@cosmicdrift/kumiko-bundled-features 0.354.1 → 0.356.0

package/dist/agent-tools/agent-manifest.js

@@ -163,6 +163,7 @@ function buildHandlerEntry(qn, kind, def, roles, getHandlerEntity, denyQns) {
         return undefined;
     }
     const entity = getHandlerEntity(qn);
+    const excludedFields = "excludedFields" in def ? def.excludedFields : undefined;
     return {
         qn,
         kind,
@@ -170,6 +171,7 @@ function buildHandlerEntry(qn, kind, def, roles, getHandlerEntity, denyQns) {
         risk: exposure.risk,
         inputSchema,
         ...(entity !== undefined && { entity }),
+        ...(excludedFields !== undefined && { excludedFields }),
     };
 }
 function buildHandlers(queryHandlers, writeHandlers, roles, getHandlerEntity, denyQns) {

package/dist/agent-tools/types.d.ts

@@ -130,6 +130,8 @@ export type AgentManifestHandler = {
     readonly risk: AgentRisk;
     readonly inputSchema: Readonly<Record<string, unknown>>;
     readonly entity?: string;
+    /** Fields this generic create/update handler never writes; sending one fails validation. */
+    readonly excludedFields?: readonly string[];
 };
 export type AgentManifestScreen = {
     readonly id: string;

package/dist/audit/escape-hatch-audit-sink.d.ts

@@ -15,6 +15,7 @@ export declare const escapeHatchUsedSchema: z.ZodObject<{
     }>;
     reason: z.ZodString;
     actor: z.ZodString;
+    caller: z.ZodOptional<z.ZodString>;
     targetUserId: z.ZodOptional<z.ZodString>;
     targetTenantId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;

package/dist/audit/escape-hatch-audit-sink.js

@@ -18,6 +18,7 @@ export const escapeHatchUsedSchema = z.object({
     kind: z.enum(escapeHatchKinds),
     reason: z.string(),
     actor: z.string(),
+    caller: z.string().optional(),
     targetUserId: z.string().optional(),
     targetTenantId: z.string().optional(),
 });
@@ -28,6 +29,7 @@ export function createEscapeHatchAuditSink(opts) {
             kind: event.kind,
             reason: event.reason,
             actor: event.actor,
+            ...(event.caller !== undefined && { caller: event.caller }),
             ...(event.target && { targetUserId: event.target.id, targetTenantId: event.target.tenantId }),
         });
         // Appends on the unbound pool, never the handler tx — an audit entry must

package/dist/audit/handlers/resolve-audit-tenant.js

@@ -1,4 +1,5 @@
-import { crossTenantOverrideDenied } from "@cosmicdrift/kumiko-framework/engine";
+import { mayOverrideTenant } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, FrameworkReasons } from "@cosmicdrift/kumiko-framework/errors";
 import { APP_INSTANCE_STREAM_TYPE } from "@cosmicdrift/kumiko-framework/event-store";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
 import { AuditScopes } from "../constants.js";
@@ -7,8 +8,11 @@ import { AuditScopes } from "../constants.js";
 export function resolveAuditScopeFilter(user, scope) {
     if (scope !== AuditScopes.system)
         return { tenantId: user.tenantId };
-    const denied = crossTenantOverrideDenied(user, SYSTEM_TENANT_ID, "audit.errors.systemScopeRequiresSystemAdmin");
-    if (denied)
-        throw denied;
+    if (!mayOverrideTenant(user)) {
+        throw new AccessDeniedError({
+            i18nKey: "audit.errors.systemScopeRequiresSystemAdmin",
+            details: { reason: FrameworkReasons.tenantOverrideRequiresSystemAdmin },
+        });
+    }
     return { tenantId: SYSTEM_TENANT_ID, aggregateType: APP_INSTANCE_STREAM_TYPE };
 }

