@cosmicdrift/kumiko-bundled-features 0.336.0 → 0.337.1

package/dist/agent-tools/agent-manifest.js

@@ -6,14 +6,38 @@ import * as z from "zod";
 function entryAsLabels(entry) {
     return Object.fromEntries(Object.entries(entry).map(([locale, value]) => [locale, translationValueOtherText(value)]));
 }
+const labelsIndexByTranslations = new WeakMap();
+/** Every tail starting at a key boundary (`:` or `.`, with and without the
+ *  separator) maps to the labels of the first key that ends with it. */
+function buildSuffixIndex(translations) {
+    const index = new Map();
+    for (const [key, entry] of Object.entries(translations)) {
+        const labels = entryAsLabels(entry);
+        const addTail = (start) => {
+            const tail = key.slice(start);
+            if (!index.has(tail))
+                index.set(tail, labels);
+        };
+        addTail(0);
+        for (let position = 0; position < key.length; position++) {
+            if (key[position] === ":" || key[position] === ".") {
+                addTail(position);
+                addTail(position + 1);
+            }
+        }
+    }
+    return index;
+}
 /** Translation keys carry a feature prefix the manifest can't reconstruct
- *  (`showcase:entity:item:field:title`), so match on the suffix instead. */
+ *  (`showcase:entity:item:field:title`), so match on the suffix instead. The
+ *  suffix must start at a `:` or `.` boundary of the key. */
 function labelsForSuffix(translations, suffix) {
-    for (const [key, labels] of Object.entries(translations)) {
-        if (key === suffix || key.endsWith(suffix))
-            return entryAsLabels(labels);
+    let index = labelsIndexByTranslations.get(translations);
+    if (index === undefined) {
+        index = buildSuffixIndex(translations);
+        labelsIndexByTranslations.set(translations, index);
     }
-    return {};
+    return index.get(suffix) ?? {};
 }
 /** Nav/screen/workspace gating is opt-in: no rule means visible to everyone
  *  (NavDefinition.access). Handlers are the opposite — `hasAccess` is
@@ -205,6 +229,9 @@ function lastSegment(qualifiedId) {
     const idx = qualifiedId.lastIndexOf(":");
     return idx === -1 ? qualifiedId : qualifiedId.slice(idx + 1);
 }
+function detailIdParam(screen) {
+    return screen.type === "projectionDetail" ? (screen.idParam ?? "id") : "id";
+}
 function buildScreens(screens, navs, workspaces, translations, roles, visibleNavIds) {
     const allNavs = [...navs.values()];
     const result = [];
@@ -239,8 +266,8 @@ function buildScreens(screens, navs, workspaces, translations, roles, visibleNav
                 description: labelsForSuffix(translations, screen.description)["en"] ?? screen.description,
             }),
             ...("entity" in screen && screen.entity !== undefined && { entity: screen.entity }),
-            // A detail screen takes the row id; everything else is parameterless.
-            params: screen.detailFor !== undefined ? ["id"] : [],
+            // A detail screen takes the row id under its idParam; everything else is parameterless.
+            params: screen.detailFor !== undefined ? [detailIdParam(screen)] : [],
             workspaces: screenWorkspaces,
             ...(screen.detailFor !== undefined && { detailFor: screen.detailFor }),
             ...("handler" in screen && typeof screen.handler === "string" && { handler: screen.handler }),

