@cosmicdrift/kumiko-bundled-features 0.244.0 → 0.246.0

package/src/notes-history/__tests__/notes-history.integration.test.ts

@@ -9,9 +9,17 @@
 //   - read-layer composition: list filtered on entityId
 //   - multi-tenant isolation
 //   - append-only: only add-note and list are registered handlers
+//
+// fw#2627 made add-note's parent-visibility check unconditional: entityType
+// must name a registered entity, and the row must be visible to the caller.
+// A minimal `contact` fixture entity (PASS_CLAUSE, no `access`) is mounted
+// below and seeded with one row per id this file writes a note to — this
+// file's own assertions are about note-entry behavior, not about parent
+// ownership, so the fixture stays unrestricted on purpose.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -25,12 +33,57 @@ import { createNotesHistoryFeature } from "../feature";
 
 const notesHistoryFeature = createNotesHistoryFeature();
 
+const CONTACT_TABLE = "notes_history_test_contacts";
+const contactEntity = createEntity({
+  table: CONTACT_TABLE,
+  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+});
+const contactFixtureFeature = defineFeature("notes-history-test-contact-fixture", (r) => {
+  r.entity("contact", contactEntity);
+});
+
 let stack: TestStack;
 
+// Distinct ids (default createTestUser() shares TestUsers.admin.id) —
+// authorId-attribution tests need two genuinely different users.
+const admin = createTestUser({ id: 1, roles: ["TenantAdmin"] });
+const member = createTestUser({ id: 2, roles: ["TenantMember"] });
+const otherTenant = createTestUser({
+  id: 10,
+  roles: ["TenantAdmin"],
+  tenantId: "00000000-0000-4000-8000-0000000000aa",
+});
+
+const CONTACT_1 = "30000000-0000-4000-8000-000000000001";
+const CONTACT_2 = "30000000-0000-4000-8000-000000000002";
+const CONTACT_2B = "30000000-0000-4000-8000-00000000002b";
+const CONTACT_3 = "30000000-0000-4000-8000-000000000003";
+const CONTACT_4 = "30000000-0000-4000-8000-000000000004";
+const CONTACT_5 = "30000000-0000-4000-8000-000000000005";
+const CONTACT_6 = "30000000-0000-4000-8000-000000000006";
+const CONTACT_SHARED = "30000000-0000-4000-8000-000000000007";
+
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [notesHistoryFeature] });
+  stack = await setupTestStack({ features: [notesHistoryFeature, contactFixtureFeature] });
   await unsafeCreateEntityTable(stack.db, noteEntryEntity);
+  await unsafeCreateEntityTable(stack.db, contactEntity);
   await createEventsTable(stack.db);
+
+  for (const id of [
+    CONTACT_1,
+    CONTACT_2,
+    CONTACT_2B,
+    CONTACT_3,
+    CONTACT_4,
+    CONTACT_5,
+    CONTACT_6,
+    CONTACT_SHARED,
+  ]) {
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO ${CONTACT_TABLE} (id, tenant_id, name) VALUES ($1, $2, $3)`,
+      [id, admin.tenantId, id],
+    );
+  }
 });
 
 afterAll(async () => {
@@ -42,16 +95,6 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe("DELETE FROM read_note_entries");
 });
 
-// Distinct ids (default createTestUser() shares TestUsers.admin.id) —
-// authorId-attribution tests need two genuinely different users.
-const admin = createTestUser({ id: 1, roles: ["TenantAdmin"] });
-const member = createTestUser({ id: 2, roles: ["TenantMember"] });
-const otherTenant = createTestUser({
-  id: 10,
-  roles: ["TenantAdmin"],
-  tenantId: "00000000-0000-4000-8000-0000000000aa",
-});
-
 async function addNote(
   entityType: string,
   entityId: string,
@@ -80,8 +123,8 @@ async function listNotes(
 
