@cosmicdrift/kumiko-bundled-features 0.355.0 → 0.356.0

package/dist/compliance-profiles/handlers/set-profile.write.js

@@ -4,6 +4,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, validationErrorFromZod, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "../schema/profile-selection.js";
 const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantComplianceProfileEntity, {
     entityName: "tenant-compliance-profile",
@@ -13,24 +14,16 @@ const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantCompli
 // nicht eine waehlbare Production-Option. Symmetrisch zu
 // SELECTABLE_PROFILE_KEYS aus der framework/compliance-Liste.
 const profileKeySchema = z.enum(SELECTABLE_PROFILE_KEYS);
-// Tenant-Admin setzt Profile-Key + optional Override-JSON.
+// Upsert: the first call inserts, later calls update, so repeating the same values
+// is idempotent apart from the extra audit events.
 //
-// Upsert-Verhalten: erste Wahl insert, weitere update. Idempotent —
-// wer mit gleichen Werten zweimal aufruft, kriegt das gleiche Ergebnis
-// (modulo aktualisierte Audit-Events im Event-Store).
+// A SystemAdmin may target another tenant via `tenantIdOverride` (operator setup,
+// onboarding migrations); the dispatcher rejects the override for anyone else. The
+// executor then writes into the target tenant's stream via streamTenantId while
+// the operator stays the recorded actor.
 //
-// Cross-Tenant-Pfad: SystemAdmin kann via `tenantIdOverride` fuer einen
-// anderen Tenant schreiben (Plattform-Operator-Setup, Customer-
-// Onboarding-Migrationen). TenantAdmin's Override-Versuch → 403.
-// executorUser.tenantId muss = ziel-tenant sein damit der event-store-
-// Stream-Lookup nicht miss → version_conflict gibt (Memory:
-// feedback_event_store_tenant_consistency).
-//
-// Validation:
-//   - profileKey muss in SELECTABLE_PROFILE_KEYS sein (Zod-checked)
-//   - override (optional) muss valides JSON-Object sein
-//   - override Top-Level-Keys muessen in ALLOWED_OVERRIDE_KEYS sein
-//     — verhindert Tippfehler die deepMerge stillschweigend ignoriert
+// Override top-level keys are restricted to ALLOWED_OVERRIDE_KEYS because deepMerge
+// would silently ignore a typo.
 export const setProfileWrite = defineWriteHandler({
     name: "set-profile",
     schema: z.object({
@@ -43,9 +36,8 @@ export const setProfileWrite = defineWriteHandler({
     access: { roles: access.admin },
     description: "Sets or replaces a tenant's compliance profile key plus an optional JSON override, for onboarding or a later region change; a system admin may target a different tenant through tenantIdOverride.",
     handler: async (event, ctx) => {
-        const tenantOverride = event.payload.tenantIdOverride;
-        const tenantId = (tenantOverride ?? event.user.tenantId); // @cast-boundary engine-payload
-        const executorUser = tenantOverride !== undefined ? { ...event.user, tenantId } : event.user;
+        const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId); // @cast-boundary engine-payload
+        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
         // Override-Validation: muss parseables JSON-Object sein UND dem
         // ComplianceProfileOverride-Schema entsprechen (S1.9 Z3 — strict-Zod
         // mit Top-Level + Sub-Level-Whitelist via .strict()). Tippfehler
@@ -72,7 +64,7 @@ export const setProfileWrite = defineWriteHandler({
             }
         }
         // Upsert: existierenden Eintrag suchen
-        const existing = (await fetchOne(ctx.db, tenantComplianceProfileTable, {
+        const existing = (await fetchOne(db, tenantComplianceProfileTable, {
             tenantId: tenantId,
         })); // @cast-boundary db-runner
         if (existing) {
@@ -83,7 +75,7 @@ export const setProfileWrite = defineWriteHandler({
                     profileKey: event.payload.profileKey,
                     override: event.payload.override ?? null,
                 },
-            }, executorUser, ctx.db);
+            }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -95,7 +87,7 @@ export const setProfileWrite = defineWriteHandler({
             profileKey: event.payload.profileKey,
             override: event.payload.override ?? null,
             tenantId,
-        }, executorUser, ctx.db);
+        }, event.user, db, { streamTenantId });
         if (!result.isSuccess)
             return result;
         return {

