@cosmicdrift/kumiko-samples 0.353.0 → 0.354.1

package/packages/bundled-features/src/sessions/feature.ts

@@ -4,18 +4,26 @@ import {
   type SessionStoreProvider,
 } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { type DbConnection, deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  defineFeature,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { USER_SESSION_ENTITY_NAME } from "./constants.js";
 import { cleanupJob } from "./handlers/cleanup.job.js";
-import { detailQuery } from "./handlers/detail.query.js";
-import { listQuery } from "./handlers/list.query.js";
+import { createDetailQuery } from "./handlers/detail.query.js";
+import { createListQuery } from "./handlers/list.query.js";
 import { mineQuery } from "./handlers/mine.query.js";
 import { revokeWrite } from "./handlers/revoke.write.js";
 import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write.js";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write.js";
 import { SESSIONS_I18N } from "./i18n.js";
 import { userSessionEntity } from "./schema/user-session.js";
-import { sessionDetailScreen, sessionListScreen, sessionMineScreen } from "./screens.js";
+import {
+  createSessionDetailScreen,
+  createSessionListScreen,
+  sessionMineScreen,
+} from "./screens.js";
 import {
   createSessionCallbacks,
   type SessionAllOthersRevoker,
@@ -45,6 +53,10 @@ export type SessionsFeatureOptions = {
   // Session JWT / store_user_sessions TTL. Was previously auth.sessions.expiresInMs
   // (#1372) — lives on the sessions feature now that sessionStore is the wiring.
   readonly expiresInMs?: number;
+  // Access preset for the admin list/detail queries and screens; they expose decrypted
+  // IP/user-agent of every session in the tenant. A preset name, not a role array, because
+  // dedupeOptions must stay primitive.
+  readonly adminAccess?: "admin" | "systemAdmin";
 };
 
 export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
@@ -89,6 +101,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
   return defineFeature(
     "sessions",
     (r) => {
+      const adminRoles = access[options?.adminAccess ?? "admin"];
       r.describe(
         "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
       );
@@ -162,8 +175,8 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
 
       const queries = {
         mine: r.queryHandler(mineQuery),
-        list: r.queryHandler(listQuery),
-        detail: r.queryHandler(detailQuery),
+        list: r.queryHandler(createListQuery(adminRoles)),
+        detail: r.queryHandler(createDetailQuery(adminRoles)),
       };
 
       // Retention: chunked DELETE of expired/revoked rows. Manual trigger
@@ -222,8 +235,8 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
 
       r.translations({ keys: SESSIONS_I18N });
 
-      r.screen(sessionListScreen);
-      r.screen(sessionDetailScreen);
+      r.screen(createSessionListScreen(adminRoles));
+      r.screen(createSessionDetailScreen(adminRoles));
       r.screen(sessionMineScreen);
       r.nav({
         id: "session-list",

package/packages/bundled-features/src/sessions/handlers/detail.query.ts

@@ -16,36 +16,37 @@ const sessionRowSchema = z.object({
   userAgent: z.string().nullable(),
 });
 
