@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/dist/compliance-profiles/seeding.js

@@ -1,22 +1,21 @@
-// Test-Helper für compliance-profiles. Legt einen Profile-Eintrag direkt
-// über den Event-Store-Executor an — gleicher Pfad wie der echte
-// set-profile-Handler, aber ohne Zod-Schema-Engung (akzeptiert
-// minimal-no-region für Migration-Edge-Case-Tests) und ohne Access-
-// Check. Default ifExists="skip": nur fehlende Profile anlegen.
+// Test helper for compliance-profiles. Creates a profile entry directly
+// through the Event Store executor—the same path as the real
+// set-profile handler, but without Zod schema restrictions (accepts
+// minimal-no-region for migration edge-case tests) and without an access
+// check. Default ifExists="skip": creates only missing profiles.
 //
-// Sprint 2 user-data-rights nutzt das fuer Test-Setup ("user kann
-// Daten exportieren mit profile X" — pro Test ein frischer Tenant +
-// Profile-Wahl in einem Helper-Call).
+// user-data-rights uses this for test setup ("user can export data with
+// profile X": a fresh tenant and profile selection per test in one helper
+// call).
 //
-// Pattern matched seedTextBlock aus text-content.
+// The pattern matches seedTextBlock in template-resolver/seeding.ts.
 import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { runEventStoreSeed, TestUsers, } from "@cosmicdrift/kumiko-framework/seeding";
 import { tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "./schema/profile-selection.js";
 const executor = createEventStoreExecutor(tenantComplianceProfileTable, tenantComplianceProfileEntity, { entityName: "tenant-compliance-profile" });
 export async function seedComplianceProfile(db, opts) {
-    // user.tenantId muss === opts.tenantId sein damit Event-Store-Stream
-    // + Projection im selben Tenant-Bucket landen (Memory:
-    // feedback_event_store_tenant_consistency).
+    // user.tenantId must equal opts.tenantId so the Event Store stream
+    // and projection remain in the same tenant bucket.
     const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
     const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
     const overrideJson = opts.override !== undefined ? JSON.stringify(opts.override) : null;
@@ -35,9 +34,9 @@ export async function seedComplianceProfile(db, opts) {
             if (!result.isSuccess) {
                 throw new Error(`seedComplianceProfile create failed: ${JSON.stringify(result)}`);
             }
-            // @cast-boundary db-row: executor.create result.data ist die
-            // inserted Projection-Row (Record<string, unknown>); id ist nach
-            // INSERT garantiert (Runtime-Check direkt darunter).
+            // @cast-boundary db-row: executor.create result.data is the
+            // inserted projection row (Record<string, unknown>); id is guaranteed
+            // after INSERT (runtime check directly below).
             const data = result.data;
             if (data.id === undefined) {
                 throw new Error("seedComplianceProfile: executor.create did not return an id");

package/dist/compliance-profiles-ops/handlers/tenants-missing-profile.query.js

@@ -4,12 +4,12 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { tenantComplianceProfileTable } from "../../compliance-profiles/index.js";
 import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
-// SystemAdmin platform-wide counterpart to needs-profile (#2089).
+// SystemAdmin platform-wide counterpart to needs-profile.
 //
-// #2084 stopped needs-profile from nagging a TenantAdmin who can no longer
+// The change stopped needs-profile from nagging a TenantAdmin who can no longer
 // reach a picker narrowed to access.systemAdmin — correct, but it left no
 // one else able to notice: needs-profile stays TenantAdmin-only on purpose
-// (widening its call-access was explicitly rejected in #2084), so a
+// (widening its call-access was explicitly rejected), so a
 // SystemAdmin who owns the platform-only picker has no way to see which
 // tenants still run on minimal-no-region. This query fills that gap
 // instead of touching needs-profile: every enabled tenant that has no row

package/dist/compliance-profiles-ops/index.js

@@ -1,8 +1,8 @@
 // compliance-profiles-ops — platform-wide SystemAdmin visibility into
-// tenants missing a compliance-profile selection (#2089).
+// tenants missing a compliance-profile selection.
 //
 // needs-profile (compliance-profiles) tells a TenantAdmin they must pick a
-// profile, but stays TenantAdmin-only by design (#2084) — a SystemAdmin who
+// profile, but stays TenantAdmin-only by design — a SystemAdmin who
 // owns a picker narrowed to access.systemAdmin has no query at all. Kept as
 // a separate feature (mirrors folders-user-data/notes-history-user-data)
 // rather than folded into compliance-profiles: this is the one genuinely

