@cosmicdrift/kumiko-bundled-features 0.378.0 → 0.379.0

package/dist/delivery/unsubscribe-page.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { mailT } from "@cosmicdrift/kumiko-framework/i18n";
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
-import { DELIVERY_RESUBSCRIBE_PATH, DELIVERY_UNSUBSCRIBE_PATH } from "./public-names.js";
+import { DELIVERY_RESUBSCRIBE_PATH, DELIVERY_UNSUBSCRIBE_PATH } from "./web/public-names.js";
 import "./unsubscribe-page-strings.js";
 // Same values as the in-code mail layout of renderer-mail-html, so the page reads as the mail's sequel.
 const DEFAULT_ACCENT_COLOR = "#1f5468";

package/dist/delivery/web/client-plugin.js

@@ -1,9 +1,9 @@
-import { DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, } from "../public-names.js";
 import { DeliveryChannelCell } from "./delivery-channel-cell.js";
 import { DeliveryErrorCell } from "./delivery-error-cell.js";
 import { DeliveryStatusCell } from "./delivery-status-cell.js";
 import { DeliveryTimeCell } from "./delivery-time-cell.js";
 import { DeliveryTypeCell } from "./delivery-type-cell.js";
+import { DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, } from "./public-names.js";
 export function deliveryClient(options) {
     return {
         name: DELIVERY_FEATURE,

package/dist/delivery/web/delivery-channel-cell.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Channel column: the label comes from `delivery.channel.<name>`, registered by each
 // channel feature; unknown channels show their raw name.
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";

package/dist/delivery/web/delivery-error-cell.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Error column. The log only carries fixed codes (`DeliveryErrorCode`); `http_<status>`
 // takes the status as a parameter, anything unknown shows as the raw value.
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";

package/dist/delivery/web/delivery-status-cell.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// @runtime client
 // Column-renderer for the delivery-log screen's status column, registered
 // via `deliveryClient()`'s `columnRenderers` map (screen.columns[].renderer
 // in feature.ts). The list frame itself is the generic declarative
@@ -7,7 +6,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { StatusBadge } from "@cosmicdrift/kumiko-renderer/web";
 import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
-import { DeliveryStatus } from "../public-names.js";
+import { DeliveryStatus } from "./public-names.js";
 const STATUS_TONE = {
     [DeliveryStatus.sent]: "ok",
     [DeliveryStatus.failed]: "bad",

package/dist/delivery/web/delivery-time-cell.js

@@ -1,4 +1,3 @@
-// @runtime client
 import { formatWhen } from "@cosmicdrift/kumiko-renderer";
 export function DeliveryTimeCell({ row }) {
     const createdAt = row["createdAt"];

package/dist/delivery/web/delivery-type-cell.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Notification type column. Types are QNs like `<scope>:notify:<name>`; the
 // translation key is `<scope>.notification.<name>`, registered by the app that
 // owns the notification (bundled features register none). Falls back to the short

package/dist/delivery/web/index.js

@@ -1,3 +1,2 @@
-// @runtime client
 export { deliveryClient } from "./client-plugin.js";
 export { DeliveryStatusCell } from "./delivery-status-cell.js";

package/dist/delivery/{public-names.js → web/public-names.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // String-only delivery QNs and screen ids — safe for client bundles.
 export const DELIVERY_FEATURE = "delivery";
 export const DeliveryHandlers = {

package/dist/document-ingest-foundation/events.d.ts

@@ -1,5 +1,6 @@
 import * as z from "zod";
 export declare const DOCUMENT_INGEST_AGGREGATE_TYPE = "document-ingest";
+export declare const DOCUMENT_EXTRACT_AGGREGATE_TYPE = "document-extract";
 export declare const DOCUMENT_INGEST_REQUESTED_EVENT_SHORT: "documentIngest.requested";
 export declare const DOCUMENT_INGEST_REQUESTED_EVENT_QN: "document-ingest-foundation:event:document-ingest-requested";
 export declare const documentIngestRequestedPayloadSchema: z.ZodObject<{