package/dist/billing-foundation/consumer-protection/register-consent.js

@@ -1,4 +1,3 @@
-import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
 import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../constants.js";
 import { CHECKOUT_CONSENT_RECORDED_EVENT_SHORT, CONTRACT_CONFIRMATION_ISSUED_EVENT_SHORT, checkoutConsentRecordedPayloadSchema, contractConfirmationIssuedPayloadSchema, INVOICE_PAID_EVENT_QN, PAYMENT_RECEIVED_EVENT_QN, SUBSCRIPTION_CREATED_EVENT_QN, SUBSCRIPTION_UPDATED_EVENT_QN, } from "../events.js";
@@ -48,7 +47,7 @@ export function registerConsumerProtection(r, options, consumerProtection) {
             // user), never from payload data.
             const tenantId = ctx.systemUser.tenantId;
             const currentPeriodEndIso = payload["currentPeriodEndIso"];
-            const result = await ctx.writeAs(createSystemUser(tenantId), SubscriptionFoundationHandlers.issueContractConfirmation, {
+            const result = await ctx.write(SubscriptionFoundationHandlers.issueContractConfirmation, {
                 consentId,
                 sourceAggregateId: isSubscriptionEvent
                     ? subscriptionAggregateId(tenantId)

package/dist/billing-foundation/consumer-protection/register-termination.d.ts

@@ -1,3 +1,3 @@
-import { type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+import type { FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
 import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.js";
 export declare function registerContractTermination(r: FeatureRegistrar, options: ResolvedBillingFoundationOptions, consumerProtection: ConsumerProtectionOptions): void;

package/dist/billing-foundation/consumer-protection/register-termination.js

@@ -1,4 +1,3 @@
-import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { SubscriptionCancelTimings, SubscriptionFoundationHandlers } from "../constants.js";
 import { CONTRACT_TERMINATION_DECLARED_EVENT_QN, CONTRACT_TERMINATION_DECLARED_EVENT_SHORT, CONTRACT_TERMINATION_REQUESTED_EVENT_SHORT, CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT, contractTerminationDeclaredPayloadSchema, contractTerminationRequestedPayloadSchema, contractTerminationUnmatchedPayloadSchema, } from "../events.js";
 import { createDeclareContractTerminationHandler, createRecordContractTerminationHandler, createRecordUnmatchedContractTerminationHandler, createTerminableSubscriptionQuery, } from "./termination-record.js";
@@ -22,7 +21,7 @@ export function registerContractTermination(r, options, consumerProtection) {
         // skip: trigger event carries no usable declaration
         if (!declared.success)
             return;
-        const result = await ctx.writeAs(createSystemUser(ctx.systemUser.tenantId), SubscriptionFoundationHandlers.recordContractTermination, {
+        const result = await ctx.write(SubscriptionFoundationHandlers.recordContractTermination, {
             requestId: declared.data.requestId,
             declarationType: declared.data.declarationType,
             terminationKind: declared.data.terminationKind,

package/dist/cap-overview/handlers/caps-usage.query.js

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { defineQueryHandler, mayOverrideTenant, } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, FrameworkReasons, InternalError, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { tierAssignmentEntity } from "../../tier-engine/index.js";
 import { computeFraction, computeTone, computeUnclampedFraction } from "../usage-math.js";
@@ -24,9 +24,12 @@ export function createCapsUsageQuery(caps, usageRoles) {
                 });
             }
             const override = query.payload.tenantId;
-            const overrideDenied = crossTenantOverrideDenied(query.user, override, "cap-overview.errors.tenantOverrideRequiresSystemAdmin");
-            if (overrideDenied)
-                throw overrideDenied;
+            if (override !== undefined && !mayOverrideTenant(query.user)) {
+                throw new AccessDeniedError({
+                    i18nKey: "cap-overview.errors.tenantOverrideRequiresSystemAdmin",
+                    details: { reason: FrameworkReasons.tenantOverrideRequiresSystemAdmin },
+                });
+            }
             const targetTenantId = override ?? query.user.tenantId;
             // Both branches return the SAME unfiltered system-mode db —
             // assertTenantMatch is a self-check on the caller, not a query

