@cosmicdrift/kumiko-bundled-features 0.336.1 → 0.337.1

package/dist/agent-tools/agent-manifest.js

@@ -6,14 +6,38 @@ import * as z from "zod";
 function entryAsLabels(entry) {
     return Object.fromEntries(Object.entries(entry).map(([locale, value]) => [locale, translationValueOtherText(value)]));
 }
+const labelsIndexByTranslations = new WeakMap();
+/** Every tail starting at a key boundary (`:` or `.`, with and without the
+ *  separator) maps to the labels of the first key that ends with it. */
+function buildSuffixIndex(translations) {
+    const index = new Map();
+    for (const [key, entry] of Object.entries(translations)) {
+        const labels = entryAsLabels(entry);
+        const addTail = (start) => {
+            const tail = key.slice(start);
+            if (!index.has(tail))
+                index.set(tail, labels);
+        };
+        addTail(0);
+        for (let position = 0; position < key.length; position++) {
+            if (key[position] === ":" || key[position] === ".") {
+                addTail(position);
+                addTail(position + 1);
+            }
+        }
+    }
+    return index;
+}
 /** Translation keys carry a feature prefix the manifest can't reconstruct
- *  (`showcase:entity:item:field:title`), so match on the suffix instead. */
+ *  (`showcase:entity:item:field:title`), so match on the suffix instead. The
+ *  suffix must start at a `:` or `.` boundary of the key. */
 function labelsForSuffix(translations, suffix) {
-    for (const [key, labels] of Object.entries(translations)) {
-        if (key === suffix || key.endsWith(suffix))
-            return entryAsLabels(labels);
+    let index = labelsIndexByTranslations.get(translations);
+    if (index === undefined) {
+        index = buildSuffixIndex(translations);
+        labelsIndexByTranslations.set(translations, index);
     }
-    return {};
+    return index.get(suffix) ?? {};
 }
 /** Nav/screen/workspace gating is opt-in: no rule means visible to everyone
  *  (NavDefinition.access). Handlers are the opposite — `hasAccess` is
@@ -205,6 +229,9 @@ function lastSegment(qualifiedId) {
     const idx = qualifiedId.lastIndexOf(":");
     return idx === -1 ? qualifiedId : qualifiedId.slice(idx + 1);
 }
+function detailIdParam(screen) {
+    return screen.type === "projectionDetail" ? (screen.idParam ?? "id") : "id";
+}
 function buildScreens(screens, navs, workspaces, translations, roles, visibleNavIds) {
     const allNavs = [...navs.values()];
     const result = [];
@@ -239,8 +266,8 @@ function buildScreens(screens, navs, workspaces, translations, roles, visibleNav
                 description: labelsForSuffix(translations, screen.description)["en"] ?? screen.description,
             }),
             ...("entity" in screen && screen.entity !== undefined && { entity: screen.entity }),
-            // A detail screen takes the row id; everything else is parameterless.
-            params: screen.detailFor !== undefined ? ["id"] : [],
+            // A detail screen takes the row id under its idParam; everything else is parameterless.
+            params: screen.detailFor !== undefined ? [detailIdParam(screen)] : [],
             workspaces: screenWorkspaces,
             ...(screen.detailFor !== undefined && { detailFor: screen.detailFor }),
             ...("handler" in screen && typeof screen.handler === "string" && { handler: screen.handler }),

package/dist/agent-tools/tool-catalog.js

@@ -206,6 +206,25 @@ export function toolNameForQn(qn) {
     const sanitized = joined.replace(/[^A-Za-z0-9_]/g, "_").replace(/_+/g, "_");
     return sanitized.slice(0, MAX_TOOL_NAME_LENGTH);
 }
+// FNV-1a: only needs to be stable and well-spread, not collision-proof — a hash clash
+// on top of a name clash falls through to the sink's drop-later-tool guard.
+function shortQnHash(qn) {
+    let hash = 0x811c9dc5;
+    for (let index = 0; index < qn.length; index++) {
+        hash = Math.imul(hash ^ qn.charCodeAt(index), 0x01000193) >>> 0;
+    }
+    return hash.toString(16).padStart(8, "0");
+}
+/** Sanitizing, verb-dropping and truncation make distinct QNs share a tool name; the
+ *  first QN in manifest order keeps the plain name, later ones get a QN-hash suffix so
+ *  no handler silently disappears from the catalog. */
+function uniqueToolNameForQn(qn, usedNames) {
+    const plainName = toolNameForQn(qn);
+    if (!usedNames.has(plainName))
+        return plainName;
+    const hashSuffix = `_${shortQnHash(qn)}`;
+    return `${plainName.slice(0, MAX_TOOL_NAME_LENGTH - hashSuffix.length)}${hashSuffix}`;
+}
 export const OPEN_FORM_TOOL_NAME = "open_form";
 function buildNavigateTool(manifest) {
     const entityScreens = new Map();
@@ -359,7 +378,7 @@ function addQueryHandlerTools(manifest, entityListDetailQns, denyQns, sink) {
             continue;
         if (entityListDetailQns.has(handler.qn))
             continue;
-        const name = toolNameForQn(handler.qn);
+        const name = uniqueToolNameForQn(handler.qn, sink.usedNames);
         addTool(sink, { name, description: handlerDescription(handler), inputSchema: handler.inputSchema }, {
             kind: "server",
             op: "query",
@@ -375,7 +394,7 @@ function addWriteHandlerTools(manifest, detailQnByEntity, denyQns, sink) {
             continue;
         if (denyQns.has(handler.qn))
             continue;
-        const name = toolNameForQn(handler.qn);
+        const name = uniqueToolNameForQn(handler.qn, sink.usedNames);
         const detailQn = handler.entity !== undefined ? detailQnByEntity.get(handler.entity) : undefined;
         const injectsVersion = detailQn !== undefined && schemaRequiresField(handler.inputSchema, "version");
         const inputSchema = injectsVersion

