@cosmicdrift/kumiko-bundled-features 0.269.2 → 0.273.0

package/src/sessions/handlers/mine.query.ts

@@ -12,7 +12,13 @@ import { userSessionTable } from "../schema/user-session";
 export const mineQuery = definePagedQueryHandler({
   name: "user-session:mine",
   schema: z.object({}),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user lists only their own live sessions; the query filters " +
+        "userSessionTable by the caller's own userId",
+    },
+  },
   description:
     "Lists the calling user's own still-live sessions, newest first, each flagged whether it is the one making the request; use it to show a user their signed-in devices.",
   outputSchema: z.object({

package/src/sessions/handlers/revoke-all-others.write.ts

@@ -15,7 +15,13 @@ import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN } from "../ses
 export const revokeAllOthersWrite = defineWriteHandler({
   name: "user-session:revoke-all-others",
   schema: z.object({}),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user revokes only their own other sessions; the update is " +
+        "scoped to the caller's own userId, keeping only their current session (sid)",
+    },
+  },
   description:
     'Irreversibly signs the calling user out of every session except the one making the request and reports how many were dropped; use it for a "sign out everywhere else" action after a suspected compromise.',
   agent: { risk: "high" },

package/src/sessions/handlers/revoke.write.ts

@@ -28,7 +28,13 @@ export const revokeWrite = defineWriteHandler({
   schema: z.object({
     id: z.uuid(),
   }),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user revokes only their own session by id; the update is " +
+        "scoped to the caller's own userId",
+    },
+  },
   description:
     "Irreversibly signs one of the caller's own sessions out by id; use it when a user wants to drop a single device, and note that revoking their current session logs them out.",
   agent: { risk: "high" },

package/src/sessions/screens.ts

@@ -140,5 +140,13 @@ export const sessionMineScreen: ProjectionListScreenDefinition = {
       confirm: i18nKey("sessions.mine.revokeAllOthers.confirm"),
     },
   ],
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user views and revokes only their own sessions, mirroring the mine/revoke handlers",
+    },
+  },
+  // Self-service settings-area screen, placed by the consuming app's own
+  // r.nav() — no nav area to resolve in isolation.
+  dormant: true,
 };

package/src/tags/__tests__/feature.test.ts

@@ -105,7 +105,9 @@ describe("createTagsFeature access-options", () => {
   });
 
   test("access:{openToAll} applies to every write- and query-path", () => {
-    const feature = createTagsFeature({ access: { openToAll: true } });
+    const feature = createTagsFeature({
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    });
     for (const path of [
       "create-tag",
       "update-tag",
@@ -116,17 +118,28 @@ describe("createTagsFeature access-options", () => {
       "assign-tag",
       "remove-tag",
     ]) {
-      expect(rawWriteAccess(feature, path)).toEqual({ openToAll: true });
+      expect(rawWriteAccess(feature, path)).toEqual({
+        openToAll: { reason: "test handler callable by any signed-in test user" },
+      });
     }
     for (const query of ["tag:list", "tag:detail", "tag-assignment:list"]) {
-      expect(rawQueryAccess(feature, query)).toEqual({ openToAll: true });
+      expect(rawQueryAccess(feature, query)).toEqual({
+        openToAll: { reason: "test handler callable by any signed-in test user" },
+      });
     }
   });
 
   test("access takes precedence over the roles shorthand", () => {
-    const feature = createTagsFeature({ access: { openToAll: true }, roles: ["Admin"] });
-    expect(rawWriteAccess(feature, "create-tag")).toEqual({ openToAll: true });
-    expect(rawQueryAccess(feature, "tag:list")).toEqual({ openToAll: true });
+    const feature = createTagsFeature({
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      roles: ["Admin"],
+    });
+    expect(rawWriteAccess(feature, "create-tag")).toEqual({
+      openToAll: { reason: "test handler callable by any signed-in test user" },
+    });
+    expect(rawQueryAccess(feature, "tag:list")).toEqual({
+      openToAll: { reason: "test handler callable by any signed-in test user" },
+    });
   });
 
