@cosmicdrift/kumiko-framework 0.356.0 → 0.358.0

package/dist/crypto/pii-field-encryption.d.ts

@@ -11,6 +11,7 @@ export interface EncryptPiiOptions {
     readonly tenantId?: TenantId;
     readonly subjectSource?: Record<string, unknown>;
     readonly entityName: string;
+    readonly ownerFallback?: Record<string, unknown>;
 }
 export declare function encryptPiiFieldValues(row: Record<string, unknown>, entity: EntityDefinition, piiFields: readonly string[], kms: LocalKeyKmsAdapter, kmsCtx: KmsContext, opts: EncryptPiiOptions): Promise<Record<string, unknown>>;
 export declare function serializeJsonbValue(field: string, value: unknown): string;

package/dist/crypto/pii-field-encryption.js

@@ -151,6 +151,7 @@ export async function encryptPiiFieldValues(row, entity, piiFields, kms, kmsCtx,
         const subject = resolveSubjectForField(entity, name, subjectSource, {
             entityName: opts.entityName,
             ...(opts.tenantId !== undefined && { tenantId: opts.tenantId }),
+            ...(opts.ownerFallback !== undefined && { ownerFallback: opts.ownerFallback }),
         });
         // skip: collectPiiSubjectFields only yields annotated fields — null is unreachable, kept as a type guard
         if (subject === null)

package/dist/crypto/subject-resolver.d.ts

@@ -9,6 +9,8 @@ export declare class SubjectResolutionError extends Error {
 export interface ResolveSubjectOptions {
     readonly tenantId?: TenantId;
     readonly entityName: string;
+    readonly ownerFallback?: Record<string, unknown>;
+    readonly ignoreWhenAbsent?: boolean;
 }
 /**
  * Maps a pii-annotated field to the subject whose key encrypts it.

package/dist/crypto/subject-resolver.js

@@ -29,12 +29,15 @@ function resolveRecordSubject(fieldName, row, opts) {
     }
     return { kind: "record", entity: entityName, id: recordId };
 }
-function resolveUserOwnedSubject(ownerField, fieldName, row) {
-    const userId = nonEmptyString(row[ownerField]);
-    if (userId === null) {
-        throw new SubjectResolutionError(fieldName, `owner field "${ownerField}" is empty on the row`);
+function resolveUserOwnedSubject(userOwned, fieldName, row, opts) {
+    const { ownerField } = userOwned;
+    const userId = nonEmptyString(row[ownerField]) ?? nonEmptyString(opts.ownerFallback?.[ownerField]);
+    if (userId !== null)
+        return { kind: "user", userId };
+    if (userOwned.whenAbsent === "tenant" && opts.ignoreWhenAbsent !== true) {
+        return resolveTenantSubject(fieldName, row, opts);
     }
-    return { kind: "user", userId };
+    throw new SubjectResolutionError(fieldName, `owner field "${ownerField}" is empty on the row and the field declares no whenAbsent — declare { personal: { of: "${ownerField}", whenAbsent: "tenant" } } (fw#3654)`);
 }
 function resolveTenantSubject(fieldName, row, opts) {
     const tenantId = nonEmptyString(row["tenantId"]) ?? opts.tenantId;
@@ -68,7 +71,7 @@ export function resolveSubjectForField(entity, fieldName, row, opts) {
         return resolveRecordSubject(fieldName, row, opts);
     }
     if ("userOwned" in field && field.userOwned !== undefined) {
-        return resolveUserOwnedSubject(field.userOwned.ownerField, fieldName, row);
+        return resolveUserOwnedSubject(field.userOwned, fieldName, row, opts);
     }
     if ("tenantOwned" in field && field.tenantOwned === true) {
         return resolveTenantSubject(fieldName, row, opts);

package/dist/db/connection.d.ts

@@ -8,3 +8,5 @@ export declare function createDbConnection(url: string, options?: import("./api.
     close: () => Promise<void>;
 };
 export declare function dbConnectionOptionsFromEnv(env?: Readonly<Record<string, string | undefined>>): import("./api.js").DbConnectionOptions;
+export declare const DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX = 3;
+export declare function outsideTransactionPoolOptionsFromEnv(env?: Readonly<Record<string, string | undefined>>): import("./api.js").DbConnectionOptions;

