@cosmicdrift/kumiko-bundled-features 0.378.0 → 0.379.0

package/dist/personal-access-tokens/resolver.d.ts

@@ -1,6 +1,6 @@
 import type { TokenVerifier } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { type PatScopeConfig } from "./scopes.ts";
+import { type PatScopeConfig } from "./web/scopes.ts";
 export declare function createPatResolver(opts: {
     readonly db: DbConnection;
     readonly scopes: PatScopeConfig;

package/dist/personal-access-tokens/resolver.js

@@ -3,7 +3,7 @@ import { isExpiredAt } from "./expiry.js";
 import { hashPatToken } from "./hash.js";
 import { resolvePatRoles } from "./roles.js";
 import { apiTokenTable } from "./schema/api-token.js";
-import { expandScopes } from "./scopes.js";
+import { expandScopes } from "./web/scopes.js";
 // Hot-path resolver — raw-DB like session-callbacks (a dispatcher roundtrip on
 // every request buys nothing here). Hash the bearer token, point-read the row,
 // reject revoked/expired, resolve LIVE roles, expand granted scopes into

package/dist/personal-access-tokens/schema/api-token.js

@@ -1,6 +1,6 @@
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { access, createEntity, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
-import { API_TOKEN_ENTITY_NAME } from "../constants.js";
+import { API_TOKEN_ENTITY_NAME } from "../web/constants.js";
 // One row per Personal Access Token. Like store_user_sessions this is a
 // direct-write store (r.unmanagedTable): the create/revoke handlers write it and
 // the resolver point-reads it on the hot auth path. `tokenHash` is the SHA-256

package/dist/personal-access-tokens/screens.d.ts

@@ -1,5 +1,5 @@
 import { type ProjectionListScreenDefinition, type SecretMintScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import type { PatScopeConfig } from "./scopes.ts";
+import type { PatScopeConfig } from "./web/scopes.ts";
 export declare const patListScreen: ProjectionListScreenDefinition;
 export declare function patGrantOptions(scopes: PatScopeConfig): string[];
 export declare function createPatMintScreen(scopes: PatScopeConfig): SecretMintScreenDefinition;

package/dist/personal-access-tokens/screens.js

@@ -1,7 +1,7 @@
 import { i18nKey, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
 import { fieldOptionLabelKeyPrefix } from "@cosmicdrift/kumiko-renderer/headless";
-import { PAT_FEATURE, PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries, } from "./constants.js";
+import { PAT_FEATURE, PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries, } from "./web/constants.js";
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
 // Same keys the mint form's `scopes` multiSelect options resolve through
 // (see patScopeOptionTranslations), so list and form show identical labels.

package/dist/personal-access-tokens/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure constants — client-marked so the web screen (web/) may import screen-id
 // and QN names without pulling the feature's server runtime barrel.
 export const PAT_FEATURE = "personal-access-tokens";

package/dist/presets/index.d.ts

@@ -1,2 +1 @@
-export { type DsgvoSelfServiceOptions, dsgvoSelfServiceFeatures } from "./dsgvo-self-service.ts";
 export { type SecurityBaselineOptions, securityBaselineFeatures } from "./security-baseline.ts";

package/dist/presets/index.js

@@ -1,2 +1 @@
-export { dsgvoSelfServiceFeatures } from "./dsgvo-self-service.js";
 export { securityBaselineFeatures } from "./security-baseline.js";

package/dist/presets/security-baseline.d.ts

@@ -2,6 +2,6 @@ import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export type SecurityBaselineOptions = {
     readonly includeSessions?: boolean;
 };
-/** @deprecated Removed in the next release. Use `composeSecurityStack({ includeSessions })`
+/** @deprecated Removed in 0.390.0. Use `composeSecurityStack({ includeSessions })`
  *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export declare function securityBaselineFeatures(opts?: SecurityBaselineOptions): FeatureDefinition[];