package/dist/config/handlers/cascade.query.d.ts

@@ -2,4 +2,9 @@ import { type ConfigCascade } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 export declare const cascadeQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"cascade", z.ZodObject<{
     keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    scope: z.ZodOptional<z.ZodEnum<{
+        system: "system";
+        tenant: "tenant";
+        user: "user";
+    }>>;
 }, z.core.$strip>, Record<string, ConfigCascade>, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/config/handlers/cascade.query.js

@@ -1,13 +1,14 @@
-import { defineQueryHandler, isEncryptedAtRest, } from "@cosmicdrift/kumiko-framework/engine";
+import { ConfigScopes, defineQueryHandler, isEncryptedAtRest, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { requireConfigResolver, requireSystemDb } from "../feature.js";
 import { MASKED, redactInheritedCascade, shouldRedactInherited } from "../read-redaction.js";
-import { hasConfigAccess } from "../write-helpers.js";
+import { hasConfigAccess, keyDefAtScope } from "../write-helpers.js";
 export const cascadeQuery = defineQueryHandler({
     name: "cascade",
     description: "Shows, per config key the caller may read, the value at every cascade level (user, tenant, system, app override, default) and which level won; use it to explain where a setting's current value comes from.",
     schema: z.object({
         keys: z.array(z.string()).optional(),
+        scope: z.enum([ConfigScopes.system, ConfigScopes.tenant, ConfigScopes.user]).optional(),
     }),
     access: {
         openToAll: {
@@ -34,7 +35,7 @@ export const cascadeQuery = defineQueryHandler({
                 continue;
             if (!hasConfigAccess(keyDef.access.read, query.user.roles))
                 continue;
-            keyDefs.set(key, keyDef);
+            keyDefs.set(key, keyDefAtScope(keyDef, query.payload.scope, query.user.roles));
             filteredKeys.push(key);
         }
         const cascades = await resolver.getCascadeBatch(filteredKeys, keyDefs, query.user.tenantId, query.user.id, db, ctx.secrets);

package/dist/config/handlers/readiness.query.d.ts

@@ -9,10 +9,10 @@ export type ReadinessMissingKey = {
 export type RequiredKeyGate = (qualifiedName: string) => boolean;
 export declare function buildProviderSelectionGate(ctx: HandlerContext, callerQn: string, user: SessionUser, db: TenantDb): Promise<RequiredKeyGate>;
 export declare function collectMissingRequiredConfig(ctx: HandlerContext, callerQn: string, user: SessionUser, db: TenantDb, gate?: RequiredKeyGate, options?: {
-    /** Verdict-Pfade (Rollup, selbst role-gated) MÜSSEN ungefiltert zählen:
-     *  der Per-Key-read-Filter ist Info-Disclosure-Schutz für den
-     *  openToAll-Handler — im Verdict droppte er SystemAdmin-gated
-     *  required-Keys still und meldete ready:true trotz Lücke. */
+    /** Verdict paths (rollup, themselves role-gated) MUST count without filtering:
+     *  the per-key read filter protects the openToAll handler from information
+     *  disclosure, but in the verdict it dropped SystemAdmin-gated required keys
+     *  and incorrectly reported ready:true despite the gap. */
     readonly skipAccessFilter?: boolean;
 }): Promise<ReadinessMissingKey[]>;
 export declare const readinessQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"readiness", z.ZodObject<{}, z.core.$strip>, {

package/dist/config/handlers/readiness.query.js

@@ -95,7 +95,7 @@ export const readinessQuery = defineQueryHandler({
         const db = requireSystemDb(ctx, "config:query:readiness", query.user.tenantId);
         const missing = await collectMissingRequiredConfig(ctx, "config:query:readiness", query.user, db);
         // Additive, display-ready fields for the admin-shell dashboard stat
-        // panel (fw#2312) — `missing` itself stays untouched for existing
+        // panel — `missing` itself stays untouched for existing
         // consumers that read the array directly.
         return {
             missing,

