@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/cap-overview/i18n.js

@@ -11,9 +11,14 @@ export const CAP_OVERVIEW_I18N = {
     "cap-overview.cards.empty": { en: "No caps configured for this tenant." },
     "cap-overview.cards.loading": { en: "Loading usage…" },
     "cap-overview.notMeasured": { en: "Not measured yet" },
+    "cap-overview.unlimited": { en: "{used} · unlimited" },
     "cap-overview.errors.progressPrimitiveMissing": {
         en: "Usage bar unavailable — Progress primitive is not registered.",
     },
+    "cap-overview.errors.invalidCursor": { en: "The pagination cursor is invalid." },
+    "cap-overview.errors.filterFieldUnsupported": {
+        en: "Filtering by this field is not supported, or tier was filtered more than once.",
+    },
     "cap-overview.errors.sortFieldUnsupported": { en: "Sorting by this field is not supported." },
     "cap-overview.errors.tenantOverrideRequiresSystemAdmin": {
         en: "Only SystemAdmin may query another tenant's data.",

package/dist/cap-overview/web/cap-cards-panel.js

@@ -52,10 +52,13 @@ export function CapCardsPanel({ filterParams }) {
         // rule exists, since that file IS in the scanned surface.
         className: "grid gap-4 sm:grid-cols-2 lg:grid-cols-4", "data-testid": "cap-cards-panel", children: [query.loading && rows.length === 0 && (_jsx("div", { className: "text-sm text-muted-foreground", children: t("cap-overview.cards.loading") })), rows.map((cap) => {
                 const Icon = cap.icon !== undefined ? CAP_ICONS[cap.icon] : undefined;
+                // An unlimited, measured cap has neither a badge nor a bar; StatCard still
+                // wraps any defined child in a spacing div, so pass undefined then.
+                const body = !isMeasured(cap) || cap.limit !== null ? (_jsxs("div", { className: "flex flex-col gap-2", children: [cap.percent !== null && (_jsx("div", { className: "flex items-center justify-between gap-2", children: _jsx(StatusBadge, { tone: TONE_TO_STATUS[cap.tone], children: `${cap.percent}%` }) })), _jsx(CapUsageBar, { usage: cap, showLabel: false })] })) : undefined;
                 return (_jsx(StatCard, { icon: Icon !== undefined ? _jsx(Icon, { className: "size-4" }) : undefined, label: t(cap.label), value: !isMeasured(cap)
                         ? "—"
                         : cap.limit === null
                             ? String(cap.used)
-                            : `${cap.used} / ${cap.limit}`, ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }), testId: "cap-card", children: _jsxs("div", { className: "flex flex-col gap-2", children: [cap.percent !== null && (_jsx("div", { className: "flex items-center justify-between gap-2", children: _jsx(StatusBadge, { tone: TONE_TO_STATUS[cap.tone], children: `${cap.percent}%` }) })), _jsx(CapUsageBar, { usage: cap, showLabel: false })] }) }, cap.id));
+                            : `${cap.used} / ${cap.limit}`, ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }), testId: "cap-card", children: body }, cap.id));
             })] }));
 }

package/dist/cap-overview/web/cap-usage-bar.js

@@ -10,7 +10,7 @@ export function CapUsageBar({ usage, showLabel = true, }) {
     }
     if (usage.limit === null) {
         // A progress bar with no denominator says nothing — show the raw count instead.
-        return showLabel ? (_jsx(Text, { variant: "small", testId: "cap-usage-unlimited", children: String(usage.used) })) : null;
+        return showLabel ? (_jsx(Text, { variant: "small", testId: "cap-usage-unlimited", children: t("cap-overview.unlimited", { used: usage.used }) })) : null;
     }
     return (_jsxs("div", { className: "flex flex-col gap-1", children: [Progress ? (_jsx(Progress, { value: usage.fraction, tone: computeTone(usage.fraction), testId: "cap-usage-bar" })) : (_jsx(Banner, { variant: "error", testId: "cap-usage-bar-missing-primitive", children: t("cap-overview.errors.progressPrimitiveMissing") })), showLabel && _jsx(Text, { variant: "small", children: `${usage.used} / ${usage.limit}` })] }));
 }

