@cosmicdrift/kumiko-bundled-features 0.220.1 → 0.221.0

package/src/notes-history/handlers/add-note.write.ts

@@ -1,4 +1,4 @@
-import { fetchOne, runInSavepoint } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { decryptStoredPii } from "../../shared";
 import { userTable } from "../../user";
@@ -26,14 +26,18 @@ export function createAddNoteHandler(
         // read_users is tenant-agnostic → ctx.db.raw, not the tenant-scoped ctx.db.
         // Bun.SQL poisons the whole tx after any error inside it, even one that's
         // caught — a bare try/catch here would take the note write down with it.
-        authorName = await runInSavepoint(ctx.db.raw, async (sp) => {
+        authorName = await runInSavepointIfSupported(ctx.db.raw, async (sp) => {
           const userRow = await fetchOne<{ displayName: string | null }>(sp, userTable, {
             id: event.user.id,
           });
           if (!userRow?.displayName) return null;
           return decryptStoredPii(userRow.displayName, "displayName", "notes-history:add-note");
         });
-      } catch {
+      } catch (e) {
+        ctx.log?.warn("notes-history: authorName lookup failed", {
+          error: e,
+          userId: event.user.id,
+        });
         authorName = null;
       }
 

package/src/notes-history/web/notes-section.tsx

@@ -26,11 +26,19 @@ type NoteRow = {
   readonly entityType: string;
   readonly entityId: string;
   readonly authorId: string;
-  // Null for pre-authorName history and for shredded authors.
+  // Null for pre-authorName history; shredded authors arrive as PII_ERASED_SENTINEL.
   readonly authorName: string | null;
   readonly body: string;
   readonly insertedAt: string;
 };
+
+// Matches @cosmicdrift/kumiko-framework/crypto PII_ERASED_SENTINEL — cannot
+// import that module from @runtime client (runtime-isolation).
+const PII_ERASED_SENTINEL = "[[erased]]";
+
+function displayAuthorName(authorName: string | null, unknownLabel: string): string {
+  return authorName && authorName !== PII_ERASED_SENTINEL ? authorName : unknownLabel;
+}
 type NoteListResponse = { readonly rows: readonly NoteRow[] };
 
 export function NotesSection({
@@ -144,7 +152,7 @@ export function NotesSection({
               <Text testId={`notes-section-row-${n.id}-body`}>{n.body}</Text>
               <Text variant="small" testId={`notes-section-row-${n.id}-meta`}>
                 {t("notesHistory.section.meta", {
-                  author: n.authorName ?? t("notesHistory.section.authorUnknown"),
+                  author: displayAuthorName(n.authorName, t("notesHistory.section.authorUnknown")),
                   date: formatWhen(n.insertedAt),
                 })}
               </Text>

package/src/secrets/__tests__/access-options-precedence.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, test } from "bun:test";
+import { createSecretsFeature } from "../feature";
+
+describe("createSecretsFeature access/roles precedence", () => {
+  test("roles-only adopts the host role vocabulary", () => {
+    expect(() => createSecretsFeature({ roles: ["Admin"] })).not.toThrow();
+  });
+
+  test("access-only is accepted", () => {
+    expect(() => createSecretsFeature({ access: { openToAll: true } })).not.toThrow();
+  });
+
+  test("access + roles together fail fast", () => {
+    expect(() => createSecretsFeature({ access: { openToAll: true }, roles: ["Admin"] })).toThrow(
+      /either `access` or `roles`/,
+    );
+  });
+});

package/src/secrets/__tests__/access-options.integration.test.ts

@@ -77,12 +77,22 @@ describe("secrets — roles option (#2296)", () => {
   });
 