package/dist/document-ingest-foundation/events.js

@@ -6,6 +6,9 @@ import * as z from "zod";
 // this is a pure saga-anchor event (kumiko-framework#1497) that the Phase-2
 // worker job (kumiko-enterprise LiteParse provider) subscribes to.
 export const DOCUMENT_INGEST_AGGREGATE_TYPE = "document-ingest";
+// Stream name of stored extract events; differs from the camelCase r.entity name
+// "documentExtract", so the projection replays this stream through an extension.
+export const DOCUMENT_EXTRACT_AGGREGATE_TYPE = "document-extract";
 export const DOCUMENT_INGEST_REQUESTED_EVENT_SHORT = "documentIngest.requested";
 // Qualified name — what ctx.unsafeAppendEvent's `type` actually needs
 // (r.defineEvent registers under qn(toKebab(feature), "event",

package/dist/document-ingest-foundation/executor.js

@@ -3,4 +3,5 @@
 // the entity's own inline projection (tenant-destroy-hook, forget-extract-with-file-ref).
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { documentExtractEntity, documentExtractsTable } from "./entity.js";
-export const documentExtractExecutor = createEventStoreExecutor(documentExtractsTable, documentExtractEntity, { entityName: "document-extract" });
+import { DOCUMENT_EXTRACT_AGGREGATE_TYPE } from "./events.js";
+export const documentExtractExecutor = createEventStoreExecutor(documentExtractsTable, documentExtractEntity, { entityName: DOCUMENT_EXTRACT_AGGREGATE_TYPE });

package/dist/document-ingest-foundation/feature.js

@@ -3,14 +3,14 @@
 // Provider-driven PDF/Scan/Image → normalized-text ingest primitive. No
 // hardcoded mime allowlist or size cap — providers register via
 // EXT_DOCUMENT_INGEST_PROVIDER (see providers.ts).
-import { entityEventName } from "@cosmicdrift/kumiko-framework/db";
+import { applyEntityEvent, entityEventName } from "@cosmicdrift/kumiko-framework/db";
 import { access, createTenantConfig, defineFeature, EXT_TENANT_DATA, } from "@cosmicdrift/kumiko-framework/engine";
 import { normalizeMimeType } from "@cosmicdrift/kumiko-framework/files";
 import * as z from "zod";
 import { documentIngestAggregateId } from "./aggregate-id.js";
 import { validateDocumentIngestProviderWiring } from "./boot-checks.js";
-import { documentExtractEntity } from "./entity.js";
-import { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
+import { documentExtractEntity, documentExtractsTable } from "./entity.js";
+import { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
 import { forgetExtractOnFileRefDeletedHook, forgetExtractOnFileRefForgottenHook, forgetOrphanedDocumentExtractHook, } from "./forget-extract-with-file-ref.js";
 import { EXT_DOCUMENT_INGEST_PROVIDER, resolveDocumentIngestProviders, UNCLAIMED_PROVIDER_SENTINEL, } from "./providers.js";
 import { documentExtractTenantDestroyHook } from "./tenant-destroy-hook.js";
@@ -19,9 +19,9 @@ const FILE_REF_CREATED = entityEventName("fileRef", "created");
 const FILE_REF_RESTORED = entityEventName("fileRef", "restored");
 const FILE_REF_DELETED = entityEventName("fileRef", "deleted");
 const FILE_REF_FORGOTTEN = entityEventName("fileRef", "forgotten");
-// Executors write under entityName "document-extract" (executor.ts), not the
+// Executors write under DOCUMENT_EXTRACT_AGGREGATE_TYPE (executor.ts), not the
 // camelCase r.entity() name — the event type follows the executor.
-const DOCUMENT_EXTRACT_CREATED = entityEventName("document-extract", "created");
+const DOCUMENT_EXTRACT_CREATED = entityEventName(DOCUMENT_EXTRACT_AGGREGATE_TYPE, "created");
 // Missing/invalid fields → skip, never cast — a bad size would otherwise
 // pass a provider's maxFileBytes comparison and dead-letter the consumer.
 // Shared by fileRef.created (the entity fields directly) and fileRef.restored
@@ -96,6 +96,17 @@ export function createDocumentIngestFoundationFeature() {
         r.useExtension(EXT_TENANT_DATA, "documentExtract", {
             destroy: documentExtractTenantDestroyHook,
         });
+        // The implicit projection listens for "documentExtract.*"; stored events are
+        // "document-extract.*", so a rebuild would otherwise drop every extract row.
+        r.extendEntityProjection("documentExtract", {
+            sources: [DOCUMENT_EXTRACT_AGGREGATE_TYPE],
+            apply: Object.fromEntries(["created", "updated", "deleted", "forgotten"].map((verb) => [
+                entityEventName(DOCUMENT_EXTRACT_AGGREGATE_TYPE, verb),
+                async (event, tx) => {
+                    await applyEntityEvent(event, documentExtractsTable, documentExtractEntity, tx);
+                },
+            ])),
+        });
         // No onRegister: resolution happens at boot and per-apply, not on register.
         r.extendsRegistrar(EXT_DOCUMENT_INGEST_PROVIDER, {});
         r.bootCheck(({ features }) => validateDocumentIngestProviderWiring(features));

