@cosmicdrift/kumiko-bundled-features 0.334.0 → 0.335.0

package/dist/managed-pages/handlers/by-slug.query.js

@@ -15,7 +15,7 @@ export const bySlugQuery = defineQueryHandler({
         lang: z.string().min(2).max(8),
     }),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
     description: "Reads the body and metadata of one published managed page of the caller's tenant by slug and language, returning null for drafts and bodyless pages; use it to render a public page, not to load one for editing.",
     handler: async (query, ctx) => {
         const row = await fetchOne(ctx.db, pagesTable, {

package/dist/managed-pages/handlers/by-tenant-published.query.js

@@ -11,7 +11,7 @@ export const byTenantPublishedQuery = defineQueryHandler({
         tenantIdOverride: z.string().min(1).optional(),
     }),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
     description: "Lists every published page of a tenant with slug, language, title and last-change time but no body; use it to enumerate the public pages for sitemap.xml or llms.txt, rather than by-slug which fetches one page's content.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;

package/dist/metrics/compute.js

@@ -111,7 +111,13 @@ export async function runMetric(db, metric, params) {
         ? bucketStartsMs(window, bucket, params.timeZone)
         : [];
     const fillBuckets = (byBucketMs) => bucketStarts.map((atMs) => ({ atMs, value: byBucketMs.get(atMs) ?? gapValue }));
-    const points = fillBuckets(new Map(aggregates.points.map((row) => [Number(row.keys[0]), row.value])));
+    // Grouped metrics carry their time series in `series`; fetchAggregates skips the total series, so filling gaps here would fake a flat zero line.
+    const points = metric.groupBy === undefined
+        ? fillBuckets(new Map(aggregates.points.map((row) => [
+            Number(row.keys[0]),
+            row.value,
+        ])))
+        : [];
     const rows = buildRows(metric, aggregates, value, labelOf);
     return {
         value,

package/dist/metrics/window.js

@@ -12,7 +12,12 @@ const RANGE_DAYS = {
     "14d": 14,
     "30d": 30,
 };
+// Offset strings ("+01:00") pass Intl/Temporal as ISO offsets but Postgres
+// date_trunc reads them as POSIX zones with the opposite sign, so only named
+// zones are accepted.
 export function isValidTimeZone(timeZone) {
+    if (/^[+-]/.test(timeZone))
+        return false;
     try {
         new Intl.DateTimeFormat(undefined, { timeZone });
         return true;

package/dist/notes-history/handlers/add-note.write.js

@@ -1,6 +1,5 @@
 import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
-import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { decryptStoredPii, joinRowParentIsVisible } from "../../shared/index.js";
+import { decryptStoredPii, denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { userTable } from "../../user/index.js";
 import { DEFAULT_NOTES_HISTORY_ACCESS } from "../constants.js";
 import { noteEntryExecutor, noteMentionExecutor } from "../executor.js";
@@ -29,13 +28,9 @@ export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS) {
         },
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            // NotFoundError, not an access-denied error, so the response doesn't
-            // double as an existence oracle — same policy as executor.detail,
-            // which never distinguishes "no access" from "doesn't exist".
-            const visible = await joinRowParentIsVisible(ctx.registry, "note-entry", payload, event.user, ctx.db);
-            if (!visible) {
-                return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
-            }
+            const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "note-entry", payload, event.user, ctx.db);
+            if (denied)
+                return denied;
             let authorName = null;
             try {
                 // read_users is tenant-agnostic → ctx.db.unsafeRaw, not the tenant-scoped ctx.db.

