@cosmicdrift/kumiko-samples 0.388.0 → 0.390.0

package/packages/bundled-features/src/jobs/job-run-logger.ts

@@ -18,7 +18,17 @@ import {
   updateMany,
   upsertOnConflict,
 } from "@cosmicdrift/kumiko-framework/db";
-import { type Registry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  parseTenantId,
+  type Registry,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  isRowLevelSecurityViolation,
+  runInRowLevelSecurityScope,
+  tenantRowLevelSecurityScope,
+} from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import type {
   JobDroppedMeta,
   JobLogEntry,
@@ -77,6 +87,16 @@ const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 // Run rows hang on SYSTEM_TENANT_ID and a null trigger is a cron/system run;
 // job-run-table.ts declares whenAbsent: "tenant" for exactly that case, so the
 // logger must resolve the same subject the entity chain would.
+// Job callbacks run outside any request scope; the tenant tables enforce their rows per tenant, so each write
+// declares the tenant it belongs to.
+function inTenantScope<T>(tenantId: string, work: () => Promise<T>): Promise<T> {
+  const parsed = parseTenantId(tenantId);
+  if (parsed === null) {
+    throw new InternalError({ message: `job run logger got a malformed tenant id "${tenantId}"` });
+  }
+  return runInRowLevelSecurityScope(tenantRowLevelSecurityScope(parsed), work);
+}
+
 function jobRunSubject(triggeredById: string | null): SubjectId {
   return triggeredById === null
     ? { kind: "tenant", tenantId: SYSTEM_TENANT_ID }
@@ -182,7 +202,7 @@ const TENANT_RUN_CONFLICT_KEYS = ["tenantId", "jobName", "bullJobId"] as const;
 function tenantJobFailureTarget(
   jobName: string,
   outcome: JobOutcomeMeta | undefined,
-): Record<string, unknown> | null {
+): { tenantId: string; jobName: string; subject: string | null } | null {
   if (!outcome?.tenantVisible || outcome.tenantId === SYSTEM_TENANT_ID) return null;
   return { tenantId: outcome.tenantId, jobName, subject: outcome.tenantVisible.subject };
 }
@@ -202,19 +222,21 @@ async function recordTenantJobFailure(
   // partial unique indexes (subject NULL vs. set) are no ON CONFLICT target.
   // The lock makes the later of two racing final failures replace the earlier
   // one; the indexes are the backstop against any writer that skips the lock.
-  await transaction(db, async (tx) => {
-    await acquireNamespacedAdvisoryLock(
-      tx,
-      TENANT_JOB_FAILURE_LOCK_NAMESPACE,
-      JSON.stringify([where["tenantId"], where["jobName"], where["subject"]]),
-    );
-    await deleteMany(tx, tenantJobFailuresTable, where);
-    await insertOne(tx, tenantJobFailuresTable, {
-      ...where,
-      messageKey,
-      failedAt: Temporal.Now.instant(),
-    });
-  });
+  await inTenantScope(where.tenantId, () =>
+    transaction(db, async (tx) => {
+      await acquireNamespacedAdvisoryLock(
+        tx,
+        TENANT_JOB_FAILURE_LOCK_NAMESPACE,
+        JSON.stringify([where["tenantId"], where["jobName"], where["subject"]]),
+      );
+      await deleteMany(tx, tenantJobFailuresTable, where);
+      await insertOne(tx, tenantJobFailuresTable, {
+        ...where,
+        messageKey,
+        failedAt: Temporal.Now.instant(),
+      });
+    }),
+  );
 }
 
 async function clearTenantJobFailure(
@@ -225,7 +247,7 @@ async function clearTenantJobFailure(
   const where = tenantJobFailureTarget(jobName, outcome);
   // skip: no tenant-visible target — nothing was ever recorded
   if (!where) return;
-  await deleteMany(db, tenantJobFailuresTable, where);
+  await inTenantScope(where.tenantId, () => deleteMany(db, tenantJobFailuresTable, where));
 }
 