 describe("notes-history integration — add + list", () => {
   test("add-note lands in read_note_entries with author + timestamp stamped", async () => {
-    const { id } = await addNote("contact", "contact-1", "Called about renewal", member);
-    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-1" });
+    const { id } = await addNote("contact", CONTACT_1, "Called about renewal", member);
+    const rows = await listNotes({ field: "entityId", op: "eq", value: CONTACT_1 });
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["id"]).toBe(id);
     expect(rows[0]?.["body"]).toBe("Called about renewal");
@@ -95,8 +138,8 @@ describe("notes-history integration — add + list", () => {
   });
 
   test("a client-supplied authorId in the payload is ignored", async () => {
-    await addNote("contact", "contact-2", "note", member, { authorId: admin.id });
-    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-2" });
+    await addNote("contact", CONTACT_2, "note", member, { authorId: admin.id });
+    const rows = await listNotes({ field: "entityId", op: "eq", value: CONTACT_2 });
     // The write always attributes to the authenticated caller (member), never
     // to a value smuggled in through the payload — schema doesn't even accept
     // an authorId field, so this proves it's silently dropped, not honoured.
@@ -104,8 +147,8 @@ describe("notes-history integration — add + list", () => {
   });
 
   test("a client-supplied authorName in the payload is ignored", async () => {
-    await addNote("contact", "contact-2b", "note", member, { authorName: "Fake Display Name" });
-    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-2b" });
+    await addNote("contact", CONTACT_2B, "note", member, { authorName: "Fake Display Name" });
+    const rows = await listNotes({ field: "entityId", op: "eq", value: CONTACT_2B });
     // Same guard as authorId above: addNotePayloadSchema doesn't accept an
     // authorName field, so a smuggled value never survives to the write —
     // the name (once stamped) can only come from the caller's own session.
@@ -114,17 +157,17 @@ describe("notes-history integration — add + list", () => {
   });
 
   test("multiple notes on the same entity accumulate — nothing overwrites", async () => {
-    await addNote("contact", "contact-3", "first");
-    await addNote("contact", "contact-3", "second");
-    await addNote("contact", "contact-3", "third");
-    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-3" });
+    await addNote("contact", CONTACT_3, "first");
+    await addNote("contact", CONTACT_3, "second");
+    await addNote("contact", CONTACT_3, "third");
+    const rows = await listNotes({ field: "entityId", op: "eq", value: CONTACT_3 });
     expect(rows.map((r) => r["body"]).sort()).toEqual(["first", "second", "third"]);
   });
 
   test("read-layer composition: filtering by entityId scopes to that entity only", async () => {
-    await addNote("contact", "contact-4", "for four");
-    await addNote("contact", "contact-5", "for five");
-    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-4" });
+    await addNote("contact", CONTACT_4, "for four");
+    await addNote("contact", CONTACT_5, "for five");
+    const rows = await listNotes({ field: "entityId", op: "eq", value: CONTACT_4 });
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["body"]).toBe("for four");
   });
@@ -132,7 +175,7 @@ describe("notes-history integration — add + list", () => {
   test("empty body is rejected", async () => {
     const err = await stack.http.writeErr(
       NotesHistoryHandlers.addNote,
-      { entityType: "contact", entityId: "contact-6", body: "  " },
+      { entityType: "contact", entityId: CONTACT_6, body: "  " },
       admin,
     );
     expect(err.httpStatus).toBe(400);
@@ -141,13 +184,13 @@ describe("notes-history integration — add + list", () => {
 
 describe("notes-history integration — multi-tenant isolation", () => {
   test("tenant B sees none of tenant A's notes", async () => {
-    await addNote("contact", "contact-shared-id", "A's note", admin);
+    await addNote("contact", CONTACT_SHARED, "A's note", admin);
 
     expect(
-      await listNotes({ field: "entityId", op: "eq", value: "contact-shared-id" }, otherTenant),
+      await listNotes({ field: "entityId", op: "eq", value: CONTACT_SHARED }, otherTenant),
     ).toHaveLength(0);
     expect(
-      await listNotes({ field: "entityId", op: "eq", value: "contact-shared-id" }, admin),
+      await listNotes({ field: "entityId", op: "eq", value: CONTACT_SHARED }, admin),
     ).toHaveLength(1);
   });
 });

