@cosmicdrift/kumiko-bundled-features 0.306.0 → 0.308.0

package/src/feature-toggles/handlers/set.write.ts

@@ -6,7 +6,7 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import {
   FEATURE_TOGGLE_AGGREGATE_TYPE,
   FEATURE_TOGGLE_CROSS_TENANT_REASON,

package/src/file-derivatives/handlers/public-variant.query.ts

@@ -28,7 +28,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
-import { z } from "zod";
+import * as z from "zod";
 
 type FileRefRow = {
   readonly entityType: string | null;

package/src/file-foundation/__tests__/file-foundation.integration.test.ts

@@ -28,7 +28,7 @@ import {
   createTestEnvelopeCipher,
   type MutableMasterKeyProvider,
 } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { createConfigFeature } from "../../config";
 import { ConfigHandlers } from "../../config/constants";
 import { createConfigAccessorFactory } from "../../config/feature";

package/src/files-tenant-data/handlers/sweep-orphaned-derivatives.job.ts

@@ -28,7 +28,7 @@ import {
   type FileStorageProvider,
   fileRefsTable,
 } from "@cosmicdrift/kumiko-framework/files";
-import { z } from "zod";
+import * as z from "zod";
 import { runChunkedMigration } from "../../shared";
 import { tenantTable } from "../../tenant";
 

package/src/folders/handlers/delete-folder.write.ts

@@ -1,6 +1,6 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { DEFAULT_FOLDER_ACCESS } from "../constants";
 import { folderAssignmentExecutor, folderExecutor } from "../executor";
 

package/src/folders/schemas.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 // set-folder + clear-folder share the (entity) reference shape; set-folder adds
 // the target folderId. Folder catalog CRUD (create/update/delete) uses the

package/src/form-draft/schemas.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_VALUES_MAX_BYTES } from "./constants";
 
 const draftKeySchema = z.string().trim().min(1).max(FORM_DRAFT_KEY_MAX_LENGTH);

package/src/inbound-mail-foundation/events.ts

@@ -19,7 +19,7 @@
 //     eraseSubjectKeys macht Event-Log UND Projection unlesbar
 //     (crypto-shredding, Muster billing-foundation #800).
 
-import { z } from "zod";
+import * as z from "zod";
 import { INBOUND_MAIL_FOUNDATION_FEATURE, InboundMailAccountStatuses } from "./constants";
 
 // Aggregate-types für den event-store.

package/src/inbound-mail-foundation/handlers/connect-account.write.ts

@@ -19,7 +19,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { InboundMailAccountStatuses, InboundMailAuthMethods } from "../constants";
 import { MAIL_ACCOUNT_PII_FIELDS, mailAccountEntity } from "../entities";
 import {

package/src/inbound-mail-foundation/handlers/disconnect-account.write.ts

@@ -9,7 +9,7 @@
 
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { InboundMailAccountStatuses } from "../constants";
 import {
   MAIL_ACCOUNT_AGGREGATE_TYPE,

package/src/inbound-mail-foundation/handlers/ingest-message.write.ts

@@ -29,7 +29,7 @@ import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db"
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { inboundMessageAggregateId, mailThreadAggregateId } from "../aggregate-id";
 import {
   INBOUND_MESSAGE_PII_FIELDS,

package/src/inbound-mail-foundation/handlers/list-accounts.query.ts

@@ -12,7 +12,7 @@ import {
   decryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { MAIL_ACCOUNT_PII_FIELDS } from "../entities";
 import { mailAccountsProjectionTable } from "../projection";
 import { isVisibleToCaller } from "./scope-visibility";

package/src/inbound-mail-foundation/handlers/list-messages.query.ts

@@ -13,7 +13,7 @@ import {
   decryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { INBOUND_MESSAGE_PII_FIELDS } from "../entities";
 import { inboundMessagesProjectionTable } from "../projection";
 import { isVisibleToCaller } from "./scope-visibility";

package/src/inbound-mail-foundation/handlers/update-account.write.ts

@@ -5,7 +5,7 @@
 
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { InboundMailAccountStatuses } from "../constants";
 import {
   MAIL_ACCOUNT_AGGREGATE_TYPE,

package/src/inbound-provider-imap/credential-document.ts

@@ -15,7 +15,7 @@
 //              (M365/Gmail, Phase 4/5); der imap-Provider konsumiert
 //              nur einen gültigen Access-Token aus dem Slot.
 
