@cosmicdrift/kumiko-framework 0.359.0 → 0.361.0

package/dist/jobs/job-runner.js

@@ -17,6 +17,7 @@ import { RedisKeys } from "../pipeline/redis-keys.js";
 import { createGatedIdentitySwitch } from "../pipeline/system-identity-switch.js";
 import { buildPersonalDataGate, isPersonalDataGated, parseWriteOrigin, } from "../pipeline/write-origin.js";
 import { bridgeStub } from "../testing/handler-context.js";
+import { cronRepeatOptions } from "./cron-repeat-options.js";
 // Shape-checked after the BullMQ/Redis JSON round-trip. Unlike `_writeOrigin`
 // (a security-relevant escape hatch that must fail the run closed), a
 // malformed `_triggerEvent` only costs an idempotency-key convenience — the
@@ -1154,7 +1155,7 @@ export function createJobRunner(options) {
                 if ("cron" in jobDef.trigger) {
                     const schedulerId = schedulerIdForJobName(name);
                     expectedSchedulerIds.add(schedulerId);
-                    await consumerQueue.upsertJobScheduler(schedulerId, { pattern: jobDef.trigger.cron }, {
+                    await consumerQueue.upsertJobScheduler(schedulerId, cronRepeatOptions(jobDef.trigger), {
                         name: jobDef.perTenant ? `_perTenant:${name}` : name,
                         data: {},
                         // Queue-level defaultJobOptions (jobRetentionOpts) covers

package/dist/migrations/pii-event-backfill.d.ts

@@ -33,6 +33,7 @@ export type PiiEventBackfillResult = {
     readonly updatedEvents: number;
     readonly encryptedFields: number;
     readonly erasedFields: number;
+    readonly rekeyedFields: number;
     readonly failures: readonly PiiBackfillFailure[];
     readonly queuedTables: readonly string[];
     readonly rebuild: PiiRebuildRun | null;

package/dist/migrations/pii-event-backfill.js

@@ -68,8 +68,14 @@ export function piiAnnotationEntries(registry) {
     }
     return entries.sort();
 }
+// Bump when the backfill gains a transform stage: completed states keyed by the
+// old fingerprint must run one more full pass. Kept out of piiAnnotationEntries,
+// whose emptiness gates no_pii.
+const PII_BACKFILL_TRANSFORM_VERSION = "owner-rekey-v1";
 export function piiAnnotationFingerprint(registry) {
-    return createHash("sha256").update(piiAnnotationEntries(registry).join("\n")).digest("hex");
+    return createHash("sha256")
+        .update([...piiAnnotationEntries(registry), PII_BACKFILL_TRANSFORM_VERSION].join("\n"))
+        .digest("hex");
 }
 async function queueRebuildTables(db, tableNames, migrationId) {
     for (const tableName of tableNames) {
@@ -125,6 +131,7 @@ async function runOneBatch(ctx, progress, retryEventIds) {
             ...(retryEventIds && { eventIds: retryEventIds }),
             batchSize: ctx.batchSize,
             resolveOwnerFromProjection: true,
+            rekeyTenantKeyedOwnerFields: true,
             scanCache: progress.scanCache,
         });
         const batchTouchedEventTypes = new Set(batch.touchedEventTypes);
@@ -151,6 +158,7 @@ function recordBatch(progress, step) {
     progress.totals.updatedEvents += batch.updatedEvents;
     progress.totals.encryptedFields += batch.encryptedFields;
     progress.totals.erasedFields += batch.erasedFields;
+    progress.totals.rekeyedFields += batch.rekeyedFields;
     for (const failure of batch.failures) {
         // The catch-up overlap and the per-event retry can hit the same failed event twice in one run.
         if (progress.failedIdsSeen.has(failure.eventId))
@@ -218,7 +226,13 @@ export async function runPiiEventBackfill(db, registry, options = {}) {
     const progress = {
         scanCursor,
         scanCache: {},
-        totals: { scannedEvents: 0, updatedEvents: 0, encryptedFields: 0, erasedFields: 0 },
+        totals: {
+            scannedEvents: 0,
+            updatedEvents: 0,
+            encryptedFields: 0,
+            erasedFields: 0,
+            rekeyedFields: 0,
+        },
         failures: [],
         queuedTables: new Set(),
         failedIdsSeen: new Set(),

