@cosmicdrift/kumiko-framework 0.351.0 → 0.353.0

package/dist/api/pii-leak-guard.js

@@ -13,6 +13,9 @@ const CIPHERTEXT_REDACT_RE = new RegExp(CIPHERTEXT_RE.source, "g");
 // red; prod redacts + logs instead of shipping the blob. Scans unconditionally:
 // legacy ciphertext rows can outlive a subject KMS that later became
 // unconfigured, and the marker check itself needs no KMS access to run.
+// Buffers every JSON body (no streaming, roughly double peak memory for large
+// exports) on purpose: a size threshold or opt-out would be a leak bypass for
+// exactly the large responses most likely to carry raw rows.
 export function piiCiphertextResponseGuard() {
     return async (c, next) => {
         await next();

package/dist/api/route-registrars.d.ts

@@ -1,10 +1,11 @@
-import { Hono } from "hono";
+import { Hono, type MiddlewareHandler } from "hono";
 import type { DbConnection } from "../db/connection.js";
 import type { Lifecycle } from "../lifecycle/index.js";
 import type { Meter, PrometheusMeter } from "../observability/index.js";
 import type { EventConsumer } from "../pipeline/event-dispatcher.js";
 export declare const DEFAULT_MAX_REQUEST_BYTES = 1048576;
 export declare function registerBodyLimit(app: Hono, maxBytes: number): void;
+export declare function bodyLimitForRoutePath(path: string, maxBytes: number): readonly MiddlewareHandler[];
 export type MetricsRouteOptions = {
     readonly token?: string;
     readonly path?: string;

package/dist/api/route-registrars.js

@@ -31,6 +31,14 @@ export function registerBodyLimit(app, maxBytes) {
         return limit(c, next);
     });
 }
+// registerBodyLimit only covers /api/*; signature routes outside it (webhook
+// receivers, OAuth callbacks) read the raw body before verify() runs and so
+// need the same cap on their own handler chain.
+export function bodyLimitForRoutePath(path, maxBytes) {
+    if (maxBytes <= 0 || path === "/api" || path.startsWith("/api/"))
+        return [];
+    return [bodyLimit({ maxSize: maxBytes })];
+}
 // Timing-safe string compare — equal-length strings compare every byte
 // regardless of where they diverge; different lengths return false without
 // iterating. Prevents side-channel leaks on the Bearer-token check.

package/dist/api/server.js

@@ -40,7 +40,7 @@ import { piiCiphertextResponseGuard } from "./pii-leak-guard.js";
 import { createDefaultSseBroker } from "./redis-sse-broker.js";
 import { requestContext } from "./request-context.js";
 import { buildRequestContextData, requestIdMiddleware } from "./request-id-middleware.js";
-import { DEFAULT_MAX_REQUEST_BYTES, registerBodyLimit, registerHealthRoutes, registerMetricsRoute, registerVersionRoute, } from "./route-registrars.js";
+import { bodyLimitForRoutePath, DEFAULT_MAX_REQUEST_BYTES, registerBodyLimit, registerHealthRoutes, registerMetricsRoute, registerVersionRoute, } from "./route-registrars.js";
 import { createApiRoutes, handleUncaughtRouteError } from "./routes.js";
 import { createSseRoute } from "./sse-route.js";
 import { buildWebSocketSessionRevalidator, createWebSocketConnectionLimiter, hasWebSocketUpgradeServer, isWebSocketUpgradeRequest, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES, } from "./websocket-route.js";
@@ -782,7 +782,9 @@ export function buildServer(options) {
                 dispatchSystemQuery,
                 clientIpResolver,
             });
-            mountHonoRoute(app, route.method, route.path, honoHandler);
+            mountHonoRoute(app, route.method, route.path, honoHandler, route.entry === ExtraRouteEntries.signature
+                ? bodyLimitForRoutePath(route.path, options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES)
+                : []);
         }
     }
     // /version-Default registriert NACH feature-routes — Hono "first match
@@ -927,6 +929,7 @@ function unauthenticatedResponse(c) {
     }, 401);
 }
 const webSocketLog = createFallbackLogger("websocket");
+const extraRouteLog = createFallbackLogger("extra-route");
 function webSocketErrorResponse(c, status, code, message) {
     return c.json({ error: { code, httpStatus: status, message } }, status);
 }
@@ -1069,10 +1072,15 @@ function buildExtraRouteHonoHandler(route, shared) {
                         }
                         return c.json(e.body, e.status);
                     }
+                    // The body goes to unauthenticated callers; infra errors thrown by
+                    // verify() (secrets, DB) must not leak, so the detail stays in the log.
+                    extraRouteLog.error(`signature verify() threw on ${c.req.path}`, {
+                        error: e instanceof Error ? e.message : String(e),
+                    });
                     return c.json({
                         error: {
                             code: "extra_route_signature_invalid",
-                            message: e instanceof Error ? e.message : String(e),
+                            message: "signature verification failed",
                         },
                     }, 401);
                 }

