@cosmicdrift/kumiko-framework 0.336.1 → 0.338.0

package/dist/search/meilisearch-adapter.js

@@ -153,7 +153,6 @@ export function createMeilisearchAdapter(options) {
             // skip: empty batch — avoid an unnecessary Meilisearch round-trip
             if (items.length === 0)
                 return;
-            await ensureConfigured(tenantId);
             const index = client.index(meilisearchTenantIndex(prefix, tenantId));
             const ids = items.map((i) => meilisearchDocId(i.entityType, i.entityId));
             await awaitSucceededTask(index.deleteDocuments(ids), REMOVE_TOLERATED_ERROR_CODES);
@@ -178,7 +177,6 @@ export function createMeilisearchAdapter(options) {
             }));
         },
         async remove(tenantId, entityType, entityId) {
-            await ensureConfigured(tenantId);
             const index = client.index(meilisearchTenantIndex(prefix, tenantId));
             await awaitSucceededTask(index.deleteDocument(meilisearchDocId(entityType, entityId)), REMOVE_TOLERATED_ERROR_CODES);
         },

package/dist/stack/push-entity-projection-tables.js

@@ -1,6 +1,6 @@
 import { KUMIKO_NAME_SYMBOL } from "@cosmicdrift/kumiko-types/schema-table-types";
 import { columnNamesOf, tableExists } from "../db/schema-inspection.js";
-import { addMissingColumns, tableToMeta, unsafePushTables } from "./table-helpers.js";
+import { addMissingColumns, addMissingIndexes, tableToMeta, unsafePushTables, } from "./table-helpers.js";
 // biome-ignore lint/suspicious/noConsole: stack-internal status logging
 const logInfo = (msg) => console.log(msg);
 /**
@@ -44,7 +44,7 @@ export async function pushEntityProjectionTables(stack, registry) {
 function isUnsafeToAutoAdd(col) {
     return col.notNull && !col.primaryKey && col.defaultSql === undefined;
 }
-// Backfills columns a persistent dev DB predates; a required column with no
+// Backfills columns and indexes a persistent dev DB predates; a required column with no
 // default can't be added safely on a table that may hold rows, so that
 // stays a boot error instead.
 async function syncExistingProjectionTable(stack, physical, table) {
@@ -53,7 +53,8 @@ async function syncExistingProjectionTable(stack, physical, table) {
     const missingColumns = meta.columns.filter((c) => !liveColumns.has(c.name));
     if (missingColumns.length === 0) {
         logInfo(`[kumiko-stack] table ${physical} already exists — skipping create`);
-        // skip: live table already has every declared column
+        await addMissingIndexes(stack.db, physical, meta.indexes);
+        // skip: table is already in sync, only indexes needed backfilling
         return;
     }
     const unsafeColumns = missingColumns.filter(isUnsafeToAutoAdd);
@@ -70,4 +71,5 @@ async function syncExistingProjectionTable(stack, physical, table) {
     logInfo(`[kumiko-stack] table ${physical} is missing column(s) ` +
         `${missingColumns.map((c) => `"${c.name}"`).join(", ")} — adding`);
     await addMissingColumns(stack.db, physical, missingColumns);
+    await addMissingIndexes(stack.db, physical, meta.indexes);
 }

package/dist/stack/redis.d.ts

@@ -8,4 +8,5 @@ export type TestRedis = {
     flushNamespace: () => Promise<void>;
     cleanup: () => Promise<void>;
 };
+export declare function queueNamePrefixForTestRedis(keyPrefix: string): string;
 export declare function createTestRedis(): Promise<TestRedis>;

