@cosmicdrift/kumiko-framework 0.334.0 → 0.336.0

package/dist/engine/where-rule-lint.js

@@ -17,8 +17,9 @@ const SELF_COMPARISON_RE = new RegExp(`(${QUALIFIED_SRC})\\s*(?<![!<>=])=(?!=)\\
 const QUALIFIED_PARSE_RE = new RegExp(`^(${IDENT_SRC})(?:\\.(${IDENT_SRC}))?$`);
 // Resolve the SQL column names a table exposes, so the lint can tell a
 // real column reference apart from a table alias / function name / SQL
-// keyword. Returns an empty set when nothing is derivable (fail-open on
-// the lint itself would be worse than skipping it).
+// keyword. Returns an empty set when nothing is derivable; the column-aware
+// check then finds no bare column and is effectively skipped (only the
+// self-comparison check still applies).
 export function tableColumnSqlNames(table) {
     if (table === null || typeof table !== "object")
         return new Set();
@@ -131,16 +132,33 @@ function findSelfComparison(cleaned) {
 // column on the OUTER table is the fail-open shape — Postgres resolves it
 // against the innermost table first. A qualifier (`t.x`) or a table/alias
 // name immediately followed by `.` is not a column reference and is
-// ignored.
+// ignored. Bare identifiers on the outer level bind to the outer table and
+// are fine, so only tokens inside a `( SELECT ...` parenthesis block count.
+const SUBQUERY_OPEN_RE = /^\s*SELECT\b/i;
 function findUnqualifiedColumnReference(cleaned, columnSqlNames) {
+    const parenIsSubquery = [];
+    let subqueryDepth = 0;
+    let scanned = 0;
     TOKEN_RE.lastIndex = 0;
     let match = TOKEN_RE.exec(cleaned);
     while (match !== null) {
         const start = match.index;
         const end = start + match[0].length;
+        for (; scanned < start; scanned++) {
+            const ch = cleaned[scanned];
+            if (ch === "(") {
+                const opensSubquery = SUBQUERY_OPEN_RE.test(cleaned.slice(scanned + 1));
+                parenIsSubquery.push(opensSubquery);
+                if (opensSubquery)
+                    subqueryDepth++;
+            }
+            else if (ch === ")" && parenIsSubquery.pop() === true) {
+                subqueryDepth--;
+            }
+        }
         const precededByDot = start > 0 && cleaned[start - 1] === ".";
         const followedByDot = cleaned[end] === ".";
-        if (!precededByDot && !followedByDot) {
+        if (subqueryDepth > 0 && !precededByDot && !followedByDot) {
             const normalized = normalizeIdent(match[0]);
             if (columnSqlNames.has(normalized))
                 return normalized;

package/dist/env/dry-run.js

@@ -105,13 +105,19 @@ function renderJson(fields, options) {
         withDefault: withDefault.map(toEntry),
     }, null, 2)}\n`;
 }
+// A newline in a `.describe()` text would end the `#` comment, so the rest of
+// the description would run as a shell command or break the YAML.
+function oneLineDescription(f) {
+    return f.description?.replace(/\s*\r?\n\s*/g, " ");
+}
 function pulumiConfigSetLine(f, options) {
     const meta = readKumikoMeta(f.field);
     const key = pulumiConfigKey(f.name, f.field, options.pulumiPrefix);
     const secretFlag = meta.pulumi?.secret ? " --secret" : "";
     const value = meta.pulumi?.generator ? `"$(${meta.pulumi.generator})"` : `"<set-me>"`;
-    const comment = f.description
-        ? ` # ${f.name} (${f.source}): ${f.description}`
+    const description = oneLineDescription(f);
+    const comment = description
+        ? ` # ${f.name} (${f.source}): ${description}`
         : ` # ${f.name} (${f.source})`;
     return `pulumi config set${secretFlag} ${key} ${value}${comment}`;
 }
@@ -150,7 +156,8 @@ function renderK8s(fields, options) {
     if (optional.length > 0) {
         lines.push("  # Optional (uncomment and set to enable):");
         for (const f of optional) {
-            const comment = f.description ? ` # (${f.source}): ${f.description}` : ` # (${f.source})`;
+            const description = oneLineDescription(f);
+            const comment = description ? ` # (${f.source}): ${description}` : ` # (${f.source})`;
             lines.push(`  # ${f.name}: "<set-me>"${comment}`);
         }
     }