package/dist/document-ingest-foundation/index.d.ts

@@ -1,6 +1,6 @@
 export { documentIngestAggregateId } from "./aggregate-id.ts";
 export { type DocumentExtractMeta, documentExtractEntity, documentExtractsTable, type IngestPage, } from "./entity.ts";
-export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.ts";
+export { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.ts";
 export { createDocumentIngestFoundationFeature } from "./feature.ts";
 export { readIngestPages, writeIngestPages } from "./pages.ts";
 export { type DocumentIngestProviderOptions, documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, type ResolvedDocumentIngestProvider, resolveDocumentIngestProviders, } from "./providers.ts";

package/dist/document-ingest-foundation/index.js

@@ -1,7 +1,7 @@
 // Public API of the document-ingest-foundation bundled-feature.
 export { documentIngestAggregateId } from "./aggregate-id.js";
 export { documentExtractEntity, documentExtractsTable, } from "./entity.js";
-export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
+export { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
 export { createDocumentIngestFoundationFeature } from "./feature.js";
 export { readIngestPages, writeIngestPages } from "./pages.js";
 export { documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, resolveDocumentIngestProviders, } from "./providers.js";

package/dist/feature-toggles/feature.d.ts

@@ -4,7 +4,7 @@ export type FeatureTogglesOptions = {
     readonly getRuntime?: () => GlobalFeatureToggleRuntime;
 };
 export declare function createFeatureTogglesFeature(options?: FeatureTogglesOptions): FeatureDefinition;
-export { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors } from "./constants.ts";
 export { globalFeatureStateTable, globalFeatureStateTableMeta, } from "./global-feature-state-table.ts";
 export { createFeatureToggleRuntime, GlobalFeatureToggleRuntime, type ToggleSyncSignal, } from "./toggle-runtime.ts";
 export { createRedisToggleSyncSignal, type RedisToggleSyncSignal } from "./toggle-sync-signal.ts";
+export { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors } from "./web/constants.ts";

package/dist/feature-toggles/feature.js

@@ -1,11 +1,11 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID, } from "./constants.js";
 import { featureToggleSetSchema } from "./events.js";
 import { globalFeatureStateTableMeta } from "./global-feature-state-table.js";
 import { listQuery } from "./handlers/list.query.js";
 import { registeredQuery } from "./handlers/registered.query.js";
 import { createSetWriteHandler } from "./handlers/set.write.js";
 import { FEATURE_TOGGLES_I18N } from "./i18n.js";
+import { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID, } from "./web/constants.js";
 export function createFeatureTogglesFeature(options = {}) {
     return defineFeature("feature-toggles", (r) => {
         r.describe('Persists per-feature enabled/disabled state in the `store_global_feature_state` table and exposes a `set` write-handler plus `list`/`registered` query-handlers so operators can flip features at runtime without redeploying. Each API instance keeps an in-memory `GlobalFeatureToggleRuntime` snapshot (initialize it via `createFeatureToggleRuntime`, pass a `() => runtime` accessor to `createFeatureTogglesFeature`) that the dispatcher gate reads on every request; a `toggle-cache-sync` multi-stream projection with `delivery: "shared"` syncs the snapshot across instances whenever a `toggle-set` event is appended.');
@@ -109,9 +109,9 @@ export function createFeatureTogglesFeature(options = {}) {
         return { handlers, queries };
     });
 }
-export { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors } from "./constants.js";
 export { globalFeatureStateTable, globalFeatureStateTableMeta, } from "./global-feature-state-table.js";
 // Re-export the runtime factory + class so app-boot code has a single
 // import path: "@cosmicdrift/kumiko-bundled-features/feature-toggles".
 export { createFeatureToggleRuntime, GlobalFeatureToggleRuntime, } from "./toggle-runtime.js";
 export { createRedisToggleSyncSignal } from "./toggle-sync-signal.js";
+export { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors } from "./web/constants.js";

