@cosmicdrift/kumiko-samples 0.354.1 → 0.356.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.354.1",
+  "version": "0.356.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.354.1",
+  "version": "0.356.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/src/agent-tools/agent-manifest.ts

@@ -251,6 +251,7 @@ function buildHandlerEntry(
   }
 
   const entity = getHandlerEntity(qn);
+  const excludedFields = "excludedFields" in def ? def.excludedFields : undefined;
   return {
     qn,
     kind,
@@ -258,6 +259,7 @@ function buildHandlerEntry(
     risk: exposure.risk,
     inputSchema,
     ...(entity !== undefined && { entity }),
+    ...(excludedFields !== undefined && { excludedFields }),
   };
 }
 

package/packages/bundled-features/src/agent-tools/types.ts

@@ -152,6 +152,8 @@ export type AgentManifestHandler = {
   readonly risk: AgentRisk;
   readonly inputSchema: Readonly<Record<string, unknown>>;
   readonly entity?: string;
+  /** Fields this generic create/update handler never writes; sending one fails validation. */
+  readonly excludedFields?: readonly string[];
 };
 
 export type AgentManifestScreen = {

package/packages/bundled-features/src/audit/escape-hatch-audit-sink.ts

@@ -23,6 +23,7 @@ export const escapeHatchUsedSchema = z.object({
   kind: z.enum(escapeHatchKinds),
   reason: z.string(),
   actor: z.string(),
+  caller: z.string().optional(),
   targetUserId: z.string().optional(),
   targetTenantId: z.string().optional(),
 });
@@ -36,6 +37,7 @@ export function createEscapeHatchAuditSink(opts: {
       kind: event.kind,
       reason: event.reason,
       actor: event.actor,
+      ...(event.caller !== undefined && { caller: event.caller }),
       ...(event.target && { targetUserId: event.target.id, targetTenantId: event.target.tenantId }),
     });
     // Appends on the unbound pool, never the handler tx — an audit entry must

package/packages/bundled-features/src/audit/handlers/resolve-audit-tenant.ts

@@ -1,4 +1,5 @@
-import { crossTenantOverrideDenied, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { mayOverrideTenant, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, FrameworkReasons } from "@cosmicdrift/kumiko-framework/errors";
 import { APP_INSTANCE_STREAM_TYPE } from "@cosmicdrift/kumiko-framework/event-store";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
 import { type AuditScope, AuditScopes } from "../constants.js";
@@ -12,11 +13,11 @@ export function resolveAuditScopeFilter(
   scope: AuditScope | undefined,
 ): AuditScopeFilter {
   if (scope !== AuditScopes.system) return { tenantId: user.tenantId };
-  const denied = crossTenantOverrideDenied(
-    user,
-    SYSTEM_TENANT_ID,
-    "audit.errors.systemScopeRequiresSystemAdmin",
-  );
-  if (denied) throw denied;
+  if (!mayOverrideTenant(user)) {
+    throw new AccessDeniedError({
+      i18nKey: "audit.errors.systemScopeRequiresSystemAdmin",
+      details: { reason: FrameworkReasons.tenantOverrideRequiresSystemAdmin },
+    });
+  }
   return { tenantId: SYSTEM_TENANT_ID, aggregateType: APP_INSTANCE_STREAM_TYPE };
 }

package/packages/bundled-features/src/billing-foundation/consumer-protection/register-consent.ts

@@ -1,5 +1,4 @@
 import type { FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
-import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
 import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../constants.js";
 import {
@@ -75,17 +74,13 @@ export function registerConsumerProtection(
         // user), never from payload data.
         const tenantId = ctx.systemUser.tenantId;
         const currentPeriodEndIso = payload["currentPeriodEndIso"];
-        const result = await ctx.writeAs(
-          createSystemUser(tenantId),
-          SubscriptionFoundationHandlers.issueContractConfirmation,
-          {
-            consentId,
-            sourceAggregateId: isSubscriptionEvent
-              ? subscriptionAggregateId(tenantId)
-              : paymentAggregateId(tenantId),
-            ...(typeof currentPeriodEndIso === "string" && { currentPeriodEndIso }),
-          },
-        );
+        const result = await ctx.write(SubscriptionFoundationHandlers.issueContractConfirmation, {
+          consentId,
+          sourceAggregateId: isSubscriptionEvent
+            ? subscriptionAggregateId(tenantId)
+            : paymentAggregateId(tenantId),
+          ...(typeof currentPeriodEndIso === "string" && { currentPeriodEndIso }),
+        });
         if (!result.isSuccess) {
           throw new Error(
             `billing-foundation:${trigger.jobName}: issue-contract-confirmation failed: ${JSON.stringify(result.error)}`,

package/packages/bundled-features/src/billing-foundation/consumer-protection/register-termination.ts