package/dist/env/index.js

@@ -57,6 +57,9 @@ export function kmsSlotsOf(schema) {
 // only exists after the boot-time decrypt, so requiring it here would reject
 // exactly the deployment this meta enables. safeExtend, not extend: Zod 4 throws
 // on extend for schemas carrying refinements (app-level superRefine).
+// Caveat: refinements run against the relaxed object, so they see such a slot as
+// `undefined` despite `z.infer<S>` promising a string. A refinement that reads the
+// slot must tolerate that; a throw from it is reported by parseEnv as a boot error.
 function relaxCiphertextOnlySlots(schema, env) {
     const shape = zodShape(schema);
     const relaxed = {};
@@ -227,6 +230,23 @@ export class KumikoBootError extends Error {
         return formatBootError(this.errors);
     }
 }
+// safeParse does not catch exceptions thrown inside refinements; a refinement
+// reading a ciphertext-only slot (undefined here) would otherwise escape as a raw
+// TypeError past the KumikoBootError mapping.
+function safeParseReportingThrows(schema, input) {
+    try {
+        return schema.safeParse(input);
+    }
+    catch (error) {
+        throw new KumikoBootError([
+            {
+                name: "<schema refinement>",
+                kind: "invalid",
+                message: `an env schema refinement threw: ${error instanceof Error ? error.message : String(error)}. If it reads a kms slot delivered only as <NAME>_CIPHERTEXT, the value is undefined at this point.`,
+            },
+        ]);
+    }
+}
 export function parseEnv(schema, env, options = {}) {
     // Filter undefined values to keep Zod's required-vs-invalid signal clean.
     // (process.env returns string|undefined; passing undefined would parse
@@ -236,7 +256,7 @@ export function parseEnv(schema, env, options = {}) {
         if (v !== undefined)
             cleaned[k] = v;
     }
-    const result = relaxCiphertextOnlySlots(schema, cleaned).safeParse(cleaned);
+    const result = safeParseReportingThrows(relaxCiphertextOnlySlots(schema, cleaned), cleaned);
     if (result.success) {
         // @cast-boundary schema-walk — z.infer<S> erasure across safeParse result
         return result.data;

package/dist/errors/reasons.d.ts

@@ -17,7 +17,6 @@ export type FrameworkReason = (typeof FrameworkReasons)[keyof typeof FrameworkRe
 export declare const AgentReasons: {
     readonly toolNotAllowed: "agent.tool_not_allowed";
     readonly iterationLimit: "agent.iteration_limit";
-    readonly permissionDenied: "agent.permission_denied";
     readonly highRiskNoAlways: "agent.high_risk_no_always";
 };
 export type AgentReason = (typeof AgentReasons)[keyof typeof AgentReasons];

package/dist/errors/reasons.js

@@ -13,8 +13,8 @@
 // reasons surface from the AI-agent runtime (tool dispatch, permission and
 // risk gates), not from a handler's own domain logic, and the `agent.`
 // prefix keeps them visibly distinct from FrameworkReasons in error payloads.
-// Both the docs site (`errors/` pages) and the enterprise repo read this same
-// source, so the prefix stays a naming convention here, not a new registry.
+// The docs site (`errors/` pages) reads this source; the enterprise repo keeps
+// its own AGENT_REASONS, so only reasons it actually emits belong in both.
 export const FrameworkReasons = {
     // ConflictError: atomic UPDATE lost the race (another writer moved the row
     // between our snapshot and our WHERE clause). Client SDK default: toast +
@@ -73,9 +73,6 @@ export const AgentReasons = {
     // Not thrown: the run ends with a `clarify` turn (`payload.reason`) once
     // MAX_AGENT_ROUNDS is reached.
     iterationLimit: "agent.iteration_limit",
-    // AccessDeniedError: the tool exists, but the caller's roles don't cover
-    // the handler behind it.
-    permissionDenied: "agent.permission_denied",
     // UnprocessableError: a permission rule with `always` was requested for an
     // `agent: { risk: "high" }` handler; `details.handlerQn` names it.
     highRiskNoAlways: "agent.high_risk_no_always",

