@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.379.0

package/dist/user-data-rights/web/index.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Public exports für die Browser-Seite des user-data-rights Features —
 // die anonymen Apex-Deletion-Screens. Konsumiert via Sub-Path-Export
 // `@cosmicdrift/kumiko-bundled-features/user-data-rights/web`. Die Server-
@@ -6,7 +5,7 @@
 // keine React-/DOM-Deps.
 export { userDataRightsClient } from "./client-plugin.js";
 export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.js";
-export { defaultTranslations } from "./i18n.js";
+export { defaultTranslations } from "./default-translations.js";
 export { formatDate } from "./privacy-center-screen.js";
 export { makePublicDeletionGate } from "./public-deletion-gate.js";
 export { RequestAccountDeletionScreen } from "./request-deletion-screen.js";

package/dist/user-data-rights/web/privacy-center-screen.js

@@ -1,6 +1,5 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { EMPTY_VALUE_PLACEHOLDER } from "@cosmicdrift/kumiko-renderer/headless";
-// @runtime client
 // Export section (Art. 20) — the one part of user-data-rights' privacy-center
 // screen that stays custom (fw#2312). Registered as an EditExtensionSection
 // component (see web/client-plugin.tsx); the projectionDetail screen
@@ -15,7 +14,7 @@ import { useDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmic
 import { postWithDownload } from "@cosmicdrift/kumiko-renderer/web";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { useEffect, useState } from "react";
-import { EXPORT_JOB_STATUS, UserDataRightsHandlers, UserDataRightsQueries, } from "../constants.js";
+import { EXPORT_JOB_STATUS, UserDataRightsHandlers, UserDataRightsQueries, } from "./constants.js";
 // Export-Job läuft async (worker-Lane-Cron, ~1 Min). Solange er pending/running
 // ist, pollt der Screen den Status, damit der Download ohne manuellen Reload
 // erscheint.

package/dist/user-data-rights/web/request-deletion-screen.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // RequestAccountDeletionScreen — anonymer Apex-Screen Schritt 1. Email-Form
 // → user-data-rights:write:request-deletion-by-email. Enumeration-safe: zeigt
 // unconditional ein "Falls Account existiert, Mail unterwegs"-Confirm, auch

package/dist/user-data-rights-defaults/hooks/file-ref.userdata-hook.js

@@ -2,7 +2,7 @@ import { createEventStoreExecutor, WritePurposes, } from "@cosmicdrift/kumiko-fr
 import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import { fileRefEntity, fileRefsTable, resolveActionFormFileField, } from "@cosmicdrift/kumiko-framework/files";
 import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
 const ERROR_CONTEXT = "user-data-rights-defaults:fileRef";
 // Forget writes go through the executor (events), not deleteMany/updateMany:
@@ -145,6 +145,8 @@ function isPersonalPiiField(field) {
 //   2. Field exists but carries no PII annotation → anonymize (the
 //      conservative path); the boot-validator warns on a PII-typical field
 //      name so this stays visible and quiet-fixable via `personal`.
+//   2b. Pending upload of an actionForm files field (entityType = screen QN, entityId null):
+//      nothing owns it yet, so it is personal to its uploader and hard-deleted like case 1.
 //   3. Entity or field not resolvable (upload hardening in file-routes.ts
 //      should prevent this from ever being written; theoretical remainder
 //      only) → anonymize, never a silent hard-delete.
@@ -155,6 +157,9 @@ function isPersonalFileRow(registry, row) {
         return true;
     if (typeof entityType !== "string" || typeof fieldName !== "string")
         return false;
+    if (row["entityId"] === null && resolveActionFormFileField(registry, entityType, fieldName)) {
+        return true;
+    }
     const fieldDef = registry.getEntity(entityType)?.fields[fieldName];
     return isPersonalPiiField(fieldDef);
 }

