@cosmicdrift/kumiko-framework 0.352.0 → 0.353.0

package/dist/engine/build-config-feature-schema.js

@@ -415,10 +415,16 @@ function buildSecretsEditScreen(screenId, secrets, access, declaredTranslationKe
     // need a writable local type; each entry is still a fresh, never-mutated object.
     const translations = {};
     const sections = [];
+    const seenFieldIds = new Map();
     for (const feature of [...new Set(secrets.map((s) => s.feature))]) {
         const fieldIds = [];
         for (const s of secrets.filter((v) => v.feature === feature)) {
             const fieldId = `${s.feature}-${s.shortKey}`;
+            const prevQn = seenFieldIds.get(fieldId);
+            if (prevQn !== undefined) {
+                throw new Error(`[Settings-Hub] secrets "${prevQn}" and "${s.qn}" both resolve to field id "${fieldId}" — rename one secret or its feature.`);
+            }
+            seenFieldIds.set(fieldId, s.qn);
             fieldIds.push(fieldId);
             secretKeys[fieldId] = s.qn;
             const labelKey = `config.secret.${s.feature}.${s.shortKey}.label`;

package/dist/engine/dedupe-features.js

@@ -6,15 +6,31 @@ function dedupeOptionsShallowEqual(a, b) {
     }
     return true;
 }
+function sameKeys(a, b) {
+    const aKeys = Object.keys(a ?? {});
+    const bKeys = new Set(Object.keys(b ?? {}));
+    return aKeys.length === bKeys.size && aKeys.every((key) => bKeys.has(key));
+}
+// dedupeOptions is a declaration, not proof: two same-named features that both
+// carry `{}` but register different surface must still clash, not silently drop one.
+function sameRegisteredSurface(a, b) {
+    return (sameKeys(a.entities, b.entities) &&
+        sameKeys(a.writeHandlers, b.writeHandlers) &&
+        sameKeys(a.queryHandlers, b.queryHandlers) &&
+        sameKeys(a.streamHandlers, b.streamHandlers));
+}
 function isInterchangeable(existing, next) {
     if (existing === next)
         return true;
     if (existing.dedupeOptions !== undefined && next.dedupeOptions !== undefined) {
-        return dedupeOptionsShallowEqual(existing.dedupeOptions, next.dedupeOptions);
+        return (dedupeOptionsShallowEqual(existing.dedupeOptions, next.dedupeOptions) &&
+            sameRegisteredSurface(existing, next));
     }
     return false;
 }
 // First occurrence wins: runtimes late-bind closure state (sessions' autoRevoke) on the kept instance.
+// An app holding its own handle to a later, dropped instance would bind state the registry never
+// runs — resolve the kept instance from the composed list (`features.find(name)`), not a local handle.
 export function dedupeFeatures(features) {
     const byName = new Map();
     const result = [];

package/dist/engine/entity-handlers.js

@@ -198,11 +198,14 @@ export function defineEntityWriteHandler(name, entity, options) {
     // query-handler branch below: this ONE write handler reads/writes across
     // every tenant without making the whole feature r.systemScope().
     const crossTenantReason = resolveCrossTenantReason(name, options);
+    // create always writes into the acting user's own tenant, so its FK,
+    // unique and preSave lookups must stay tenant-filtered even when the
+    // handler declares cross-tenant access for the row-addressing verbs.
     const dbFor = (ctx) => {
         if (ctx.systemDb) {
             return ctx.systemDb.acknowledgeCrossTenant(`entity convention handler for r.systemScope() feature (${name})`);
         }
-        return crossTenantReason !== undefined
+        return crossTenantReason !== undefined && verb !== "create"
             ? acknowledgeConventionCrossTenant(ctx.db, crossTenantReason)
             : ctx.db;
     };
@@ -539,18 +542,24 @@ export function registerEntityCrud(r, entityName, entity, options) {
     };
     const resolveWriteOpts = (verb) => {
         const excludeFields = verb === "create" || verb === "update" ? options?.excludeFields?.[verb] : undefined;
+        const verbAgent = options?.agents?.[verb];
         return {
             ...writeOpts,
             access: requireAccess(verb, options?.verbAccess?.[verb] ?? writeOpts?.access),
             description: options?.descriptions?.[verb] ?? writeOpts?.description,
+            ...(verbAgent !== undefined && { agent: verbAgent }),
             ...(excludeFields !== undefined && { excludeFields }),
         };
     };
-    const resolveReadOpts = (verb) => ({
-        ...readOpts,
-        access: requireAccess(verb, options?.verbAccess?.[verb] ?? readOpts?.access),
-        description: options?.descriptions?.[verb] ?? readOpts?.description,
-    });
+    const resolveReadOpts = (verb) => {
+        const verbAgent = options?.agents?.[verb];
+        return {
+            ...readOpts,
+            access: requireAccess(verb, options?.verbAccess?.[verb] ?? readOpts?.access),
+            description: options?.descriptions?.[verb] ?? readOpts?.description,
+            ...(verbAgent !== undefined && { agent: verbAgent }),
+        };
+    };
     if (verbs.create) {
         r.writeHandler(defineEntityCreateHandler(entityName, entity, resolveWriteOpts("create")));
     }