package/dist/notes-history-user-data/hooks.js

@@ -4,7 +4,7 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
-import { resolveRetentionPolicyForTenant } from "../data-retention/index.js";
+import { resolveRetentionPolicyForTenant, resolveTenantRetentionPreset, } from "../data-retention/index.js";
 import { noteEntryTable, noteMentionTable } from "../notes-history/index.js";
 import { policyToStrategy } from "../user-data-rights/index.js";
 // note-entry has no per-tenant scope quirk (unlike folders) — it's genuinely
@@ -58,6 +58,12 @@ export const noteEntryDeleteHook = async (ctx) => {
     if (mentions.length === 0)
         return;
     const noteIds = new Set(mentions.map((m) => m.noteId));
+    // Once per hook run: the preset depends on the tenant only, not the note.
+    const tenantPreset = await resolveTenantRetentionPreset({
+        db: ctx.db,
+        registry: ctx.registry,
+        tenantId: ctx.tenantId,
+    });
     for (const noteId of noteIds) {
         const note = await ctx.db.fetchOne(noteEntryTable, { id: noteId });
         // Defensive: append-only rows are never hard-deleted, so this shouldn't
@@ -69,6 +75,7 @@ export const noteEntryDeleteHook = async (ctx) => {
             registry: ctx.registry,
             tenantId: ctx.tenantId,
             entityName: note.entityType,
+            preloadedTenantPreset: tenantPreset,
         });
         if (policyToStrategy(hostPolicy.policy?.strategy ?? null) === "anonymize")
             continue;

package/dist/personal-access-tokens/constants.d.ts

@@ -1,4 +1,5 @@
 export declare const PAT_FEATURE = "personal-access-tokens";
+export declare const API_TOKEN_ENTITY_NAME: "api-token";
 export declare const PatErrors: {
     readonly ownershipDenied: "ownership_denied";
     readonly reauthRequired: "reauth_required";

package/dist/personal-access-tokens/constants.js

@@ -2,6 +2,7 @@
 // Pure constants — client-marked so the web screen (web/) may import screen-id
 // and QN names without pulling the feature's server runtime barrel.
 export const PAT_FEATURE = "personal-access-tokens";
+export const API_TOKEN_ENTITY_NAME = "api-token";
 // Snake_case reason strings (Error-Reasons guard: no colons/dashes).
 export const PatErrors = {
     ownershipDenied: "ownership_denied",

package/dist/personal-access-tokens/feature.js

@@ -2,7 +2,7 @@ import { EXT_TOKEN_VERIFIER, } from "@cosmicdrift/kumiko-bundled-features/auth-f
 import { PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE } from "./constants.js";
+import { API_TOKEN_ENTITY_NAME, PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, } from "./constants.js";
 import { buildAvailableScopesQuery } from "./handlers/available-scopes.query.js";
 import { createPatCreateHandler } from "./handlers/create.write.js";
 import { listPatQuery } from "./handlers/list.query.js";
@@ -62,7 +62,7 @@ export function createPersonalAccessTokensFeature(options) {
         // Direct-write store like store_user_sessions: create/revoke write it, the
         // resolver point-reads it. r.entity would make it a rebuildable projection
         // whose replay (no token events) would wipe every live token (#498/#494).
-        r.storeTable(deriveEntityTableMeta("api-token", apiTokenEntity, { source: "unmanaged" }), {
+        r.storeTable(deriveEntityTableMeta(API_TOKEN_ENTITY_NAME, apiTokenEntity, { source: "unmanaged" }), {
             reason: "read_side.api_tokens_direct_write",
             // create.write encrypts `name` via encryptForDirectWrite (#820).
             piiEncryptedOnWrite: true,

package/dist/personal-access-tokens/handlers/create.write.js

@@ -6,7 +6,7 @@ import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 import { encryptForDirectWrite, verifyPassword } from "../../shared/index.js";
 import { UserQueries } from "../../user/index.js";
-import { PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors } from "../constants.js";
+import { API_TOKEN_ENTITY_NAME, PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors } from "../constants.js";
 import { mintPatToken } from "../hash.js";
 import { apiTokenEntity, apiTokenTable } from "../schema/api-token.js";
 // @wrapper-known error-helper
@@ -67,7 +67,7 @@ export function createPatCreateHandler(opts = {}) {
             const { raw, hash, prefix } = mintPatToken();
             const now = Temporal.Now.instant();
             const id = generateId();
-            const row = await encryptForDirectWrite(apiTokenEntity, "api-token", {
+            const row = await encryptForDirectWrite(apiTokenEntity, API_TOKEN_ENTITY_NAME, {
                 id,
                 userId: event.user.id,
                 tenantId: event.user.tenantId,

