@cosmicdrift/kumiko-bundled-features 0.210.0 → 0.212.0

package/src/auth-mfa/feature.ts

@@ -130,6 +130,7 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
     // convention). App places it via r.nav in its logged-in settings area.
     // dormant: true skips createKumikoApp's missing-client-plugin boot
     // diagnostic (#2025) for apps that don't nav this screen (#2034).
+    // kumiko-lint-ignore app-feature-structure Multi-step auth flow (enable + recovery-codes reveal), no declarative screen type covers this
     r.screen({
       id: MFA_ENABLE_SCREEN_ID,
       type: "custom",

package/src/auth-mfa/web/mfa-disable-dialog.tsx

@@ -21,6 +21,7 @@ export type MfaDisableDialogProps = {
   readonly onError: (i18nKey: string) => void;
 };
 
+// kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaDisableDialog({
   open,
   onOpenChange,

package/src/auth-mfa/web/mfa-regenerate-recovery-dialog.tsx

@@ -18,6 +18,7 @@ export type MfaRegenerateRecoveryDialogProps = {
   readonly onError: (i18nKey: string) => void;
 };
 
+// kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaRegenerateRecoveryDialog({
   open,
   onOpenChange,

package/src/compliance-profiles/feature.ts

@@ -103,11 +103,7 @@ export function createComplianceProfilesFeature(
       id: "profile-picker",
       label: "compliance-profiles:nav.profilePicker",
       screen: "compliance-profiles:screen:profile-picker",
-      // "shield-check" (spec suggestion, fw#2222) isn't in NavIconKey's closed
-      // vocabulary (packages/types/src/nav-icon.ts) — adding it needs a
-      // matching lucide-react entry in renderer-web's NAV_ICONS map too, both
-      // outside this feature. "shield" is the closest already-registered key.
-      icon: "shield",
+      icon: "shield-check",
       order: 50,
     });
 

package/src/crypto-shredding/changes.json

@@ -16,7 +16,8 @@
     "type": "breaking",
     "title": "Test-only reset helpers moved from /crypto to /testing (fw#1631).",
     "detail": "resetPiiSubjectKmsForTests and resetBlindIndexKeyForTests are no longer exported by the production barrels. The functions did not change — only the export path. Why it matters beyond tidiness: resetPiiSubjectKmsForTests clears the injected KMS, after which encryptForStorage sees no adapter and writes subject-annotated fields in plaintext, with no error and no log. Reachable from a production barrel, that is one stray import away from silent plaintext PII.",
-    "migration": "Change the import in your test files: `import { resetPiiSubjectKmsForTests } from \"@cosmicdrift/kumiko-framework/testing\"` instead of `.../crypto`. Type-check catches every occurrence; nothing else changes. Apps mounting crypto-shredding typically hit this in every test that configures an InMemoryKmsAdapter."
+    "migration": "Change the import in your test files: `import { resetPiiSubjectKmsForTests } from \"@cosmicdrift/kumiko-framework/testing\"` instead of `.../crypto`. Type-check catches every occurrence; nothing else changes. Apps mounting crypto-shredding typically hit this in every test that configures an InMemoryKmsAdapter.",
+    "codemod": "scripts/codemod/crypto-shredding-testing-move.ts"
   },
   {
     "version": "0.165.3",

