@cosmicdrift/kumiko-bundled-features 0.355.0 → 0.357.0

package/dist/notes-history-user-data/hooks.js

@@ -3,6 +3,7 @@
 // notes consumers without the user-data-rights pipeline don't pull a hard
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
 import { resolveRetentionPolicyForTenant, resolveTenantRetentionPreset, } from "../data-retention/index.js";
 import { noteEntryTable, noteMentionTable } from "../notes-history/index.js";
@@ -26,93 +27,109 @@ export const noteEntryExportHook = async (ctx) => {
         })),
     };
 };
+// What erasing a subject's key reaches: notes that @-mention the subject plus notes
+// attached to it as host. Export and erasure both go through this, so Art. 15
+// lists exactly what Art. 17 shreds.
+async function selectNotesReachingSubject(db, subject) {
+    if (subject.kind === "tenant")
+        return [];
+    const subjectId = subject.kind === "user" ? subject.userId : subject.id;
+    const attachedWhere = subject.kind === "record"
+        ? { entityType: subject.entity, entityId: subjectId }
+        : { entityId: subjectId };
+    const mentions = await selectMany(db, noteMentionTable, { subjectId });
+    const mentioned = mentions.length === 0
+        ? []
+        : await selectMany(db, noteEntryTable, {
+            id: { in: [...new Set(mentions.map((m) => m.noteId))] },
+        });
+    const attached = await selectMany(db, noteEntryTable, attachedWhere);
+    const byId = new Map();
+    for (const note of [...mentioned, ...attached])
+        byId.set(note.id, note);
+    return [...byId.values()];
+}
 // `authorName` is separately annotated `personal: { of: "authorId" }`
 // (entity.ts), so forgetting the AUTHOR already crypto-shreds that field on
-// its own — unrelated to this hook. `body` is Row-Subject (`personal: { of:
-// "id" }`): its key is per-note, not per-user, so forgetting a user only
-// reaches a note's body when that note structurally @-mentions the user via
-// a `note-mention` row (fw#2787). Free-text mentions are NOT detected —
-// that's the documented gap in entity.ts, not a bug here.
+// its own. `body` is Row-Subject (`personal: { of: "id" }`): its key is per
+// note, so forgetting a subject only reaches a body when the note structurally
+// @-mentions the subject (`note-mention`, fw#2787) or hangs on it as host.
+// Free-text mentions are NOT detected — the documented gap in entity.ts.
 //
-// Per reached note: consult the HOST entity's (entityType, not note-entry's
-// own) retention strategy first — blockDelete/anonymize must win over
-// erasure, same rule the automated forget-cleanup pipeline applies to every
-// other entity. The `strategy` this hook itself is called with is resolved
-// for note-entry, not the host, so it is deliberately unused here.
+// Per reached note the HOST entity's retention strategy (entityType, resolved
+// for the note's own tenant — the manual forget-subject path runs cross-tenant)
+// is consulted first: anonymize/blockDelete win over erasure, same rule the
+// automated forget-cleanup applies to every other entity.
 //
-// Precondition: this ONLY erases anything if the app mounts a KMS adapter —
-// without one, record-owned fields fall back to plaintext storage
-// framework-wide (see pii-field-encryption.ts) and forget is a true no-op.
-// That gap is a property of the framework's crypto-shredding design, not
-// specific to this hook; apps that need Art.17 coverage without KMS must
-// mount one.
-export const noteEntryDeleteHook = async (ctx) => {
+// Without a mounted KMS this erases nothing: record-owned fields fall back to
+// plaintext framework-wide (see pii-field-encryption.ts), so apps that need
+// Art. 17 coverage must mount one.
+export async function eraseNoteBodiesReachingSubject(args) {
     const kms = configuredPiiSubjectKms();
-    // skip: no KMS adapter mounted — record-owned fields stay plaintext framework-wide, forget is a true no-op
+    // skip: no KMS adapter mounted — forget is a true no-op
     if (!kms)
         return;
-    const mentions = await ctx.db.selectMany(noteMentionTable, {
-        subjectId: ctx.userId,
-    });
-    // skip: no note-mention rows for this user — nothing structurally reaches this user's data to shred
-    if (mentions.length === 0)
-        return;
-    const noteIds = new Set(mentions.map((m) => m.noteId));
-    // Once per hook run: the preset depends on the tenant only, not the note.
