@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -121,7 +121,8 @@ export function createInboundMailSupervisor(deps) {
             return null; // korrupter Cursor = wie kein Cursor → Backfill, Dedup fängt Dubletten
         }
     }
-    async function saveCursor(accountId, cursor) {
+    async function saveCursor(account, cursor) {
+        const accountId = account.id;
         const now = Temporal.Now.instant().toString();
         const serialized = JSON.stringify(cursor);
         const existing = await fetchOne(deps.db, syncCursorTable, {
@@ -135,6 +136,8 @@ export function createInboundMailSupervisor(deps) {
         }
         await insertOne(deps.db, syncCursorTable, {
             id: crypto.randomUUID(),
+            // Direct-write store: no executor stamps the NOT NULL tenant_id for us.
+            tenantId: account.tenantId,
             accountId,
             scope: CURSOR_SCOPE,
             cursor: serialized,
@@ -227,7 +230,7 @@ export function createInboundMailSupervisor(deps) {
                     maxMessages: budget,
                 });
                 await ingestBatch(account, result.messages, JSON.stringify(result.nextCursor));
-                await saveCursor(account.id, result.nextCursor);
+                await saveCursor(account, result.nextCursor);
                 cursor = result.nextCursor;
                 budget -= result.messages.length;
                 if (!result.hasMore || budget <= 0)
@@ -267,51 +270,52 @@ export function createInboundMailSupervisor(deps) {
     // lifecycle — it keeps renewing across reconnect backoff, not just while
     // `plugin.watch()` is actually connected, so a flaky IMAP link doesn't
     // make this worker lose the account to a peer mid-backoff.
-    // kumiko-lint-ignore complexity-budget watch lease renew backoff/re-acquire loop
     function scheduleRenew(account, state, generation) {
         state.renewTimer = setTimeout(() => {
-            // kumiko-lint-ignore complexity-budget renew timer callback (renew/backoff/re-acquire)
-            void (async () => {
-                state.renewTimer = null;
-                // skip: supervisor stopped, generation superseded, or lease already lost — stale timer fire, nothing to renew.
-                if (!running || state.generation !== generation || !state.lockToken || !deps.lock)
-                    return;
-                let renewed;
-                try {
-                    renewed = await deps.lock.renew(account.id, state.lockToken, leaseTtlSeconds);
-                }
-                catch (err) {
-                    log(`inbound-mail: watch lease renew for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`);
-                    state.renewFailures += 1;
-                    // After failures spanning a full lease TTL, tear down — otherwise a
-                    // peer can acquire the expired key while we still hold an IDLE conn.
-                    if (state.renewFailures * renewIntervalMs >= leaseTtlSeconds * 1000) {
-                        log(`inbound-mail: watch lease renew for account ${account.id} failed across TTL — tearing down local watcher`);
-                        state.lockToken = null;
-                        await stopWatcher(account.id);
-                        // skip: local watcher torn down after renew failures spanning a full lease TTL.
-                        return;
-                    }
-                    if (running && state.generation === generation && state.lockToken) {
-                        scheduleRenew(account, state, generation);
-                    }
-                    // skip: renew already rescheduled above (or conditions no longer hold) — nothing left to do this tick.
-                    return;
-                }
-                state.renewFailures = 0;
-                if (!renewed) {
-                    log(`inbound-mail: watch lease for account ${account.id} lost — tearing down local watcher`);
-                    state.lockToken = null;
-                    await stopWatcher(account.id);
-                    // skip: watcher already torn down by stopWatcher() above — nothing left to do.
-                    return;
-                }
-                if (running && state.generation === generation && state.lockToken) {
-                    scheduleRenew(account, state, generation);
-                }
-            })();
+            void renewLeaseOnce(account, state, generation);
         }, renewIntervalMs);
     }
+    async function tearDownAfterRenewFailures(account, state, reason) {
+        log(`inbound-mail: watch lease ${reason} for account ${account.id} — tearing down local watcher`);
+        state.lockToken = null;
+        await stopWatcher(account.id);
+    }
+    async function renewLeaseOnce(account, state, generation) {
+        state.renewTimer = null;
+        // skip: supervisor stopped, generation superseded, or lease already lost — stale timer fire, nothing to renew.
+        if (!running || state.generation !== generation || !state.lockToken || !deps.lock)
+            return;
+        let renewed;
+        try {
+            renewed = await deps.lock.renew(account.id, state.lockToken, leaseTtlSeconds);
+        }
+        catch (err) {
+            log(`inbound-mail: watch lease renew for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+            state.renewFailures += 1;
+            // After failures spanning a full lease TTL, tear down — otherwise a
+            // peer can acquire the expired key while we still hold an IDLE conn.
+            if (state.renewFailures * renewIntervalMs >= leaseTtlSeconds * 1000) {
+                await tearDownAfterRenewFailures(account, state, "renew failed across TTL");
+                // skip: connection torn down, no reschedule
+                return;
+            }
+            rescheduleIfStillHeld(account, state, generation);
+            // skip: renew failed but TTL not yet exhausted, retry already scheduled
+            return;
+        }
+        state.renewFailures = 0;
+        if (!renewed) {
+            await tearDownAfterRenewFailures(account, state, "lost");
+            // skip: lease lost and torn down, nothing to reschedule
+            return;
+        }
+        rescheduleIfStillHeld(account, state, generation);
+    }
+    function rescheduleIfStillHeld(account, state, generation) {
+        if (running && state.generation === generation && state.lockToken) {
+            scheduleRenew(account, state, generation);
+        }
+    }
     // kumiko-lint-ignore complexity-budget yield-point stale-map check after acquire is intentional (#2460)
     async function acquireWatchLease(account, state) {
         if (!deps.lock || state.lockToken)