package/dist/config/handlers/reencrypt.job.js

@@ -16,8 +16,8 @@
 // the NEW envelope: after a full run even a from-scratch rebuild only
 // ever sees the current-KEK envelope.
 //
-// systemScope() fail-closed pattern (framework#2056): the initial scan is
-// intentionally cross-tenant (system-wide key rotation), acknowledged via
+// systemScope() fail-closed pattern: the initial scan is intentionally
+// cross-tenant (system-wide key rotation), acknowledged via
 // UncheckedSystemDb.acknowledgeCrossTenant(). Rows are bucketed by tenant,
 // and assertRowsTenant() re-verifies each row against its bucket's tenant
 // right before the write — both checks are built locally from the exported
@@ -163,9 +163,8 @@ export const reencryptJob = async (rawPayload, ctx) => {
             return "failed";
         }
         // Re-verify the row's own tenantId against the bucket it was scanned
-        // into, right before the write (framework#2072) — a mismatch here
-        // fails this row only (via onRowError below), it does not abort the
-        // whole job.
+        // into, right before the write — a mismatch here fails this row only
+        // (via onRowError below), it does not abort the whole job.
         sdbFor(tenantId).assertRowsTenant([row], "tenantId");
         const plaintext = await cipher.decrypt(row.value, { tenantId });
         const reencrypted = await cipher.encrypt(plaintext, { tenantId });

package/dist/config/handlers/set.write.js

@@ -45,7 +45,8 @@ export const setWrite = defineWriteHandler({
         // rejected), but an admin override write can still target scope=
         // "system" for a tenant/user-scoped key (validateScope allows any
         // requestedScope <= definedScope) — system-row has no subject.
-        if (keyDef.piiEncrypted && scope === ConfigScopes.system) {
+        const piiScope = keyDef.piiEncrypted && scope !== ConfigScopes.system ? scope : undefined;
+        if (keyDef.piiEncrypted && piiScope === undefined) {
             return writeFailure(new UnprocessableError("invalid_scope", {
                 i18nKey: "config.errors.invalidScope",
                 details: { key: event.payload.key, definedScope: keyDef.scope, requestedScope: scope },
@@ -110,7 +111,7 @@ export const setWrite = defineWriteHandler({
             const cipher = requireConfigEncryption(ctx, "config:write:set");
             serialized = await cipher.encrypt(serialized, { tenantId });
         }
-        else if (keyDef.piiEncrypted) {
+        else if (piiScope !== undefined) {
             const kms = configuredPiiSubjectKms();
             if (!kms) {
                 throw new InternalError({
@@ -119,8 +120,7 @@ export const setWrite = defineWriteHandler({
                         `configurePiiSubjectKms(adapter) at boot.`,
                 });
             }
-            // scope="system" was already rejected above — narrow accordingly.
-            const subject = resolvePiiSubject(scope, tenantId, userId);
+            const subject = resolvePiiSubject(piiScope, tenantId, userId);
             const kmsCtx = {
                 requestId: requestContext.get()?.requestId ?? "config:write:set",
                 tenantId,

package/dist/config/handlers/values.query.d.ts

@@ -2,6 +2,11 @@ import { type ConfigScope, type ConfigValueSource } from "@cosmicdrift/kumiko-fr
 import * as z from "zod";
 export declare const valuesQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"values", z.ZodObject<{
     keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    scope: z.ZodOptional<z.ZodEnum<{
+        system: "system";
+        tenant: "tenant";
+        user: "user";
+    }>>;
 }, z.core.$strip>, Record<string, {
     value: string | number | boolean | undefined;
     scope: ConfigScope;

