@cosmicdrift/kumiko-framework 0.331.0 → 0.333.0

package/dist/db/blind-index-cleanup.d.ts

@@ -3,3 +3,4 @@ import type { DbRunner } from "./connection.js";
 export declare function nullBlindIndexesForSubject(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, subjectKey: string): Promise<void>;
 export declare function subjectRowExistsInTenant(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, subjectId: string, tenantId: string): Promise<boolean>;
 export declare function recordRowExistsInTenant(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, entityName: string, recordId: string, tenantId: string): Promise<boolean>;
+export declare function recordRowOwningTenantId(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, entityName: string, recordId: string): Promise<string | undefined>;

package/dist/db/blind-index-cleanup.js

@@ -110,3 +110,15 @@ export async function recordRowExistsInTenant(db, features, entityName, recordId
     const rows = await executeRawQueryRead(db, `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`, [recordId, tenantId]);
     return rows.length > 0;
 }
+// Owning tenant of a record subject's row, for callers that must evaluate
+// tenant-scoped policy for the row's real owner (not the acting user's tenant).
+export async function recordRowOwningTenantId(db, features, entityName, recordId) {
+    const entity = findEntityByExactName(features, entityName);
+    if (!entity)
+        return undefined;
+    const tableName = resolveTableName(entityName, entity, undefined);
+    if (!(await tableExists(db, tableName)))
+        return undefined;
+    const rows = await executeRawQueryRead(db, `SELECT tenant_id FROM ${quoteIdent(tableName)} WHERE id = $1 LIMIT 1`, [recordId]);
+    return rows[0]?.tenant_id;
+}

package/dist/db/index.d.ts

@@ -1,5 +1,5 @@
 export { assertExistsIn } from "./assert-exists-in.js";
-export { nullBlindIndexesForSubject, recordRowExistsInTenant, subjectRowExistsInTenant, } from "./blind-index-cleanup.js";
+export { nullBlindIndexesForSubject, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "./blind-index-cleanup.js";
 export { collectTableMetas } from "./collect-table-metas.js";
 export { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
 export { seedConfigValues } from "./config-seed.js";

package/dist/db/index.js

@@ -1,5 +1,5 @@
 export { assertExistsIn } from "./assert-exists-in.js";
-export { nullBlindIndexesForSubject, recordRowExistsInTenant, subjectRowExistsInTenant, } from "./blind-index-cleanup.js";
+export { nullBlindIndexesForSubject, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "./blind-index-cleanup.js";
 export { collectTableMetas } from "./collect-table-metas.js";
 export { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
 export { seedConfigValues } from "./config-seed.js";

package/dist/db/queries/event-consumer.d.ts

@@ -24,10 +24,11 @@ export type ConsumerDeliveryOutcome = {
     readonly deadLettered: boolean;
     readonly processed: number;
     readonly pendingGaps: readonly PendingGapEntry[];
+    readonly failedEventId: bigint | null;
 };
 export declare function updateConsumerDeliveryOutcome(db: AnyDb, name: string, instanceId: string, outcome: ConsumerDeliveryOutcome): Promise<void>;
 export declare function updateConsumerStatusReturning(db: AnyDb, name: string, instanceId: string, status: "idle" | "disabled"): Promise<Record<string, unknown> | undefined>;
-export declare function advanceConsumerPastEventReturning(db: AnyDb, name: string, instanceId: string, eventId: bigint): Promise<Record<string, unknown> | undefined>;
+export declare function advanceConsumerPastEventReturning(db: AnyDb, name: string, instanceId: string, eventId: bigint, gapToAdd?: PendingGapEntry | null): Promise<Record<string, unknown> | undefined>;
 export declare function resetConsumerForMspRebuild(db: AnyDb, name: string, instanceId: string): Promise<void>;
 export declare function selectConsumerForUpdate(db: AnyDb, name: string, instanceId: string): Promise<Record<string, unknown> | undefined>;
 export declare function updateConsumerRebuildCursor(db: AnyDb, name: string, instanceId: string, lastProcessedEventId: bigint, pendingGaps: readonly PendingGapEntry[]): Promise<void>;