   test("the framework-default TenantAdmin role is denied once `roles` overrides it", async () => {
-    const denied = await stack.http.writeErr(
+    const deniedSet = await stack.http.writeErr(
       "secrets:write:set",
       { key: "api.key.denied", value: "x" },
       admin,
     );
-    expect(denied.code).toBe("access_denied");
+    expect(deniedSet.code).toBe("access_denied");
+
+    const deniedList = await stack.http.queryErr("secrets:query:list", {}, admin);
+    expect(deniedList.code).toBe("access_denied");
+
+    const deniedDelete = await stack.http.writeErr(
+      "secrets:write:delete",
+      { key: "api.key.denied" },
+      admin,
+    );
+    expect(deniedDelete.code).toBe("access_denied");
   });
 });
 

package/src/secrets/feature.ts

@@ -96,14 +96,21 @@ export type SecretsFeatureOptions = {
    *  user manage secrets — note this is a much larger blast radius than the
    *  default: tenant credentials (API keys, tokens) become writable/deletable,
    *  and their previews/hints listable, by every tenant member, not just
-   *  admins. Takes precedence over `roles`. The `rotate` job is unaffected —
+   *  admins. Mutually exclusive with `roles`. The `rotate` job is unaffected —
    *  it's a manual, cross-tenant ops path, not per-tenant RBAC. */
   readonly access?: AccessRule;
-  /** Shorthand for { access: { roles } }. Ignored when `access` is set. */
+  /** Shorthand for { access: { roles } }. Mutually exclusive with `access`. */
   readonly roles?: readonly string[];
 };
 
 function resolveSecretsAccess(opts: SecretsFeatureOptions): AccessRule {
+  if (opts.access !== undefined && opts.roles !== undefined) {
+    throw new InternalError({
+      message:
+        "createSecretsFeature: pass either `access` or `roles`, not both — " +
+        "`access` previously silently discarded `roles`, which looks like a refinement.",
+    });
+  }
   if (opts.access !== undefined) return opts.access;
   if (opts.roles !== undefined) return { roles: opts.roles };
   return DEFAULT_SECRETS_ACCESS;

package/src/shared/index.ts

@@ -16,6 +16,7 @@ export { isWithinGracePeriod } from "./grace-period";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
 export { mapWithConcurrency } from "./map-with-concurrency";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
+export { sessionField } from "./session-field";
 export { sessionLocaleField } from "./session-locale-field";
 export { sessionTimezoneField } from "./session-timezone-field";
 export type { SystemQueryFn } from "./system-query";

package/src/shared/map-with-concurrency.test.ts

@@ -44,7 +44,7 @@ describe("mapWithConcurrency", () => {
   // `mapWithConcurrency` call already settled on the first one.
   test("a second rejection after the first doesn't surface as an unhandled rejection", async () => {
     const unhandled: unknown[] = [];
-    const onUnhandledRejection = (reason: unknown): void => {
+    const onUnhandledRejection = (reason: unknown, _promise: Promise<unknown>): void => {
       unhandled.push(reason);
     };
     process.on("unhandledRejection", onUnhandledRejection);
@@ -68,7 +68,7 @@ describe("mapWithConcurrency", () => {
       // for a real unhandled rejection (if any) to fire.
       await new Promise((resolve) => setTimeout(resolve, 50));
     } finally {
-      process.off("unhandledRejection" as never, onUnhandledRejection);
+      process.off("unhandledRejection", onUnhandledRejection);
     }
     expect(unhandled).toEqual([]);
   });

package/src/shared/session-field.ts

@@ -0,0 +1,10 @@
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+
+/** Omit null/undefined session keys so callers can spread without wiping defaults. */
+export function sessionField<K extends "locale" | "timezone">(
+  key: K,
+  value: string | null | undefined,
+): Partial<Pick<SessionUser, K>> {
+  if (value === null || value === undefined) return {};
+  return { [key]: value } as Pick<SessionUser, K>;
+}

package/src/shared/session-locale-field.test.ts

@@ -6,6 +6,15 @@ describe("sessionLocaleField", () => {
     expect(sessionLocaleField("de-DE")).toEqual({ locale: "de-DE" });
   });
 