package/dist/event-store/event-store.js

@@ -173,14 +173,22 @@ function buildStoredEvent(event, newVersion, eventVersion, row) {
 // aggregateId alone, matching prior behavior. Callers that share id
 // generation across multiple aggregate types on the same id (e.g. a solon-
 // style collision) must pass it to avoid folding a foreign type's events
-// into the loaded stream.
+// into the loaded stream. The aggregateType condition stays an unindexed
+// post-filter on purpose: events_aggregate_version_uq already narrows the scan
+// to one aggregate's rows, so an index including aggregate_type would only add
+// write cost.
 export async function loadAggregate(db, aggregateId, tenantId, options) {
+    // "" must not fall through to the unfiltered load: a dynamically computed
+    // type that came out empty would silently fold in foreign aggregate types.
+    if (options?.aggregateType === "") {
+        throw new Error("loadAggregate: aggregateType must be a non-empty string when provided");
+    }
     if (!options?.includeArchived) {
         const archived = await isStreamArchived(db, tenantId, aggregateId);
         if (archived)
             return [];
     }
-    const rows = await selectMany(db, eventsTable, options?.aggregateType
+    const rows = await selectMany(db, eventsTable, options?.aggregateType !== undefined
         ? { aggregateId, tenantId, aggregateType: options.aggregateType }
         : { aggregateId, tenantId }, { orderBy: { col: "version", direction: "asc" } });
     return rows.map(toStoredEvent);

package/dist/event-store/provenance-append.js

@@ -1,6 +1,7 @@
 import { SYSTEM_EVENT_PREFIX } from "../crypto/system-event-pii.js";
 import { runInSavepointIfSupported } from "../db/query.js";
 import { unsafeRawForDeclaredStep, withUnsafeRawGrant } from "../db/tenant-db.js";
+import { qnScope } from "../engine/qualified-name.js";
 import { AccessDeniedError, InternalError } from "../errors/index.js";
 import { append, getStreamVersion } from "./event-store.js";
 // Fixed by the framework, not the caller — the point of this entry point is
@@ -14,7 +15,9 @@ export async function appendProvenanceEvent(db, event) {
             message: `appendProvenanceEvent("${event.type}") — the "${SYSTEM_EVENT_PREFIX}" namespace is framework-internal and is not reachable through this entry point.`,
         });
     }
-    if (!event.type.includes(":")) {
+    // qnScope is the same owner definition appendDomainEventCore uses: a leading
+    // ":" (empty owner) counts as unowned there, so it must here too.
+    if (!qnScope(event.type) || event.type.endsWith(":")) {
         throw new InternalError({
             message: `appendProvenanceEvent("${event.type}") — event types must be owner-qualified ("<feature>:<name>"). Unowned types are not allowed here.`,
         });

package/dist/files/file-routes.d.ts

@@ -14,7 +14,6 @@ export type FileRef = {
     entityId: string | null;
     fieldName: string | null;
     insertedById: string | null;
-    isDeleted: boolean;
 };
 export type FileAccessGuard = (args: {
     readonly fileRef: FileRef;

