@cosmicdrift/kumiko-samples 0.355.0 → 0.357.0

package/packages/bundled-features/src/delivery/jobs.ts

@@ -18,7 +18,7 @@ import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import * as z from "zod";
 import { appendAttemptEvent } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DeliveryJobs, deliveryPriorityRank } from "./constants.js";
+import { DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank } from "./constants.js";
 import { collectChannels, redactedMessageOf } from "./delivery-service.js";
 import type {
   ChannelMessage,
@@ -44,6 +44,7 @@ const renderJobPayloadSchema = z.object({
   deliveryAttemptId: z.string(),
   priority: z.enum(["critical", "normal", "low"]),
   message: channelMessageSchema,
+  idempotencyKey: z.string().optional(),
 });
 
 const sendJobPayloadSchema = renderJobPayloadSchema.extend({
@@ -110,6 +111,30 @@ function entryFor(
   };
 }
 
+// Only the final retry frees the key: earlier failures are retried by the runner and
+// must still dedup. Assumes ctx.redis is the handle the service claimed on; runProdApp
+// wires the same instance into both.
+async function releaseIdempotencyOnTerminalFailure(
+  ctx: JobContext,
+  p: RenderJobPayload,
+): Promise<void> {
+  // skip: nothing to release before the last attempt or without an idempotency key
+  if (!ctx.finalAttempt || !p.idempotencyKey) return;
+  if (!ctx.redis) {
+    ctx.log.warn("delivery: idempotency key not released, job context has no redis", {
+      notificationType: p.notificationType,
+    });
+    return;
+  }
+  try {
+    await ctx.redis.del(deliveryIdempotencyRedisKey(p.tenantId, p.idempotencyKey));
+  } catch (err) {
+    ctx.log.warn(`delivery: idempotency key release failed: ${redactedMessageOf(err)}`, {
+      notificationType: p.notificationType,
+    });
+  }
+}
+
 // The job runner stores err.message in the run row, and BullMQ keeps failedReason and
 // the stack trace in Redis in plain text, so the rethrown error carries only the code.
 // The redacted message goes to the log.
@@ -132,6 +157,7 @@ async function failAttempt(
     p.deliveryAttemptId,
     entryFor(p, "failed", code, p.address),
   );
+  await releaseIdempotencyOnTerminalFailure(ctx, p);
   throw new Error(code);
 }
 

package/packages/bundled-features/src/delivery/testing.ts

@@ -18,6 +18,7 @@ export type CreateDeliveryTestContextOptions = {
   readonly log?: Logger;
   readonly jobRunner?: JobRunner;
   readonly secrets?: SecretsContext;
+  readonly idempotencyRedis?: Redis;
 };
 
 /**

package/packages/bundled-features/src/managed-pages/handlers/set.write.ts

@@ -1,7 +1,8 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { type PageRow, pageEntity, pagesTable } from "../table.js";
 
 const slugSchema = z
@@ -18,9 +19,6 @@ const langSchema = z
 
 const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName: "page" });
 
-const SET_PAGE_TENANT_OVERRIDE_REASON =
-  "SystemAdmin tenantIdOverride re-scopes the page write to the target tenant";
-
 // Upsert einer Page — eine Operation pro (tenantId, slug, lang). Tenant-
 // Scope default aus event.user; SystemAdmin kann via `tenantIdOverride`
 // für einen anderen Tenant schreiben (typisch SYSTEM_TENANT_ID für app-
@@ -43,29 +41,12 @@ export const setWrite = defineWriteHandler({
   access: { roles: ["TenantAdmin", "SystemAdmin"] },
   description:
     "Creates or overwrites one managed page addressed by slug and language, keeping the existing published flag, description and OG image when the payload omits them; use it for content edits and publish toggles, and as SystemAdmin to write another tenant's pages.",
-  escapeHatch: {
-    grants: ["unsafeRaw"],
-    reason: SET_PAGE_TENANT_OVERRIDE_REASON,
-  },
   handler: async (event, ctx) => {
-    const db = ctx.db;
     const override = event.payload.tenantIdOverride;
-    const tenantId = override ?? event.user.tenantId;
-    // override: point the executor context at the target tenant, else getStreamVersion runs against user.tenantId → version_conflict.
-    const executorUser =
-      override !== undefined ? { ...event.user, tenantId: override as TenantId } : event.user; // @cast-boundary engine-bridge
-
+    const tenantId = (override ?? event.user.tenantId) as TenantId; // @cast-boundary engine-bridge
     // ctx.db is scoped to the executing user's tenant, wrong for a cross-tenant override
     // on both the existing-check and the executor's stream reads; re-scope to the target.
-    // Safe: the override branch is SystemAdmin-gated above.
-    const scopedDb =
-      override !== undefined
-        ? createTenantDb(
-            db.unsafeRaw(),
-            override as TenantId, // @cast-boundary engine-bridge
-            "tenant",
-          )
-        : db;
+    const { db: scopedDb, streamTenantId } = requireForTenant(ctx, tenantId);
     const existing = await fetchOne<PageRow>(scopedDb, pagesTable, {
       tenantId,
       slug: event.payload.slug,
@@ -89,8 +70,9 @@ export const setWrite = defineWriteHandler({
               event.payload.published !== undefined ? event.payload.published : existing.published,
           },
         },
-        executorUser,
+        event.user,
         scopedDb,
+        { streamTenantId },
       );
       if (!result.isSuccess) return result;
       return {
@@ -110,8 +92,9 @@ export const setWrite = defineWriteHandler({
         published: event.payload.published ?? false,
         tenantId,
       },
-      executorUser,
+      event.user,
       scopedDb,
+      { streamTenantId },
     );
     if (!result.isSuccess) return result;
     return {