package/dist/presets/security-baseline.js

@@ -3,7 +3,7 @@ import { createCryptoShreddingFeature } from "../crypto-shredding/index.js";
 import { createRateLimitingFeature } from "../rate-limiting/index.js";
 import { createSessionsFeature } from "../sessions/index.js";
 // Host app must mount user, tenant, auth-foundation (sessions/audit requires).
-/** @deprecated Removed in the next release. Use `composeSecurityStack({ includeSessions })`
+/** @deprecated Removed in 0.390.0. Use `composeSecurityStack({ includeSessions })`
  *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export function securityBaselineFeatures(opts = {}) {
     return [

package/dist/secrets/feature.js

@@ -3,7 +3,6 @@ import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
-import { DEFAULT_SECRETS_ACCESS } from "./constants.js";
 import { createDeleteHandler } from "./handlers/delete.write.js";
 import { createListHandler } from "./handlers/list.query.js";
 import { rotateJob } from "./handlers/rotate.job.js";
@@ -11,6 +10,7 @@ import { createSetHandler } from "./handlers/set.write.js";
 import { SECRETS_I18N } from "./i18n.js";
 import { secretReadSchema } from "./secrets-context.js";
 import { tenantSecretEntity, tenantSecretsTable } from "./table.js";
+import { DEFAULT_SECRETS_ACCESS } from "./web/constants.js";
 const ROTATE_ESCAPE_HATCH_REASON = "re-encrypts every tenant's secrets with the new master key";
 /**
  * Env-vars contract for the `secrets` feature. Apps merge this via

package/dist/secrets/handlers/delete.write.js

@@ -2,8 +2,8 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
-import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.js";
 import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../web/constants.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
 export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({

package/dist/secrets/handlers/list.query.js

@@ -1,7 +1,7 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { tenantSecretsTable } from "../table.js";
+import { DEFAULT_SECRETS_ACCESS } from "../web/constants.js";
 // Lists all secrets for the current tenant. Returns redactedPreview, never
 // the plaintext. Decryption would be pointless here anyway — this is the
 // TenantAdmin UI, not feature code that needs the value.

package/dist/secrets/handlers/set.write.js

@@ -1,8 +1,8 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
-import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.js";
 import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../web/constants.js";
 import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({

package/dist/secrets/i18n.js

@@ -1,4 +1,4 @@
-import { SECRETS_ERROR_KEYS } from "./constants.js";
+import { SECRETS_ERROR_KEYS } from "./web/constants.js";
 export const SECRETS_I18N = {
     [SECRETS_ERROR_KEYS.unknownKey]: {
         en: "Unknown secret key.",

package/dist/secrets/index.d.ts

@@ -1,7 +1,7 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, SecretsHandlers, SecretsQueries, } from "./constants.ts";
 export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.ts";
 export { createDeleteHandler } from "./handlers/delete.write.ts";
 export { createListHandler } from "./handlers/list.query.ts";
 export { type RotateJobPayload, type RotateJobResult, rotateJob, } from "./handlers/rotate.job.ts";
 export { createSetHandler } from "./handlers/set.write.ts";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, SecretsHandlers, SecretsQueries, } from "./web/constants.ts";
 export { isInvalidSecretValueError } from "./write-gate.ts";

package/dist/secrets/index.js

@@ -1,7 +1,7 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, SecretsHandlers, SecretsQueries, } from "./constants.js";
 export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
 export { createDeleteHandler } from "./handlers/delete.write.js";
 export { createListHandler } from "./handlers/list.query.js";
 export { rotateJob, } from "./handlers/rotate.job.js";
 export { createSetHandler } from "./handlers/set.write.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, SecretsHandlers, SecretsQueries, } from "./web/constants.js";
 export { isInvalidSecretValueError } from "./write-gate.js";

package/dist/secrets/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // secrets bundle constants — default RBAC for set/delete/list (#2296).
 // Default-RBAC of the set/delete/list handlers, hard-wired to ["TenantAdmin"]
 // before #2296. Apps with their own role vocabulary override via

package/dist/secrets/write-gate.js

@@ -1,5 +1,5 @@
 import { AccessDeniedError, isKumikoError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
-import { INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS } from "./constants.js";
+import { INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS } from "./web/constants.js";
 function unknownKeyFailure(key) {
     return {
         ok: false,