package/dist/audit/handlers/list.query.js

@@ -27,15 +27,19 @@ function buildDateRange(from, to) {
         range.lte = Temporal.Instant.from(to);
     return range;
 }
+function escapeLikePattern(value) {
+    return value.replace(/[\\%_]/g, (m) => `\\${m}`);
+}
 function buildAuditWhere(tenantId, p) {
     const where = { tenantId };
     if (p.aggregateType)
         where["aggregateType"] = p.aggregateType;
     if (p.aggregateId)
         where["aggregateId"] = p.aggregateId;
-    const type = p.eventType ?? p.search;
-    if (type)
-        where["type"] = type;
+    if (p.eventType)
+        where["type"] = p.eventType;
+    else if (p.search)
+        where["type"] = { like: `%${escapeLikePattern(p.search)}%` };
     if (p.userId)
         where["createdBy"] = p.userId;
     const range = buildDateRange(p.from, p.to);

package/dist/auth-email-password/seeding.js

@@ -151,6 +151,12 @@ export async function seedAdmin(db, options) {
     return { id: userId };
 }
 function compareInsertedAt(a, b) {
+    // selectMany<ActiveUserRow> is an unchecked row-shape claim. A codec that
+    // yields another type would make both comparisons false and silently fall
+    // back to id order, which can crown the younger duplicate as survivor.
+    if (typeof a.epochNanoseconds !== "bigint" || typeof b.epochNanoseconds !== "bigint") {
+        throw new Error("compareInsertedAt: user.insertedAt is not a Temporal.Instant");
+    }
     if (a.epochNanoseconds < b.epochNanoseconds)
         return -1;
     if (a.epochNanoseconds > b.epochNanoseconds)

package/dist/auth-email-password/web/invite-accept-screen.js

@@ -22,6 +22,9 @@ import { csrfHeader } from "./auth-client.js";
 import { resolvePostAuthHref } from "./auth-form-logic.js";
 import { AuthCard, useUrlToken } from "./auth-form-primitives.js";
 import { SessionContext, UNAUTHENTICATED } from "./session.js";
+function isMfaPending(data) {
+    return data.tenantId === undefined;
+}
 function grantedRoles(data) {
     if (data.user?.roles !== undefined)
         return data.user.roles;
@@ -46,7 +49,7 @@ export function InviteAcceptScreen({ title, token: tokenProp, loggedInHref = "/"
     // challenge / setup requirement, but no session cookie was minted: send the
     // user to the login screen (now a member) instead of a tenant URL.
     const finishAccept = (data) => {
-        if (data.mfaRequired === true || data.mfaSetupRequired === true) {
+        if (isMfaPending(data)) {
             window.location.assign(loginHref);
             return;
         }

package/dist/auth-mfa/handlers/enable-start.write.js

@@ -9,6 +9,18 @@ import { signMfaSetupToken } from "../mfa-setup-token.js";
 import { buildOtpauthUri } from "../otpauth-uri.js";
 import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.js";
 import { generateTotpSecret } from "../totp.js";
+const FALLBACK_ACCOUNT_LABEL = "account";
+// The authenticator app shows this label, so an internal user id must never leak into it.
+function readableAccountLabel(me) {
+    if (typeof me !== "object" || me === null)
+        return FALLBACK_ACCOUNT_LABEL;
+    for (const field of ["email", "displayName"]) {
+        const value = Reflect.get(me, field);
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return FALLBACK_ACCOUNT_LABEL;
+}
 // Stateless setup: no `userMfa` row is created here. The generated secret +
 // recovery-code hashes are signed into a short-lived `setupToken` (see
 // mfa-setup-token.ts) that `enable-confirm` verifies. An abandoned setup
@@ -41,8 +53,7 @@ export function createEnableStartHandler(opts) {
             if (!accountLabel) {
                 // The declarative secretMint screen has no client component left to
                 // read the session email off — derive the otpauth label server-side.
-                const me = (await ctx.queryAs(event.user, UserQueries.me, {})); // @cast-boundary engine-payload
-                accountLabel = me?.email ?? event.user.id;
+                accountLabel = readableAccountLabel(await ctx.queryAs(event.user, UserQueries.me, {}));
             }
             const secret = generateTotpSecret();
             const recoveryCodes = generateRecoveryCodes();

package/dist/auth-mfa/hmac-token-codec.js

@@ -7,15 +7,15 @@ function hmacSign(input, secret) {
 // minted for one MFA step from verifying as another (e.g. a preauth-setup token
 // replayed as a challenge token), since both share the same secret and payload shape.
 export function createHmacTokenCodec(domain, isPayload) {
-    function isEncodedBody(value) {
+    function splitEncodedBody(value) {
         if (typeof value !== "object" || value === null)
-            return false;
+            return null;
         const v = value;
         const expiresAtMs = v["expiresAtMs"];
         if (typeof expiresAtMs !== "number")
-            return false;
+            return null;
         const { expiresAtMs: _drop, ...rest } = v;
-        return isPayload(rest);
+        return isPayload(rest) ? { payload: rest, expiresAtMs } : null;
     }
     return {
         sign(payload, ttlMinutes, secret, now = Temporal.Now.instant()) {
@@ -46,14 +46,13 @@ export function createHmacTokenCodec(domain, isPayload) {
             catch {
                 return { ok: false, reason: "malformed" };
             }
-            if (!isEncodedBody(parsed))
+            const body = splitEncodedBody(parsed);
+            if (!body)
                 return { ok: false, reason: "malformed" };
-            if (Temporal.Instant.compare(now, Temporal.Instant.fromEpochMilliseconds(parsed.expiresAtMs)) >
-                0) {
+            if (Temporal.Instant.compare(now, Temporal.Instant.fromEpochMilliseconds(body.expiresAtMs)) > 0) {
                 return { ok: false, reason: "expired" };
             }
-            const { expiresAtMs, ...payload } = parsed;
-            return { ok: true, payload: payload, expiresAtMs };
+            return { ok: true, payload: body.payload, expiresAtMs: body.expiresAtMs };
         },
     };
 }

package/dist/auth-mfa/web/mfa-setup-preauth-screen.js

@@ -1,5 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
+// Consumers that type-check this source never include the ambient declaration on their own.
+/// <reference path="./qrcode-browser.d.ts" />
 // Pre-auth twin of the declarative auth-mfa-enable secretMint screen: a user
 // blocked at login by MFA enforcement and not yet enrolled lands here
 // straight out of the login flow — there is no session yet. Identity comes