package/dist/custom-fields/handlers/define-system-field.write.js

@@ -1,19 +1,14 @@
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { defineOrResurrectFieldDefinition } from "../lib/define-or-resurrect.js";
 import { buildFieldDefinitionColumns } from "../lib/field-definition-row.js";
 import { defineFieldPayloadSchema } from "../schemas.js";
-// define-system-field — SystemAdmin definiert eine system-weite Custom-Field-
-// Definition die für ALLE Tenants gilt. tenantId wird auf SYSTEM_TENANT_ID
-// gesetzt (NICHT vom Caller — SystemAdmin's event.user.tenantId würde sonst
-// auf den admin's eigenen platform-tenant zeigen).
-//
-// **Use-Case:** Vendor (cdgs) sagt "alle Hausverwaltungs-customers haben ab
-// heute ein `internalNumber`-Field". Tenant kann den Wert pro customer
-// setzen, aber die Definition nicht ändern oder löschen.
-//
-// **Same-scope-conflict** wie bei define-tenant-field via aggregate-version-
-// conflict (deterministische ID mit tenantId=SYSTEM_TENANT_ID).
+// A system-wide field definition applies to every tenant. tenantId is forced to
+// SYSTEM_TENANT_ID (never taken from the caller) and addressed via streamTenantId,
+// so the SystemAdmin stays the recorded actor. Tenants can set values for the field
+// but cannot change or delete the definition. A same-scope duplicate surfaces as an
+// aggregate version conflict, because the ID is derived from SYSTEM_TENANT_ID.
 export const defineSystemFieldHandler = {
     name: "define-system-field",
     schema: defineFieldPayloadSchema,
@@ -22,10 +17,7 @@ export const defineSystemFieldHandler = {
     handler: async (event, ctx) => {
         const payload = event.payload; // @cast-boundary engine-payload
         const aggregateId = fieldDefinitionAggregateId(SYSTEM_TENANT_ID, payload.entityName, payload.fieldKey);
-        // Override event.user.tenantId to SYSTEM_TENANT_ID for the system-scope
-        // write. The framework's CrudExecutor writes the row with this tenantId
-        // — the row lives in the system-scope-stream.
-        const systemUser = { ...event.user, tenantId: SYSTEM_TENANT_ID };
-        return defineOrResurrectFieldDefinition(aggregateId, buildFieldDefinitionColumns(payload), systemUser, ctx.db);
+        const { db, streamTenantId } = requireForTenant(ctx, SYSTEM_TENANT_ID);
+        return defineOrResurrectFieldDefinition(aggregateId, buildFieldDefinitionColumns(payload), event.user, db, streamTenantId);
     },
 };

package/dist/custom-fields/handlers/delete-system-field.write.js

@@ -1,4 +1,5 @@
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants.js";
 import { fieldDefinitionExecutor } from "../executor.js";
@@ -18,8 +19,10 @@ export const deleteSystemFieldHandler = {
     handler: async (event, ctx) => {
         const payload = event.payload; // @cast-boundary engine-payload
         const aggregateId = fieldDefinitionAggregateId(SYSTEM_TENANT_ID, payload.entityName, payload.fieldKey);
-        const systemUser = { ...event.user, tenantId: SYSTEM_TENANT_ID };
-        const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, systemUser, ctx.db);
+        const { db, streamTenantId } = requireForTenant(ctx, SYSTEM_TENANT_ID);
+        const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, event.user, db, {
+            streamTenantId,
+        });
         // Cascade-cleanup-Event — host-entity-MSPs entfernen orphan values aus
         // ihrer customFields jsonb. Im selben TX = atomic.
         if (result.isSuccess) {