package/dist/api/sse-route.js

@@ -3,7 +3,7 @@ import { streamSSE } from "hono/streaming";
 import { tenantChannel } from "../engine/constants.js";
 import { isAnonymousSessionUser } from "../engine/system-user.js";
 import { Routes } from "./api-constants.js";
-import { getUser } from "./auth-middleware.js";
+import { getAuthTokenExpiry, getUser } from "./auth-middleware.js";
 import { accessInvalidationCredentialFor } from "./sse-broker.js";
 /**
  * Heartbeat-Cadence für SSE-Streams.
@@ -81,6 +81,9 @@ function decideWireFrame(event, user, options) {
         return undefined;
     return { name: event.type, data };
 }
+// setTimeout overflows (fires immediately) above 2^31-1 ms; a token that
+// outlives it just gets its stream recycled early, the client reconnects.
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
 export function createSseRoute(broker, options) {
     const route = new Hono();
     route.get(Routes.sse, async (c) => {
@@ -88,6 +91,9 @@ export function createSseRoute(broker, options) {
         // Channel is server-derived from authenticated user — never trust client input.
         // Allowing ?channel=... would let any authenticated user subscribe to other tenants' feeds.
         const channel = tenantChannel(user.tenantId);
+        // JWT expiry raises no access-invalidation event, so the stream must end
+        // itself when the token it was opened with expires.
+        const tokenExpiresAtSec = getAuthTokenExpiry(c);
         return streamSSE(c, async (stream) => {
             let resolveEnded;
             const ended = new Promise((resolve) => {
@@ -105,6 +111,9 @@ export function createSseRoute(broker, options) {
                 stream.writeSSE({ event: frame.name, data: JSON.stringify(frame.data) });
             }, closeStream);
             const unsubscribeAccessInvalidation = broker.subscribeAccessInvalidation(user.id, closeStream, accessInvalidationCredentialFor(user));
+            const expiryTimer = tokenExpiresAtSec === undefined
+                ? undefined
+                : setTimeout(closeStream, Math.min(MAX_TIMER_DELAY_MS, Math.max(0, tokenExpiresAtSec * 1000 - Date.now())));
             let released = false;
             const release = () => {
                 // skip: onAbort and the finally block both release, the second call is a no-op
@@ -113,6 +122,7 @@ export function createSseRoute(broker, options) {
                 released = true;
                 // A client disconnect must also wake the heartbeat sleep, not only a server close.
                 resolveEnded();
+                clearTimeout(expiryTimer);
                 broker.removeClient(channel, clientId);
                 unsubscribeAccessInvalidation();
             };

package/dist/bun-db/query.js

@@ -507,6 +507,11 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                 parts.push(`${ref(col)} @> $${idx++}${p.sql}`);
                 values.push(p.bound);
             }
+            // A jsonb column holding the scalar itself is never `@>` an array of it.
+            if (isJsonbScalar(v)) {
+                parts.push(`${ref(col)} = $${idx++}::text::jsonb`);
+                values.push(JSON.stringify(v));
+            }
         }
         return parts.length > 0 ? `(${parts.join(" OR ")})` : "FALSE";
     }
@@ -592,8 +597,8 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                 if (opKey === "ne" && pgType === "jsonb" && isJsonbScalar(opVal)) {
                     const p = prepareJsonbValue([opVal]);
                     if (p && p.kind === "param") {
-                        conditions.push(`(${ref(col)} IS NULL OR NOT (${ref(col)} @> $${idx++}${p.sql}))`);
-                        values.push(p.bound);
+                        conditions.push(`(${ref(col)} IS NULL OR NOT (${ref(col)} @> $${idx++}${p.sql} OR ${ref(col)} = $${idx++}::text::jsonb))`);
+                        values.push(p.bound, JSON.stringify(opVal));
                         continue;
                     }
                 }

