@cosmicdrift/kumiko-bundled-features 0.105.2 → 0.109.0

package/src/personal-access-tokens/web/pat-tokens-screen.tsx

@@ -0,0 +1,251 @@
+// @runtime client
+// PatTokensScreen — logged-in self-service for Personal Access Tokens. Two-axis
+// scopes (like GitHub fine-grained PATs): per API domain pick a permission LEVEL
+// (no access / read / read & write). Mint → copy the plaintext ONCE → it's never
+// re-displayed. Layout follows the framework's polished-screen convention (Form
+// primitive + Tailwind), cards match the mh style. The feature registers this
+// dormant (r.screen); the app places it via r.nav.
+
+import {
+  useDispatcher,
+  usePrimitives,
+  useQuery,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
+import { type ReactNode, useState } from "react";
+import { PatHandlers, PatQueries } from "../constants";
+import { parseGrant } from "../scopes";
+
+type ScopeDomain = { readonly name: string; readonly label: string; readonly canWrite: boolean };
+type TokenRow = {
+  readonly id: string;
+  readonly name: string;
+  readonly scopes: readonly string[];
+  readonly createdAt: string | null;
+  readonly expiresAt: string | null;
+  readonly revokedAt: string | null;
+};
+
+type Level = "none" | "read" | "write";
+type ExpiryKey = "30d" | "90d" | "1y" | "never";
+const EXPIRY_DAYS: Record<ExpiryKey, number | undefined> = {
+  "30d": 30,
+  "90d": 90,
+  "1y": 365,
+  never: undefined,
+};
+
+// Timestamps arrive as ISO strings over the JSON API — slice the date part
+// without touching the banned Date API.
+function isoDate(value: string | null): string | null {
+  return typeof value === "string" && value.length >= 10 ? value.slice(0, 10) : null;
+}
+
+export function PatTokensScreen(): ReactNode {
+  const t = useTranslation();
+  const { Form, Field, Input, Button, Banner, Card, Heading } = usePrimitives();
+  const dispatcher = useDispatcher();
+
+  const scopesQuery = useQuery<readonly ScopeDomain[]>(PatQueries.availableScopes, {});
+  const listQuery = useQuery<readonly TokenRow[]>(PatQueries.mine, {});
+
+  const [name, setName] = useState("");
+  const [levels, setLevels] = useState<Readonly<Record<string, Level>>>({});
+  const [expiry, setExpiry] = useState<ExpiryKey>("90d");
+  const [minted, setMinted] = useState<{ token: string } | null>(null);
+  const [copied, setCopied] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  const domains = scopesQuery.data ?? [];
+  const tokens = listQuery.data ?? [];
+  const labelOf = (domain: string): string =>
+    domains.find((d) => d.name === domain)?.label ?? domain;
+
+  // Granted scopes = "<domain>:<level>" for every domain not set to "none".
+  const grants = (): string[] =>
+    Object.entries(levels)
+      .filter(([, l]) => l !== "none")
+      .map(([domain, l]) => `${domain}:${l}`);
+
+  const setLevel = (domain: string, level: Level): void =>
+    setLevels((cur) => ({ ...cur, [domain]: level }));
+
+  const create = async (): Promise<void> => {
+    if (name.trim() === "") return setError(t("pat.create.needName"));
+    const scopes = grants();
+    if (scopes.length === 0) return setError(t("pat.create.needScope"));
+    setBusy(true);
+    setError(null);
+    const days = EXPIRY_DAYS[expiry];
+    const res = await dispatcher.write(PatHandlers.create, {
+      name: name.trim(),
+      scopes,
+      ...(days !== undefined ? { expiresInDays: days } : {}),
+    });
+    setBusy(false);
+    if (!res.isSuccess) return setError(t("pat.error.generic"));
+    setMinted({ token: (res.data as { token: string }).token });
+    setCopied(false);
+    setName("");
+    setLevels({});
+    setExpiry("90d");
+    void listQuery.refetch?.();
+  };
+
+  const copy = async (): Promise<void> => {
+    if (!minted) return;
+    try {
+      await navigator.clipboard.writeText(minted.token);
+      setCopied(true);
+    } catch {
+      // clipboard blocked (non-secure context) — the token stays selectable in place
+    }
+  };
+
+  const revoke = async (id: string): Promise<void> => {
+    const res = await dispatcher.write(PatHandlers.revoke, { id });
+    if (!res.isSuccess) return setError(t("pat.error.generic"));
+    void listQuery.refetch?.();
+  };
+
+  // "Pages (read & write) · Tags (read) · Valid until … · Created …"
+  const meta = (row: TokenRow): string => {
+    const scopeText = row.scopes
+      .map((g) => {
+        const p = parseGrant(g);
+        if (!p) return g;
+        const lvl = p.level === "write" ? t("pat.level.write") : t("pat.level.read");
