@cosmicdrift/kumiko-bundled-features 0.320.0 → 0.322.0

package/src/tenant-handover/__tests__/claim.integration.test.ts

@@ -20,8 +20,13 @@ import {
   type EntityDefinition,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  AGGREGATE_TRANSFER_STREAM_TYPE,
+  AGGREGATE_TRANSFERRED_EVENT_TYPE,
+  loadAggregate,
+} from "@cosmicdrift/kumiko-framework/event-store";
 import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   createTestUser,
   setupTestStack,
@@ -387,7 +392,7 @@ async function seedFileRef(
   tenantId: TenantId,
   entityType: string,
   entityId: string,
-): Promise<void> {
+): Promise<string> {
   const user = createSystemUser(tenantId);
   const db = createTenantDb(stack.db, tenantId, "system");
   const result = await fileRefCrud.create(
@@ -404,6 +409,7 @@ async function seedFileRef(
     db,
   );
   if (!result.isSuccess) throw new Error(`seedFileRef failed: ${result.error.message}`);
+  return String(result.data.id);
 }
 
 function grantFor(rowId: string): string {
@@ -429,8 +435,8 @@ describe("tenant-handover :: claim", () => {
   test("claims the root, its parentRef-linked child, and both attached files into the caller's tenant, leaving an unrelated run of the same type untouched", async () => {
     const runId = await seedRun(SOURCE_TENANT, "my run");
     const photoId = await seedPhoto(SOURCE_TENANT, runId, "front");
-    await seedFileRef(SOURCE_TENANT, "run", runId);
-    await seedFileRef(SOURCE_TENANT, "photo", photoId);
+    const runFileRefId = await seedFileRef(SOURCE_TENANT, "run", runId);
+    const photoFileRefId = await seedFileRef(SOURCE_TENANT, "photo", photoId);
 
     // A second, unrelated run of the SAME entity type, still in the source
     // tenant — proves the claim moves only the identified run's rows, not
@@ -491,6 +497,58 @@ describe("tenant-handover :: claim", () => {
     // The unrelated run (same entity type, different row) never moved.
     expect(await readTenantId("handover_run", otherRunId)).toBe(SOURCE_TENANT);
     expect(await readTenantId("handover_photo", otherPhotoId)).toBe(SOURCE_TENANT);
+
+    // The event store's own transfer primitive left its own audit trail too:
+    // exactly one aggregate.transferred system event per moved aggregate,
+    // landed in the destination tenant.
+    const transferEvents = await executeRawQuery<{ payload: Record<string, unknown> }>(
+      stack.db,
+      `SELECT payload FROM kumiko_events WHERE tenant_id = $1 AND aggregate_type = $2 AND type = $3`,
+      [dest.tenantId, AGGREGATE_TRANSFER_STREAM_TYPE, AGGREGATE_TRANSFERRED_EVENT_TYPE],
+    );
+    expect(transferEvents).toHaveLength(4);
+    const byMovedAggregateId = new Map(
+      transferEvents.map((row) => [row.payload["aggregateId"], row.payload]),
+    );
+    for (const [aggregateId, aggregateType] of [
+      [runId, "run"],
+      [photoId, "photo"],
+      [runFileRefId, "fileRef"],
+      [photoFileRefId, "fileRef"],
+    ] as const) {
+      expect(byMovedAggregateId.get(aggregateId)).toMatchObject({
+        aggregateType,
+        aggregateId,
+        sourceTenantId: SOURCE_TENANT,
+        destinationTenantId: dest.tenantId,
+      });
+    }
+
+    // A projection rebuild of the root entity after the claim still resolves
+    // it under the destination tenant with the same content — the transfer
+    // didn't leave the projection and the event store out of sync.
+    await rebuildProjection("handover-fixtures:projection:run-entity", {
+      db: stack.db,
+      registry: stack.registry,
+    });
+    expect(await readTenantId("handover_run", runId)).toBe(dest.tenantId);
+    const rebuiltRow = await executeRawQuery<{ name: string }>(
+      stack.db,
+      `SELECT name FROM handover_run WHERE id = $1`,
+      [runId],
+    );
+    expect(rebuiltRow[0]?.name).toBe("my run");
+
+    // The event store's version bookkeeping survived the move: a normal
+    // write against the claimed root in its new tenant still succeeds.
+    const destDb = createTenantDb(stack.db, dest.tenantId, "system");
+    const destUser = createSystemUser(dest.tenantId);
+    const followUpWrite = await runCrud.update(
+      { id: runId, version: 1, changes: { name: "renamed after claim" } },
+      destUser,
+      destDb,
+    );
+    expect(followUpWrite.isSuccess).toBe(true);
   });
 
