@cosmicdrift/kumiko-bundled-features 0.211.0 → 0.213.0

package/src/auth-email-password/web/signup-complete-screen.tsx

@@ -1,19 +1,19 @@
 // @runtime client
 // SignupCompleteScreen — Magic-Link-Self-Signup, Step 2.
 //
-// Liest `?token=...` aus der URL, zeigt Form mit Password + Confirm.
-// Submit triggert /api/auth/signup-confirm — bei Erfolg setzt der
-// Server JWT + Cookies (Auto-Login!) und liefert tenantKey für den
-// Post-Signup-Redirect.
+// Reads `?token=...` from the URL, shows a form with password + confirm.
+// Submit posts to /api/auth/signup-confirm — on success the server sets
+// JWT + cookies (auto-login!) and returns the tenantKey.
 //
-// Token-Quelle ist read-once via useUrlToken: liest `?token=...` beim
-// Mount und scrubbt den Param danach aus der URL (#774). Apps die einen
-// server-injected Token nutzen, reichen `token` als Prop durch.
+// Token source is read-once via useUrlToken: reads `?token=...` on mount
+// and scrubs the param from the URL afterwards (#774). Apps that inject a
+// server-side token pass `token` as a prop instead.
 //
-// Nach success: redirect via window.location.assign zu loggedInHref.
-// Default-Pattern ist "/<tenantKey>/" — die App reicht ein Template
-// rein. Default-Template "/" wäre auch valide (App hat dann eigene
-// Routing-Logik die den eingeloggten User zur richtigen Page schickt).
+// On success: shows a confirmation (account active, signed in) with a
+// button to loggedInHref, instead of navigating away immediately — the
+// server already logged the user in via cookies, but a silent redirect
+// leaves no signal that activation worked. Default pattern is "/" — apps
+// with multi-tenant routing pass `(data) => "/" + data.tenantKey + "/"`.
 
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
@@ -50,6 +50,7 @@ export function SignupCompleteScreen({
   const [confirmPassword, setConfirmPassword] = useState("");
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  const [continueHref, setContinueHref] = useState<string | null>(null);
 
   const doSubmit = async (): Promise<void> => {
     setError(null);
@@ -66,9 +67,10 @@ export function SignupCompleteScreen({
     const res = await confirmSignup(token, password);
     setSubmitting(false);
     if (res.ok) {
-      // Auto-Login: Cookies sind via Set-Cookie schon im Browser. Wir
-      // schicken den User direkt zur eingeloggten Page.
-      window.location.assign(resolveLoggedInHref(loggedInHref, res.data.tenantKey));
+      // Cookies are already set (auto-login). Show a confirmation with an
+      // explicit continue button instead of navigating away silently —
+      // the user otherwise gets no signal that activation worked.
+      setContinueHref(resolveLoggedInHref(loggedInHref, res.data.tenantKey));
       return;
     }
     if (res.error.reason === "invalid_signup_token") {
@@ -104,6 +106,19 @@ export function SignupCompleteScreen({
     );
   }
 
+  if (continueHref !== null) {
+    return (
+      <AuthCard title={effectiveTitle}>
+        <div className="p-6 pt-0 flex flex-col gap-4">
+          <p className="text-sm text-muted-foreground">{t("auth.signupComplete.activated")}</p>
+          <Link href={continueHref} variant="button">
+            {t("auth.signupComplete.continue")}
+          </Link>
+        </div>
+      </AuthCard>
+    );
+  }
+
   return (
     <AuthCard title={effectiveTitle}>
       <div className="p-6 pt-0 flex flex-col gap-4">

package/src/auth-email-password/web/verify-email-screen.tsx

@@ -36,6 +36,7 @@ export function VerifyEmailScreen({
   const [status, setStatus] = useState<Status>(token === "" ? "missing-token" : "verifying");
   const startedRef = useRef(false);
 