package/dist/jobs/handlers/list.query.d.ts

@@ -8,9 +8,14 @@ export declare const listQuery: import("@cosmicdrift/kumiko-types/define-handler
         running: "running";
     }>>;
     filters: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        field: z.ZodString;
+        field: z.ZodLiteral<"status">;
         op: z.ZodLiteral<"in">;
-        value: z.ZodArray<z.ZodString>;
+        value: z.ZodArray<z.ZodEnum<{
+            completed: "completed";
+            failed: "failed";
+            queued: "queued";
+            running: "running";
+        }>>;
     }, z.core.$strip>>>;
     sort: z.ZodOptional<z.ZodEnum<{
         duration: "duration";

package/dist/jobs/handlers/list.query.js

@@ -5,6 +5,7 @@ import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
 import { jobRunsTable } from "../job-run-table.js";
 const KMS_POOL_CONCURRENCY = 4;
+const jobRunStatusSchema = z.enum(["queued", "running", "completed", "failed"]);
 async function decryptRunRow(row) {
     let result = row;
     if (typeof result["payload"] === "string") {
@@ -23,9 +24,13 @@ export const listQuery = defineQueryHandler({
     description: "Lists job runs across all tenants newest-first, optionally filtered by job name and status; use it to check whether a job ran and whether it succeeded.",
     schema: z.object({
         jobName: z.string().optional(),
-        status: z.enum(["queued", "running", "completed", "failed"]).optional(),
+        status: jobRunStatusSchema.optional(),
         filters: z
-            .array(z.object({ field: z.string(), op: z.literal("in"), value: z.array(z.string()) }))
+            .array(z.object({
+            field: z.literal("status"),
+            op: z.literal("in"),
+            value: z.array(jobRunStatusSchema),
+        }))
             .optional(),
         sort: z.enum(["jobName", "status", "startedAt", "duration"]).optional(),
         sortDirection: z.enum(["asc", "desc"]).optional(),
@@ -47,6 +52,8 @@ export const listQuery = defineQueryHandler({
         const statuses = statusFilter?.value ?? (query.payload.status ? [query.payload.status] : []);
         if (statuses.length === 1)
             where["status"] = statuses[0];
+        else if (statuses.length > 1)
+            where["status"] = { in: statuses };
         const sortColumn = query.payload.sort ?? "startedAt";
         const rows = await selectMany(db, jobRunsTable, where, {
             orderBy: { col: sortColumn, direction: query.payload.sortDirection ?? "desc" },

package/dist/jobs/handlers/retry.write.js

@@ -1,5 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
+import { isPiiCiphertext, PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
@@ -44,7 +44,8 @@ export const retryWrite = defineWriteHandler({
         let decryptedPayloadJson = null;
         if (run.payload) {
             const decryptedPayload = await decryptStoredPii(run.payload, "payload", `job run ${event.payload.runId} payload`);
-            if (decryptedPayload === PII_ERASED_SENTINEL) {
+            // Still-ciphertext means no KMS could decrypt it (rollout mode); not JSON either.
+            if (decryptedPayload === PII_ERASED_SENTINEL || isPiiCiphertext(decryptedPayload)) {
                 return writeFailure(new UnprocessableError(JobErrors.payloadErased, {
                     i18nKey: "jobs.errors.payloadErased",
                 }));