package/src/notes-history/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.244.0",
+    "type": "improvement",
+    "title": "add-note now always verifies entityType/entityId against the parent entity's own read path",
+    "detail": "Before this change, add-note took entityType/entityId straight from the client with no check — any dispatch-eligible tenant user could attach a note to any parent object, including one they couldn't otherwise see. add-note now unconditionally verifies that entityType names a registered entity and that the row is visible to the caller through that entity's own read path (tenant scope plus its `access.read` ownership) before accepting the write; entries that fail either check are rejected with a not_found response. createNotesHistoryFeature also accepts a `parents` option — an allowlist further narrowing which registered entities may be a note's parent — but this option is additive-only; the parent-visibility check itself is not gated behind it.",
+    "migration": "entityType must now name an entity registered in the same app (via r.entity(...) or a bundled feature), and the caller must be able to see the target row through that entity's own read path. Any consumer that called add-note with an entityType that is NOT a registered entity name, or with an entityId the caller could not otherwise read, will now get a not_found error instead of a successful write — register the parent entity (and, if it needs row-level ownership, its `access.read` rule) before upgrading."
+  },
   {
     "version": "0.215.3",
     "type": "improvement",

package/src/notes-history/feature.ts

@@ -30,6 +30,7 @@ function registerNotesHistory(
   r: FeatureRegistrar<typeof NOTES_HISTORY_FEATURE_NAME>,
   access: AccessRule,
   ownership: EntityDefinition["access"] | undefined,
+  parents: ReadonlySet<string> | undefined,
 ): void {
   r.describe(
     "Generic, host-agnostic, append-only note history for any entity. Owns one event-sourced entity, `note-entry` (`read_note_entries`), keyed by (entityType, entityId) — so attaching notes adds NO column to the host entity and needs no relational pivot or JOIN. Provides a `create` write-handler (author stamped server-side from the caller, never client-supplied) and a `list` query filterable on entityId. Deliberately append-only: no update or delete handler is registered — a correction is a new entry, not an edit, so who-said-what-when stays reconstructable. Every path uses one access rule — adopt the host's model with createNotesHistoryFeature({ access: { openToAll: true } }) or pin roles with createNotesHistoryFeature({ roles }).",
@@ -43,7 +44,7 @@ function registerNotesHistory(
   const entity = createNoteEntryEntity(ownership);
   r.entity("note-entry", entity);
 
-  r.writeHandler(createAddNoteHandler(access));
+  r.writeHandler(createAddNoteHandler(access, parents));
   r.queryHandler(
     defineEntityListHandler("note-entry", entity, {
       access,
@@ -56,7 +57,7 @@ function registerNotesHistory(
 }
 
 export const notesHistoryFeature = defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) =>
-  registerNotesHistory(r, DEFAULT_NOTES_HISTORY_ACCESS, undefined),
+  registerNotesHistory(r, DEFAULT_NOTES_HISTORY_ACCESS, undefined, undefined),
 );
 
 export type NotesHistoryFeatureOptions = {
@@ -83,6 +84,16 @@ export type NotesHistoryFeatureOptions = {
    *  crypto-shredding — a silent Art.17 failure, not a thrown error. Make
    *  sure any `ownership.write` you set covers that role, or leave it unset. */
   readonly ownership?: EntityDefinition["access"];
+  /** Allowlist further narrowing which registered entities may be used as a
+   *  note's parent (entityType). This is NOT what turns parent-checking on —
+   *  add-note always verifies that entityType names a registered entity and
+   *  that the row is visible to the caller through that entity's own read
+   *  path (tenant scope plus its `access.read` ownership); an entityType
+   *  that names no registered entity is rejected regardless of this option.
+   *  Setting `parents` narrows further, to a specific set of entity names —
+   *  useful when a host entity is registered but should never be a valid
+   *  note parent. */
+  readonly parents?: readonly string[];
 };
 
