@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/tier-engine/__tests__/tier-engine.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -11,7 +11,10 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { expectErrorIncludes } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { type ConfigResolver, createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -38,8 +41,8 @@ const tenantFeature = createTenantFeature();
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(testEncryptionKey);
-  resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(testEncryptionKey);
+  resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [configFeature, tenantFeature, tierEngineFeature],

package/src/tier-engine/__tests__/trial-config-validation.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+import type { TierMap } from "../compose-app";
+import { createTierEngineFeature } from "../feature";
+
+type Caps = { readonly apps: number };
+
+const tierMap: TierMap<Caps> = {
+  free: { features: [], caps: { apps: 1 } },
+  pro: { features: ["designer"], caps: { apps: 5 } },
+};
+
+describe("createTierEngineFeature trial config validation", () => {
+  test("throws at construction when trial.tier is not a key in tierMap", () => {
+    expect(() =>
+      createTierEngineFeature({
+        tierMap,
+        trial: { tier: "enterprise", durationHours: 72 },
+      }),
+    ).toThrow(/trial\.tier "enterprise" is not a key in tierMap/);
+  });
+
+  test("does not throw when trial.tier is a valid tierMap key", () => {
+    expect(() =>
+      createTierEngineFeature({
+        tierMap,
+        trial: { tier: "pro", durationHours: 72 },
+      }),
+    ).not.toThrow();
+  });
+});

package/src/tier-engine/feature.ts

@@ -62,7 +62,7 @@ import {
   type TierResolverPlugin,
   type TrialGate,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { getAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { tenantTable } from "../tenant";
@@ -73,6 +73,7 @@ import { tierAssignmentEntity } from "./entity";
 import { getActiveTierQuery } from "./handlers/active-tier.query";
 import { getTenantTierQuery } from "./handlers/get-tenant-tier.query";
 import { createSetTenantTierWrite } from "./handlers/set-tenant-tier.write";
+import { TIER_ENGINE_I18N } from "./i18n";
 import { isTrialActive, type TrialPolicy } from "./trial";
 
 // Drizzle-table for the tier-assignment-entity. Built once at module-load
@@ -234,6 +235,7 @@ export function createTierEngineFeature<
     // verdrahtet (Platform-Admin-Hoheit, nicht App-konfigurierbar). App
     // platziert ihn nur via r.nav("tier-engine:screen:tier-admin"); die
     // Komponente liefert tierEngineClient() aus dem ./web-subpath.
+    r.translations({ keys: TIER_ENGINE_I18N });
     r.screen({
       id: TIER_ADMIN_SCREEN_ID,
       type: "custom",
@@ -268,6 +270,11 @@ export function createTierEngineFeature<
     // Sekunde 1 nach Signup. Darum lebt er als async trialGate (unten, am
     // build-Ende angehängt), den der dispatcher nur auf dem disabled-Pfad
     // konsultiert. trialFeatures = fixe Feature-Menge des Trial-Tiers.
+    if (opts.trial && !tierMap[opts.trial.tier]) {
+      throw new Error(
+        `tier-engine: trial.tier "${opts.trial.tier}" is not a key in tierMap — trial would unlock no features`,
+      );
+    }
     const trialFeatures: ReadonlySet<string> = opts.trial
       ? featuresForTier(tierMap, opts.trial.tier)
       : new Set();
@@ -283,7 +290,7 @@ export function createTierEngineFeature<
     };
 
