@cosmicdrift/kumiko-bundled-features 0.220.0 → 0.221.0

package/src/jobs/job-run-logger.ts

@@ -2,15 +2,24 @@ import { fetchOne, insertMany, insertOne, updateMany } from "@cosmicdrift/kumiko
 import {
   configuredPiiSubjectKms,
   encryptPiiValueForSubject,
+  KeyErasedError,
+  type LocalKeyKmsAdapter,
+  PII_ERASED_SENTINEL,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import type { JobLogEntry, JobMeta, JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import { mapWithConcurrency } from "../shared";
 import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events";
 import { parseJobInstant } from "./job-instant";
 import { jobRunLogsTable, jobRunsTable } from "./job-run-table";
 
+// Matches PgKmsAdapter's default pool size (see tenant/handlers/*.query.ts) —
+// bounds concurrent getOrCreateDek calls so a large log batch doesn't claim
+// every connection in the pool.
+const KMS_POOL_CONCURRENCY = 4;
+
 // Direct-write job-run log (#2243): onJobStart/-Complete/-Failed write
 // straight into jobRunsTable / jobRunLogsTable instead of appending to the
 // event store and replaying through inline projections. Pre-#2243 every run
@@ -44,27 +53,32 @@ const DEFAULT_CACHE_MAX_ENTRIES = 10_000;
 // to DB-lookup if actually needed.
 const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 
-// The run-started payload can carry arbitrary user data; triggeredById
-// names its owning user. No event-PII catalog involved (#2243 removed the
-// jobRun r.defineEvent registrations, so there is nothing to catalog) —
-// the subject is known statically, so we encrypt directly. A null subject
-// (system cron runs, recipient-less triggers) stays plaintext: there is no
-// user key to shred, mirroring the previous event-pii catalog's own skip
-// rule. Absent KMS adapter stays plaintext too (rollout mode, unchanged).
-async function encryptStartedPayload(
-  payload: string | null,
-  triggeredById: string | null,
-): Promise<string | null> {
-  if (payload === null || triggeredById === null) return payload;
-  const kms = configuredPiiSubjectKms();
-  if (!kms) return payload;
-  return encryptPiiValueForSubject(
-    kms,
-    { kind: "user", userId: triggeredById },
-    payload,
-    { requestId: "jobs:job-run-logger" },
-    "payload",
-  );
+// Same per-subject encryption as encryptFailureError/encryptStartedPayload,
+// applied to a single value — shared so payload/message/error all go
+// through the identical erased-key fallback. A key erased right before (or
+// between) any of these callbacks must not blow up the write (status is
+// already committed by the time logs/error land): fall back to the
+// sentinel like decryptPiiValueForSubject does on the read side, instead of
+// throwing and dropping the rest of the batch — or, for onJobStart, the
+// whole run row.
+async function encryptOrSentinel(
+  kms: LocalKeyKmsAdapter,
+  subjectUserId: string,
+  value: string,
+  field: string,
+): Promise<string> {
+  try {
+    return await encryptPiiValueForSubject(
+      kms,
+      { kind: "user", userId: subjectUserId },
+      value,
+      { requestId: "jobs:job-run-logger" },
+      field,
+    );
+  } catch (e) {
+    if (!(e instanceof KeyErasedError)) throw e;
+    return PII_ERASED_SENTINEL;
+  }
 }
 
