@cosmicdrift/kumiko-bundled-features 0.392.2 → 0.394.0

package/dist/template-resolver/web/client-plugin.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { EMPTY_VALUE_PLACEHOLDER } from "@cosmicdrift/kumiko-renderer/headless";
 // Client feature factory for the text-block content tree. Apps mount it via
 // createKumikoApp({ clientFeatures: [textBlocksClient()] }); it loads the
@@ -11,10 +11,12 @@ import { EMPTY_VALUE_PLACEHOLDER } from "@cosmicdrift/kumiko-renderer/headless";
 // **State**: TreeNode.state = "filled" when content is set, otherwise "stub"
 // (a hint that the slug exists but is empty).
 import { useShellUser } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web";
+import { isUiAccessGranted } from "@cosmicdrift/kumiko-framework/ui-types";
 import { ContentPreview, useAppFeatures, useContentEditor, useDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { CSRF_HEADER_NAME, readCsrfToken } from "@cosmicdrift/kumiko-renderer/live";
 import { PlainContentEditor, RichContentEditor, } from "@cosmicdrift/kumiko-renderer/web";
 import { useEffect, useId, useState } from "react";
+import { DEFAULT_COLLECTION_ACCESS } from "./constants.js";
 import { DocumentBlocksContext, DocumentContentEditor } from "./document-editor.js";
 import { documentBlocksForKind } from "./document-toolbar-blocks.js";
 import { defaultTranslations } from "./i18n.js";
@@ -89,58 +91,122 @@ export function groupBlocksByFolder(blocks, tenantIdOverride, collectionId) {
         },
     ];
 }
+// A save in the editor re-fires the tree of the collection it wrote to. The
+// SSE refresh does not cover every collection: per-user entries carry no
+// entity signal, because naming their ids to every collection reader would
+// reveal when colleagues change their own entries.
+const TEXT_BLOCK_TREE_KEY = "";
+const treeRefreshListeners = new Map();
+function onTreeRefresh(treeKey, listener) {
+    const listeners = treeRefreshListeners.get(treeKey) ?? new Set();
+    listeners.add(listener);
+    treeRefreshListeners.set(treeKey, listeners);
+    return () => listeners.delete(listener);
+}
+function refreshTree(treeKey) {
+    for (const listener of treeRefreshListeners.get(treeKey) ?? [])
+        listener();
+}
+async function postBlockList(queryType, tenantIdOverride) {
+    // CSRF header is mandatory on authenticated requests (auth-middleware
+    // double-submit pattern). Anonymous/pre-login has no token → header
+    // omitted → the server takes the anonymous path.
+    const headers = { "content-type": "application/json" };
+    const csrf = readCsrfToken();
+    if (csrf !== undefined)
+        headers[CSRF_HEADER_NAME] = csrf;
+    // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
+    const response = await fetch("/api/query", {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+            type: queryType,
+            payload: tenantIdOverride !== undefined ? { tenantIdOverride } : {},
+        }),
+    });
+    if (!response.ok) {
+        return {
+            ok: false,
+            status: response.status,
+            body: await response.text().catch(() => response.statusText),
+        };
+    }
+    const data = await response.json();
+    return { ok: true, blocks: data.data.blocks };
+}
+const TENANT_OVERRIDE_DENIED_REASON = "tenant_override_requires_system_admin";
+// The dispatcher accepts tenantIdOverride from a SystemAdmin only, and the
+// provider cannot see the session roles. Everyone else gets this exact denial
+// and reads their session tenant instead, which is the only tenant they may
+// edit anyway.
+function isTenantOverrideDenied(result) {
+    return !result.ok && result.status === 403 && result.body.includes(TENANT_OVERRIDE_DENIED_REASON);
+}
+async function loadBlocks(queryType, tenantIdOverride) {
+    let result = await postBlockList(queryType, tenantIdOverride);
+    let effectiveOverride = tenantIdOverride;
+    if (tenantIdOverride !== undefined && isTenantOverrideDenied(result)) {
+        result = await postBlockList(queryType, undefined);
+        effectiveOverride = undefined;
+    }
+    if (!result.ok) {
+        // 403 (CSRF/auth) or 5xx — explicit error instead of silent empty.
+        throw new Error(`text-block load failed: ${result.status} ${result.body}`);
+    }
+    return {
+        blocks: result.blocks,
+        ...(effectiveOverride !== undefined && { tenantIdOverride: effectiveOverride }),
+    };
+}