     // Invalidation: tier-assignment events update the cache.
-    r.entityHook("postSave", "tier-assignment", async (result) => {
+    r.hook("postSave", { allOf: "tier-assignment" }, async (result) => {
       // result.data has tenantId + tier (after entity-update merge)
       const data = result.data as { tenantId?: unknown; tier?: unknown }; // @cast-boundary engine-payload
       // skip: defensive type-guard auf payload-shape. Bei korrekt gerenderten
@@ -295,7 +302,7 @@ export function createTierEngineFeature<
       const tenantId = data.tenantId as TenantId;
       cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, data.tier)));
     });
-    r.entityHook("postDelete", "tier-assignment", async (payload) => {
+    r.hook("postDelete", { allOf: "tier-assignment" }, async (payload) => {
       const data = payload.data as { tenantId?: unknown }; // @cast-boundary engine-payload
       // skip: gleiche type-guard semantik wie postSave-hook oben.
       if (typeof data.tenantId !== "string") return;
@@ -316,9 +323,9 @@ export function createTierEngineFeature<
     // neuer Tenant (Memory `feedback_event_store_tenant_consistency`).
     if (opts.defaultTier !== undefined) {
       const defaultTier = opts.defaultTier;
-      r.entityHook(
+      r.hook(
         "postSave",
-        "tenant",
+        { allOf: "tenant" },
         async (result, ctx) => {
           // result-shape: kumiko-framework's SaveContext mit isNew + data
           const saveResult = result as { isNew?: unknown; data?: unknown }; // @cast-boundary engine-payload
@@ -358,7 +365,7 @@ export function createTierEngineFeature<
 
           // Idempotency: stream-existence-check vor create. Pattern aus
           // seedTenant.ts. Bei re-replay (rebuild) nicht versionsbumpen.
-          const streamVersion = await getAggregateStreamMaxVersion(rawDb, aggregateId);
+          const streamVersion = await getUnscopedAggregateStreamMaxVersion(rawDb, aggregateId);
           // skip: idempotent — tier-assignment stream already seeded (rebuild/replay).
           if (streamVersion > 0) return;
 

package/src/tier-engine/i18n.ts

@@ -5,8 +5,15 @@
 
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const TIER_ENGINE_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:tier-admin.title": { de: "Tier manuell zuweisen", en: "Assign tier manually" },
+};
+
 export const defaultTranslations: TranslationsByLocale = {
   de: {
+    "screen:tier-admin.title": "Tier manuell zuweisen",
     "tier-admin.title": "Tier manuell zuweisen",
     "tier-admin.explainer":
       "Weise einem Tenant ein Tier ohne Kauf zu. Der Grant wird als „manuell“ markiert und von einem späteren Billing-Sync nicht überschrieben.",
@@ -22,6 +29,7 @@ export const defaultTranslations: TranslationsByLocale = {
       "Diese App hat keine TierMap konfiguriert — es gibt keine zuweisbaren Tiers.",
   },
   en: {
+    "screen:tier-admin.title": "Assign tier manually",
     "tier-admin.title": "Assign tier manually",
     "tier-admin.explainer":
       "Grant a tenant a tier without a purchase. The grant is marked as “manual” and a later billing sync won't overwrite it.",

package/src/tier-engine/web/tier-admin-screen.tsx

@@ -13,6 +13,7 @@ import {
   useQuery,
   useTranslation,
 } from "@cosmicdrift/kumiko-renderer";
+import { FormScreenShell } from "@cosmicdrift/kumiko-renderer-web";
 import { type ReactNode, useEffect, useState } from "react";
 import { TierEngineHandlers, TierEngineQueries } from "../constants";
 
@@ -36,7 +37,7 @@ type Status =
 
 export function TierAdminScreen(): ReactNode {
   const t = useTranslation();
-  const { Section, Field, Input, Button, Banner, Heading } = usePrimitives();
+  const { Field, Input, Button, Banner, Form, Text } = usePrimitives();
   const dispatcher = useDispatcher();
 
   // ponytail: nur die erste Seite (default-limit, nextCursor ignoriert) —
@@ -91,10 +92,7 @@ export function TierAdminScreen(): ReactNode {
   const canSubmit = tenantId !== "" && tier !== "" && !submitting;
 
   return (
-    <div className="p-6 flex flex-col gap-6 max-w-xl" data-testid="tier-admin-screen">
-      <Heading variant="page">{t("tier-admin.title")}</Heading>
-      <p className="text-sm text-muted-foreground">{t("tier-admin.explainer")}</p>
-
+    <FormScreenShell testId="tier-admin-screen" className="flex flex-col gap-6">
       {tenantsQuery.error !== null && (
         <Banner variant="error" testId="tier-admin-load-error">
           {t("tier-admin.error.load")}
@@ -106,7 +104,25 @@ export function TierAdminScreen(): ReactNode {
         </Banner>
       )}
 