package/src/custom-fields/__tests__/feature.test.ts

@@ -189,6 +189,33 @@ describe("createCustomFieldsFeature access-options", () => {
     });
     expect(listAccess(feature)).toEqual(["Viewer"]);
   });
+
+  // #2296 — define-/update-/delete-tenant-field were hard-wired to
+  // ["TenantAdmin"] with no override; fieldDefinitionWriteRoles closes that gap.
+  test("fieldDefinitionWriteRoles überschreibt define-, update- UND delete-tenant-field", () => {
+    const feature = createCustomFieldsFeature({ fieldDefinitionWriteRoles: ["Admin", "Editor"] });
+    expect(writeAccess(feature, "define-tenant-field")).toEqual(["Admin", "Editor"]);
+    expect(writeAccess(feature, "update-tenant-field")).toEqual(["Admin", "Editor"]);
+    expect(writeAccess(feature, "delete-tenant-field")).toEqual(["Admin", "Editor"]);
+    // System-scope stays hard-wired — a different trust boundary that must not
+    // become reachable through a tenant role vocabulary.
+    expect(writeAccess(feature, "define-system-field")).toEqual(["SystemAdmin"]);
+    expect(writeAccess(feature, "delete-system-field")).toEqual(["SystemAdmin"]);
+  });
+
+  test("fieldDefinitionWriteRoles feeds into the list-default (a definer can load what they defined)", () => {
+    const feature = createCustomFieldsFeature({ fieldDefinitionWriteRoles: ["Admin", "Editor"] });
+    const roles = listAccess(feature);
+    expect(roles).toContain("Admin");
+    expect(roles).toContain("Editor");
+    expect(roles).toContain("TenantAdmin");
+  });
+
+  test("fieldDefinitionWriteRoles and valueWriteRoles are independent — setting one leaves the other's default", () => {
+    const feature = createCustomFieldsFeature({ fieldDefinitionWriteRoles: ["Admin"] });
+    expect(writeAccess(feature, "set-custom-field")).toEqual(["TenantAdmin", "TenantMember"]);
+    expect(writeAccess(feature, "clear-custom-field")).toEqual(["TenantAdmin", "TenantMember"]);
+  });
 });
 
 describe("resolveFieldDefinitionListRoles", () => {
@@ -216,4 +243,19 @@ describe("resolveFieldDefinitionListRoles", () => {
       }),
     ).toEqual(["Viewer"]);
   });
+
+  test("fieldDefinitionWriteRoles gesetzt, list ungesetzt → Union mit Default, dedupliziert", () => {
+    expect(
+      resolveFieldDefinitionListRoles({ fieldDefinitionWriteRoles: ["Admin", "Editor"] }),
+    ).toEqual(["Admin", "Editor", "TenantAdmin"]);
+  });
+
+  test("valueWriteRoles UND fieldDefinitionWriteRoles gesetzt → Union aus beiden plus Default", () => {
+    expect(
+      resolveFieldDefinitionListRoles({
+        valueWriteRoles: ["Member"],
+        fieldDefinitionWriteRoles: ["Admin"],
+      }),
+    ).toEqual(["Member", "Admin", "TenantAdmin"]);
+  });
 });

package/src/custom-fields/__tests__/field-definition-role-config.integration.test.ts

