@cosmicdrift/kumiko-framework 0.331.0 → 0.332.0

package/dist/db/blind-index-cleanup.d.ts

@@ -3,3 +3,4 @@ import type { DbRunner } from "./connection.js";
 export declare function nullBlindIndexesForSubject(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, subjectKey: string): Promise<void>;
 export declare function subjectRowExistsInTenant(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, subjectId: string, tenantId: string): Promise<boolean>;
 export declare function recordRowExistsInTenant(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, entityName: string, recordId: string, tenantId: string): Promise<boolean>;
+export declare function recordRowOwningTenantId(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, entityName: string, recordId: string): Promise<string | undefined>;

package/dist/db/blind-index-cleanup.js

@@ -110,3 +110,15 @@ export async function recordRowExistsInTenant(db, features, entityName, recordId
     const rows = await executeRawQueryRead(db, `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`, [recordId, tenantId]);
     return rows.length > 0;
 }
+// Owning tenant of a record subject's row, for callers that must evaluate
+// tenant-scoped policy for the row's real owner (not the acting user's tenant).
+export async function recordRowOwningTenantId(db, features, entityName, recordId) {
+    const entity = findEntityByExactName(features, entityName);
+    if (!entity)
+        return undefined;
+    const tableName = resolveTableName(entityName, entity, undefined);
+    if (!(await tableExists(db, tableName)))
+        return undefined;
+    const rows = await executeRawQueryRead(db, `SELECT tenant_id FROM ${quoteIdent(tableName)} WHERE id = $1 LIMIT 1`, [recordId]);
+    return rows[0]?.tenant_id;
+}

package/dist/db/index.d.ts

@@ -1,5 +1,5 @@
 export { assertExistsIn } from "./assert-exists-in.js";
-export { nullBlindIndexesForSubject, recordRowExistsInTenant, subjectRowExistsInTenant, } from "./blind-index-cleanup.js";
+export { nullBlindIndexesForSubject, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "./blind-index-cleanup.js";
 export { collectTableMetas } from "./collect-table-metas.js";
 export { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
 export { seedConfigValues } from "./config-seed.js";

package/dist/db/index.js

@@ -1,5 +1,5 @@
 export { assertExistsIn } from "./assert-exists-in.js";
-export { nullBlindIndexesForSubject, recordRowExistsInTenant, subjectRowExistsInTenant, } from "./blind-index-cleanup.js";
+export { nullBlindIndexesForSubject, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "./blind-index-cleanup.js";
 export { collectTableMetas } from "./collect-table-metas.js";
 export { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
 export { seedConfigValues } from "./config-seed.js";

package/dist/db/queries/event-consumer.d.ts

@@ -24,10 +24,11 @@ export type ConsumerDeliveryOutcome = {
     readonly deadLettered: boolean;
     readonly processed: number;
     readonly pendingGaps: readonly PendingGapEntry[];
+    readonly failedEventId: bigint | null;
 };
 export declare function updateConsumerDeliveryOutcome(db: AnyDb, name: string, instanceId: string, outcome: ConsumerDeliveryOutcome): Promise<void>;
 export declare function updateConsumerStatusReturning(db: AnyDb, name: string, instanceId: string, status: "idle" | "disabled"): Promise<Record<string, unknown> | undefined>;
-export declare function advanceConsumerPastEventReturning(db: AnyDb, name: string, instanceId: string, eventId: bigint): Promise<Record<string, unknown> | undefined>;
+export declare function advanceConsumerPastEventReturning(db: AnyDb, name: string, instanceId: string, eventId: bigint, gapToAdd?: PendingGapEntry | null): Promise<Record<string, unknown> | undefined>;
 export declare function resetConsumerForMspRebuild(db: AnyDb, name: string, instanceId: string): Promise<void>;
 export declare function selectConsumerForUpdate(db: AnyDb, name: string, instanceId: string): Promise<Record<string, unknown> | undefined>;
 export declare function updateConsumerRebuildCursor(db: AnyDb, name: string, instanceId: string, lastProcessedEventId: bigint, pendingGaps: readonly PendingGapEntry[]): Promise<void>;

package/dist/db/queries/event-consumer.js

@@ -167,6 +167,7 @@ export async function updateConsumerDeliveryOutcome(db, name, instanceId, outcom
        "rearm_count" = CASE WHEN $5 THEN 0 ELSE "rearm_count" END,
        -- text param + cast: a JS string bound straight to ::jsonb double-encodes under Bun.SQL
        "pending_gaps" = $6::text::jsonb,
+       "last_failed_event_id" = $9,
        "updated_at" = now()
      WHERE "name" = $7 AND "instance_id" = $8`, [
         outcome.cursor,
@@ -177,6 +178,7 @@ export async function updateConsumerDeliveryOutcome(db, name, instanceId, outcom
         JSON.stringify(outcome.pendingGaps),
         name,
         instanceId,
+        outcome.failedEventId,
     ]);
 }
 export async function updateConsumerStatusReturning(db, name, instanceId, status) {
@@ -185,16 +187,21 @@ export async function updateConsumerStatusReturning(db, name, instanceId, status
      RETURNING *`, [status, name, instanceId]));
     return rows[0];
 }
-export async function advanceConsumerPastEventReturning(db, name, instanceId, eventId) {
+export async function advanceConsumerPastEventReturning(db, name, instanceId, eventId, 
+// Ids skipped over between the old cursor and eventId that were not visible yet.
+gapToAdd = null) {
     const rows = (await asRawClient(db).unsafe(`UPDATE "kumiko_event_consumers" SET
        "last_processed_event_id" = $1,
        "status" = 'idle',
        "attempts" = 0,
        "last_error" = NULL,
        "rearm_count" = 0,
+       "last_failed_event_id" = NULL,
+       -- text param + cast: a JS string bound straight to ::jsonb double-encodes under Bun.SQL
+       "pending_gaps" = CASE WHEN $4::text IS NULL THEN "pending_gaps" ELSE "pending_gaps" || $4::text::jsonb END,
        "updated_at" = now()
      WHERE "name" = $2 AND "instance_id" = $3
-     RETURNING *`, [eventId, name, instanceId]));
+     RETURNING *`, [eventId, name, instanceId, gapToAdd === null ? null : JSON.stringify([gapToAdd])]));
     return rows[0];
 }
 export async function resetConsumerForMspRebuild(db, name, instanceId) {
@@ -206,6 +213,7 @@ export async function resetConsumerForMspRebuild(db, name, instanceId) {
        "attempts" = 0,
        "last_error" = NULL,
        "pending_gaps" = '[]'::jsonb,
+       "last_failed_event_id" = NULL,
        "updated_at" = now()`, [name, instanceId]);
 }
 export async function selectConsumerForUpdate(db, name, instanceId) {
@@ -220,6 +228,7 @@ export async function updateConsumerRebuildCursor(db, name, instanceId, lastProc
        "last_error" = NULL,
        -- text param + cast: a JS string bound straight to ::jsonb double-encodes under Bun.SQL
        "pending_gaps" = $2::text::jsonb,
+       "last_failed_event_id" = NULL,
        "updated_at" = now()
      WHERE "name" = $3 AND "instance_id" = $4`, [lastProcessedEventId, JSON.stringify(pendingGaps), name, instanceId]);
 }
@@ -254,6 +263,7 @@ export async function removePendingGapReturning(db, name, instanceId, newPending
        "attempts" = 0,
        "last_error" = NULL,
        "rearm_count" = 0,
+       "last_failed_event_id" = NULL,
        "updated_at" = now()
      WHERE "name" = $2 AND "instance_id" = $3
      RETURNING *`, [JSON.stringify(newPendingGaps), name, instanceId]));