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
   useEffect(() => {
     if (status !== "verifying") return;
     if (startedRef.current) return;

package/src/auth-mfa/feature.ts

@@ -130,6 +130,7 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
     // convention). App places it via r.nav in its logged-in settings area.
     // dormant: true skips createKumikoApp's missing-client-plugin boot
     // diagnostic (#2025) for apps that don't nav this screen (#2034).
+    // kumiko-lint-ignore app-feature-structure Multi-step auth flow (enable + recovery-codes reveal), no declarative screen type covers this
     r.screen({
       id: MFA_ENABLE_SCREEN_ID,
       type: "custom",

package/src/auth-mfa/web/mfa-disable-dialog.tsx

@@ -21,6 +21,7 @@ export type MfaDisableDialogProps = {
   readonly onError: (i18nKey: string) => void;
 };
 
+// kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaDisableDialog({
   open,
   onOpenChange,

package/src/auth-mfa/web/mfa-regenerate-recovery-dialog.tsx

@@ -18,6 +18,7 @@ export type MfaRegenerateRecoveryDialogProps = {
   readonly onError: (i18nKey: string) => void;
 };
 
+// kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaRegenerateRecoveryDialog({
   open,
   onOpenChange,

package/src/compliance-profiles/feature.ts

@@ -103,11 +103,7 @@ export function createComplianceProfilesFeature(
       id: "profile-picker",
       label: "compliance-profiles:nav.profilePicker",
       screen: "compliance-profiles:screen:profile-picker",
-      // "shield-check" (spec suggestion, fw#2222) isn't in NavIconKey's closed
-      // vocabulary (packages/types/src/nav-icon.ts) — adding it needs a
-      // matching lucide-react entry in renderer-web's NAV_ICONS map too, both
-      // outside this feature. "shield" is the closest already-registered key.
-      icon: "shield",
+      icon: "shield-check",
       order: 50,
     });
 

package/src/config/db/queries/__tests__/resolver.test.ts

@@ -0,0 +1,64 @@
+// #1163: config:query:readiness read config rows via asRawClient(db).unsafe()
+// directly, bypassing the #1358 closed-connection retry that only covered
+// bun-db/query.ts's own selectMany/countWhere. Routed through the exported
+// unsafeReadRetrying helper instead — this test mirrors
+// bun-db/__tests__/select-many-retry.test.ts's fake-client pattern to prove
+// the retry now actually fires for this call site.
+
+import { describe, expect, test } from "bun:test";
+import { selectConfigRowsForKeys, selectConfigRowsForScope } from "../resolver";
+
+function closedConnectionError(): Error {
+  return Object.assign(new Error("The connection was closed."), { name: "AbortError" });
+}
+
+type FakeClient = {
+  unsafe: (sql: string, params?: readonly unknown[]) => Promise<readonly unknown[]>;
+  begin: () => never;
+  calls: number;
+};
+
+function fakeClient(failures: Error[]): FakeClient {
+  const remaining = [...failures];
+  const client: FakeClient = {
+    calls: 0,
+    unsafe: async () => {
+      client.calls++;
+      const err = remaining.shift();
+      if (err) throw err;
+      return [{ id: "r1", key: "k", value: "v", tenantId: "t1", userId: null }];
+    },
+    // Top-level pool client — matches what dispatch-query.ts hands buildHandlerContext
+    // for a standalone query.execute() call (no tx passed, resolveDbSource falls back
+    // to the pool connection, which has .begin()).
+    begin: () => {
+      throw new Error("not used in test");
+    },
+  };
+  return client;
+}
+
+describe("config db/queries/resolver — closed-connection retry (#1163)", () => {
+  test("selectConfigRowsForScope retries once and returns rows", async () => {
+    const db = fakeClient([closedConnectionError()]);
+    const rows = await selectConfigRowsForScope(db as never, "system", "t1", "u1");
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.key).toBe("k");
+    expect(db.calls).toBe(2);
+  });
+
+  test("selectConfigRowsForKeys retries once and returns rows", async () => {
+    const db = fakeClient([closedConnectionError()]);
+    const rows = await selectConfigRowsForKeys(db as never, ["k"], "system", "t1", "u1");
+    expect(rows).toHaveLength(1);
+    expect(db.calls).toBe(2);
+  });
+
+  test("gives up after the single retry when the connection stays closed", async () => {
+    const db = fakeClient([closedConnectionError(), closedConnectionError()]);
+    await expect(selectConfigRowsForScope(db as never, "system", "t1", "u1")).rejects.toThrow(
+      "connection was closed",
+    );
+    expect(db.calls).toBe(2);
+  });
+});