package/dist/agent-tools/tool-catalog.js

@@ -206,6 +206,25 @@ export function toolNameForQn(qn) {
     const sanitized = joined.replace(/[^A-Za-z0-9_]/g, "_").replace(/_+/g, "_");
     return sanitized.slice(0, MAX_TOOL_NAME_LENGTH);
 }
+// FNV-1a: only needs to be stable and well-spread, not collision-proof — a hash clash
+// on top of a name clash falls through to the sink's drop-later-tool guard.
+function shortQnHash(qn) {
+    let hash = 0x811c9dc5;
+    for (let index = 0; index < qn.length; index++) {
+        hash = Math.imul(hash ^ qn.charCodeAt(index), 0x01000193) >>> 0;
+    }
+    return hash.toString(16).padStart(8, "0");
+}
+/** Sanitizing, verb-dropping and truncation make distinct QNs share a tool name; the
+ *  first QN in manifest order keeps the plain name, later ones get a QN-hash suffix so
+ *  no handler silently disappears from the catalog. */
+function uniqueToolNameForQn(qn, usedNames) {
+    const plainName = toolNameForQn(qn);
+    if (!usedNames.has(plainName))
+        return plainName;
+    const hashSuffix = `_${shortQnHash(qn)}`;
+    return `${plainName.slice(0, MAX_TOOL_NAME_LENGTH - hashSuffix.length)}${hashSuffix}`;
+}
 export const OPEN_FORM_TOOL_NAME = "open_form";
 function buildNavigateTool(manifest) {
     const entityScreens = new Map();
@@ -359,7 +378,7 @@ function addQueryHandlerTools(manifest, entityListDetailQns, denyQns, sink) {
             continue;
         if (entityListDetailQns.has(handler.qn))
             continue;
-        const name = toolNameForQn(handler.qn);
+        const name = uniqueToolNameForQn(handler.qn, sink.usedNames);
         addTool(sink, { name, description: handlerDescription(handler), inputSchema: handler.inputSchema }, {
             kind: "server",
             op: "query",
@@ -375,7 +394,7 @@ function addWriteHandlerTools(manifest, detailQnByEntity, denyQns, sink) {
             continue;
         if (denyQns.has(handler.qn))
             continue;
-        const name = toolNameForQn(handler.qn);
+        const name = uniqueToolNameForQn(handler.qn, sink.usedNames);
         const detailQn = handler.entity !== undefined ? detailQnByEntity.get(handler.entity) : undefined;
         const injectsVersion = detailQn !== undefined && schemaRequiresField(handler.inputSchema, "version");
         const inputSchema = injectsVersion

package/dist/audit/handlers/list.query.js

@@ -27,15 +27,19 @@ function buildDateRange(from, to) {
         range.lte = Temporal.Instant.from(to);
     return range;
 }
+function escapeLikePattern(value) {
+    return value.replace(/[\\%_]/g, (m) => `\\${m}`);
+}
 function buildAuditWhere(tenantId, p) {
     const where = { tenantId };
     if (p.aggregateType)
         where["aggregateType"] = p.aggregateType;
     if (p.aggregateId)
         where["aggregateId"] = p.aggregateId;
-    const type = p.eventType ?? p.search;
-    if (type)
-        where["type"] = type;
+    if (p.eventType)
+        where["type"] = p.eventType;
+    else if (p.search)
+        where["type"] = { like: `%${escapeLikePattern(p.search)}%` };
     if (p.userId)
         where["createdBy"] = p.userId;
     const range = buildDateRange(p.from, p.to);

package/dist/auth-email-password/handlers/login.write.js

@@ -179,8 +179,7 @@ export function createLoginHandler(opts = {}) {
             const statusGate = gateEnforceAccountStatus(found);
             if (!statusGate.ok)
                 return statusGate.result;
-            // Still needed for candidate ORDER (preferred tenant first) — the actual
-            // active/blocked/teardown decision comes from ctx.resolveActiveMembership below.
+            // Still needed for candidate ORDER (preferred tenant first) in gateResolveMembership.
             const memberships = (await ctx.queryAs(systemUser, TENANT_MEMBERSHIPS_QUERY, {
                 userId: found.id,
             })); // @cast-boundary db-runner

package/dist/auth-email-password/seeding.js

@@ -151,6 +151,12 @@ export async function seedAdmin(db, options) {
     return { id: userId };
 }
 function compareInsertedAt(a, b) {
+    // selectMany<ActiveUserRow> is an unchecked row-shape claim. A codec that
+    // yields another type would make both comparisons false and silently fall
+    // back to id order, which can crown the younger duplicate as survivor.
+    if (typeof a.epochNanoseconds !== "bigint" || typeof b.epochNanoseconds !== "bigint") {
+        throw new Error("compareInsertedAt: user.insertedAt is not a Temporal.Instant");
+    }
     if (a.epochNanoseconds < b.epochNanoseconds)
         return -1;
     if (a.epochNanoseconds > b.epochNanoseconds)