package/dist/db/queries/event-consumer.js

@@ -167,6 +167,7 @@ export async function updateConsumerDeliveryOutcome(db, name, instanceId, outcom
        "rearm_count" = CASE WHEN $5 THEN 0 ELSE "rearm_count" END,
        -- text param + cast: a JS string bound straight to ::jsonb double-encodes under Bun.SQL
        "pending_gaps" = $6::text::jsonb,
+       "last_failed_event_id" = $9,
        "updated_at" = now()
      WHERE "name" = $7 AND "instance_id" = $8`, [
         outcome.cursor,
@@ -177,6 +178,7 @@ export async function updateConsumerDeliveryOutcome(db, name, instanceId, outcom
         JSON.stringify(outcome.pendingGaps),
         name,
         instanceId,
+        outcome.failedEventId,
     ]);
 }
 export async function updateConsumerStatusReturning(db, name, instanceId, status) {
@@ -185,16 +187,21 @@ export async function updateConsumerStatusReturning(db, name, instanceId, status
      RETURNING *`, [status, name, instanceId]));
     return rows[0];
 }
-export async function advanceConsumerPastEventReturning(db, name, instanceId, eventId) {
+export async function advanceConsumerPastEventReturning(db, name, instanceId, eventId, 
+// Ids skipped over between the old cursor and eventId that were not visible yet.
+gapToAdd = null) {
     const rows = (await asRawClient(db).unsafe(`UPDATE "kumiko_event_consumers" SET
        "last_processed_event_id" = $1,
        "status" = 'idle',
        "attempts" = 0,
        "last_error" = NULL,
        "rearm_count" = 0,
+       "last_failed_event_id" = NULL,
+       -- text param + cast: a JS string bound straight to ::jsonb double-encodes under Bun.SQL
+       "pending_gaps" = CASE WHEN $4::text IS NULL THEN "pending_gaps" ELSE "pending_gaps" || $4::text::jsonb END,
        "updated_at" = now()
      WHERE "name" = $2 AND "instance_id" = $3
-     RETURNING *`, [eventId, name, instanceId]));
+     RETURNING *`, [eventId, name, instanceId, gapToAdd === null ? null : JSON.stringify([gapToAdd])]));
     return rows[0];
 }
 export async function resetConsumerForMspRebuild(db, name, instanceId) {
@@ -206,6 +213,7 @@ export async function resetConsumerForMspRebuild(db, name, instanceId) {
        "attempts" = 0,
        "last_error" = NULL,
        "pending_gaps" = '[]'::jsonb,
+       "last_failed_event_id" = NULL,
        "updated_at" = now()`, [name, instanceId]);
 }
 export async function selectConsumerForUpdate(db, name, instanceId) {
@@ -220,6 +228,7 @@ export async function updateConsumerRebuildCursor(db, name, instanceId, lastProc
        "last_error" = NULL,
        -- text param + cast: a JS string bound straight to ::jsonb double-encodes under Bun.SQL
        "pending_gaps" = $2::text::jsonb,
+       "last_failed_event_id" = NULL,
        "updated_at" = now()
      WHERE "name" = $3 AND "instance_id" = $4`, [lastProcessedEventId, JSON.stringify(pendingGaps), name, instanceId]);
 }
@@ -254,6 +263,7 @@ export async function removePendingGapReturning(db, name, instanceId, newPending
        "attempts" = 0,
        "last_error" = NULL,
        "rearm_count" = 0,
+       "last_failed_event_id" = NULL,
        "updated_at" = now()
      WHERE "name" = $2 AND "instance_id" = $3
      RETURNING *`, [JSON.stringify(newPendingGaps), name, instanceId]));

package/dist/engine/boot-validator/index.js

@@ -24,6 +24,7 @@ import { validateQueryRefs } from "./query-refs.js";
 import { validateRecordOwnedSubjects } from "./record-owned.js";
 import { collectScreenQns, collectScreensByShortId, validateScreenShortIdCollisions, validateScreens, } from "./screens.js";
 import { warnOnMissingSecurityBaseline } from "./security-baseline.js";
+import { validateExtensionSelectorPanels } from "./selector-owner-panels.js";
 import { validateTransferGraph } from "./transfer-graph.js";
 import { collectWorkspaceQns, resolveNavAllowlist, validateDefaultWorkspaceUniqueness, validateWorkspaces, } from "./workspaces.js";
 export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns.js";
@@ -170,6 +171,7 @@ export function validateBoot(rawFeatures, options) {
     // misleading "no search parameter in its Zod schema" error instead of
     // the clear typo message below.
     validateQueryRefs(features);
+    validateExtensionSelectorPanels(features);
     // Must also run after validateQueryRefs — column/field checks below
     // assume every `query` string already resolves to a registered handler.
     validateQueryOutputColumns(features);

package/dist/engine/boot-validator/query-output-columns.js

@@ -62,8 +62,21 @@ function checkProjectionDetailOutputFields(queryHandlers, featureName, screenId,
     };
     if (screen.header !== undefined) {
         checkHeaderField("title", screen.header.title);
-        if (screen.header.subtitle !== undefined)
-            checkHeaderField("subtitle", screen.header.subtitle);
+        const subtitle = screen.header.subtitle;
+        if (typeof subtitle === "string")
+            checkHeaderField("subtitle", subtitle);
+        else if (subtitle !== undefined) {
+            for (const part of subtitle) {
+                if (typeof part === "string") {
+                    checkHeaderField("subtitle", part);
+                    continue;
+                }
+                checkHeaderField("subtitle", part.field);
+                if (part.navigate?.entityId !== undefined) {
+                    checkHeaderField("subtitle", part.navigate.entityId);
+                }
+            }
+        }
         if (screen.header.status !== undefined)
             checkHeaderField("status", screen.header.status);
     }

package/dist/engine/boot-validator/query-refs.d.ts

@@ -1,2 +1,3 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition, QueryHandlerDef } from "../types/index.js";
+export declare function checkQueryRef(queryHandlers: ReadonlyMap<string, QueryHandlerDef>, query: string, buildPrefix: () => string): void;
 export declare function validateQueryRefs(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/query-refs.js

