@cosmicdrift/kumiko-samples 0.389.0 → 0.390.1

package/packages/bundled-features/src/secrets/handlers/delete.write.ts

@@ -18,9 +18,10 @@ export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS)
     access,
     escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
     handler: async (event, ctx) => {
-      const secrets = requireSecretsContext(ctx, SecretsHandlers.delete).withRunner(
-        ctx.db.unsafeRaw(),
-      );
+      const secrets = requireSecretsContext(
+        { secrets: ctx.services.secrets, user: ctx.user },
+        SecretsHandlers.delete,
+      ).withRunner(ctx.db.unsafeRaw());
       const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {
         allowUndeclared: true,
       });

package/packages/bundled-features/src/secrets/handlers/rotate.job.ts

@@ -61,13 +61,13 @@ export async function rotateJob(
   db: DbConnection,
 ): Promise<void> {
   const payload = rawPayload as RotateJobPayload; // @cast-boundary engine-payload
-  if (!ctx.masterKeyProvider) {
+  if (!ctx.services.masterKeyProvider) {
     throw new InternalError({
       message:
-        "[secrets:rotate] ctx.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
+        "[secrets:rotate] ctx.services.masterKeyProvider missing — wire it via extraContext.masterKeyProvider at boot.",
     });
   }
-  const provider = ctx.masterKeyProvider;
+  const provider = ctx.services.masterKeyProvider;
   const batchSize = payload.batchSize ?? DEFAULT_BATCH_SIZE;
   const maxFailures = payload.maxFailures ?? DEFAULT_MAX_FAILURES;
   const deadline = payload.maxDurationMs
@@ -81,7 +81,12 @@ export async function rotateJob(
   function tdbFor(tenantId: TenantId): TenantDb {
     let existing = tdbCache.get(tenantId);
     if (!existing) {
-      existing = createTenantDb({ db, tenantId, mode: "system" });
+      existing = createTenantDb({
+        db,
+        tenantId,
+        mode: "system",
+        reason: "secret key rotation job re-encrypts secrets of every tenant",
+      });
       tdbCache.set(tenantId, existing);
     }
     return existing;
@@ -137,7 +142,7 @@ export async function rotateJob(
     // potentially even past target.
     if (!result.isSuccess) {
       if (result.error.code === "version_conflict") return "skipped";
-      ctx.log?.warn?.(`[secrets:rotate] executor rejected row ${row.id}`, {
+      ctx.obs.log?.warn?.(`[secrets:rotate] executor rejected row ${row.id}`, {
         code: result.error.code,
       });
       return "failed";
@@ -150,9 +155,9 @@ export async function rotateJob(
     migrateRow,
     maxFailures,
     deadlineAt: deadline,
-    signal: ctx.signal,
+    signal: ctx.lifecycle.signal,
     onRowError: (row, err) => {
-      ctx.log?.warn?.(`[secrets:rotate] failed to rotate row ${row.id}`, { err });
+      ctx.obs.log?.warn?.(`[secrets:rotate] failed to rotate row ${row.id}`, { err });
     },
   });
 
@@ -162,5 +167,5 @@ export async function rotateJob(
     batchesProcessed: outcome.batchesProcessed,
     stoppedReason: outcome.stoppedReason,
   };
-  ctx.log?.info?.(`[secrets:rotate] complete: ${JSON.stringify(result)}`);
+  ctx.obs.log?.info?.(`[secrets:rotate] complete: ${JSON.stringify(result)}`);
 }

package/packages/bundled-features/src/secrets/handlers/set.write.ts

@@ -25,9 +25,10 @@ export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
     access,
     escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
     handler: async (event, ctx) => {
-      const secrets = requireSecretsContext(ctx, SecretsHandlers.set).withRunner(
-        ctx.db.unsafeRaw(),
-      );
+      const secrets = requireSecretsContext(
+        { secrets: ctx.services.secrets, user: ctx.user },
+        SecretsHandlers.set,
+      ).withRunner(ctx.db.unsafeRaw());
       const { key, value, redactedPreview, hint } = event.payload;
 