package/dist/compliance/sub-processors.js

@@ -13,6 +13,11 @@
 // Lead-Time aus dem Compliance-Profile (typisch 30d). Cron-Job kommt
 // in Sprint 1 (compliance-profiles).
 //
+// SubProcessor has no "removed" state yet: a removed entry is deleted from
+// the array, so until the notification cron exists a removal is documented
+// only in the changelog. Removed so far: Mailbox.org (mailbox hosting),
+// replaced by ALL-INKL.COM on 2026-09-02.
+//
 // Quelle: docs/plans/datenschutz/compliance-profiles.md "Sub-Processor-
 // Management" + docs/plans/datenschutz/legal-artifacts.md.
 /**

package/dist/crypto/pii-field-encryption.d.ts

@@ -1,9 +1,8 @@
 import type { EntityDefinition } from "../engine/types/fields.js";
 import type { TenantId } from "../engine/types/identifiers.js";
-import { type KmsAdapter, type KmsContext, type LocalKeyKmsAdapter, type SubjectId } from "./kms-adapter.js";
+import { type KmsAdapter, type KmsContext, type LocalKeyKmsAdapter, PII_ERASED_SENTINEL, type SubjectId } from "./kms-adapter.js";
 import { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON } from "./pii-ciphertext-format.js";
-export { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON };
-export declare const PII_ERASED_SENTINEL = "[[erased]]";
+export { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL };
 export declare function encryptPiiValueForSubject(kms: LocalKeyKmsAdapter, subject: SubjectId, value: string, kmsCtx: KmsContext, field: string): Promise<string>;
 export declare function encryptPiiJsonValueForSubject(kms: LocalKeyKmsAdapter, subject: SubjectId, value: unknown, kmsCtx: KmsContext, field: string): Promise<string>;
 export declare function decryptPiiValueForSubject(kms: LocalKeyKmsAdapter, value: string, kmsCtx: KmsContext, field: string): Promise<string>;

package/dist/crypto/pii-field-encryption.js

@@ -16,12 +16,11 @@
 // a v2<->v3 prefix swap fails GCM instead of silently changing the type.
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { assertIrreversibleOperationAllowed } from "../pipeline/irreversible-operation-gate.js";
-import { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, subjectIdFromKey, subjectIdToKey, } from "./kms-adapter.js";
+import { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, PII_ERASED_SENTINEL, subjectIdFromKey, subjectIdToKey, } from "./kms-adapter.js";
 import { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_CIPHERTEXT_PREFIX_V1, } from "./pii-ciphertext-format.js";
 import { resolveSubjectForField } from "./subject-resolver.js";
 // Spec value (crypto-shredding.md) — renderers show it verbatim.
-export { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON };
-export const PII_ERASED_SENTINEL = "[[erased]]";
+export { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL };
 const IV_LENGTH = 12;
 const AUTH_TAG_LENGTH = 16;
 function buildAad(subject, field, isJson) {

package/dist/db/entity-table-meta.js

@@ -222,6 +222,17 @@ export function deriveEntityTableMeta(entityName, entity, options) {
         assertUnmanagedTableName(tableName, "deriveEntityTableMeta/buildEntityTableMeta");
     }
     const idType = entity.idType ?? "uuid";
+    if (source === "unmanaged" && idType === "serial") {
+        // Unmanaged direct-write stores bypass validateRecordOwnedSubjects (it only walks
+        // feature.entities), yet encryptForDirectWrite still keys recordOwned fields as
+        // `record:<entity>:<id>`; forgetSubject requires a UUID, so the value could never be shredded.
+        const recordOwnedField = Object.entries(entity.fields).find(
+        // @cast-boundary schema-walk — PII flags live on the resolved field annotation
+        ([, field]) => field.recordOwned === true);
+        if (recordOwnedField) {
+            throw new Error(`deriveEntityTableMeta("${entityName}", { source: "unmanaged" }): field "${recordOwnedField[0]}" is recordOwned but the entity declares idType: "serial" — the record subject key is "record:${entityName}:<id>" and forgetSubject validates that id as a UUID, so this field could never be shredded. Use idType: "uuid", or give the field a different personal stance.`);
+        }
+    }
     // Base columns first, then user-fields. User-fields with the same
     // pg-name as a base-column OVERRIDE the base-column (last-wins, same
     // behavior as drizzle's `{ ...base, ...fields }` spread in the table