package/dist/jobs/handlers/tenant-failures.query.js

@@ -1,17 +1,11 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { serializeJobSubject } from "@cosmicdrift/kumiko-framework/jobs";
 import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { tenantJobFailuresTable } from "../tenant-job-failure-table.js";
 const DEFAULT_LIMIT = 50;
-// Mirrors job-runner.ts's jobSubjectKey: sorted field names, so a caller that
-// passes the same subject values gets the same string the writer stored.
-function subjectKey(subject) {
-    return JSON.stringify(Object.keys(subject)
-        .sort()
-        .map((field) => [field, subject[field] ?? null]));
-}
 function isSubjectEntry(value) {
     return Array.isArray(value) && typeof value[0] === "string";
 }
@@ -28,7 +22,7 @@ function parseSubject(stored) {
 }
 export const tenantFailuresQuery = defineQueryHandler({
     name: "failures",
-    description: "Lists the calling tenant's own failed jobs — one record per job and subject, newest first, each carrying a translation key for the reason, never the provider's own error message; use it to tell a tenant that their asynchronous job failed instead of leaving the screen waiting.",
+    description: "Lists the calling tenant's own failed jobs — one record per job and subject, newest first, each carrying a translation key for the reason, never the provider's own error message; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to tell a tenant that their asynchronous job failed instead of leaving the screen waiting.",
     schema: z.object({
         jobName: z.string().optional(),
         subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
@@ -52,7 +46,7 @@ export const tenantFailuresQuery = defineQueryHandler({
         if (query.payload.jobName)
             where["jobName"] = query.payload.jobName;
         if (query.payload.subject)
-            where["subject"] = subjectKey(query.payload.subject);
+            where["subject"] = serializeJobSubject(query.payload.subject);
         const rows = await selectMany(db, tenantJobFailuresTable, where, {
             orderBy: { col: "failedAt", direction: "desc" },
             limit: query.payload.limit ?? DEFAULT_LIMIT,

package/dist/jobs/job-run-logger.js

@@ -1,6 +1,7 @@
 import { deleteMany, fetchOne, insertMany, insertOne, updateMany, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, KeyErasedError, PII_ERASED_SENTINEL, } from "@cosmicdrift/kumiko-framework/crypto";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { mapWithConcurrency } from "../shared/index.js";
 import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events.js";
@@ -128,6 +129,21 @@ async function clearTenantJobFailure(db, jobName, outcome) {
         return;
     await deleteMany(db, tenantJobFailuresTable, where);
 }
+const log = createFallbackLogger("job-run-logger");
+// The tenant failure record is an optional side write: a throw here must not
+// skip the run-row update or turn a completed run into a BullMQ retry.
+async function isolateTenantFailureWrite(write, jobName, bullJobId) {
+    try {
+        await write();
+    }
+    catch (e) {
+        log.error("tenant job failure record write failed", {
+            jobName,
+            bullJobId,
+            error: e instanceof Error ? e.message : String(e),
+        });
+    }
+}
 export function createJobRunLogger(opts) {
     const { db } = opts;
     const runIdByBullJobId = new Map();
@@ -210,7 +226,7 @@ export function createJobRunLogger(opts) {
             // Before the run-row write and independent of it: a successful run
             // clears the tenant's failure record even when the run row itself is
             // unreachable (the state-loss return below).
-            await clearTenantJobFailure(db, jobName, outcome);
+            await isolateTenantFailureWrite(() => clearTenantJobFailure(db, jobName, outcome), jobName, bullJobId);
             const resolved = await resolveRun(bullJobId);
             // skip: state loss between start + complete (worker restart, cache
             // evicted AND DB has no matching bull_job_id). Rare edge case; we
@@ -255,7 +271,7 @@ export function createJobRunLogger(opts) {
         onJobFailed: async (jobName, bullJobId, error, logs, outcome) => {
             // Mirror of onJobComplete: recorded independently of the run row, so a
             // tenant still learns their job failed if the row is unreachable.
-            await recordTenantJobFailure(db, jobName, outcome);
+            await isolateTenantFailureWrite(() => recordTenantJobFailure(db, jobName, outcome), jobName, bullJobId);
             const resolved = await resolveRun(bullJobId);
             // skip: same rare state-loss case as in onJobComplete — drop the
             // failure write rather than forge a run row from scratch.

