@cosmicdrift/kumiko-framework 0.304.0 → 0.305.0

package/src/pipeline/__tests__/public-intake-runtime-gate.integration.test.ts

@@ -0,0 +1,425 @@
+// Every anonymous handler here keeps personal-data keys out of its own input schema,
+// so the static boot check passes and only the runtime gate can stop the write.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { z } from "zod";
+import type { SchemaTable } from "../../db";
+import { createEventStoreExecutor } from "../../db/event-store-executor";
+import { asRawClient, selectMany } from "../../db/query";
+import { buildEntityTable } from "../../db/table-builder";
+import type { TenantDb } from "../../db/tenant-db";
+import { createEntity, createSystemUser, createTextField, defineFeature } from "../../engine";
+import { SYSTEM_ROLE } from "../../engine/system-user";
+import type { TenantId } from "../../engine/types";
+import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } from "../../stack";
+
+const TENANT_ID = "00000000-0000-4000-8000-000000000001" as TenantId;
+const RATE_LIMIT = { per: "ip", limit: 1000, windowSeconds: 60 } as const;
+
+// --- Feature B: owns the PII-carrying entity ---
+
+const contactEntity = createEntity({
+  table: "intake_contacts",
+  fields: {
+    email: createTextField({ personal: "self", find: "none", default: "" }),
+    note: createTextField({ personal: false, reason: "test_fixture", default: "" }),
+  },
+});
+const contactTable = buildEntityTable("contact", contactEntity);
+
+// No `table:` override: the gate must resolve the default, entity-name-derived table.
+const leadEntity = createEntity({
+  fields: {
+    phone: createTextField({ personal: "self", find: "none", default: "" }),
+  },
+});
+const leadTable = buildEntityTable("intakeLead", leadEntity);
+
+const featureB = defineFeature("intakeb", (r) => {
+  r.entity("contact", contactEntity);
+  r.entity("intakeLead", leadEntity);
+
+  r.writeHandler(
+    "create-lead",
+    z.object({ phone: z.string() }),
+    async (event, ctx) => {
+      const crud = createEventStoreExecutor(leadTable, leadEntity, { entityName: "intakeLead" });
+      return crud.create({ phone: event.payload.phone }, event.user, ctx.db);
+    },
+    { access: { roles: [SYSTEM_ROLE] } },
+  );
+
+  r.writeHandler(
+    "create",
+    z.object({ email: z.string(), note: z.string().optional() }),
+    async (event, ctx) => {
+      const crud = createEventStoreExecutor(contactTable, contactEntity, { entityName: "contact" });
+      return crud.create(
+        { email: event.payload.email, note: event.payload.note ?? "" },
+        event.user,
+        ctx.db,
+      );
+    },
+    { access: { roles: [SYSTEM_ROLE] } },
+  );
+});
+
+// --- Feature A: anonymous entry points that try to leak B's PII by every route ---
+
+const probeEntity = createEntity({
+  table: "intake_probes",
+  fields: {
+    note: createTextField({ personal: false, reason: "test_fixture", required: true }),
+  },
+});
+const probeTable = buildEntityTable("probe", probeEntity);
+
+const featureA = defineFeature("intakea", (r) => {
+  r.entity("probe", probeEntity);
+
+  r.writeHandler(
+    "direct-insert-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      // @cast-boundary test-fixture — proving the RUNTIME gate stops this
+      // write, not the compile-time ExecutorOnly brand on contactTable.
+      await ctx.db.insertOne(contactTable as unknown as SchemaTable, {
+        email: "leak-direct@example.com",
+        note: event.payload.note,
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+
+  r.writeHandler(
+    "direct-insert-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      // @cast-boundary test-fixture — see direct-insert-no-declare above.
+      await ctx.db.insertOne(contactTable as unknown as SchemaTable, {
+        email: "leak-direct-declared@example.com",
+        note: event.payload.note,
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"], personalData: "public-intake" }, rateLimit: RATE_LIMIT },
+  );
+
+  r.writeHandler(
+    "writeas-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) =>
+      ctx.writeAs(createSystemUser(event.user.tenantId), "intakeb:write:create", {
+        email: "leak-writeas@example.com",
+        note: event.payload.note,
+      }),
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: "test: cross-identity detour to prove the gate survives writeAs" },
+    },
+  );
+
+  r.writeHandler(
+    "writeas-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) =>
+      ctx.writeAs(createSystemUser(event.user.tenantId), "intakeb:write:create", {
+        email: "leak-writeas-declared@example.com",
+        note: event.payload.note,
+      }),
+    {
+      access: { roles: ["anonymous"], personalData: "public-intake" },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: "test: cross-identity detour to prove the gate survives writeAs" },
+    },
