@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/managed-pages/table.d.ts

@@ -9,6 +9,7 @@ export declare const pageEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const pageEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -49,6 +51,7 @@ export declare const pageEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -69,6 +72,7 @@ export declare const pageEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -89,6 +93,7 @@ export declare const pageEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -109,6 +114,7 @@ export declare const pageEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -134,6 +140,7 @@ export declare const pagesTable: import("@cosmicdrift/kumiko-framework/db").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -154,6 +161,7 @@ export declare const pagesTable: import("@cosmicdrift/kumiko-framework/db").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -174,6 +182,7 @@ export declare const pagesTable: import("@cosmicdrift/kumiko-framework/db").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -194,6 +203,7 @@ export declare const pagesTable: import("@cosmicdrift/kumiko-framework/db").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -214,6 +224,7 @@ export declare const pagesTable: import("@cosmicdrift/kumiko-framework/db").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -234,6 +245,7 @@ export declare const pagesTable: import("@cosmicdrift/kumiko-framework/db").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/metrics/compute.js

@@ -111,7 +111,13 @@ export async function runMetric(db, metric, params) {
         ? bucketStartsMs(window, bucket, params.timeZone)
         : [];
     const fillBuckets = (byBucketMs) => bucketStarts.map((atMs) => ({ atMs, value: byBucketMs.get(atMs) ?? gapValue }));
-    const points = fillBuckets(new Map(aggregates.points.map((row) => [Number(row.keys[0]), row.value])));
+    // Grouped metrics carry their time series in `series`; fetchAggregates skips the total series, so filling gaps here would fake a flat zero line.
+    const points = metric.groupBy === undefined
+        ? fillBuckets(new Map(aggregates.points.map((row) => [
+            Number(row.keys[0]),
+            row.value,
+        ])))
+        : [];
     const rows = buildRows(metric, aggregates, value, labelOf);
     return {
         value,

package/dist/metrics/window.js

@@ -12,7 +12,12 @@ const RANGE_DAYS = {
     "14d": 14,
     "30d": 30,
 };
+// Offset strings ("+01:00") pass Intl/Temporal as ISO offsets but Postgres
+// date_trunc reads them as POSIX zones with the opposite sign, so only named
+// zones are accepted.
 export function isValidTimeZone(timeZone) {
+    if (/^[+-]/.test(timeZone))
+        return false;
     try {
         new Intl.DateTimeFormat(undefined, { timeZone });
         return true;

package/dist/notes-history/entity.d.ts

@@ -10,6 +10,7 @@ export declare function createNoteEntryEntity(access?: EntityDefinition["access"
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -30,6 +31,7 @@ export declare function createNoteEntryEntity(access?: EntityDefinition["access"
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -50,6 +52,7 @@ export declare function createNoteEntryEntity(access?: EntityDefinition["access"
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -70,6 +73,7 @@ export declare function createNoteEntryEntity(access?: EntityDefinition["access"
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -108,6 +112,7 @@ export declare const noteEntryEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -128,6 +133,7 @@ export declare const noteEntryEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -148,6 +154,7 @@ export declare const noteEntryEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -168,6 +175,7 @@ export declare const noteEntryEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -206,6 +214,7 @@ export declare function createNoteMentionEntity(): EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -226,6 +235,7 @@ export declare function createNoteMentionEntity(): EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -248,6 +258,7 @@ export declare const noteMentionEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -268,6 +279,7 @@ export declare const noteMentionEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/notes-history/handlers/add-note.write.js