-export const detailQuery = defineQueryHandler({
-  name: "user-session:detail",
-  schema: z.object({ id: z.uuid() }),
-  access: { roles: access.admin },
-  description:
-    "Loads one session of the active tenant by its id with owner, timestamps and decrypted IP/user-agent; use it when an admin investigates a specific session found through the session list.",
-  // Decrypted IP and user-agent.
-  agent: { risk: "high" },
-  outputSchema: sessionRowSchema.nullable(),
-  handler: async (query, ctx) => {
-    const row = await fetchOne<{
-      id: string;
-      userId: string;
-      createdAt: unknown;
-      expiresAt: unknown;
-      revokedAt: unknown;
-      ip: string | null;
-      userAgent: string | null;
-    }>(ctx.db, userSessionTable, { id: query.payload.id });
-    if (!row) return null;
-    return {
-      id: row.id,
-      userId: row.userId,
-      createdAt: row.createdAt,
-      expiresAt: row.expiresAt,
-      revokedAt: row.revokedAt,
-      ip: row.ip ? await decryptStoredPii(row.ip, "ip", "sessions:detail") : row.ip,
-      userAgent: row.userAgent
-        ? await decryptStoredPii(row.userAgent, "userAgent", "sessions:detail")
-        : row.userAgent,
-    };
-  },
-});
+export const createDetailQuery = (adminRoles: readonly string[] = access.admin) =>
+  defineQueryHandler({
+    name: "user-session:detail",
+    schema: z.object({ id: z.uuid() }),
+    access: { roles: adminRoles },
+    description:
+      "Loads one session of the active tenant by its id with owner, timestamps and decrypted IP/user-agent; use it when an admin investigates a specific session found through the session list.",
+    // Decrypted IP and user-agent.
+    agent: { risk: "high" },
+    outputSchema: sessionRowSchema.nullable(),
+    handler: async (query, ctx) => {
+      const row = await fetchOne<{
+        id: string;
+        userId: string;
+        createdAt: unknown;
+        expiresAt: unknown;
+        revokedAt: unknown;
+        ip: string | null;
+        userAgent: string | null;
+      }>(ctx.db, userSessionTable, { id: query.payload.id });
+      if (!row) return null;
+      return {
+        id: row.id,
+        userId: row.userId,
+        createdAt: row.createdAt,
+        expiresAt: row.expiresAt,
+        revokedAt: row.revokedAt,
+        ip: row.ip ? await decryptStoredPii(row.ip, "ip", "sessions:detail") : row.ip,
+        userAgent: row.userAgent
+          ? await decryptStoredPii(row.userAgent, "userAgent", "sessions:detail")
+          : row.userAgent,
+      };
+    },
+  });

package/packages/bundled-features/src/sessions/handlers/list.query.ts

@@ -25,68 +25,71 @@ function isSortableColumn(value: string): value is SortableColumn {
 // tenantId column. Includes revoked rows; UI shows revokedAt distinct.
 // No cursor — nextCursor is always null; `limit` only caps the page size,
 // it doesn't offset into a further one.
-export const listQuery = definePagedQueryHandler({
-  name: "user-session:list",
-  schema: z.object({
-    limit: z.number().int().nonnegative().max(MAX_LIST_LIMIT).optional(),
-    sort: z.string().optional(),
-    sortDirection: z.enum(["asc", "desc"]).optional(),
-  }),
-  access: { roles: access.admin },
-  description:
-    "Lists every session in the active tenant, live and revoked, sortable by id, user, creation, expiry or revocation, for an admin auditing who is signed in.",
-  outputSchema: z.object({
-    rows: z.array(
-      z.object({
-        id: z.string(),
-        userId: z.string(),
-        createdAt: z.unknown(),
-        expiresAt: z.unknown(),
-        revokedAt: z.unknown(),
-        ip: z.string().nullable(),
-        userAgent: z.string().nullable(),
-      }),
-    ),
-    nextCursor: z.string().nullable(),
-  }),
-  handler: async (query, ctx) => {
-    const requestedSort = query.payload.sort;
-    const sortColumn: SortableColumn =
-      requestedSort !== undefined && isSortableColumn(requestedSort) ? requestedSort : "createdAt";
-    const rows = await selectMany<{
-      id: string;
-      userId: string;
-      createdAt: unknown;
-      expiresAt: unknown;
-      revokedAt: unknown;
-      ip: string | null;
-      userAgent: string | null;
-    }>(ctx.db, userSessionTable, undefined, {
-      // `id` as a tie-breaker keeps row order (and, with `limit` set, row
-      // selection) deterministic across identical requests — sortColumn
-      // alone isn't unique (e.g. many NULL revokedAt, or equal timestamps).
-      orderBy:
-        sortColumn === "id"
-          ? { col: "id", direction: query.payload.sortDirection ?? "desc" }
-          : [
-              { col: sortColumn, direction: query.payload.sortDirection ?? "desc" },
-              { col: "id", direction: "asc" },
-            ],
-      ...(query.payload.limit !== undefined && { limit: query.payload.limit }),
-    });
-    const decryptedRows = await Promise.all(
-      rows.map(async (r) => ({
-        id: r.id,
-        userId: r.userId,
-        createdAt: r.createdAt,
-        expiresAt: r.expiresAt,
-        revokedAt: r.revokedAt,
-        ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:list") : r.ip,
-        userAgent: r.userAgent
-          ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:list")
-          : r.userAgent,
-      })),
-    );
-    return { rows: decryptedRows, nextCursor: null };
-  },
-});
+export const createListQuery = (adminRoles: readonly string[] = access.admin) =>
+  definePagedQueryHandler({
+    name: "user-session:list",
+    schema: z.object({
+      limit: z.number().int().nonnegative().max(MAX_LIST_LIMIT).optional(),
+      sort: z.string().optional(),
+      sortDirection: z.enum(["asc", "desc"]).optional(),
+    }),
+    access: { roles: adminRoles },
+    description:
+      "Lists every session in the active tenant, live and revoked, sortable by id, user, creation, expiry or revocation, for an admin auditing who is signed in.",
+    outputSchema: z.object({
+      rows: z.array(
+        z.object({
+          id: z.string(),
+          userId: z.string(),
+          createdAt: z.unknown(),
+          expiresAt: z.unknown(),
+          revokedAt: z.unknown(),
+          ip: z.string().nullable(),
+          userAgent: z.string().nullable(),
+        }),
+      ),
+      nextCursor: z.string().nullable(),
+    }),
+    handler: async (query, ctx) => {
+      const requestedSort = query.payload.sort;
+      const sortColumn: SortableColumn =
+        requestedSort !== undefined && isSortableColumn(requestedSort)
+          ? requestedSort
+          : "createdAt";
+      const rows = await selectMany<{
+        id: string;
+        userId: string;
+        createdAt: unknown;
+        expiresAt: unknown;
+        revokedAt: unknown;
+        ip: string | null;
+        userAgent: string | null;
+      }>(ctx.db, userSessionTable, undefined, {
+        // `id` as a tie-breaker keeps row order (and, with `limit` set, row
+        // selection) deterministic across identical requests — sortColumn
+        // alone isn't unique (e.g. many NULL revokedAt, or equal timestamps).
+        orderBy:
+          sortColumn === "id"
+            ? { col: "id", direction: query.payload.sortDirection ?? "desc" }
+            : [
+                { col: sortColumn, direction: query.payload.sortDirection ?? "desc" },
+                { col: "id", direction: "asc" },
+              ],
+        ...(query.payload.limit !== undefined && { limit: query.payload.limit }),
+      });
+      const decryptedRows = await Promise.all(
+        rows.map(async (r) => ({
+          id: r.id,
+          userId: r.userId,
+          createdAt: r.createdAt,
+          expiresAt: r.expiresAt,
+          revokedAt: r.revokedAt,
+          ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:list") : r.ip,
+          userAgent: r.userAgent
+            ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:list")
+            : r.userAgent,
+        })),
+      );
+      return { rows: decryptedRows, nextCursor: null };
+    },
+  });