package/dist/user-profile/feature.js

@@ -1,6 +1,6 @@
 import { defineFeature, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
-import { CHANGE_EMAIL_SECTION_EXTENSION_NAME, CHANGE_PASSWORD_SECTION_EXTENSION_NAME, PROFILE_SCREEN_ID, UserDataRightsHandlers, UserProfileQueries, } from "./constants.js";
 import { changeEmailWrite } from "./handlers/change-email.write.js";
+import { CHANGE_EMAIL_SECTION_EXTENSION_NAME, CHANGE_PASSWORD_SECTION_EXTENSION_NAME, PROFILE_SCREEN_ID, UserDataRightsHandlers, UserProfileQueries, } from "./web/constants.js";
 export function createUserProfileFeature(options) {
     const allowEmailChange = options?.allowEmailChange ?? true;
     return defineFeature("user-profile", (r) => {

package/dist/user-profile/handlers/change-email.write.js

@@ -4,7 +4,7 @@ import * as z from "zod";
 import { AuthErrors } from "../../auth-email-password/index.js";
 import { decryptStoredPii, verifyPassword } from "../../shared/index.js";
 import { UserErrors, UserHandlers, UserQueries } from "../../user/index.js";
-import { UserProfileErrors } from "../constants.js";
+import { UserProfileErrors } from "../web/constants.js";
 // Gleiche Failure-Shape wie auth-email-password (anti-enumeration):
 // dessen errors.ts ist nicht Teil des Feature-Barrels, der Reason-Code
 // + i18nKey sind aber stabile Public-API.

package/dist/user-profile/index.d.ts

@@ -1,2 +1,2 @@
-export { USER_PROFILE_FEATURE, UserDataRightsHandlers, UserProfileErrors, UserProfileHandlers, UserProfileQueries, } from "./constants.ts";
 export { createUserProfileFeature, type UserProfileFeatureOptions } from "./feature.ts";
+export { USER_PROFILE_FEATURE, UserDataRightsHandlers, UserProfileErrors, UserProfileHandlers, UserProfileQueries, } from "./web/constants.ts";

package/dist/user-profile/index.js

@@ -1,5 +1,5 @@
 // Bewusst OHNE i18n-Export: das Server-Barrel muss von Server-Samples
 // ohne jsx-tsconfig kompilierbar bleiben (i18n zieht kumiko-renderer →
 // .tsx). Translations kommen via ./web (userProfileClient).
-export { USER_PROFILE_FEATURE, UserDataRightsHandlers, UserProfileErrors, UserProfileHandlers, UserProfileQueries, } from "./constants.js";
 export { createUserProfileFeature } from "./feature.js";
+export { USER_PROFILE_FEATURE, UserDataRightsHandlers, UserProfileErrors, UserProfileHandlers, UserProfileQueries, } from "./web/constants.js";

package/dist/user-profile/web/client-plugin.js

@@ -1,7 +1,6 @@
-// @runtime client
 import { mergeTranslations, } from "@cosmicdrift/kumiko-renderer";
-import { CHANGE_EMAIL_SECTION_EXTENSION_NAME, CHANGE_PASSWORD_SECTION_EXTENSION_NAME, } from "../constants.js";
-import { defaultTranslations } from "../i18n.js";
+import { CHANGE_EMAIL_SECTION_EXTENSION_NAME, CHANGE_PASSWORD_SECTION_EXTENSION_NAME, } from "./constants.js";
+import { defaultTranslations } from "./i18n.js";
 import { ChangeEmailSection, ChangePasswordSection } from "./profile-screen.js";
 // Supplies the ChangeEmail/ChangePassword extension components for the
 // declarative `profile` projectionDetail screen (fw#2312, ../feature.ts,

package/dist/user-profile/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // Plain string constants — client-marked so web/profile-screen.tsx can
 // import them; runtime code (handlers/feature) may pull client files anyway.
 export const USER_PROFILE_FEATURE = "user-profile";

package/dist/user-profile/{i18n.js → web/i18n.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // Default bundles for the `profile` screen. userProfileClient() hangs this
 // in the LocaleProvider as a fallback bundle — apps override individual keys
 // via `userProfileClient({ translations })`.