       // Preview-priority: explicit payload param > feature-declared redact

package/packages/bundled-features/src/secrets/secrets-context.ts

@@ -1,6 +1,6 @@
-// Feature-level accessor injected as `ctx.secrets` at boot. Not a HTTP API —
+// Feature-level accessor injected as `ctx.services.secrets` at boot. Not a HTTP API —
 // feature code that needs a plaintext secret (SMTP-connect, Stripe-call, …)
-// pulls it via ctx.secrets.get. Cleartext never crosses the wire.
+// pulls it via ctx.services.secrets.get. Cleartext never crosses the wire.
 //
 // Post-ES pivot: all three ops (get/set/delete) flow through the events-
 // table.
@@ -154,7 +154,7 @@ function buildSecretsContext(
         const readId = generateId();
         const metadata: EventMetadata = { userId: auditCtx.userId };
         // Parse against the registered schema so the low-level append
-        // here gets the same validation guarantee as ctx.appendEvent.
+        // here gets the same validation guarantee as ctx.events.append.
         // A payload-shape drift between schema + call-site fails at the
         // source instead of landing on the events-stream.
         const payload = secretReadSchema.parse({
@@ -206,7 +206,12 @@ function buildSecretsContext(
         tenantId,
         roles: SYSTEM_ROLES,
       };
-      const tdb = createTenantDb({ db, tenantId, mode: "system" });
+      const tdb = createTenantDb({
+        db,
+        tenantId,
+        mode: "system",
+        reason: "secrets API writes for a caller-named tenant, outside a request scope",
+      });
 
       const existing = await lookup(tenantId, key);
       const commonFields = {
@@ -271,7 +276,12 @@ function buildSecretsContext(
         tenantId,
         roles: SYSTEM_ROLES,
       };
-      const tdb = createTenantDb({ db, tenantId, mode: "system" });
+      const tdb = createTenantDb({
+        db,
+        tenantId,
+        mode: "system",
+        reason: "secrets API writes for a caller-named tenant, outside a request scope",
+      });
       const result = await executor.delete({ id: existing.id }, actor, tdb);
       return result.isSuccess;
     },
@@ -279,7 +289,7 @@ function buildSecretsContext(
 }
 
 // Wrap an executor-level write failure into a KumikoError so callers of
-// ctx.secrets.set / .delete can still branch on .code / details / i18nKey
+// ctx.services.secrets.set / .delete can still branch on .code / details / i18nKey
 // after it propagates up. Plain `new Error(...)` would have stripped the
 // structured payload the error-contract promises.
 function wrapSetFailure(err: WriteErrorInfo): InternalError {

package/packages/bundled-features/src/secrets/write-gate.ts

@@ -77,7 +77,7 @@ export function checkSecretKeyWrite(
   return { ok: true, keyDef };
 }
 
-// The registry surface the value check needs; lets ctx.secrets validate without a full Registry.
+// The registry surface the value check needs; lets ctx.services.secrets validate without a full Registry.
 export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
 
 // Carries neither the value nor the schema's issues.

package/packages/bundled-features/src/seo/feature.ts

@@ -285,7 +285,7 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
           sitemapEntries: opts.sitemapEntries,
           includeLegalPages: opts.includeLegalPages ?? false,
           hasManagedPages: opts.managedPages !== undefined,
-          log: ctx.log,
+          log: ctx.obs.log,
         }),
     );
 

package/packages/bundled-features/src/sessions/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Session screens show the device without sessionsClient()",
+    "detail": "The list, my-sessions and detail screens showed [object Object] in the device column for apps that do not register sessionsClient(). The session queries (user-session:list, user-session:mine, user-session:detail) now return a deviceLabel string such as \"Chrome 141 · macOS\" next to the unchanged device object, null when the user agent is unknown, and the screens render that field. sessionsClient() only adds the translated \"Unknown device\" for rows without a label."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Sessions tests no longer write projection tables directly",
+    "detail": "The sessions integration tests change tenant memberships and user status through the update-member-roles handler or the event-store executor instead of writing into the projection tables. Nothing changes for apps; the package is only republished."
+  },
   {
     "version": "0.389.0",
     "type": "breaking",

package/packages/bundled-features/src/sessions/feature.ts

@@ -157,7 +157,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       } satisfies SessionStoreProvider);
 