package/dist/db/connection.js

@@ -33,3 +33,13 @@ export function dbConnectionOptionsFromEnv(env = process.env) {
         opts.connectTimeoutSeconds = connect;
     return opts;
 }
+// Outside-tx access runs on its own pool: sharing the write pool deadlocks once
+// pool-max concurrent writes each hold a tx and then wait for a second connection.
+export const DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX = 3;
+export function outsideTransactionPoolOptionsFromEnv(env = process.env) {
+    return {
+        ...dbConnectionOptionsFromEnv(env),
+        maxConnections: readPositiveIntEnv(env, "DATABASE_OUTSIDE_TX_POOL_MAX") ??
+            DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX,
+    };
+}

package/dist/db/event-store-executor-context.d.ts

@@ -29,7 +29,9 @@ export type ExecutorContext = {
     readonly streamTenantFor: (user: SessionUser, requestedStreamTenantId?: TenantId) => TenantId;
     readonly streamTenantOverrideFailure: (db: TenantDb, row: Record<string, unknown>, requestedStreamTenantId: TenantId | undefined) => WriteFailure | undefined;
     readonly idFilter: (id: EntityId) => WhereObject;
-    readonly loadById: (id: EntityId, db: TenantDb) => Promise<Record<string, unknown> | null>;
+    readonly loadById: (id: EntityId, db: TenantDb, options?: {
+        readonly includeDeleted?: boolean;
+    }) => Promise<Record<string, unknown> | null>;
     readonly assertStreamWritable: (db: TenantDb, id: EntityId, tenantId: TenantId) => Promise<void>;
     readonly loadWithOwnership: (db: TenantDb, idWhere: WhereObject, ownership: {
         kind: "pass";
@@ -60,6 +62,7 @@ export type ExecutorContext = {
         onlyKeys?: Iterable<string>;
         subjectSource?: Record<string, unknown>;
         keyTenantId?: TenantId | undefined;
+        ownerFallback?: Record<string, unknown>;
     }) => Promise<Record<string, unknown>>;
     readonly decryptForRead: (row: Record<string, unknown>, opts?: DecryptForReadOptions) => Promise<Record<string, unknown>>;
     readonly applyDefaults: (payload: Record<string, unknown>) => Record<string, unknown>;

package/dist/db/event-store-executor-context.js

@@ -208,6 +208,7 @@ export function buildExecutorContext(table, entity, options) {
                     entityName,
                     ...(opts?.onlyKeys !== undefined && { onlyKeys: opts.onlyKeys }),
                     ...(opts?.subjectSource !== undefined && { subjectSource: opts.subjectSource }),
+                    ...(opts?.ownerFallback !== undefined && { ownerFallback: opts.ownerFallback }),
                 });
             }
             catch (e) {
@@ -272,8 +273,9 @@ export function buildExecutorContext(table, entity, options) {
             filter["isDeleted"] = false;
         return filter;
     }
-    async function loadById(id, db) {
-        const row = await db.fetchOne(table, idFilter(id));
+    async function loadById(id, db, options) {
+        // Only the soft-delete predicate is relaxed; the tenant filter of db.fetchOne stays.
+        const row = await db.fetchOne(table, options?.includeDeleted ? { id } : idFilter(id));
         if (!row)
             return null;
         return await decryptForRead(rehydrateCompoundTypes(row, entity));

package/dist/db/event-store-executor-write.js

@@ -343,7 +343,9 @@ export function createWriteVerbs(ctx) {
                         "be SYSTEM_TENANT_ID or omitted.",
                 });
             }
-            const previous = await loadById(payload.id, db);
+            const previous = await loadById(payload.id, db, {
+                includeDeleted: updateOptions?.includeDeleted === true,
+            });
             if (!previous)
                 return writeFailure(new NotFoundError(entityName, payload.id));
             const streamTenantId = updateOptions?.streamTenantId;
@@ -462,8 +464,11 @@ export function createWriteVerbs(ctx) {
                 // re-encrypt it before it's persisted so plaintext of pii/encrypted
                 // fields doesn't land in the immutable log (flatChanges is already
                 // ciphertext from encryptForStorage above).
+                // Owner chain for the ownerless-then-assigned row: previous owner, then the
+                // owner this event sets, then whenAbsent (fw#3654).
                 const encryptedPrevious = await encryptForStorage(previous, user, {
                     keyTenantId: streamTenantId,
+                    ownerFallback: submittedChanges,
                 });
                 // Savepoint-scoped — see the create() append() above for why:
                 // confines a losing writer's unique-violation to a nested scope