 // Tenant-visible run state. One row per BullMQ job in
@@ -260,28 +282,30 @@ async function recordTenantRunQueued(
   // skip: system-tenant run, no tenant-scoped query reads it
   if (!key) return;
   const now = Temporal.Now.instant();
-  await transaction(db, async (tx) => {
-    // A finished row under the same id is left over from before a Redis reset
-    // (ids restart at 1), not this job. Only rows queued before this BullMQ job
-    // was created qualify: a fast worker can finish before the hook runs (no
-    // queuedAt), and a deduplicated add of an already finished job re-announces
-    // it with a creation time older than its own row. Both rows must stay.
-    await deleteMany(tx, tenantJobRunsTable, {
-      tenantId: key.tenantId,
-      jobName,
-      bullJobId,
-      status: { in: ["completed", "failed"] },
-      queuedAt: { lt: Temporal.Instant.fromEpochMilliseconds(meta.jobCreatedAtMs) },
-    });
-    // DO NOTHING: a fast worker can report the start before this enqueue hook
-    // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.
-    await insertOnConflictDoNothing(
-      tx,
-      tenantJobRunsTable,
-      { ...key, bullJobId, status: "queued", queuedAt: now, updatedAt: now },
-      { conflictKeys: [...TENANT_RUN_CONFLICT_KEYS] },
-    );
-  });
+  await inTenantScope(key.tenantId, () =>
+    transaction(db, async (tx) => {
+      // A finished row under the same id is left over from before a Redis reset
+      // (ids restart at 1), not this job. Only rows queued before this BullMQ job
+      // was created qualify: a fast worker can finish before the hook runs (no
+      // queuedAt), and a deduplicated add of an already finished job re-announces
+      // it with a creation time older than its own row. Both rows must stay.
+      await deleteMany(tx, tenantJobRunsTable, {
+        tenantId: key.tenantId,
+        jobName,
+        bullJobId,
+        status: { in: ["completed", "failed"] },
+        queuedAt: { lt: Temporal.Instant.fromEpochMilliseconds(meta.jobCreatedAtMs) },
+      });
+      // DO NOTHING: a fast worker can report the start before this enqueue hook
+      // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.
+      await insertOnConflictDoNothing(
+        tx,
+        tenantJobRunsTable,
+        { ...key, bullJobId, status: "queued", queuedAt: now, updatedAt: now },
+        { conflictKeys: [...TENANT_RUN_CONFLICT_KEYS] },
+      );
+    }),
+  );
 }
 
 async function recordTenantRunStarted(
@@ -296,14 +320,16 @@ async function recordTenantRunStarted(
   // skip: system-tenant run, no tenant-scoped query reads it
   if (!key) return;
   const now = Temporal.Now.instant();
-  await upsertOnConflict(
-    db,
-    tenantJobRunsTable,
-    { ...key, bullJobId, status: "running", startedAt: now, updatedAt: now },
-    {
-      conflictKeys: [...TENANT_RUN_CONFLICT_KEYS],
-      update: { status: "running", startedAt: now, finishedAt: null, updatedAt: now },
-    },
+  await inTenantScope(key.tenantId, () =>
+    upsertOnConflict(
+      db,
+      tenantJobRunsTable,
+      { ...key, bullJobId, status: "running", startedAt: now, updatedAt: now },
+      {
+        conflictKeys: [...TENANT_RUN_CONFLICT_KEYS],
+        update: { status: "running", startedAt: now, finishedAt: null, updatedAt: now },
+      },
+    ),
   );
 }
 