package/dist/user-profile/web/profile-screen.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // Change-password and change-email sections for the declarative `profile`
 // projectionDetail screen (fw#2312, ../feature.ts). Both keep re-auth flows
 // a declarative action can't express, so they stay React `EditExtensionSection`
@@ -10,9 +9,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useDispatcher, usePrimitives, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { useState } from "react";
-import { AuthHandlers } from "../../auth-email-password/constants.js";
+import { AuthHandlers } from "../../auth-email-password/web/constants.js";
 import { requestEmailVerification } from "../../auth-email-password/web/index.js";
-import { UserProfileHandlers } from "../constants.js";
+import { UserProfileHandlers } from "./constants.js";
 // Dispatcher failures carry an i18nKey only when the handler sets one —
 // boundary read with a generic fallback.
 function failureKey(error) {

package/dist/waitlist/entity.js

@@ -1,6 +1,6 @@
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { createEntity, createLongTextField, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
-import { WAITLIST_STATUS } from "./constants.js";
+import { WAITLIST_STATUS } from "./web/constants.js";
 const WAITLIST_STATUS_OPTIONS = [
     WAITLIST_STATUS.Pending,
     WAITLIST_STATUS.Invited,

package/dist/waitlist/feature.js

@@ -1,5 +1,4 @@
 import { defineFeature, EXT_USER_DATA, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
-import { WAITLIST_EXPORTED_EVENT_SHORT, WAITLIST_FEATURE, WAITLIST_PURGED_EVENT_SHORT, } from "./constants.js";
 import { waitlistEntryEntity } from "./entity.js";
 import { exportHandler, purgeHandler } from "./handlers/export-purge.write.js";
 import { createInviteHandler } from "./handlers/invite.write.js";
@@ -13,6 +12,7 @@ import { WAITLIST_ADMIN_NOTICE_RECORD, WAITLIST_ADMIN_NOTICE_VARIABLES, WAITLIST
 import { WaitlistAuditEventSchema } from "./payloads.js";
 import { waitlistListScreen } from "./screens.js";
 import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-hooks.js";
+import { WAITLIST_EXPORTED_EVENT_SHORT, WAITLIST_FEATURE, WAITLIST_PURGED_EVENT_SHORT, } from "./web/constants.js";
 export function createWaitlistFeature(opts = {}) {
     return defineFeature(WAITLIST_FEATURE, (r) => {
         r.describe("Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.");

package/dist/waitlist/handlers/export-purge.write.js

@@ -2,9 +2,9 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-import { WAITLIST_AUDIT_AGGREGATE_TYPE, WAITLIST_EXPORTED_EVENT_QN, WAITLIST_PURGED_EVENT_QN, WaitlistErrors, } from "../constants.js";
 import { listAllWaitlistRows, purgeWaitlistRows } from "../entries-admin.js";
 import { adminAccess, waitlistDb } from "../lib.js";
+import { WAITLIST_AUDIT_AGGREGATE_TYPE, WAITLIST_EXPORTED_EVENT_QN, WAITLIST_PURGED_EVENT_QN, WaitlistErrors, } from "../web/constants.js";
 const PurgeSchema = z.object({ confirmCount: z.number().int().min(0) }).strict();
 const ExportSchema = z.object({}).strict();
 async function appendAudit(ctx, type, count) {

package/dist/waitlist/handlers/invite.write.js

@@ -4,10 +4,10 @@ import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/index.js";
 import { TenantHandlers, tenantTable } from "../../tenant/index.js";
-import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS, WaitlistErrors } from "../constants.js";
 import { isOpenWaitlistStatus } from "../entity.js";
 import { adminAccess, isTenantMember, platformActor, waitlistDb, waitlistExecutor, } from "../lib.js";
 import { WaitlistIdSchema } from "../payloads.js";
+import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS, WaitlistErrors, } from "../web/constants.js";
 // pg_advisory_xact_lock namespace (int4): 'wlin' as ASCII, disjoint from the submit lock.
 const INVITE_LOCK_NAMESPACE = 0x776c696e;
 const INVITE_LOCK_REASON = "takes the per-entry advisory lock so parallel invites cannot both create a tenant and invitation; TenantDb has no lock API";