package/dist/sessions/feature.js

@@ -9,11 +9,11 @@ import { mineQuery } from "./handlers/mine.query.js";
 import { revokeWrite } from "./handlers/revoke.write.js";
 import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write.js";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write.js";
-import { SESSIONS_I18N } from "./i18n.js";
 import { userSessionEntity } from "./schema/user-session.js";
 import { createSessionDetailScreen, createSessionListScreen, sessionMineScreen, } from "./screens.js";
 import { createSessionCallbacks, } from "./session-callbacks.js";
 import { SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema } from "./session-revoked-event.js";
+import { SESSIONS_I18N } from "./web/i18n.js";
 const CLEANUP_ESCAPE_HATCH_REASON = "deletes expired session rows of every tenant";
 // Reads the late-bind setter off a mounted sessions feature's exports.
 // run{Prod,Dev}App call it once the DB connection is concrete — the feature
@@ -143,11 +143,15 @@ export function createSessionsFeature(options) {
         // sessionChecker blocks a status-locked principal on its next request
         // regardless.
         const REVOKE_TRIGGERING_FIELDS = ["passwordHash"];
-        let autoRevoke = options?.autoRevokeOnPasswordChange;
+        // Explicit option wins; the runtime binding is replaceable so a second boot of the same
+        // feature instance (a new app or test stack in one process) binds its own database.
+        const explicitAutoRevoke = options?.autoRevokeOnPasswordChange;
+        let boundAutoRevoke;
         r.hook({
             type: "postSave",
             target: { allOf: "user" },
             handler: async (ctx) => {
+                const autoRevoke = explicitAutoRevoke ?? boundAutoRevoke;
                 // skip: nothing bound — stateless-JWT deployments without a runtime
                 // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
                 if (!autoRevoke)
@@ -165,8 +169,7 @@ export function createSessionsFeature(options) {
             },
         });
         const bindAutoRevokeOnPasswordChange = (revoker) => {
-            // explicit constructor option wins over the runtime binding
-            autoRevoke ??= revoker;
+            boundAutoRevoke = revoker;
         };
         r.translations({ keys: SESSIONS_I18N });
         r.screen(createSessionListScreen(adminRoles));

package/dist/sessions/{i18n.js → web/i18n.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // Server + client i18n for the sessions operator screens.
 export const SESSIONS_I18N = {
     "screen:session-list.title": { en: "Sessions" },

package/dist/shared/index.d.ts

@@ -10,7 +10,7 @@ export { isWithinGracePeriod } from "./grace-period.ts";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.ts";
 export { isTenantDb } from "./is-tenant-db.ts";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.ts";
-export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.ts";
+export { mailHeading, mailParagraph, mailParagraphWithLink, mailRepeatedRows, } from "./mail-template-body.ts";
 export { mapWithConcurrency } from "./map-with-concurrency.ts";
 export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.ts";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.ts";

package/dist/shared/index.js

@@ -10,7 +10,7 @@ export { isWithinGracePeriod } from "./grace-period.js";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter } from "./lockout-counter.js";
-export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.js";
+export { mailHeading, mailParagraph, mailParagraphWithLink, mailRepeatedRows, } from "./mail-template-body.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";

package/dist/shared/purge-files-reaching-subject.js

@@ -1,7 +1,7 @@
 import { resolveSubjectForField, SubjectResolutionError, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, parseTenantId, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
-import { FILE_REF_ENTITY_NAME, fileRefEntity, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
+import { FILE_REF_ENTITY_NAME, fileRefEntity, fileRefsTable, listActionFormFileFields, } from "@cosmicdrift/kumiko-framework/files";
 import { collectSingleFileHolders, planFileFields, purgeRowFileRefs, } from "./purge-row-file-refs.js";
 // Callers' error labels read err.code, so audit events name the failure class.
 export class FileSweepError extends Error {
@@ -147,7 +147,7 @@ export async function purgeFilesReachingSubject(args) {
         db,
         registry,
         subject,
-        fileFieldKeys: pendingFieldKeys(fileEntities),
+        fileFieldKeys: pendingFieldKeys(fileEntities, registry),
         fileHolders,
         storageByTenant,
         resolveDeleteBytes,
@@ -158,8 +158,12 @@ export async function purgeFilesReachingSubject(args) {
         throw firstFailure;
 }
 const pendingFieldKey = (entityType, fieldName) => `${entityType}\u0000${fieldName}`;
-function pendingFieldKeys(fileEntities) {
+// A pending upload of an actionForm files field is keyed by the screen QN, like an entity's by its name.
+function pendingFieldKeys(fileEntities, registry) {
     const keys = new Set();
+    for (const { screenQn, fieldName } of listActionFormFileFields(registry)) {
+        keys.add(pendingFieldKey(screenQn, fieldName));
+    }
     for (const { entityName, fileFields } of fileEntities) {
         for (const fieldName of fileFields)
             keys.add(pendingFieldKey(entityName, fieldName));