 // tenantIdOverride (SystemAdmin-only) lets an app point the content tree at a
 // tenant other than the session's — publicstatus seeds marketing/legal blocks
 // on SYSTEM_TENANT_ID, so its SystemAdmin must read that tenant, not their own.
-// Without a collection id: the anonymous-capable by-tenant query, so a public
+// Without a collection: the anonymous-capable by-tenant query, so a public
 // page keeps its content sidebar without a session. With one: that
 // collection's own list handler, which carries the collection's access rule.
-function makeTreeProvider(tenantIdOverride, collectionId) {
+function makeTreeProvider(tenantIdOverride, collection) {
+    const collectionId = collection?.id;
     const queryType = collectionId === undefined
         ? TemplateResolverQueries.byTenant
         : collectionQueryName(collectionId, "list");
+    // A per-user entry belongs to its author in the session tenant; pointing the
+    // tree at another tenant would only hide the author's own entries.
+    const requestedOverride = collection?.ownership === "user" ? undefined : tenantIdOverride;
     return () => (emit, emitError) => {
-        // CSRF header is mandatory on authenticated requests (auth-middleware
-        // double-submit pattern). Anonymous/pre-login has no token → header
-        // omitted → the server takes the anonymous path.
-        const headers = { "content-type": "application/json" };
-        const csrf = readCsrfToken();
-        if (csrf !== undefined)
-            headers[CSRF_HEADER_NAME] = csrf;
-        // kumiko-lint-ignore no-raw-hooks not yet converted to the framework hook set
-        fetch("/api/query", {
-            method: "POST",
-            headers,
-            body: JSON.stringify({
-                type: queryType,
-                payload: tenantIdOverride !== undefined ? { tenantIdOverride } : {},
-            }),
-        })
-            .then(async (r) => {
-            if (!r.ok) {
-                // 403 (CSRF/auth) or 5xx — explicit error instead of silent empty.
-                const text = await r.text().catch(() => r.statusText);
-                throw new Error(`text-block load failed: ${r.status} ${text}`);
-            }
-            return r.json();
-        })
-            .then((data) => {
-            // The app-side r.nav node IS the "Content" container → the provider's
-            // children are the folders/leaves below it, not the wrapper.
-            const content = groupBlocksByFolder(data.data.blocks, tenantIdOverride, collectionId)[0];
-            emit(content !== undefined && Array.isArray(content.children) ? content.children : []);
-        })
-            .catch((e) => {
-            // Explicit error signal via emitError; ProviderBranch shows a banner
-            // plus retry. Falls back to emit([]) for consumers without emitError.
-            if (emitError) {
-                emitError(e instanceof Error ? e : new Error(String(e)));
-            }
-            else {
-                emit([]);
-            }
-        });
-        return () => { };
+        let active = true;
+        // Each denial logs a client-fault warning on the server, so a reload after a
+        // save does not ask again once this subscription learned the answer.
+        let override = requestedOverride;
+        const load = () => {
+            loadBlocks(queryType, override)
+                .then(({ blocks, tenantIdOverride: effectiveOverride }) => {
+                if (!active)
+                    return;
+                override = effectiveOverride;
+                // The app-side r.nav node IS the "Content" container → the provider's
+                // children are the folders/leaves below it, not the wrapper.
+                const content = groupBlocksByFolder(blocks, effectiveOverride, collectionId)[0];
+                emit(content !== undefined && Array.isArray(content.children) ? content.children : []);
+            })
+                .catch((e) => {
+                if (!active)
+                    return;
+                // Explicit error signal via emitError; ProviderBranch shows a banner
+                // plus retry. Falls back to emit([]) for consumers without emitError.
+                if (emitError) {
+                    emitError(e instanceof Error ? e : new Error(String(e)));
+                }
+                else {
+                    emit([]);
+                }