package/dist/engine/feature-builder-state.d.ts

@@ -1,8 +1,7 @@
 import type { WebSocketRouteDefinition } from "@cosmicdrift/kumiko-types/websocket-route";
 import type * as z from "zod";
-import type { ZodType } from "zod";
 import type { HttpRouteDefinition } from "./types/http-route.js";
-import type { AuthClaimsFn, BootCheckFn, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventMigrationDef, ExtensionSelectorDef, FeatureMetricDef, JobDefinition, LifecycleHookFn, MultiStreamProjectionDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, SearchPayloadContributorFn, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableEntry, StreamHandlerDef, TranslationKeys, TreeActionDef, UiHints, ValidationHookFn, WriteHandlerDef } from "./types/index.js";
+import type { AuthClaimsFn, BootCheckFn, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventDef, EventMigrationDef, ExtensionSelectorDef, FeatureMetricDef, JobDefinition, LifecycleHookFn, MultiStreamProjectionDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, SearchPayloadContributorFn, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableEntry, StreamHandlerDef, TranslationKeys, TreeActionDef, UiHints, ValidationHookFn, WriteHandlerDef } from "./types/index.js";
 import type { ContentCollectionDefinition, NavDefinition } from "./types/nav.js";
 import type { ScreenDefinition } from "./types/screen.js";
 import type { WorkspaceDefinition } from "./types/workspace.js";
@@ -23,11 +22,7 @@ export type FeatureBuilderState = {
     configKeys: Record<string, ConfigKeyDefinition>;
     configSeeds: ConfigSeedDef[];
     jobs: Record<string, JobDefinition>;
-    events: Record<string, {
-        name: string;
-        schema: ZodType;
-        version: number;
-    }>;
+    events: Record<string, EventDef>;
     eventMigrations: Record<string, EventMigrationDef[]>;
     configReads: string[];
     entityPostSave: Record<string, PhasedHook<PostSaveHookFn>[]>;

package/dist/engine/feature-config-events-jobs.js

@@ -73,6 +73,9 @@ export function buildConfigEventsJobsMethods(state, name) {
             if (field === normalized.ownerField) {
                 throw new Error(`[Feature ${name}] defineEvent("${eventName}"): piiFields."${field}" cannot use itself as the owner field — the subject id is a plaintext pseudonymous fk, the pii field is the value it owns.`);
             }
+            if (normalized.ownerField === "id") {
+                throw new Error(`[Feature ${name}] defineEvent("${eventName}"): piiFields."${field}" uses owner field "id" — on entities \`of: "id"\` means record-owned, but on events it would encrypt under a phantom user key that a forget never reaches. Use \`personal: "self"\` for a record-owned event field.`);
+            }
             for (const required of [field, normalized.ownerField]) {
                 if (shape && !(required in shape)) {
                     throw new Error(`[Feature ${name}] defineEvent("${eventName}"): piiFields references "${required}" which is not a field of the payload schema.`);