package/dist/compliance-profiles/handlers/set-profile.write.js

@@ -1,9 +1,10 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { complianceProfileOverrideSchema, SELECTABLE_PROFILE_KEYS, } from "@cosmicdrift/kumiko-framework/compliance";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { access, crossTenantOverrideDenied, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, validationErrorFromZod, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "../schema/profile-selection.js";
 const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantComplianceProfileEntity, {
     entityName: "tenant-compliance-profile",
@@ -13,24 +14,16 @@ const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantCompli
 // nicht eine waehlbare Production-Option. Symmetrisch zu
 // SELECTABLE_PROFILE_KEYS aus der framework/compliance-Liste.
 const profileKeySchema = z.enum(SELECTABLE_PROFILE_KEYS);
-// Tenant-Admin setzt Profile-Key + optional Override-JSON.
+// Upsert: the first call inserts, later calls update, so repeating the same values
+// is idempotent apart from the extra audit events.
 //
-// Upsert-Verhalten: erste Wahl insert, weitere update. Idempotent —
-// wer mit gleichen Werten zweimal aufruft, kriegt das gleiche Ergebnis
-// (modulo aktualisierte Audit-Events im Event-Store).
+// A SystemAdmin may target another tenant via `tenantIdOverride` (operator setup,
+// onboarding migrations); the dispatcher rejects the override for anyone else. The
+// executor then writes into the target tenant's stream via streamTenantId while
+// the operator stays the recorded actor.
 //
-// Cross-Tenant-Pfad: SystemAdmin kann via `tenantIdOverride` fuer einen
-// anderen Tenant schreiben (Plattform-Operator-Setup, Customer-
-// Onboarding-Migrationen). TenantAdmin's Override-Versuch → 403.
-// executorUser.tenantId muss = ziel-tenant sein damit der event-store-
-// Stream-Lookup nicht miss → version_conflict gibt (Memory:
-// feedback_event_store_tenant_consistency).
-//
-// Validation:
-//   - profileKey muss in SELECTABLE_PROFILE_KEYS sein (Zod-checked)
-//   - override (optional) muss valides JSON-Object sein
-//   - override Top-Level-Keys muessen in ALLOWED_OVERRIDE_KEYS sein
-//     — verhindert Tippfehler die deepMerge stillschweigend ignoriert
+// Override top-level keys are restricted to ALLOWED_OVERRIDE_KEYS because deepMerge
+// would silently ignore a typo.
 export const setProfileWrite = defineWriteHandler({
     name: "set-profile",
     schema: z.object({
@@ -43,12 +36,8 @@ export const setProfileWrite = defineWriteHandler({
     access: { roles: access.admin },
     description: "Sets or replaces a tenant's compliance profile key plus an optional JSON override, for onboarding or a later region change; a system admin may target a different tenant through tenantIdOverride.",
     handler: async (event, ctx) => {
-        const tenantOverride = event.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(event.user, tenantOverride, "complianceProfiles.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            return writeFailure(overrideDenied);
-        const tenantId = (tenantOverride ?? event.user.tenantId); // @cast-boundary engine-payload
-        const executorUser = tenantOverride !== undefined ? { ...event.user, tenantId } : event.user;
+        const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId); // @cast-boundary engine-payload
+        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
         // Override-Validation: muss parseables JSON-Object sein UND dem
         // ComplianceProfileOverride-Schema entsprechen (S1.9 Z3 — strict-Zod
         // mit Top-Level + Sub-Level-Whitelist via .strict()). Tippfehler
@@ -75,7 +64,7 @@ export const setProfileWrite = defineWriteHandler({
             }
         }
         // Upsert: existierenden Eintrag suchen
-        const existing = (await fetchOne(ctx.db, tenantComplianceProfileTable, {
+        const existing = (await fetchOne(db, tenantComplianceProfileTable, {
             tenantId: tenantId,
         })); // @cast-boundary db-runner
         if (existing) {
@@ -86,7 +75,7 @@ export const setProfileWrite = defineWriteHandler({
                     profileKey: event.payload.profileKey,
                     override: event.payload.override ?? null,
                 },
-            }, executorUser, ctx.db);
+            }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -98,7 +87,7 @@ export const setProfileWrite = defineWriteHandler({
             profileKey: event.payload.profileKey,
             override: event.payload.override ?? null,
             tenantId,
-        }, executorUser, ctx.db);
+        }, event.user, db, { streamTenantId });
         if (!result.isSuccess)
             return result;
         return {