package/dist/db/event-store-executor-context.js

@@ -4,7 +4,7 @@ import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues
 import { executeRawQueryRead } from "../db/queries/raw-sql.js";
 import { shiftParams } from "../engine/ownership.js";
 import { SYSTEM_TENANT_ID } from "../engine/types/identifiers.js";
-import { UniqueViolationError, writeFailure } from "../errors/index.js";
+import { InternalError, UniqueViolationError, writeFailure, } from "../errors/index.js";
 import { ArchivedStreamError, isStreamArchived } from "../event-store/index.js";
 import { assertUnreachable } from "../utils/index.js";
 import { rehydrateCompoundTypes } from "./compound-types.js";
@@ -289,31 +289,26 @@ export function buildExecutorContext(table, entity, options) {
             ...(await executeRawQueryRead(tenantDbRunner(db), sqlText, params)),
         ];
     }
-    // Combined, atomic read for the `expect:` precondition: the projection
-    // row's expect-checked fields AND the events table's current MAX(version)
-    // for this aggregate, in ONE SQL statement.
-    //
-    // Two separate reads leave a gap: applyEntityEvent writes the projection in
-    // a separate statement after its event commits, so a second reader can see
-    // a version that already reflects a concurrent writer's event while its read
-    // of the expect fields still shows the pre-write row. One query runs against
-    // a single consistent snapshot.
-    //
-    // The row's own `version` column can't be trusted instead: it is only in
-    // lock-step with the events for rows this executor wrote. A raw-seeded row
-    // (test fixtures, legacy data) can carry a default version with zero
-    // matching events, so deriving expectedVersion from it makes the append
-    // target a non-existent predecessor and fail.
-    // The events table's MAX(version) (0 for such a row) is the only value
-    // append() can safely use as expectedVersion — exactly what
-    // getStreamVersion() already returns for every other (non-`expect`)
-    // caller; this reads it in the same statement as the expect columns
-    // instead of a second round-trip.
-    //
-    // Reads raw column values — no decryptForRead pass — so `expect:` only
-    // supports plain (non-pii, non-encrypted) columns: business-state fields
-    // like status flags or foreign-key ids, not PII.
+    // Reads the `expect:` fields and the aggregate's MAX(version) in ONE statement:
+    // projection rows are written after their event commits, so two reads can
+    // pair a post-write version with a pre-write row.
+    // row.version can't stand in for MAX(version) — raw-seeded/legacy rows carry
+    // a default version with no matching events, so the append would target a
+    // non-existent predecessor.
+    // Raw column values, no decrypt pass: plain (non-pii, non-encrypted) columns only.
     async function loadExpectSnapshot(db, id, streamTenantId, expectKeys) {
+        for (const key of expectKeys) {
+            if (table[key] === undefined) {
+                throw new InternalError({
+                    message: `expect: "${key}" is not a column of entity "${entityName}"`,
+                });
+            }
+            if (encryptedFields.has(key) || piiSubjectFields.includes(key)) {
+                throw new InternalError({
+                    message: `expect: "${key}" on entity "${entityName}" is stored encrypted and cannot be compared as plaintext`,
+                });
+            }
+        }
         const quote = (name) => `"${name.replace(/"/g, '""')}"`;
         const columnOf = (field) => quote(table[field]?.name ?? toSnakeCase(field));
         const tableName = String(table[KUMIKO_NAME_SYMBOL]);

package/dist/db/migrate-generator.js

@@ -122,7 +122,10 @@ function diffOneTable(prev, next) {
         const uniqueChanged = (prevI.unique ?? false) === (idx.unique ?? false)
             ? undefined
             : { from: prevI.unique ?? false, to: idx.unique ?? false };
-        const whereSqlChanged = prevI.whereSql === idx.whereSql ? undefined : { from: prevI.whereSql, to: idx.whereSql };
+        // Whitespace-only re-rendering of the predicate must not drop and rebuild a large index.
+        const whereSqlChanged = whereSqlEqual(prevI.whereSql, idx.whereSql)
+            ? undefined
+            : { from: prevI.whereSql, to: idx.whereSql };
         const needsManualWhereChanged = (prevI.needsManualWhere ?? false) === (idx.needsManualWhere ?? false)
             ? undefined
             : { from: prevI.needsManualWhere ?? false, to: idx.needsManualWhere ?? false };
@@ -297,6 +300,11 @@ function renderColumnChange(tableName, change) {
 function toSingleLine(text) {
     return text.replace(/\s+/g, " ").trim();
 }
+function whereSqlEqual(a, b) {
+    if (a === undefined || b === undefined)
+        return a === b;
+    return toSingleLine(a) === toSingleLine(b);
+}
 function describeIndexChange(change) {
     const parts = [];
     if (change.columnsChanged) {