package/dist/db/index.d.ts

@@ -4,7 +4,7 @@ export { collectTableMetas } from "./collect-table-metas.js";
 export { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
 export { seedConfigValues } from "./config-seed.js";
 export type { DbConnection, DbConnectionOptions, DbPoolHandle, DbRow, DbRunner, DbTx, } from "./connection.js";
-export { createDbConnection, dbConnectionOptionsFromEnv } from "./connection.js";
+export { createDbConnection, DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX, dbConnectionOptionsFromEnv, outsideTransactionPoolOptionsFromEnv, } from "./connection.js";
 export type { CursorQueryOptions, CursorResult, DecodedKeysetCursor } from "./cursor.js";
 export { decodeCursor, decodeKeysetCursor, encodeCursor, encodeKeysetCursor } from "./cursor.js";
 export type { SchemaTable, SelectQuery, TableColumns } from "./dialect.js";

package/dist/db/index.js

@@ -3,7 +3,7 @@ export { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recor
 export { collectTableMetas } from "./collect-table-metas.js";
 export { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
 export { seedConfigValues } from "./config-seed.js";
-export { createDbConnection, dbConnectionOptionsFromEnv } from "./connection.js";
+export { createDbConnection, DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX, dbConnectionOptionsFromEnv, outsideTransactionPoolOptionsFromEnv, } from "./connection.js";
 export { decodeCursor, decodeKeysetCursor, encodeCursor, encodeKeysetCursor } from "./cursor.js";
 export { bigint, bigserial, boolean, extractTableName, index, instant, instantToDriver, integer, jsonb, moneyAmount, numeric, primaryKey, serial, sql, table, text, timestamp, uniqueIndex, uuid, } from "./dialect.js";
 export { collectReferenceFields, enrichRowWithReferences, enrichWithReferences, } from "./eagerload.js";