   test("access:{roles} threads through like the roles shorthand", () => {
@@ -139,12 +152,16 @@ describe("createTagsFeature access-options", () => {
 describe("createTagsFeature toggleable-option (tier-gating)", () => {
   test("without toggleable: feature is always-on (toggleableDefault undefined)", () => {
     expect(createTagsFeature().toggleableDefault).toBeUndefined();
-    expect(createTagsFeature({ access: { openToAll: true } }).toggleableDefault).toBeUndefined();
+    expect(
+      createTagsFeature({
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      }).toggleableDefault,
+    ).toBeUndefined();
   });
 
   test("toggleable:{default:false} makes the feature tier-gatable, fail-closed", () => {
     const feature = createTagsFeature({
-      access: { openToAll: true },
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       toggleable: { default: false },
     });
     expect(feature.toggleableDefault).toBe(false);

package/src/tags/__tests__/tags-parent-visibility.integration.test.ts

@@ -93,7 +93,12 @@ let tagId: string;
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [createTagsFeature({ access: { openToAll: true } }), hostFixturesFeature],
+    features: [
+      createTagsFeature({
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      }),
+      hostFixturesFeature,
+    ],
   });
   await unsafeCreateEntityTable(stack.db, tagEntity);
   await unsafeCreateEntityTable(stack.db, tagAssignmentEntity);

package/src/tags/__tests__/tags-read-gate.integration.test.ts

@@ -99,7 +99,12 @@ let tagId: string;
 beforeAll(async () => {
   stack = await setupTestStack({
     // Deliberately no `ownership` — the gate must hold on a bare mount.
-    features: [createTagsFeature({ access: { openToAll: true } }), hostFixturesFeature],
+    features: [
+      createTagsFeature({
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      }),
+      hostFixturesFeature,
+    ],
   });
   await unsafeCreateEntityTable(stack.db, tagEntity);
   await unsafeCreateEntityTable(stack.db, tagAssignmentEntity);
@@ -303,7 +308,7 @@ describe("tags read-gate — ownership narrows further, it does not replace the
     ownedStack = await setupTestStack({
       features: [
         createTagsFeature({
-          access: { openToAll: true },
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
           // An extra row rule on the assignment row itself, unrelated to who
           // may see the host: the caller's claim must name the row's host type.
           ownership: {

package/src/tags/__tests__/tags.integration.test.ts

@@ -457,7 +457,12 @@ describe("tags integration — openToAll access model", () => {
 
   beforeAll(async () => {
     openStack = await setupTestStack({
-      features: [createTagsFeature({ access: { openToAll: true } }), hostFixturesFeature],
+      features: [
+        createTagsFeature({
+          access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+        }),
+        hostFixturesFeature,
+      ],
     });
     await unsafeCreateEntityTable(openStack.db, tagEntity);
     await unsafeCreateEntityTable(openStack.db, tagAssignmentEntity);

package/src/tags/constants.ts

@@ -55,7 +55,7 @@ export const TagsQueries = {
 export const DEFAULT_TAG_ROLES = ["TenantAdmin", "TenantMember"] as const;
 
 // The default access rule applied to every tag handler when the app passes
-// neither `access` nor `roles`. createTagsFeature({ access: { openToAll: true } })
+// neither `access` nor `roles`. createTagsFeature({ access: { openToAll: { reason } } })
 // makes tagging reachable for any authenticated tenant user — matching apps
 // whose other handlers are openToAll rather than role-gated.
 export const DEFAULT_TAG_ACCESS: AccessRule = { roles: DEFAULT_TAG_ROLES };

