@cosmicdrift/kumiko-framework 0.355.0 → 0.357.0

package/dist/db/event-store-executor-context.d.ts

@@ -25,10 +25,13 @@ export type ExecutorContext = {
     readonly entityCache?: EntityCache;
     readonly searchAdapter?: SearchAdapter;
     readonly softDelete: boolean;
+    readonly streamTenantCreateFailure: (db: TenantDb, payload: Record<string, unknown>, requestedStreamTenantId: TenantId | undefined) => WriteFailure | undefined;
     readonly streamTenantFor: (user: SessionUser, requestedStreamTenantId?: TenantId) => TenantId;
     readonly streamTenantOverrideFailure: (db: TenantDb, row: Record<string, unknown>, requestedStreamTenantId: TenantId | undefined) => WriteFailure | undefined;
     readonly idFilter: (id: EntityId) => WhereObject;
-    readonly loadById: (id: EntityId, db: TenantDb) => Promise<Record<string, unknown> | null>;
+    readonly loadById: (id: EntityId, db: TenantDb, options?: {
+        readonly includeDeleted?: boolean;
+    }) => Promise<Record<string, unknown> | null>;
     readonly assertStreamWritable: (db: TenantDb, id: EntityId, tenantId: TenantId) => Promise<void>;
     readonly loadWithOwnership: (db: TenantDb, idWhere: WhereObject, ownership: {
         kind: "pass";

package/dist/db/event-store-executor-context.js

@@ -118,14 +118,15 @@ export function buildExecutorContext(table, entity, options) {
     // there. Everything else stays on the caller's tenant (byte-identical to the
     // old hardcoded user.tenantId). Single source of truth for the stream key.
     const streamTenantFor = (user, requestedStreamTenantId) => entity.systemStream ? SYSTEM_TENANT_ID : (requestedStreamTenantId ?? user.tenantId);
-    // Only a system-mode db (r.systemScope() / acknowledged cross-tenant) may address another
-    // tenant's stream, and only the tenant of the row it just loaded.
+    // Only a system-mode db (r.systemScope() / acknowledged cross-tenant) or a tenant-mode db bound
+    // to exactly that stream tenant (ctx.forTenant) may address another tenant's stream, and only
+    // the tenant of the row it just loaded.
     const streamTenantOverrideFailure = (db, row, requestedStreamTenantId) => {
         if (requestedStreamTenantId === undefined)
             return undefined;
-        if (db.mode !== "system") {
+        if (db.mode !== "system" && db.tenantId !== requestedStreamTenantId) {
             return writeFailure(new AccessDeniedError({
-                message: `${entityName}: streamTenantId requires a system-mode db`,
+                message: `${entityName}: streamTenantId requires a system-mode db or a db bound to that tenant`,
             }));
         }
         if (row["tenantId"] !== requestedStreamTenantId) {
@@ -135,6 +136,8 @@ export function buildExecutorContext(table, entity, options) {
         }
         return undefined;
     };
+    // Create has no loaded row: the payload's own tenantId (if any) must agree with the target stream.
+    const streamTenantCreateFailure = (db, payload, requestedStreamTenantId) => streamTenantOverrideFailure(db, { tenantId: payload["tenantId"] ?? requestedStreamTenantId }, requestedStreamTenantId);
     // idType default (undefined) is now "uuid" — the ES-pivot made UUID the
     // only valid aggregate-id type. Explicit `idType: "serial"` is the only
     // shape that's incompatible with the event-store and still rejected.
@@ -269,8 +272,9 @@ export function buildExecutorContext(table, entity, options) {
             filter["isDeleted"] = false;
         return filter;
     }
-    async function loadById(id, db) {
-        const row = await db.fetchOne(table, idFilter(id));
+    async function loadById(id, db, options) {
+        // Only the soft-delete predicate is relaxed; the tenant filter of db.fetchOne stays.
+        const row = await db.fetchOne(table, options?.includeDeleted ? { id } : idFilter(id));
         if (!row)
             return null;
         return await decryptForRead(rehydrateCompoundTypes(row, entity));
@@ -416,6 +420,7 @@ export function buildExecutorContext(table, entity, options) {
         softDelete,
         streamTenantFor,
         streamTenantOverrideFailure,
+        streamTenantCreateFailure,
         idFilter,
         loadById,
         assertStreamWritable,

