@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/folders/entity.d.ts

@@ -10,6 +10,7 @@ export declare const folderEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -30,6 +31,7 @@ export declare const folderEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -52,6 +54,7 @@ export declare function createFolderAssignmentEntity(access?: EntityDefinition["
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -72,6 +75,7 @@ export declare function createFolderAssignmentEntity(access?: EntityDefinition["
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -92,6 +96,7 @@ export declare function createFolderAssignmentEntity(access?: EntityDefinition["
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -114,6 +119,7 @@ export declare const folderAssignmentEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -134,6 +140,7 @@ export declare const folderAssignmentEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -154,6 +161,7 @@ export declare const folderAssignmentEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/folders/handlers/clear-folder.write.js

@@ -1,5 +1,4 @@
-import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { joinRowParentIsVisible } from "../../shared/index.js";
+import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { folderAssignmentAggregateId } from "../aggregate-id.js";
 import { DEFAULT_FOLDER_ACCESS } from "../constants.js";
 import { folderAssignmentExecutor } from "../executor.js";
@@ -19,15 +18,9 @@ export function createClearFolderHandler(access = DEFAULT_FOLDER_ACCESS) {
         description: "Unfiles a host entity so it sits in no folder at all, reporting success when it was already unfiled; use it to take an entity out of its folder without touching the folder itself.",
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            // entityType/entityId are client input: the caller must be able to see
-            // the host row through that entity's own read path (tenant scope plus its
-            // `access.read` ownership) before its assignment row may be written.
-            // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
-            // an invisible parent apart from a missing assignment or an unknown folder —
-            // every path answers with the same NotFoundError.
-            if (!(await joinRowParentIsVisible(ctx.registry, "folder-assignment", payload, event.user, ctx.db))) {
-                return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
-            }
+            const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "folder-assignment", payload, event.user, ctx.db);
+            if (denied)
+                return denied;
             const id = folderAssignmentAggregateId(event.user.tenantId, payload.entityType, payload.entityId);
             const existing = await folderAssignmentExecutor.detail({ id }, event.user, ctx.db);
             if (!existing) {

package/dist/folders/handlers/set-folder.write.js

@@ -1,5 +1,5 @@
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { joinRowParentIsVisible } from "../../shared/index.js";
+import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { folderAssignmentAggregateId } from "../aggregate-id.js";
 import { DEFAULT_FOLDER_ACCESS } from "../constants.js";
 import { folderAssignmentExecutor, folderExecutor } from "../executor.js";
@@ -35,15 +35,9 @@ export function createSetFolderHandler(access = DEFAULT_FOLDER_ACCESS) {
         description: "Files a host entity into one existing folder and moves it out of whatever folder it was in, since an entity belongs to at most one folder; use it for both the first filing and every later move.",
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            // entityType/entityId are client input: the caller must be able to see
-            // the host row through that entity's own read path (tenant scope plus its
-            // `access.read` ownership) before its assignment row may be written.
-            // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
-            // an invisible parent apart from a missing assignment or an unknown folder —
-            // every path answers with the same NotFoundError.
-            if (!(await joinRowParentIsVisible(ctx.registry, "folder-assignment", payload, event.user, ctx.db))) {
-                return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
-            }
+            const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "folder-assignment", payload, event.user, ctx.db);
+            if (denied)
+                return denied;
             const id = folderAssignmentAggregateId(event.user.tenantId, payload.entityType, payload.entityId);
             const folder = await folderExecutor.detail({ id: payload.folderId }, event.user, ctx.db);
             if (!folder)

package/dist/form-draft/entity.d.ts

@@ -9,6 +9,7 @@ export declare const formDraftEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const formDraftEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/form-draft/feature.js

@@ -12,6 +12,7 @@ import { discardDraftWrite } from "./handlers/discard.write.js";
 import { getDraftQuery } from "./handlers/get.query.js";
 import { listDraftsQuery } from "./handlers/list.query.js";
 import { saveDraftWrite } from "./handlers/save.write.js";
+const CLEANUP_ESCAPE_HATCH_REASON = "purges stale drafts of every tenant";
 function registerFormDraft(r) {
     r.describe("Per-user, per-tenant working copy of an in-progress form, saved BEFORE the real domain entity exists. Owns one event-sourced entity, `form-draft` (`read_form_drafts`), keyed by a caller-assigned draftKey (typically screenId + optional hostEntityId), unique per (tenant, owner, draftKey). `save` upserts the draft blob ({ values, stepIndex, savedAt } — savedAt stamped server-side), `discard` deletes it (called once the real submit succeeds), `get` resumes it, `list` finds a user's open drafts for a given screenId (draftKey prefix match) — the fallback when a client-generated draftId is lost. Ownership is enforced by a per-row owner filter in every handler, not by roles — a foreign user's save/discard/get/list for someone else's draftKey never sees or touches that row. Never holds anything that already lives in a domain stream; the consuming app is responsible for discarding once the domain write succeeds. A daily cron job hard-deletes drafts past a configurable retention window (`form-draft:config:retention-days`, SystemAdmin-writable, default 30 days).");
     r.uiHints({
@@ -36,8 +37,8 @@ function registerFormDraft(r) {
         name: "cleanup",
         trigger: { cron: "0 3 * * *" },
         concurrency: "skip",
-        escapeHatch: { reason: "purges stale drafts of every tenant" },
-        handler: (payload, ctx) => cleanupDraftsJob(payload, ctx, ctx.db.unsafeRaw("purges stale drafts of every tenant")),
+        escapeHatch: { reason: CLEANUP_ESCAPE_HATCH_REASON },
+        handler: (payload, ctx) => cleanupDraftsJob(payload, ctx, ctx.db.unsafeRaw(CLEANUP_ESCAPE_HATCH_REASON)),
     });
 }
 export const formDraftFeature = defineFeature(FORM_DRAFT_FEATURE_NAME, registerFormDraft);