+  test("canonicalizes primary subtag", () => {
+    expect(sessionLocaleField("DE")).toEqual({ locale: "de" });
+    expect(sessionLocaleField("DE-at")).toEqual({ locale: "de-at" });
+  });
+
+  test("rejects malformed locale tags", () => {
+    expect(sessionLocaleField('"><img sr')).toEqual({});
+  });
+
   test("null locale → empty object", () => {
     expect(sessionLocaleField(null)).toEqual({});
   });

package/src/shared/session-locale-field.ts

@@ -1,7 +1,10 @@
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
+import { sessionField } from "./session-field";
 
 export function sessionLocaleField(
   locale: string | null | undefined,
 ): Pick<SessionUser, "locale"> | Record<string, never> {
-  return locale !== null && locale !== undefined ? { locale } : {};
+  if (locale === null || locale === undefined || !isValidLocaleTag(locale)) return {};
+  return sessionField("locale", canonicalizeLocaleTag(locale));
 }

package/src/shared/session-timezone-field.ts

@@ -1,7 +1,8 @@
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { sessionField } from "./session-field";
 
 export function sessionTimezoneField(
   timezone: string | null | undefined,
 ): Pick<SessionUser, "timezone"> | Record<string, never> {
-  return timezone !== null && timezone !== undefined ? { timezone } : {};
+  return sessionField("timezone", timezone);
 }

package/src/subscription-stripe/feature.ts

@@ -163,17 +163,11 @@ export function createSubscriptionStripeFeature(
 
     r.translations({
       keys: {
-        "subscription-stripe.api-key": { de: "Stripe API Key", en: "Stripe API Key" },
-        "subscription-stripe.webhook-secret": {
-          de: "Stripe Webhook Secret",
-          en: "Stripe Webhook Secret",
-        },
-        "subscription-stripe.billing-live": {
-          de: "Stripe Billing live",
-          en: "Stripe Billing Live",
-        },
-        "subscription-stripe.settings": { de: "Stripe", en: "Stripe" },
-        "screen:subscription-stripe-system.title": { de: "Stripe", en: "Stripe" },
+        "subscription-stripe.api-key": { en: "Stripe API Key" },
+        "subscription-stripe.webhook-secret": { en: "Stripe Webhook Secret" },
+        "subscription-stripe.billing-live": { en: "Stripe Billing Live" },
+        "subscription-stripe.settings": { en: "Stripe" },
+        "screen:subscription-stripe-system.title": { en: "Stripe" },
       },
     });
 

package/src/tags/feature.ts

@@ -22,6 +22,7 @@ import {
   type AccessRule,
   defineEntityDetailHandler,
   defineEntityListHandler,
+  defineEntityUpdateHandler,
   defineFeature,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -49,7 +50,7 @@ function registerTags(
   toggleable: TagsToggleable | undefined,
 ): void {
   r.describe(
-    "Generic, host-agnostic tagging for any entity. Owns two event-sourced entities — the per-tenant `tag` catalog (`read_tags`, with optional `color` and `scope`) and `tag-assignment` join rows keyed by (entityType, entityId) (`read_tag_assignments`) — so tagging adds NO column to the host entity and needs no relational pivot or JOIN. Provides write-handlers `create-tag`, `update-tag` (optimistic-locked rename/recolor/re-scope), `delete-tag` (cascades over assignments), `assign-tag` (idempotent), `remove-tag` (idempotent) and list queries for the catalog and the assignments. Read which tags an entity has, or which entities carry a tag, by listing `tag-assignment` filtered on `entityId` or `tagId` and composing in the read-layer. A tag with empty `scope` is global; a `scope` of an entityType restricts it to that type in the picker. Every path uses one access rule — adopt the host's model with createTagsFeature({ access: { openToAll: true } }) or pin roles with createTagsFeature({ roles }). Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).",
+    "Generic, host-agnostic tagging for any entity. Owns two event-sourced entities — the per-tenant `tag` catalog (`read_tags`, with optional `color` and `scope`) and `tag-assignment` join rows keyed by (entityType, entityId) (`read_tag_assignments`) — so tagging adds NO column to the host entity and needs no relational pivot or JOIN. Catalog screens are declarative (`entityList` + `entityEdit`) and use convention QNs `tag:{create,update,delete}`; TagManager/TagPicker keep `create-tag`/`update-tag`/`delete-tag`. Also: `assign-tag` (idempotent), `remove-tag` (idempotent) and list queries for the catalog and the assignments. Read which tags an entity has, or which entities carry a tag, by listing `tag-assignment` filtered on `entityId` or `tagId` and composing in the read-layer. A tag with empty `scope` is global; a `scope` of an entityType restricts it to that type in the picker. Every path uses one access rule — adopt the host's model with createTagsFeature({ access: { openToAll: true } }) or pin roles with createTagsFeature({ roles }). Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).",
   );
   r.uiHints({
     displayLabel: "Tags",
@@ -70,10 +71,12 @@ function registerTags(
   r.writeHandler(createAssignTagHandler(access));
   r.writeHandler(createRemoveTagHandler(access));
 