       // Custom domain-event for cross-instance access-invalidation.
-      // r.defineEvent registers the schema so ctx.unsafeAppendEvent (revoke,
+      // r.defineEvent registers the schema so ctx.events.unsafeAppend (revoke,
       // revoke-all-others) enforces it at append time. revoke-all-for-user
       // appends via the low-level append() instead (needs to anchor on
       // SYSTEM_TENANT_ID — see that handler for why) — append() does NOT

package/packages/bundled-features/src/sessions/handlers/cleanup.job.ts

@@ -60,7 +60,7 @@ export async function cleanupJob(
   let stoppedReason: SessionCleanupResult["stoppedReason"] = "empty";
 
   while (true) {
-    if (ctx.signal?.aborted) {
+    if (ctx.lifecycle.signal?.aborted) {
       stoppedReason = "signal";
       break;
     }
@@ -79,5 +79,5 @@ export async function cleanupJob(
   }
 
   const result: SessionCleanupResult = { deleted, batchesProcessed, stoppedReason };
-  ctx.log?.info?.(`[sessions:cleanup] complete: ${JSON.stringify(result)}`);
+  ctx.obs.log?.info?.(`[sessions:cleanup] complete: ${JSON.stringify(result)}`);
 }

package/packages/bundled-features/src/sessions/handlers/detail.query.ts

@@ -3,7 +3,7 @@ import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
 import { userSessionTable } from "../schema/user-session.ts";
-import { parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
+import { formatDeviceLabel, parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
 
 // Admin single-session inspector — mirrors list.query's decrypt handling for
 // the one-row case. ctx.db (TenantDb) applies tenant-scoping automatically.
@@ -16,6 +16,7 @@ const sessionRowSchema = z.object({
   ip: z.string().nullable(),
   userAgent: z.string().nullable(),
   device: parsedDeviceSchema,
+  deviceLabel: z.string().nullable(),
 });
 
 export const createDetailQuery = (adminRoles: readonly string[] = access.admin) =>
@@ -42,6 +43,7 @@ export const createDetailQuery = (adminRoles: readonly string[] = access.admin)
       const userAgent = row.userAgent
         ? await decryptStoredPii(row.userAgent, "userAgent", "sessions:detail")
         : row.userAgent;
+      const device = parseUserAgent(userAgent);
       return {
         id: row.id,
         userId: row.userId,
@@ -50,7 +52,8 @@ export const createDetailQuery = (adminRoles: readonly string[] = access.admin)
         revokedAt: row.revokedAt,
         ip: row.ip ? await decryptStoredPii(row.ip, "ip", "sessions:detail") : row.ip,
         userAgent,
-        device: parseUserAgent(userAgent),
+        device,
+        deviceLabel: formatDeviceLabel(device),
       };
     },
   });

package/packages/bundled-features/src/sessions/handlers/list.query.ts

@@ -8,7 +8,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
 import { userSessionTable } from "../schema/user-session.ts";
-import { parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
+import { formatDeviceLabel, parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
 
 // `sort` arrives raw from the client's query string. selectMany's orderBy
 // has no column-existence check — an unrecognised field just gets
@@ -49,6 +49,7 @@ export const createListQuery = (adminRoles: readonly string[] = access.admin) =>
           ip: z.string().nullable(),
           userAgent: z.string().nullable(),
           device: parsedDeviceSchema,
+          deviceLabel: z.string().nullable(),
         }),
       ),
       nextCursor: z.string().nullable(),
@@ -85,6 +86,7 @@ export const createListQuery = (adminRoles: readonly string[] = access.admin) =>
           const userAgent = r.userAgent
             ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:list")
             : r.userAgent;
+          const device = parseUserAgent(userAgent);
           return {
             id: r.id,
             userId: r.userId,
@@ -93,7 +95,8 @@ export const createListQuery = (adminRoles: readonly string[] = access.admin) =>
             revokedAt: r.revokedAt,
             ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:list") : r.ip,
             userAgent,
-            device: parseUserAgent(userAgent),
+            device,
+            deviceLabel: formatDeviceLabel(device),
           };
         }),
       );