@@ -4,7 +4,7 @@ const NOT_REGISTERED_SUFFIX = "is not a registered query-handler. Check the QN s
 function isNonEmptyQueryString(value) {
     return typeof value === "string" && value.length > 0;
 }
-function checkQueryRef(queryHandlers, query, buildPrefix) {
+export function checkQueryRef(queryHandlers, query, buildPrefix) {
     // skip: empty/non-string queries get their own message in screens.ts;
     // a registered query has nothing left to check.
     if (!isNonEmptyQueryString(query) || queryHandlers.has(query))

package/dist/engine/boot-validator/screens.d.ts

@@ -1,6 +1,6 @@
 import type { IconKey } from "@cosmicdrift/kumiko-types/nav-icon";
 import type { FeatureDefinition } from "../types/index.js";
-import type { RelatedListToolbarAction, RowAction, RowFieldExtractor, ScreenDefinition, ToolbarAction } from "../types/screen.js";
+import type { DashboardCustomPanel, DashboardScreenPanel, RelatedListToolbarAction, RowAction, RowFieldExtractor, ScreenDefinition, ToolbarAction } from "../types/screen.js";
 export declare function rowFieldExtractorKeys(params: RowFieldExtractor): readonly string[];
 export declare function readsNavigateParamsAsFormPrefill(target: ScreenDefinition, explicitEntityId: string | undefined, sourceScreenEntity: string | undefined): boolean;
 export declare function validateActionHasIcon(featureName: string, screenId: string, screenType: "projectionDetail" | "entityEdit", context: string, action: {
@@ -20,6 +20,8 @@ export declare function validateScreens(feature: FeatureDefinition, featureMap:
     readonly featureName: string;
     readonly screen: ScreenDefinition;
 }>): void;
+export declare function validateDashboardScreenPanel(featureName: string, screenId: string, panel: DashboardScreenPanel, featureMap: ReadonlyMap<string, FeatureDefinition>): void;
+export declare function validateDashboardCustomPanel(featureName: string, screenId: string, panel: DashboardCustomPanel): void;
 export declare function validateColumnRendererForm(featureName: string, screenId: string, column: {
     readonly field: string;
     readonly renderer?: unknown;

package/dist/engine/boot-validator/screens.js

@@ -942,6 +942,37 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                     }
                 }
             }
+            if (Array.isArray(screen.header?.subtitle)) {
+                if (screen.header.subtitleHref !== undefined) {
+                    throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) sets header.subtitleHref ` +
+                        `together with a multi-part header.subtitle — subtitleHref only works with the string form.`);
+                }
+                const seenPartFields = new Set();
+                for (const part of screen.header.subtitle) {
+                    const partField = typeof part === "string" ? part : part.field;
+                    if (seenPartFields.has(partField)) {
+                        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) header.subtitle ` +
+                            `lists field "${partField}" twice.`);
+                    }
+                    seenPartFields.add(partField);
+                    const navigate = typeof part === "string" ? undefined : part.navigate;
+                    if (navigate === undefined)
+                        continue;
+                    if (navigate.screen === undefined && navigate.entity === undefined) {
+                        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) header.subtitle part ` +
+                            `"${partField}" navigates with neither "screen" nor "entity" — a tab-only navigate has no link target.`);
+                    }
+                    resolveRowActionNavigateTarget(feature.name, screenId, "projectionDetail", "subtitle part", {
+                        kind: "navigate",
+                        id: partField,
+                        label: partField,
+                        ...(navigate.screen !== undefined ? { screen: navigate.screen } : {}),
+                        ...(navigate.entity !== undefined ? { entity: navigate.entity } : {}),
+                        ...(navigate.entityId !== undefined ? { entityId: navigate.entityId } : {}),
+                        ...(navigate.tab !== undefined ? { tab: navigate.tab } : {}),
+                    }, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens);
+                }
+            }
             for (const section of screen.layout.sections) {
                 const sectionLabel = section.title ?? section.id ?? "(untitled)";
                 if (section.actions !== undefined) {
@@ -1562,7 +1593,7 @@ const EMBEDDABLE_SCREEN_TYPES = new Set([
     "configEdit",
     "secretsEdit",
 ]);
-function validateDashboardScreenPanel(featureName, screenId, panel, featureMap) {
+export function validateDashboardScreenPanel(featureName, screenId, panel, featureMap) {
     const context = `[Feature ${featureName}] Screen "${screenId}" (dashboard) screen-panel "${panel.id}"`;
     const targetQn = resolveScreenTargetQn(featureName, panel.screen);
     const [targetFeatureName = "", , targetShortId = ""] = targetQn.split(":");
@@ -1594,7 +1625,7 @@ function validateDashboardStatGroupPanel(featureName, screenId, panel, addPanelI
         }
     }
 }
-function validateDashboardCustomPanel(featureName, screenId, panel) {
+export function validateDashboardCustomPanel(featureName, screenId, panel) {
     if (panel.component.react === undefined && panel.component.native === undefined) {
         throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) custom-panel "${panel.id}" has no component — ` +
             `declare a react/native component marker.`);

package/dist/engine/boot-validator/selector-owner-panels.d.ts

@@ -0,0 +1,2 @@
+import type { FeatureDefinition } from "../types/index.js";
+export declare function validateExtensionSelectorPanels(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/selector-owner-panels.js

