@cosmicdrift/kumiko-samples 0.355.0 → 0.357.0

package/packages/bundled-features/src/tenant/cancel-pending-invitation.ts

@@ -1,5 +1,5 @@
 import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type { Redis } from "ioredis";
 // kumiko-lint-ignore cross-feature-import cancel needs invite-token-store for Redis cleanup
@@ -23,6 +23,7 @@ export async function cancelPendingInvitation(
   invitation: { readonly id: string; readonly version: number },
   actor: SessionUser,
   redis: Redis | undefined,
+  streamTenantId?: TenantId,
 ): Promise<WriteFailure | undefined> {
   const updateResult = await invitationExecutor.update(
     {
@@ -32,6 +33,7 @@ export async function cancelPendingInvitation(
     },
     actor,
     db,
+    { streamTenantId },
   );
   if (!updateResult.isSuccess) return updateResult;
 

package/packages/bundled-features/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "The member roles form only offers roles the signed-in admin may assign",
+    "detail": "New query tenant:query:member-role-availability; TenantAdmin still sees every role."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/tenant/constants.ts

@@ -26,9 +26,10 @@ export const MEMBER_ROLES_CELL_COMPONENT = "MemberRolesCell" as const;
 // Admin (rank 2) shares the invite-create screen with TenantAdmin — TenantAdmin
 // must not appear here or Admin sees an unassignable option (fw#2414).
 export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin"] as const;
-// Full assignable rank list, used by memberRolesEditScreen: that screen is
-// prefilled with a member's *current* roles, so it must be able to represent
-// every rank a membership can actually hold, including TenantAdmin (fw#2452).
+// Full rank list for memberRolesEditScreen: it is prefilled with a member's
+// *current* roles, so it must represent every rank a membership can hold,
+// including TenantAdmin (fw#2452). The screen hides what the caller may not
+// assign via TenantQueries.memberRoleAvailability.
 export const OWNER_INVITE_ROLE_OPTIONS = [
   "User",
   "Member",
@@ -67,6 +68,8 @@ export const TenantQueries = {
   invitations: "tenant:query:invitations",
   // Combined active-members + pending-invitations list backing /members.
   teamList: "tenant:query:team:list",
+  // Per-role assignability for the caller, mirrors the rank rule of updateMemberRoles.
+  memberRoleAvailability: "tenant:query:member-role-availability",
 } as const;
 
 // Error codes

package/packages/bundled-features/src/tenant/feature.ts

@@ -20,6 +20,7 @@ import { invitationsQuery } from "./handlers/invitations.query.js";
 import { listQuery } from "./handlers/list.query.js";
 import { meQuery } from "./handlers/me.query.js";
 import { memberDirectoryQuery } from "./handlers/member-directory.query.js";
+import { memberRoleAvailabilityQuery } from "./handlers/member-role-availability.query.js";
 import { membersQuery } from "./handlers/members.query.js";
 import { membershipsQuery } from "./handlers/memberships.query.js";
 import { removeMemberWrite } from "./handlers/remove-member.write.js";
@@ -166,6 +167,7 @@ export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefi
       resolveUserIds: r.queryHandler(resolveUserIdsQuery),
       invitations: r.queryHandler(invitationsQuery),
       teamList: r.queryHandler(teamListQuery),
+      memberRoleAvailability: r.queryHandler(memberRoleAvailabilityQuery),
     };
 
     // Entity-convention handlers for the SystemAdmin entityList/entityEdit

package/packages/bundled-features/src/tenant/handlers/member-role-availability.query.ts

