;
   // role deliberately not in DEFAULT_TAG_ROLES nor "Admin" — proves openToAll,
   // not an accidental role match.
   const unprivileged = createTestUser({ roles: ["Viewer"] });
@@ -374,16 +369,10 @@ describe("tags integration — openToAll access model", () => {
     await unsafeCreateEntityTable(openStack.db, tagEntity);
     await unsafeCreateEntityTable(openStack.db, tagAssignmentEntity);
     await createEventsTable(openStack.db);
-
-    defaultStack = await setupTestStack({ features: [tagsFeature] });
-    await unsafeCreateEntityTable(defaultStack.db, tagEntity);
-    await unsafeCreateEntityTable(defaultStack.db, tagAssignmentEntity);
-    await createEventsTable(defaultStack.db);
   });
 
   afterAll(async () => {
     await openStack.cleanup();
-    await defaultStack.cleanup();
   });
 
   test("a non-tag-role user can create, assign, list and remove", async () => {
@@ -420,7 +409,7 @@ describe("tags integration — openToAll access model", () => {
   });
 
   test("the SAME user is denied on a default-role-mounted feature", async () => {
-    const denied = await defaultStack.http.writeErr(
+    const denied = await stack.http.writeErr(
       TagsHandlers.createTag,
       { name: "nope" },
       unprivileged,

package/src/tags/entity.ts

@@ -6,12 +6,7 @@ import { createEntity, createTextField } from "@cosmicdrift/kumiko-framework/eng
 export const tagEntity = createEntity({
   table: "read_tags",
   fields: {
-    // Catalog labels ("urgent", "billing"), not user-identifying content —
-    // allowPlaintext silences the user-content heuristic (456/5). A tenant
-    // COULD name a tag after a person; if that becomes a real requirement,
-    // this needs a userOwned annotation + forget/export hooks in the
-    // user-data-rights pipeline (none exist for tags today).
-    name: createTextField({ required: true, maxLength: 64, allowPlaintext: "catalog-label" }),
+    name: createTextField({ required: true, maxLength: 64 }),
     // Optional UI hint (hex or token). No enforcement — purely for rendering.
     color: createTextField({ maxLength: 32 }),
     // Optional entity-type scope (GitLab project-vs-group labels): empty = global

package/src/tags/schemas.ts

@@ -41,17 +41,10 @@ export const deleteTagPayloadSchema = z.object({
 export type DeleteTagPayload = z.infer<typeof deleteTagPayloadSchema>;
 
 // assign + remove share the (tag, entity) reference shape.
-// entityType/entityId are app-supplied, unlike tagId (always a real tag's
-// UUID) — tagAssignmentAggregateId joins all four with "|" to derive the
-// stream id, so a literal "|" in either could shift tuple boundaries and
-// collide with an unrelated (tenant, tag, entity) combination (456/3).
-// Rejecting it here is cheaper and non-breaking compared to changing the
-// derivation's separator, which would re-key every existing stream.
-const NO_PIPE = /^[^|]*$/;
 const entityTagRef = {
   tagId: z.string().min(1).max(64),
-  entityType: z.string().min(1).max(64).regex(NO_PIPE, 'entityType must not contain "|"'),
-  entityId: z.string().min(1).max(128).regex(NO_PIPE, 'entityId must not contain "|"'),
+  entityType: z.string().min(1).max(64),
+  entityId: z.string().min(1).max(128),
 } as const;
 
 export const assignTagPayloadSchema = z.object(entityTagRef);

package/src/tags/web/tag-manager.tsx

@@ -308,7 +308,7 @@ export function TagManager({
                 <div className="flex gap-2">
                   <Button
                     variant="primary"
-                    disabled={busy || editName.trim() === ""}
+                    disabled={busy}
                     onClick={() => saveEdit(tag)}
                     testId={`tag-manager-save-${tag.id}`}
                   >

package/src/template-resolver/testing.ts

@@ -74,11 +74,10 @@ export async function assertConsumerHandlesNotFound(
   const { tenantId } = opts;
   let rejected = false;
   let err: unknown;
-  const slug = `conformance-not-found-${crypto.randomUUID()}`;
   try {
     await consumer.resolve({
       tenantId,
-      slug,
+      slug: "conformance-not-found-slug",
       kind: "mail-html",
       locale: "de",
     });

package/src/tenant/__tests__/tenant.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -10,11 +10,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import {
-  createTestEnvelopeCipher,
-  expectErrorIncludes,
-  rolesOf,
-} from "@cosmicdrift/kumiko-framework/testing";
+import { expectErrorIncludes, rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigAccessor, createConfigFeature } from "../../config";
 import { ConfigHandlers, ConfigQueries } from "../../config/constants";
 import { type ConfigResolver, createConfigResolver } from "../../config/resolver";
@@ -37,8 +33,8 @@ const tenantFeature = createTenantFeature();
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(testEncryptionKey);
-  resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(testEncryptionKey);
+  resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [configFeature, tenantFeature],