package/dist/personal-access-tokens/handlers/revoke.write.js

@@ -4,7 +4,7 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
-import { PatErrors } from "../constants.js";
+import { API_TOKEN_ENTITY_NAME, PatErrors } from "../constants.js";
 import { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN } from "../pat-revoked-event.js";
 import { apiTokenTable } from "../schema/api-token.js";
 // Revoke one of the caller's own tokens. Ownership is enforced in the WHERE
@@ -43,7 +43,7 @@ export const revokePatWrite = defineWriteHandler({
             i18nKey: "errors.ownershipDenied",
             details: {
                 scope: "entity",
-                entityName: "api-token",
+                entityName: API_TOKEN_ENTITY_NAME,
                 action: "revoke",
                 userId: event.user.id,
             },

package/dist/personal-access-tokens/i18n.js

@@ -1,3 +1,8 @@
+import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
+import { fieldLabelKey, fieldOptionLabelKey } from "@cosmicdrift/kumiko-headless";
+import { PAT_FEATURE } from "./constants.js";
+const mintFieldKey = (field) => fieldLabelKey(PAT_FEATURE, ACTION_FORM_ENTITY, field);
+const scopeOptionKey = (grant) => fieldOptionLabelKey(PAT_FEATURE, ACTION_FORM_ENTITY, "scopes", grant);
 export const PAT_FEATURE_I18N = {
     "screen:api-tokens.title": { en: "Personal Access Tokens" },
     "screen:api-token-create.title": { en: "Create a new token" },
@@ -23,13 +28,11 @@ export const PAT_FEATURE_I18N = {
     // (`__action-form__`, see action-form-shim.ts) — required by the i18n
     // boot-validator (requiredKeysFromScreen); the declarative renderer
     // resolves these through the schema payload, not a client component's t().
-    "personal-access-tokens:entity:__action-form__:field:name": { en: "Name" },
-    "personal-access-tokens:entity:__action-form__:field:scopes": { en: "Per-API access" },
-    "personal-access-tokens:entity:__action-form__:field:expiresInDays": { en: "Expires in (days)" },
-    "personal-access-tokens:entity:__action-form__:field:currentPassword": {
-        en: "Password (to confirm)",
-    },
-    "personal-access-tokens:entity:__action-form__:field:mfaCode": { en: "2FA code (if enabled)" },
+    [mintFieldKey("name")]: { en: "Name" },
+    [mintFieldKey("scopes")]: { en: "Per-API access" },
+    [mintFieldKey("expiresInDays")]: { en: "Expires in (days)" },
+    [mintFieldKey("currentPassword")]: { en: "Password (to confirm)" },
+    [mintFieldKey("mfaCode")]: { en: "2FA code (if enabled)" },
 };
 // Per-grant-option labels for the mint form's `scopes` multiSelect —
 // "<domain> (read)" / "<domain> (read & write)", matching the wording the
@@ -38,13 +41,9 @@ export const PAT_FEATURE_I18N = {
 export function patScopeOptionTranslations(scopes) {
     const out = {};
     for (const [domain, def] of Object.entries(scopes)) {
-        out[`personal-access-tokens:entity:__action-form__:field:scopes:option:${domain}:read`] = {
-            en: `${def.label} (read)`,
-        };
+        out[scopeOptionKey(`${domain}:read`)] = { en: `${def.label} (read)` };
         if (def.write && def.write.length > 0) {
-            out[`personal-access-tokens:entity:__action-form__:field:scopes:option:${domain}:write`] = {
-                en: `${def.label} (read & write)`,
-            };
+            out[scopeOptionKey(`${domain}:write`)] = { en: `${def.label} (read & write)` };
         }
     }
     return out;