package/dist/feature-toggles/handlers/list.query.js

@@ -1,7 +1,7 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../constants.js";
 import { globalFeatureStateTable } from "../global-feature-state-table.js";
+import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../web/constants.js";
 // List every row in the global_feature_state table — i.e. every feature
 // that has ever been explicitly flipped. Features without a row aren't
 // returned; callers must combine this with `registered` to see the full

package/dist/feature-toggles/handlers/registered.query.js

@@ -1,7 +1,7 @@
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../constants.js";
 import { globalFeatureStateTable } from "../global-feature-state-table.js";
+import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../web/constants.js";
 // Inventory of every registered feature, annotated with toggle metadata
 // and the current effective state. This is the canonical "what's here,
 // what's on, what depends on what" snapshot — the UI for the operator

package/dist/feature-toggles/handlers/set.write.js

@@ -3,8 +3,8 @@ import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framew
 import { UnprocessableError, VersionConflictError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { FEATURE_TOGGLE_AGGREGATE_TYPE, FEATURE_TOGGLE_CROSS_TENANT_REASON, FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors, } from "../constants.js";
 import { globalFeatureStateTable } from "../global-feature-state-table.js";
+import { FEATURE_TOGGLE_AGGREGATE_TYPE, FEATURE_TOGGLE_CROSS_TENANT_REASON, FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors, } from "../web/constants.js";
 // Factory: binds a runtime accessor to the handler at registration time.
 // The runtime holds the in-memory snapshot that the dispatcher's gate
 // reads; every successful set() call must update it, otherwise the flip

package/dist/feature-toggles/index.d.ts

@@ -1,3 +1,3 @@
 export { composeTierResolverWithGlobalToggles } from "./compose-tier-resolver.ts";
-export { FEATURE_TOGGLES_FEATURE, FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID, } from "./constants.ts";
 export { createFeatureToggleRuntime, createFeatureTogglesFeature, createRedisToggleSyncSignal, FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors, type FeatureTogglesOptions, GlobalFeatureToggleRuntime, globalFeatureStateTable, globalFeatureStateTableMeta, type RedisToggleSyncSignal, type ToggleSyncSignal, } from "./feature.ts";
+export { FEATURE_TOGGLES_FEATURE, FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID, } from "./web/constants.ts";

package/dist/feature-toggles/index.js

@@ -1,3 +1,3 @@
 export { composeTierResolverWithGlobalToggles } from "./compose-tier-resolver.js";
-export { FEATURE_TOGGLES_FEATURE, FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID, } from "./constants.js";
 export { createFeatureToggleRuntime, createFeatureTogglesFeature, createRedisToggleSyncSignal, FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors, GlobalFeatureToggleRuntime, globalFeatureStateTable, globalFeatureStateTableMeta, } from "./feature.js";
+export { FEATURE_TOGGLES_FEATURE, FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID, } from "./web/constants.js";

package/dist/feature-toggles/web/client-plugin.js

@@ -1,6 +1,5 @@
-// @runtime client
 import { mergeTranslations } from "@cosmicdrift/kumiko-renderer";
-import { FEATURE_TOGGLES_FEATURE } from "../constants.js";
+import { FEATURE_TOGGLES_FEATURE } from "./constants.js";
 import { defaultTranslations } from "./i18n.js";
 export function featureTogglesClient(options) {
     return {

package/dist/feature-toggles/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 export const FEATURE_TOGGLES_FEATURE = "feature-toggles";
 // Fully-qualified event name for feature-toggle changes. Kept as a constant
 // so write-handler + tests reference one source.

package/dist/feature-toggles/web/index.js

@@ -1,2 +1 @@
-// @runtime client
 export { featureTogglesClient, } from "./client-plugin.js";