@@ -0,0 +1,25 @@
+import { buildQueryHandlerMap } from "./projection-list-screens.js";
+import { checkQueryRef } from "./query-refs.js";
+import { validateDashboardCustomPanel, validateDashboardScreenPanel } from "./screens.js";
+// Owner panels are merged into a dashboard that is built after boot, so the screen and
+// query refs are checked here against the registered features instead.
+export function validateExtensionSelectorPanels(features) {
+    const featureMap = new Map(features.map((feature) => [feature.name, feature]));
+    const queryHandlers = buildQueryHandlerMap(features);
+    for (const feature of features) {
+        for (const selector of feature.extensionSelectors ?? []) {
+            const where = `extensionSelector("${selector.extensionName}")`;
+            for (const panel of selector.panels ?? []) {
+                const context = `[Feature ${feature.name}] ${where} panel "${panel.id}"`;
+                if (panel.kind === "custom") {
+                    validateDashboardCustomPanel(feature.name, where, panel);
+                    continue;
+                }
+                validateDashboardScreenPanel(feature.name, where, panel, featureMap);
+                if (panel.visibleWhen !== undefined) {
+                    checkQueryRef(queryHandlers, panel.visibleWhen.query, () => `${context} visibleWhen`);
+                }
+            }
+        }
+    }
+}

package/dist/engine/boot-validator/url-prefill-fields.js

@@ -11,6 +11,12 @@ function scopeActions(actions, sourceScreenEntity, implicitParams) {
 function relatedListParentParamField(section) {
     return section.parentFilter?.field ?? section.parentParam ?? "id";
 }
+function subtitlePartNavigates(screen) {
+    const subtitle = screen.header?.subtitle;
+    if (typeof subtitle === "string" || subtitle === undefined)
+        return [];
+    return subtitle.flatMap((part) => typeof part === "string" || part.navigate === undefined ? [] : [part.navigate]);
+}
 function projectionDetailNavigateActions(screen) {
     return [
         ...scopeActions(screen.actions, screen.detailFor),
@@ -23,6 +29,7 @@ function projectionDetailNavigateActions(screen) {
         ...(screen.metrics ?? []).flatMap((metric) => typeof metric === "string" || metric.navigate === undefined
             ? []
             : scopeActions([metric.navigate], undefined)),
+        ...subtitlePartNavigates(screen).flatMap((navigate) => scopeActions([navigate], undefined)),
     ];
 }
 function navigateActionsOf(screen) {

package/dist/engine/build-config-feature-schema.js

@@ -56,6 +56,7 @@ const ELEVATED_ROLES = {
 const MACHINE_WRITE_ROLE = "system";
 const NO_SELECTOR_GATING = {
     pluginsByOwnerGroup: new Map(),
+    ownerPanelsByGroup: new Map(),
     pluginFeatures: new Set(),
     secretQns: new Set(),
 };
@@ -93,6 +94,16 @@ function collectVisibleSelectorOwners(registry, visible) {
     }
     return { ownerGroupByExtension, selectorFeatures };
 }
+function collectOwnerPanelsByGroup(registry, ownerGroupByExtension) {
+    const panelsByGroup = new Map();
+    for (const [extension, ownerGroup] of [...ownerGroupByExtension].sort(([a], [b]) => a.localeCompare(b))) {
+        const panels = registry.getExtensionSelectorPanels(extension);
+        if (panels.length === 0)
+            continue;
+        panelsByGroup.set(ownerGroup, [...(panelsByGroup.get(ownerGroup) ?? []), ...panels]);
+    }
+    return panelsByGroup;
+}
 function countSelectorUsagesByFeature(registry) {
     const usageCountByFeature = new Map();
     for (const [extensionName] of registry.getAllExtensionSelectors()) {
@@ -112,7 +123,9 @@ function planSelectorGating(registry, visible, declaredSecrets, secretsEnabled)
     if (ownerGroupByExtension.size === 0)
         return NO_SELECTOR_GATING;
     const usageCountByFeature = countSelectorUsagesByFeature(registry);
-    const pluginsByOwnerGroup = new Map();
+    const ownerPanelsByGroup = collectOwnerPanelsByGroup(registry, ownerGroupByExtension);
+    // A selector with panels but no gated plugin still becomes a dashboard.
+    const pluginsByOwnerGroup = new Map([...ownerPanelsByGroup.keys()].map((ownerGroup) => [ownerGroup, []]));
     const pluginFeatures = new Set();
     const secretQns = new Set();
     for (const [extension, ownerGroup] of [...ownerGroupByExtension].sort(([a], [b]) => a.localeCompare(b))) {
@@ -135,7 +148,7 @@ function planSelectorGating(registry, visible, declaredSecrets, secretsEnabled)
                 secretQns.add(s.qn);
         }
     }
-    return { pluginsByOwnerGroup, pluginFeatures, secretQns };
+    return { pluginsByOwnerGroup, ownerPanelsByGroup, pluginFeatures, secretQns };
 }
 // A tenant/user-home key with an elevated write role (SystemAdmin on a
 // tenant key, see ELEVATED_ROLES) surfaces the SAME feature under two
@@ -173,7 +186,7 @@ function buildFeatureScreensAndNavs(scope, visible, hub, gating, secretsAccess)
             out.navs.push(buildFeatureNav(scope, feature, ordered, access, hub.declaredTranslationKeys));
             continue;
         }
-        const ownerHub = buildSelectorOwnerDashboard(feature, ordered, access, plugins, hub, secretsAccess);
+        const ownerHub = buildSelectorOwnerDashboard(feature, ordered, access, plugins, gating.ownerPanelsByGroup.get(feature) ?? [], hub, secretsAccess);
         out.screens.push(...ownerHub.screens);
         out.navs.push(buildFeatureNav(scope, feature, ordered, ownerHub.access, hub.declaredTranslationKeys));
         Object.assign(out.translations, ownerHub.translations);
@@ -183,9 +196,20 @@ function buildFeatureScreensAndNavs(scope, visible, hub, gating, secretsAccess)
 function pluginTenantScreenId(plugin) {
     return `${plugin.feature}-tenant`;
 }
+function assertUniquePanelIds(ownerGroup, panels) {
+    const seen = new Set();
+    for (const panel of panels) {
+        if (seen.has(panel.id)) {
+            throw new Error(`Settings dashboard "${ownerGroup}-tenant" has duplicate panel id "${panel.id}" — an ` +
+                `extensionSelector panel id collides with another panel of the same dashboard.`);
+        }
+        seen.add(panel.id);
+    }
+    return panels;
+}
 // Plugin screens keep their `${F}-tenant` ids so consumer title keys stay valid;
 // they are dormant because only this dashboard embeds them.
-function buildSelectorOwnerDashboard(ownerGroup, ownerKeys, ownerAccess, plugins, hub, secretsAccess) {
+function buildSelectorOwnerDashboard(ownerGroup, ownerKeys, ownerAccess, plugins, ownerPanels, hub, secretsAccess) {
     const selectionScreenId = `${ownerGroup}-tenant-selection`;
     const selectionScreen = {
         ...buildScreen(selectionScreenId, "tenant", ownerGroup, ownerKeys, ownerAccess, hub),
@@ -240,11 +264,12 @@ function buildSelectorOwnerDashboard(ownerGroup, ownerKeys, ownerAccess, plugins
         id: `${ownerGroup}-tenant`,
         type: "dashboard",
         description: EXTENSION_SELECTOR_HINT_KEY,
-        panels: [
+        panels: assertUniquePanelIds(ownerGroup, [
             { kind: "screen", id: "selection", screen: selectionScreenId },
+            ...ownerPanels,
             ...configPanels,
             ...secretsPanels,
-        ],
+        ]),
         access,
     };
     return { screens: [dashboard, ...screens], access, translations };