+        return `${labelOf(p.domain)} (${lvl})`;
+      })
+      .join(" · ");
+    const d = isoDate(row.expiresAt);
+    const parts = [
+      scopeText,
+      d ? t("pat.list.validUntil", { date: d }) : t("pat.list.neverExpires"),
+    ];
+    const created = isoDate(row.createdAt);
+    if (created) parts.push(t("pat.list.created", { date: created }));
+    return parts.join("  ·  ");
+  };
+
+  return (
+    <div className="flex max-w-3xl flex-col gap-6 p-6">
+      <Heading>{t("pat.title")}</Heading>
+
+      {minted && (
+        <Banner
+          variant="info"
+          actions={
+            <>
+              <Button variant="primary" onClick={copy}>
+                {copied ? t("pat.created.copied") : t("pat.created.copy")}
+              </Button>
+              <Button variant="secondary" onClick={() => setMinted(null)}>
+                {t("pat.created.dismiss")}
+              </Button>
+            </>
+          }
+        >
+          <div className="flex flex-col gap-2">
+            <span className="text-sm">{t("pat.created.hint")}</span>
+            <code className="block break-all rounded bg-muted px-3 py-2 font-mono text-sm">
+              {minted.token}
+            </code>
+          </div>
+        </Banner>
+      )}
+
+      {error && <Banner variant="error">{error}</Banner>}
+
+      <Form
+        title={t("pat.create.title")}
+        subtitle={t("pat.create.subtitle")}
+        onSubmit={create}
+        actions={
+          <Button type="submit" variant="primary" onClick={create} loading={busy} disabled={busy}>
+            {t("pat.create.submit")}
+          </Button>
+        }
+      >
+        <Field id="pat-name" label={t("pat.create.name")} required>
+          <Input
+            kind="text"
+            id="pat-name"
+            name="name"
+            value={name}
+            onChange={setName}
+            placeholder={t("pat.create.namePlaceholder")}
+            disabled={busy}
+          />
+        </Field>
+
+        {domains.map((d) => (
+          <Field key={d.name} id={`pat-scope-${d.name}`} label={d.label}>
+            <Input
+              kind="select"
+              id={`pat-scope-${d.name}`}
+              name={d.name}
+              value={levels[d.name] ?? "none"}
+              onChange={(v) => setLevel(d.name, v as Level)}
+              options={[
+                { value: "none", label: t("pat.level.none") },
+                { value: "read", label: t("pat.level.read") },
+                ...(d.canWrite ? [{ value: "write", label: t("pat.level.write") }] : []),
+              ]}
+              disabled={busy}
+            />
+          </Field>
+        ))}
+
+        <Field id="pat-expiry" label={t("pat.create.expiry")}>
+          <Input
+            kind="select"
+            id="pat-expiry"
+            name="expiry"
+            value={expiry}
+            onChange={(v) => setExpiry(v as ExpiryKey)}
+            options={[
+              { value: "30d", label: t("pat.expiry.30d") },
+              { value: "90d", label: t("pat.expiry.90d") },
+              { value: "1y", label: t("pat.expiry.1y") },
+              { value: "never", label: t("pat.expiry.never") },
+            ]}
+            disabled={busy}
+          />
+        </Field>
+      </Form>
+
+      <div className="flex flex-col gap-3">
+        <Heading>{t("pat.list.title")}</Heading>
+        {tokens.length === 0 && (
+          <span className="text-sm text-muted-foreground">{t("pat.list.empty")}</span>
+        )}
+        {tokens.map((row) => {
+          const revoked = row.revokedAt !== null;
+          return (
+            <Card
+              key={row.id}
+              options={{ padded: false }}
+              className={`p-4 ${revoked ? "opacity-60" : ""}`}
+            >
+              <div className="flex items-center justify-between gap-3">
+                <div className="flex min-w-0 flex-col gap-0.5">
+                  <span className="truncate text-sm font-semibold">{row.name}</span>
+                  <span className="truncate text-xs text-muted-foreground">
+                    {revoked ? t("pat.list.revoked") : meta(row)}
+                  </span>
+                </div>
+                {!revoked && (
+                  <Button variant="danger" onClick={() => revoke(row.id)}>
+                    {t("pat.list.revoke")}
+                  </Button>
+                )}
+              </div>
+            </Card>
+          );
+        })}
+      </div>
+    </div>
+  );
+}