package/dist/engine/boot-validator/index.js

@@ -24,6 +24,7 @@ import { validateQueryRefs } from "./query-refs.js";
 import { validateRecordOwnedSubjects } from "./record-owned.js";
 import { collectScreenQns, collectScreensByShortId, validateScreenShortIdCollisions, validateScreens, } from "./screens.js";
 import { warnOnMissingSecurityBaseline } from "./security-baseline.js";
+import { validateExtensionSelectorPanels } from "./selector-owner-panels.js";
 import { validateTransferGraph } from "./transfer-graph.js";
 import { collectWorkspaceQns, resolveNavAllowlist, validateDefaultWorkspaceUniqueness, validateWorkspaces, } from "./workspaces.js";
 export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns.js";
@@ -170,6 +171,7 @@ export function validateBoot(rawFeatures, options) {
     // misleading "no search parameter in its Zod schema" error instead of
     // the clear typo message below.
     validateQueryRefs(features);
+    validateExtensionSelectorPanels(features);
     // Must also run after validateQueryRefs — column/field checks below
     // assume every `query` string already resolves to a registered handler.
     validateQueryOutputColumns(features);

package/dist/engine/boot-validator/query-output-columns.js

@@ -62,8 +62,21 @@ function checkProjectionDetailOutputFields(queryHandlers, featureName, screenId,
     };
     if (screen.header !== undefined) {
         checkHeaderField("title", screen.header.title);
-        if (screen.header.subtitle !== undefined)
-            checkHeaderField("subtitle", screen.header.subtitle);
+        const subtitle = screen.header.subtitle;
+        if (typeof subtitle === "string")
+            checkHeaderField("subtitle", subtitle);
+        else if (subtitle !== undefined) {
+            for (const part of subtitle) {
+                if (typeof part === "string") {
+                    checkHeaderField("subtitle", part);
+                    continue;
+                }
+                checkHeaderField("subtitle", part.field);
+                if (part.navigate?.entityId !== undefined) {
+                    checkHeaderField("subtitle", part.navigate.entityId);
+                }
+            }
+        }
         if (screen.header.status !== undefined)
             checkHeaderField("status", screen.header.status);
     }

package/dist/engine/boot-validator/query-refs.d.ts

@@ -1,2 +1,3 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition, QueryHandlerDef } from "../types/index.js";
+export declare function checkQueryRef(queryHandlers: ReadonlyMap<string, QueryHandlerDef>, query: string, buildPrefix: () => string): void;
 export declare function validateQueryRefs(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/query-refs.js

@@ -4,7 +4,7 @@ const NOT_REGISTERED_SUFFIX = "is not a registered query-handler. Check the QN s
 function isNonEmptyQueryString(value) {
     return typeof value === "string" && value.length > 0;
 }
-function checkQueryRef(queryHandlers, query, buildPrefix) {
+export function checkQueryRef(queryHandlers, query, buildPrefix) {
     // skip: empty/non-string queries get their own message in screens.ts;
     // a registered query has nothing left to check.
     if (!isNonEmptyQueryString(query) || queryHandlers.has(query))

package/dist/engine/boot-validator/screens.d.ts

@@ -1,6 +1,6 @@
 import type { IconKey } from "@cosmicdrift/kumiko-types/nav-icon";
 import type { FeatureDefinition } from "../types/index.js";
-import type { RelatedListToolbarAction, RowAction, RowFieldExtractor, ScreenDefinition, ToolbarAction } from "../types/screen.js";
+import type { DashboardCustomPanel, DashboardScreenPanel, RelatedListToolbarAction, RowAction, RowFieldExtractor, ScreenDefinition, ToolbarAction } from "../types/screen.js";
 export declare function rowFieldExtractorKeys(params: RowFieldExtractor): readonly string[];
 export declare function readsNavigateParamsAsFormPrefill(target: ScreenDefinition, explicitEntityId: string | undefined, sourceScreenEntity: string | undefined): boolean;
 export declare function validateActionHasIcon(featureName: string, screenId: string, screenType: "projectionDetail" | "entityEdit", context: string, action: {
@@ -20,6 +20,8 @@ export declare function validateScreens(feature: FeatureDefinition, featureMap:
     readonly featureName: string;
     readonly screen: ScreenDefinition;
 }>): void;
+export declare function validateDashboardScreenPanel(featureName: string, screenId: string, panel: DashboardScreenPanel, featureMap: ReadonlyMap<string, FeatureDefinition>): void;
+export declare function validateDashboardCustomPanel(featureName: string, screenId: string, panel: DashboardCustomPanel): void;
 export declare function validateColumnRendererForm(featureName: string, screenId: string, column: {
     readonly field: string;
     readonly renderer?: unknown;

package/dist/engine/boot-validator/screens.js

@@ -942,6 +942,37 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                     }
                 }
             }
+            if (Array.isArray(screen.header?.subtitle)) {
+                if (screen.header.subtitleHref !== undefined) {
+                    throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) sets header.subtitleHref ` +
+                        `together with a multi-part header.subtitle — subtitleHref only works with the string form.`);
+                }
+                const seenPartFields = new Set();
+                for (const part of screen.header.subtitle) {
+                    const partField = typeof part === "string" ? part : part.field;
+                    if (seenPartFields.has(partField)) {
+                        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) header.subtitle ` +
+                            `lists field "${partField}" twice.`);
+                    }
+                    seenPartFields.add(partField);
+                    const navigate = typeof part === "string" ? undefined : part.navigate;
+                    if (navigate === undefined)
+                        continue;
+                    if (navigate.screen === undefined && navigate.entity === undefined) {
+                        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) header.subtitle part ` +
+                            `"${partField}" navigates with neither "screen" nor "entity" — a tab-only navigate has no link target.`);
+                    }
+                    resolveRowActionNavigateTarget(feature.name, screenId, "projectionDetail", "subtitle part", {
+                        kind: "navigate",
+                        id: partField,
+                        label: partField,
+                        ...(navigate.screen !== undefined ? { screen: navigate.screen } : {}),
+                        ...(navigate.entity !== undefined ? { entity: navigate.entity } : {}),
+                        ...(navigate.entityId !== undefined ? { entityId: navigate.entityId } : {}),
+                        ...(navigate.tab !== undefined ? { tab: navigate.tab } : {}),
+                    }, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens);
+                }
+            }
             for (const section of screen.layout.sections) {
                 const sectionLabel = section.title ?? section.id ?? "(untitled)";
                 if (section.actions !== undefined) {
@@ -1562,7 +1593,7 @@ const EMBEDDABLE_SCREEN_TYPES = new Set([
     "configEdit",
     "secretsEdit",
 ]);
-function validateDashboardScreenPanel(featureName, screenId, panel, featureMap) {
+export function validateDashboardScreenPanel(featureName, screenId, panel, featureMap) {
     const context = `[Feature ${featureName}] Screen "${screenId}" (dashboard) screen-panel "${panel.id}"`;
     const targetQn = resolveScreenTargetQn(featureName, panel.screen);
     const [targetFeatureName = "", , targetShortId = ""] = targetQn.split(":");
@@ -1594,7 +1625,7 @@ function validateDashboardStatGroupPanel(featureName, screenId, panel, addPanelI
         }
     }
 }
-function validateDashboardCustomPanel(featureName, screenId, panel) {
+export function validateDashboardCustomPanel(featureName, screenId, panel) {
     if (panel.component.react === undefined && panel.component.native === undefined) {
         throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) custom-panel "${panel.id}" has no component — ` +
             `declare a react/native component marker.`);

package/dist/engine/boot-validator/selector-owner-panels.d.ts

@@ -0,0 +1,2 @@
+import type { FeatureDefinition } from "../types/index.js";
+export declare function validateExtensionSelectorPanels(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/selector-owner-panels.js