package/dist/channel-email/email-channel.js

@@ -15,6 +15,10 @@ function stringHeaders(raw) {
     }
     return Object.keys(out).length > 0 ? out : undefined;
 }
+const UNSUBSCRIBE_HEADER_NAMES = new Set([
+    "list-unsubscribe",
+    "list-unsubscribe-post",
+]);
 // Only the framework's own unsubscribe route can honor a one-click POST.
 function listUnsubscribeHeaders(data) {
     const rawUrl = data?.["unsubscribeUrl"];
@@ -43,7 +47,14 @@ function emailEnvelopeFrom(data) {
     const replyTo = typeof data["replyTo"] === "string" ? data["replyTo"] : undefined;
     const autoHeaders = listUnsubscribeHeaders(data);
     const explicitHeaders = stringHeaders(data["headers"]);
-    const headers = autoHeaders || explicitHeaders ? { ...autoHeaders, ...explicitHeaders } : undefined;
+    // Header names are case-insensitive, and the auto pair only works together:
+    // an explicit override of either half must drop both, or a mail client would
+    // one-click POST to a URL that cannot handle it.
+    const overridesUnsubscribe = explicitHeaders !== undefined &&
+        Object.keys(explicitHeaders).some((name) => UNSUBSCRIBE_HEADER_NAMES.has(name.toLowerCase()));
+    const headers = (!overridesUnsubscribe && autoHeaders) || explicitHeaders
+        ? { ...(overridesUnsubscribe ? undefined : autoHeaders), ...explicitHeaders }
+        : undefined;
     return { ...(from && { from }), ...(replyTo && { replyTo }), ...(headers && { headers }) };
 }
 export function createEmailChannel(options) {

package/dist/channel-in-app/tables.js

@@ -1,4 +1,4 @@
-import { asEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
+import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
 import { boolean, instant, table as pgTable, serial, sql, text, uuid, } from "@cosmicdrift/kumiko-framework/db";
 export const inAppMessagesTable = pgTable("in_app_messages", {
     id: serial("id").primaryKey(),
@@ -14,8 +14,4 @@ export const inAppMessagesTable = pgTable("in_app_messages", {
 });
 // Derived from inAppMessagesTable (table() attaches the meta as a Symbol) so
 // the two can't drift, instead of hand-duplicating the column list.
-const derivedInAppMessagesTableMeta = asEntityTableMeta(inAppMessagesTable);
-if (!derivedInAppMessagesTableMeta) {
-    throw new Error("inAppMessagesTable: table carries no EntityTableMeta — built via table()?");
-}
-export const inAppMessagesTableMeta = derivedInAppMessagesTableMeta;
+export const inAppMessagesTableMeta = requireEntityTableMeta(inAppMessagesTable, "inAppMessagesTable");

package/dist/compliance-profiles/handlers/sub-processors.query.js

@@ -19,7 +19,7 @@ export const subProcessorsQuery = defineQueryHandler({
     name: "sub-processors",
     schema: z.object({}),
     access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
     description: "Returns the publicly readable Kumiko sub-processor list split into active and planned entries, for the GDPR Art. 28(2) disclosure a privacy policy or data-processing agreement links to.",
     handler: async () => {
         return {

package/dist/compliance-profiles/schema/profile-selection.d.ts

@@ -17,7 +17,7 @@ export declare const tenantComplianceProfileEntity: import("@cosmicdrift/kumiko-
             readonly "swiss-dsg"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -57,7 +57,7 @@ export declare const tenantComplianceProfileTable: import("@cosmicdrift/kumiko-f
             readonly "swiss-dsg"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };

package/dist/config/db/queries/resolver.js

@@ -1,6 +1,8 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configValuesTable } from "../../table.js";
-// Method-form so a tenant-mode TenantDb stays filtered.
+// Method-form so a tenant-mode TenantDb stays filtered. Two parallel selects
+// (disjoint via userId IS NULL) instead of one OR query: the buckets don't share
+// a snapshot, so a concurrent config write can mix old scope and new user values.
 export async function selectConfigRowsForScope(db, systemTenantId, tenantId, userId) {
     const [scopeRows, userRows] = await Promise.all([
         selectMany(db, configValuesTable, {