-import { z } from "zod";
+import * as z from "zod";
 
 export const imapCredentialDocumentSchema = z.object({
   host: z.string().min(1).max(255),

package/src/jobs/__tests__/jobs-catalog.integration.test.ts

@@ -9,7 +9,7 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { JobErrors, JobHandlers, JobQueries } from "../constants";
 import { createJobsFeature } from "../feature";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";

package/src/jobs/__tests__/tenant-job-failures.integration.test.ts

@@ -31,7 +31,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import { sleep } from "@cosmicdrift/kumiko-framework/testing";
 import type { Hono } from "hono";
-import { z } from "zod";
+import * as z from "zod";
 import { JobQueries } from "../constants";
 import { createJobsFeature } from "../feature";
 import { createJobRunLogger } from "../job-run-logger";

package/src/jobs/events.ts

@@ -4,7 +4,7 @@
 // jobRunsTable/jobRunLogsTable, so an out-of-dispatcher write still gets the
 // same validation guarantee ctx.appendEvent used to give it.
 
-import { z } from "zod";
+import * as z from "zod";
 
 export const jobLogEntrySchema = z.object({
   level: z.enum(["info", "warn", "error"]),

package/src/jobs/handlers/catalog.query.ts

@@ -1,5 +1,5 @@
 import { defineQueryHandler, type JobDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { isManualTrigger } from "../is-manual-trigger";
 
 export type ManualJobCatalogEntry = {

package/src/jobs/handlers/detail.query.ts

@@ -1,7 +1,7 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 

package/src/jobs/handlers/list.query.ts

@@ -1,7 +1,7 @@
 import { countWhere, selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { jobRunsTable } from "../job-run-table";
 

package/src/jobs/handlers/projection-rebuild.job.ts

@@ -4,7 +4,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
-import { z } from "zod";
+import * as z from "zod";
 
 export const projectionRebuildPayloadSchema = z.object({
   projection: z.string().min(1),

package/src/jobs/handlers/reindex-entity.job.ts

@@ -7,7 +7,7 @@
 import type { JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { reindexEntity } from "@cosmicdrift/kumiko-framework/search";
-import { z } from "zod";
+import * as z from "zod";
 
 export const reindexEntityPayloadSchema = z.object({
   entity: z.string().min(1),

package/src/jobs/handlers/retry.write.ts

@@ -9,7 +9,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/errors";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii } from "../../shared";
 import { JobErrors } from "../constants";
 import { jobRunsTable } from "../job-run-table";

package/src/jobs/handlers/tenant-failures.query.ts

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { tenantJobFailuresTable } from "../tenant-job-failure-table";
 
 type TenantJobFailureRow = {

package/src/jobs/handlers/trigger.write.ts

@@ -7,7 +7,7 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
-import { z } from "zod";
+import * as z from "zod";
 import { JobErrors } from "../constants";
 import { isManualTrigger } from "../is-manual-trigger";
 

package/src/ledger/handlers/reports.query.ts

@@ -1,5 +1,5 @@
 import type { AccessRule, QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { DEFAULT_LEDGER_ACCESS } from "../constants";
 import { accountTable, transactionTable } from "../executor";
 import {

package/src/ledger/schemas.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 import { ACCOUNT_TYPES, TRANSACTION_STATUS } from "./constants";
 
 // A posting line. amount is integer minor units (cents), SIGNED: Soll/debit > 0,

package/src/mail-foundation/__tests__/mail-foundation.integration.test.ts

@@ -26,7 +26,7 @@ import {
   createTestEnvelopeCipher,
   type MutableMasterKeyProvider,
 } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { createConfigFeature } from "../../config";
 import { ConfigHandlers } from "../../config/constants";
 import { createConfigAccessorFactory } from "../../config/feature";

package/src/managed-pages/handlers/branding.query.ts

@@ -1,5 +1,5 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { MANAGED_PAGES_CSS_FEATURE, readBranding, readCustomCss } from "../branding";
 
 // Public branding read for the server-render path. Anonymous-capable: the

package/src/managed-pages/handlers/by-slug.query.ts

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { type PageRow, pagesTable } from "../table";
 