package/dist/custom-fields/lib/define-or-resurrect.d.ts

@@ -1,7 +1,8 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionExecutor } from "../executor.js";
 import type { FieldDefinitionColumns } from "./field-definition-row.js";
 type DefineUser = Parameters<typeof fieldDefinitionExecutor.create>[1];
 type DefineDb = Parameters<typeof fieldDefinitionExecutor.create>[2];
 type WriteResult = Awaited<ReturnType<typeof fieldDefinitionExecutor.create>>;
-export declare function defineOrResurrectFieldDefinition(aggregateId: string, columns: FieldDefinitionColumns, user: DefineUser, db: DefineDb): Promise<WriteResult>;
+export declare function defineOrResurrectFieldDefinition(aggregateId: string, columns: FieldDefinitionColumns, user: DefineUser, db: DefineDb, streamTenantId?: TenantId): Promise<WriteResult>;
 export {};

package/dist/custom-fields/lib/define-or-resurrect.js

@@ -16,12 +16,16 @@ import { fieldDefinitionExecutor } from "../executor.js";
 // fail with "current transaction is aborted". detail() (a read) + restore()
 // (which sees soft-deleted rows via a tenant-scoped fetch and only writes on
 // success) keep the tx clean until the single terminal write.
-export async function defineOrResurrectFieldDefinition(aggregateId, columns, user, db) {
+export async function defineOrResurrectFieldDefinition(aggregateId, columns, user, db, streamTenantId) {
     const active = await fieldDefinitionExecutor.detail({ id: aggregateId }, user, db);
     if (active) {
-        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
+        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db, {
+            streamTenantId,
+        });
     }
-    const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db);
+    const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db, {
+        streamTenantId,
+    });
     if (restored.isSuccess) {
         // restore() just un-deleted the row in this same tx; no concurrent writer
         // exists, so skip the optimistic-lock version match (we'd otherwise have to
@@ -31,10 +35,13 @@ export async function defineOrResurrectFieldDefinition(aggregateId, columns, use
         // readonly FieldDefinitionColumns isn't assignable to it.
         return fieldDefinitionExecutor.update({ id: aggregateId, changes: { ...columns } }, user, db, {
             skipOptimisticLock: true,
+            streamTenantId,
         });
     }
     if (restored.error.code === "not_found") {
-        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
+        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db, {
+            streamTenantId,
+        });
     }
     return restored;
 }

package/dist/managed-pages/handlers/set.write.js

@@ -1,7 +1,8 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { pageEntity, pagesTable } from "../table.js";
 const slugSchema = z
     .string()
@@ -14,7 +15,6 @@ const langSchema = z
     .max(8)
     .regex(/^[a-z]{2}(-[a-z]{2})?$/i, "lang must be ISO 639-1 (e.g. de, en, en-us)");
 const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName: "page" });
-const SET_PAGE_TENANT_OVERRIDE_REASON = "SystemAdmin tenantIdOverride re-scopes the page write to the target tenant";
 // Upsert einer Page — eine Operation pro (tenantId, slug, lang). Tenant-
 // Scope default aus event.user; SystemAdmin kann via `tenantIdOverride`
 // für einen anderen Tenant schreiben (typisch SYSTEM_TENANT_ID für app-
@@ -36,23 +36,12 @@ export const setWrite = defineWriteHandler({
     }),
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
     description: "Creates or overwrites one managed page addressed by slug and language, keeping the existing published flag, description and OG image when the payload omits them; use it for content edits and publish toggles, and as SystemAdmin to write another tenant's pages.",
-    escapeHatch: {
-        grants: ["unsafeRaw"],
-        reason: SET_PAGE_TENANT_OVERRIDE_REASON,
-    },
     handler: async (event, ctx) => {
-        const db = ctx.db;
         const override = event.payload.tenantIdOverride;
-        const tenantId = override ?? event.user.tenantId;
-        // override: point the executor context at the target tenant, else getStreamVersion runs against user.tenantId → version_conflict.
-        const executorUser = override !== undefined ? { ...event.user, tenantId: override } : event.user; // @cast-boundary engine-bridge
+        const tenantId = (override ?? event.user.tenantId); // @cast-boundary engine-bridge
         // ctx.db is scoped to the executing user's tenant, wrong for a cross-tenant override
         // on both the existing-check and the executor's stream reads; re-scope to the target.
-        // Safe: the override branch is SystemAdmin-gated above.
-        const scopedDb = override !== undefined
-            ? createTenantDb(db.unsafeRaw(), override, // @cast-boundary engine-bridge
-            "tenant")
-            : db;
+        const { db: scopedDb, streamTenantId } = requireForTenant(ctx, tenantId);
         const existing = await fetchOne(scopedDb, pagesTable, {
             tenantId,
             slug: event.payload.slug,
@@ -71,7 +60,7 @@ export const setWrite = defineWriteHandler({
                     ogImage: event.payload.ogImage !== undefined ? event.payload.ogImage : existing.ogImage,
                     published: event.payload.published !== undefined ? event.payload.published : existing.published,
                 },
-            }, executorUser, scopedDb);
+            }, event.user, scopedDb, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -88,7 +77,7 @@ export const setWrite = defineWriteHandler({
             ogImage: event.payload.ogImage ?? null,
             published: event.payload.published ?? false,
             tenantId,
-        }, executorUser, scopedDb);
+        }, event.user, scopedDb, { streamTenantId });
         if (!result.isSuccess)
             return result;
         return {