package/src/tier-engine/__tests__/tier-engine.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -11,10 +11,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import {
-  createTestEnvelopeCipher,
-  expectErrorIncludes,
-} from "@cosmicdrift/kumiko-framework/testing";
+import { expectErrorIncludes } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { type ConfigResolver, createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -41,8 +38,8 @@ const tenantFeature = createTenantFeature();
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(testEncryptionKey);
-  resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(testEncryptionKey);
+  resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [configFeature, tenantFeature, tierEngineFeature],

package/src/user/__tests__/user.integration.test.ts

@@ -109,32 +109,6 @@ describe("scenario 2: field-level read access", () => {
   });
 });
 
-// --- find-for-auth is system-only: it returns the raw row incl. passwordHash,
-// and every query handler is reachable via POST /api/query — so even a
-// SystemAdmin (assignable app role) must be denied over HTTP. ---
-
-describe("scenario 2b: find-for-auth is system-only", () => {
-  test("SystemAdmin over HTTP is denied — passwordHash must not leak", async () => {
-    await seedUser({
-      email: "auth-lookup@example.com",
-      displayName: "AuthLookup",
-      passwordHash: "must-never-leave-the-server",
-    });
-
-    const res = await stack.http.queryWithHeaders(
-      UserQueries.findForAuth,
-      { email: "auth-lookup@example.com" },
-      systemAdmin,
-      {},
-    );
-
-    expect(res.status).toBeGreaterThanOrEqual(400);
-    const body = await res.text();
-    expect(body).toContain("access_denied");
-    expect(body).not.toContain("must-never-leave-the-server");
-  });
-});
-
 // --- Scenario 3: user edits own profile, email/passwordHash are system-locked ---
 
 describe("scenario 3: self-update + field-level write access", () => {

package/src/user/handlers/find-for-auth.query.ts

@@ -7,12 +7,10 @@ import { userTable } from "../schema/user";
 // by email OR id (exactly one, enforced by the schema). Used by the auth
 // features via ctx.queryAs(systemUser, ...).
 //
-// Access is system-only, NOT access.privileged: every query handler is
-// reachable via POST /api/query, and "SystemAdmin" is an assignable app
-// role — privileged would hand any SystemAdmin the raw passwordHash over
-// HTTP. The "system" role can't be minted into a session (only
-// createSystemUser() carries it), so system-only keeps this handler
-// internal to ctx.queryAs(systemUser, ...) callers.
+// Field-level read rules allow passwordHash for the "privileged" role set,
+// so system callers see everything; any other caller is filtered even if
+// they somehow reach this handler. Access is also restricted to privileged
+// — regular users or tenant admins cannot call this at all.
 export const findForAuthQuery = defineQueryHandler({
   name: "user:find-for-auth",
   schema: z
@@ -26,7 +24,7 @@ export const findForAuthQuery = defineQueryHandler({
       (v) => (v.email !== undefined) !== (v.id !== undefined),
       { message: "exactly one of email or id must be set" },
     ),
-  access: { roles: access.system },
+  access: { roles: access.privileged },
   handler: async (query, ctx) => {
     const where =
       query.payload.email !== undefined

package/src/user/index.ts

@@ -1,9 +1,5 @@
 export { UserCommandSchemas } from "./command-schemas";
 export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants";
-export {
-  backfillUserStreamTenants,
-  type UserStreamBackfillResult,
-} from "./db/queries/stream-tenant-backfill";
 export { createUserFeature } from "./feature";
 export type { UserStatus } from "./schema/user";
 export {

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -10,6 +10,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -24,11 +25,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import {
-  createTestEnvelopeCipher,
-  resetTestTables,
-  updateRows,
-} from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
@@ -103,8 +100,8 @@ const noSignedUrlProviderFeature = defineFeature("test-no-signed-url-provider",
 });
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(testEncryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(testEncryptionKey);
+  const resolver = createConfigResolver({ encryption });
 
   stack = await setupTestStack({
     features: [

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -14,6 +14,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import {
   createRegistry,
   type Registry,
@@ -39,7 +40,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
-  createTestEnvelopeCipher,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
@@ -97,8 +97,8 @@ function buildFeatures() {
 }
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -13,6 +13,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -25,7 +26,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
-  createTestEnvelopeCipher,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
@@ -65,8 +65,8 @@ const ALICE_EMAIL = "alice.restrict@example.com";
 const ALICE_PW = "alice-pw-long-enough";
 
 beforeAll(async () => {
-  const encryption = createTestEnvelopeCipher(encryptionKey);
-  const resolver = createConfigResolver({ cipher: encryption });
+  const encryption = createEncryptionProvider(encryptionKey);
+  const resolver = createConfigResolver({ encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({

package/src/user-data-rights/feature.ts

@@ -249,7 +249,9 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     r.queryHandler(myAuditLogQuery);
     r.queryHandler(listDownloadAttemptsQuery);
 