package/packages/bundled-features/src/sessions/screens.ts

@@ -13,9 +13,9 @@ import {
   SessionQueries,
 } from "./constants.js";
 
-const listAccess = { roles: access.admin };
-
-export const sessionListScreen: ProjectionListScreenDefinition = {
+export const createSessionListScreen = (
+  adminRoles: readonly string[] = access.admin,
+): ProjectionListScreenDefinition => ({
   id: SESSION_LIST_SCREEN_ID,
   type: "projectionList",
   query: SessionQueries.list,
@@ -61,10 +61,12 @@ export const sessionListScreen: ProjectionListScreenDefinition = {
       rowClick: true,
     },
   ],
-  access: listAccess,
-};
+  access: { roles: adminRoles },
+});
 
-export const sessionDetailScreen: ProjectionDetailScreenDefinition = {
+export const createSessionDetailScreen = (
+  adminRoles: readonly string[] = access.admin,
+): ProjectionDetailScreenDefinition => ({
   id: SESSION_DETAIL_SCREEN_ID,
   type: "projectionDetail",
   query: SessionQueries.detail,
@@ -97,8 +99,8 @@ export const sessionDetailScreen: ProjectionDetailScreenDefinition = {
     ip: i18nKey("sessions.detail.field.ip"),
     userAgent: i18nKey("sessions.detail.field.userAgent"),
   },
-  access: listAccess,
-};
+  access: { roles: adminRoles },
+});
 