package/dist/personal-access-tokens/schema/api-token.js

@@ -1,5 +1,6 @@
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { access, createEntity, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+import { API_TOKEN_ENTITY_NAME } from "../constants.js";
 // One row per Personal Access Token. Like store_user_sessions this is a
 // direct-write store (r.unmanagedTable): the create/revoke handlers write it and
 // the resolver point-reads it on the hot auth path. `tokenHash` is the SHA-256
@@ -80,6 +81,6 @@ export const apiTokenEntity = createEntity({
 // deriveEntityTableMeta (not buildEntityTable): this is a direct-write store, so
 // the table must be a WritableTable (post ES-write-brand #742) — same as
 // sessions' userSessionTable. buildEntityTable is branded executor-only.
-export const apiTokenTable = deriveEntityTableMeta("api-token", apiTokenEntity, {
+export const apiTokenTable = deriveEntityTableMeta(API_TOKEN_ENTITY_NAME, apiTokenEntity, {
     source: "unmanaged",
 });

package/dist/personal-access-tokens/screens.js

@@ -1,10 +1,14 @@
-import { i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
+import { i18nKey, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries } from "./constants.js";
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
 export const patListScreen = {
     id: PAT_SCREEN_ID,
     type: "projectionList",
     query: PatQueries.mine,
+    // The `mine` handler honours `limit` only (no offset/total), so a pager would
+    // show page 1 forever: send one max-size request and render no pager.
+    pagination: false,
+    pageSize: MAX_LIST_LIMIT,
     defaultSort: { field: "createdAt", dir: "desc" },
     columns: [
         { field: "name", label: i18nKey("pat.list.col.name") },

package/dist/rate-limiting/feature.js

@@ -1,5 +1,6 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { rateLimitStatus } from "./handlers/status.query.js";
+import { RATE_LIMITING_I18N } from "./i18n.js";
 // Opt-in feature. Loading it does NOT install rate-limit middleware —
 // the framework auto-wires the L3 dispatcher hook and the resolver
 // when (a) at least one handler declared a rateLimit option, OR (b) the
@@ -17,5 +18,6 @@ export function createRateLimitingFeature() {
             recommended: false,
         });
         r.queryHandler(rateLimitStatus);
+        r.translations({ keys: RATE_LIMITING_I18N });
     }, { dedupeOptions: {} });
 }

package/dist/rate-limiting/handlers/bucket-access.js

@@ -1,23 +1,31 @@
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
 import { RateLimitErrors } from "../constants.js";
+// Typed against RateLimitPer so a renamed dimension in bucket.ts
+// breaks the typecheck instead of silently denying access.
+const BUCKET_OWNER_KIND = {
+    tenant: "tenant",
+    "tenant+handler": "tenant",
+    user: "user",
+    "user+handler": "user",
+};
+function isOwnableDimension(dimension) {
+    return Object.hasOwn(BUCKET_OWNER_KIND, dimension);
+}
 function ownsBucket(bucket, caller) {
     const [dimension, subject, ...handler] = bucket.split(":");
     if (dimension === undefined)
         return false;
-    const owner = dimension === "tenant" || dimension === "tenant+handler"
-        ? caller.tenantId
-        : dimension === "user" || dimension === "user+handler"
-            ? caller.id
-            : undefined;
-    if (owner === undefined)
+    if (!isOwnableDimension(dimension))
         return false;
+    const owner = BUCKET_OWNER_KIND[dimension] === "tenant" ? caller.tenantId : caller.id;
     // Segment-exact: a startsWith check would pass `tenant:<own-id>-other`.
     if (subject !== owner)
         return false;
     return dimension.endsWith("+handler") ? handler.length > 0 : handler.length === 0;
 }
 export function bucketAccessDenied(bucket, caller) {
-    if (caller.roles.includes("SystemAdmin"))
+    if (caller.roles.includes(ROLES.SystemAdmin))
         return undefined;
     if (ownsBucket(bucket, caller))
         return undefined;

package/dist/rate-limiting/i18n.d.ts

@@ -0,0 +1,10 @@
+export declare const RATE_LIMITING_I18N: {
+    readonly "rateLimiting.errors.bucketOutsideTenant": {
+        readonly en: "You can only inspect rate-limit buckets that belong to your own tenant or user.";
+        readonly de: "Du kannst nur Rate-Limit-Buckets deines eigenen Mandanten oder Benutzers einsehen.";
+    };
+    readonly "rateLimiting.errors.resolverUnavailable": {
+        readonly en: "Rate limiting is not available on this server.";
+        readonly de: "Rate-Limiting ist auf diesem Server nicht verfügbar.";
+    };
+};