package/dist/engine/feature-entity-handlers.js

@@ -55,7 +55,7 @@ function agentSlots(source) {
     };
 }
 function requireInlineHandlerArgs(kind, schema, handler, options) {
-    if (!schema || !handler || !options) {
+    if (!schema || !handler || !options?.access) {
         throw new Error(`${kind} inline form requires schema + handler + options.access`);
     }
     return { schema, handler, options };

package/dist/engine/i18n-key.js

@@ -1,10 +1,21 @@
 // Dot-form labels are indistinguishable from literal display text ("actions.open"),
 // so authors mark the i18n ones explicitly; the registry is what boot validation reads.
-const explicitDotFormKeys = new Set();
+// Marking is by string value and therefore global across features. The registry sits on
+// globalThis so a second installed copy of the framework still reads the marks the
+// other copy wrote; otherwise they are silently ignored and #2313 reopens.
+const REGISTRY_KEY = Symbol.for("kumiko.i18n.explicitDotFormKeys");
+function explicitDotFormKeys() {
+    const existing = Reflect.get(globalThis, REGISTRY_KEY);
+    if (existing instanceof Set)
+        return existing;
+    const created = new Set();
+    Reflect.set(globalThis, REGISTRY_KEY, created);
+    return created;
+}
 export function i18nKey(value) {
-    explicitDotFormKeys.add(value);
+    explicitDotFormKeys().add(value);
     return value;
 }
 export function isExplicitDotFormKey(value) {
-    return explicitDotFormKeys.has(value);
+    return explicitDotFormKeys().has(value);
 }

package/dist/engine/index.d.ts

@@ -59,7 +59,7 @@ export { createRegistry } from "./registry.js";
 export type { ClampInfo, ResolveOptions } from "./resolve-config-or-param.js";
 export { resolveConfigOrParam } from "./resolve-config-or-param.js";
 export type { AssignableAppRoles, AssignableFromRole } from "./role-assignment.js";
-export { assignableAppRolesFromUsages, assignableAppRolesOf, canActorAssignRole, findForbiddenRoleAssignment, isAssignableByRole, mergeAssignedRoles, } from "./role-assignment.js";
+export { assignableAppRolesFromUsages, assignableAppRolesOf, BUILT_IN_MEMBERSHIP_ROLES, canActorAssignRole, findForbiddenRoleAssignment, isAssignableByRole, mergeAssignedRoles, } from "./role-assignment.js";
 export { runsInLane } from "./run-in.js";
 export type { StepListOutcome } from "./run-pipeline.js";
 export { runPipeline, runStepList } from "./run-pipeline.js";

package/dist/engine/index.js

@@ -55,7 +55,7 @@ export { isValidQn, parseQn, QnTypes, qn, toKebab } from "./qualified-name.js";
 export { readClaim } from "./read-claim.js";
 export { createRegistry } from "./registry.js";
 export { resolveConfigOrParam } from "./resolve-config-or-param.js";
-export { assignableAppRolesFromUsages, assignableAppRolesOf, canActorAssignRole, findForbiddenRoleAssignment, isAssignableByRole, mergeAssignedRoles, } from "./role-assignment.js";
+export { assignableAppRolesFromUsages, assignableAppRolesOf, BUILT_IN_MEMBERSHIP_ROLES, canActorAssignRole, findForbiddenRoleAssignment, isAssignableByRole, mergeAssignedRoles, } from "./role-assignment.js";
 export { runsInLane } from "./run-in.js";
 export { runPipeline, runStepList } from "./run-pipeline.js";
 export { buildInsertSchema, buildUpdateSchema, fieldToZod, SYSTEM_ONLY_JSON_SCHEMA_KEY, } from "./schema-builder.js";