@@ -323,11 +349,13 @@ async function recordTenantRunOutcome(
   // A failed attempt BullMQ will retry goes back to waiting: the tenant keeps
   // seeing pending work, not a failure the next attempt may still resolve.
   if (result === "failed" && !outcome.finalAttempt) {
-    await updateMany(
-      db,
-      tenantJobRunsTable,
-      { status: "queued", startedAt: null, finishedAt: null, updatedAt: now },
-      { tenantId: key.tenantId, jobName, bullJobId },
+    await inTenantScope(key.tenantId, () =>
+      updateMany(
+        db,
+        tenantJobRunsTable,
+        { status: "queued", startedAt: null, finishedAt: null, updatedAt: now },
+        { tenantId: key.tenantId, jobName, bullJobId },
+      ),
     );
     // skip: retry pending, the row stays active until the final attempt
     return;
@@ -336,30 +364,32 @@ async function recordTenantRunOutcome(
   // one it replaces. The per-key lock keeps two runs of the same subject that
   // finish together from each missing the other's uncommitted row and leaving
   // both behind.
-  await transaction(db, async (tx) => {
-    await acquireNamespacedAdvisoryLock(
-      tx,
-      TENANT_JOB_RUN_LOCK_NAMESPACE,
-      JSON.stringify([key.tenantId, key.jobName, key.subject]),
-    );
-    // Read under the lock: the run that finishes last in lock order must also carry the
-    // latest finishedAt, otherwise a stale timestamp makes it the row that gets pruned.
-    const finishedAt = Temporal.Now.instant();
-    await upsertOnConflict(
-      tx,
-      tenantJobRunsTable,
-      { ...key, bullJobId, status: result, finishedAt, updatedAt: finishedAt },
-      {
-        conflictKeys: [...TENANT_RUN_CONFLICT_KEYS],
-        update: { status: result, finishedAt, updatedAt: finishedAt },
-      },
-    );
-    await deleteMany(tx, tenantJobRunsTable, {
-      ...key,
-      status: { in: ["completed", "failed"] },
-      bullJobId: { ne: bullJobId },
-    });
-  });
+  await inTenantScope(key.tenantId, () =>
+    transaction(db, async (tx) => {
+      await acquireNamespacedAdvisoryLock(
+        tx,
+        TENANT_JOB_RUN_LOCK_NAMESPACE,
+        JSON.stringify([key.tenantId, key.jobName, key.subject]),
+      );
+      // Read under the lock: the run that finishes last in lock order must also carry the
+      // latest finishedAt, otherwise a stale timestamp makes it the row that gets pruned.
+      const finishedAt = Temporal.Now.instant();
+      await upsertOnConflict(
+        tx,
+        tenantJobRunsTable,
+        { ...key, bullJobId, status: result, finishedAt, updatedAt: finishedAt },
+        {
+          conflictKeys: [...TENANT_RUN_CONFLICT_KEYS],
+          update: { status: result, finishedAt, updatedAt: finishedAt },
+        },
+      );
+      await deleteMany(tx, tenantJobRunsTable, {
+        ...key,
+        status: { in: ["completed", "failed"] },
+        bullJobId: { ne: bullJobId },
+      });
+    }),
+  );
 }
 
 async function requeueTenantRun(
@@ -373,11 +403,13 @@ async function requeueTenantRun(
   const key = tenantRunKey(jobName, meta.tenantVisibleRun.tenantId, meta.tenantVisibleRun.subject);
   // skip: system-tenant run, no tenant-scoped query reads it
   if (!key) return;
-  await updateMany(
-    db,
-    tenantJobRunsTable,
-    { status: "queued", startedAt: null, finishedAt: null, updatedAt: Temporal.Now.instant() },
-    { tenantId: key.tenantId, jobName, bullJobId },
+  await inTenantScope(key.tenantId, () =>
+    updateMany(
+      db,
+      tenantJobRunsTable,
+      { status: "queued", startedAt: null, finishedAt: null, updatedAt: Temporal.Now.instant() },
+      { tenantId: key.tenantId, jobName, bullJobId },
+    ),
   );
 }
 
@@ -387,20 +419,22 @@ async function dropTenantRunQueued(
   bullJobId: string,
   meta: JobDroppedMeta,
 ): Promise<void> {
-  await deleteMany(db, tenantJobRunsTable, {
-    tenantId: meta.tenantId,
-    jobName,
-    bullJobId,
-    status: "queued",
-  });
+  await inTenantScope(meta.tenantId, () =>
+    deleteMany(db, tenantJobRunsTable, {
+      tenantId: meta.tenantId,
+      jobName,
+      bullJobId,
+      status: "queued",
+    }),
+  );
 }
 
 const log = createFallbackLogger("job-run-logger");
 