package/dist/files/file-routes.js

@@ -3,7 +3,7 @@ import { bodyLimit } from "hono/body-limit";
 import { getUser } from "../api/auth-middleware.js";
 import { requestContext } from "../api/request-context.js";
 import { selectMany } from "../bun-db/index.js";
-import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "../crypto/index.js";
+import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
 import { createEventStoreExecutor } from "../db/event-store-executor.js";
 import { createTenantDb } from "../db/tenant-db.js";
 import { createDerivativesContext, resolveFieldVariant, resolveRenderer, } from "../derivatives/index.js";
@@ -106,11 +106,27 @@ export function createFileRoutes(options) {
         if (!isPiiCiphertext(fileRef.fileName))
             return fileRef.fileName;
         const kms = configuredPiiSubjectKms();
+        // skip: the framework has no logger at this route layer and the file bytes are
+        // still served; the "download" fallback only hides the stored ciphertext name.
         if (!kms) {
             return "download";
         }
-        const decrypted = await decryptPiiFieldValues({ fileName: fileRef.fileName }, piiSubjectFields, kms, kmsContextFor());
-        return typeof decrypted["fileName"] === "string" ? decrypted["fileName"] : "download";
+        try {
+            const decrypted = await decryptPiiFieldValues({ fileName: fileRef.fileName }, piiSubjectFields, kms, kmsContextFor());
+            const name = decrypted["fileName"];
+            // decryptPiiFieldValues returns the row untouched when fileName isn't
+            // annotated as PII (annotation drift), so ciphertext/erased sentinel
+            // can still be here and must never reach a header.
+            if (typeof name !== "string" || isPiiCiphertext(name) || name === PII_ERASED_SENTINEL) {
+                return "download";
+            }
+            return name;
+        }
+        catch {
+            // skip: broken crypto metadata (malformed ciphertext, auth failure, missing key)
+            // must not make intact bytes unreachable; the route layer has no logger.
+            return "download";
+        }
     }
     // Runs before parseBody buffers the request below: checks Content-Length
     // upfront, counts chunked bodies while streaming.
@@ -397,11 +413,10 @@ export function createFileRoutes(options) {
         if (!row)
             return c.json({ error: "not_found" }, 404);
         const fileRef = row; // @cast-boundary db-row (decrypted via executor.detail)
-        // detail()'s "pass"-ownership read widens to tenantId IN (self, SYSTEM)
-        // and doesn't filter isDeleted (list() does, detail() doesn't) — both
+        // detail()'s "pass"-ownership read widens to tenantId IN (self, SYSTEM),
         // narrower in loadFileForTenant's selectMany. Restore that here so meta
-        // doesn't leak reference-tenant or soft-deleted rows.
-        if (fileRef.tenantId !== user.tenantId || fileRef.isDeleted) {
+        // doesn't leak reference-tenant rows.
+        if (fileRef.tenantId !== user.tenantId) {
             return c.json({ error: "not_found" }, 404);
         }
         const decision = await guard({ fileRef, user, operation: "read" });

package/dist/files/local-provider.js

@@ -1,6 +1,6 @@
 import { createReadStream, createWriteStream } from "node:fs";
 import { mkdir, readdir, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { dirname, join, resolve, sep } from "node:path";
+import { dirname, join, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { assertSafeStorageKey } from "./types.js";
 // Local-filesystem backend — intended for dev + tests. Production deploys
@@ -101,25 +101,28 @@ export function createLocalProvider(basePath) {
             }
         },
         async list(prefix) {
-            // recursive:true returns POSIX- or OS-sep-joined relative paths for
-            // both files and directories; normalize to "/" (storage keys are
-            // always "/"-joined, matching S3) before the prefix match, then stat
-            // only the (few) matches to drop directory entries.
+            // Walk only the directory part of the prefix: a tenant-scoped sweep must
+            // not traverse every other tenant's files in a shared storage root.
+            // Keys are normalized to "/" (storage keys are always "/"-joined,
+            // matching S3) before the final prefix match.
+            const prefixDir = prefix.slice(0, prefix.lastIndexOf("/") + 1);
+            const walkRoot = prefixDir === "" ? resolvedBase : resolveContainedPath(prefixDir);
             let entries;
             try {
-                entries = await readdir(resolvedBase, { recursive: true });
+                entries = await readdir(walkRoot, { recursive: true, withFileTypes: true });
             }
             catch (err) {
-                if (err.code === "ENOENT")
+                const code = err.code;
+                if (code === "ENOENT" || code === "ENOTDIR")
                     return [];
                 throw err;
             }
             const results = [];
             for (const entry of entries) {
-                const key = entry.split(sep).join("/");
-                if (!key.startsWith(prefix))
+                if (!entry.isFile())
                     continue;
-                if ((await stat(join(resolvedBase, entry))).isFile())
+                const key = relative(resolvedBase, join(entry.parentPath, entry.name)).split(sep).join("/");
+                if (key.startsWith(prefix))
                     results.push(key);
             }
             return results;