package/dist/folders/feature.js

@@ -16,11 +16,11 @@
 // no UI exposes it in v1 — folders-view guards cycles defensively).
 import { defineEntityCreateHandler, defineEntityDetailHandler, defineEntityListHandler, defineEntityUpdateHandler, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
 import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
-import { DEFAULT_FOLDER_ACCESS, FOLDERS_FEATURE_NAME } from "./constants.js";
 import { createFolderAssignmentEntity, folderEntity } from "./entity.js";
 import { createClearFolderHandler } from "./handlers/clear-folder.write.js";
 import { createDeleteFolderHandler } from "./handlers/delete-folder.write.js";
 import { createSetFolderHandler } from "./handlers/set-folder.write.js";
+import { DEFAULT_FOLDER_ACCESS, FOLDERS_FEATURE_NAME } from "./web/constants.js";
 function registerFolders(r, access, toggleable, ownership, parents) {
     r.describe("Generic, host-agnostic hierarchical folders for any entity. Owns two event-sourced entities — the per-tenant `folder` tree (`read_folders`, self-referential via parentId) and SINGLE-membership `folder-assignment` rows keyed by (entityType, entityId) (`read_folder_assignments`) — so filing an entity adds NO column to the host and needs no relational pivot or JOIN. The folder catalog uses the generic entity handlers (create, update [= rename, optimistic-locked], delete, list, detail); set-folder puts/moves an entity into a folder (one folder per entity) and clear-folder unfiles it (both idempotent). Read which folder an entity is in, or which entities a folder holds, by listing `folder-assignment` filtered on `entityId` or `folderId`. Every path uses one access rule — adopt the host's model with createFoldersFeature({ access: { openToAll: { reason } } }) or pin roles. Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).");
     r.uiHints({

package/dist/folders/handlers/clear-folder.write.js

@@ -1,8 +1,8 @@
 import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { folderAssignmentAggregateId } from "../aggregate-id.js";
-import { DEFAULT_FOLDER_ACCESS } from "../constants.js";
 import { folderAssignmentExecutor } from "../executor.js";
 import { clearFolderPayloadSchema } from "../schemas.js";
+import { DEFAULT_FOLDER_ACCESS } from "../web/constants.js";
 // clear-folder — removes a host entity from its folder (back to "unfiled").
 // Idempotent: clearing an entity that isn't in any folder is already the
 // requested end state, so we pre-check and return success without a delete.

package/dist/folders/handlers/delete-folder.write.js

@@ -1,8 +1,8 @@
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { hostRowIsGone } from "../../shared/index.js";
-import { DEFAULT_FOLDER_ACCESS } from "../constants.js";
 import { folderAssignmentExecutor, folderExecutor } from "../executor.js";
+import { DEFAULT_FOLDER_ACCESS } from "../web/constants.js";
 const deleteFolderPayloadSchema = z.object({ id: z.uuid() });
 // delete-folder — the UI's folder-manager only blocks deleting a folder that
 // still has CHILD folders; it never checks folder-assignments. A leaf folder

package/dist/folders/handlers/set-folder.write.js

@@ -1,9 +1,9 @@
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { folderAssignmentAggregateId } from "../aggregate-id.js";
-import { DEFAULT_FOLDER_ACCESS } from "../constants.js";
 import { folderAssignmentExecutor, folderExecutor } from "../executor.js";
 import { setFolderPayloadSchema } from "../schemas.js";
+import { DEFAULT_FOLDER_ACCESS } from "../web/constants.js";
 // set-folder — puts a host entity into a folder. Single-membership: the
 // assignment id is deterministic over (tenant, entity) WITHOUT folderId, so an
 // entity has exactly one assignment and setting a different folder MOVES it.

package/dist/folders/index.d.ts

@@ -1,7 +1,7 @@
 export { folderAssignmentAggregateId } from "./aggregate-id.ts";
-export { DEFAULT_FOLDER_ACCESS, DEFAULT_FOLDER_ROLES, FOLDER_SECTION_EXTENSION_NAME, FOLDERS_FEATURE_NAME, FoldersHandlers, FoldersQueries, } from "./constants.ts";
 export { folderAssignmentEntity, folderEntity } from "./entity.ts";
 export { createFoldersFeature, type FoldersFeatureOptions, } from "./feature.ts";
 export { clearFolderHandler, createClearFolderHandler } from "./handlers/clear-folder.write.ts";
 export { createSetFolderHandler, setFolderHandler } from "./handlers/set-folder.write.ts";
 export { type ClearFolderPayload, clearFolderPayloadSchema, type SetFolderPayload, setFolderPayloadSchema, } from "./schemas.ts";
+export { DEFAULT_FOLDER_ACCESS, DEFAULT_FOLDER_ROLES, FOLDER_SECTION_EXTENSION_NAME, FOLDERS_FEATURE_NAME, FoldersHandlers, FoldersQueries, } from "./web/constants.ts";