 // Revoke is hidden on the current session — it would sign the user out mid-click; logout covers it.
 export const sessionMineScreen: ProjectionListScreenDefinition = {

package/packages/bundled-features/src/shared/encrypt-for-direct-write.ts

@@ -3,8 +3,10 @@ import {
   collectPiiSubjectFields,
   configuredPiiSubjectKms,
   encryptPiiFieldValues,
+  KeyErasedError,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { EntityDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { subjectErasedConflict } from "@cosmicdrift/kumiko-framework/errors";
 
 // Unmanaged direct-write stores (r.unmanagedTable) skip the executor, so its
 // PII encryption never runs — every insert of subject-annotated fields must
@@ -18,12 +20,17 @@ export async function encryptForDirectWrite(
 ): Promise<Record<string, unknown>> {
   const kms = configuredPiiSubjectKms();
   if (!kms) return row;
-  return encryptPiiFieldValues(
-    row,
-    entity,
-    collectPiiSubjectFields(entity),
-    kms,
-    { requestId: requestContext.get()?.requestId ?? fallbackRequestId },
-    { entityName },
-  );
+  try {
+    return await encryptPiiFieldValues(
+      row,
+      entity,
+      collectPiiSubjectFields(entity),
+      kms,
+      { requestId: requestContext.get()?.requestId ?? fallbackRequestId },
+      { entityName },
+    );
+  } catch (e) {
+    if (e instanceof KeyErasedError) throw subjectErasedConflict(e);
+    throw e;
+  }
 }

package/packages/bundled-features/src/shared/index.ts

@@ -21,6 +21,7 @@ export { createLockoutCounter, type LockoutCounterState } from "./lockout-counte
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export {
   denyUnlessJoinRowParentVisible,
+  hostRowIsGone,
   joinRowParentIsVisible,
   parentRowIsVisible,
 } from "./parent-visibility.js";
@@ -38,7 +39,7 @@ export {
   signRowBoundGrant,
 } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
-export { sessionLocaleField } from "./session-locale-field.js";
+export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";
 export { sessionTimezoneField } from "./session-timezone-field.js";
 export {
   peekTokenSubject,

package/packages/bundled-features/src/shared/parent-visibility.ts

@@ -1,4 +1,8 @@
-import type { EventStoreExecutor, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  buildEntityTable,
+  type EventStoreExecutor,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntityExecutor,
   type EntityDefinition,
@@ -61,6 +65,32 @@ export async function parentRowIsVisible(
   return (await executor.detail({ id: entityId }, user, db)) !== null;
 }
 
+const hostTablesByEntity = new WeakMap<EntityDefinition, ReturnType<typeof buildEntityTable>>();
+
+// True when the host row can never be read again by anyone: its entityType no
+// longer names a registered entity, or the row is hard-deleted / soft-deleted.
+// Deliberately skips the caller's `access.read` ownership (unlike
+// parentRowIsVisible): a row hidden from this caller but alive for another team
+// is NOT gone, and its join row must stay.
+export async function hostRowIsGone(
+  registry: Registry,
+  entityType: string,
+  entityId: string,
+  db: TenantDb,
+): Promise<boolean> {
+  const entity = registry.getEntity(entityType);
+  if (!entity) return true;
+  if (!idShapeMatchesEntity(entity, entityId)) return true;
+
+  let table = hostTablesByEntity.get(entity);
+  if (!table) {
+    table = buildEntityTable(entityType, entity, { relations: registry.getRelations(entityType) });
+    hostTablesByEntity.set(entity, table);
+  }
+  const row = await db.fetchOne(table, { id: entityId });
+  return row === undefined || row["isDeleted"] === true;
+}
+
 // Write-path half of the parentRef gate (fw#2766). Resolves the join entity's
 // own `parentRef` declaration from the registry — the same object the read
 // path's SQL gate reads — so the field names and the allowedTypes allowlist

package/packages/bundled-features/src/shared/row-bound-grant.ts

@@ -54,6 +54,19 @@ function anchoredPurpose(purpose: string, anchor: string): string {
   return `${purpose}:${anchor}`;
 }
 
