@cosmicdrift/kumiko-bundled-features 0.352.0 → 0.354.0

package/dist/notes-history/entity.js

@@ -81,6 +81,8 @@ export function createNoteEntryEntity(access, parents) {
                 find: "none",
             }),
         },
+        // Every host detail screen reads its notes by tenant + host entity.
+        indexes: [{ columns: ["tenantId", "entityType", "entityId"] }],
     });
 }
 export const noteEntryEntity = createNoteEntryEntity();
@@ -109,6 +111,8 @@ export function createNoteMentionEntity() {
             }),
             subjectId: createTextField({ required: true, maxLength: 64, personal: "ref" }),
         },
+        // The forget cascade looks mentions up by subject within one tenant.
+        indexes: [{ columns: ["tenantId", "subjectId"] }],
     });
 }
 export const noteMentionEntity = createNoteMentionEntity();

package/dist/notes-history/feature.js

@@ -13,7 +13,7 @@
 // a new entry, not an edit; see entity.ts for why that still satisfies GDPR
 // erasure without a delete path.
 import { defineEntityListHandler, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
-import { hasWhereRule } from "../shared/index.js";
+import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
 import { DEFAULT_NOTES_HISTORY_ACCESS, NOTES_HISTORY_FEATURE_NAME } from "./constants.js";
 import { createNoteEntryEntity, noteMentionEntity } from "./entity.js";
 import { createNoteEntryExecutor } from "./executor.js";
@@ -58,15 +58,7 @@ export function createNotesHistoryFeature(opts = {}) {
         opts.parents === undefined) {
         return notesHistoryFeature;
     }
-    if (hasWhereRule(opts.ownership?.write)) {
-        throw new Error("createNotesHistoryFeature({ ownership }): ownership.write must not contain a " +
-            '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
-            "layer (the read path, via buildOwnershipClause). Write paths that " +
-            "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-            "evaluate them, so such a rule can only ever deny — boot validation " +
-            "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
-            "leave it unset.");
-    }
+    assertNoWhereRuleInOwnershipWrite("createNotesHistoryFeature", opts.ownership?.write);
     // A mount that accepts no parents at all can never take a note write —
     // that's a config mistake, not a valid allowlist. Omit `parents` instead
     // of passing an empty array.

package/dist/personal-access-tokens/handlers/create.write.js

@@ -41,6 +41,7 @@ export function createPatCreateHandler(opts = {}) {
             },
         },
         escapeHatch: {
+            grants: ["systemIdentity"],
             reason: "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, " +
                 "user:findForAuth) to re-verify the current password before minting the token. Also " +
                 "reads the MFA enrollment of the user being re-authenticated via the mfaVerifier callback.",

package/dist/personal-access-tokens/schema/api-token.d.ts

@@ -3,6 +3,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -45,6 +47,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -66,6 +69,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -87,6 +91,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -108,6 +113,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/personal-access-tokens/screens.js

@@ -1,6 +1,11 @@
 import { i18nKey, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
-import { PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries } from "./constants.js";
+import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
+import { fieldOptionLabelKeyPrefix } from "@cosmicdrift/kumiko-headless";
+import { PAT_FEATURE, PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries, } from "./constants.js";
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
+// Same keys the mint form's `scopes` multiSelect options resolve through
+// (see patScopeOptionTranslations), so list and form show identical labels.
+const PAT_SCOPE_OPTION_KEY_PREFIX = fieldOptionLabelKeyPrefix(PAT_FEATURE, ACTION_FORM_ENTITY, "scopes");
 // Both screens render only for tenants whose tier includes the feature; the
 // availability query is rejected by the feature gate otherwise.
 const PAT_SCREEN_VISIBLE_WHEN = {
@@ -20,11 +25,17 @@ export const patListScreen = {
     defaultSort: { field: "createdAt", dir: "desc" },
     columns: [
         { field: "name", label: i18nKey("pat.list.col.name") },
-        { field: "prefix", label: i18nKey("pat.list.col.prefix") },
-        { field: "scopes", label: i18nKey("pat.list.col.scopes") },
+        { field: "prefix", label: i18nKey("pat.list.col.prefix"), sortable: false },
+        {
+            field: "scopes",
+            label: i18nKey("pat.list.col.scopes"),
+            sortable: false,
+            renderer: { format: "enumOption", keyPrefix: PAT_SCOPE_OPTION_KEY_PREFIX },
+        },
         {
             field: "status",
             label: i18nKey("pat.list.col.status"),
+            sortable: false,
             renderer: { format: "enumOption", keyPrefix: PAT_STATUS_OPTION_KEY_PREFIX },
         },
         {

package/dist/secrets/table.d.ts

@@ -8,6 +8,7 @@ export declare const tenantSecretEntity: import("@cosmicdrift/kumiko-types/field
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/seo/feature.js