package/dist/db/queries/backfill-pii.d.ts

@@ -16,6 +16,7 @@ export type PiiBackfillResult = {
 };
 export type PiiBackfillScanCache = {
     forgottenAggregates?: ReadonlySet<string>;
+    destroyedTenants?: ReadonlySet<string>;
 };
 export type PiiBackfillBatchResult = PiiBackfillResult & {
     readonly lastEventId: string | null;

package/dist/db/queries/backfill-pii.js

@@ -380,8 +380,21 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
         const forgottenAggregates = await loadForgottenAggregates();
         if (forgottenAggregates.has(aggregateId))
             return true;
+        if (subject.kind === "record" && subject.entity === "tenant") {
+            return (await loadDestroyedTenants()).has(subject.id);
+        }
         return subject.kind === "user" && forgottenAggregates.has(subject.userId);
     }
+    // A tenant destroyed before its name was record-owned never had a record key
+    // to erase, and destroy tombstones the row instead of emitting *.forgotten —
+    // read_tenants.destroyed_at is the only durable marker.
+    async function loadDestroyedTenants() {
+        if (scanCache.destroyedTenants)
+            return scanCache.destroyedTenants;
+        const rows = (await raw.unsafe(`SELECT id::text AS id FROM read_tenants WHERE destroyed_at IS NOT NULL`));
+        scanCache.destroyedTenants = new Set(rows.map((r) => r.id));
+        return scanCache.destroyedTenants;
+    }
 }
 // Stage 1 (payload) then stage 2 (projection row, when supplied) — stage 3
 // (erase) is the caller's call, made from the "unresolved" outcome.

package/dist/db/queries/seed-context.d.ts

@@ -1,3 +1,4 @@
+import type { DbRunner } from "../connection.js";
 import type { AnyDb } from "../query.js";
 export type SeedUserRow = {
     readonly id: string;
@@ -18,3 +19,19 @@ export type SeedTenantDbRow = {
 export declare function selectUserByEmail(db: AnyDb, email: string): Promise<SeedUserRow | null>;
 export declare function selectMembershipsOfUser(db: AnyDb, userId: string): Promise<readonly SeedMembershipDbRow[]>;
 export declare function selectAllTenants(db: AnyDb): Promise<readonly SeedTenantDbRow[]>;
+export type SeedTemplateResourceDbRow = {
+    readonly id: string;
+    readonly tenant_id: string;
+    readonly slug: string;
+    readonly kind: string;
+    readonly locale: string;
+    readonly status: string;
+};
+export type SeedTemplateResourceDbFilter = {
+    readonly tenantId: string;
+    readonly slug?: string;
+    readonly kind?: string;
+    readonly status?: string;
+    readonly locale?: string;
+};
+export declare function selectTemplateResources(db: DbRunner, filter: SeedTemplateResourceDbFilter): Promise<readonly SeedTemplateResourceDbRow[]>;