package/dist/auth-email-password/web/invite-accept-screen.js

@@ -22,6 +22,9 @@ import { csrfHeader } from "./auth-client.js";
 import { resolvePostAuthHref } from "./auth-form-logic.js";
 import { AuthCard, useUrlToken } from "./auth-form-primitives.js";
 import { SessionContext, UNAUTHENTICATED } from "./session.js";
+function isMfaPending(data) {
+    return data.tenantId === undefined;
+}
 function grantedRoles(data) {
     if (data.user?.roles !== undefined)
         return data.user.roles;
@@ -46,7 +49,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
     // challenge / setup requirement, but no session cookie was minted: send the
     // user to the login screen (now a member) instead of a tenant URL.
     const finishAccept = (data) => {
-        if (data.mfaRequired === true || data.mfaSetupRequired === true) {
+        if (isMfaPending(data)) {
             window.location.assign(loginHref);
             return;
         }

package/dist/auth-mfa/handlers/enable-start.write.js

@@ -9,6 +9,18 @@ import { signMfaSetupToken } from "../mfa-setup-token.js";
 import { buildOtpauthUri } from "../otpauth-uri.js";
 import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.js";
 import { generateTotpSecret } from "../totp.js";
+const FALLBACK_ACCOUNT_LABEL = "account";
+// The authenticator app shows this label, so an internal user id must never leak into it.
+function readableAccountLabel(me) {
+    if (typeof me !== "object" || me === null)
+        return FALLBACK_ACCOUNT_LABEL;
+    for (const field of ["email", "displayName"]) {
+        const value = Reflect.get(me, field);
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return FALLBACK_ACCOUNT_LABEL;
+}
 // Stateless setup: no `userMfa` row is created here. The generated secret +
 // recovery-code hashes are signed into a short-lived `setupToken` (see
 // mfa-setup-token.ts) that `enable-confirm` verifies. An abandoned setup
@@ -41,8 +53,7 @@ export function createEnableStartHandler(opts) {
             if (!accountLabel) {
                 // The declarative secretMint screen has no client component left to
                 // read the session email off — derive the otpauth label server-side.
-                const me = (await ctx.queryAs(event.user, UserQueries.me, {})); // @cast-boundary engine-payload
-                accountLabel = me?.email ?? event.user.id;
+                accountLabel = readableAccountLabel(await ctx.queryAs(event.user, UserQueries.me, {}));
             }
             const secret = generateTotpSecret();
             const recoveryCodes = generateRecoveryCodes();

package/dist/auth-mfa/hmac-token-codec.js

@@ -7,15 +7,15 @@ function hmacSign(input, secret) {
 // minted for one MFA step from verifying as another (e.g. a preauth-setup token
 // replayed as a challenge token), since both share the same secret and payload shape.
 export function createHmacTokenCodec(domain, isPayload) {
-    function isEncodedBody(value) {
+    function splitEncodedBody(value) {
         if (typeof value !== "object" || value === null)
-            return false;
+            return null;
         const v = value;
         const expiresAtMs = v["expiresAtMs"];
         if (typeof expiresAtMs !== "number")
-            return false;
+            return null;
         const { expiresAtMs: _drop, ...rest } = v;
-        return isPayload(rest);
+        return isPayload(rest) ? { payload: rest, expiresAtMs } : null;
     }
     return {
         sign(payload, ttlMinutes, secret, now = Temporal.Now.instant()) {
@@ -46,14 +46,13 @@ export function createHmacTokenCodec(domain, isPayload) {
             catch {
                 return { ok: false, reason: "malformed" };
             }
-            if (!isEncodedBody(parsed))
+            const body = splitEncodedBody(parsed);
+            if (!body)
                 return { ok: false, reason: "malformed" };
-            if (Temporal.Instant.compare(now, Temporal.Instant.fromEpochMilliseconds(parsed.expiresAtMs)) >
-                0) {
+            if (Temporal.Instant.compare(now, Temporal.Instant.fromEpochMilliseconds(body.expiresAtMs)) > 0) {
                 return { ok: false, reason: "expired" };
             }
-            const { expiresAtMs, ...payload } = parsed;
-            return { ok: true, payload: payload, expiresAtMs };
+            return { ok: true, payload: body.payload, expiresAtMs: body.expiresAtMs };
         },
     };
 }

