@cosmicdrift/kumiko-framework 0.336.1 → 0.338.0

package/dist/engine/feature-ast/pattern-change-schema.js

@@ -21,6 +21,7 @@
 // resolve this statically" markers) and, for EntityDefinition only,
 // additionally checked for field-type membership via the shared
 // `findUnknownEntityFieldTypes` helper (kept in sync with `extractEntity`).
+import { ESCAPE_HATCH_GRANTS } from "@cosmicdrift/kumiko-types/handlers";
 import * as z from "zod";
 import { LifecycleHookTypes } from "../constants.js";
 import { describeUnknownFieldType, findUnknownEntityFieldTypes } from "./entity-field-types.js";
@@ -131,6 +132,7 @@ const escapeHatchSchema = z
     reason: z.string().refine((s) => s.trim().length > 0, {
         message: "reason must be non-empty",
     }),
+    grants: z.array(z.enum(ESCAPE_HATCH_GRANTS)).min(1).optional(),
 })
     .strict();
 const rawRefSentinelSchema = z.object({ __raw: z.string() }).strict();
@@ -413,6 +415,14 @@ const secretSchema = z
     options: passthroughSchema(),
 })
     .strict();
+const secretNamespaceSchema = z
+    .object({
+    kind: z.literal("secretNamespace"),
+    source: sourceFieldSchema,
+    shortName: z.string(),
+    options: passthroughSchema(),
+})
+    .strict();
 const claimKeySchema = z
     .object({
     kind: z.literal("claimKey"),
@@ -707,6 +717,7 @@ export const PATTERN_SCHEMAS_BY_KIND = {
     uiHints: uiHintsSchema,
     metric: metricSchema,
     secret: secretSchema,
+    secretNamespace: secretNamespaceSchema,
     claimKey: claimKeySchema,
     referenceData: referenceDataSchema,
     readsConfig: readsConfigSchema,
@@ -733,7 +744,7 @@ export const PATTERN_SCHEMAS_BY_KIND = {
     "ai.classify": aiClassifySchema,
     unknown: unknownPatternSchema,
 };
-const patternSchema = z.discriminatedUnion("kind", [
+export const patternSchema = z.discriminatedUnion("kind", [
     entitySchema,
     relationSchema,
     navSchema,
@@ -748,6 +759,7 @@ const patternSchema = z.discriminatedUnion("kind", [
     uiHintsSchema,
     metricSchema,
     secretSchema,
+    secretNamespaceSchema,
     claimKeySchema,
     referenceDataSchema,
     readsConfigSchema,
@@ -810,6 +822,9 @@ const patternIdMetricSchema = z
 const patternIdSecretSchema = z
     .object({ kind: z.literal("secret"), shortName: z.string() })
     .strict();
+const patternIdSecretNamespaceSchema = z
+    .object({ kind: z.literal("secretNamespace"), shortName: z.string() })
+    .strict();
 const patternIdClaimKeySchema = z
     .object({ kind: z.literal("claimKey"), shortName: z.string() })
     .strict();
@@ -870,6 +885,7 @@ export const PATTERN_ID_SCHEMAS_BY_KIND = {
     hook: patternIdHookSchema,
     metric: patternIdMetricSchema,
     secret: patternIdSecretSchema,
+    secretNamespace: patternIdSecretNamespaceSchema,
     claimKey: patternIdClaimKeySchema,
     referenceData: patternIdReferenceDataSchema,
     useExtension: patternIdUseExtensionSchema,
@@ -895,7 +911,7 @@ export const PATTERN_ID_SCHEMAS_BY_KIND = {
     authClaims: patternIdAuthClaimsSchema,
     treeActions: patternIdTreeActionsSchema,
 };
-const patternIdSchema = z.discriminatedUnion("kind", [
+export const patternIdSchema = z.discriminatedUnion("kind", [
     patternIdEntitySchema,
     patternIdRelationSchema,
     patternIdNavSchema,
@@ -907,6 +923,7 @@ const patternIdSchema = z.discriminatedUnion("kind", [
     patternIdHookSchema,
     patternIdMetricSchema,
     patternIdSecretSchema,
+    patternIdSecretNamespaceSchema,
     patternIdClaimKeySchema,
     patternIdReferenceDataSchema,
     patternIdUseExtensionSchema,