package/src/tags/feature.ts

@@ -54,7 +54,7 @@ function registerTags(
   parents: readonly string[] | undefined,
 ): void {
   r.describe(
-    "Generic, host-agnostic tagging for any entity. Owns two event-sourced entities — the per-tenant `tag` catalog (`read_tags`, with optional `color` and `scope`) and `tag-assignment` join rows keyed by (entityType, entityId) (`read_tag_assignments`) — so tagging adds NO column to the host entity and needs no relational pivot or JOIN. Catalog screens are declarative (`entityList` + `entityEdit`) and use convention QNs `tag:{create,update,delete}`; TagManager/TagPicker keep `create-tag`/`update-tag`/`delete-tag`. Also: `assign-tag` (idempotent), `remove-tag` (idempotent) and list queries for the catalog and the assignments. Read which tags an entity has, or which entities carry a tag, by listing `tag-assignment` filtered on `entityId` or `tagId` and composing in the read-layer. A tag with empty `scope` is global; a `scope` of an entityType restricts it to that type in the picker. Every path uses one access rule — adopt the host's model with createTagsFeature({ access: { openToAll: true } }) or pin roles with createTagsFeature({ roles }). Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).",
+    "Generic, host-agnostic tagging for any entity. Owns two event-sourced entities — the per-tenant `tag` catalog (`read_tags`, with optional `color` and `scope`) and `tag-assignment` join rows keyed by (entityType, entityId) (`read_tag_assignments`) — so tagging adds NO column to the host entity and needs no relational pivot or JOIN. Catalog screens are declarative (`entityList` + `entityEdit`) and use convention QNs `tag:{create,update,delete}`; TagManager/TagPicker keep `create-tag`/`update-tag`/`delete-tag`. Also: `assign-tag` (idempotent), `remove-tag` (idempotent) and list queries for the catalog and the assignments. Read which tags an entity has, or which entities carry a tag, by listing `tag-assignment` filtered on `entityId` or `tagId` and composing in the read-layer. A tag with empty `scope` is global; a `scope` of an entityType restricts it to that type in the picker. Every path uses one access rule — adopt the host's model with createTagsFeature({ access: { openToAll: { reason } } }) or pin roles with createTagsFeature({ roles }). Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).",
   );
   r.uiHints({
     displayLabel: "Tags",
@@ -134,7 +134,7 @@ export const tagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) =>
 
 export type TagsFeatureOptions = {
   /** Access rule for all tag write/read paths. Default { roles: ["TenantAdmin","TenantMember"] }.
-   *  Adopt the host's model — e.g. { openToAll: true } when the host lets any
+   *  Adopt the host's model — e.g. { openToAll: { reason: "..." } } when the host lets any
    *  authenticated tenant user tag (like the rest of its handlers), or
    *  { roles: ["Admin"] } for a custom role vocabulary. Takes precedence over `roles`. */
   readonly access?: AccessRule;

package/src/tags/screens.ts

@@ -40,6 +40,9 @@ export function createTagListScreen(
       },
     ],
     access,
+    // App navs via r.nav("tags:screen:tag-list") — no nav area to resolve
+    // in isolation.
+    dormant: true,
   };
 }
 

package/src/tenant/__tests__/members-facet-i18n.test.ts

@@ -16,11 +16,11 @@ function membersFacetLabelKeys(): readonly string[] {
   if (screen?.type !== "projectionList") {
     throw new Error("expected members screen to be projectionList");
   }
-  return (screen.facets ?? []).flatMap((facet) =>
-    facet.type === "select"
-      ? [facet.label, ...facet.options.map((option) => option.label)]
-      : [facet.label, facet.trueLabel, facet.falseLabel],
-  );
+  return (screen.facets ?? []).flatMap((facet) => {
+    if (facet.type === "select") return [facet.label, ...facet.options.map((o) => o.label)];
+    if (facet.type === "boolean") return [facet.label, facet.trueLabel, facet.falseLabel];
+    return [facet.label];
+  });
 }
 
 // Column labels of the members screen itself — deliberately scoped to this

package/src/tenant/__tests__/tenant-timezone-boot.integration.test.ts

@@ -25,7 +25,7 @@ const probeFeature = defineFeature("tz-probe", (r) => {
     "read-tz",
     z.object({}),
     async (_event, ctx) => ({ isSuccess: true, data: { tenant: ctx.tz.tenant } }),
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });
 
@@ -35,7 +35,7 @@ const probeFeature = defineFeature("tz-probe", (r) => {
 const queryProbeFeature = defineFeature("tz-cache-probe", (r) => {
   r.requires("tenant");
   r.queryHandler("read-tz", z.object({}), async (_query, ctx) => ({ tenant: ctx.tz.tenant }), {
-    access: { openToAll: true },
+    access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
   });
 });
 

package/src/tenant/__tests__/tenant.integration.test.ts

@@ -401,7 +401,11 @@ describe("scenario 7: access rules on handlers", () => {
       "SystemAdmin",
     ]);
     expect(stack.registry.getQueryHandler(TenantQueries.me)?.access).toEqual({
-      openToAll: true,
+      openToAll: {
+        reason:
+          "any signed-in user reads only their own active tenant; the query is scoped " +
+          "to the caller's own tenantId",
+      },
     });
   });
 });