package/dist/rate-limiting/i18n.js

@@ -0,0 +1,10 @@
+export const RATE_LIMITING_I18N = {
+    "rateLimiting.errors.bucketOutsideTenant": {
+        en: "You can only inspect rate-limit buckets that belong to your own tenant or user.",
+        de: "Du kannst nur Rate-Limit-Buckets deines eigenen Mandanten oder Benutzers einsehen.",
+    },
+    "rateLimiting.errors.resolverUnavailable": {
+        en: "Rate limiting is not available on this server.",
+        de: "Rate-Limiting ist auf diesem Server nicht verfügbar.",
+    },
+};

package/dist/secrets/feature.js

@@ -9,6 +9,7 @@ import { rotateJob } from "./handlers/rotate.job.js";
 import { createSetHandler } from "./handlers/set.write.js";
 import { secretReadSchema } from "./secrets-context.js";
 import { tenantSecretEntity, tenantSecretsTable } from "./table.js";
+const ROTATE_ESCAPE_HATCH_REASON = "re-encrypts every tenant's secrets with the new master key";
 /**
  * Env-vars contract for the `secrets` feature. Apps merge this via
  * `composeEnvSchema({ features: [secretsFeature, ...] })` so boot-time
@@ -130,9 +131,9 @@ export function createSecretsFeature(opts = {}) {
             name: "rotate",
             trigger: { manual: true },
             escapeHatch: {
-                reason: "re-encrypts every tenant's secrets with the new master key",
+                reason: ROTATE_ESCAPE_HATCH_REASON,
             },
-            handler: (payload, ctx) => rotateJob(payload, ctx, ctx.db.unsafeRaw("re-encrypts every tenant's secrets with the new master key")),
+            handler: (payload, ctx) => rotateJob(payload, ctx, ctx.db.unsafeRaw(ROTATE_ESCAPE_HATCH_REASON)),
         });
         // Pre-ES had a separate `retention-cleanup` job scrubbing the audit
         // table on a compliance-driven schedule (90d default). Post-ES the

package/dist/seo/handlers/seo-config.query.js

@@ -17,7 +17,7 @@ export const seoConfigQuery = defineQueryHandler({
     name: "config",
     schema: z.object({}),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
     description: "Reads the tenant's SEO metadata settings — organization name and logo URL, Twitter site handle, LLMs summary and default OG image — as plain strings; use it to inspect what the sitemap, llms.txt and page meta tags will publish.",
     handler: async (_query, ctx) => {
         const read = async (qualifiedKey) => {

package/dist/sessions/constants.d.ts

@@ -1,4 +1,5 @@
 export declare const SESSIONS_FEATURE: "sessions";
+export declare const USER_SESSION_ENTITY_NAME: "user-session";
 export declare const SessionHandlers: {
     readonly revoke: "sessions:write:user-session:revoke";
     readonly revokeAllOthers: "sessions:write:user-session:revoke-all-others";

package/dist/sessions/constants.js

@@ -1,4 +1,5 @@
 export const SESSIONS_FEATURE = "sessions";
+export const USER_SESSION_ENTITY_NAME = "user-session";
 // Qualified write handler names — entity prefix is "userSession", snake_case
 // "user_session" on the wire.
 export const SessionHandlers = {