@@ -0,0 +1,139 @@
+// #2296 — role-configurability of the definition-CRUD triad (define-/update-/
+// delete-tenant-field), which was hard-wired to ["TenantAdmin"] with no override.
+// Verifies createCustomFieldsFeature({ fieldDefinitionWriteRoles }) actually
+// gates all three handlers with the configured roles (not just define), that the
+// default-role user loses access once the override is set (Role-Naming-Drift is
+// real, not just documented), and that a definer without an explicit
+// fieldDefinitionListRoles override can still list what they defined.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { fieldDefinitionEntity } from "../entity";
+import { createCustomFieldsFeature } from "../feature";
+
+const admin = createTestUser({ roles: ["TenantAdmin"] });
+const customRoleUser = createTestUser({ roles: ["Admin"] });
+
+function defPayload(fieldKey: string) {
+  return {
+    entityName: "customer",
+    fieldKey,
+    serializedField: { type: "text" },
+    required: false,
+    searchable: false,
+    displayOrder: 0,
+  };
+}
+
+describe("custom-fields — fieldDefinitionWriteRoles (#2296)", () => {
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    stack = await setupTestStack({
+      features: [createCustomFieldsFeature({ fieldDefinitionWriteRoles: ["Admin"] })],
+    });
+    await unsafeCreateEntityTable(stack.db, fieldDefinitionEntity);
+    await createEventsTable(stack.db);
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await asRawClient(stack.db).unsafe("DELETE FROM kumiko_events");
+    await asRawClient(stack.db).unsafe("DELETE FROM read_custom_field_definitions");
+  });
+
+  test("a custom-role user can define, update and delete a tenant field definition", async () => {
+    await stack.http.writeOk(
+      "custom-fields:write:define-tenant-field",
+      defPayload("vip"),
+      customRoleUser,
+    );
+    const afterDefine = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
+      "custom-fields:query:field-definition:list",
+      {},
+      customRoleUser,
+    );
+    const defined = afterDefine.rows.find((r) => r["fieldKey"] === "vip");
+    expect(defined).toBeDefined();
+    expect(defined?.["searchable"]).toBe(false);
+
+    await stack.http.writeOk(
+      "custom-fields:write:update-tenant-field",
+      { ...defPayload("vip"), searchable: true },
+      customRoleUser,
+    );
+    const afterUpdate = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
+      "custom-fields:query:field-definition:list",
+      {},
+      customRoleUser,
+    );
+    const updated = afterUpdate.rows.find((r) => r["fieldKey"] === "vip");
+    expect(updated?.["searchable"]).toBe(true);
+
+    await stack.http.writeOk(
+      "custom-fields:write:delete-tenant-field",
+      { entityName: "customer", fieldKey: "vip" },
+      customRoleUser,
+    );
+    const afterDelete = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
+      "custom-fields:query:field-definition:list",
+      {},
+      customRoleUser,
+    );
+    expect(afterDelete.rows.some((r) => r["fieldKey"] === "vip")).toBe(false);
+  });
+
+  test("the default TenantAdmin role is denied on all three once fieldDefinitionWriteRoles overrides it", async () => {
+    const defineDenied = await stack.http.writeErr(
+      "custom-fields:write:define-tenant-field",
+      defPayload("vip2"),
+      admin,
+    );
+    expect(defineDenied.httpStatus).toBe(403);
+
+    await stack.http.writeOk(
+      "custom-fields:write:define-tenant-field",
+      defPayload("vip2"),
+      customRoleUser,
+    );
+
+    const updateDenied = await stack.http.writeErr(
+      "custom-fields:write:update-tenant-field",
+      { ...defPayload("vip2"), searchable: true },
+      admin,
+    );
+    expect(updateDenied.httpStatus).toBe(403);
+
+    const deleteDenied = await stack.http.writeErr(
+      "custom-fields:write:delete-tenant-field",
+      { entityName: "customer", fieldKey: "vip2" },
+      admin,
+    );
+    expect(deleteDenied.httpStatus).toBe(403);
+  });
+
+  test("a definer without an explicit fieldDefinitionListRoles override can list their own definitions", async () => {
+    await stack.http.writeOk(
+      "custom-fields:write:define-tenant-field",
+      defPayload("vip3"),
+      customRoleUser,
+    );
+
+    const list = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
+      "custom-fields:query:field-definition:list",
+      {},
+      customRoleUser,
+    );
+    expect(list.rows.some((r) => r["fieldKey"] === "vip3")).toBe(true);
+  });
+});

package/src/custom-fields/constants.ts

@@ -59,6 +59,12 @@ export const CUSTOM_FIELDS_EXTENSION = "customFields";
 // für jeden App-User access_denied.
 export const DEFAULT_VALUE_WRITE_ROLES = ["TenantAdmin", "TenantMember"] as const;
 export const DEFAULT_FIELD_DEFINITION_LIST_ROLES = ["TenantAdmin"] as const;
+// Default-RBAC of the definition-CRUD triad (define-/update-/delete-tenant-field,
+// #2296). Apps with their own role vocabulary override via
+// createCustomFieldsFeature({ fieldDefinitionWriteRoles }) — otherwise those three
+// hard-wired handler QNs are access_denied for every app-user without a
+// "TenantAdmin" role (same Role-Naming-Drift as DEFAULT_VALUE_WRITE_ROLES above).
+export const DEFAULT_FIELD_DEFINITION_WRITE_ROLES = ["TenantAdmin"] as const;
 