 // The tenant run state is an optional side write: a throw here must not
 // fail the enqueue, skip the run-row write or turn a completed run into a
-// BullMQ retry.
-async function isolateTenantRunWrite(
+// BullMQ retry. A row-level-security rejection is logged louder (a missing or wrong tenant scope), never rethrown.
+export async function isolateTenantRunWrite(
   write: () => Promise<void>,
   jobName: string,
   bullJobId: string,
@@ -408,6 +442,13 @@ async function isolateTenantRunWrite(
   try {
     await write();
   } catch (e) {
+    if (isRowLevelSecurityViolation(e)) {
+      log.error(
+        "tenant job run state write rejected by row level security: missing or wrong tenant scope",
+        { jobName, bullJobId },
+      );
+      return;
+    }
     log.error("tenant job run state write failed", {
       jobName,
       bullJobId,
@@ -417,7 +458,8 @@ async function isolateTenantRunWrite(
 }
 
 // The tenant failure record is an optional side write: a throw here must not
-// skip the run-row update or turn a completed run into a BullMQ retry.
+// skip the run-row update or turn a completed run into a BullMQ retry. A row-level-security rejection is
+// logged louder (a missing or wrong tenant scope), never rethrown.
 async function isolateTenantFailureWrite(
   write: () => Promise<void>,
   jobName: string,
@@ -426,6 +468,13 @@ async function isolateTenantFailureWrite(
   try {
     await write();
   } catch (e) {
+    if (isRowLevelSecurityViolation(e)) {
+      log.error(
+        "tenant job failure record write rejected by row level security: missing or wrong tenant scope",
+        { jobName, bullJobId },
+      );
+      return;
+    }
     log.error("tenant job failure record write failed", {
       jobName,
       bullJobId,
@@ -544,7 +593,7 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
       const triggeredById = meta.triggeredById ?? null;
       cachePut(bullJobId, runId, triggeredById);
       // Parse against the registered schema so out-of-dispatcher writes
-      // get the same validation guarantee as ctx.appendEvent. A shape
+      // get the same validation guarantee as ctx.events.append. A shape
       // drift between feature + logger fails loudly at the source
       // instead of silently landing on the table.
       const payload = runStartedSchema.parse({

package/packages/bundled-features/src/ledger/web/index.ts

@@ -1,7 +1,7 @@
 // Client-safe ledger surface: QN constants, pure recurring helpers
 // (projection + Soll/Ist merge), and Zod payload schemas for client-side
 // pre-validation before dispatch. The full `../ledger` entry also re-exports
-// the feature/handlers/executor, which pull postgres-js; importing it in a
+// the feature/handlers/executor, which pull the DB driver; importing it in a
 // browser bundle fails on Node builtins. Client screens import dispatch QNs and
 // pure forecast/merge helpers from this module, then dispatch via the renderer's
 // useDispatcher.

package/packages/bundled-features/src/legal-pages/README.md

@@ -164,7 +164,7 @@ A throw rejects the boot, so the process never reports ready.
 
 | Slug + locale | What happens when missing |
 |---|---|
-| `imprint` / `de` | **Production:** `throw new Error(...)` blocks app start. **Dev:** `ctx.log.warn(...)` |
+| `imprint` / `de` | **Production:** `throw new Error(...)` blocks app start. **Dev:** `ctx.obs.log.warn(...)` |
 | `privacy` / `de` | as above |
 
 EN versions are **not** boot-fail-relevant by default (`LEGAL_OPTIONAL_BLOCKS`).

package/packages/bundled-features/src/legal-pages/lib/boot-check.ts

@@ -6,13 +6,17 @@ import {
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { LEGAL_REQUIRED_BLOCKS, type LegalRequiredBlock } from "../web/constants.ts";
 