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -25,13 +25,8 @@ function capTierKey(capId, tier) {
     return JSON.stringify([capId, tier]);
 }
 async function resolveLimitsByCapAndTier(caps, tiers, context) {
-    const limitByCapAndTier = new Map();
-    for (const cap of caps) {
-        for (const tier of tiers) {
-            limitByCapAndTier.set(capTierKey(cap.id, tier), await cap.limit(tier, context));
-        }
-    }
-    return limitByCapAndTier;
+    const entries = await Promise.all(caps.flatMap((cap) => [...tiers].map(async (tier) => [capTierKey(cap.id, tier), await cap.limit(tier, context)])));
+    return new Map(entries);
 }
 function isSortableField(field) {
     return SORTABLE_FIELDS.includes(field);

package/dist/config/write-helpers.js

@@ -217,7 +217,7 @@ export function validateBounds(value, keyDef) {
                     path: "value",
                     code: "out_of_bounds",
                     i18nKey: "errors.validation.out_of_bounds",
-                    params: { value, min, max: max ?? null },
+                    params: { ...echoableValue(keyDef, value), min, max: max ?? null },
                 },
             ],
         });
@@ -229,7 +229,7 @@ export function validateBounds(value, keyDef) {
                     path: "value",
                     code: "out_of_bounds",
                     i18nKey: "errors.validation.out_of_bounds",
-                    params: { value, min: min ?? null, max },
+                    params: { ...echoableValue(keyDef, value), min: min ?? null, max },
                 },
             ],
         });

package/dist/custom-fields/lib/field-access.d.ts

@@ -1,4 +1,5 @@
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type SerializedFieldShape } from "./parse-serialized-field.js";
 export type FieldAccessCheckResult = {
     ok: true;
@@ -13,6 +14,6 @@ export type LoadedFieldDefinition = {
     found: true;
     field: SerializedFieldShape | null;
 };
-export declare function loadFieldDefinition(runner: DbRunner, tenantId: string, entityName: string, fieldKey: string): Promise<LoadedFieldDefinition>;
+export declare function loadFieldDefinition(runner: DbRunner, tenantId: TenantId, entityName: string, fieldKey: string): Promise<LoadedFieldDefinition>;
 export declare function fieldWriteAccessDeniedRoles(field: SerializedFieldShape | null, userRoles: ReadonlyArray<string>): ReadonlyArray<string> | null;
-export declare function checkFieldAccessForWrite(runner: DbRunner, tenantId: string, entityName: string, fieldKey: string, userRoles: ReadonlyArray<string>): Promise<FieldAccessCheckResult>;
+export declare function checkFieldAccessForWrite(runner: DbRunner, tenantId: TenantId, entityName: string, fieldKey: string, userRoles: ReadonlyArray<string>): Promise<FieldAccessCheckResult>;

package/dist/custom-fields/lib/field-access.js

@@ -3,6 +3,7 @@
 // value-validation off one DB read (no double fetch).
 import { selectSerializedFieldDefinition } from "../db/queries/field-access.js";
 import { parseSerializedField } from "./parse-serialized-field.js";
+// `runner` is deliberately unscoped: tenant isolation rests solely on `tenantId`.
 export async function loadFieldDefinition(runner, tenantId, entityName, fieldKey) {
     const serialized = await selectSerializedFieldDefinition(runner, tenantId, entityName, fieldKey);
     if (serialized === null)

package/dist/delivery/unsubscribe.js

@@ -168,6 +168,7 @@ function isResubscribeLimitReached(error) {
     const details = error.details;
     return (typeof details === "object" &&
         details !== null &&
+        "reason" in details &&
         details.reason === DeliveryErrors.resubscribeLimitReached);
 }
 async function dispatchResubscribeWrite(verified, deps) {

package/dist/files-tenant-data/hooks.js

@@ -47,7 +47,7 @@
 //     not one query per key.
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { assertSafeStorageKey, fileRefEntity, fileRefsTable, storageKeyStemPrefix, tenantStoragePrefixes, } from "@cosmicdrift/kumiko-framework/files";
 const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName: "fileRef" });
 // Existence-check batch size for fileRefStorageDestroyHook's survivor lookup
@@ -83,6 +83,13 @@ export const fileRefTenantDestroyHook = async (ctx) => {
         }
     }
 };
+// The bytes live under the tenant that uploaded them (`<tenantId>/…` or
+// `exports/<tenantId>/…`), so with per-tenant storage config that tenant's
+// provider — not the destroyed destination tenant's — holds them.
+function storageKeyOwnerTenant(storageKey, fallback) {
+    const [first, second] = storageKey.split("/");
+    return parseTenantId(first) ?? (first === "exports" ? parseTenantId(second) : null) ?? fallback;
+}
 async function deleteHandedOverBinary(ctx, storageKey) {
     if (!ctx.fileProviderResolver) {
         // skip: same graceful-degradation stance as fileRefStorageDestroyHook —
@@ -91,12 +98,13 @@ async function deleteHandedOverBinary(ctx, storageKey) {
         // skip: no provider wired, so there is no store to delete from — logged above.
         return;
     }
+    const ownerTenantId = storageKeyOwnerTenant(storageKey, ctx.tenantId);
     let provider;
     try {
-        provider = await ctx.fileProviderResolver(ctx.tenantId);
+        provider = await ctx.fileProviderResolver(ownerTenantId);
     }
     catch (err) {
-        ctx.log?.(`[files-tenant-data] no file provider resolvable for tenant ${ctx.tenantId}: ${err instanceof Error ? err.message : String(err)} — handed-over binary for ${storageKey} NOT deleted`);
+        ctx.log?.(`[files-tenant-data] no file provider resolvable for tenant ${ownerTenantId}: ${err instanceof Error ? err.message : String(err)} — handed-over binary for ${storageKey} NOT deleted`);
         // skip: provider resolution failed, so there is nothing this call can delete — logged above.
         return;
     }