@@ -0,0 +1,25 @@
+import { buildQueryHandlerMap } from "./projection-list-screens.js";
+import { checkQueryRef } from "./query-refs.js";
+import { validateDashboardCustomPanel, validateDashboardScreenPanel } from "./screens.js";
+// Owner panels are merged into a dashboard that is built after boot, so the screen and
+// query refs are checked here against the registered features instead.
+export function validateExtensionSelectorPanels(features) {
+    const featureMap = new Map(features.map((feature) => [feature.name, feature]));
+    const queryHandlers = buildQueryHandlerMap(features);
+    for (const feature of features) {
+        for (const selector of feature.extensionSelectors ?? []) {
+            const where = `extensionSelector("${selector.extensionName}")`;
+            for (const panel of selector.panels ?? []) {
+                const context = `[Feature ${feature.name}] ${where} panel "${panel.id}"`;
+                if (panel.kind === "custom") {
+                    validateDashboardCustomPanel(feature.name, where, panel);
+                    continue;
+                }
+                validateDashboardScreenPanel(feature.name, where, panel, featureMap);
+                if (panel.visibleWhen !== undefined) {
+                    checkQueryRef(queryHandlers, panel.visibleWhen.query, () => `${context} visibleWhen`);
+                }
+            }
+        }
+    }
+}

package/dist/engine/boot-validator/url-prefill-fields.js

@@ -11,6 +11,12 @@ function scopeActions(actions, sourceScreenEntity, implicitParams) {
 function relatedListParentParamField(section) {
     return section.parentFilter?.field ?? section.parentParam ?? "id";
 }
+function subtitlePartNavigates(screen) {
+    const subtitle = screen.header?.subtitle;
+    if (typeof subtitle === "string" || subtitle === undefined)
+        return [];
+    return subtitle.flatMap((part) => typeof part === "string" || part.navigate === undefined ? [] : [part.navigate]);
+}
 function projectionDetailNavigateActions(screen) {
     return [
         ...scopeActions(screen.actions, screen.detailFor),
@@ -23,6 +29,7 @@ function projectionDetailNavigateActions(screen) {
         ...(screen.metrics ?? []).flatMap((metric) => typeof metric === "string" || metric.navigate === undefined
             ? []
             : scopeActions([metric.navigate], undefined)),
+        ...subtitlePartNavigates(screen).flatMap((navigate) => scopeActions([navigate], undefined)),
     ];
 }
 function navigateActionsOf(screen) {

package/dist/engine/build-config-feature-schema.js

@@ -56,6 +56,7 @@ const ELEVATED_ROLES = {
 const MACHINE_WRITE_ROLE = "system";
 const NO_SELECTOR_GATING = {
     pluginsByOwnerGroup: new Map(),
+    ownerPanelsByGroup: new Map(),
     pluginFeatures: new Set(),
     secretQns: new Set(),
 };
@@ -93,6 +94,16 @@ function collectVisibleSelectorOwners(registry, visible) {
     }
     return { ownerGroupByExtension, selectorFeatures };
 }
+function collectOwnerPanelsByGroup(registry, ownerGroupByExtension) {
+    const panelsByGroup = new Map();
+    for (const [extension, ownerGroup] of [...ownerGroupByExtension].sort(([a], [b]) => a.localeCompare(b))) {
+        const panels = registry.getExtensionSelectorPanels(extension);
+        if (panels.length === 0)
+            continue;
+        panelsByGroup.set(ownerGroup, [...(panelsByGroup.get(ownerGroup) ?? []), ...panels]);
+    }
+    return panelsByGroup;
+}
 function countSelectorUsagesByFeature(registry) {
     const usageCountByFeature = new Map();
     for (const [extensionName] of registry.getAllExtensionSelectors()) {
@@ -112,7 +123,9 @@ function planSelectorGating(registry, visible, declaredSecrets, secretsEnabled)
     if (ownerGroupByExtension.size === 0)
         return NO_SELECTOR_GATING;
     const usageCountByFeature = countSelectorUsagesByFeature(registry);
-    const pluginsByOwnerGroup = new Map();
+    const ownerPanelsByGroup = collectOwnerPanelsByGroup(registry, ownerGroupByExtension);
+    // A selector with panels but no gated plugin still becomes a dashboard.
+    const pluginsByOwnerGroup = new Map([...ownerPanelsByGroup.keys()].map((ownerGroup) => [ownerGroup, []]));
     const pluginFeatures = new Set();
     const secretQns = new Set();
     for (const [extension, ownerGroup] of [...ownerGroupByExtension].sort(([a], [b]) => a.localeCompare(b))) {
@@ -135,7 +148,7 @@ function planSelectorGating(registry, visible, declaredSecrets, secretsEnabled)
                 secretQns.add(s.qn);
         }
     }
-    return { pluginsByOwnerGroup, pluginFeatures, secretQns };
+    return { pluginsByOwnerGroup, ownerPanelsByGroup, pluginFeatures, secretQns };
 }
 // A tenant/user-home key with an elevated write role (SystemAdmin on a
 // tenant key, see ELEVATED_ROLES) surfaces the SAME feature under two
@@ -173,7 +186,7 @@ function buildFeatureScreensAndNavs(scope, visible, hub, gating, secretsAccess)
             out.navs.push(buildFeatureNav(scope, feature, ordered, access, hub.declaredTranslationKeys));
             continue;
         }
-        const ownerHub = buildSelectorOwnerDashboard(feature, ordered, access, plugins, hub, secretsAccess);
+        const ownerHub = buildSelectorOwnerDashboard(feature, ordered, access, plugins, gating.ownerPanelsByGroup.get(feature) ?? [], hub, secretsAccess);
         out.screens.push(...ownerHub.screens);
         out.navs.push(buildFeatureNav(scope, feature, ordered, ownerHub.access, hub.declaredTranslationKeys));
         Object.assign(out.translations, ownerHub.translations);
@@ -183,9 +196,20 @@ function buildFeatureScreensAndNavs(scope, visible, hub, gating, secretsAccess)
 function pluginTenantScreenId(plugin) {
     return `${plugin.feature}-tenant`;
 }
+function assertUniquePanelIds(ownerGroup, panels) {
+    const seen = new Set();
+    for (const panel of panels) {
+        if (seen.has(panel.id)) {
+            throw new Error(`Settings dashboard "${ownerGroup}-tenant" has duplicate panel id "${panel.id}" — an ` +
+                `extensionSelector panel id collides with another panel of the same dashboard.`);
+        }
+        seen.add(panel.id);
+    }
+    return panels;
+}
 // Plugin screens keep their `${F}-tenant` ids so consumer title keys stay valid;
 // they are dormant because only this dashboard embeds them.
-function buildSelectorOwnerDashboard(ownerGroup, ownerKeys, ownerAccess, plugins, hub, secretsAccess) {
+function buildSelectorOwnerDashboard(ownerGroup, ownerKeys, ownerAccess, plugins, ownerPanels, hub, secretsAccess) {
     const selectionScreenId = `${ownerGroup}-tenant-selection`;
     const selectionScreen = {
         ...buildScreen(selectionScreenId, "tenant", ownerGroup, ownerKeys, ownerAccess, hub),
@@ -240,11 +264,12 @@ function buildSelectorOwnerDashboard(ownerGroup, ownerKeys, ownerAccess, plugins
         id: `${ownerGroup}-tenant`,
         type: "dashboard",
         description: EXTENSION_SELECTOR_HINT_KEY,
-        panels: [
+        panels: assertUniquePanelIds(ownerGroup, [
             { kind: "screen", id: "selection", screen: selectionScreenId },
+            ...ownerPanels,
             ...configPanels,
             ...secretsPanels,
-        ],
+        ]),
         access,
     };
     return { screens: [dashboard, ...screens], access, translations };