@@ -1,4 +1,4 @@
-import { createSystemUser, type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+import type { FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
 import { SubscriptionCancelTimings, SubscriptionFoundationHandlers } from "../constants.js";
 import {
   CONTRACT_TERMINATION_DECLARED_EVENT_QN,
@@ -59,22 +59,18 @@ export function registerContractTermination(
       const declared = contractTerminationDeclaredPayloadSchema.safeParse(payload);
       // skip: trigger event carries no usable declaration
       if (!declared.success) return;
-      const result = await ctx.writeAs(
-        createSystemUser(ctx.systemUser.tenantId),
-        SubscriptionFoundationHandlers.recordContractTermination,
-        {
-          requestId: declared.data.requestId,
-          declarationType: declared.data.declarationType,
-          terminationKind: declared.data.terminationKind,
-          channel: "public",
-          when:
-            declared.data.declarationType === "withdrawal"
-              ? "none"
-              : SubscriptionCancelTimings.periodEnd,
-          receivedAtIso: declared.data.receivedAtIso,
-          locale: declared.data.locale,
-        },
-      );
+      const result = await ctx.write(SubscriptionFoundationHandlers.recordContractTermination, {
+        requestId: declared.data.requestId,
+        declarationType: declared.data.declarationType,
+        terminationKind: declared.data.terminationKind,
+        channel: "public",
+        when:
+          declared.data.declarationType === "withdrawal"
+            ? "none"
+            : SubscriptionCancelTimings.periodEnd,
+        receivedAtIso: declared.data.receivedAtIso,
+        locale: declared.data.locale,
+      });
       if (!result.isSuccess) {
         throw new Error(
           `billing-foundation:cancel-on-public-termination-declared: record-contract-termination failed: ${JSON.stringify(result.error)}`,

package/packages/bundled-features/src/cap-overview/handlers/caps-usage.query.ts

@@ -1,12 +1,16 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
-  crossTenantOverrideDenied,
   defineQueryHandler,
+  mayOverrideTenant,
   type QueryHandlerDefinition,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  AccessDeniedError,
+  FrameworkReasons,
+  InternalError,
+} from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { tierAssignmentEntity } from "../../tier-engine/index.js";
 import type { CapSpec, CapUsageWithMeta } from "../types.js";
@@ -39,12 +43,12 @@ export function createCapsUsageQuery(
         });
       }
       const override = query.payload.tenantId;
-      const overrideDenied = crossTenantOverrideDenied(
-        query.user,
-        override,
-        "cap-overview.errors.tenantOverrideRequiresSystemAdmin",
-      );
-      if (overrideDenied) throw overrideDenied;
+      if (override !== undefined && !mayOverrideTenant(query.user)) {
+        throw new AccessDeniedError({
+          i18nKey: "cap-overview.errors.tenantOverrideRequiresSystemAdmin",
+          details: { reason: FrameworkReasons.tenantOverrideRequiresSystemAdmin },
+        });
+      }
 
       const targetTenantId = override ?? query.user.tenantId;
       // Both branches return the SAME unfiltered system-mode db —

package/packages/bundled-features/src/compliance-profiles/handlers/set-profile.write.ts

@@ -4,18 +4,14 @@ import {
   SELECTABLE_PROFILE_KEYS,
 } from "@cosmicdrift/kumiko-framework/compliance";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import {
-  access,
-  crossTenantOverrideDenied,
-  defineWriteHandler,
-  type TenantId,
-} from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   UnprocessableError,
   validationErrorFromZod,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import {
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
@@ -31,24 +27,16 @@ const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantCompli
 // SELECTABLE_PROFILE_KEYS aus der framework/compliance-Liste.
 const profileKeySchema = z.enum(SELECTABLE_PROFILE_KEYS);
 