package/dist/jobs/job-run-table.d.ts

@@ -12,6 +12,7 @@ export declare const jobRunEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -32,6 +33,7 @@ export declare const jobRunEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -52,6 +54,7 @@ export declare const jobRunEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -72,6 +75,7 @@ export declare const jobRunEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -92,6 +96,7 @@ export declare const jobRunEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -180,6 +185,7 @@ export declare const jobRunEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/jobs/tenant-job-failure-table.js

@@ -1,4 +1,4 @@
-import { asEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
+import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
 import { instant, table as pgTable, serial, sql, text, uuid, } from "@cosmicdrift/kumiko-framework/db";
 // The tenant's own view of a failed job (fw#3079). Direct-write store like
 // store_job_runs: job-run-logger.ts writes it from the BullMQ callbacks,
@@ -22,8 +22,4 @@ export const tenantJobFailuresTable = pgTable("store_tenant_job_failures", {
     messageKey: text("message_key").notNull(),
     failedAt: instant("failed_at").default(sql `now()`).notNull(),
 });
-const derivedTenantJobFailuresTableMeta = asEntityTableMeta(tenantJobFailuresTable);
-if (!derivedTenantJobFailuresTableMeta) {
-    throw new Error("tenantJobFailuresTable: table carries no EntityTableMeta — built via table()?");
-}
-export const tenantJobFailuresTableMeta = derivedTenantJobFailuresTableMeta;
+export const tenantJobFailuresTableMeta = requireEntityTableMeta(tenantJobFailuresTable, "tenantJobFailuresTable");

package/dist/ledger/entity.d.ts

@@ -9,6 +9,7 @@ export declare const accountEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -38,7 +39,7 @@ export declare const accountEntity: import("@cosmicdrift/kumiko-types/fields").E
             readonly liability?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -52,6 +53,7 @@ export declare const accountEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -72,6 +74,7 @@ export declare const accountEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -108,6 +111,7 @@ export declare const transactionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -128,6 +132,7 @@ export declare const transactionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -154,7 +159,7 @@ export declare const transactionEntity: import("@cosmicdrift/kumiko-types/fields
             readonly posted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -184,6 +189,7 @@ export declare const transactionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -204,6 +210,7 @@ export declare const transactionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -226,6 +233,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -279,7 +287,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
             readonly monthly?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -312,6 +320,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -332,6 +341,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -352,6 +362,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -372,6 +383,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -392,6 +404,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/ledger/handlers/confirm-schedule-period.write.js

@@ -4,6 +4,7 @@ import { DEFAULT_LEDGER_ACCESS } from "../constants.js";
 import { accountExecutor, scheduleExecutor, transactionExecutor, transactionTable, } from "../executor.js";
 import { findReversedIds, isoMonth, scheduleReference } from "../recurring.js";
 import { confirmSchedulePeriodPayloadSchema, } from "../schemas.js";
+import { readSubjectReference } from "../subject-reference.js";
 // confirm-schedule-period — turn ONE projected period of a schedule into a posted,
 // balanced transaction (debit +amount / credit −amount), tagged with
 // scheduleReference(scheduleId, period) so the host can merge Soll vs. Ist.
@@ -70,8 +71,7 @@ export function createConfirmSchedulePeriodHandler(access = DEFAULT_LEDGER_ACCES
             const amount = payload.amount ?? Number(schedule["amount"]);
             // The subject is a property of the schedule, not the confirm call — a
             // period without one stays without one, no backfill/error.
-            const subjectType = typeof schedule["subjectType"] === "string" ? schedule["subjectType"] : null;
-            const subjectId = typeof schedule["subjectId"] === "string" ? schedule["subjectId"] : null;
+            const { subjectType, subjectId } = readSubjectReference(schedule);
             const created = await transactionExecutor.create({
                 id: generateId(),
                 date: payload.date ?? `${payload.period}-01`,

package/dist/ledger/handlers/reverse-transaction.write.js

@@ -4,6 +4,7 @@ import { DEFAULT_LEDGER_ACCESS } from "../constants.js";
 import { transactionExecutor, transactionTable } from "../executor.js";
 import { normalizeLines } from "../reports.js";
 import { reverseTransactionPayloadSchema } from "../schemas.js";
+import { readSubjectReference } from "../subject-reference.js";
 // reverse-transaction (Storno) — the ONLY correction path for a posted entry.
 // Books the mirror image (every amount negated) as a new posted entry that
 // references the original, leaving the original untouched. This is why
@@ -51,8 +52,7 @@ export function createReverseTransactionHandler(access = DEFAULT_LEDGER_ACCESS)
             }));
             // The reversal shares its subject with the original so filtering by
             // subjectId still finds the Storno; unset on the original stays unset.
-            const subjectType = typeof original["subjectType"] === "string" ? original["subjectType"] : null;
-            const subjectId = typeof original["subjectId"] === "string" ? original["subjectId"] : null;
+            const { subjectType, subjectId } = readSubjectReference(original);
             return transactionExecutor.create({
                 id: generateId(),
                 // Pass the original's date through untyped — create takes Record<string,