package/dist/engine/feature-ast/patterns.d.ts

@@ -1,6 +1,6 @@
 import type { LifecycleHookType } from "../constants.js";
 import type { ConfigKeyDefinition, ConfigKeyType, JobDefinition, ReferenceDataDef, RunIn, TranslationKeys } from "../types/config.js";
-import type { MetricOptions, SecretOptions } from "../types/feature.js";
+import type { MetricOptions, SecretNamespaceOptions, SecretOptions } from "../types/feature.js";
 import type { EntityDefinition } from "../types/fields.js";
 import type { AccessRule, AgentHandlerHints, ClaimKeyType, EscapeHatchDeclaration, RateLimitDeclaration } from "../types/handlers.js";
 import type { HookPhase } from "../types/hooks.js";
@@ -86,6 +86,12 @@ export type SecretPattern = {
     readonly shortName: string;
     readonly options: SecretOptions;
 };
+export type SecretNamespacePattern = {
+    readonly kind: "secretNamespace";
+    readonly source: SourceLocation;
+    readonly shortName: string;
+    readonly options: SecretNamespaceOptions;
+};
 export type ClaimKeyPattern = {
     readonly kind: "claimKey";
     readonly source: SourceLocation;
@@ -295,7 +301,7 @@ export type UnknownPattern = {
     readonly source: SourceLocation;
     readonly methodName: string;
 };
-export type FeaturePattern = EntityPattern | RelationPattern | NavPattern | WorkspacePattern | ConfigPattern | TranslationsPattern | RequiresPattern | OptionalRequiresPattern | SystemScopePattern | ToggleablePattern | DescribePattern | UiHintsPattern | MetricPattern | SecretPattern | ClaimKeyPattern | ReferenceDataPattern | ReadsConfigPattern | UseExtensionPattern | UsesApiPattern | ExposesApiPattern | TreeActionsPattern | ScreenPattern | WriteHandlerPattern | QueryHandlerPattern | StreamHandlerPattern | HookPattern | JobPattern | NotificationPattern | AuthClaimsPattern | HttpRoutePattern | ProjectionPattern | MultiStreamProjectionPattern | DefineEventPattern | ExtendsRegistrarPattern | EnvSchemaPattern | AiGeneratePattern | AiExtractPattern | AiClassifyPattern | UnknownPattern;
+export type FeaturePattern = EntityPattern | RelationPattern | NavPattern | WorkspacePattern | ConfigPattern | TranslationsPattern | RequiresPattern | OptionalRequiresPattern | SystemScopePattern | ToggleablePattern | DescribePattern | UiHintsPattern | MetricPattern | SecretPattern | SecretNamespacePattern | ClaimKeyPattern | ReferenceDataPattern | ReadsConfigPattern | UseExtensionPattern | UsesApiPattern | ExposesApiPattern | TreeActionsPattern | ScreenPattern | WriteHandlerPattern | QueryHandlerPattern | StreamHandlerPattern | HookPattern | JobPattern | NotificationPattern | AuthClaimsPattern | HttpRoutePattern | ProjectionPattern | MultiStreamProjectionPattern | DefineEventPattern | ExtendsRegistrarPattern | EnvSchemaPattern | AiGeneratePattern | AiExtractPattern | AiClassifyPattern | UnknownPattern;
 export type FeaturePatternKind = FeaturePattern["kind"];
 export type Editability = "static" | "mixed" | "opaque";
 export declare function getEditability(pattern: FeaturePattern): Editability;

package/dist/engine/feature-ast/patterns.js

@@ -74,6 +74,7 @@ export function getEditability(pattern) {
         case "describe":
         case "metric":
         case "secret":
+        case "secretNamespace":
         case "claimKey":
         case "referenceData":
         case "readsConfig":

package/dist/engine/feature-ast/render.js

@@ -61,6 +61,8 @@ export function renderPattern(pattern) {
             return renderMetric(pattern);
         case "secret":
             return renderSecret(pattern);
+        case "secretNamespace":
+            return renderSecretNamespace(pattern);
         case "claimKey":
             return renderClaimKey(pattern);
         case "referenceData":
@@ -245,6 +247,13 @@ function renderSecret(p) {
     const merged = { name: p.shortName, ...p.options };
     return `r.secret(${renderValue(merged)});`;
 }
+function renderSecretNamespace(p) {
+    if (isRawRefSentinel(p.options)) {
+        return `r.secretNamespace(${JSON.stringify(p.shortName)}, ${p.options.__raw});`;
+    }
+    const merged = { name: p.shortName, ...p.options };
+    return `r.secretNamespace(${renderValue(merged)});`;
+}
 function renderClaimKey(p) {
     return `r.claimKey(${renderValue({ name: p.shortName, type: p.claimType })});`;
 }