@@ -0,0 +1,25 @@
+import {
+  access,
+  assignableAppRolesOf,
+  canActorAssignRole,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { memberRoleOptions } from "../member-role-options.js";
+
+export const memberRoleAvailabilityQuery = defineQueryHandler({
+  name: "member-role-availability",
+  schema: z.object({}),
+  access: { roles: access.admin },
+  description:
+    "Lists every role the member roles form offers and whether the caller's own rank may assign it; the form hides the roles marked disabled.",
+  handler: async (query, ctx) => {
+    const assignableAppRoles = assignableAppRolesOf(ctx.registry);
+    return {
+      rows: memberRoleOptions(assignableAppRoles).map((value) => ({
+        value,
+        disabled: !canActorAssignRole(query.user.roles, value, assignableAppRoles),
+      })),
+    };
+  },
+});

package/packages/bundled-features/src/tenant/handlers/remove-member.write.ts

@@ -7,7 +7,9 @@ import {
 import {
   createSystemUser,
   defineWriteHandler,
+  parseTenantId,
   type SessionUser,
+  type TenantId,
   withResponseData,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -34,6 +36,7 @@ type PendingInvitationCancel = {
   readonly userId: string;
   readonly tenantId: string;
   readonly actor: SessionUser;
+  readonly streamTenantId: TenantId;
   readonly redis: Redis | undefined;
 };
 
@@ -51,7 +54,13 @@ async function cancelPendingInvitationsOfUser(
     { tenantId: options.tenantId, email, status: INVITATION_STATUS.pending },
   );
   for (const invitation of pendingInvitations) {
-    const failure = await cancelPendingInvitation(db, invitation, options.actor, options.redis);
+    const failure = await cancelPendingInvitation(
+      db,
+      invitation,
+      options.actor,
+      options.redis,
+      options.streamTenantId,
+    );
     if (failure) return failure;
   }
   return undefined;
@@ -79,11 +88,15 @@ export const removeMemberWrite = defineWriteHandler({
     const db = ctx.systemDb.acknowledgeCrossTenant(
       "SystemAdmin manages memberships across tenants",
     );
-    const existing = await fetchOne(db, tenantMembershipsTable, {
-      userId: event.payload.userId,
-      tenantId: event.payload.tenantId,
-    });
-    if (!existing) {
+    const streamTenantId = parseTenantId(event.payload.tenantId);
+    const existing =
+      streamTenantId === null
+        ? undefined
+        : await fetchOne(db, tenantMembershipsTable, {
+            userId: event.payload.userId,
+            tenantId: streamTenantId,
+          });
+    if (!existing || streamTenantId === null) {
       return writeFailure(
         new NotFoundError("membership", undefined, {
           i18nKey: "tenant.errors.membershipNotFound",
@@ -125,14 +138,15 @@ export const removeMemberWrite = defineWriteHandler({
       { id: (existing as DbRow)["id"] as string }, // @cast-boundary db-row
       event.user,
       db,
+      { streamTenantId },
     );
     if (!result.isSuccess) return result;
 
-    // Actor tenant = invitation tenant so the update hits the invitation's stream.
     const cancelFailure = await cancelPendingInvitationsOfUser(db, {
       userId: event.payload.userId,
       tenantId: event.payload.tenantId,
-      actor: { ...event.user, tenantId: event.payload.tenantId },
+      actor: event.user,
+      streamTenantId,
       redis: ctx.redis,
     });
     if (cancelFailure !== undefined) return cancelFailure;

package/packages/bundled-features/src/tenant/handlers/update-member-roles.write.ts

@@ -6,8 +6,12 @@ import {
   createSystemUser,
   defineWriteHandler,
   findForbiddenRoleAssignment,
+  mayOverrideTenant,
   mergeAssignedRoles,
+  parseTenantId,
+  type SessionUser,
   SYSTEM_ROLE,
+  type TenantId,
   withResponseData,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -40,9 +44,14 @@ const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user"
 function resolveTargetTenantId(
   isSystem: boolean,
   payloadTenantId: string | undefined,
-  sessionTenantId: string | undefined,
-): string | undefined {
-  return isSystem ? (payloadTenantId ?? sessionTenantId) : sessionTenantId;
+  sessionTenantId: TenantId,
+): TenantId | undefined {
+  if (!isSystem || payloadTenantId === undefined) return sessionTenantId;
+  return parseTenantId(payloadTenantId) ?? undefined;
+}
+
+function foreignStreamTenant(user: SessionUser, targetTenantId: TenantId): TenantId | undefined {
+  return targetTenantId === user.tenantId ? undefined : targetTenantId;
 }
 