package/dist/config/handlers/set.write.js

@@ -1,10 +1,11 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { ConfigScopes, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { ConfigScopes, defineWriteHandler, isEncryptedAtRest, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireConfigEncryption, requireSystemDb } from "../feature.js";
+import { MASKED } from "../read-redaction.js";
 import { configValueEntity, configValuesTable } from "../table.js";
 import { findConfigRow, prepareConfigWrite, resolvePiiSubject, validateBounds, validateExtensionPlugin, validatePattern, validateScope, validateType, } from "../write-helpers.js";
 const scopeEnum = z.enum([ConfigScopes.system, ConfigScopes.tenant, ConfigScopes.user]);
@@ -53,7 +54,7 @@ export const setWrite = defineWriteHandler({
         const typeError = validateType(event.payload.value, keyDef);
         if (typeError)
             return writeFailure(typeError);
-        const pluginError = validateExtensionPlugin(ctx.registry, event.payload.key, event.payload.value);
+        const pluginError = validateExtensionPlugin(ctx.registry, event.payload.key, event.payload.value, keyDef);
         if (pluginError)
             return writeFailure(pluginError);
         // Bounds enforcement: hard-reject (not silent-clamp). A caller that
@@ -66,6 +67,9 @@ export const setWrite = defineWriteHandler({
         const patternError = validatePattern(event.payload.value, keyDef);
         if (patternError)
             return writeFailure(patternError);
+        // The batch idempotency cache stores this result and only masks entity
+        // writeOnly fields, so an at-rest-encrypted value must not be echoed.
+        const echoedValue = isEncryptedAtRest(keyDef) ? MASKED : event.payload.value;
         // backing="secrets": persist into the secrets store (system tenant, own
         // envelope encryption + audit) instead of config_values. Same JSON
         // serialization as a config row so the read path round-trips via
@@ -82,7 +86,7 @@ export const setWrite = defineWriteHandler({
             });
             return {
                 isSuccess: true,
-                data: { key: event.payload.key, value: event.payload.value, scope },
+                data: { key: event.payload.key, value: echoedValue, scope },
             };
         }
         let serialized = JSON.stringify(event.payload.value);
@@ -139,7 +143,7 @@ export const setWrite = defineWriteHandler({
         }
         return {
             isSuccess: true,
-            data: { key: event.payload.key, value: event.payload.value, scope },
+            data: { key: event.payload.key, value: echoedValue, scope },
         };
     },
 });

package/dist/config/table.d.ts

@@ -9,6 +9,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -49,6 +51,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -71,6 +74,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -91,6 +95,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -111,6 +116,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/config/web/i18n.js

@@ -8,11 +8,15 @@
 // for ITS keys (mask.title) and the per-feature group key `<feature>.settings`.
 export const defaultTranslations = {
     en: {
-        "config.secrets.delete": "Delete",
+        "config.secrets.delete": "Remove",
+        "config.secrets.deleteConfirm": "Remove this secret? Anything using it stops working, and it cannot be restored.",
         "config.secrets.notSet": "Not set",
         "config.secrets.placeholder": "Enter a value",
-        "config.secrets.replacePlaceholder": "Enter a new value to replace",
-        "config.secrets.required": "Required",
+        "config.secrets.replacePlaceholder": "Enter a new value to replace it",
+        "config.secrets.saved": "Saved",
+        "config.secrets.section": "Secrets",
+        "config.secrets.description": "Stored encrypted. Saved values are never shown again.",
+        "config.secrets.stored": "Stored: {preview}",
         "config.secrets.set": "Set",
         "config.secrets.title": "Secrets",
         "config.settings.title": "Settings",
@@ -23,7 +27,12 @@ export const defaultTranslations = {
         "config.errors.invalidScope": "This scope is not allowed for this key.",
         "config.errors.unknownKey": "Unknown configuration key.",
         "config.errors.unknownExtensionPlugin": "This provider is not available.",
-        "config.settings.extensionSelectorHint": "Save the provider selection to show its settings below.",
+        "config.settings.extensionSelectorHint": "Choose a provider and save. Its settings appear below.",
+        "config.settings.provider": "Provider",
+        "config.settings.saveProvider": "Save provider",
+        "config.settings.audience.system": "Applies to every tenant unless a tenant sets its own value.",
+        "config.settings.audience.tenant": "Applies to everyone in this tenant. Platform defaults are shown where nothing is set here.",
+        "config.settings.audience.user": "Only applies to you.",
         // Required by every generated screen (screenTitleKey, required-surface-keys.ts) —
         // the secrets screen has a fixed id ("secrets"), so the framework ships its
         // title translation directly instead of asking every app to declare it.