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.271.0",
+    "type": "improvement",
+    "title": "systemScope handlers get a default per-tenant+handler rate limit; tenant:me opts out (fw#2861).",
+    "detail": "`tenant` mounts under `r.systemScope()`, so its write/query handlers without their own `rateLimit` now default to `{ per: \"tenant+handler\", limit: 600, windowSeconds: 60 }` once an app has a `RateLimitResolver` configured (framework change, see kumiko-framework changes.json 0.271.0). `tenant:query:me` (`tenant:me.query.ts`) declares `rateLimit: { disabled: true, reason: \"...\" }` — it is a self-scoped read of the caller's own active tenant, hit on every page load, and a per-tenant bucket would throttle the whole tenant's page loads instead of just that one handler's traffic."
+  },
   {
     "version": "0.219.0",
     "type": "improvement",

package/src/tenant/handlers/me.query.ts

@@ -9,7 +9,19 @@ import { tenantTable } from "../schema/tenant";
 export const meQuery = defineQueryHandler({
   name: "me",
   schema: z.object({}),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "any signed-in user reads only their own active tenant; the query is scoped " +
+        "to the caller's own tenantId",
+    },
+  },
+  rateLimit: {
+    disabled: true,
+    reason:
+      "self-scoped read of the caller's own active tenant, hit on every page load; per-tenant " +
+      "bucket would throttle the whole tenant, L1 IP limit still applies",
+  },
   description:
     "Returns the record of the tenant the caller is currently signed in to, or null if it is gone; use it whenever the active tenant's own name, key or settings are needed.",
   handler: async (query, ctx) => {

package/src/tenant/handlers/update-member-roles.write.ts

@@ -122,7 +122,16 @@ export const updateMemberRolesWrite = defineWriteHandler({
     const willBeTenantAdmin = event.payload.roles.includes("TenantAdmin");
 
     if (targetIsTenantAdmin && !willBeTenantAdmin) {
-      const lastAdmin = await assertNotLastTenantAdmin(db, targetTenantId, event.payload.userId);
+      // assertNotLastTenantAdmin issues raw SQL, so it needs the raw runner, not
+      // `db` — the count is already filtered by the explicit targetTenantId.
+      const lockRunner = ctx.systemDb.unsafeRaw(
+        "tenant:write:updateMemberRoles last-TenantAdmin advisory lock + membership count",
+      );
+      const lastAdmin = await assertNotLastTenantAdmin(
+        lockRunner,
+        targetTenantId,
+        event.payload.userId,
+      );
       if (lastAdmin !== undefined) return lastAdmin;
     }
 

package/src/tenant/screens.ts

@@ -44,6 +44,9 @@ export const tenantListScreen: EntityListScreenDefinition = {
   defaultSort: { field: "name", dir: "asc" },
   searchable: true,
   access: { roles: ["SystemAdmin"] },
+  // Inert until an app navs it (see file header) — no nav area to resolve
+  // in isolation.
+  dormant: true,
 };
 
 export const tenantEditScreen: EntityEditScreenDefinition = {

package/src/tenant/seeding.ts

@@ -117,19 +117,22 @@ export type SeedTenantHooks = {
 // (HandlerContext from a live write), afterCommit hooks are queued onto the
 // dispatcher's sink and flush post-commit. Without a sink (fixture / plain
 // Connection) they still fire immediately — there is no outer TX to wait for.
-function resolveRawDb(db: AppContext["db"]): DbRunner | undefined {
-  if (!db) return undefined;
-  if (typeof db === "object" && "raw" in db) {
-    return (db as { raw: DbRunner }).raw;
-  }
-  return db as DbRunner;
-}
-
-function scopeSeedHookContext(context: AppContext, targetTenantId: TenantId): AppContext {
-  const raw = resolveRawDb(context.db);
-  const db = raw
-    ? createTenantDb(raw, targetTenantId, "system", context.tracer, context.meter, context.signal)
-    : context.db;
+//
+// `runner` comes from the caller, which already holds a declared DbRunner —
+// a TenantDb exposes no runner back out to feature code.
+function scopeSeedHookContext(
+  context: AppContext,
+  targetTenantId: TenantId,
+  runner: DbRunner,
+): AppContext {
+  const db = createTenantDb(
+    runner,
+    targetTenantId,
+    "system",
+    context.tracer,
+    context.meter,
+    context.signal,
+  );
 