package/dist/custom-fields/handlers/define-system-field.write.js

@@ -1,19 +1,14 @@
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { defineOrResurrectFieldDefinition } from "../lib/define-or-resurrect.js";
 import { buildFieldDefinitionColumns } from "../lib/field-definition-row.js";
 import { defineFieldPayloadSchema } from "../schemas.js";
-// define-system-field — SystemAdmin definiert eine system-weite Custom-Field-
-// Definition die für ALLE Tenants gilt. tenantId wird auf SYSTEM_TENANT_ID
-// gesetzt (NICHT vom Caller — SystemAdmin's event.user.tenantId würde sonst
-// auf den admin's eigenen platform-tenant zeigen).
-//
-// **Use-Case:** Vendor (cdgs) sagt "alle Hausverwaltungs-customers haben ab
-// heute ein `internalNumber`-Field". Tenant kann den Wert pro customer
-// setzen, aber die Definition nicht ändern oder löschen.
-//
-// **Same-scope-conflict** wie bei define-tenant-field via aggregate-version-
-// conflict (deterministische ID mit tenantId=SYSTEM_TENANT_ID).
+// A system-wide field definition applies to every tenant. tenantId is forced to
+// SYSTEM_TENANT_ID (never taken from the caller) and addressed via streamTenantId,
+// so the SystemAdmin stays the recorded actor. Tenants can set values for the field
+// but cannot change or delete the definition. A same-scope duplicate surfaces as an
+// aggregate version conflict, because the ID is derived from SYSTEM_TENANT_ID.
 export const defineSystemFieldHandler = {
     name: "define-system-field",
     schema: defineFieldPayloadSchema,
@@ -22,10 +17,7 @@ export const defineSystemFieldHandler = {
     handler: async (event, ctx) => {
         const payload = event.payload; // @cast-boundary engine-payload
         const aggregateId = fieldDefinitionAggregateId(SYSTEM_TENANT_ID, payload.entityName, payload.fieldKey);
-        // Override event.user.tenantId to SYSTEM_TENANT_ID for the system-scope
-        // write. The framework's CrudExecutor writes the row with this tenantId
-        // — the row lives in the system-scope-stream.
-        const systemUser = { ...event.user, tenantId: SYSTEM_TENANT_ID };
-        return defineOrResurrectFieldDefinition(aggregateId, buildFieldDefinitionColumns(payload), systemUser, ctx.db);
+        const { db, streamTenantId } = requireForTenant(ctx, SYSTEM_TENANT_ID);
+        return defineOrResurrectFieldDefinition(aggregateId, buildFieldDefinitionColumns(payload), event.user, db, streamTenantId);
     },
 };

package/dist/custom-fields/handlers/delete-system-field.write.js

@@ -1,4 +1,5 @@
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants.js";
 import { fieldDefinitionExecutor } from "../executor.js";
@@ -18,8 +19,10 @@ export const deleteSystemFieldHandler = {
     handler: async (event, ctx) => {
         const payload = event.payload; // @cast-boundary engine-payload
         const aggregateId = fieldDefinitionAggregateId(SYSTEM_TENANT_ID, payload.entityName, payload.fieldKey);
-        const systemUser = { ...event.user, tenantId: SYSTEM_TENANT_ID };
-        const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, systemUser, ctx.db);
+        const { db, streamTenantId } = requireForTenant(ctx, SYSTEM_TENANT_ID);
+        const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, event.user, db, {
+            streamTenantId,
+        });
         // Cascade-cleanup-Event — host-entity-MSPs entfernen orphan values aus
         // ihrer customFields jsonb. Im selben TX = atomic.
         if (result.isSuccess) {