package/dist/engine/changeset-changes.js

@@ -67,6 +67,12 @@ export function parseChangesetChanges(markdown, source) {
     let match = BLOCK_RE.exec(markdown);
     while (match !== null) {
         const block = match[1];
+        // BLOCK_RE closes at the first line starting with "-->"; text after it on
+        // that line means a field value contained one and the block ended early.
+        const restOfLine = markdown.slice(match.index + match[0].length).split("\n", 1)[0] ?? "";
+        if (restOfLine.trim() !== "") {
+            throw new Error(`${source}: kumiko-changes block closed early by a line starting with "-->"; field values must not contain such a line`);
+        }
         if (!block)
             throw new Error(`${source}: empty kumiko-changes block`);
         const fields = parseBlock(block, source);

package/dist/engine/entity-handlers.js

@@ -224,7 +224,7 @@ export function defineEntityWriteHandler(name, entity, options) {
     let handler;
     switch (verb) {
         case "create":
-            schema = buildInsertSchema(entity, undefined, excludedFields);
+            schema = buildInsertSchema(entity, undefined, excludedFields, { allowCallerId: true });
             handler = async (event, ctx) => {
                 const { runPreSave } = ctx;
                 // A caller-chosen id (deterministic-id idempotent creates) is only

package/dist/engine/feature-ui-extensions.d.ts

@@ -2,7 +2,7 @@ import { type WebSocketRouteDefinition } from "@cosmicdrift/kumiko-types/websock
 import type { EntityTableMeta } from "../db/entity-table-meta.js";
 import type { FeatureBuilderState } from "./feature-builder-state.js";
 import type { HttpRouteDefinition } from "./types/http-route.js";
-import type { BootCheckFn, EntityProjectionExtension, EscapeHatchDeclaration, HookPhase, LifecycleHookFn, LifecycleHookType, MultiStreamProjectionDefinition, NameOrRef, ProjectionDefinition, RegistrarExtensionDef, SearchPayloadContributorFn, StoreTableOptions, TreeActionDef, TreeActionsHandle, ValidationHookFn } from "./types/index.js";
+import type { BootCheckFn, EntityProjectionExtension, EscapeHatchDeclaration, ExtensionSelectorPanel, HookPhase, LifecycleHookFn, LifecycleHookType, MultiStreamProjectionDefinition, NameOrRef, ProjectionDefinition, RegistrarExtensionDef, SearchPayloadContributorFn, StoreTableOptions, TreeActionDef, TreeActionsHandle, ValidationHookFn } from "./types/index.js";
 import type { ContentCollectionDefinition, NavDefinition } from "./types/nav.js";
 import type { ScreenDefinition } from "./types/screen.js";
 import type { WorkspaceDefinition } from "./types/workspace.js";
@@ -21,7 +21,9 @@ export declare function buildUiExtensionsMethods<TName extends string>(state: Fe
     } & object), entityRef?: NameOrRef, options?: object): void;
     extensionSelector(extensionName: string, key: {
         readonly name: string;
-    } | string): void;
+    } | string, options?: {
+        readonly panels?: readonly ExtensionSelectorPanel[];
+    }): void;
     /**
      * Marker-Deklaration: dieses Feature stellt eine Cross-Feature-API
      * unter dem genannten Namen bereit. Die eigentliche Implementation

package/dist/engine/feature-ui-extensions.js

@@ -2,8 +2,39 @@ import { WEBSOCKET_MAX_CONNECTIONS_PER_USER_LIMIT, WEBSOCKET_MAX_PAYLOAD_BYTES,
 import { bindHookEscapeHatchGrant } from "../pipeline/system-identity-switch.js";
 import { LifecycleHookTypes } from "./constants.js";
 import { resolveName } from "./handler-helpers.js";
-import { isKebabSegment, toKebab } from "./qualified-name.js";
+import { isKebabSegment, isValidQn, qualifyEntityName, toKebab } from "./qualified-name.js";
 import { HookPhases } from "./types/index.js";
+// Builds hooks/extensions/projections/screens/nav/workspace/tables/tree-actions
+// registrar methods.
+// Id the generated owner dashboard reserves for its selector panel.
+const RESERVED_SELECTION_PANEL_ID = "selection";
+function assertSelectorPanelIds(featureName, extensionName, panels) {
+    const seen = new Set();
+    for (const { id } of panels) {
+        if (id === "" || id === RESERVED_SELECTION_PANEL_ID || seen.has(id)) {
+            throw new Error(`[Feature ${featureName}] extensionSelector("${extensionName}") panel id "${id}" must be unique, ` +
+                `non-empty and not "${RESERVED_SELECTION_PANEL_ID}" (reserved for the selector panel).`);
+        }
+        seen.add(id);
+    }
+}
+// The owner dashboard lives in the "config" namespace, so a short screen ref must be
+// qualified against the declaring feature here. Untyped authors can pass other kinds.
+function qualifySelectorPanel(featureName, panel) {
+    if (panel.kind === "custom")
+        return panel;
+    if (panel.kind === "screen") {
+        if ("label" in panel) {
+            throw new Error(`[Feature ${featureName}] extensionSelector screen panel "${panel.id}" must not set a label — ` +
+                `the settings dashboard has no i18n namespace for it; the embedded screen carries its own title.`);
+        }
+        if (panel.screen === "" || isValidQn(panel.screen))
+            return panel;
+        return { ...panel, screen: qualifyEntityName(featureName, "screen", panel.screen) };
+    }
+    throw new Error(`[Feature ${featureName}] extensionSelector panel ${JSON.stringify(panel)} has an unsupported kind — ` +
+        `only "custom" and "screen" panels are allowed.`);
+}
 function isEntityWideHookType(type) {
     return (type === LifecycleHookTypes.postSave ||
         type === LifecycleHookTypes.preDelete ||
@@ -184,13 +215,19 @@ export function buildUiExtensionsMethods(state, name) {
                 options: optionsBag,
             });
         },
-        extensionSelector(extensionName, key) {
+        extensionSelector(extensionName, key, options) {
             if (state.extensionSelectors.some((s) => s.extensionName === extensionName)) {
                 throw new Error(`[Feature ${name}] extensionSelector("${extensionName}") declared twice — ` +
                     `one selector key per extension point.`);
             }
             const qualifiedKey = typeof key === "string" ? key : key.name;
-            state.extensionSelectors.push({ extensionName, qualifiedKey });
+            const panels = options?.panels?.map((panel) => qualifySelectorPanel(name, panel));
+            assertSelectorPanelIds(name, extensionName, panels ?? []);
+            state.extensionSelectors.push({
+                extensionName,
+                qualifiedKey,
+                ...(panels !== undefined && { panels }),
+            });
         },
         /**
          * Marker-Deklaration: dieses Feature stellt eine Cross-Feature-API