package/src/config/db/queries/resolver.ts

@@ -1,4 +1,4 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 
@@ -16,7 +16,8 @@ export async function selectConfigRowsForScope(
   tenantId: TenantId,
   userId: string,
 ): Promise<readonly ConfigRow[]> {
-  return asRawClient(db).unsafe<ConfigRow>(
+  return unsafeReadRetrying<ConfigRow>(
+    db,
     `SELECT id, key, value, tenant_id AS "tenantId", user_id AS "userId"
      FROM read_config_values
      WHERE (tenant_id = $1 AND user_id IS NULL)
@@ -33,7 +34,8 @@ export async function selectConfigRowsForKeys(
   tenantId: TenantId,
   userId: string,
 ): Promise<readonly ConfigRow[]> {
-  return asRawClient(db).unsafe<ConfigRow>(
+  return unsafeReadRetrying<ConfigRow>(
+    db,
     `SELECT id, key, value, tenant_id AS "tenantId", user_id AS "userId"
      FROM read_config_values
      WHERE key = ANY($1)

package/src/crypto-shredding/changes.json

@@ -16,7 +16,8 @@
     "type": "breaking",
     "title": "Test-only reset helpers moved from /crypto to /testing (fw#1631).",
     "detail": "resetPiiSubjectKmsForTests and resetBlindIndexKeyForTests are no longer exported by the production barrels. The functions did not change — only the export path. Why it matters beyond tidiness: resetPiiSubjectKmsForTests clears the injected KMS, after which encryptForStorage sees no adapter and writes subject-annotated fields in plaintext, with no error and no log. Reachable from a production barrel, that is one stray import away from silent plaintext PII.",
-    "migration": "Change the import in your test files: `import { resetPiiSubjectKmsForTests } from \"@cosmicdrift/kumiko-framework/testing\"` instead of `.../crypto`. Type-check catches every occurrence; nothing else changes. Apps mounting crypto-shredding typically hit this in every test that configures an InMemoryKmsAdapter."
+    "migration": "Change the import in your test files: `import { resetPiiSubjectKmsForTests } from \"@cosmicdrift/kumiko-framework/testing\"` instead of `.../crypto`. Type-check catches every occurrence; nothing else changes. Apps mounting crypto-shredding typically hit this in every test that configures an InMemoryKmsAdapter.",
+    "codemod": "scripts/codemod/crypto-shredding-testing-move.ts"
   },
   {
     "version": "0.165.3",

package/src/custom-fields/__tests__/feature.test.ts

@@ -189,6 +189,33 @@ describe("createCustomFieldsFeature access-options", () => {
     });
     expect(listAccess(feature)).toEqual(["Viewer"]);
   });
+
+  // #2296 — define-/update-/delete-tenant-field were hard-wired to
+  // ["TenantAdmin"] with no override; fieldDefinitionWriteRoles closes that gap.
+  test("fieldDefinitionWriteRoles überschreibt define-, update- UND delete-tenant-field", () => {
+    const feature = createCustomFieldsFeature({ fieldDefinitionWriteRoles: ["Admin", "Editor"] });
+    expect(writeAccess(feature, "define-tenant-field")).toEqual(["Admin", "Editor"]);
+    expect(writeAccess(feature, "update-tenant-field")).toEqual(["Admin", "Editor"]);
+    expect(writeAccess(feature, "delete-tenant-field")).toEqual(["Admin", "Editor"]);
+    // System-scope stays hard-wired — a different trust boundary that must not
+    // become reachable through a tenant role vocabulary.
+    expect(writeAccess(feature, "define-system-field")).toEqual(["SystemAdmin"]);
+    expect(writeAccess(feature, "delete-system-field")).toEqual(["SystemAdmin"]);
+  });
+
+  test("fieldDefinitionWriteRoles feeds into the list-default (a definer can load what they defined)", () => {
+    const feature = createCustomFieldsFeature({ fieldDefinitionWriteRoles: ["Admin", "Editor"] });
+    const roles = listAccess(feature);
+    expect(roles).toContain("Admin");
+    expect(roles).toContain("Editor");
+    expect(roles).toContain("TenantAdmin");
+  });
+
+  test("fieldDefinitionWriteRoles and valueWriteRoles are independent — setting one leaves the other's default", () => {
+    const feature = createCustomFieldsFeature({ fieldDefinitionWriteRoles: ["Admin"] });
+    expect(writeAccess(feature, "set-custom-field")).toEqual(["TenantAdmin", "TenantMember"]);
+    expect(writeAccess(feature, "clear-custom-field")).toEqual(["TenantAdmin", "TenantMember"]);
+  });
 });
 
