@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/tags/entity.d.ts

@@ -10,6 +10,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -30,6 +31,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -50,6 +52,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -72,6 +75,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -92,6 +96,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -112,6 +117,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -134,6 +140,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -154,6 +161,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -174,6 +182,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/tags/handlers/assign-tag.write.js

@@ -1,5 +1,5 @@
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { joinRowParentIsVisible } from "../../shared/index.js";
+import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { tagAssignmentAggregateId } from "../aggregate-id.js";
 import { DEFAULT_TAG_ACCESS } from "../constants.js";
 import { tagAssignmentExecutor, tagExecutor } from "../executor.js";
@@ -33,15 +33,9 @@ export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS) {
         description: "Attaches an existing catalog tag to one host entity addressed by its type and id, reporting success when the tag was already attached; use it to tag a record, not to create the tag.",
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            // entityType/entityId are client input: the caller must be able to see
-            // the host row through that entity's own read path (tenant scope plus its
-            // `access.read` ownership) before its assignment row may be written.
-            // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
-            // an invisible parent apart from a missing assignment or an unknown tag —
-            // every path answers with the same NotFoundError.
-            if (!(await joinRowParentIsVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db))) {
-                return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
-            }
+            const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db);
+            if (denied)
+                return denied;
             const id = tagAssignmentAggregateId(event.user.tenantId, payload.tagId, payload.entityType, payload.entityId);
             const existing = await tagAssignmentExecutor.detail({ id }, event.user, ctx.db);
             if (existing) {

package/dist/tags/handlers/remove-tag.write.js

@@ -1,5 +1,4 @@
-import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { joinRowParentIsVisible } from "../../shared/index.js";
+import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { tagAssignmentAggregateId } from "../aggregate-id.js";
 import { DEFAULT_TAG_ACCESS } from "../constants.js";
 import { tagAssignmentExecutor } from "../executor.js";
@@ -19,15 +18,9 @@ export function createRemoveTagHandler(access = DEFAULT_TAG_ACCESS) {
         description: "Detaches one catalog tag from one host entity, reporting success when it was not attached; use it to untag a single record while the tag itself stays in the catalog.",
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            // entityType/entityId are client input: the caller must be able to see
-            // the host row through that entity's own read path (tenant scope plus its
-            // `access.read` ownership) before its assignment row may be written.
-            // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
-            // an invisible parent apart from a missing assignment or an unknown tag —
-            // every path answers with the same NotFoundError.
-            if (!(await joinRowParentIsVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db))) {
-                return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
-            }
+            const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db);
+            if (denied)
+                return denied;
             const id = tagAssignmentAggregateId(event.user.tenantId, payload.tagId, payload.entityType, payload.entityId);
             const existing = await tagAssignmentExecutor.detail({ id }, event.user, ctx.db);
             if (!existing) {

package/dist/template-resolver/api.d.ts

@@ -1,5 +1,6 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "temporal-polyfill";
 import type { ContentFormat, TemplateKind } from "./constants.js";
 export type TemplateResource = {
     readonly id: string;
@@ -17,7 +18,7 @@ export type TemplateResource = {
     readonly scope: "system" | "tenant";
     readonly parentTemplateId: string | null;
     readonly status: "draft" | "active" | "archived";
-    readonly updatedAt: Date;
+    readonly modifiedAt: Temporal.Instant | null;
 };
 export type ResolveRequest = {
     readonly tenantId: TenantId;

package/dist/template-resolver/api.js

@@ -70,7 +70,7 @@ function toPublic(row) {
         scope,
         parentTemplateId: row.parentTemplateId,
         status,
-        updatedAt: row.updatedAt,
+        modifiedAt: row.modifiedAt,
     };
 }
 function parseJson(raw) {

package/dist/template-resolver/handlers/by-slug.query.d.ts

@@ -10,5 +10,5 @@ export declare const bySlugQuery: import("@cosmicdrift/kumiko-types/define-handl
     content: string | null;
     contentFormat: string;
     folder: string | null;
-    updatedAt: Date;
+    modifiedAt: import("temporal-spec").Temporal.Instant | null;
 } | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/by-slug.query.js

