@cosmicdrift/kumiko-framework 0.354.1 → 0.356.0

package/dist/pipeline/dispatch-shared.js

@@ -3,16 +3,18 @@ import { requestContext, runWithOrigin } from "../api/request-context.js";
 import { runInSavepoint, selectMany } from "../db/query.js";
 import { createTenantDb, createUncheckedSystemDb, hasTenantColumn, runInOwnTransaction, } from "../db/tenant-db.js";
 import { createDerivativesContext } from "../derivatives/derivatives-context.js";
+import { mayOverrideTenant } from "../engine/cross-tenant.js";
 import { createSystemUser } from "../engine/system-user.js";
 import { isRateLimitDisabled, resolveAgentExposure } from "../engine/types/index.js";
-import { AccessDeniedError, FeatureDisabledError, InternalError, memberResolutionReadOnlyDenied, RateLimitError, RateLimitUnavailableError, VersionConflictError, } from "../errors/index.js";
+import { AccessDeniedError, FeatureDisabledError, FrameworkReasons, InternalError, memberResolutionReadOnlyDenied, RateLimitError, RateLimitUnavailableError, VersionConflictError, } from "../errors/index.js";
 import { archiveStream as archiveStreamHelper, isStreamArchived, restoreStream as restoreStreamHelper, } from "../event-store/archive.js";
 import { IdempotentAppendConflictError as EventStoreIdempotentAppendConflictError, VersionConflictError as EventStoreVersionConflictError, } from "../event-store/errors.js";
 import { getStreamVersion, loadAggregate, loadAggregateAsOf, } from "../event-store/event-store.js";
-import { loadAggregateWithSnapshot, saveSnapshot, } from "../event-store/snapshot.js";
+import { effectiveSnapshotGeneration, loadAggregateWithSnapshot, saveSnapshot, } from "../event-store/snapshot.js";
 import { upcastStoredEvent, upcastStoredEvents } from "../event-store/upcaster.js";
 import { createFileContext } from "../files/file-handle.js";
 import { DEFAULT_LOCALE, isValidLocaleTag } from "../i18n/request-locale.js";
+import { createFallbackLogger } from "../logging/utils.js";
 import { createEscapeHatchReporter, createMetricsHandle, createNoopMetricsHandle, createSafeMetricsHandle, emitDispatcherError, emitDispatcherHandler, getFallbackTracer, observabilityContext, } from "../observability/index.js";
 import { buildBucketKey, buildPayloadBucketKey, normalizePayloadBucketValue, } from "../rate-limit/index.js";
 import { createTzContext, isValidIanaTimeZone } from "../time/index.js";
@@ -23,7 +25,7 @@ import { resolveAuthClaims as runAuthClaimsResolver } from "./auth-claims-resolv
 import { runBatch, unwrapSingle } from "./dispatch-batch.js";
 import { executeQuery } from "./dispatch-query.js";
 import { executeWrite } from "./dispatch-write.js";
-import { dispatcherSpanAttributes, isFailedWriteResult, } from "./dispatcher-utils.js";
+import { dispatcherSpanAttributes, isFailedWriteResult, NestedWriteRollback, } from "./dispatcher-utils.js";
 import { createMemberReaderFn } from "./member-reader.js";
 import { createGatedIdentitySwitch, createGatedMemberReader, createGatedProjectionReader, isSystemIdentity, systemIdentitySwitchDenied, } from "./system-identity-switch.js";
 import { buildPersonalDataGate, rootWriteOrigin } from "./write-origin.js";
@@ -177,6 +179,7 @@ export function applyMemberResolutionReadOnly(handlerContext) {
         restoreStream: denyMemberResolutionWrite,
         snapshotAggregate: denyMemberResolutionWrite,
         queryAsMember: denyMemberResolutionWrite,
+        forTenant: undefined,
         resolveActiveMembership: denyMemberResolutionWrite,
         scheduleAfterCommit: () => {
             throw memberResolutionReadOnlyDenied();