@@ -1,8 +1,10 @@
 // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312 (feature.ts > 300 lines)
 import { computeRevisionEtag } from "@cosmicdrift/kumiko-framework/api";
 import { defineFeature, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
 import { LEGAL_ROUTES } from "../legal-pages/index.js";
 import { cachedSecurePageResponse } from "../page-render/index.js";
+import { rateLimitedTextResponse } from "../shared/index.js";
 import { SEO_CONFIG_KEYS, SEO_DEFAULT_PATHS } from "./constants.js";
 import { seoConfigQuery } from "./handlers/seo-config.query.js";
 import { buildLlmsTxt } from "./llms-txt.js";
@@ -62,7 +64,10 @@ async function gatherEntries(opts, systemQuery, origin, host) {
                     });
                 }
             }
-            catch {
+            catch (error) {
+                // A rate limit must not look like "pages removed" to a crawler.
+                if (error instanceof RateLimitError)
+                    throw error;
                 // managed-pages unreachable/not mounted — degrade to callback-only entries.
             }
         }
@@ -113,7 +118,15 @@ export function createSeoFeature(opts) {
             anonymous: true,
             handler: async (c, { systemQuery }) => {
                 const { origin, host } = requestHost(c);
-                const entries = await gatherEntries(opts, systemQuery, origin, host);
+                let entries;
+                try {
+                    entries = await gatherEntries(opts, systemQuery, origin, host);
+                }
+                catch (error) {
+                    if (error instanceof RateLimitError)
+                        return rateLimitedTextResponse(error);
+                    throw error;
+                }
                 const xml = buildSitemapXml(entries);
                 const etag = computeRevisionEtag([host, xml]);
                 return cachedSecurePageResponse(c.req.raw, {
@@ -133,10 +146,19 @@ export function createSeoFeature(opts) {
                 const tenantId = opts.managedPages
                     ? ((await opts.managedPages.resolveApexTenant(host)) ?? SYSTEM_TENANT_ID)
                     : SYSTEM_TENANT_ID;
-                const [entries, seoConfig] = await Promise.all([
-                    gatherEntries(opts, systemQuery, origin, host),
-                    readSeoConfig(systemQuery, tenantId),
-                ]);
+                let entries;
+                let seoConfig;
+                try {
+                    [entries, seoConfig] = await Promise.all([
+                        gatherEntries(opts, systemQuery, origin, host),
+                        readSeoConfig(systemQuery, tenantId),
+                    ]);
+                }
+                catch (error) {
+                    if (error instanceof RateLimitError)
+                        return rateLimitedTextResponse(error);
+                    throw error;
+                }
                 const sections = entries.length > 0
                     ? [
                         {

package/dist/sessions/feature.d.ts

@@ -3,6 +3,7 @@ import { type SessionAllOthersRevoker, type SessionMassRevoker } from "./session
 export type SessionsFeatureOptions = {
     readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
     readonly expiresInMs?: number;
+    readonly adminAccess?: "admin" | "systemAdmin";
 };
 export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
 export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => void;

package/dist/sessions/feature.js

@@ -1,17 +1,17 @@
 import { EXT_SESSION_STORE, } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
 import { USER_SESSION_ENTITY_NAME } from "./constants.js";
 import { cleanupJob } from "./handlers/cleanup.job.js";
-import { detailQuery } from "./handlers/detail.query.js";
-import { listQuery } from "./handlers/list.query.js";
+import { createDetailQuery } from "./handlers/detail.query.js";
+import { createListQuery } from "./handlers/list.query.js";
 import { mineQuery } from "./handlers/mine.query.js";
 import { revokeWrite } from "./handlers/revoke.write.js";
 import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write.js";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write.js";
 import { SESSIONS_I18N } from "./i18n.js";
 import { userSessionEntity } from "./schema/user-session.js";
-import { sessionDetailScreen, sessionListScreen, sessionMineScreen } from "./screens.js";
+import { createSessionDetailScreen, createSessionListScreen, sessionMineScreen, } from "./screens.js";
 import { createSessionCallbacks, } from "./session-callbacks.js";
 import { SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema } from "./session-revoked-event.js";
 const CLEANUP_ESCAPE_HATCH_REASON = "deletes expired session rows of every tenant";
@@ -47,6 +47,7 @@ export function bindAutoRevokeFromFeature(feature) {
 // see rows in the caller's active tenant.
 export function createSessionsFeature(options) {
     return defineFeature("sessions", (r) => {
+        const adminRoles = access[options?.adminAccess ?? "admin"];
         r.describe("Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.");
         r.uiHints({
             displayLabel: "Sessions · Server-side Logout",
@@ -111,8 +112,8 @@ export function createSessionsFeature(options) {
         r.exposesApi("sessions.revokeAllForUser");
         const queries = {
             mine: r.queryHandler(mineQuery),
-            list: r.queryHandler(listQuery),
-            detail: r.queryHandler(detailQuery),
+            list: r.queryHandler(createListQuery(adminRoles)),
+            detail: r.queryHandler(createDetailQuery(adminRoles)),
         };
         // Retention: chunked DELETE of expired/revoked rows. Manual trigger
         // only so dev environments don't churn. Ops wires a cron in the app's
@@ -164,8 +165,8 @@ export function createSessionsFeature(options) {
             autoRevoke ??= revoker;
         };
         r.translations({ keys: SESSIONS_I18N });
-        r.screen(sessionListScreen);
-        r.screen(sessionDetailScreen);
+        r.screen(createSessionListScreen(adminRoles));
+        r.screen(createSessionDetailScreen(adminRoles));
         r.screen(sessionMineScreen);
         r.nav({
             id: "session-list",

package/dist/sessions/handlers/detail.query.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-export declare const detailQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"user-session:detail", z.ZodObject<{
+export declare const createDetailQuery: (adminRoles?: readonly string[]) => import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"user-session:detail", z.ZodObject<{
     id: z.ZodUUID;
 }, z.core.$strip>, {
     id: string;

package/dist/sessions/handlers/detail.query.js

@@ -14,10 +14,10 @@ const sessionRowSchema = z.object({
     ip: z.string().nullable(),
     userAgent: z.string().nullable(),
 });
-export const detailQuery = defineQueryHandler({
+export const createDetailQuery = (adminRoles = access.admin) => defineQueryHandler({
     name: "user-session:detail",
     schema: z.object({ id: z.uuid() }),
-    access: { roles: access.admin },
+    access: { roles: adminRoles },
     description: "Loads one session of the active tenant by its id with owner, timestamps and decrypted IP/user-agent; use it when an admin investigates a specific session found through the session list.",
     // Decrypted IP and user-agent.
     agent: { risk: "high" },

package/dist/sessions/handlers/list.query.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-export declare const listQuery: import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"user-session:list", z.ZodObject<{
+export declare const createListQuery: (adminRoles?: readonly string[]) => import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"user-session:list", z.ZodObject<{
     limit: z.ZodOptional<z.ZodNumber>;
     sort: z.ZodOptional<z.ZodString>;
     sortDirection: z.ZodOptional<z.ZodEnum<{

package/dist/sessions/handlers/list.query.js

@@ -17,14 +17,14 @@ function isSortableColumn(value) {
 // tenantId column. Includes revoked rows; UI shows revokedAt distinct.
 // No cursor — nextCursor is always null; `limit` only caps the page size,
 // it doesn't offset into a further one.
-export const listQuery = definePagedQueryHandler({
+export const createListQuery = (adminRoles = access.admin) => definePagedQueryHandler({
     name: "user-session:list",
     schema: z.object({
         limit: z.number().int().nonnegative().max(MAX_LIST_LIMIT).optional(),
         sort: z.string().optional(),
         sortDirection: z.enum(["asc", "desc"]).optional(),
     }),
-    access: { roles: access.admin },
+    access: { roles: adminRoles },
     description: "Lists every session in the active tenant, live and revoked, sortable by id, user, creation, expiry or revocation, for an admin auditing who is signed in.",
     outputSchema: z.object({
         rows: z.array(z.object({
@@ -40,7 +40,9 @@ export const listQuery = definePagedQueryHandler({
     }),
     handler: async (query, ctx) => {
         const requestedSort = query.payload.sort;
-        const sortColumn = requestedSort !== undefined && isSortableColumn(requestedSort) ? requestedSort : "createdAt";
+        const sortColumn = requestedSort !== undefined && isSortableColumn(requestedSort)
+            ? requestedSort
+            : "createdAt";
         const rows = await selectMany(ctx.db, userSessionTable, undefined, {
             // `id` as a tie-breaker keeps row order (and, with `limit` set, row
             // selection) deterministic across identical requests — sortColumn

package/dist/sessions/schema/user-session.d.ts

@@ -3,6 +3,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -105,6 +107,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -126,6 +129,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/sessions/screens.d.ts

@@ -1,4 +1,4 @@
 import { type ProjectionDetailScreenDefinition, type ProjectionListScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
-export declare const sessionListScreen: ProjectionListScreenDefinition;
-export declare const sessionDetailScreen: ProjectionDetailScreenDefinition;
+export declare const createSessionListScreen: (adminRoles?: readonly string[]) => ProjectionListScreenDefinition;
+export declare const createSessionDetailScreen: (adminRoles?: readonly string[]) => ProjectionDetailScreenDefinition;
 export declare const sessionMineScreen: ProjectionListScreenDefinition;

package/dist/sessions/screens.js

@@ -1,7 +1,6 @@
 import { access, i18nKey, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID, SESSION_MINE_SCREEN_ID, SessionHandlers, SessionQueries, } from "./constants.js";
-const listAccess = { roles: access.admin };
-export const sessionListScreen = {
+export const createSessionListScreen = (adminRoles = access.admin) => ({
     id: SESSION_LIST_SCREEN_ID,
     type: "projectionList",
     query: SessionQueries.list,
@@ -47,9 +46,9 @@ export const sessionListScreen = {
             rowClick: true,
         },
     ],
-    access: listAccess,
-};
-export const sessionDetailScreen = {
+    access: { roles: adminRoles },
+});
+export const createSessionDetailScreen = (adminRoles = access.admin) => ({
     id: SESSION_DETAIL_SCREEN_ID,
     type: "projectionDetail",
     query: SessionQueries.detail,
@@ -82,8 +81,8 @@ export const sessionDetailScreen = {
         ip: i18nKey("sessions.detail.field.ip"),
         userAgent: i18nKey("sessions.detail.field.userAgent"),
     },
-    access: listAccess,
-};
+    access: { roles: adminRoles },
+});
 // Revoke is hidden on the current session — it would sign the user out mid-click; logout covers it.
 export const sessionMineScreen = {
     id: SESSION_MINE_SCREEN_ID,

package/dist/shared/assert-no-where-rule-in-ownership-write.d.ts

@@ -0,0 +1,2 @@
+import type { OwnershipMap } from "@cosmicdrift/kumiko-framework/engine";
+export declare function assertNoWhereRuleInOwnershipWrite(factoryName: string, writeOwnership: OwnershipMap | undefined): void;

package/dist/shared/assert-no-where-rule-in-ownership-write.js

@@ -0,0 +1,18 @@
+// Boot validation rejects `{ kind: "where" }` in access.write too (fw#2626);
+// failing at factory time names the option instead of an entity scope.
+export function assertNoWhereRuleInOwnershipWrite(factoryName, writeOwnership) {
+    // skip: no write ownership declared, nothing to validate
+    if (!writeOwnership)
+        return;
+    const hasWhereRule = Object.values(writeOwnership).some((rule) => rule !== "all" && rule.kind === "where");
+    // skip: no where-rule present, the option is valid
+    if (!hasWhereRule)
+        return;
+    throw new Error(`${factoryName}({ ownership }): ownership.write must not contain a ` +
+        '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
+        "layer (the read path, via buildOwnershipClause). Write paths that " +
+        "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
+        "evaluate them, so such a rule can only ever deny — boot validation " +
+        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
+        "leave it unset.");
+}

package/dist/shared/encrypt-for-direct-write.js

@@ -1,5 +1,6 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { collectPiiSubjectFields, configuredPiiSubjectKms, encryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { collectPiiSubjectFields, configuredPiiSubjectKms, encryptPiiFieldValues, KeyErasedError, } from "@cosmicdrift/kumiko-framework/crypto";
+import { subjectErasedConflict } from "@cosmicdrift/kumiko-framework/errors";
 // Unmanaged direct-write stores (r.unmanagedTable) skip the executor, so its
 // PII encryption never runs — every insert of subject-annotated fields must
 // go through this instead, and the feature declares { piiEncryptedOnWrite:
@@ -8,5 +9,12 @@ export async function encryptForDirectWrite(entity, entityName, row, fallbackReq
     const kms = configuredPiiSubjectKms();
     if (!kms)
         return row;
-    return encryptPiiFieldValues(row, entity, collectPiiSubjectFields(entity), kms, { requestId: requestContext.get()?.requestId ?? fallbackRequestId }, { entityName });
+    try {
+        return await encryptPiiFieldValues(row, entity, collectPiiSubjectFields(entity), kms, { requestId: requestContext.get()?.requestId ?? fallbackRequestId }, { entityName });
+    }
+    catch (e) {
+        if (e instanceof KeyErasedError)
+            throw subjectErasedConflict(e);
+        throw e;
+    }
 }

package/dist/shared/index.d.ts

@@ -1,21 +1,22 @@
 export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
+export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
 export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
 export { entitiesOf } from "./entities-of.js";
 export { isWithinGracePeriod } from "./grace-period.js";
-export { hasWhereRule } from "./has-where-rule.js";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
-export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
+export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
+export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
-export { sessionLocaleField } from "./session-locale-field.js";
+export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";
 export { sessionTimezoneField } from "./session-timezone-field.js";
 export { peekTokenSubject, signToken, TokenPurpose, type VerifyResult, verifyToken, } from "./signed-token.js";
 export { EXT_SIGNUP_HANDOVER, findSignupHandoverProvider, isSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, type SignupHandoverBinding, type SignupHandoverProvider, } from "./signup-handover.js";

package/dist/shared/index.js

@@ -1,21 +1,22 @@
 export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
+export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
 export { runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
 export { entitiesOf } from "./entities-of.js";
 export { isWithinGracePeriod } from "./grace-period.js";
-export { hasWhereRule } from "./has-where-rule.js";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter } from "./lockout-counter.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
-export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
+export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
+export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
-export { sessionLocaleField } from "./session-locale-field.js";
+export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";
 export { sessionTimezoneField } from "./session-timezone-field.js";
 export { peekTokenSubject, signToken, TokenPurpose, verifyToken, } from "./signed-token.js";
 export { EXT_SIGNUP_HANDOVER, findSignupHandoverProvider, isSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, } from "./signup-handover.js";

package/dist/shared/parent-visibility.d.ts

@@ -1,7 +1,8 @@
-import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 export declare function parentRowIsVisible(registry: Registry, entityType: string, entityId: string, user: SessionUser, db: TenantDb): Promise<boolean>;
+export declare function hostRowIsGone(registry: Registry, entityType: string, entityId: string, db: TenantDb): Promise<boolean>;
 export declare function joinRowParentIsVisible(registry: Registry, joinEntityName: string, payload: Readonly<Record<string, unknown>>, user: SessionUser, db: TenantDb): Promise<boolean>;
 export declare function denyUnlessJoinRowParentVisible(registry: Registry, joinEntityName: string, payload: {
     readonly entityType: string;

package/dist/shared/parent-visibility.js

@@ -1,3 +1,4 @@
+import { buildEntityTable, } from "@cosmicdrift/kumiko-framework/db";
 import { createEntityExecutor, isUuid, } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 // Keyed by definition identity, not by entity name — two test stacks can
@@ -39,6 +40,26 @@ export async function parentRowIsVisible(registry, entityType, entityId, user, d
     }
     return (await executor.detail({ id: entityId }, user, db)) !== null;
 }
+const hostTablesByEntity = new WeakMap();
+// True when the host row can never be read again by anyone: its entityType no
+// longer names a registered entity, or the row is hard-deleted / soft-deleted.
+// Deliberately skips the caller's `access.read` ownership (unlike
+// parentRowIsVisible): a row hidden from this caller but alive for another team
+// is NOT gone, and its join row must stay.
+export async function hostRowIsGone(registry, entityType, entityId, db) {
+    const entity = registry.getEntity(entityType);
+    if (!entity)
+        return true;
+    if (!idShapeMatchesEntity(entity, entityId))
+        return true;
+    let table = hostTablesByEntity.get(entity);
+    if (!table) {
+        table = buildEntityTable(entityType, entity, { relations: registry.getRelations(entityType) });
+        hostTablesByEntity.set(entity, table);
+    }
+    const row = await db.fetchOne(table, { id: entityId });
+    return row === undefined || row["isDeleted"] === true;
+}
 // Write-path half of the parentRef gate (fw#2766). Resolves the join entity's
 // own `parentRef` declaration from the registry — the same object the read
 // path's SQL gate reads — so the field names and the allowedTypes allowlist

package/dist/shared/rate-limited-text-response.d.ts

@@ -0,0 +1,2 @@
+import type { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
+export declare function rateLimitedTextResponse(error: RateLimitError): Response;

package/dist/shared/rate-limited-text-response.js

@@ -0,0 +1,9 @@
+export function rateLimitedTextResponse(error) {
+    return new Response("rate limited", {
+        status: 429,
+        headers: {
+            "content-type": "text/plain; charset=utf-8",
+            "retry-after": String(error.details.retryAfterSeconds),
+        },
+    });
+}

package/dist/shared/row-bound-grant.js

@@ -36,7 +36,21 @@ const FAILED = { ok: false };
 function anchoredPurpose(purpose, anchor) {
     return `${purpose}:${anchor}`;
 }
+// The HMAC input is `${purpose}:${anchor}:${subject}.${expiresAtMs}` with no
+// length prefixes. Colon-free anchor and subject make the split unambiguous
+// from the right, so two different (purpose, anchor, subject) triples can
+// never share a signature. The purpose may keep colons (tenant-handover
+// namespaces its purpose by entity type).
+function hasDelimiter(value) {
+    return value.includes(":");
+}
+function isUnambiguousPart(value) {
+    return !!value && !hasDelimiter(value);
+}
 export function signRowBoundGrant(args) {
+    if (hasDelimiter(args.anchor) || hasDelimiter(args.subject)) {
+        throw new Error("row-bound grant: subject and anchor must not contain ':'");
+    }
     return signToken(args.subject, anchoredPurpose(args.purpose, args.anchor), args.ttlMinutes, args.secret, args.now);
 }
 // Every rejection returns the same bare `{ ok: false }` — no reason, by
@@ -51,7 +65,7 @@ export async function redeemRowBoundGrant(args) {
     if (!args.secret)
         return FAILED;
     const subject = peekTokenSubject(args.token);
-    if (!subject)
+    if (!isUnambiguousPart(subject))
         return FAILED;
     // The subject is unverified attacker input at this point, so a lookup that
     // throws on it (e.g. a non-uuid value against a uuid column) must not
@@ -69,7 +83,7 @@ export async function redeemRowBoundGrant(args) {
         });
         return FAILED;
     }
-    if (!anchor)
+    if (!isUnambiguousPart(anchor))
         return FAILED;
     const verified = verifyToken(args.token, anchoredPurpose(args.purpose, anchor), args.secret, args.now);
     if (!verified.ok)

package/dist/shared/session-locale-field.d.ts

@@ -1,2 +1,3 @@
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 export declare function sessionLocaleField(locale: string | null | undefined): Pick<SessionUser, "locale"> | Record<string, never>;
+export declare function registrationLocaleFromRequest(): ReturnType<typeof sessionLocaleField>;

package/dist/shared/session-locale-field.js

@@ -1,6 +1,12 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 export function sessionLocaleField(locale) {
     if (locale === null || locale === undefined || !isValidLocaleTag(locale))
         return {};
     return { locale: canonicalizeLocaleTag(locale) };
 }
+// Only an explicit request signal (X-Locale) counts: the boot default is not a
+// choice the new user made.
+export function registrationLocaleFromRequest() {
+    return sessionLocaleField(requestContext.get()?.locale);
+}