   // HandlerContext carries `user`; AppContext only `systemUser`. Prefer the
   // live handler user when present so notify/hasFeature keep a real SessionUser.
@@ -163,7 +166,7 @@ function scopeSeedHookContext(context: AppContext, targetTenantId: TenantId): Ap
   return {
     ...context,
     _tenantId: targetTenantId,
-    ...(db !== undefined ? { db } : {}),
+    db,
     ...(notify !== undefined ? { notify } : {}),
     ...(scopedUser && "user" in context ? { user: scopedUser } : {}),
     ...(hasFeature ? { hasFeature } : {}),
@@ -176,16 +179,16 @@ export async function fireEntityPostSave(
   entityData: SaveContext,
   // Undefined for tenant-agnostic entities (user has no tenant_id column at
   // seed time) — keeps hooks.context._tenantId as the caller passed it.
-  targetTenantId?: TenantId,
+  target?: { readonly tenantId: TenantId; readonly db: DbRunner },
 ): Promise<void> {
   // skip: caller opted out of hooks (existing fixture/test call-sites that
   // don't pass them keep today's hook-less behavior, see seedTenant's doc).
   if (!hooks) return;
   const lifecycle = createLifecycleHooks(hooks.registry);
   const scopedContext =
-    targetTenantId === undefined
+    target === undefined
       ? hooks.context
-      : scopeSeedHookContext(hooks.context, targetTenantId);
+      : scopeSeedHookContext(hooks.context, target.tenantId, target.db);
   await lifecycle.runPostSave(pseudoType, entityData, scopedContext, HookPhases.inTransaction);
   const runAfterCommit = () =>
     lifecycle.runPostSave(pseudoType, entityData, scopedContext, HookPhases.afterCommit);
@@ -239,7 +242,7 @@ export async function seedTenant(
   // "tenant:seed" matches no handler-scoped hook, only entity-scoped ones
   // (keyed by result.entityName === "tenant") — that's exactly what
   // tier-engine's `r.hook("postSave", { allOf: "tenant" }, ...)` needs.
-  await fireEntityPostSave(hooks, "tenant:seed", result.data, options.id);
+  await fireEntityPostSave(hooks, "tenant:seed", result.data, { tenantId: options.id, db });
 
   return { id: options.id };
 }
@@ -301,7 +304,10 @@ export async function seedTenantMembership(
       `seedTenantMembership failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
     );
   }
-  await fireEntityPostSave(hooks, "tenant-membership:seed", result.data, options.tenantId);
+  await fireEntityPostSave(hooks, "tenant-membership:seed", result.data, {
+    tenantId: options.tenantId,
+    db,
+  });
   return { id: extractMembershipId(result.data) };
 }
 

package/src/tier-engine/feature.ts

@@ -290,6 +290,9 @@ export function createTierEngineFeature<
       description:
         "Operator form that assigns a tier to any tenant as a manual grant without a billing purchase.",
       access: { roles: ["SystemAdmin"] },
+      // Apps place it via r.nav() (see above) — no nav area to resolve in
+      // isolation.
+      dormant: true,
     });
 