+            });
+        };
+        load();
+        const unsubscribe = onTreeRefresh(collectionId ?? TEXT_BLOCK_TREE_KEY, load);
+        return () => {
+            active = false;
+            unsubscribe();
+        };
     };
 }
 // A node without a collectionId (the hand-wired text-block tree) has no
@@ -165,6 +231,16 @@ function findContentFormat(features, collectionId) {
 function findVariableExamples(features, collectionId) {
     return findCollection(features, collectionId)?.variableSchema ?? {};
 }
+// Edit form: loads the current values, dispatches set on submit. Who may save
+// follows the server: a collection's set handler carries the collection's own
+// access rule (one rule for list, item and set), the public text-block pair
+// stays TenantAdmin/SystemAdmin. Other users see the form read-only.
+export function canWriteContent(collection, roles) {
+    if (collection !== undefined) {
+        return isUiAccessGranted(collection.access ?? DEFAULT_COLLECTION_ACCESS, roles);
+    }
+    return roles?.includes("TenantAdmin") === true || roles?.includes("SystemAdmin") === true;
+}
 // The collection's declared contentFormat ("plain" | "rich" | "markdown" |
 // "document", see ContentCollectionDefinition.contentFormat) uses a different vocabulary
 // than the stored entry's contentFormat ("plain" | "html" | "markdown" |
@@ -197,7 +273,7 @@ function TextBlockEditor({ target, }) {
     // Which collection the node came from. Absent → the public text-block pair,
     // which is what the hand-wired content tree uses.
     const collectionId = args?.collectionId;
-    const { Form, Field, Input, Button, Banner } = usePrimitives();
+    const { Form, Field, Input, Button, Banner, PageHeader } = usePrimitives();
     const dispatcher = useDispatcher();
     const user = useShellUser();
     const t = useTranslation();
@@ -206,9 +282,10 @@ function TextBlockEditor({ target, }) {
     const contentFormat = findContentFormat(features, collectionId);
     const variableExamples = findVariableExamples(features, collectionId);
     const variables = Object.keys(variableExamples);
-    const documentBlocks = documentBlocksForKind(findCollection(features, collectionId)?.kind);
+    const collection = findCollection(features, collectionId);
+    const documentBlocks = documentBlocksForKind(collection?.kind);
     const ContentEditor = useContentEditor(contentFormat);
-    const canWrite = user?.roles.includes("TenantAdmin") === true || user?.roles.includes("SystemAdmin") === true;
+    const canWrite = canWriteContent(collection, user?.roles);
     // Same split as the tree provider: a node without a collection reads through
     // the public by-slug, a collection node through that collection's handlers.
     const readQuery = collectionId === undefined
@@ -249,6 +326,7 @@ function TextBlockEditor({ target, }) {
                 ...(tenantIdOverride !== undefined && { tenantIdOverride }),
             });
             if (result.isSuccess) {
+                refreshTree(collectionId ?? TEXT_BLOCK_TREE_KEY);
                 setSavedMsg(result.data.isNew
                     ? t("template-resolver.editor.created")
                     : t("template-resolver.editor.saved"));
@@ -270,16 +348,20 @@ function TextBlockEditor({ target, }) {
         void handleSave();
     };
     const disabled = submitting || loading || !canWrite;
-    return (_jsxs(Form, { onSubmit: onSubmit, testId: "text-block-editor", title: title || slug || EMPTY_VALUE_PLACEHOLDER, subtitle: locale !== "" ? `${slug} · (${locale})` : slug, actions: canWrite ? (_jsx(Button, { type: "submit", loading: submitting, disabled: disabled, children: submitting ? t("template-resolver.editor.saving") : t("template-resolver.editor.save") })) : undefined, children: [loading && _jsx(Banner, { variant: "loading", children: t("template-resolver.editor.loading") }), loadError !