package/dist/engine/index.d.ts

@@ -71,7 +71,7 @@ export { describeWorkflowStepError } from "./steps/describe-workflow-step-error.
 export { ANONYMOUS_ROLE, ANONYMOUS_USER_ID, createAnonymousUser, createSystemUser, SYSTEM_ROLE, SYSTEM_USER_ID, } from "./system-user.js";
 export { type EffectiveFeaturesResolver, findTierResolverUsage, isTierResolverPlugin, TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin, type TrialGate, } from "./tier-resolver-extension.js";
 export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID } from "./types/identifiers.js";
-export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, CamelToKebab, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DateFieldDef, DecimalFieldDef, DeleteContext, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EntityDefinition, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationRecipientFn, NotificationTemplateFn, NotifyFactory, NotifyFn, NotifyOptions, NotifyPriority, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RecordHeaderSpec, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TenantId, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.js";
+export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, CamelToKebab, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DateFieldDef, DecimalFieldDef, DeleteContext, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EntityDefinition, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationRecipientFn, NotificationTemplateFn, NotifyFactory, NotifyFn, NotifyOptions, NotifyPriority, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TenantId, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.js";
 export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, HookPhases, isAgentVisibleScreen, isOpenToAllGranted, resolveAgentExposure, } from "./types/index.js";
 export type { AwaitedEventType, PipelineBuildCtx, PipelineCtx, PipelineDef, StepBuilder, StepDef, StepFailureStrategy, StepInstance, StepKind, StepNamespace, StepResolver, } from "./types/step.js";
 export { runValidation } from "./validation.js";

package/dist/engine/project-app-schema-for-roles.js

@@ -401,6 +401,22 @@ function projectMetrics(metrics, indices, keptScreenQns) {
     });
     return changed ? next : metrics;
 }
+function projectHeader(header, indices, keptScreenQns) {
+    const subtitle = header?.subtitle;
+    if (header === undefined || typeof subtitle === "string" || subtitle === undefined) {
+        return header;
+    }
+    let changed = false;
+    const nextParts = subtitle.map((part) => {
+        if (typeof part === "string" || part.navigate === undefined)
+            return part;
+        if (keepMetricNavigate(part.navigate, indices, keptScreenQns))
+            return part;
+        changed = true;
+        return part.field;
+    });
+    return changed ? { ...header, subtitle: nextParts } : header;
+}
 function projectDashboardPanels(panels, feature, keptScreenQns) {
     const kept = panels.filter((p) => p.kind !== "screen" || isScreenTargetKept(feature.featureName, p.screen, keptScreenQns));
     return kept.length === panels.length ? panels : kept;
@@ -451,12 +467,14 @@ function projectListScreen(original, feature, indices, keptScreenQns) {
     };
 }
 function projectProjectionDetailScreen(screen, feature, indices, keptScreenQns) {
-    const { metrics, actions, layout, listScreenId, ...rest } = screen;
+    const { metrics, header, actions, layout, listScreenId, ...rest } = screen;
     const nextMetrics = projectMetrics(metrics, indices, keptScreenQns);
+    const nextHeader = projectHeader(header, indices, keptScreenQns);
     const nextActions = projectRowActionArray(actions, feature, indices, keptScreenQns);
     const nextLayout = projectEditLayout(layout, feature, indices, keptScreenQns);
     const nextListScreenId = projectListScreenId(listScreenId, indices, keptScreenQns);
     const unchanged = nextMetrics === metrics &&
+        nextHeader === header &&
         nextActions === actions &&
         nextLayout === layout &&
         nextListScreenId === listScreenId;
@@ -465,6 +483,7 @@ function projectProjectionDetailScreen(screen, feature, indices, keptScreenQns)
     return {
         ...rest,
         layout: nextLayout,
+        ...(nextHeader !== undefined && { header: nextHeader }),
         ...(nextMetrics !== undefined && { metrics: nextMetrics }),
         ...(nextActions !== undefined && { actions: nextActions }),
         ...(nextListScreenId !== undefined && { listScreenId: nextListScreenId }),

package/dist/engine/registry-facade.js

@@ -149,6 +149,9 @@ export function buildRegistryFacade(state) {
         getAllExtensionSelectors() {
             return state.extensionSelectorMap;
         },
+        getExtensionSelectorPanels(extensionName) {
+            return state.extensionSelectorPanelsMap.get(extensionName) ?? [];
+        },
         getAllNotifications() {
             return state.notificationMap;
         },

package/dist/engine/registry-ingest.js

@@ -189,6 +189,8 @@ export function populateExtensionsAndSeeds(state, feature) {
                 `(feature "${feature.name}") — one owning feature declares the selector.`);
         }
         state.extensionSelectorMap.set(sel.extensionName, sel.qualifiedKey);
+        if (sel.panels !== undefined)
+            state.extensionSelectorPanelsMap.set(sel.extensionName, sel.panels);
     }
     state.allReferenceData.push(...(feature.referenceData ?? []));
     state.allConfigSeeds.push(...(feature.configSeeds ?? []));

package/dist/engine/registry-state.d.ts

@@ -1,5 +1,5 @@
 import { type QnType, qualifyEntityName } from "./qualified-name.js";
-import type { AuthClaimsHookDef, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventDef, EventUpcastFn, FeatureDefinition, FeatureMetricDef, HookPhase, JobDefinition, MultiStreamProjectionDefinition, NavDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, ScreenDefinition, SearchPayloadContributorFn, SecretKeyDefinition, StoreTableDef, StreamHandlerDef, TranslationValue, TreeActionDef, WorkspaceDefinition, WriteHandlerDef } from "./types/index.js";
+import type { AuthClaimsHookDef, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventDef, EventUpcastFn, ExtensionSelectorPanel, FeatureDefinition, FeatureMetricDef, HookPhase, JobDefinition, MultiStreamProjectionDefinition, NavDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, ScreenDefinition, SearchPayloadContributorFn, SecretKeyDefinition, StoreTableDef, StreamHandlerDef, TranslationValue, TreeActionDef, WorkspaceDefinition, WriteHandlerDef } from "./types/index.js";
 export type IncomingRelation = {
     sourceEntity: string;
     relationName: string;
@@ -46,6 +46,7 @@ export type RegistryState = {
     extensionMap: Map<string, RegistrarExtensionDef>;
     extensionUsages: RegistrarExtensionRegistration[];
     extensionSelectorMap: Map<string, string>;
+    extensionSelectorPanelsMap: Map<string, readonly ExtensionSelectorPanel[]>;
     allReferenceData: ReferenceDataDef[];
     allConfigSeeds: ConfigSeedDef[];
     mergedTranslations: Record<string, Record<string, TranslationValue>>;

package/dist/engine/registry-state.js

@@ -116,6 +116,7 @@ export function createInitialState() {
         extensionMap: new Map(),
         extensionUsages: [],
         extensionSelectorMap: new Map(),
+        extensionSelectorPanelsMap: new Map(),
         allReferenceData: [],
         allConfigSeeds: [],
         mergedTranslations: {},

package/dist/engine/schema-builder.d.ts

@@ -4,5 +4,7 @@ export declare function isRepresentableAtScale(n: number, scale: number): boolea
 export declare function fieldToZod(field: FieldDefinition, currencies: readonly string[], opts?: {
     readonly applyDefaults?: boolean;
 }): z.ZodTypeAny;
-export declare function buildInsertSchema(entity: EntityDefinition, currencies?: readonly string[], excludedFields?: readonly string[]): z.ZodObject<Record<string, z.ZodTypeAny>>;
+export declare function buildInsertSchema(entity: EntityDefinition, currencies?: readonly string[], excludedFields?: readonly string[], options?: {
+    readonly allowCallerId?: boolean;
+}): z.ZodObject<Record<string, z.ZodTypeAny>>;
 export declare function buildUpdateSchema(entity: EntityDefinition, currencies?: readonly string[], excludedFields?: readonly string[]): z.ZodObject<Record<string, z.ZodTypeAny>>;