package/dist/stack/redis.js

@@ -1,5 +1,11 @@
 import { generateId } from "../utils/index.js";
 import { requireEnv } from "./db.js";
+// BullMQ queues live on the raw redisUrl, outside the test Redis keyPrefix, so
+// parallel stacks sharing the prod default queue name would consume each
+// other's jobs. BullMQ rejects `:` in queue names.
+export function queueNamePrefixForTestRedis(keyPrefix) {
+    return keyPrefix.split(":").filter(Boolean).join("-");
+}
 export async function createTestRedis() {
     const Redis = (await import("ioredis")).Redis;
     const redisUrl = requireEnv("REDIS_URL");
@@ -8,13 +14,13 @@ export async function createTestRedis() {
     // prefix space is unbounded. See Track B.3 in docs/plans/tests-refactor.
     const prefix = `kt:${generateId().slice(-8)}:`;
     const redis = new Redis(redisUrl, { keyPrefix: prefix });
-    async function flushNamespace() {
+    async function deleteKeysMatching(pattern) {
         // Open a prefix-less client for the scan — ioredis' keyPrefix is applied
         // per-command but SCAN's returned keys are full names, so managing the
         // del set with the prefix already on the connection is error-prone.
         const raw = new Redis(redisUrl);
         try {
-            const stream = raw.scanStream({ match: `${prefix}*`, count: 500 });
+            const stream = raw.scanStream({ match: pattern, count: 500 });
             const keys = [];
             for await (const batch of stream)
                 keys.push(...batch);
@@ -25,6 +31,7 @@ export async function createTestRedis() {
             raw.disconnect();
         }
     }
+    const flushNamespace = () => deleteKeysMatching(`${prefix}*`);
     return {
         redis,
         redisUrl,
@@ -32,6 +39,8 @@ export async function createTestRedis() {
         flushNamespace,
         cleanup: async () => {
             await flushNamespace();
+            // The derived per-stack JobRunner queues sit outside the keyPrefix.
+            await deleteKeysMatching(`bull:${queueNamePrefixForTestRedis(prefix)}-*`);
             redis.disconnect();
         },
     };

package/dist/stack/table-helpers.d.ts

@@ -1,5 +1,5 @@
 import type { DbConnection } from "../db/connection.js";
-import type { ColumnMeta, EntityTableMeta } from "../db/entity-table-meta.js";
+import type { ColumnMeta, EntityTableMeta, IndexMeta } from "../db/entity-table-meta.js";
 import type { EventDispatcher } from "../pipeline/index.js";
 /**
  * Bypass: creates an entity-table directly without going through the
@@ -11,6 +11,8 @@ export declare function unsafeEnsureEntityTable(db: DbConnection, entity: import
 export declare function tableToMeta(table: unknown): EntityTableMeta;
 /** Applies ALTER TABLE ADD COLUMN for exactly the given columns. */
 export declare function addMissingColumns(db: DbConnection, tableName: string, columns: readonly ColumnMeta[]): Promise<void>;
+/** CREATE [UNIQUE] INDEX IF NOT EXISTS for exactly the given indexes. */
+export declare function addMissingIndexes(db: DbConnection, tableName: string, indexes: readonly IndexMeta[]): Promise<void>;
 /**
  * Bypass: pushes table definitions to the database directly. Produces
  * CREATE TABLE IF NOT EXISTS + CREATE INDEX statements via renderTableDdl

package/dist/stack/table-helpers.js

@@ -66,6 +66,14 @@ export async function addMissingColumns(db, tableName, columns) {
         await alterTableAddColumn(db, tableName, col.name, type, defaultClause, notNull);
     }
 }
+/** CREATE [UNIQUE] INDEX IF NOT EXISTS for exactly the given indexes. */
+export async function addMissingIndexes(db, tableName, indexes) {
+    for (const idx of indexes) {
+        const kind = idx.unique ? "UNIQUE INDEX" : "INDEX";
+        const colList = idx.columns.map((c) => `"${c}"`).join(", ");
+        await createIndexIfNotExists(db, kind, idx.name, tableName, colList, idx.whereSql);
+    }
+}
 /**
  * Bypass: pushes table definitions to the database directly. Produces
  * CREATE TABLE IF NOT EXISTS + CREATE INDEX statements via renderTableDdl
@@ -90,13 +98,7 @@ export async function unsafePushTables(db, tables, prevTables) {
             const newCols = meta.columns.filter((c) => !prevCols.has(c.name));
             await addMissingColumns(db, meta.tableName, newCols);
             const prevIdxNames = new Set(prev.indexes.map((i) => i.name));
-            for (const idx of meta.indexes) {
-                if (!prevIdxNames.has(idx.name)) {
-                    const kind = idx.unique ? "UNIQUE INDEX" : "INDEX";
-                    const colList = idx.columns.map((c) => `"${c}"`).join(", ");
-                    await createIndexIfNotExists(db, kind, idx.name, meta.tableName, colList, idx.whereSql);
-                }
-            }
+            await addMissingIndexes(db, meta.tableName, meta.indexes.filter((i) => !prevIdxNames.has(i.name)));
         }
         else {
             const statements = renderTableDdl(meta);