package/packages/bundled-features/src/sessions/handlers/mine.query.ts

@@ -3,7 +3,7 @@ import { definePagedQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
 import { userSessionTable } from "../schema/user-session.ts";
-import { parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
+import { formatDeviceLabel, parsedDeviceSchema, parseUserAgent } from "../web/user-agent.ts";
 
 // "My live sessions" — the backing data for a devices/sessions UI. Returns
 // ONLY the current user's own, currently-live sessions, ordered by most-
@@ -31,6 +31,7 @@ export const mineQuery = definePagedQueryHandler({
         ip: z.string().nullable(),
         userAgent: z.string().nullable(),
         device: parsedDeviceSchema,
+        deviceLabel: z.string().nullable(),
         current: z.boolean(),
       }),
     ),
@@ -57,13 +58,15 @@ export const mineQuery = definePagedQueryHandler({
         const userAgent = r.userAgent
           ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:mine")
           : r.userAgent;
+        const device = parseUserAgent(userAgent);
         return {
           id: r.id,
           createdAt: r.createdAt,
           expiresAt: r.expiresAt,
           ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:mine") : r.ip,
           userAgent,
-          device: parseUserAgent(userAgent),
+          device,
+          deviceLabel: formatDeviceLabel(device),
           current: currentSid === r.id,
         };
       }),

package/packages/bundled-features/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -67,9 +67,9 @@ export const revokeAllForUserWrite = defineWriteHandler({
     // Lightweight append alongside the direct-write above; see revoke.write.ts
     // for why this isn't a lifecycle event on
     // store_user_sessions. Uses the low-level append() (not
-    // ctx.unsafeAppendEvent) because this handler is deliberately
+    // ctx.events.unsafeAppend) because this handler is deliberately
     // cross-tenant: the privileged caller's own tenantId (what
-    // ctx.unsafeAppendEvent would bind to) has no relationship to the
+    // ctx.events.unsafeAppend would bind to) has no relationship to the
     // target user's session tenant(s). Anchored on SYSTEM_TENANT_ID
     // instead, same as the jobs feature's cross-tenant run-lifecycle
     // events (job-run-logger.ts) — a fresh aggregate per call, so no
@@ -77,7 +77,7 @@ export const revokeAllForUserWrite = defineWriteHandler({
     //
     // append() itself does NOT validate against the r.defineEvent-
     // registered schema (that guarantee only comes from going through
-    // ctx.unsafeAppendEvent's dispatcher path). Mirrors job-run-logger.ts:
+    // ctx.events.unsafeAppend's dispatcher path). Mirrors job-run-logger.ts:
     // parse explicitly before the raw append so a shape drift fails loudly
     // here instead of landing unvalidated on the events table.
     if (updated.length > 0) {

package/packages/bundled-features/src/sessions/handlers/revoke-all-others.write.ts

@@ -51,7 +51,7 @@ export const revokeAllOthersWrite = defineWriteHandler({
     // store_user_sessions. Skipped when nothing was revoked (no other
     // live sessions) — a spurious invalidation would be the failure mode.
     if (updated.length > 0) {
-      await ctx.unsafeAppendEvent({
+      await ctx.events.unsafeAppend({
         aggregateId: generateId(),
         aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
         type: SESSION_REVOKED_EVENT_QN,

package/packages/bundled-features/src/sessions/handlers/revoke.write.ts

@@ -55,7 +55,7 @@ export const revokeWrite = defineWriteHandler({
       // unmanaged direct-write store, see feature.ts). Own aggregate id per
       // revoke, no predecessor to satisfy, no version_conflict against a
       // concurrent revoke on a different sid.
-      await ctx.unsafeAppendEvent({
+      await ctx.events.unsafeAppend({
         aggregateId: generateId(),
         aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
         type: SESSION_REVOKED_EVENT_QN,