+  );
+
+  // The postSave hook only fires for handlers whose result is a genuine
+  // SaveContext (createEventStoreExecutor's crud.create), so these write to
+  // a harmless non-PII probe entity purely to trigger the hook.
+  r.writeHandler(
+    "hook-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const crud = createEventStoreExecutor(probeTable, probeEntity, { entityName: "probe" });
+      return crud.create({ note: event.payload.note }, event.user, ctx.db);
+    },
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+  r.writeHandler(
+    "hook-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      const crud = createEventStoreExecutor(probeTable, probeEntity, { entityName: "probe" });
+      return crud.create({ note: event.payload.note }, event.user, ctx.db);
+    },
+    { access: { roles: ["anonymous"], personalData: "public-intake" }, rateLimit: RATE_LIMIT },
+  );
+  r.hook("postSave", "hook-no-declare", async (_result, ctx) => {
+    // @cast-boundary test-fixture — postSave hooks receive HandlerContext as
+    // AppContext, whose `db` is typed as the DbConnection|TenantDb union
+    // (fail-closed at the outer boundary); at runtime it's always the
+    // TenantDb built for this write. See direct-insert-no-declare above.
+    await (ctx.db as TenantDb).insertOne(contactTable as unknown as SchemaTable, {
+      email: "leak-hook@example.com",
+      note: "from-afterCommit-hook",
+    });
+  });
+  r.hook("postSave", "hook-declare", async (_result, ctx) => {
+    // @cast-boundary test-fixture — see hook-no-declare above.
+    await (ctx.db as TenantDb).insertOne(contactTable as unknown as SchemaTable, {
+      email: "leak-hook-declared@example.com",
+      note: "from-afterCommit-hook",
+    });
+  });
+
+  r.queryHandler(
+    "detour-query",
+    z.object({ note: z.string() }),
+    async (event, ctx) =>
+      ctx.write("intakeb:write:create", {
+        email: "leak-queryas@example.com",
+        note: event.payload.note,
+      }),
+    { access: { roles: [SYSTEM_ROLE] } },
+  );
+
+  r.writeHandler(
+    "queryas-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) =>
+      // Detour: anonymous root -> ctx.queryAs(SYSTEM) -> that query handler's
+      // own ctx.write. The origin travels with the root call, not the
+      // identity-switched SYSTEM user, so this must still be blocked.
+      ctx.queryAs(createSystemUser(event.user.tenantId), "intakea:query:detour-query", {
+        note: event.payload.note,
+      }) as ReturnType<typeof ctx.write>,
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: {
+        reason: "test: queryAs detour to prove the gate survives nested query->write",
+      },
+    },
+  );
+  r.writeHandler(
+    "queryas-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) =>
+      ctx.queryAs(createSystemUser(event.user.tenantId), "intakea:query:detour-query", {
+        note: event.payload.note,
+      }) as ReturnType<typeof ctx.write>,
+    {
+      access: { roles: ["anonymous"], personalData: "public-intake" },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: {
+        reason: "test: queryAs detour to prove the gate survives nested query->write",
+      },
+    },
+  );
+
+  r.writeHandler(
+    "default-table-insert-no-declare",
+    z.object({ note: z.string() }),
+    async (_event, ctx) => {
+      // @cast-boundary test-fixture — see direct-insert-no-declare above.
+      await ctx.db.insertOne(leadTable as unknown as SchemaTable, { phone: "+49 30 1234" });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+
+  r.writeHandler(
+    "default-table-writeas-no-declare",
+    z.object({ note: z.string() }),
+    async (event, ctx) =>
+      ctx.writeAs(createSystemUser(event.user.tenantId), "intakeb:write:create-lead", {
+        phone: "+49 30 5678",
+      }),
+    {
+      access: { roles: ["anonymous"] },
+      rateLimit: RATE_LIMIT,
+      escapeHatch: { reason: "test: cross-identity detour to prove the gate survives writeAs" },
+    },
+  );
+
+  r.writeHandler(
+    "non-pii-insert",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      // @cast-boundary test-fixture — only the non-PII `note` column is
+      // written here; `email` is deliberately absent so the gate has
+      // nothing to block.
+      await ctx.db.insertOne(contactTable as unknown as SchemaTable, {
+        note: event.payload.note,
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+
+  r.writeHandler(
+    "mixed-role-insert",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      // @cast-boundary test-fixture — see direct-insert-no-declare above.
+      await ctx.db.insertOne(contactTable as unknown as SchemaTable, {
+        email: "leak-mixed-role@example.com",
+        note: event.payload.note,
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous", "Admin"] }, rateLimit: RATE_LIMIT },
+  );
+});
+
+describe("public-intake runtime gate", () => {