package/dist/config/write-helpers.d.ts

@@ -38,7 +38,7 @@ export declare function resolveScopeIds(scope: ConfigScope, tenantId: TenantId,
     userId: string | null;
 };
 export declare function resolvePiiSubject(scope: Exclude<ConfigScope, "system">, tenantId: TenantId, userId: string | null): SubjectId;
-export declare function validateExtensionPlugin(registry: Registry, key: string, value: string | number | boolean): KumikoError | null;
+export declare function validateExtensionPlugin(registry: Pick<Registry, "getAllExtensionSelectors" | "getExtensionUsages">, key: string, value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;
 export declare function validateType(value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;
 export declare function validateBounds(value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;
 export declare function validatePattern(value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;

package/dist/config/write-helpers.js

@@ -2,7 +2,7 @@
 // Extracted from set.write.ts so reset.write.ts + values.query.ts don't
 // have to cross-import from another handler file.
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { ConfigScopes, extensionSelectorTargets, SYSTEM_ROLE, SYSTEM_TENANT_ID, selectablePluginIds, } from "@cosmicdrift/kumiko-framework/engine";
+import { ConfigScopes, extensionSelectorTargets, isEncryptedAtRest, SYSTEM_ROLE, SYSTEM_TENANT_ID, selectablePluginIds, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, NotFoundError, UnprocessableError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { assertUnreachable } from "@cosmicdrift/kumiko-framework/utils";
 import { ConfigErrors } from "./constants.js";
@@ -134,9 +134,14 @@ export function resolvePiiSubject(scope, tenantId, userId) {
     }
     return { kind: "tenant", tenantId };
 }
+// An encrypted value must not travel back in an error (logs, idempotency cache),
+// so rejection details spread this instead of naming `value` directly.
+function echoableValue(keyDef, value) {
+    return isEncryptedAtRest(keyDef) ? {} : { value };
+}
 // An extension-selector key may only name a mounted plugin (or "" to clear) —
 // otherwise the settings screen would show no panel for a typo'd value.
-export function validateExtensionPlugin(registry, key, value) {
+export function validateExtensionPlugin(registry, key, value, keyDef) {
     const extensionName = extensionSelectorTargets(registry).get(key);
     if (extensionName === undefined || value === "")
         return null;
@@ -145,7 +150,7 @@ export function validateExtensionPlugin(registry, key, value) {
         return null;
     return new UnprocessableError(ConfigErrors.unknownExtensionPlugin, {
         i18nKey: "config.errors.unknownExtensionPlugin",
-        details: { key, value, allowed },
+        details: { key, ...echoableValue(keyDef, value), allowed },
     });
 }
 export function validateType(value, keyDef) {
@@ -172,7 +177,7 @@ export function validateType(value, keyDef) {
                             path: "value",
                             code: "invalid_option",
                             i18nKey: "errors.validation.invalid_option",
-                            params: { value, options: keyDef.options },
+                            params: { ...echoableValue(keyDef, value), options: keyDef.options },
                         },
                     ],
                 });
@@ -254,13 +259,14 @@ export function validatePattern(value, keyDef) {
     }
     if (re.test(value))
         return null;
+    const echoedParams = { ...echoableValue(keyDef, value), pattern: keyDef.pattern.regex };
     return new ValidationError({
         fields: [
             {
                 path: "value",
                 code: "invalid_format",
                 i18nKey: "errors.validation.invalid_format",
-                params: { value, pattern: keyDef.pattern.regex },
+                params: echoedParams,
             },
         ],
     });