@@ -220,14 +223,16 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
         tenantId: user.tenantId,
         actor: user.id,
         sink: context._escapeHatchAuditSink,
-        log: context.log,
+        log: context.log ?? createFallbackLogger("dispatcher"),
         window: ctx.escapeHatchReportWindow,
     });
     const identitySwitchGrantReason = identitySwitchEscapeHatch?.reason ??
         (isSystem ? `r.systemScope() feature "${featureName ?? "unknown"}"` : undefined);
-    const buildTenantScopedDb = (source, signal) => createTenantDb(source, user.tenantId, isSystem ? "system" : "tenant", context.tracer, context.meter, signal, {
-        globalWrites: escapeHatchFor(writeEscapeHatch, "globalWrites"),
-        unsafeRaw: escapeHatchFor(handlerEscapeHatch, "unsafeRaw"),
+    const buildTenantScopedDb = (source, signal, foreignTenantId) => createTenantDb(source, foreignTenantId ?? user.tenantId, isSystem && foreignTenantId === undefined ? "system" : "tenant", context.tracer, context.meter, signal, {
+        ...(foreignTenantId === undefined && {
+            globalWrites: escapeHatchFor(writeEscapeHatch, "globalWrites"),
+            unsafeRaw: escapeHatchFor(handlerEscapeHatch, "unsafeRaw"),
+        }),
         report: reportEscapeHatch,
         memberReadOnly: isMemberResolutionPrincipal(user),
         personalDataGate: buildPersonalDataGate(registry, origin),
@@ -308,6 +313,26 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
             });
         }
         : undefined;
+    // Write handlers only, and not r.systemScope() ones (they have ctx.systemDb). The gate is the
+    // dispatcher's tenantIdOverride predicate, so no caller reaches more than it could via
+    // tenantIdOverride. The foreign db carries no unsafeRaw/globalWrites grant and is tenant mode
+    // bound to the target; the executor accepts streamTenantId only on a db bound to that tenant.
+    const forTenant = !isSystem && dbSource && registry.getWriteHandler(type) !== undefined
+        ? (targetTenantId) => {
+            if (targetTenantId === user.tenantId && exposedDb) {
+                return { db: exposedDb, streamTenantId: undefined };
+            }
+            if (!mayOverrideTenant(user)) {
+                throw new AccessDeniedError({
+                    details: { reason: FrameworkReasons.tenantOverrideRequiresSystemAdmin },
+                });
+            }
+            return {
+                db: buildTenantScopedDb(dbSource, reqCtx?.signal, targetTenantId),
+                streamTenantId: targetTenantId,
+            };
+        }
+        : undefined;
     // ctx.files resolved per-tenant through file-foundation (lazy — the
     // provider is only resolved when a handle actually does I/O). Boot wires
     // _fileProviderResolver when a file-provider plugin is mounted; falls back
@@ -339,13 +364,38 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
     // Cross-feature bridge: ctx.query/write share the current tx + afterCommitHooks sink.
     // queryAs/writeAs to anyone but the caller itself needs r.systemScope() or { escapeHatch } (system-identity-switch.ts).
     const bridgeSink = afterCommitHooks ?? [];
+    // A failed inner write has already appended its event and projections when a later
+    // step (e.g. an inTransaction hook) fails, and the outer handler may swallow the
+    // failure result. The savepoint makes the failure undo exactly the inner write; the
+    // inner afterCommit hooks only reach the outer sink if it succeeded.