package/dist/shared/index.d.ts

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { requireForTenant } from "./require-for-tenant.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/index.js

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { requireForTenant } from "./require-for-tenant.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/require-for-tenant.d.ts

@@ -0,0 +1,2 @@
+import type { HandlerContext, TenantId, TenantWriteTarget } from "@cosmicdrift/kumiko-framework/engine";
+export declare function requireForTenant(ctx: Pick<HandlerContext, "forTenant">, targetTenantId: TenantId): TenantWriteTarget;

package/dist/shared/require-for-tenant.js

@@ -0,0 +1,9 @@
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+// ctx.forTenant is absent for r.systemScope() handlers and without a db; a write handler that
+// needs a cross-tenant target must fail loudly instead of falling back to ctx.db.
+export function requireForTenant(ctx, targetTenantId) {
+    if (!ctx.forTenant) {
+        throw new InternalError({ message: "ctx.forTenant is not available in this handler context" });
+    }
+    return ctx.forTenant(targetTenantId);
+}

package/dist/template-resolver/handlers/collection-set.write.js

@@ -1,6 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, } from "./collection-shared.js";
 import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.js";
 // Upsert inside one collection. Mirrors set.write for text-blocks, but the
@@ -29,12 +30,11 @@ export function makeCollectionSetWrite(collection) {
             ? `Creates or overwrites the caller's own "${collection.id}" entry at a slug and locale, live on save with no draft stage; it always writes the acting user's entry, never another user's.`
             : `Creates or overwrites the tenant-wide "${collection.id}" entry at a slug and locale, live on save with no draft stage; the change is visible to everyone who may reach this shared collection.`,
         handler: async (event, ctx) => {
-            const db = ctx.db;
             const override = event.payload.tenantIdOverride;
             // @cast-boundary engine-payload — override is a zod-validated string, the
             // user's own tenantId is already TenantId-branded.
             const tenantId = (override ?? event.user.tenantId);
-            const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
+            const { db, streamTenantId } = requireForTenant(ctx, tenantId);
             // Scoped to the acting user even under a tenant override: a SystemAdmin
             // writing into another tenant still writes their own entry, never
             // someone else's signature.
@@ -59,7 +59,7 @@ export function makeCollectionSetWrite(collection) {
                         contentFormat: event.payload.contentFormat,
                         folder: event.payload.folder ?? null,
                     },
-                }, executorUser, db);
+                }, event.user, db, { streamTenantId });
                 if (!result.isSuccess)
                     return result;
                 return {
@@ -78,7 +78,7 @@ export function makeCollectionSetWrite(collection) {
                 folder: event.payload.folder ?? null,
                 ...store.createDefaults(tenantId),
                 ...owner,
-            }, executorUser, db);
+            }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {

package/dist/template-resolver/handlers/set.write.js

@@ -1,6 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { TEMPLATE_KINDS, TEXT_BLOCK_KIND } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
 import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema } from "./shared.js";
@@ -42,15 +43,11 @@ export const setWrite = defineWriteHandler({
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
     description: "Creates or overwrites one content-tree resource addressed by slug, kind and locale, carrying a title and folder and going live on save with no draft stage; a SystemAdmin may target the system tenant, where shared legal and marketing copy lives.",
     handler: async (event, ctx) => {
-        const db = ctx.db;
         const override = event.payload.tenantIdOverride;
         // @cast-boundary engine-payload — override is a zod-validated string, the
         // user's own tenantId is already TenantId-branded.
         const tenantId = (override ?? event.user.tenantId);
-        // With an override the executor user has to move to the target tenant too,
-        // otherwise the event-store stream lookup runs against event.user.tenantId
-        // and reports a version conflict although the projection row exists.
-        const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
+        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
         const kind = event.payload.kind ?? TEXT_BLOCK_KIND;
         const existing = await fetchOne(db, templateResourcesTable, {
             tenantId,
@@ -87,7 +84,7 @@ export const setWrite = defineWriteHandler({
                     contentFormat: fields.contentFormat,
                     folder: fields.folder,
                 },
-            }, executorUser, db);
+            }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -95,7 +92,9 @@ export const setWrite = defineWriteHandler({
                 data: { slug: event.payload.slug, locale: event.payload.locale, isNew: false },
             };
         }
-        const result = await executor.create({ ...fields, tenantId }, executorUser, db);
+        const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+            streamTenantId,
+        });
         if (!result.isSuccess)
             return result;
         return {

package/dist/template-resolver/handlers/upsert-system.write.js

@@ -1,5 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { templateResourcesTable } from "../table.js";
 import { executor, upsertPayloadSchema } from "./shared.js";
 // System-Template anlegen/updaten. Liegt unter SYSTEM_TENANT_ID,
@@ -12,13 +13,10 @@ export const upsertSystemWrite = defineWriteHandler({
     access: { roles: ["SystemAdmin"] },
     description: "Creates or overwrites a system-default template under the system tenant with its full variable schema and linked resources, active straight away with no draft stage; SystemAdmin only, since tenants shadow these defaults through upsert-tenant instead.",
     handler: async (event, ctx) => {
-        const db = ctx.db;
         // @cast-boundary engine-payload — SYSTEM_TENANT_ID is a UUID literal,
         // asserted to the branded TenantId (parseTenantId equivalent).
         const tenantId = SYSTEM_TENANT_ID;
-        // The executor user must carry SYSTEM_TENANT as tenantId, otherwise the
-        // event store looks up the stream under user.tenantId → conflict.
-        const executorUser = { ...event.user, tenantId };
+        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
         const existing = await fetchOne(db, templateResourcesTable, {
             tenantId,
             slug: event.payload.slug,
@@ -41,7 +39,7 @@ export const upsertSystemWrite = defineWriteHandler({
             status: "active",
         };
         if (existing) {
-            const result = await executor.update({ id: existing.id, version: existing.version, changes: fields }, executorUser, db);
+            const result = await executor.update({ id: existing.id, version: existing.version, changes: fields }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -49,7 +47,9 @@ export const upsertSystemWrite = defineWriteHandler({
                 data: { id: String(existing.id), slug: event.payload.slug, isNew: false },
             };
         }
-        const result = await executor.create({ ...fields, tenantId }, executorUser, db);
+        const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+            streamTenantId,
+        });
         if (!result.isSuccess)
             return result;
         // @cast-boundary db-row — executor.create returnt Record-row aus