 // Same per-subject encryption as encryptStartedPayload, applied to each
@@ -74,7 +88,8 @@ async function encryptStartedPayload(
 // field name and must match the field passed to decryptStoredPii on read
 // (detail.query.ts) or decrypt fails loud. Same skip rules as the payload:
 // null subject (system/cron runs) and absent KMS (rollout mode) both stay
-// plaintext.
+// plaintext. Bounded concurrency (#2307) — unbounded Promise.all would fire
+// one getOrCreateDek per log line at once against the KMS adapter's pool.
 async function encryptLogMessages<T extends { readonly message: string }>(
   logs: readonly T[],
   triggeredById: string | null,
@@ -82,18 +97,40 @@ async function encryptLogMessages<T extends { readonly message: string }>(
   if (triggeredById === null) return [...logs];
   const kms = configuredPiiSubjectKms();
   if (!kms) return [...logs];
-  return Promise.all(
-    logs.map(async (log) => ({
-      ...log,
-      message: await encryptPiiValueForSubject(
-        kms,
-        { kind: "user", userId: triggeredById },
-        log.message,
-        { requestId: "jobs:job-run-logger" },
-        "message",
-      ),
-    })),
-  );
+  return mapWithConcurrency(logs, KMS_POOL_CONCURRENCY, async (log) => ({
+    ...log,
+    message: await encryptOrSentinel(kms, triggeredById, log.message, "message"),
+  }));
+}
+
+// Mirrors encryptFailureError for the failure-path `error` column (#2307):
+// stored alongside logs[].message under the same triggering user's DEK, so
+// a log/error pair from the same failed run decrypt together or erase
+// together.
+async function encryptFailureError(error: string, triggeredById: string | null): Promise<string> {
+  if (triggeredById === null) return error;
+  const kms = configuredPiiSubjectKms();
+  if (!kms) return error;
+  return encryptOrSentinel(kms, triggeredById, error, "error");
+}
+
+// The run-started payload can carry arbitrary user data; triggeredById
+// names its owning user. No event-PII catalog involved (#2243 removed the
+// jobRun r.defineEvent registrations, so there is nothing to catalog) —
+// the subject is known statically, so we encrypt directly. A null subject
+// (system cron runs, recipient-less triggers) stays plaintext: there is no
+// user key to shred, mirroring the previous event-pii catalog's own skip
+// rule. Absent KMS adapter stays plaintext too (rollout mode, unchanged).
+// A key already erased by the time the trigger lands (#2307) must not fail
+// the whole run-start write — sentinel like the log/error paths.
+async function encryptStartedPayload(
+  payload: string | null,
+  triggeredById: string | null,
+): Promise<string | null> {
+  if (payload === null || triggeredById === null) return payload;
+  const kms = configuredPiiSubjectKms();
+  if (!kms) return payload;
+  return encryptOrSentinel(kms, triggeredById, payload, "payload");
 }
 
 export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallbacks {
@@ -225,7 +262,11 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
         jobRunsTable,
         {
           status: "completed",
-          duration: payload.duration,
+          // Clear stale-sweep error if the run finished after being marked failed.
+          error: null,
+          // integer column — match onJobFailed's Math.round so fractional
+          // BullMQ timings don't trip Postgres integer syntax.
+          duration: Math.round(payload.duration),
           finishedAt: parseJobInstant(payload.finishedAt),
           modifiedAt: Temporal.Now.instant(),
           modifiedById: "system",
@@ -279,12 +320,13 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
           timestamp: l.timestamp.toString(),
         })),
       });
+      const encryptedError = await encryptFailureError(payload.error, triggeredById);
       await updateMany(
         db,
         jobRunsTable,
         {
           status: "failed",
-          error: payload.error,
+          error: encryptedError,
           duration: payload.duration,
           finishedAt: parseJobInstant(payload.finishedAt),
           modifiedAt: now,

package/src/jobs/web/job-run-detail-screen.tsx

@@ -83,7 +83,7 @@ export function JobRunDetailScreen(): ReactNode {
 
   if (state.kind === "loading") {
     return (
-      <FormScreenShell testId="job-run-detail-screen">
+      <FormScreenShell testId="job-run-detail-screen" maxWidth="3xl">
         <Text variant="small">{t("jobs.detail.loading")}</Text>
       </FormScreenShell>
     );
@@ -91,7 +91,7 @@ export function JobRunDetailScreen(): ReactNode {
 
   if (state.kind === "missing") {
     return (
-      <FormScreenShell testId="job-run-detail-screen">
+      <FormScreenShell testId="job-run-detail-screen" maxWidth="3xl">
         <Banner variant="error">{t("jobs.detail.missing")}</Banner>
       </FormScreenShell>
     );
@@ -99,7 +99,7 @@ export function JobRunDetailScreen(): ReactNode {
 
   if (state.kind === "error") {
     return (
-      <FormScreenShell testId="job-run-detail-screen">
+      <FormScreenShell testId="job-run-detail-screen" maxWidth="3xl">
         <Banner variant="error">{state.message}</Banner>
       </FormScreenShell>
     );
@@ -108,7 +108,7 @@ export function JobRunDetailScreen(): ReactNode {
   const { run } = state;
 
   return (
-    <FormScreenShell testId="job-run-detail-screen" className="flex flex-col gap-6">
+    <FormScreenShell testId="job-run-detail-screen" maxWidth="3xl" className="flex flex-col gap-6">
       <Card slots={{ title: run.jobName }}>
         <dl className="grid gap-3 text-sm">
           <div>

package/src/mail-transport-smtp/feature.ts

@@ -62,9 +62,8 @@ export const mailTransportSmtpFeature = defineFeature(FEATURE_NAME, (r) => {
 