@@ -1,6 +1,5 @@
 import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
-import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { decryptStoredPii, joinRowParentIsVisible } from "../../shared/index.js";
+import { decryptStoredPii, denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { userTable } from "../../user/index.js";
 import { DEFAULT_NOTES_HISTORY_ACCESS } from "../constants.js";
 import { noteEntryExecutor, noteMentionExecutor } from "../executor.js";
@@ -29,13 +28,9 @@ export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS) {
         },
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            // NotFoundError, not an access-denied error, so the response doesn't
-            // double as an existence oracle — same policy as executor.detail,
-            // which never distinguishes "no access" from "doesn't exist".
-            const visible = await joinRowParentIsVisible(ctx.registry, "note-entry", payload, event.user, ctx.db);
-            if (!visible) {
-                return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
-            }
+            const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "note-entry", payload, event.user, ctx.db);
+            if (denied)
+                return denied;
             let authorName = null;
             try {
                 // read_users is tenant-agnostic → ctx.db.unsafeRaw, not the tenant-scoped ctx.db.

package/dist/notes-history-user-data/hooks.js

@@ -4,7 +4,7 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
-import { resolveRetentionPolicyForTenant } from "../data-retention/index.js";
+import { resolveRetentionPolicyForTenant, resolveTenantRetentionPreset, } from "../data-retention/index.js";
 import { noteEntryTable, noteMentionTable } from "../notes-history/index.js";
 import { policyToStrategy } from "../user-data-rights/index.js";
 // note-entry has no per-tenant scope quirk (unlike folders) — it's genuinely
@@ -58,6 +58,12 @@ export const noteEntryDeleteHook = async (ctx) => {
     if (mentions.length === 0)
         return;
     const noteIds = new Set(mentions.map((m) => m.noteId));
+    // Once per hook run: the preset depends on the tenant only, not the note.
+    const tenantPreset = await resolveTenantRetentionPreset({
+        db: ctx.db,
+        registry: ctx.registry,
+        tenantId: ctx.tenantId,
+    });
     for (const noteId of noteIds) {
         const note = await ctx.db.fetchOne(noteEntryTable, { id: noteId });
         // Defensive: append-only rows are never hard-deleted, so this shouldn't
@@ -69,6 +75,7 @@ export const noteEntryDeleteHook = async (ctx) => {
             registry: ctx.registry,
             tenantId: ctx.tenantId,
             entityName: note.entityType,
+            preloadedTenantPreset: tenantPreset,
         });
         if (policyToStrategy(hostPolicy.policy?.strategy ?? null) === "anonymize")
             continue;

package/dist/personal-access-tokens/constants.d.ts

@@ -1,4 +1,5 @@
 export declare const PAT_FEATURE = "personal-access-tokens";
+export declare const API_TOKEN_ENTITY_NAME: "api-token";
 export declare const PatErrors: {
     readonly ownershipDenied: "ownership_denied";
     readonly reauthRequired: "reauth_required";

package/dist/personal-access-tokens/constants.js

@@ -2,6 +2,7 @@
 // Pure constants — client-marked so the web screen (web/) may import screen-id
 // and QN names without pulling the feature's server runtime barrel.
 export const PAT_FEATURE = "personal-access-tokens";
+export const API_TOKEN_ENTITY_NAME = "api-token";
 // Snake_case reason strings (Error-Reasons guard: no colons/dashes).
 export const PatErrors = {
     ownershipDenied: "ownership_denied",

package/dist/personal-access-tokens/feature.js

@@ -2,7 +2,7 @@ import { EXT_TOKEN_VERIFIER, } from "@cosmicdrift/kumiko-bundled-features/auth-f
 import { PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE } from "./constants.js";
+import { API_TOKEN_ENTITY_NAME, PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, } from "./constants.js";
 import { buildAvailableScopesQuery } from "./handlers/available-scopes.query.js";
 import { createPatCreateHandler } from "./handlers/create.write.js";
 import { listPatQuery } from "./handlers/list.query.js";
@@ -62,7 +62,7 @@ export function createPersonalAccessTokensFeature(options) {
         // Direct-write store like store_user_sessions: create/revoke write it, the
         // resolver point-reads it. r.entity would make it a rebuildable projection
         // whose replay (no token events) would wipe every live token (#498/#494).
-        r.storeTable(deriveEntityTableMeta("api-token", apiTokenEntity, { source: "unmanaged" }), {
+        r.storeTable(deriveEntityTableMeta(API_TOKEN_ENTITY_NAME, apiTokenEntity, { source: "unmanaged" }), {
             reason: "read_side.api_tokens_direct_write",
             // create.write encrypts `name` via encryptForDirectWrite (#820).
             piiEncryptedOnWrite: true,