-  // Convention aliases for entityList/entityEdit — same bodies as the legacy
-  // create-tag/update-tag/delete-tag QNs (TagManager/TagPicker keep those).
+  // Convention aliases for entityList/entityEdit — create stays flat-payload
+  // (payloadMode=values); update must accept the {id,version,changes} envelope
+  // entityEdit sends (legacy update-tag stays for TagManager). delete stays
+  // legacy so assignment cascade is preserved (convention delete would orphan).
   r.writeHandler(createCreateTagHandler(access, "tag:create"));
-  r.writeHandler(createUpdateTagHandler(access, "tag:update"));
+  r.writeHandler(defineEntityUpdateHandler("tag", tagEntity, { access }));
   r.writeHandler(createDeleteTagHandler(access, "tag:delete"));
 
   r.queryHandler(defineEntityListHandler("tag", tagEntity, { access }));

package/src/template-resolver/__tests__/seed-legal-content.integration.test.ts

@@ -14,7 +14,12 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import { TEXT_BLOCK_KIND } from "../constants";
 import { createTemplateResolverFeature } from "../feature";
-import { type LegalContentBlock, seedLegalContentFromJson } from "../seeding";
+import {
+  type LegalContentBlock,
+  type SeedSystemTemplateOptions,
+  seedLegalContentFromJson,
+  seedSystemTemplate,
+} from "../seeding";
 import { type TemplateResourceRow, templateResourceEntity, templateResourcesTable } from "../table";
 
 // Pins seedLegalContentFromJson: seeds into SYSTEM_TENANT_ID by default and
@@ -44,6 +49,15 @@ function read(slug: string, locale: string) {
   });
 }
 
+function readSystemTemplate(slug: string, locale: string, kind: SeedSystemTemplateOptions["kind"]) {
+  return fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+    tenantId: SYSTEM_TENANT_ID,
+    slug,
+    kind,
+    locale,
+  });
+}
+
 describe("seedLegalContentFromJson", () => {
   test("seeds all blocks into SYSTEM_TENANT_ID as SYSTEM_USER", async () => {
     const blocks: LegalContentBlock[] = [
@@ -82,6 +96,30 @@ describe("seedLegalContentFromJson", () => {
     expect(row.modifiedById).toBe(SYSTEM_USER_ID);
   });
 
+  test("re-seed of a healthy row (existing events) keeps id and appends, does not delete+recreate", async () => {
+    await seedLegalContentFromJson(db, [
+      { slug: "healthy-block", locale: "de", title: "Titel", content: "v1" },
+    ]);
+    const before = await read("healthy-block", "de");
+    expect(before).not.toBeNull();
+    const eventsBefore = await selectMany(db, eventsTable, { aggregateId: String(before!.id) });
+    expect(eventsBefore.map((e) => e.type)).toEqual(["template-resource.created"]);
+
+    await seedLegalContentFromJson(db, [
+      { slug: "healthy-block", locale: "de", title: "Titel", content: "v2" },
+    ]);
+
+    const after = await read("healthy-block", "de");
+    expect(after).not.toBeNull();
+    expect(after!.id).toBe(before!.id);
+    expect(after).toMatchObject({ content: "v2" });
+
+    const eventsAfter = await selectMany(db, eventsTable, { aggregateId: String(before!.id) });
+    expect(eventsAfter.filter((e) => e.type === "template-resource.created")).toHaveLength(1);
+    expect(eventsAfter.filter((e) => e.type === "template-resource.updated")).toHaveLength(1);
+    expect(eventsAfter).toHaveLength(2);
+  });
+
   test("orphan projection (row without events) is recreated on ifExists:update", async () => {
     await seedLegalContentFromJson(db, [
       { slug: "orphan-privacy", locale: "de", title: "DS", content: "old" },
@@ -108,6 +146,31 @@ describe("seedLegalContentFromJson", () => {
     expect(events.some((e) => e.type === "template-resource.created")).toBe(true);
   });
 