package/dist/form-draft/handlers/discard.write.js

@@ -73,18 +73,17 @@ export const discardDraftWrite = defineWriteHandler({
             const keys = ownedRefs.map((ref) => ref.storageKey);
             const log = ctx.log;
             const schedule = ctx.scheduleAfterCommit;
+            const release = async () => {
+                await releaseDraftFileRefs(keys, async (key) => {
+                    await files.ref(key).delete();
+                }, log);
+            };
             if (schedule) {
-                schedule(async () => {
-                    await releaseDraftFileRefs(keys, async (key) => {
-                        await files.ref(key).delete();
-                    }, log);
-                });
+                schedule(release);
             }
             else {
                 // Unit/harness paths without a commit sink — best-effort inline.
-                await releaseDraftFileRefs(keys, async (key) => {
-                    await files.ref(key).delete();
-                }, log);
+                await release();
             }
         }
         return { isSuccess: true, data: { discarded: true } };

package/dist/form-draft/handlers/get.query.js

@@ -16,6 +16,12 @@ export const getDraftQuery = defineQueryHandler({
         if (!row)
             return { draft: null };
         const parsed = formDraftBlobSchema.safeParse(row.draft);
-        return { draft: parsed.success ? parsed.data : null };
+        if (!parsed.success) {
+            // Schema evolution or a corrupt jsonb row: surface it to operators
+            // instead of silently making the user's draft vanish.
+            ctx.log?.warn?.(`[form-draft:get] stored blob for draftKey=${query.payload.draftKey} failed schema, treating as absent: ${parsed.error.message}`);
+            return { draft: null };
+        }
+        return { draft: parsed.data };
     },
 });

package/dist/foundation-shared/host-allowlist.d.ts

@@ -0,0 +1,4 @@
+/** Parses a comma-separated operator host allowlist env var. Never throws —
+ *  an unset or empty value just means no bypass. */
+export declare function readHostAllowlistFromEnv(envVar: string, env?: Readonly<Record<string, string | undefined>>): readonly string[];
+export declare function isHostAllowlisted(host: string, allowlist: readonly string[]): boolean;

package/dist/foundation-shared/host-allowlist.js

@@ -0,0 +1,14 @@
+/** Parses a comma-separated operator host allowlist env var. Never throws —
+ *  an unset or empty value just means no bypass. */
+export function readHostAllowlistFromEnv(envVar, env = process.env) {
+    const raw = env[envVar];
+    if (!raw)
+        return [];
+    return raw
+        .split(",")
+        .map((host) => host.trim())
+        .filter((host) => host.length > 0);
+}
+export function isHostAllowlisted(host, allowlist) {
+    return allowlist.some((candidate) => candidate.toLowerCase() === host.toLowerCase());
+}

package/dist/foundation-shared/index.d.ts

@@ -1,2 +1,3 @@
 export { requireDefined, requireNonEmpty, requireSecretSet } from "./config-helpers.js";
+export { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
 export { BlockedHostError, HostResolutionError, MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, type MailConnectTarget, type MailHostGuardOptions, readAllowedPrivateMailHostsFromEnv, resolveMailConnectTarget, } from "./mail-host-policy.js";

package/dist/foundation-shared/index.js

@@ -1,4 +1,5 @@
 // Public API of foundation-shared — utilities consumed by the per-tenant
 // Foundation packages (ai-foundation, mail-foundation, file-foundation).
 export { requireDefined, requireNonEmpty, requireSecretSet } from "./config-helpers.js";
+export { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
 export { BlockedHostError, HostResolutionError, MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, readAllowedPrivateMailHostsFromEnv, resolveMailConnectTarget, } from "./mail-host-policy.js";

