@cosmicdrift/kumiko-framework 0.363.0 → 0.364.0

package/dist/engine/boot-validator/url-prefill-fields.js

@@ -1,6 +1,6 @@
 import { qualifyEntityName } from "../qualified-name.js";
 import { isFieldsEditSection, normalizeEditField, sectionFieldSpecs } from "../screen-helpers.js";
-import { collectScreensByShortId, readsNavigateParamsAsFormPrefill, rowFieldExtractorKeys, } from "./screens.js";
+import { collectScreensByShortId, readsNavigateParamsAsFormPrefill, rowFieldExtractorKeys, validateDrawerPrefillKeys, } from "./screens.js";
 function isNavigateKind(action) {
     return action.kind === undefined || action.kind === "navigate";
 }
@@ -59,13 +59,14 @@ function navigateActionsOf(screen) {
             return [];
     }
 }
-function toNavigateParamsSource(action, params, sourceScreenEntity) {
+function toNavigateParamsSource(action, params, sourceScreenEntity, sourceLabel) {
     return {
         ...(action.screen !== undefined && { screen: action.screen }),
         ...(action.entity !== undefined && { entity: action.entity }),
         ...(action.entityId !== undefined && { entityId: action.entityId }),
         params,
         sourceScreenEntity,
+        sourceLabel,
     };
 }
 // Every declarative navigate that writes params into the target's URL —
@@ -73,17 +74,19 @@ function toNavigateParamsSource(action, params, sourceScreenEntity) {
 // plus projectionDetail metrics (runMetricNavigate), which reuse that shape —
 // plus a relatedList toolbarAction with no `params` of its own, which still
 // writes its implicit parent-id param at runtime (see `implicitParams`).
-function navigateParamsSources(screen) {
+function navigateParamsSources(screen, sourceLabel) {
     return navigateActionsOf(screen).flatMap(({ action, sourceScreenEntity, implicitParams }) => {
         if (!isNavigateKind(action))
             return [];
         const params = action.params ?? implicitParams;
-        return params === undefined ? [] : [toNavigateParamsSource(action, params, sourceScreenEntity)];
+        return params === undefined
+            ? []
+            : [toNavigateParamsSource(action, params, sourceScreenEntity, sourceLabel)];
     });
 }
-// Per target screen QN, the union of field names any navigate `params` may
-// prefill from the URL. A form screen absent from the map accepts no URL prefill.
-export function collectUrlPrefillFieldsByScreenQn(features) {
+// Per target screen QN, every navigate `params` source that writes into the
+// target's URL prefill. A form screen absent from the map accepts no URL prefill.
+function collectUrlPrefillSourcesByScreenQn(features) {
     const screensByShortId = collectScreensByShortId(features);
     const detailForByEntity = new Map();
     for (const feature of features) {
@@ -95,8 +98,9 @@ export function collectUrlPrefillFieldsByScreenQn(features) {
     }
     const result = new Map();
     for (const feature of features) {
-        for (const screen of Object.values(feature.screens)) {
-            for (const source of navigateParamsSources(screen)) {
+        for (const [screenId, screen] of Object.entries(feature.screens)) {
+            const sourceLabel = `[Feature ${feature.name}] Screen "${screenId}" (${screen.type}) navigate action`;
+            for (const source of navigateParamsSources(screen, sourceLabel)) {
                 const target = resolveTarget(source, screensByShortId, detailForByEntity);
                 if (target === undefined)
                     continue;
@@ -105,15 +109,21 @@ export function collectUrlPrefillFieldsByScreenQn(features) {
                     continue;
                 }
                 const qn = qualifyEntityName(target.featureName, "screen", target.shortId);
-                const fields = result.get(qn) ?? new Set();
-                for (const key of rowFieldExtractorKeys(source.params))
-                    fields.add(key);
-                result.set(qn, fields);
+                result.set(qn, [...(result.get(qn) ?? []), source]);
             }
         }
     }
     return result;
 }
+// Per target screen QN, the union of field names any navigate `params` may
+// prefill from the URL.
+export function collectUrlPrefillFieldsByScreenQn(features) {
+    const result = new Map();
+    for (const [qn, sources] of collectUrlPrefillSourcesByScreenQn(features)) {
+        result.set(qn, new Set(sources.flatMap((source) => rowFieldExtractorKeys(source.params))));