   // Provider-secret. Sensitive: redact-helper for admin-UI display.
   const password = r.secret("smtp.password", {
-    label: { de: "SMTP-Passwort", en: "SMTP password" },
+    label: { en: "SMTP password" },
     hint: {
-      de: "Login-Passwort am SMTP-Server. Bei Brevo/Postmark/SES heißt es 'API key' bzw. 'SMTP credentials'.",
       en: "Login password at the SMTP server. Brevo/Postmark/SES call it 'API key' or 'SMTP credentials'.",
     },
     redact: (plaintext) => {

package/src/notes-history/__tests__/notes-history.integration.test.ts

@@ -109,7 +109,8 @@ describe("notes-history integration — add + list", () => {
     // Same guard as authorId above: addNotePayloadSchema doesn't accept an
     // authorName field, so a smuggled value never survives to the write —
     // the name (once stamped) can only come from the caller's own session.
-    expect(rows[0]?.["authorName"]).not.toBe("Fake Display Name");
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.["authorName"]).toBeNull();
   });
 
   test("multiple notes on the same entity accumulate — nothing overwrites", async () => {

package/src/notes-history/__tests__/notes-section.test.tsx

@@ -58,6 +58,8 @@ const AUTHOR_NAME = "Jamie Vance";
 const INSERTED_AT = "2026-08-21T12:28:41.580Z";
 const NOTE_BODY = "Vertragsunterlagen per Post verschickt.";
 
+const PII_ERASED_SENTINEL = "[[erased]]";
+
 const NOTE_ROWS: readonly NoteRowFixture[] = [
   {
     id: "note-1",
@@ -77,6 +79,15 @@ const NOTE_ROWS: readonly NoteRowFixture[] = [
     body: "Legacy entry predating authorName.",
     insertedAt: "2026-07-01T09:00:00.000Z",
   },
+  {
+    id: "note-3",
+    entityType: "contact",
+    entityId: "contact-1",
+    authorId: "03c2466d-9314-98a6-a761-a5827a611301",
+    authorName: PII_ERASED_SENTINEL,
+    body: "Note whose author was crypto-shredded.",
+    insertedAt: "2026-06-15T08:00:00.000Z",
+  },
 ];
 
 function makeDispatcher(): Dispatcher {
@@ -146,7 +157,7 @@ describe("NotesSection — entry display", () => {
     expect(metaEl.textContent).toContain(AUTHOR_NAME);
   });
 
-  test("a null authorName (legacy row, or shredded author) renders the placeholder", async () => {
+  test("a null authorName (legacy row) renders the placeholder", async () => {
     const view = renderSection();
     await waitFor(() => {
       if (view.queryByTestId("notes-section-row-note-2-meta") === null) {
@@ -157,6 +168,18 @@ describe("NotesSection — entry display", () => {
     expect(metaEl.textContent).toContain("Unknown author");
   });
 
+  test("a shredded authorName sentinel renders the placeholder, never [[erased]]", async () => {
+    const view = renderSection();
+    await waitFor(() => {
+      if (view.queryByTestId("notes-section-row-note-3-meta") === null) {
+        throw new Error("row not rendered yet");
+      }
+    });
+    const metaEl = view.getByTestId("notes-section-row-note-3-meta");
+    expect(metaEl.textContent).toContain("Unknown author");
+    expect(metaEl.textContent).not.toContain(PII_ERASED_SENTINEL);
+  });
+
   test("date renders formatted, never the raw ISO timestamp", async () => {
     const view = renderSection();
     await waitFor(() => {

package/src/notes-history/handlers/add-note.write.ts

@@ -1,4 +1,4 @@
-import { fetchOne, runInSavepoint } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { decryptStoredPii } from "../../shared";
 import { userTable } from "../../user";
@@ -26,14 +26,18 @@ export function createAddNoteHandler(
         // read_users is tenant-agnostic → ctx.db.raw, not the tenant-scoped ctx.db.
         // Bun.SQL poisons the whole tx after any error inside it, even one that's
         // caught — a bare try/catch here would take the note write down with it.
-        authorName = await runInSavepoint(ctx.db.raw, async (sp) => {
+        authorName = await runInSavepointIfSupported(ctx.db.raw, async (sp) => {
           const userRow = await fetchOne<{ displayName: string | null }>(sp, userTable, {
             id: event.user.id,
           });
           if (!userRow?.displayName) return null;
           return decryptStoredPii(userRow.displayName, "displayName", "notes-history:add-note");
         });
-      } catch {
+      } catch (e) {
+        ctx.log?.warn("notes-history: authorName lookup failed", {
+          error: e,
+          userId: event.user.id,
+        });
         authorName = null;
       }
 