 // Field-type union — identisch zu Stammfeld-Field-Type-System (Spec Z.59-73:
 // `Identisch zu Entity-Feld-Typen`). Builder-Reuse-Promise: was `r.field.X()`

package/src/custom-fields/feature.ts

@@ -73,12 +73,18 @@ import {
   defineTenantFieldHandler,
 } from "./handlers/define-tenant-field.write";
 import { deleteSystemFieldHandler } from "./handlers/delete-system-field.write";
-import { deleteTenantFieldHandler } from "./handlers/delete-tenant-field.write";
+import {
+  createDeleteTenantFieldHandler,
+  deleteTenantFieldHandler,
+} from "./handlers/delete-tenant-field.write";
 import {
   createSetCustomFieldHandler,
   setCustomFieldHandler,
 } from "./handlers/set-custom-field.write";
-import { updateTenantFieldHandler } from "./handlers/update-tenant-field.write";
+import {
+  createUpdateTenantFieldHandler,
+  updateTenantFieldHandler,
+} from "./handlers/update-tenant-field.write";
 
 const fieldDefinitionDeletedSchema = z.object({
   entityName: z.string(),
@@ -97,6 +103,8 @@ const fieldDefinitionDeletedSchema = z.object({
 // Options-Variante verfehlt.
 type RegisterVariant = {
   readonly defineTenantHandler: WriteHandlerDef;
+  readonly updateTenantHandler: WriteHandlerDef;
+  readonly deleteTenantHandler: WriteHandlerDef;
   readonly setHandler: WriteHandlerDef;
   readonly clearHandler: WriteHandlerDef;
   readonly fieldDefinitionListRoles: readonly string[];
@@ -141,8 +149,8 @@ function registerCustomFields(
   // Definition-CRUD handlers (B1; update kam mit Bug-Bash D2 2026-06-08).
   r.writeHandler(variant.defineTenantHandler);
   r.writeHandler(defineSystemFieldHandler);
-  r.writeHandler(updateTenantFieldHandler);
-  r.writeHandler(deleteTenantFieldHandler);
+  r.writeHandler(variant.updateTenantHandler);
+  r.writeHandler(variant.deleteTenantHandler);
   r.writeHandler(deleteSystemFieldHandler);
 
   // Value-write handlers (B2). Emittieren events auf host-aggregate-stream.
@@ -169,6 +177,8 @@ function registerCustomFields(
 export const customFieldsFeature = defineFeature(CUSTOM_FIELDS_FEATURE_NAME, (r) =>
   registerCustomFields(r, {
     defineTenantHandler: defineTenantFieldHandler,
+    updateTenantHandler: updateTenantFieldHandler,
+    deleteTenantHandler: deleteTenantFieldHandler,
     setHandler: setCustomFieldHandler,
     clearHandler: clearCustomFieldHandler,
     fieldDefinitionListRoles: DEFAULT_FIELD_DEFINITION_LIST_ROLES,
@@ -191,14 +201,37 @@ export type CustomFieldsFeatureOptions = {
    *  FormSection für Value-Writer nie (access_denied), während der Save-Pfad
    *  offen wäre (asymmetrischer Bruch). */
   readonly fieldDefinitionListRoles?: readonly string[];
+  /** Access roles for the definition-CRUD triad (`define-tenant-field`,
+   *  `update-tenant-field`, `delete-tenant-field`) — hard-wired to ["TenantAdmin"]
+   *  before #2296. Apps with their own role vocabulary (e.g. ["Admin","Editor"])
+   *  MUST set this, else field-definition management is access_denied for every
+   *  app-user without a "TenantAdmin" role. Only covers the tenant-scope triad —
+   *  define-/delete-system-field stay hard-wired to ["TenantAdmin"], since
+   *  system-scope is a separate trust boundary that must not become reachable
+   *  through a tenant role vocabulary. Also feeds into
+   *  resolveFieldDefinitionListRoles (below) so a definer without an explicit
+   *  fieldDefinitionListRoles override can still load the definitions they can
+   *  write — mirrors the valueWriteRoles → list-default inheritance. */
+  readonly fieldDefinitionWriteRoles?: readonly string[];
 };
 