package/dist/sessions/feature.js

@@ -1,6 +1,7 @@
 import { EXT_SESSION_STORE, } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { USER_SESSION_ENTITY_NAME } from "./constants.js";
 import { cleanupJob } from "./handlers/cleanup.job.js";
 import { detailQuery } from "./handlers/detail.query.js";
 import { listQuery } from "./handlers/list.query.js";
@@ -13,6 +14,7 @@ import { userSessionEntity } from "./schema/user-session.js";
 import { sessionDetailScreen, sessionListScreen, sessionMineScreen } from "./screens.js";
 import { createSessionCallbacks, } from "./session-callbacks.js";
 import { SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema } from "./session-revoked-event.js";
+const CLEANUP_ESCAPE_HATCH_REASON = "deletes expired session rows of every tenant";
 // Reads the late-bind setter off a mounted sessions feature's exports.
 // run{Prod,Dev}App call it once the DB connection is concrete — the feature
 // itself is constructed in app run-config long before a db exists, so the
@@ -66,7 +68,7 @@ export function createSessionsFeature(options) {
         // (#498/#494). r.storeTable keeps the migration DDL but opts the
         // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
         // which are direct-write stores too.
-        r.storeTable(deriveEntityTableMeta("user-session", userSessionEntity, { source: "unmanaged" }), {
+        r.storeTable(deriveEntityTableMeta(USER_SESSION_ENTITY_NAME, userSessionEntity, { source: "unmanaged" }), {
             reason: "read_side.user_sessions_direct_write",
             // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
             piiEncryptedOnWrite: true,
@@ -118,8 +120,8 @@ export function createSessionsFeature(options) {
         r.job({
             name: "cleanup",
             trigger: { manual: true },
-            escapeHatch: { reason: "deletes expired session rows of every tenant" },
-            handler: (payload, ctx) => cleanupJob(payload, ctx, ctx.db.unsafeRaw("deletes expired session rows of every tenant")),
+            escapeHatch: { reason: CLEANUP_ESCAPE_HATCH_REASON },
+            handler: (payload, ctx) => cleanupJob(payload, ctx, ctx.db.unsafeRaw(CLEANUP_ESCAPE_HATCH_REASON)),
         });
         // Cross-feature entity hook on "user". `r.entityHook` (NOT `r.hook`) is
         // the supported cross-feature path: entity-keyed, not prefixed by the

package/dist/sessions/handlers/revoke-all-for-user.write.d.ts

@@ -2,6 +2,7 @@ import * as z from "zod";
 export declare const revokeAllForUserWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"user-session:revoke-all-for-user", z.ZodObject<{
     userId: z.ZodString;
     tenantId: z.ZodOptional<z.ZodString>;
+    exceptSessionId: z.ZodOptional<z.ZodUUID>;
 }, z.core.$strip>, {
     count: number;
     userId: string;

package/dist/sessions/handlers/revoke-all-for-user.write.js

@@ -14,7 +14,10 @@ const REVOKE_ALL_SESSIONS_REASON = "revokes the target user's sessions in every
 // Art. 18) and potentially other ops flows ("ban user", "compromised
 // account"). Unlike revoke-all-others, the caller's own session (if any)
 // is revoked too — the caller is System (cron/operator/cross-feature),
-// not the end-user themselves.
+// not the end-user themselves. A caller that IS the end-user (an admin
+// editing their own roles) passes `exceptSessionId` to keep that one
+// session alive; the event then carries keptSessionId so the SSE streams of
+// that session stay open too.
 //
 // Tenant-scope: the userSession schema persists tenantId per row (a user
 // can have sessions in multiple tenants). Omitting `tenantId` revokes
@@ -28,9 +31,10 @@ export const revokeAllForUserWrite = defineWriteHandler({
     schema: z.object({
         userId: z.string().min(1),
         tenantId: z.string().min(1).optional(),
+        exceptSessionId: z.uuid().optional(),
     }),
     access: { roles: access.privileged },
-    description: "Irreversibly signs a named user out of all their live sessions, across every tenant unless a tenantId narrows it; use it for operator actions such as freezing or banning an account.",
+    description: "Irreversibly signs a named user out of all their live sessions, across every tenant unless a tenantId narrows it, optionally sparing one session (exceptSessionId); use it for operator actions such as freezing or banning an account, or a role change that must not end the editor's own session.",
     agent: { risk: "high" },
     escapeHatch: {
         reason: REVOKE_ALL_SESSIONS_REASON,
@@ -41,6 +45,9 @@ export const revokeAllForUserWrite = defineWriteHandler({
             userId: event.payload.userId,
             revokedAt: null,
             ...(event.payload.tenantId !== undefined && { tenantId: event.payload.tenantId }),
+            ...(event.payload.exceptSessionId !== undefined && {
+                id: { ne: event.payload.exceptSessionId },
+            }),
         });
         // Lightweight append alongside the direct-write above (#1559) — see
         // revoke.write.ts for why this isn't a lifecycle event on
@@ -68,6 +75,9 @@ export const revokeAllForUserWrite = defineWriteHandler({
             const payload = sessionRevokedSchema.parse({
                 userId: event.payload.userId,
                 sessionIds: updated.map((row) => row.id),
+                ...(event.payload.exceptSessionId !== undefined && {
+                    keptSessionId: event.payload.exceptSessionId,
+                }),
             });
             const reqCtx = requestContext.get();
             await append(runner, {