package/dist/subscription-stripe/feature.js

@@ -34,7 +34,7 @@ import { access, createSystemConfig, defineFeature, } from "@cosmicdrift/kumiko-
 import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
 import { STRIPE_API_KEY_CONFIG, STRIPE_BILLING_LIVE_CONFIG, STRIPE_PROVIDER_NAME, STRIPE_WEBHOOK_SECRET_CONFIG, SUBSCRIPTION_STRIPE_FEATURE, } from "./constants.js";
-import { createStripeCancelSubscription, createStripeCheckoutSession, createStripePlanSwitchSession, createStripePortalSession, createStripePriceCache, createStripeRetrievePrices, createStripeRetrieveSubscription, } from "./plugin-methods.js";
+import { createStripeCancelSubscription, createStripeCheckoutSession, createStripePlanSwitchSession, createStripePortalSession, createStripePriceCache, createStripeResumeSubscription, createStripeRetrievePrices, createStripeRetrieveSubscription, } from "./plugin-methods.js";
 import { createStripeRuntimes } from "./runtime.js";
 import { verifyAndParseStripeWebhook } from "./verify-webhook.js";
 /**
@@ -181,6 +181,7 @@ export function createSubscriptionStripeFeature(options = {}) {
             }),
             createPortalSession: createStripePortalSession(runtimes.ctx),
             cancelSubscription: createStripeCancelSubscription(runtimes.ctx),
+            resumeSubscription: createStripeResumeSubscription(runtimes.ctx),
             priceToTier: options.priceToTier ?? {},
             oneOffPriceIds: options.oneOffPriceIds ?? [],
             isBillingEnabled: runtimes.ctx.isBillingEnabled,

package/dist/subscription-stripe/plugin-methods.d.ts

@@ -16,6 +16,9 @@ export type StripePortalOptions = Parameters<NonNullable<SubscriptionProviderPlu
 export declare function createStripePortalSession(runtime: StripeCtxRuntime): (ctx: HandlerContext, options: StripePortalOptions) => Promise<{
     url: string;
 }>;
+export declare function createStripeResumeSubscription(runtime: StripeCtxRuntime): (ctx: HandlerContext, options: {
+    readonly providerSubscriptionId: string;
+}) => Promise<void>;
 export type StripeCancelOptions = Parameters<NonNullable<SubscriptionProviderPlugin["cancelSubscription"]>>[1];
 export declare function createStripeCancelSubscription(runtime: StripeCtxRuntime): (ctx: HandlerContext, options: StripeCancelOptions) => Promise<void>;
 export type StripeRetrieveSubscriptionOptions = {

package/dist/subscription-stripe/plugin-methods.js

@@ -164,6 +164,20 @@ export function createStripePortalSession(runtime) {
         }
     };
 }
+// =============================================================================
+// resumeSubscription
+// =============================================================================
+//
+// Takes back a period-end cancel; the following `customer.subscription.updated`
+// carries cancel_at null, which the projection stores as "renews".
+export function createStripeResumeSubscription(runtime) {
+    return async (ctx, options) => {
+        const stripe = await runtime.clientForCtx(ctx);
+        await stripe.subscriptions.update(options.providerSubscriptionId, {
+            cancel_at_period_end: false,
+        });
+    };
+}
 export function createStripeCancelSubscription(runtime) {
     return async (ctx, options) => {
         const stripe = await runtime.clientForCtx(ctx);