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    stack = await setupTestStack({
+      features: [featureB, featureA],
+      anonymousAccess: { defaultTenantId: TENANT_ID },
+    });
+    await unsafeCreateEntityTable(stack.db, contactEntity);
+    await unsafeCreateEntityTable(stack.db, probeEntity);
+    await unsafeCreateEntityTable(stack.db, leadEntity, "intakeLead");
+  });
+
+  afterAll(() => stack.cleanup());
+
+  beforeEach(async () => {
+    await asRawClient(stack.db).unsafe(`DELETE FROM "${contactTable.tableName}"`);
+    await asRawClient(stack.db).unsafe(`DELETE FROM "${probeTable.tableName}"`);
+    await asRawClient(stack.db).unsafe(`DELETE FROM "${leadTable.tableName}"`);
+  });
+
+  async function rowCount(): Promise<number> {
+    const rows = await selectMany(stack.db, contactTable);
+    return rows.length;
+  }
+
+  async function probeRowCount(): Promise<number> {
+    const rows = await selectMany(stack.db, probeTable);
+    return rows.length;
+  }
+
+  test("(a) direct ctx.db.insertOne on a foreign PII table — blocked without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:direct-insert-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { details: { reason: string } } };
+    expect(body.error.details.reason).toBe("public_intake_required");
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("(a) direct ctx.db.insertOne on a foreign PII table — allowed once declared", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:direct-insert-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(b) ctx.writeAs(SYSTEM, ...) detour — blocked without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:writeas-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { details: { reason: string } } };
+    expect(body.error.details.reason).toBe("public_intake_required");
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("(b) ctx.writeAs(SYSTEM, ...) detour — allowed once declared", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:writeas-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(c) afterCommit postSave hook writing foreign PII — blocked without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:hook-no-declare",
+      payload: { note: "x" },
+    });
+    // The outer write itself already succeeded before the hook ran —
+    // afterCommit errors are logged, never surfaced on the HTTP response
+    // (flushAfterCommit is awaited inside runBatch before it returns, so
+    // there is no race to sleep past). The probe-row assertion proves the
+    // hook actually ran (and was gated), not merely that it never fired.
+    expect(res.status).toBe(200);
+    expect(await probeRowCount()).toBe(1);
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("(c) afterCommit postSave hook writing foreign PII — allowed once declared", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:hook-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await probeRowCount()).toBe(1);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(d) anonymous write -> queryAs(SYSTEM) -> query handler's own ctx.write — blocked without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:queryas-no-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { details: { reason: string } } };
+    expect(body.error.details.reason).toBe("public_intake_required");
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("(d) anonymous write -> queryAs(SYSTEM) -> query handler's own ctx.write — allowed once declared", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:queryas-declare",
+      payload: { note: "x" },
+    });
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("default entity table name — insertOne and executor create both blocked", async () => {
+    for (const type of [
+      "intakea:write:default-table-insert-no-declare",
+      "intakea:write:default-table-writeas-no-declare",
+    ]) {
+      const res = await stack.http.raw("POST", "/api/write", { type, payload: { note: "x" } });
+      expect(res.status).toBe(403);
+      const body = (await res.json()) as { error: { details: { reason: string } } };
+      expect(body.error.details.reason).toBe("public_intake_required");
+    }
+    expect(await selectMany(stack.db, leadTable)).toHaveLength(0);
+  });
+
+  test("(e) anonymous write of a non-PII field only — allowed without declaration", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: "intakea:write:non-pii-insert",
+      payload: { note: "hello" },
+    });
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+
+  test("(f) authenticated user on a mixed-role handler (anonymous + Admin) — allowed without declaration", async () => {
+    const res = await stack.http.write(
+      "intakea:write:mixed-role-insert",
+      { note: "hi" },
+      TestUsers.admin,
+    );
+    expect(res.status).toBe(200);
+    expect(await rowCount()).toBe(1);
+  });
+});