package/dist/db/event-store-executor-write.js

@@ -118,7 +118,7 @@ async function runPreSave(preSave, changes, previous, isNew, entityName, action,
     }
 }
 export function createWriteVerbs(ctx) {
-    const { table, entity, entityName, entityCache, softDelete, streamTenantFor, streamTenantOverrideFailure, encryptForStorage, decryptForRead, applyDefaults, stripSensitive, loadById, assertStreamWritable, loadExpectSnapshot, } = ctx;
+    const { table, entity, entityName, entityCache, softDelete, streamTenantFor, streamTenantOverrideFailure, streamTenantCreateFailure, encryptForStorage, decryptForRead, applyDefaults, stripSensitive, loadById, assertStreamWritable, loadExpectSnapshot, } = ctx;
     const entityInstructionFieldNames = instructionFieldNames(entity);
     const eventVersion = entity.eventVersion ?? 1;
     let insertSchema;
@@ -163,6 +163,10 @@ export function createWriteVerbs(ctx) {
                         "SYSTEM_TENANT_ID or omitted.",
                 });
             }
+            const streamTenantId = options?.streamTenantId;
+            const streamTenantMismatch = streamTenantCreateFailure(db, payload, streamTenantId);
+            if (streamTenantMismatch)
+                return streamTenantMismatch;
             const runner = tenantDbRunner(db);
             // Respect an explicit id in the payload (seed pattern, SCIM import). Without
             // one the framework mints a fresh UUIDv7 via generateId. Strip it out of the
@@ -179,7 +183,7 @@ export function createWriteVerbs(ctx) {
             assertInstructionFieldWriteAllowed(entityName, "create", Object.keys(data), entityInstructionFieldNames);
             // H.2 — entity-level write-ownership on create. No oldRow exists, so
             // only the new row is checked. No Straddle concern for creates.
-            if (!userCanCreateFieldRow(user, entity.access?.write, data)) {
+            if (!userCanCreateFieldRow(ownershipSubject(user, streamTenantId), entity.access?.write, data)) {
                 return writeFailure(new UnprocessableError("ownership_denied", {
                     i18nKey: "errors.ownershipDenied",
                     details: { scope: "entity", entityName, action: "create", userId: user.id },
@@ -195,7 +199,7 @@ export function createWriteVerbs(ctx) {
             // field is still evaluated against the full post-hook row (`data`) —
             // an ownership rule can reference a column only a hook populates
             // (kumiko-framework#1672).
-            const fieldDeniedCreate = checkWriteFieldOwnership(entity, applyDefaults(payloadWithoutId), user, undefined, data);
+            const fieldDeniedCreate = checkWriteFieldOwnership(entity, applyDefaults(payloadWithoutId), ownershipSubject(user, streamTenantId), undefined, data);
             if (fieldDeniedCreate) {
                 return writeFailure(new UnprocessableError("ownership_denied", {
                     i18nKey: "errors.ownershipDenied",
@@ -219,6 +223,7 @@ export function createWriteVerbs(ctx) {
             const flatCreateData = flattenCompoundTypes(data, entity);
             const flatData = await encryptForStorage(flatCreateData, user, {
                 subjectSource: { ...flatCreateData, id: aggregateId },
+                keyTenantId: streamTenantId,
             });
             // 1. Append event (same TX as the projection write — both must succeed
             //    or both roll back; the dispatcher wraps both in one transaction).
@@ -246,7 +251,7 @@ export function createWriteVerbs(ctx) {
                 event = await runInSavepointIfSupported(runner, async (sp) => append(sp, {
                     aggregateId,
                     aggregateType: entityName,
-                    tenantId: streamTenantFor(user),
+                    tenantId: streamTenantFor(user, streamTenantId),
                     expectedVersion: 0,
                     type: entityEventName(entityName, "created"),
                     eventVersion,
@@ -258,7 +263,7 @@ export function createWriteVerbs(ctx) {
                 if (e instanceof EventStoreVersionConflict) {
                     let currentVersion = -1;
                     try {
-                        currentVersion = await getStreamVersion(runner, aggregateId, streamTenantFor(user));
+                        currentVersion = await getStreamVersion(runner, aggregateId, streamTenantFor(user, streamTenantId));
                     }
                     catch {
                         // Lookup failure — keep the sentinel.
@@ -308,7 +313,7 @@ export function createWriteVerbs(ctx) {
             // Compound-Types in einem Pass.
             const projection = await decryptForRead(rehydrateCompoundTypes(row, entity));
             if (entityCache && entityName) {
-                await entityCache.del(user.tenantId, entityName, aggregateId);
+                await entityCache.del(streamTenantId ?? user.tenantId, entityName, aggregateId);
             }
             // The echoed event is the one projections see (and the dispatcher later
             // skips), so build it before projecting.
@@ -338,7 +343,9 @@ export function createWriteVerbs(ctx) {
                         "be SYSTEM_TENANT_ID or omitted.",
                 });
             }
-            const previous = await loadById(payload.id, db);
+            const previous = await loadById(payload.id, db, {
+                includeDeleted: updateOptions?.includeDeleted === true,
+            });
             if (!previous)
                 return writeFailure(new NotFoundError(entityName, payload.id));
             const streamTenantId = updateOptions?.streamTenantId;

package/dist/engine/boot-validator/card-meta-overflow.d.ts

@@ -0,0 +1,10 @@
+import type { FeatureDefinition } from "../types/index.js";
+export type CardMetaOverflow = {
+    readonly feature: string;
+    readonly screen: string;
+    readonly location?: string;
+    readonly count: number;
+    readonly fields: readonly string[];
+};
+export declare function collectCardMetaOverflow(features: readonly FeatureDefinition[]): readonly CardMetaOverflow[];
+export declare function validateCardMetaOverflow(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/card-meta-overflow.js