package/dist/subscription-stripe/verify-webhook.js

@@ -125,6 +125,7 @@ export function verifyAndParseStripeWebhook(runtime, options) {
             ...(consentId !== undefined && { consentId }),
             providerCustomerId: typeof sub.customer === "string" ? sub.customer : sub.customer.id,
             providerSubscriptionId: sub.id,
+            providerEventAt: Temporal.Instant.fromEpochMilliseconds(event.created * 1000).toString(),
             ...state,
         };
     };

package/dist/tags/feature.js

@@ -19,7 +19,6 @@
 // Deferred: optional host-projection decoration (`wireTagsFor`), search indexing.
 import { defineEntityDetailHandler, defineEntityListHandler, defineEntityUpdateHandler, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
 import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
-import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./constants.js";
 import { createTagAssignmentEntity, tagEntity } from "./entity.js";
 import { createTagAssignmentExecutor } from "./executor.js";
 import { createAssignTagHandler } from "./handlers/assign-tag.write.js";
@@ -29,6 +28,7 @@ import { createRemoveTagHandler } from "./handlers/remove-tag.write.js";
 import { createUpdateTagHandler } from "./handlers/update-tag.write.js";
 import { TAGS_FEATURE_I18N } from "./i18n.js";
 import { createTagEditScreen, createTagListScreen } from "./screens.js";
+import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./web/constants.js";
 function registerTags(r, access, toggleable, ownership, parents) {
     r.describe("Generic, host-agnostic tagging for any entity. Owns two event-sourced entities — the per-tenant `tag` catalog (`read_tags`, with optional `color` and `scope`) and `tag-assignment` join rows keyed by (entityType, entityId) (`read_tag_assignments`) — so tagging adds NO column to the host entity and needs no relational pivot or JOIN. Catalog screens are declarative (`entityList` + `entityEdit`) and use convention QNs `tag:{create,update,delete}`; TagManager/TagPicker keep `create-tag`/`update-tag`/`delete-tag`. Also: `assign-tag` (idempotent), `remove-tag` (idempotent) and list queries for the catalog and the assignments. Read which tags an entity has, or which entities carry a tag, by listing `tag-assignment` filtered on `entityId` or `tagId` and composing in the read-layer. A tag with empty `scope` is global; a `scope` of an entityType restricts it to that type in the picker. Every path uses one access rule — adopt the host's model with createTagsFeature({ access: { openToAll: { reason } } }) or pin roles with createTagsFeature({ roles }). Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).");
     r.uiHints({

package/dist/tags/handlers/assign-tag.write.js

@@ -2,9 +2,9 @@ import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/error
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { tagAssignmentAggregateId } from "../aggregate-id.js";
-import { DEFAULT_TAG_ACCESS } from "../constants.js";
 import { tagAssignmentExecutor, tagExecutor } from "../executor.js";
 import { assignTagPayloadSchema } from "../schemas.js";
+import { DEFAULT_TAG_ACCESS, TAG_LOCK_NAMESPACE } from "../web/constants.js";
 // assign-tag — links a tag to a host entity by (entityType, entityId). The
 // assignment id is deterministic, so the row is unique per (tag, entity).
 //
@@ -18,9 +18,9 @@ import { assignTagPayloadSchema } from "../schemas.js";
 // create(), the loser's create() version_conflicts, and the handler treats
 // that as success since the winner already wrote the desired end state.
 //
-// Referential integrity: there is no FK (event-sourced, no JOIN), so before a
-// first-time create we verify the tag exists in the catalog — a malformed call
-// with an unknown tagId would otherwise project a dangling assignment.
+// Referential integrity: there is no FK (event-sourced, no JOIN), so we verify
+// the tag exists in the catalog before any restore/create — otherwise a call
+// racing delete-tag would resurrect or project an assignment for a gone tag.
 //
 // Host reference: entityType/entityId are never trusted client input either —
 // the aggregate-id is tenant-scoped, so this is not a cross-tenant hole, but
@@ -37,6 +37,13 @@ export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS, assignmentEx
             const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db);
             if (denied)
                 return denied;
+            // Same lock as delete-tag: the existence check below and the assignment
+            // write must not interleave with a delete-tag cascade, or the cascade
+            // misses the new assignment and leaves an orphan.
+            await ctx.db.advisoryXactLock(TAG_LOCK_NAMESPACE, payload.tagId);
+            const tag = await tagExecutor.detail({ id: payload.tagId }, event.user, ctx.db);
+            if (!tag)
+                return writeFailure(new NotFoundError("tag", payload.tagId));
             const id = tagAssignmentAggregateId(event.user.tenantId, payload.tagId, payload.entityType, payload.entityId);
             const existing = await assignmentExecutor.detail({ id }, event.user, ctx.db);
             if (existing) {
@@ -56,9 +63,6 @@ export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS, assignmentEx
             }
             if (restored.error.code !== "not_found")
                 return restored;
-            const tag = await tagExecutor.detail({ id: payload.tagId }, event.user, ctx.db);
-            if (!tag)
-                return writeFailure(new NotFoundError("tag", payload.tagId));
             const created = await assignmentExecutor.create({
                 id,
                 tagId: payload.tagId,