package/src/renderer-simple/__tests__/template-resolver.integration.test.ts

@@ -1,5 +1,4 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -7,6 +6,7 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import type { RendererContext } from "../../renderer-foundation";
 import { SYSTEM_TENANT_ID } from "../../template-resolver/constants";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
@@ -35,7 +35,7 @@ function rendererCtx(): RendererContext {
 }
 
 async function seedPlainNotificationTemplate(content: string): Promise<void> {
-  await insertOne(db, templateResourcesTable, {
+  await seedRow(db, templateResourcesTable, {
     tenantId: SYSTEM_TENANT_ID,
     slug: "welcome-mail",
     kind: "notification",

package/src/sessions/__tests__/cleanup.integration.test.ts

@@ -5,7 +5,7 @@
 // expired/revoked rows go, live rows stay, batching + signal work.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { sql } from "@cosmicdrift/kumiko-framework/db";
 import type { AppContext } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -14,7 +14,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createUserFeature } from "../../user/feature";
 import { userEntity } from "../../user/schema/user";
 import { createSessionsFeature } from "../feature";
@@ -79,7 +79,7 @@ async function seedSession(opts: {
   const past = sql`now() - ${sql.raw(`interval '${opts.ageDays} days'`)}`;
   const future = sql`now() + ${sql.raw(`interval '30 days'`)}`;
 
-  await insertOne(stack.db, userSessionTable, {
+  await seedRow(stack.db, userSessionTable, {
     id: opts.id,
     tenantId: TENANT,
     userId: opts.userId,

package/src/sessions/__tests__/rebuild-survival.integration.test.ts

@@ -1,10 +1,5 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import {
-  asRawClient,
-  insertOne,
-  selectMany,
-  updateMany,
-} from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -18,6 +13,7 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createUserFeature } from "../../user/feature";
 import { createSessionsFeature } from "../feature";
@@ -62,7 +58,7 @@ const SID = "00000000-0000-0000-0000-000000000001";
 
 async function insertRevokedSession(db: DbConnection): Promise<void> {
   const now = Temporal.Now.instant();
-  await insertOne(db, userSessionTable, {
+  await seedRow(db, userSessionTable, {
     id: SID,
     tenantId: TENANT,
     userId: "user-1",
@@ -71,7 +67,7 @@ async function insertRevokedSession(db: DbConnection): Promise<void> {
     ip: "1.2.3.4",
     userAgent: "test-agent",
   });
-  await updateMany(db, userSessionTable, { revokedAt: now }, { id: SID, revokedAt: null });
+  await updateRows(db, userSessionTable, { revokedAt: now }, { id: SID, revokedAt: null });
 }
 
 describe("sessions / read_user_sessions survives projection rebuild", () => {
@@ -93,6 +89,6 @@ describe("sessions / read_user_sessions survives projection rebuild", () => {
 
     const rows = await selectMany(testDb.db, userSessionTable, {});
     expect(rows.length).toBe(1);
-    expect((rows[0] as { revokedAt: unknown }).revokedAt).not.toBeNull();
+    expect(rows[0]?.revokedAt).not.toBeNull();
   });
 });

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { deleteMany, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -10,7 +10,12 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createLateBoundHolder, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createLateBoundHolder,
+  deleteRows,
+  resetTestTables,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
@@ -367,7 +372,7 @@ describe("sessions feature — login → check → revoke → rejected", () => {
 
     // Hard-delete the session row so it's gone from the store (as opposed to
     // soft-revoked). The JWT stays syntactically valid.
-    await deleteMany(stack.db, userSessionTable, { id: sid });
+    await deleteRows(stack.db, userSessionTable, { id: sid });
 
     const res = await h.authedPost("/api/query", token, {
       type: "user:query:user:me",
@@ -384,7 +389,7 @@ describe("sessions feature — login → check → revoke → rejected", () => {
 