package/dist/engine/feature-builder-state.d.ts

@@ -2,7 +2,7 @@ import type { WebSocketRouteDefinition } from "@cosmicdrift/kumiko-types/websock
 import type * as z from "zod";
 import type { ZodType } from "zod";
 import type { HttpRouteDefinition } from "./types/http-route.js";
-import type { AuthClaimsFn, BootCheckFn, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventMigrationDef, ExtensionSelectorDef, FeatureMetricDef, JobDefinition, LifecycleHookFn, MultiStreamProjectionDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, SearchPayloadContributorFn, SecretKeyDefinition, StoreTableEntry, StreamHandlerDef, TranslationKeys, TreeActionDef, UiHints, ValidationHookFn, WriteHandlerDef } from "./types/index.js";
+import type { AuthClaimsFn, BootCheckFn, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventMigrationDef, ExtensionSelectorDef, FeatureMetricDef, JobDefinition, LifecycleHookFn, MultiStreamProjectionDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, SearchPayloadContributorFn, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableEntry, StreamHandlerDef, TranslationKeys, TreeActionDef, UiHints, ValidationHookFn, WriteHandlerDef } from "./types/index.js";
 import type { ContentCollectionDefinition, NavDefinition } from "./types/nav.js";
 import type { ScreenDefinition } from "./types/screen.js";
 import type { WorkspaceDefinition } from "./types/workspace.js";
@@ -46,6 +46,7 @@ export type FeatureBuilderState = {
     handlerEntityMappings: Record<string, string>;
     metrics: Record<string, FeatureMetricDef>;
     secretKeys: Record<string, SecretKeyDefinition>;
+    secretNamespaces: Record<string, SecretNamespaceDefinition>;
     projections: Record<string, ProjectionDefinition>;
     multiStreamProjections: Record<string, MultiStreamProjectionDefinition>;
     entityProjectionExtensions: Record<string, EntityProjectionExtension[]>;

package/dist/engine/feature-builder-state.js

@@ -41,6 +41,7 @@ export function createInitialFeatureBuilderState() {
         handlerEntityMappings: {},
         metrics: {},
         secretKeys: {},
+        secretNamespaces: {},
         projections: {},
         multiStreamProjections: {},
         entityProjectionExtensions: {},

package/dist/engine/feature-config-events-jobs.d.ts

@@ -1,7 +1,7 @@
 import type * as z from "zod";
 import { type ZodType } from "zod";
 import type { FeatureBuilderState } from "./feature-builder-state.js";
-import type { AuthClaimsFn, ClaimKeyHandle, ClaimKeyType, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigSeedDef, DeclarativeEventMigration, EventDef, EventPiiStance, EventUpcastFn, JobDefinition, JobHandlerFn, MetricOptions, NameOrRef, NotificationDataFn, NotificationRecipientFn, NotificationTemplateFn, QualifiedEventName, SecretKeyHandle, SecretOptions, TranslationsDef } from "./types/index.js";
+import type { AuthClaimsFn, ClaimKeyHandle, ClaimKeyType, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigSeedDef, DeclarativeEventMigration, EventDef, EventPiiStance, EventUpcastFn, JobDefinition, JobHandlerFn, MetricOptions, NameOrRef, NotificationDataFn, NotificationRecipientFn, NotificationTemplateFn, QualifiedEventName, SecretKeyHandle, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, TranslationsDef } from "./types/index.js";
 export declare function buildConfigEventsJobsMethods<TName extends string>(state: FeatureBuilderState, name: TName): {
     config: {
         <T extends ConfigKeyType>(keyName: string, def: ConfigKeyDefinition<T>): ConfigKeyHandle<T>;
@@ -48,6 +48,9 @@ export declare function buildConfigEventsJobsMethods<TName extends string>(state
     secret(shortNameOrDefinition: string | ({
         readonly name: string;
     } & SecretOptions), options?: SecretOptions): SecretKeyHandle;
+    secretNamespace(shortNameOrDefinition: string | ({
+        readonly name: string;
+    } & SecretNamespaceOptions), options?: SecretNamespaceOptions): SecretNamespaceHandle;
     claimKey<T extends ClaimKeyType>(shortNameOrDefinition: string | {
         readonly name: string;
         readonly type: T;