package/dist/engine/pipeline.js

@@ -79,9 +79,26 @@ export function stepsPipeline(closure) {
 // carried in (D4, workflow-resume-loop.md), never an unchecked external
 // value.
 export function buildPipelineSteps(pipelineDef, event) {
-    return pipelineDef.build({
+    const steps = pipelineDef.build({
         event,
         r: stepBuilder,
         awaits: (pipelineDef.awaits ?? {}),
     });
+    assertUniqueWaitForEventTypes(steps);
+    return steps;
+}
+// waitForEvent's result key is the awaited event type, so a second wait on the
+// same type would overwrite the first one's resumed payload.
+function assertUniqueWaitForEventTypes(steps) {
+    const seen = new Set();
+    for (const step of steps) {
+        if (step.kind !== "workflow.waitForEvent")
+            continue;
+        const { event } = step.args; // @cast-boundary engine-payload
+        if (seen.has(event)) {
+            throw new Error(`r.step.waitForEvent: event "${String(event)}" is awaited more than once in one workflow — ` +
+                "each awaits entry can back only one waitForEvent step.");
+        }
+        seen.add(event);
+    }
 }

package/dist/engine/project-app-schema-for-roles.js

@@ -530,20 +530,26 @@ function projectActionFormScreen(screen, feature, indices, keptScreenQns) {
     };
 }
 function projectSecretMintScreen(screen, feature, indices, keptScreenQns) {
-    const { redirect, cancelTarget, layout, listScreenId, ...rest } = screen;
+    const { redirect, cancelTarget, layout, listScreenId, confirm, ...rest } = screen;
     const nextRedirect = projectRedirect(feature.featureName, redirect, keptScreenQns);
     const nextCancelTarget = projectCancelTarget(feature.featureName, cancelTarget, keptScreenQns);
     const nextLayout = projectEditLayout(layout, feature, indices, keptScreenQns);
     const nextListScreenId = projectListScreenId(listScreenId, indices, keptScreenQns);
+    const nextConfirmLayout = confirm === undefined
+        ? undefined
+        : projectEditLayout(confirm.layout, feature, indices, keptScreenQns);
     const unchanged = nextRedirect === redirect &&
         nextCancelTarget === cancelTarget &&
         nextLayout === layout &&
-        nextListScreenId === listScreenId;
+        nextListScreenId === listScreenId &&
+        nextConfirmLayout === confirm?.layout;
     if (unchanged)
         return screen;
     return {
         ...rest,
         layout: nextLayout,
+        ...(confirm !== undefined &&
+            nextConfirmLayout !== undefined && { confirm: { ...confirm, layout: nextConfirmLayout } }),
         ...(nextRedirect !== undefined && { redirect: nextRedirect }),
         ...(nextCancelTarget !== undefined && { cancelTarget: nextCancelTarget }),
         ...(nextListScreenId !== undefined && { listScreenId: nextListScreenId }),

package/dist/engine/role-assignment.d.ts

@@ -1,4 +1,6 @@
 import type { Registry } from "./types/feature.js";
+/** Every membership role the engine ranks, excluding the internal `system` actor. */
+export declare const BUILT_IN_MEMBERSHIP_ROLES: readonly string[];
 declare const ASSIGNABLE_FROM_ROLE_LIST: readonly ["User", "Member", "Editor", "Admin", "TenantAdmin", "SystemAdmin"];
 export type AssignableFromRole = (typeof ASSIGNABLE_FROM_ROLE_LIST)[number];
 /** App role → lowest built-in role allowed to assign it. */

package/dist/engine/role-assignment.js

@@ -16,6 +16,8 @@ const ROLE_RANKS = new Map([
     ["SystemAdmin", 4],
     ["system", 5],
 ]);
+/** Every membership role the engine ranks, excluding the internal `system` actor. */
+export const BUILT_IN_MEMBERSHIP_ROLES = [...ROLE_RANKS.keys()].filter((role) => role !== "system");
 const ASSIGNABLE_FROM_ROLE_LIST = [
     "User",
     "Member",

package/dist/engine/schema-builder.js

@@ -87,6 +87,14 @@ export function fieldToZod(field, currencies, opts = {}) {
             let schema = z.string();
             if (field.maxLength)
                 schema = schema.max(field.maxLength);
+            if (field.minLength) {
+                // "" must stay valid for optional fields and writeOnly updates (""
+                // = unchanged); `required` rejects it separately via min(1) below.
+                const minLength = field.minLength;
+                schema = schema.refine((value) => value.length === 0 || value.length >= minLength, {
+                    message: `at least ${minLength} characters`,
+                });
+            }
             if (field.writeOnly === true) {
                 // Update: "" = unchanged (dropped before the executor), null = clear,
                 // unless required. Create: "" would leave a required field unset.