package/dist/tags/handlers/create-tag.write.js

@@ -1,6 +1,6 @@
-import { DEFAULT_TAG_ACCESS } from "../constants.js";
 import { tagExecutor } from "../executor.js";
 import { createTagPayloadSchema } from "../schemas.js";
+import { DEFAULT_TAG_ACCESS } from "../web/constants.js";
 // create-tag — adds a tag to the tenant's catalog. The framework mints a fresh
 // UUIDv7 id (no explicit id passed). Tag names are not unique by design: the
 // catalog is a free list and dedup is a UI concern (autocomplete from existing

package/dist/tags/handlers/delete-tag.write.js

@@ -1,6 +1,6 @@
-import { DEFAULT_TAG_ACCESS } from "../constants.js";
 import { tagAssignmentExecutor, tagExecutor } from "../executor.js";
 import { deleteTagPayloadSchema } from "../schemas.js";
+import { DEFAULT_TAG_ACCESS, TAG_LOCK_NAMESPACE } from "../web/constants.js";
 const CASCADE_PAGE = 200;
 // delete-tag — removes a tag from the catalog and detaches it everywhere. No FK
 // (event-sourced, no JOIN), so the handler cascades: soft-delete every
@@ -22,6 +22,9 @@ export function createDeleteTagHandler(access = DEFAULT_TAG_ACCESS, name = "dele
         agent: { risk: "high" },
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
+            // Serialises with assign-tag (see there): the cascade must see every
+            // assignment that a concurrent assign-tag committed before the tag goes.
+            await ctx.db.advisoryXactLock(TAG_LOCK_NAMESPACE, payload.id);
             const existing = await tagExecutor.detail({ id: payload.id }, event.user, ctx.db);
             if (!existing) {
                 return { isSuccess: true, data: { id: payload.id } };

package/dist/tags/handlers/remove-tag.write.js

@@ -1,8 +1,8 @@
 import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { tagAssignmentAggregateId } from "../aggregate-id.js";
-import { DEFAULT_TAG_ACCESS } from "../constants.js";
 import { tagAssignmentExecutor } from "../executor.js";
 import { removeTagPayloadSchema } from "../schemas.js";
+import { DEFAULT_TAG_ACCESS } from "../web/constants.js";
 // remove-tag — unlinks a tag from a host entity. Idempotent: removing an
 // assignment that doesn't exist is already the requested end state (not
 // assigned), so we pre-check and return success without a delete.

package/dist/tags/handlers/update-tag.write.js

@@ -1,6 +1,6 @@
-import { DEFAULT_TAG_ACCESS } from "../constants.js";
 import { tagExecutor } from "../executor.js";
 import { updateTagPayloadSchema } from "../schemas.js";
+import { DEFAULT_TAG_ACCESS } from "../web/constants.js";
 // update-tag — edits a catalog tag (rename / recolor / re-scope). Optimistic-
 // locked: the client sends the `version` it read (mirrors tenant:update). Only
 // the fields present in the payload go into `changes`, and the executor merges