package/dist/engine/changeset-changes.js

@@ -67,6 +67,12 @@ export function parseChangesetChanges(markdown, source) {
     let match = BLOCK_RE.exec(markdown);
     while (match !== null) {
         const block = match[1];
+        // BLOCK_RE closes at the first line starting with "-->"; text after it on
+        // that line means a field value contained one and the block ended early.
+        const restOfLine = markdown.slice(match.index + match[0].length).split("\n", 1)[0] ?? "";
+        if (restOfLine.trim() !== "") {
+            throw new Error(`${source}: kumiko-changes block closed early by a line starting with "-->"; field values must not contain such a line`);
+        }
         if (!block)
             throw new Error(`${source}: empty kumiko-changes block`);
         const fields = parseBlock(block, source);

package/dist/engine/entity-handlers.js

@@ -224,7 +224,7 @@ export function defineEntityWriteHandler(name, entity, options) {
     let handler;
     switch (verb) {
         case "create":
-            schema = buildInsertSchema(entity, undefined, excludedFields);
+            schema = buildInsertSchema(entity, undefined, excludedFields, { allowCallerId: true });
             handler = async (event, ctx) => {
                 const { runPreSave } = ctx;
                 // A caller-chosen id (deterministic-id idempotent creates) is only

package/dist/engine/extension-names.d.ts

@@ -5,6 +5,7 @@ import type { PrincipalStatusPlugin, TenantLifecycleStatusPlugin } from "./activ
 import type { TenantDataExtensionHooks } from "./extensions/tenant-data.js";
 import type { TenantResourceExtensionHooks } from "./extensions/tenant-resource.js";
 import type { UserDataExtensionOptions } from "./extensions/user-data.js";
+import type { AssignableFromRole } from "./role-assignment.js";
 import { TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin } from "./tier-resolver-extension.js";
 /**
  * `userData` — User-Daten-Rights-Hooks (DSGVO Art. 15 + 17 + 20).
@@ -137,13 +138,20 @@ export declare const EXT_PRINCIPAL_STATUS: "principalStatus";
  * the bundled `tenant-lifecycle` feature; absent means no tenant is ever "in teardown".
  */
 export declare const EXT_TENANT_LIFECYCLE_STATUS: "tenantLifecycleStatus";
+/**
+ * `assignableRole` — an app declares a membership role as assignable:
+ * `r.useExtension(EXT_ASSIGNABLE_ROLE, "<RoleName>", { assignableFrom? })`
+ * (`assignableFrom` defaults to "Admin").
+ * Provider is the bundled `tenant` feature; consumers are the membership-role guards.
+ */
+export declare const EXT_ASSIGNABLE_ROLE: "assignableRole";
 export declare const TENANT_MEMBERSHIPS_QUERY: "tenant:query:memberships";
 /**
  * Union aller standardisierten Extension-Namen der Datenschutz-Surface.
  * Nicht alle Extensions im System sind in dieser Liste — andere
  * Features koennen weiterhin eigene Extension-Namen registrieren.
  */
-export type KumikoExtensionName = typeof EXT_USER_DATA | typeof EXT_TENANT_DATA | typeof EXT_STORAGE_PROVIDER | typeof EXT_SEARCH_ADAPTER | typeof EXT_EXTERNAL_RESOURCE | typeof EXT_INFRA_RESOURCE | typeof EXT_FILE_PROVIDER | typeof EXT_DERIVATIVE_RENDERER | typeof EXT_DERIVATIVE_PUBLIC_PREDICATE | typeof EXT_DERIVATIVE_OVERLAY_RESOLVER | typeof EXT_PRINCIPAL_STATUS | typeof EXT_TENANT_LIFECYCLE_STATUS;