+    const executeNestedWriteInSavepoint = async (asUser, targetType, payload) => {
+        if (!tx)
+            return executeWrite(ctx, targetType, payload, asUser, origin, tx, bridgeSink);
+        const innerAfterCommitHooks = [];
+        try {
+            const result = await runInSavepoint(tx, async (savepointTx) => {
+                const innerResult = await executeWrite(ctx, targetType, payload, asUser, origin, savepointTx, // @cast-boundary driver savepoint handle is a transaction handle
+                innerAfterCommitHooks);
+                if (isFailedWriteResult(innerResult))
+                    throw new NestedWriteRollback(innerResult);
+                return innerResult;
+            });
+            bridgeSink.push(...innerAfterCommitHooks);
+            return result;
+        }
+        catch (e) {
+            if (e instanceof NestedWriteRollback)
+                return e.failure;
+            throw e;
+        }
+    };
     // Post-commit hooks have no transaction left, so a bare executeWrite would
     // auto-commit event append, projections and inTransaction hooks separately
     // and its afterCommit hooks would land in an already-flushed sink. A
     // batch-of-one gives the write its own transaction and its own flush.
     const writeAsUser = async (asUser, targetType, payload) => isPostCommit
         ? unwrapSingle(await runBatch(ctx, [{ type: targetType, payload }], asUser, undefined, origin))
-        : executeWrite(ctx, targetType, payload, asUser, origin, tx, bridgeSink);
+        : executeNestedWriteInSavepoint(asUser, targetType, payload);
     const scheduleAfterCommit = (hook) => {
         bridgeSink.push(hook);
     };
@@ -560,7 +610,7 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
                 aggregateType: snapshotArgs.aggregateType,
                 version: snapshotArgs.version,
                 state: snapshotArgs.state,
-                snapshotVersion: snapshotArgs.snapshotVersion,
+                snapshotVersion: effectiveSnapshotGeneration(snapshotArgs.snapshotVersion ?? 1, registry.getEntity(snapshotArgs.aggregateType)?.eventVersion),
             });
         },
         loadAggregateWithSnapshot: async (aggregateId, reducer, initial, loadOptions) => {
@@ -579,6 +629,7 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
             const upcastCtx = { db: dbSource, tenantId: user.tenantId };
             return loadAggregateWithSnapshot(dbSource, aggregateId, user.tenantId, reducer, initial, {
                 ...loadOptions,
+                entityEventVersionOf: (aggregateType) => registry.getEntity(aggregateType)?.eventVersion,
                 upcastEvent: (event) => upcastStoredEvent(event, upcasters, upcastCtx), // @wrapper-known semantic-alias
             });
         },
@@ -694,6 +745,7 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
         notify,
         ...(config && { config }),
         ...(configFor && { configFor }),
+        ...(forTenant && { forTenant }),
         ...(files && { files }),
         ...(derivatives && { derivatives }),
         // preSave hooks need `changes`/`previous`/`isNew`, which only exist once
@@ -1057,7 +1109,7 @@ function buildAuthClaimsContext(ctx, user) {
             tenantId: user.tenantId,
             actor: user.id,
             sink: context._escapeHatchAuditSink,
-            log: context.log,
+            log: context.log ?? createFallbackLogger("dispatcher"),
             window: ctx.escapeHatchReportWindow,
         }),
         projectionRegistry: ctx.registry,