package/dist/custom-fields/lib/define-or-resurrect.d.ts

@@ -1,7 +1,8 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionExecutor } from "../executor.js";
 import type { FieldDefinitionColumns } from "./field-definition-row.js";
 type DefineUser = Parameters<typeof fieldDefinitionExecutor.create>[1];
 type DefineDb = Parameters<typeof fieldDefinitionExecutor.create>[2];
 type WriteResult = Awaited<ReturnType<typeof fieldDefinitionExecutor.create>>;
-export declare function defineOrResurrectFieldDefinition(aggregateId: string, columns: FieldDefinitionColumns, user: DefineUser, db: DefineDb): Promise<WriteResult>;
+export declare function defineOrResurrectFieldDefinition(aggregateId: string, columns: FieldDefinitionColumns, user: DefineUser, db: DefineDb, streamTenantId?: TenantId): Promise<WriteResult>;
 export {};

package/dist/custom-fields/lib/define-or-resurrect.js

@@ -16,12 +16,16 @@ import { fieldDefinitionExecutor } from "../executor.js";
 // fail with "current transaction is aborted". detail() (a read) + restore()
 // (which sees soft-deleted rows via a tenant-scoped fetch and only writes on
 // success) keep the tx clean until the single terminal write.
-export async function defineOrResurrectFieldDefinition(aggregateId, columns, user, db) {
+export async function defineOrResurrectFieldDefinition(aggregateId, columns, user, db, streamTenantId) {
     const active = await fieldDefinitionExecutor.detail({ id: aggregateId }, user, db);
     if (active) {
-        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
+        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db, {
+            streamTenantId,
+        });
     }
-    const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db);
+    const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db, {
+        streamTenantId,
+    });
     if (restored.isSuccess) {
         // restore() just un-deleted the row in this same tx; no concurrent writer
         // exists, so skip the optimistic-lock version match (we'd otherwise have to
@@ -31,10 +35,13 @@ export async function defineOrResurrectFieldDefinition(aggregateId, columns, use
         // readonly FieldDefinitionColumns isn't assignable to it.
         return fieldDefinitionExecutor.update({ id: aggregateId, changes: { ...columns } }, user, db, {
             skipOptimisticLock: true,
+            streamTenantId,
         });
     }
     if (restored.error.code === "not_found") {
-        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
+        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db, {
+            streamTenantId,
+        });
     }
     return restored;
 }

package/dist/delivery/delivery-service.js

@@ -92,7 +92,7 @@ export function createDeliveryService(options) {
             tenantId,
             actor: systemUser.id,
             sink: escapeHatchAuditSink,
-            log,
+            log: logError,
         });
         // ctx.db/dbOutsideTransaction are tenant-filtered even for a systemScope handler:
         // the dispatcher closes them off entirely there, so "system" mode would hand this

package/dist/managed-pages/handlers/by-tenant-published.query.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { pagesTable } from "../table.js";
 export const byTenantPublishedQuery = defineQueryHandler({
@@ -15,9 +15,6 @@ export const byTenantPublishedQuery = defineQueryHandler({
     description: "Lists every published page of a tenant with slug, language, title and last-change time but no body; use it to enumerate the public pages for sitemap.xml or llms.txt, rather than by-slug which fetches one page's content.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(query.user, override, "managedPages.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            throw overrideDenied;
         const tenantId = override ?? query.user.tenantId;
         const rows = castTenantRows(await selectMany(ctx.db, pagesTable, { tenantId: tenantId, published: true }));
         return {