 export function resolveFieldDefinitionListRoles(
-  opts: Pick<CustomFieldsFeatureOptions, "valueWriteRoles" | "fieldDefinitionListRoles">,
+  opts: Pick<
+    CustomFieldsFeatureOptions,
+    "valueWriteRoles" | "fieldDefinitionListRoles" | "fieldDefinitionWriteRoles"
+  >,
 ): readonly string[] {
   if (opts.fieldDefinitionListRoles !== undefined) return opts.fieldDefinitionListRoles;
-  if (opts.valueWriteRoles === undefined) return DEFAULT_FIELD_DEFINITION_LIST_ROLES;
-  return [...new Set([...opts.valueWriteRoles, ...DEFAULT_FIELD_DEFINITION_LIST_ROLES])];
+  if (opts.valueWriteRoles === undefined && opts.fieldDefinitionWriteRoles === undefined) {
+    return DEFAULT_FIELD_DEFINITION_LIST_ROLES;
+  }
+  return [
+    ...new Set([
+      ...(opts.valueWriteRoles ?? []),
+      ...(opts.fieldDefinitionWriteRoles ?? []),
+      ...DEFAULT_FIELD_DEFINITION_LIST_ROLES,
+    ]),
+  ];
 }
 
 // Backwards-compat-wrapper. Bestehende Caller (z.B. integration-tests,
@@ -212,17 +245,30 @@ export function createCustomFieldsFeature(
   const hasOptions =
     opts.fieldDefinitionLimitPerTenant !== undefined ||
     opts.valueWriteRoles !== undefined ||
-    opts.fieldDefinitionListRoles !== undefined;
+    opts.fieldDefinitionListRoles !== undefined ||
+    opts.fieldDefinitionWriteRoles !== undefined;
   if (!hasOptions) {
     return customFieldsFeature;
   }
   const limit = opts.fieldDefinitionLimitPerTenant;
+  const definitionWriteRoles = opts.fieldDefinitionWriteRoles;
   return defineFeature(CUSTOM_FIELDS_FEATURE_NAME, (r) =>
     registerCustomFields(r, {
       defineTenantHandler:
-        limit !== undefined
-          ? createDefineTenantFieldHandler({ fieldDefinitionLimitPerTenant: limit })
+        limit !== undefined || definitionWriteRoles !== undefined
+          ? createDefineTenantFieldHandler({
+              fieldDefinitionLimitPerTenant: limit,
+              roles: definitionWriteRoles,
+            })
           : defineTenantFieldHandler,
+      updateTenantHandler:
+        definitionWriteRoles !== undefined
+          ? createUpdateTenantFieldHandler({ roles: definitionWriteRoles })
+          : updateTenantFieldHandler,
+      deleteTenantHandler:
+        definitionWriteRoles !== undefined
+          ? createDeleteTenantFieldHandler({ roles: definitionWriteRoles })
+          : deleteTenantFieldHandler,
       setHandler: createSetCustomFieldHandler(opts.valueWriteRoles),
       clearHandler: createClearCustomFieldHandler(opts.valueWriteRoles),
       fieldDefinitionListRoles: resolveFieldDefinitionListRoles(opts),