package/dist/foundation-shared/mail-host-policy.d.ts

@@ -1,7 +1,5 @@
 import type { lookup } from "node:dns/promises";
 export declare const MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS";
-/** Parses the comma-separated operator allowlist env var. Never throws —
- *  an unset or empty value just means no bypass. */
 export declare function readAllowedPrivateMailHostsFromEnv(env?: Readonly<Record<string, string | undefined>>): readonly string[];
 export type MailHostGuardOptions = {
     readonly allowedPrivateMailHosts?: readonly string[];

package/dist/foundation-shared/mail-host-policy.js

@@ -16,23 +16,13 @@
 // conflict check tripping when both features are mounted together.
 import { isIP } from "node:net";
 import { resolvePublicHostname } from "@cosmicdrift/kumiko-framework/http";
+import { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
 export const MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS";
-/** Parses the comma-separated operator allowlist env var. Never throws —
- *  an unset or empty value just means no bypass. */
 export function readAllowedPrivateMailHostsFromEnv(env = process.env) {
-    const raw = env[MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
-    if (!raw)
-        return [];
-    return raw
-        .split(",")
-        .map((host) => host.trim())
-        .filter((host) => host.length > 0);
-}
-function isAllowedPrivateMailHost(host, allowed) {
-    return allowed.some((candidate) => candidate.toLowerCase() === host.toLowerCase());
+    return readHostAllowlistFromEnv(MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, env);
 }
 export async function resolveMailConnectTarget(host, options = {}) {
-    if (isAllowedPrivateMailHost(host, options.allowedPrivateMailHosts ?? [])) {
+    if (isHostAllowlisted(host, options.allowedPrivateMailHosts ?? [])) {
         return { host };
     }
     const resolved = await resolvePublicHostname(host, options.lookupFn);

package/dist/inbound-mail-foundation/connect-routes.js

@@ -73,6 +73,12 @@ export function createInboundMailConnectRoutes(options) {
         verify: async (request) => verifyCallbackRequest(request, options.stateSecret),
         handler: async (c, verified, deps) => {
             const { code, state } = verified;
+            // Checked before exchangeCode/connectAccount: the code is single-use and
+            // an account created without a persistable refresh token is an orphan.
+            // `deps.secrets` is optional on SignatureExtraRouteDeps.
+            if (!deps.secrets) {
+                return errorJson(c, 500, "secrets_context_missing", `${INBOUND_MAIL_FOUNDATION_FEATURE}: no secrets context wired for the oauth callback route — the refresh token cannot be persisted`);
+            }
             const providerCtx = { registry: deps.registry, secrets: deps.secrets, config: undefined };
             let plugin;
             try {
@@ -123,11 +129,7 @@ export function createInboundMailConnectRoutes(options) {
             }
             // Refresh-token into the per-account secret slot (Slot = accountId).
             // Access tokens (~1h) are NEVER persisted — refresh-before-poll in the
-            // sync path. `deps.secrets` is optional on SignatureExtraRouteDeps —
-            // without it the token would be silently lost, so fail loud instead.
-            if (!deps.secrets) {
-                return errorJson(c, 500, "secrets_context_missing", `${INBOUND_MAIL_FOUNDATION_FEATURE}: no secrets context wired for the oauth callback route — the refresh token cannot be persisted`);
-            }
+            // sync path.
             await deps.secrets.set(state.tenantId, inboundCredentialSecretKey(accountId), tokens.refreshToken, {
                 redact: (plaintext) => `${plaintext.slice(0, 4)}…`,
                 hint: `OAuth refresh token for inbound mail account ${accountId}`,

package/dist/inbound-mail-foundation/entities.d.ts

@@ -11,6 +11,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -31,6 +32,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -51,6 +53,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -71,6 +74,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -91,6 +95,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -111,6 +116,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -131,6 +137,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -171,6 +178,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -191,6 +199,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -211,6 +220,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -231,6 +241,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -251,6 +262,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -271,6 +283,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -291,6 +304,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -311,6 +325,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -331,6 +346,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -366,6 +382,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -386,6 +403,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -410,6 +428,7 @@ export declare const mailThreadEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -430,6 +449,7 @@ export declare const mailThreadEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -493,6 +513,7 @@ export declare const syncCursorEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -513,6 +534,7 @@ export declare const syncCursorEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -533,6 +555,7 @@ export declare const syncCursorEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -574,6 +597,7 @@ export declare const seenMessageEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -594,6 +618,7 @@ export declare const seenMessageEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/inbound-mail-foundation/projection.d.ts

@@ -9,6 +9,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -49,6 +51,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -69,6 +72,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -89,6 +93,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -109,6 +114,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -129,6 +135,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -166,6 +173,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -186,6 +194,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -206,6 +215,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -226,6 +236,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -246,6 +257,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -266,6 +278,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -286,6 +299,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -306,6 +320,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -326,6 +341,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -361,6 +377,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -381,6 +398,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -403,6 +421,7 @@ export declare const mailThreadsProjectionTable: import("@cosmicdrift/kumiko-fra
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -423,6 +442,7 @@ export declare const mailThreadsProjectionTable: import("@cosmicdrift/kumiko-fra
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;