@@ -0,0 +1,95 @@
+import { CARD_META_MAX, cardColumnRoles } from "../../ui-types/card-column-roles.js";
+import { LIST_ROW_META_COLUMNS } from "../../ui-types/list-row-meta.js";
+import { parseRefTarget } from "../parse-ref-target.js";
+import { normalizeListColumn } from "../screen-helpers.js";
+// Mirrors the type resolution of headless computeListViewModel; only the
+// "select" outcome matters for the card status role.
+function resolveColumnType(spec, storedType, entity) {
+    const col = normalizeListColumn(spec);
+    if (col.refEntity !== undefined && (storedType === undefined || storedType === "text")) {
+        return "reference";
+    }
+    if (storedType !== undefined)
+        return storedType;
+    const derived = entity?.derivedFields?.[col.field];
+    if (derived !== undefined)
+        return derived.valueType;
+    return LIST_ROW_META_COLUMNS[col.field] ?? "text";
+}
+function countOverflow(feature, screen, location, columns, storedTypeOf, entity) {
+    const cardColumns = columns.map((spec) => {
+        const col = normalizeListColumn(spec);
+        return {
+            field: col.field,
+            type: resolveColumnType(spec, storedTypeOf(col.field), entity),
+            renderer: col.renderer,
+            hideOnNarrow: col.hideOnNarrow,
+        };
+    });
+    const { meta } = cardColumnRoles(cardColumns);
+    if (meta.length <= CARD_META_MAX)
+        return undefined;
+    return {
+        feature: feature.name,
+        screen,
+        ...(location !== undefined && { location }),
+        count: meta.length,
+        fields: meta.map((col) => col.field),
+    };
+}
+function relatedListOverflow(features, feature, screen, location, section) {
+    let source;
+    if (section.entity !== undefined) {
+        const target = parseRefTarget(section.entity, feature.name);
+        source = features.find((f) => f.name === target.featureName)?.entities?.[target.entityName];
+    }
+    const synthesizedTypes = new Map(section.columns.map((spec) => {
+        const col = normalizeListColumn(spec);
+        return [col.field, col.valueType ?? "text"];
+    }));
+    return countOverflow(feature, screen, location, section.columns, (field) => source?.fields[field]?.type ?? synthesizedTypes.get(field), source);
+}
+// Every declaration whose columns the narrow layout draws as a DataTable card.
+// Dashboard list panels have their own table and are not covered.
+export function collectCardMetaOverflow(features) {
+    const found = [];
+    const add = (overflow) => {
+        if (overflow !== undefined)
+            found.push(overflow);
+    };
+    for (const feature of features) {
+        for (const screen of Object.values(feature.screens)) {
+            if (screen.type === "entityList") {
+                const entity = feature.entities?.[screen.entity];
+                add(countOverflow(feature, screen.id, undefined, screen.columns, (field) => entity?.fields[field]?.type, entity));
+                if (screen.expandableRow !== undefined) {
+                    add(relatedListOverflow(features, feature, screen.id, `expandableRow "${screen.expandableRow.title}"`, screen.expandableRow));
+                }
+            }
+            else if (screen.type === "projectionList") {
+                // The projection shim types every column "text"; only refEntity changes it.
+                add(countOverflow(feature, screen.id, undefined, screen.columns, () => "text", undefined));
+            }
+            else if (screen.type === "projectionDetail") {
+                const isTabs = screen.layout.mode === "tabs";
+                for (const section of screen.layout.sections) {
+                    if (!("kind" in section) || section.kind !== "relatedList")
+                        continue;
+                    const location = isTabs
+                        ? `tab "${section.id ?? section.title}" section "${section.title}"`
+                        : `section "${section.title}"`;
+                    add(relatedListOverflow(features, feature, screen.id, location, section));
+                }
+            }
+        }
+    }
+    return found;
+}
+export function validateCardMetaOverflow(features) {
+    const overflows = collectCardMetaOverflow(features);
+    // skip: nothing overflows, so there is nothing to report
+    if (overflows.length === 0)
+        return;
+    const lines = overflows.map((o) => `  - Feature "${o.feature}" screen "${o.screen}"${o.location !== undefined ? ` ${o.location}` : ""}: ${o.count} meta columns (${o.fields.join(", ")})`);
+    throw new Error(`List cards show at most ${CARD_META_MAX} meta columns (all columns except title, status select and hideOnNarrow ones); more would be cut off on narrow screens:\n${lines.join("\n")}\nReduce each to ${CARD_META_MAX} columns or mark the others hideOnNarrow: true.`);
+}

package/dist/engine/boot-validator/entity-handler.js

@@ -710,11 +710,12 @@ function assertNoSelectOptionsQuery(field, path, featureName) {
 export function validateEntitySelectAvailabilityQuery(feature, queryHandlers) {
     for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
         for (const [fieldName, field] of Object.entries(entity.fields)) {
-            if (field.type !== "select" || field.optionsAvailabilityQuery === undefined)
+            if ((field.type !== "select" && field.type !== "multiSelect") ||
+                field.optionsAvailabilityQuery === undefined)
                 continue;
             const query = field.optionsAvailabilityQuery;
             if (query.length === 0 || !queryHandlers.has(query)) {
-                throw new Error(`[Feature ${feature.name}] Select field "${fieldName}" on entity "${entityName}" ` +
+                throw new Error(`[Feature ${feature.name}] ${field.type === "select" ? "Select" : "MultiSelect"} field "${fieldName}" on entity "${entityName}" ` +
                     `declares optionsAvailabilityQuery "${query}" which is not a registered query-handler. ` +
                     `Check the QN spelling (expected "<feature>:query:<short>") and that the handler ` +
                     `is declared via r.queryHandler(...).`);

package/dist/engine/boot-validator/index.d.ts

@@ -1,5 +1,6 @@
 import type { EnvelopeCipher } from "../../secrets/envelope-cipher.js";
 import type { FeatureDefinition } from "../types/index.js";
+export { type CardMetaOverflow, collectCardMetaOverflow } from "./card-meta-overflow.js";
 export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns.js";
 export { collectWriteHandlerQns } from "./nav.js";
 export { SECURITY_BASELINE_FEATURE_NAMES } from "./security-baseline.js";