package/dist/waitlist/handlers/reject.write.js

@@ -2,10 +2,10 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { cancelPendingInvitation, INVITATION_STATUS, tenantInvitationsTable, } from "../../tenant/index.js";
-import { WAITLIST_STATUS, WaitlistErrors } from "../constants.js";
 import { isOpenWaitlistStatus } from "../entity.js";
 import { adminAccess, isTenantMember, normalizeEmail, platformActor, waitlistDb, waitlistExecutor, } from "../lib.js";
 import { WaitlistIdSchema } from "../payloads.js";
+import { WAITLIST_STATUS, WaitlistErrors } from "../web/constants.js";
 // An invited entry already has a live invitation link; rejecting must kill it,
 // otherwise the rejected person can still sign up. Once accepted they hold
 // access, which only tenant member removal may revoke.

package/dist/waitlist/handlers/submit.write.js

@@ -2,11 +2,11 @@ import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db"
 import { access, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS } from "../constants.js";
 import { normalizeEmail, platformActor, waitlistDb, waitlistExecutor } from "../lib.js";
-import { resolveWaitlistAdminMailLocale, resolveWaitlistMailLocale, waitlistAdminNoticeVariables, waitlistConfirmationVariables, } from "../mail.js";
+import { resolveWaitlistMailLocale, waitlistAdminNoticeVariables, waitlistConfirmationVariables, } from "../mail.js";
 import { DEFAULT_SUBMIT_EMAIL_RATE_LIMITS, DEFAULT_SUBMIT_RATE_LIMIT, } from "../options.js";
 import { WaitlistSubmitSchema } from "../payloads.js";
+import { WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS } from "../web/constants.js";
 // pg_advisory_xact_lock namespace (int4): 'wlst' as ASCII, disjoint from the
 // framework's other fixed advisory-lock keys.
 const SUBMIT_LOCK_NAMESPACE = 0x776c7374;
@@ -124,7 +124,8 @@ export function createSubmitHandler(opts) {
                         message: payload.message,
                     }),
                     priority: "normal",
-                    locale: resolveWaitlistAdminMailLocale(ctx.locale),
+                    // Operator-facing: the request locale, not the one the entrant picked in the form.
+                    locale: resolveWaitlistMailLocale(ctx.locale),
                 });
             });
             return SUBMITTED;

package/dist/waitlist/import.d.ts

@@ -1,6 +1,6 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import type { WaitlistStatus } from "./constants.ts";
+import type { WaitlistStatus } from "./web/constants.ts";
 export type WaitlistImportEntry = {
     /** Stable identity of the source row (e.g. `offlot:<uuid>`); the new entry id derives from it. */
     readonly sourceKey: string;

package/dist/waitlist/index.d.ts

@@ -1,7 +1,7 @@
-export { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_FEATURE, WAITLIST_FIELD_LIMITS, WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS, WaitlistErrors, WaitlistHandlers, WaitlistQueries, type WaitlistStatus, } from "./constants.ts";
 export { isOpenWaitlistStatus, waitlistEntryEntity, waitlistEntryTable } from "./entity.ts";
 export { createWaitlistFeature } from "./feature.ts";
 export { importWaitlistEntry, type WaitlistImportEntry, type WaitlistImportOutcome, waitlistImportId, } from "./import.ts";
 export { DEFAULT_IMPORT_LOCALE, DEFAULT_LEGACY_SOURCE_TABLE, isLegacyWaitlistSource, LEGACY_WAITLIST_SOURCES, type LegacyWaitlistMigrateOptions, type LegacyWaitlistMigrateReport, type LegacyWaitlistSource, migrateLegacyWaitlist, offlotLegacyTable, publicstatusLegacyTable, } from "./legacy-migrate.ts";
 export type { WaitlistInviteOptions, WaitlistOptions } from "./options.ts";
 export { type WaitlistSubmitInput, WaitlistSubmitSchema } from "./payloads.ts";
+export { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_FEATURE, WAITLIST_FIELD_LIMITS, WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS, WaitlistErrors, WaitlistHandlers, WaitlistQueries, type WaitlistStatus, } from "./web/constants.ts";