@@ -24,7 +24,7 @@ export const bySlugQuery = defineQueryHandler({
         tenantIdOverride: z.string().min(1).optional(),
     }),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
     description: "Reads one text-block of a tenant by slug and locale together with its body and format; it is pinned to the text-block kind so mail templates and AI prompts in the same table stay unreachable through this anonymous-capable path.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;
@@ -47,7 +47,7 @@ export const bySlugQuery = defineQueryHandler({
             content: row.content,
             contentFormat: row.contentFormat,
             folder: row.folder,
-            updatedAt: row.updatedAt,
+            modifiedAt: row.modifiedAt,
         };
     },
 });

package/dist/template-resolver/handlers/by-tenant.query.d.ts

@@ -1,3 +1,4 @@
+import type { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 export type TextBlockSummary = {
     readonly slug: string;
@@ -5,7 +6,7 @@ export type TextBlockSummary = {
     readonly title: string | null;
     readonly content: string | null;
     readonly folder: string | null;
-    readonly updatedAt: Date;
+    readonly modifiedAt: Temporal.Instant | null;
 };
 export declare const byTenantQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"by-tenant", z.ZodObject<{
     tenantIdOverride: z.ZodOptional<z.ZodString>;
@@ -16,6 +17,6 @@ export declare const byTenantQuery: import("@cosmicdrift/kumiko-types/define-han
         title: string | null;
         content: string | null;
         folder: string | null;
-        updatedAt: Date;
+        modifiedAt: Temporal.Instant | null;
     }[];
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/by-tenant.query.js

@@ -11,7 +11,7 @@ export const byTenantQuery = defineQueryHandler({
         tenantIdOverride: z.string().min(1).optional(),
     }),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
     description: "Lists every text-block of a tenant with slug, locale, title and body so a public content tree can be rendered in one call; use it for the whole sidebar, and by-slug when only one block is needed.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;
@@ -27,7 +27,7 @@ export const byTenantQuery = defineQueryHandler({
                 title: row.title,
                 content: row.content,
                 folder: row.folder,
-                updatedAt: row.updatedAt,
+                modifiedAt: row.modifiedAt,
             })),
         };
     },

package/dist/template-resolver/handlers/collection-item.query.d.ts

@@ -11,5 +11,5 @@ export declare function makeCollectionItemQuery(collection: ContentCollectionDef
     content: string | null;
     contentFormat: string;
     folder: string | null;
-    updatedAt: Date;
+    modifiedAt: import("temporal-spec").Temporal.Instant | null;
 } | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/collection-list.query.d.ts

@@ -10,6 +10,6 @@ export declare function makeCollectionListQuery(collection: ContentCollectionDef
         content: string | null;
         contentFormat: string;
         folder: string | null;
-        updatedAt: Date;
+        modifiedAt: import("temporal-spec").Temporal.Instant | null;
     }[];
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/collection-shared.d.ts

@@ -1,5 +1,6 @@
 import type { EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import type { AccessRule, ContentCollectionDefinition, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "temporal-polyfill";
 import { templateResourcesTable } from "../table.js";
 import { userContentEntriesTable } from "../user-content-table.js";
 export declare const DEFAULT_COLLECTION_ACCESS: AccessRule;
@@ -12,7 +13,7 @@ export type CollectionEntryRow = {
     readonly content: string | null;
     readonly contentFormat: string;
     readonly folder: string | null;
-    readonly updatedAt: Date;
+    readonly modifiedAt: Temporal.Instant | null;
 };
 export type CollectionStore = {
     readonly table: typeof templateResourcesTable | typeof userContentEntriesTable;
@@ -30,5 +31,5 @@ export declare function toCollectionEntry(row: CollectionEntryRow): {
     content: string | null;
     contentFormat: string;
     folder: string | null;
-    updatedAt: Date;
+    modifiedAt: Temporal.Instant | null;
 };

package/dist/template-resolver/handlers/collection-shared.js

@@ -45,6 +45,6 @@ export function toCollectionEntry(row) {
         content: row.content,
         contentFormat: row.contentFormat,
         folder: row.folder,
-        updatedAt: row.updatedAt,
+        modifiedAt: row.modifiedAt,
     };
 }

package/dist/template-resolver/handlers/find-by-id.query.d.ts

@@ -15,5 +15,5 @@ export declare const findByIdQuery: import("@cosmicdrift/kumiko-types/define-han
     scope: string;
     parentTemplateId: string | null;
     status: string;
-    updatedAt: Date;
+    modifiedAt: import("temporal-spec").Temporal.Instant | null;
 } | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/find-by-id.query.js