 function resolveAccess(opts: NotesHistoryFeatureOptions): AccessRule {
@@ -96,7 +107,12 @@ function resolveAccess(opts: NotesHistoryFeatureOptions): AccessRule {
 export function createNotesHistoryFeature(
   opts: NotesHistoryFeatureOptions = {},
 ): typeof notesHistoryFeature {
-  if (opts.access === undefined && opts.roles === undefined && opts.ownership === undefined) {
+  if (
+    opts.access === undefined &&
+    opts.roles === undefined &&
+    opts.ownership === undefined &&
+    opts.parents === undefined
+  ) {
     return notesHistoryFeature;
   }
   if (hasWhereRule(opts.ownership?.write)) {
@@ -105,11 +121,23 @@ export function createNotesHistoryFeature(
         '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
         "layer (the read path, via buildOwnershipClause). Write paths that " +
         "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them: create throws at runtime, update/delete/forget/restore " +
-        "silently deny. Use a `from()` rule for ownership.write, or leave it unset.",
+        "evaluate them, so such a rule can only ever deny — boot validation " +
+        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
+        "leave it unset.",
     );
   }
+  // A mount that accepts no parents at all can never take a note write —
+  // that's a config mistake, not a valid allowlist. Omit `parents` instead
+  // of passing an empty array.
+  if (opts.parents !== undefined && opts.parents.length === 0) {
+    throw new Error(
+      "createNotesHistoryFeature({ parents }): parents must not be an empty array — " +
+        "an empty allowlist rejects every add-note call. Omit `parents` to keep " +
+        "today's unrestricted behavior instead.",
+    );
+  }
+  const parents = opts.parents === undefined ? undefined : new Set(opts.parents);
   return defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) =>
-    registerNotesHistory(r, resolveAccess(opts), opts.ownership),
+    registerNotesHistory(r, resolveAccess(opts), opts.ownership, parents),
   );
 }

package/src/notes-history/handlers/add-note.write.ts

@@ -1,6 +1,7 @@
 import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { decryptStoredPii } from "../../shared";
+import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { decryptStoredPii, parentRowIsVisible } from "../../shared";
 import { userTable } from "../../user";
 import { DEFAULT_NOTES_HISTORY_ACCESS } from "../constants";
 import { noteEntryExecutor } from "../executor";
@@ -11,8 +12,16 @@ import { type AddNotePayload, addNotePayloadSchema } from "../schemas";
 // (event.user.id), so a note can't be authored as someone else. No update or
 // delete counterpart is registered — see entity.ts for why append-only is
 // deliberate.
+//
+// entityType/entityId are never trusted client input: entityType must name a
+// registered entity, and the row must be visible to the caller through that
+// entity's own read path (tenant scope plus its `access.read` ownership) —
+// see shared/parent-visibility.ts. `parents`, when set, is an ADDITIONAL allowlist
+// narrowing which registered entities may be a note's parent at all; it is
+// not what turns the check on.
 export function createAddNoteHandler(
   access: AccessRule = DEFAULT_NOTES_HISTORY_ACCESS,
+  parents?: ReadonlySet<string>,
 ): WriteHandlerDef {
   return {
     name: "add-note",
@@ -23,6 +32,23 @@ export function createAddNoteHandler(
     handler: async (event, ctx) => {
       const payload = event.payload as AddNotePayload; // @cast-boundary engine-payload
 
+      // NotFoundError, not an access-denied error, so the response doesn't
+      // double as an existence oracle — same policy as executor.detail,
+      // which never distinguishes "no access" from "doesn't exist".
+      if (parents !== undefined && !parents.has(payload.entityType)) {
+        return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
+      }
+      const visible = await parentRowIsVisible(
+        ctx.registry,
+        payload.entityType,
+        payload.entityId,
+        event.user,
+        ctx.db,
+      );
+      if (!visible) {
+        return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
+      }
+
       let authorName: string | null = null;
       try {
         // read_users is tenant-agnostic → ctx.db.raw, not the tenant-scoped ctx.db.