package/dist/waitlist/index.js

@@ -1,6 +1,6 @@
-export { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_FEATURE, WAITLIST_FIELD_LIMITS, WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS, WaitlistErrors, WaitlistHandlers, WaitlistQueries, } from "./constants.js";
 export { isOpenWaitlistStatus, waitlistEntryEntity, waitlistEntryTable } from "./entity.js";
 export { createWaitlistFeature } from "./feature.js";
 export { importWaitlistEntry, waitlistImportId, } from "./import.js";
 export { DEFAULT_IMPORT_LOCALE, DEFAULT_LEGACY_SOURCE_TABLE, isLegacyWaitlistSource, LEGACY_WAITLIST_SOURCES, migrateLegacyWaitlist, offlotLegacyTable, publicstatusLegacyTable, } from "./legacy-migrate.js";
 export { WaitlistSubmitSchema } from "./payloads.js";
+export { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_FEATURE, WAITLIST_FIELD_LIMITS, WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS, WaitlistErrors, WaitlistHandlers, WaitlistQueries, } from "./web/constants.js";

package/dist/waitlist/legacy-migrate.js

@@ -3,8 +3,8 @@ import { countWhere, createTenantDb, selectMany, table, text as textColumn, time
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { archiveStream, createArchivedStreamsTable, eventsTable, isStreamArchived, } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { WAITLIST_STATUS } from "./constants.js";
 import { importWaitlistEntry, waitlistImportId } from "./import.js";
+import { WAITLIST_STATUS } from "./web/constants.js";
 export const LEGACY_WAITLIST_SOURCES = ["offlot", "publicstatus"];
 export function isLegacyWaitlistSource(value) {
     return LEGACY_WAITLIST_SOURCES.some((known) => known === value);

package/dist/waitlist/link-on-signup.js

@@ -5,8 +5,8 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { decryptStoredPii } from "../shared/index.js";
 import { tenantMembershipsTable } from "../tenant/index.js";
 import { userTable } from "../user/index.js";
-import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS } from "./constants.js";
 import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.js";
+import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS } from "./web/constants.js";
 const PII_DECRYPT_REASON = "waitlist:link-on-signup";
 export const WAITLIST_MEMBERSHIP_CREATED_EVENT = entityEventName("tenant-membership", "created");
 // Only a TenantAdmin membership can be the signup owner; invite-accept memberships of

package/dist/waitlist/mail.d.ts

@@ -13,7 +13,6 @@ export declare function waitlistConfirmationVariables(args: {
     readonly footer: string;
 };
 export declare function waitlistConfirmationTemplate(): NotificationLocalizedTemplate;
-export declare function resolveWaitlistAdminMailLocale(adminLocale: string | undefined): "en" | "de";
 export declare function waitlistAdminNoticeVariables(args: {
     readonly name: string;
     readonly email: string;

package/dist/waitlist/mail.js

@@ -33,6 +33,12 @@ const ADMIN_NOTICE_STRINGS = {
         intro: "Jemand hat sich gerade auf die Warteliste eingetragen.",
         footer: "Den Eintrag findest du in der Wartelisten-Verwaltung.",
     },
+    es: {
+        subject: (name) => `Nueva entrada en la lista de espera: ${name}`,
+        header: "Nueva entrada en la lista de espera",
+        intro: "Alguien acaba de unirse a la lista de espera.",
+        footer: "Revisa la entrada en la administración de la lista de espera.",
+    },
 };
 function languageOf(locale) {
     return (locale ?? "").split("-")[0]?.toLowerCase() ?? "";
@@ -79,10 +85,6 @@ export function waitlistConfirmationTemplate() {
         },
     ]));
 }
-// Operator-facing, so the entrant's locale does not apply: en/de, en default.
-export function resolveWaitlistAdminMailLocale(adminLocale) {
-    return languageOf(adminLocale) === "de" ? "de" : "en";
-}
 export function waitlistAdminNoticeVariables(args) {
     return {
         name: args.name,