+export type KumikoExtensionName = typeof EXT_USER_DATA | typeof EXT_TENANT_DATA | typeof EXT_STORAGE_PROVIDER | typeof EXT_SEARCH_ADAPTER | typeof EXT_EXTERNAL_RESOURCE | typeof EXT_INFRA_RESOURCE | typeof EXT_FILE_PROVIDER | typeof EXT_DERIVATIVE_RENDERER | typeof EXT_DERIVATIVE_PUBLIC_PREDICATE | typeof EXT_DERIVATIVE_OVERLAY_RESOLVER | typeof EXT_PRINCIPAL_STATUS | typeof EXT_TENANT_LIFECYCLE_STATUS | typeof EXT_ASSIGNABLE_ROLE;
 /** The four `destroyTenant(tenantId, ctx)`-only resource-cleanup extension points. */
 export type TenantResourceExtensionName = typeof EXT_STORAGE_PROVIDER | typeof EXT_SEARCH_ADAPTER | typeof EXT_EXTERNAL_RESOURCE | typeof EXT_INFRA_RESOURCE;
 declare module "@cosmicdrift/kumiko-framework/engine" {
@@ -155,6 +163,9 @@ declare module "@cosmicdrift/kumiko-framework/engine" {
         [EXT_DERIVATIVE_OVERLAY_RESOLVER]: OverlayResolverPlugin;
         [EXT_PRINCIPAL_STATUS]: PrincipalStatusPlugin;
         [EXT_TENANT_LIFECYCLE_STATUS]: TenantLifecycleStatusPlugin;
+        [EXT_ASSIGNABLE_ROLE]: {
+            readonly assignableFrom?: AssignableFromRole;
+        };
         [EXT_STORAGE_PROVIDER]: TenantResourceExtensionHooks;
         [EXT_SEARCH_ADAPTER]: TenantResourceExtensionHooks;
         [EXT_EXTERNAL_RESOURCE]: TenantResourceExtensionHooks;

package/dist/engine/extension-names.js

@@ -167,6 +167,13 @@ export const EXT_PRINCIPAL_STATUS = "principalStatus";
  * the bundled `tenant-lifecycle` feature; absent means no tenant is ever "in teardown".
  */
 export const EXT_TENANT_LIFECYCLE_STATUS = "tenantLifecycleStatus";
+/**
+ * `assignableRole` — an app declares a membership role as assignable:
+ * `r.useExtension(EXT_ASSIGNABLE_ROLE, "<RoleName>", { assignableFrom? })`
+ * (`assignableFrom` defaults to "Admin").
+ * Provider is the bundled `tenant` feature; consumers are the membership-role guards.
+ */
+export const EXT_ASSIGNABLE_ROLE = "assignableRole";
 // Default membership-list query handler name. Accepted coupling, same
 // pattern as FILE_PROVIDER_CONFIG_KEY — the `tenant` feature registers a handler under this literal.
 export const TENANT_MEMBERSHIPS_QUERY = "tenant:query:memberships";

package/dist/engine/feature-ast/extractors/index.d.ts

@@ -8,7 +8,7 @@ export { findImportBindingForLocalName, resolveModuleFile, } from "./resolve-imp
 export { extractDescribe, extractOptionalRequires, extractReadsConfig, extractRequires, extractSystemScope, extractToggleable, extractUiHints, } from "./round1.js";
 export { extractEntity, extractNav, extractRelation, extractWorkspace, } from "./round2.js";
 export { extractClaimKey, extractConfig, extractMetric, extractReferenceData, extractSecret, extractTranslations, extractUseExtension, isClaimKeyType, type NamedOptionsResult, readNamedOptions, } from "./round3.js";
-export { extractEnvSchema, extractExposesApi, extractExtendsRegistrar, extractStoreTable, extractUsesApi, } from "./round5.js";
+export { extractBootCheck, extractEnvSchema, extractExposesApi, extractExtendsRegistrar, extractStoreTable, extractUsesApi, } from "./round5.js";
 export { extractTreeActions } from "./round6.js";
 export type { ExtractOutput } from "./shared.js";
 export { fail, findFunctionLiteral, isPlainObject, ok, readBooleanProperty, readDataLiteralNode, readNameOrRef, readNameOrRefOrList, readObjectPropertyInitializer, readPropertyKey, readStringLiteralArgs, readVarargsOrArrayProp, resolveSameFileObjectLiteral, } from "./shared.js";