package/dist/tags/index.d.ts

@@ -1,5 +1,4 @@
 export { tagAssignmentAggregateId } from "./aggregate-id.ts";
-export { DEFAULT_TAG_ACCESS, DEFAULT_TAG_ROLES, TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FEATURE_NAME, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "./constants.ts";
 export { tagAssignmentEntity, tagEntity } from "./entity.ts";
 export { createTagsFeature, type TagsFeatureOptions } from "./feature.ts";
 export { assignTagHandler, createAssignTagHandler, } from "./handlers/assign-tag.write.ts";
@@ -9,3 +8,4 @@ export { createRemoveTagHandler, removeTagHandler, } from "./handlers/remove-tag
 export { createUpdateTagHandler, updateTagHandler, } from "./handlers/update-tag.write.ts";
 export { type AssignTagPayload, assignTagPayloadSchema, type CreateTagPayload, createTagPayloadSchema, type DeleteTagPayload, deleteTagPayloadSchema, type RemoveTagPayload, removeTagPayloadSchema, type UpdateTagPayload, updateTagPayloadSchema, } from "./schemas.ts";
 export { createTagEditScreen, createTagListScreen } from "./screens.ts";
+export { DEFAULT_TAG_ACCESS, DEFAULT_TAG_ROLES, TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FEATURE_NAME, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "./web/constants.ts";

package/dist/tags/index.js

@@ -1,5 +1,4 @@
 export { tagAssignmentAggregateId } from "./aggregate-id.js";
-export { DEFAULT_TAG_ACCESS, DEFAULT_TAG_ROLES, TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FEATURE_NAME, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "./constants.js";
 export { tagAssignmentEntity, tagEntity } from "./entity.js";
 export { createTagsFeature } from "./feature.js";
 export { assignTagHandler, createAssignTagHandler, } from "./handlers/assign-tag.write.js";
@@ -9,3 +8,4 @@ export { createRemoveTagHandler, removeTagHandler, } from "./handlers/remove-tag
 export { createUpdateTagHandler, updateTagHandler, } from "./handlers/update-tag.write.js";
 export { assignTagPayloadSchema, createTagPayloadSchema, deleteTagPayloadSchema, removeTagPayloadSchema, updateTagPayloadSchema, } from "./schemas.js";
 export { createTagEditScreen, createTagListScreen } from "./screens.js";
+export { DEFAULT_TAG_ACCESS, DEFAULT_TAG_ROLES, TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FEATURE_NAME, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "./web/constants.js";

package/dist/tags/screens.js

@@ -1,5 +1,5 @@
 import { i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_TAG_ACCESS, TAGS_EDIT_SCREEN_ID, TAGS_SCREEN_ID } from "./constants.js";
+import { DEFAULT_TAG_ACCESS, TAGS_EDIT_SCREEN_ID, TAGS_SCREEN_ID } from "./web/constants.js";
 // Declarative catalog screens (Phase-3 / #2312). Access matches create/update/
 // delete so createTagsFeature({ access|roles }) stays consistent. TagManager
 // remains for TagPicker/TagSection — only the standalone admin screen moved.

package/dist/tags/web/client-plugin.js

@@ -1,5 +1,4 @@
-// @runtime client
-import { TAGS_COLUMN_RENDERER_NAME, TAGS_FEATURE_NAME, TAGS_FILTER_EXTENSION_NAME, TAGS_SECTION_EXTENSION_NAME, } from "../constants.js";
+import { TAGS_COLUMN_RENDERER_NAME, TAGS_FEATURE_NAME, TAGS_FILTER_EXTENSION_NAME, TAGS_SECTION_EXTENSION_NAME, } from "./constants.js";
 import { defaultTranslations } from "./i18n.js";
 import { TagFilter } from "./tag-filter.js";
 import { TagSection } from "./tag-section.js";

package/dist/tags/{constants.d.ts → web/constants.d.ts}

@@ -18,3 +18,4 @@ export declare const TagsQueries: {
 };
 export declare const DEFAULT_TAG_ROLES: readonly ["TenantAdmin", "TenantMember"];
 export declare const DEFAULT_TAG_ACCESS: AccessRule;
+export declare const TAG_LOCK_NAMESPACE = 1952540531;