package/dist/engine/feature-config-events-jobs.js

@@ -1,4 +1,4 @@
-import { normalizeEventPiiSubject } from "@cosmicdrift/kumiko-types/handlers";
+import { escapeHatchGrantsProblem, normalizeEventPiiSubject, } from "@cosmicdrift/kumiko-types/handlers";
 import { ZodObject } from "zod";
 import { resolveName } from "./handler-helpers.js";
 import { splitNamedDefinition, unwrapArrayForm } from "./object-form.js";
@@ -124,6 +124,10 @@ export function buildConfigEventsJobsMethods(state, name) {
                 throw new Error(`[Feature ${name}] r.job("${jobName}") declares { escapeHatch: { reason: "" } } — ` +
                     "the reason must be a non-empty string explaining why this job needs unfiltered database access.");
             }
+            const jobGrantsProblem = jobOptions.escapeHatch && escapeHatchGrantsProblem(jobOptions.escapeHatch);
+            if (jobGrantsProblem) {
+                throw new Error(`[Feature ${name}] r.job("${jobName}") declares an invalid escapeHatch — ${jobGrantsProblem}`);
+            }
             // Resolve NameOrRef(s) in trigger.on. Multi-Trigger-Form: Array
             // wird zu Array von resolved strings, Single bleibt single string —
             // job-runner unterscheidet anhand Array.isArray.
@@ -235,6 +239,10 @@ export function buildConfigEventsJobsMethods(state, name) {
                 throw new Error(`[Feature ${name}] Secret "${shortName}" already registered. ` +
                     `Secret key names must be unique per feature.`);
             }
+            if (secretOptions.writeRoles !== undefined && secretOptions.writeRoles.length === 0) {
+                throw new Error(`[Feature ${name}] Secret "${shortName}" declares an empty writeRoles list, ` +
+                    `which nobody could ever satisfy. Omit writeRoles to fall back to the secrets handler access.`);
+            }
             // Qualified name follows the framework's "<feature>:<type>:<name>"
             // QN convention — same pattern config / jobs / events use. toKebab
             // handles the common input shapes ("stripe.apiKey" → "stripe-api-key")
@@ -248,6 +256,22 @@ export function buildConfigEventsJobsMethods(state, name) {
             };
             return { name: qualifiedName };
         },
+        secretNamespace(shortNameOrDefinition, options) {
+            const [shortName, namespaceOptions] = typeof shortNameOrDefinition === "string"
+                ? [shortNameOrDefinition, options]
+                : splitNamedDefinition(shortNameOrDefinition);
+            if (state.secretNamespaces[shortName]) {
+                throw new Error(`[Feature ${name}] Secret namespace "${shortName}" already registered. ` +
+                    `Secret namespace names must be unique per feature.`);
+            }
+            if (namespaceOptions.writeRoles !== undefined && namespaceOptions.writeRoles.length === 0) {
+                throw new Error(`[Feature ${name}] Secret namespace "${shortName}" declares an empty writeRoles list, ` +
+                    `which nobody could ever satisfy. Omit writeRoles to fall back to the secrets handler access.`);
+            }
+            const qualifiedPrefix = `${toKebab(name)}:${toKebab(shortName)}.`;
+            state.secretNamespaces[shortName] = { shortName, qualifiedPrefix, ...namespaceOptions };
+            return { prefix: qualifiedPrefix, keyFor: (suffix) => `${qualifiedPrefix}${suffix}` };
+        },
         claimKey(shortNameOrDefinition, options) {
             const shortName = typeof shortNameOrDefinition === "string"
                 ? shortNameOrDefinition

package/dist/engine/feature-manifest.d.ts

@@ -7,6 +7,7 @@ export type ManifestConfigKey = {
     readonly default: string | number | boolean | null;
     readonly encrypted: boolean;
     readonly computed: boolean;
+    readonly validated: boolean;
     readonly options: readonly string[] | null;
     readonly bounds: {
         readonly min?: number;

package/dist/engine/feature-manifest.js

@@ -29,6 +29,7 @@ export function buildManifestFromRegistry(registry, options) {
                 default: def.default ?? null,
                 encrypted: isEncryptedAtRest(def),
                 computed: def.computed !== undefined,
+                validated: def.validate !== undefined,
                 options: def.options ?? null,
                 bounds: def.bounds ?? null,
                 pattern: def.pattern ?? null,