== null && (_jsxs(Banner, { variant: "error", children: [t("template-resolver.editor.loadFailed"), ": ", loadError.code] })), !canWrite && !loading && (_jsx(Banner, { variant: "info", children: t("template-resolver.editor.readOnly") })), _jsx(Field, { id: "text-block-title", label: t("template-resolver.editor.titleLabel"), required: true, children: _jsx(Input, { kind: "text", id: "text-block-title", name: "text-block-title", value: title, onChange: setTitle, disabled: disabled, required: true }) }), _jsx(Field, { id: contentEditorId, label: t("template-resolver.editor.contentLabel"), labelAppendix: _jsx(Button, { type: "button", variant: "secondary", size: "sm", onClick: () => setPreviewing((p) => !p), children: previewing ? t("kumiko.contentEditor.editMode") : t("kumiko.contentEditor.preview") }), children: previewing ? (_jsx(ContentPreview, { content: content, variables: variableExamples, contentFormat: contentFormat })) : (_jsx(DocumentBlocksContext.Provider, { value: documentBlocks, children: _jsx(ContentEditor, { id: contentEditorId, value: content, onChange: setContent, variables: variables, readOnly: disabled }) })) }), saveError !== null && _jsx(Banner, { variant: "error", children: saveError }), savedMsg !== null && _jsx(Banner, { variant: "info", children: savedMsg })] }));
+    const headerTitle = title || slug || undefined;
+    return (_jsxs(_Fragment, { children: [PageHeader !== undefined && headerTitle !== undefined && _jsx(PageHeader, { title: headerTitle }), _jsxs(Form, { onSubmit: onSubmit, testId: "text-block-editor", title: title || slug || EMPTY_VALUE_PLACEHOLDER, subtitle: locale !== "" ? `${slug} · (${locale})` : slug, actions: canWrite ? (_jsx(Button, { type: "submit", loading: submitting, disabled: disabled, children: submitting
+                        ? t("template-resolver.editor.saving")
+                        : t("template-resolver.editor.save") })) : undefined, children: [loading && _jsx(Banner, { variant: "loading", children: t("template-resolver.editor.loading") }), loadError !== null && (_jsxs(Banner, { variant: "error", children: [t("template-resolver.editor.loadFailed"), ": ", loadError.code] })), !canWrite && !loading && (_jsx(Banner, { variant: "info", children: t("template-resolver.editor.readOnly") })), _jsx(Field, { id: "text-block-title", label: t("template-resolver.editor.titleLabel"), required: true, children: _jsx(Input, { kind: "text", id: "text-block-title", name: "text-block-title", value: title, onChange: setTitle, disabled: disabled, required: true }) }), _jsx(Field, { id: contentEditorId, label: t("template-resolver.editor.contentLabel"), labelAppendix: _jsx(Button, { type: "button", variant: "secondary", size: "sm", onClick: () => setPreviewing((p) => !p), children: previewing ? t("kumiko.contentEditor.editMode") : t("kumiko.contentEditor.preview") }), children: previewing ? (_jsx(ContentPreview, { content: content, variables: variableExamples, contentFormat: contentFormat })) : (_jsx(DocumentBlocksContext.Provider, { value: documentBlocks, children: _jsx(ContentEditor, { id: contentEditorId, value: content, onChange: setContent, variables: variables, readOnly: disabled }) })) }), saveError !== null && _jsx(Banner, { variant: "error", children: saveError }), savedMsg !== null && _jsx(Banner, { variant: "info", children: savedMsg })] })] }));
 }
 // `navId` = the QN of the r.nav({ provider: true }) node the app registers for
 // the content tree (e.g. "publicstatus:nav:content"). The app owns the node's
 // label/icon/access, the feature only supplies children plus the editor.
 // Without navId: resolver only, no sidebar node (server-only consumers such as
 // money-horse leak nothing).
-// `tenantId` (SystemAdmin-only): which tenant the tree and editor serve —
-// SYSTEM_TENANT_ID for apps that seed marketing/legal there. Omit for the
-// session tenant (default, no cross-tenant access).
+// `tenantId`: which tenant a SystemAdmin's trees and editor serve —
+// SYSTEM_TENANT_ID for apps that seed marketing/legal there. Other users and
+// per-user collections always stay on the session tenant. Omit for the
+// session tenant everywhere.
 //
 // Beyond that single tree, this client also serves every content collection
 // the app declares via r.contentCollection() — one provider per collection,
@@ -299,7 +381,7 @@ export function textBlocksClient(opts) {
         // that collection's kind. The explicit navId above stays independent of
         // this — an app can have both a hand-wired content tree and collections.
         navProvidersFromCollections: (collections) => ({
-            providers: Object.fromEntries(collections.map((c) => [c.navQn, makeTreeProvider(tenantId, c.id)])),
+            providers: Object.fromEntries(collections.map((c) => [c.navQn, makeTreeProvider(tenantId, c)])),
             entities: Object.fromEntries(collections.map((c) => [c.navQn, ["template-resource"]])),
         }),
         resolvers: {