-// Only the fields the check reads, so HandlerContext, AppContext or a hand-built
-// object in a unit test all fit.
+// Only the fields the check reads, so a HandlerContext or a hand-built object in a unit test
+// fits.
 export type LegalPagesBootCheckCtx = {
-  readonly templateResolver?: TemplateResolverApi;
-  readonly log?: {
-    readonly info?: (msg: string) => void;
-    readonly warn?: (msg: string) => void;
+  readonly services: {
+    readonly extensions: { readonly templateResolver?: TemplateResolverApi };
+  };
+  readonly obs?: {
+    readonly log?: {
+      readonly info?: (msg: string) => void;
+      readonly warn?: (msg: string) => void;
+    };
   };
 };
 
@@ -42,7 +46,7 @@ export async function runLegalPagesBootCheck(
   }
 
   if (missing.length === 0) {
-    ctx.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
+    ctx.obs?.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
   } else {
     const message =
       `legal-pages: missing ${missing.length} required text-block(s) in SYSTEM_TENANT: ` +
@@ -52,6 +56,6 @@ export async function runLegalPagesBootCheck(
     if (process.env["NODE_ENV"] === "production") {
       throw new Error(`Boot-Validation failed: ${message}`);
     }
-    ctx.log?.warn?.(message);
+    ctx.obs?.log?.warn?.(message);
   }
 }

package/packages/bundled-features/src/legal-pages/seed.ts

@@ -42,12 +42,15 @@ async function loadBlocksFromJson(path: string): Promise<readonly LegalContentBl
 
 // Boot seed for runProdApp's `seeds: [...]`. The JSON template is authoritative
 // (ifExists "update"), so legally required text changes reach rows seeded once.
-export function legalContentSeed(source: LegalContentSeedSource): LegalContentSeedFn {
+export function legalContentSeed(
+  source: LegalContentSeedSource,
+  options?: { readonly folder?: string },
+): LegalContentSeedFn {
   return async ({ db }) => {
     const blocks =
       "blocks" in source
         ? legalContentBlocksSchema.parse(source.blocks)
         : await loadBlocksFromJson(source.path);
-    await seedLegalContentFromJson(db, blocks);
+    await seedLegalContentFromJson(db, blocks, options);
   };
 }

package/packages/bundled-features/src/mail-foundation/feature.ts

@@ -64,7 +64,7 @@ export const MAIL_TRANSPORT_EXTENSION = "mailTransport" as const;
  * **Why not the full HandlerContext?** On the worker path (transport builds
  * triggered by r.job, such as the user-data-rights forget/export cron) there
  * is no per-request `config`/`tx`/`actor`; the wrapper builds the per-tenant
- * ConfigAccessor from `ctx.configResolver`. A plugin reading `ctx.tx` or other
+ * ConfigAccessor from `ctx.services.configResolver`. A plugin reading `ctx.tx` or other
  * request-only fields would break the worker path at runtime, and that would
  * only show up with real SMTP in production. Casting
  * `ctx as unknown as HandlerContext` satisfies the compiler but fails at
@@ -82,7 +82,7 @@ export const MAIL_TRANSPORT_EXTENSION = "mailTransport" as const;
 export type MailTransportContext = {
   readonly config?: ConfigAccessor;
   readonly registry?: Registry;
-  readonly secrets?: import("@cosmicdrift/kumiko-framework/secrets").SecretsContext;
+  readonly secrets: import("@cosmicdrift/kumiko-framework/secrets").SecretsContext | undefined;
   readonly auditUserId?: string | undefined;
 };
 

package/packages/bundled-features/src/mail-transport-smtp/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "nodemailer 10.2.1 fixes the address-parser advisories",
+    "detail": "nodemailer 10.0.13 mis-parsed quoted semicolons, angle brackets and nested comments in addresses (GHSA-m943-m63m-w62w, GHSA-85x2-q946-cp5h, GHSA-8c8m-p3m8-cjg8). The dependency is now 10.2.1, and the overrides for ip-address (10.7.4) and fast-copy (4.2.0) remove the remaining audit findings."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "SMTP authentication is optional",
+    "detail": "authUser is no longer a required key and the SMTP password secret no longer counts as missing in readiness. With an empty user the transport connects without auth, which suits internal relays; with a user set, a missing password still fails the send."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/packages/bundled-features/src/mail-transport-smtp/config-keys.ts