package/dist/db/queries/seed-context.js

@@ -1,4 +1,6 @@
 import { unsafeReadRetrying } from "../query.js";
+import { tableExists } from "../schema-inspection.js";
+import { SOFT_DELETE_LIVE_ROW_PREDICATE } from "../table-builder.js";
 export async function selectUserByEmail(db, email) {
     const rows = await unsafeReadRetrying(db, `SELECT id::text AS id, email, tenant_id::text AS tenant_id
      FROM read_users
@@ -23,3 +25,27 @@ export async function selectAllTenants(db) {
      FROM read_tenants
      ORDER BY inserted_at`, []);
 }
+// Column names are fixed fragments; every filter value is a bound parameter.
+// template-resolver is an optional feature — without its table the answer is
+// "no templates", not an error.
+export async function selectTemplateResources(db, filter) {
+    if (!(await tableExists(db, "read_template_resources")))
+        return [];
+    const conditions = ["tenant_id = $1", SOFT_DELETE_LIVE_ROW_PREDICATE];
+    const params = [filter.tenantId];
+    for (const [column, value] of [
+        ["slug", filter.slug],
+        ["kind", filter.kind],
+        ["status", filter.status],
+        ["locale", filter.locale],
+    ]) {
+        if (value === undefined)
+            continue;
+        params.push(value);
+        conditions.push(`${column} = $${params.length}`);
+    }
+    return unsafeReadRetrying(db, `SELECT id::text AS id, tenant_id::text AS tenant_id, slug, kind, locale, status
+     FROM read_template_resources
+     WHERE ${conditions.join(" AND ")}
+     ORDER BY slug, locale`, params);
+}

package/dist/db/queries/shadow-swap.js

@@ -362,10 +362,13 @@ export async function countColumnDrift(tx, tableName, meta) {
 // object depends on the live table the swap fails loud and the whole rebuild
 // rolls back, leaving the old table untouched.
 export async function swapShadowIntoLive(tx, tableName) {
-    // Re-checked right before DROP: RLS could have been enabled after the early check.
-    await assertLiveTableHasNoRowLevelSecurity(tx, tableName);
     const raw = asRawClient(tx);
     const ident = quoteTableIdent(tableName);
+    // Held before the re-check so a concurrent ENABLE ROW LEVEL SECURITY either commits first
+    // (and is seen) or waits behind the DROP. Without it the catalog read takes no lock, and
+    // the unfenced paths (MSP rebuild, projection with no subscribed events) would drop RLS.
+    await raw.unsafe(`LOCK TABLE public.${ident} IN ACCESS EXCLUSIVE MODE`);
+    await assertLiveTableHasNoRowLevelSecurity(tx, tableName);
     await raw.unsafe(`DROP TABLE public.${ident}`);
     await raw.unsafe(`ALTER TABLE ${SCHEMA_IDENT}.${ident} SET SCHEMA public`);
 }

package/dist/engine/boot-validator/access-declarations.js

@@ -1,4 +1,4 @@
-import { escapeHatchGrantsProblem } from "@cosmicdrift/kumiko-types/handlers";
+import { escapeHatchGrantsProblem, isRateLimitDisabled } from "@cosmicdrift/kumiko-types/handlers";
 import { accessAllowsAnonymous, declaredPersonalData, personalFieldNames, } from "../personal-data-fields.js";
 import { ANONYMOUS_ROLE } from "../system-user.js";
 import { collectZodObjectKeys } from "./zod-shape.js";
@@ -143,6 +143,20 @@ function validateAnonymousPersonalData(feature, handlerName, handler) {
         'request shares one caller identity, so owner-binding via from("user:id", ...) does not ' +
         "vouch for it; protection comes from the handler's required rateLimit (per ip).");
 }
+// The rateLimit is the only protection of a public-intake handler, so the
+// generic anonymous opt-out (rateLimit: { disabled: true }) must not apply.
+function validatePublicIntakeRateLimit(feature, handlerName, handler) {
+    // skip: not a public-intake handler, or its rateLimit is active
+    if (declaredPersonalData(handler.access) !== "public-intake")
+        return;
+    // skip: rateLimit is active
+    if (!isRateLimitDisabled(handler.rateLimit))
+        return;
+    throw new Error(`[Feature ${feature.name}] write handler "${handlerName}" declares ` +
+        'access.personalData: "public-intake" with rateLimit: { disabled: true } — the rateLimit ' +
+        'is the only protection for anonymous personal-data writes. Declare rateLimit: { per: "ip" ' +
+        'or "ip+handler", ... } instead.');
+}
 export function validateAccessDeclarations(feature) {
     for (const [handlerName, handler] of Object.entries(feature.writeHandlers)) {
         validateOpenToAllReason(feature, "write", handlerName, handler.access);
@@ -150,6 +164,7 @@ export function validateAccessDeclarations(feature) {
         validatePersonalDataValue(feature, handlerName, handler.access);
         validateOpenToAllPersonalData(feature, handlerName, handler);
         validateAnonymousPersonalData(feature, handlerName, handler);
+        validatePublicIntakeRateLimit(feature, handlerName, handler);
     }
     for (const [handlerName, handler] of Object.entries(feature.queryHandlers)) {
         validateOpenToAllReason(feature, "query", handlerName, handler.access);