package/dist/sessions/handlers/revoke.write.js

@@ -4,7 +4,7 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
-import { SessionErrors } from "../constants.js";
+import { SessionErrors, USER_SESSION_ENTITY_NAME } from "../constants.js";
 import { userSessionTable } from "../schema/user-session.js";
 import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, } from "../session-revoked-event.js";
 // Revoke a single session by id (= JWT jti). Three distinguishable outcomes:
@@ -66,7 +66,7 @@ export const revokeWrite = defineWriteHandler({
             i18nKey: "errors.ownershipDenied",
             details: {
                 scope: "entity",
-                entityName: "user-session",
+                entityName: USER_SESSION_ENTITY_NAME,
                 action: "revoke",
                 userId: event.user.id,
             },

package/dist/sessions/schema/user-session.js

@@ -1,5 +1,6 @@
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { access, createEntity, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+import { USER_SESSION_ENTITY_NAME } from "../constants.js";
 // userSession — one row per signed-in client (browser tab, mobile app).
 // The PRIMARY key is the sid — generated by the framework at login time and
 // embedded in the JWT's `jti` claim. Using sid-as-PK means the auth middleware
@@ -78,6 +79,6 @@ export const userSessionEntity = createEntity({
 // revocation is a column write, not an aggregate). Handlers write via ctx.db;
 // the meta carries no executor-only brand so those writes stay legal. See
 // feature.ts for the rebuild-exclusion rationale (#494/#498).
-export const userSessionTable = deriveEntityTableMeta("user-session", userSessionEntity, {
+export const userSessionTable = deriveEntityTableMeta(USER_SESSION_ENTITY_NAME, userSessionEntity, {
     source: "unmanaged",
 });

package/dist/sessions/screens.js

@@ -1,10 +1,14 @@
-import { access, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, i18nKey, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID, SESSION_MINE_SCREEN_ID, SessionHandlers, SessionQueries, } from "./constants.js";
 const listAccess = { roles: access.admin };
 export const sessionListScreen = {
     id: SESSION_LIST_SCREEN_ID,
     type: "projectionList",
     query: SessionQueries.list,
+    // The `list` handler honours `limit` only (no offset/total), so a pager would
+    // show page 1 forever: send one max-size request and render no pager.
+    pagination: false,
+    pageSize: MAX_LIST_LIMIT,
     // Mirrors list.query's own fallback (unrecognised/absent sort → createdAt
     // desc) — kept in sync by hand, boot-validator only requires the field
     // be present once the query accepts `sort` (fw#2230).