package/packages/bundled-features/src/notes-history/entity.ts

@@ -26,17 +26,18 @@ import {
 //
 // `body` is instead `personal: { of: "id" }` (Row-Subject, fw#2596/#2786):
 // the note's OWN row is its content's subject, so `body` is encrypted under a
-// per-note key that nothing else shares. That key gets erased only when
-// `note-mention` (below) names this note as reached by a forgotten subject
-// (see `notes-history-user-data/hooks.ts`) — a note with no mention on the
-// forgotten subject is untouched. GDPR erasure of the AUTHOR still separately
+// per-note key that nothing else shares. That key gets erased only when the
+// note is reached by a forgotten subject: `note-mention` (below) names the
+// subject, or the note hangs on the subject as host (entityId, plus entityType
+// for record subjects). See `notes-history-user-data/hooks.ts`; any other note
+// is untouched. GDPR erasure of the AUTHOR still separately
 // shreds `authorName` (`personal: { of: "authorId" }`, the name as stamped at
 // write time); the two erasures are independent.
 //
 // Known gap (fw#2596, not fixed by this entity): prose that names a third
 // party without a structured @-mention is not tracked — regex/NLP over
-// free text is unreliable. The operator's manual `forget-subject` path
-// covers what this structured trigger misses.
+// free text is unreliable. An operator must erase such a note's own record
+// subject (`forget-subject` kind "record", entity "note-entry") to cover it.
 export function createNoteEntryEntity(
   access?: EntityDefinition["access"],
   parents?: readonly string[],