package/dist/folders/index.js

@@ -1,7 +1,7 @@
 export { folderAssignmentAggregateId } from "./aggregate-id.js";
-export { DEFAULT_FOLDER_ACCESS, DEFAULT_FOLDER_ROLES, FOLDER_SECTION_EXTENSION_NAME, FOLDERS_FEATURE_NAME, FoldersHandlers, FoldersQueries, } from "./constants.js";
 export { folderAssignmentEntity, folderEntity } from "./entity.js";
 export { createFoldersFeature, } from "./feature.js";
 export { clearFolderHandler, createClearFolderHandler } from "./handlers/clear-folder.write.js";
 export { createSetFolderHandler, setFolderHandler } from "./handlers/set-folder.write.js";
 export { clearFolderPayloadSchema, setFolderPayloadSchema, } from "./schemas.js";
+export { DEFAULT_FOLDER_ACCESS, DEFAULT_FOLDER_ROLES, FOLDER_SECTION_EXTENSION_NAME, FOLDERS_FEATURE_NAME, FoldersHandlers, FoldersQueries, } from "./web/constants.js";

package/dist/folders/web/client-plugin.js

@@ -1,5 +1,4 @@
-// @runtime client
-import { FOLDER_SECTION_EXTENSION_NAME, FOLDERS_FEATURE_NAME } from "../constants.js";
+import { FOLDER_SECTION_EXTENSION_NAME, FOLDERS_FEATURE_NAME } from "./constants.js";
 import { FolderSection } from "./folder-section.js";
 import { defaultTranslations } from "./i18n.js";
 export function foldersClient() {

package/dist/folders/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // folders bundle constants — feature-name + qualified handler/query names.
 //
 // Spec: kumiko-platform/docs/plans/folders-feature.md

package/dist/folders/web/folder-manager.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // FolderManager — in-screen folder tree the user manages directly: create root
 // folders + subfolders, rename, delete, collapse/expand. KPI-agnostic: a host
 // passes `renderMeta` to hang its own per-folder badges (e.g. money-horse's
@@ -30,7 +29,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { ChevronRight, File, Folder, Pencil, Plus, Trash2 } from "lucide-react";
 import { useEffect, useState } from "react";
-import { FoldersHandlers, FoldersQueries } from "../constants.js";
+import { FoldersHandlers, FoldersQueries } from "./constants.js";
 import { buildFolderTree } from "./tree.js";
 const UNFILED = "__unfiled__";
 const DRAG_MIME = "text/plain";

package/dist/folders/web/folder-section.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // FolderSection — drop-in single-folder picker for ANY entity. Unlike tags
 // (many-to-many multi-combobox), an entity lives in exactly ONE folder, so this
 // is a single-select combobox with a "no folder" option plus a compact row to
@@ -14,7 +13,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 //                   (RenderEdit passes { entityName, entityId }).
 import { useDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
-import { FoldersHandlers, FoldersQueries } from "../constants.js";
+import { FoldersHandlers, FoldersQueries } from "./constants.js";
 import { folderPath } from "./tree.js";
 // Sentinel for the "no folder" combobox option — selecting it clears the
 // assignment. Empty string can't collide with a folder id (uuid).

package/dist/folders/web/i18n.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Default translation bundle for the folders UI. foldersClient() hangs it into
 // the LocaleProvider as a fallback bundle — apps override individual keys via
 // foldersClient({ translations }). Keys follow `folders.<area>.<slug>`.

package/dist/folders/web/index.d.ts

@@ -1,5 +1,5 @@
-export { FOLDER_SECTION_EXTENSION_NAME, FoldersHandlers, FoldersQueries } from "../constants.ts";
 export { foldersClient } from "./client-plugin.tsx";
+export { FOLDER_SECTION_EXTENSION_NAME, FoldersHandlers, FoldersQueries } from "./constants.ts";
 export { type FolderFiling, type FolderLeaf, FolderManager } from "./folder-manager.tsx";
 export { FolderSection } from "./folder-section.tsx";
 export { buildFolderTree, type FolderNode, type FolderRow, folderPath } from "./tree.ts";

package/dist/folders/web/index.js

@@ -1,6 +1,5 @@
-// @runtime client
-export { FOLDER_SECTION_EXTENSION_NAME, FoldersHandlers, FoldersQueries } from "../constants.js";
 export { foldersClient } from "./client-plugin.js";
+export { FOLDER_SECTION_EXTENSION_NAME, FoldersHandlers, FoldersQueries } from "./constants.js";
 export { FolderManager } from "./folder-manager.js";
 export { FolderSection } from "./folder-section.js";
 export { buildFolderTree, folderPath } from "./tree.js";

package/dist/folders/web/tree.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure tree helpers shared by FolderManager (nested render) and FolderSection
 // (path-labelled options). No React, no IO — folder rows in, structure out, so
 // both can be unit-tested without a renderer harness.