package/dist/pipeline/dispatch-stream.js

@@ -1,6 +1,7 @@
 import { accessInvalidationCredentialFor } from "../api/sse-broker.js";
 import { scheduleTokenExpiry } from "../api/token-expiry-timer.js";
 import { hasAccess } from "../engine/access.js";
+import { tenantOverrideDenied } from "../engine/cross-tenant.js";
 import { AccessDeniedError, memberResolutionReadOnlyDenied, NotFoundError, validationErrorFromZod, } from "../errors/index.js";
 import { assertNoSecretLeak } from "../secrets/index.js";
 import { buildHandlerContext, enforceRateLimit, ensureFeatureEnabled, isMemberResolutionPrincipal, runStreamInstrumented, } from "./dispatch-shared.js";
@@ -33,6 +34,9 @@ async function* executeStreamInner(ctx, type, payload, user, origin, options) {
     if (!parsed.success) {
         throw validationErrorFromZod(parsed.error);
     }
+    const overrideDenied = tenantOverrideDenied(user, parsed.data);
+    if (overrideDenied)
+        throw overrideDenied;
     // Idle (heartbeat-only) streams must also cut on access revoke or token expiry — race each
     // pull against an ended Deferred instead of a post-chunk boolean.
     let resolveEnded;

package/dist/pipeline/dispatcher-utils.d.ts

@@ -31,6 +31,10 @@ export declare class BatchRollback extends Error {
     readonly failureError: WriteErrorInfo;
     constructor(failedIndex: number, failureError: WriteErrorInfo);
 }
+export declare class NestedWriteRollback extends Error {
+    readonly failure: WriteResult;
+    constructor(failure: WriteResult);
+}
 export type HandlerType = string | HandlerRef;
 export declare function resolveType(type: HandlerType): string;
 export declare function wrapToKumiko(e: unknown): KumikoError;

package/dist/pipeline/dispatcher-utils.js

@@ -127,6 +127,16 @@ export class BatchRollback extends Error {
         this.name = "BatchRollback";
     }
 }
+// Thrown inside a nested write's savepoint so the driver rolls the savepoint back;
+// the caller unwraps it into the original failure result.
+export class NestedWriteRollback extends Error {
+    failure;
+    constructor(failure) {
+        super("nested write rollback");
+        this.failure = failure;
+        this.name = "NestedWriteRollback";
+    }
+}
 export function resolveType(type) {
     return typeof type === "string" ? type : type.name;
 }

package/dist/pipeline/dispatcher.js

@@ -1,7 +1,7 @@
 import { runWithWriteOrigin } from "../api/request-context.js";
 import { TENANT_MEMBERSHIPS_QUERY } from "../engine/extension-names.js";
 import { InternalError, reraiseAsKumikoError } from "../errors/index.js";
-import { createEscapeHatchReportWindow, getFallbackMeter, getFallbackTracer, registerStandardMetrics, } from "../observability/index.js";
+import { createEscapeHatchReportWindow, getFallbackMeter, getFallbackTracer, registerStandardMetrics, withEscapeHatchAuditScope, } from "../observability/index.js";
 import { CACHE_SYNC_TOPICS, isTenantConfigSyncMessage } from "../redis/cache-sync-topics.js";
 import { INTERACTIVE_SIGN_IN_POLICY, resolveActiveMembershipFn } from "./active-membership.js";
 import { runBatch, unwrapSingle } from "./dispatch-batch.js";
@@ -102,14 +102,14 @@ export function createDispatcher(registry, context, options = {}) {
         async write(typeOrRef, payload, user, requestId) {
             const type = resolveType(typeOrRef);
             // Idempotency handled inside runBatch (caches BatchResult under requestId).
-            const batchResult = await runBatch(ctx, [{ type, payload }], user, requestId);
+            const batchResult = await withEscapeHatchAuditScope(() => runBatch(ctx, [{ type, payload }], user, requestId));
             return unwrapSingle(batchResult);
         },
-        batch: (commands, user, requestId) => runBatch(ctx, commands, user, requestId),
+        batch: (commands, user, requestId) => withEscapeHatchAuditScope(() => runBatch(ctx, commands, user, requestId)),
         query: (typeOrRef, payload, user) => {
             const type = resolveType(typeOrRef);
             const origin = rootWriteOrigin(registry, type, user);
-            return runWithWriteOrigin(origin, () => executeQuery(ctx, type, payload, user, origin));
+            return withEscapeHatchAuditScope(() => runWithWriteOrigin(origin, () => executeQuery(ctx, type, payload, user, origin)));
         },
         stream: (typeOrRef, payload, user, options) => {
             const type = resolveType(typeOrRef);
@@ -117,7 +117,7 @@ export function createDispatcher(registry, context, options = {}) {
         },
         async command(typeOrRef, payload, user) {
             const type = resolveType(typeOrRef);
-            const batchResult = await runBatch(ctx, [{ type, payload }], user);
+            const batchResult = await withEscapeHatchAuditScope(() => runBatch(ctx, [{ type, payload }], user));
             const result = unwrapSingle(batchResult);
             if (!result.isSuccess) {
                 throw reraiseAsKumikoError(result.error);
@@ -129,12 +129,12 @@ export function createDispatcher(registry, context, options = {}) {
     };
     dispatcherInternals.set(dispatcher, {
         writeWithOrigin: async (type, payload, user, inheritedOrigin) => {
-            const batchResult = await runBatch(ctx, [{ type, payload }], user, undefined, inheritedOrigin);
+            const batchResult = await withEscapeHatchAuditScope(() => runBatch(ctx, [{ type, payload }], user, undefined, inheritedOrigin));
             return unwrapSingle(batchResult);
         },
         queryWithOrigin: (type, payload, user, inheritedOrigin) => {
             const origin = effectiveWriteOrigin(rootWriteOrigin(registry, type, user), inheritedOrigin);
-            return runWithWriteOrigin(origin, () => executeQuery(ctx, type, payload, user, origin));
+            return withEscapeHatchAuditScope(() => runWithWriteOrigin(origin, () => executeQuery(ctx, type, payload, user, origin)));
         },
     });
     return dispatcher;