package/dist/config/handlers/values.query.js

@@ -1,13 +1,14 @@
-import { defineQueryHandler, isEncryptedAtRest, } from "@cosmicdrift/kumiko-framework/engine";
+import { ConfigScopes, defineQueryHandler, isEncryptedAtRest, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { requireConfigResolver, requireSystemDb } from "../feature.js";
 import { MASKED, redactInheritedCascade, shouldRedactInherited } from "../read-redaction.js";
-import { hasConfigAccess } from "../write-helpers.js";
+import { hasConfigAccess, keyDefAtScope } from "../write-helpers.js";
 export const valuesQuery = defineQueryHandler({
     name: "values",
     description: "Returns the effective value, scope and winning source for every config key the caller may read (optionally narrowed to `keys`), with encrypted and secret-backed values masked; use it to inspect the current settings.",
     schema: z.object({
         keys: z.array(z.string()).optional(),
+        scope: z.enum([ConfigScopes.system, ConfigScopes.tenant, ConfigScopes.user]).optional(),
     }),
     // Per-key read access enforced via hasConfigAccess inside the handler.
     access: {
@@ -34,7 +35,7 @@ export const valuesQuery = defineQueryHandler({
                 continue;
             if (!hasConfigAccess(keyDef.access.read, query.user.roles))
                 continue;
-            keyDefs.set(qualifiedKey, keyDef);
+            keyDefs.set(qualifiedKey, keyDefAtScope(keyDef, query.payload.scope, query.user.roles));
             filteredKeys.push(qualifiedKey);
         }
         // Resolve through the full cascade (rows → app-override → computed →

package/dist/config/resolver.js

@@ -402,10 +402,10 @@ export function validateAppOverrides(registry, overrides) {
         if (keyDef.computed) {
             throw new Error(`App-Boot-Override for "${key}": this key has a computed resolver (plan-based / derived). App-overrides would silently bypass that logic — remove the override, or remove the computed resolver if a flat deploy-default is intended.`);
         }
-        // Per keyDef.type narrow value inline — TS narrowt nicht durch
-        // `typeof value !== typeForKey(...)` (typeForKey returnt string,
-        // kein discriminator). Das vermeidet `value as string|number` casts
-        // unten, weil value innerhalb des Branches schon typed ist.
+        // Narrow by keyDef.type inline because TypeScript cannot narrow through
+        // `typeof value !== typeForKey(...)`, whose return type is string rather
+        // than a discriminator. This avoids `value as string|number` casts below;
+        // value is correctly typed within each branch.
         if (keyDef.type === "number") {
             if (typeof value !== "number") {
                 throw new Error(`App-Boot-Override for "${key}": expected number, got ${typeof value}`);

package/dist/config/table.js

@@ -2,19 +2,19 @@ import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createTextField } from "@cosmicdrift/kumiko-framework/engine";
 // Config values are event-sourced. Each (key, scope) is its own aggregate
 // stream — lifecycle events `configValue.created / .updated / .deleted`
-// flow through createEventStoreExecutor, which writes the stream + this
-// projection in one TX. Reads stay O(1) against the projection.
+// flow through createEventStoreExecutor, which writes the stream and this
+// projection in one TX. Reads remain O(1) against the projection.
 //
 // System-scope rows use SYSTEM_TENANT_ID (not null) — buildBaseColumns
-// (via buildEntityTable) forces tenant_id NOT NULL, so die pre-ES "NULL
-// means system" convention is replaced with a fixed sentinel. Der unique
-// index über (key, tenant_id, user_id) prevent duplicate writes at the DB
-// level — deklariert via entity.indexes.
+// (via buildEntityTable) forces tenant_id NOT NULL, so the pre-ES "NULL
+// means system" convention is replaced with a fixed sentinel. The unique
+// index on (key, tenant_id, user_id) prevents duplicate writes at the DB
+// level — declared via entity.indexes.
 //
-// Single-Source-of-Truth: `configValueEntity`. Die DB-Tabelle wird über
-// buildEntityTable aus der EntityDefinition abgeleitet, der unique-Index
-// ist via entity.indexes deklariert. Plural-Re-Export `configValuesTable`
-// dient handlers (`reset.write.ts` etc.) als typisierte Drizzle-Table-Ref.
+// Single source of truth: `configValueEntity`. The DB table is derived from
+// the EntityDefinition through buildEntityTable, and the unique index is
+// declared via entity.indexes. The plural re-export `configValuesTable`
+// provides handlers (`reset.write.ts` etc.) with a typed Drizzle table ref.
 export const configValueEntity = createEntity({
     table: "read_config_values",
     fields: {