-      <Section>
+      <Form
+        testId="tier-admin-form"
+        onSubmit={(e) => {
+          e?.preventDefault();
+          void onSave();
+        }}
+        actions={
+          <Button
+            type="submit"
+            disabled={!canSubmit}
+            loading={submitting}
+            testId="tier-admin-submit"
+          >
+            {t("tier-admin.submit")}
+          </Button>
+        }
+      >
+        <Text variant="small">{t("tier-admin.explainer")}</Text>
+
         <Field id="tier-admin-tenant" label={t("tier-admin.tenant.label")} required>
           <Input
             kind="select"
@@ -119,9 +135,9 @@ export function TierAdminScreen(): ReactNode {
         </Field>
 
         {tenantId !== "" && (
-          <p className="text-sm text-muted-foreground" data-testid="tier-admin-current">
+          <Text variant="small" testId="tier-admin-current">
             {t("tier-admin.current.label")}: {currentTier ?? t("tier-admin.current.none")}
-          </p>
+          </Text>
         )}
 
         <Field id="tier-admin-tier" label={t("tier-admin.tier.label")} required>
@@ -146,16 +162,7 @@ export function TierAdminScreen(): ReactNode {
             {t(status.messageKey)}
           </Banner>
         )}
-
-        <Button
-          onClick={() => void onSave()}
-          disabled={!canSubmit}
-          loading={submitting}
-          testId="tier-admin-submit"
-        >
-          {t("tier-admin.submit")}
-        </Button>
-      </Section>
-    </div>
+      </Form>
+    </FormScreenShell>
   );
 }