package/src/custom-fields/handlers/define-tenant-field.write.ts

@@ -1,6 +1,7 @@
 import { isSystemTenant, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
+import { DEFAULT_FIELD_DEFINITION_WRITE_ROLES } from "../constants";
 import { defineOrResurrectFieldDefinition } from "../lib/define-or-resurrect";
 import { buildFieldDefinitionColumns } from "../lib/field-definition-row";
 import { countTenantFieldDefinitions } from "../lib/quota";
@@ -37,6 +38,11 @@ import { type DefineFieldPayload, defineFieldPayloadSchema } from "../schemas";
 export interface DefineTenantFieldOptions {
   /** Soft cap — `>= limit` definitions per tenant rejects further defines (see header: concurrent defines may overshoot). */
   readonly fieldDefinitionLimitPerTenant?: number;
+  /** Access roles for this handler. Default ["TenantAdmin"] (#2296) — apps with
+   *  their own role vocabulary pass this via createCustomFieldsFeature({
+   *  fieldDefinitionWriteRoles }), which threads the same roles into
+   *  update-/delete-tenant-field too (the definition-CRUD triad shares one gate). */
+  readonly roles?: readonly string[];
 }
 
 export function createDefineTenantFieldHandler(
@@ -46,7 +52,7 @@ export function createDefineTenantFieldHandler(
   return {
     name: "define-tenant-field",
     schema: defineFieldPayloadSchema,
-    access: { roles: ["TenantAdmin"] },
+    access: { roles: opts.roles ?? DEFAULT_FIELD_DEFINITION_WRITE_ROLES },
     handler: async (event, ctx) => {
       const payload = event.payload as DefineFieldPayload; // @cast-boundary engine-payload
       const tenantId = event.user.tenantId;

package/src/custom-fields/handlers/delete-tenant-field.write.ts

@@ -1,6 +1,9 @@
 import { isSystemTenant, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
-import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants";
+import {
+  DEFAULT_FIELD_DEFINITION_WRITE_ROLES,
+  FIELD_DEFINITION_AGGREGATE_TYPE,
+} from "../constants";
 import { fieldDefinitionExecutor } from "../executor";
 import { customFieldsFeature } from "../feature";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas";
@@ -15,36 +18,54 @@ import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas";
 // **Idempotency:** Delete auf nicht-existente Definition → version_conflict
 // (executor.delete returns failure, dispatcher 404/422). Caller sieht "not
 // found" — kein Crash.
-export const deleteTenantFieldHandler: WriteHandlerDef = {
-  name: "delete-tenant-field",
-  schema: deleteFieldPayloadSchema,
-  access: { roles: ["TenantAdmin"] },
-  handler: async (event, ctx) => {
-    const payload = event.payload as DeleteFieldPayload; // @cast-boundary engine-payload
-    const tenantId = event.user.tenantId;
-
-    if (isSystemTenant(tenantId)) {
-      throw new Error(
-        "delete-tenant-field: tenantId is SYSTEM_TENANT_ID — use delete-system-field for system-scope deletions",
+export interface DeleteTenantFieldOptions {
+  /** Access roles for this handler. Default ["TenantAdmin"] (#2296) — see
+   *  DefineTenantFieldOptions.roles, the definition-CRUD triad shares one gate. */
+  readonly roles?: readonly string[];
+}
+
+export function createDeleteTenantFieldHandler(
+  opts: DeleteTenantFieldOptions = {},
+): WriteHandlerDef {
+  return {
+    name: "delete-tenant-field",
+    schema: deleteFieldPayloadSchema,
+    access: { roles: opts.roles ?? DEFAULT_FIELD_DEFINITION_WRITE_ROLES },
+    handler: async (event, ctx) => {
+      const payload = event.payload as DeleteFieldPayload; // @cast-boundary engine-payload
+      const tenantId = event.user.tenantId;
+
+      if (isSystemTenant(tenantId)) {
+        throw new Error(
+          "delete-tenant-field: tenantId is SYSTEM_TENANT_ID — use delete-system-field for system-scope deletions",
+        );
+      }
+
+      const aggregateId = fieldDefinitionAggregateId(
+        tenantId,
+        payload.entityName,
+        payload.fieldKey,
       );
-    }
-
-    const aggregateId = fieldDefinitionAggregateId(tenantId, payload.entityName, payload.fieldKey);
-
-    const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, event.user, ctx.db);
-
-    // Emit cascade-cleanup-Event NACH erfolgreichem Delete. host-entity-MSPs
-    // (registriert via wireCustomFieldsFor) konsumieren das + entfernen orphan
-    // values aus ihrer customFields jsonb. Im selben TX = atomic cleanup.
-    if (result.isSuccess) {
-      await ctx.unsafeAppendEvent({
-        aggregateId,
-        aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
-        type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
-        payload: { entityName: payload.entityName, fieldKey: payload.fieldKey, tenantId },
-      });
-    }
-
-    return result;
-  },
-};
+
+      const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, event.user, ctx.db);
+
+      // Emit cascade-cleanup-Event NACH erfolgreichem Delete. host-entity-MSPs
+      // (registriert via wireCustomFieldsFor) konsumieren das + entfernen orphan
+      // values aus ihrer customFields jsonb. Im selben TX = atomic cleanup.
+      if (result.isSuccess) {
+        await ctx.unsafeAppendEvent({
+          aggregateId,
+          aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
+          type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
+          payload: { entityName: payload.entityName, fieldKey: payload.fieldKey, tenantId },
+        });
+      }
+
+      return result;
+    },
+  };
+}
+
+// Backwards-compat: existing imports of `deleteTenantFieldHandler` keep
+// working — identical to createDeleteTenantFieldHandler() with default roles.
+export const deleteTenantFieldHandler: WriteHandlerDef = createDeleteTenantFieldHandler();