   // kumiko-framework#3088: before this, resolveChildCandidates only knew

package/src/tenant-handover/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.321.0",
+    "type": "improvement",
+    "title": "Claim now moves event-store ownership through transferAggregateStreams instead of raw SQL",
+    "detail": "move-entity-graph.ts no longer runs its own `UPDATE kumiko_events` /\n`UPDATE kumiko_snapshots` against the event store — it calls the\nframework's `transferAggregateStreams` per aggregate type, threading the\nclaiming user's id as `transferredBy`. Archive markers now move with the\nstream (previously left behind under the source tenant). Each moved\naggregate gets its own `kumiko:system:aggregate.transferred` audit event\nin the destination tenant, in addition to the existing\n`tenant-handover:event:claimed` summary event.",
+    "migration": "No action needed — the claim API and its response shape are unchanged."
+  },
   {
     "version": "0.313.0",
     "type": "fix",

package/src/tenant-handover/handlers/claim.write.ts

@@ -82,6 +82,7 @@ export function createClaimTenantHandoverHandler(opts: ClaimTenantHandoverOption
             rootRowId: subject,
             sourceTenantId: expectedAnchor,
             destinationTenantId,
+            transferredBy: event.user.id,
           });
 
           // Own aggregate, decoupled from the transferred root's stream (see

package/src/tenant-handover/move-entity-graph.ts

@@ -1,9 +1,12 @@
 // The actual ownership change (kumiko-framework#3035): raw SQL against the
-// event store + read-model tables, because moving a row across the tenant
-// boundary is exactly the kind of write the framework's entity write map
-// cannot express (it is single-tenant-scoped by design — that boundary is
-// the whole point of `assertTenantMatch`). This is the framework's OWN
-// declared operation, not a consumer's `acknowledgeCrossTenant` escape.
+// read-model tables, because moving a row across the tenant boundary is
+// exactly the kind of write the framework's entity write map cannot express
+// (it is single-tenant-scoped by design — that boundary is the whole point
+// of `assertTenantMatch`). This is the framework's OWN declared operation,
+// not a consumer's `acknowledgeCrossTenant` escape. The event-store side of
+// the move (kumiko_events/kumiko_snapshots/kumiko_archived_streams) is the
+// framework's own `transferAggregateStreams` primitive
+// — see event-store/transfer.ts for why that boundary is owned there instead.
 //
 // Every statement here runs inside the calling write handler's own
 // transaction (HandlerContext.db is transaction-scoped for the handler's
@@ -28,12 +31,11 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import { MAX_TRANSFER_DEPTH, type Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
+import { transferAggregateStreams } from "@cosmicdrift/kumiko-framework/event-store";
 import { transferTenantStorageUsage } from "@cosmicdrift/kumiko-framework/files";
 import { resolveTransferAdjacency, type TransferEdge } from "./transfer-graph";
 
 const FILE_REFS_TABLE = "file_refs";
-const EVENTS_TABLE = "kumiko_events";
-const SNAPSHOTS_TABLE = "kumiko_snapshots";
 
 // The commitAnchor statement itself: spends the anchor (WHERE tenant_id =
 // expected) AND performs the ownership write (SET tenant_id = destination)
@@ -57,34 +59,6 @@ export async function moveRootRow(args: {
   return rows.length === 1;
 }
 
-async function moveEventHistory(args: {
-  readonly db: DbRunner;
-  readonly aggregateType: string;
-  readonly aggregateIds: readonly string[];
-  readonly sourceTenantId: string;
-  readonly destinationTenantId: string;
-}): Promise<void> {
-  // skip: an empty id list has nothing to move — both callers already
-  // filter to a non-empty list before calling, this only guards a future
-  // caller that forgets to.
-  if (args.aggregateIds.length === 0) return;
-  await executeRawQuery(
-    args.db,
-    `UPDATE ${EVENTS_TABLE} SET tenant_id = $1 ` +
-      `WHERE tenant_id = $2 AND aggregate_type = $3 AND aggregate_id = ANY($4)`,
-    [args.destinationTenantId, args.sourceTenantId, args.aggregateType, args.aggregateIds],
-  );
-  // Snapshots are a pure read-performance cache (event-store/snapshot.ts) —
-  // dropped rather than rewritten, forcing a full replay from the just-moved
-  // events on next read instead of carrying the snapshot's own generation
-  // bookkeeping across the tenant boundary.
-  await executeRawQuery(
-    args.db,
-    `DELETE FROM ${SNAPSHOTS_TABLE} WHERE tenant_id = $1 AND aggregate_id = ANY($2)`,
-    [args.sourceTenantId, args.aggregateIds],
-  );
-}
-
 // Moves the file_refs row itself PLUS the fileRef aggregate's own event
 // history + storage-usage counters — fileRef is a standard ES entity (see
 // files-storage-tracking.md), so without those two follow-ups a later write
@@ -98,6 +72,7 @@ async function moveFileRefs(args: {
   readonly entityIds: readonly string[];
   readonly sourceTenantId: string;
   readonly destinationTenantId: string;
+  readonly transferredBy: string;
 }): Promise<number> {
   if (args.entityIds.length === 0) return 0;
   const rows = await executeRawQuery<{ id: string }>(
@@ -109,8 +84,8 @@ async function moveFileRefs(args: {
   const movedIds = rows.map((row) => row.id);
   if (movedIds.length === 0) return 0;
 