package/dist/pipeline/cascade-handler.js

@@ -1,6 +1,7 @@
-import { deleteMany, fetchOne, updateMany } from "../db/query.js";
+import { deleteMany, fetchOne, selectMany, updateMany } from "../db/query.js";
 import { OnDeleteStrategies, SystemHookNames, SystemHookPriorities } from "../engine/constants.js";
-import { ConflictError, FrameworkReasons } from "../errors/index.js";
+import { isRecordLocked } from "../engine/screen-helpers.js";
+import { ConflictError, FrameworkReasons, RecordLockedError } from "../errors/index.js";
 export function createCascadeDeleteHook(registry, tables) {
     return {
         name: SystemHookNames.cascadeDelete,
@@ -47,6 +48,20 @@ export function createCascadeDeleteHook(registry, tables) {
                             });
                         }
                     }
+                    // The raw delete/update below bypasses the executor, so a locked child must
+                    // block the parent delete here instead of changing with it. The error names
+                    // the parent only: the caller may delete the parent without reading the child.
+                    if (strategy === OnDeleteStrategies.cascade || strategy === OnDeleteStrategies.setNull) {
+                        const childLock = registry.getEntity(relation.target)?.lockedWhen;
+                        if (childLock !== undefined) {
+                            const children = await selectMany(db, targetTable, {
+                                [relation.foreignKey]: payload.id,
+                            });
+                            if (children.some((child) => isRecordLocked(childLock, child))) {
+                                throw new RecordLockedError({ entityName, entityId: payload.id });
+                            }
+                        }
+                    }
                     if (strategy === OnDeleteStrategies.cascade) {
                         await deleteMany(db, targetTable, { [relation.foreignKey]: payload.id });
                     }

package/dist/pipeline/dispatch-write.js

@@ -8,6 +8,9 @@ import { checkWriteFieldOwnership, maskWriteOnlyFields } from "../engine/field-a
 import { defineTransitions, guardTransition } from "../engine/state-machine.js";
 import { HookPhases } from "../engine/types/index.js";
 import { AccessDeniedError, FrameworkReasons, InternalError, memberResolutionReadOnlyDenied, NotFoundError, ValidationError, writeFailure, } from "../errors/index.js";
+import { assertFileRefsBelongToTenant } from "../files/assert-file-refs-belong-to-tenant.js";
+import { bindPendingFileRefs } from "../files/bind-pending-file-refs.js";
+import { disposeRemovedFileRefs } from "../files/dispose-removed-file-refs.js";
 import { CACHE_SYNC_TOPICS } from "../redis/cache-sync-topics.js";
 import { assertNoSecretLeak } from "../secrets/index.js";
 import { buildHandlerContext, CONFIG_WRITE_RESET_TYPE, CONFIG_WRITE_SET_TYPE, isMemberResolutionPrincipal, resolveDbSource, runHandlerInstrumented, TENANT_TIMEZONE_CONFIG_KEY, } from "./dispatch-shared.js";
@@ -111,6 +114,10 @@ async function runLifecycle(ctx, type, data, handlerContext, user, origin, after
     // keeps projection state consistent with what the hooks observe.
     await runProjections(result, handlerContext.registry, runner);
     if (result.kind === "save") {
+        const fileRefArgs = { registry: handlerContext.registry, result, user, db: handlerContext.db };
+        await assertFileRefsBelongToTenant(fileRefArgs);
+        await bindPendingFileRefs(fileRefArgs);
+        await disposeRemovedFileRefs(fileRefArgs);
         await lifecycle.runPostSave(type, result, handlerContext, HookPhases.inTransaction);
         afterCommitHooks.push(async () => {
             const afterCommitContext = await buildHandlerContext(ctx, type, user, origin, undefined, undefined, undefined, true);