-// Tenant-Admin setzt Profile-Key + optional Override-JSON.
-//
-// Upsert-Verhalten: erste Wahl insert, weitere update. Idempotent —
-// wer mit gleichen Werten zweimal aufruft, kriegt das gleiche Ergebnis
-// (modulo aktualisierte Audit-Events im Event-Store).
+// Upsert: the first call inserts, later calls update, so repeating the same values
+// is idempotent apart from the extra audit events.
 //
-// Cross-Tenant-Pfad: SystemAdmin kann via `tenantIdOverride` fuer einen
-// anderen Tenant schreiben (Plattform-Operator-Setup, Customer-
-// Onboarding-Migrationen). TenantAdmin's Override-Versuch → 403.
-// executorUser.tenantId muss = ziel-tenant sein damit der event-store-
-// Stream-Lookup nicht miss → version_conflict gibt (Memory:
-// feedback_event_store_tenant_consistency).
+// A SystemAdmin may target another tenant via `tenantIdOverride` (operator setup,
+// onboarding migrations); the dispatcher rejects the override for anyone else. The
+// executor then writes into the target tenant's stream via streamTenantId while
+// the operator stays the recorded actor.
 //
-// Validation:
-//   - profileKey muss in SELECTABLE_PROFILE_KEYS sein (Zod-checked)
-//   - override (optional) muss valides JSON-Object sein
-//   - override Top-Level-Keys muessen in ALLOWED_OVERRIDE_KEYS sein
-//     — verhindert Tippfehler die deepMerge stillschweigend ignoriert
+// Override top-level keys are restricted to ALLOWED_OVERRIDE_KEYS because deepMerge
+// would silently ignore a typo.
 export const setProfileWrite = defineWriteHandler({
   name: "set-profile",
   schema: z.object({
@@ -62,15 +50,8 @@ export const setProfileWrite = defineWriteHandler({
   description:
     "Sets or replaces a tenant's compliance profile key plus an optional JSON override, for onboarding or a later region change; a system admin may target a different tenant through tenantIdOverride.",
   handler: async (event, ctx) => {
-    const tenantOverride = event.payload.tenantIdOverride;
-    const overrideDenied = crossTenantOverrideDenied(
-      event.user,
-      tenantOverride,
-      "complianceProfiles.errors.tenantOverrideRequiresSystemAdmin",
-    );
-    if (overrideDenied) return writeFailure(overrideDenied);
-    const tenantId = (tenantOverride ?? event.user.tenantId) as TenantId; // @cast-boundary engine-payload
-    const executorUser = tenantOverride !== undefined ? { ...event.user, tenantId } : event.user;
+    const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId) as TenantId; // @cast-boundary engine-payload
+    const { db, streamTenantId } = requireForTenant(ctx, tenantId);
 
     // Override-Validation: muss parseables JSON-Object sein UND dem
     // ComplianceProfileOverride-Schema entsprechen (S1.9 Z3 — strict-Zod
@@ -100,7 +81,7 @@ export const setProfileWrite = defineWriteHandler({
     }
 
     // Upsert: existierenden Eintrag suchen
-    const existing = (await fetchOne(ctx.db, tenantComplianceProfileTable, {
+    const existing = (await fetchOne(db, tenantComplianceProfileTable, {
       tenantId: tenantId,
     })) as { id: string; version: number } | null; // @cast-boundary db-runner
 
@@ -114,8 +95,9 @@ export const setProfileWrite = defineWriteHandler({
             override: event.payload.override ?? null,
           },
         },
-        executorUser,
-        ctx.db,
+        event.user,
+        db,
+        { streamTenantId },
       );
       if (!result.isSuccess) return result;
       return {
@@ -130,8 +112,9 @@ export const setProfileWrite = defineWriteHandler({
         override: event.payload.override ?? null,
         tenantId,
       },
-      executorUser,
-      ctx.db,
+      event.user,
+      db,
+      { streamTenantId },
     );
     if (!result.isSuccess) return result;
     return {

package/packages/bundled-features/src/custom-fields/handlers/define-system-field.write.ts

@@ -1,20 +1,15 @@
 import { SYSTEM_TENANT_ID, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { defineOrResurrectFieldDefinition } from "../lib/define-or-resurrect.js";
 import { buildFieldDefinitionColumns } from "../lib/field-definition-row.js";
 import { type DefineFieldPayload, defineFieldPayloadSchema } from "../schemas.js";
 