package/dist/engine/boot-validator/entity-handler.d.ts

@@ -19,6 +19,7 @@ export declare function validateFileFields(feature: FeatureDefinition): boolean;
 export declare function validateReferenceFields(feature: FeatureDefinition, featureMap: ReadonlyMap<string, FeatureDefinition>, queryHandlers: ReadonlyMap<string, QueryHandlerDef>): void;
 export declare function validateEmbeddedFields(feature: FeatureDefinition, featureMap: ReadonlyMap<string, FeatureDefinition>, queryHandlers: ReadonlyMap<string, QueryHandlerDef>): void;
 export declare function validateEntitySelectOptionsQuery(feature: FeatureDefinition): void;
+export declare function validateEntitySelectAvailabilityQuery(feature: FeatureDefinition, queryHandlers: ReadonlyMap<string, QueryHandlerDef>): void;
 export declare function validateMultiSelectFields(feature: FeatureDefinition): void;
 export declare function validateImageVariants(feature: FeatureDefinition): void;
 export declare function validateTransitions(feature: FeatureDefinition): void;

package/dist/engine/boot-validator/entity-handler.js

@@ -1,8 +1,10 @@
+import { SELECT_OPTION_TONES } from "@cosmicdrift/kumiko-types/fields";
 import { isRateLimitDisabled } from "@cosmicdrift/kumiko-types/handlers";
 import { ZodObject } from "zod";
 import { VARIANT_NAME_PATTERN } from "../../derivatives/variant-key.js";
 import { access as accessPresets } from "../config-helpers.js";
 import { parseRefTarget } from "../parse-ref-target.js";
+import { isSelectOptionTone } from "./select-option-tone.js";
 export const FILE_FIELD_TYPES = new Set(["file", "image", "files", "images"]);
 // Field-Namen die typischerweise PII enthalten. Ohne `pii: true` /
 // `userOwned` / `tenantOwned` / `allowPlaintext`-Marker → Boot-Warning.
@@ -672,14 +674,25 @@ function validateCheckboxDisplayOptions(field, fieldName, entityName) {
         throw new Error(`MultiSelect field "${fieldName}" on entity "${entityName}" sets maxRows, which is only valid with display: "checkboxes".`);
     }
 }
+function assertSelectOptionTones(field, path, featureName) {
+    const tones = field.type === "select" ? Object.entries(field.optionTones ?? {}) : [];
+    for (const [optionValue, tone] of tones) {
+        if (!isSelectOptionTone(tone)) {
+            throw new Error(`[Feature ${featureName}] Entity select field "${path}" optionTones["${optionValue}"] is ` +
+                `"${String(tone)}" — expected one of ${SELECT_OPTION_TONES.join(", ")}.`);
+        }
+    }
+}
 export function validateEntitySelectOptionsQuery(feature) {
     for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
         for (const [fieldName, field] of Object.entries(entity.fields)) {
             assertNoSelectOptionsQuery(field, `${entityName}.${fieldName}`, feature.name);
+            assertSelectOptionTones(field, `${entityName}.${fieldName}`, feature.name);
             if (field.type !== "embedded")
                 continue;
             for (const [subName, subField] of Object.entries(field.schema ?? {})) {
                 assertNoSelectOptionsQuery(subField, `${entityName}.${fieldName}.${subName}`, feature.name);
+                assertSelectOptionTones(subField, `${entityName}.${fieldName}.${subName}`, feature.name);
             }
         }
     }
@@ -692,6 +705,23 @@ function assertNoSelectOptionsQuery(field, path, featureName) {
         throw new Error(`[Feature ${featureName}] Entity select field "${path}" declares optionsQuery — not supported on entity fields because the stored value would not be validated against the query result. Use static options, or a reference field.`);
     }
 }
+// A typo'd availability QN would only surface as a failed query when the form
+// mounts, so it is pinned at boot like the other option queries.
+export function validateEntitySelectAvailabilityQuery(feature, queryHandlers) {
+    for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
+        for (const [fieldName, field] of Object.entries(entity.fields)) {
+            if (field.type !== "select" || field.optionsAvailabilityQuery === undefined)
+                continue;
+            const query = field.optionsAvailabilityQuery;
+            if (query.length === 0 || !queryHandlers.has(query)) {
+                throw new Error(`[Feature ${feature.name}] Select field "${fieldName}" on entity "${entityName}" ` +
+                    `declares optionsAvailabilityQuery "${query}" which is not a registered query-handler. ` +
+                    `Check the QN spelling (expected "<feature>:query:<short>") and that the handler ` +
+                    `is declared via r.queryHandler(...).`);
+            }
+        }
+    }
+}
 export function validateMultiSelectFields(feature) {
     for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
         for (const [fieldName, field] of Object.entries(entity.fields)) {