package/src/notes-history-user-data/__tests__/hooks.integration.test.ts

@@ -4,6 +4,8 @@
 // confirm it doesn't touch the row.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -21,10 +23,34 @@ let stack: TestStack;
 const author = createTestUser({ id: 1, roles: ["TenantMember"] });
 const other = createTestUser({ id: 2, roles: ["TenantMember"] });
 
+// fw#2627 made add-note's parent-visibility check unconditional — entityType
+// must name a registered entity whose row is visible to the caller. This
+// fixture stands in for that parent; it deliberately has no `access` (PASS_CLAUSE)
+// so it never gates on its own, keeping this file focused on author filtering.
+const CONTACT_TABLE = "notes_user_data_test_contacts";
+const contactEntity = createEntity({
+  table: CONTACT_TABLE,
+  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+});
+const contactFixtureFeature = defineFeature("notes-user-data-test-contact-fixture", (r) => {
+  r.entity("contact", contactEntity);
+});
+
+// author and other share the same tenantId (both from TestUsers.admin), so
+// one contact row is visible to both.
+const CONTACT_1 = "30000000-0000-4000-8000-000000000001";
+
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [createNotesHistoryFeature()] });
+  stack = await setupTestStack({
+    features: [createNotesHistoryFeature(), contactFixtureFeature],
+  });
   await unsafeCreateEntityTable(stack.db, noteEntryEntity);
+  await unsafeCreateEntityTable(stack.db, contactEntity);
   await createEventsTable(stack.db);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO ${CONTACT_TABLE} (id, tenant_id, name) VALUES ($1, $2, $3)`,
+    [CONTACT_1, author.tenantId, "Contact 1"],
+  );
 });
 
 afterAll(async () => {
@@ -35,12 +61,12 @@ describe("noteEntryExportHook", () => {
   test("includes only the requesting user's own authored notes", async () => {
     await stack.http.writeOk(
       NotesHistoryHandlers.addNote,
-      { entityType: "contact", entityId: "c-1", body: "by author" },
+      { entityType: "contact", entityId: CONTACT_1, body: "by author" },
       author,
     );
     await stack.http.writeOk(
       NotesHistoryHandlers.addNote,
-      { entityType: "contact", entityId: "c-1", body: "by other" },
+      { entityType: "contact", entityId: CONTACT_1, body: "by other" },
       other,
     );
 

package/src/shared/assert-erased.ts

@@ -0,0 +1,15 @@
+import type { WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+
+// GDPR-forget hooks used to `await crud.forget(...)` and drop the result —
+// a silent ownership_denied (or any other failure) meant the row was never
+// actually erased, with nothing surfacing the miss. Callers must assert.
+export function assertErased(result: WriteResult<unknown>, entityName: string, id: string): void {
+  // skip: the happy path — the assertion below only concerns failures.
+  if (result.isSuccess) return;
+  // skip: erasure is idempotent — a row that is already gone (e.g. a parallel
+  // forget sweep) satisfies the erase request just as well as one this call removed.
+  if (result.error.code === "not_found") return;
+  throw new Error(
+    `[user-data-rights] failed to erase ${entityName}/${id}: ${result.error.code} — ${result.error.message}`,
+  );
+}

package/src/shared/has-where-rule.ts

@@ -1,13 +1,10 @@
 import type { OwnershipMap } from "@cosmicdrift/kumiko-framework/engine";
 
-// `where`-rules are read-path only (buildOwnershipClause). On the write path
-// userCanWriteFieldRow silently skips them (fail-closed deny), but
-// userCanCreateFieldRow does NOT skip them — it runs matchesRule(), which
-// throws for `kind: "where"` (no in-memory evaluator for raw SQL). An
-// ownership.write map with a where-rule boots fine (the boot-validator has no
-// where-specific handling either) and only blows up the first time a create
-// hits it. Feature factories that accept an `ownership` option must reject
-// this shape at build time instead of shipping the landmine.
+// `where`-rules are read-path only (buildOwnershipClause). The write path
+// decides in memory against the concrete row, so a where-rule there can only
+// ever deny — boot validation rejects the shape (fw#2626). Feature factories
+// that accept an `ownership` option reject it earlier, at build time, so the
+// author gets the option name in the message instead of an entity scope.
 export function hasWhereRule(map: OwnershipMap | undefined): boolean {
   if (!map) return false;
   return Object.values(map).some((rule) => rule !== "all" && rule.kind === "where");