package/dist/managed-pages/handlers/set.write.js

@@ -1,8 +1,8 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { crossTenantOverrideDenied, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
-import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { pageEntity, pagesTable } from "../table.js";
 const slugSchema = z
     .string()
@@ -15,7 +15,6 @@ const langSchema = z
     .max(8)
     .regex(/^[a-z]{2}(-[a-z]{2})?$/i, "lang must be ISO 639-1 (e.g. de, en, en-us)");
 const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName: "page" });
-const SET_PAGE_TENANT_OVERRIDE_REASON = "SystemAdmin tenantIdOverride re-scopes the page write to the target tenant";
 // Upsert einer Page — eine Operation pro (tenantId, slug, lang). Tenant-
 // Scope default aus event.user; SystemAdmin kann via `tenantIdOverride`
 // für einen anderen Tenant schreiben (typisch SYSTEM_TENANT_ID für app-
@@ -37,26 +36,12 @@ export const setWrite = defineWriteHandler({
     }),
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
     description: "Creates or overwrites one managed page addressed by slug and language, keeping the existing published flag, description and OG image when the payload omits them; use it for content edits and publish toggles, and as SystemAdmin to write another tenant's pages.",
-    escapeHatch: {
-        grants: ["unsafeRaw"],
-        reason: SET_PAGE_TENANT_OVERRIDE_REASON,
-    },
     handler: async (event, ctx) => {
-        const db = ctx.db;
         const override = event.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(event.user, override, "managedPages.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            return writeFailure(overrideDenied);
-        const tenantId = override ?? event.user.tenantId;
-        // override: point the executor context at the target tenant, else getStreamVersion runs against user.tenantId → version_conflict.
-        const executorUser = override !== undefined ? { ...event.user, tenantId: override } : event.user; // @cast-boundary engine-bridge
+        const tenantId = (override ?? event.user.tenantId); // @cast-boundary engine-bridge
         // ctx.db is scoped to the executing user's tenant, wrong for a cross-tenant override
         // on both the existing-check and the executor's stream reads; re-scope to the target.
-        // Safe: the override branch is SystemAdmin-gated above.
-        const scopedDb = override !== undefined
-            ? createTenantDb(db.unsafeRaw(), override, // @cast-boundary engine-bridge
-            "tenant")
-            : db;
+        const { db: scopedDb, streamTenantId } = requireForTenant(ctx, tenantId);
         const existing = await fetchOne(scopedDb, pagesTable, {
             tenantId,
             slug: event.payload.slug,
@@ -75,7 +60,7 @@ export const setWrite = defineWriteHandler({
                     ogImage: event.payload.ogImage !== undefined ? event.payload.ogImage : existing.ogImage,
                     published: event.payload.published !== undefined ? event.payload.published : existing.published,
                 },
-            }, executorUser, scopedDb);
+            }, event.user, scopedDb, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -92,7 +77,7 @@ export const setWrite = defineWriteHandler({
             ogImage: event.payload.ogImage ?? null,
             published: event.payload.published ?? false,
             tenantId,
-        }, executorUser, scopedDb);
+        }, event.user, scopedDb, { streamTenantId });
         if (!result.isSuccess)
             return result;
         return {

package/dist/shared/index.d.ts

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { requireForTenant } from "./require-for-tenant.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/index.js

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { requireForTenant } from "./require-for-tenant.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/require-for-tenant.d.ts

@@ -0,0 +1,2 @@
+import type { HandlerContext, TenantId, TenantWriteTarget } from "@cosmicdrift/kumiko-framework/engine";
+export declare function requireForTenant(ctx: Pick<HandlerContext, "forTenant">, targetTenantId: TenantId): TenantWriteTarget;

package/dist/shared/require-for-tenant.js

@@ -0,0 +1,9 @@
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+// ctx.forTenant is absent for r.systemScope() handlers and without a db; a write handler that
+// needs a cross-tenant target must fail loudly instead of falling back to ctx.db.
+export function requireForTenant(ctx, targetTenantId) {
+    if (!ctx.forTenant) {
+        throw new InternalError({ message: "ctx.forTenant is not available in this handler context" });
+    }
+    return ctx.forTenant(targetTenantId);
+}

package/dist/template-resolver/handlers/by-slug.query.js

@@ -1,5 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
@@ -28,9 +28,6 @@ export const bySlugQuery = defineQueryHandler({
     description: "Reads one text-block of a tenant by slug and locale together with its body and format; it is pinned to the text-block kind so mail templates and AI prompts in the same table stay unreachable through this anonymous-capable path.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(query.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            throw overrideDenied;
         const tenantId = override ?? query.user.tenantId;
         const row = await fetchOne(ctx.db, templateResourcesTable, {
             tenantId,