package/dist/stack/test-stack.js

@@ -11,16 +11,10 @@ import { createInMemorySearchAdapter } from "../search/index.js";
 import { createTestDb } from "./db.js";
 import { createJobFailureTracker, drainJobs } from "./drain-jobs.js";
 import { createEventCollector } from "./event-collector.js";
-import { createTestRedis } from "./redis.js";
+import { createTestRedis, queueNamePrefixForTestRedis } from "./redis.js";
 import { createRequestHelper } from "./request-helper.js";
 import { unsafePushTables } from "./table-helpers.js";
 const DEFAULT_JWT_SECRET = "test-stack-secret-minimum-32-characters!!";
-// BullMQ queues live on the raw redisUrl, outside the test Redis keyPrefix, so
-// parallel stacks sharing the prod default queue name would consume each
-// other's jobs. BullMQ rejects `:` in queue names.
-function queueNamePrefixForTestRedis(keyPrefix) {
-    return keyPrefix.split(":").filter(Boolean).join("-");
-}
 export async function setupTestStack(options) {
     const jwtSecret = options.jwtSecret ?? DEFAULT_JWT_SECRET;
     const enabledHooks = options.systemHooks ?? ["sse", "search"];

package/dist/testing/handler-context.js

@@ -5,7 +5,7 @@
 // production services (delivery-service uses it to run cross-feature notify
 // calls without a real dispatcher). Hence the runtime classification despite
 // living under `testing/` — no vitest imports, no test side-effects.
-import { ANONYMOUS_ROLE } from "../engine/system-user.js";
+import { createAnonymousUser } from "../engine/system-user.js";
 import { DEFAULT_LOCALE } from "../i18n/request-locale.js";
 import { createNoopMetricsHandle, getFallbackTracer } from "../observability/index.js";
 import { createTzContext } from "../time/index.js";
@@ -31,11 +31,8 @@ export function bridgeStub(opts) {
     // anonymous default values when no user is passed explicitly. Test code
     // that cares about identity passes its own SessionUser here and gets it
     // back on ctx.
-    const stubUser = opts?.user ?? {
-        id: "00000000-0000-0000-0000-000000000000",
-        tenantId: "00000000-0000-0000-0000-000000000000", // @cast-boundary engine-bridge
-        roles: [ANONYMOUS_ROLE],
-    };
+    const stubUser = opts?.user ??
+        createAnonymousUser("00000000-0000-0000-0000-000000000000"); // @cast-boundary engine-bridge
     return {
         user: stubUser,
         query: notAvailable("query"), // @cast-boundary engine-bridge

package/dist/ui-types/index.d.ts

@@ -10,7 +10,7 @@ export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPe
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
 export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav.js";
 export type { ActionFormFooterAction, ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartPanel, DashboardChartTone, DashboardCustomPanel, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardTimeRangeDefinition, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.js";
-export { metricField } from "../engine/types/screen.js";
+export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
 export type { TargetRef } from "../engine/types/target-ref.js";
 export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.js";
 export type { WorkspaceDefinition } from "../engine/types/workspace.js";

package/dist/ui-types/index.js

@@ -24,7 +24,7 @@ export { computeDerivedCellValue, roundDerivedCellValue } from "../engine/embedd
 export { parseRefTarget } from "../engine/parse-ref-target.js";
 export { evalFieldCondition, explicitListScreenId, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
-export { metricField } from "../engine/types/screen.js";
+export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
 export { ACTION_FORM_ENTITY, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
 export { formalLocaleTag } from "./formality.js";
 export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, } from "./list-row-meta.js";