package/dist/schema-cli.js

@@ -10,7 +10,7 @@
 import { existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
 import { join, resolve as resolvePath } from "node:path";
 import { configureBlindIndexKey, configurePiiSubjectKms, resolveKmsWiringAsync, } from "./crypto/index.js";
-import { assertValidMigrationName, baselineMigrations, createDbConnection, diffReplayAgainstSnapshot, fetchAppliedMigrations, findCommentedDropTables, generateMigration, isRetiredFrameworkTable, loadMigrationsFromDir, loadSnapshotJson, readMigrationSqlTexts, rebuildTablesFromDiff, replayMigrationsDir, runMigrationsFromDir, tableExists, writeRebuildMarker, writeSnapshotJson, } from "./db/index.js";
+import { assertUniqueTableNames, assertValidMigrationName, baselineMigrations, createDbConnection, diffReplayAgainstSnapshot, fetchAppliedMigrations, findCommentedDropTables, generateMigration, isRetiredFrameworkTable, loadMigrationsFromDir, loadSnapshotJson, readMigrationSqlTexts, rebuildTablesFromDiff, replayMigrationsDir, runMigrationsFromDir, tableExists, writeRebuildMarker, writeSnapshotJson, } from "./db/index.js";
 import { validateBoot } from "./engine/boot-validator.js";
 import { createRegistry } from "./engine/registry.js";
 import { createEventsTable } from "./event-store/index.js";
@@ -29,10 +29,9 @@ async function loadSchemaModFromApp(schemaFile) {
     if (!Array.isArray(mod.ENTITY_METAS)) {
         throw new Error(`Schema file ${schemaFile} muss \`export const ENTITY_METAS: EntityTableMeta[]\` haben.`);
     }
-    return {
-        entityMetas: mod.ENTITY_METAS,
-        features: mod.FEATURES,
-    };
+    const entityMetas = mod.ENTITY_METAS;
+    assertUniqueTableNames(entityMetas);
+    return { entityMetas, features: mod.FEATURES };
 }
 function nextSequenceNumber(migrationsDir) {
     if (!existsSync(migrationsDir))
@@ -134,7 +133,14 @@ export async function runSchemaCli(argv, appCwd, out, options = {}) {
                 out.err("    export const ENTITY_METAS: EntityTableMeta[] = [...]");
                 return 1;
             }
-            const { entityMetas: metas } = await loadSchemaModFromApp(schemaFile);
+            let metas;
+            try {
+                ({ entityMetas: metas } = await loadSchemaModFromApp(schemaFile));
+            }
+            catch (e) {
+                out.err(`  ${e instanceof Error ? e.message : String(e)}`);
+                return 1;
+            }
             const snapshotPath = join(migrationsDir, SNAPSHOT_FILENAME);
             const prevSnapshot = existsSync(snapshotPath) ? loadSnapshotJson(snapshotPath) : null;
             const result = generateMigration({

package/dist/search/reindex-entity.js

@@ -13,10 +13,9 @@ function quoteIdent(name) {
 }
 // Read-table state, forward-mapped from entity.fields (fieldName →
 // toSnakeCase(fieldName)). SELECT * + forward-map instead of building an
-// explicit column list: some field types (files/images) emit no column at
-// all, others (locatedTimestamp, money) emit companion columns under a
-// different name — an explicit alias list breaks on those. Missing columns
-// are just skipped, matching what a `.created` event payload would carry.
+// explicit column list: some field types (locatedTimestamp, money) emit
+// companion columns under a different name — an explicit alias list breaks on
+// those. Missing columns are just skipped, matching what a `.created` event payload would carry.
 function rowToState(row, fieldNames) {
     const state = {};
     for (const fieldName of fieldNames) {