package/dist/engine/boot-validator/index.js

@@ -7,6 +7,7 @@ import { warnOnUniqueAccessRoles } from "./access-roles.js";
 import { validateActionWiring, validateFieldWiring } from "./action-wiring.js";
 import { validateApiExposureMatching, validateExtensionUsages } from "./api-ext.js";
 import { validateFeatureBootChecks } from "./boot-check.js";
+import { validateCardMetaOverflow } from "./card-meta-overflow.js";
 import { validateCircularDeps, validateConfigKeyAllowPerRequest, validateConfigKeyBacking, validateConfigKeyBounds, validateConfigKeyComputed, validateConfigKeyOptionsQuery, validateConfigKeyPiiEncrypted, validateConfigKeyRequired, validateConfigReads, warnOnToggleableDependencies, } from "./config-deps.js";
 import { collectDetailForScreens } from "./detail-screens.js";
 import { validateDerivedFieldCollisions, validateEmbeddedFields, validateEncryptedFields, validateEntityIndexes, validateEntitySelectAvailabilityQuery, validateEntitySelectConditionalOptions, validateEntitySelectOptionsQuery, validateExtendSchemaCollisions, validateExtensionPreSaveWiring, validateFileFields, validateHandlerAccess, validateImageVariants, validateLocatedTimestamps, validateMultiSelectFields, validateMultiStreamProjections, validateReferenceFields, validateSearchableFieldReadAccess, validateTransitions, } from "./entity-handler.js";
@@ -29,10 +30,11 @@ import { validateExtensionSelectorPanels } from "./selector-owner-panels.js";
 import { validateTransferGraph } from "./transfer-graph.js";
 import { validateSubmitPrefilledHiddenFields } from "./url-prefill-fields.js";
 import { collectWorkspaceQns, resolveNavAllowlist, validateDefaultWorkspaceUniqueness, validateWorkspaces, } from "./workspaces.js";
-export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns.js";
 // Re-export: wird von run-dev-app.ts benötigt um Write-Handler-QNs
 // an den Codegen zu übergeben. Nicht Teil von validateBoot, aber
 // dieselbe Extraktionslogik.
+export { collectCardMetaOverflow } from "./card-meta-overflow.js";
+export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns.js";
 export { collectWriteHandlerQns } from "./nav.js";
 export { SECURITY_BASELINE_FEATURE_NAMES } from "./security-baseline.js";
 export { MAX_TRANSFER_DEPTH } from "./transfer-graph.js";
@@ -217,6 +219,7 @@ export function validateBoot(rawFeatures, options) {
     validateI18nSurfaceKeys(features);
     validateEntityListScreens(features);
     validateSubmitPrefilledHiddenFields(features);
+    validateCardMetaOverflow(features);
     // Must run before validateProjectionListScreens: an unresolvable query
     // there is silently treated as "capability absent" and surfaces as a
     // misleading "no search parameter in its Zod schema" error instead of

package/dist/engine/boot-validator/query-refs.js

@@ -45,6 +45,9 @@ function checkDashboardQueryRefs(queryHandlers, featureName, screenId, screen) {
 }
 function checkFormFieldQueryRefs(queryHandlers, featureName, screenId, screenType, fields) {
     for (const [fieldName, field] of Object.entries(fields)) {
+        if (field.type === "multiSelect" && field.optionsAvailabilityQuery !== undefined) {
+            checkQueryRef(queryHandlers, field.optionsAvailabilityQuery, () => `[Feature ${featureName}] Screen "${screenId}" (${screenType}) multiSelect field "${fieldName}" optionsAvailabilityQuery`);
+        }
         if (field.type !== "select")
             continue;
         if (field.optionsQuery !== undefined) {

package/dist/engine/boot-validator/screens.js

@@ -550,6 +550,11 @@ function validateFormSelectOptions(featureName, screenId, context, fieldName, fd
             throw new Error(`${where} has optionsQueryPayload without optionsQuery`);
         }
     }
+    else if (fdef.type === "multiSelect" && fdef.optionsAvailabilityQuery !== undefined) {
+        if (fdef.optionsAvailabilityQuery.length === 0) {
+            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) multiSelect field "${fieldName}" has an empty optionsAvailabilityQuery`);
+        }
+    }
 }
 // Fail-closed currency-source gate (fw#2839), the runtime half of the
 // narrowed `FormFieldDefinition` — an untyped JS consumer has no compiler to

package/dist/engine/boot-validator.d.ts

@@ -1 +1 @@
-export { collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";
+export { type CardMetaOverflow, collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";

package/dist/engine/boot-validator.js

@@ -1 +1 @@
-export { collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";
+export { collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";