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -133,6 +133,17 @@ getRunner) {
     });
     return effective.policy?.strategy === "blockDelete" ? deny() : undefined;
 }
+// AccessDeniedError.code is the generic "access_denied" for every branch;
+// the specific branch lives in details.reason.
+function denialReasonOf(failure) {
+    const details = failure.error.details;
+    if (typeof details === "object" && details !== null && "reason" in details) {
+        const { reason } = details;
+        if (typeof reason === "string")
+            return reason;
+    }
+    return failure.error.code;
+}
 // Denied cross-tenant probes must still leave an audit trail (fw#2348).
 // Appended outside the handler tx (fw#2592): the caller's
 // `return tenantScopeDenial` rolls that tx back.
@@ -228,18 +239,14 @@ export const forgetSubjectWrite = defineWriteHandler({
         const subjectKey = subjectIdToKey(subject);
         const tenantScopeDenial = await resolveTenantScopeDenial(ctx.db.unsafeRaw("tenant-scope check runs against the subject's tenant, not necessarily the caller's"), ctx.registry.features, event.user, raw);
         if (tenantScopeDenial) {
-            const auditFailure = await appendDenialAuditEvent(ctx, event, subjectKey, raw.kind, tenantScopeDenial.error.code, ctx.dbOutsideTransaction?.unsafeRaw("denial audit append: names the prober's own tenant stream on the outside-transaction db"));
+            const auditFailure = await appendDenialAuditEvent(ctx, event, subjectKey, raw.kind, denialReasonOf(tenantScopeDenial), ctx.dbOutsideTransaction?.unsafeRaw("denial audit append: names the prober's own tenant stream on the outside-transaction db"));
             return auditFailure ?? tenantScopeDenial;
         }
-        // Runs AFTER the tenant gate (VORHER only means "before the shred"): a
-        // retention check ahead of the tenant gate would leak a foreign
-        // entity's retention posture to a cross-tenant prober.
+        // Runs after the tenant gate but before any key is touched: a retention
+        // check ahead of the tenant gate would leak a foreign entity's retention
+        // posture to a cross-tenant prober.
         const retentionDenial = await resolveRetentionDenial(ctx, raw, () => ctx.db.unsafeRaw("retention check reads the record row's owning tenant, not the caller's"));
         if (retentionDenial) {
-            // Own reason constant, not tenantScopeDenial's `.error.code` pattern:
-            // AccessDeniedError.code is the generic "access_denied" for every
-            // branch, so re-deriving it here would make a blockDelete refusal
-            // indistinguishable from a cross-tenant one in the audit trail.
             const auditFailure = await appendDenialAuditEvent(ctx, event, subjectKey, raw.kind, TARGET_RECORD_RETENTION_BLOCK_DELETE, ctx.dbOutsideTransaction?.unsafeRaw("denial audit append: names the prober's own tenant stream on the outside-transaction db"));
             return auditFailure ?? retentionDenial;
         }

package/dist/custom-fields/constants.js

@@ -19,10 +19,7 @@ export const CustomFieldsHandlers = {
 export const CustomFieldsQueries = {
     fieldDefinitionList: "custom-fields:query:field-definition:list",
 };
-// Name the web component registers under in ExtensionSectionsProvider —
-// apps reference it in the screen schema via:
-// { kind: "extension", title, contributesToFormSubmit: true,
-//   component: { react: { __component: CUSTOM_FIELDS_FORM_EXTENSION_NAME } } }
+// Name the web component registers under in ExtensionSectionsProvider.
 export const CUSTOM_FIELDS_FORM_EXTENSION_NAME = "CustomFieldsFormSection";
 // Entity-CRUD auto-events for the `field-definition` entity. registry.ts emits
 // these as `${entityName}.created`/`.updated` (dot form) — they do NOT run

package/dist/custom-fields/entity.d.ts

@@ -9,6 +9,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -49,6 +51,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -94,6 +97,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/data-retention/resolve-for-tenant.d.ts

@@ -10,9 +10,8 @@ export interface ResolveForTenantArgs {
     /**
      * Layer 2 — Tenant-Preset. `undefined` (the default) means this resolver
      * derives it itself via resolveTenantRetentionPreset — one compliance-
-     * profile read per call, fine for single-lookup callers (`policy-for`, a
-     * per-hook TenantDb caller like notes-history-user-data). A bulk caller
-     * iterating N entities × M tenants (the forget-cleanup runner, the
+     * profile read per call, fine for single-lookup callers (`policy-for`). A
+     * bulk caller iterating N entities × M tenants (the forget-cleanup runner, the
      * retention-cleanup cron) MUST resolve it ONCE per tenant and pass it in
      * here instead, or it re-derives per entity. `null` means "resolved
      * already, no preset applies" — the resolver falls back to Entity-Default