@cosmicdrift/kumiko-bundled-features 0.337.1 → 0.338.0

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable, decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
-import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
+import { definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { subscriptionsProjectionTable } from "../../billing-foundation/index.js";
@@ -21,11 +21,16 @@ function billingLabel(subscription, tierSource) {
 }
 const FILTER_OP = z.enum(["eq", "ne", "lt", "gt", "in"]);
 const SORTABLE_FIELDS = ["name", "tier", "billing"];
-function capTierKey(capId, tier) {
-    return JSON.stringify([capId, tier]);
+function tenantCapKey(tenantId, capId) {
+    return JSON.stringify([tenantId, capId]);
 }
-async function resolveLimitsByCapAndTier(caps, tiers, context) {
-    const entries = await Promise.all(caps.flatMap((cap) => [...tiers].map(async (tier) => [capTierKey(cap.id, tier), await cap.limit(tier, context)])));
+// One config accessor per tenant: limits may read tenant-scoped config keys, so
+// a limit shared across tenants of the same tier would show the wrong value.
+async function resolveLimitsByTenantAndCap(caps, tenants, configFor) {
+    const entries = await Promise.all(tenants.flatMap(({ tenantId, tier }) => {
+        const context = { config: configFor?.(tenantId) };
+        return caps.map(async (cap) => [tenantCapKey(tenantId, cap.id), await cap.limit(tier, context)]);
+    }));
     return new Map(entries);
 }
 function isSortableField(field) {
@@ -183,7 +188,7 @@ export function createTenantCapsListQuery(caps, listCaps) {
                 const perTenantEntries = await Promise.all(pageTenantIds.map(async (tenantId) => [tenantId, await cap.usage(db, tenantId)]));
                 usageByCap.set(cap.id, new Map(perTenantEntries));
             }));
-            const limitByCapAndTier = await resolveLimitsByCapAndTier(listedCaps, new Set(page.map((row) => row.tier)), { config: ctx.config });
+            const limitByTenantAndCap = await resolveLimitsByTenantAndCap(listedCaps, page, ctx.configFor);
             const rows = page.map((row) => {
                 const capFields = {};
                 for (const cap of listedCaps) {
@@ -191,7 +196,7 @@ export function createTenantCapsListQuery(caps, listCaps) {
                     // only an explicit `null` value means "not measured".
                     const rawUsed = usageByCap.get(cap.id)?.get(row.tenantId);
                     const used = rawUsed === undefined ? 0 : rawUsed;
-                    const limit = limitByCapAndTier.get(capTierKey(cap.id, row.tier)) ?? null;
+                    const limit = limitByTenantAndCap.get(tenantCapKey(row.tenantId, cap.id)) ?? null;
                     capFields[capFieldName(cap.id)] =
                         used === null
                             ? { used: null, limit, fraction: 0 }

package/dist/cap-overview/index.d.ts

@@ -1,6 +1,6 @@
-export { MY_CAPS_ACCESS_ROLES } from "./access.js";
+export { DEFAULT_CAP_USAGE_ROLES } from "./access.js";
 export { CAP_CARDS_PANEL_COMPONENT, CAP_OVERVIEW_FEATURE, CAP_USAGE_CELL_COMPONENT, CapOverviewQueries, capFieldName, MY_CAPS_SCREEN_ID, PLATFORM_TENANT_CAPS_SCREEN_ID, TENANT_CAP_LIST_SCREEN_ID, } from "./constants.js";
 export { type CreateCapOverviewOptions, createCapOverviewFeature } from "./feature.js";
-export { createTenantCapListScreen, myCapsScreen, platformTenantCapsScreen, } from "./screens.js";
+export { createMyCapsScreen, createTenantCapListScreen, platformTenantCapsScreen, } from "./screens.js";
 export type { CapSpec, CapUsage, CapUsageTone, CapUsageWithMeta } from "./types.js";
 export { computeFraction, computeTone } from "./usage-math.js";