package/dist/files/provider-resolver.js

@@ -50,8 +50,27 @@ export async function createFileProviderForTenant(ctx, tenantId, handlerName = "
         throw new Error(`${FEATURE_NAME}: provider "${provider}" registered without a build() — ` +
             `extension options must be a FileProviderPlugin.`);
     }
-    return usage.options.build(ctx, tenantId);
+    const built = await usage.options.build(ctx, tenantId);
+    // Extension payloads are never type-checked, so a plugin predating a
+    // required method (list) would otherwise surface as a misleading
+    // "missing s3:ListBucket permission" hint during erasure.
+    for (const method of REQUIRED_PROVIDER_METHODS) {
+        if (typeof built[method] !== "function") {
+            throw new Error(`${FEATURE_NAME}: provider "${provider}" built without the required method ${method}() — ` +
+                `update the file-provider plugin to the current FileStorageProvider contract.`);
+        }
+    }
+    return built;
 }
+const REQUIRED_PROVIDER_METHODS = [
+    "write",
+    "writeStream",
+    "read",
+    "readStream",
+    "delete",
+    "exists",
+    "list",
+];
 // Builds the resolver from the ambient AppContext fields — the framework-side
 // equivalent of the GDPR `makeTenantStorageProviderResolver`. The config
 // accessor (and therefore the s3.secretAccessKey secret-read) runs under

package/dist/files/types.js

@@ -207,6 +207,15 @@ export function validateFileContent(fileName, content, accept) {
     const ext = extractExtension(fileName);
     if (!ext)
         return { kind: "ok" };
+    // validateFile accepts aliased declared MIMEs (csv as vnd.ms-excel) on
+    // metadata alone, so the byte check has to live on this exported path too:
+    // a text-format extension with an alias must never carry a binary signature.
+    if (Object.hasOwn(EXTENSION_MIME_ALIASES, ext) && sniffMimeType(content) !== null) {
+        return {
+            kind: "rejected",
+            error: `content_mismatch: ".${ext}" upload bytes are a binary format`,
+        };
+    }
     const signatureMimeTypes = signatureMimeTypesForExtension(ext);
     if (signatureMimeTypes.length === 0)
         return { kind: "ok" };
@@ -261,9 +270,15 @@ extensionOverride) {
     const ext = /^[A-Za-z0-9]+$/.test(rawExt) ? rawExt.toLowerCase() : "bin";
     return `${tenantId}/${entityType}/${entityId}/${fieldName}/${uniqueId}.${ext}`;
 }
+const EXPORTS_PREFIX_SEGMENT = "exports";
 /** Fixed leading segment so one S3 lifecycle rule (Prefix: "exports/") can expire export bundles for every tenant without matching a buildStorageKey() upload. */
 export function tenantExportPrefix(tenantId) {
-    return `exports/${tenantId}/`;
+    // A tenant named like the reserved segment would make the sweep prefix
+    // "exports/" match every tenant's export bundles.
+    if (tenantId === EXPORTS_PREFIX_SEGMENT) {
+        throw new Error(`tenantId "${tenantId}" collides with the reserved storage segment`);
+    }
+    return `${EXPORTS_PREFIX_SEGMENT}/${tenantId}/`;
 }
 /**
  * Every storage-key prefix a tenant's binaries can live under. A tenant-destroy