package/dist/engine/index.d.ts

@@ -3,7 +3,7 @@ export { hasAccess } from "./access.js";
 export { isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, type PrincipalProfile, type PrincipalStatus, type PrincipalStatusPlugin, TENANT_TEARDOWN_STATUSES, type TenantLifecycleStatusPlugin, } from "./active-membership.js";
 export { PII_DIRECT_NAME_HINTS, PII_USER_OWNED_NAME_HINTS, PII_USER_REFERENCE_NAME_HINTS, } from "./boot-validator/entity-handler.js";
 export { entityHasAnonymizableSubjectField } from "./boot-validator/pii-retention.js";
-export { collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.js";
+export { type CardMetaOverflow, collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.js";
 export { type BuildAppSchemaOptions, buildAppSchema } from "./build-app-schema.js";
 export type { ConfigFeatureSchema } from "./build-config-feature-schema.js";
 export { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE, SETTINGS_HUB_WORKSPACE, } from "./build-config-feature-schema.js";
@@ -80,7 +80,7 @@ export { ANONYMOUS_ROLE, ANONYMOUS_USER_ID, createAnonymousUser, createSystemUse
 export { type EffectiveFeaturesResolver, findTierResolverUsage, isTierResolverPlugin, TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin, type TrialGate, } from "./tier-resolver-extension.js";
 export { findOverDeepTransferChain, resolveTransferAdjacency as resolveEntityTransferAdjacency, type TransferAdjacency, type TransferEdge, type TransferEdgeLink, } from "./transfer-adjacency.js";
 export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID } from "./types/identifiers.js";
-export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EntityDefinition, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationRecipientFn, NotificationTemplateFn, NotifyDelivery, NotifyDeliveryStatus, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TenantId, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.js";
+export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationRecipientFn, NotificationTemplateFn, NotifyDelivery, NotifyDeliveryStatus, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.js";
 export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HookPhases, HTTP_ERROR_CODE_PATTERN, isAgentVisibleScreen, isDeliveryErrorCode, isOpenToAllGranted, resolveAgentExposure, } from "./types/index.js";
 export type { AwaitedEventType, PipelineBuildCtx, PipelineCtx, PipelineDef, StepBuilder, StepDef, StepFailureStrategy, StepInstance, StepKind, StepNamespace, StepResolver, } from "./types/step.js";
 export { runValidation } from "./validation.js";

package/dist/engine/index.js

@@ -4,7 +4,7 @@ export { hasAccess } from "./access.js";
 export { isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, TENANT_TEARDOWN_STATUSES, } from "./active-membership.js";
 export { PII_DIRECT_NAME_HINTS, PII_USER_OWNED_NAME_HINTS, PII_USER_REFERENCE_NAME_HINTS, } from "./boot-validator/entity-handler.js";
 export { entityHasAnonymizableSubjectField } from "./boot-validator/pii-retention.js";
-export { collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.js";
+export { collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.js";
 export { buildAppSchema } from "./build-app-schema.js";
 export { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE, SETTINGS_HUB_WORKSPACE, } from "./build-config-feature-schema.js";
 export { buildTarget } from "./build-target.js";

package/dist/engine/types/index.d.ts

@@ -7,7 +7,7 @@ export type { ExtensionOptionsArgs, ExtensionOptionsFor, KumikoExtensionOptionsM
 export type { BootCheckContext, BootCheckFn, FeatureDefinition, FeatureMetricDef, FeatureMetricType, FeatureRegistrar, MetricOptions, Registry, SecretKeyDefinition, SecretKeyHandle, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, StoreTableDef, StoreTableEntry, StoreTableOptions, UiHintOption, UiHints, } from "@cosmicdrift/kumiko-types/feature";
 export type { FieldIconKey } from "@cosmicdrift/kumiko-types/field-icon";
 export type { AnyFileFieldDef, BigIntFieldDef, BooleanFieldDef, ClientDerivedFieldDef, DateFieldDef, DecimalFieldDef, DefaultCurrency, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EmbeddedDerivedCellDef, EmbeddedFieldDef, EmbeddedSubFieldDef, EntityDefinition, EntityEventMigration, EntityIndexDef, FieldAccess, FieldDefinition, FieldsMap, FileFieldDef, FilesFieldDef, Findability, ImageFieldDef, ImagesFieldDef, JsonbFieldDef, LocatedTimestampFieldDef, LongTextFieldDef, LongTextFindability, MoneyCurrencySource, MoneyFieldDef, MultiSelectFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, ReferenceFieldDef, ResolvedPiiFlags, RetentionDef, SelectFieldDef, SelectOptionTone, TextFieldDef, TimestampFieldDef, TransitionMap, TzFieldDef, } from "@cosmicdrift/kumiko-types/fields";
-export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDelivery, NotifyDeliveryStatus, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadRateLimitOption, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
+export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDelivery, NotifyDeliveryStatus, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadRateLimitOption, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
 export { DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HTTP_ERROR_CODE_PATTERN, isDeliveryErrorCode, isOpenToAllGranted, isRateLimitDisabled, isUiAccessGranted, } from "@cosmicdrift/kumiko-types/handlers";
 export type { DeleteContext, EntityHookMap, HookMap, HookOwner, HookPhase, LifecycleHookFn, LifecycleResult, OwnedFn, PhasedHook, PostDeleteBatchHookFn, PostDeleteHookFn, PostQueryHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, SaveContext, SearchPayloadContributorFn, ValidationError, ValidationHookFn, } from "@cosmicdrift/kumiko-types/hooks";
 export type { HttpRouteDefinition, HttpRouteHandler, HttpRouteHandlerDeps, HttpRouteMethod, } from "@cosmicdrift/kumiko-types/http-route";
@@ -17,7 +17,7 @@ export type { ContentCollectionDefinition, NavDefinition, NavIconKey, } from "@c
 export type { FromRule, FromRuleKind, OwnershipClause, OwnershipMap, OwnershipRef, OwnershipRule, SqlFragment, WhereRule, WhereRuleContext, } from "@cosmicdrift/kumiko-types/ownership";
 export type { EntityProjectionExtension, MspErrorMode, MspErrorPolicy, MultiStreamApplyFn, MultiStreamProjectionDefinition, ProjectionDefinition, ProjectionRowIdOf, ProjectionTable, SingleStreamApplyFn, } from "@cosmicdrift/kumiko-types/projection";
 export type { BelongsToRelation, EntityRelations, HasManyRelation, ManyToManyRelation, RelationDefinition, } from "@cosmicdrift/kumiko-types/relations";
-export type { ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelGate, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardValueFormat, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, FieldCondition, FieldFormatRegistry, FieldRenderer, FormatSpec, FormWidth, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RecordHeaderSubtitlePart, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, UnitKey, } from "@cosmicdrift/kumiko-types/screen";
+export type { ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelGate, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardValueFormat, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, FieldCondition, FieldFormatRegistry, FieldRenderer, FormatSpec, FormWidth, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RecordHeaderSubtitlePart, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, UnitKey, } from "@cosmicdrift/kumiko-types/screen";
 export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
 export type { TargetRef } from "@cosmicdrift/kumiko-types/target-ref";
 export type { Subscribe, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, } from "@cosmicdrift/kumiko-types/tree-node";