 describe("resolveFieldDefinitionListRoles", () => {
@@ -216,4 +243,19 @@ describe("resolveFieldDefinitionListRoles", () => {
       }),
     ).toEqual(["Viewer"]);
   });
+
+  test("fieldDefinitionWriteRoles gesetzt, list ungesetzt → Union mit Default, dedupliziert", () => {
+    expect(
+      resolveFieldDefinitionListRoles({ fieldDefinitionWriteRoles: ["Admin", "Editor"] }),
+    ).toEqual(["Admin", "Editor", "TenantAdmin"]);
+  });
+
+  test("valueWriteRoles UND fieldDefinitionWriteRoles gesetzt → Union aus beiden plus Default", () => {
+    expect(
+      resolveFieldDefinitionListRoles({
+        valueWriteRoles: ["Member"],
+        fieldDefinitionWriteRoles: ["Admin"],
+      }),
+    ).toEqual(["Member", "Admin", "TenantAdmin"]);
+  });
 });

package/src/custom-fields/__tests__/field-definition-role-config.integration.test.ts

@@ -0,0 +1,139 @@
+// #2296 — role-configurability of the definition-CRUD triad (define-/update-/
+// delete-tenant-field), which was hard-wired to ["TenantAdmin"] with no override.
+// Verifies createCustomFieldsFeature({ fieldDefinitionWriteRoles }) actually
+// gates all three handlers with the configured roles (not just define), that the
+// default-role user loses access once the override is set (Role-Naming-Drift is
+// real, not just documented), and that a definer without an explicit
+// fieldDefinitionListRoles override can still list what they defined.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { fieldDefinitionEntity } from "../entity";
+import { createCustomFieldsFeature } from "../feature";
+
+const admin = createTestUser({ roles: ["TenantAdmin"] });
+const customRoleUser = createTestUser({ roles: ["Admin"] });
+
+function defPayload(fieldKey: string) {
+  return {
+    entityName: "customer",
+    fieldKey,
+    serializedField: { type: "text" },
+    required: false,
+    searchable: false,
+    displayOrder: 0,
+  };
+}
+
+describe("custom-fields — fieldDefinitionWriteRoles (#2296)", () => {
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    stack = await setupTestStack({
+      features: [createCustomFieldsFeature({ fieldDefinitionWriteRoles: ["Admin"] })],
+    });
+    await unsafeCreateEntityTable(stack.db, fieldDefinitionEntity);
+    await createEventsTable(stack.db);
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await asRawClient(stack.db).unsafe("DELETE FROM kumiko_events");
+    await asRawClient(stack.db).unsafe("DELETE FROM read_custom_field_definitions");
+  });
+
+  test("a custom-role user can define, update and delete a tenant field definition", async () => {
+    await stack.http.writeOk(
+      "custom-fields:write:define-tenant-field",
+      defPayload("vip"),
+      customRoleUser,
+    );
+    const afterDefine = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
+      "custom-fields:query:field-definition:list",
+      {},
+      customRoleUser,
+    );
+    const defined = afterDefine.rows.find((r) => r["fieldKey"] === "vip");
+    expect(defined).toBeDefined();
+    expect(defined?.["searchable"]).toBe(false);
+
+    await stack.http.writeOk(
+      "custom-fields:write:update-tenant-field",
+      { ...defPayload("vip"), searchable: true },
+      customRoleUser,
+    );
+    const afterUpdate = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
+      "custom-fields:query:field-definition:list",
+      {},
+      customRoleUser,
+    );
+    const updated = afterUpdate.rows.find((r) => r["fieldKey"] === "vip");
+    expect(updated?.["searchable"]).toBe(true);
+