package/dist/template-resolver/handlers/upsert-tenant.write.js

@@ -2,6 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { templateResourcesTable } from "../table.js";
 import { executor, upsertPayloadSchema } from "./shared.js";
 // Tenant-Override anlegen/updaten. Liegt unter event.user.tenantId,
@@ -18,7 +19,6 @@ export const upsertTenantWrite = defineWriteHandler({
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
     description: "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live; it refuses a system-tenant target, which is what upsert-system is for.",
     handler: async (event, ctx) => {
-        const db = ctx.db;
         const override = event.payload.tenantIdOverride;
         // upsertTenant erzeugt scope='tenant'. SYSTEM_TENANT_ID-Override würde
         // scope='tenant' unter SYSTEM_TENANT_ID schreiben → inkonsistenter Zustand
@@ -34,7 +34,7 @@ export const upsertTenantWrite = defineWriteHandler({
         // event.user.tenantId schon TenantId-branded; union als TenantId casten
         // ist legit (override ist UUID-Format-validiert in schema).
         const tenantId = (override ?? event.user.tenantId);
-        const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
+        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
         const existing = await fetchOne(db, templateResourcesTable, {
             tenantId,
             slug: event.payload.slug,
@@ -56,7 +56,7 @@ export const upsertTenantWrite = defineWriteHandler({
             status: event.payload.status,
         };
         if (existing) {
-            const result = await executor.update({ id: existing.id, version: existing.version, changes: fields }, executorUser, db);
+            const result = await executor.update({ id: existing.id, version: existing.version, changes: fields }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -64,7 +64,9 @@ export const upsertTenantWrite = defineWriteHandler({
                 data: { id: String(existing.id), slug: event.payload.slug, isNew: false },
             };
         }
-        const result = await executor.create({ ...fields, tenantId }, executorUser, db);
+        const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+            streamTenantId,
+        });
         if (!result.isSuccess)
             return result;
         // @cast-boundary db-row — executor.create returnt Record-row aus

package/dist/tenant/cancel-pending-invitation.d.ts

@@ -1,8 +1,8 @@
 import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type { Redis } from "ioredis";
 export declare function cancelPendingInvitation(db: TenantDb, invitation: {
     readonly id: string;
     readonly version: number;
-}, actor: SessionUser, redis: Redis | undefined): Promise<WriteFailure | undefined>;
+}, actor: SessionUser, redis: Redis | undefined, streamTenantId?: TenantId): Promise<WriteFailure | undefined>;

package/dist/tenant/cancel-pending-invitation.js

@@ -5,12 +5,12 @@ import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } fr
 const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
 // Shared by cancel-invitation and remove-member so the cancel behavior
 // (status transition + token invalidation) cannot drift between them.
-export async function cancelPendingInvitation(db, invitation, actor, redis) {
+export async function cancelPendingInvitation(db, invitation, actor, redis, streamTenantId) {
     const updateResult = await invitationExecutor.update({
         id: invitation.id,
         version: invitation.version,
         changes: { status: INVITATION_STATUS.cancelled },
-    }, actor, db);
+    }, actor, db, { streamTenantId });
     if (!updateResult.isSuccess)
         return updateResult;
     // Delete the token from Redis (if still there). If Redis is

package/dist/tenant/handlers/remove-member.write.js

@@ -1,6 +1,6 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, defineWriteHandler, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, defineWriteHandler, parseTenantId, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -20,7 +20,7 @@ async function cancelPendingInvitationsOfUser(db, options) {
     const email = (await decryptStoredPii(user.email, "email", "tenant:remove-member")).toLowerCase();
     const pendingInvitations = await selectMany(db, tenantInvitationsTable, { tenantId: options.tenantId, email, status: INVITATION_STATUS.pending });
     for (const invitation of pendingInvitations) {
-        const failure = await cancelPendingInvitation(db, invitation, options.actor, options.redis);
+        const failure = await cancelPendingInvitation(db, invitation, options.actor, options.redis, options.streamTenantId);
         if (failure)
             return failure;
     }
@@ -43,11 +43,14 @@ export const removeMemberWrite = defineWriteHandler({
             });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin manages memberships across tenants");
-        const existing = await fetchOne(db, tenantMembershipsTable, {
-            userId: event.payload.userId,
-            tenantId: event.payload.tenantId,
-        });
-        if (!existing) {
+        const streamTenantId = parseTenantId(event.payload.tenantId);
+        const existing = streamTenantId === null
+            ? undefined
+            : await fetchOne(db, tenantMembershipsTable, {
+                userId: event.payload.userId,
+                tenantId: streamTenantId,
+            });
+        if (!existing || streamTenantId === null) {
             return writeFailure(new NotFoundError("membership", undefined, {
                 i18nKey: "tenant.errors.membershipNotFound",
                 i18nParams: { userId: event.payload.userId, tenantId: event.payload.tenantId },
@@ -75,14 +78,14 @@ export const removeMemberWrite = defineWriteHandler({
             });
         }
         const result = await executor.delete({ id: existing["id"] }, // @cast-boundary db-row
-        event.user, db);
+        event.user, db, { streamTenantId });
         if (!result.isSuccess)
             return result;
-        // Actor tenant = invitation tenant so the update hits the invitation's stream.
         const cancelFailure = await cancelPendingInvitationsOfUser(db, {
             userId: event.payload.userId,
             tenantId: event.payload.tenantId,
-            actor: { ...event.user, tenantId: event.payload.tenantId },
+            actor: event.user,
+            streamTenantId,
             redis: ctx.redis,
         });
         if (cancelFailure !== undefined)