package/dist/upgrade-cli.js

@@ -109,10 +109,12 @@ export function findPackageChangelogFiles(cwd) {
             for (const name of pkgNames) {
                 if (seenNames.has(name))
                     continue;
+                // Claimed by the nearest scope even without a changelog, so a farther
+                // node_modules can't contribute another version of the same package.
+                seenNames.add(name);
                 const changelogPath = join(scopeDir, name, "src", "changes.json");
                 if (!existsSync(changelogPath))
                     continue;
-                seenNames.add(name);
                 const realPath = realpathSync(changelogPath);
                 if (seenRealPaths.has(realPath))
                     continue;
@@ -305,9 +307,30 @@ function logManualMarkerOutcome(out, manualEntries, markerVersion) {
             : `  ⚠ Marker moved past the manual change(s) above to ${markerVersion}; the upgrade guard no longer lists them, so make sure they are migrated.`);
     }
 }
+// Records the codemods that already wrote files before a later one failed, so
+// a re-run resumes after them instead of replaying non-idempotent codemods.
+function writePartialMarker(out, targetDir, pending, manualEntries, failedVersion, ran) {
+    // skip: no codemod wrote files before the failure, nothing to resume after
+    if (ran.length === 0)
+        return;
+    const doneBeforeFailure = pending.filter((e) => compareVersions(e.version, failedVersion) < 0);
+    const version = markerVersionForPending(doneBeforeFailure, manualEntries, "");
+    // skip: no pending entry completed before the failure, so no marker version to record
+    if (version === "")
+        return;
+    const pendingManual = manualEntries.map((e) => ({ version: e.version, title: e.title }));
+    writeUpgradeMarker(targetDir, {
+        version,
+        appliedAt: Temporal.Now.instant().toString(),
+        codemods: ran,
+        ...(pendingManual.length > 0 && { pendingManual }),
+    });
+    out.err(`  ⚠ ${ran.length} codemod(s) already applied; wrote marker at ${version} so a re-run resumes at the failed one.`);
+}
 // Runs every pending breaking entry's codemod, oldest version first (so a
 // later codemod can assume an earlier one already ran). Stops on the first
-// failure — no partial marker. Writes the marker whenever dryRun is false —
+// failure; codemods that already ran are kept in a partial marker. Writes the
+// marker whenever dryRun is false —
 // even with zero pending entries, so an already-current app still gets a
 // bootstrap marker recording its installed version (fw#2299).
 // kumiko-lint-ignore complexity-budget sequential codemod runner with zero-pending bootstrap marker
@@ -364,6 +387,8 @@ markerVersion) {
         const scriptPath = resolveCodemodScript(repoRoot, e.codemod);
         if (!scriptPath) {
             out.err(`  ✗ ${e.version} · ${e.title} — invalid codemod path "${e.codemod}"`);
+            if (!dryRun)
+                writePartialMarker(out, targetDir, pending, manualEntries, e.version, ran);
             return 1;
         }
         out.log(`  → ${e.version} · running ${e.codemod}${dryRun ? " (dry-run)" : ""}`);
@@ -372,6 +397,8 @@ markerVersion) {
             out.log(result.output);
         if (!result.ok) {
             out.err(`  ✗ ${e.version} · ${e.codemod} failed`);
+            if (!dryRun)
+                writePartialMarker(out, targetDir, pending, manualEntries, e.version, ran);
             return 1;
         }
         ran.push({ version: e.version, codemod: e.codemod, title: e.title });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.336.1",
+  "version": "0.338.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -206,8 +206,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.336.1",
-    "@cosmicdrift/kumiko-types": "0.336.1",
+    "@cosmicdrift/kumiko-http": "0.338.0",
+    "@cosmicdrift/kumiko-types": "0.338.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -223,7 +223,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.336.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.338.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,157 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "ctx.configFor(tenantId) resolves config for another tenant",
+    "detail": "Query and write handler contexts get `configFor(tenantId)` next to `config`, present when the config feature wired its accessor factory. The accessor runs as the target tenant's system user on a db scoped to that tenant, so the caller's user-scope values never leak into the result. Calls for another tenant throw `AccessDeniedError` unless the caller is the system identity or has the `SystemAdmin` role; the caller's own tenant needs no privilege and returns the same accessor as `ctx.config`.",