package/dist/i18n/request-locale.d.ts

@@ -1,7 +1,8 @@
 export declare const DEFAULT_LOCALE = "en";
 export declare function isValidLocaleTag(value: string): boolean;
-/** BCP-47 is case-insensitive; canonicalize the primary subtag to lowercase
- *  so registry lookups (`mailT`, `hasMailTranslations`) hit registered keys. */
+/** BCP-47 is case-insensitive; canonicalize to the RFC 5646 conventional form
+ *  (`de-AT`, `zh-Hant-TW`) so registry lookups (`mailT`, `hasMailTranslations`)
+ *  hit registered keys regardless of header casing. */
 export declare function canonicalizeLocaleTag(tag: string): string;
 /**
  * Picks the best well-formed tag from an Accept-Language header (RFC 9110

package/dist/i18n/request-locale.js

@@ -14,13 +14,23 @@ const MAX_LOCALE_TAG_LENGTH = 35;
 export function isValidLocaleTag(value) {
     return value.length <= MAX_LOCALE_TAG_LENGTH && LOCALE_TAG_RE.test(value);
 }
-/** BCP-47 is case-insensitive; canonicalize the primary subtag to lowercase
- *  so registry lookups (`mailT`, `hasMailTranslations`) hit registered keys. */
+/** BCP-47 is case-insensitive; canonicalize to the RFC 5646 conventional form
+ *  (`de-AT`, `zh-Hant-TW`) so registry lookups (`mailT`, `hasMailTranslations`)
+ *  hit registered keys regardless of header casing. */
 export function canonicalizeLocaleTag(tag) {
-    const dash = tag.indexOf("-");
-    if (dash === -1)
-        return tag.toLowerCase();
-    return `${tag.slice(0, dash).toLowerCase()}${tag.slice(dash)}`;
+    return tag
+        .split("-")
+        .map((subtag, index) => {
+        if (index === 0)
+            return subtag.toLowerCase();
+        if (/^[A-Za-z]{2}$/.test(subtag))
+            return subtag.toUpperCase();
+        if (/^[A-Za-z]{4}$/.test(subtag)) {
+            return subtag.charAt(0).toUpperCase() + subtag.slice(1).toLowerCase();
+        }
+        return subtag.toLowerCase();
+    })
+        .join("-");
 }
 /**
  * Picks the best well-formed tag from an Accept-Language header (RFC 9110