package/dist/stack/test-stack.d.ts

@@ -7,7 +7,7 @@ import type { ErrorDocsConfig } from "../errors/docs-url.js";
 import { type JobRunner, type JobRunnerOptions } from "../jobs/index.js";
 import type { Lifecycle } from "../lifecycle/index.js";
 import { type ObservabilityProvider } from "../observability/index.js";
-import type { Dispatcher, EventDispatcher } from "../pipeline/index.js";
+import type { Dispatcher, EventDispatcher, SystemHooks } from "../pipeline/index.js";
 import { type ClosableCacheSyncBus } from "../redis/cache-sync-bus.js";
 import type { SearchAdapter } from "../search/types.js";
 import { type EventCollector } from "./event-collector.js";
@@ -37,6 +37,8 @@ export type TestStackOptions = {
     features: readonly FeatureDefinition[];
     /** System hooks to wire up. Default: all (sse, search) */
     systemHooks?: ("sse" | "search")[];
+    /** Pipeline system hooks handed to buildServer, e.g. the cascade-delete preDelete hook. None by default. */
+    lifecycleSystemHooks?: SystemHooks;
     /** Search config per tenant — defaults to tenant 1 with all text fields */
     searchConfig?: {
         tenantId: TenantId;

package/dist/stack/test-stack.js

@@ -287,6 +287,7 @@ export async function setupTestStack(options) {
             context: rateLimitFallback ? { ...appContext, rateLimit: rateLimitFallback } : appContext,
             jwtSecret,
             ...(options.observability ? { observability: options.observability } : {}),
+            ...(options.lifecycleSystemHooks && { systemHooks: options.lifecycleSystemHooks }),
             dispatcherOptions: {
                 idempotency,
                 cacheSync,

package/dist/ui-types/index.d.ts

@@ -4,12 +4,12 @@ export { computeDerivedCellValue, roundDerivedCellValue } from "../engine/embedd
 export type { ParsedRefTarget } from "../engine/parse-ref-target.js";
 export { parseRefTarget } from "../engine/parse-ref-target.js";
 export type { FieldsOrGroupsSection, UnavailableSelectOption } from "../engine/screen-helpers.js";
-export { availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
+export { availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
 export type { BooleanFieldDef, DateFieldDef, EmbeddedDerivedCellDef, EntityDefinition, FieldDefinition, FileFieldDef, FilesFieldDef, ImageFieldDef, ImagesFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, SelectFieldDef, SelectOptionTone, TextFieldDef, } from "../engine/types/fields.js";
 export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, RoleAccessPersonalData, RoleAccessRule, } from "../engine/types/handlers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
 export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav.js";
-export type { ActionFormFooterAction, ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.js";
+export type { ActionFormFooterAction, ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.js";
 export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
 export type { TargetRef } from "../engine/types/target-ref.js";
 export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.js";