package/dist/files/file-ref-entity.d.ts

@@ -4,6 +4,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -82,6 +85,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -104,6 +108,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -126,6 +131,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/files/file-ref-table.d.ts

@@ -4,6 +4,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -82,6 +85,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -104,6 +108,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -126,6 +131,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/i18n/required-surface-keys.js

@@ -283,6 +283,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
             pushKey(out, mint.reveal.title);
             pushKey(out, mint.reveal.warning);
             pushKey(out, mint.reveal.confirmLabel);
+            pushKey(out, mint.reveal.acknowledge);
             for (const revealField of mint.reveal.fields) {
                 pushKey(out, revealField.label);
             }

package/dist/jobs/job-runner.js

@@ -869,7 +869,6 @@ export function createJobRunner(options) {
             }
             return dispatchWriteRef.queryAs(user, qn, payload, jobOrigin);
         };
-        // Only writeAs is gated for jobs; queryAs stays ungated (fw#2859).
         const gatedIdentitySwitch = createGatedIdentitySwitch(`job "${jobName}"`, jobSystemUser, isSystemJob || identitySwitchHatch !== undefined, {
             queryAs: ungatedQueryAs,
             writeAs: async (user, qn, payload) => {
@@ -909,7 +908,7 @@ export function createJobRunner(options) {
                 return dispatchWriteRef.write(jobSystemUser, qn, payload, jobOrigin);
             },
             writeAs: gatedIdentitySwitch.writeAs,
-            queryAs: ungatedQueryAs,
+            queryAs: gatedIdentitySwitch.queryAs,
             queryAsMember: (userId, qn, payload) => {
                 if (!dispatchWriteRef) {
                     throw new Error("JobContext.queryAsMember called before dispatcher attached — call attachDispatcher() first");