package/dist/engine/feature-ast/extractors/index.js

@@ -8,6 +8,6 @@ export { findImportBindingForLocalName, resolveModuleFile, } from "./resolve-imp
 export { extractDescribe, extractOptionalRequires, extractReadsConfig, extractRequires, extractSystemScope, extractToggleable, extractUiHints, } from "./round1.js";
 export { extractEntity, extractNav, extractRelation, extractWorkspace, } from "./round2.js";
 export { extractClaimKey, extractConfig, extractMetric, extractReferenceData, extractSecret, extractTranslations, extractUseExtension, isClaimKeyType, readNamedOptions, } from "./round3.js";
-export { extractEnvSchema, extractExposesApi, extractExtendsRegistrar, extractStoreTable, extractUsesApi, } from "./round5.js";
+export { extractBootCheck, extractEnvSchema, extractExposesApi, extractExtendsRegistrar, extractStoreTable, extractUsesApi, } from "./round5.js";
 export { extractTreeActions } from "./round6.js";
 export { fail, findFunctionLiteral, isPlainObject, ok, readBooleanProperty, readDataLiteralNode, readNameOrRef, readNameOrRefOrList, readObjectPropertyInitializer, readPropertyKey, readStringLiteralArgs, readVarargsOrArrayProp, resolveSameFileObjectLiteral, } from "./shared.js";

package/dist/engine/feature-ast/extractors/round5.d.ts

@@ -6,3 +6,4 @@ export declare function extractExtendsRegistrar(call: CallExpression, sourceFile
 export declare function extractUsesApi(call: CallExpression, sourceFile: SourceFile): ExtractOutput<UsesApiPattern>;
 export declare function extractExposesApi(call: CallExpression, sourceFile: SourceFile): ExtractOutput<ExposesApiPattern>;
 export declare function extractStoreTable(call: CallExpression, sourceFile: SourceFile): ExtractOutput<never>;
+export declare function extractBootCheck(call: CallExpression, sourceFile: SourceFile): ExtractOutput<never>;

package/dist/engine/feature-ast/extractors/round5.js

@@ -61,3 +61,8 @@ export function extractStoreTable(call, sourceFile) {
     // UnknownPattern) marks it design-time-unreadable, like entity-by-identifier.
     return fail("storeTable", sourceLocationFromNode(call, sourceFile), "storeTable meta is a factory/identifier argument, not a static literal");
 }
+export function extractBootCheck(call, sourceFile) {
+    // The argument is a runtime closure over the composed feature list —
+    // nothing to extract statically, so a clean ParseError like storeTable.
+    return fail("bootCheck", sourceLocationFromNode(call, sourceFile), "bootCheck takes a runtime closure, not a static literal");
+}

package/dist/engine/feature-ast/parse.js

@@ -21,7 +21,7 @@
 // Per-pattern extractors fill in iteratively (C1.5) — each round adds
 // one extractor + a focused test.
 import { Project, SyntaxKind } from "ts-morph";
-import { extractAiClassify, extractAiExtract, extractAiGenerate, extractAuthClaims, extractClaimKey, extractConfig, extractDefineEvent, extractDescribe, extractEntity, extractEnvSchema, extractExposesApi, extractExtendsRegistrar, extractHook, extractHttpRoute, extractJob, extractMetric, extractMultiStreamProjection, extractNav, extractNotification, extractOptionalRequires, extractProjection, extractQueryHandler, extractReadsConfig, extractReferenceData, extractRelation, extractRequires, extractScreen, extractSecret, extractStoreTable, extractStreamHandler, extractSystemScope, extractToggleable, extractTranslations, extractTreeActions, extractUiHints, extractUseExtension, extractUsesApi, extractWorkspace, extractWriteHandler, findFunctionLiteral, findImportBindingForLocalName, readObjectPropertyInitializer, resolveModuleFile, resolveSameFileObjectLiteral, } from "./extractors/index.js";
+import { extractAiClassify, extractAiExtract, extractAiGenerate, extractAuthClaims, extractBootCheck, extractClaimKey, extractConfig, extractDefineEvent, extractDescribe, extractEntity, extractEnvSchema, extractExposesApi, extractExtendsRegistrar, extractHook, extractHttpRoute, extractJob, extractMetric, extractMultiStreamProjection, extractNav, extractNotification, extractOptionalRequires, extractProjection, extractQueryHandler, extractReadsConfig, extractReferenceData, extractRelation, extractRequires, extractScreen, extractSecret, extractStoreTable, extractStreamHandler, extractSystemScope, extractToggleable, extractTranslations, extractTreeActions, extractUiHints, extractUseExtension, extractUsesApi, extractWorkspace, extractWriteHandler, findFunctionLiteral, findImportBindingForLocalName, readObjectPropertyInitializer, resolveModuleFile, resolveSameFileObjectLiteral, } from "./extractors/index.js";
 import { sourceLocationFromNode } from "./source-location.js";
 /**
  * Parse the given feature file and return all recognised r.* calls
@@ -440,6 +440,8 @@ function dispatchExtractor(methodName, call, sourceFile) {
             return extractExposesApi(call, sourceFile);
         case "storeTable":
             return extractStoreTable(call, sourceFile);
+        case "bootCheck":
+            return extractBootCheck(call, sourceFile);
         // Round 6 — Tree-Actions pattern
         case "treeActions":
             return extractTreeActions(call, sourceFile);