package/src/custom-fields/handlers/update-tenant-field.write.ts

@@ -1,6 +1,7 @@
 import { isSystemTenant, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
+import { DEFAULT_FIELD_DEFINITION_WRITE_ROLES } from "../constants";
 import { fieldDefinitionExecutor } from "../executor";
 import { buildFieldDefinitionColumns } from "../lib/field-definition-row";
 import { type UpdateFieldPayload, updateFieldPayloadSchema } from "../schemas";
@@ -29,45 +30,67 @@ import { type UpdateFieldPayload, updateFieldPayloadSchema } from "../schemas";
 // **skipOptimisticLock:** Definition-Edits sind admin-only + low-frequency
 // (gleiche Abwägung wie der Quota-soft-cap in define). Last-write-wins
 // statt version-Roundtrip durch den Edit-Screen.
-export const updateTenantFieldHandler: WriteHandlerDef = {
-  name: "update-tenant-field",
-  schema: updateFieldPayloadSchema,
-  access: { roles: ["TenantAdmin"] },
-  handler: async (event, ctx) => {
-    const payload = event.payload as UpdateFieldPayload; // @cast-boundary engine-payload
-    const tenantId = event.user.tenantId;
+export interface UpdateTenantFieldOptions {
+  /** Access roles for this handler. Default ["TenantAdmin"] (#2296) — see
+   *  DefineTenantFieldOptions.roles, the definition-CRUD triad shares one gate. */
+  readonly roles?: readonly string[];
+}
 