package/dist/pipeline/dispatch-shared.js

@@ -3,9 +3,10 @@ import { requestContext, runWithOrigin } from "../api/request-context.js";
 import { runInSavepoint, selectMany } from "../db/query.js";
 import { createTenantDb, createUncheckedSystemDb, hasTenantColumn, runInOwnTransaction, } from "../db/tenant-db.js";
 import { createDerivativesContext } from "../derivatives/derivatives-context.js";
+import { mayOverrideTenant } from "../engine/cross-tenant.js";
 import { createSystemUser } from "../engine/system-user.js";
 import { isRateLimitDisabled, resolveAgentExposure } from "../engine/types/index.js";
-import { AccessDeniedError, FeatureDisabledError, InternalError, memberResolutionReadOnlyDenied, RateLimitError, RateLimitUnavailableError, VersionConflictError, } from "../errors/index.js";
+import { AccessDeniedError, FeatureDisabledError, FrameworkReasons, InternalError, memberResolutionReadOnlyDenied, RateLimitError, RateLimitUnavailableError, VersionConflictError, } from "../errors/index.js";
 import { archiveStream as archiveStreamHelper, isStreamArchived, restoreStream as restoreStreamHelper, } from "../event-store/archive.js";
 import { IdempotentAppendConflictError as EventStoreIdempotentAppendConflictError, VersionConflictError as EventStoreVersionConflictError, } from "../event-store/errors.js";
 import { getStreamVersion, loadAggregate, loadAggregateAsOf, } from "../event-store/event-store.js";
@@ -178,6 +179,7 @@ export function applyMemberResolutionReadOnly(handlerContext) {
         restoreStream: denyMemberResolutionWrite,
         snapshotAggregate: denyMemberResolutionWrite,
         queryAsMember: denyMemberResolutionWrite,
+        forTenant: undefined,
         resolveActiveMembership: denyMemberResolutionWrite,
         scheduleAfterCommit: () => {
             throw memberResolutionReadOnlyDenied();
@@ -226,9 +228,11 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
     });
     const identitySwitchGrantReason = identitySwitchEscapeHatch?.reason ??
         (isSystem ? `r.systemScope() feature "${featureName ?? "unknown"}"` : undefined);
-    const buildTenantScopedDb = (source, signal) => createTenantDb(source, user.tenantId, isSystem ? "system" : "tenant", context.tracer, context.meter, signal, {
-        globalWrites: escapeHatchFor(writeEscapeHatch, "globalWrites"),
-        unsafeRaw: escapeHatchFor(handlerEscapeHatch, "unsafeRaw"),
+    const buildTenantScopedDb = (source, signal, foreignTenantId) => createTenantDb(source, foreignTenantId ?? user.tenantId, isSystem && foreignTenantId === undefined ? "system" : "tenant", context.tracer, context.meter, signal, {
+        ...(foreignTenantId === undefined && {
+            globalWrites: escapeHatchFor(writeEscapeHatch, "globalWrites"),
+            unsafeRaw: escapeHatchFor(handlerEscapeHatch, "unsafeRaw"),
+        }),
         report: reportEscapeHatch,
         memberReadOnly: isMemberResolutionPrincipal(user),
         personalDataGate: buildPersonalDataGate(registry, origin),
@@ -309,6 +313,26 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
             });
         }
         : undefined;
+    // Write handlers only, and not r.systemScope() ones (they have ctx.systemDb). The gate is the
+    // dispatcher's tenantIdOverride predicate, so no caller reaches more than it could via
+    // tenantIdOverride. The foreign db carries no unsafeRaw/globalWrites grant and is tenant mode
+    // bound to the target; the executor accepts streamTenantId only on a db bound to that tenant.
+    const forTenant = !isSystem && dbSource && registry.getWriteHandler(type) !== undefined
+        ? (targetTenantId) => {
+            if (targetTenantId === user.tenantId && exposedDb) {
+                return { db: exposedDb, streamTenantId: undefined };
+            }
+            if (!mayOverrideTenant(user)) {
+                throw new AccessDeniedError({
+                    details: { reason: FrameworkReasons.tenantOverrideRequiresSystemAdmin },
+                });
+            }
+            return {
+                db: buildTenantScopedDb(dbSource, reqCtx?.signal, targetTenantId),
+                streamTenantId: targetTenantId,
+            };
+        }
+        : undefined;
     // ctx.files resolved per-tenant through file-foundation (lazy — the
     // provider is only resolved when a handle actually does I/O). Boot wires
     // _fileProviderResolver when a file-provider plugin is mounted; falls back
@@ -721,6 +745,7 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
         notify,
         ...(config && { config }),
         ...(configFor && { configFor }),
+        ...(forTenant && { forTenant }),
         ...(files && { files }),
         ...(derivatives && { derivatives }),
         // preSave hooks need `changes`/`previous`/`isNew`, which only exist once

package/dist/pipeline/system-hooks.js

@@ -37,15 +37,19 @@ import { InternalError } from "../errors/index.js";
 // call per tenant instead of one round-trip per event; handler stays the
 // per-event fallback the dispatcher falls back to when a batch throws.
 export const SEARCH_CONSUMER_NAME = "system:consumer:search";
+// An executor update with includeDeleted leaves the row deleted; indexing it would make it findable again.
+function isUpdateOfSoftDeletedRow(event, verb) {
+    return (verb === "updated" && reconstructStateForSearch(event.payload, "updated")["isDeleted"] === true);
+}
 // Resolves what one event implies for the search index, without touching
 // the adapter — same decision tree the old per-event handler ran inline.
 async function resolveSearchOperation(event, ctx, registry) {
     const entityName = event.aggregateType;
     const verb = event.type.split(".").pop();
     const tenantId = event.tenantId;
-    // skip: delete/forgotten remove the index entry — reconstruct only
-    // makes sense for created/updated/restored (field data in payload).
-    if (verb === "deleted" || verb === "forgotten") {
+    // skip: delete/forgotten (and an update on a still soft-deleted row) remove the
+    // index entry — reconstruct only makes sense for live created/updated/restored.
+    if (verb === "deleted" || verb === "forgotten" || isUpdateOfSoftDeletedRow(event, verb)) {
         return { kind: "remove", tenantId, entityType: entityName, entityId: event.aggregateId };
     }
     let state;

package/dist/testing/shared-entities.d.ts

@@ -4,6 +4,7 @@ export declare const sharedWidgetEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -28,6 +29,7 @@ export declare const sharedWidgetTable: import("../db/table-builder.js").EntityT
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -52,6 +54,7 @@ export declare const sharedUserEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -74,6 +77,7 @@ export declare const sharedUserEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -96,6 +100,7 @@ export declare const sharedUserEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -123,6 +128,7 @@ export declare const sharedUserTable: import("../db/table-builder.js").EntityTab
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -145,6 +151,7 @@ export declare const sharedUserTable: import("../db/table-builder.js").EntityTab
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -167,6 +174,7 @@ export declare const sharedUserTable: import("../db/table-builder.js").EntityTab
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -194,6 +202,7 @@ export declare const sharedItemEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -237,6 +246,7 @@ export declare const sharedItemTable: import("../db/table-builder.js").EntityTab
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/ui-types/card-column-roles.d.ts