package/dist/engine/feature-ui-extensions.js

@@ -1,3 +1,4 @@
+import { escapeHatchGrantsProblem } from "@cosmicdrift/kumiko-types/handlers";
 import { WEBSOCKET_MAX_CONNECTIONS_PER_USER_LIMIT, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_ROUTE_PATH_PREFIX, } from "@cosmicdrift/kumiko-types/websocket-route";
 import { bindHookEscapeHatchGrant } from "../pipeline/system-identity-switch.js";
 import { LifecycleHookTypes } from "./constants.js";
@@ -99,7 +100,10 @@ export function buildUiExtensionsMethods(state, name) {
                 `Nav ids must be unique per feature — remove the standalone ` +
                 `r.nav("${navDefinition.id}", ...) call or the screen's inline nav.`);
         }
-        state.navs[navDefinition.id] = navDefinition;
+        // Explicit `undefined` values (e.g. `icon: cond ? "x" : undefined`) would trip
+        // buildAppSchema's JSON-safety check, so strip them for every nav path.
+        // @cast-boundary engine-bridge — filtering undefined keeps the NavDefinition shape.
+        state.navs[navDefinition.id] = Object.fromEntries(Object.entries(navDefinition).filter(([, value]) => value !== undefined));
     }
     return {
         hook(type, target, fn, options) {
@@ -114,6 +118,10 @@ export function buildUiExtensionsMethods(state, name) {
                 throw new Error(`[Feature ${name}] r.hook("${type}", ...) declares { escapeHatch: { reason: "" } } — ` +
                     "the reason must be a non-empty string explaining why this hook switches identity to SYSTEM.");
             }
+            const hookGrantsProblem = options?.escapeHatch && escapeHatchGrantsProblem(options.escapeHatch);
+            if (hookGrantsProblem) {
+                throw new Error(`[Feature ${name}] r.hook("${type}", ...) declares an invalid escapeHatch — ${hookGrantsProblem}`);
+            }
             // Wrapped once for both branches below; validation hooks stay unwrapped (no context).
             const hookLabel = `${type} hook of feature "${name}"`;
             const wrapped = type === "validation"
@@ -208,6 +216,10 @@ export function buildUiExtensionsMethods(state, name) {
                     throw new Error(`[Feature ${name}] r.useExtension("${extensionName}", "${resolvedEntityName}", ...) declares an invalid { escapeHatch } — ` +
                         `must be { reason: "<non-empty string>" } explaining why this usage needs unfiltered db access.`);
                 }
+                const extGrantsProblem = escapeHatchGrantsProblem(escapeHatch);
+                if (extGrantsProblem) {
+                    throw new Error(`[Feature ${name}] r.useExtension("${extensionName}", "${resolvedEntityName}", ...) declares an invalid { escapeHatch } — ${extGrantsProblem}`);
+                }
             }
             state.extensionUsages.push({
                 extensionName,
@@ -337,15 +349,12 @@ export function buildUiExtensionsMethods(state, name) {
                 // Sugar for the common "one nav entry pointing at this screen"
                 // case — synthesizes id/screen from the screen's own id. Beyond
                 // label/icon/parent/order, declare a standalone r.nav() instead.
-                // Optional fields stay absent rather than explicitly undefined —
-                // buildAppSchema's JSON-safety check flags undefined values. Same
-                // pattern as r.contentCollection() below.
                 registerNav({
                     id: definition.id,
                     label: definition.nav.label,
-                    ...(definition.nav.icon !== undefined && { icon: definition.nav.icon }),
-                    ...(definition.nav.parent !== undefined && { parent: definition.nav.parent }),
-                    ...(definition.nav.order !== undefined && { order: definition.nav.order }),
+                    icon: definition.nav.icon,
+                    parent: definition.nav.parent,
+                    order: definition.nav.order,
                     screen: `${name}:screen:${definition.id}`,
                 });
             }
@@ -359,26 +368,20 @@ export function buildUiExtensionsMethods(state, name) {
                     `Collection ids must be unique per feature.`);
             }
             // registerNav owns the kebab + collision checks, including collisions
-            // with a plain r.nav() of the same id. Optional fields stay absent
-            // rather than explicitly undefined — buildAppSchema's JSON-safety check
-            // flags undefined values.
+            // with a plain r.nav() of the same id.
             registerNav({
                 id: definition.id,
                 label: definition.nav.label,
-                ...(definition.nav.icon !== undefined && { icon: definition.nav.icon }),
-                ...(definition.nav.parent !== undefined && { parent: definition.nav.parent }),
-                ...(definition.nav.order !== undefined && { order: definition.nav.order }),
+                icon: definition.nav.icon,
+                parent: definition.nav.parent,
+                order: definition.nav.order,
                 // Nav visibility follows the collection's access unless the caller
                 // overrode it — a node the handler would refuse has no business in
                 // the sidebar.
-                ...((definition.nav.access ?? definition.access) !== undefined && {
-                    access: definition.nav.access ?? definition.access,
-                }),
-                ...(definition.nav.workspaces !== undefined && { workspaces: definition.nav.workspaces }),
-                ...(definition.nav.createAction !== undefined && {
-                    createAction: definition.nav.createAction,
-                }),
-                ...(definition.nav.actions !== undefined && { actions: definition.nav.actions }),
+                access: definition.nav.access ?? definition.access,
+                workspaces: definition.nav.workspaces,
+                createAction: definition.nav.createAction,
+                actions: definition.nav.actions,
                 // The tree children come from a runtime provider keyed on this QN —
                 // a collection without it would render as an empty leaf.
                 provider: true,

package/dist/engine/index.d.ts

@@ -73,7 +73,7 @@ export { describeWorkflowStepError } from "./steps/describe-workflow-step-error.
 export { ANONYMOUS_ROLE, ANONYMOUS_USER_ID, createAnonymousUser, createSystemUser, SYSTEM_ROLE, SYSTEM_USER_ID, } from "./system-user.js";
 export { type EffectiveFeaturesResolver, findTierResolverUsage, isTierResolverPlugin, TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin, type TrialGate, } from "./tier-resolver-extension.js";
 export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID } from "./types/identifiers.js";
-export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, CamelToKebab, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DateFieldDef, DecimalFieldDef, DeleteContext, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EntityDefinition, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationRecipientFn, NotificationTemplateFn, NotifyFactory, NotifyFn, NotifyOptions, NotifyPriority, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TenantId, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.js";
+export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, CamelToKebab, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DateFieldDef, DecimalFieldDef, DeleteContext, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EntityDefinition, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationRecipientFn, NotificationTemplateFn, NotifyFactory, NotifyFn, NotifyOptions, NotifyPriority, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TenantId, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.js";
 export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, HookPhases, isAgentVisibleScreen, isOpenToAllGranted, resolveAgentExposure, } from "./types/index.js";
 export type { AwaitedEventType, PipelineBuildCtx, PipelineCtx, PipelineDef, StepBuilder, StepDef, StepFailureStrategy, StepInstance, StepKind, StepNamespace, StepResolver, } from "./types/step.js";
 export { runValidation } from "./validation.js";

package/dist/engine/pattern-library/library.js

@@ -14,7 +14,7 @@
 // the Designer/LLM relies on.
 import { aiClassifySchema, aiExtractSchema, aiGenerateSchema, authClaimsSchema, defineEventSchema, hookSchema, httpRouteSchema, jobSchema, multiStreamProjectionSchema, notificationSchema, projectionSchema, queryHandlerSchema, screenSchema, streamHandlerSchema, writeHandlerSchema, } from "./mixed-schemas.js";
 import { envSchemaSchema, exposesApiSchema, extendsRegistrarSchema, treeActionsSchema, unknownSchema, usesApiSchema, } from "./opaque-schemas.js";
-import { claimKeySchema, configSchema, describeSchema, entitySchema, metricSchema, navSchema, optionalRequiresSchema, readsConfigSchema, referenceDataSchema, relationSchema, requiresSchema, secretSchema, systemScopeSchema, toggleableSchema, translationsSchema, uiHintsSchema, useExtensionSchema, workspaceSchema, } from "./static-schemas.js";
+import { claimKeySchema, configSchema, describeSchema, entitySchema, metricSchema, navSchema, optionalRequiresSchema, readsConfigSchema, referenceDataSchema, relationSchema, requiresSchema, secretNamespaceSchema, secretSchema, systemScopeSchema, toggleableSchema, translationsSchema, uiHintsSchema, useExtensionSchema, workspaceSchema, } from "./static-schemas.js";
 export const PATTERN_LIBRARY = {
     requires: requiresSchema,
     optionalRequires: optionalRequiresSchema,
@@ -31,6 +31,7 @@ export const PATTERN_LIBRARY = {
     translations: translationsSchema,
     metric: metricSchema,
     secret: secretSchema,
+    secretNamespace: secretNamespaceSchema,
     claimKey: claimKeySchema,
     referenceData: referenceDataSchema,
     useExtension: useExtensionSchema,

package/dist/engine/pattern-library/static-schemas.d.ts

@@ -14,6 +14,7 @@ export declare const configSchema: PatternFormSchema;
 export declare const translationsSchema: PatternFormSchema;
 export declare const metricSchema: PatternFormSchema;
 export declare const secretSchema: PatternFormSchema;
+export declare const secretNamespaceSchema: PatternFormSchema;
 export declare const claimKeySchema: PatternFormSchema;
 export declare const referenceDataSchema: PatternFormSchema;
 export declare const useExtensionSchema: PatternFormSchema;

package/dist/engine/pattern-library/static-schemas.js

@@ -351,10 +351,53 @@ export const secretSchema = {
             path: "options.scope",
             label: { en: "Scope", de: "Geltungsbereich" },
             input: "select",
-            options: [
-                { value: "tenant", label: { en: "Tenant" } },
-                { value: "system", label: { en: "System" } },
-            ],
+            options: [{ value: "tenant", label: { en: "Tenant" } }],
+        },
+        {
+            path: "options.writeRoles",
+            label: { en: "Write roles", de: "Schreibrollen" },
+            hint: {
+                en: "Roles allowed to set or delete. Leave empty to rely on the secrets handler access alone.",
+                de: "Rollen, die setzen oder löschen dürfen. Leer lassen, dann entscheidet allein der Handler-Zugriff.",
+            },
+            input: "string-list",
+        },
+    ],
+};
+export const secretNamespaceSchema = {
+    kind: "secretNamespace",
+    label: { en: "Secret namespace", de: "Secret-Namespace" },
+    summary: { en: "Family of tenant-scoped secrets with a runtime-chosen name." },
+    category: "meta",
+    editability: "static",
+    fields: [
+        {
+            path: "shortName",
+            label: { en: "Short name", de: "Kurzname" },
+            input: "text",
+            required: true,
+        },
+        {
+            path: "options.label",
+            label: { en: "UI label (i18n)", de: "UI-Label (i18n)" },
+            hint: { en: "{ en: 'Webhook token', de: 'Webhook-Token' }" },
+            input: "json-readonly",
+            required: true,
+        },
+        {
+            path: "options.scope",
+            label: { en: "Scope", de: "Geltungsbereich" },
+            input: "select",
+            options: [{ value: "tenant", label: { en: "Tenant" } }],
+        },
+        {
+            path: "options.writeRoles",
+            label: { en: "Write roles", de: "Schreibrollen" },
+            hint: {
+                en: "Roles allowed to set or delete. Leave empty to rely on the secrets handler access alone.",
+                de: "Rollen, die setzen oder löschen dürfen. Leer lassen, dann entscheidet allein der Handler-Zugriff.",
+            },
+            input: "string-list",
         },
     ],
 };

package/dist/engine/registry-facade.js

@@ -125,6 +125,13 @@ export function buildRegistryFacade(state) {
         getSecretKey(qualifiedName) {
             return state.secretKeyMap.get(qualifiedName);
         },
+        findSecretNamespace(key) {
+            for (const [prefix, def] of state.secretNamespaceMap) {
+                if (key.startsWith(prefix))
+                    return def;
+            }
+            return undefined;
+        },
         getConfigKey(qualifiedKey) {
             return state.configKeyMap.get(qualifiedKey);
         },

package/dist/engine/registry-ingest.js

@@ -221,6 +221,13 @@ export function populateMetricsAndSecrets(state, feature) {
         }
         state.secretKeyMap.set(def.qualifiedName, def);
     }
+    for (const def of Object.values(feature.secretNamespaces ?? {})) {
+        if (state.secretNamespaceMap.has(def.qualifiedPrefix)) {
+            throw new Error(`[Kumiko Secrets] Secret namespace "${def.qualifiedPrefix}" registered multiple times. ` +
+                "Namespace prefixes must be globally unique across features.");
+        }
+        state.secretNamespaceMap.set(def.qualifiedPrefix, def);
+    }
 }
 // Explicit + multi-stream projections (source-entity indexed) + store tables +
 // unmanaged tables (both cross-feature-uniqueness-by-physical-name guarded).

package/dist/engine/registry-state.d.ts

@@ -1,5 +1,5 @@
 import { type QnType, qualifyEntityName } from "./qualified-name.js";
-import type { AuthClaimsHookDef, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventDef, EventUpcastFn, ExtensionSelectorPanel, FeatureDefinition, FeatureMetricDef, HookPhase, JobDefinition, MultiStreamProjectionDefinition, NavDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, ScreenDefinition, SearchPayloadContributorFn, SecretKeyDefinition, StoreTableDef, StreamHandlerDef, TranslationValue, TreeActionDef, WorkspaceDefinition, WriteHandlerDef } from "./types/index.js";
+import type { AuthClaimsHookDef, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventDef, EventUpcastFn, ExtensionSelectorPanel, FeatureDefinition, FeatureMetricDef, HookPhase, JobDefinition, MultiStreamProjectionDefinition, NavDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, ScreenDefinition, SearchPayloadContributorFn, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableDef, StreamHandlerDef, TranslationValue, TreeActionDef, WorkspaceDefinition, WriteHandlerDef } from "./types/index.js";
 export type IncomingRelation = {
     sourceEntity: string;
     relationName: string;
@@ -54,6 +54,7 @@ export type RegistryState = {
         readonly featureName: string;
     }>;
     secretKeyMap: Map<string, SecretKeyDefinition>;
+    secretNamespaceMap: Map<string, SecretNamespaceDefinition>;
     projectionMap: Map<string, ProjectionDefinition>;
     projectionsBySource: Map<string, ProjectionDefinition[]>;
     multiStreamProjectionMap: Map<string, MultiStreamProjectionDefinition>;