 // Editing your OWN roles keeps the current session: roles are re-derived per
@@ -50,7 +59,7 @@ function resolveTargetTenantId(
 // of that user and any foreign edit still revoke all.
 function revokeSessionsPayload(
   targetUserId: string,
-  targetTenantId: string,
+  targetTenantId: TenantId,
   actor: { readonly id: string; readonly sid?: string | undefined },
 ): { userId: string; tenantId: string; exceptSessionId?: string } {
   const payload = { userId: targetUserId, tenantId: targetTenantId };
@@ -82,7 +91,7 @@ export const updateMemberRolesWrite = defineWriteHandler({
     }
 
     const isSystemActor = event.user.roles.includes(SYSTEM_ROLE);
-    const isSystem = event.user.roles.includes("SystemAdmin") || isSystemActor;
+    const isSystem = mayOverrideTenant(event.user) || isSystemActor;
     const assignableAppRoles = assignableAppRolesOf(ctx.registry);
     const targetTenantId = resolveTargetTenantId(
       isSystem,
@@ -185,19 +194,18 @@ export const updateMemberRolesWrite = defineWriteHandler({
       );
     }
 
-    // Stream tenant follows the actor via streamTenantFor — use the
-    // membership tenant so SystemAdmin/cross-tenant and TenantAdmin paths
-    // hit the same stream seedTenantMembership/invite-accept wrote.
-    // Keep the real actor for audit metadata; only override tenantId so
-    // streamTenantFor writes into the membership tenant (#2401).
+    // The membership stream lives on the membership's tenant (where seedTenantMembership/
+    // invite-accept wrote it); a cross-tenant operator addresses it without becoming a member.
+    // Same-tenant writes run on a tenant-mode db, which refuses a stream override.
     const result = await executor.update(
       {
         id: row["id"] as string, // @cast-boundary db-row
         version: row["version"] as number, // @cast-boundary db-row
         changes: { roles: JSON.stringify(nextRoles) },
       },
-      { ...event.user, tenantId: targetTenantId },
+      event.user,
       db,
+      { streamTenantId: foreignStreamTenant(event.user, targetTenantId) },
     );
 
     return withResponseData(result, {

package/packages/bundled-features/src/tenant/member-role-options.ts

@@ -0,0 +1,6 @@
+import type { AssignableAppRoles } from "@cosmicdrift/kumiko-framework/engine";
+import { OWNER_INVITE_ROLE_OPTIONS } from "./constants.js";
+
+export function memberRoleOptions(assignableAppRoles: AssignableAppRoles): readonly string[] {
+  return [...OWNER_INVITE_ROLE_OPTIONS, ...assignableAppRoles.keys()];
+}

package/packages/bundled-features/src/tenant/screens.ts

@@ -15,10 +15,10 @@ import {
   MEMBER_ROLES_EDIT_SCREEN_ID,
   MEMBER_STATUS_CELL_COMPONENT,
   MEMBERS_SCREEN_ID,
-  OWNER_INVITE_ROLE_OPTIONS,
   TenantHandlers,
   TenantQueries,
 } from "./constants.js";
+import { memberRoleOptions } from "./member-role-options.js";
 