package/dist/auth-mfa/web/mfa-setup-preauth-screen.js

@@ -1,5 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
+// Consumers that type-check this source never include the ambient declaration on their own.
+/// <reference path="./qrcode-browser.d.ts" />
 // Pre-auth twin of the declarative auth-mfa-enable secretMint screen: a user
 // blocked at login by MFA enforcement and not yet enrolled lands here
 // straight out of the login flow — there is no session yet. Identity comes

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -25,13 +25,8 @@ function capTierKey(capId, tier) {
     return JSON.stringify([capId, tier]);
 }
 async function resolveLimitsByCapAndTier(caps, tiers, context) {
-    const limitByCapAndTier = new Map();
-    for (const cap of caps) {
-        for (const tier of tiers) {
-            limitByCapAndTier.set(capTierKey(cap.id, tier), await cap.limit(tier, context));
-        }
-    }
-    return limitByCapAndTier;
+    const entries = await Promise.all(caps.flatMap((cap) => [...tiers].map(async (tier) => [capTierKey(cap.id, tier), await cap.limit(tier, context)])));
+    return new Map(entries);
 }
 function isSortableField(field) {
     return SORTABLE_FIELDS.includes(field);

package/dist/config/write-helpers.js

@@ -217,7 +217,7 @@ export function validateBounds(value, keyDef) {
                     path: "value",
                     code: "out_of_bounds",
                     i18nKey: "errors.validation.out_of_bounds",
-                    params: { value, min, max: max ?? null },
+                    params: { ...echoableValue(keyDef, value), min, max: max ?? null },
                 },
             ],
         });
@@ -229,7 +229,7 @@ export function validateBounds(value, keyDef) {
                     path: "value",
                     code: "out_of_bounds",
                     i18nKey: "errors.validation.out_of_bounds",
-                    params: { value, min: min ?? null, max },
+                    params: { ...echoableValue(keyDef, value), min: min ?? null, max },
                 },
             ],
         });

package/dist/custom-fields/feature.js

@@ -79,8 +79,9 @@ function registerCustomFields(r, variant) {
     // Event-types — qualified als "custom-fields:event:<short-name>".
     // Returned EventDefs liefern .name als compile-time literal-typed string,
     // den Handler + MSP-keys konsumieren statt Template-Literal-Konstruktion.
-    // `value: z.unknown()` has no field-level schema to catalog under piiFields;
-    // "no PII" is a naming convention (#972), not an enforced guarantee — see #2776.
+    // `value: z.unknown()` has no field-level schema to catalog under piiFields
+    // (event PII covers string fields only), so "no PII" is a convention here,
+    // not an enforced guarantee.
     const setEvent = r.defineEvent(CUSTOM_FIELD_SET_EVENT, customFieldSetSchema, {
         piiFields: "none",
     });