package/packages/bundled-features/src/notes-history-user-data/hooks.ts

@@ -4,9 +4,17 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 
-import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
-import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configuredPiiSubjectKms, type SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type {
+  Registry,
+  TenantId,
+  UserDataDeleteHook,
+  UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
+  type RetentionPresetKey,
   resolveRetentionPolicyForTenant,
   resolveTenantRetentionPreset,
 } from "../data-retention/index.js";
@@ -32,95 +40,134 @@ export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
+type NoteRow = {
+  readonly id: string;
+  readonly tenantId: TenantId;
+  readonly entityType: string;
+  readonly entityId: string;
+  readonly body: unknown;
+  readonly insertedAt: unknown;
+};
+
+// What erasing a subject's key reaches: notes that @-mention the subject plus notes
+// attached to it as host. Export and erasure both go through this, so Art. 15
+// lists exactly what Art. 17 shreds.
+async function selectNotesReachingSubject(
+  db: DbRunner | TenantDb,
+  subject: SubjectId,
+): Promise<readonly NoteRow[]> {
+  if (subject.kind === "tenant") return [];
+  const subjectId = subject.kind === "user" ? subject.userId : subject.id;
+  const attachedWhere =
+    subject.kind === "record"
+      ? { entityType: subject.entity, entityId: subjectId }
+      : { entityId: subjectId };
+
+  const mentions = await selectMany<{ noteId: string }>(db, noteMentionTable, { subjectId });
+  const mentioned =
+    mentions.length === 0
+      ? []
+      : await selectMany<NoteRow>(db, noteEntryTable, {
+          id: { in: [...new Set(mentions.map((m) => m.noteId))] },
+        });
+  const attached = await selectMany<NoteRow>(db, noteEntryTable, attachedWhere);
+
+  const byId = new Map<string, NoteRow>();
+  for (const note of [...mentioned, ...attached]) byId.set(note.id, note);
+  return [...byId.values()];
+}
+
 // `authorName` is separately annotated `personal: { of: "authorId" }`
 // (entity.ts), so forgetting the AUTHOR already crypto-shreds that field on
-// its own — unrelated to this hook. `body` is Row-Subject (`personal: { of:
-// "id" }`): its key is per-note, not per-user, so forgetting a user only
-// reaches a note's body when that note structurally @-mentions the user via
-// a `note-mention` row (fw#2787). Free-text mentions are NOT detected —
-// that's the documented gap in entity.ts, not a bug here.
+// its own. `body` is Row-Subject (`personal: { of: "id" }`): its key is per
+// note, so forgetting a subject only reaches a body when the note structurally
+// @-mentions the subject (`note-mention`, fw#2787) or hangs on it as host.
+// Free-text mentions are NOT detected — the documented gap in entity.ts.
 //
-// Per reached note: consult the HOST entity's (entityType, not note-entry's
-// own) retention strategy first — blockDelete/anonymize must win over
-// erasure, same rule the automated forget-cleanup pipeline applies to every
-// other entity. The `strategy` this hook itself is called with is resolved
-// for note-entry, not the host, so it is deliberately unused here.
+// Per reached note the HOST entity's retention strategy (entityType, resolved
+// for the note's own tenant — the manual forget-subject path runs cross-tenant)
+// is consulted first: anonymize/blockDelete win over erasure, same rule the
+// automated forget-cleanup applies to every other entity.
 //
-// Precondition: this ONLY erases anything if the app mounts a KMS adapter —
-// without one, record-owned fields fall back to plaintext storage
-// framework-wide (see pii-field-encryption.ts) and forget is a true no-op.
-// That gap is a property of the framework's crypto-shredding design, not
-// specific to this hook; apps that need Art.17 coverage without KMS must
-// mount one.
-export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
+// Without a mounted KMS this erases nothing: record-owned fields fall back to
+// plaintext framework-wide (see pii-field-encryption.ts), so apps that need
+// Art. 17 coverage must mount one.
+export async function eraseNoteBodiesReachingSubject(args: {
+  readonly db: DbRunner | TenantDb;
+  readonly registry: Registry;
+  readonly subject: SubjectId;
+  readonly erasedBy: string;
+  readonly requestId: string;
+}): Promise<void> {
   const kms = configuredPiiSubjectKms();
-  // skip: no KMS adapter mounted — record-owned fields stay plaintext framework-wide, forget is a true no-op
+  // skip: no KMS adapter mounted — forget is a true no-op
   if (!kms) return;
 
-  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
-    subjectId: ctx.userId,
-  });
-  // skip: no note-mention rows for this user — nothing structurally reaches this user's data to shred
-  if (mentions.length === 0) return;
-
-  const noteIds = new Set(mentions.map((m) => m.noteId));
-  // Once per hook run: the preset depends on the tenant only, not the note.
-  const tenantPreset = await resolveTenantRetentionPreset({
-    db: ctx.db,
-    registry: ctx.registry,
-    tenantId: ctx.tenantId,
-  });
-  // Append-only rows are never hard-deleted, so every mentioned note should
-  // resolve; a missing one has no host and thus no retention policy to consult.
-  const notes = await ctx.db.selectMany<{ id: string; entityType: string }>(noteEntryTable, {
-    id: { in: [...noteIds] },
-  });
-  const strategyByEntityType = new Map<string, ReturnType<typeof policyToStrategy>>();
+  const notes = await selectNotesReachingSubject(args.db, args.subject);
+  const dataRetentionMounted = args.registry.features.has("data-retention");
+  const presetByTenant = new Map<string, RetentionPresetKey | null>();
+  const strategyByTenantAndEntityType = new Map<string, ReturnType<typeof policyToStrategy>>();
   for (const note of notes) {
-    let strategy = strategyByEntityType.get(note.entityType);
+    const strategyKey = `${note.tenantId}:${note.entityType}`;
+    let strategy = strategyByTenantAndEntityType.get(strategyKey);
     if (strategy === undefined) {
+      let tenantPreset = presetByTenant.get(note.tenantId);
+      if (tenantPreset === undefined) {
+        tenantPreset = await resolveTenantRetentionPreset({
+          db: args.db,
+          registry: args.registry,
+          tenantId: note.tenantId,
+        });
+        presetByTenant.set(note.tenantId, tenantPreset);
+      }
       const hostPolicy = await resolveRetentionPolicyForTenant({
-        db: ctx.db,
-        registry: ctx.registry,
-        tenantId: ctx.tenantId,
+        db: args.db,
+        registry: args.registry,
+        tenantId: note.tenantId,
         entityName: note.entityType,
         preloadedTenantPreset: tenantPreset,
+        // Without data-retention there is no override table to read.
+        ...(!dataRetentionMounted && { preloadedOverride: null }),
       });
       strategy = policyToStrategy(hostPolicy.policy?.strategy ?? null);
-      strategyByEntityType.set(note.entityType, strategy);
+      strategyByTenantAndEntityType.set(strategyKey, strategy);
     }
     if (strategy === "anonymize") continue;
-    const noteId = note.id;
 