+    "migration": "No code change needed. Handlers that compute values for a tenant other than the caller's (limits, quotas, billing previews) call `ctx.configFor(tenantId)` instead of passing `ctx.config`."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "escapeHatch grants split the SYSTEM identity switch from raw access",
+    "detail": "escapeHatch: new optional `grants` (`systemIdentity`, `globalWrites`, `unsafeRaw`) narrows what a declaration unlocks. Without `grants` the declaration keeps unlocking all three. An empty or unknown `grants` list is a boot error. Bundled handlers that only needed the raw runner now declare `grants: [\"unsafeRaw\"]`, so they no longer gain the SYSTEM identity switch.",
+    "migration": "No action needed: `grants` is additive and an escapeHatch without it behaves as before.\nDeclare `grants: [\"unsafeRaw\"]` on handlers that only call ctx.db.unsafeRaw to drop the SYSTEM identity switch."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "boot warning for file and image fields without a personal annotation",
+    "detail": "Boot validation warns for every `file`, `image`, `files` and `images` field without a `personal` annotation. A forget with strategy `delete` keeps the binary of such a field and only severs the uploader link, so the stance has to be declared.",
+    "migration": "Mark fields that hold personal data with `personal: \"self\"` or `personal: { of: \"<ownerField>\" }`, and business data with `personal: false, reason: \"is_business_data\"`. Unannotated fields keep their binary on forget."
+  },
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "reference label search applies target read access on the plaintext path",
+    "detail": "Searching a list by a reference field's label now respects the target entity's row-level `access.read` and the label field's own `access.read` on the plaintext (ILIKE) path. Before, a viewer who could not read the target row or its label could probe names through the match results."
+  },
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "/api/schema answers 401 instead of 400 tenant_required after logout",
+    "detail": "With `anonymousAccess` and an authoritative tenant resolver, a request without a token to `/api/schema` ran through tenant resolution and failed with 400 `tenant_required`. Paths that need a session but no tenant (`/api/auth/*` and `/api/schema`) are now listed in `isSessionRequiredApiPath` and answer 401 `missing_token` before any tenant lookup.",
+    "migration": "No code change needed."
+  },
+  {
+    "version": "0.338.0",
+    "type": "breaking",
+    "title": "searchable text fields must not declare a restricted access.read",
+    "detail": "Boot validation rejects a text field that is `searchable` (or `find: \"fuzzy\"`) and also has a restricted `access.read`. The search index is not filtered per role, so search matches leaked the value to roles that cannot read the field.",
+    "migration": "Remove `searchable` / `find: \"fuzzy\"` from the field, or remove the read restriction. Write-only `access.write` restrictions are unaffected."
+  },
+  {
+    "version": "0.338.0",
+    "type": "breaking",
+    "title": "signature routes with a :param segment or wildcard must not match framework paths",
+    "detail": "Boot validation rejects `entry: \"signature\"` extra routes whose pattern, including `:param` segments, matches a framework path such as `/api/write`. Such a route skipped the JWT, origin and CSRF guards for that path.",
+    "migration": "Give the route a static prefix, for example `/api/webhooks/:provider` instead of `/api/:provider` or `/:provider/write`."
+  },
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "planned Scaleway purposes listed as planned sub-processor entry",
+    "detail": "The sub-processor list now carries the planned Scaleway purposes (key custody and transactional email) as their own `status: \"planned\"` entry. The active Scaleway entry only names the backup mirror, so the public `planned` section and change notifications see the upcoming processing."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "unsafeRaw audit events carry the declared escapeHatch reason",
+    "detail": "`ctx.db.unsafeRaw(reason)` and `ctx.systemDb.unsafeRaw(reason)` now write the reason declared on the handler or hook `escapeHatch` into the escape-hatch audit event, not the string passed at the call. A call-site string can no longer put arbitrary text into the audit trail.",
+    "migration": "No action needed: calls that pass the same reason as the declaration audit unchanged. Calls with a different string now audit the declared reason."
+  },
+  {