package/packages/bundled-features/src/sessions/screens.ts

@@ -39,7 +39,7 @@ export const createSessionListScreen = (
       refLabelField: "displayName",
     },
     {
-      field: "device",
+      field: "deviceLabel",
       label: i18nKey("sessions.list.col.device"),
       renderer: DEVICE_RENDERER,
     },
@@ -94,7 +94,7 @@ export const createSessionDetailScreen = (
           { field: "createdAt", renderer: { format: "timestamp" } },
           { field: "expiresAt", renderer: { format: "timestamp" } },
           { field: "revokedAt", renderer: { format: "timestamp" } },
-          { field: "device", renderer: DEVICE_RENDERER },
+          { field: "deviceLabel", renderer: DEVICE_RENDERER },
           "ip",
           "userAgent",
         ],
@@ -107,7 +107,7 @@ export const createSessionDetailScreen = (
     createdAt: i18nKey("sessions.detail.field.createdAt"),
     expiresAt: i18nKey("sessions.detail.field.expiresAt"),
     revokedAt: i18nKey("sessions.detail.field.revokedAt"),
-    device: i18nKey("sessions.list.col.device"),
+    deviceLabel: i18nKey("sessions.list.col.device"),
     ip: i18nKey("sessions.detail.field.ip"),
     userAgent: i18nKey("sessions.detail.field.userAgent"),
   },
@@ -120,7 +120,11 @@ export const sessionMineScreen: ProjectionListScreenDefinition = {
   type: "projectionList",
   query: SessionQueries.mine,
   columns: [
-    { field: "device", label: i18nKey("sessions.mine.col.userAgent"), renderer: DEVICE_RENDERER },
+    {
+      field: "deviceLabel",
+      label: i18nKey("sessions.mine.col.userAgent"),
+      renderer: DEVICE_RENDERER,
+    },
     { field: "ip", label: i18nKey("sessions.mine.col.ip") },
     {
       field: "current",

package/packages/bundled-features/src/sessions/session-revoked-event.ts

@@ -12,7 +12,7 @@ import * as z from "zod";
 // _SHORT/_QN pair mirrors cap-counter's rolling-incremented event:
 //   _SHORT — r.defineEvent(short, schema) in feature.ts, framework prefixes
 //            it to the QN below.
-//   _QN    — ctx.unsafeAppendEvent({ type }) / raw append()'s `type` field.
+//   _QN    — ctx.events.unsafeAppend({ type }) / raw append()'s `type` field.
 export const SESSION_REVOKED_EVENT_SHORT = "session-revoked" as const;
 export const SESSION_REVOKED_EVENT_QN = "sessions:event:session-revoked" as const;
 

package/packages/bundled-features/src/sessions/web/session-device-cell.tsx

@@ -1,19 +1,17 @@
-// Column renderer for the parsed `device` of a session row, registered via `sessionsClient()`.
+// Column renderer for session devices, registered via `sessionsClient()`. Takes the server-made
+// `deviceLabel` string, or the parsed `device` object for screens that bind that column.
 
 import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import type { ReactNode } from "react";
-import { parsedDeviceSchema } from "./user-agent.ts";
+import { formatDeviceLabel, parsedDeviceSchema } from "./user-agent.ts";
+
+function deviceLabelOf(value: unknown): string | null {
+  if (typeof value === "string") return value === "" ? null : value;
+  const parsed = parsedDeviceSchema.safeParse(value);
+  return parsed.success ? formatDeviceLabel(parsed.data) : null;
+}
 
 export function SessionDeviceCell({ value }: ColumnRendererProps): ReactNode {
   const t = useTranslation();
-  const parsed = parsedDeviceSchema.safeParse(value);
-  const device = parsed.success ? parsed.data : null;
-  if (device === null) return t("sessions.device.unknown");
-  const browser =
-    device.browser === null
-      ? null
-      : device.browserMajor === null
-        ? device.browser
-        : `${device.browser} ${device.browserMajor}`;
-  return [browser, device.os].filter((part) => part !== null).join(" · ");
+  return deviceLabelOf(value) ?? t("sessions.device.unknown");
 }

package/packages/bundled-features/src/sessions/web/user-agent.ts

@@ -56,6 +56,18 @@ const OPERATING_SYSTEM_PATTERNS: readonly {
   { os: "Linux", pattern: /\bLinux\b/ },
 ];
 