package/dist/tags/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // tags bundle constants — feature-name + qualified handler/query names.
 //
 // Spec: kumiko-platform/docs/plans/features/tags.md
@@ -48,3 +47,6 @@ export const DEFAULT_TAG_ROLES = ["TenantAdmin", "TenantMember"];
 // makes tagging reachable for any authenticated tenant user — matching apps
 // whose other handlers are openToAll rather than role-gated.
 export const DEFAULT_TAG_ACCESS = { roles: DEFAULT_TAG_ROLES };
+// Advisory-lock namespace serialising assign-tag against delete-tag per tag id
+// (no FK in the event-sourced catalog, so the DB cannot guard the orphan race).
+export const TAG_LOCK_NAMESPACE = 0x74_61_67_73; // 'tags'

package/dist/tags/web/entity-tags.js

@@ -1,11 +1,10 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// @runtime client
 // EntityTags — read-only colored tag row for ANY entity. Drop it on a card or
 // detail view: <EntityTags entityName="note" entityId={id} />. Loads the
 // catalog (for name+color) and the entity's assignments, renders a TagChip per
 // assigned tag. Renders nothing when the entity has no tags.
 import { useQuery } from "@cosmicdrift/kumiko-renderer";
-import { TagsQueries } from "../constants.js";
+import { TagsQueries } from "./constants.js";
 import { TagChip } from "./tag-chip.js";
 export function EntityTags({ entityName, entityId, }) {
     const enabled = entityId !== null;

package/dist/tags/web/i18n.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Default translation bundle for the tags UI. tagsClient() hangs it into the
 // LocaleProvider as a fallback bundle — apps override individual keys via
 // tagsClient({ translations }). Keys follow `tags.<area>.<slug>`.
@@ -22,7 +21,8 @@ export const defaultTranslations = {
         "tags.manage.toggle": "Toggle label",
         "tags.manage.usage": "{count}×",
         "tags.manage.deleteConfirmTitle": "Delete label “{name}”?",
-        "tags.manage.deleteConfirmDesc": "Removes it from {count} objects. This can't be undone.",
+        "tags.manage.deleteConfirmDesc.one": "Removes it from 1 object. This can't be undone.",
+        "tags.manage.deleteConfirmDesc.other": "Removes it from {count} objects. This can't be undone.",
         "tags.picker.title": "Tags",
         "tags.picker.done": "Done",
         "tags.filter.label": "Filter by tag",

package/dist/tags/web/index.d.ts

@@ -1,5 +1,5 @@
-export { TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "../constants.ts";
 export { tagsClient } from "./client-plugin.tsx";
+export { TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "./constants.ts";
 export { EntityTags } from "./entity-tags.tsx";
 export { contrastText, TagChip } from "./tag-chip.tsx";
 export { TagFilter } from "./tag-filter.tsx";

package/dist/tags/web/index.js

@@ -1,6 +1,5 @@
-// @runtime client
-export { TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "../constants.js";
 export { tagsClient } from "./client-plugin.js";
+export { TAGS_COLUMN_RENDERER_NAME, TAGS_EDIT_SCREEN_ID, TAGS_FILTER_EXTENSION_NAME, TAGS_SCREEN_ID, TAGS_SECTION_EXTENSION_NAME, TagsHandlers, TagsQueries, } from "./constants.js";
 export { EntityTags } from "./entity-tags.js";
 export { contrastText, TagChip } from "./tag-chip.js";
 export { TagFilter } from "./tag-filter.js";

package/dist/tags/web/tag-filter.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // TagFilter — a drop-in tag filter for ANY entityList toolbar. Register it as
 // the list's header slot (`screen.slots.header`); the renderer passes it the
 // list's screenId, and picking tags resolves the matching row ids and narrows
@@ -15,7 +14,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // server-side `entitiesByTag` query + a server-side join filter instead.
 import { useListUrlState, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
-import { TagsQueries } from "../constants.js";
+import { TagsQueries } from "./constants.js";
 import { TagChip } from "./tag-chip.js";
 import { TagPicker } from "./tag-picker.js";
 // Tags chosen but zero matching entities → filter to a value that matches no row