package/dist/template-resolver/web/i18n.js

@@ -134,6 +134,6 @@ export const defaultTranslations = {
         "template-resolver.editor.networkError": "Network error while saving.",
         "template-resolver.editor.loading": "Loading current version…",
         "template-resolver.editor.loadFailed": "Could not load block",
-        "template-resolver.editor.readOnly": "Read-only — TenantAdmin or SystemAdmin role required to make changes.",
+        "template-resolver.editor.readOnly": "Read-only. Your role does not allow changes here.",
     },
 };

package/dist/tenant/handlers/add-member.write.d.ts

@@ -3,4 +3,4 @@ export declare const addMemberWrite: import("@cosmicdrift/kumiko-types/define-ha
     userId: z.ZodString;
     tenantId: z.ZodString;
     roles: z.ZodArray<z.ZodString>;
-}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/tenant/handlers/cancel-invitation.write.d.ts

@@ -4,4 +4,4 @@ export declare const cancelInvitationWrite: import("@cosmicdrift/kumiko-types/de
 }, z.core.$strip>, {
     id: string;
     alreadyDone: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/tenant/handlers/create.write.d.ts

@@ -3,4 +3,4 @@ export declare const createWrite: import("@cosmicdrift/kumiko-types/define-handl
     id: z.ZodOptional<z.ZodUUID>;
     key: z.ZodString;
     name: z.ZodString;
-}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/tenant/handlers/remove-member.write.d.ts

@@ -5,4 +5,4 @@ export declare const removeMemberWrite: import("@cosmicdrift/kumiko-types/define
 }, z.core.$strip>, {
     userId: string;
     tenantId: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/tenant/handlers/toggle-enabled.write.d.ts

@@ -1,7 +1,7 @@
 import * as z from "zod";
 export declare const enableWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"disable" | "enable", z.ZodObject<{
     id: z.ZodUUID;
-}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;
 export declare const disableWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"disable" | "enable", z.ZodObject<{
     id: z.ZodUUID;
-}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/tenant/handlers/update-member-roles.write.d.ts

@@ -7,4 +7,4 @@ export declare const updateMemberRolesWrite: import("@cosmicdrift/kumiko-types/d
     userId: string;
     roles: readonly string[];
     tenantId: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/tenant/handlers/update.write.d.ts

@@ -5,4 +5,4 @@ export declare const updateWrite: import("@cosmicdrift/kumiko-types/define-handl
     changes: z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
-}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/tenant-handover/handlers/claim.write.d.ts

@@ -11,4 +11,4 @@ export declare function createClaimTenantHandoverHandler(opts?: ClaimTenantHando
     sourceTenantId: string;
     destinationTenantId: string;
     movedEntities: Readonly<Record<string, number>>;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/tenant-lifecycle/handlers/cancel-destruction.write.d.ts

@@ -3,4 +3,4 @@ export declare const cancelDestructionWrite: import("@cosmicdrift/kumiko-types/d
     tenantId: string;
     status: "active";
     gracePeriodEnd: null;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/tenant-lifecycle/handlers/request-destruction.write.d.ts

@@ -3,4 +3,4 @@ export declare const requestDestructionWrite: import("@cosmicdrift/kumiko-types/
     tenantId: string;
     status: "destroyRequested";
     gracePeriodEnd: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/tier-engine/handlers/set-tenant-tier.write.d.ts

@@ -23,4 +23,4 @@ export declare function createSetTenantTierWrite(opts?: SetTenantTierOptions): i
     tenantId: string;
     tier: string;
     isNew: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user/handlers/create.write.d.ts

@@ -6,4 +6,4 @@ export declare const createWrite: import("@cosmicdrift/kumiko-types/define-handl
     locale: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     timezone: z.ZodOptional<z.ZodString>;
     roles: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>]>>;
-}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user/handlers/update.write.d.ts

@@ -12,4 +12,4 @@ export declare const updateWrite: import("@cosmicdrift/kumiko-types/define-handl
         emailVerified: z.ZodOptional<z.ZodBoolean>;
         roles: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>]>>;
     }, z.core.$strip>;
-}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user-data-rights/handlers/cancel-deletion.write.d.ts

@@ -3,4 +3,4 @@ export declare const cancelDeletionWrite: import("@cosmicdrift/kumiko-types/defi
     userId: string;
     status: "active";
     gracePeriodEnd: null;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.d.ts

@@ -7,4 +7,4 @@ export declare function createConfirmDeletionByTokenHandler(opts?: ConfirmDeleti
 }, z.core.$strip>, {
     status: "deletionRequested";
     gracePeriodEnd: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user-data-rights/handlers/lift-restriction.write.d.ts

@@ -4,4 +4,4 @@ export declare const liftRestrictionWrite: import("@cosmicdrift/kumiko-types/def
 }, z.core.$strip>, {
     userId: string;
     status: "active";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user-data-rights/handlers/request-deletion-by-email.write.d.ts