     await kms.eraseKey(
-      { kind: "record", entity: "note-entry", id: noteId },
+      { kind: "record", entity: "note-entry", id: note.id },
       {
-        requestId: "notes-history-user-data:forget-mentioned-notes",
-        userId: ctx.userId,
-        eraseReason: "notes-history:mention-forget",
+        requestId: args.requestId,
+        userId: args.erasedBy,
+        eraseReason: "notes-history:subject-forget",
       },
     );
   }
+}
+
+export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
+  await eraseNoteBodiesReachingSubject({
+    db: ctx.db,
+    registry: ctx.registry,
+    subject: { kind: "user", userId: ctx.userId },
+    erasedBy: ctx.userId,
+    requestId: "notes-history-user-data:forget-reached-notes",
+  });
 };
 
-// Erasure reaches every note that structurally mentions the user (see
-// noteEntryDeleteHook), so the Art. 15/20 export must list those notes too.
+// Erasure reaches every note that mentions the user or hangs on the user as host
+// (see eraseNoteBodiesReachingSubject), so the Art. 15/20 export lists those too.
 export const noteMentionExportHook: UserDataExportHook = async (ctx) => {
-  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
-    subjectId: ctx.userId,
-  });
-  if (mentions.length === 0) return null;
-  const noteIds = [...new Set(mentions.map((m) => m.noteId))];
-  const notes = await ctx.db.selectMany(noteEntryTable, { id: { in: noteIds } });
+  const notes = await selectNotesReachingSubject(ctx.db, { kind: "user", userId: ctx.userId });
   if (notes.length === 0) return null;
   return {
     entity: "note-mention",
     rows: notes.map((note) => ({
-      noteId: note["id"],
-      entityType: note["entityType"],
-      entityId: note["entityId"],
-      body: note["body"],
-      insertedAt: note["insertedAt"],
+      noteId: note.id,
+      entityType: note.entityType,
+      entityId: note.entityId,
+      body: note.body,
+      insertedAt: note.insertedAt,
     })),
   };
 };

package/packages/bundled-features/src/notes-history-user-data/index.ts

@@ -13,9 +13,11 @@ import {
   noteMentionExportHook,
 } from "./hooks.js";
 
+export { eraseNoteBodiesReachingSubject } from "./hooks.js";
+
 export const notesHistoryUserDataFeature = defineFeature("notes-history-user-data", (r) => {
   r.describe(
-    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook looks up `note-mention` for notes that structurally @-mention the forgotten user and crypto-shreds each reached note's row-subject key (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for notes without such a mention. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
   );
   // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
   // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -60,11 +60,13 @@ export const patListScreen: ProjectionListScreenDefinition = {
     {
       field: "createdAt",
       label: i18nKey("pat.list.col.created"),
+      hideOnNarrow: true,
       renderer: { format: "timestamp" },
     },
     {
       field: "expiresAt",
       label: i18nKey("pat.list.col.expires"),
+      hideOnNarrow: true,
       renderer: { format: "timestamp" },
     },
   ],

package/packages/bundled-features/src/sessions/screens.ts

@@ -48,6 +48,7 @@ export const createSessionListScreen = (
     {
       field: "revokedAt",
       label: i18nKey("sessions.list.col.revokedAt"),
+      hideOnNarrow: true,
       renderer: { format: "timestamp" },
     },
   ],
@@ -123,6 +124,7 @@ export const sessionMineScreen: ProjectionListScreenDefinition = {
     {
       field: "current",
       label: i18nKey("sessions.mine.col.current"),
+      hideOnNarrow: true,
       renderer: { format: "boolean" },
     },
   ],