package/dist/config/write-helpers.d.ts

@@ -35,6 +35,7 @@ export declare function checkWriteAccess(keyDef: ConfigKeyDefinition, userRoles:
  */
 export declare function checkScopeWriteAccess(scope: ConfigScope, userRoles: readonly string[]): KumikoError | null;
 export declare function validateScope(requestedScope: ConfigScope, definedScope: ConfigScope, key: string): KumikoError | null;
+export declare function keyDefAtScope(keyDef: ConfigKeyDefinition, readScope: ConfigScope | undefined, roles: readonly string[]): ConfigKeyDefinition;
 export declare function resolveScopeIds(scope: ConfigScope, tenantId: TenantId, userId: string): {
     tenantId: TenantId;
     userId: string | null;

package/dist/config/write-helpers.js

@@ -33,10 +33,9 @@ export async function findConfigRow(db, key, tenantId, userId) {
 export async function configRowHoldsValue(row, keyDef, cipher, qualifiedKey, serializedValue) {
     if (row?.value === null || row?.value === undefined)
         return false;
-    if (!keyDef?.encrypted && !keyDef?.piiEncrypted)
+    if (keyDef === undefined || (!keyDef.encrypted && !keyDef.piiEncrypted)) {
         return row.value === serializedValue;
-    if (!keyDef)
-        return false;
+    }
     try {
         return (await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey)) === serializedValue;
     }
@@ -112,12 +111,7 @@ export function checkScopeWriteAccess(scope, userRoles) {
     });
 }
 export function validateScope(requestedScope, definedScope, key) {
-    const levels = {
-        [ConfigScopes.system]: 0,
-        [ConfigScopes.tenant]: 1,
-        [ConfigScopes.user]: 2,
-    };
-    if (levels[requestedScope] > levels[definedScope]) {
+    if (SCOPE_LEVEL[requestedScope] > SCOPE_LEVEL[definedScope]) {
         return new UnprocessableError("invalid_scope", {
             i18nKey: "config.errors.invalidScope",
             details: { key, definedScope, requestedScope },
@@ -125,6 +119,21 @@ export function validateScope(requestedScope, definedScope, key) {
     }
     return null;
 }
+const SCOPE_LEVEL = {
+    [ConfigScopes.system]: 0,
+    [ConfigScopes.tenant]: 1,
+    [ConfigScopes.user]: 2,
+};
+// Reads a tenant/user key at a narrower scope, e.g. system for a system-level screen.
+// Only a SystemAdmin may widen the read to the platform level; everyone else keeps the normal cascade.
+export function keyDefAtScope(keyDef, readScope, roles) {
+    if (readScope === undefined ||
+        !roles.includes("SystemAdmin") ||
+        SCOPE_LEVEL[readScope] >= SCOPE_LEVEL[keyDef.scope]) {
+        return keyDef;
+    }
+    return { ...keyDef, scope: readScope };
+}
 export function resolveScopeIds(scope, tenantId, userId) {
     switch (scope) {
         case ConfigScopes.system:
@@ -138,7 +147,7 @@ export function resolveScopeIds(scope, tenantId, userId) {
     }
 }
 // The subject a piiEncrypted config value is encrypted under, for the scope
-// actually written to (kumiko-platform#231/#459). Pure — no I/O — so a bug
+// actually written to. Pure — no I/O — so a bug
 // here (e.g. picking the writer's identity instead of the row's target,
 // see entity fields' explicit userOwned.ownerField for why that
 // distinction matters) is caught by a fast unit test, not only the DB-

package/dist/crypto-shredding/handlers/forget-subject.write.d.ts

@@ -7,7 +7,7 @@ export declare const forgetSubjectSchema: z.ZodObject<{
         userId: z.ZodUUID;
     }, z.core.$strip>, z.ZodObject<{
         kind: z.ZodLiteral<"tenant">;
-        tenantId: z.ZodPipe<z.ZodUUID, z.ZodTransform<string, string>>;
+        tenantId: z.ZodUUID;
     }, z.core.$strip>, z.ZodObject<{
         kind: z.ZodLiteral<"record">;
         entity: z.ZodString;
@@ -39,7 +39,7 @@ export declare const forgetSubjectWrite: import("@cosmicdrift/kumiko-types/defin
         userId: z.ZodUUID;
     }, z.core.$strip>, z.ZodObject<{
         kind: z.ZodLiteral<"tenant">;
-        tenantId: z.ZodPipe<z.ZodUUID, z.ZodTransform<string, string>>;
+        tenantId: z.ZodUUID;
     }, z.core.$strip>, z.ZodObject<{
         kind: z.ZodLiteral<"record">;
         entity: z.ZodString;