package/src/shared/index.ts

@@ -1,3 +1,4 @@
+export { assertErased } from "./assert-erased";
 export {
   type ChunkedMigrationOptions,
   type ChunkedMigrationResult,
@@ -16,6 +17,7 @@ export { isWithinGracePeriod } from "./grace-period";
 export { hasWhereRule } from "./has-where-rule";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
 export { mapWithConcurrency } from "./map-with-concurrency";
+export { parentRowIsVisible } from "./parent-visibility";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
 export { sessionField } from "./session-field";
 export { sessionLocaleField } from "./session-locale-field";

package/src/shared/parent-visibility.ts

@@ -0,0 +1,48 @@
+import type { EventStoreExecutor, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntityExecutor,
+  type EntityDefinition,
+  isUuid,
+  type Registry,
+  type SessionUser,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// Keyed by definition identity, not by entity name — two test stacks can
+// register different EntityDefinitions under the same entity name.
+const executorsByEntity = new WeakMap<EntityDefinition, EventStoreExecutor>();
+
+function idShapeMatchesEntity(entity: EntityDefinition, entityId: string): boolean {
+  return entity.idType === "serial" ? /^\d+$/.test(entityId) : isUuid(entityId);
+}
+
+// Checks whether a client-supplied (entityType, entityId) host reference is one
+// the caller can see via that entity's own read path — tenant scope plus its
+// `access.read` ownership. Shared by every handler that attaches something to a
+// host entity the client names (add-note, assign-tag, remove-tag, set-folder,
+// clear-folder); those handlers deny with NotFoundError so the response never
+// doubles as an existence oracle.
+export async function parentRowIsVisible(
+  registry: Registry,
+  entityType: string,
+  entityId: string,
+  user: SessionUser,
+  db: TenantDb,
+): Promise<boolean> {
+  // Default-deny: an entityType that names no registered entity has no read
+  // path to check visibility against, so it can never be a valid parent.
+  const entity = registry.getEntity(entityType);
+  if (!entity) return false;
+
+  // A malformed id would abort the write transaction on a Postgres cast
+  // error (22P02) instead of cleanly denying — reject it before it reaches
+  // the executor.
+  if (!idShapeMatchesEntity(entity, entityId)) return false;
+
+  let executor = executorsByEntity.get(entity);
+  if (!executor) {
+    executor = createEntityExecutor(entityType, entity).executor;
+    executorsByEntity.set(entity, executor);
+  }
+
+  return (await executor.detail({ id: entityId }, user, db)) !== null;
+}

package/src/tags/__tests__/tags-ownership.test.ts

@@ -1,15 +1,14 @@
-// H.2 boot guard — mirrors notes-history-ownership.integration.test.ts's
-// guard test. A where-rule in ownership.write boots fine (the boot-validator
-// has no where-specific handling) and only blows up the first time
-// assign-tag's create() hits it (userCanCreateFieldRow throws on
-// `kind: "where"`, unlike update/delete/forget which silently deny). No DB
-// needed — the guard fires at feature-construction time.
+// H.2 build-time guard — mirrors notes-history-ownership.integration.test.ts's
+// guard test. A where-rule in ownership.write can only ever deny (the write
+// path has no SQL layer); framework boot validation rejects it too, this guard
+// just fires earlier with the option name in the message. No DB needed — it
+// runs at feature-construction time.
 
 import { describe, expect, test } from "bun:test";
 import { createTagsFeature } from "../feature";
 
 describe("tags — boot guard rejects a where-rule in ownership.write", () => {
-  test("createTagsFeature throws instead of shipping a create()-time landmine", () => {
+  test("createTagsFeature throws instead of shipping a deny-only ownership map", () => {
     expect(() =>
       createTagsFeature({
         ownership: {