package/dist/db/queries/backfill-pii.js

@@ -25,17 +25,22 @@
 // second run reports 0 updates. One failing event does not abort the run;
 // failures are collected and reported (fail-loud at the caller).
 //
-// Owner resolution for entity-lifecycle events (backfill-only — the live
-// write path in event-store-executor-write.ts / subject-resolver.ts stays
-// fail-closed and is untouched by this):
-//   1. payload — the event section itself names the owner field.
+// Owner resolution for entity-lifecycle events. The live write path
+// (event-store-executor-write.ts) resolves the same chain via
+// subject-resolver.ts: row owner, then the owner the same event sets, then
+// the field's whenAbsent (fw#3654). Backfill adds two opt-in stages and
+// delays whenAbsent behind the projection so a known owner is never shadowed:
+//   1. payload — the event section (plus the owner the same event sets) names
+//      the owner field; whenAbsent is not applied yet.
 //   2. projection ({@link PiiBackfillOptions.resolveOwnerFromProjection}) —
 //      pre-owner-field-addition events don't carry it; read it from the
 //      entity's current projection row instead.
+//   2b. whenAbsent — the payload again, now falling back to the tenant key for
+//      fields that declare it.
 //   3. erase ({@link PiiBackfillOptions.eraseUnresolvableSubjects}) — still
 //      unresolvable (hard-deleted aggregate, no projection) → PII_ERASED_SENTINEL.
-//   Both stages are opt-in and off by default; without them an unresolvable
-//   subject still fails loud into `failures`, as before.
+//   Stages 2 and 3 are opt-in and off by default; without them an
+//   unresolvable subject still fails loud into `failures`, as before.
 //
 // Snapshots of touched aggregates are dropped per batch (they may cache
 // plaintext); the next snapshotting load recreates them. AFTER a run, rebuild the
@@ -293,14 +298,7 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
         async function applyEntityLifecycleFields(target, projectionOwnerRow) {
             const sections = lifecycleSections(payload);
             for (const section of sections) {
-                // Update-changes may carry a pii field without its owner field —
-                // resolve subjects from the merged view; aggregate_id backs the
-                // self-subject when a section lacks the id column.
-                const subjectSource = {
-                    id: row.aggregate_id,
-                    ...Object.assign({}, ...sections),
-                    ...section,
-                };
+                const { subjectSource, ownerFallback } = lifecycleSubjectView(section, payload, row.aggregate_id);
                 for (const field of target.piiFields) {
                     const value = section[field];
                     if (value === null || value === undefined)
@@ -316,7 +314,7 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
                     // must stay untouched, not get erased by stage 3.
                     if (isPiiCiphertext(value) || value === PII_ERASED_SENTINEL)
                         continue;
-                    const resolution = resolveOwnerSubject(target.entity, field, subjectSource, projectionOwnerRow, 
+                    const resolution = resolveOwnerSubject(target.entity, field, subjectSource, ownerFallback, projectionOwnerRow, 
                     // @cast-boundary db-read — tenant_id column is the branded TenantId
                     row.tenant_id, row.aggregate_type);
                     if (resolution.kind === "unannotated")
@@ -401,32 +399,41 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
         return scanCache.destroyedTenants;
     }
 }
-// Stage 1 (payload) then stage 2 (projection row, when supplied) — stage 3
-// (erase) is the caller's call, made from the "unresolved" outcome.
-function resolveOwnerSubject(entity, field, subjectSource, projectionOwnerRow, tenantId, entityName) {
+function attemptResolve(entity, field, source, opts) {
     try {
-        const subject = resolveSubjectForField(entity, field, subjectSource, { tenantId, entityName });
-        return subject === null
-            ? { kind: "unannotated" }
-            : { kind: "resolved", subject, viaProjection: false };
+        return { ok: true, subject: resolveSubjectForField(entity, field, source, opts) };
     }
     catch (e) {
         if (!(e instanceof SubjectResolutionError))
             throw e;
-        if (projectionOwnerRow) {
-            try {
-                const augmented = { ...subjectSource, ...projectionOwnerRow };
-                const subject = resolveSubjectForField(entity, field, augmented, { tenantId, entityName });
-                if (subject !== null)
-                    return { kind: "resolved", subject, viaProjection: true };
-            }
-            catch (e2) {
-                if (!(e2 instanceof SubjectResolutionError))
-                    throw e2;
-            }
+        return { ok: false, error: e };
+    }
+}
+// Stage 1 (payload) and stage 2 (projection row, when supplied) resolve the
+// owner strictly, ignoring whenAbsent — an ownerless payload must not shadow
+// an owner the projection knows. Stage 2b then applies whenAbsent to the
+// payload. Stage 3 (erase) is the caller's call, made from "unresolved".
+function resolveOwnerSubject(entity, field, subjectSource, ownerFallback, projectionOwnerRow, tenantId, entityName) {
+    const baseOpts = { tenantId, entityName, ...(ownerFallback && { ownerFallback }) };
+    const strictOpts = { ...baseOpts, ignoreWhenAbsent: true };
+    const payloadAttempt = attemptResolve(entity, field, subjectSource, strictOpts);
+    if (payloadAttempt.ok) {
+        return payloadAttempt.subject === null
+            ? { kind: "unannotated" }
+            : { kind: "resolved", subject: payloadAttempt.subject, viaProjection: false };
+    }
+    if (projectionOwnerRow) {
+        const augmented = { ...subjectSource, ...projectionOwnerRow };
+        const projectionAttempt = attemptResolve(entity, field, augmented, strictOpts);
+        if (projectionAttempt.ok && projectionAttempt.subject !== null) {
+            return { kind: "resolved", subject: projectionAttempt.subject, viaProjection: true };
         }
-        return { kind: "unresolved", error: e };
     }
+    const whenAbsentAttempt = attemptResolve(entity, field, subjectSource, baseOpts);
+    if (whenAbsentAttempt.ok && whenAbsentAttempt.subject !== null) {
+        return { kind: "resolved", subject: whenAbsentAttempt.subject, viaProjection: false };
+    }
+    return { kind: "unresolved", error: payloadAttempt.error };
 }
 // Projection columns are snake_case (author_id); event-payload/subject
 // fields are camelCase (authorId) — forward-map from entity.fields like
@@ -460,6 +467,23 @@ function lifecycleSections(payload) {
         sections.push(payload);
     return sections;
 }
+// Same view the live write path resolves from: changes see the merged row,
+// previous sees the owner the same event sets as fallback. aggregate_id backs
+// the self-subject when a section lacks the id column.
+function lifecycleSubjectView(section, payload, aggregateId) {
+    const changes = isRecord(payload["changes"]) ? payload["changes"] : undefined;
+    const previous = isRecord(payload["previous"]) ? payload["previous"] : undefined;
+    if (section === changes) {
+        return {
+            subjectSource: { id: aggregateId, ...previous, ...changes },
+            ownerFallback: undefined,
+        };
+    }
+    return {
+        subjectSource: { id: aggregateId, ...section },
+        ownerFallback: section === previous ? changes : undefined,
+    };
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/dist/engine/boot-validator/card-meta-overflow.d.ts