package/dist/cap-overview/index.js

@@ -1,6 +1,6 @@
 // Public API of the cap-overview bundled-feature.
-export { MY_CAPS_ACCESS_ROLES } from "./access.js";
+export { DEFAULT_CAP_USAGE_ROLES } from "./access.js";
 export { CAP_CARDS_PANEL_COMPONENT, CAP_OVERVIEW_FEATURE, CAP_USAGE_CELL_COMPONENT, CapOverviewQueries, capFieldName, MY_CAPS_SCREEN_ID, PLATFORM_TENANT_CAPS_SCREEN_ID, TENANT_CAP_LIST_SCREEN_ID, } from "./constants.js";
 export { createCapOverviewFeature } from "./feature.js";
-export { createTenantCapListScreen, myCapsScreen, platformTenantCapsScreen, } from "./screens.js";
+export { createMyCapsScreen, createTenantCapListScreen, platformTenantCapsScreen, } from "./screens.js";
 export { computeFraction, computeTone } from "./usage-math.js";

package/dist/cap-overview/screens.d.ts

@@ -1,5 +1,5 @@
 import type { ScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import type { CapSpec } from "./types.js";
 export declare function createTenantCapListScreen(caps: readonly CapSpec[], listCaps: readonly string[], tiers?: readonly string[]): ScreenDefinition;
-export declare const myCapsScreen: ScreenDefinition;
+export declare function createMyCapsScreen(usageRoles: readonly string[]): ScreenDefinition;
 export declare const platformTenantCapsScreen: ScreenDefinition;

package/dist/cap-overview/screens.js

@@ -1,4 +1,3 @@
-import { MY_CAPS_ACCESS_ROLES } from "./access.js";
 import { CAP_CARDS_PANEL_COMPONENT, CAP_USAGE_CELL_COMPONENT, CapOverviewQueries, capFieldName, MY_CAPS_SCREEN_ID, PLATFORM_TENANT_CAPS_SCREEN_ID, TENANT_CAP_LIST_SCREEN_ID, } from "./constants.js";
 // `tiers` has no room for a separate per-tier display label (it's just
 // `readonly string[]`) — tier-engine itself has no enumerated tier list to
@@ -55,21 +54,23 @@ export function createTenantCapListScreen(caps, listCaps, tiers) {
         dormant: true,
     };
 }
-export const myCapsScreen = {
-    id: MY_CAPS_SCREEN_ID,
-    type: "dashboard",
-    panels: [
-        {
-            kind: "custom",
-            id: "cap-cards",
-            component: { react: { __component: CAP_CARDS_PANEL_COMPONENT } },
-        },
-    ],
-    access: { roles: MY_CAPS_ACCESS_ROLES },
-    // No nav wiring yet (see feature.ts header) — no nav area to resolve in
-    // isolation.
-    dormant: true,
-};
+export function createMyCapsScreen(usageRoles) {
+    return {
+        id: MY_CAPS_SCREEN_ID,
+        type: "dashboard",
+        panels: [
+            {
+                kind: "custom",
+                id: "cap-cards",
+                component: { react: { __component: CAP_CARDS_PANEL_COMPONENT } },
+            },
+        ],
+        access: { roles: usageRoles },
+        // No nav wiring yet (see feature.ts header) — no nav area to resolve in
+        // isolation.
+        dormant: true,
+    };
+}
 export const platformTenantCapsScreen = {
     id: PLATFORM_TENANT_CAPS_SCREEN_ID,
     type: "dashboard",