package/src/pipeline/active-membership.ts

@@ -16,6 +16,7 @@ import type { TenantId } from "../engine/types/identifiers";
 import { InternalError } from "../errors";
 import { executeQuery } from "./dispatch-query";
 import { type DispatchContext, resolveDbSource } from "./dispatch-shared";
+import { rootWriteOrigin } from "./write-origin";
 
 export type ActiveMembershipPolicy = {
   // destroyRequested still counts as active — owners must be able to cancel
@@ -60,11 +61,14 @@ async function findMembership(
   userId: string,
   tenantId: TenantId,
 ): Promise<RawMembershipRow | undefined> {
+  const membershipUser = createSystemUser(tenantId);
+  // Auth-flow entry point with no enclosing handler, so it is its own root.
   const rawMemberships = await executeQuery(
     ctx,
     ctx.membershipQuery,
     { userId },
-    createSystemUser(tenantId),
+    membershipUser,
+    rootWriteOrigin(ctx.registry, ctx.membershipQuery, membershipUser),
   );
   if (!Array.isArray(rawMemberships) || !rawMemberships.every(isMembershipRow)) {
     throw new InternalError({

package/src/pipeline/dispatch-batch.ts

@@ -13,6 +13,7 @@ import {
   isLifecycleResult,
   wrapToKumiko,
 } from "./dispatcher-utils";
+import { rootWriteOrigin } from "./write-origin";
 
 // Core batch logic extracted so write() and command() can reuse it
 // (a single write = batch of one, running in its own transaction).
@@ -117,6 +118,7 @@ export async function runBatch(
         cmd.type,
         cmd.payload,
         user,
+        rootWriteOrigin(ctx.registry, cmd.type, user),
         undefined,
         afterCommitHooks,
       );
@@ -142,6 +144,7 @@ export async function runBatch(
           cmd.type,
           cmd.payload,
           user,
+          rootWriteOrigin(ctx.registry, cmd.type, user),
           tx,
           afterCommitHooks,
         );