@@ -0,0 +1,14 @@
+export declare const CARD_META_MAX = 3;
+export type CardRoleColumn = {
+    readonly field: string;
+    readonly highlighted?: boolean;
+    readonly type?: string;
+    readonly renderer?: unknown;
+    readonly hideOnNarrow?: boolean;
+};
+export type CardColumnRoles<C extends CardRoleColumn> = {
+    readonly title: C | undefined;
+    readonly status: C | undefined;
+    readonly meta: readonly C[];
+};
+export declare function cardColumnRoles<C extends CardRoleColumn>(columns: readonly C[]): CardColumnRoles<C>;

package/dist/ui-types/card-column-roles.js

@@ -0,0 +1,9 @@
+export const CARD_META_MAX = 3;
+// One rule for the narrow-layout list card, shared by the renderer and the
+// boot validator so the validator counts exactly what the card would draw.
+export function cardColumnRoles(columns) {
+    const title = columns.find((col) => col.highlighted === true) ?? columns[0];
+    const status = columns.find((col) => col !== title && col.type === "select" && col.renderer === undefined);
+    const meta = columns.filter((col) => col !== title && col !== status && col.hideOnNarrow !== true);
+    return { title, status, meta };
+}

package/dist/ui-types/index.d.ts

@@ -9,13 +9,15 @@ export type { BooleanFieldDef, DateFieldDef, EmbeddedDerivedCellDef, EntityDefin
 export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, RoleAccessPersonalData, RoleAccessRule, } from "../engine/types/handlers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
 export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav.js";
-export type { ActionFormFooterAction, ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.js";
+export type { ActionFormFooterAction, ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.js";
 export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
 export type { TargetRef } from "../engine/types/target-ref.js";
 export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.js";
 export type { WorkspaceDefinition } from "../engine/types/workspace.js";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
 export type { AppSchema, FeatureSchema, QualifiedContentCollection, WorkspaceSchema, } from "./app-schema.js";
+export type { CardColumnRoles, CardRoleColumn } from "./card-column-roles.js";
+export { CARD_META_MAX, cardColumnRoles } from "./card-column-roles.js";
 export { type Formality, formalLocaleTag } from "./formality.js";
 export type { ListRowMetaColumnType, ListRowMetaReference, ReferenceLookupSource, SystemReferenceLabel, } from "./list-row-meta.js";
 export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, } from "./list-row-meta.js";

package/dist/ui-types/index.js

@@ -26,6 +26,7 @@ export { availableSelectOptions, evalFieldCondition, explicitListScreenId, findU
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
 export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
+export { CARD_META_MAX, cardColumnRoles } from "./card-column-roles.js";
 export { formalLocaleTag } from "./formality.js";
 export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, } from "./list-row-meta.js";
 export { resolveTranslationValue, translationValueOtherText, } from "./plural.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.355.0",
+  "version": "0.357.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -210,8 +210,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.355.0",
-    "@cosmicdrift/kumiko-types": "0.355.0",
+    "@cosmicdrift/kumiko-http": "0.357.0",
+    "@cosmicdrift/kumiko-types": "0.357.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -227,7 +227,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.355.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.357.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,27 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "Executor update accepts includeDeleted for soft-deleted rows",
+    "detail": "`executor.update(payload, user, db, { includeDeleted: true })` loads the row without the soft-delete filter (the tenant filter stays), so server code can move a trashed row together with its parent (for example a team change) and a later restore lands consistently. The row stays deleted. The default is unchanged (NotFound) and the generic HTTP update handler never sets the option. The projection apply was already unfiltered by `isDeleted`, so live and rebuild agree. The search consumer treats an update on a soft-deleted row as a removal, so the moved row does not reappear in search."
+  },
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "Boot validation covers multiSelect optionsAvailabilityQuery on entity and screen fields"
+  },
+  {
+    "version": "0.356.0",
+    "type": "improvement",
+    "title": "Executor create accepts streamTenantId; ctx.forTenant(tenantId) for gated cross-tenant writes",
+    "detail": "createEventStoreExecutor().create takes { streamTenantId } (stream, event tenant, row tenant, PII key and cache invalidation follow it, the acting user stays the operator). The override is accepted on a system-mode db and also on a tenant-mode db bound to exactly that stream tenant. New handler-context method ctx.forTenant(tenantId) returns { db, streamTenantId }: a tenant-mode db bound to the target tenant plus the stream override to pass to the executor, so a handler needs no unsafeRaw escape hatch for cross-tenant writes. A foreign tenant is gated to SystemAdmin and system identities (AccessDeniedError with reason tenant_override_requires_system_admin otherwise); the caller's own tenant returns streamTenantId undefined. It is not offered to r.systemScope() handlers. The bundled cross-tenant handlers (tenant removeMember/updateMemberRoles, tier setTenantTier, custom-fields system fields, template-resolver upserts/set, managed-pages set, compliance-profiles setProfile) no longer rewrite event.user.tenantId; the event actor is the operator. tenant cancelPendingInvitation takes an optional streamTenantId."
+  },
+  {
+    "version": "0.356.0",
+    "type": "breaking",
+    "title": "Job ctx.queryAs is gated like ctx.writeAs",
+    "migration": "Jobs calling ctx.queryAs with createSystemUser(...) or any identity other than the job's own caller now fail with AccessDeniedError (system_identity_switch_denied / identity_switch_denied). Declare r.systemScope() on the job's feature or escapeHatch: { reason } on the job, the same grant ctx.writeAs already needs. The escape-hatch guard exempts jobs by name, so this surfaces only at runtime; grep your jobs for ctx.queryAs. Known consumer sites: offlot-app channel-text generate-texts.job, campaign-calendar sync, campaign-channel-foundation seed-starter-channels."
+  },
   {
     "version": "0.355.0",
     "type": "improvement",