@@ -6,6 +6,7 @@ const tenantAdminWrite = access.withSystem(access.roles("TenantAdmin"));
 const tenantAdminRead = access.roles("TenantAdmin", "SystemAdmin");
 
 // required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
+// authUser stays optional: empty means an unauthenticated relay.
 export const SMTP_CONFIG_KEYS = {
   host: createTenantConfig("text", {
     required: true,
@@ -41,7 +42,6 @@ export const SMTP_CONFIG_KEYS = {
     },
   }),
   authUser: createTenantConfig("text", {
-    required: true,
     default: "",
     write: tenantAdminWrite,
     read: tenantAdminRead,

package/packages/bundled-features/src/mail-transport-smtp/feature.ts

@@ -105,8 +105,7 @@ export function createMailTransportSmtpFeature() {
           return `${plaintext.slice(0, 3)}...${plaintext.slice(-2)}`;
         },
         scope: "tenant",
-        // required: true ↔ the missing-secret throw in readPassword — keep in sync.
-        required: true,
+        // Only needed once authUser is set (readPassword throws then), so readiness must not demand it.
       });
 
       const configKeys = r.config({ keys: SMTP_CONFIG_KEYS });
@@ -191,14 +190,13 @@ async function buildSmtpTransport(
     "from",
     SMTP_HINT,
   );
-  const authUser = requireNonEmpty(
-    await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.authUser),
-    FEATURE_NAME,
-    "authUser",
-    SMTP_HINT,
-  );
-
-  const password = await readPassword(ctx, tenantId);
+  const authUser = (
+    await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.authUser)
+  )?.trim();
+  const auth =
+    authUser === undefined || authUser === ""
+      ? undefined
+      : { user: authUser, pass: await readPassword(ctx, tenantId) };
 
   let target: MailConnectTarget;
   try {
@@ -227,13 +225,16 @@ async function buildSmtpTransport(
     port,
     secure,
     from,
-    auth: { user: authUser, pass: password },
+    ...(auth && { auth }),
     ...(target.servername && { servername: target.servername }),
   });
 }
 
 async function readPassword(ctx: MailTransportContext, tenantId: string): Promise<string> {
-  const secrets = requireSecretsContext(ctx, FEATURE_NAME);
+  const secrets = requireSecretsContext(
+    { secrets: ctx.secrets, auditUserId: ctx.auditUserId },
+    FEATURE_NAME,
+  );
   const branded = await secrets.get(tenantId, SMTP_PASSWORD);
   return requireSecretSet(branded, FEATURE_NAME, SMTP_PASSWORD.name).reveal();
 }

package/packages/bundled-features/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "MANAGED_PAGES_FEATURE names the feature",
+    "detail": "The barrel exports the MANAGED_PAGES_FEATURE constant so other code can refer to the feature name without a string literal."
+  },
   {
     "version": "0.363.0",
     "type": "improvement",

package/packages/bundled-features/src/managed-pages/constants.ts

@@ -0,0 +1 @@
+export const MANAGED_PAGES_FEATURE = "managed-pages" as const;

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -10,6 +10,7 @@ import {
 } from "../page-render/index.ts";
 import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.ts";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding.ts";
+import { MANAGED_PAGES_FEATURE } from "./constants.ts";
 import { createBrandingQuery } from "./handlers/branding.query.ts";
 import { bySlugQuery } from "./handlers/by-slug.query.ts";
 import { byTenantPublishedQuery } from "./handlers/by-tenant-published.query.ts";
@@ -153,7 +154,8 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
   const defaultLang = opts.defaultLang ?? "en";
   const allowCustomCss = opts.allowCustomCss ?? false;
 