+// The HMAC input is `${purpose}:${anchor}:${subject}.${expiresAtMs}` with no
+// length prefixes. Colon-free anchor and subject make the split unambiguous
+// from the right, so two different (purpose, anchor, subject) triples can
+// never share a signature. The purpose may keep colons (tenant-handover
+// namespaces its purpose by entity type).
+function hasDelimiter(value: string): boolean {
+  return value.includes(":");
+}
+
+function isUnambiguousPart(value: string | null | undefined): value is string {
+  return !!value && !hasDelimiter(value);
+}
+
 export function signRowBoundGrant(args: {
   readonly subject: string;
   readonly purpose: string;
@@ -62,6 +75,9 @@ export function signRowBoundGrant(args: {
   readonly secret: string;
   readonly now?: Temporal.Instant;
 }): { readonly token: string; readonly expiresAt: Temporal.Instant } {
+  if (hasDelimiter(args.anchor) || hasDelimiter(args.subject)) {
+    throw new Error("row-bound grant: subject and anchor must not contain ':'");
+  }
   return signToken(
     args.subject,
     anchoredPurpose(args.purpose, args.anchor),
@@ -90,7 +106,7 @@ export async function redeemRowBoundGrant(args: {
   if (!args.secret) return FAILED;
 
   const subject = peekTokenSubject(args.token);
-  if (!subject) return FAILED;
+  if (!isUnambiguousPart(subject)) return FAILED;
 
   // The subject is unverified attacker input at this point, so a lookup that
   // throws on it (e.g. a non-uuid value against a uuid column) must not
@@ -107,7 +123,7 @@ export async function redeemRowBoundGrant(args: {
     });
     return FAILED;
   }
-  if (!anchor) return FAILED;
+  if (!isUnambiguousPart(anchor)) return FAILED;
 
   const verified = verifyToken(
     args.token,

package/packages/bundled-features/src/shared/session-locale-field.ts

@@ -1,3 +1,4 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 
@@ -7,3 +8,9 @@ export function sessionLocaleField(
   if (locale === null || locale === undefined || !isValidLocaleTag(locale)) return {};
   return { locale: canonicalizeLocaleTag(locale) };
 }
+
+// Only an explicit request signal (X-Locale) counts: the boot default is not a
+// choice the new user made.
+export function registrationLocaleFromRequest(): ReturnType<typeof sessionLocaleField> {
+  return sessionLocaleField(requestContext.get()?.locale);
+}

package/packages/bundled-features/src/template-resolver/api.ts

@@ -3,7 +3,7 @@
 // ctx.templateResolver at runtime.
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -76,7 +76,7 @@ export type TemplateResolverApi = {
   readonly resolveTemplate: (args: ResolveRequest) => Promise<TemplateResource>;
 };
 
-export function createTemplateResolverApi(db: DbConnection): TemplateResolverApi {
+export function createTemplateResolverApi(db: DbRunner): TemplateResolverApi {
   return {
     findExact: async ({ tenantId, slug, kind, locale, scope }) => {
       const effectiveTenantId = scope === "system" ? SYSTEM_TENANT_ID : tenantId;
@@ -106,7 +106,7 @@ export function createTemplateResolverApi(db: DbConnection): TemplateResolverApi
 }
 
 async function fetchTemplate(
-  db: DbConnection,
+  db: DbRunner,
   tenantId: string,
   slug: string,
   kind: TemplateKind,

package/packages/bundled-features/src/template-resolver/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "template-resolver list filters by every template kind including text-block and ai-prompt"
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/packages/bundled-features/src/template-resolver/handlers/list.query.ts

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { RENDER_KINDS, TEMPLATE_STATUSES } from "../constants.js";
+import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../constants.js";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
 
 // List für Admin-UI: filterbar nach kind / locale / status. Liefert
@@ -10,7 +10,7 @@ import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
 export const listQuery = defineQueryHandler({
   name: "list",
   schema: z.object({
-    kind: z.enum(RENDER_KINDS).optional(),
+    kind: z.enum(TEMPLATE_KINDS).optional(),
     locale: z.string().min(2).max(8).optional(),
     status: z.enum(TEMPLATE_STATUSES).optional(),
     includeSystem: z.boolean().default(true),