package/dist/waitlist/payloads.js

@@ -1,6 +1,6 @@
 import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
-import { WAITLIST_FIELD_LIMITS } from "./constants.js";
+import { WAITLIST_FIELD_LIMITS } from "./web/constants.js";
 // Submitted text lands in a mail subject; CR/LF there would allow header injection.
 const NO_CONTROL_CHARS = /^\P{Cc}*$/u;
 const NO_CONTROL_CHARS_EXCEPT_WHITESPACE = /^(?:[^\p{Cc}]|[\n\r\t])*$/u;

package/dist/waitlist/screens.js

@@ -1,6 +1,6 @@
 import { i18nKey } from "@cosmicdrift/kumiko-framework/engine";
-import { WAITLIST_STATUS, WaitlistHandlers } from "./constants.js";
 import { adminAccess } from "./lib.js";
+import { WAITLIST_STATUS, WaitlistHandlers } from "./web/constants.js";
 export const waitlistListScreen = {
     id: "waitlist-list",
     type: "entityList",

package/dist/waitlist/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure string constants, safe for browser code (see auth-email-password/constants.ts).
 export const WAITLIST_FEATURE = "waitlist";
 export const WAITLIST_STATUS = {

package/kumiko-es-tables.json

@@ -0,0 +1,102 @@
+[
+  {
+    "module": "auth-mfa/schema/user-mfa",
+    "export": "userMfaTable"
+  },
+  {
+    "module": "billing-foundation/projection",
+    "export": "paymentsProjectionTable"
+  },
+  {
+    "module": "billing-foundation/projection",
+    "export": "subscriptionsProjectionTable"
+  },
+  {
+    "module": "compliance-profiles/schema/profile-selection",
+    "export": "tenantComplianceProfileTable"
+  },
+  {
+    "module": "config/table",
+    "export": "configValuesTable"
+  },
+  {
+    "module": "data-retention/schema/tenant-retention-override",
+    "export": "tenantRetentionOverrideTable"
+  },
+  {
+    "module": "delivery/tables",
+    "export": "deliveryAttemptsTable"
+  },
+  {
+    "module": "delivery/tables",
+    "export": "notificationAddressOptOutsTable"
+  },
+  {
+    "module": "delivery/tables",
+    "export": "notificationPreferencesTable"
+  },
+  {
+    "module": "document-ingest-foundation/entity",
+    "export": "documentExtractsTable"
+  },
+  {
+    "module": "inbound-mail-foundation/projection",
+    "export": "inboundMessagesProjectionTable"
+  },
+  {
+    "module": "inbound-mail-foundation/projection",
+    "export": "mailAccountsProjectionTable"
+  },
+  {
+    "module": "inbound-mail-foundation/projection",
+    "export": "mailThreadsProjectionTable"
+  },
+  {
+    "module": "managed-pages/table",
+    "export": "pagesTable"
+  },
+  {
+    "module": "secrets/table",
+    "export": "tenantSecretsTable"
+  },
+  {
+    "module": "template-resolver/table",
+    "export": "templateResourcesTable"
+  },
+  {
+    "module": "template-resolver/user-content-table",
+    "export": "userContentEntriesTable"
+  },
+  {
+    "module": "tenant/invitation-table",
+    "export": "tenantInvitationsTable"
+  },
+  {
+    "module": "tenant/membership-table",
+    "export": "tenantMembershipsTable"
+  },
+  {
+    "module": "tenant/schema/tenant",
+    "export": "tenantTable"
+  },
+  {
+    "module": "user-data-rights/schema/download-attempt",
+    "export": "downloadAttemptsTable"
+  },
+  {
+    "module": "user-data-rights/schema/download-token",
+    "export": "exportDownloadTokensTable"
+  },
+  {
+    "module": "user-data-rights/schema/export-job",
+    "export": "exportJobsTable"
+  },
+  {
+    "module": "user/schema/user",
+    "export": "userTable"
+  },
+  {
+    "module": "waitlist/entity",
+    "export": "waitlistEntryTable"
+  }
+]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.377.0",
+  "version": "0.379.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -279,8 +279,8 @@
       "default": "./dist/tenant/index.js"
     },
     "./tenant/constants": {
-      "types": "./dist/tenant/constants.d.ts",
-      "default": "./dist/tenant/constants.js"
+      "types": "./dist/tenant/web/constants.d.ts",
+      "default": "./dist/tenant/web/constants.js"
     },
     "./tenant/web": {
       "types": "./dist/tenant/web/index.d.ts",
@@ -335,8 +335,8 @@
       "default": "./dist/auth-email-password/email-templates.js"
     },
     "./auth-email-password/constants": {
-      "types": "./dist/auth-email-password/constants.d.ts",
-      "default": "./dist/auth-email-password/constants.js"
+      "types": "./dist/auth-email-password/web/constants.d.ts",
+      "default": "./dist/auth-email-password/web/constants.js"
     },
     "./auth-email-password/seeding": {
       "types": "./dist/auth-email-password/seeding.d.ts",
@@ -459,8 +459,8 @@
       "default": "./dist/template-resolver/index.js"
     },
     "./template-resolver/document-schema": {