+    await stack.http.writeOk(
+      "custom-fields:write:delete-tenant-field",
+      { entityName: "customer", fieldKey: "vip" },
+      customRoleUser,
+    );
+    const afterDelete = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
+      "custom-fields:query:field-definition:list",
+      {},
+      customRoleUser,
+    );
+    expect(afterDelete.rows.some((r) => r["fieldKey"] === "vip")).toBe(false);
+  });
+
+  test("the default TenantAdmin role is denied on all three once fieldDefinitionWriteRoles overrides it", async () => {
+    const defineDenied = await stack.http.writeErr(
+      "custom-fields:write:define-tenant-field",
+      defPayload("vip2"),
+      admin,
+    );
+    expect(defineDenied.httpStatus).toBe(403);
+
+    await stack.http.writeOk(
+      "custom-fields:write:define-tenant-field",
+      defPayload("vip2"),
+      customRoleUser,
+    );
+
+    const updateDenied = await stack.http.writeErr(
+      "custom-fields:write:update-tenant-field",
+      { ...defPayload("vip2"), searchable: true },
+      admin,
+    );
+    expect(updateDenied.httpStatus).toBe(403);
+
+    const deleteDenied = await stack.http.writeErr(
+      "custom-fields:write:delete-tenant-field",
+      { entityName: "customer", fieldKey: "vip2" },
+      admin,
+    );
+    expect(deleteDenied.httpStatus).toBe(403);
+  });
+
+  test("a definer without an explicit fieldDefinitionListRoles override can list their own definitions", async () => {
+    await stack.http.writeOk(
+      "custom-fields:write:define-tenant-field",
+      defPayload("vip3"),
+      customRoleUser,
+    );
+
+    const list = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
+      "custom-fields:query:field-definition:list",
+      {},
+      customRoleUser,
+    );
+    expect(list.rows.some((r) => r["fieldKey"] === "vip3")).toBe(true);
+  });
+});

package/src/custom-fields/constants.ts

@@ -59,6 +59,12 @@ export const CUSTOM_FIELDS_EXTENSION = "customFields";
 // für jeden App-User access_denied.
 export const DEFAULT_VALUE_WRITE_ROLES = ["TenantAdmin", "TenantMember"] as const;
 export const DEFAULT_FIELD_DEFINITION_LIST_ROLES = ["TenantAdmin"] as const;
+// Default-RBAC of the definition-CRUD triad (define-/update-/delete-tenant-field,
+// #2296). Apps with their own role vocabulary override via
+// createCustomFieldsFeature({ fieldDefinitionWriteRoles }) — otherwise those three
+// hard-wired handler QNs are access_denied for every app-user without a
+// "TenantAdmin" role (same Role-Naming-Drift as DEFAULT_VALUE_WRITE_ROLES above).
+export const DEFAULT_FIELD_DEFINITION_WRITE_ROLES = ["TenantAdmin"] as const;
 
 // Field-type union — identisch zu Stammfeld-Field-Type-System (Spec Z.59-73:
 // `Identisch zu Entity-Feld-Typen`). Builder-Reuse-Promise: was `r.field.X()`

package/src/custom-fields/feature.ts

@@ -73,12 +73,18 @@ import {
   defineTenantFieldHandler,
 } from "./handlers/define-tenant-field.write";
 import { deleteSystemFieldHandler } from "./handlers/delete-system-field.write";
-import { deleteTenantFieldHandler } from "./handlers/delete-tenant-field.write";
+import {
+  createDeleteTenantFieldHandler,
+  deleteTenantFieldHandler,
+} from "./handlers/delete-tenant-field.write";
 import {
   createSetCustomFieldHandler,
   setCustomFieldHandler,
 } from "./handlers/set-custom-field.write";
-import { updateTenantFieldHandler } from "./handlers/update-tenant-field.write";
+import {
+  createUpdateTenantFieldHandler,
+  updateTenantFieldHandler,
+} from "./handlers/update-tenant-field.write";
 