package/dist/engine/where-rule-lint.js

@@ -17,9 +17,9 @@ const SELF_COMPARISON_RE = new RegExp(`(${QUALIFIED_SRC})\\s*(?<![!<>=])=(?!=)\\
 const QUALIFIED_PARSE_RE = new RegExp(`^(${IDENT_SRC})(?:\\.(${IDENT_SRC}))?$`);
 // Resolve the SQL column names a table exposes, so the lint can tell a
 // real column reference apart from a table alias / function name / SQL
-// keyword. Returns an empty set when nothing is derivable; the column-aware
-// check then finds no bare column and is effectively skipped (only the
-// self-comparison check still applies).
+// keyword. Returns an empty set when nothing is derivable; callers that need
+// the column-aware check must treat that as "unknown" (see
+// assertQualifiedWhereFragment, which fails closed on it).
 export function tableColumnSqlNames(table) {
     if (table === null || typeof table !== "object")
         return new Set();
@@ -182,6 +182,9 @@ export function assertQualifiedWhereFragment(sqlText, columnSqlNames, scope) {
     // the fail-open shape this lint targets is impossible here.
     if (!/\bSELECT\b/i.test(cleaned))
         return;
+    if (columnSqlNames.size === 0) {
+        throw new Error(`[Kumiko Ownership] ${scope}: cannot verify where-rule SQL containing a subquery — the table's column set is unknown, so unqualified column references cannot be detected.`);
+    }
     const unqualified = findUnqualifiedColumnReference(cleaned, columnSqlNames);
     if (unqualified !== null) {
         throw new Error(`[Kumiko Ownership] ${scope}: where-rule SQL references column "${unqualified}" unqualified inside a subquery. Postgres binds an unqualified name to the innermost table first, which silently turns the ownership predicate into a tautology (fail-open). Qualify it with the outer table, e.g. \`\${ctx.tableName}.${unqualified}\`.`);

package/dist/env/index.d.ts

@@ -88,6 +88,10 @@ export type ParseEnvOptions = {
     /** When set, error suggestions include `pulumi config set <prefix>...`. */
     readonly pulumiPrefix?: string;
 };
+/** Validates `env` against `schema` and throws KumikoBootError on any issue.
+ *  A `kms: true` field delivered only as `<NAME>_CIPHERTEXT` passes validation but
+ *  is `undefined` in the result despite its `string` type — it is only set once
+ *  the boot-time decrypt (resolvePlatformKeks) has run. */
 export declare function parseEnv<S extends z.ZodObject<z.ZodRawShape>>(schema: S, env: Record<string, string | undefined>, options?: ParseEnvOptions): z.infer<S>;
 /** Dry-Run-Gegenstück zu parseEnv (KUMIKO_DRY_RUN_ENV-Pfad): parst jedes
  *  Feld einzeln und liefert ein ehrliches Partial — vorhandene Werte kommen

package/dist/env/index.js

@@ -259,6 +259,10 @@ function safeParseReportingThrows(schema, input) {
         ]);
     }
 }
+/** Validates `env` against `schema` and throws KumikoBootError on any issue.
+ *  A `kms: true` field delivered only as `<NAME>_CIPHERTEXT` passes validation but
+ *  is `undefined` in the result despite its `string` type — it is only set once
+ *  the boot-time decrypt (resolvePlatformKeks) has run. */
 export function parseEnv(schema, env, options = {}) {
     // Filter undefined values to keep Zod's required-vs-invalid signal clean.
     // (process.env returns string|undefined; passing undefined would parse