@@ -0,0 +1,10 @@
+import type { FeatureDefinition } from "../types/index.js";
+export type CardMetaOverflow = {
+    readonly feature: string;
+    readonly screen: string;
+    readonly location?: string;
+    readonly count: number;
+    readonly fields: readonly string[];
+};
+export declare function collectCardMetaOverflow(features: readonly FeatureDefinition[]): readonly CardMetaOverflow[];
+export declare function validateCardMetaOverflow(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/card-meta-overflow.js

@@ -0,0 +1,95 @@
+import { CARD_META_MAX, cardColumnRoles } from "../../ui-types/card-column-roles.js";
+import { LIST_ROW_META_COLUMNS } from "../../ui-types/list-row-meta.js";
+import { parseRefTarget } from "../parse-ref-target.js";
+import { normalizeListColumn } from "../screen-helpers.js";
+// Mirrors the type resolution of headless computeListViewModel; only the
+// "select" outcome matters for the card status role.
+function resolveColumnType(spec, storedType, entity) {
+    const col = normalizeListColumn(spec);
+    if (col.refEntity !== undefined && (storedType === undefined || storedType === "text")) {
+        return "reference";
+    }
+    if (storedType !== undefined)
+        return storedType;
+    const derived = entity?.derivedFields?.[col.field];
+    if (derived !== undefined)
+        return derived.valueType;
+    return LIST_ROW_META_COLUMNS[col.field] ?? "text";
+}
+function countOverflow(feature, screen, location, columns, storedTypeOf, entity) {
+    const cardColumns = columns.map((spec) => {
+        const col = normalizeListColumn(spec);
+        return {
+            field: col.field,
+            type: resolveColumnType(spec, storedTypeOf(col.field), entity),
+            renderer: col.renderer,
+            hideOnNarrow: col.hideOnNarrow,
+        };
+    });
+    const { meta } = cardColumnRoles(cardColumns);
+    if (meta.length <= CARD_META_MAX)
+        return undefined;
+    return {
+        feature: feature.name,
+        screen,
+        ...(location !== undefined && { location }),
+        count: meta.length,
+        fields: meta.map((col) => col.field),
+    };
+}
+function relatedListOverflow(features, feature, screen, location, section) {
+    let source;
+    if (section.entity !== undefined) {
+        const target = parseRefTarget(section.entity, feature.name);
+        source = features.find((f) => f.name === target.featureName)?.entities?.[target.entityName];
+    }
+    const synthesizedTypes = new Map(section.columns.map((spec) => {
+        const col = normalizeListColumn(spec);
+        return [col.field, col.valueType ?? "text"];
+    }));
+    return countOverflow(feature, screen, location, section.columns, (field) => source?.fields[field]?.type ?? synthesizedTypes.get(field), source);
+}
+// Every declaration whose columns the narrow layout draws as a DataTable card.
+// Dashboard list panels have their own table and are not covered.
+export function collectCardMetaOverflow(features) {
+    const found = [];
+    const add = (overflow) => {
+        if (overflow !== undefined)
+            found.push(overflow);
+    };
+    for (const feature of features) {
+        for (const screen of Object.values(feature.screens)) {
+            if (screen.type === "entityList") {
+                const entity = feature.entities?.[screen.entity];
+                add(countOverflow(feature, screen.id, undefined, screen.columns, (field) => entity?.fields[field]?.type, entity));
+                if (screen.expandableRow !== undefined) {
+                    add(relatedListOverflow(features, feature, screen.id, `expandableRow "${screen.expandableRow.title}"`, screen.expandableRow));
+                }
+            }
+            else if (screen.type === "projectionList") {
+                // The projection shim types every column "text"; only refEntity changes it.
+                add(countOverflow(feature, screen.id, undefined, screen.columns, () => "text", undefined));
+            }
+            else if (screen.type === "projectionDetail") {
+                const isTabs = screen.layout.mode === "tabs";
+                for (const section of screen.layout.sections) {
+                    if (!("kind" in section) || section.kind !== "relatedList")
+                        continue;
+                    const location = isTabs
+                        ? `tab "${section.id ?? section.title}" section "${section.title}"`
+                        : `section "${section.title}"`;
+                    add(relatedListOverflow(features, feature, screen.id, location, section));
+                }
+            }
+        }
+    }
+    return found;
+}
+export function validateCardMetaOverflow(features) {
+    const overflows = collectCardMetaOverflow(features);
+    // skip: nothing overflows, so there is nothing to report
+    if (overflows.length === 0)
+        return;
+    const lines = overflows.map((o) => `  - Feature "${o.feature}" screen "${o.screen}"${o.location !== undefined ? ` ${o.location}` : ""}: ${o.count} meta columns (${o.fields.join(", ")})`);
+    throw new Error(`List cards show at most ${CARD_META_MAX} meta columns (all columns except title, status select and hideOnNarrow ones); more would be cut off on narrow screens:\n${lines.join("\n")}\nReduce each to ${CARD_META_MAX} columns or mark the others hideOnNarrow: true.`);
+}