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -54,7 +54,7 @@ function subjectAggregateId(raw) {
     }
 }
 // The record subject names its own entity — resolve it against the registry
-// instead of trusting the payload straight into resolveTableName/SQL (#2786).
+// instead of trusting the payload straight into resolveTableName/SQL.
 function findRegisteredEntity(features, entityName) {
     for (const feature of features.values()) {
         const entity = feature.entities?.[entityName];
@@ -63,7 +63,7 @@ function findRegisteredEntity(features, entityName) {
     }
     return undefined;
 }
-// Tenant-scope guard (mh#349): DataProtectionOfficer is a tenant-scoped role,
+// Tenant-scope guard: DataProtectionOfficer is a tenant-scoped role,
 // but the handler otherwise erases ANY subject cross-tenant on a raw
 // (un-scoped) client — a Tenant-A DPO who learns a Tenant-B subject id
 // (export, support ticket, log line) could destroy it. SystemAdmin
@@ -111,7 +111,7 @@ async function resolveTenantScopeDenial(db, features, user, raw) {
     const ownedInTenant = await subjectRowExistsInTenant(db, features, raw.userId, user.tenantId);
     return ownedInTenant ? undefined : memberDenied;
 }
-// fw#2789/#2805: blockDelete (legally mandated physical retention, e.g.
+// blockDelete (legally mandated physical retention, e.g.
 // ledger/invoice text) means this command must refuse, not silently
 // anonymize or proceed. Refused when the host entity itself declares
 // blockDelete OR the owning tenant's effective data-retention policy
@@ -162,8 +162,8 @@ function denialReasonOf(failure) {
     }
     return failure.error.code;
 }
-// Denied cross-tenant probes must still leave an audit trail (fw#2348).
-// Appended outside the handler tx (fw#2592): the caller's
+// Denied cross-tenant probes must still leave an audit trail.
+// Appended outside the handler tx: the caller's
 // `return tenantScopeDenial` rolls that tx back.
 async function appendDenialAuditEvent(ctx, event, subjectKey, subjectKind, denialCode, denialAuditRunner) {
     if (!denialAuditRunner) {
@@ -195,7 +195,7 @@ async function appendDenialAuditEvent(ctx, event, subjectKey, subjectKind, denia
         registry: ctx.registry,
         db: denialAuditRunner,
         // MUST be event.user.tenantId, never SYSTEM_TENANT_ID — unsafeRaw
-        // bypasses TenantDb's scoping, so this is the only guard against a cross-tenant denial event (fw#2452).
+        // bypasses TenantDb's scoping, so this is the only guard against a cross-tenant denial event.
         tenantId: event.user.tenantId,
         userId: String(event.user.id),
         callSiteLabel: "forget-subject denial audit",
@@ -224,7 +224,6 @@ function sweepErrorLabel(err) {
 // Each step runs in its own savepoint: a database error must not abort the handler
 // transaction, and one failing step must not skip or roll back the others.
 async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner, audit, rawSubject) {
-    const recordTenantId = await owningTenantOfRecordSubject(crossTenantRunner, ctx.registry.features, rawSubject);
     const failureLabels = [];
     const runStep = async (step) => {
         try {
@@ -235,10 +234,10 @@ async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunn
         }
     };
     await runStep(async (crossTenantSubjectRunner) => {
-        // Blind-index sweep (#818): nulls bidx columns now so the deterministic
+        // Blind-index sweep: nulls bidx columns now so the deterministic
         // HMAC doesn't stay equality-matchable; raw because the ciphertext prefix addresses the subject across tenants.