@@ -19,4 +19,4 @@ export declare function createRequestDeletionByEmailHandler(opts?: RequestDeleti
     email: z.ZodEmail;
 }, z.core.$strip>, {
     kind: "requested";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user-data-rights/handlers/request-deletion.write.d.ts

@@ -19,4 +19,4 @@ export declare function createRequestDeletionHandler(opts?: RequestDeletionOptio
     userId: string;
     status: "deletionRequested";
     gracePeriodEnd: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user-data-rights/handlers/request-export.write.d.ts

@@ -3,4 +3,4 @@ export declare const requestExportWrite: import("@cosmicdrift/kumiko-types/defin
     jobId: string;
     status: string;
     isExisting: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user-data-rights/handlers/restrict-account.write.d.ts

@@ -4,4 +4,4 @@ export declare const restrictAccountWrite: import("@cosmicdrift/kumiko-types/def
 }, z.core.$strip>, {
     userId: string;
     status: "restricted";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user-data-rights/handlers/run-forget-cleanup.write.d.ts

@@ -10,4 +10,4 @@ export declare function createRunForgetCleanupHandler(opts?: RunForgetCleanupOpt
     errors: readonly import("../run-forget-cleanup.ts").ForgetCleanupError[];
     incompleteCount: number;
     incomplete: readonly import("../run-forget-cleanup.ts").ForgetCleanupIncomplete[];
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/user-data-rights-defaults/hooks/file-ref.userdata-hook.js

@@ -154,7 +154,8 @@ function isPersonalFileRow(registry, row) {
     if (row["entityId"] === null && resolveActionFormFileField(registry, entityType, fieldName)) {
         return true;
     }
-    const fieldDef = registry.getEntity(entityType)?.fields[fieldName];
+    const entity = registry.getEntity(entityType) ?? registry.getReadModelEntity(entityType);
+    const fieldDef = entity?.fields[fieldName];
     return isPersonalPiiField(fieldDef);
 }
 // Delete every row's binary (original + any derivatives) via the provider.

package/dist/user-profile/handlers/change-email.write.d.ts

@@ -5,4 +5,4 @@ export declare const changeEmailWrite: import("@cosmicdrift/kumiko-types/define-
 }, z.core.$strip>, {
     kind: string;
     email: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/waitlist/handlers/export-purge.write.d.ts

@@ -6,7 +6,7 @@ export type WaitlistExportData = {
 export type WaitlistPurgeData = {
     readonly purged: number;
 };
-export declare const exportHandler: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"export", z.ZodObject<{}, z.core.$strict>, WaitlistExportData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+export declare const exportHandler: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"export", z.ZodObject<{}, z.core.$strict>, WaitlistExportData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;
 export declare const purgeHandler: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"purge", z.ZodObject<{
     confirmCount: z.ZodNumber;
-}, z.core.$strict>, WaitlistPurgeData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strict>, WaitlistPurgeData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/waitlist/handlers/invite.write.d.ts

@@ -6,4 +6,4 @@ export type WaitlistInviteData = {
 };
 export declare function createInviteHandler(invite?: WaitlistInviteOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite", import("zod").ZodObject<{
     id: import("zod").ZodUUID;
-}, import("zod/v4/core").$strict>, WaitlistInviteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("zod/v4/core").$strict>, WaitlistInviteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/waitlist/handlers/reject.write.d.ts

@@ -4,4 +4,4 @@ export type WaitlistRejectData = {
 };
 export declare const rejectHandler: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"reject", import("zod").ZodObject<{
     id: import("zod").ZodUUID;
-}, import("zod/v4/core").$strict>, WaitlistRejectData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("zod/v4/core").$strict>, WaitlistRejectData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/waitlist/handlers/submit.write.d.ts