+  test("orphan projection (row without events) is recreated on ifExists:update — seedSystemTemplate path", async () => {
+    const opts: SeedSystemTemplateOptions = {
+      slug: "orphan-notification",
+      kind: "notification",
+      locale: "de",
+      content: "old",
+      contentFormat: "plain",
+      ifExists: "update",
+    };
+    await seedSystemTemplate(db, opts);
+    const before = await readSystemTemplate(opts.slug, opts.locale, opts.kind);
+    expect(before).not.toBeNull();
+
+    // Same desync as prod: projection left behind, event stream empty.
+    await deleteMany(db, eventsTable, { aggregateId: String(before!.id) });
+    expect(await readSystemTemplate(opts.slug, opts.locale, opts.kind)).not.toBeNull();
+
+    await seedSystemTemplate(db, { ...opts, content: "new from template" });
+    const after = await readSystemTemplate(opts.slug, opts.locale, opts.kind);
+    expect(after).toMatchObject({ content: "new from template" });
+    const events2 = await selectMany(db, eventsTable, { aggregateId: String(after!.id) });
+    expect(events2.length).toBeGreaterThan(0);
+    expect(events2.some((e) => e.type === "template-resource.created")).toBe(true);
+  });
+
   test("identical re-seed is a no-op (no update event, version/modifiedAt stable)", async () => {
     const blocks: LegalContentBlock[] = [
       { slug: "terms", locale: "de", title: "AGB", content: "stable" },

package/src/template-resolver/seeding.ts

@@ -15,6 +15,7 @@ import {
   type DbConnection,
   deleteMany,
   type EntityTableMeta,
+  type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
@@ -22,18 +23,19 @@ import {
   SYSTEM_TENANT_ID,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { getStreamVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  getStreamVersion,
+  getUnscopedStreamMaxVersionForSeed,
+} from "@cosmicdrift/kumiko-framework/event-store";
 import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
 import { type ContentFormat, TEXT_BLOCK_KIND, type UpsertKind } from "./constants";
 import { executor } from "./handlers/shared";
 import { type TemplateResourceRow, templateResourcesTable } from "./table";
 