package/dist/config/handlers/set.write.js

@@ -2,7 +2,7 @@ import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { ConfigScopes, defineWriteHandler, isEncryptedAtRest, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { InternalError, isKumikoError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireConfigEncryption, requireSystemDb } from "../feature.js";
 import { MASKED } from "../read-redaction.js";
@@ -14,7 +14,7 @@ const executor = createEventStoreExecutor(configValuesTable, configValueEntity,
 });
 export const setWrite = defineWriteHandler({
     name: "set",
-    description: "Stores a config value for one key at the requested scope (user, tenant or system) after type, bounds and pattern validation, encrypting it when the key declares that; use it to change a setting.",
+    description: "Stores a config value for one key at the requested scope (user, tenant or system) after type, bounds, pattern and the key's own validator, encrypting it when the key declares that; use it to change a setting.",
     schema: z.object({
         key: z.string(),
         value: z.union([z.string(), z.number(), z.boolean()]),
@@ -67,6 +67,22 @@ export const setWrite = defineWriteHandler({
         const patternError = validatePattern(event.payload.value, keyDef);
         if (patternError)
             return writeFailure(patternError);
+        if (keyDef.validate) {
+            try {
+                await keyDef.validate(event.payload.value, {
+                    key: event.payload.key,
+                    scope,
+                    tenantId,
+                    userId,
+                    db,
+                });
+            }
+            catch (error) {
+                if (isKumikoError(error))
+                    return writeFailure(error);
+                throw error;
+            }
+        }
         // The batch idempotency cache stores this result and only masks entity
         // writeOnly fields, so an at-rest-encrypted value must not be echoed.
         const echoedValue = isEncryptedAtRest(keyDef) ? MASKED : event.payload.value;

package/dist/crypto-shredding/feature.js

@@ -8,8 +8,9 @@ export function createCryptoShreddingFeature() {
             displayLabel: "Crypto-Shredding",
             category: "compliance",
         });
-        // `reason` is operator free text and may name the subject; encrypting it under
-        // the subject key is pointless (that key is being erased) — see #2776.
+        // `reason` is operator free text and may name the subject, yet stays plaintext: the forget
+        // erases the subject key before the audit append, so a forget of the actor's own tenant
+        // would fail to seal the reason under that tenant's key.
         r.defineEvent("subject-forgotten", subjectForgottenSchema, { piiFields: "none" });
         r.defineEvent("forget-denied", subjectForgetDeniedSchema, { piiFields: "none" });
         r.writeHandler(forgetSubjectWrite);

package/dist/crypto-shredding/handlers/forget-subject.write.d.ts

@@ -21,7 +21,7 @@ export declare const subjectForgottenSchema: z.ZodObject<{
     forgottenBy: z.ZodString;
 }, z.core.$strip>;
 export declare const subjectForgetDeniedSchema: z.ZodObject<{
-    subjectKeyDigest: z.ZodString;
+    subjectKeyDigest: z.ZodOptional<z.ZodString>;
     subjectKind: z.ZodEnum<{
         record: "record";
         tenant: "tenant";