-// define-system-field — SystemAdmin definiert eine system-weite Custom-Field-
-// Definition die für ALLE Tenants gilt. tenantId wird auf SYSTEM_TENANT_ID
-// gesetzt (NICHT vom Caller — SystemAdmin's event.user.tenantId würde sonst
-// auf den admin's eigenen platform-tenant zeigen).
-//
-// **Use-Case:** Vendor (cdgs) sagt "alle Hausverwaltungs-customers haben ab
-// heute ein `internalNumber`-Field". Tenant kann den Wert pro customer
-// setzen, aber die Definition nicht ändern oder löschen.
-//
-// **Same-scope-conflict** wie bei define-tenant-field via aggregate-version-
-// conflict (deterministische ID mit tenantId=SYSTEM_TENANT_ID).
+// A system-wide field definition applies to every tenant. tenantId is forced to
+// SYSTEM_TENANT_ID (never taken from the caller) and addressed via streamTenantId,
+// so the SystemAdmin stays the recorded actor. Tenants can set values for the field
+// but cannot change or delete the definition. A same-scope duplicate surfaces as an
+// aggregate version conflict, because the ID is derived from SYSTEM_TENANT_ID.
 export const defineSystemFieldHandler: WriteHandlerDef = {
   name: "define-system-field",
   schema: defineFieldPayloadSchema,
@@ -30,16 +25,14 @@ export const defineSystemFieldHandler: WriteHandlerDef = {
       payload.fieldKey,
     );
 
-    // Override event.user.tenantId to SYSTEM_TENANT_ID for the system-scope
-    // write. The framework's CrudExecutor writes the row with this tenantId
-    // — the row lives in the system-scope-stream.
-    const systemUser = { ...event.user, tenantId: SYSTEM_TENANT_ID };
+    const { db, streamTenantId } = requireForTenant(ctx, SYSTEM_TENANT_ID);
 
     return defineOrResurrectFieldDefinition(
       aggregateId,
       buildFieldDefinitionColumns(payload),
-      systemUser,
-      ctx.db,
+      event.user,
+      db,
+      streamTenantId,
     );
   },
 };

package/packages/bundled-features/src/custom-fields/handlers/delete-system-field.write.ts

@@ -1,4 +1,5 @@
 import { SYSTEM_TENANT_ID, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants.js";
 import { fieldDefinitionExecutor } from "../executor.js";
@@ -26,8 +27,10 @@ export const deleteSystemFieldHandler: WriteHandlerDef = {
       payload.fieldKey,
     );
 
-    const systemUser = { ...event.user, tenantId: SYSTEM_TENANT_ID };
-    const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, systemUser, ctx.db);
+    const { db, streamTenantId } = requireForTenant(ctx, SYSTEM_TENANT_ID);
+    const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, event.user, db, {
+      streamTenantId,
+    });
 
     // Cascade-cleanup-Event — host-entity-MSPs entfernen orphan values aus
     // ihrer customFields jsonb. Im selben TX = atomic.

package/packages/bundled-features/src/custom-fields/lib/define-or-resurrect.ts

@@ -1,3 +1,4 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionExecutor } from "../executor.js";
 import type { FieldDefinitionColumns } from "./field-definition-row.js";
 
@@ -27,13 +28,18 @@ export async function defineOrResurrectFieldDefinition(
   columns: FieldDefinitionColumns,
   user: DefineUser,
   db: DefineDb,
+  streamTenantId?: TenantId,
 ): Promise<WriteResult> {
   const active = await fieldDefinitionExecutor.detail({ id: aggregateId }, user, db);
   if (active) {
-    return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
+    return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db, {
+      streamTenantId,
+    });
   }
 
-  const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db);
+  const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db, {
+    streamTenantId,
+  });
   if (restored.isSuccess) {
     // restore() just un-deleted the row in this same tx; no concurrent writer
     // exists, so skip the optimistic-lock version match (we'd otherwise have to
@@ -43,10 +49,13 @@ export async function defineOrResurrectFieldDefinition(
     // readonly FieldDefinitionColumns isn't assignable to it.
     return fieldDefinitionExecutor.update({ id: aggregateId, changes: { ...columns } }, user, db, {
       skipOptimisticLock: true,
+      streamTenantId,
     });
   }
   if (restored.error.code === "not_found") {
-    return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
+    return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db, {
+      streamTenantId,
+    });
   }
   return restored;
 }

package/packages/bundled-features/src/delivery/delivery-service.ts

@@ -190,7 +190,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
       tenantId,
       actor: systemUser.id,
       sink: escapeHatchAuditSink,
-      log,
+      log: logError,
     });
     // ctx.db/dbOutsideTransaction are tenant-filtered even for a systemScope handler:
     // the dispatcher closes them off entirely there, so "system" mode would hand this

package/packages/bundled-features/src/managed-pages/handlers/by-tenant-published.query.ts