package/src/notes-history/web/notes-section.tsx

@@ -26,11 +26,19 @@ type NoteRow = {
   readonly entityType: string;
   readonly entityId: string;
   readonly authorId: string;
-  // Null for pre-authorName history and for shredded authors.
+  // Null for pre-authorName history; shredded authors arrive as PII_ERASED_SENTINEL.
   readonly authorName: string | null;
   readonly body: string;
   readonly insertedAt: string;
 };
+
+// Matches @cosmicdrift/kumiko-framework/crypto PII_ERASED_SENTINEL — cannot
+// import that module from @runtime client (runtime-isolation).
+const PII_ERASED_SENTINEL = "[[erased]]";
+
+function displayAuthorName(authorName: string | null, unknownLabel: string): string {
+  return authorName && authorName !== PII_ERASED_SENTINEL ? authorName : unknownLabel;
+}
 type NoteListResponse = { readonly rows: readonly NoteRow[] };
 
 export function NotesSection({
@@ -144,7 +152,7 @@ export function NotesSection({
               <Text testId={`notes-section-row-${n.id}-body`}>{n.body}</Text>
               <Text variant="small" testId={`notes-section-row-${n.id}-meta`}>
                 {t("notesHistory.section.meta", {
-                  author: n.authorName ?? t("notesHistory.section.authorUnknown"),
+                  author: displayAuthorName(n.authorName, t("notesHistory.section.authorUnknown")),
                   date: formatWhen(n.insertedAt),
                 })}
               </Text>

package/src/secrets/__tests__/access-options-precedence.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, test } from "bun:test";
+import { createSecretsFeature } from "../feature";
+
+describe("createSecretsFeature access/roles precedence", () => {
+  test("roles-only adopts the host role vocabulary", () => {
+    expect(() => createSecretsFeature({ roles: ["Admin"] })).not.toThrow();
+  });
+
+  test("access-only is accepted", () => {
+    expect(() => createSecretsFeature({ access: { openToAll: true } })).not.toThrow();
+  });
+
+  test("access + roles together fail fast", () => {
+    expect(() => createSecretsFeature({ access: { openToAll: true }, roles: ["Admin"] })).toThrow(
+      /either `access` or `roles`/,
+    );
+  });
+});

package/src/secrets/__tests__/access-options.integration.test.ts

@@ -77,12 +77,22 @@ describe("secrets — roles option (#2296)", () => {
   });
 
   test("the framework-default TenantAdmin role is denied once `roles` overrides it", async () => {
-    const denied = await stack.http.writeErr(
+    const deniedSet = await stack.http.writeErr(
       "secrets:write:set",
       { key: "api.key.denied", value: "x" },
       admin,
     );
-    expect(denied.code).toBe("access_denied");
+    expect(deniedSet.code).toBe("access_denied");
+
+    const deniedList = await stack.http.queryErr("secrets:query:list", {}, admin);
+    expect(deniedList.code).toBe("access_denied");
+
+    const deniedDelete = await stack.http.writeErr(
+      "secrets:write:delete",
+      { key: "api.key.denied" },
+      admin,
+    );
+    expect(deniedDelete.code).toBe("access_denied");
   });
 });
 

package/src/secrets/feature.ts

@@ -96,14 +96,21 @@ export type SecretsFeatureOptions = {
    *  user manage secrets — note this is a much larger blast radius than the
    *  default: tenant credentials (API keys, tokens) become writable/deletable,
    *  and their previews/hints listable, by every tenant member, not just
-   *  admins. Takes precedence over `roles`. The `rotate` job is unaffected —
+   *  admins. Mutually exclusive with `roles`. The `rotate` job is unaffected —
    *  it's a manual, cross-tenant ops path, not per-tenant RBAC. */
   readonly access?: AccessRule;
-  /** Shorthand for { access: { roles } }. Ignored when `access` is set. */
+  /** Shorthand for { access: { roles } }. Mutually exclusive with `access`. */
   readonly roles?: readonly string[];
 };
 