-    const tenantPreset = await resolveTenantRetentionPreset({
-        db: ctx.db,
-        registry: ctx.registry,
-        tenantId: ctx.tenantId,
-    });
-    // Append-only rows are never hard-deleted, so every mentioned note should
-    // resolve; a missing one has no host and thus no retention policy to consult.
-    const notes = await ctx.db.selectMany(noteEntryTable, {
-        id: { in: [...noteIds] },
-    });
-    const strategyByEntityType = new Map();
+    const notes = await selectNotesReachingSubject(args.db, args.subject);
+    const dataRetentionMounted = args.registry.features.has("data-retention");
+    const presetByTenant = new Map();
+    const strategyByTenantAndEntityType = new Map();
     for (const note of notes) {
-        let strategy = strategyByEntityType.get(note.entityType);
+        const strategyKey = `${note.tenantId}:${note.entityType}`;
+        let strategy = strategyByTenantAndEntityType.get(strategyKey);
         if (strategy === undefined) {
+            let tenantPreset = presetByTenant.get(note.tenantId);
+            if (tenantPreset === undefined) {
+                tenantPreset = await resolveTenantRetentionPreset({
+                    db: args.db,
+                    registry: args.registry,
+                    tenantId: note.tenantId,
+                });
+                presetByTenant.set(note.tenantId, tenantPreset);
+            }
             const hostPolicy = await resolveRetentionPolicyForTenant({
-                db: ctx.db,
-                registry: ctx.registry,
-                tenantId: ctx.tenantId,
+                db: args.db,
+                registry: args.registry,
+                tenantId: note.tenantId,
                 entityName: note.entityType,
                 preloadedTenantPreset: tenantPreset,
+                // Without data-retention there is no override table to read.
+                ...(!dataRetentionMounted && { preloadedOverride: null }),
             });
             strategy = policyToStrategy(hostPolicy.policy?.strategy ?? null);
-            strategyByEntityType.set(note.entityType, strategy);
+            strategyByTenantAndEntityType.set(strategyKey, strategy);
         }
         if (strategy === "anonymize")
             continue;
-        const noteId = note.id;
-        await kms.eraseKey({ kind: "record", entity: "note-entry", id: noteId }, {
-            requestId: "notes-history-user-data:forget-mentioned-notes",
-            userId: ctx.userId,
-            eraseReason: "notes-history:mention-forget",
+        await kms.eraseKey({ kind: "record", entity: "note-entry", id: note.id }, {
+            requestId: args.requestId,
+            userId: args.erasedBy,
+            eraseReason: "notes-history:subject-forget",
         });
     }
+}
+export const noteEntryDeleteHook = async (ctx) => {
+    await eraseNoteBodiesReachingSubject({
+        db: ctx.db,
+        registry: ctx.registry,
+        subject: { kind: "user", userId: ctx.userId },
+        erasedBy: ctx.userId,
+        requestId: "notes-history-user-data:forget-reached-notes",
+    });
 };
-// Erasure reaches every note that structurally mentions the user (see
-// noteEntryDeleteHook), so the Art. 15/20 export must list those notes too.
+// Erasure reaches every note that mentions the user or hangs on the user as host
+// (see eraseNoteBodiesReachingSubject), so the Art. 15/20 export lists those too.
 export const noteMentionExportHook = async (ctx) => {
-    const mentions = await ctx.db.selectMany(noteMentionTable, {
-        subjectId: ctx.userId,
-    });
-    if (mentions.length === 0)
-        return null;
-    const noteIds = [...new Set(mentions.map((m) => m.noteId))];
-    const notes = await ctx.db.selectMany(noteEntryTable, { id: { in: noteIds } });
+    const notes = await selectNotesReachingSubject(ctx.db, { kind: "user", userId: ctx.userId });
     if (notes.length === 0)
         return null;
     return {
         entity: "note-mention",
         rows: notes.map((note) => ({
-            noteId: note["id"],
-            entityType: note["entityType"],
-            entityId: note["entityId"],
-            body: note["body"],
-            insertedAt: note["insertedAt"],
+            noteId: note.id,
+            entityType: note.entityType,
+            entityId: note.entityId,
+            body: note.body,
+            insertedAt: note.insertedAt,
         })),
     };
 };