package/dist/tenant/handlers/update-member-roles.write.js

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { access, assignableAppRolesOf, createSystemUser, defineWriteHandler, findForbiddenRoleAssignment, mergeAssignedRoles, SYSTEM_ROLE, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, assignableAppRolesOf, createSystemUser, defineWriteHandler, findForbiddenRoleAssignment, mayOverrideTenant, mergeAssignedRoles, parseTenantId, SYSTEM_ROLE, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -17,7 +17,12 @@ const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user"
 /** SystemAdmin may pass payload.tenantId (cross-tenant); the members actionForm
  *  only sends userId+roles, so fall back to the active session tenant. */
 function resolveTargetTenantId(isSystem, payloadTenantId, sessionTenantId) {
-    return isSystem ? (payloadTenantId ?? sessionTenantId) : sessionTenantId;
+    if (!isSystem || payloadTenantId === undefined)
+        return sessionTenantId;
+    return parseTenantId(payloadTenantId) ?? undefined;
+}
+function foreignStreamTenant(user, targetTenantId) {
+    return targetTenantId === user.tenantId ? undefined : targetTenantId;
 }
 // Editing your OWN roles keeps the current session: roles are re-derived per
 // request, so the new roles apply at once without a re-login. Other sessions
@@ -49,7 +54,7 @@ export const updateMemberRolesWrite = defineWriteHandler({
             });
         }
         const isSystemActor = event.user.roles.includes(SYSTEM_ROLE);
-        const isSystem = event.user.roles.includes("SystemAdmin") || isSystemActor;
+        const isSystem = mayOverrideTenant(event.user) || isSystemActor;
         const assignableAppRoles = assignableAppRolesOf(ctx.registry);
         const targetTenantId = resolveTargetTenantId(isSystem, event.payload.tenantId, event.user.tenantId);
         if (!targetTenantId) {
@@ -117,16 +122,14 @@ export const updateMemberRolesWrite = defineWriteHandler({
         if (revoker) {
             await ctx.writeAs(createSystemUser(targetTenantId), REVOKE_ALL_SESSIONS_QN, revokeSessionsPayload(event.payload.userId, targetTenantId, event.user));
         }
-        // Stream tenant follows the actor via streamTenantFor — use the
-        // membership tenant so SystemAdmin/cross-tenant and TenantAdmin paths
-        // hit the same stream seedTenantMembership/invite-accept wrote.
-        // Keep the real actor for audit metadata; only override tenantId so
-        // streamTenantFor writes into the membership tenant (#2401).
+        // The membership stream lives on the membership's tenant (where seedTenantMembership/
+        // invite-accept wrote it); a cross-tenant operator addresses it without becoming a member.
+        // Same-tenant writes run on a tenant-mode db, which refuses a stream override.
         const result = await executor.update({
             id: row["id"], // @cast-boundary db-row
             version: row["version"], // @cast-boundary db-row
             changes: { roles: JSON.stringify(nextRoles) },
-        }, { ...event.user, tenantId: targetTenantId }, db);
+        }, event.user, db, { streamTenantId: foreignStreamTenant(event.user, targetTenantId) });
         return withResponseData(result, {
             ...event.payload,
             roles: nextRoles,