package/dist/engine/schema-builder.js

@@ -366,7 +366,7 @@ function applyTotalsMatchRefinements(entity, schema) {
 function notWritableField() {
     return z.never().optional();
 }
-export function buildInsertSchema(entity, currencies = [...DEFAULT_CURRENCIES], excludedFields = []) {
+export function buildInsertSchema(entity, currencies = [...DEFAULT_CURRENCIES], excludedFields = [], options = {}) {
     const shape = {};
     for (const [name, field] of Object.entries(entity.fields)) {
         if (excludedFields.includes(name)) {
@@ -378,11 +378,10 @@ export function buildInsertSchema(entity, currencies = [...DEFAULT_CURRENCIES],
         const isRequired = "required" in field && field.required === true;
         shape[name] = isRequired || hasDefault ? zodField : zodField.optional();
     }
-    // Caller-chosen aggregate id for idempotent creates (deterministic-id
-    // patterns). Accepting it here only lets it survive parsing — the create
-    // handler still honors it only for a system-identity caller (jobs/hooks
-    // via createSystemUser), never for an ordinary HTTP-authenticated user.
-    shape["id"] = z.uuid().optional();
+    // Opt-in only for the generic create verb, which honors the id for system identities;
+    // other schema consumers must keep stripping an unknown `id`.
+    if (options.allowCallerId)
+        shape["id"] = z.uuid().optional();
     return applyTotalsMatchRefinements(entity, z.object(shape));
 }
 export function buildUpdateSchema(entity, currencies = [...DEFAULT_CURRENCIES], excludedFields = []) {

package/dist/engine/types/index.d.ts

@@ -1,5 +1,5 @@
 export { isAgentVisibleScreen, resolveAgentExposure, } from "@cosmicdrift/kumiko-types/agent-exposure";
-export type { ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigBounds, ConfigCascade, ConfigCascadeLevel, ConfigComputedContext, ConfigComputedFn, ConfigDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValue, ConfigValueSource, ConfigValueWithSource, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, ExtensionSelectorDef, JobBackoff, JobBackoffStrategy, JobDefinition, JobHandlerFn, JobRunIn, JobTrigger, NotificationDataFn, NotificationDefinition, NotificationRecipientFn, NotificationTemplateFn, PluralForms, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionHooks, RegistrarExtensionRegistration, RunIn, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, UiExtensionDef, } from "@cosmicdrift/kumiko-types/config";
+export type { ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigBounds, ConfigCascade, ConfigCascadeLevel, ConfigComputedContext, ConfigComputedFn, ConfigDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValue, ConfigValueSource, ConfigValueWithSource, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, ExtensionSelectorDef, ExtensionSelectorPanel, JobBackoff, JobBackoffStrategy, JobDefinition, JobHandlerFn, JobRunIn, JobTrigger, NotificationDataFn, NotificationDefinition, NotificationRecipientFn, NotificationTemplateFn, PluralForms, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionHooks, RegistrarExtensionRegistration, RunIn, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, UiExtensionDef, } from "@cosmicdrift/kumiko-types/config";
 export type { QueryHandlerDefinition, StreamHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput, } from "@cosmicdrift/kumiko-types/define-handler";
 export type { EntityCrudRegistrar, EntityCrudVerb, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions, } from "@cosmicdrift/kumiko-types/entity-handlers";
 export type { KumikoEntityTypeMap, KumikoEventTypeMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, } from "@cosmicdrift/kumiko-types/event-type-map";
@@ -17,7 +17,7 @@ export type { ContentCollectionDefinition, NavDefinition, NavIconKey, } from "@c
 export type { FromRule, FromRuleKind, OwnershipClause, OwnershipMap, OwnershipRef, OwnershipRule, SqlFragment, WhereRule, WhereRuleContext, } from "@cosmicdrift/kumiko-types/ownership";
 export type { EntityProjectionExtension, MspErrorMode, MspErrorPolicy, MultiStreamApplyFn, MultiStreamProjectionDefinition, ProjectionDefinition, ProjectionTable, SingleStreamApplyFn, } from "@cosmicdrift/kumiko-types/projection";
 export type { BelongsToRelation, EntityRelations, HasManyRelation, ManyToManyRelation, RelationDefinition, } from "@cosmicdrift/kumiko-types/relations";
-export type { ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, FieldCondition, FieldFormatRegistry, FieldRenderer, FormatSpec, FormWidth, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, UnitKey, } from "@cosmicdrift/kumiko-types/screen";
+export type { ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, FieldCondition, FieldFormatRegistry, FieldRenderer, FormatSpec, FormWidth, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RecordHeaderSubtitlePart, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, UnitKey, } from "@cosmicdrift/kumiko-types/screen";
 export { metricField } from "@cosmicdrift/kumiko-types/screen";
 export type { TargetRef } from "@cosmicdrift/kumiko-types/target-ref";
 export type { Subscribe, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, } from "@cosmicdrift/kumiko-types/tree-node";

package/dist/errors/reasons.js

@@ -66,16 +66,17 @@ export const FrameworkReasons = {
 // sister catalog to FrameworkReasons instead of extending it — see the
 // file-header note above for why these carry the `agent.` prefix.
 export const AgentReasons = {
-    // AccessDeniedError: the agent called a tool name outside its allowed
-    // catalog for this run.
+    // Error turn in the agent loop when the model requests a tool outside the
+    // run's catalog; UnprocessableError in rule validation (handler missing from
+    // the caller's role-filtered manifest, or `ai-agent-edit` not mounted).
     toolNotAllowed: "agent.tool_not_allowed",
-    // UnprocessableError: the agent loop hit its maximum round count before
-    // producing a final answer.
+    // Not thrown: the run ends with a `clarify` turn (`payload.reason`) once
+    // MAX_AGENT_ROUNDS is reached.
     iterationLimit: "agent.iteration_limit",
     // AccessDeniedError: the tool exists, but the caller's roles don't cover
     // the handler behind it.
     permissionDenied: "agent.permission_denied",
-    // AccessDeniedError: an `agent.risk: "high"` handler was invoked without
-    // the required explicit confirmation.
+    // UnprocessableError: a permission rule with `always` was requested for an
+    // `agent: { risk: "high" }` handler; `details.handlerQn` names it.
     highRiskNoAlways: "agent.high_risk_no_always",
 };

package/dist/pipeline/dispatch-write.js

@@ -1,6 +1,7 @@
 import { selectRowForUpdateById } from "../db/queries/entity-read.js";
 import { asEntityTableMeta, selectMany } from "../db/query.js";
 import { buildEntityTable, toSnakeCase } from "../db/table-builder.js";
+import { createTenantDb, hasTenantColumn } from "../db/tenant-db.js";
 import { tenantDbRunner } from "../db/tenant-db-runner.js";
 import { hasAccess } from "../engine/access.js";
 import { ConfigScopes } from "../engine/constants.js";
@@ -126,6 +127,24 @@ function isForeignTenantParentRow(parentRow, user) {
     const rowTenantId = parentRow["tenantId"];
     return typeof rowTenantId === "string" && rowTenantId !== user.tenantId;
 }
+// A custom create handler may return a row without a string tenantId; the row's
+// tenant is then unknown from the payload, so re-read it through the caller's tenant
+// filter. Fail-closed: anything that cannot be verified counts as not visible.
+// Tenant reads also return SYSTEM reference rows, so the row's own tenantId must match
+// (same rule as the string path) unless the entity has no tenant column.
+async function isParentRowHiddenFromCaller(ctx, parentEntityName, parentId, user, tx) {
+    if (parentEntityName === undefined)
+        return true;
+    const table = getTable(ctx, parentEntityName);
+    const source = resolveDbSource(ctx, tx);
+    if (!table || !source)
+        return true;
+    const callerDb = createTenantDb(source, user.tenantId, "tenant");
+    const visibleRow = await callerDb.fetchOne(table, { id: parentId });
+    if (visibleRow === undefined)
+        return true;
+    return hasTenantColumn(table) && visibleRow["tenantId"] !== user.tenantId;
+}
 // Nested-write orchestration (v1: depth=1, create-only, hasMany-only).
 //
 // When a parent `:create` handler's payload carries values under keys
@@ -199,13 +218,18 @@ export async function executeNestedWrite(ctx, type, payload, user, origin, tx, a
         }));
     }
     // A custom create handler may return an existing foreign row; verify it before attaching children.
-    if (!registry.isHandlerSystemScoped(type) && isForeignTenantParentRow(parentRow, user)) {
+    const parentEntityName = registry.getHandlerEntity(type);
+    const isCallerScoped = !registry.isHandlerSystemScoped(type);
+    const isParentForeign = isCallerScoped &&
+        (typeof parentRow["tenantId"] === "string"
+            ? isForeignTenantParentRow(parentRow, user)
+            : await isParentRowHiddenFromCaller(ctx, parentEntityName, parentId, user, tx));
+    if (isParentForeign) {
         return writeFailure(new AccessDeniedError({
             message: `nested-write: parent row belongs to another tenant — refusing to attach children to "${type}"`,
             details: { reason: FrameworkReasons.fieldAccessDenied, handler: type },
         }));
     }
-    const parentEntityName = registry.getHandlerEntity(type);
     if (parentEntityName) {
         const parentEntity = registry.getEntity(parentEntityName);
         if (parentEntity) {