package/dist/ui-types/index.js

@@ -22,7 +22,7 @@
 export { NO_WIDGET_FIELD_TYPES } from "@cosmicdrift/kumiko-types/fields";
 export { computeDerivedCellValue, roundDerivedCellValue } from "../engine/embedded-derived.js";
 export { parseRefTarget } from "../engine/parse-ref-target.js";
-export { availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
+export { availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
 export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.359.0",
+  "version": "0.361.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -210,8 +210,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.359.0",
-    "@cosmicdrift/kumiko-types": "0.359.0",
+    "@cosmicdrift/kumiko-http": "0.361.0",
+    "@cosmicdrift/kumiko-types": "0.361.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -227,7 +227,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.359.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.361.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,139 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "Boot check for edit field prefill",
+    "detail": "validateBoot allows today only on date fields, currentUser displayName and email only on text fields and id on text or reference fields."
+  },
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "Boot check for the entityEdit readOnly condition",
+    "detail": "validateBoot rejects a screen readOnly condition whose field is not a field of the screen's entity."
+  },
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "Boot check for embeddedList on edit fields",
+    "detail": "validateBoot requires the field to be an embedded list and every readOnlyCells entry to be a sub-field."
+  },
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "Locked records reject executor writes",
+    "detail": "The event-store executor checks entity.lockedWhen against the loaded row in update and delete and fails with RecordLockedError (409, code record_locked, i18n key errors.recordLocked); a missing condition field counts as locked. Create, restore, forget, framework-system-user writes that name a writePurpose and the write that sets the lock pass. validateBoot rejects a lockedWhen field that is unknown, personal, encrypted or not a plain scalar type."
+  },
+  {
+    "version": "0.361.0",
+    "type": "breaking",
+    "title": "POST /files checks write access to the target record",
+    "detail": "createRecordWriteCheck loads the stored row tenant-scoped and applies update-handler access, entity access.write, field write access and lockedWhen before the upload is stored. Results map to 404, 403 and 409 record_locked. Uploads with an entityId and no check wired are refused.",
+    "migration": "Grant the uploader the entity's update right for records they attach files to, or upload without an entityId and bind the file on save. Entities without a generic :update handler no longer accept uploads with an entityId. Code that used entityId as a free slot without a stored record must create the record first."
+  },
+  {
+    "version": "0.361.0",
+    "type": "breaking",
+    "title": "Unbound uploads are private to the uploader (security)",
+    "detail": "The default file access guard denies every operation on a file with no entityType or no entityId unless the caller is the uploader or has a role in privilegedRoles; the file routes answer 404 as for any denied file. Before, files without entityType were readable by the whole tenant and pending uploads until a record claimed them. bindPendingFileRefs now also runs for updates and binds the file ids named in the update's changes for file, image, files and images fields (same entityType and fieldName, entityId null, insertedById = caller), so createFileRefFromBytes with attachTo but no entityId plus a following update write attaches the file to the record.",
+    "migration": "Code that shows a file without entityType to other users (tenant logo, avatar, mail attachment, import preview, AI-agent output) must upload it with entityType and fieldName of a file field on a record and save the record, so readers of that record can read it; or keep it uploader-only, run the read as a role in privilegedRoles, or set a custom accessGuard in the files feature options. Apps that set accessGuard keep their own decision. Code that reads another user's pending upload before the record is saved must bind the file first or run as the uploader. Known case: solon's document upload (`document/web/upload-file.ts`) posts without entityType and the later document record (created by the ingest job, not the uploader) stores the id in its `fileId` field, so other users no longer read the original; solon must upload with entityType and fieldName of `fileId` and bind the file when the record is created, because a different creator cannot claim the pending upload."
+  },
+  {
+    "version": "0.361.0",
+    "type": "fix",
+    "title": "Personal file/image fields are no longer encrypted",