 // Public-Read by (tenantId, slug, lang). Anonymous-capable (Landing-/

package/src/managed-pages/handlers/by-tenant-published.query.ts

@@ -4,7 +4,7 @@ import {
   crossTenantOverrideDenied,
   defineQueryHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { type PageRow, pagesTable } from "../table";
 
 // Public-Read aller published Pages eines Tenants — Discovery-Quelle für

package/src/managed-pages/handlers/set.write.ts

@@ -6,7 +6,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { type PageRow, pageEntity, pagesTable } from "../table";
 
 const slugSchema = z

package/src/notes-history/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.308.0",
+    "type": "breaking",
+    "title": "NotesSection no longer wraps its own \"new note\" / \"history\" blocks in a Card (fw#3234)",
+    "detail": "As an extension section (its documented usage: `component: { react: { __component: NOTES_SECTION_EXTENSION_NAME } }`), NotesSection was already mounted inside the host's own section frame — its two internal Cards doubled the border/padding there. Both blocks now use a plain container with a `Heading variant=\"section\"` sub-header instead.",
+    "migration": "A standalone `<NotesSection entityName={...} entityId={id} />` mount (outside a screen-schema extension section) now renders both blocks without their own card chrome — wrap it in a `Section`/`Card` if the standalone mount needs one."
+  },
   {
     "version": "0.244.0",
     "type": "improvement",

package/src/notes-history/schemas.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 // entityType/entityId are app-supplied — mirror tags' NO_PIPE guard isn't
 // needed here since note-entry has no deterministic aggregate-id derived

package/src/notes-history/web/notes-section.tsx

@@ -48,7 +48,7 @@ export function NotesSection({
   readonly entityName: string;
   readonly entityId: string | null;
 }): ReactNode {
-  const { Banner, Button, Card, Grid, Text, Input } = usePrimitives();
+  const { Banner, Button, Grid, Heading, Text, Input } = usePrimitives();
   const t = useTranslation();
   const dispatcher = useDispatcher();
   const enabled = entityId !== null;
@@ -117,43 +117,44 @@ export function NotesSection({
     })();
   };
 
+  // No own Card/SectionCard here — the host (ExtensionSectionMount) already
+  // frames this whole component in one card; a nested card would double the
+  // border/padding. "New note" and "History" are sub-headers within that
+  // single frame instead.
   return (
     <Grid columns={1} testId="notes-section">
-      <Card slots={{ title: t("notesHistory.section.newNoteTitle") }} testId="notes-section-new">
-        <Grid columns={1}>
-          <Input
-            kind="textarea"
-            id="notes-section-draft"
-            name="draft"
-            value={draft}
-            onChange={setDraft}
-            onSubmitShortcut={() => {
-              if (!busy && draft.trim() !== "") addNote();
-            }}
-          />
-          <div className="flex items-center justify-between gap-2">
-            <Text variant="small">{t("notesHistory.section.shortcutHint")}</Text>
-            <Button
-              variant="primary"
-              disabled={busy || draft.trim() === ""}
-              onClick={() => addNote()}
-              testId="notes-section-add"
-            >
-              {busy ? t("notesHistory.section.working") : t("notesHistory.section.add")}
-            </Button>
-          </div>
-          {errorKey !== null && (
-            <Banner variant="error" testId="notes-section-action-error">
-              <Text>{t(errorKey)}</Text>
-            </Banner>
-          )}
-        </Grid>
-      </Card>
+      <div className="flex flex-col gap-3" data-testid="notes-section-new">
+        <Heading variant="section">{t("notesHistory.section.newNoteTitle")}</Heading>
+        <Input
+          kind="textarea"
+          id="notes-section-draft"
+          name="draft"
+          value={draft}
+          onChange={setDraft}
+          onSubmitShortcut={() => {
+            if (!busy && draft.trim() !== "") addNote();
+          }}
+        />
+        <div className="flex items-center justify-between gap-2">
+          <Text variant="small">{t("notesHistory.section.shortcutHint")}</Text>
+          <Button
+            variant="primary"
+            disabled={busy || draft.trim() === ""}
+            onClick={() => addNote()}
+            testId="notes-section-add"
+          >
+            {busy ? t("notesHistory.section.working") : t("notesHistory.section.add")}
+          </Button>
+        </div>
+        {errorKey !== null && (
+          <Banner variant="error" testId="notes-section-action-error">
+            <Text>{t(errorKey)}</Text>
+          </Banner>
+        )}
+      </div>
 