package/dist/pipeline/event-consumer-state.js

@@ -29,6 +29,10 @@ export const eventConsumerStateTable = pgTable("kumiko_event_consumers", {
     // skipPoisonEvent() — an operator vouching the consumer is healthy.
     rearmCount: integer("rearm_count").notNull().default(0),
     pendingGaps: jsonb("pending_gaps").$type().default([]).notNull(),
+    // Id of the event whose handler failed last (halt-on-poison). skipPoisonEvent
+    // skips exactly this id; guessing the smallest visible id would drop a healthy
+    // writer that committed late into a pending gap. Null once a delivery succeeds.
+    lastFailedEventId: bigint("last_failed_event_id", { mode: "bigint" }),
     lastError: text("last_error"),
     updatedAt: instant("updated_at", { precision: 3 }).notNull().default(sql `now()`),
 }, (t) => ({
@@ -78,6 +82,8 @@ export async function createEventConsumerStateTable(db) {
         /* ifNotExists */ true);
         await alterTableAddColumn(db, "kumiko_event_consumers", "pending_gaps", "jsonb", " DEFAULT '[]'::jsonb", " NOT NULL", 
         /* ifNotExists */ true);
+        await alterTableAddColumn(db, "kumiko_event_consumers", "last_failed_event_id", "bigint", "", "", 
+        /* ifNotExists */ true);
         // Runs on every boot, including mid-rolling-deploy: a new pod can delete
         // an old pod's still-in-use per-instance row out from under it. That old
         // pod's next acquireConsumer then finds no row, delivers no more SSE/

package/dist/pipeline/event-dispatcher-admin.js

@@ -1,8 +1,8 @@
-import { advanceConsumerPastEventReturning, removePendingGapReturning, updateConsumerStatusReturning, } from "../db/queries/event-consumer.js";
+import { advanceConsumerPastEventReturning, removePendingGapReturning, selectSnapshotXmax, updateConsumerStatusReturning, } from "../db/queries/event-consumer.js";
 import { selectNextEventIdAfter, selectSmallestVisibleIdInRanges, } from "../db/queries/event-store.js";
 import { coerceRow, extractTableInfo, selectMany } from "../db/query.js";
 import { getEventsHighWaterMark } from "../event-store/index.js";
-import { eventConsumerStateTable, SHARED_INSTANCE_SENTINEL } from "./event-consumer-state.js";
+import { eventConsumerStateTable, SHARED_INSTANCE_SENTINEL, } from "./event-consumer-state.js";
 import { rangeContainsId, splitRangeExcludingIds, toIdRanges } from "./pending-gap-ranges.js";
 // --- Ops recovery surface ---
 //
@@ -76,29 +76,38 @@ export async function enableConsumer(db, name, instanceId = SHARED_INSTANCE_SENT
     }
     return applyConsumerStatusTransition(db, name, instanceId, "idle");
 }
-// skipPoisonEvent advances past whatever is currently blocking the consumer.
-// If the smallest visible id inside pending_gaps exists, THAT'S the poison —
-// halt-on-poison walks gap ids before any id past the cursor — so it's split
-// out of its range directly; the cursor stays put (it's already above this
-// id). Otherwise the poison is the usual next event after the cursor. Single
-// TX so concurrent dispatcher passes can't double-advance. Neither exists →
-// idempotent no-op.
+// skipPoisonEvent skips the event whose handler failed last
+// (last_failed_event_id, set by the delivery's halt-on-poison branch): inside
+// pending_gaps it is split out of its range, otherwise the cursor moves onto
+// it. Without a recorded id (consumer parked before that column existed) it
+// falls back to a guess: the smallest visible pending-gap id, else the next
+// event after the cursor. Single TX so concurrent dispatcher passes can't
+// double-advance. Nothing to skip → idempotent no-op.
 export async function skipPoisonEvent(db, name, instanceId = SHARED_INSTANCE_SENTINEL) {
     const before = await requireConsumerRow(db, name, instanceId);
     return db.begin(async (tx) => {
         const pendingGaps = before.pendingGaps;
-        const smallestVisiblePending = await selectSmallestVisibleIdInRanges(tx, toIdRanges(pendingGaps));
-        if (smallestVisiblePending !== null) {
-            const newPendingGaps = pendingGaps.flatMap((gap) => rangeContainsId(gap, smallestVisiblePending)
-                ? splitRangeExcludingIds(gap, [smallestVisiblePending])
+        const failedEventId = before.lastFailedEventId;
+        const failedIsPending = failedEventId !== null && pendingGaps.some((gap) => rangeContainsId(gap, failedEventId));
+        const failedIsAboveCursor = failedEventId !== null && failedEventId > before.lastProcessedEventId;
+        const pendingPoisonId = failedIsPending
+            ? failedEventId
+            : failedIsAboveCursor
+                ? null
+                : await selectSmallestVisibleIdInRanges(tx, toIdRanges(pendingGaps));
+        if (pendingPoisonId !== null) {
+            const newPendingGaps = pendingGaps.flatMap((gap) => rangeContainsId(gap, pendingPoisonId)
+                ? splitRangeExcludingIds(gap, [pendingPoisonId])
                 : [gap]);
             const raw = await removePendingGapReturning(tx, name, instanceId, newPendingGaps);
             const updated = raw && coerceRow(raw, extractTableInfo(eventConsumerStateTable));
             if (!updated)
                 throw new Error(`Consumer "${name}" (instance_id="${instanceId}") vanished mid-skip — retry.`);
-            return { ...normalizeConsumerState(updated), skippedEventId: smallestVisiblePending };
+            return { ...normalizeConsumerState(updated), skippedEventId: pendingPoisonId };
         }
-        const poisonId = await selectNextEventIdAfter(tx, before.lastProcessedEventId);
+        const poisonId = failedIsAboveCursor
+            ? failedEventId
+            : await selectNextEventIdAfter(tx, before.lastProcessedEventId);
         if (poisonId === null) {
             const [unchanged] = await selectMany(tx, eventConsumerStateTable, {
                 name,
@@ -108,7 +117,18 @@ export async function skipPoisonEvent(db, name, instanceId = SHARED_INSTANCE_SEN
                 throw new Error(`Consumer "${name}" (instance_id="${instanceId}") vanished — retry.`);
             return { ...normalizeConsumerState(unchanged), skippedEventId: null };
         }
-        const raw = await advanceConsumerPastEventReturning(tx, name, instanceId, poisonId);
+        // Delivery stops at the poison event, so ids between the cursor and it were
+        // invisible during that pass (in-flight commits). Jumping the cursor over them
+        // would lose them; keep them as a pending gap like the dispatcher's own gaps.
+        const skippedWindowStart = before.lastProcessedEventId + 1n;
+        const gapToAdd = poisonId > skippedWindowStart
+            ? {
+                from: skippedWindowStart.toString(),
+                to: (poisonId - 1n).toString(),
+                xmax: await selectSnapshotXmax(tx),
+            }
+            : null;
+        const raw = await advanceConsumerPastEventReturning(tx, name, instanceId, poisonId, gapToAdd);
         const updated = raw && coerceRow(raw, extractTableInfo(eventConsumerStateTable));
         if (!updated)
             throw new Error(`Consumer "${name}" (instance_id="${instanceId}") vanished mid-skip — retry.`);