package/dist/template-resolver/handlers/by-tenant.query.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
@@ -15,9 +15,6 @@ export const byTenantQuery = defineQueryHandler({
     description: "Lists every text-block of a tenant with slug, locale, title and body so a public content tree can be rendered in one call; use it for the whole sidebar, and by-slug when only one block is needed.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;
-        const overrideDenied = crossTenantOverrideDenied(query.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-        if (overrideDenied)
-            throw overrideDenied;
         const tenantId = override ?? query.user.tenantId;
         const rows = castTenantRows(await selectMany(ctx.db, templateResourcesTable, { tenantId, kind: TEXT_BLOCK_KIND }));
         return {

package/dist/template-resolver/handlers/collection-item.query.js

@@ -1,5 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, toCollectionEntry, } from "./collection-shared.js";
 // Single entry of one collection, for the editor behind a tree node. Same
@@ -20,9 +20,6 @@ export function makeCollectionItemQuery(collection) {
             : `Reads one tenant-wide "${collection.id}" entry by slug and locale, returning null when it does not exist; use it to open a single entry in the editor rather than to list the collection.`,
         handler: async (query, ctx) => {
             const override = query.payload.tenantIdOverride;
-            const overrideDenied = crossTenantOverrideDenied(query.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-            if (overrideDenied)
-                throw overrideDenied;
             const tenantId = override ?? query.user.tenantId;
             const row = await fetchOne(ctx.db, store.table, {
                 tenantId,

package/dist/template-resolver/handlers/collection-list.query.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
-import { crossTenantOverrideDenied, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, toCollectionEntry, } from "./collection-shared.js";
 // One list handler per declared collection: `kind`, `ownership` and `access`
@@ -25,9 +25,6 @@ export function makeCollectionListQuery(collection) {
             : `Lists the tenant-wide entries of the "${collection.id}" content collection (${collection.kind} content) with slug, locale, title and body; every caller who may reach this collection sees the same shared set.`,
         handler: async (query, ctx) => {
             const override = query.payload.tenantIdOverride;
-            const overrideDenied = crossTenantOverrideDenied(query.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-            if (overrideDenied)
-                throw overrideDenied;
             const tenantId = override ?? query.user.tenantId;
             const rows = castTenantRows(await selectMany(ctx.db, store.table, {
                 tenantId,

package/dist/template-resolver/handlers/collection-set.write.js

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { crossTenantOverrideDenied, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
-import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, } from "./collection-shared.js";
 import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.js";
 // Upsert inside one collection. Mirrors set.write for text-blocks, but the
@@ -30,15 +30,11 @@ export function makeCollectionSetWrite(collection) {
             ? `Creates or overwrites the caller's own "${collection.id}" entry at a slug and locale, live on save with no draft stage; it always writes the acting user's entry, never another user's.`
             : `Creates or overwrites the tenant-wide "${collection.id}" entry at a slug and locale, live on save with no draft stage; the change is visible to everyone who may reach this shared collection.`,
         handler: async (event, ctx) => {
-            const db = ctx.db;
             const override = event.payload.tenantIdOverride;
-            const overrideDenied = crossTenantOverrideDenied(event.user, override, "templateResolver.errors.tenantOverrideRequiresSystemAdmin");
-            if (overrideDenied)
-                return writeFailure(overrideDenied);
             // @cast-boundary engine-payload — override is a zod-validated string, the
             // user's own tenantId is already TenantId-branded.
             const tenantId = (override ?? event.user.tenantId);
-            const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
+            const { db, streamTenantId } = requireForTenant(ctx, tenantId);
             // Scoped to the acting user even under a tenant override: a SystemAdmin
             // writing into another tenant still writes their own entry, never
             // someone else's signature.
@@ -63,7 +59,7 @@ export function makeCollectionSetWrite(collection) {
                         contentFormat: event.payload.contentFormat,
                         folder: event.payload.folder ?? null,
                     },
-                }, executorUser, db);
+                }, event.user, db, { streamTenantId });
                 if (!result.isSuccess)
                     return result;
                 return {
@@ -82,7 +78,7 @@ export function makeCollectionSetWrite(collection) {
                 folder: event.payload.folder ?? null,
                 ...store.createDefaults(tenantId),
                 ...owner,
-            }, executorUser, db);
+            }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {