@cosmicdrift/kumiko-bundled-features 0.355.0 → 0.357.0

package/dist/auth-mfa/i18n.js

@@ -19,6 +19,7 @@ export const AUTH_MFA_FEATURE_I18N = {
     "mfa.enable.reveal.qr": { en: "Scan this QR code" },
     "mfa.enable.reveal.secret": { en: "Or enter this code manually" },
     "mfa.enable.reveal.recoveryCodes": { en: "Recovery codes" },
+    "mfa.enable.reveal.savedCodes": { en: "I have saved my recovery codes." },
     "mfa.enable.confirm.submit": { en: "Enable" },
     "mfa.enable.confirm.done": { en: "Two-factor authentication is now enabled." },
     "screen:auth-mfa-disable.title": { en: "Disable two-factor authentication" },

package/dist/auth-mfa/schema/user-mfa.d.ts

@@ -4,6 +4,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -102,6 +105,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -124,6 +128,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -146,6 +151,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/auth-mfa/screens.js

@@ -23,6 +23,7 @@ export const mfaEnableScreen = {
     reveal: {
         title: i18nKey("mfa.enable.reveal.title"),
         warning: i18nKey("mfa.enable.reveal.warning"),
+        acknowledge: i18nKey("mfa.enable.reveal.savedCodes"),
         fields: [
             {
                 field: "otpauthUri",
@@ -47,7 +48,13 @@ export const mfaEnableScreen = {
     confirm: {
         handler: AuthMfaHandlers.enableConfirm,
         fields: {
-            code: { type: "text", required: true, minLength: 6, maxLength: 6 },
+            code: {
+                type: "text",
+                required: true,
+                minLength: 6,
+                maxLength: 6,
+                autoComplete: "one-time-code",
+            },
         },
         layout: { sections: [{ fields: ["code"] }] },
         carry: ["setupToken"],

package/dist/billing-foundation/entities.d.ts

@@ -4,6 +4,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -70,6 +73,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -92,6 +96,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -147,6 +152,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -169,6 +175,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -191,6 +198,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/billing-foundation/projection.d.ts

@@ -4,6 +4,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -70,6 +73,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -92,6 +96,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -146,6 +151,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -168,6 +174,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -190,6 +197,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/cap-counter/entity.d.ts

@@ -4,6 +4,7 @@ export declare const capCounterEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/cap-counter/feature.js

@@ -94,7 +94,13 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
         id: CAP_COUNTER_LIST_SCREEN_ID,
         type: "entityList",
         entity: "cap-counter",
-        columns: ["tenantId", "capName", "value", "periodStart", "lastSoftWarnedAt"],
+        columns: [
+            "tenantId",
+            "capName",
+            "value",
+            "periodStart",
+            { field: "lastSoftWarnedAt", hideOnNarrow: true },
+        ],
         defaultSort: { field: "capName", dir: "asc" },
         // Search resolves against the caller's own tenant stream, so on this
         // cross-tenant operator list it would only ever hit the SystemAdmin's tenant.

package/dist/cap-overview/screens.js

@@ -15,10 +15,12 @@ export function createTenantCapListScreen(caps, listCaps, tiers) {
             { field: "name", label: "cap-overview.list.col.name" },
             { field: "tier", label: "cap-overview.list.col.tier" },
             { field: "billing", label: "cap-overview.list.col.billing" },
-            ...listedCaps.map((cap) => ({
+            // Name is the title; tier, billing and the first cap fill the card's three meta rows.
+            ...listedCaps.map((cap, index) => ({
                 field: capFieldName(cap.id),
                 label: cap.label,
                 renderer: { react: { __component: CAP_USAGE_CELL_COMPONENT } },
+                ...(index > 0 && { hideOnNarrow: true }),
             })),
         ],
         searchable: true,

package/dist/compliance-profiles/handlers/set-profile.write.js

@@ -4,6 +4,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, validationErrorFromZod, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { requireForTenant } from "../../shared/index.js";
 import { tenantComplianceProfileEntity, tenantComplianceProfileTable, } from "../schema/profile-selection.js";
 const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantComplianceProfileEntity, {
     entityName: "tenant-compliance-profile",
@@ -13,24 +14,16 @@ const crud = createEventStoreExecutor(tenantComplianceProfileTable, tenantCompli
 // nicht eine waehlbare Production-Option. Symmetrisch zu
 // SELECTABLE_PROFILE_KEYS aus der framework/compliance-Liste.
 const profileKeySchema = z.enum(SELECTABLE_PROFILE_KEYS);
-// Tenant-Admin setzt Profile-Key + optional Override-JSON.
+// Upsert: the first call inserts, later calls update, so repeating the same values
+// is idempotent apart from the extra audit events.
 //
-// Upsert-Verhalten: erste Wahl insert, weitere update. Idempotent —
-// wer mit gleichen Werten zweimal aufruft, kriegt das gleiche Ergebnis
-// (modulo aktualisierte Audit-Events im Event-Store).
+// A SystemAdmin may target another tenant via `tenantIdOverride` (operator setup,
+// onboarding migrations); the dispatcher rejects the override for anyone else. The
+// executor then writes into the target tenant's stream via streamTenantId while
+// the operator stays the recorded actor.
 //
-// Cross-Tenant-Pfad: SystemAdmin kann via `tenantIdOverride` fuer einen
-// anderen Tenant schreiben (Plattform-Operator-Setup, Customer-
-// Onboarding-Migrationen). TenantAdmin's Override-Versuch → 403.
-// executorUser.tenantId muss = ziel-tenant sein damit der event-store-
-// Stream-Lookup nicht miss → version_conflict gibt (Memory:
-// feedback_event_store_tenant_consistency).
-//
-// Validation:
-//   - profileKey muss in SELECTABLE_PROFILE_KEYS sein (Zod-checked)
-//   - override (optional) muss valides JSON-Object sein
-//   - override Top-Level-Keys muessen in ALLOWED_OVERRIDE_KEYS sein
-//     — verhindert Tippfehler die deepMerge stillschweigend ignoriert
+// Override top-level keys are restricted to ALLOWED_OVERRIDE_KEYS because deepMerge
+// would silently ignore a typo.
 export const setProfileWrite = defineWriteHandler({
     name: "set-profile",
     schema: z.object({
@@ -43,9 +36,8 @@ export const setProfileWrite = defineWriteHandler({
     access: { roles: access.admin },
     description: "Sets or replaces a tenant's compliance profile key plus an optional JSON override, for onboarding or a later region change; a system admin may target a different tenant through tenantIdOverride.",
     handler: async (event, ctx) => {
-        const tenantOverride = event.payload.tenantIdOverride;
-        const tenantId = (tenantOverride ?? event.user.tenantId); // @cast-boundary engine-payload
-        const executorUser = tenantOverride !== undefined ? { ...event.user, tenantId } : event.user;
+        const tenantId = (event.payload.tenantIdOverride ?? event.user.tenantId); // @cast-boundary engine-payload
+        const { db, streamTenantId } = requireForTenant(ctx, tenantId);
         // Override-Validation: muss parseables JSON-Object sein UND dem
         // ComplianceProfileOverride-Schema entsprechen (S1.9 Z3 — strict-Zod
         // mit Top-Level + Sub-Level-Whitelist via .strict()). Tippfehler
@@ -72,7 +64,7 @@ export const setProfileWrite = defineWriteHandler({
             }
         }
         // Upsert: existierenden Eintrag suchen
-        const existing = (await fetchOne(ctx.db, tenantComplianceProfileTable, {
+        const existing = (await fetchOne(db, tenantComplianceProfileTable, {
             tenantId: tenantId,
         })); // @cast-boundary db-runner
         if (existing) {
@@ -83,7 +75,7 @@ export const setProfileWrite = defineWriteHandler({
                     profileKey: event.payload.profileKey,
                     override: event.payload.override ?? null,
                 },
-            }, executorUser, ctx.db);
+            }, event.user, db, { streamTenantId });
             if (!result.isSuccess)
                 return result;
             return {
@@ -95,7 +87,7 @@ export const setProfileWrite = defineWriteHandler({
             profileKey: event.payload.profileKey,
             override: event.payload.override ?? null,
             tenantId,
-        }, executorUser, ctx.db);
+        }, event.user, db, { streamTenantId });
         if (!result.isSuccess)
             return result;
         return {

package/dist/config/table.d.ts

@@ -4,6 +4,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -72,6 +75,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -94,6 +98,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -116,6 +121,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -10,6 +10,7 @@ import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/se
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
+import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
 import { USER_STATUS } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant, isSystemAdminActor, updateUserLifecycle, } from "../../user-data-rights/index.js";
@@ -213,7 +214,7 @@ function sweepErrorLabel(err) {
 // The key is already erased when this runs, so a failing sweep must not skip the
 // audit event: the failure is returned as a label for the event instead of thrown.
 // The savepoint keeps a database error from aborting the handler transaction.
-async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner) {
+async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner, audit) {
     try {
         await runInSavepointIfSupported(crossTenantRunner, async (crossTenantSubjectRunner) => {
             // Blind-index sweep (#818): nulls bidx columns now so the deterministic
@@ -224,6 +225,16 @@ async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunn
             if (ctx.searchAdapter) {
                 await purgeSearchDocumentsForSubject(crossTenantSubjectRunner, ctx.registry.features, ctx.searchAdapter, subjectKey, subject);
             }
+            // Note bodies are keyed per note, so the subject's own key never reaches them.
+            if (ctx.registry.features.has("notes-history")) {
+                await eraseNoteBodiesReachingSubject({
+                    db: crossTenantSubjectRunner,
+                    registry: ctx.registry,
+                    subject,
+                    erasedBy: audit.erasedBy,
+                    requestId: audit.requestId,
+                });
+            }
         });
         return undefined;
     }
@@ -335,12 +346,13 @@ export const forgetSubjectWrite = defineWriteHandler({
         // but no event exists — a retry is a no-op erase plus the event. The
         // reverse order could leave an audit trail claiming a shred that never
         // happened.
+        const requestId = requestContext.get()?.requestId ?? "crypto-shredding:forget-subject";
         await kms.eraseKey(subject, {
-            requestId: requestContext.get()?.requestId ?? "crypto-shredding:forget-subject",
+            requestId,
             userId: event.user.id,
             eraseReason: event.payload.reason,
         });
-        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw());
+        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw(), { requestId, erasedBy: event.user.id });
         // User subject: close the login door. DEK-erase makes the passwordHash
         // ciphertext unreadable, but status + PATs are standalone credentials —
         // the PAT resolver only checks revokedAt/expiresAt, NOT user.status

package/dist/custom-fields/entity.d.ts

@@ -4,6 +4,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -95,6 +98,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/custom-fields/handlers/define-system-field.write.js

@@ -1,19 +1,14 @@
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { defineOrResurrectFieldDefinition } from "../lib/define-or-resurrect.js";
 import { buildFieldDefinitionColumns } from "../lib/field-definition-row.js";
 import { defineFieldPayloadSchema } from "../schemas.js";
-// define-system-field — SystemAdmin definiert eine system-weite Custom-Field-
-// Definition die für ALLE Tenants gilt. tenantId wird auf SYSTEM_TENANT_ID
-// gesetzt (NICHT vom Caller — SystemAdmin's event.user.tenantId würde sonst
-// auf den admin's eigenen platform-tenant zeigen).
-//
-// **Use-Case:** Vendor (cdgs) sagt "alle Hausverwaltungs-customers haben ab
-// heute ein `internalNumber`-Field". Tenant kann den Wert pro customer
-// setzen, aber die Definition nicht ändern oder löschen.
-//
-// **Same-scope-conflict** wie bei define-tenant-field via aggregate-version-
-// conflict (deterministische ID mit tenantId=SYSTEM_TENANT_ID).
+// A system-wide field definition applies to every tenant. tenantId is forced to
+// SYSTEM_TENANT_ID (never taken from the caller) and addressed via streamTenantId,
+// so the SystemAdmin stays the recorded actor. Tenants can set values for the field
+// but cannot change or delete the definition. A same-scope duplicate surfaces as an
+// aggregate version conflict, because the ID is derived from SYSTEM_TENANT_ID.
 export const defineSystemFieldHandler = {
     name: "define-system-field",
     schema: defineFieldPayloadSchema,
@@ -22,10 +17,7 @@ export const defineSystemFieldHandler = {
     handler: async (event, ctx) => {
         const payload = event.payload; // @cast-boundary engine-payload
         const aggregateId = fieldDefinitionAggregateId(SYSTEM_TENANT_ID, payload.entityName, payload.fieldKey);
-        // Override event.user.tenantId to SYSTEM_TENANT_ID for the system-scope
-        // write. The framework's CrudExecutor writes the row with this tenantId
-        // — the row lives in the system-scope-stream.
-        const systemUser = { ...event.user, tenantId: SYSTEM_TENANT_ID };
-        return defineOrResurrectFieldDefinition(aggregateId, buildFieldDefinitionColumns(payload), systemUser, ctx.db);
+        const { db, streamTenantId } = requireForTenant(ctx, SYSTEM_TENANT_ID);
+        return defineOrResurrectFieldDefinition(aggregateId, buildFieldDefinitionColumns(payload), event.user, db, streamTenantId);
     },
 };

package/dist/custom-fields/handlers/delete-system-field.write.js

@@ -1,4 +1,5 @@
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants.js";
 import { fieldDefinitionExecutor } from "../executor.js";
@@ -18,8 +19,10 @@ export const deleteSystemFieldHandler = {
     handler: async (event, ctx) => {
         const payload = event.payload; // @cast-boundary engine-payload
         const aggregateId = fieldDefinitionAggregateId(SYSTEM_TENANT_ID, payload.entityName, payload.fieldKey);
-        const systemUser = { ...event.user, tenantId: SYSTEM_TENANT_ID };
-        const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, systemUser, ctx.db);
+        const { db, streamTenantId } = requireForTenant(ctx, SYSTEM_TENANT_ID);
+        const result = await fieldDefinitionExecutor.delete({ id: aggregateId }, event.user, db, {
+            streamTenantId,
+        });
         // Cascade-cleanup-Event — host-entity-MSPs entfernen orphan values aus
         // ihrer customFields jsonb. Im selben TX = atomic.
         if (result.isSuccess) {