package/dist/personal-access-tokens/handlers/create.write.js

@@ -6,7 +6,7 @@ import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 import { encryptForDirectWrite, verifyPassword } from "../../shared/index.js";
 import { UserQueries } from "../../user/index.js";
-import { PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors } from "../constants.js";
+import { API_TOKEN_ENTITY_NAME, PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors } from "../constants.js";
 import { mintPatToken } from "../hash.js";
 import { apiTokenEntity, apiTokenTable } from "../schema/api-token.js";
 // @wrapper-known error-helper
@@ -67,7 +67,7 @@ export function createPatCreateHandler(opts = {}) {
             const { raw, hash, prefix } = mintPatToken();
             const now = Temporal.Now.instant();
             const id = generateId();
-            const row = await encryptForDirectWrite(apiTokenEntity, "api-token", {
+            const row = await encryptForDirectWrite(apiTokenEntity, API_TOKEN_ENTITY_NAME, {
                 id,
                 userId: event.user.id,
                 tenantId: event.user.tenantId,

package/dist/personal-access-tokens/handlers/revoke.write.js

@@ -4,7 +4,7 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
-import { PatErrors } from "../constants.js";
+import { API_TOKEN_ENTITY_NAME, PatErrors } from "../constants.js";
 import { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN } from "../pat-revoked-event.js";
 import { apiTokenTable } from "../schema/api-token.js";
 // Revoke one of the caller's own tokens. Ownership is enforced in the WHERE
@@ -43,7 +43,7 @@ export const revokePatWrite = defineWriteHandler({
             i18nKey: "errors.ownershipDenied",
             details: {
                 scope: "entity",
-                entityName: "api-token",
+                entityName: API_TOKEN_ENTITY_NAME,
                 action: "revoke",
                 userId: event.user.id,
             },

package/dist/personal-access-tokens/i18n.js

@@ -1,3 +1,8 @@
+import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
+import { fieldLabelKey, fieldOptionLabelKey } from "@cosmicdrift/kumiko-headless";
+import { PAT_FEATURE } from "./constants.js";
+const mintFieldKey = (field) => fieldLabelKey(PAT_FEATURE, ACTION_FORM_ENTITY, field);
+const scopeOptionKey = (grant) => fieldOptionLabelKey(PAT_FEATURE, ACTION_FORM_ENTITY, "scopes", grant);
 export const PAT_FEATURE_I18N = {
     "screen:api-tokens.title": { en: "Personal Access Tokens" },
     "screen:api-token-create.title": { en: "Create a new token" },
@@ -23,13 +28,11 @@ export const PAT_FEATURE_I18N = {
     // (`__action-form__`, see action-form-shim.ts) — required by the i18n
     // boot-validator (requiredKeysFromScreen); the declarative renderer
     // resolves these through the schema payload, not a client component's t().
-    "personal-access-tokens:entity:__action-form__:field:name": { en: "Name" },
-    "personal-access-tokens:entity:__action-form__:field:scopes": { en: "Per-API access" },
-    "personal-access-tokens:entity:__action-form__:field:expiresInDays": { en: "Expires in (days)" },
-    "personal-access-tokens:entity:__action-form__:field:currentPassword": {
-        en: "Password (to confirm)",
-    },
-    "personal-access-tokens:entity:__action-form__:field:mfaCode": { en: "2FA code (if enabled)" },
+    [mintFieldKey("name")]: { en: "Name" },
+    [mintFieldKey("scopes")]: { en: "Per-API access" },
+    [mintFieldKey("expiresInDays")]: { en: "Expires in (days)" },
+    [mintFieldKey("currentPassword")]: { en: "Password (to confirm)" },
+    [mintFieldKey("mfaCode")]: { en: "2FA code (if enabled)" },
 };
 // Per-grant-option labels for the mint form's `scopes` multiSelect —
 // "<domain> (read)" / "<domain> (read & write)", matching the wording the
@@ -38,13 +41,9 @@ export const PAT_FEATURE_I18N = {
 export function patScopeOptionTranslations(scopes) {
     const out = {};
     for (const [domain, def] of Object.entries(scopes)) {
-        out[`personal-access-tokens:entity:__action-form__:field:scopes:option:${domain}:read`] = {
-            en: `${def.label} (read)`,
-        };
+        out[scopeOptionKey(`${domain}:read`)] = { en: `${def.label} (read)` };
         if (def.write && def.write.length > 0) {
-            out[`personal-access-tokens:entity:__action-form__:field:scopes:option:${domain}:write`] = {
-                en: `${def.label} (read & write)`,
-            };
+            out[scopeOptionKey(`${domain}:write`)] = { en: `${def.label} (read & write)` };
         }
     }
     return out;