 // Cross-tenant SystemAdmin platform view of the tenants themselves. The tenant
 // feature runs with `r.systemScope()`, so the entityList returns every tenant.
@@ -107,6 +107,7 @@ export function createMembersScreen(options?: {
         field: "lastSeenAt",
         label: i18nKey("tenant.members.col.lastActivity"),
         renderer: { format: "timestamp" },
+        hideOnNarrow: true,
       },
     ],
     defaultSort: { field: "createdAt", dir: "desc" },
@@ -199,13 +200,15 @@ export function createMemberRolesEditScreen(assignableAppRoles: AssignableAppRol
     cancelTarget: MEMBERS_SCREEN_ID,
     fields: {
       userId: { type: "text", required: true },
-      // Prefilled with the member's current roles, so the option list must be
-      // able to represent every assignable rank — DEFAULT_INVITE_ROLE_OPTIONS
-      // omits TenantAdmin and would silently strip it on submit. Escalation
-      // still stays server-side via findForbiddenRoleAssignment (update-member-roles.write.ts).
+      // Prefilled with the member's current roles, so the static options must
+      // represent every rank (DEFAULT_INVITE_ROLE_OPTIONS omits TenantAdmin and
+      // would silently strip it on submit); the availability query hides what the
+      // caller may not assign. Enforcement stays server-side via
+      // findForbiddenRoleAssignment (update-member-roles.write.ts).
       roles: {
         type: "multiSelect",
-        options: [...OWNER_INVITE_ROLE_OPTIONS, ...assignableAppRoles.keys()],
+        options: memberRoleOptions(assignableAppRoles),
+        optionsAvailabilityQuery: TenantQueries.memberRoleAvailability,
         required: true,
       },
     },

package/packages/bundled-features/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -1,11 +1,8 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  buildEntityTable,
-  createEventStoreExecutor,
-  createTenantDb,
-} from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { tierAssignmentAggregateId } from "../aggregate-id.js";
 import { TierAssignmentSources } from "../constants.js";
 import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
@@ -14,13 +11,8 @@ import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
 // Billing. Cross-tenant, daher SystemAdmin-only (kein TenantAdmin: sonst
 // Gratis-Self-Upgrade).
 //
-// **Cross-tenant-Mechanik:** ein "system"-mode TenantDb auf den Ziel-Tenant legt
-// KEINEN Tenant-Filter an (tenant-db.ts:141 — mode==="system" überspringt ihn);
-// der executor-user wird ebenfalls auf den Ziel-Tenant gestellt, sonst landet das
-// Event im Stream des Admins (Memory feedback_event_store_tenant_consistency).
-// Das set.write-"override-user"-Muster trägt NICHT für beliebige Tenants — es
-// funktioniert nur für SYSTEM_TENANT_ID (immer im IN-Filter). Dies ist das
-// auto-default-Hook-Muster (feature.ts), generalisiert auf einen Request-Handler.
+// Cross-tenant mechanics: ctx.forTenant(tenantId) yields a tenant-mode db bound to the target plus
+// the streamTenantId, so the event lands in the target's stream with the operator as actor.
 //
 // `source: TierAssignmentSources.manual` marks the grant so the billing sync skips it.
 // Upsert: one aggregate per tenant (deterministic aggregate id).
@@ -38,8 +30,6 @@ const executor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEnt
   entityName: "tier-assignment",
 });
 
-const SET_TENANT_TIER_REASON = "SystemAdmin assigns the tier of the tenant named in the payload";
-
 export type SetTenantTierOptions = {
   /** Runs after the write commits so feature.ts can update the resolver cache
    *  and notify the other processes. Without a tierMap there is no resolver
@@ -68,10 +58,6 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
     }),
     access: { roles: ["SystemAdmin"] },
     agent: { risk: "high" },
-    escapeHatch: {
-      grants: ["unsafeRaw"],
-      reason: SET_TENANT_TIER_REASON,
-    },
     handler: async (event, ctx) => {
       // Without a commit sink (unit harness) there is no transaction to wait for.
       const afterCommit = (tenantId: TenantId, tier: string): void => {
@@ -80,9 +66,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
         else opts.onAssigned?.(tenantId, tier);
       };
       const tenantId = event.payload.tenantId as TenantId; // @cast-boundary engine-bridge
-      const rawDb = ctx.db.unsafeRaw();
-      const tdb = createTenantDb(rawDb, tenantId, "system");
-      const systemUser = { ...event.user, tenantId };
+      const { db: tdb, streamTenantId } = requireForTenant(ctx, tenantId);
       const tier = event.payload.tier;
 