package/dist/engine/boot-validator/entity-handler.js

@@ -710,11 +710,12 @@ function assertNoSelectOptionsQuery(field, path, featureName) {
 export function validateEntitySelectAvailabilityQuery(feature, queryHandlers) {
     for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
         for (const [fieldName, field] of Object.entries(entity.fields)) {
-            if (field.type !== "select" || field.optionsAvailabilityQuery === undefined)
+            if ((field.type !== "select" && field.type !== "multiSelect") ||
+                field.optionsAvailabilityQuery === undefined)
                 continue;
             const query = field.optionsAvailabilityQuery;
             if (query.length === 0 || !queryHandlers.has(query)) {
-                throw new Error(`[Feature ${feature.name}] Select field "${fieldName}" on entity "${entityName}" ` +
+                throw new Error(`[Feature ${feature.name}] ${field.type === "select" ? "Select" : "MultiSelect"} field "${fieldName}" on entity "${entityName}" ` +
                     `declares optionsAvailabilityQuery "${query}" which is not a registered query-handler. ` +
                     `Check the QN spelling (expected "<feature>:query:<short>") and that the handler ` +
                     `is declared via r.queryHandler(...).`);

package/dist/engine/boot-validator/index.d.ts

@@ -1,5 +1,6 @@
 import type { EnvelopeCipher } from "../../secrets/envelope-cipher.js";
 import type { FeatureDefinition } from "../types/index.js";
+export { type CardMetaOverflow, collectCardMetaOverflow } from "./card-meta-overflow.js";
 export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns.js";
 export { collectWriteHandlerQns } from "./nav.js";
 export { SECURITY_BASELINE_FEATURE_NAMES } from "./security-baseline.js";

package/dist/engine/boot-validator/index.js

@@ -7,6 +7,7 @@ import { warnOnUniqueAccessRoles } from "./access-roles.js";
 import { validateActionWiring, validateFieldWiring } from "./action-wiring.js";
 import { validateApiExposureMatching, validateExtensionUsages } from "./api-ext.js";
 import { validateFeatureBootChecks } from "./boot-check.js";
+import { validateCardMetaOverflow } from "./card-meta-overflow.js";
 import { validateCircularDeps, validateConfigKeyAllowPerRequest, validateConfigKeyBacking, validateConfigKeyBounds, validateConfigKeyComputed, validateConfigKeyOptionsQuery, validateConfigKeyPiiEncrypted, validateConfigKeyRequired, validateConfigReads, warnOnToggleableDependencies, } from "./config-deps.js";
 import { collectDetailForScreens } from "./detail-screens.js";
 import { validateDerivedFieldCollisions, validateEmbeddedFields, validateEncryptedFields, validateEntityIndexes, validateEntitySelectAvailabilityQuery, validateEntitySelectConditionalOptions, validateEntitySelectOptionsQuery, validateExtendSchemaCollisions, validateExtensionPreSaveWiring, validateFileFields, validateHandlerAccess, validateImageVariants, validateLocatedTimestamps, validateMultiSelectFields, validateMultiStreamProjections, validateReferenceFields, validateSearchableFieldReadAccess, validateTransitions, } from "./entity-handler.js";
@@ -29,10 +30,11 @@ import { validateExtensionSelectorPanels } from "./selector-owner-panels.js";
 import { validateTransferGraph } from "./transfer-graph.js";
 import { validateSubmitPrefilledHiddenFields } from "./url-prefill-fields.js";
 import { collectWorkspaceQns, resolveNavAllowlist, validateDefaultWorkspaceUniqueness, validateWorkspaces, } from "./workspaces.js";
-export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns.js";
 // Re-export: wird von run-dev-app.ts benötigt um Write-Handler-QNs
 // an den Codegen zu übergeben. Nicht Teil von validateBoot, aber
 // dieselbe Extraktionslogik.
+export { collectCardMetaOverflow } from "./card-meta-overflow.js";
+export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns.js";
 export { collectWriteHandlerQns } from "./nav.js";
 export { SECURITY_BASELINE_FEATURE_NAMES } from "./security-baseline.js";
 export { MAX_TRANSFER_DEPTH } from "./transfer-graph.js";
@@ -217,6 +219,7 @@ export function validateBoot(rawFeatures, options) {
     validateI18nSurfaceKeys(features);
     validateEntityListScreens(features);
     validateSubmitPrefilledHiddenFields(features);
+    validateCardMetaOverflow(features);
     // Must run before validateProjectionListScreens: an unresolvable query
     // there is silently treated as "capability absent" and surfaces as a
     // misleading "no search parameter in its Zod schema" error instead of