package/dist/custom-fields/lib/define-or-resurrect.d.ts

@@ -1,7 +1,8 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionExecutor } from "../executor.js";
 import type { FieldDefinitionColumns } from "./field-definition-row.js";
 type DefineUser = Parameters<typeof fieldDefinitionExecutor.create>[1];
 type DefineDb = Parameters<typeof fieldDefinitionExecutor.create>[2];
 type WriteResult = Awaited<ReturnType<typeof fieldDefinitionExecutor.create>>;
-export declare function defineOrResurrectFieldDefinition(aggregateId: string, columns: FieldDefinitionColumns, user: DefineUser, db: DefineDb): Promise<WriteResult>;
+export declare function defineOrResurrectFieldDefinition(aggregateId: string, columns: FieldDefinitionColumns, user: DefineUser, db: DefineDb, streamTenantId?: TenantId): Promise<WriteResult>;
 export {};

package/dist/custom-fields/lib/define-or-resurrect.js

@@ -16,12 +16,16 @@ import { fieldDefinitionExecutor } from "../executor.js";
 // fail with "current transaction is aborted". detail() (a read) + restore()
 // (which sees soft-deleted rows via a tenant-scoped fetch and only writes on
 // success) keep the tx clean until the single terminal write.
-export async function defineOrResurrectFieldDefinition(aggregateId, columns, user, db) {
+export async function defineOrResurrectFieldDefinition(aggregateId, columns, user, db, streamTenantId) {
     const active = await fieldDefinitionExecutor.detail({ id: aggregateId }, user, db);
     if (active) {
-        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
+        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db, {
+            streamTenantId,
+        });
     }
-    const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db);
+    const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db, {
+        streamTenantId,
+    });
     if (restored.isSuccess) {
         // restore() just un-deleted the row in this same tx; no concurrent writer
         // exists, so skip the optimistic-lock version match (we'd otherwise have to
@@ -31,10 +35,13 @@ export async function defineOrResurrectFieldDefinition(aggregateId, columns, use
         // readonly FieldDefinitionColumns isn't assignable to it.
         return fieldDefinitionExecutor.update({ id: aggregateId, changes: { ...columns } }, user, db, {
             skipOptimisticLock: true,
+            streamTenantId,
         });
     }
     if (restored.error.code === "not_found") {
-        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
+        return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db, {
+            streamTenantId,
+        });
     }
     return restored;
 }

package/dist/data-retention/schema/tenant-retention-override.d.ts

@@ -4,6 +4,7 @@ export declare const tenantRetentionOverrideEntity: import("@cosmicdrift/kumiko-
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -42,6 +43,7 @@ export declare const tenantRetentionOverrideEntity: import("@cosmicdrift/kumiko-
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -66,6 +68,7 @@ export declare const tenantRetentionOverrideTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -104,6 +107,7 @@ export declare const tenantRetentionOverrideTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/delivery/chat-webhook-sender.js

@@ -17,7 +17,7 @@ export const chatConnectionNameSchema = z
 function policyFor(request, target) {
     return request.requireHttps
         ? { kind: "external" }
-        : { kind: "internal", allowHosts: [target.hostname] };
+        : { kind: "internal", allowOrigins: [target.origin] };
 }
 function hostMatches(hostname, allowedHost) {
     const allowed = allowedHost.toLowerCase();

package/dist/delivery/constants.d.ts

@@ -1,6 +1,7 @@
 import type { NotifyPriority } from "@cosmicdrift/kumiko-framework/engine";
 export declare const DELIVERY_CHANNEL_EXTENSION: "deliveryChannel";
 export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, type DeliveryStatusValue, } from "./public-names.js";
+export declare function deliveryIdempotencyRedisKey(tenantId: string, key: string): string;
 export declare const deliveryPriorityRank: Record<NotifyPriority, number>;
 export declare const DeliveryJobs: {
     readonly render: string;

package/dist/delivery/constants.js

@@ -4,6 +4,10 @@ import { DELIVERY_FEATURE, DeliveryJobNames } from "./public-names.js";
 // channel-in-app, channel-push, ...).
 export const DELIVERY_CHANNEL_EXTENSION = "deliveryChannel";
 export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, } from "./public-names.js";
+// Single source for claim (delivery-service) and terminal-failure release (jobs).
+export function deliveryIdempotencyRedisKey(tenantId, key) {
+    return `delivery:idem:${tenantId}:${key}`;
+}
 // notify() priority → BullMQ job priority. Lower number = processed first; all
 // > 0 so prioritised delivery jobs never mix with BullMQ's "0 = unprioritised
 // FIFO" bucket. critical jobs jump ahead of normal/low in the worker queue.