package/dist/notes-history-user-data/index.d.ts

@@ -1,3 +1,4 @@
+export { eraseNoteBodiesReachingSubject } from "./hooks.js";
 export declare const notesHistoryUserDataFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/notes-history-user-data/index.js

@@ -6,8 +6,9 @@
 // user-data-rights stack. Mirrors folders-user-data.
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { noteEntryDeleteHook, noteEntryExportHook, noteMentionDeleteHook, noteMentionExportHook, } from "./hooks.js";
+export { eraseNoteBodiesReachingSubject } from "./hooks.js";
 export const notesHistoryUserDataFeature = defineFeature("notes-history-user-data", (r) => {
-    r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook looks up `note-mention` for notes that structurally @-mention the forgotten user and crypto-shreds each reached note's row-subject key (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for notes without such a mention. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.");
+    r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.");
     // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
     // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
     // would throw an "effectively disabled" boot warning even though the

package/dist/personal-access-tokens/schema/api-token.d.ts

@@ -4,6 +4,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -70,6 +73,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -92,6 +96,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -114,6 +119,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/personal-access-tokens/screens.js

@@ -41,11 +41,13 @@ export const patListScreen = {
         {
             field: "createdAt",
             label: i18nKey("pat.list.col.created"),
+            hideOnNarrow: true,
             renderer: { format: "timestamp" },
         },
         {
             field: "expiresAt",
             label: i18nKey("pat.list.col.expires"),
+            hideOnNarrow: true,
             renderer: { format: "timestamp" },
         },
     ],

package/dist/secrets/table.d.ts

@@ -9,6 +9,7 @@ export declare const tenantSecretEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/sessions/schema/user-session.d.ts

@@ -4,6 +4,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -108,6 +110,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -130,6 +133,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/sessions/screens.js

@@ -33,6 +33,7 @@ export const createSessionListScreen = (adminRoles = access.admin) => ({
         {
             field: "revokedAt",
             label: i18nKey("sessions.list.col.revokedAt"),
+            hideOnNarrow: true,
             renderer: { format: "timestamp" },
         },
     ],
@@ -104,6 +105,7 @@ export const sessionMineScreen = {
         {
             field: "current",
             label: i18nKey("sessions.mine.col.current"),
+            hideOnNarrow: true,
             renderer: { format: "boolean" },
         },
     ],

package/dist/shared/index.d.ts

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { requireForTenant } from "./require-for-tenant.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/index.js

@@ -14,6 +14,7 @@ export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible,
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
+export { requireForTenant } from "./require-for-tenant.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/require-for-tenant.d.ts

@@ -0,0 +1,2 @@
+import type { HandlerContext, TenantId, TenantWriteTarget } from "@cosmicdrift/kumiko-framework/engine";
+export declare function requireForTenant(ctx: Pick<HandlerContext, "forTenant">, targetTenantId: TenantId): TenantWriteTarget;

package/dist/shared/require-for-tenant.js

@@ -0,0 +1,9 @@
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+// ctx.forTenant is absent for r.systemScope() handlers and without a db; a write handler that
+// needs a cross-tenant target must fail loudly instead of falling back to ctx.db.
+export function requireForTenant(ctx, targetTenantId) {
+    if (!ctx.forTenant) {
+        throw new InternalError({ message: "ctx.forTenant is not available in this handler context" });
+    }
+    return ctx.forTenant(targetTenantId);
+}

package/dist/tags/entity.d.ts

@@ -5,6 +5,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -27,6 +28,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -49,6 +51,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -73,6 +76,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -95,6 +99,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -117,6 +122,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -141,6 +147,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -163,6 +170,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -185,6 +193,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/template-resolver/handlers/collection-set.write.js