package/dist/form-draft/db/queries/cleanup.d.ts

@@ -7,9 +7,10 @@ export type StaleDraftRow = {
     readonly tenantId: TenantId;
     readonly ownerId: string;
     readonly draftKey: string;
-    readonly draft: FormDraftBlob;
+    readonly draft: FormDraftBlob | null;
+    readonly draftUnreadable?: true;
     readonly insertedAt: Temporal.Instant;
 };
-export declare function selectStaleDraftsBatch(db: DbConnection, olderThanDays: number, batchSize: number): Promise<readonly StaleDraftRow[]>;
+export declare function selectStaleDraftsBatch(db: DbConnection, olderThanDays: number, batchSize: number, excludeIds?: readonly string[]): Promise<readonly StaleDraftRow[]>;
 /** Re-check staleness after the select→release window so a freshly saved draft is not deleted. */
 export declare function isDraftStillStale(db: DbConnection, tenantId: TenantId, id: string, olderThanDays: number): Promise<boolean>;

package/dist/form-draft/db/queries/cleanup.js

@@ -1,5 +1,6 @@
 import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { readStoredDraft } from "../../decrypt-draft.js";
 // COALESCE(modified_at, inserted_at) — a draft's "last touched" timestamp is
 // modified_at once the upsert path (save.write.ts) has updated it at least
 // once; a draft saved exactly once (create, never updated) has no
@@ -11,18 +12,26 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 // per-row via formDraftExecutor.delete (event-sourced, not raw SQL — a
 // rebuild must not resurrect a "deleted" draft). Ordered oldest-first so a
 // batch is a stable, deterministic slice across the two queries.
-export async function selectStaleDraftsBatch(db, olderThanDays, batchSize) {
+export async function selectStaleDraftsBatch(db, olderThanDays, batchSize, excludeIds = []) {
     const rows = await unsafeReadRetrying(db, `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
      WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
+     AND NOT ("id"::text = ANY($3::text[]))
      ORDER BY COALESCE("modified_at", "inserted_at") ASC
-     LIMIT $2`, [olderThanDays, batchSize]);
-    return rows.map((row) => ({
-        id: row.id,
-        tenantId: row.tenant_id, // @cast-boundary db-row
-        ownerId: row.owner_id,
-        draftKey: row.draft_key,
-        draft: row.draft,
-        insertedAt: Temporal.Instant.fromEpochMilliseconds(+row.inserted_at), // @cast-boundary db-row
+     LIMIT $2`, [olderThanDays, batchSize, [...excludeIds]]);
+    return Promise.all(rows.map(async (row) => {
+        const base = {
+            id: row.id,
+            tenantId: row.tenant_id, // @cast-boundary db-row
+            ownerId: row.owner_id,
+            draftKey: row.draft_key,
+            insertedAt: Temporal.Instant.fromEpochMilliseconds(+row.inserted_at), // @cast-boundary db-row
+        };
+        try {
+            return { ...base, draft: await readStoredDraft(row.draft) };
+        }
+        catch {
+            return { ...base, draft: null, draftUnreadable: true };
+        }
     }));
 }
 /** Re-check staleness after the select→release window so a freshly saved draft is not deleted. */

package/dist/form-draft/decrypt-draft.d.ts

@@ -0,0 +1,2 @@
+import { type FormDraftBlob } from "./schemas.ts";
+export declare function readStoredDraft(stored: unknown): Promise<FormDraftBlob | null>;

package/dist/form-draft/decrypt-draft.js

@@ -0,0 +1,19 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
+import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "@cosmicdrift/kumiko-framework/crypto";
+import { formDraftBlobSchema } from "./schemas.js";
+// Raw reads (fetchOne/selectMany/SQL) return the stored column, which is
+// ciphertext once the owner's key exists. The field name is part of the AAD,
+// so it must stay "draft". An erased owner yields the sentinel string, which
+// fails the blob schema and reads as null (no usable draft).
+export async function readStoredDraft(stored) {
+    let plain = stored;
+    const kms = configuredPiiSubjectKms();
+    if (isPiiCiphertext(stored) && kms) {
+        const out = await decryptPiiFieldValues({ draft: stored }, ["draft"], kms, {
+            requestId: requestContext.get()?.requestId ?? "form-draft:read",
+        });
+        plain = out["draft"];
+    }
+    const parsed = formDraftBlobSchema.safeParse(plain);
+    return parsed.success ? parsed.data : null;
+}