package/dist/engine/feature-ui-extensions.d.ts

@@ -2,7 +2,7 @@ import { type WebSocketRouteDefinition } from "@cosmicdrift/kumiko-types/websock
 import type { EntityTableMeta } from "../db/entity-table-meta.js";
 import type { FeatureBuilderState } from "./feature-builder-state.js";
 import type { HttpRouteDefinition } from "./types/http-route.js";
-import type { BootCheckFn, EntityProjectionExtension, EscapeHatchDeclaration, HookPhase, LifecycleHookFn, LifecycleHookType, MultiStreamProjectionDefinition, NameOrRef, ProjectionDefinition, RegistrarExtensionDef, SearchPayloadContributorFn, StoreTableOptions, TreeActionDef, TreeActionsHandle, ValidationHookFn } from "./types/index.js";
+import type { BootCheckFn, EntityProjectionExtension, EscapeHatchDeclaration, ExtensionSelectorPanel, HookPhase, LifecycleHookFn, LifecycleHookType, MultiStreamProjectionDefinition, NameOrRef, ProjectionDefinition, RegistrarExtensionDef, SearchPayloadContributorFn, StoreTableOptions, TreeActionDef, TreeActionsHandle, ValidationHookFn } from "./types/index.js";
 import type { ContentCollectionDefinition, NavDefinition } from "./types/nav.js";
 import type { ScreenDefinition } from "./types/screen.js";
 import type { WorkspaceDefinition } from "./types/workspace.js";
@@ -21,7 +21,9 @@ export declare function buildUiExtensionsMethods<TName extends string>(state: Fe
     } & object), entityRef?: NameOrRef, options?: object): void;
     extensionSelector(extensionName: string, key: {
         readonly name: string;
-    } | string): void;
+    } | string, options?: {
+        readonly panels?: readonly ExtensionSelectorPanel[];
+    }): void;
     /**
      * Marker-Deklaration: dieses Feature stellt eine Cross-Feature-API
      * unter dem genannten Namen bereit. Die eigentliche Implementation

package/dist/engine/feature-ui-extensions.js

@@ -2,8 +2,39 @@ import { WEBSOCKET_MAX_CONNECTIONS_PER_USER_LIMIT, WEBSOCKET_MAX_PAYLOAD_BYTES,
 import { bindHookEscapeHatchGrant } from "../pipeline/system-identity-switch.js";
 import { LifecycleHookTypes } from "./constants.js";
 import { resolveName } from "./handler-helpers.js";
-import { isKebabSegment, toKebab } from "./qualified-name.js";
+import { isKebabSegment, isValidQn, qualifyEntityName, toKebab } from "./qualified-name.js";
 import { HookPhases } from "./types/index.js";
+// Builds hooks/extensions/projections/screens/nav/workspace/tables/tree-actions
+// registrar methods.
+// Id the generated owner dashboard reserves for its selector panel.
+const RESERVED_SELECTION_PANEL_ID = "selection";
+function assertSelectorPanelIds(featureName, extensionName, panels) {
+    const seen = new Set();
+    for (const { id } of panels) {
+        if (id === "" || id === RESERVED_SELECTION_PANEL_ID || seen.has(id)) {
+            throw new Error(`[Feature ${featureName}] extensionSelector("${extensionName}") panel id "${id}" must be unique, ` +
+                `non-empty and not "${RESERVED_SELECTION_PANEL_ID}" (reserved for the selector panel).`);
+        }
+        seen.add(id);
+    }
+}
+// The owner dashboard lives in the "config" namespace, so a short screen ref must be
+// qualified against the declaring feature here. Untyped authors can pass other kinds.
+function qualifySelectorPanel(featureName, panel) {
+    if (panel.kind === "custom")
+        return panel;
+    if (panel.kind === "screen") {
+        if ("label" in panel) {
+            throw new Error(`[Feature ${featureName}] extensionSelector screen panel "${panel.id}" must not set a label — ` +
+                `the settings dashboard has no i18n namespace for it; the embedded screen carries its own title.`);
+        }
+        if (panel.screen === "" || isValidQn(panel.screen))
+            return panel;
+        return { ...panel, screen: qualifyEntityName(featureName, "screen", panel.screen) };
+    }
+    throw new Error(`[Feature ${featureName}] extensionSelector panel ${JSON.stringify(panel)} has an unsupported kind — ` +
+        `only "custom" and "screen" panels are allowed.`);
+}
 function isEntityWideHookType(type) {
     return (type === LifecycleHookTypes.postSave ||
         type === LifecycleHookTypes.preDelete ||
@@ -184,13 +215,19 @@ export function buildUiExtensionsMethods(state, name) {
                 options: optionsBag,
             });
         },
-        extensionSelector(extensionName, key) {
+        extensionSelector(extensionName, key, options) {
             if (state.extensionSelectors.some((s) => s.extensionName === extensionName)) {
                 throw new Error(`[Feature ${name}] extensionSelector("${extensionName}") declared twice — ` +
                     `one selector key per extension point.`);
             }
             const qualifiedKey = typeof key === "string" ? key : key.name;
-            state.extensionSelectors.push({ extensionName, qualifiedKey });
+            const panels = options?.panels?.map((panel) => qualifySelectorPanel(name, panel));
+            assertSelectorPanelIds(name, extensionName, panels ?? []);
+            state.extensionSelectors.push({
+                extensionName,
+                qualifiedKey,
+                ...(panels !== undefined && { panels }),
+            });
         },
         /**
          * Marker-Deklaration: dieses Feature stellt eine Cross-Feature-API