package/dist/folders/web/folder-section.js

@@ -25,7 +25,14 @@ export function FolderSection({ entityName, entityId, }) {
     const dispatcher = useDispatcher();
     const enabled = entityId !== null;
     const catalog = useQuery(FoldersQueries.folderList, {}, { enabled });
-    const assignments = useQuery(FoldersQueries.assignmentList, { filter: { field: "entityId", op: "eq", value: entityId } }, { enabled });
+    const assignments = useQuery(FoldersQueries.assignmentList, {
+        // entityType server-side, not just entityId: it collapses the parent-ref
+        // read gate to this one host entity instead of every registered one.
+        filters: [
+            { field: "entityType", op: "eq", value: entityName },
+            { field: "entityId", op: "eq", value: entityId },
+        ],
+    }, { enabled });
     const [newName, setNewName] = useState("");
     const [busy, setBusy] = useState(false);
     const [errorKey, setErrorKey] = useState(null);

package/dist/jobs/constants.d.ts

@@ -14,6 +14,7 @@ export declare const JobErrors: {
     readonly notFound: "not_found";
     readonly onlyFailedCanRetry: "only_failed_jobs_can_be_retried";
     readonly notManual: "job_not_manual";
+    readonly invalidPayload: "job_invalid_payload";
     readonly payloadErased: "job_payload_erased";
 };
 /** SystemAdmin job-runs list. Nav: `jobs:screen:job-runs`. */

package/dist/jobs/constants.js

@@ -19,6 +19,7 @@ export const JobErrors = {
     notFound: "not_found",
     onlyFailedCanRetry: "only_failed_jobs_can_be_retried",
     notManual: "job_not_manual",
+    invalidPayload: "job_invalid_payload",
     payloadErased: "job_payload_erased",
 };
 /** SystemAdmin job-runs list. Nav: `jobs:screen:job-runs`. */

package/dist/jobs/handlers/trigger.write.js

@@ -3,6 +3,11 @@ import { NotFoundError, UnprocessableError, validationErrorFromZod, writeFailure
 import * as z from "zod";
 import { JobErrors } from "../constants.js";
 import { isManualTrigger } from "../is-manual-trigger.js";
+function invalidPayloadError() {
+    return new UnprocessableError(JobErrors.invalidPayload, {
+        i18nKey: "jobs.errors.invalidPayload",
+    });
+}
 export const triggerWrite = defineWriteHandler({
     name: "trigger",
     description: "Starts one manually-triggerable job with the given payload after validating it against the job's schema; use it to run a maintenance or import job on demand.",
@@ -32,12 +37,12 @@ export const triggerWrite = defineWriteHandler({
             try {
                 const parsed = JSON.parse(event.payload.payload);
                 if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-                    return writeFailure(new UnprocessableError(JobErrors.notManual));
+                    return writeFailure(invalidPayloadError());
                 }
                 rawPayload = parsed;
             }
             catch {
-                return writeFailure(new UnprocessableError(JobErrors.notManual));
+                return writeFailure(invalidPayloadError());
             }
         }
         else if (event.payload.payload !== undefined) {

package/dist/jobs/i18n.js

@@ -38,6 +38,9 @@ export const JOBS_I18N = {
     "jobs.errors.notManual": {
         en: "This job cannot be triggered manually.",
     },
+    "jobs.errors.invalidPayload": {
+        en: "The payload must be a valid JSON object.",
+    },
     "jobs.errors.notFound": { en: "Not found." },
     "jobs.errors.onlyFailedCanRetry": {
         en: "Only failed runs can be retried.",

package/dist/metrics/compute.js

@@ -35,20 +35,31 @@ async function fetchAggregates(db, metric, wheres, bucketDimension) {
     const aggregate = (groupBy, where, extra = {}) => db.aggregate(metric.source, { measure: metric.measure, groupBy, ...extra }, where);
     const { groupBy, stackBy } = metric;
     const { current } = wheres;
+    const groupsPromise = groupBy === undefined
+        ? Promise.resolve([])
+        : aggregate([{ field: groupBy }], current, { orderByValue: "desc", limit: MAX_GROUP_ROWS });
+    // Stacks/series are only rendered for the top groups. A NULL group key can't be
+    // matched by IN, so a null among the top groups falls back to the unrestricted scan.
+    const groupedWhere = async () => {
+        if (groupBy === undefined)
+            return current;
+        const keys = (await groupsPromise).map((row) => row.keys[0]);
+        return keys.length === 0 || keys.includes(null) || keys.includes(undefined)
+            ? current
+            : { ...current, [groupBy]: keys };
+    };
     const [total, previous, points, groups, stacks, series] = await Promise.all([
         aggregate([], current),
         wheres.previous === undefined ? Promise.resolve(undefined) : aggregate([], wheres.previous),
         bucketDimension !== undefined && groupBy === undefined
             ? aggregate([bucketDimension], current)
             : Promise.resolve([]),
-        groupBy === undefined
-            ? Promise.resolve([])
-            : aggregate([{ field: groupBy }], current, { orderByValue: "desc", limit: MAX_GROUP_ROWS }),
+        groupsPromise,
         groupBy !== undefined && stackBy !== undefined
-            ? aggregate([{ field: groupBy }, { field: stackBy }], current)
+            ? groupedWhere().then((where) => aggregate([{ field: groupBy }, { field: stackBy }], where))
             : Promise.resolve([]),
         bucketDimension !== undefined && groupBy !== undefined
-            ? aggregate([{ field: groupBy }, bucketDimension], current)
+            ? groupedWhere().then((where) => aggregate([{ field: groupBy }, bucketDimension], where))
             : Promise.resolve([]),
     ]);
     return { total, previous, points, groups, stacks, series };

package/dist/notes-history/web/notes-section.js

@@ -26,7 +26,12 @@ export function NotesSection({ entityName, entityId, }) {
     const dispatcher = useDispatcher();
     const enabled = entityId !== null;
     const notes = useQuery(NotesHistoryQueries.noteList, {
-        filter: { field: "entityId", op: "eq", value: entityId },
+        // entityType server-side, not just entityId: it collapses the parent-ref
+        // read gate to this one host entity instead of every registered one.
+        filters: [
+            { field: "entityType", op: "eq", value: entityName },
+            { field: "entityId", op: "eq", value: entityId },
+        ],
         sort: "insertedAt",
         sortDirection: "desc",
         // ponytail: fixed page, no "load more" — an entity with a note history