package/dist/personal-access-tokens/schema/api-token.d.ts

@@ -9,6 +9,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -49,6 +51,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -69,6 +72,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -89,6 +93,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -109,6 +114,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/personal-access-tokens/schema/api-token.js

@@ -1,5 +1,6 @@
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { access, createEntity, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+import { API_TOKEN_ENTITY_NAME } from "../constants.js";
 // One row per Personal Access Token. Like store_user_sessions this is a
 // direct-write store (r.unmanagedTable): the create/revoke handlers write it and
 // the resolver point-reads it on the hot auth path. `tokenHash` is the SHA-256
@@ -80,6 +81,6 @@ export const apiTokenEntity = createEntity({
 // deriveEntityTableMeta (not buildEntityTable): this is a direct-write store, so
 // the table must be a WritableTable (post ES-write-brand #742) — same as
 // sessions' userSessionTable. buildEntityTable is branded executor-only.
-export const apiTokenTable = deriveEntityTableMeta("api-token", apiTokenEntity, {
+export const apiTokenTable = deriveEntityTableMeta(API_TOKEN_ENTITY_NAME, apiTokenEntity, {
     source: "unmanaged",
 });

package/dist/personal-access-tokens/screens.js

@@ -1,10 +1,14 @@
-import { i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
+import { i18nKey, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries } from "./constants.js";
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
 export const patListScreen = {
     id: PAT_SCREEN_ID,
     type: "projectionList",
     query: PatQueries.mine,
+    // The `mine` handler honours `limit` only (no offset/total), so a pager would
+    // show page 1 forever: send one max-size request and render no pager.
+    pagination: false,
+    pageSize: MAX_LIST_LIMIT,
     defaultSort: { field: "createdAt", dir: "desc" },
     columns: [
         { field: "name", label: i18nKey("pat.list.col.name") },

package/dist/rate-limiting/feature.js

@@ -1,5 +1,6 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { rateLimitStatus } from "./handlers/status.query.js";
+import { RATE_LIMITING_I18N } from "./i18n.js";
 // Opt-in feature. Loading it does NOT install rate-limit middleware —
 // the framework auto-wires the L3 dispatcher hook and the resolver
 // when (a) at least one handler declared a rateLimit option, OR (b) the
@@ -17,5 +18,6 @@ export function createRateLimitingFeature() {
             recommended: false,
         });
         r.queryHandler(rateLimitStatus);
+        r.translations({ keys: RATE_LIMITING_I18N });
     }, { dedupeOptions: {} });
 }