+    "version": "0.337.1",
+    "type": "improvement",
+    "title": "Designer reads and creates r.secretNamespace, edits writeRoles on secrets",
+    "detail": "The Designer source model now parses `r.secretNamespace(...)` as its own pattern kind `secretNamespace` instead of falling back to `unknown`, renders it back and can add it through the pattern library. A Zod `nameSchema` or an options identifier is kept verbatim. The `r.secret` form gains a `writeRoles` list and no longer offers the `system` scope, which the secret type never allowed."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "variant() ignores caller-supplied resolvedOverlays",
+    "detail": "`derivatives.variant()` now discards a caller-supplied `resolvedOverlays`, so a literal overlay payload can no longer bypass the overlay resolver. The guarded admin seed throws instead of silently picking by id when a user row's `insertedAt` is not an instant."
+  },
+  {
+    "version": "0.337.0",
+    "type": "breaking",
+    "title": "Anonymous callers on protected handlers get 401 unauthenticated, and a stale auth cookie no longer blocks public handlers",
+    "migration": "Tests or clients that expect 403 / access_denied for an anonymous caller (no session, the anonymousAccess user, or a JWT carrying only the anonymous role) on a role-gated or openToAll handler now get 401 / unauthenticated; update those assertions. Signed-in callers without the role still get 403 access_denied. With anonymousAccess wired, a request whose auth cookie fails verification or whose session is no longer live continues as anonymous outside /api/auth/* (public handlers answer 200, protected ones 401 unauthenticated) instead of failing with 401 invalid_token / session_invalid; bearer tokens and /api/auth/* keep the explicit 401."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "Anonymous SSE signals no longer carry row id or version",
+    "detail": "An anonymous /api/sse connection gets every row signal of a declared liveEntities entity, including rows the anonymous query hides. The frame now carries only aggregateType, eventType and createdAt, so a public viewer can no longer see which hidden rows exist or change; signed-in connections keep id and version. LiveEvent.data.id and version are optional in kumiko-renderer accordingly."
+  },
+  {
+    "version": "0.337.0",
+    "type": "breaking",
+    "title": "buildServer refuses partially wired session callbacks",
+    "migration": "If you call buildServer with auth.sessionCreator or auth.sessionRevoker, also wire the other two of sessionCreator, sessionRevoker and sessionChecker (the sessions feature's sessionStore provides all three; runProdApp and runDevApp already do this). Without a sessionChecker a logout never invalidated the JWT. A sessionChecker alone stays allowed."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "Job triggers accept short handler and event names",
+    "detail": "r.job trigger.on now qualifies a short name against the job's own feature (write handler, then query handler, then defineEvent), like notification triggers, and the boot error lists every name it tried."
+  },
+  {
+    "version": "0.337.0",
+    "type": "improvement",
+    "title": "Boot rejects a collapsed relatedList group without a header; expandableRow groupBy keys are required i18n keys",
+    "detail": "Boot fails when `groupBy.collapsedWhen` names a group that has neither `label` nor a `labels` entry, because its rows could never be opened. The required surface keys now include `groupBy.label` and `groupBy.labels` of an entityList `expandableRow`, as they already did for projectionDetail relatedList sections.",
+    "migration": "Add translations for expandableRow `groupBy` header keys if the i18n check reports them missing."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "json format falls back to text, IPv4-first egress pin, structural claim comparison for identity switch",
+    "detail": "The `json` format no longer throws on BigInt or circular values and falls back to text. `resolvePublicHost` prefers an IPv4 address on dual-stack hosts. Identity-switch claim comparison no longer treats structurally equal object claims in a different key order as a different identity."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "reference search and sort skip soft-deleted targets, blind-index sweep resolves tables in public, key-manager retry releases 5xx bodies",