package/dist/rate-limiting/handlers/bucket-access.d.ts

@@ -1,8 +1,5 @@
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
-type BucketCaller = {
-    readonly id: string;
-    readonly tenantId: string;
-    readonly roles: readonly string[];
-};
+type BucketCaller = Pick<SessionUser, "id" | "tenantId" | "roles">;
 export declare function bucketAccessDenied(bucket: string, caller: BucketCaller): AccessDeniedError | undefined;
 export {};

package/dist/secrets/feature.js

@@ -7,6 +7,7 @@ import { createDeleteHandler } from "./handlers/delete.write.js";
 import { createListHandler } from "./handlers/list.query.js";
 import { rotateJob } from "./handlers/rotate.job.js";
 import { createSetHandler } from "./handlers/set.write.js";
+import { SECRETS_I18N } from "./i18n.js";
 import { secretReadSchema } from "./secrets-context.js";
 import { tenantSecretEntity, tenantSecretsTable } from "./table.js";
 const ROTATE_ESCAPE_HATCH_REASON = "re-encrypts every tenant's secrets with the new master key";
@@ -102,6 +103,7 @@ export function createSecretsFeature(opts = {}) {
         // covering both boot-time validation and rendering without a web
         // client-plugin for this feature.
         r.translations({ keys: SETTINGS_HUB_I18N });
+        r.translations({ keys: SECRETS_I18N });
         // ES entity: set/delete go through the executor, `tenantSecret.created/
         // .updated/.deleted` events land on the aggregate stream. Reads fire a
         // separate `tenantSecretRead` event per call (see secrets-context.get

package/dist/secrets/handlers/delete.write.js

@@ -3,6 +3,7 @@ import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
+import { checkSecretKeyWrite } from "../write-gate.js";
 export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
         name: "delete",
@@ -14,6 +15,9 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
         access,
         handler: async (event, ctx) => {
             const secrets = requireSecretsContext(ctx, "secrets:write:delete");
+            const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key);
+            if (!gate.ok)
+                return gate.failure;
             const removed = await secrets.delete(event.user.tenantId, event.payload.key, {
                 deletedBy: event.user.id,
             });

package/dist/secrets/handlers/set.write.js

@@ -2,6 +2,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
+import { checkSecretKeyWrite } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
         name: "set",
@@ -26,8 +27,10 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
             // (via r.secret()) > generic default. A feature that declared a
             // domain-aware redact (Stripe keys: "sk_test...2345") wins over the
             // framework default unless the caller sent a specific preview.
-            const keyDef = ctx.registry.getSecretKey(key);
-            const featureRedact = keyDef?.redact;
+            const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, key);
+            if (!gate.ok)
+                return gate.failure;
+            const featureRedact = gate.keyDef?.redact;
             const redactFn = redactedPreview
                 ? () => redactedPreview
                 : (featureRedact ?? defaultRedact);

package/dist/secrets/i18n.d.ts

@@ -0,0 +1,10 @@
+export declare const SECRETS_I18N: {
+    readonly "secrets.errors.unknownKey": {
+        readonly en: "Unknown secret key.";
+        readonly de: "Unbekannter Geheimnis-Schlüssel.";
+    };
+    readonly "secrets.errors.writeDenied": {
+        readonly en: "You are not allowed to change this secret.";
+        readonly de: "Dieses Geheimnis darf nicht geändert werden.";
+    };
+};

package/dist/secrets/i18n.js

@@ -0,0 +1,10 @@
+export const SECRETS_I18N = {
+    "secrets.errors.unknownKey": {
+        en: "Unknown secret key.",
+        de: "Unbekannter Geheimnis-Schlüssel.",
+    },
+    "secrets.errors.writeDenied": {
+        en: "You are not allowed to change this secret.",
+        de: "Dieses Geheimnis darf nicht geändert werden.",
+    },
+};

package/dist/secrets/write-gate.d.ts

@@ -0,0 +1,10 @@
+import type { Registry, SecretKeyDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+export type SecretKeyWriteCheck = {
+    readonly ok: true;
+    readonly keyDef: SecretKeyDefinition | undefined;
+} | {
+    readonly ok: false;
+    readonly failure: WriteFailure;
+};
+export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string): SecretKeyWriteCheck;

package/dist/secrets/write-gate.js

@@ -0,0 +1,36 @@
+import { AccessDeniedError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+function unknownKeyFailure(key) {
+    return {
+        ok: false,
+        failure: writeFailure(new NotFoundError("secretKey", key, { i18nKey: "secrets.errors.unknownKey" })),
+    };
+}
+function namespaceAcceptsKey(namespace, key) {
+    const suffix = key.slice(namespace.qualifiedPrefix.length);
+    if (suffix.length === 0)
+        return false;
+    return namespace.nameSchema ? namespace.nameSchema.safeParse(suffix).success : true;
+}
+// Only keys declared via r.secret() or under a declared r.secretNamespace()
+// are writable through the API, so a tenant admin cannot plant arbitrary rows
+// next to the feature-owned ones. writeRoles narrows the handler access
+// further for a key or a whole namespace.
+export function checkSecretKeyWrite(registry, userRoles, key) {
+    const keyDef = registry.getSecretKey(key);
+    const namespace = keyDef ? undefined : registry.findSecretNamespace(key);
+    if (!keyDef && !(namespace && namespaceAcceptsKey(namespace, key))) {
+        return unknownKeyFailure(key);
+    }
+    const writeRoles = keyDef?.writeRoles ?? namespace?.writeRoles;
+    if (writeRoles !== undefined && !userRoles.some((role) => writeRoles.includes(role))) {
+        return {
+            ok: false,
+            failure: writeFailure(new AccessDeniedError({
+                message: "secret write access denied",
+                i18nKey: "secrets.errors.writeDenied",
+                details: { requiredRoles: writeRoles },
+            })),
+        };
+    }
+    return { ok: true, keyDef };
+}

package/dist/shared/index.d.ts

@@ -14,7 +14,6 @@ export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisi
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
-export { sessionField } from "./session-field.js";
 export { sessionLocaleField } from "./session-locale-field.js";
 export { sessionTimezoneField } from "./session-timezone-field.js";
 export { peekTokenSubject, signToken, TokenPurpose, type VerifyResult, verifyToken, } from "./signed-token.js";