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -1,8 +1,7 @@
-import { createHash } from "node:crypto";
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
-import { configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { nullBlindIndexesForSubject, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "@cosmicdrift/kumiko-framework/db";
+import { computeBlindIndex, configuredBlindIndexKey, configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
+import { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
@@ -26,7 +25,7 @@ export const subjectForgottenSchema = z.object({
     forgottenBy: z.string().min(1),
 });
 export const subjectForgetDeniedSchema = z.object({
-    subjectKeyDigest: z.string().min(1),
+    subjectKeyDigest: z.string().min(1).optional(),
     subjectKind: z.enum(["user", "tenant", "record"]),
     reason: z.string().min(10),
     forgottenBy: z.string().min(1),
@@ -78,13 +77,20 @@ async function resolveTenantScopeDenial(db, features, user, raw) {
         if (!features.has("tenant"))
             return undefined;
         const entity = findRegisteredEntity(features, raw.entity);
-        if (!entity) {
-            return writeFailure(new AccessDeniedError({ details: { reason: RECORD_ENTITY_NOT_REGISTERED } }));
+        const rowInTenant = entity !== undefined &&
+            (await recordRowExistsInTenant(db, features, raw.entity, raw.id, user.tenantId));
+        if (rowInTenant)
+            return undefined;
+        // A deleted row or a custom aggregate without an entity has no projection
+        // row to check; its event stream still proves which tenant owns it.
+        if (await recordEventsOwnedExclusivelyByTenant(db, raw.entity, raw.id, user.tenantId)) {
+            return undefined;
         }
-        const ownedInTenant = await recordRowExistsInTenant(db, features, raw.entity, raw.id, user.tenantId);
-        return ownedInTenant
-            ? undefined
-            : writeFailure(new AccessDeniedError({ details: { reason: TARGET_RECORD_NOT_ADMIN_TENANT } }));
+        return writeFailure(new AccessDeniedError({
+            details: {
+                reason: entity ? TARGET_RECORD_NOT_ADMIN_TENANT : RECORD_ENTITY_NOT_REGISTERED,
+            },
+        }));
     }
     // Without the tenant feature there's no membership table to check against —
     // no scoping concept exists to enforce (single/no-tenant apps only;
@@ -160,15 +166,19 @@ async function appendDenialAuditEvent(ctx, event, subjectKey, subjectKind, denia
             message: `[crypto-shredding] event "${SUBJECT_FORGET_DENIED_EVENT_NAME}" is not registered.`,
         }));
     }
+    const blindIndexKey = configuredBlindIndexKey();
     const payload = subjectForgetDeniedSchema.parse({
         // The denial lands in the REQUESTING actor's own tenant-scoped stream —
         // it must never materialise the foreign subject's identifiers there. A
         // plaintext subjectKey/aggregateId would survive as a permanent record
         // for the prober and would still be present when the owning tenant
         // later runs its own (legitimate) forget-subject for that subject. The
-        // digest still lets an operator correlate repeated probes of the same
-        // subject without exposing it (fw#2452).
-        subjectKeyDigest: createHash("sha256").update(subjectKey, "utf8").digest("base64url"),
+        // digest is keyed (a bare hash of a guessable id could be recomputed from
+        // a candidate id) and lets an operator correlate repeated probes of the
+        // same subject; without a blind-index key no digest is stored at all.
+        ...(blindIndexKey !== undefined && {
+            subjectKeyDigest: computeBlindIndex(blindIndexKey, subjectKey),
+        }),
         subjectKind,
         reason: event.payload.reason,
         forgottenBy: event.user.id,
@@ -216,6 +226,7 @@ export const forgetSubjectWrite = defineWriteHandler({
     // not be able to reach it at all.
     agent: { expose: false, risk: "high" },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: "denial audit append names the prober's own tenant stream on the outside-transaction db; " +
             "the tenant-scope and retention checks run against the subject's tenant, not necessarily the caller's; " +
             "the blind-index sweep and search purge address the subject across tenants; the user " +

package/dist/custom-fields/feature.js

@@ -136,12 +136,15 @@ export function resolveFieldDefinitionListRoles(opts) {
     if (opts.valueWriteRoles === undefined && opts.fieldDefinitionWriteRoles === undefined) {
         return DEFAULT_FIELD_DEFINITION_LIST_ROLES;
     }
-    // Write-roles override replaces the default role vocab — don't keep unioning
-    // TenantAdmin onto list when the app opted into its own write roles.
-    if (opts.fieldDefinitionWriteRoles !== undefined) {
-        return [...new Set([...(opts.valueWriteRoles ?? []), ...opts.fieldDefinitionWriteRoles])];
-    }
-    return [...new Set([...(opts.valueWriteRoles ?? []), ...DEFAULT_FIELD_DEFINITION_LIST_ROLES])];
+    // The default stays in the union: with valueWriteRoles unset, TenantAdmin still
+    // saves values and must be able to load the FormSection.
+    return [
+        ...new Set([
+            ...(opts.valueWriteRoles ?? []),
+            ...(opts.fieldDefinitionWriteRoles ?? []),
+            ...DEFAULT_FIELD_DEFINITION_LIST_ROLES,
+        ]),
+    ];
 }
 // Backwards-compat-wrapper. Bestehende Caller (z.B. integration-tests,
 // host-apps) nutzen weiterhin `createCustomFieldsFeature()`. Returnt den