+    "detail": "List search and sort by a reference field now ignore soft-deleted target rows: a deleted customer's name no longer matches a reference search and no longer decides the position in a label sort. The blind-index sweep checks table existence in the `public` schema instead of relying on the session `search_path`. The Scaleway key-manager retry cancels the response body of a retried 5xx instead of leaving it open."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "boot validator rejects redirect on list row actions, httpRoute with non-literal anonymous is a parse error, local const shadows same-named import in feature-ast, r.nav strips undefined properties",
+    "detail": "The boot validator now rejects a `redirect` on `entityList`, `projectionList` and `relatedList` row actions, where it was silently ignored. The feature-ast parser reports an `httpRoute` whose `anonymous` is a non-literal expression as a parse error instead of rewriting it to `false` on round-trip, and a local non-literal `const` no longer resolves to a same-named import. `r.nav()` strips explicitly-`undefined` properties for every registration path."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "isRedisSseBroker narrows on a kind discriminant, tenant-lifecycle gate cache is bounded",
+    "detail": "`isRedisSseBroker` now narrows on a `kind: \"redis\"` discriminant that `createRedisSseBroker` sets, so an app-owned broker that happens to expose `close()` is no longer mistaken for the Redis one. The tenant-lifecycle gate cache is capped at 5000 entries, so anonymous requests with random `X-Tenant` ids can no longer grow it without bound."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "search extensions never see sensitive row fields on named events, streams cannot hard-delete (gate message now says so), codemod walkers and namespace imports hardened",
+    "detail": "The search consumer no longer hands `sensitive` columns of the projection row to `searchPayloadExtension` contributors when a named domain event triggers the re-index. A `skipApplyErrors` rebuild option passed for a multi-stream projection is now logged as ignored instead of dropped silently. The irreversible-operation gate error for stream entry handlers says that streams cannot declare an agent risk (streams always resolve `mid`, so a hard delete or `forget` inside a stream is denied; dispatch a risk `high` write handler directly). The `migrate-open-to-all` codemod skips symlinks and `dist`/`build`/`.next`/`.git`, and the `unprocessable-error-details-reason` codemod follows namespace imports and reports member-access callees it cannot resolve."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "search remove no longer creates indexes, upgrade --apply keeps a partial marker on codemod failure, test stack syncs indexes and cleans queue keys, codemod walkers skip symlinks",
+    "detail": "Meilisearch `remove` and `removeBatch` no longer configure (and thereby implicitly create) the tenant index before deleting. `kumiko-upgrade --apply` writes a partial upgrade marker when a later codemod fails, so a re-run resumes at the failed codemod instead of replaying the ones that already wrote files. The changelog lookup claims a package name in the nearest `node_modules` even when it has no `changes.json`, instead of listing a farther version's changelog. The test stack syncs missing indexes (including unique) on a persistent dev DB and removes the BullMQ keys of its derived per-stack queues on cleanup. `bridgeStub` defaults to the real anonymous identity. The `migrate-cross-tenant` and `migrate-db-raw` codemods share one walker with `migrate-open-to-all` that skips symlinks and `dist`/`build`/`.next`/`.git`."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "Removed unreachable PAT rate-limit guard from the httpRoute chain",
+    "detail": "The httpRoute guard chain no longer includes the PAT rate-limit guard. PATs are rejected on httpRoutes before it could count, so behavior is unchanged."
+  },
+  {
+    "version": "0.337.0",
+    "type": "improvement",
+    "title": "r.secretNamespace declares a family of runtime-named secret keys",
+    "detail": "`r.secretNamespace(name, { label, scope: \"tenant\", writeRoles?, nameSchema? })` declares the prefix `<feature>:<name>.` (kebab-cased) and returns `{ prefix, keyFor(name) }`. `secrets:write:set` and `secrets:write:delete` accept a key under that prefix when the suffix is non-empty and passes `nameSchema`; `writeRoles` applies to every key in the namespace. Namespaces are kept out of `getAllSecretKeys` and the generated secrets screen. `Registry.findSecretNamespace(key)` resolves the namespace of a key. step-dispatcher declares `webhook-auth`, so webhook auth secrets (`step-dispatcher:webhook-auth.<name>`) stay settable through the API.",
+    "migration": "No code change needed. A feature that stores secrets under a runtime-chosen suffix declares a namespace instead of one `r.secret` per key."
+  },
   {
     "version": "0.336.1",
     "type": "fix",