package/dist/sessions/session-callbacks.js

@@ -6,7 +6,7 @@ import { Temporal } from "temporal-polyfill";
 import { encryptForDirectWrite } from "../shared/index.js";
 import { tenantMembershipsTable } from "../tenant/index.js";
 import { isPrincipalBlocked, userTable } from "../user/index.js";
-import { DEFAULT_SESSION_EXPIRY_MS, LAST_SEEN_REFRESH_MS } from "./constants.js";
+import { DEFAULT_SESSION_EXPIRY_MS, LAST_SEEN_REFRESH_MS, USER_SESSION_ENTITY_NAME, } from "./constants.js";
 import { userSessionEntity, userSessionTable } from "./schema/user-session.js";
 import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, sessionRevokedSchema, } from "./session-revoked-event.js";
 // Re-exported so existing `../sessions` importers keep working unchanged.
@@ -19,7 +19,7 @@ export function createSessionCallbacks(opts) {
             const sid = generateId();
             const now = Temporal.Now.instant();
             const expiresAt = now.add({ milliseconds: ttlMs });
-            await insertOne(db, userSessionTable, await encryptForDirectWrite(userSessionEntity, "user-session", {
+            await insertOne(db, userSessionTable, await encryptForDirectWrite(userSessionEntity, USER_SESSION_ENTITY_NAME, {
                 id: sid,
                 tenantId: user.tenantId,
                 userId: user.id,

package/dist/shared/index.d.ts

@@ -10,7 +10,7 @@ export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
-export { joinRowParentIsVisible, parentRowIsVisible } from "./parent-visibility.js";
+export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/index.js

@@ -10,7 +10,7 @@ export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter } from "./lockout-counter.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
-export { joinRowParentIsVisible, parentRowIsVisible } from "./parent-visibility.js";
+export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/lockout-counter.js

@@ -1,6 +1,6 @@
 // Generic Redis-backed failed-attempt counter with auto-expiring lockout.
 // Extracted from auth-email-password/lockout-store.ts and
-// auth-mfa/mfa-verify-attempts.ts (infra#446) — both were byte-identical
+// auth-mfa/mfa-verify-attempts.ts — both were byte-identical
 // INCR/NX logic, differing only in their Redis key prefixes.
 // Two keys per subject so each can carry its own TTL:
 //   - count-key: 24h, carries the streak. Monotonic — once threshold is

package/dist/shared/parent-visibility.d.ts

@@ -1,4 +1,9 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 export declare function parentRowIsVisible(registry: Registry, entityType: string, entityId: string, user: SessionUser, db: TenantDb): Promise<boolean>;
 export declare function joinRowParentIsVisible(registry: Registry, joinEntityName: string, payload: Readonly<Record<string, unknown>>, user: SessionUser, db: TenantDb): Promise<boolean>;
+export declare function denyUnlessJoinRowParentVisible(registry: Registry, joinEntityName: string, payload: {
+    readonly entityType: string;
+    readonly entityId: string;
+}, user: SessionUser, db: TenantDb): Promise<WriteFailure | null>;

package/dist/shared/parent-visibility.js

@@ -1,9 +1,15 @@
 import { createEntityExecutor, isUuid, } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 // Keyed by definition identity, not by entity name — two test stacks can
 // register different EntityDefinitions under the same entity name.
 const executorsByEntity = new WeakMap();
+// Postgres `serial` is int4; a larger digit string would raise 22003 (numeric
+// out of range) inside the write transaction instead of denying cleanly.
+const SERIAL_ID_MAX = 2_147_483_647;
 function idShapeMatchesEntity(entity, entityId) {
-    return entity.idType === "serial" ? /^\d+$/.test(entityId) : isUuid(entityId);
+    if (entity.idType !== "serial")
+        return isUuid(entityId);
+    return /^\d{1,10}$/.test(entityId) && Number(entityId) <= SERIAL_ID_MAX;
 }
 // Checks whether a client-supplied (entityType, entityId) host reference is one
 // the caller can see via that entity's own read path — tenant scope plus its
@@ -52,3 +58,13 @@ export async function joinRowParentIsVisible(registry, joinEntityName, payload,
     }
     return parentRowIsVisible(registry, entityType, entityId, user, db);
 }
+// Write-handler gate over joinRowParentIsVisible: null means proceed, anything
+// else is returned as-is. The host reference is client input, so this must run
+// FIRST in the handler, ahead of every other lookup — a denied caller then
+// can't tell an invisible parent apart from a missing assignment or an unknown
+// tag/folder; every path answers with the same NotFoundError.
+export async function denyUnlessJoinRowParentVisible(registry, joinEntityName, payload, user, db) {
+    if (await joinRowParentIsVisible(registry, joinEntityName, payload, user, db))
+        return null;
+    return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
+}