package/dist/custom-fields/handlers/clear-custom-field.write.js

@@ -26,6 +26,7 @@ export const clearCustomFieldHandler = {
     access: { roles: DEFAULT_VALUE_WRITE_ROLES },
     description: "Removes the stored value of one custom field from a single host entity row after re-checking that field's per-field write roles; use it to blank a field the user emptied instead of writing a null value.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: CLEAR_CUSTOM_FIELD_REASON,
     },
     handler: async (event, ctx) => {

package/dist/custom-fields/handlers/define-tenant-field.write.js

@@ -15,6 +15,7 @@ export function createDefineTenantFieldHandler(opts = {}) {
         access: { roles: opts.roles ?? DEFAULT_FIELD_DEFINITION_WRITE_ROLES },
         description: "Creates a custom-field definition owned by the caller's own tenant on the named entity, rejecting the write once the tenant's definition quota is reached; use it when one tenant needs an extra field the other tenants must not see.",
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: DEFINE_TENANT_FIELD_REASON,
         },
         handler: async (event, ctx) => {

package/dist/custom-fields/handlers/set-custom-field.write.js

@@ -49,6 +49,7 @@ export const setCustomFieldHandler = {
     access: { roles: DEFAULT_VALUE_WRITE_ROLES },
     description: "Stores one custom-field value on a single host entity row after validating it against the field definition's declared type and per-field write roles; use it to save what a user entered into a custom field.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: SET_CUSTOM_FIELD_REASON,
     },
     handler: async (event, ctx) => {

package/dist/delivery/delivery-service.js

@@ -88,16 +88,18 @@ export function createDeliveryService(options) {
             sink: escapeHatchAuditSink,
             log,
         });
-        // Mirrors buildHandlerContext (pipeline/dispatch-shared.ts): a non-systemScope
-        // tenantUserIdsQuery must get the same tenant-filtered db/no-systemDb context
-        // the real dispatcher would give it — handing it "system" mode + a systemDb
-        // view regardless would grant cross-tenant reach the dispatcher never would.
+        // ctx.db/dbOutsideTransaction are tenant-filtered even for a systemScope handler:
+        // the dispatcher closes them off entirely there, so "system" mode would hand this
+        // path a cross-tenant read the dispatcher never allows. Cross-tenant reach only
+        // exists through the grant-carrying systemDb view below.
         const isSystem = registry.isHandlerSystemScoped(tenantUserIdsQuery);
-        const tenantDb = createTenantDb(db, tenantId, isSystem ? "system" : "tenant", undefined, undefined, undefined, { report });
+        const tenantDb = createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
+            report,
+        });
         // The dispatcher grants a systemScope handler's ctx.systemDb.unsafeRaw() ungated —
         // the grant comes from the handler's own r.systemScope() registration, not from this
-        // caller. ctx.db/dbOutsideTransaction stay on the grant-less tenantDb above; only the
-        // systemDb view's own source TenantDb carries the grant, so it can't leak onto ctx.db.
+        // caller. Only the systemDb view's own source TenantDb carries the grant, so it
+        // can't leak onto ctx.db.
         const systemDbSourceTenantDb = isSystem
             ? createTenantDb(db, tenantId, "system", undefined, undefined, undefined, {
                 report,

package/dist/document-ingest-foundation/feature.js

@@ -114,8 +114,9 @@ export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) =
         write: access.roles("TenantAdmin", "SystemAdmin"),
         read: access.roles("TenantAdmin", "SystemAdmin", "User"),
     }));
-    // "fileName" can carry a real person's name; the payload has no user-subject
-    // field to encrypt it under, so piiFields stays "none" for now.
+    // "fileName" can carry a real person's name, but it reaches both events already as the
+    // fileRef's own self-subject ciphertext (copied from fileRef.created/restored), which
+    // append() passes through; shredding the fileRef's key shreds it here too.
     r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema, {
         piiFields: "none",
         version: 2,