package/dist/custom-fields/lib/field-access.d.ts

@@ -1,4 +1,5 @@
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type SerializedFieldShape } from "./parse-serialized-field.js";
 export type FieldAccessCheckResult = {
     ok: true;
@@ -13,6 +14,6 @@ export type LoadedFieldDefinition = {
     found: true;
     field: SerializedFieldShape | null;
 };
-export declare function loadFieldDefinition(runner: DbRunner, tenantId: string, entityName: string, fieldKey: string): Promise<LoadedFieldDefinition>;
+export declare function loadFieldDefinition(runner: DbRunner, tenantId: TenantId, entityName: string, fieldKey: string): Promise<LoadedFieldDefinition>;
 export declare function fieldWriteAccessDeniedRoles(field: SerializedFieldShape | null, userRoles: ReadonlyArray<string>): ReadonlyArray<string> | null;
-export declare function checkFieldAccessForWrite(runner: DbRunner, tenantId: string, entityName: string, fieldKey: string, userRoles: ReadonlyArray<string>): Promise<FieldAccessCheckResult>;
+export declare function checkFieldAccessForWrite(runner: DbRunner, tenantId: TenantId, entityName: string, fieldKey: string, userRoles: ReadonlyArray<string>): Promise<FieldAccessCheckResult>;

package/dist/custom-fields/lib/field-access.js

@@ -3,6 +3,7 @@
 // value-validation off one DB read (no double fetch).
 import { selectSerializedFieldDefinition } from "../db/queries/field-access.js";
 import { parseSerializedField } from "./parse-serialized-field.js";
+// `runner` is deliberately unscoped: tenant isolation rests solely on `tenantId`.
 export async function loadFieldDefinition(runner, tenantId, entityName, fieldKey) {
     const serialized = await selectSerializedFieldDefinition(runner, tenantId, entityName, fieldKey);
     if (serialized === null)

package/dist/delivery/unsubscribe.js

@@ -168,6 +168,7 @@ function isResubscribeLimitReached(error) {
     const details = error.details;
     return (typeof details === "object" &&
         details !== null &&
+        "reason" in details &&
         details.reason === DeliveryErrors.resubscribeLimitReached);
 }
 async function dispatchResubscribeWrite(verified, deps) {

package/dist/files-tenant-data/hooks.js

@@ -47,7 +47,7 @@
 //     not one query per key.
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { assertSafeStorageKey, fileRefEntity, fileRefsTable, storageKeyStemPrefix, tenantStoragePrefixes, } from "@cosmicdrift/kumiko-framework/files";
 const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName: "fileRef" });
 // Existence-check batch size for fileRefStorageDestroyHook's survivor lookup
@@ -83,6 +83,13 @@ export const fileRefTenantDestroyHook = async (ctx) => {
         }
     }
 };
+// The bytes live under the tenant that uploaded them (`<tenantId>/…` or
+// `exports/<tenantId>/…`), so with per-tenant storage config that tenant's
+// provider — not the destroyed destination tenant's — holds them.
+function storageKeyOwnerTenant(storageKey, fallback) {
+    const [first, second] = storageKey.split("/");
+    return parseTenantId(first) ?? (first === "exports" ? parseTenantId(second) : null) ?? fallback;
+}
 async function deleteHandedOverBinary(ctx, storageKey) {
     if (!ctx.fileProviderResolver) {
         // skip: same graceful-degradation stance as fileRefStorageDestroyHook —
@@ -91,12 +98,13 @@ async function deleteHandedOverBinary(ctx, storageKey) {
         // skip: no provider wired, so there is no store to delete from — logged above.
         return;
     }
+    const ownerTenantId = storageKeyOwnerTenant(storageKey, ctx.tenantId);
     let provider;
     try {
-        provider = await ctx.fileProviderResolver(ctx.tenantId);
+        provider = await ctx.fileProviderResolver(ownerTenantId);
     }
     catch (err) {
-        ctx.log?.(`[files-tenant-data] no file provider resolvable for tenant ${ctx.tenantId}: ${err instanceof Error ? err.message : String(err)} — handed-over binary for ${storageKey} NOT deleted`);
+        ctx.log?.(`[files-tenant-data] no file provider resolvable for tenant ${ownerTenantId}: ${err instanceof Error ? err.message : String(err)} — handed-over binary for ${storageKey} NOT deleted`);
         // skip: provider resolution failed, so there is nothing this call can delete — logged above.
         return;
     }