-    if (isSystemTenant(tenantId)) {
-      throw new Error(
-        "update-tenant-field: tenantId is SYSTEM_TENANT_ID — system-scope definitions have no update handler (delete + re-define via the system-field handlers)",
+export function createUpdateTenantFieldHandler(
+  opts: UpdateTenantFieldOptions = {},
+): WriteHandlerDef {
+  return {
+    name: "update-tenant-field",
+    schema: updateFieldPayloadSchema,
+    access: { roles: opts.roles ?? DEFAULT_FIELD_DEFINITION_WRITE_ROLES },
+    handler: async (event, ctx) => {
+      const payload = event.payload as UpdateFieldPayload; // @cast-boundary engine-payload
+      const tenantId = event.user.tenantId;
+
+      if (isSystemTenant(tenantId)) {
+        throw new Error(
+          "update-tenant-field: tenantId is SYSTEM_TENANT_ID — system-scope definitions have no update handler (delete + re-define via the system-field handlers)",
+        );
+      }
+
+      const aggregateId = fieldDefinitionAggregateId(
+        tenantId,
+        payload.entityName,
+        payload.fieldKey,
       );
-    }
 
-    const aggregateId = fieldDefinitionAggregateId(tenantId, payload.entityName, payload.fieldKey);
+      const existing = await fieldDefinitionExecutor.detail(
+        { id: aggregateId },
+        event.user,
+        ctx.db,
+      );
+      if (!existing) {
+        return failNotFound("field-definition", aggregateId);
+      }
 
-    const existing = await fieldDefinitionExecutor.detail({ id: aggregateId }, event.user, ctx.db);
-    if (!existing) {
-      return failNotFound("field-definition", aggregateId);
-    }
+      if (existing["type"] !== payload.serializedField.type) {
+        return failUnprocessable("field_type_immutable", {
+          entityName: payload.entityName,
+          fieldKey: payload.fieldKey,
+          currentType: existing["type"],
+          requestedType: payload.serializedField.type,
+        });
+      }
 
-    if (existing["type"] !== payload.serializedField.type) {
-      return failUnprocessable("field_type_immutable", {
-        entityName: payload.entityName,
-        fieldKey: payload.fieldKey,
-        currentType: existing["type"],
-        requestedType: payload.serializedField.type,
-      });
-    }
+      // entityName/fieldKey sind die Identität — nicht Teil der changes.
+      const {
+        entityName: _entityName,
+        fieldKey: _fieldKey,
+        ...changes
+      } = buildFieldDefinitionColumns(payload);
 
-    // entityName/fieldKey sind die Identität — nicht Teil der changes.
-    const {
-      entityName: _entityName,
-      fieldKey: _fieldKey,
-      ...changes
-    } = buildFieldDefinitionColumns(payload);
+      return fieldDefinitionExecutor.update({ id: aggregateId, changes }, event.user, ctx.db, {
+        skipOptimisticLock: true,
+      });
+    },
+  };
+}
 
-    return fieldDefinitionExecutor.update({ id: aggregateId, changes }, event.user, ctx.db, {
-      skipOptimisticLock: true,
-    });
-  },
-};
+// Backwards-compat: existing imports of `updateTenantFieldHandler` keep
+// working — identical to createUpdateTenantFieldHandler() with default roles.
+export const updateTenantFieldHandler: WriteHandlerDef = createUpdateTenantFieldHandler();

package/src/delivery/feature.ts

@@ -163,9 +163,7 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
     r.nav({
       id: "delivery-log",
       label: "delivery:nav.deliveryLog",
-      // "send" isn't in the closed NavIconKey vocabulary (packages/types/src/
-      // nav-icon.ts) — "bell" matches the feature's own notifications framing.
-      icon: "bell",
+      icon: "send",
       screen: "delivery:screen:delivery-log",
       order: 40,
     });

package/src/feature-toggles/feature.ts

@@ -67,6 +67,7 @@ export function createFeatureTogglesFeature(
       registered: r.queryHandler(registeredQuery),
     };
 
+    // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312
     r.screen({
       id: TOGGLE_ADMIN_SCREEN_ID,
       type: "custom",

package/src/feature-toggles/web/toggle-admin-screen.tsx

@@ -38,6 +38,7 @@ export function ToggleAdminScreen(): ReactNode {
     setState({ kind: "ready", items: res.data.items });
   }, [dispatcher]);
 
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
   useEffect(() => {
     void load();
   }, [load]);