 function resolveSecretsAccess(opts: SecretsFeatureOptions): AccessRule {
+  if (opts.access !== undefined && opts.roles !== undefined) {
+    throw new InternalError({
+      message:
+        "createSecretsFeature: pass either `access` or `roles`, not both — " +
+        "`access` previously silently discarded `roles`, which looks like a refinement.",
+    });
+  }
   if (opts.access !== undefined) return opts.access;
   if (opts.roles !== undefined) return { roles: opts.roles };
   return DEFAULT_SECRETS_ACCESS;

package/src/secrets/handlers/delete.write.ts

@@ -21,7 +21,3 @@ export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS)
     },
   });
 }
-
-// Backwards-compat: existing imports of `deleteWrite` keep working —
-// identical to createDeleteHandler() with the default access.
-export const deleteWrite = createDeleteHandler();

package/src/secrets/handlers/list.query.ts

@@ -38,7 +38,3 @@ export function createListHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
     },
   });
 }
-
-// Backwards-compat: existing imports of `listQuery` keep working — identical
-// to createListHandler() with the default access.
-export const listQuery = createListHandler();

package/src/secrets/handlers/set.write.ts

@@ -44,10 +44,6 @@ export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
   });
 }
 
-// Backwards-compat: existing imports of `setWrite` keep working — identical
-// to createSetHandler() with the default access.
-export const setWrite = createSetHandler();
-
 // Fallback redaction: show at most the first 3 chars + trailing bullets.
 // Deliberately conservative — a too-generous preview defeats the point.
 function defaultRedact(value: string): string {

package/src/secrets/index.ts

@@ -13,11 +13,11 @@ export {
   TENANT_SECRET_READ_EVENT,
   tenantSecretsTable,
 } from "./feature";
-export { createDeleteHandler, deleteWrite } from "./handlers/delete.write";
-export { createListHandler, listQuery } from "./handlers/list.query";
+export { createDeleteHandler } from "./handlers/delete.write";
+export { createListHandler } from "./handlers/list.query";
 export {
   type RotateJobPayload,
   type RotateJobResult,
   rotateJob,
 } from "./handlers/rotate.job";
-export { createSetHandler, setWrite } from "./handlers/set.write";
+export { createSetHandler } from "./handlers/set.write";

package/src/shared/index.ts

@@ -16,6 +16,7 @@ export { isWithinGracePeriod } from "./grace-period";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
 export { mapWithConcurrency } from "./map-with-concurrency";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
+export { sessionField } from "./session-field";
 export { sessionLocaleField } from "./session-locale-field";
 export { sessionTimezoneField } from "./session-timezone-field";
 export type { SystemQueryFn } from "./system-query";

package/src/shared/map-with-concurrency.test.ts

@@ -44,7 +44,7 @@ describe("mapWithConcurrency", () => {
   // `mapWithConcurrency` call already settled on the first one.
   test("a second rejection after the first doesn't surface as an unhandled rejection", async () => {
     const unhandled: unknown[] = [];
-    const onUnhandledRejection = (reason: unknown): void => {
+    const onUnhandledRejection = (reason: unknown, _promise: Promise<unknown>): void => {
       unhandled.push(reason);
     };
     process.on("unhandledRejection", onUnhandledRejection);
@@ -68,7 +68,7 @@ describe("mapWithConcurrency", () => {
       // for a real unhandled rejection (if any) to fire.
       await new Promise((resolve) => setTimeout(resolve, 50));
     } finally {
-      process.off("unhandledRejection" as never, onUnhandledRejection);
+      process.off("unhandledRejection", onUnhandledRejection);
     }
     expect(unhandled).toEqual([]);
   });

package/src/shared/session-field.ts

@@ -0,0 +1,10 @@
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+
+/** Omit null/undefined session keys so callers can spread without wiping defaults. */
+export function sessionField<K extends "locale" | "timezone">(
+  key: K,
+  value: string | null | undefined,
+): Partial<Pick<SessionUser, K>> {
+  if (value === null || value === undefined) return {};
+  return { [key]: value } as Pick<SessionUser, K>;
+}

package/src/shared/session-locale-field.test.ts

@@ -6,6 +6,15 @@ describe("sessionLocaleField", () => {
     expect(sessionLocaleField("de-DE")).toEqual({ locale: "de-DE" });
   });
 