package/dist/engine/boot-validator/pii-retention.js

@@ -203,6 +203,13 @@ export function validatePiiAndRetention(feature) {
                 if (ownerField.type !== "reference" && ownerField.type !== "text") {
                     throw new Error(`[Feature ${feature.name}] personal.of "${ownerName}" on entity "${entityName}" must be a reference or text (userId) field, got type "${ownerField.type}"`);
                 }
+                const { whenAbsent } = annot.userOwned;
+                if (whenAbsent !== undefined && whenAbsent !== "tenant") {
+                    throw new Error(`[Feature ${feature.name}] Field "${fieldName}" on entity "${entityName}" declares personal.whenAbsent "${String(whenAbsent)}" — entity fields only support whenAbsent: "tenant" (no plaintext fallback for stored PII).`);
+                }
+                if (ownerField.required !== true && whenAbsent === undefined) {
+                    throw new Error(`[Feature ${feature.name}] Field "${fieldName}" on entity "${entityName}" is personal: { of: "${ownerName}" }, but "${ownerName}" is not required — rows without an owner would fail to encrypt (SubjectResolutionError, HTTP 500) on update, delete and forget. Declare { personal: { of: "${ownerName}", whenAbsent: "tenant" } } to encrypt those rows under the tenant key, or make "${ownerName}" required: true. Entity fields have no plaintext fallback (fw#3654).`);
+                }
                 // Soft-Warning wenn das reference-target nicht offensichtlich user
                 // ist — custom subject-entities (HR-Mitarbeiter, Patient) sind
                 // erlaubt, müssen aber bewusste Wahl sein.

package/dist/engine/boot-validator/query-refs.js

@@ -45,6 +45,9 @@ function checkDashboardQueryRefs(queryHandlers, featureName, screenId, screen) {
 }
 function checkFormFieldQueryRefs(queryHandlers, featureName, screenId, screenType, fields) {
     for (const [fieldName, field] of Object.entries(fields)) {
+        if (field.type === "multiSelect" && field.optionsAvailabilityQuery !== undefined) {
+            checkQueryRef(queryHandlers, field.optionsAvailabilityQuery, () => `[Feature ${featureName}] Screen "${screenId}" (${screenType}) multiSelect field "${fieldName}" optionsAvailabilityQuery`);
+        }
         if (field.type !== "select")
             continue;
         if (field.optionsQuery !== undefined) {