-  return defineFeature("managed-pages", (r) => {
+  return defineFeature(MANAGED_PAGES_FEATURE, (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
     );

package/packages/bundled-features/src/managed-pages/index.ts

@@ -21,6 +21,7 @@ export {
 // (`config:write:set`) — single source for the `managed-pages:config:branding-*`
 // strings, so apps + the per-tenant migration never hardcode them.
 export { BRANDING_QN, MANAGED_PAGES_CSS_FEATURE } from "./branding.ts";
+export { MANAGED_PAGES_FEATURE } from "./constants.ts";
 export { createManagedPagesCssFeature } from "./css-gate.ts";
 export {
   createManagedPagesFeature,

package/packages/bundled-features/src/managed-pages/seeding.ts

@@ -8,12 +8,12 @@ import {
   type DbConnection,
   fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
-  runEventStoreSeed,
-  type SeedIfExists,
-  TestUsers,
-} from "@cosmicdrift/kumiko-framework/seeding";
+  createSystemUser,
+  type SessionUser,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
 
 import { type PageRow, pageEntity, pagesTable } from "./table.ts";
 
@@ -35,9 +35,14 @@ export type SeedPageOptions = {
 export async function seedPage(db: DbConnection, opts: SeedPageOptions): Promise<{ id: string }> {
   // The default user must have user.tenantId === opts.tenantId; otherwise the
   // event-store stream ends up in the wrong tenant bucket → version_conflict
-  // on subsequent real writes. TestUsers.systemAdmin is testTenantId(1).
-  const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
-  const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
+  // on subsequent real writes.
+  const by = opts.by ?? createSystemUser(opts.tenantId);
+  const tdb = createTenantDb({
+    db,
+    tenantId: opts.tenantId,
+    mode: "system",
+    reason: "seeding writes managed pages into an explicitly named tenant",
+  });
 
   const existing = await fetchOne<PageRow>(db, pagesTable, {
     tenantId: opts.tenantId,

package/packages/bundled-features/src/notes-history/handlers/add-note.write.ts

@@ -69,7 +69,7 @@ export function createAddNoteHandler(
       let authorName: string | null = null;
       try {
         // read_users is tenant-agnostic → ctx.db.unsafeRaw, not the tenant-scoped ctx.db.
-        // postgres-js poisons the whole tx after any error inside it, even one that's
+        // Postgres aborts the whole tx after any error inside it, even one that's
         // caught — so the lookup runs in a savepoint where available, otherwise directly
         // (pool statements are their own units).
         authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(), async (sp) => {
@@ -80,7 +80,7 @@ export function createAddNoteHandler(
           return decryptStoredPii(userRow.displayName, "displayName", "notes-history:add-note");
         });
       } catch (e) {
-        ctx.log?.warn("notes-history: authorName lookup failed", {
+        ctx.obs.log?.warn("notes-history: authorName lookup failed", {
           error: e,
           userId: event.user.id,
         });

package/packages/bundled-features/src/personal-access-tokens/feature.ts

@@ -101,6 +101,7 @@ export function createPersonalAccessTokensFeature(
 ): FeatureDefinition {
   const { scopes } = options;
   return defineFeature(PAT_FEATURE, (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `store_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — registered as an auth-foundation tokenVerifier provider, resolved generically by the middleware. Pass { toggleable: { default: false } } to tier-gate the whole feature.",
     );
@@ -135,7 +136,7 @@ export function createPersonalAccessTokensFeature(
 
     // Custom domain-event for cross-instance access-invalidation,
     // mirroring sessions' SESSION_REVOKED_EVENT_SHORT. r.defineEvent
-    // registers the schema so ctx.unsafeAppendEvent (revoke) enforces it at
+    // registers the schema so ctx.events.unsafeAppend (revoke) enforces it at
     // append time. revoke-for-user.ts appends via the low-level append()
     // instead (needs to anchor on SYSTEM_TENANT_ID) — same guarantee via a
     // different path. No projection: the payload IS the read, consumed