@@ -1,6 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { collectionStore, DEFAULT_COLLECTION_ACCESS, } from "./collection-shared.js";
 import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.js";
 // Upsert inside one collection. Mirrors set.write for text-blocks, but the
@@ -29,12 +30,11 @@ export function makeCollectionSetWrite(collection) {
             ? `Creates or overwrites the caller's own "${collection.id}" entry at a slug and locale, live on save with no draft stage; it always writes the acting user's entry, never another user's.`
             : `Creates or overwrites the tenant-wide "${collection.id}" entry at a slug and locale, live on save with no draft stage; the change is visible to everyone who may reach this shared collection.`,
         handler: async (event, ctx) => {
-            const db = ctx.db;
             const override = event.payload.tenantIdOverride;
             // @cast-boundary engine-payload — override is a zod-validated string, the
             // user's own tenantId is already TenantId-branded.
             const tenantId = (override ?? event.user.tenantId);
-            const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
+            const { db, streamTenantId } = requireForTenant(ctx, tenantId);
             // Scoped to the acting user even under a tenant override: a SystemAdmin
             // writing into another tenant still writes their own entry, never
             // someone else's signature.
@@ -59,7 +59,7 @@ export function makeCollectionSetWrite(collection) {
                         contentFormat: event.payload.contentFormat,
                         folder: event.payload.folder ?? null,
                     },
-                }, executorUser, db);
+                }, event.user, db, { streamTenantId });
                 if (!result.isSuccess)
                     return result;
                 return {
@@ -78,7 +78,7 @@ export function makeCollectionSetWrite(collection) {
                 folder: event.payload.folder ?? null,
                 ...store.createDefaults(tenantId),
                 ...owner,
-            }, executorUser, db);
+            }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {

package/dist/template-resolver/handlers/set.write.js

@@ -1,6 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { TEMPLATE_KINDS, TEXT_BLOCK_KIND } from "../constants.js";
 import { templateResourcesTable } from "../table.js";
 import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema } from "./shared.js";
@@ -42,15 +43,11 @@ export const setWrite = defineWriteHandler({
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
     description: "Creates or overwrites one content-tree resource addressed by slug, kind and locale, carrying a title and folder and going live on save with no draft stage; a SystemAdmin may target the system tenant, where shared legal and marketing copy lives.",
     handler: async (event, ctx) => {
-        const db = ctx.db;
         const override = event.payload.tenantIdOverride;
         // @cast-boundary engine-payload — override is a zod-validated string, the
         // user's own tenantId is already TenantId-branded.
         const tenantId = (override ?? event.user.tenantId);
-        // With an override the executor user has to move to the target tenant too,
-        // otherwise the event-store stream lookup runs against event.user.tenantId
-        // and reports a version conflict although the projection row exists.
-        const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
+        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
         const kind = event.payload.kind ?? TEXT_BLOCK_KIND;
         const existing = await fetchOne(db, templateResourcesTable, {
             tenantId,
@@ -87,7 +84,7 @@ export const setWrite = defineWriteHandler({
                     contentFormat: fields.contentFormat,
                     folder: fields.folder,
                 },
-            }, executorUser, db);
+            }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -95,7 +92,9 @@ export const setWrite = defineWriteHandler({
                 data: { slug: event.payload.slug, locale: event.payload.locale, isNew: false },
             };
         }
-        const result = await executor.create({ ...fields, tenantId }, executorUser, db);
+        const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+            streamTenantId,
+        });
         if (!result.isSuccess)
             return result;
         return {