package/dist/form-draft/handlers/discard.write.js

@@ -29,6 +29,7 @@ export const discardDraftWrite = defineWriteHandler({
     description: "Deletes the calling user's draft for one draftKey and, when releaseFiles is set, hard-deletes the file references that draft alone uploaded; use it after a successful submit or when the user abandons the form.",
     agent: { risk: "high" },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: DISCARD_DRAFT_FILE_REFS_REASON,
     },
     handler: async (event, ctx) => {

package/dist/form-draft/handlers/save.write.js

@@ -27,6 +27,7 @@ export const saveDraftWrite = defineWriteHandler({
     access: FORM_DRAFT_ACCESS,
     description: "Upserts the calling user's draft for one draftKey with the given form values and step index, stamping savedAt server-side and refusing a brand-new draft once the per-owner draft cap is reached; use it to persist an in-progress form before the real entity exists.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: SAVE_DRAFT_COUNT_REASON,
     },
     handler: async (event, ctx) => {

package/dist/inbound-mail-foundation/handlers/ingest-message.write.js

@@ -91,6 +91,7 @@ export const ingestMessageHandler = {
     access: { roles: ["SystemAdmin"] },
     agent: { expose: false },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: THREAD_ROLLUP_ADVISORY_LOCK_REASON,
     },
     handler: async (event, ctx) => {

package/dist/managed-pages/handlers/set.write.js

@@ -38,6 +38,7 @@ export const setWrite = defineWriteHandler({
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
     description: "Creates or overwrites one managed page addressed by slug and language, keeping the existing published flag, description and OG image when the payload omits them; use it for content edits and publish toggles, and as SystemAdmin to write another tenant's pages.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: SET_PAGE_TENANT_OVERRIDE_REASON,
     },
     handler: async (event, ctx) => {

package/dist/notes-history/executor.d.ts

@@ -1,2 +1,4 @@
+import { type EntityDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export declare const noteEntryExecutor: import("@cosmicdrift/kumiko-types/event-store-executor-types").EventStoreExecutor, noteEntryTable: import("@cosmicdrift/kumiko-framework/db").EntityTable;
+export declare function createNoteEntryExecutor(ownership: EntityDefinition["access"] | undefined): typeof noteEntryExecutor;
 export declare const noteMentionExecutor: import("@cosmicdrift/kumiko-types/event-store-executor-types").EventStoreExecutor, noteMentionTable: import("@cosmicdrift/kumiko-framework/db").EntityTable;

package/dist/notes-history/executor.js

@@ -1,4 +1,12 @@
 import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
-import { noteEntryEntity, noteMentionEntity } from "./entity.js";
+import { createNoteEntryEntity, noteEntryEntity, noteMentionEntity } from "./entity.js";
 export const { executor: noteEntryExecutor, table: noteEntryTable } = createEntityExecutor("note-entry", noteEntryEntity);
+// Carries only `ownership.write`: the executor enforces entity.access.write on
+// create, while read ownership is applied by the list handler.
+export function createNoteEntryExecutor(ownership) {
+    if (ownership?.write === undefined)
+        return noteEntryExecutor;
+    return createEntityExecutor("note-entry", createNoteEntryEntity({ write: ownership.write }))
+        .executor;
+}
 export const { executor: noteMentionExecutor, table: noteMentionTable } = createEntityExecutor("note-mention", noteMentionEntity);

package/dist/notes-history/feature.d.ts

@@ -19,9 +19,8 @@ export type NotesHistoryFeatureOptions = {
      *  it is AND-ed with the host-visibility gate, never a replacement for it.
      *
      *  `ownership.write` is separate and does NOT affect list/read. It's
-     *  consulted by the framework's generic delete/forget/restore paths (not
-     *  by this feature's own add-note handler — see createNotesHistoryFeature's
-     *  boot-guard comment). A `from()` rule there also gates GDPR erasure
+     *  consulted on add-note (create) and the framework's generic
+     *  forget/restore paths. A `from()` rule there also gates GDPR erasure
      *  (`forget`): if the rule's role map doesn't cover whatever role the
      *  erasure/retention pipeline runs as, `forget` denies instead of
      *  crypto-shredding — a silent Art.17 failure, not a thrown error. Make