package/dist/i18n/required-surface-keys.js

@@ -46,6 +46,24 @@ function pushSectionTitles(out, section, treatAsKey = false) {
     for (const group of section.groups ?? [])
         pushKey(out, group.title, treatAsKey);
 }
+// Field labels and section titles of a step rendered through the action-form shim.
+function pushActionFormShapedKeys(out, featureName, step) {
+    for (const fieldName of Object.keys(step.fields)) {
+        out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
+    }
+    for (const section of step.layout.sections) {
+        if (isExtensionEditSection(section)) {
+            pushKey(out, section.title);
+            continue;
+        }
+        if (section.kind === "relatedList")
+            continue; // rejected at boot, unreachable here
+        pushSectionTitles(out, section);
+        for (const f of sectionFieldSpecs(section)) {
+            out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, editFieldName(f)));
+        }
+    }
+}
 function pushRowActionKeys(out, action) {
     pushKey(out, action.label);
     if (action.kind === "writeHandler" || action.kind === undefined) {
@@ -242,26 +260,9 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
             break;
         }
         case "secretMint": {
-            // Mirrors the actionForm case above (submitLabel, fields/section titles
-            // via ACTION_FORM_ENTITY) plus the reveal-phase's own i18n surface.
             const mint = screen;
             pushKey(out, mint.submitLabel);
-            for (const fieldName of Object.keys(mint.fields)) {
-                out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
-            }
-            for (const section of mint.layout.sections) {
-                if (isExtensionEditSection(section)) {
-                    pushKey(out, section.title);
-                    continue;
-                }
-                if (section.kind === "relatedList")
-                    continue; // rejected at boot, unreachable here
-                pushSectionTitles(out, section);
-                for (const f of sectionFieldSpecs(section)) {
-                    const fieldName = editFieldName(f);
-                    out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
-                }
-            }
+            pushActionFormShapedKeys(out, featureName, mint);
             pushKey(out, mint.reveal.title);
             pushKey(out, mint.reveal.warning);
             pushKey(out, mint.reveal.confirmLabel);
@@ -271,22 +272,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
             if (mint.confirm !== undefined) {
                 pushKey(out, mint.confirm.submitLabel);
                 pushKey(out, mint.confirm.doneMessage);
-                for (const fieldName of Object.keys(mint.confirm.fields)) {
-                    out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
-                }
-                for (const section of mint.confirm.layout.sections) {
-                    if (isExtensionEditSection(section)) {
-                        pushKey(out, section.title);
-                        continue;
-                    }
-                    if (section.kind === "relatedList")
-                        continue; // rejected at boot, unreachable here
-                    pushSectionTitles(out, section);
-                    for (const f of sectionFieldSpecs(section)) {
-                        const fieldName = editFieldName(f);
-                        out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
-                    }
-                }
+                pushActionFormShapedKeys(out, featureName, mint.confirm);
             }
             break;
         }
@@ -353,6 +339,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
                 }
                 if (isWriteFormEditSection(section)) {
                     pushKey(out, section.title);
+                    pushKey(out, section.description);
                     pushKey(out, section.submitLabel);
                     // kumiko-lint-ignore section-fields-raw writeForm sections carry no groups (EditWriteFormSection)
                     for (const f of section.fields) {
@@ -404,7 +391,8 @@ function collectEntityListFilterKeys(feature, out) {
                     out.add(key);
                 }
             }
-            else if (def.type === "select" && Array.isArray(def.options)) {
+            else if ((def.type === "select" || def.type === "multiSelect") &&
+                Array.isArray(def.options)) {
                 for (const value of def.options) {
                     out.add(selectFacetOptionKey(feature.name, screen.entity, fieldName, value));
                 }

package/dist/i18n/settings-hub-keys.js

@@ -39,5 +39,8 @@ export const SETTINGS_HUB_I18N = {
     "config.secrets.placeholder": { en: "Enter a value" },
     "config.secrets.replacePlaceholder": { en: "Enter a new value to replace it" },
     "config.secrets.delete": { en: "Remove" },
+    "config.secrets.deleteConfirm": {
+        en: "Remove this secret? Anything using it stops working, and it cannot be restored.",
+    },
     "screen:secrets.title": { en: "Secrets" },
 };

package/dist/jobs/index.d.ts

@@ -1,2 +1,2 @@
-export type { JobLogEntry, JobMeta, JobOutcomeMeta, JobRunner, JobRunnerOptions, } from "./job-runner.js";
-export { createJobRunner } from "./job-runner.js";
+export type { JobLogEntry, JobMeta, JobOutcomeMeta, JobRunner, JobRunnerOptions, JobSubjectValue, } from "./job-runner.js";
+export { createJobRunner, serializeJobSubject } from "./job-runner.js";

package/dist/jobs/index.js

@@ -1 +1 @@
-export { createJobRunner } from "./job-runner.js";
+export { createJobRunner, serializeJobSubject } from "./job-runner.js";

package/dist/jobs/job-runner.d.ts

@@ -28,6 +28,8 @@ export type JobOutcomeMeta = {
         readonly messageKey: string | null;
     } | undefined;
 };
+export type JobSubjectValue = string | number | boolean | null;
+export declare function serializeJobSubject(subject: Readonly<Record<string, JobSubjectValue>>): string;
 export type JobRunner = {
     start(): Promise<void>;
     stop(): Promise<void>;