package/src/scripts/codemod/collect-source-files.ts

@@ -0,0 +1,48 @@
+import { lstatSync, readdirSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+const BUILD_AND_VENDOR_DIR_NAMES: readonly string[] = [
+  "node_modules",
+  "dist",
+  "build",
+  ".next",
+  ".git",
+];
+
+export interface CollectSourceFilesOptions {
+  readonly isMigratableFile: (name: string) => boolean;
+  readonly extraSkippedDirNames?: readonly string[];
+}
+
+export function collectSourceFiles(
+  paths: readonly string[],
+  options: CollectSourceFilesOptions,
+): string[] {
+  const skippedDirNames = new Set([
+    ...BUILD_AND_VENDOR_DIR_NAMES,
+    ...(options.extraSkippedDirNames ?? []),
+  ]);
+
+  function walkDir(dir: string, out: string[]): void {
+    for (const name of readdirSync(dir)) {
+      if (skippedDirNames.has(name)) continue;
+      const full = join(dir, name);
+      const stat = lstatSync(full);
+      // Symlinks can point back at a parent directory (workspace links) and loop forever.
+      if (stat.isSymbolicLink()) continue;
+      if (stat.isDirectory()) {
+        walkDir(full, out);
+        continue;
+      }
+      if (options.isMigratableFile(name)) out.push(full);
+    }
+  }
+
+  const files: string[] = [];
+  for (const p of paths) {
+    const abs = resolve(p);
+    if (statSync(abs).isDirectory()) walkDir(abs, files);
+    else if (options.isMigratableFile(abs)) files.push(abs);
+  }
+  return files;
+}

package/src/scripts/codemod/migrate-cross-tenant.ts

@@ -6,8 +6,7 @@
 // Usage:
 //   bun scripts/codemod/migrate-cross-tenant.ts [--dry-run] <path...>
 
-import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { readFileSync, writeFileSync } from "node:fs";
 import {
   type CallExpression,
   Node,
@@ -16,6 +15,7 @@ import {
   type PropertyAssignment,
   SyntaxKind,
 } from "ts-morph";
+import { collectSourceFiles } from "./collect-source-files.js";
 
 export interface Rewrite {
   readonly file: string;
@@ -264,28 +264,8 @@ function isMigratableFile(name: string): boolean {
   return /\.(ts|tsx)$/.test(name);
 }
 
-function walkDir(dir: string, out: string[]): void {
-  for (const name of readdirSync(dir)) {
-    if (name === "node_modules") continue;
-    const full = join(dir, name);
-    const stat = statSync(full);
-    if (stat.isDirectory()) {
-      walkDir(full, out);
-      continue;
-    }
-    if (isMigratableFile(name)) out.push(full);
-  }
-}
-
 function collectFiles(paths: string[]): string[] {
-  const files: string[] = [];
-  for (const p of paths) {
-    const abs = resolve(p);
-    const stat = statSync(abs);
-    if (stat.isDirectory()) walkDir(abs, files);
-    else if (isMigratableFile(abs)) files.push(abs);
-  }
-  return files;
+  return collectSourceFiles(paths, { isMigratableFile });
 }
 
 async function main(): Promise<void> {

package/src/scripts/codemod/migrate-db-raw.ts

@@ -7,9 +7,9 @@
 // Usage:
 //   bun scripts/codemod/migrate-db-raw.ts [--dry-run] [--global-tables a,b] <path...>
 
-import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { readFileSync, writeFileSync } from "node:fs";
 import { Node, Project, type SourceFile, SyntaxKind, VariableDeclarationKind } from "ts-morph";
+import { collectSourceFiles } from "./collect-source-files.js";
 
 const DEFAULT_GLOBAL_TABLES: ReadonlySet<string> = new Set([
   "userTable",
@@ -334,28 +334,11 @@ function isMigratableFile(name: string): boolean {
   return true;
 }
 
-function walkDir(dir: string, out: string[]): void {
-  for (const name of readdirSync(dir)) {
-    if (name === "node_modules" || name === "__tests__") continue;
-    const full = join(dir, name);
-    const stat = statSync(full);
-    if (stat.isDirectory()) {
-      walkDir(full, out);
-      continue;
-    }
-    if (isMigratableFile(name)) out.push(full);
-  }
-}
-
 function collectFiles(paths: string[]): string[] {
-  const files: string[] = [];
-  for (const p of paths) {
-    const abs = resolve(p);
-    const stat = statSync(abs);
-    if (stat.isDirectory()) walkDir(abs, files);
-    else if (isMigratableFile(abs)) files.push(abs);
-  }
-  return files;
+  return collectSourceFiles(paths, {
+    isMigratableFile,
+    extraSkippedDirNames: ["__tests__"],
+  });
 }
 
 async function main(): Promise<void> {