         await nullBlindIndexesForSubject(crossTenantSubjectRunner, ctx.registry.features, subjectKey);
-        // Derived search index still holds plaintext (#1610) — purge next to the
+        // Derived search index still holds plaintext — purge next to the
         // blind-index sweep. No adapter → no-op (apps without search).
         if (ctx.searchAdapter) {
             await purgeSearchDocumentsForSubject(crossTenantSubjectRunner, ctx.registry.features, ctx.searchAdapter, subjectKey, subject);
@@ -254,15 +253,19 @@ async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunn
         }
     });
     // File columns hold only the fileRef id, so the key erase never reaches the bytes.
-    await runStep((crossTenantSubjectRunner) => purgeFilesReachingSubject({
-        registry: ctx.registry,
-        db: crossTenantSubjectRunner,
-        subject,
-        subjectKey,
-        ...(recordTenantId !== undefined && { recordTenantId }),
-        resolveDeleteBytes: resolveFileBytesDeleter(ctx),
-        missingStorage: { mode: "fail" },
-    }));
+    await runStep(async (crossTenantSubjectRunner) => {
+        // Inside the step: a failing owner lookup must land in the audit label, not abort the handler.
+        const recordTenantId = await owningTenantOfRecordSubject(crossTenantSubjectRunner, ctx.registry.features, rawSubject);
+        await purgeFilesReachingSubject({
+            registry: ctx.registry,
+            db: crossTenantSubjectRunner,
+            subject,
+            subjectKey,
+            ...(recordTenantId !== undefined && { recordTenantId }),
+            resolveDeleteBytes: resolveFileBytesDeleter(ctx),
+            missingStorage: { mode: "fail" },
+        });
+    });
     return failureLabels[0];
 }
 // Email subscribers and other non-user entities use user-style subject keys
@@ -310,7 +313,8 @@ async function appendSubjectForgotten(ctx, event, aggregateId, payload, outsideR
         await appendDomainEventCore({
             registry: ctx.registry,
             db: outsideRunner,
-            // MUST be event.user.tenantId, never SYSTEM_TENANT_ID — unsafeRaw bypasses TenantDb's scoping (fw#2452).
+            // MUST be event.user.tenantId, never SYSTEM_TENANT_ID — unsafeRaw bypasses TenantDb's
+            // scoping.
             tenantId: event.user.tenantId,
             userId: String(event.user.id),
             callSiteLabel: "forget-subject audit",
@@ -331,7 +335,7 @@ async function appendSubjectForgotten(ctx, event, aggregateId, payload, outsideR
 // The automated Art.-17 path (user-data-rights forget-cleanup) calls
 // kms.eraseKey directly inside its per-user sub-tx; this command is the
 // standalone trigger for cases outside that pipeline (authority requests,
-// tenant-destroy in Sprint 5, operator recovery).
+// tenant-destroy, operator recovery).
 export const forgetSubjectWrite = defineWriteHandler({
     name: "forget-subject",
     schema: forgetSubjectSchema,
@@ -393,7 +397,7 @@ export const forgetSubjectWrite = defineWriteHandler({
         // callable. Mirror of the automated Art.-17 path (userDeleteHook:
         // status=Deleted; apiTokenDeleteHook: revoke):
         //   - user.updated as lifecycle event (updateUserLifecycle), so a
-        //     read_users rebuild doesn't wipe the flip (#494)
+        //     read_users rebuild doesn't wipe the flip
         //   - sessions don't need active revocation — session-callbacks
         //     re-validate user.status on every request (isPrincipalBlocked
         //     blocks Deleted).