-/** Projection row without events — update() would 409 (expectedVersion from
- *  projection, stream currentVersion=0). Drop the orphan and treat as create
- *  so boot seeds (legal ifExists:update) survive desync. Stream version is the
- *  optimistic-lock source of truth when events exist. */
+/** Drop projection orphans (no events anywhere) so boot seeds can recreate. */
 async function resolveExistingForEventStoreSeed(
   db: DbConnection,
+  tdb: TenantDb,
   existingRow: { readonly id: string | number; readonly version: number } | null,
   tenantId: TenantId,
 ): Promise<{ id: string; version: number } | null> {
@@ -41,7 +43,17 @@ async function resolveExistingForEventStoreSeed(
   const id = String(existingRow.id);
   const streamVersion = await getStreamVersion(db, id, tenantId);
   if (streamVersion === 0) {
-    await deleteMany(db, templateResourcesTable as EntityTableMeta, { id });
+    // Tenant-scoped 0 can still hide a live stream under another tenant —
+    // only delete when unscoped is also empty (true orphan).
+    const unscoped = await getUnscopedStreamMaxVersionForSeed(db, id);
+    if (unscoped !== 0) {
+      throw new Error(
+        `seed orphan check: projection ${id} has no events for tenant ${tenantId} but unscoped stream version is ${unscoped} — refusing delete/recreate to avoid wiping a live stream`,
+      );
+    }
+    // @cast-boundary orphan projection cleanup: empty stream, no executor verb;
+    // plain table ident trips guard-direct-entity-writes (infra EXCLUDE follow-up).
+    await deleteMany(tdb, templateResourcesTable as EntityTableMeta, { id, tenantId });
     return null;
   }
   return { id, version: streamVersion };
@@ -76,6 +88,7 @@ export async function seedSystemTemplate(
   });
   const existing = await resolveExistingForEventStoreSeed(
     db,
+    tdb,
     existingRow ? { id: existingRow.id, version: existingRow.version } : null,
     tenantId,
   );
@@ -105,6 +118,34 @@ export async function seedSystemTemplate(
     create: async () => {
       const result = await executor.create({ ...rowFields, tenantId }, by, tdb);
       if (!result.isSuccess) {
+        // Parallel boot pods can both delete the orphan and race on create —
+        // unique on (tenantId, slug, kind, locale) → resolve winner and update.
+        if (result.error?.code === "unique_violation") {
+          const again = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+            tenantId,
+            slug: opts.slug,
+            kind: opts.kind,
+            locale: opts.locale,
+          });
+          const resolved = await resolveExistingForEventStoreSeed(
+            db,
+            tdb,
+            again ? { id: again.id, version: again.version } : null,
+            tenantId,
+          );
+          if (resolved == null) {
+            throw new Error(`seedSystemTemplate create unique_violation but row missing`);
+          }
+          const upd = await executor.update(
+            { id: resolved.id, version: resolved.version, changes: rowFields },
+            by,
+            tdb,
+          );
+          if (!upd.isSuccess) {
+            throw new Error(`seedSystemTemplate race-update failed: ${JSON.stringify(upd)}`);
+          }
+          return { id: resolved.id };
+        }
         throw new Error(`seedSystemTemplate create failed: ${JSON.stringify(result)}`);
       }
       const data = result.data as Partial<TemplateResourceRow>;
@@ -159,6 +200,7 @@ export async function seedTextBlock(
   });
   const existing = await resolveExistingForEventStoreSeed(
     db,
+    tdb,
     existingRow ? { id: existingRow.id, version: existingRow.version } : null,
     opts.tenantId,
   );
@@ -184,6 +226,36 @@ export async function seedTextBlock(
     create: async () => {
       const result = await executor.create({ ...fields, tenantId: opts.tenantId }, by, tdb);
       if (!result.isSuccess) {
+        if (result.error?.code === "unique_violation") {
+          const again = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+            tenantId: opts.tenantId,
+            slug: opts.slug,
+            kind: TEXT_BLOCK_KIND,
+            locale: opts.locale,
+          });
+          const resolved = await resolveExistingForEventStoreSeed(
+            db,
+            tdb,
+            again ? { id: again.id, version: again.version } : null,
+            opts.tenantId,
+          );
+          if (resolved == null) {
+            throw new Error("seedTextBlock create unique_violation but row missing");
+          }
+          const upd = await executor.update(
+            {
+              id: resolved.id,
+              version: resolved.version,
+              changes: { title: fields.title, content: fields.content, folder: fields.folder },
+            },
+            by,
+            tdb,
+          );
+          if (!upd.isSuccess) {
+            throw new Error(`seedTextBlock race-update failed: ${JSON.stringify(upd)}`);
+          }
+          return { id: resolved.id };
+        }
         throw new Error(`seedTextBlock create failed: ${JSON.stringify(result)}`);
       }
       // @cast-boundary db-row — executor.create returns the inserted row from

package/src/template-resolver/web/__tests__/client-plugin.test.tsx

@@ -22,9 +22,9 @@ mock.module("@cosmicdrift/kumiko-bundled-features/auth-email-password/web", () =
   useShellUser: mock(),
 }));
 