package/dist/engine/boot-validator/screens.js

@@ -550,6 +550,11 @@ function validateFormSelectOptions(featureName, screenId, context, fieldName, fd
             throw new Error(`${where} has optionsQueryPayload without optionsQuery`);
         }
     }
+    else if (fdef.type === "multiSelect" && fdef.optionsAvailabilityQuery !== undefined) {
+        if (fdef.optionsAvailabilityQuery.length === 0) {
+            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) multiSelect field "${fieldName}" has an empty optionsAvailabilityQuery`);
+        }
+    }
 }
 // Fail-closed currency-source gate (fw#2839), the runtime half of the
 // narrowed `FormFieldDefinition` — an untyped JS consumer has no compiler to
@@ -1869,7 +1874,7 @@ function validateDashboardChartDisplay(featureName, screenId, panel) {
         "from-today",
     ]);
     validateStackedAreaEnumProp(where, "markerLegend", panel.markerLegend, ["list", "legend"]);
-    const nonBooleanProp = ["brush", "legendTotals"].find((prop) => panel[prop] !== undefined && typeof panel[prop] !== "boolean");
+    const nonBooleanProp = ["brush", "legendTotals", "markerLabels"].find((prop) => panel[prop] !== undefined && typeof panel[prop] !== "boolean");
     if (nonBooleanProp !== undefined) {
         throw new Error(`${where} has a non-boolean ${nonBooleanProp}.`);
     }
@@ -1904,6 +1909,7 @@ function validateStackedAreaOnlyProps(where, panel) {
         "dateFormat",
         "initialWindow",
         "markerLegend",
+        "markerLabels",
     ].filter((prop) => panel[prop] !== undefined);
     if (stackedAreaOnly.length > 0) {
         throw new Error(`${where} sets ${stackedAreaOnly.join(", ")} on chart "${panel.chart}" — only "stacked-area" supports it.`);

package/dist/engine/boot-validator.d.ts

@@ -1 +1 @@
-export { collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";
+export { type CardMetaOverflow, collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";

package/dist/engine/boot-validator.js

@@ -1 +1 @@
-export { collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";
+export { collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";

package/dist/engine/factories.js

@@ -1,6 +1,28 @@
 // `personal: { of: "id" }` means the row itself is the subject, not a
 // referenced user — resolves to `recordOwned` instead of `userOwned`.
 const RECORD_OWNER_FIELD = "id";
+function resolvePersonalFlags(personal, reason) {
+    if (personal === "self")
+        return { pii: true };
+    if (personal === "tenant")
+        return { tenantOwned: true };
+    if (personal === "ref")
+        return { subjectRef: true };
+    if (personal === false)
+        return { allowPlaintext: reason };
+    if (!personal)
+        return {};
+    if (personal.of === RECORD_OWNER_FIELD) {
+        if (personal.whenAbsent !== undefined) {
+            throw new Error(`personal: { of: "${RECORD_OWNER_FIELD}", whenAbsent } is meaningless: a row always has an id, so there is never an absent owner (fw#3654)`);
+        }
+        return { recordOwned: true };
+    }
+    const { whenAbsent } = personal;
+    return {
+        userOwned: { ownerField: personal.of, ...(whenAbsent !== undefined && { whenAbsent }) },
+    };
+}
 // Resolves the author-facing `personal`/`find` annotations (kumiko-framework#2250)
 // into the internal ResolvedPiiFlags every factory below merges into its
 // return value. `personal`, `find`, `reason` never survive into the field def.
@@ -9,25 +31,7 @@ function expandPersonalAnnotations(overrides) {
         return {};
     }
     const { personal, find, reason, anonymize, ...rest } = overrides;
-    let personalFlags = {};
-    if (personal === "self") {
-        personalFlags = { pii: true };
-    }
-    else if (personal === "tenant") {
-        personalFlags = { tenantOwned: true };
-    }
-    else if (personal === "ref") {
-        personalFlags = { subjectRef: true };
-    }
-    else if (personal === false) {
-        personalFlags = { allowPlaintext: reason };
-    }
-    else if (personal && personal.of === RECORD_OWNER_FIELD) {
-        personalFlags = { recordOwned: true };
-    }
-    else if (personal) {
-        personalFlags = { userOwned: { ownerField: personal.of } };
-    }
+    const personalFlags = resolvePersonalFlags(personal, reason);
     // `searchable`/`sensitive` live on the individual FieldDef, not on
     // ResolvedPiiFlags — "fuzzy"/"secret" resolve into those too.
     let findFlags = {};

package/dist/engine/feature-ast/extractors/resolve-import.d.ts

@@ -1,6 +1,8 @@
 import type { SourceFile, VariableDeclaration } from "ts-morph";
 import { Node } from "ts-morph";
-export declare function resolveModuleFile(fromFile: SourceFile, specifier: string): SourceFile | undefined;
+export declare function resolveModuleFile(fromFile: SourceFile, specifier: string, { allowDeclarationFiles }?: {
+    readonly allowDeclarationFiles?: boolean;
+}): SourceFile | undefined;
 export declare function findImportBindingForLocalName(sourceFile: SourceFile, localName: string): {
     readonly moduleSpecifier: string;
     readonly importedName: string;