package/dist/es-ops/context.js

@@ -6,6 +6,7 @@
 // SystemUser bypassed Access-Checks (Standard-Seed-Pattern, siehe
 // config-seed.ts:40). Events haben createdBy = SYSTEM_TENANT_ID-User
 // → audit-fähig.
+import { configuredPiiSubjectKms, decryptPiiFieldValues } from "../crypto/index.js";
 import { selectAllTenants, selectMembershipsOfUser, selectTemplateResources, selectUserByEmail, } from "../db/queries/seed-context.js";
 import { createSystemUser, SYSTEM_TENANT_ID } from "../engine/index.js";
 import { parseStringArrayJson } from "../utils/parse-string-array-json.js";
@@ -63,7 +64,24 @@ export function createSeedMigrationContext(args) {
         },
         findTenants: async () => {
             const rows = await selectAllTenants(args.dbRunner);
-            return rows.map((r) => ({ id: r.id, name: r.name, tenantKey: r.tenant_key }));
+            const kms = configuredPiiSubjectKms();
+            // Sequential on purpose: each decrypt borrows from the KMS adapter's small pool.
+            const tenants = [];
+            for (const r of rows) {
+                // tenant.name is ciphertext at rest under an active KMS
+                const decrypted = kms
+                    ? await decryptPiiFieldValues({ name: r.name }, ["name"], kms, {
+                        requestId: "es-ops:find-tenants",
+                    })
+                    : { name: r.name };
+                const name = decrypted["name"];
+                tenants.push({
+                    id: r.id,
+                    name: typeof name === "string" ? name : r.name,
+                    tenantKey: r.tenant_key,
+                });
+            }
+            return tenants;
         },
         findTemplateResources: async (filter) => {
             const rows = await selectTemplateResources(args.dbRunner, {

package/dist/files/file-ref-entity.d.ts

@@ -3,6 +3,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -45,6 +47,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -78,6 +81,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -99,6 +103,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -120,6 +125,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/files/file-ref-table.d.ts

@@ -3,6 +3,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -45,6 +47,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -78,6 +81,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -99,6 +103,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -120,6 +125,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/files/file-routes.js

@@ -47,7 +47,7 @@ function resolveAttachedField(registry, entityType, fieldName) {
         return { kind: "unattached" };
     const entity = entityType !== undefined ? registry?.getEntity(entityType) : undefined;
     const fieldDef = entity && fieldName !== undefined ? entity.fields[fieldName] : undefined;
-    if (!entityType || !fieldName || !entity || !fieldDef)
+    if (!entityType || !fieldName || !entity || !fieldDef || !isFileField(fieldDef))
         return { kind: "unresolvable" };
     return { kind: "resolved", fieldDef };
 }
@@ -168,10 +168,10 @@ export function createFileRoutes(options) {
         const attachedField = resolveAttachedField(options.registry, entityType, fieldName);
         if (attachedField.kind === "unresolvable") {
             return c.json({
-                error: "unresolvable_field: entityType/fieldName must resolve to a registered entity field, or both must be omitted for an unattached upload",
+                error: "unresolvable_field: entityType/fieldName must resolve to a registered file field, or both must be omitted for an unattached upload",
             }, 400);
         }
-        if (attachedField.kind === "resolved" && isFileField(attachedField.fieldDef)) {
+        if (attachedField.kind === "resolved") {
             if (attachedField.fieldDef.maxSize)
                 maxSize = attachedField.fieldDef.maxSize;
             if (attachedField.fieldDef.accept)