-    // Read-only GDPR operator inspector (SystemAdmin) — screens stay inert until an app navs them.
+    // Read-only operator inspector over the GDPR read-models (SystemAdmin).
+    // Convention list/detail handlers so entityList/entityEdit resolve by QN;
+    // the screens stay inert until an app navs them (opt-in at wire time).
     r.queryHandler(exportJobListQuery);
     r.queryHandler(exportJobDetailQuery);
     r.queryHandler(downloadAttemptListQuery);

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -63,11 +63,13 @@ export const downloadByJobQuery = defineQueryHandler({
     const userId = query.user.id;
     const jobId = query.payload.jobId;
     const tenantId = query.user.tenantId;
-    // IP + UA aus dem request-scoped Kontext (von requestIdMiddleware
-    // befuellt) — server-trusted, anders als ein vom Client mitgeschickter
-    // Wert (603/2).
+    // IP aus dem request-scoped Kontext (von requestIdMiddleware aus
+    // x-forwarded-for befuellt) — server-trusted, anders als ein vom Client
+    // mitgeschickter Wert. UA steht nicht im RequestContext; der Audit-Row
+    // laesst sie null (best-effort, via requestId in den Server-Logs
+    // cross-referenzierbar).
     const auditIp = requestContext.get()?.ip ?? null;
-    const auditUa = requestContext.get()?.userAgent ?? null;
+    const auditUa: string | null = null;
 
     // Step 1-2: job-lookup + cross-user-isolation
     // ctx.db.raw weil tenant-agnostisch — Alice in Tenant B sucht den

package/src/user-data-rights/lib/update-user-lifecycle.ts

@@ -1,7 +1,7 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 
@@ -21,6 +21,16 @@ import { USER_STATUS, userEntity, userTable } from "../../user";
 // kann abweichen).
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
 
+// Stream-Tenant = die framework-injizierte tenant_id der read_users-Row. Der
+// Reducer setzt sie aus `user.created`.tenantId, ein Rebuild rekonstruiert sie
+// daraus — sie IST also der Stream-Key des Aggregats. Die Row direkt zu lesen
+// (statt das created-Event zu joinen) deckt auch direkt-geseedete Rows ab.
+async function streamTenantOf(conn: DbRunner, userId: string): Promise<TenantId | null> {
+  const row = await fetchOne<{ tenantId?: string }>(conn, userTable, { id: userId });
+  // @cast-boundary db-row — tenant_id ist eine TenantId-shaped uuid-Spalte.
+  return row?.tenantId ? (row.tenantId as TenantId) : null;
+}
+
 // `conn` ist ctx.db.raw (regulaere Handler) ODER die offene tx (forget-cleanup
 // Sub-Tx) — so bleibt der Event-Append atomar mit dem umgebenden Write.
 export async function updateUserLifecycle(
@@ -28,14 +38,20 @@ export async function updateUserLifecycle(
   userId: string,
   changes: Record<string, unknown>,
 ): Promise<void> {
-  // user ist systemStream (#497): der Executor-Choke-Point addressiert den
-  // Stream immer auf SYSTEM_TENANT_ID — ein Rescope auf die row-tenant_id
-  // waere wirkungslos. "system"-Mode, damit loadById auch Legacy-Rows findet,
-  // deren tenant_id noch vor dem #762-Backfill-Rebuild steht.
-  const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
+  const streamTenantId = await streamTenantOf(conn, userId);
+  if (!streamTenantId) {
+    throw new InternalError({
+      message: `read_users row ${userId} has no tenant_id — cannot rescope lifecycle write to its stream tenant`,
+    });
+  }
+
+  // Rescope BEIDE Achsen auf den Stream-Tenant: der db-Arg treibt loadById +
+  // den Stream-Read, der user-Arg die Event-tenantId + Ownership. Nur beide
+  // zusammen halten created + updated auf einem Stream.
+  const tenantDb = createTenantDb(conn, streamTenantId, "tenant");
   const result = await userExecutor.update(
     { id: userId, changes },
-    createSystemUser(SYSTEM_TENANT_ID),
+    createSystemUser(streamTenantId),
     tenantDb,
     { skipOptimisticLock: true },
   );

package/src/user-data-rights/run-forget-cleanup.ts

@@ -316,7 +316,6 @@ async function processUser(args: {
           await entry.deleteHook(
             {
               db: tx,
-              registry,
               tenantId,
               userId,
               buildStorageProvider,