package/dist/folders/web/folder-section.js

@@ -25,7 +25,14 @@ export function FolderSection({ entityName, entityId, }) {
     const dispatcher = useDispatcher();
     const enabled = entityId !== null;
     const catalog = useQuery(FoldersQueries.folderList, {}, { enabled });
-    const assignments = useQuery(FoldersQueries.assignmentList, { filter: { field: "entityId", op: "eq", value: entityId } }, { enabled });
+    const assignments = useQuery(FoldersQueries.assignmentList, {
+        // entityType server-side, not just entityId: it collapses the parent-ref
+        // read gate to this one host entity instead of every registered one.
+        filters: [
+            { field: "entityType", op: "eq", value: entityName },
+            { field: "entityId", op: "eq", value: entityId },
+        ],
+    }, { enabled });
     const [newName, setNewName] = useState("");
     const [busy, setBusy] = useState(false);
     const [errorKey, setErrorKey] = useState(null);

package/dist/inbound-mail-foundation/feature.js

@@ -67,7 +67,7 @@ export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATIO
     // piiFields: "none" — address/subject/snippet are already ciphertext under the tenant subject key before append (see events.ts).
     // "displayName" stays plaintext (often the mailbox owner's real name for
     // personal accounts); encrypting it would break the entity-projection read
-    // path that carries it as `personal: false` (#2776).
+    // path that carries it as `personal: false`.
     r.defineEvent(MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
         piiFields: "none",
     });

package/dist/jobs/constants.d.ts

@@ -14,6 +14,7 @@ export declare const JobErrors: {
     readonly notFound: "not_found";
     readonly onlyFailedCanRetry: "only_failed_jobs_can_be_retried";
     readonly notManual: "job_not_manual";
+    readonly invalidPayload: "job_invalid_payload";
     readonly payloadErased: "job_payload_erased";
 };
 /** SystemAdmin job-runs list. Nav: `jobs:screen:job-runs`. */

package/dist/jobs/constants.js

@@ -19,6 +19,7 @@ export const JobErrors = {
     notFound: "not_found",
     onlyFailedCanRetry: "only_failed_jobs_can_be_retried",
     notManual: "job_not_manual",
+    invalidPayload: "job_invalid_payload",
     payloadErased: "job_payload_erased",
 };
 /** SystemAdmin job-runs list. Nav: `jobs:screen:job-runs`. */

package/dist/jobs/handlers/trigger.write.js

@@ -3,6 +3,11 @@ import { NotFoundError, UnprocessableError, validationErrorFromZod, writeFailure
 import * as z from "zod";
 import { JobErrors } from "../constants.js";
 import { isManualTrigger } from "../is-manual-trigger.js";
+function invalidPayloadError() {
+    return new UnprocessableError(JobErrors.invalidPayload, {
+        i18nKey: "jobs.errors.invalidPayload",
+    });
+}
 export const triggerWrite = defineWriteHandler({
     name: "trigger",
     description: "Starts one manually-triggerable job with the given payload after validating it against the job's schema; use it to run a maintenance or import job on demand.",
@@ -32,12 +37,12 @@ export const triggerWrite = defineWriteHandler({
             try {
                 const parsed = JSON.parse(event.payload.payload);
                 if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-                    return writeFailure(new UnprocessableError(JobErrors.notManual));
+                    return writeFailure(invalidPayloadError());
                 }
                 rawPayload = parsed;
             }
             catch {
-                return writeFailure(new UnprocessableError(JobErrors.notManual));
+                return writeFailure(invalidPayloadError());
             }
         }
         else if (event.payload.payload !== undefined) {

package/dist/jobs/i18n.js

@@ -38,6 +38,9 @@ export const JOBS_I18N = {
     "jobs.errors.notManual": {
         en: "This job cannot be triggered manually.",
     },
+    "jobs.errors.invalidPayload": {
+        en: "The payload must be a valid JSON object.",
+    },
     "jobs.errors.notFound": { en: "Not found." },
     "jobs.errors.onlyFailedCanRetry": {
         en: "Only failed runs can be retried.",