     // Back-date expiresAt so the row is still present + not revoked, just
     // past its window. Simulates what a long-lived JWT would hit.
-    await updateMany(
+    await updateRows(
       stack.db,
       userSessionTable,
       { expiresAt: Temporal.Instant.from("2020-01-01T00:00:00Z") },
@@ -422,7 +427,7 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     // so she gets a fresh JWT with the new role in its claims. This is the
     // actual production path — roles are tenant-membership data, not JWT
     // metadata we can fiddle with directly.
-    await updateMany(
+    await updateRows(
       stack.db,
       tenantMembershipsTable,
       { roles: JSON.stringify(["Admin"]) },
@@ -475,7 +480,7 @@ describe("sessions feature — locked accounts blocked on a live session", () =>
   test("restricted after login → 401 reason=blocked", async () => {
     const { userId } = await h.seedUser("restrict@example.com", "pw-long-enough");
     const { token } = await h.login("restrict@example.com", "pw-long-enough");
-    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: userId });
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: userId });
 
     const res = await h.authedPost("/api/query", token, {
       type: "user:query:user:me",
@@ -489,7 +494,7 @@ describe("sessions feature — locked accounts blocked on a live session", () =>
   test("deleted after login → 401 reason=blocked", async () => {
     const { userId } = await h.seedUser("gone@example.com", "pw-long-enough");
     const { token } = await h.login("gone@example.com", "pw-long-enough");
-    await updateMany(stack.db, userTable, { status: USER_STATUS.Deleted }, { id: userId });
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Deleted }, { id: userId });
 
     const res = await h.authedPost("/api/query", token, {
       type: "user:query:user:me",
@@ -507,7 +512,7 @@ describe("sessions feature — locked accounts blocked on a live session", () =>
     // into a global lockout for every affected session instead of a no-op.
     const { userId } = await h.seedUser("hardgone@example.com", "pw-long-enough");
     const { token } = await h.login("hardgone@example.com", "pw-long-enough");
-    await deleteMany(stack.db, userTable, { id: userId });
+    await deleteRows(stack.db, userTable, { id: userId });
 
     const res = await h.authedPost("/api/query", token, {
       type: "user:query:user:me",
@@ -519,7 +524,7 @@ describe("sessions feature — locked accounts blocked on a live session", () =>
   test("deletionRequested keeps its session live — reversible grace period", async () => {
     const { userId } = await h.seedUser("leaving@example.com", "pw-long-enough");
     const { token } = await h.login("leaving@example.com", "pw-long-enough");
-    await updateMany(
+    await updateRows(
       stack.db,
       userTable,
       { status: USER_STATUS.DeletionRequested },

package/src/sessions/schema/user-session.ts

@@ -1,4 +1,4 @@
-import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createEntity,
@@ -64,4 +64,10 @@ export const userSessionEntity = createEntity({
   },
 });
 
-export const userSessionTable = buildEntityTable("user_session", userSessionEntity);
+// Plain EntityTableMeta, NOT a branded EntityTable: user-session is an
+// unmanaged direct-write store (r.unmanagedTable in feature.ts, no event
+// stream — revocation is a column write, not an aggregate). The feature's
+// handlers write it directly via ctx.db; the meta carries no executor-only
+// brand so those writes stay legal. See feature.ts for the rebuild-exclusion
+// rationale (#494/#498).
+export const userSessionTable = buildEntityTableMeta("user-session", userSessionEntity);

package/src/sessions/session-callbacks.ts

@@ -10,14 +10,14 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
-import { USER_STATUS, userTable } from "../user";
+import { USER_STATUS, type UserStatus, userTable } from "../user";
 import { DEFAULT_SESSION_EXPIRY_MS } from "./constants";
 import { userSessionTable } from "./schema/user-session";
 
 // Locked accounts whose live sessions must be refused. deletionRequested is
 // intentionally absent — it's a reversible grace period and the user needs
 // their session to reach cancel-deletion.
-const BLOCKED_STATUSES: ReadonlySet<string> = new Set([
+const BLOCKED_STATUSES: ReadonlySet<UserStatus> = new Set([
   USER_STATUS.Restricted,
   USER_STATUS.Deleted,
 ]);
@@ -104,7 +104,13 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       // a stale sid. Fail-OPEN on a lookup miss — this is the second layer,
       // revocation is primary; never turn a user-row miss into a global
       // lockout. (+1 PK read on read_users per authenticated request.)
-      const user = await fetchOne<{ status: string }>(db, userTable, { id: expectedUserId });
+      //
+      // Fail-open covers a THROW too, not just a null-miss: this read sits on
+      // the hot path of every authenticated request, so a DB timeout / lock
+      // contention / pool exhaustion here must not turn into a global lockout.
+      const user = await fetchOne<{ status: UserStatus }>(db, userTable, {
+        id: expectedUserId,
+      }).catch(() => null);
       if (user && BLOCKED_STATUSES.has(user.status)) return "blocked";
       return "live";
     },