-const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
+const actualRenderer = await import("@cosmicdrift/kumiko-renderer");
 mock.module("@cosmicdrift/kumiko-renderer", () => ({
-  ...actual_renderer,
+  ...actualRenderer,
   useDispatcher: mock(() => ({ write: mock(), query: mock() })),
   useQuery: mock(() => ({
     data: {

package/src/template-resolver/web/client-plugin.tsx

@@ -32,6 +32,7 @@ import {
   PlainContentEditor,
   RichContentEditor,
 } from "@cosmicdrift/kumiko-renderer-web";
+import type { ContentEditorFormat } from "@cosmicdrift/kumiko-types/nav";
 import { type FormEvent, type ReactNode, useEffect, useId, useState } from "react";
 import {
   collectionHandlerName,
@@ -226,7 +227,7 @@ function findCollection(
 function findContentFormat(
   features: readonly FeatureSchema[],
   collectionId?: string,
-): string | undefined {
+): ContentEditorFormat | undefined {
   return findCollection(features, collectionId)?.contentFormat;
 }
 

package/src/tenant/__tests__/members-facet-i18n.test.ts

@@ -23,7 +23,30 @@ function membersFacetLabelKeys(): readonly string[] {
   );
 }
 
+// Column labels of the members screen itself — deliberately scoped to this
+// one screen, not a generic "walk every column of every screen" helper.
+function membersColumnLabelKeys(): readonly string[] {
+  const screen = createTenantFeature().screens[MEMBERS_SCREEN_ID];
+  if (screen?.type !== "projectionList") {
+    throw new Error("expected members screen to be projectionList");
+  }
+  return screen.columns.flatMap((col) =>
+    typeof col === "string" || col.label === undefined ? [] : [col.label],
+  );
+}
+
+// Nav-menu-entry label(s) that point at the members screen — same
+// single-screen scope as the facet/column helpers above.
+function membersNavLabelKeys(): readonly string[] {
+  const feature = createTenantFeature();
+  const membersScreenTarget = `${feature.name}:screen:${MEMBERS_SCREEN_ID}`;
+  return Object.values(feature.navs)
+    .filter((nav) => nav.screen === membersScreenTarget)
+    .map((nav) => nav.label);
+}
+
 const facetKeys = membersFacetLabelKeys();
+const membersScreenI18nKeys = [...facetKeys, ...membersColumnLabelKeys(), ...membersNavLabelKeys()];
 
 const localePacks: ReadonlyArray<readonly [string, Readonly<Record<string, string>>]> = [
   ["es", localeEsBundle],
@@ -31,12 +54,21 @@ const localePacks: ReadonlyArray<readonly [string, Readonly<Record<string, strin
 ];
 
 describe("members status filter labels are localized in every shipped locale (fw#2376)", () => {
-  test("the status facet ships the keys the locale packs have to cover", () => {
-    expect(facetKeys).toEqual([
-      "tenant.members.filter.status",
-      "tenant.members.filter.status.option.active",
-      "tenant.members.filter.status.option.pending",
-    ]);
+  // A hardcoded toEqual() array here would fail with a confusing "array
+  // mismatch" the moment a facet/column/nav-label key is added to the
+  // members screen — instead of the clear "key not translated" failure a
+  // missing en copy should produce. Reading the keys off the live screen
+  // definition and checking each one resolves catches the real failure
+  // mode (fw#2376) without hardcoding an ever-growing key list.
+  test("every facet/column/nav-label key of the members screen has English copy", () => {
+    expect(membersScreenI18nKeys.length).toBeGreaterThan(0);
+    const translations = createTenantFeature().translations ?? {};
+    for (const key of membersScreenI18nKeys) {
+      const label = translations[key]?.["en"];
+      expect(label).toBeString();
+      expect(label).not.toBe(key);
+      expect((label ?? "").trim()).not.toBe("");
+    }
   });
 
   test("every facet label has English copy in the tenant feature itself", () => {