package/dist/custom-fields/aggregate-id.d.ts

@@ -1,19 +1,18 @@
 /**
- * Deterministic aggregate-id für ein fieldDefinition-Aggregate aus dem
- * Tripel (tenantId, entityName, fieldKey). Pro (Tenant|System, Entity,
- * FieldKey) existiert genau ein Aggregate.
+ * Deterministic aggregate ID for a fieldDefinition aggregate from the tuple
+ * (tenantId, entityName, fieldKey). Exactly one aggregate exists per
+ * (Tenant|System, Entity, FieldKey).
  *
- * **Scope-Semantik:**
- *   - System-Scope: `tenantId = SYSTEM_TENANT_ID` → die fieldDefinition
- *     gilt für alle Tenants (vendor-defined).
- *   - Tenant-Scope: `tenantId = <tenant-uuid>` → pro Tenant eigene
+ * **Scope semantics:**
+ *   - System scope: `tenantId = SYSTEM_TENANT_ID` → the fieldDefinition applies
+ *     to all tenants (vendor-defined).
+ *   - Tenant scope: `tenantId = <tenant-uuid>` → each tenant has its own
  *     fieldDefinition.
  *
- * **Conflict-Rule** (durchgesetzt im write-handler, NICHT via DB-constraint):
- *   Pro (entityName, fieldKey) darf nur EINE Definition existieren — entweder
- *   system oder tenant, nicht beide. Wenn system `customer.internalNumber`
- *   definiert, kann Tenant kein eigenes `customer.internalNumber` mehr
- *   definieren (422 `fieldKey_conflict`). Verhindert Resolution-Ambiguität
- *   beim Read.
+ * **Conflict rule** (enforced in the write handler, NOT via a DB constraint):
+ *   Only ONE definition may exist per (entityName, fieldKey)—system or tenant,
+ *   but not both. If system defines `customer.internalNumber`, a tenant cannot
+ *   define its own `customer.internalNumber` (422 `fieldKey_conflict`). This
+ *   prevents ambiguity when resolving the field during reads.
  */
 export declare function fieldDefinitionAggregateId(tenantId: string, entityName: string, fieldKey: string): string;

package/dist/custom-fields/aggregate-id.js

@@ -1,26 +1,25 @@
 import { v5 as uuidv5 } from "uuid";
-// Fixed UUID-namespace für custom-field-definition aggregate-id-Ableitung.
-// Generiert einmalig (2026-05-22), in Stein gemeißelt: ein Wechsel würde
-// jeden existing fieldDefinition-Stream re-keyen → kaputter event-replay,
-// kaputte definition-history. Drift-Pin in __tests__/drift.test.ts.
+// Fixed UUID namespace for deriving custom-field definition aggregate IDs.
+// Generated once; changing it would re-key every existing fieldDefinition stream,
+// breaking event replay and definition history. Drift is pinned in
+// __tests__/drift.test.ts.
 const FIELD_DEFINITION_NAMESPACE = "f1d3b2c7-4e5a-4b9c-8d1f-2a3b4c5d6e7f";
 /**
- * Deterministic aggregate-id für ein fieldDefinition-Aggregate aus dem
- * Tripel (tenantId, entityName, fieldKey). Pro (Tenant|System, Entity,
- * FieldKey) existiert genau ein Aggregate.
+ * Deterministic aggregate ID for a fieldDefinition aggregate from the tuple
+ * (tenantId, entityName, fieldKey). Exactly one aggregate exists per
+ * (Tenant|System, Entity, FieldKey).
  *
- * **Scope-Semantik:**
- *   - System-Scope: `tenantId = SYSTEM_TENANT_ID` → die fieldDefinition
- *     gilt für alle Tenants (vendor-defined).
- *   - Tenant-Scope: `tenantId = <tenant-uuid>` → pro Tenant eigene
+ * **Scope semantics:**
+ *   - System scope: `tenantId = SYSTEM_TENANT_ID` → the fieldDefinition applies
+ *     to all tenants (vendor-defined).
+ *   - Tenant scope: `tenantId = <tenant-uuid>` → each tenant has its own
  *     fieldDefinition.
  *
- * **Conflict-Rule** (durchgesetzt im write-handler, NICHT via DB-constraint):
- *   Pro (entityName, fieldKey) darf nur EINE Definition existieren — entweder
- *   system oder tenant, nicht beide. Wenn system `customer.internalNumber`
- *   definiert, kann Tenant kein eigenes `customer.internalNumber` mehr
- *   definieren (422 `fieldKey_conflict`). Verhindert Resolution-Ambiguität
- *   beim Read.
+ * **Conflict rule** (enforced in the write handler, NOT via a DB constraint):
+ *   Only ONE definition may exist per (entityName, fieldKey)—system or tenant,
+ *   but not both. If system defines `customer.internalNumber`, a tenant cannot
+ *   define its own `customer.internalNumber` (422 `fieldKey_conflict`). This
+ *   prevents ambiguity when resolving the field during reads.
  */
 // @wrapper-known uuid-domain
 export function fieldDefinitionAggregateId(tenantId, entityName, fieldKey) {