package/src/subscription-stripe/__tests__/runtime.test.ts

@@ -44,34 +44,24 @@ const BILLING_LIVE_HANDLE: ConfigKeyHandle<"boolean"> = {
 
 /** Stub-SecretsContext: liest aus einer in-memory-map, matcht per
  *  qualified-name. backing:"secrets" persistiert config-Werte JSON-
- *  serialisiert — der Stub spiegelt das, damit der Runtime-parseStoredSecret
- *  denselben Pfad nimmt wie gegen den echten Store. Ignoriert auditCtx. */
-function stubSecrets(values: Record<string, string>): SecretsContext {
+ *  serialisiert — der Stub spiegelt das per Default, damit der Runtime-
+ *  parseStoredSecret denselben Pfad nimmt wie gegen den echten Store.
+ *  `raw: true` speichert UN-serialisiert (482/1) — um parseStoredSecret's
+ *  Fehlerpfad zu treffen: ein Credential, das der Store un-JSON-kodiert
+ *  zurückgibt (Korruption oder außerhalb des backing:"secrets"-Roundtrips
+ *  geschrieben) muss laut failen, nicht still Müll liefern. Ignoriert
+ *  auditCtx. */
+function stubSecrets(
+  values: Record<string, string>,
+  opts?: { readonly raw?: boolean },
+): SecretsContext {
   const nameOf = (k: string | { readonly name: string }): string =>
     typeof k === "string" ? k : k.name;
   return {
     get: async (_tenantId, key) => {
       const value = values[nameOf(key)];
-      return value === undefined ? undefined : createSecret(JSON.stringify(value));
-    },
-    has: async (_tenantId, key) => values[nameOf(key)] !== undefined,
-    set: async () => undefined,
-    delete: async () => false,
-  };
-}
-
-/** Wie stubSecrets, aber speichert den Wert ROH (kein JSON.stringify) — um
- *  parseStoredSecret's Fehlerpfad zu treffen: ein Credential, das der Store
- *  un-JSON-kodiert zurückgibt (Korruption oder ein außerhalb des
- *  backing:"secrets"-Roundtrips geschriebener Wert) muss laut failen, nicht
- *  still Müll liefern. */
-function rawSecretsStub(values: Record<string, string>): SecretsContext {
-  const nameOf = (k: string | { readonly name: string }): string =>
-    typeof k === "string" ? k : k.name;
-  return {
-    get: async (_tenantId, key) => {
-      const value = values[nameOf(key)];
-      return value === undefined ? undefined : createSecret(value); // RAW, not JSON
+      if (value === undefined) return undefined;
+      return createSecret(opts?.raw ? value : JSON.stringify(value));
     },
     has: async (_tenantId, key) => values[nameOf(key)] !== undefined,
     set: async () => undefined,
@@ -164,7 +154,7 @@ describe("StripeCtxRuntime.clientForCtx", () => {
     // throw, not silently fall through to undefined/fallback.
     const rt = makeRuntimes({ apiKey: "sk_test_fallback" });
     const ctx = stubCtx({
-      secrets: rawSecretsStub({ [API_KEY_HANDLE.name]: "sk_test_raw_unquoted" }),
+      secrets: stubSecrets({ [API_KEY_HANDLE.name]: "sk_test_raw_unquoted" }, { raw: true }),
     });
     await expect(rt.ctx.clientForCtx(ctx)).rejects.toThrow(
       /Invalid JSON in subscription-stripe credential/,