+    "detail": "collectPiiSubjectFields still lists file, image, files and images fields with a personal annotation (forget and retention use it), but the new collectPiiEncryptedFields leaves them out and every encrypt, decrypt, backfill and store-gate path now uses it. The column holds only the fileRef uuid; the binary is erased by the file-ref user-data hook."
+  },
+  {
+    "version": "0.361.0",
+    "type": "fix",
+    "title": "Personal fields are re-keyed to the new owner on owner change",
+    "detail": "On absent to X and X to Y, the executor writes the personal fields (personal: { of: ownerField }) of the row under the new owner's key into the update event, so the projection, a rebuild and every event from the transition on agree and only the current owner's forget decides erasure. As a result <entity>.updated changes can contain personal fields the caller did not send. X to absent keeps the values under X so the last owner's forget still erases them. The created event from before an owner existed stays tenant-keyed in the immutable log. The new backfill option rekeyTenantKeyedOwnerFields moves such tenant-keyed values under the owner the projection or payload names (never via whenAbsent, a projection row of another tenant is ignored, other tenants' keys are not touched, a forgotten owner yields the erased sentinel). The boot PII backfill passes it, and its fingerprint now includes a transform version, so each deployment runs one full pass and afterwards only catch-up passes near the cursor. A created event whose owner transition happens after that full pass is not rescanned and stays tenant-keyed until someone runs backfillEventPiiEncryption(db, registry, { resolveOwnerFromProjection: true, rekeyTenantKeyedOwnerFields: true }) followed by a projection rebuild, or the transform version is bumped.",
+    "migration": "No consumer code change. The boot backfill runs in the background (startPiiEventBackfillOnBoot, it does not block readiness, KUMIKO_SKIP_PII_BACKFILL=1 turns it off). On the first boot after the bump it does one full scan of kumiko_events and rebuilds the affected projections. Consumers reading updated.changes must not treat a personal field there as a user edit when the owner field changed in the same event."
+  },
+  {
+    "version": "0.361.0",
+    "type": "breaking",
+    "title": "Plural file fields have a projection column",
+    "detail": "files and images fields get a jsonb NOT NULL DEFAULT '[]' column on the entity table (entity-table-meta, buildEntityTable row type readonly string[]) and applyEntityEvent no longer strips them from updated events. Detail and list queries return the ordered id arrays; before, they never carried the field, so an edit form of a saved record showed no files. kumiko schema generate emits an in-place ADD COLUMN for existing tables and no .rebuild.json, so existing rows hold [] until their projection is rebuilt from the events.",
+    "migration": "Run kumiko schema generate and apply the migration. Existing rows keep [] until the entity projection is rebuilt, so add a rebuild marker before applying: create <NNNN_migration-name>.rebuild.json next to the generated SQL with {\"version\":1,\"tables\":[\"<table name from the ALTER TABLE statement>\"]}; kumiko schema apply then rebuilds the projection. Without the marker, call enqueueProjectionRebuild(\"<feature>:projection:<entity>-entity\", { db, registry, jobRunner }) from @cosmicdrift/kumiko-framework/migrations once per entity. Known consumers: solon protocol (attachmentFileIds) and the Wartungs-Demo (photos). Code that read the ids of a plural file field from the event log or from file_refs can read the row field instead."
+  },
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "Files removed from a record are deleted",
+    "detail": "disposeRemovedFileRefs runs next to bindPendingFileRefs for every save that is not a create. For each file field named in changes it soft-deletes the fileRefs present in previous but not in the saved row, when entityType, entityId and fieldName match this record. The binary is removed by the soft-delete cleanup job after retention, or by forget."
+  },
+  {
+    "version": "0.361.0",
+    "type": "breaking",
+    "title": "Schema generate rejects a table listed twice in ENTITY_METAS",
+    "detail": "When ENTITY_METAS contained the same tableName twice, the migration diff kept only the last definition and compared it against the previous snapshot entry, so a new index was written to .snapshot.json but no CREATE INDEX reached the migration SQL. kumiko-schema generate, kumiko-schema validate and programmatic generateMigration now throw (generate and validate exit 1 with a message naming every duplicated table) before any file is written.",
+    "migration": "Remove hand-added metas for tables a feature already registers from kumiko/schema.ts. Known: phronexsis kumiko/schema.ts appends IN_APP_MESSAGES_META next to collectTableMetas(FEATURES); drop it (and its comment), then run kumiko-schema generate — the existing in_app_messages_tenant_user_created_idx comes out as CREATE INDEX IF NOT EXISTS (no-op) and the two legacy indexes as commented review drops. The duplicate in_app_messages entry in .snapshot.json disappears with that generate."