package/dist/pipeline/event-dispatcher-delivery.d.ts

@@ -13,6 +13,7 @@ export type ConsumerStateRowShape = {
     readonly attempts: number;
     readonly rearmCount: number;
     readonly pendingGaps: readonly PendingGapEntry[];
+    readonly lastFailedEventId: bigint | null;
     readonly lastError: string | null;
     readonly updatedAt: Temporal.Instant;
 };
@@ -58,6 +59,7 @@ export type DeliveryOutcome = {
     readonly deadLettered: boolean;
     readonly processed: number;
     readonly failed: number;
+    readonly failedEventId: bigint | null;
     readonly resolvedPendingIds: readonly bigint[];
 };
 export declare function deliverEvents(consumer: EventConsumer, events: ReadonlyArray<StoredEventRow>, context: AppContext, maxAttempts: number, state: ConsumerStateRow): Promise<DeliveryOutcome>;

package/dist/pipeline/event-dispatcher-delivery.js

@@ -171,6 +171,7 @@ export async function deliverEvents(consumer, events, context, maxAttempts, stat
     const effectiveMaxAttempts = consumer.errorPolicy?.maxAttempts ?? maxAttempts;
     let processed = 0;
     let failed = 0;
+    let failedEventId = null;
     const resolvedPendingIds = [];
     // A pending row sits below startCursor: it resolves its gap but never moves
     // the cursor backward. ORDER BY id walks all pending rows first.
@@ -188,7 +189,16 @@ export async function deliverEvents(consumer, events, context, maxAttempts, stat
             for (const row of events)
                 resolve(row.id);
             processed = events.length;
-            return { cursor, attempts, lastError, deadLettered, processed, failed, resolvedPendingIds };
+            return {
+                cursor,
+                attempts,
+                lastError,
+                deadLettered,
+                processed,
+                failed,
+                failedEventId,
+                resolvedPendingIds,
+            };
         }
         // fall through to the per-event loop below; the batch failure itself
         // does NOT bump attempts — only a per-event failure does.
@@ -209,12 +219,22 @@ export async function deliverEvents(consumer, events, context, maxAttempts, stat
             }
             attempts += 1;
             lastError = errMessage;
+            failedEventId = row.id;
             if (attempts >= effectiveMaxAttempts)
                 deadLettered = true;
             break;
         }
     }
-    return { cursor, attempts, lastError, deadLettered, processed, failed, resolvedPendingIds };
+    return {
+        cursor,
+        attempts,
+        lastError,
+        deadLettered,
+        processed,
+        failed,
+        failedEventId,
+        resolvedPendingIds,
+    };
 }
 // Shared requestContext scope for one apply — event-derived fields
 // (correlationId, causationId, writeOrigin) come from `causationSource`;

package/dist/pipeline/event-dispatcher.js

@@ -331,6 +331,7 @@ export function createEventDispatcher(options) {
                         deadLettered: false,
                         processed: 0,
                         failed: 0,
+                        failedEventId: acquired.state.lastFailedEventId,
                         resolvedPendingIds: [],
                     };
                 processed = outcome.processed;

package/dist/ui-types/index.d.ts

@@ -9,7 +9,7 @@ export type { BooleanFieldDef, DateFieldDef, EmbeddedDerivedCellDef, EntityDefin
 export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, RoleAccessPersonalData, RoleAccessRule, } from "../engine/types/handlers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
 export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav.js";
-export type { ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartPanel, DashboardChartTone, DashboardCustomPanel, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardTimeRangeDefinition, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RelatedListToolbarAction, RowAction, RowActionDrawer, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.js";
+export type { ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartPanel, DashboardChartTone, DashboardCustomPanel, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardTimeRangeDefinition, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListToolbarAction, RowAction, RowActionDrawer, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.js";
 export { metricField } from "../engine/types/screen.js";
 export type { TargetRef } from "../engine/types/target-ref.js";
 export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.331.0",
+  "version": "0.332.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -206,8 +206,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.331.0",
-    "@cosmicdrift/kumiko-types": "0.331.0",
+    "@cosmicdrift/kumiko-http": "0.332.0",
+    "@cosmicdrift/kumiko-types": "0.332.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -223,7 +223,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.331.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.332.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,44 @@
 [
+  {
+    "version": "0.332.0",
+    "type": "fix",
+    "title": "agent reason developer texts match the actual error types"
+  },
+  {
+    "version": "0.332.0",
+    "type": "breaking",
+    "title": "buildInsertSchema strips id again; caller-chosen ids need { allowCallerId: true }",
+    "migration": "Custom-Create-Handler, die eine caller-gewaehlte id brauchen, uebergeben { allowCallerId: true } und erlauben sie nur System-Identities."
+  },
+  {
+    "version": "0.332.0",
+    "type": "fix",
+    "title": "early-closed kumiko-changes blocks fail with a clear error"
+  },
+  {
+    "version": "0.332.0",
+    "type": "improvement",
+    "title": "A selector owner can add its own custom or screen panels to the generated settings page (extensionSelector panels)",
+    "detail": "`r.extensionSelector(extension, key, { panels })` lets the selector owner add its own `custom` or `screen` panels to the generated `<ownerGroup>-tenant` settings dashboard, after the selection panel and before the plugin panels. Short `screen` refs resolve against the declaring feature. Dead screen or `visibleWhen` query refs, empty, duplicate or `selection` panel ids fail at boot or declaration.",
+    "migration": "No code change needed."
+  },
+  {
+    "version": "0.332.0",
+    "type": "breaking",
+    "title": "ctx.fetchForWriting scopes handle.events to the aggregateType since the #2979 release (correction, not purely additive)",
+    "detail": "The #2979 changeset described the `aggregateType` filter as \"purely additive\". For `ctx.fetchForWriting` that was wrong: since that release, `handle.events` only contains events of the fetched aggregateType, even when a handler never passed an `aggregateType` option. Events of another aggregateType on the same aggregateId are no longer part of the handle. `loadAggregate` without `aggregateType` is unchanged.",
+    "migration": "handle.events von ctx.fetchForWriting ist seit Einführung des aggregateType-Filters\ntyp-gescoped; Handler prüfen, die Events eines anderen aggregateType auf derselben\naggregateId erwartet haben, und diese per loadAggregate ohne aggregateType lesen."
+  },
+  {
+    "version": "0.332.0",
+    "type": "fix",
+    "title": "Nested-write parent tenant check fails closed for parent rows without tenantId"
+  },
+  {
+    "version": "0.332.0",
+    "type": "fix",
+    "title": "skipPoisonEvent skips the actually failed event via kumiko_event_consumers.last_failed_event_id"
+  },
   {
     "version": "0.331.0",
     "type": "fix",