-      "types": "./dist/template-resolver/document-schema.d.ts",
-      "default": "./dist/template-resolver/document-schema.js"
+      "types": "./dist/template-resolver/web/document-schema.d.ts",
+      "default": "./dist/template-resolver/web/document-schema.js"
     },
     "./template-resolver/seeding": {
       "types": "./dist/template-resolver/seeding.d.ts",
@@ -483,8 +483,8 @@
       "default": "./dist/account-security/index.js"
     },
     "./account-security/constants": {
-      "types": "./dist/account-security/constants.d.ts",
-      "default": "./dist/account-security/constants.js"
+      "types": "./dist/account-security/web/constants.d.ts",
+      "default": "./dist/account-security/web/constants.js"
     },
     "./host-routing": {
       "types": "./dist/host-routing/index.d.ts",
@@ -495,8 +495,8 @@
       "default": "./dist/legal-pages/index.js"
     },
     "./legal-pages/constants": {
-      "types": "./dist/legal-pages/constants.d.ts",
-      "default": "./dist/legal-pages/constants.js"
+      "types": "./dist/legal-pages/web/constants.d.ts",
+      "default": "./dist/legal-pages/web/constants.js"
     },
     "./legal-pages/web": {
       "types": "./dist/legal-pages/web/index.d.ts",
@@ -540,9 +540,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.377.0",
-    "@cosmicdrift/kumiko-renderer": "0.377.0",
-    "@cosmicdrift/kumiko-types": "0.377.0",
+    "@cosmicdrift/kumiko-framework": "0.379.0",
+    "@cosmicdrift/kumiko-renderer": "0.379.0",
+    "@cosmicdrift/kumiko-types": "0.379.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -838,8 +838,8 @@
         "default": "./dist/tenant/index.js"
       },
       "./tenant/constants": {
-        "types": "./dist/tenant/constants.d.ts",
-        "default": "./dist/tenant/constants.js"
+        "types": "./dist/tenant/web/constants.d.ts",
+        "default": "./dist/tenant/web/constants.js"
       },
       "./tenant/web": {
         "types": "./dist/tenant/web/index.d.ts",
@@ -894,8 +894,8 @@
         "default": "./dist/auth-email-password/email-templates.js"
       },
       "./auth-email-password/constants": {
-        "types": "./dist/auth-email-password/constants.d.ts",
-        "default": "./dist/auth-email-password/constants.js"
+        "types": "./dist/auth-email-password/web/constants.d.ts",
+        "default": "./dist/auth-email-password/web/constants.js"
       },
       "./auth-email-password/seeding": {
         "types": "./dist/auth-email-password/seeding.d.ts",
@@ -1018,8 +1018,8 @@
         "default": "./dist/template-resolver/index.js"
       },
       "./template-resolver/document-schema": {
-        "types": "./dist/template-resolver/document-schema.d.ts",
-        "default": "./dist/template-resolver/document-schema.js"
+        "types": "./dist/template-resolver/web/document-schema.d.ts",
+        "default": "./dist/template-resolver/web/document-schema.js"
       },
       "./template-resolver/seeding": {
         "types": "./dist/template-resolver/seeding.d.ts",
@@ -1042,8 +1042,8 @@
         "default": "./dist/account-security/index.js"
       },
       "./account-security/constants": {
-        "types": "./dist/account-security/constants.d.ts",
-        "default": "./dist/account-security/constants.js"
+        "types": "./dist/account-security/web/constants.d.ts",
+        "default": "./dist/account-security/web/constants.js"
       },
       "./host-routing": {
         "types": "./dist/host-routing/index.d.ts",
@@ -1054,8 +1054,8 @@
         "default": "./dist/legal-pages/index.js"
       },
       "./legal-pages/constants": {
-        "types": "./dist/legal-pages/constants.d.ts",
-        "default": "./dist/legal-pages/constants.js"
+        "types": "./dist/legal-pages/web/constants.d.ts",
+        "default": "./dist/legal-pages/web/constants.js"
       },
       "./legal-pages/web": {
         "types": "./dist/legal-pages/web/index.d.ts",
@@ -1101,21 +1101,22 @@
   },
   "files": [
     "dist",
+    "kumiko-es-tables.json",
     "src/*/changes.json",
     "README.md",
     "LICENSE"
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.377.0",
-    "@cosmicdrift/kumiko-locale-es": "0.377.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.377.0",
+    "@cosmicdrift/kumiko-locale-de": "0.379.0",
+    "@cosmicdrift/kumiko-locale-es": "0.379.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.379.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.377.0"
+    "@cosmicdrift/kumiko-testing": "0.379.0"
   },
   "peerDependencies": {
-    "@cosmicdrift/kumiko-testing": ">=0.366.0 <1.0.0"
+    "@cosmicdrift/kumiko-testing": "0.379.0"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-testing": {