package/dist/files/types.js

@@ -75,6 +75,7 @@ function extensionsForMimeType(mimeType) {
 // application/octet-stream in resolveServedContentType below — this also
 // guarantees text/html and image/svg+xml are never served inline, even for
 // an honestly-declared upload.
+const DOCX_MIME_TYPE = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
 const MAGIC_BYTE_SIGNATURES = [
     {
         mimeType: "image/png",
@@ -99,10 +100,22 @@ const MAGIC_BYTE_SIGNATURES = [
     // ZIP local-file-header signature — .docx/.xlsx/.pptx/plain .zip all share
     // it; same caveat as OLE above.
     {
-        mimeType: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+        mimeType: DOCX_MIME_TYPE,
         matches: (bytes) => startsWithBytes(bytes, [0x50, 0x4b, 0x03, 0x04]),
     },
 ];
+// ZIP entry names are stored uncompressed in the local and central headers,
+// so a byte search finds the docx part directory without unzipping. The main
+// part is resolved via _rels/.rels and may be named e.g. word/document2.xml.
+const DOCX_PART_PREFIX = "word/";
+function containsAscii(bytes, ascii) {
+    const first = ascii.charCodeAt(0);
+    for (let i = bytes.indexOf(first); i !== -1; i = bytes.indexOf(first, i + 1)) {
+        if (startsWithAscii(bytes, ascii, i))
+            return true;
+    }
+    return false;
+}
 function startsWithBytes(bytes, signature) {
     if (bytes.length < signature.length)
         return false;
@@ -220,6 +233,13 @@ export function validateFileContent(fileName, content, accept) {
     if (signatureMimeTypes.length === 0)
         return { kind: "ok" };
     const sniffed = sniffMimeType(content);
+    // sniffMimeType only sees the ZIP container; any .xlsx/.pptx/.zip shares it.
+    if (sniffed === DOCX_MIME_TYPE && !containsAscii(content, DOCX_PART_PREFIX)) {
+        return {
+            kind: "rejected",
+            error: `content_mismatch: ".${ext}" upload bytes are a ZIP archive without ${DOCX_PART_PREFIX} entries, not a docx`,
+        };
+    }
     if (sniffed && signatureMimeTypes.includes(sniffed))
         return { kind: "ok" };
     if (sniffed) {

package/dist/observability/metrics-wiring.d.ts

@@ -2,7 +2,7 @@ import * as z from "zod";
 import { type PrometheusMeter } from "./prometheus-meter.js";
 import type { ObservabilityProvider } from "./types/index.js";
 export declare const prometheusMetricsEnvSchema: z.ZodObject<{
-    PROMETHEUS_METRICS_TOKEN: z.ZodOptional<z.ZodString>;
+    PROMETHEUS_METRICS_TOKEN: z.ZodOptional<z.ZodUnion<readonly [z.ZodPipe<z.ZodLiteral<"">, z.ZodTransform<undefined, "">>, z.ZodString]>>;
 }, z.core.$strip>;
 type PrometheusObservabilityProvider = ObservabilityProvider & {
     readonly meter: PrometheusMeter;

package/dist/observability/metrics-wiring.js

@@ -2,9 +2,9 @@ import * as z from "zod";
 import { createNoopProvider } from "./noop-provider.js";
 import { createPrometheusMeter } from "./prometheus-meter.js";
 export const prometheusMetricsEnvSchema = z.object({
+    // An empty value (blank .env line, empty k8s secret) means "unset", not "invalid".
     PROMETHEUS_METRICS_TOKEN: z
-        .string()
-        .min(32)
+        .union([z.literal("").transform(() => undefined), z.string().min(32)])
         .optional()
         .describe("Bearer token for /metrics; unset keeps the endpoint off.")
         .meta({ kumiko: { pulumi: { secret: true, generator: "openssl rand -base64 32" } } }),

package/dist/pipeline/member-reader.js

@@ -67,6 +67,7 @@ export function createMemberReaderFn(ctx, tenantId, tx) {
     }
     // Only successful resolutions are cached — a rejected/failed resolution
     // deletes its own entry so a transient error can't poison the rest of the run.
+    // No TTL: a membership revoked mid-run is only noticed by the next reader.
     const cache = new Map();
     function resolve(userId) {
         const cached = cache.get(userId);

package/dist/testing/shared-entities.d.ts

@@ -3,6 +3,7 @@ export declare const sharedWidgetEntity: import("@cosmicdrift/kumiko-types/field
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const sharedWidgetTable: import("../db/table-builder.js").EntityT
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -49,6 +51,7 @@ export declare const sharedUserEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -70,6 +73,7 @@ export declare const sharedUserEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -91,6 +95,7 @@ export declare const sharedUserEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -117,6 +122,7 @@ export declare const sharedUserTable: import("../db/table-builder.js").EntityTab
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -138,6 +144,7 @@ export declare const sharedUserTable: import("../db/table-builder.js").EntityTab
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -159,6 +166,7 @@ export declare const sharedUserTable: import("../db/table-builder.js").EntityTab
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -185,6 +193,7 @@ export declare const sharedItemEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -227,6 +236,7 @@ export declare const sharedItemTable: import("../db/table-builder.js").EntityTab
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;