package/packages/bundled-features/src/tenant/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "createTenantFeature fails the boot when a declared assignable app role is missing from its assignableAppRoles option",
+    "detail": "Final review batch E1: bundled features\n`createTenantFeature` now fails the boot when an `assignableRole` declaration is missing from its `assignableAppRoles` option, because the members and invite screens would otherwise omit the role and a save of the member-roles form would silently strip it. `composeFeatures(includeBundled)` already passes the option. Agent-callable handlers that change access or books now resolve risk `high`: `tenant:write:disable`, `tenant:write:updateMemberRoles`, `user:write:user:update`, `tier-engine:write:set-tenant-tier`, `ledger:write:create-transaction` and `ledger:write:reverse-transaction`. `in_app_messages` gets a `(tenant_id, user_id, created_at)` index. `GET /files/:id/download-url` no longer puts a personal `fileName` into the signed URL; the hint carries a neutral name derived from the MIME type, while `GET /files/:id` still sends the real name in its response header. The forget-subject denial audit event goes through the shared `appendDomainEventCore`, which the pipeline barrel now exports.",
+    "migration": "Pass assignableAppRoles: collectAssignableAppRoles(appFeatures) to createTenantFeature when you mount it by hand; composeFeatures(includeBundled) already does."
+  },
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "tenant:write:disable and tenant:write:updateMemberRoles resolve agent risk high"
+  },
   {
     "version": "0.353.0",
     "type": "breaking",

package/packages/bundled-features/src/tenant/feature.ts

@@ -81,8 +81,15 @@ export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefi
     r.systemScope();
     r.requires("config");
     r.extendsRegistrar(EXT_ASSIGNABLE_ROLE, {});
+    // The elevation guards read the registry, the screens only these options: a role the
+    // server accepts but the screen omits is silently stripped on the next member-roles save.
     r.bootCheck(({ features }) => {
-      collectAssignableAppRoles(features);
+      for (const [role, assignableFrom] of collectAssignableAppRoles(features)) {
+        if (options?.assignableAppRoles?.get(role) === assignableFrom) continue;
+        throw new Error(
+          `[tenant] assignable app role "${role}" (assignableFrom "${assignableFrom}") is declared but missing from the tenant screens' options; pass assignableAppRoles: collectAssignableAppRoles(appFeatures) to createTenantFeature.`,
+        );
+      }
     });
     r.entity("tenant", tenantEntity);
     r.entity("tenant-membership", tenantMembershipEntity);

package/packages/bundled-features/src/tenant/handlers/toggle-enabled.write.ts

@@ -14,6 +14,8 @@ function createToggleTenantHandler(enable: boolean) {
     name: verbName,
     schema: z.object({ id: z.uuid() }),
     access: { roles: ["SystemAdmin"] },
+    // Disabling locks every member out; enabling is its undo.
+    ...(enable ? {} : { agent: { risk: "high" as const } }),
     description: enable
       ? "Re-enables a disabled tenant so its members can sign in and switch to it again; this is the undo for tenant:write:disable."
       : "Marks a tenant disabled so it stops counting as a membership — its members can no longer sign in to it or switch to it — while leaving all of its data in place.",

package/packages/bundled-features/src/tenant/handlers/update-member-roles.write.ts

@@ -72,6 +72,7 @@ export const updateMemberRolesWrite = defineWriteHandler({
   access: { roles: ["system", ...access.admin] },
   description:
     "Sets the roles a user holds in a tenant, rejecting reserved role names and any grant that would raise the target above the caller; roles the caller could not grant (platform roles such as DataProtectionOfficer or TenantOwner, undeclared or higher-tier app roles) are kept, only the system user replaces the full list; admins act on their own tenant, SystemAdmins on any.",
+  agent: { risk: "high" },
   handler: async (event, ctx) => {
     if (!ctx.systemDb) {
       throw new InternalError({

package/packages/bundled-features/src/tenant/invitation-table.ts

@@ -26,6 +26,7 @@ import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
   createMultiSelectField,
+  createNumberField,
   createSelectField,
   createTextField,
   createTimestampField,
@@ -94,6 +95,11 @@ export const tenantInvitationEntity = createEntity({
       personal: { of: "invitedBy" },
       find: "exact",
     }),
+    // Version of the invitee's membership row when the invitation was issued
+    // (0 = no membership yet). Accept compares it against the current version
+    // to detect a membership decision made after the invite. NULL only on rows
+    // issued before this field existed.
+    membershipVersion: createNumberField({ integer: true, min: 0 }),
     // UI-Anzeige — Wahrheit liegt in Redis-TTL.
     expiresAt: createTimestampField({ required: true }),
   },