package/src/user/__tests__/stream-tenant-backfill.integration.test.ts

@@ -0,0 +1,186 @@
+// #762 — backfillUserStreamTenants: pre-#497 user streams live on the
+// creating tenant; post-#497 the executor addresses SYSTEM_TENANT_ID, so
+// legacy users version-conflict on every write (password-reset collapses to
+// invalid_token). The backfill retenants + renumbers per aggregate in global
+// id order — including the split-stream case the raw #497-changeset SQL
+// crashes on (legacy tenant v1..n AND post-#497 SYSTEM events for the same
+// aggregate → events_aggregate_version_uq violation).
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  SYSTEM_TENANT_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { append, createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestDb,
+  type TestDb,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { backfillUserStreamTenants } from "../db/queries/stream-tenant-backfill";
+import { userEntity, userTable } from "../schema/user";
+
+const T1 = "00000000-0000-4000-8000-000000000011" as TenantId;
+const LEGACY_USER = "aaaaaaaa-0000-4000-8000-000000000001";
+const SPLIT_USER = "aaaaaaaa-0000-4000-8000-000000000002";
+const MODERN_USER = "aaaaaaaa-0000-4000-8000-000000000003";
+
+let testDb: TestDb;
+
+const executor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+
+beforeAll(async () => {
+  testDb = await createTestDb();
+  await unsafeCreateEntityTable(testDb.db, userEntity, "user");
+  await createEventsTable(testDb.db);
+});
+
+afterAll(async () => {
+  await testDb.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(testDb.db).unsafe(
+    `TRUNCATE kumiko_events, kumiko_snapshots, kumiko_archived_streams, read_users RESTART IDENTITY CASCADE`,
+  );
+});
+
+async function appendUserEvent(
+  aggregateId: string,
+  tenantId: TenantId,
+  expectedVersion: number,
+  type: string,
+  payload: Record<string, unknown>,
+): Promise<void> {
+  await append(testDb.db, {
+    aggregateId,
+    aggregateType: "user",
+    tenantId,
+    expectedVersion,
+    type,
+    payload,
+    metadata: { userId: "test-migrator" },
+  });
+}
+
+async function streamRows(
+  aggregateId: string,
+): Promise<ReadonlyArray<{ tenant_id: string; version: number; type: string }>> {
+  return (await asRawClient(testDb.db).unsafe(
+    `SELECT "tenant_id", "version", "type" FROM "kumiko_events"
+      WHERE "aggregate_id" = $1::uuid ORDER BY "id" ASC`,
+    [aggregateId],
+  )) as ReadonlyArray<{ tenant_id: string; version: number; type: string }>;
+}
+
+function seedUserRow(id: string, tenantId: TenantId, version: number) {
+  return asRawClient(testDb.db).unsafe(
+    `INSERT INTO "read_users" ("id", "tenant_id", "email", "display_name", "locale", "password_hash", "status", "version")
+     VALUES ($1::uuid, $2::uuid, $3, 'Legacy', 'de', 'x', 'active', $4)`,
+    [id, tenantId, `${id.slice(0, 8)}@example.com`, version],
+  );
+}
+
+describe("backfillUserStreamTenants (#762)", () => {
+  test("legacy stream: retenanted to SYSTEM, versions contiguous, executor write works again", async () => {
+    await appendUserEvent(LEGACY_USER, T1, 0, "user.created", { email: "l@example.com" });
+    await appendUserEvent(LEGACY_USER, T1, 1, "user.updated", { changes: { displayName: "L" } });
+    await seedUserRow(LEGACY_USER, T1, 2);
+
+    const result = await backfillUserStreamTenants(testDb.db);
+    expect(result.aggregatesMigrated).toBe(1);
+    expect(result.eventsMigrated).toBe(2);
+    expect(result.failed).toHaveLength(0);
+
+    const rows = await streamRows(LEGACY_USER);
+    expect(rows.map((r) => r.tenant_id)).toEqual([SYSTEM_TENANT_ID, SYSTEM_TENANT_ID]);
+    expect(rows.map((r) => r.version)).toEqual([1, 2]);
+
+    // The actual #762 symptom: an optimistic-locked executor update with the
+    // row version now targets a stream that HAS that version — no conflict.
+    const tdb = createTenantDb(testDb.db, SYSTEM_TENANT_ID, "system");
+    const writeRes = await executor.update(
+      { id: LEGACY_USER, version: 2, changes: { displayName: "After" } },
+      createSystemUser(SYSTEM_TENANT_ID),
+      tdb,
+    );
+    expect(writeRes.isSuccess).toBe(true);
+  });
+
+  test("split stream (legacy + post-#497 SYSTEM events) merges in global id order", async () => {
+    // Legacy: created + updated on T1 (v1, v2). Then a post-#497 lifecycle
+    // write appended v1 on SYSTEM — the split the raw changeset-SQL trips on.
+    await appendUserEvent(SPLIT_USER, T1, 0, "user.created", { email: "s@example.com" });
+    await appendUserEvent(SPLIT_USER, T1, 1, "user.updated", { changes: { a: 1 } });
+    await appendUserEvent(SPLIT_USER, SYSTEM_TENANT_ID, 0, "user.updated", {
+      changes: { status: "restricted" },
+    });
+    await seedUserRow(SPLIT_USER, T1, 2);
+
+    const result = await backfillUserStreamTenants(testDb.db);
+    expect(result.aggregatesMigrated).toBe(1);
+    expect(result.eventsMigrated).toBe(3);
+    expect(result.failed).toHaveLength(0);
+
+    const rows = await streamRows(SPLIT_USER);
+    expect(rows.map((r) => r.tenant_id)).toEqual([
+      SYSTEM_TENANT_ID,
+      SYSTEM_TENANT_ID,
+      SYSTEM_TENANT_ID,
+    ]);
+    // Renumbered by global event id: created, updated(T1), updated(SYSTEM).
+    expect(rows.map((r) => r.version)).toEqual([1, 2, 3]);
+    expect(rows[0]?.type).toBe("user.created");
+  });
+
+  test("idempotent: second run finds nothing; modern SYSTEM streams untouched", async () => {
+    await appendUserEvent(MODERN_USER, SYSTEM_TENANT_ID, 0, "user.created", {
+      email: "m@example.com",
+    });
+    await appendUserEvent(LEGACY_USER, T1, 0, "user.created", { email: "l@example.com" });
+
+    const first = await backfillUserStreamTenants(testDb.db);
+    expect(first.aggregatesMigrated).toBe(1);
+
+    const second = await backfillUserStreamTenants(testDb.db);
+    expect(second.aggregatesMigrated).toBe(0);
+    expect(second.eventsMigrated).toBe(0);
+
+    const modern = await streamRows(MODERN_USER);
+    expect(modern).toHaveLength(1);
+    expect(modern[0]?.version).toBe(1);
+  });
+
+  test("stale snapshots dropped, archived-stream marker moves to SYSTEM", async () => {
+    await appendUserEvent(LEGACY_USER, T1, 0, "user.created", { email: "l@example.com" });
+    await asRawClient(testDb.db).unsafe(
+      `INSERT INTO "kumiko_snapshots" ("aggregate_id", "aggregate_type", "tenant_id", "version", "state")
+       VALUES ($1::uuid, 'user', $2::uuid, 1, '{}'::jsonb)`,
+      [LEGACY_USER, T1],
+    );
+    await asRawClient(testDb.db).unsafe(
+      `INSERT INTO "kumiko_archived_streams" ("tenant_id", "aggregate_id", "aggregate_type", "archived_by")
+       VALUES ($1::uuid, $2::uuid, 'user', 'test')`,
+      [T1, LEGACY_USER],
+    );
+
+    const result = await backfillUserStreamTenants(testDb.db);
+    expect(result.failed).toHaveLength(0);
+
+    const snapshots = (await asRawClient(testDb.db).unsafe(
+      `SELECT count(*)::int AS n FROM "kumiko_snapshots" WHERE "aggregate_id" = $1::uuid`,
+      [LEGACY_USER],
+    )) as ReadonlyArray<{ n: number }>;
+    expect(snapshots[0]?.n).toBe(0);
+
+    const archived = (await asRawClient(testDb.db).unsafe(
+      `SELECT "tenant_id" FROM "kumiko_archived_streams" WHERE "aggregate_id" = $1::uuid`,
+      [LEGACY_USER],
+    )) as ReadonlyArray<{ tenant_id: string }>;
+    expect(archived).toHaveLength(1);
+    expect(archived[0]?.tenant_id).toBe(SYSTEM_TENANT_ID);
+  });
+});