package/dist/shared/index.js

@@ -14,7 +14,6 @@ export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisi
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
-export { sessionField } from "./session-field.js";
 export { sessionLocaleField } from "./session-locale-field.js";
 export { sessionTimezoneField } from "./session-timezone-field.js";
 export { peekTokenSubject, signToken, TokenPurpose, verifyToken, } from "./signed-token.js";

package/dist/shared/session-locale-field.js

@@ -1,7 +1,6 @@
 import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
-import { sessionField } from "./session-field.js";
 export function sessionLocaleField(locale) {
     if (locale === null || locale === undefined || !isValidLocaleTag(locale))
         return {};
-    return sessionField("locale", canonicalizeLocaleTag(locale));
+    return { locale: canonicalizeLocaleTag(locale) };
 }

package/dist/shared/session-timezone-field.js

@@ -1,4 +1,5 @@
-import { sessionField } from "./session-field.js";
 export function sessionTimezoneField(timezone) {
-    return sessionField("timezone", timezone);
+    if (timezone === null || timezone === undefined)
+        return {};
+    return { timezone };
 }

package/dist/step-dispatcher/feature.js

@@ -12,8 +12,8 @@ import { defineFeature, STEP_DISPATCH_AGGREGATE_TYPE, STEP_DISPATCH_FAILED_TYPE,
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-types/identifiers";
 import * as z from "zod";
-import { mailSpecSchema, performMailDispatch } from "./mail-runner.js";
-import { performWebhookDispatch, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, webhookSpecSchema, } from "./webhook-runner.js";
+import { mailSpecSchema, performMailDispatch, redactEmailAddresses, } from "./mail-runner.js";
+import { performWebhookDispatch, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS, webhookSpecSchema, } from "./webhook-runner.js";
 const log = createFallbackLogger("step-dispatcher");
 export const stepDispatcherEnvSchema = z.object({
     [WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR]: z
@@ -144,6 +144,7 @@ function buildDispatchSpec(payload, fields) {
 export function createStepDispatcherFeature() {
     return defineFeature("step-dispatcher", (r) => {
         r.describe("Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. Listens via `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event, performs the actual HTTP or mail delivery, then appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream so the outcome is recorded in the event log without a separate status table. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`.");
+        r.secretNamespace("webhook-auth", WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS);
         r.uiHints({
             displayLabel: "Step Dispatcher · Deferred Side-Effects",
             category: "infrastructure",
@@ -216,7 +217,7 @@ export function createStepDispatcherFeature() {
                         if (payload.stepKind === "mail.send") {
                             log.warn("mail dispatch failed", {
                                 aggregateId: event.aggregateId,
-                                reason: result.error,
+                                reason: redactEmailAddresses(result.error),
                             });
                             await recordFailure(payload.stepKind, MAIL_DELIVERY_FAILED_ERROR);
                         }

package/dist/step-dispatcher/mail-runner.d.ts

@@ -15,3 +15,4 @@ export type MailDispatchResult = {
 };
 export declare function setMailRunner(fn: (spec: MailSpec) => Promise<MailDispatchResult>): void;
 export declare function performMailDispatch(spec: MailSpec): Promise<MailDispatchResult>;
+export declare function redactEmailAddresses(text: string): string;

package/dist/step-dispatcher/mail-runner.js

@@ -19,3 +19,8 @@ export function setMailRunner(fn) {
 export async function performMailDispatch(spec) {
     return mailRunner(spec);
 }
+// Adapter errors usually quote the rejected recipient ("550 <ops@example.com> rejected"); the
+// address must not outlive the crypto-shredded dispatch payload in logs.
+export function redactEmailAddresses(text) {
+    return text.replace(/[^\s<>,;"']+@[^\s<>,;"']+/g, "[redacted-address]");
+}

package/dist/step-dispatcher/webhook-runner.d.ts

@@ -7,6 +7,13 @@ export declare function readAllowedPrivateWebhookHostsFromEnv(env?: Readonly<Rec
 export declare function setWebhookHostLookup(fn: typeof lookup | undefined): void;
 export declare const WEBHOOK_AUTH_SECRET_KEY_PREFIX = "step-dispatcher:webhook-auth.";
 export declare function webhookAuthSecretKey(name: string): string;
+export declare const WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS: {
+    readonly label: {
+        readonly en: "Webhook auth secrets";
+    };
+    readonly scope: "tenant";
+    readonly nameSchema: z.ZodString;
+};
 export declare const webhookSpecSchema: z.ZodObject<{
     url: z.ZodString;
     method: z.ZodEnum<{

package/dist/step-dispatcher/webhook-runner.js

@@ -50,6 +50,15 @@ const webhookAuthSecretNameSchema = z
     .min(1)
     .max(WEBHOOK_AUTH_SECRET_NAME_MAX_LENGTH)
     .regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
+// The same schema validates `auth.secret` in the step spec and the suffix the
+// secrets handlers accept under the namespace, so the two cannot drift. The
+// prefix itself is derived from the feature name by r.secretNamespace; the
+// boot test pins it to WEBHOOK_AUTH_SECRET_KEY_PREFIX.
+export const WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS = {
+    label: { en: "Webhook auth secrets" },
+    scope: "tenant",
+    nameSchema: webhookAuthSecretNameSchema,
+};
 export const webhookSpecSchema = z.object({
     url: z.string(),
     method: z.enum(["POST", "PUT", "PATCH"]),

package/dist/subscription-stripe/plugin-methods.js

@@ -270,6 +270,13 @@ async function resolvePortalConfiguration(stripe, runtime, cache, portalConfigCa
         const price = cache.get(priceId);
         return price ? [price] : [];
     });
+    // A transient prices.retrieve failure would otherwise yield a different
+    // priceSetHash and persist an incomplete portal configuration at Stripe.
+    if (prices.length !== allowedPriceIds.length) {
+        throw new UnprocessableError("price_unavailable", {
+            i18nKey: "billing-foundation.errors.priceUnavailable",
+        });
+    }
     const hash = priceSetHash(prices);
     const cached = portalConfigCache.get(hash);
     if (cached)