@@ -37,7 +37,7 @@ export const findByIdQuery = defineQueryHandler({
             scope: row.scope,
             parentTemplateId: row.parentTemplateId,
             status: row.status,
-            updatedAt: row.updatedAt,
+            modifiedAt: row.modifiedAt,
         };
     },
 });

package/dist/template-resolver/handlers/list.query.d.ts

@@ -22,5 +22,5 @@ export declare const listQuery: import("@cosmicdrift/kumiko-types/define-handler
     scope: string;
     status: string;
     contentFormat: string;
-    updatedAt: Date;
+    modifiedAt: import("temporal-spec").Temporal.Instant | null;
 }[], import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/list.query.js

@@ -48,7 +48,7 @@ export const listQuery = defineQueryHandler({
             scope: row.scope,
             status: row.status,
             contentFormat: row.contentFormat,
-            updatedAt: row.updatedAt,
+            modifiedAt: row.modifiedAt,
         }));
     },
 });

package/dist/template-resolver/seeding.js

@@ -64,6 +64,13 @@ export async function seedSystemTemplate(db, opts) {
         parentTemplateId,
         status: "active",
     };
+    const applyUpdate = async (row) => {
+        const result = await executor.update({ id: row.id, version: row.version, changes: rowFields }, by, tdb);
+        if (!result.isSuccess) {
+            throw new Error(`seedSystemTemplate update failed: ${JSON.stringify(result)}`);
+        }
+        return { id: String(row.id) };
+    };
     return runEventStoreSeed({
         existing,
         ifExists: opts.ifExists,
@@ -83,11 +90,13 @@ export async function seedSystemTemplate(db, opts) {
                     if (resolved == null) {
                         throw new Error(`seedSystemTemplate create unique_violation but row missing`);
                     }
-                    const upd = await executor.update({ id: resolved.id, version: resolved.version, changes: rowFields }, by, tdb);
-                    if (!upd.isSuccess) {
-                        throw new Error(`seedSystemTemplate race-update failed: ${JSON.stringify(upd)}`);
-                    }
-                    return { id: resolved.id };
+                    // Race loser goes through the same skip/update contract as a normal re-seed.
+                    return runEventStoreSeed({
+                        existing: resolved,
+                        ifExists: opts.ifExists,
+                        create: () => Promise.reject(new Error("seedSystemTemplate: unreachable create")),
+                        update: applyUpdate,
+                    });
                 }
                 throw new Error(`seedSystemTemplate create failed: ${JSON.stringify(result)}`);
             }
@@ -97,13 +106,7 @@ export async function seedSystemTemplate(db, opts) {
             }
             return { id: String(data.id) };
         },
-        update: async (row) => {
-            const result = await executor.update({ id: row.id, version: row.version, changes: rowFields }, by, tdb);
-            if (!result.isSuccess) {
-                throw new Error(`seedSystemTemplate update failed: ${JSON.stringify(result)}`);
-            }
-            return { id: String(row.id) };
-        },
+        update: applyUpdate,
     });
 }
 // Boot/test seed for kind=text-block. Same projection path as set.write,
@@ -132,6 +135,24 @@ export async function seedTextBlock(db, opts) {
         parentTemplateId: null,
         status: "active",
     };
+    const applyUpdate = async (row, current) => {
+        // Skip no-op updates so a legal re-seed on every pod boot does not bump
+        // version/modifiedAt (ETag, "last changed", event-store growth).
+        if (current?.title === fields.title &&
+            current?.content === fields.content &&
+            current?.folder === fields.folder) {
+            return { id: String(row.id) };
+        }
+        const result = await executor.update({
+            id: row.id,
+            version: row.version,
+            changes: { title: fields.title, content: fields.content, folder: fields.folder },
+        }, by, tdb);
+        if (!result.isSuccess) {
+            throw new Error(`seedTextBlock update failed: ${JSON.stringify(result)}`);
+        }
+        return { id: String(row.id) };
+    };
     return runEventStoreSeed({
         existing,
         ifExists: opts.ifExists,
@@ -149,15 +170,13 @@ export async function seedTextBlock(db, opts) {
                     if (resolved == null) {
                         throw new Error("seedTextBlock create unique_violation but row missing");
                     }
-                    const upd = await executor.update({
-                        id: resolved.id,
-                        version: resolved.version,
-                        changes: { title: fields.title, content: fields.content, folder: fields.folder },
-                    }, by, tdb);
-                    if (!upd.isSuccess) {
-                        throw new Error(`seedTextBlock race-update failed: ${JSON.stringify(upd)}`);
-                    }
-                    return { id: resolved.id };
+                    // Race loser goes through the same skip/no-op/update contract as a normal re-seed.
+                    return runEventStoreSeed({
+                        existing: resolved,
+                        ifExists: opts.ifExists,
+                        create: () => Promise.reject(new Error("seedTextBlock: unreachable create")),
+                        update: (row) => applyUpdate(row, again),
+                    });
                 }
                 throw new Error(`seedTextBlock create failed: ${JSON.stringify(result)}`);
             }
@@ -169,24 +188,7 @@ export async function seedTextBlock(db, opts) {
             }
             return { id: String(data.id) };
         },
-        update: async (row) => {
-            // Skip no-op updates so a legal re-seed on every pod boot does not bump
-            // version/updatedAt (ETag, "last changed", event-store growth).
-            if (existingRow?.title === fields.title &&
-                existingRow?.content === fields.content &&
-                existingRow?.folder === fields.folder) {
-                return { id: String(row.id) };
-            }
-            const result = await executor.update({
-                id: row.id,
-                version: row.version,
-                changes: { title: fields.title, content: fields.content, folder: fields.folder },
-            }, by, tdb);
-            if (!result.isSuccess) {
-                throw new Error(`seedTextBlock update failed: ${JSON.stringify(result)}`);
-            }
-            return { id: String(row.id) };
-        },
+        update: (row) => applyUpdate(row, existingRow),
     });
 }
 // Boot seed for legal/marketing copy from a JSON template. `ifExists: "update"`