package/dist/metrics/compute.js

@@ -35,20 +35,31 @@ async function fetchAggregates(db, metric, wheres, bucketDimension) {
     const aggregate = (groupBy, where, extra = {}) => db.aggregate(metric.source, { measure: metric.measure, groupBy, ...extra }, where);
     const { groupBy, stackBy } = metric;
     const { current } = wheres;
+    const groupsPromise = groupBy === undefined
+        ? Promise.resolve([])
+        : aggregate([{ field: groupBy }], current, { orderByValue: "desc", limit: MAX_GROUP_ROWS });
+    // Stacks/series are only rendered for the top groups. A NULL group key can't be
+    // matched by IN, so a null among the top groups falls back to the unrestricted scan.
+    const groupedWhere = async () => {
+        if (groupBy === undefined)
+            return current;
+        const keys = (await groupsPromise).map((row) => row.keys[0]);
+        return keys.length === 0 || keys.includes(null) || keys.includes(undefined)
+            ? current
+            : { ...current, [groupBy]: keys };
+    };
     const [total, previous, points, groups, stacks, series] = await Promise.all([
         aggregate([], current),
         wheres.previous === undefined ? Promise.resolve(undefined) : aggregate([], wheres.previous),
         bucketDimension !== undefined && groupBy === undefined
             ? aggregate([bucketDimension], current)
             : Promise.resolve([]),
-        groupBy === undefined
-            ? Promise.resolve([])
-            : aggregate([{ field: groupBy }], current, { orderByValue: "desc", limit: MAX_GROUP_ROWS }),
+        groupsPromise,
         groupBy !== undefined && stackBy !== undefined
-            ? aggregate([{ field: groupBy }, { field: stackBy }], current)
+            ? groupedWhere().then((where) => aggregate([{ field: groupBy }, { field: stackBy }], where))
             : Promise.resolve([]),
         bucketDimension !== undefined && groupBy !== undefined
-            ? aggregate([{ field: groupBy }, bucketDimension], current)
+            ? groupedWhere().then((where) => aggregate([{ field: groupBy }, bucketDimension], where))
             : Promise.resolve([]),
     ]);
     return { total, previous, points, groups, stacks, series };

package/dist/notes-history/feature.js

@@ -71,8 +71,8 @@ export function createNotesHistoryFeature(opts = {}) {
     // of passing an empty array.
     if (opts.parents !== undefined && opts.parents.length === 0) {
         throw new Error("createNotesHistoryFeature({ parents }): parents must not be an empty array — " +
-            "an empty allowlist rejects every add-note call. Omit `parents` to keep " +
-            "today's unrestricted behavior instead.");
+            "an empty allowlist rejects every add-note call. Omit `parents` to allow " +
+            "any registered entity the caller can read as a note parent.");
     }
     return defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) => registerNotesHistory(r, resolveAccess(opts), opts.ownership, opts.parents));
 }

package/dist/notes-history/handlers/add-note.write.js

@@ -35,7 +35,8 @@ export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS) {
             try {
                 // read_users is tenant-agnostic → ctx.db.unsafeRaw, not the tenant-scoped ctx.db.
                 // Bun.SQL poisons the whole tx after any error inside it, even one that's
-                // caught — a bare try/catch here would take the note write down with it.
+                // caught — so the lookup runs in a savepoint where available, otherwise directly
+                // (pool statements are their own units).
                 authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(READ_AUTHOR_DISPLAY_NAME_REASON), async (sp) => {
                     const userRow = await fetchOne(sp, userTable, {
                         id: event.user.id,

package/dist/notes-history/web/notes-section.js

@@ -26,7 +26,12 @@ export function NotesSection({ entityName, entityId, }) {
     const dispatcher = useDispatcher();
     const enabled = entityId !== null;
     const notes = useQuery(NotesHistoryQueries.noteList, {
-        filter: { field: "entityId", op: "eq", value: entityId },
+        // entityType server-side, not just entityId: it collapses the parent-ref
+        // read gate to this one host entity instead of every registered one.
+        filters: [
+            { field: "entityType", op: "eq", value: entityName },
+            { field: "entityId", op: "eq", value: entityId },
+        ],
         sort: "insertedAt",
         sortDirection: "desc",
         // ponytail: fixed page, no "load more" — an entity with a note history