package/dist/engine/boot-validator/index.js

@@ -9,7 +9,7 @@ import { validateApiExposureMatching, validateExtensionUsages } from "./api-ext.
 import { validateFeatureBootChecks } from "./boot-check.js";
 import { validateCircularDeps, validateConfigKeyAllowPerRequest, validateConfigKeyBacking, validateConfigKeyBounds, validateConfigKeyComputed, validateConfigKeyOptionsQuery, validateConfigKeyPiiEncrypted, validateConfigKeyRequired, validateConfigReads, warnOnToggleableDependencies, } from "./config-deps.js";
 import { collectDetailForScreens } from "./detail-screens.js";
-import { validateDerivedFieldCollisions, validateEmbeddedFields, validateEncryptedFields, validateEntityIndexes, validateEntitySelectOptionsQuery, validateExtendSchemaCollisions, validateExtensionPreSaveWiring, validateFileFields, validateHandlerAccess, validateImageVariants, validateLocatedTimestamps, validateMultiSelectFields, validateMultiStreamProjections, validateReferenceFields, validateSearchableFieldReadAccess, validateTransitions, } from "./entity-handler.js";
+import { validateDerivedFieldCollisions, validateEmbeddedFields, validateEncryptedFields, validateEntityIndexes, validateEntitySelectAvailabilityQuery, validateEntitySelectOptionsQuery, validateExtendSchemaCollisions, validateExtensionPreSaveWiring, validateFileFields, validateHandlerAccess, validateImageVariants, validateLocatedTimestamps, validateMultiSelectFields, validateMultiStreamProjections, validateReferenceFields, validateSearchableFieldReadAccess, validateTransitions, } from "./entity-handler.js";
 import { validateEntityListScreens } from "./entity-list-screens.js";
 import { validateGdprStoragePersistence } from "./gdpr-storage.js";
 import { validateGlobalTenancyEntities } from "./global-tenancy.js";
@@ -169,6 +169,7 @@ export function validateBoot(rawFeatures, options) {
         validateRecordOwnedSubjects(feature);
         validateApiExposureMatching(feature, allExposedApis, featureMap);
         validateEntitySelectOptionsQuery(feature);
+        validateEntitySelectAvailabilityQuery(feature, queryHandlerQns);
         validateEmbeddedFields(feature, featureMap, queryHandlerQns);
         validateMultiSelectFields(feature);
         validateImageVariants(feature);

package/dist/engine/boot-validator/query-refs.js

@@ -45,9 +45,14 @@ function checkDashboardQueryRefs(queryHandlers, featureName, screenId, screen) {
 }
 function checkFormFieldQueryRefs(queryHandlers, featureName, screenId, screenType, fields) {
     for (const [fieldName, field] of Object.entries(fields)) {
-        if (field.type !== "select" || field.optionsQuery === undefined)
+        if (field.type !== "select")
             continue;
-        checkQueryRef(queryHandlers, field.optionsQuery, () => `[Feature ${featureName}] Screen "${screenId}" (${screenType}) select field "${fieldName}" optionsQuery`);
+        if (field.optionsQuery !== undefined) {
+            checkQueryRef(queryHandlers, field.optionsQuery, () => `[Feature ${featureName}] Screen "${screenId}" (${screenType}) select field "${fieldName}" optionsQuery`);
+        }
+        if (field.optionsAvailabilityQuery !== undefined) {
+            checkQueryRef(queryHandlers, field.optionsAvailabilityQuery, () => `[Feature ${featureName}] Screen "${screenId}" (${screenType}) select field "${fieldName}" optionsAvailabilityQuery`);
+        }
     }
 }
 function checkScreenQueryRefs(queryHandlers, featureName, screenId, screen) {