package/src/user/__tests__/user.integration.test.ts

@@ -109,6 +109,32 @@ describe("scenario 2: field-level read access", () => {
   });
 });
 
+// --- find-for-auth is system-only: it returns the raw row incl. passwordHash,
+// and every query handler is reachable via POST /api/query — so even a
+// SystemAdmin (assignable app role) must be denied over HTTP. ---
+
+describe("scenario 2b: find-for-auth is system-only", () => {
+  test("SystemAdmin over HTTP is denied — passwordHash must not leak", async () => {
+    await seedUser({
+      email: "auth-lookup@example.com",
+      displayName: "AuthLookup",
+      passwordHash: "must-never-leave-the-server",
+    });
+
+    const res = await stack.http.queryWithHeaders(
+      UserQueries.findForAuth,
+      { email: "auth-lookup@example.com" },
+      systemAdmin,
+      {},
+    );
+
+    expect(res.status).toBeGreaterThanOrEqual(400);
+    const body = await res.text();
+    expect(body).toContain("access_denied");
+    expect(body).not.toContain("must-never-leave-the-server");
+  });
+});
+
 // --- Scenario 3: user edits own profile, email/passwordHash are system-locked ---
 
 describe("scenario 3: self-update + field-level write access", () => {

package/src/user/constants.ts

@@ -1,3 +1,4 @@
+// @runtime client
 // Feature name
 export const USER_FEATURE = "user" as const;
 