     // ───────────────────────────────────────────────────────────────────

package/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.271.0",
+    "type": "improvement",
+    "title": "systemScope handlers get a default per-tenant+handler rate limit; user:me opts out (fw#2861).",
+    "detail": "`user` mounts under `r.systemScope()`, so its write/query handlers without their own `rateLimit` now default to `{ per: \"tenant+handler\", limit: 600, windowSeconds: 60 }` once an app has a `RateLimitResolver` configured (framework change, see kumiko-framework changes.json 0.271.0). `user:query:user:me` (`user:me.query.ts`) declares `rateLimit: { disabled: true, reason: \"...\" }` — it is a self-scoped read of the caller's own identity record, hit on every page load, and a per-tenant bucket would throttle the whole tenant's page loads instead of just that one handler's traffic."
+  },
   {
     "version": "0.218.1",
     "type": "improvement",

package/src/user/handlers/me.query.ts

@@ -11,7 +11,19 @@ const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user
 export const meQuery = defineQueryHandler({
   name: "user:me",
   schema: z.object({}),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user reads only their own identity record; the detail lookup " +
+        "is by the caller's own id",
+    },
+  },
+  rateLimit: {
+    disabled: true,
+    reason:
+      "self-scoped read of the caller's own user record, hit on every page load; per-tenant " +
+      "bucket would throttle the whole tenant, L1 IP limit still applies",
+  },
   description:
     "Returns the signed-in caller's own identity record, with the password hash stripped by field-level read access; use it whenever the current user's own profile data is needed.",
   handler: async (query, ctx) => {

package/src/user/handlers/update-roles.ts

@@ -126,14 +126,17 @@ export async function applyUserRolesUpdate(
   const willBeSystemAdmin = newRoles.includes("SystemAdmin");
 
   if (wasActiveSystemAdmin && !willBeSystemAdmin) {
-    // Lock before count+update so two concurrent demotions cannot both
-    // observe otherActiveSystemAdmins >= 1 and leave zero active SystemAdmins.
-    await acquireNamespacedAdvisoryLock(db, LAST_SYSTEM_ADMIN_LOCK_NAMESPACE, "global");
-    // user is r.systemScope() — the count spans every tenant's SystemAdmins,
-    // so it needs the raw runner, not the (still tenant-shaped) `db` above.
+    // user is r.systemScope() — the lock + count span every tenant's SystemAdmins,
+    // so both need the raw runner, not the tenant-shaped `db` above.
     if (!ctx.systemDb) {
       throw new InternalError({ message: "user:update-roles requires ctx.systemDb" });
     }
+    const lockRunner = ctx.systemDb.unsafeRaw(
+      "advisory lock serializing concurrent last-SystemAdmin demotions",
+    );
+    // Lock before count+update so two concurrent demotions cannot both
+    // observe otherActiveSystemAdmins >= 1 and leave zero active SystemAdmins.
+    await acquireNamespacedAdvisoryLock(lockRunner, LAST_SYSTEM_ADMIN_LOCK_NAMESPACE, "global");
     const otherActiveSystemAdmins = await countOtherActiveSystemAdmins(
       ctx.systemDb.unsafeRaw(
         "jsonb @> prefilter over the global users table to count remaining active SystemAdmins",

package/src/user/screens.ts

@@ -32,6 +32,9 @@ export const userListScreen: EntityListScreenDefinition = {
   // Apps must boot a user search index on that tenant (offlot: bootWaitlistSearch).
   searchable: true,
   access: { roles: ["SystemAdmin"] },
+  // Inert until an app navs it (see file header) — no nav area to resolve
+  // in isolation.
+  dormant: true,
 };
 
 export const userEditScreen: EntityEditScreenDefinition = {

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -270,3 +270,19 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
     expect(() => validateBoot([...minimalTenantLifecycleFeatures(), hooked])).not.toThrow();
   });
 });
+
+describe("nav-area boot check — bundled dormant screens survive a real app nav", () => {
+  test("baseFeatures() (privacy-center included) boots clean once the app registers its own nav area", () => {
+    const appShell = defineFeature("app-shell", (r) => {
+      r.screen({ id: "home", type: "custom", renderer: { react: "Home" } });
+      r.nav({ id: "home", label: "app-shell:nav.home", screen: "app-shell:screen:home" });
+      r.translations({
+        keys: {
+          "app-shell:nav.home": { de: "Start", en: "Home" },
+          "screen:home.title": { de: "Start", en: "Home" },
+        },
+      });
+    });
+    expect(() => validateBoot([...baseFeatures(), appShell])).not.toThrow();
+  });
+});

package/src/user-data-rights/__tests__/export-job-list-cross-tenant.integration.test.ts