@@ -1,9 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
-import {
-  crossTenantOverrideDenied,
-  defineQueryHandler,
-} from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type PageRow, pagesTable } from "../table.js";
 
@@ -33,12 +30,6 @@ export const byTenantPublishedQuery = defineQueryHandler({
     "Lists every published page of a tenant with slug, language, title and last-change time but no body; use it to enumerate the public pages for sitemap.xml or llms.txt, rather than by-slug which fetches one page's content.",
   handler: async (query, ctx) => {
     const override = query.payload.tenantIdOverride;
-    const overrideDenied = crossTenantOverrideDenied(
-      query.user,
-      override,
-      "managedPages.errors.tenantOverrideRequiresSystemAdmin",
-    );
-    if (overrideDenied) throw overrideDenied;
     const tenantId = override ?? query.user.tenantId;
     const rows = castTenantRows<PageRow>(
       await selectMany(ctx.db, pagesTable, { tenantId: tenantId, published: true }),

package/packages/bundled-features/src/managed-pages/handlers/set.write.ts

@@ -1,12 +1,8 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import {
-  crossTenantOverrideDenied,
-  defineWriteHandler,
-  type TenantId,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { type PageRow, pageEntity, pagesTable } from "../table.js";
 
 const slugSchema = z
@@ -23,9 +19,6 @@ const langSchema = z
 
 const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName: "page" });
 
-const SET_PAGE_TENANT_OVERRIDE_REASON =
-  "SystemAdmin tenantIdOverride re-scopes the page write to the target tenant";
-
 // Upsert einer Page — eine Operation pro (tenantId, slug, lang). Tenant-
 // Scope default aus event.user; SystemAdmin kann via `tenantIdOverride`
 // für einen anderen Tenant schreiben (typisch SYSTEM_TENANT_ID für app-
@@ -48,35 +41,12 @@ export const setWrite = defineWriteHandler({
   access: { roles: ["TenantAdmin", "SystemAdmin"] },
   description:
     "Creates or overwrites one managed page addressed by slug and language, keeping the existing published flag, description and OG image when the payload omits them; use it for content edits and publish toggles, and as SystemAdmin to write another tenant's pages.",
-  escapeHatch: {
-    grants: ["unsafeRaw"],
-    reason: SET_PAGE_TENANT_OVERRIDE_REASON,
-  },
   handler: async (event, ctx) => {
-    const db = ctx.db;
     const override = event.payload.tenantIdOverride;
-    const overrideDenied = crossTenantOverrideDenied(
-      event.user,
-      override,
-      "managedPages.errors.tenantOverrideRequiresSystemAdmin",
-    );
-    if (overrideDenied) return writeFailure(overrideDenied);
-    const tenantId = override ?? event.user.tenantId;
-    // override: point the executor context at the target tenant, else getStreamVersion runs against user.tenantId → version_conflict.
-    const executorUser =
-      override !== undefined ? { ...event.user, tenantId: override as TenantId } : event.user; // @cast-boundary engine-bridge
-
+    const tenantId = (override ?? event.user.tenantId) as TenantId; // @cast-boundary engine-bridge
     // ctx.db is scoped to the executing user's tenant, wrong for a cross-tenant override
     // on both the existing-check and the executor's stream reads; re-scope to the target.
-    // Safe: the override branch is SystemAdmin-gated above.
-    const scopedDb =
-      override !== undefined
-        ? createTenantDb(
-            db.unsafeRaw(),
-            override as TenantId, // @cast-boundary engine-bridge
-            "tenant",
-          )
-        : db;
+    const { db: scopedDb, streamTenantId } = requireForTenant(ctx, tenantId);
     const existing = await fetchOne<PageRow>(scopedDb, pagesTable, {
       tenantId,
       slug: event.payload.slug,
@@ -100,8 +70,9 @@ export const setWrite = defineWriteHandler({
               event.payload.published !== undefined ? event.payload.published : existing.published,
           },
         },
-        executorUser,
+        event.user,
         scopedDb,
+        { streamTenantId },
       );
       if (!result.isSuccess) return result;
       return {
@@ -121,8 +92,9 @@ export const setWrite = defineWriteHandler({
         published: event.payload.published ?? false,
         tenantId,
       },
-      executorUser,
+      event.user,
       scopedDb,
+      { streamTenantId },
     );
     if (!result.isSuccess) return result;
     return {