@@ -10,4 +10,4 @@ export declare function createSubmitHandler(opts: WaitlistOptions): import("@cos
     message: import("zod").ZodOptional<import("zod").ZodString>;
     locale: import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<string, string>>;
     website: import("zod").ZodOptional<import("zod").ZodString>;
-}, import("zod/v4/core").$strict>, WaitlistSubmitData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("zod/v4/core").$strict>, WaitlistSubmitData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.392.2",
+  "version": "0.394.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -188,9 +188,9 @@
       "types": "./dist/subscription-stripe/index.d.ts",
       "default": "./dist/subscription-stripe/index.js"
     },
-    "./subscription-dodo": {
-      "types": "./dist/subscription-dodo/index.d.ts",
-      "default": "./dist/subscription-dodo/index.js"
+    "./subscription-paddle": {
+      "types": "./dist/subscription-paddle/index.d.ts",
+      "default": "./dist/subscription-paddle/index.js"
     },
     "./subscription-mollie": {
       "types": "./dist/subscription-mollie/index.d.ts",
@@ -212,6 +212,10 @@
       "types": "./dist/inbound-mail-foundation/index.d.ts",
       "default": "./dist/inbound-mail-foundation/index.js"
     },
+    "./inbound-mail-foundation/web": {
+      "types": "./dist/inbound-mail-foundation/web/index.d.ts",
+      "default": "./dist/inbound-mail-foundation/web/index.js"
+    },
     "./inbound-provider-inmemory": {
       "types": "./dist/inbound-provider-inmemory/index.d.ts",
       "default": "./dist/inbound-provider-inmemory/index.js"
@@ -348,6 +352,10 @@
       "types": "./dist/auth-email-password/web/return-path.d.ts",
       "default": "./dist/auth-email-password/web/return-path.js"
     },
+    "./auth-email-password/static-login": {
+      "types": "./dist/auth-email-password/web/static-login.d.ts",
+      "default": "./dist/auth-email-password/web/static-login.js"
+    },
     "./auth-email-password/seeding": {
       "types": "./dist/auth-email-password/seeding.d.ts",
       "default": "./dist/auth-email-password/seeding.js"
@@ -558,9 +566,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.392.2",
-    "@cosmicdrift/kumiko-renderer": "0.392.2",
-    "@cosmicdrift/kumiko-types": "0.392.2",
+    "@cosmicdrift/kumiko-framework": "0.394.0",
+    "@cosmicdrift/kumiko-renderer": "0.394.0",
+    "@cosmicdrift/kumiko-types": "0.394.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "^3.31.3",
@@ -763,9 +771,9 @@
         "types": "./dist/subscription-stripe/index.d.ts",
         "default": "./dist/subscription-stripe/index.js"
       },
-      "./subscription-dodo": {
-        "types": "./dist/subscription-dodo/index.d.ts",
-        "default": "./dist/subscription-dodo/index.js"
+      "./subscription-paddle": {
+        "types": "./dist/subscription-paddle/index.d.ts",
+        "default": "./dist/subscription-paddle/index.js"
       },
       "./subscription-mollie": {
         "types": "./dist/subscription-mollie/index.d.ts",
@@ -787,6 +795,10 @@
         "types": "./dist/inbound-mail-foundation/index.d.ts",
         "default": "./dist/inbound-mail-foundation/index.js"
       },
+      "./inbound-mail-foundation/web": {
+        "types": "./dist/inbound-mail-foundation/web/index.d.ts",
+        "default": "./dist/inbound-mail-foundation/web/index.js"
+      },
       "./inbound-provider-inmemory": {
         "types": "./dist/inbound-provider-inmemory/index.d.ts",
         "default": "./dist/inbound-provider-inmemory/index.js"
@@ -923,6 +935,10 @@
         "types": "./dist/auth-email-password/web/return-path.d.ts",
         "default": "./dist/auth-email-password/web/return-path.js"
       },
+      "./auth-email-password/static-login": {
+        "types": "./dist/auth-email-password/web/static-login.d.ts",
+        "default": "./dist/auth-email-password/web/static-login.js"
+      },
       "./auth-email-password/seeding": {
         "types": "./dist/auth-email-password/seeding.d.ts",
         "default": "./dist/auth-email-password/seeding.js"
@@ -1142,17 +1158,17 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.392.2",
-    "@cosmicdrift/kumiko-locale-es": "0.392.2",
-    "@cosmicdrift/kumiko-locale-fr": "0.392.2",
-    "@cosmicdrift/kumiko-locale-it": "0.392.2",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.392.2",
+    "@cosmicdrift/kumiko-locale-de": "0.394.0",
+    "@cosmicdrift/kumiko-locale-es": "0.394.0",
+    "@cosmicdrift/kumiko-locale-fr": "0.394.0",
+    "@cosmicdrift/kumiko-locale-it": "0.394.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.394.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.392.2"
+    "@cosmicdrift/kumiko-testing": "0.394.0"
   },
   "peerDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.392.2"
+    "@cosmicdrift/kumiko-testing": "0.394.0"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-testing": {