 const fieldDefinitionDeletedSchema = z.object({
   entityName: z.string(),
@@ -97,6 +103,8 @@ const fieldDefinitionDeletedSchema = z.object({
 // Options-Variante verfehlt.
 type RegisterVariant = {
   readonly defineTenantHandler: WriteHandlerDef;
+  readonly updateTenantHandler: WriteHandlerDef;
+  readonly deleteTenantHandler: WriteHandlerDef;
   readonly setHandler: WriteHandlerDef;
   readonly clearHandler: WriteHandlerDef;
   readonly fieldDefinitionListRoles: readonly string[];
@@ -141,8 +149,8 @@ function registerCustomFields(
   // Definition-CRUD handlers (B1; update kam mit Bug-Bash D2 2026-06-08).
   r.writeHandler(variant.defineTenantHandler);
   r.writeHandler(defineSystemFieldHandler);
-  r.writeHandler(updateTenantFieldHandler);
-  r.writeHandler(deleteTenantFieldHandler);
+  r.writeHandler(variant.updateTenantHandler);
+  r.writeHandler(variant.deleteTenantHandler);
   r.writeHandler(deleteSystemFieldHandler);
 
   // Value-write handlers (B2). Emittieren events auf host-aggregate-stream.
@@ -169,6 +177,8 @@ function registerCustomFields(
 export const customFieldsFeature = defineFeature(CUSTOM_FIELDS_FEATURE_NAME, (r) =>
   registerCustomFields(r, {
     defineTenantHandler: defineTenantFieldHandler,
+    updateTenantHandler: updateTenantFieldHandler,
+    deleteTenantHandler: deleteTenantFieldHandler,
     setHandler: setCustomFieldHandler,
     clearHandler: clearCustomFieldHandler,
     fieldDefinitionListRoles: DEFAULT_FIELD_DEFINITION_LIST_ROLES,
@@ -191,14 +201,37 @@ export type CustomFieldsFeatureOptions = {
    *  FormSection für Value-Writer nie (access_denied), während der Save-Pfad
    *  offen wäre (asymmetrischer Bruch). */
   readonly fieldDefinitionListRoles?: readonly string[];
+  /** Access roles for the definition-CRUD triad (`define-tenant-field`,
+   *  `update-tenant-field`, `delete-tenant-field`) — hard-wired to ["TenantAdmin"]
+   *  before #2296. Apps with their own role vocabulary (e.g. ["Admin","Editor"])
+   *  MUST set this, else field-definition management is access_denied for every
+   *  app-user without a "TenantAdmin" role. Only covers the tenant-scope triad —
+   *  define-/delete-system-field stay hard-wired to ["TenantAdmin"], since
+   *  system-scope is a separate trust boundary that must not become reachable
+   *  through a tenant role vocabulary. Also feeds into
+   *  resolveFieldDefinitionListRoles (below) so a definer without an explicit
+   *  fieldDefinitionListRoles override can still load the definitions they can
+   *  write — mirrors the valueWriteRoles → list-default inheritance. */
+  readonly fieldDefinitionWriteRoles?: readonly string[];
 };
 
 export function resolveFieldDefinitionListRoles(
-  opts: Pick<CustomFieldsFeatureOptions, "valueWriteRoles" | "fieldDefinitionListRoles">,
+  opts: Pick<
+    CustomFieldsFeatureOptions,
+    "valueWriteRoles" | "fieldDefinitionListRoles" | "fieldDefinitionWriteRoles"
+  >,
 ): readonly string[] {
   if (opts.fieldDefinitionListRoles !== undefined) return opts.fieldDefinitionListRoles;
-  if (opts.valueWriteRoles === undefined) return DEFAULT_FIELD_DEFINITION_LIST_ROLES;
-  return [...new Set([...opts.valueWriteRoles, ...DEFAULT_FIELD_DEFINITION_LIST_ROLES])];
+  if (opts.valueWriteRoles === undefined && opts.fieldDefinitionWriteRoles === undefined) {
+    return DEFAULT_FIELD_DEFINITION_LIST_ROLES;
+  }
+  return [
+    ...new Set([
+      ...(opts.valueWriteRoles ?? []),
+      ...(opts.fieldDefinitionWriteRoles ?? []),
+      ...DEFAULT_FIELD_DEFINITION_LIST_ROLES,
+    ]),
+  ];
 }
 