+export function formatDeviceLabel(device: ParsedDevice): string | null {
+  if (device === null) return null;
+  const browser =
+    device.browser === null
+      ? null
+      : device.browserMajor === null
+        ? device.browser
+        : `${device.browser} ${device.browserMajor}`;
+  const parts = [browser, device.os].filter((part) => part !== null);
+  return parts.length === 0 ? null : parts.join(" · ");
+}
+
 export function parseUserAgent(userAgent: string | null): ParsedDevice {
   if (userAgent === null || userAgent === "") return null;
   let browser: UserAgentBrowser | null = null;

package/packages/bundled-features/src/shared/index.ts

@@ -92,5 +92,20 @@ export {
   type SignupHandoverProvider,
 } from "./signup-handover.ts";
 export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store.ts";
+export {
+  backfillAggregateStreamTenants,
+  type StreamBackfillCandidate,
+  type StreamBackfillFailure,
+  type StreamBackfillOptions,
+  type StreamBackfillResult,
+  type StreamTenantTarget,
+} from "./stream-tenant-backfill.ts";
+export {
+  createSearchBucketCleanup,
+  type DerivedStateMode,
+  rebuildAndReindex,
+  type StreamBackfillStepFailure,
+  stepFailures,
+} from "./stream-tenant-derived-state.ts";
 export type { SystemQueryFn } from "./system-query.ts";
 export { type BurnResult, burnToken, unburnToken } from "./token-burn-store.ts";

package/packages/bundled-features/src/shared/purge-files-reaching-subject.ts

@@ -206,7 +206,12 @@ export async function purgeFilesReachingSubject(args: {
         }
         const deleteBytes = await storagePromise;
         const systemUser = createSystemUser(tenantId);
-        const tdb = createTenantDb({ db, tenantId, mode: "system" });
+        const tdb = createTenantDb({
+          db,
+          tenantId,
+          mode: "system",
+          reason: "subject erasure purges file refs in every tenant that holds them",
+        });
 
         const outcome = await purgeRowFileRefs({
           db,
@@ -353,7 +358,12 @@ async function purgePendingFileRef(
   const forgotten = await fileRefExecutor.forget(
     { id: fileRefId },
     createSystemUser(tenantId),
-    createTenantDb({ db, tenantId, mode: "system" }),
+    createTenantDb({
+      db,
+      tenantId,
+      mode: "system",
+      reason: "subject erasure purges file refs in every tenant that holds them",
+    }),
   );
   return forgotten.isSuccess
     ? undefined

package/packages/bundled-features/src/shared/require-for-tenant.ts

@@ -5,14 +5,16 @@ import type {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 
-// ctx.forTenant is absent for r.systemScope() handlers and without a db; a write handler that
+// ctx.tenants.writeTarget is absent for r.systemScope() handlers and without a db; a write handler that
 // needs a cross-tenant target must fail loudly instead of falling back to ctx.db.
 export function requireForTenant(
-  ctx: Pick<HandlerContext, "forTenant">,
+  ctx: Pick<HandlerContext, "tenants">,
   targetTenantId: TenantId,
 ): TenantWriteTarget {
-  if (!ctx.forTenant) {
-    throw new InternalError({ message: "ctx.forTenant is not available in this handler context" });
+  if (!ctx.tenants.writeTarget) {
+    throw new InternalError({
+      message: "ctx.tenants.writeTarget is not available in this handler context",
+    });
   }
-  return ctx.forTenant(targetTenantId);
+  return ctx.tenants.writeTarget(targetTenantId);
 }