package/dist/notes-history/feature.js

@@ -16,6 +16,7 @@ import { defineEntityListHandler, defineFeature, } from "@cosmicdrift/kumiko-fra
 import { hasWhereRule } from "../shared/index.js";
 import { DEFAULT_NOTES_HISTORY_ACCESS, NOTES_HISTORY_FEATURE_NAME } from "./constants.js";
 import { createNoteEntryEntity, noteMentionEntity } from "./entity.js";
+import { createNoteEntryExecutor } from "./executor.js";
 import { createAddNoteHandler } from "./handlers/add-note.write.js";
 import { NOTES_HISTORY_FEATURE_I18N } from "./i18n.js";
 function registerNotesHistory(r, access, ownership, parents) {
@@ -33,7 +34,7 @@ function registerNotesHistory(r, access, ownership, parents) {
     // just building it inline in the handler) is what makes it visible to the
     // registry-wide GDPR boot guards and to executor.ts's table/projection setup.
     r.entity("note-mention", noteMentionEntity);
-    r.writeHandler(createAddNoteHandler(access));
+    r.writeHandler(createAddNoteHandler(access, createNoteEntryExecutor(ownership)));
     r.queryHandler(defineEntityListHandler("note-entry", entity, {
         access,
         description: "Lists note-history entries of the caller's tenant with their text, author and timestamp; filter on entityId to read the full note trail of one record.",

package/dist/notes-history/handlers/add-note.write.d.ts

@@ -1,3 +1,4 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-export declare function createAddNoteHandler(access?: AccessRule): WriteHandlerDef;
+import { noteEntryExecutor } from "../executor.js";
+export declare function createAddNoteHandler(access?: AccessRule, entryExecutor?: typeof noteEntryExecutor): WriteHandlerDef;
 export declare const addNoteHandler: WriteHandlerDef;

package/dist/notes-history/handlers/add-note.write.js

@@ -1,5 +1,7 @@
 import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
+import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { decryptStoredPii, denyUnlessJoinRowParentVisible } from "../../shared/index.js";
+import { tenantMembershipsTable } from "../../tenant/index.js";
 import { userTable } from "../../user/index.js";
 import { DEFAULT_NOTES_HISTORY_ACCESS } from "../constants.js";
 import { noteEntryExecutor, noteMentionExecutor } from "../executor.js";
@@ -17,13 +19,14 @@ const READ_AUTHOR_DISPLAY_NAME_REASON = "reads the author's displayName from the
 // Both the field names and the optional `parents` allowlist come from the
 // entity's own `parentRef` declaration, which the read gate reads too —
 // see shared/parent-visibility.ts.
-export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS) {
+export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS, entryExecutor = noteEntryExecutor) {
     return {
         name: "add-note",
         schema: addNotePayloadSchema,
         access,
         description: "Appends a note to one host entity's history, stamping the author from the authenticated caller rather than the payload; use it for every remark and correction alike, because entries can never be edited or removed afterwards.",
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: READ_AUTHOR_DISPLAY_NAME_REASON,
         },
         handler: async (event, ctx) => {
@@ -31,6 +34,20 @@ export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS) {
             const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "note-entry", payload, event.user, ctx.db);
             if (denied)
                 return denied;
+            // A mention of a non-member would leave a note body about that person out of reach of
+            // their forget run, which only visits the tenants they are a member of.
+            const mentionedUserIds = [...new Set(payload.mentions ?? [])];
+            if (mentionedUserIds.length > 0) {
+                const memberRows = await ctx.db.selectMany(tenantMembershipsTable, {
+                    userId: { in: mentionedUserIds },
+                });
+                const memberIds = new Set(memberRows.map((row) => row.userId));
+                if (mentionedUserIds.some((userId) => !memberIds.has(userId))) {
+                    return writeFailure(new ValidationError({
+                        fields: [{ path: "mentions", code: "custom", i18nKey: "errors.validation.custom" }],
+                    }));
+                }
+            }
             let authorName = null;
             try {
                 // read_users is tenant-agnostic → ctx.db.unsafeRaw, not the tenant-scoped ctx.db.
@@ -54,13 +71,13 @@ export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS) {
                 authorName = null;
             }
             const { mentions, ...notePayload } = payload;
-            const created = await noteEntryExecutor.create({ ...notePayload, authorId: event.user.id, authorName }, event.user, ctx.db);
+            const created = await entryExecutor.create({ ...notePayload, authorId: event.user.id, authorName }, event.user, ctx.db);
             if (!created.isSuccess)
                 return created;
             // Same tx as the note create above (ctx.db) — a mention-row failure
             // rolls the note back with it, same as the framework's own nested-write
             // parent+child pattern (dispatch-write.ts).
-            for (const subjectId of new Set(mentions ?? [])) {
+            for (const subjectId of mentionedUserIds) {
                 const mentionResult = await noteMentionExecutor.create({ noteId: created.data.id, subjectId }, event.user, ctx.db);
                 if (!mentionResult.isSuccess)
                     return mentionResult;