package/packages/bundled-features/src/shared/index.ts

@@ -33,6 +33,7 @@ export {
   redactErrorText,
   redactUrls,
 } from "./redact.js";
+export { requireForTenant } from "./require-for-tenant.js";
 export {
   type RowBoundGrantResult,
   redeemRowBoundGrant,

package/packages/bundled-features/src/shared/require-for-tenant.ts

@@ -0,0 +1,18 @@
+import type {
+  HandlerContext,
+  TenantId,
+  TenantWriteTarget,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+
+// ctx.forTenant is absent for r.systemScope() handlers and without a db; a write handler that
+// needs a cross-tenant target must fail loudly instead of falling back to ctx.db.
+export function requireForTenant(
+  ctx: Pick<HandlerContext, "forTenant">,
+  targetTenantId: TenantId,
+): TenantWriteTarget {
+  if (!ctx.forTenant) {
+    throw new InternalError({ message: "ctx.forTenant is not available in this handler context" });
+  }
+  return ctx.forTenant(targetTenantId);
+}

package/packages/bundled-features/src/template-resolver/handlers/collection-set.write.ts

@@ -5,6 +5,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import {
   type CollectionEntryRow,
   collectionStore,
@@ -39,12 +40,11 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
         ? `Creates or overwrites the caller's own "${collection.id}" entry at a slug and locale, live on save with no draft stage; it always writes the acting user's entry, never another user's.`
         : `Creates or overwrites the tenant-wide "${collection.id}" entry at a slug and locale, live on save with no draft stage; the change is visible to everyone who may reach this shared collection.`,
     handler: async (event, ctx) => {
-      const db = ctx.db;
       const override = event.payload.tenantIdOverride;
       // @cast-boundary engine-payload — override is a zod-validated string, the
       // user's own tenantId is already TenantId-branded.
       const tenantId = (override ?? event.user.tenantId) as TenantId;
-      const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
+      const { db, streamTenantId } = requireForTenant(ctx, tenantId);
       // Scoped to the acting user even under a tenant override: a SystemAdmin
       // writing into another tenant still writes their own entry, never
       // someone else's signature.
@@ -73,8 +73,9 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
               folder: event.payload.folder ?? null,
             },
           },
-          executorUser,
+          event.user,
           db,
+          { streamTenantId },
         );
         if (!result.isSuccess) return result;
         return {
@@ -96,8 +97,9 @@ export function makeCollectionSetWrite(collection: ContentCollectionDefinition)
           ...store.createDefaults(tenantId),
           ...owner,
         },
-        executorUser,
+        event.user,
         db,
+        { streamTenantId },
       );
       if (!result.isSuccess) return result;
       return {

package/packages/bundled-features/src/template-resolver/handlers/set.write.ts

@@ -5,6 +5,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { TEMPLATE_KINDS, TEXT_BLOCK_KIND } from "../constants.js";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.js";
 import { contentFormatSchema, executor, folderSchema, localeSchema, slugSchema } from "./shared.js";
@@ -48,15 +49,11 @@ export const setWrite = defineWriteHandler({
   description:
     "Creates or overwrites one content-tree resource addressed by slug, kind and locale, carrying a title and folder and going live on save with no draft stage; a SystemAdmin may target the system tenant, where shared legal and marketing copy lives.",
   handler: async (event, ctx) => {
-    const db = ctx.db;
     const override = event.payload.tenantIdOverride;
     // @cast-boundary engine-payload — override is a zod-validated string, the
     // user's own tenantId is already TenantId-branded.
     const tenantId = (override ?? event.user.tenantId) as TenantId;
-    // With an override the executor user has to move to the target tenant too,
-    // otherwise the event-store stream lookup runs against event.user.tenantId
-    // and reports a version conflict although the projection row exists.
-    const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
+    const { db, streamTenantId } = requireForTenant(ctx, tenantId);
 
     const kind = event.payload.kind ?? TEXT_BLOCK_KIND;
     const existing = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
@@ -98,8 +95,9 @@ export const setWrite = defineWriteHandler({
             folder: fields.folder,
           },
         },
-        executorUser,
+        event.user,
         db,
+        { streamTenantId },
       );
       if (!result.isSuccess) return result;
       return {
@@ -108,7 +106,9 @@ export const setWrite = defineWriteHandler({
       };
     }
 