-      <Card
-        slots={{ title: t("notesHistory.section.historyTitle") }}
-        testId="notes-section-history"
-      >
+      <div className="flex flex-col gap-3" data-testid="notes-section-history">
+        <Heading variant="section">{t("notesHistory.section.historyTitle")}</Heading>
         {rows.length === 0 ? (
           <Text variant="small">{t("notesHistory.section.empty")}</Text>
         ) : (
@@ -178,7 +179,7 @@ export function NotesSection({
             ))}
           </div>
         )}
-      </Card>
+      </div>
     </Grid>
   );
 }

package/src/personal-access-tokens/feature.ts

@@ -11,6 +11,7 @@ import { type CreatePatOptions, createPatCreateHandler } from "./handlers/create
 import { listPatQuery } from "./handlers/list.query";
 import { revokePatWrite } from "./handlers/revoke.write";
 import { PAT_FEATURE_I18N, patScopeOptionTranslations } from "./i18n";
+import { PAT_REVOKED_EVENT_SHORT, patRevokedSchema } from "./pat-revoked-event";
 import { createPatResolver } from "./resolver";
 import { apiTokenEntity } from "./schema/api-token";
 import type { PatScopeConfig } from "./scopes";
@@ -114,6 +115,15 @@ export function createPersonalAccessTokensFeature(
       piiEncryptedOnWrite: true,
     });
 
+    // Custom domain-event for cross-instance access-invalidation,
+    // mirroring sessions' SESSION_REVOKED_EVENT_SHORT. r.defineEvent
+    // registers the schema so ctx.unsafeAppendEvent (revoke) enforces it at
+    // append time. revoke-for-user.ts appends via the low-level append()
+    // instead (needs to anchor on SYSTEM_TENANT_ID) — same guarantee via a
+    // different path. No projection: the payload IS the read, consumed
+    // directly off the event-store NOTIFY.
+    r.defineEvent(PAT_REVOKED_EVENT_SHORT, patRevokedSchema, { piiFields: "none" });
+
     // Password-change auto-revoke — mirrors sessions' own
     // autoRevokeOnPasswordChange postSave hook, including WHY it's a
     // late-bind callback rather than direct ctx.db use: user:write:user:update

package/src/personal-access-tokens/handlers/available-scopes.query.ts

@@ -1,5 +1,5 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import type { PatScopeConfig } from "../scopes";
 
 // Returns the app-declared scope domains ({name, label, canWrite}) so the mint

package/src/personal-access-tokens/handlers/create.write.ts

@@ -8,7 +8,7 @@ import {
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { encryptForDirectWrite, verifyPassword } from "../../shared";
 import { UserQueries } from "../../user";
 import { PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors } from "../constants";

package/src/personal-access-tokens/handlers/list.query.ts

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii } from "../../shared";
 import { isExpiredAt } from "../expiry";
 import { apiTokenTable } from "../schema/api-token";

package/src/personal-access-tokens/handlers/revoke.write.ts

@@ -1,9 +1,11 @@
 import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { PatErrors } from "../constants";
+import { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN } from "../pat-revoked-event";
 import { apiTokenTable } from "../schema/api-token";
 
 // Revoke one of the caller's own tokens. Ownership is enforced in the WHERE
@@ -30,7 +32,21 @@ export const revokePatWrite = defineWriteHandler({
       { revokedAt: Temporal.Now.instant() },
       { id: event.payload.id, userId: event.user.id, revokedAt: null },
     );
-    if (updated.length > 0) return { isSuccess: true, data: { id: event.payload.id } };
+    if (updated.length > 0) {
+      // Lightweight append alongside the direct-write above, mirroring
+      // sessions' revoke.write.ts. NOT a lifecycle event for
+      // store_api_tokens (that table stays an unmanaged direct-write store,
+      // see feature.ts). Without this, the access-invalidation consumer
+      // never hears about the revoke and an already-open SSE stream
+      // authenticated by this exact token survives it.
+      await ctx.unsafeAppendEvent({
+        aggregateId: generateId(),
+        aggregateType: PAT_REVOKED_AGGREGATE_TYPE,
+        type: PAT_REVOKED_EVENT_QN,
+        payload: { userId: event.user.id, tokenIds: [event.payload.id] },
+      });
+      return { isSuccess: true, data: { id: event.payload.id } };
+    }
     return writeFailure(
       new UnprocessableError(PatErrors.ownershipDenied, {
         i18nKey: "errors.ownershipDenied",