       const existing = await fetchOne<TierAssignmentRow>(tdb, tierAssignmentTable, { tenantId });
@@ -94,8 +78,9 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
             version: existing.version,
             changes: { tier, source: TierAssignmentSources.manual },
           },
-          systemUser,
+          event.user,
           tdb,
+          { streamTenantId },
         );
         if (!result.isSuccess) return result;
         afterCommit(tenantId, tier);
@@ -109,8 +94,9 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
           source: TierAssignmentSources.manual,
           tenantId,
         },
-        systemUser,
+        event.user,
         tdb,
+        { streamTenantId },
       );
       if (!result.isSuccess) return result;
       afterCommit(tenantId, tier);

package/packages/bundled-features/src/user/screens.ts

@@ -17,7 +17,14 @@ export const userListScreen: EntityListScreenDefinition = {
   id: "user-list",
   type: "entityList",
   entity: "user",
-  columns: ["email", "displayName", "roles", "tenants", "status", "emailVerified"],
+  columns: [
+    "email",
+    "displayName",
+    "roles",
+    "tenants",
+    "status",
+    { field: "emailVerified", hideOnNarrow: true },
+  ],
   rowActions: [
     {
       kind: "navigate",

package/packages/bundled-features/src/user-data-rights/screens.ts

@@ -68,7 +68,14 @@ export const downloadAttemptListScreen: EntityListScreenDefinition = {
   id: "download-attempt-list",
   type: "entityList",
   entity: "download-attempt",
-  columns: ["attemptedAt", "result", "via", "ip", "attemptedByUserId", "jobId"],
+  columns: [
+    "attemptedAt",
+    "result",
+    "via",
+    "ip",
+    { field: "attemptedByUserId", hideOnNarrow: true },
+    { field: "jobId", hideOnNarrow: true },
+  ],
   searchable: false,
   access: { roles: access.systemAdmin },
   // Inert until an app navs it (see file header) — no nav area to resolve

package/packages/bundled-features/src/waitlist/screens.ts

@@ -6,7 +6,14 @@ export const waitlistListScreen: EntityListScreenDefinition = {
   id: "waitlist-list",
   type: "entityList",
   entity: "waitlistEntry",
-  columns: ["name", "email", "company", "status", "locale", "submittedAt"],
+  columns: [
+    "name",
+    "email",
+    "company",
+    "status",
+    "locale",
+    { field: "submittedAt", hideOnNarrow: true },
+  ],
   defaultSort: { field: "submittedAt", dir: "desc" },
   access: adminAccess,
   searchable: true,

package/samples/apps/marketing-demo/src/features/assets/schema/asset.ts

@@ -116,10 +116,10 @@ export const assetListScreen: EntityListScreenDefinition = {
     "status",
     "department",
     "owner",
-    "location",
-    "vendor",
-    "purchaseDate",
-    "warrantyUntil",
+    { field: "location", hideOnNarrow: true },
+    { field: "vendor", hideOnNarrow: true },
+    { field: "purchaseDate", hideOnNarrow: true },
+    { field: "warrantyUntil", hideOnNarrow: true },
   ],
   pageSize: 25,
   defaultSort: { field: "name", dir: "asc" },

package/samples/apps/marketing-demo/src/features/helpdesk/schema/ticket.ts

@@ -123,10 +123,10 @@ export const ticketListScreen: EntityListScreenDefinition = {
     "severity",
     "status",
     "department",
-    "assignee",
-    "reporter",
-    "dueDate",
-    "spentMinutes",
+    { field: "assignee", hideOnNarrow: true },
+    { field: "reporter", hideOnNarrow: true },
+    { field: "dueDate", hideOnNarrow: true },
+    { field: "spentMinutes", hideOnNarrow: true },
   ],
   pageSize: 25,
   defaultSort: { field: "severity", dir: "desc" },

package/samples/apps/showcase/src/features/items/schema/item.ts

@@ -102,7 +102,7 @@ export const itemListScreen: EntityListScreenDefinition = {
     "dueDate",
     // Tier 2.7e-4 Demo — Reference-Spalte. Renderer macht Bulk-Lookup
     // auf item:list (limit:200), zeigt parentId als parent.title.
-    "parentId",
+    { field: "parentId", hideOnNarrow: true },
   ],
   // Server-side Pagination Demo — Showcase seedet ~200 items, der
   // Pager hat 4 Seiten zum Durchklicken bei pageSize: 50.