package/src/user/db/queries/stream-tenant-backfill.ts

@@ -0,0 +1,112 @@
+// #762 — one-time migration tooling for pre-#497 user event streams.
+//
+// #497 made `user` a systemStream entity: every executor op addresses the
+// stream on SYSTEM_TENANT_ID. Streams created before that live on whichever
+// tenant created them ("scattered"), so post-#497 writes version-conflict
+// against the empty SYSTEM stream. The raw UPDATE documented in the #497
+// changeset breaks as soon as an aggregate has BOTH a legacy stream and
+// post-#497 SYSTEM events (split stream — e.g. a skipOptimisticLock
+// lifecycle write appended v1 on SYSTEM while v1..n live on the old
+// tenant): retenanting then trips events_aggregate_version_uq.
+//
+// This tool merges per aggregate: all user events, ordered by global event
+// id, are renumbered 1..n and retenanted to SYSTEM_TENANT_ID — two-phase
+// version writes (negative interim values) dodge the unique index while the
+// per-aggregate transaction is in flight. Snapshots of migrated aggregates
+// are dropped (version numbering changed; the next snapshotting load
+// recreates them); archived-stream markers move with the stream.
+//
+// Idempotent: the candidate query only matches aggregates that still have
+// non-SYSTEM events. One failing aggregate does not abort the run — the
+// rest of the estate migrates, failures are reported.
+//
+// After a run, rebuild the user projection so read_users.tenant_id reflects
+// the stream move: rebuildProjection("user:projection:user-entity", ...) or
+// the jobs:job:projection-rebuild job.
+
+import { asRawClient, transaction } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+
+export type UserStreamBackfillResult = {
+  readonly aggregatesMigrated: number;
+  readonly eventsMigrated: number;
+  readonly failed: ReadonlyArray<{ readonly aggregateId: string; readonly error: string }>;
+};
+
+export async function backfillUserStreamTenants(
+  db: DbConnection,
+): Promise<UserStreamBackfillResult> {
+  const candidates = (await asRawClient(db).unsafe(
+    `SELECT DISTINCT "aggregate_id" FROM "kumiko_events"
+      WHERE "aggregate_type" = 'user' AND "tenant_id" <> $1::uuid`,
+    [SYSTEM_TENANT_ID],
+  )) as ReadonlyArray<{ aggregate_id: string }>;
+
+  let aggregatesMigrated = 0;
+  let eventsMigrated = 0;
+  const failed: Array<{ aggregateId: string; error: string }> = [];
+
+  for (const { aggregate_id } of candidates) {
+    try {
+      eventsMigrated += await migrateAggregate(db, aggregate_id);
+      aggregatesMigrated++;
+    } catch (e) {
+      failed.push({
+        aggregateId: aggregate_id,
+        error: e instanceof Error ? e.message : String(e),
+      });
+    }
+  }
+  return { aggregatesMigrated, eventsMigrated, failed };
+}
+
+async function migrateAggregate(db: DbConnection, aggregateId: string): Promise<number> {
+  return transaction(db, async (tx) => {
+    const raw = asRawClient(tx);
+    // Global id order = commit-adjacent replay order; merges a split stream
+    // (legacy tenant + SYSTEM) into one consistent version sequence.
+    const events = (await raw.unsafe(
+      `SELECT "id" FROM "kumiko_events"
+        WHERE "aggregate_type" = 'user' AND "aggregate_id" = $1::uuid
+        ORDER BY "id" ASC
+        FOR UPDATE`,
+      [aggregateId],
+    )) as ReadonlyArray<{ id: bigint | string }>;
+
+    // Phase 1: negative interim versions — real versions are always >= 1, so
+    // nothing can collide with events_aggregate_version_uq mid-migration.
+    for (const [i, ev] of events.entries()) {
+      await raw.unsafe(
+        `UPDATE "kumiko_events" SET "tenant_id" = $1::uuid, "version" = $2 WHERE "id" = $3`,
+        [SYSTEM_TENANT_ID, -(i + 1), ev.id],
+      );
+    }
+    // Phase 2: final contiguous 1..n.
+    for (const [i, ev] of events.entries()) {
+      await raw.unsafe(`UPDATE "kumiko_events" SET "version" = $1 WHERE "id" = $2`, [i + 1, ev.id]);
+    }
+
+    // Version numbering changed → any snapshot of this aggregate is stale.
+    await raw.unsafe(`DELETE FROM "kumiko_snapshots" WHERE "aggregate_id" = $1::uuid`, [
+      aggregateId,
+    ]);
+
+    // Archived markers key on (tenant_id, aggregate_id) — move them with the
+    // stream, keeping an existing SYSTEM marker if both exist.
+    await raw.unsafe(
+      `INSERT INTO "kumiko_archived_streams" ("tenant_id", "aggregate_id", "aggregate_type", "archived_at", "archived_by", "reason")
+        SELECT $1::uuid, "aggregate_id", "aggregate_type", "archived_at", "archived_by", "reason"
+          FROM "kumiko_archived_streams"
+         WHERE "aggregate_id" = $2::uuid AND "tenant_id" <> $1::uuid
+        ON CONFLICT DO NOTHING`,
+      [SYSTEM_TENANT_ID, aggregateId],
+    );
+    await raw.unsafe(
+      `DELETE FROM "kumiko_archived_streams" WHERE "aggregate_id" = $1::uuid AND "tenant_id" <> $2::uuid`,
+      [aggregateId, SYSTEM_TENANT_ID],
+    );
+
+    return events.length;
+  });
+}