package/src/pipeline/dispatch-query.ts

@@ -4,7 +4,7 @@ import { filterReadFields } from "../engine/field-access";
 import type { QueryHandlerDef, SessionUser } from "../engine/types";
 import { AccessDeniedError, NotFoundError, validationErrorFromZod } from "../errors";
 import { assertNoSecretLeak } from "../secrets";
-import type { DispatchContext } from "./dispatch-shared";
+import type { DispatchContext, WriteOrigin } from "./dispatch-shared";
 import {
   buildHandlerContext,
   enforceRateLimit,
@@ -21,10 +21,11 @@ export async function executeQuery(
   type: string,
   payload: unknown,
   user: SessionUser,
+  origin: WriteOrigin,
   tx?: DbTx,
 ): Promise<unknown> {
   return runHandlerInstrumented(ctx, type, "query", user, () =>
-    executeQueryInner(ctx, type, payload, user, tx),
+    executeQueryInner(ctx, type, payload, user, origin, tx),
   );
 }
 
@@ -33,6 +34,7 @@ async function executeQueryInner(
   type: string,
   payload: unknown,
   user: SessionUser,
+  origin: WriteOrigin,
   tx?: DbTx,
 ): Promise<unknown> {
   const { registry } = ctx;
@@ -83,9 +85,9 @@ async function executeQueryInner(
   // A resolved member (ctx.queryAsMember) runs in a Postgres READ ONLY transaction, not just the ctx surface below.
   return user.origin === "member-resolution"
     ? runInMemberReadOnlyTransaction(ctx, tx, (readOnlyTx) =>
-        runQueryHandler(ctx, type, handler, parsed.data, includeDeleted, user, readOnlyTx),
+        runQueryHandler(ctx, type, handler, parsed.data, includeDeleted, user, origin, readOnlyTx),
       )
-    : runQueryHandler(ctx, type, handler, parsed.data, includeDeleted, user, tx);
+    : runQueryHandler(ctx, type, handler, parsed.data, includeDeleted, user, origin, tx);
 }
 
 async function runQueryHandler(
@@ -95,10 +97,19 @@ async function runQueryHandler(
   payload: unknown,
   includeDeleted: boolean,
   user: SessionUser,
+  origin: WriteOrigin,
   tx: DbTx | undefined,
 ): Promise<unknown> {
   const { registry } = ctx;
-  const handlerContext = await buildHandlerContext(ctx, type, user, tx, undefined, includeDeleted);
+  const handlerContext = await buildHandlerContext(
+    ctx,
+    type,
+    user,
+    origin,
+    tx,
+    undefined,
+    includeDeleted,
+  );
   let result = await handler.handler({ type, payload, user }, handlerContext);
 
   // postQuery-Hooks: fire BEFORE field-access-filter so hooks see raw data

package/src/pipeline/dispatch-shared.ts

@@ -100,6 +100,9 @@ import {
   systemIdentitySwitchDenied,
 } from "./system-identity-switch";
 import type { TenantTimezoneCache } from "./tenant-timezone-cache";
+import { buildPersonalDataGate, rootWriteOrigin, type WriteOrigin } from "./write-origin";
+
+export type { WriteOrigin } from "./write-origin";
 