package/samples/apps/styleguide/src/features/demo/feature.ts

@@ -228,9 +228,9 @@ export const demoFeature = defineFeature("styleguide", (r) => {
       "status",
       "isActive",
       "quantity",
-      "rating",
-      "publishedAt",
-      "price",
+      { field: "rating", hideOnNarrow: true },
+      { field: "publishedAt", hideOnNarrow: true },
+      { field: "price", hideOnNarrow: true },
     ],
     pagination: "pages",
     pageSize: 25,

package/samples/apps/styleguide/src/features/gallery/web/Gallery.tsx

@@ -331,7 +331,7 @@ export function Gallery(): ReactNode {
         {/* Standalone <Section> (outside Form) = the calculator-result-card
             standard. title-only = existing consumer (publicstatus/tier-admin),
             must NOT regress from the border-b removal; subtitle +
-            actions footer = new. No divider under the title (shadcn pattern). */}
+            actions (title row, top right) = new. No divider under the title (shadcn pattern). */}
         <div className="flex max-w-md flex-col gap-6">
           <Section title="Affordable rate / month">
             <div className="text-2xl font-semibold tabular-nums">€2,500.00</div>

package/samples/apps/ui-walkthrough/src/features/rental/screens.ts

@@ -27,7 +27,7 @@ const OPEN_FILL_COLUMNS = [
   "einheit",
   "liegenschaft",
   "beginn",
-  "ende",
+  { field: "ende", hideOnNarrow: true },
   "status",
 ] as const;
 
@@ -145,7 +145,11 @@ const POSITION_COLUMNS = [
     label: "rental:entity:leasePosition:field:gueltigVon",
     sortable: true,
   },
-  { field: "gueltigBis", label: "rental:entity:leasePosition:field:gueltigBis" },
+  {
+    field: "gueltigBis",
+    label: "rental:entity:leasePosition:field:gueltigBis",
+    hideOnNarrow: true,
+  },
 ] as const;
 
 export const leaseDetailScreen: ProjectionDetailScreenDefinition = {

package/samples/apps/ui-walkthrough/src/features/vehicles/screens.ts

@@ -31,7 +31,14 @@ export const vehicleListScreen: EntityListScreenDefinition = {
   id: "vehicle-list",
   type: "entityList",
   entity: "vehicle",
-  columns: ["marke", "modell", "baujahr", "preis", "zustand", "scheckheftGepflegt"],
+  columns: [
+    "marke",
+    "modell",
+    "baujahr",
+    "preis",
+    "zustand",
+    { field: "scheckheftGepflegt", hideOnNarrow: true },
+  ],
   searchPlaceholder: "vehicles.search.placeholder",
   defaultSort: { field: "marke", dir: "asc" },
   rowActions: [
@@ -129,7 +136,7 @@ export const campaignListScreen: EntityListScreenDefinition = {
     "aktionStartet",
     "aktionEndet",
     "meta",
-    "gepostet",
+    { field: "gepostet", hideOnNarrow: true },
     { field: "gestartetAm", hideOnNarrow: true },
   ],
   searchPlaceholder: "vehicles.search.placeholder",

package/samples/apps/use-all-bundled/feature-manifest.json

@@ -1954,7 +1954,7 @@
     },
     {
       "name": "notes-history-user-data",
-      "description": "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook looks up `note-mention` for notes that structurally @-mention the forgotten user and crypto-shreds each reached note's row-subject key (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for notes without such a mention. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+      "description": "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
       "toggleableDefault": null,
       "requires": [
         "user-data-rights"