+  test("canonicalizes primary subtag", () => {
+    expect(sessionLocaleField("DE")).toEqual({ locale: "de" });
+    expect(sessionLocaleField("DE-at")).toEqual({ locale: "de-at" });
+  });
+
+  test("rejects malformed locale tags", () => {
+    expect(sessionLocaleField('"><img sr')).toEqual({});
+  });
+
   test("null locale → empty object", () => {
     expect(sessionLocaleField(null)).toEqual({});
   });

package/src/shared/session-locale-field.ts

@@ -1,7 +1,10 @@
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
+import { sessionField } from "./session-field";
 
 export function sessionLocaleField(
   locale: string | null | undefined,
 ): Pick<SessionUser, "locale"> | Record<string, never> {
-  return locale !== null && locale !== undefined ? { locale } : {};
+  if (locale === null || locale === undefined || !isValidLocaleTag(locale)) return {};
+  return sessionField("locale", canonicalizeLocaleTag(locale));
 }

package/src/shared/session-timezone-field.ts

@@ -1,7 +1,8 @@
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { sessionField } from "./session-field";
 
 export function sessionTimezoneField(
   timezone: string | null | undefined,
 ): Pick<SessionUser, "timezone"> | Record<string, never> {
-  return timezone !== null && timezone !== undefined ? { timezone } : {};
+  return sessionField("timezone", timezone);
 }

package/src/subscription-stripe/feature.ts

@@ -163,17 +163,11 @@ export function createSubscriptionStripeFeature(
 
     r.translations({
       keys: {
-        "subscription-stripe.api-key": { de: "Stripe API Key", en: "Stripe API Key" },
-        "subscription-stripe.webhook-secret": {
-          de: "Stripe Webhook Secret",
-          en: "Stripe Webhook Secret",
-        },
-        "subscription-stripe.billing-live": {
-          de: "Stripe Billing live",
-          en: "Stripe Billing Live",
-        },
-        "subscription-stripe.settings": { de: "Stripe", en: "Stripe" },
-        "screen:subscription-stripe-system.title": { de: "Stripe", en: "Stripe" },
+        "subscription-stripe.api-key": { en: "Stripe API Key" },
+        "subscription-stripe.webhook-secret": { en: "Stripe Webhook Secret" },
+        "subscription-stripe.billing-live": { en: "Stripe Billing Live" },
+        "subscription-stripe.settings": { en: "Stripe" },
+        "screen:subscription-stripe-system.title": { en: "Stripe" },
       },
     });
 

package/src/tags/__tests__/feature.test.ts

@@ -48,7 +48,7 @@ function rawQueryAccess(feature: ReturnType<typeof createTagsFeature>, nameMatch
 }
 
 describe("createTagsFeature shape", () => {
-  test("registers tag + tag-assignment entities, 5 write-handlers, 2 query-handlers", () => {
+  test("registers tag + tag-assignment entities, legacy + convention CRUD handlers", () => {
     const feature = createTagsFeature();
 
     expect(Object.keys(feature.entities ?? {})).toEqual(
@@ -62,17 +62,21 @@ describe("createTagsFeature shape", () => {
         expect.stringMatching(/delete-tag/),
         expect.stringMatching(/assign-tag/),
         expect.stringMatching(/remove-tag/),
+        "tag:create",
+        "tag:update",
+        "tag:delete",
       ]),
     );
-    expect(Object.keys(feature.writeHandlers)).toHaveLength(5);
+    expect(Object.keys(feature.writeHandlers)).toHaveLength(8);
 
     expect(Object.keys(feature.queryHandlers)).toEqual(
       expect.arrayContaining([
         expect.stringMatching(/tag:list/),
         expect.stringMatching(/tag-assignment:list/),
+        "tag:detail",
       ]),
     );
-    expect(Object.keys(feature.queryHandlers)).toHaveLength(2);
+    expect(Object.keys(feature.queryHandlers)).toHaveLength(3);
   });
 });
 
@@ -102,10 +106,19 @@ describe("createTagsFeature access-options", () => {
 
   test("access:{openToAll} applies to every write- and query-path", () => {
     const feature = createTagsFeature({ access: { openToAll: true } });
-    for (const path of ["create-tag", "update-tag", "delete-tag", "assign-tag", "remove-tag"]) {
+    for (const path of [
+      "create-tag",
+      "update-tag",
+      "delete-tag",
+      "tag:create",
+      "tag:update",
+      "tag:delete",
+      "assign-tag",
+      "remove-tag",
+    ]) {
       expect(rawWriteAccess(feature, path)).toEqual({ openToAll: true });
     }
-    for (const query of ["tag:list", "tag-assignment:list"]) {
+    for (const query of ["tag:list", "tag:detail", "tag-assignment:list"]) {
       expect(rawQueryAccess(feature, query)).toEqual({ openToAll: true });
     }
   });