package/dist/tenant-handover/move-entity-graph.js

@@ -175,7 +175,9 @@ export async function moveTransferGraph(args) {
         { entityName: rootEntityName, rowIds: [rootRowId] },
     ];
     for (let round = 0; round < MAX_TRANSFER_DEPTH && pending.length > 0; round++) {
-        const discovered = [];
+        // Merged per type so an edge leaving a type runs once per round, not once
+        // per edge that reached it.
+        const discovered = new Map();
         for (const { entityName, rowIds } of pending) {
             for (const edge of adjacency.get(entityName) ?? []) {
                 const childIds = await moveEdgeRows({
@@ -204,7 +206,13 @@ export async function moveTransferGraph(args) {
                 // (`note.vehicleId` and `note.campaignId`), and assigning would drop the
                 // earlier count.
                 movedCounts[edge.entityName] = (movedCounts[edge.entityName] ?? 0) + childIds.length;
-                discovered.push({ entityName: edge.entityName, rowIds: childIds });
+                const discoveredIds = discovered.get(edge.entityName);
+                if (discoveredIds === undefined) {
+                    discovered.set(edge.entityName, [...childIds]);
+                }
+                else {
+                    discoveredIds.push(...childIds);
+                }
                 await transferAggregateStreams(db, {
                     aggregateType: edge.entityName,
                     aggregateIds: childIds,
@@ -223,7 +231,7 @@ export async function moveTransferGraph(args) {
                 }));
             }
         }
-        pending = discovered;
+        pending = [...discovered].map(([entityName, rowIds]) => ({ entityName, rowIds }));
     }
     // The depth limit is a safety net, not a licence to move part of a graph: if
     // rounds ran out while rows remain whose type still leads somewhere, the

package/dist/tenant-lifecycle/lifecycle-gate.d.ts

@@ -4,6 +4,8 @@ export type TenantLifecycleGate = {
     readonly status: string;
     readonly gracePeriodEnd: string | null;
 };
+/** @internal exported for the bounded-cache test */
+export declare const GATE_CACHE_MAX_ENTRIES = 5000;
 export declare function invalidateTenantLifecycleGate(tenantId: TenantId): void;
 /** @internal test-only — resetTestTables/resetTestTable wipe rows directly
  *  via SQL, bypassing the write handlers that invalidate normally. Tests
@@ -11,4 +13,6 @@ export declare function invalidateTenantLifecycleGate(tenantId: TenantId): void;
  *  call this in beforeEach or a later test can read an earlier test's
  *  cached status for the same tenantId. */
 export declare function resetTenantLifecycleGateCacheForTests(): void;
+/** @internal test-only */
+export declare function tenantLifecycleGateCacheSizeForTests(): number;
 export declare function resolveTenantLifecycleGate(db: DbRunner, tenantId: TenantId): Promise<TenantLifecycleGate | null>;

package/dist/tenant-lifecycle/lifecycle-gate.js

@@ -11,9 +11,12 @@ import { tenantTable } from "../tenant/index.js";
 // never arrives).
 // Split into its own module (not run-tenant-destroy.ts) so stages.ts can
 // invalidate too without a stages.ts <-> run-tenant-destroy.ts import cycle.
-// ponytail: unbounded Map — fine while tenant counts stay in the thousands (a
-// few bytes/entry); swap for a bounded LRU if that ever changes.
+// The anonymous path feeds client-supplied X-Tenant ids in here, so unknown ids
+// (cached as null) must not grow the Map without bound: past the cap, expired
+// entries are swept and, if still full, the oldest-inserted entries are evicted.
 const GATE_TTL_MS = 3000;
+/** @internal exported for the bounded-cache test */
+export const GATE_CACHE_MAX_ENTRIES = 5000;
 const gateCache = new Map();
 export function invalidateTenantLifecycleGate(tenantId) {
     gateCache.delete(tenantId);
@@ -26,6 +29,25 @@ export function invalidateTenantLifecycleGate(tenantId) {
 export function resetTenantLifecycleGateCacheForTests() {
     gateCache.clear();
 }
+/** @internal test-only */
+export function tenantLifecycleGateCacheSizeForTests() {
+    return gateCache.size;
+}
+function cacheGate(tenantId, value) {
+    if (gateCache.size >= GATE_CACHE_MAX_ENTRIES && !gateCache.has(tenantId)) {
+        const now = Date.now();
+        for (const [id, entry] of gateCache) {
+            if (entry.expiresAt <= now)
+                gateCache.delete(id);
+        }
+        for (const id of gateCache.keys()) {
+            if (gateCache.size < GATE_CACHE_MAX_ENTRIES)
+                break;
+            gateCache.delete(id);
+        }
+    }
+    gateCache.set(tenantId, { value, expiresAt: Date.now() + GATE_TTL_MS });
+}
 export async function resolveTenantLifecycleGate(db, tenantId) {
     const cached = gateCache.get(tenantId);
     if (cached && cached.expiresAt > Date.now())
@@ -33,13 +55,13 @@ export async function resolveTenantLifecycleGate(db, tenantId) {
     const rows = await selectMany(db, tenantTable, { id: tenantId });
     const row = rows[0];
     if (!row) {
-        gateCache.set(tenantId, { value: null, expiresAt: Date.now() + GATE_TTL_MS });
+        cacheGate(tenantId, null);
         return null;
     }
     const gate = {
         status: row.status,
         gracePeriodEnd: row.gracePeriodEnd?.toString() ?? null,
     };
-    gateCache.set(tenantId, { value: gate, expiresAt: Date.now() + GATE_TTL_MS });
+    cacheGate(tenantId, gate);
     return gate;
 }

package/dist/user-data-rights/handlers/deletion-grace-period.js

@@ -73,10 +73,12 @@ export async function startDeletionGracePeriod(ctx, userId, resolveGracePeriodSp
     const gracePeriodEnd = addDurationSpec(T.Now.instant(), await resolveGracePeriodSpec());
     const { applied } = await updateUserLifecycle(lifecycleRunner, userId, { status: USER_STATUS.DeletionRequested, gracePeriodEnd, pendingDeletionRequestId: null }, { expect: { status: USER_STATUS.Active, ...additionalExpect } });
     if (!applied) {
+        // userRow predates the write, so its status is stale for the concurrent loser.
+        const currentRow = await ctx.db.global(userTable).fetchOne({ id: userId });
         return {
             ok: false,
             error: new UnprocessableError("user_not_in_active_state", {
-                details: { currentStatus: userRow["status"] },
+                details: { currentStatus: currentRow?.["status"] ?? userRow["status"] },
             }),
         };
     }