 // Framework/pipeline stays bundled-features-free, so this can't import the
 // `tenant` feature — the literal below IS the coupling to its `timezone`
@@ -277,6 +280,7 @@ export async function buildHandlerContext(
   ctx: DispatchContext,
   type: string,
   user: SessionUser,
+  origin: WriteOrigin,
   tx?: DbTx,
   afterCommitHooks?: AfterCommitHook[],
   includeDeleted?: boolean,
@@ -320,6 +324,7 @@ export async function buildHandlerContext(
         unsafeRaw: handlerEscapeHatch,
         report: reportEscapeHatch,
         memberReadOnly: isMemberResolutionPrincipal(user),
+        personalDataGate: buildPersonalDataGate(registry, origin),
       },
     );
   // Propagate the request's AbortSignal so every TenantDb query throws when
@@ -421,10 +426,11 @@ export async function buildHandlerContext(
     user,
     hasIdentitySwitchGrant,
     {
+      // Inherits the caller's origin, so switching to SYSTEM cannot shed an anonymous root.
       queryAs: (asUser: SessionUser, targetType: string, payload: unknown) =>
-        executeQuery(ctx, targetType, payload, asUser, tx), // @wrapper-known semantic-alias
+        executeQuery(ctx, targetType, payload, asUser, origin, tx), // @wrapper-known semantic-alias
       writeAs: (asUser: SessionUser, targetType: string, payload: unknown) =>
-        executeWrite(ctx, targetType, payload, asUser, tx, bridgeSink),
+        executeWrite(ctx, targetType, payload, asUser, origin, tx, bridgeSink),
     },
     identitySwitchAudit,
   );
@@ -483,10 +489,10 @@ export async function buildHandlerContext(
   );
   const bridge = {
     query: (targetType: string, payload: unknown) =>
-      executeQuery(ctx, targetType, payload, user, tx), // @wrapper-known semantic-alias
+      executeQuery(ctx, targetType, payload, user, origin, tx), // @wrapper-known semantic-alias
     queryAs: identitySwitch.queryAs,
     write: async (targetType: string, payload: unknown) => {
-      const res = await executeWrite(ctx, targetType, payload, user, tx, bridgeSink);
+      const res = await executeWrite(ctx, targetType, payload, user, origin, tx, bridgeSink);
       return res;
     },
     writeAs: identitySwitch.writeAs,
@@ -1175,8 +1181,9 @@ function buildAuthClaimsContext(ctx: DispatchContext, user: SessionUser): AuthCl
       })
     : undefined;
   const identitySwitch = createGatedIdentitySwitch("r.authClaims hook", user, false, {
+    // Login is itself the root operation; the hook context is read-only.
     queryAs: (asUser: SessionUser, qn: string, payload: unknown) =>
-      executeQuery(ctx, qn, payload, asUser), // @wrapper-known semantic-alias
+      executeQuery(ctx, qn, payload, asUser, rootWriteOrigin(ctx.registry, qn, asUser)), // @wrapper-known semantic-alias
     writeAs: async () => {
       throw new InternalError({
         message: "r.authClaims hook context has no writeAs — auth-claims hooks are read-only.",

package/src/pipeline/dispatch-stream.ts

@@ -14,6 +14,7 @@ import {
   ensureFeatureEnabled,
   isMemberResolutionPrincipal,
   runStreamInstrumented,
+  type WriteOrigin,
 } from "./dispatch-shared";
 
 // Standalone stream execution — used by the public dispatcher.stream().
@@ -27,8 +28,11 @@ export async function* executeStream(
   type: string,
   payload: unknown,
   user: SessionUser,
+  origin: WriteOrigin,
 ): AsyncGenerator<unknown> {
-  yield* runStreamInstrumented(ctx, type, user, () => executeStreamInner(ctx, type, payload, user));
+  yield* runStreamInstrumented(ctx, type, user, () =>
+    executeStreamInner(ctx, type, payload, user, origin),
+  );
 }
 
 async function* executeStreamInner(
@@ -36,6 +40,7 @@ async function* executeStreamInner(
   type: string,
   payload: unknown,
   user: SessionUser,
+  origin: WriteOrigin,
 ): AsyncGenerator<unknown> {
   const { registry } = ctx;
   const handler = registry.getStreamHandler(type);
@@ -80,7 +85,7 @@ async function* executeStreamInner(
   // await; close is fire-and-forget instead (#1563).
   let abandonedForInvalidation = false;
   try {
-    const handlerContext = await buildHandlerContext(ctx, type, user);
+    const handlerContext = await buildHandlerContext(ctx, type, user, origin);
     const chunks = handler.handler({ type, payload: parsed.data, user }, handlerContext);
     iterator = chunks[Symbol.asyncIterator]();