package/dist/template-resolver/handlers/upsert-system.write.js

@@ -1,5 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { templateResourcesTable } from "../table.js";
 import { executor, upsertPayloadSchema } from "./shared.js";
 // System-Template anlegen/updaten. Liegt unter SYSTEM_TENANT_ID,
@@ -12,13 +13,10 @@ export const upsertSystemWrite = defineWriteHandler({
     access: { roles: ["SystemAdmin"] },
     description: "Creates or overwrites a system-default template under the system tenant with its full variable schema and linked resources, active straight away with no draft stage; SystemAdmin only, since tenants shadow these defaults through upsert-tenant instead.",
     handler: async (event, ctx) => {
-        const db = ctx.db;
         // @cast-boundary engine-payload — SYSTEM_TENANT_ID is a UUID literal,
         // asserted to the branded TenantId (parseTenantId equivalent).
         const tenantId = SYSTEM_TENANT_ID;
-        // The executor user must carry SYSTEM_TENANT as tenantId, otherwise the
-        // event store looks up the stream under user.tenantId → conflict.
-        const executorUser = { ...event.user, tenantId };
+        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
         const existing = await fetchOne(db, templateResourcesTable, {
             tenantId,
             slug: event.payload.slug,
@@ -41,7 +39,7 @@ export const upsertSystemWrite = defineWriteHandler({
             status: "active",
         };
         if (existing) {
-            const result = await executor.update({ id: existing.id, version: existing.version, changes: fields }, executorUser, db);
+            const result = await executor.update({ id: existing.id, version: existing.version, changes: fields }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -49,7 +47,9 @@ export const upsertSystemWrite = defineWriteHandler({
                 data: { id: String(existing.id), slug: event.payload.slug, isNew: false },
             };
         }
-        const result = await executor.create({ ...fields, tenantId }, executorUser, db);
+        const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+            streamTenantId,
+        });
         if (!result.isSuccess)
             return result;
         // @cast-boundary db-row — executor.create returnt Record-row aus

package/dist/template-resolver/handlers/upsert-tenant.write.js

@@ -2,6 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { templateResourcesTable } from "../table.js";
 import { executor, upsertPayloadSchema } from "./shared.js";
 // Tenant-Override anlegen/updaten. Liegt unter event.user.tenantId,
@@ -18,7 +19,6 @@ export const upsertTenantWrite = defineWriteHandler({
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
     description: "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live; it refuses a system-tenant target, which is what upsert-system is for.",
     handler: async (event, ctx) => {
-        const db = ctx.db;
         const override = event.payload.tenantIdOverride;
         // upsertTenant erzeugt scope='tenant'. SYSTEM_TENANT_ID-Override würde
         // scope='tenant' unter SYSTEM_TENANT_ID schreiben → inkonsistenter Zustand
@@ -34,7 +34,7 @@ export const upsertTenantWrite = defineWriteHandler({
         // event.user.tenantId schon TenantId-branded; union als TenantId casten
         // ist legit (override ist UUID-Format-validiert in schema).
         const tenantId = (override ?? event.user.tenantId);
-        const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
+        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
         const existing = await fetchOne(db, templateResourcesTable, {
             tenantId,
             slug: event.payload.slug,
@@ -56,7 +56,7 @@ export const upsertTenantWrite = defineWriteHandler({
             status: event.payload.status,
         };
         if (existing) {
-            const result = await executor.update({ id: existing.id, version: existing.version, changes: fields }, executorUser, db);
+            const result = await executor.update({ id: existing.id, version: existing.version, changes: fields }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -64,7 +64,9 @@ export const upsertTenantWrite = defineWriteHandler({
                 data: { id: String(existing.id), slug: event.payload.slug, isNew: false },
             };
         }
-        const result = await executor.create({ ...fields, tenantId }, executorUser, db);
+        const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+            streamTenantId,
+        });
         if (!result.isSuccess)
             return result;
         // @cast-boundary db-row — executor.create returnt Record-row aus