package/dist/workflow-runner/db/queries/due-runs.d.ts

@@ -4,4 +4,5 @@ export type DueRow = {
     readonly run_id: string;
     readonly step_index: number;
 };
+export declare const DUE_RUNS_BATCH_SIZE = 100;
 export declare function selectDueWorkflowRunPending(db: DbConnection, tenantId: TenantId): Promise<readonly DueRow[]>;

package/dist/workflow-runner/db/queries/due-runs.js

@@ -1,9 +1,12 @@
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+// Oldest first and capped, so a backlog after an outage drains over several
+// ticks instead of holding one tick's `concurrency: "skip"` slot for minutes.
+export const DUE_RUNS_BATCH_SIZE = 100;
 // Dedup happens solely via resume-run's VersionConflictError-checked claim
 // (ctx.tryAppendEvent on WORKFLOW_RESUMED) — a second dispatch for the same
 // row loses that race and no-ops. No row locks: in an autocommit statement
 // they would be released right after the SELECT and guard nothing.
 export async function selectDueWorkflowRunPending(db, tenantId) {
     // kumiko-lint-ignore raw-sql tenant-scoped due-row pickup
-    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now()`, [tenantId]));
+    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now() ORDER BY wake_at ASC LIMIT ${DUE_RUNS_BATCH_SIZE}`, [tenantId]));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.336.1",
+  "version": "0.337.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -483,12 +483,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.336.1",
-    "@cosmicdrift/kumiko-framework": "0.336.1",
-    "@cosmicdrift/kumiko-headless": "0.336.1",
-    "@cosmicdrift/kumiko-renderer": "0.336.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.336.1",
-    "@cosmicdrift/kumiko-types": "0.336.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.337.1",
+    "@cosmicdrift/kumiko-framework": "0.337.1",
+    "@cosmicdrift/kumiko-headless": "0.337.1",
+    "@cosmicdrift/kumiko-renderer": "0.337.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.337.1",
+    "@cosmicdrift/kumiko-types": "0.337.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -985,8 +985,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.336.1",
-    "@cosmicdrift/kumiko-locale-es": "0.336.1",
+    "@cosmicdrift/kumiko-locale-de": "0.337.1",
+    "@cosmicdrift/kumiko-locale-es": "0.337.1",
     "jsqr": "^1.4.0"
   }
 }

package/src/agent-tools/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "agent tool name collisions are disambiguated, audit search is substring, encrypted config bounds errors do not echo the value",
+    "detail": "The agent manifest reports a detail screen's configured `idParam` and builds its label index once per manifest. Handler tools whose names collide after sanitizing or truncation are no longer dropped; the later one gets a QN-hash suffix. The audit log search matches event types by substring instead of exact equality. Config bounds errors no longer echo an encrypted value. The MFA account label never falls back to the internal user id. The tenant caps list resolves limits in parallel."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/src/secrets/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.337.0",
+    "type": "breaking",
+    "title": "secrets:set and secrets:delete accept only keys declared via r.secret; r.secret takes writeRoles",
+    "detail": "Both handlers reject a key that no feature declared with `r.secret` (404, i18n key `secrets.errors.unknownKey`). `r.secret` takes `writeRoles`: when set, only users holding one of those roles may set or delete that key (403, i18n key `secrets.errors.writeDenied`). The roles narrow the handler access, so both checks must pass. An empty `writeRoles` array throws at declaration.",
+    "migration": "Declare every key you set through `secrets:write:set` via `r.secret`. Rows stored under undeclared keys stay in the table but can no longer be set or deleted through the API. A key that only SystemAdmin may write declares `writeRoles: [\"SystemAdmin\"]`, and the secrets feature must then grant SystemAdmin handler access via `createSecretsFeature({ roles: [\"TenantAdmin\", \"SystemAdmin\"] })`. Tests that set a key no feature declares need the same fix: the kumiko-studio test `bundled-stack.integration.test.ts` sets `ai-foundation:secret:anthropic-api-key`, which no feature declares; kumiko-ai-foundation 0.39.1 and 0.40.1 declare the Anthropic key as `ai-provider-anthropic:secret:anthropic-api-key`."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/src/subscription-stripe/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "plan switch rejects unretrievable prices, concurrent request-deletion loser reports the fresh user status",
+    "detail": "The Stripe plan switch now fails with `price_unavailable` when an allowed price cannot be retrieved, instead of creating an incomplete Stripe portal configuration under a different price-set hash. A concurrent losing `request-deletion` now reports the user's current status in `user_not_in_active_state` instead of the stale `active`."
+  },
   {
     "version": "0.336.1",
     "type": "fix",

package/src/tenant-lifecycle/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "tenant destroy deletes handed-over binaries via the uploader's provider, trigger reports invalid payloads distinctly, mail failure logs redact addresses",
+    "detail": "A tenant destroy deletes a handed-over binary through the file provider of the tenant that uploaded it, not the destroyed tenant's. `jobs:write:trigger` answers a broken or non-object JSON payload with `job_invalid_payload` instead of `job_not_manual`. Grouped metrics restrict their stack and series queries to the top groups. The notes and folders sections filter by `entityType` on the server. A failed mail dispatch logs the adapter error without email addresses."
+  }
+]

package/src/workflow-runner/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "workflow resume batches due runs, tenant handover merges discovered rows per type",
+    "detail": "The workflow resume job now picks up at most 100 due runs per tick, oldest first, so a backlog drains over several ticks. Tenant handover merges rows discovered per entity type so each outgoing edge runs once per round."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/dist/shared/session-field.d.ts

@@ -1,3 +0,0 @@
-import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-/** Omit null/undefined session keys so callers can spread without wiping defaults. */
-export declare function sessionField<K extends "locale" | "timezone">(key: K, value: string | null | undefined): Partial<Pick<SessionUser, K>>;

package/dist/shared/session-field.js

@@ -1,6 +0,0 @@
-/** Omit null/undefined session keys so callers can spread without wiping defaults. */
-export function sessionField(key, value) {
-    if (value === null || value === undefined)
-        return {};
-    return { [key]: value };
-}