package/dist/pipeline/index.d.ts

@@ -1,5 +1,5 @@
 export type { EscapeHatchReportWindow } from "../observability/escape-hatch-report.js";
-export { createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, } from "../observability/escape-hatch-report.js";
+export { createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, flushEscapeHatchAudits, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, withEscapeHatchAuditScope, } from "../observability/escape-hatch-report.js";
 export type { AppendDomainEventCoreDeps } from "./append-event-core.js";
 export { appendDomainEventCore } from "./append-event-core.js";
 export type { ResolveAuthClaimsArgs } from "./auth-claims-resolver.js";

package/dist/pipeline/index.js

@@ -1,4 +1,4 @@
-export { createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, } from "../observability/escape-hatch-report.js";
+export { createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, flushEscapeHatchAudits, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, withEscapeHatchAuditScope, } from "../observability/escape-hatch-report.js";
 export { appendDomainEventCore } from "./append-event-core.js";
 export { resolveAuthClaims } from "./auth-claims-resolver.js";
 export { createCascadeDeleteHook } from "./cascade-handler.js";

package/dist/pipeline/pre-handler-gates.js

@@ -1,4 +1,5 @@
 import { hasAccess } from "../engine/access.js";
+import { tenantOverrideDenied } from "../engine/cross-tenant.js";
 import { checkWriteFieldRoles } from "../engine/field-access.js";
 import { runValidation } from "../engine/validation.js";
 import { AccessDeniedError, FrameworkReasons, isKumikoError, ValidationError, validationErrorFromZod, writeFailure, } from "../errors/index.js";
@@ -81,6 +82,9 @@ async function rejectBeforeParse(ctx, handler, type, user, mode) {
     return undefined;
 }
 async function rejectAfterParse(ctx, handler, type, user, payload, mode) {
+    const overrideDenied = tenantOverrideDenied(user, payload);
+    if (overrideDenied)
+        return writeFailure(overrideDenied);
     if (mode === "charge") {
         const rateLimited = await rejectPayloadRateLimited(ctx, handler, type, user, payload);
         if (rateLimited)