package/dist/notes-history-user-data/hooks.js

@@ -93,12 +93,30 @@ export const noteEntryDeleteHook = async (ctx) => {
         });
     }
 };
-// note-mention rows are a plain (noteId, subjectId) pointer — like authorId
-// on note-entry, `subjectId`'s `personal: "ref"` annotation exists for the
-// GDPR-hook-coverage boot guard, not because the row itself holds separately
-// exportable content or needs its own physical erasure: forgetting the
-// mentioned user's data is already handled by noteEntryDeleteHook shredding
-// the mentioned NOTE's row-subject key above. Registered here only so the V3
-// boot guard (validateGdprPiiHookCoverage) sees a hook for "note-mention".
-export const noteMentionExportHook = async () => null;
+// Erasure reaches every note that structurally mentions the user (see
+// noteEntryDeleteHook), so the Art. 15/20 export must list those notes too.
+export const noteMentionExportHook = async (ctx) => {
+    const mentions = await ctx.db.selectMany(noteMentionTable, {
+        subjectId: ctx.userId,
+    });
+    if (mentions.length === 0)
+        return null;
+    const noteIds = [...new Set(mentions.map((m) => m.noteId))];
+    const notes = await ctx.db.selectMany(noteEntryTable, { id: { in: noteIds } });
+    if (notes.length === 0)
+        return null;
+    return {
+        entity: "note-mention",
+        rows: notes.map((note) => ({
+            noteId: note["id"],
+            entityType: note["entityType"],
+            entityId: note["entityId"],
+            body: note["body"],
+            insertedAt: note["insertedAt"],
+        })),
+    };
+};
+// note-mention rows are a plain (noteId, subjectId) pointer: forgetting the mentioned
+// user's data is already handled by noteEntryDeleteHook shredding the mentioned NOTE's
+// row-subject key, so this delete hook has nothing of its own to erase.
 export const noteMentionDeleteHook = async () => { };

package/dist/sessions/handlers/revoke-all-for-user.write.js

@@ -37,6 +37,7 @@ export const revokeAllForUserWrite = defineWriteHandler({
     description: "Irreversibly signs a named user out of all their live sessions, across every tenant unless a tenantId narrows it, optionally sparing one session (exceptSessionId); use it for operator actions such as freezing or banning an account, or a role change that must not end the editor's own session.",
     agent: { risk: "high" },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: REVOKE_ALL_SESSIONS_REASON,
     },
     handler: async (event, ctx) => {

package/dist/subscription-mollie/plugin-methods.js

@@ -49,6 +49,7 @@ export function createMollieCheckoutSession(client, priceToConfig, appWebhookUrl
             metadata: {
                 tenantId: options.tenantId,
                 priceId: options.priceId,
+                ...(options.consentId && { consentId: options.consentId }),
             },
         })); // @cast-boundary engine-bridge
         const checkoutHref = payment.getCheckoutUrl();