package/src/personal-access-tokens/index.ts

@@ -10,6 +10,13 @@ export {
 } from "./feature";
 export type { CreatePatOptions, PatMfaVerifyResult } from "./handlers/create.write";
 export { hashPatToken, mintPatToken } from "./hash";
+export {
+  PAT_REVOKED_AGGREGATE_TYPE,
+  PAT_REVOKED_EVENT_QN,
+  PAT_REVOKED_EVENT_SHORT,
+  type PatRevokedPayload,
+  patRevokedSchema,
+} from "./pat-revoked-event";
 export { createPatResolver } from "./resolver";
 export { revokeAllPatTokensForUser } from "./revoke-for-user";
 export { apiTokenEntity, apiTokenTable } from "./schema/api-token";

package/src/personal-access-tokens/pat-revoked-event.ts

@@ -0,0 +1,23 @@
+import * as z from "zod";
+
+// Lightweight custom event appended alongside the direct-write updateMany()
+// in revoke.write.ts / revoke-for-user.ts (mirrors sessions'
+// session-revoked-event.ts). apiTokenTable itself stays an unmanaged
+// direct-write store (see feature.ts) — this event is NOT a CRUD/lifecycle
+// event for that table and carries no projection. Its only job is to give
+// the access-invalidation consumer something to LISTEN for, keyed by the
+// affected userId, so a revoked PAT's open SSE stream closes.
+export const PAT_REVOKED_EVENT_SHORT = "pat-revoked" as const;
+export const PAT_REVOKED_EVENT_QN = "personal-access-tokens:event:pat-revoked" as const;
+
+// Own aggregate type, decoupled from apiTokenEntity's implicit
+// "api-token" — each revoke action mints a fresh aggregate id (no
+// predecessor to satisfy, no version_conflict against concurrent revokes).
+export const PAT_REVOKED_AGGREGATE_TYPE = "api-token-revocation" as const;
+
+export const patRevokedSchema = z.object({
+  userId: z.string().min(1),
+  tokenIds: z.array(z.uuid()).min(1),
+});
+
+export type PatRevokedPayload = z.infer<typeof patRevokedSchema>;

package/src/personal-access-tokens/revoke-for-user.ts

@@ -1,6 +1,14 @@
 import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { append } from "@cosmicdrift/kumiko-framework/event-store";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
+import {
+  PAT_REVOKED_AGGREGATE_TYPE,
+  PAT_REVOKED_EVENT_QN,
+  patRevokedSchema,
+} from "./pat-revoked-event";
 import { apiTokenTable } from "./schema/api-token";
 
 // Cross-tenant revoke: password-change and MFA-enable/disable are account-
@@ -14,5 +22,28 @@ export async function revokeAllPatTokensForUser(db: DbRunner, userId: string): P
     { revokedAt: Temporal.Now.instant() },
     { userId, revokedAt: null },
   );
+
+  // Same reasoning as sessionMassRevoker's append — this raw
+  // callback has no dispatcher ctx to call unsafeAppendEvent from, so it
+  // uses the low-level append() directly, anchored on SYSTEM_TENANT_ID like
+  // sessions' cross-tenant writes. Without it, the access-invalidation
+  // consumer never hears about a password-change/MFA-toggle/forget-subject
+  // PAT revoke and any already-open SSE stream on those tokens survives it.
+  if (updated.length > 0) {
+    const payload = patRevokedSchema.parse({
+      userId,
+      tokenIds: updated.map((row) => row.id),
+    });
+    await append(db, {
+      aggregateId: generateId(),
+      aggregateType: PAT_REVOKED_AGGREGATE_TYPE,
+      tenantId: SYSTEM_TENANT_ID,
+      expectedVersion: 0,
+      type: PAT_REVOKED_EVENT_QN,
+      payload,
+      metadata: { userId },
+    });
+  }
+
   return updated.length;
 }

package/src/rate-limiting/__tests__/rate-limiting.integration.test.ts

@@ -13,7 +13,7 @@ import {
   TestUsers,
   testTenantId,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { createRateLimitingFeature } from "../feature";
 
 let stack: TestStack;