@@ -2,7 +2,7 @@
 //
 // Regression: the changeset describes these as "a platform-operator
 // inspector over the GDPR read-models" (i.e. cross-tenant), but the handlers
-// registered no crossTenant/systemScope override — a SystemAdmin acting in
+// registered no escapeHatch/systemScope override — a SystemAdmin acting in
 // tenant A saw only tenant A's export jobs, never tenant B's.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -94,7 +94,12 @@ describe("privacy-center screen (fw#2312 projectionDetail conversion)", () => {
     expect(screen?.type).toBe("projectionDetail");
     if (screen?.type === "projectionDetail") {
       expect(screen.query).toBe("user:query:user:me");
-      expect(screen.access).toEqual({ openToAll: true });
+      expect(screen.access).toEqual({
+        openToAll: {
+          reason:
+            "each signed-in user manages GDPR self-service actions (export, restriction, deletion) for only their own account; the bound query and every action handler operate on the caller's own userId, and no app role name is portable enough to gate this",
+        },
+      });
     }
   });
 

package/src/user-data-rights/feature.ts

@@ -325,11 +325,8 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
 
     // Self-service screen (Art. 15/17/18/20): export, restriction, deletion
     // in one projectionDetail screen bound to the user's own `me` row. No
-    // r.nav — the app places it in its logged-in area (createKumikoApp's
-    // missing-client-plugin boot diagnostic (#2025/#2034) only scans
-    // type: "custom" screens, so a non-navved projectionDetail never
-    // triggers it — no `dormant` flag needed, that field doesn't exist on
-    // this screen type). access is openToAll because no app role name is
+    // r.nav — the app places it in its logged-in area; `dormant: true` opts
+    // it out of the nav-area boot check. access is openToAll because no app role name is
     // portable; the per-user handlers enforce auth server-side.
     //
     // Restriction/Deletion are declarative fields + actions; Export stays a
@@ -344,7 +341,15 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       type: "projectionDetail",
       query: USER_ME_QUERY,
       singleton: true,
-      access: { openToAll: true },
+      access: {
+        openToAll: {
+          reason:
+            "each signed-in user manages GDPR self-service actions (export, restriction, " +
+            "deletion) for only their own account; the bound query and every action handler " +
+            "operate on the caller's own userId, and no app role name is portable enough to gate this",
+        },
+      },
+      dormant: true,
       description:
         "Logged-in GDPR self-service page where a user requests and downloads a data export (Art. 20), restricts processing of their account (Art. 18) and requests its deletion (Art. 17).",
       fieldLabels: {

package/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -22,7 +22,13 @@ const APPEND_LIFECYCLE_EVENT_REASON =
 export const cancelDeletionWrite = defineWriteHandler({
   name: "cancel-deletion",
   schema: z.object({}),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user cancels only their own pending deletion request; the " +
+        "lookup and update are scoped to the caller's own id",
+    },
+  },
   description:
     "Withdraws the calling user's own pending account-deletion request and puts the account back to active, accepted only while the grace period is still running.",
   escapeHatch: {

package/src/user-data-rights/handlers/download-attempt-list.query.ts

@@ -9,7 +9,10 @@ export const downloadAttemptListQuery = defineEntityListHandler(
   downloadAttemptEntity,
   {
     access: { roles: access.systemAdmin },
-    crossTenant: true,
+    escapeHatch: {
+      reason:
+        "SystemAdmin DPO triage of invalid export-download attempts needs every tenant's rows to spot brute-force patterns across tenants",
+    },
     description:
       "Lists invalid export-download attempts across every tenant for the system-admin inspector screen; list-download-attempts is the filterable view scoped to a single tenant.",
   },

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -63,7 +63,13 @@ export const downloadByJobQuery = defineQueryHandler({
   schema: z.object({
     jobId: z.string().min(1, "jobId required"),
   }),
-  access: { openToAll: true }, // openToAll = auth-required, kein anonymous
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user downloads only their own finished export job; the job " +
+        "lookup checks jobRow.userId against the caller's own id and 404s otherwise",
+    },
+  }, // openToAll = auth-required, kein anonymous
   description:
     "Returns a short-lived signed download URL for the calling user's own finished data-export job named by job id, backing the download button in the privacy center once export-status reports the job done.",
   escapeHatch: {