package/dist/personal-access-tokens/schema/api-token.js

@@ -42,27 +42,27 @@ export const apiTokenEntity = createEntity({
         // store ciphertext while the resolver keeps querying for the plaintext
         // hash — every bearer-token request would 401 once a KMS is active.
         // Fixing that needs a blind-index-backed lookup (like email's
-        // find:"exact" companion column), a resolver.ts rewrite out of scope
-        // here — see PR body "Offene Fragen".
+        // find:"exact" companion column), a resolver.ts rewrite, so this stays
+        // unencrypted until a blind-index lookup exists.
         tokenHash: createTextField({
             required: true,
             maxLength: 64,
             access: { write: access.privileged },
             personal: false,
-            reason: "credential_hash_used_as_exact_lookup_key_2809",
+            reason: "credential_hash_used_as_exact_lookup_key",
         }),
         // Short displayable prefix ("your tokens" list) — not the secret itself,
         // but still identifies which of the user's tokens this row is. Kept
         // Klasse 1: list.query.ts returns `r.prefix` straight through with no
         // decrypt call (unlike `name`, which goes through decryptStoredPii) — a
         // subject annotation would leak ciphertext to the UI once a KMS is
-        // active. See PR body "Offene Fragen".
+        // active.
         prefix: createTextField({
             required: true,
             maxLength: 16,
             access: { write: access.privileged },
             personal: false,
-            reason: "credential_prefix_read_without_decrypt_2809",
+            reason: "credential_prefix_read_without_decrypt",
         }),
         // JSON-encoded string[] of granted scope names — mirrors the roles-column
         // convention (parseRoles-style text); the resolver JSON.parses it.

package/dist/rate-limiting/handlers/bucket-access.d.ts

@@ -1,8 +1,5 @@
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
-type BucketCaller = {
-    readonly id: string;
-    readonly tenantId: string;
-    readonly roles: readonly string[];
-};
+type BucketCaller = Pick<SessionUser, "id" | "tenantId" | "roles">;
 export declare function bucketAccessDenied(bucket: string, caller: BucketCaller): AccessDeniedError | undefined;
 export {};

package/dist/secrets/feature.js

@@ -7,6 +7,7 @@ import { createDeleteHandler } from "./handlers/delete.write.js";
 import { createListHandler } from "./handlers/list.query.js";
 import { rotateJob } from "./handlers/rotate.job.js";
 import { createSetHandler } from "./handlers/set.write.js";
+import { SECRETS_I18N } from "./i18n.js";
 import { secretReadSchema } from "./secrets-context.js";
 import { tenantSecretEntity, tenantSecretsTable } from "./table.js";
 const ROTATE_ESCAPE_HATCH_REASON = "re-encrypts every tenant's secrets with the new master key";
@@ -102,6 +103,7 @@ export function createSecretsFeature(opts = {}) {
         // covering both boot-time validation and rendering without a web
         // client-plugin for this feature.
         r.translations({ keys: SETTINGS_HUB_I18N });
+        r.translations({ keys: SECRETS_I18N });
         // ES entity: set/delete go through the executor, `tenantSecret.created/
         // .updated/.deleted` events land on the aggregate stream. Reads fire a
         // separate `tenantSecretRead` event per call (see secrets-context.get

package/dist/secrets/handlers/delete.write.js

@@ -3,6 +3,7 @@ import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
+import { checkSecretKeyWrite } from "../write-gate.js";
 export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
         name: "delete",
@@ -14,6 +15,9 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
         access,
         handler: async (event, ctx) => {
             const secrets = requireSecretsContext(ctx, "secrets:write:delete");
+            const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key);
+            if (!gate.ok)
+                return gate.failure;
             const removed = await secrets.delete(event.user.tenantId, event.payload.key, {
                 deletedBy: event.user.id,
             });