+    }
+    return result;
+}
 // Runtime resolution: a bare screen id matches the first feature registering
 // it (create-app's router); an entity target opens its detailFor screen with an id.
 function resolveTarget(source, screensByShortId, detailForByEntity) {
@@ -124,37 +134,46 @@ function resolveTarget(source, screensByShortId, detailForByEntity) {
     const match = screensByShortId.get(source.screen)?.[0];
     return match === undefined ? undefined : { ...match, shortId: source.screen };
 }
+function assertHiddenRequiredFieldsSeeded(featureName, screenId, screen, seeded) {
+    for (const section of screen.layout.sections) {
+        if (!isFieldsEditSection(section))
+            continue;
+        for (const rawSpec of sectionFieldSpecs(section)) {
+            const spec = normalizeEditField(rawSpec);
+            if (spec.visible !== false)
+                continue;
+            const fieldDef = screen.fields[spec.field];
+            if (fieldDef === undefined || !("required" in fieldDef) || fieldDef.required !== true) {
+                continue;
+            }
+            if (seeded.has(spec.field))
+                continue;
+            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screen.type}) sets submitPrefilled but ` +
+                `hides required field "${spec.field}" (visible: false) and no navigate action passes it in ` +
+                `params — the field could never get a value and the form could never submit. Add ` +
+                `"${spec.field}" to the params of a navigate action targeting this screen, make the field ` +
+                `visible, or drop required.`);
+        }
+    }
+}
 // submitPrefilled lets an unchanged form submit, so a required field the layout
-// hides must be seeded by a navigate param — nothing else can ever fill it.
+// hides must be seeded by a navigate param — nothing else can ever fill it. The
+// param keys of every source (incl. metric/subtitle navigates and the implicit
+// relatedList parent id) must also be fields the renderer would actually prefill.
 export function validateSubmitPrefilledHiddenFields(features) {
-    const prefillByScreenQn = collectUrlPrefillFieldsByScreenQn(features);
+    const sourcesByScreenQn = collectUrlPrefillSourcesByScreenQn(features);
     for (const feature of features) {
         for (const [screenId, screen] of Object.entries(feature.screens)) {
             if (screen.type !== "actionForm" && screen.type !== "secretMint")
                 continue;
             if (screen.submitPrefilled !== true)
                 continue;
-            const seeded = prefillByScreenQn.get(qualifyEntityName(feature.name, "screen", screenId));
-            for (const section of screen.layout.sections) {
-                if (!isFieldsEditSection(section))
-                    continue;
-                for (const rawSpec of sectionFieldSpecs(section)) {
-                    const spec = normalizeEditField(rawSpec);
-                    if (spec.visible !== false)
-                        continue;
-                    const fieldDef = screen.fields[spec.field];
-                    if (fieldDef === undefined || !("required" in fieldDef) || fieldDef.required !== true) {
-                        continue;
-                    }
-                    if (seeded?.has(spec.field) === true)
-                        continue;
-                    throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (${screen.type}) sets submitPrefilled but ` +
-                        `hides required field "${spec.field}" (visible: false) and no navigate action passes it in ` +
-                        `params — the field could never get a value and the form could never submit. Add ` +
-                        `"${spec.field}" to the params of a navigate action targeting this screen, make the field ` +
-                        `visible, or drop required.`);
-                }
+            const sources = sourcesByScreenQn.get(qualifyEntityName(feature.name, "screen", screenId));
+            for (const source of sources ?? []) {
+                validateDrawerPrefillKeys(source.sourceLabel, "navigate-target", screenId, screen, source.params);
             }
+            const seeded = new Set((sources ?? []).flatMap((source) => rowFieldExtractorKeys(source.params)));
+            assertHiddenRequiredFieldsSeeded(feature.name, screenId, screen, seeded);
         }
     }
 }