-    const result = await executor.create({ ...fields, tenantId }, executorUser, db);
+    const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+      streamTenantId,
+    });
     if (!result.isSuccess) return result;
     return {
       isSuccess: true as const,

package/packages/bundled-features/src/template-resolver/handlers/upsert-system.write.ts

@@ -4,6 +4,7 @@ import {
   SYSTEM_TENANT_ID,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import type { TemplateResourceRow } from "../table.js";
 import { templateResourcesTable } from "../table.js";
 import { executor, upsertPayloadSchema } from "./shared.js";
@@ -19,13 +20,10 @@ export const upsertSystemWrite = defineWriteHandler({
   description:
     "Creates or overwrites a system-default template under the system tenant with its full variable schema and linked resources, active straight away with no draft stage; SystemAdmin only, since tenants shadow these defaults through upsert-tenant instead.",
   handler: async (event, ctx) => {
-    const db = ctx.db;
     // @cast-boundary engine-payload — SYSTEM_TENANT_ID is a UUID literal,
     // asserted to the branded TenantId (parseTenantId equivalent).
     const tenantId = SYSTEM_TENANT_ID as TenantId;
-    // The executor user must carry SYSTEM_TENANT as tenantId, otherwise the
-    // event store looks up the stream under user.tenantId → conflict.
-    const executorUser = { ...event.user, tenantId };
+    const { db, streamTenantId } = requireForTenant(ctx, tenantId);
 
     const existing = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
       tenantId,
@@ -53,8 +51,9 @@ export const upsertSystemWrite = defineWriteHandler({
     if (existing) {
       const result = await executor.update(
         { id: existing.id, version: existing.version, changes: fields },
-        executorUser,
+        event.user,
         db,
+        { streamTenantId },
       );
       if (!result.isSuccess) return result;
       return {
@@ -63,7 +62,9 @@ export const upsertSystemWrite = defineWriteHandler({
       };
     }
 
-    const result = await executor.create({ ...fields, tenantId }, executorUser, db);
+    const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+      streamTenantId,
+    });
     if (!result.isSuccess) return result;
     // @cast-boundary db-row — executor.create returnt Record-row aus
     // INSERT RETURNING; shape { id } ist garantiert weil PK in der

package/packages/bundled-features/src/template-resolver/handlers/upsert-tenant.write.ts

@@ -6,6 +6,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import type { TemplateResourceRow } from "../table.js";
 import { templateResourcesTable } from "../table.js";
 import { executor, upsertPayloadSchema } from "./shared.js";
@@ -25,7 +26,6 @@ export const upsertTenantWrite = defineWriteHandler({
   description:
     "Creates or overwrites a tenant-scoped template override with its variable schema, landing as a draft that only publish makes live; it refuses a system-tenant target, which is what upsert-system is for.",
   handler: async (event, ctx) => {
-    const db = ctx.db;
     const override = event.payload.tenantIdOverride;
     // upsertTenant erzeugt scope='tenant'. SYSTEM_TENANT_ID-Override würde
     // scope='tenant' unter SYSTEM_TENANT_ID schreiben → inkonsistenter Zustand
@@ -43,7 +43,7 @@ export const upsertTenantWrite = defineWriteHandler({
     // event.user.tenantId schon TenantId-branded; union als TenantId casten
     // ist legit (override ist UUID-Format-validiert in schema).
     const tenantId = (override ?? event.user.tenantId) as TenantId;
-    const executorUser = override !== undefined ? { ...event.user, tenantId } : event.user;
+    const { db, streamTenantId } = requireForTenant(ctx, tenantId);
 
     const existing = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
       tenantId,
@@ -70,8 +70,9 @@ export const upsertTenantWrite = defineWriteHandler({
     if (existing) {
       const result = await executor.update(
         { id: existing.id, version: existing.version, changes: fields },
-        executorUser,
+        event.user,
         db,
+        { streamTenantId },
       );
       if (!result.isSuccess) return result;
       return {
@@ -80,7 +81,9 @@ export const upsertTenantWrite = defineWriteHandler({
       };
     }
 
-    const result = await executor.create({ ...fields, tenantId }, executorUser, db);
+    const result = await executor.create({ ...fields, tenantId }, event.user, db, {
+      streamTenantId,
+    });
     if (!result.isSuccess) return result;
     // @cast-boundary db-row — executor.create returnt Record-row aus
     // INSERT RETURNING; shape { id } ist garantiert weil PK in der