package/dist/template-resolver/table.d.ts

@@ -1,3 +1,4 @@
+import type { Temporal } from "temporal-polyfill";
 export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
     slug: {
         readonly type: "text";
@@ -9,6 +10,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -39,7 +41,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
             readonly "text-block"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -53,6 +55,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -73,6 +76,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -93,6 +97,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -137,7 +142,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
             readonly plain?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -189,7 +194,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
             readonly tenant?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -203,6 +208,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -230,7 +236,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
             readonly draft?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -246,6 +252,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -276,7 +283,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
             readonly "text-block"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -290,6 +297,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -310,6 +318,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -330,6 +339,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -374,7 +384,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
             readonly plain?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -426,7 +436,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
             readonly tenant?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -440,6 +450,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -467,11 +478,17 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
             readonly draft?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
 }, "tenant">>;
+export type EntityAuditColumns = {
+    readonly insertedAt: Temporal.Instant;
+    readonly modifiedAt: Temporal.Instant | null;
+    readonly insertedById: string | null;
+    readonly modifiedById: string | null;
+};
 export type TemplateResourceRow = {
     readonly id: string | number;
     readonly version: number;
@@ -488,8 +505,4 @@ export type TemplateResourceRow = {
     readonly scope: string;
     readonly parentTemplateId: string | null;
     readonly status: string;
-    readonly createdAt: Date;
-    readonly updatedAt: Date;
-    readonly createdBy: string;
-    readonly updatedBy: string;
-};
+} & EntityAuditColumns;

package/dist/template-resolver/testing.js

@@ -24,8 +24,8 @@ async function seedTemplate(db, args) {
         variableSchema: JSON.stringify(args.variableSchema ?? {}),
         linkedResources: JSON.stringify(args.linkedResources ?? {}),
         parentTemplateId: args.parentTemplateId ?? null,
-        createdBy: "conformance",
-        updatedBy: "conformance",
+        insertedById: "conformance",
+        modifiedById: "conformance",
     });
 }
 export async function assertConsumerHandlesNotFound(consumer, opts) {