package/dist/rate-limiting/handlers/bucket-access.js

@@ -1,23 +1,31 @@
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
 import { RateLimitErrors } from "../constants.js";
+// Typed against RateLimitPer so a renamed dimension in bucket.ts
+// breaks the typecheck instead of silently denying access.
+const BUCKET_OWNER_KIND = {
+    tenant: "tenant",
+    "tenant+handler": "tenant",
+    user: "user",
+    "user+handler": "user",
+};
+function isOwnableDimension(dimension) {
+    return Object.hasOwn(BUCKET_OWNER_KIND, dimension);
+}
 function ownsBucket(bucket, caller) {
     const [dimension, subject, ...handler] = bucket.split(":");
     if (dimension === undefined)
         return false;
-    const owner = dimension === "tenant" || dimension === "tenant+handler"
-        ? caller.tenantId
-        : dimension === "user" || dimension === "user+handler"
-            ? caller.id
-            : undefined;
-    if (owner === undefined)
+    if (!isOwnableDimension(dimension))
         return false;
+    const owner = BUCKET_OWNER_KIND[dimension] === "tenant" ? caller.tenantId : caller.id;
     // Segment-exact: a startsWith check would pass `tenant:<own-id>-other`.
     if (subject !== owner)
         return false;
     return dimension.endsWith("+handler") ? handler.length > 0 : handler.length === 0;
 }
 export function bucketAccessDenied(bucket, caller) {
-    if (caller.roles.includes("SystemAdmin"))
+    if (caller.roles.includes(ROLES.SystemAdmin))
         return undefined;
     if (ownsBucket(bucket, caller))
         return undefined;

package/dist/rate-limiting/i18n.d.ts

@@ -0,0 +1,10 @@
+export declare const RATE_LIMITING_I18N: {
+    readonly "rateLimiting.errors.bucketOutsideTenant": {
+        readonly en: "You can only inspect rate-limit buckets that belong to your own tenant or user.";
+        readonly de: "Du kannst nur Rate-Limit-Buckets deines eigenen Mandanten oder Benutzers einsehen.";
+    };
+    readonly "rateLimiting.errors.resolverUnavailable": {
+        readonly en: "Rate limiting is not available on this server.";
+        readonly de: "Rate-Limiting ist auf diesem Server nicht verfügbar.";
+    };
+};

package/dist/rate-limiting/i18n.js

@@ -0,0 +1,10 @@
+export const RATE_LIMITING_I18N = {
+    "rateLimiting.errors.bucketOutsideTenant": {
+        en: "You can only inspect rate-limit buckets that belong to your own tenant or user.",
+        de: "Du kannst nur Rate-Limit-Buckets deines eigenen Mandanten oder Benutzers einsehen.",
+    },
+    "rateLimiting.errors.resolverUnavailable": {
+        en: "Rate limiting is not available on this server.",
+        de: "Rate-Limiting ist auf diesem Server nicht verfügbar.",
+    },
+};

package/dist/secrets/feature.js

@@ -9,6 +9,7 @@ import { rotateJob } from "./handlers/rotate.job.js";
 import { createSetHandler } from "./handlers/set.write.js";
 import { secretReadSchema } from "./secrets-context.js";
 import { tenantSecretEntity, tenantSecretsTable } from "./table.js";
+const ROTATE_ESCAPE_HATCH_REASON = "re-encrypts every tenant's secrets with the new master key";
 /**
  * Env-vars contract for the `secrets` feature. Apps merge this via
  * `composeEnvSchema({ features: [secretsFeature, ...] })` so boot-time
@@ -130,9 +131,9 @@ export function createSecretsFeature(opts = {}) {
             name: "rotate",
             trigger: { manual: true },
             escapeHatch: {
-                reason: "re-encrypts every tenant's secrets with the new master key",
+                reason: ROTATE_ESCAPE_HATCH_REASON,
             },
-            handler: (payload, ctx) => rotateJob(payload, ctx, ctx.db.unsafeRaw("re-encrypts every tenant's secrets with the new master key")),
+            handler: (payload, ctx) => rotateJob(payload, ctx, ctx.db.unsafeRaw(ROTATE_ESCAPE_HATCH_REASON)),
         });
         // Pre-ES had a separate `retention-cleanup` job scrubbing the audit
         // table on a compliance-driven schedule (90d default). Post-ES the

package/dist/secrets/table.d.ts

@@ -14,6 +14,7 @@ export declare const tenantSecretEntity: import("@cosmicdrift/kumiko-types/field
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/seo/handlers/seo-config.query.js