package/dist/form-draft/entity.js

@@ -1,5 +1,5 @@
 import { createEntity, createJsonbField, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
-import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT } from "./constants.js";
+import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT } from "./web/constants.js";
 // form-draft — a per-user, pre-submission working copy of an in-progress
 // form (e.g. a wizard-mode EditLayout). `draftKey` is caller-assigned
 // (typically screenId + optional hostEntityId) and scoped to
@@ -32,14 +32,11 @@ export const formDraftEntity = createEntity({
         // The blob shape is fixed by issue #1889, not left to the caller:
         // { values: Record<string, unknown>, stepIndex: number, savedAt: string }.
         // Free-form because `values` mirrors whatever fields the in-progress
-        // form has, so it can carry arbitrary user-entered PII. NOT given a
-        // `personal` annotation — the framework's PII field-encryption engine only
-        // accepts string values (pii-field-encryption.ts throws on a non-string
-        // field), and this is a jsonb object. Erasure instead runs as a real
-        // physical row-delete on forget (see form-draft-user-data/hooks.ts),
-        // not crypto-shredding; `ownerId`'s `subjectRef` annotation alone
-        // already satisfies the GDPR-hook-coverage boot guard.
-        draft: createJsonbField(),
+        // form has, so it can carry arbitrary user-entered PII. Encrypted under
+        // the owner's key (jsonb ciphertext scalar in the row and in every event
+        // that carries it, `previous` of delete included), so forgetting the
+        // owner shreds all copies.
+        draft: createJsonbField({ personal: { of: "ownerId" } }),
     },
     // One draft per (tenant, owner, draftKey) — save() is an upsert keyed on
     // this index (see handlers/save.write.ts); a resume query must find at

package/dist/form-draft/feature.js

@@ -5,13 +5,13 @@
 // savedAt } through save/discard/get. See entity.ts for the ownership +
 // uniqueness model.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { FORM_DRAFT_FEATURE_NAME } from "./constants.js";
 import { formDraftEntity } from "./entity.js";
 import { cleanupDraftsJob, formDraftRetentionDaysConfig } from "./handlers/cleanup.job.js";
 import { discardDraftWrite } from "./handlers/discard.write.js";
 import { getDraftQuery } from "./handlers/get.query.js";
 import { listDraftsQuery } from "./handlers/list.query.js";
 import { saveDraftWrite } from "./handlers/save.write.js";
+import { FORM_DRAFT_FEATURE_NAME } from "./web/constants.js";
 const CLEANUP_ESCAPE_HATCH_REASON = "purges stale drafts of every tenant";
 function registerFormDraft(r) {
     r.describe("Per-user, per-tenant working copy of an in-progress form, saved BEFORE the real domain entity exists. Owns one event-sourced entity, `form-draft` (`read_form_drafts`), keyed by a caller-assigned draftKey (typically screenId + optional hostEntityId), unique per (tenant, owner, draftKey). `save` upserts the draft blob ({ values, stepIndex, savedAt } — savedAt stamped server-side), `discard` deletes it (called once the real submit succeeds), `get` resumes it, `list` finds a user's open drafts for a given screenId (draftKey prefix match) — the fallback when a client-generated draftId is lost. Ownership is enforced by a per-row owner filter in every handler, not by roles — a foreign user's save/discard/get/list for someone else's draftKey never sees or touches that row. Never holds anything that already lives in a domain stream; the consuming app is responsible for discarding once the domain write succeeds. A daily cron job hard-deletes drafts past a configurable retention window (`form-draft:config:retention-days`, SystemAdmin-writable, default 30 days).");

package/dist/form-draft/handlers/cleanup.job.d.ts

@@ -8,5 +8,6 @@ export declare function groupStaleDraftIdsByTenant(batch: readonly StaleDraftRow
 export declare function deleteStaleDraftsBatch(batch: readonly StaleDraftRow[], db: DbConnection, retentionDays: number, log: AppContext["log"]): Promise<{
     readonly deletedRows: readonly StaleDraftRow[];
     readonly skippedCount: number;
+    readonly deferredIds: readonly string[];
 }>;
 export declare function cleanupDraftsJob(_payload: Record<string, unknown>, ctx: JobContext, db: DbConnection): Promise<void>;