 // Backwards-compat-wrapper. Bestehende Caller (z.B. integration-tests,
@@ -212,17 +245,30 @@ export function createCustomFieldsFeature(
   const hasOptions =
     opts.fieldDefinitionLimitPerTenant !== undefined ||
     opts.valueWriteRoles !== undefined ||
-    opts.fieldDefinitionListRoles !== undefined;
+    opts.fieldDefinitionListRoles !== undefined ||
+    opts.fieldDefinitionWriteRoles !== undefined;
   if (!hasOptions) {
     return customFieldsFeature;
   }
   const limit = opts.fieldDefinitionLimitPerTenant;
+  const definitionWriteRoles = opts.fieldDefinitionWriteRoles;
   return defineFeature(CUSTOM_FIELDS_FEATURE_NAME, (r) =>
     registerCustomFields(r, {
       defineTenantHandler:
-        limit !== undefined
-          ? createDefineTenantFieldHandler({ fieldDefinitionLimitPerTenant: limit })
+        limit !== undefined || definitionWriteRoles !== undefined
+          ? createDefineTenantFieldHandler({
+              fieldDefinitionLimitPerTenant: limit,
+              roles: definitionWriteRoles,
+            })
           : defineTenantFieldHandler,
+      updateTenantHandler:
+        definitionWriteRoles !== undefined
+          ? createUpdateTenantFieldHandler({ roles: definitionWriteRoles })
+          : updateTenantFieldHandler,
+      deleteTenantHandler:
+        definitionWriteRoles !== undefined
+          ? createDeleteTenantFieldHandler({ roles: definitionWriteRoles })
+          : deleteTenantFieldHandler,
       setHandler: createSetCustomFieldHandler(opts.valueWriteRoles),
       clearHandler: createClearCustomFieldHandler(opts.valueWriteRoles),
       fieldDefinitionListRoles: resolveFieldDefinitionListRoles(opts),

package/src/custom-fields/handlers/define-tenant-field.write.ts

@@ -1,6 +1,7 @@
 import { isSystemTenant, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
+import { DEFAULT_FIELD_DEFINITION_WRITE_ROLES } from "../constants";
 import { defineOrResurrectFieldDefinition } from "../lib/define-or-resurrect";
 import { buildFieldDefinitionColumns } from "../lib/field-definition-row";
 import { countTenantFieldDefinitions } from "../lib/quota";
@@ -37,6 +38,11 @@ import { type DefineFieldPayload, defineFieldPayloadSchema } from "../schemas";
 export interface DefineTenantFieldOptions {
   /** Soft cap — `>= limit` definitions per tenant rejects further defines (see header: concurrent defines may overshoot). */
   readonly fieldDefinitionLimitPerTenant?: number;
+  /** Access roles for this handler. Default ["TenantAdmin"] (#2296) — apps with
+   *  their own role vocabulary pass this via createCustomFieldsFeature({
+   *  fieldDefinitionWriteRoles }), which threads the same roles into
+   *  update-/delete-tenant-field too (the definition-CRUD triad shares one gate). */
+  readonly roles?: readonly string[];
 }
 
 export function createDefineTenantFieldHandler(
@@ -46,7 +52,7 @@ export function createDefineTenantFieldHandler(
   return {
     name: "define-tenant-field",
     schema: defineFieldPayloadSchema,
-    access: { roles: ["TenantAdmin"] },
+    access: { roles: opts.roles ?? DEFAULT_FIELD_DEFINITION_WRITE_ROLES },
     handler: async (event, ctx) => {
       const payload = event.payload as DefineFieldPayload; // @cast-boundary engine-payload
       const tenantId = event.user.tenantId;