-  // Must run before moveEventHistory rewrites these events' tenant_id — see
-  // transferTenantStorageUsage's own comment for why.
+  // Must run before transferAggregateStreams rewrites these events' tenant_id —
+  // see transferTenantStorageUsage's own comment for why.
   await transferTenantStorageUsage({
     db: args.db,
     registry: args.registry,
@@ -118,12 +93,12 @@ async function moveFileRefs(args: {
     sourceTenantId: args.sourceTenantId,
     destinationTenantId: args.destinationTenantId,
   });
-  await moveEventHistory({
-    db: args.db,
+  await transferAggregateStreams(args.db, {
     aggregateType: "fileRef",
     aggregateIds: movedIds,
     sourceTenantId: args.sourceTenantId,
     destinationTenantId: args.destinationTenantId,
+    transferredBy: args.transferredBy,
   });
   return movedIds.length;
 }
@@ -237,8 +212,17 @@ export async function moveTransferGraph(args: {
   readonly rootRowId: string;
   readonly sourceTenantId: string;
   readonly destinationTenantId: string;
+  readonly transferredBy: string;
 }): Promise<Readonly<Record<string, number>>> {
-  const { db, registry, rootEntityName, rootRowId, sourceTenantId, destinationTenantId } = args;
+  const {
+    db,
+    registry,
+    rootEntityName,
+    rootRowId,
+    sourceTenantId,
+    destinationTenantId,
+    transferredBy,
+  } = args;
   const movedCounts: Record<string, number> = { [rootEntityName]: 1 };
   const trackFileMove = (count: number) => {
     // skip: nothing moved (this entity had no attached files) — the audit
@@ -248,12 +232,12 @@ export async function moveTransferGraph(args: {
     movedCounts["fileRef"] = (movedCounts["fileRef"] ?? 0) + count;
   };
 
-  await moveEventHistory({
-    db,
+  await transferAggregateStreams(db, {
     aggregateType: rootEntityName,
     aggregateIds: [rootRowId],
     sourceTenantId,
     destinationTenantId,
+    transferredBy,
   });
   trackFileMove(
     await moveFileRefs({
@@ -263,6 +247,7 @@ export async function moveTransferGraph(args: {
       entityIds: [rootRowId],
       sourceTenantId,
       destinationTenantId,
+      transferredBy,
     }),
   );
 
@@ -317,12 +302,12 @@ export async function moveTransferGraph(args: {
         movedCounts[edge.entityName] = (movedCounts[edge.entityName] ?? 0) + childIds.length;
         discovered.push({ entityName: edge.entityName, rowIds: childIds });
 
-        await moveEventHistory({
-          db,
+        await transferAggregateStreams(db, {
           aggregateType: edge.entityName,
           aggregateIds: childIds,
           sourceTenantId,
           destinationTenantId,
+          transferredBy,
         });
         trackFileMove(
           await moveFileRefs({
@@ -332,6 +317,7 @@ export async function moveTransferGraph(args: {
             entityIds: childIds,
             sourceTenantId,
             destinationTenantId,
+            transferredBy,
           }),
         );
       }

package/src/tenant-settings/__tests__/settings-hub-i18n.test.ts

@@ -14,20 +14,16 @@
 import { describe, expect, test } from "bun:test";
 import { createConfigFeature } from "@cosmicdrift/kumiko-bundled-features/config";
 import { buildConfigFeatureSchema, createRegistry } from "@cosmicdrift/kumiko-framework/engine";
+import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-types";
 import { localeDeBundle } from "@cosmicdrift/kumiko-locale-de";
 import { localeEsBundle } from "@cosmicdrift/kumiko-locale-es";
-import { translationsByLocaleFromKeys } from "@cosmicdrift/kumiko-renderer";
+import { type TranslationsByKey, translationsByLocaleFromKeys } from "@cosmicdrift/kumiko-renderer";
 import { createTenantSettingsFeature } from "../feature";
 
-function translate(
-  translations: Readonly<Record<string, Readonly<Record<string, string>> | undefined>>,
-  key: string,
-  locale = "en",
-): string {
-  const byLocale = translationsByLocaleFromKeys(
-    translations as Record<string, Readonly<Record<string, string>>>,
-  );
-  return byLocale[locale]?.[key] ?? key;
+function translate(translations: TranslationsByKey, key: string, locale = "en"): string {
+  const byLocale = translationsByLocaleFromKeys(translations);
+  const value = byLocale[locale]?.[key];
+  return value === undefined ? key : translationValueOtherText(value);
 }
 
 function settingsHubLabelKeys(): readonly string[] {

package/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -31,7 +31,9 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
     name: "run-forget-cleanup",
     schema: z.object({}),
     access: { roles: access.privileged },
-    agent: { expose: false },
+    // Cascades into per-user forget hooks that hard-purge (executor.forget)
+    // records without softDelete — an agent must never be able to trigger it.
+    agent: { expose: false, risk: "high" },
     escapeHatch: {
       reason: RUN_FORGET_CLEANUP_REASON,
     },