package/src/tags/__tests__/tags.integration.test.ts

@@ -306,6 +306,21 @@ describe("tags integration — idempotency", () => {
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["tagId"]).toBe(tagId);
   });
+
+  test("two concurrent first-time assigns of the same (tag, entity) both succeed — one row", async () => {
+    // Both requests read `existing === null` before either write lands, so
+    // both fall through to create(); the loser's create() version_conflicts.
+    // The handler must converge that into success instead of surfacing a 409
+    // for what is, from the caller's perspective, an idempotent operation.
+    const tagId = await createTag("racy");
+    const [a, b] = await Promise.all([
+      assign(tagId, "credit", "credit-race"),
+      assign(tagId, "credit", "credit-race"),
+    ]);
+    expect(a).toBeDefined();
+    expect(b).toBeDefined();
+    expect(await countAssignments(admin.tenantId)).toBe(1);
+  });
 });
 
 describe("tags integration — referential integrity", () => {

package/src/tags/handlers/assign-tag.write.ts

@@ -14,8 +14,9 @@ import { type AssignTagPayload, assignTagPayloadSchema } from "../schemas";
 //     append at version 0 onto the created+deleted stream and version_conflict;
 //     the deterministic id means that stream is permanent.
 //   - never assigned         → create() (restore reports not_found).
-// A concurrent first-time race still version_conflicts (409); acceptable, since
-// assigning is a low-frequency UI action.
+// A concurrent first-time race converges: both callers fall through to
+// create(), the loser's create() version_conflicts, and the handler treats
+// that as success since the winner already wrote the desired end state.
 //
 // Referential integrity: there is no FK (event-sourced, no JOIN), so before a
 // first-time create we verify the tag exists in the catalog — a malformed call
@@ -46,7 +47,7 @@ export function createAssignTagHandler(access: AccessRule = DEFAULT_TAG_ACCESS):
       const tag = await tagExecutor.detail({ id: payload.tagId }, event.user, ctx.db);
       if (!tag) return writeFailure(new NotFoundError("tag", payload.tagId));
 
-      return tagAssignmentExecutor.create(
+      const created = await tagAssignmentExecutor.create(
         {
           id,
           tagId: payload.tagId,
@@ -56,6 +57,15 @@ export function createAssignTagHandler(access: AccessRule = DEFAULT_TAG_ACCESS):
         event.user,
         ctx.db,
       );
+      if (created.isSuccess) return created;
+      // A concurrent first-time assign of the same (tag, entity) races here —
+      // both callers' `existing` read above saw null, so both fall through to
+      // create(). The loser's create() version_conflicts (409), but the
+      // desired end state (the assignment exists) is already true — the
+      // winner just wrote it. Converge instead of surfacing a spurious 409
+      // for an idempotent operation.
+      if (created.error.code !== "version_conflict") return created;
+      return { isSuccess: true as const, data: { id } };
     },
   };
 }

package/src/tags/schemas.ts

@@ -1,8 +1,11 @@
 import { z } from "zod";
 
 export const createTagPayloadSchema = z.object({
-  name: z.string().min(1).max(64),
-  color: z.string().max(32).optional(),
+  name: z.string().trim().min(1).max(64),
+  color: z
+    .string()
+    .regex(/^(#([0-9a-fA-F]{3}|[0-9a-fA-F]{6}))?$/, "color must be a hex code (#rgb or #rrggbb)")
+    .optional(),
   scope: z.string().max(64).optional(),
 });
 export type CreateTagPayload = z.infer<typeof createTagPayloadSchema>;
@@ -16,8 +19,11 @@ export const updateTagPayloadSchema = z
   .object({
     id: z.string().min(1),
     version: z.number().int().nonnegative(),
-    name: z.string().min(1).max(64).optional(),
-    color: z.string().max(32).optional(),
+    name: z.string().trim().min(1).max(64).optional(),
+    color: z
+      .string()
+      .regex(/^(#([0-9a-fA-F]{3}|[0-9a-fA-F]{6}))?$/, "color must be a hex code (#rgb or #rrggbb)")
+      .optional(),
     scope: z.string().max(64).optional(),
   })
   .refine((p) => p.name !== undefined || p.color !== undefined || p.scope !== undefined, {

package/src/template-resolver/__tests__/template-resolver.integration.test.ts

@@ -1,11 +1,11 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createTemplateResolverApi, TemplateNotFoundError, type TemplateResolverApi } from "../api";
 import {
   type ContentFormat,
@@ -56,7 +56,7 @@ async function seedTemplate(args: {
   linkedResources?: Record<string, string>;
   parentTemplateId?: string;
 }) {
-  await insertOne(db, templateResourcesTable, {
+  await seedRow(db, templateResourcesTable, {
     tenantId: args.tenantId,
     slug: args.slug,
     kind: args.kind,