package/dist/ui-types/index.d.ts

@@ -9,7 +9,7 @@ export type { BooleanFieldDef, DateFieldDef, EmbeddedDerivedCellDef, EntityDefin
 export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, RoleAccessPersonalData, RoleAccessRule, } from "../engine/types/handlers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
 export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav.js";
-export type { ActionFormFooterAction, ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.js";
+export type { ActionFormFooterAction, ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.js";
 export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
 export type { TargetRef } from "../engine/types/target-ref.js";
 export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.354.1",
+  "version": "0.356.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -210,8 +210,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.354.1",
-    "@cosmicdrift/kumiko-types": "0.354.1",
+    "@cosmicdrift/kumiko-http": "0.356.0",
+    "@cosmicdrift/kumiko-types": "0.356.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -227,7 +227,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.354.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.356.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,46 @@
 [
+  {
+    "version": "0.356.0",
+    "type": "improvement",
+    "title": "Executor create accepts streamTenantId; ctx.forTenant(tenantId) for gated cross-tenant writes",
+    "detail": "createEventStoreExecutor().create takes { streamTenantId } (stream, event tenant, row tenant, PII key and cache invalidation follow it, the acting user stays the operator). The override is accepted on a system-mode db and also on a tenant-mode db bound to exactly that stream tenant. New handler-context method ctx.forTenant(tenantId) returns { db, streamTenantId }: a tenant-mode db bound to the target tenant plus the stream override to pass to the executor, so a handler needs no unsafeRaw escape hatch for cross-tenant writes. A foreign tenant is gated to SystemAdmin and system identities (AccessDeniedError with reason tenant_override_requires_system_admin otherwise); the caller's own tenant returns streamTenantId undefined. It is not offered to r.systemScope() handlers. The bundled cross-tenant handlers (tenant removeMember/updateMemberRoles, tier setTenantTier, custom-fields system fields, template-resolver upserts/set, managed-pages set, compliance-profiles setProfile) no longer rewrite event.user.tenantId; the event actor is the operator. tenant cancelPendingInvitation takes an optional streamTenantId."
+  },
+  {
+    "version": "0.356.0",
+    "type": "breaking",
+    "title": "Job ctx.queryAs is gated like ctx.writeAs",
+    "migration": "Jobs calling ctx.queryAs with createSystemUser(...) or any identity other than the job's own caller now fail with AccessDeniedError (system_identity_switch_denied / identity_switch_denied). Declare r.systemScope() on the job's feature or escapeHatch: { reason } on the job, the same grant ctx.writeAs already needs. The escape-hatch guard exempts jobs by name, so this surfaces only at runtime; grep your jobs for ctx.queryAs. Known consumer sites: offlot-app channel-text generate-texts.job, campaign-calendar sync, campaign-channel-foundation seed-starter-channels."
+  },
+  {
+    "version": "0.355.0",
+    "type": "improvement",
+    "title": "Entity events are versionable: eventVersion + eventMigrations on r.entity",
+    "detail": "Entities can declare eventVersion and row-shaped eventMigrations; lifecycle events are stamped with the version and upcast on rebuild and aggregate load. A version bump invalidates entity snapshots."
+  },
+  {
+    "version": "0.355.0",
+    "type": "improvement",
+    "title": "excludeFields per verb reaches the renderer and the agent manifest",
+    "detail": "WriteHandlerDef carries excludedFields; entityEdit screens get writeExcludedFields per verb. The edit form shows them read-only and keeps them out of the payload, create hides them, and the agent manifest lists them per handler."
+  },
+  {
+    "version": "0.355.0",
+    "type": "breaking",
+    "title": "Identity and tenant switches are explicitly gated; escape-hatch audit is durable",
+    "migration": "Job ctx.writeAs now needs r.systemScope() on the feature or escapeHatch: { reason } on the job; use ctx.write when the job acts as its own system user. A payload tenantIdOverride is refused by the dispatcher for non-SystemAdmin callers (handlers no longer call crossTenantOverrideDenied, which is removed; use mayOverrideTenant for other cross-tenant fields). Entity convention handlers with a cross-tenant escapeHatch now keep the operator as actor in the row stream (executor option streamTenantId, system-mode db only). createEscapeHatchReporter requires log; pass the runtime logger and share one report window per runtime. EscapeHatchUseEvent and the audit sink payload gain an optional caller. Call flushEscapeHatchAudits() before closing the database on shutdown."
+  },
+  {
+    "version": "0.355.0",
+    "type": "fix",
+    "title": "A failed nested ctx.write is rolled back to a savepoint instead of leaking its event and projection into the outer commit",
+    "detail": "A nested `ctx.write` / `ctx.writeAs` (and workflow `call-feature`) now runs in a savepoint of the outer transaction: when the inner write fails after its event and projection were written, for example because an in-transaction hook throws, the inner change is rolled back even if the outer handler swallows the failure result and commits, and a SQL error in the inner write no longer poisons the outer transaction. The inner write's afterCommit hooks only run when it succeeded."
+  },
+  {
+    "version": "0.355.0",
+    "type": "fix",
+    "title": "Unknown record ids show a localized empty state; an undecryptable encrypted field reads null instead of failing the whole list",
+    "detail": "Edit and detail screens show a localized empty state with a way back to the list for an unknown or deleted record id instead of a hard-coded English banner, and an entity list or detail no longer fails with a 500 when one row's encrypted field cannot be decrypted: that field reads null, the rest of the row and list are served, and the failure is logged at error level with entity, row id and field"
+  },
   {
     "version": "0.354.1",
     "type": "fix",