package/src/user-data-rights/run-user-export.ts

@@ -22,11 +22,6 @@
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import {
-  collectEncryptedFieldNames,
-  configuredEntityFieldEncryption,
-  decryptEntityFieldValues,
-} from "@cosmicdrift/kumiko-framework/db";
 import {
   EXT_USER_DATA,
   type Registry,
@@ -142,9 +137,8 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   for (const tenantId of tenantList) {
     const entities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const rawSnippet = await entry.exportHook({ db, registry, tenantId, userId });
-      if (rawSnippet === null) continue;
-      const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
+      const snippet = await entry.exportHook({ db, tenantId, userId });
+      if (snippet === null) continue;
       entities.push(snippet);
       if (snippet.fileRefs) {
         for (const ref of snippet.fileRefs) {
@@ -175,14 +169,12 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   if (tenantList.length === 0 && hookEntries.length > 0) {
     const orphanEntities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const rawSnippet = await entry.exportHook({
+      const snippet = await entry.exportHook({
         db,
-        registry,
         tenantId: SYSTEM_TENANT_ID_FOR_ORPHANS,
         userId,
       });
-      if (rawSnippet === null) continue;
-      const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
+      if (snippet === null) continue;
       orphanEntities.push(snippet);
       if (snippet.fileRefs) {
         for (const ref of snippet.fileRefs) {
@@ -211,37 +203,6 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   };
 }
 
-// Art. 20 verlangt die DATEN, nicht deren Ciphertext: Export-Hooks lesen
-// raw rows an der Executor-Decrypt-Schicht vorbei, darum entschluesselt
-// dieser zentrale Pass encrypted entity fields nach jedem Hook. Ohne
-// konfigurierten Cipher wird ein expliziter Marker exportiert statt den
-// base64-Blob als "Wert" auszuliefern (leak-by-confusion).
-const ENCRYPTED_UNAVAILABLE = "[encrypted:unavailable]";
-
-async function decryptSnippetFields(
-  registry: Registry,
-  hookEntityName: string,
-  snippet: UserDataExportSnippet,
-): Promise<UserDataExportSnippet> {
-  const entity = registry.getEntity(snippet.entity) ?? registry.getEntity(hookEntityName);
-  if (!entity) return snippet;
-  const encryptedFields = collectEncryptedFieldNames(entity);
-  if (encryptedFields.size === 0) return snippet;
-
-  const cipher = configuredEntityFieldEncryption();
-  const rows = await Promise.all(
-    snippet.rows.map(async (row) => {
-      if (cipher) return decryptEntityFieldValues(row, encryptedFields, cipher);
-      const out = { ...row };
-      for (const name of encryptedFields) {
-        if (typeof out[name] === "string") out[name] = ENCRYPTED_UNAVAILABLE;
-      }
-      return out;
-    }),
-  );
-  return { ...snippet, rows };
-}
-
 // Pseudo-Tenant fuer User ohne aktive Memberships. Identisch zum
 // Pattern in run-forget-cleanup.ts — RFC4122-Null-UUID. Tenant-scoped
 // Hooks finden hier nichts (no-op).

package/src/user-data-rights/web/__tests__/public-deletion-gate.test.tsx

@@ -5,7 +5,7 @@
 // Provider-Wrapper lokal (Dependency-Richtung renderer-web → bundled-features
 // verbietet test-utils-Import).
 
-import { afterEach, describe, expect, test } from "bun:test";
+import { describe, expect, test } from "bun:test";
 import type { Dispatcher } from "@cosmicdrift/kumiko-headless";
 import {
   createStaticLocaleResolver,
@@ -27,12 +27,6 @@ const stubDispatcher = {
 
 const ROUTES = { requestPath: "/account/delete", confirmPath: "/account/delete/confirm" };
 
-// renderGate mutates the shared happy-dom document's history (570/1) — reset
-// so a later, unrelated test file doesn't inherit this suite's last path.
-afterEach(() => {
-  window.history.replaceState({}, "", "/");
-});
-
 function renderGate(path: string, gate: ReactNode): ReturnType<typeof within> {
   window.history.replaceState({}, "", path);
   const { container } = render(

package/src/user-data-rights/web/client-plugin.tsx

@@ -45,10 +45,5 @@ export function userDataRightsClient(
     },
   };
   if (options?.publicDeletion === undefined) return base;
-  // Extend, not overwrite (570/2) — base.gates is empty today, but a spread
-  // that clobbers it instead of appending would silently drop future gates.
-  return {
-    ...base,
-    gates: [...(base.gates ?? []), makePublicDeletionGate(options.publicDeletion)],
-  };
+  return { ...base, gates: [makePublicDeletionGate(options.publicDeletion)] };
 }