+  },
+  {
+    "version": "0.361.0",
+    "type": "fix",
+    "title": "Soft-delete cleanup removes the bytes of expired fileRefs",
+    "detail": "softDeleteCleanupJob handles the fileRef entity through purgeExpiredFileRefsWithBytes, which deletes the original and its derivatives via the file provider and then only the rows whose bytes are gone. Failures are logged and retried on the next run."
+  },
+  {
+    "version": "0.361.0",
+    "type": "improvement",
+    "title": "setupTestStack option lifecycleSystemHooks",
+    "detail": "Passes the given SystemHooks to buildServer, so tests can exercise pipeline lifecycle hooks like createCascadeDeleteHook through the real HTTP stack."
+  },
+  {
+    "version": "0.361.0",
+    "type": "breaking",
+    "title": "Writes with file ids from another tenant are rejected",
+    "detail": "A create or update that puts a file id into a file or image field now fails with a ValidationError (code invalid_element, path = field name) when the id is not a UUID, does not exist, or belongs to another tenant. That includes files stored under the SYSTEM tenant. On update only the changed fields are checked. The check runs for every write that returns a save result, inside the transaction, before pending file refs are bound. System users created for a tenant pass with that tenant's own files.",
+    "migration": "Check seeds, imports and handlers that copy file ids across tenants or reference files uploaded as SYSTEM. Upload the file in the target tenant (or copy it there) before writing its id. A custom handler that writes through an executor directly, without returning a save result, is not covered and needs its own check."
+  },
+  {
+    "version": "0.360.0",
+    "type": "breaking",
+    "title": "Secure host-only session cookies use the __Host- prefix",
+    "detail": "Auth, csrf and tenant cookies are named __Host-kumiko_auth, __Host-kumiko_csrf and __Host-kumiko_tenant when they are written Secure and without a Domain (the tenant cookie is always host-only). With auth.cookieDomain or without Secure the auth and csrf names stay kumiko_auth and kumiko_csrf. New auth option secureCookies forces Secure (default NODE_ENV === \"production\"). Login deletes the legacy unprefixed host-only cookies, logout and deleteTenantCookie delete the prefixed and the legacy names. The server reads only the resolved names, so a request that carries only the legacy kumiko_auth is anonymous. AUTH_COOKIE_NAME, CSRF_COOKIE_NAME and TENANT_COOKIE_NAME are removed from the framework and dispatcher-live; the base names and sessionCookieName() are exported from @cosmicdrift/kumiko-types/session-cookies and @cosmicdrift/kumiko-framework/api, getSessionCookies(c) returns the resolved names of a request. The testing package's CSRF_COOKIE_NAME stays and resolves to the unprefixed name (e2e servers run without Secure).",
+    "migration": "Every user logs in once after the deploy, because the old kumiko_auth cookie is no longer read. Custom clients, proxies or scripts that read or forward the cookies by literal name break: read the names through sessionCookieName() / resolveSessionCookieNames() (types package) or getSessionCookies(c) on the server, and handle both the prefixed and the plain name in browser code (readCsrfToken() already does). Replace imports of AUTH_COOKIE_NAME, CSRF_COOKIE_NAME and TENANT_COOKIE_NAME with AUTH_COOKIE_BASE, CSRF_COOKIE_BASE and TENANT_COOKIE_BASE plus sessionCookieName(); e2e helpers that imported CSRF_COOKIE_NAME from @cosmicdrift/kumiko-dispatcher-live import it from @cosmicdrift/kumiko-testing/e2e instead (known: solon e2e/_helpers/api.ts and e2e/session-ended.spec.ts, kumiko-enterprise ai-agent-live-transcription.integration.test.ts uses AUTH_COOKIE_NAME). A reverse proxy that strips or rewrites cookie names must pass the __Host- names unchanged. Staging or preview deployments over plain http need no change (Secure is off there); set auth.secureCookies (also accepted by runProdApp) explicitly when TLS terminates before the app and NODE_ENV is not \"production\". A standalone createAuthRoutes mount outside buildServer must also mount sessionCookiesMiddleware with the same resolved names, otherwise the readers fall back to the domain-less default."
+  },
+  {
+    "version": "0.360.0",
+    "type": "improvement",
+    "title": "Duplicate session cookie names end the cookie session",
+    "detail": "When the Cookie header carries the resolved auth or csrf cookie name more than once, authMiddleware ignores the cookie transport and expires every variant (prefixed host-only, legacy host-only, the cookieDomain variant and retired domains). With anonymousAccess the request continues as anonymous, otherwise it gets 401 missing_token; a Bearer token on the same request still authenticates. A prefixed and a legacy name side by side are not a duplicate. The cookie clearing moved from the auth routes into clearSessionCookies in session-cookies.ts; ResolvedSessionCookies carries domain and retiredDomains."
+  },
+  {
+    "version": "0.360.0",