package/src/user/feature.ts

@@ -5,6 +5,7 @@ import { findForAuthQuery } from "./handlers/find-for-auth.query";
 import { listQuery } from "./handlers/list.query";
 import { meQuery } from "./handlers/me.query";
 import { updateWrite } from "./handlers/update.write";
+import { USER_I18N } from "./i18n";
 import { userEntity } from "./schema/user";
 import { userEditScreen, userListScreen } from "./screens";
 
@@ -43,6 +44,8 @@ export function createUserFeature(): FeatureDefinition {
     r.screen(userListScreen);
     r.screen(userEditScreen);
 
+    r.translations({ keys: USER_I18N });
+
     return { handlers, queries };
   });
 }

package/src/user/handlers/find-for-auth.query.ts

@@ -7,10 +7,12 @@ import { userTable } from "../schema/user";
 // by email OR id (exactly one, enforced by the schema). Used by the auth
 // features via ctx.queryAs(systemUser, ...).
 //
-// Field-level read rules allow passwordHash for the "privileged" role set,
-// so system callers see everything; any other caller is filtered even if
-// they somehow reach this handler. Access is also restricted to privileged
-// — regular users or tenant admins cannot call this at all.
+// Access is system-only, NOT access.privileged: every query handler is
+// reachable via POST /api/query, and "SystemAdmin" is an assignable app
+// role — privileged would hand any SystemAdmin the raw passwordHash over
+// HTTP. The "system" role can't be minted into a session (only
+// createSystemUser() carries it), so system-only keeps this handler
+// internal to ctx.queryAs(systemUser, ...) callers.
 export const findForAuthQuery = defineQueryHandler({
   name: "user:find-for-auth",
   schema: z
@@ -24,9 +26,9 @@ export const findForAuthQuery = defineQueryHandler({
       (v) => (v.email !== undefined) !== (v.id !== undefined),
       { message: "exactly one of email or id must be set" },
     ),
-  access: { roles: access.privileged },
+  access: { roles: access.system },
   handler: async (query, ctx) => {
-    const where =
+    const where: { email: string } | { id: string } =
       query.payload.email !== undefined
         ? { email: query.payload.email }
         : { id: query.payload.id as string }; // @cast-boundary engine-payload

package/src/user/i18n.ts

@@ -0,0 +1,20 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const USER_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:user-list.title": { de: "Benutzer", en: "Users" },
+  "screen:user-edit.title": { de: "Benutzer bearbeiten", en: "Edit user" },
+  "user:entity:user:field:email": { de: "E-Mail", en: "Email" },
+  "user:entity:user:field:displayName": { de: "Anzeigename", en: "Display name" },
+  "user:entity:user:field:status": { de: "Status", en: "Status" },
+  "user:entity:user:field:emailVerified": { de: "E-Mail bestätigt", en: "Email verified" },
+  "user:entity:user:field:locale": { de: "Sprache", en: "Locale" },
+  "user:entity:user:field:status:option:active": { de: "Aktiv", en: "Active" },
+  "user:entity:user:field:status:option:restricted": { de: "Eingeschränkt", en: "Restricted" },
+  "user:entity:user:field:status:option:deletionRequested": {
+    de: "Löschung angefordert",
+    en: "Deletion requested",
+  },
+  "user:entity:user:field:status:option:deleted": { de: "Gelöscht", en: "Deleted" },
+  "user:entity:user:field:emailVerified:option:true": { de: "Ja", en: "Yes" },
+  "user:entity:user:field:emailVerified:option:false": { de: "Nein", en: "No" },
+};

package/src/user/index.ts

@@ -1,5 +1,9 @@
 export { UserCommandSchemas } from "./command-schemas";
 export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants";
+export {
+  backfillUserStreamTenants,
+  type UserStreamBackfillResult,
+} from "./db/queries/stream-tenant-backfill";
 export { createUserFeature } from "./feature";
 export type { UserStatus } from "./schema/user";
 export {