package/dist/engine/registry-state.js

@@ -122,6 +122,7 @@ export function createInitialState() {
         mergedTranslations: {},
         metricMap: new Map(),
         secretKeyMap: new Map(),
+        secretNamespaceMap: new Map(),
         projectionMap: new Map(),
         projectionsBySource: new Map(),
         multiStreamProjectionMap: new Map(),

package/dist/engine/registry-validate.d.ts

@@ -16,7 +16,7 @@ export declare function validateRequiredFeatures(state: RegistryState, features:
 export declare function resolveNotificationTriggersAndRegisterHooks(state: RegistryState): void;
 export declare function validateLifecycleHookTargets(state: RegistryState): void;
 export declare function validateEntityHookTargets(state: RegistryState, features: readonly FeatureDefinition[]): void;
-export declare function validateJobTriggers(state: RegistryState): void;
+export declare function resolveJobTriggers(state: RegistryState): void;
 export declare function validateLiveEntities(state: RegistryState): void;
 export declare function validateBootGates(state: RegistryState): void;
 export declare function validateJobBackoff(state: RegistryState): void;

package/dist/engine/registry-validate.js

@@ -544,29 +544,51 @@ export function validateEntityHookTargets(state, features) {
         }
     }
 }
-export function validateJobTriggers(state) {
-    // Validate: job event triggers must reference an existing write/query
-    // handler OR an existing r.defineEvent registration. The latter is
-    // delivered async via the job-trigger event-consumer (server.ts), not
-    // the synchronous write-handler dispatch path — see
-    // createJobTriggerEventConsumer in pipeline/system-hooks.ts.
-    // Multi-Trigger-Form: jeden Eintrag im Array gegen allHandlers prüfen,
-    // auch wenn nur einer fehlt fail-fast.
+export function resolveJobTriggers(state) {
+    // Job event triggers must reference an existing write/query handler OR an
+    // existing r.defineEvent registration. The latter is delivered async via the
+    // job-trigger event-consumer (server.ts), not the synchronous write-handler
+    // dispatch path — see createJobTriggerEventConsumer in
+    // pipeline/system-hooks.ts. Short names are qualified against the job's own
+    // feature and written back, because the job runner matches by exact QN.
     const allHandlers = allHandlerQns(state);
     for (const [jobName, jobDef] of state.jobMap) {
         if (!("on" in jobDef.trigger))
             continue;
+        const featureName = state.jobFeatureMap.get(jobName);
         const triggerOn = jobDef.trigger.on;
-        const triggers = Array.isArray(triggerOn) ? triggerOn : [triggerOn];
-        for (const t of triggers) {
-            const rawName = resolveName(t);
-            if (allHandlers.has(rawName))
-                continue;
-            if (state.eventMap.has(rawName))
-                continue;
-            throw new Error(`Job "${jobName}" triggers on "${rawName}" but no handler or event with that name exists`);
-        }
+        const resolveTrigger = (trigger) => resolveJobTriggerName(state, allHandlers, jobName, featureName, resolveName(trigger));
+        const resolvedOn = isNameOrRefList(triggerOn)
+            ? triggerOn.map(resolveTrigger)
+            : resolveTrigger(triggerOn);
+        state.jobMap.set(jobName, { ...jobDef, trigger: { ...jobDef.trigger, on: resolvedOn } });
+    }
+}
+// Array.isArray does not narrow a readonly array out of a union.
+function isNameOrRefList(on) {
+    return Array.isArray(on);
+}
+// An already-qualified name (e.g. a misspelled own-feature QN) is not a
+// short name; qualify() rejects it, and the "no handler" error below names it.
+function qualifyShortTriggerName(featureName, type, trigger) {
+    try {
+        return [qualify(featureName, type, trigger)];
     }
+    catch {
+        return [];
+    }
+}
+function resolveJobTriggerName(state, allHandlers, jobName, featureName, trigger) {
+    if (allHandlers.has(trigger) || state.eventMap.has(trigger))
+        return trigger;
+    const candidates = featureName === undefined
+        ? []
+        : ["write", "query", "event"].flatMap((type) => qualifyShortTriggerName(featureName, type, trigger));
+    const match = candidates.find((qn) => allHandlers.has(qn) || state.eventMap.has(qn));
+    if (match !== undefined)
+        return match;
+    throw new Error(`Job "${jobName}" triggers on "${trigger}" but no handler or event with that name exists. ` +
+        `Tried: ${[trigger, ...candidates].map((name) => `"${name}"`).join(", ")}`);
 }
 export function validateLiveEntities(state) {
     for (const [handlerQn, handler] of state.queryHandlerMap) {