+    "type": "breaking",
+    "title": "Origin guard defaults on when the public app URL is known",
+    "detail": "New auth option publicOrigin. Without allowedOrigins, cookieDomain and unsafeSkipOriginCheck, buildServer mounts the Origin guard for cookie-authenticated state-changing /api requests and admits publicOrigin plus the request's own host (Host header). runProdApp sets publicOrigin from auth.publicOrigin, then auth.mail.baseUrl, then the APP_BASE_URL env (origin only, path dropped); with none of them in production it logs a warning that the Origin guard is off and boots anyway. allowedOrigins keeps its strict meaning, and the WebSocket check and the anonymous downgrade still use only allowedOrigins.",
+    "migration": "Cookie-authenticated POST, PUT, PATCH or DELETE requests from a page on another origin than the public app URL and than the API host itself now get 403 origin_not_allowed in runProdApp deployments that set auth.mail.baseUrl or APP_BASE_URL. A web client served from a different host than the API (for example a sibling subdomain) must list its origin in auth.allowedOrigins. Same-host setups, custom domains served by the same server and Bearer clients need no change."
+  },
+  {
+    "version": "0.360.0",
+    "type": "improvement",
+    "title": "createFileRefFromBytes creates FileRefs from handler- or job-produced bytes",
+    "detail": "createFileRefFromBytes({ db, files, registry, user }, { fileName, mimeType, data, attachTo? }) shares one pipeline with POST /api/files, so identifier checks, field-level maxSize/accept, content sniffing, MIME resolution, the tenant-prefixed storage key and the fileRef.created event are identical. The tenant always comes from ctx.user. A rejected file returns a 422 write failure with reason file_rejected and the upload error string in details.error. The FileRef's insertedById is the passed user, so the default access guard lets only that user and privileged roles read files attached to an entity."
+  },
+  {
+    "version": "0.360.0",
+    "type": "improvement",
+    "title": "Cron jobs with an IANA time zone, images fields with capture",
+    "detail": "A cron trigger accepts tz (IANA name; without it the server process zone applies) and is scheduled in that zone, DST included. r.job() throws at boot for an invalid zone. createImagesField accepts capture (\"environment\" | \"user\") like createImageField, and the edit view model carries it for images fields."
+  },
+  {
+    "version": "0.360.0",
+    "type": "breaking",
+    "title": "Uploads from an update form are attached to the record",
+    "detail": "computeEditViewModel accepts entityId (the record being edited, update mode only) and sets it on the hints of file, image, files and images fields; RenderEdit passes the id it was mounted with and the file input sends it as the entityId multipart part of POST /api/files. Create forms send no entityId; after a successful create the write pipeline binds the caller's own pending uploads named in the record's file fields (same entityType and fieldName, entityId null, insertedById = caller) to the new record via a fileRef.updated event in the same transaction, for single and plural file fields alike, when the files feature (fileRef entity) is mounted. Behaviour change: such files are now attached to the record. The default file access guard allows read on an attached file to the uploader, privilegedRoles (default Admin/SystemAdmin) and everyone whose run of the entity's <entity>:detail query returns the record; delete stays uploader and privilegedRoles only. A qr-overlay variant of an image field no longer throws for a file uploaded from an update or create form. Write-form sections send no entityId. EmbeddedListInput has a new required actionsLabel prop.",
+    "migration": "Files attached through forms now follow the record's read access instead of being tenant-wide: anyone who cannot read the record no longer reads the file, anyone who can read it does. Check image, images, file and files fields whose files must be visible beyond the record's readers (for example an avatar shown in lists to users without detail access) and add those roles to privilegedRoles or set accessGuard in the files feature options. An entity without a detail query falls back to uploader plus privilegedRoles. Files uploaded before the update keep their old attachment. Custom primitive sets that implement EmbeddedListInput accept the new actionsLabel prop and render it as the actions column header; custom file/image Input primitives forward entityId into the upload and offer a remove control that calls onChange(null)."
+  },
+  {
+    "version": "0.360.0",
+    "type": "improvement",
+    "title": "images and files fields get an edit widget; required is allowed",
+    "detail": "NO_WIDGET_FIELD_TYPES now holds only jsonb and embedded. required true on an images or files field passes boot validation and the client-side check treats an empty array as missing. The edit view model carries maxCount for files and images fields."
+  },
   {
     "version": "0.359.0",
     "type": "improvement",