@@ -17,7 +17,7 @@ export const seoConfigQuery = defineQueryHandler({
     name: "config",
     schema: z.object({}),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
     description: "Reads the tenant's SEO metadata settings — organization name and logo URL, Twitter site handle, LLMs summary and default OG image — as plain strings; use it to inspect what the sitemap, llms.txt and page meta tags will publish.",
     handler: async (_query, ctx) => {
         const read = async (qualifiedKey) => {

package/dist/sessions/constants.d.ts

@@ -1,4 +1,5 @@
 export declare const SESSIONS_FEATURE: "sessions";
+export declare const USER_SESSION_ENTITY_NAME: "user-session";
 export declare const SessionHandlers: {
     readonly revoke: "sessions:write:user-session:revoke";
     readonly revokeAllOthers: "sessions:write:user-session:revoke-all-others";

package/dist/sessions/constants.js

@@ -1,4 +1,5 @@
 export const SESSIONS_FEATURE = "sessions";
+export const USER_SESSION_ENTITY_NAME = "user-session";
 // Qualified write handler names — entity prefix is "userSession", snake_case
 // "user_session" on the wire.
 export const SessionHandlers = {

package/dist/sessions/feature.js

@@ -1,6 +1,7 @@
 import { EXT_SESSION_STORE, } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { USER_SESSION_ENTITY_NAME } from "./constants.js";
 import { cleanupJob } from "./handlers/cleanup.job.js";
 import { detailQuery } from "./handlers/detail.query.js";
 import { listQuery } from "./handlers/list.query.js";
@@ -13,6 +14,7 @@ import { userSessionEntity } from "./schema/user-session.js";
 import { sessionDetailScreen, sessionListScreen, sessionMineScreen } from "./screens.js";
 import { createSessionCallbacks, } from "./session-callbacks.js";
 import { SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema } from "./session-revoked-event.js";
+const CLEANUP_ESCAPE_HATCH_REASON = "deletes expired session rows of every tenant";
 // Reads the late-bind setter off a mounted sessions feature's exports.
 // run{Prod,Dev}App call it once the DB connection is concrete — the feature
 // itself is constructed in app run-config long before a db exists, so the
@@ -66,7 +68,7 @@ export function createSessionsFeature(options) {
         // (#498/#494). r.storeTable keeps the migration DDL but opts the
         // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
         // which are direct-write stores too.
-        r.storeTable(deriveEntityTableMeta("user-session", userSessionEntity, { source: "unmanaged" }), {
+        r.storeTable(deriveEntityTableMeta(USER_SESSION_ENTITY_NAME, userSessionEntity, { source: "unmanaged" }), {
             reason: "read_side.user_sessions_direct_write",
             // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
             piiEncryptedOnWrite: true,
@@ -118,8 +120,8 @@ export function createSessionsFeature(options) {
         r.job({
             name: "cleanup",
             trigger: { manual: true },
-            escapeHatch: { reason: "deletes expired session rows of every tenant" },
-            handler: (payload, ctx) => cleanupJob(payload, ctx, ctx.db.unsafeRaw("deletes expired session rows of every tenant")),
+            escapeHatch: { reason: CLEANUP_ESCAPE_HATCH_REASON },
+            handler: (payload, ctx) => cleanupJob(payload, ctx, ctx.db.unsafeRaw(CLEANUP_ESCAPE_HATCH_REASON)),
         });
         // Cross-feature entity hook on "user". `r.entityHook` (NOT `r.hook`) is
         // the supported cross-feature path: entity-keyed, not prefixed by the