package/packages/bundled-features/src/shared/index.ts

@@ -33,6 +33,7 @@ export {
   redactErrorText,
   redactUrls,
 } from "./redact.js";
+export { requireForTenant } from "./require-for-tenant.js";
 export {
   type RowBoundGrantResult,
   redeemRowBoundGrant,

package/packages/bundled-features/src/shared/require-for-tenant.ts

@@ -0,0 +1,18 @@
+import type {
+  HandlerContext,
+  TenantId,
+  TenantWriteTarget,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+
+// ctx.forTenant is absent for r.systemScope() handlers and without a db; a write handler that
+// needs a cross-tenant target must fail loudly instead of falling back to ctx.db.
+export function requireForTenant(
+  ctx: Pick<HandlerContext, "forTenant">,
+  targetTenantId: TenantId,
+): TenantWriteTarget {
+  if (!ctx.forTenant) {
+    throw new InternalError({ message: "ctx.forTenant is not available in this handler context" });
+  }
+  return ctx.forTenant(targetTenantId);
+}

package/packages/bundled-features/src/template-resolver/handlers/by-slug.query.ts

@@ -1,8 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  crossTenantOverrideDenied,
-  defineQueryHandler,
-} from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants.js";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
@@ -33,12 +30,6 @@ export const bySlugQuery = defineQueryHandler({
     "Reads one text-block of a tenant by slug and locale together with its body and format; it is pinned to the text-block kind so mail templates and AI prompts in the same table stay unreachable through this anonymous-capable path.",
   handler: async (query, ctx) => {
     const override = query.payload.tenantIdOverride;
-    const overrideDenied = crossTenantOverrideDenied(
-      query.user,
-      override,
-      "templateResolver.errors.tenantOverrideRequiresSystemAdmin",
-    );
-    if (overrideDenied) throw overrideDenied;
     const tenantId = override ?? query.user.tenantId;
     const row = await fetchOne<TemplateResourceRow>(ctx.db, templateResourcesTable, {
       tenantId,

package/packages/bundled-features/src/template-resolver/handlers/by-tenant.query.ts

@@ -1,9 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
-import {
-  crossTenantOverrideDenied,
-  defineQueryHandler,
-} from "@cosmicdrift/kumiko-framework/engine";
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { TEXT_BLOCK_KIND } from "../constants.js";
@@ -39,12 +36,6 @@ export const byTenantQuery = defineQueryHandler({
     "Lists every text-block of a tenant with slug, locale, title and body so a public content tree can be rendered in one call; use it for the whole sidebar, and by-slug when only one block is needed.",
   handler: async (query, ctx) => {
     const override = query.payload.tenantIdOverride;
-    const overrideDenied = crossTenantOverrideDenied(
-      query.user,
-      override,
-      "templateResolver.errors.tenantOverrideRequiresSystemAdmin",
-    );
-    if (overrideDenied) throw overrideDenied;
     const tenantId = override ?? query.user.tenantId;
     const rows = castTenantRows<TemplateResourceRow>(
       await selectMany(ctx.db, templateResourcesTable, { tenantId, kind: TEXT_BLOCK_KIND }),

package/packages/bundled-features/src/template-resolver/handlers/collection-item.query.ts

@@ -1,7 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   type ContentCollectionDefinition,
-  crossTenantOverrideDenied,
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
@@ -31,12 +30,6 @@ export function makeCollectionItemQuery(collection: ContentCollectionDefinition)
         : `Reads one tenant-wide "${collection.id}" entry by slug and locale, returning null when it does not exist; use it to open a single entry in the editor rather than to list the collection.`,
     handler: async (query, ctx) => {
       const override = query.payload.tenantIdOverride;
-      const overrideDenied = crossTenantOverrideDenied(
-        query.user,
-        override,
-        "templateResolver.errors.tenantOverrideRequiresSystemAdmin",
-      );
-      if (overrideDenied) throw overrideDenied;
       const tenantId = override ?? query.user.tenantId;
       const row = await fetchOne<CollectionEntryRow>(ctx.db, store.table, {
         tenantId,