package/dist/ledger/subject-reference.d.ts

@@ -0,0 +1,4 @@
+export declare function readSubjectReference(row: Record<string, unknown>): {
+    subjectType: string | null;
+    subjectId: string | null;
+};

package/dist/ledger/subject-reference.js

@@ -0,0 +1,7 @@
+// Subject columns are nullable; anything that is not a string reads as unset.
+export function readSubjectReference(row) {
+    return {
+        subjectType: typeof row["subjectType"] === "string" ? row["subjectType"] : null,
+        subjectId: typeof row["subjectId"] === "string" ? row["subjectId"] : null,
+    };
+}

package/dist/legal-pages/feature.js

@@ -36,6 +36,12 @@ export function createLegalPagesFeature(opts = {}) {
     const routes = opts.routes ?? LEGAL_ROUTES;
     const requiredBlocks = opts.requiredBlocks ?? LEGAL_REQUIRED_BLOCKS;
     validateRoutes(routes);
+    if (opts.routes !== undefined && opts.routes.length > 0 && opts.requiredBlocks === undefined) {
+        const coversDefaultBlock = LEGAL_REQUIRED_BLOCKS.some((block) => opts.routes?.some((route) => route.slug === block.slug && route.lang === block.lang));
+        if (!coversDefaultBlock) {
+            throw new Error("legal-pages: custom `routes` without `requiredBlocks` — pass `requiredBlocks` explicitly (or `[]`)");
+        }
+    }
     return defineFeature("legal-pages", (r) => {
         r.describe("Opt-in wrapper around `template-resolver` text-blocks that registers public HTML routes (default: `/legal/impressum`, `/legal/datenschutz`, `/legal/imprint`, `/legal/privacy`) with Markdown-to-HTML rendering and a boot-time job that hard-fails in production when the required blocks (default: `imprint/de`, `privacy/de`) are not seeded in `SYSTEM_TENANT`. Both are configurable via `routes`/`requiredBlocks` for apps with a different default language or additional pages. Requires `anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID }` and `extraContext.templateResolver` to be wired at app bootstrap; for per-tenant imprints or a custom layout call `template-resolver:query:by-slug` directly.");
         r.uiHints({
@@ -75,9 +81,10 @@ export function createLegalPagesFeature(opts = {}) {
                     }
                     const etag = computeRevisionEtag([
                         SYSTEM_TENANT_ID,
+                        route.path,
                         route.slug,
                         route.lang,
-                        data.updatedAt,
+                        String(data.modifiedAt ?? ""),
                     ]);
                     const extra = { "content-type": "text/html; charset=utf-8" };
                     // 304 (Revision unverändert) und HEAD überspringen beide das

package/dist/managed-pages/handlers/branding.query.js

@@ -18,7 +18,7 @@ export function createBrandingQuery(opts) {
         name: "branding",
         schema: z.object({}),
         access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-        rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+        rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
         description: "Reads the tenant's public branding values for the rendered page shell, adding the raw custom CSS only when the app opted in and the per-tenant CSS toggle is on; anonymous callers may read it because it dresses public pages.",
         handler: async (_query, ctx) => {
             const base = await readBranding(ctx.config);

package/dist/managed-pages/handlers/by-slug.query.js

@@ -15,7 +15,7 @@ export const bySlugQuery = defineQueryHandler({
         lang: z.string().min(2).max(8),
     }),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
     description: "Reads the body and metadata of one published managed page of the caller's tenant by slug and language, returning null for drafts and bodyless pages; use it to render a public page, not to load one for editing.",
     handler: async (query, ctx) => {
         const row = await fetchOne(ctx.db, pagesTable, {

package/dist/managed-pages/handlers/by-tenant-published.query.js

@@ -11,7 +11,7 @@ export const byTenantPublishedQuery = defineQueryHandler({
         tenantIdOverride: z.string().min(1).optional(),
     }),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
     description: "Lists every published page of a tenant with slug, language, title and last-change time but no body; use it to enumerate the public pages for sitemap.xml or llms.txt, rather than by-slug which fetches one page's content.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;