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -1,7 +1,8 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable, createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { tierAssignmentAggregateId } from "../aggregate-id.js";
 import { TierAssignmentSources } from "../constants.js";
 import { tierAssignmentEntity } from "../entity.js";
@@ -9,13 +10,8 @@ import { tierAssignmentEntity } from "../entity.js";
 // Billing. Cross-tenant, daher SystemAdmin-only (kein TenantAdmin: sonst
 // Gratis-Self-Upgrade).
 //
-// **Cross-tenant-Mechanik:** ein "system"-mode TenantDb auf den Ziel-Tenant legt
-// KEINEN Tenant-Filter an (tenant-db.ts:141 — mode==="system" überspringt ihn);
-// der executor-user wird ebenfalls auf den Ziel-Tenant gestellt, sonst landet das
-// Event im Stream des Admins (Memory feedback_event_store_tenant_consistency).
-// Das set.write-"override-user"-Muster trägt NICHT für beliebige Tenants — es
-// funktioniert nur für SYSTEM_TENANT_ID (immer im IN-Filter). Dies ist das
-// auto-default-Hook-Muster (feature.ts), generalisiert auf einen Request-Handler.
+// Cross-tenant mechanics: ctx.forTenant(tenantId) yields a tenant-mode db bound to the target plus
+// the streamTenantId, so the event lands in the target's stream with the operator as actor.
 //
 // `source: TierAssignmentSources.manual` marks the grant so the billing sync skips it.
 // Upsert: one aggregate per tenant (deterministic aggregate id).
@@ -31,7 +27,6 @@ const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEn
 const executor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEntity, {
     entityName: "tier-assignment",
 });
-const SET_TENANT_TIER_REASON = "SystemAdmin assigns the tier of the tenant named in the payload";
 export function createSetTenantTierWrite(opts = {}) {
     return defineWriteHandler({
         name: "set-tenant-tier",
@@ -46,10 +41,6 @@ export function createSetTenantTierWrite(opts = {}) {
         }),
         access: { roles: ["SystemAdmin"] },
         agent: { risk: "high" },
-        escapeHatch: {
-            grants: ["unsafeRaw"],
-            reason: SET_TENANT_TIER_REASON,
-        },
         handler: async (event, ctx) => {
             // Without a commit sink (unit harness) there is no transaction to wait for.
             const afterCommit = (tenantId, tier) => {
@@ -60,9 +51,7 @@ export function createSetTenantTierWrite(opts = {}) {
                     opts.onAssigned?.(tenantId, tier);
             };
             const tenantId = event.payload.tenantId; // @cast-boundary engine-bridge
-            const rawDb = ctx.db.unsafeRaw();
-            const tdb = createTenantDb(rawDb, tenantId, "system");
-            const systemUser = { ...event.user, tenantId };
+            const { db: tdb, streamTenantId } = requireForTenant(ctx, tenantId);
             const tier = event.payload.tier;
             const existing = await fetchOne(tdb, tierAssignmentTable, { tenantId });
             if (existing) {
@@ -70,7 +59,7 @@ export function createSetTenantTierWrite(opts = {}) {
                     id: existing.id,
                     version: existing.version,
                     changes: { tier, source: TierAssignmentSources.manual },
-                }, systemUser, tdb);
+                }, event.user, tdb, { streamTenantId });
                 if (!result.isSuccess)
                     return result;
                 afterCommit(tenantId, tier);
@@ -81,7 +70,7 @@ export function createSetTenantTierWrite(opts = {}) {
                 tier,
                 source: TierAssignmentSources.manual,
                 tenantId,
-            }, systemUser, tdb);
+            }, event.user, tdb, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             afterCommit(tenantId, tier);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.355.0",
+  "version": "0.356.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -516,12 +516,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.355.0",
-    "@cosmicdrift/kumiko-framework": "0.355.0",
-    "@cosmicdrift/kumiko-headless": "0.355.0",
-    "@cosmicdrift/kumiko-renderer": "0.355.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.355.0",
-    "@cosmicdrift/kumiko-types": "0.355.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.356.0",
+    "@cosmicdrift/kumiko-framework": "0.356.0",
+    "@cosmicdrift/kumiko-headless": "0.356.0",
+    "@cosmicdrift/kumiko-renderer": "0.356.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.356.0",
+    "@cosmicdrift/kumiko-types": "0.356.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1050,8 +1050,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.355.0",
-    "@cosmicdrift/kumiko-locale-es": "0.355.0",
+    "@cosmicdrift/kumiko-locale-de": "0.356.0",
+    "@cosmicdrift/kumiko-locale-es": "0.356.0",
     "jsqr": "^1.4.0"
   }
 }