package/src/audit/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "SystemAdmin audit log across all tenants",
+    "detail": "New queries audit:query:list-all-tenants and audit:query:details-all-tenants (SystemAdmin only) return the audit trail of every tenant, each row with its tenantId, filterable by tenant. Screens audit-log-all-tenants and audit-log-all-tenants-detail show the tenant name; the admin-shell platform workspace lists the new nav audit:nav:audit-log-all-tenants. Events of the system tenant are not included. The audit feature now declares r.systemScope(), so its handlers read through ctx.systemDb instead of ctx.db, and list and details rows carry tenantId too. A targetless cross-tenant read (acknowledgeCrossTenant or cross-tenant-read) is now recorded at most once per actor, handler, tenant and reason per hour, so the reference lookups of a SystemAdmin list no longer flood the trail on every page load; all other escape-hatch kinds keep the 60 s window. The audit events keep metadata free of PII ciphertext, a cursor or id beyond bigint is a 422 and the all-tenants tenant filter takes at most 100 ids. Applies to every user:user reference column and read-only reference field in all apps, not only the audit screens: an actor without a visible row no longer shows the raw id but reads \"Unknown\" (kumiko.reference.unknown-user), once the lookup finished without error (while it loads or after it failed the cell keeps a placeholder), and the \"system\" createdBy literal reads \"System\". The audit screen descriptions are now short user-facing sentences.",
+    "migration": "Apps with their own platform workspace add the nav `audit:nav:audit-log-all-tenants` (screen `audit:screen:audit-log-all-tenants`) to its navs; apps using the admin-shell platform workspace get it automatically."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "Unknown e-mail addresses count towards the login lockout",
+    "detail": "Failed logins for unknown or deleted addresses are counted under a keyed digest of the normalized address (ctx.rateLimitDigest, derived from the JWT secret), so after the threshold they answer account_locked like a registered address and the lock no longer reveals which addresses exist. Without a digest key the old invalid_credentials answer stays."
+  },
   {
     "version": "0.374.0",
     "type": "improvement",