package/dist/engine/define-handler.d.ts

@@ -4,9 +4,9 @@ import type { ContainsSecret } from "../secrets/types.js";
 import type { QueryHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput } from "./types/define-handler.js";
 import type { KumikoEventTypeMap } from "./types/index.js";
 export type { QueryHandlerDefinition, StreamHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput, } from "./types/define-handler.js";
-export declare function defineWriteHandler<const TName extends string, TSchema extends ZodType, TData = unknown, TMap extends object = KumikoEventTypeMap>(def: WriteHandlerInput<TName, TSchema, TData, TMap>, ..._noSecretInResponse: true extends ContainsSecret<TData> ? [
+export declare function defineWriteHandler<const TName extends string, TSchema extends ZodType, TData = unknown, TMap extends object = KumikoEventTypeMap, TPrepared = undefined>(def: WriteHandlerInput<TName, TSchema, TData, TMap, TPrepared>, ..._noSecretInResponse: true extends ContainsSecret<TData> ? [
     secretLeak: "A handler response must not contain a Secret<> — call .reveal() and return the plaintext, or drop the field."
-] : []): WriteHandlerDefinition<TName, TSchema, TData, TMap>;
+] : []): WriteHandlerDefinition<TName, TSchema, TData, TMap, TPrepared>;
 export declare function defineQueryHandler<const TName extends string, TSchema extends ZodType, TResult = unknown, TMap extends object = KumikoEventTypeMap>(def: QueryHandlerDefinition<TName, TSchema, TResult, TMap>, ..._noSecretInResponse: true extends ContainsSecret<TResult> ? [
     secretLeak: "A handler response must not contain a Secret<> — call .reveal() and return the plaintext, or drop the field."
 ] : []): QueryHandlerDefinition<TName, TSchema, TResult, TMap>;

package/dist/engine/define-handler.js

@@ -1,6 +1,12 @@
 import { ENTITY_CONVENTION_QUERY_BRAND } from "@cosmicdrift/kumiko-types/handlers";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { runPipeline } from "./run-pipeline.js";
+function pickPreTransactionPhases(def) {
+    return {
+        ...(def.reserveBeforeTransaction && { reserveBeforeTransaction: def.reserveBeforeTransaction }),
+        ...(def.beforeTransaction && { beforeTransaction: def.beforeTransaction }),
+    };
+}
 export function defineWriteHandler(def, 
 // R6: a phantom rest-param. When the inferred response `TData` carries a
 // Secret<> anywhere, ContainsSecret<TData> is `true` and this resolves to a
@@ -51,8 +57,9 @@ export function defineWriteHandler(def,
         ...(def.rateLimit && { rateLimit: def.rateLimit }),
         ...(def.additionalRateLimits && { additionalRateLimits: def.additionalRateLimits }),
         ...(def.escapeHatch && { escapeHatch: def.escapeHatch }),
-        ...(def.reserveBeforeTransaction && { reserveBeforeTransaction: def.reserveBeforeTransaction }),
+        ...pickPreTransactionPhases(def),
         ...(def.tenantlessAnonymous && { tenantlessAnonymous: true }),
+        ...(def.transaction && { transaction: def.transaction }),
     };
     if ("perform" in def && def.perform !== undefined) {
         const performDef = def.perform;

package/dist/engine/feature-ast/extractors/handlers.js

@@ -36,6 +36,8 @@ const WRITE_HANDLER_KEY_KINDS = {
     escapeHatch: "modeled",
     tenantlessAnonymous: "opaque",
     reserveBeforeTransaction: "opaque",
+    beforeTransaction: "opaque",
+    transaction: "opaque",
     perform: "opaque",
 };
 const QUERY_HANDLER_KEY_KINDS = {

package/dist/engine/feature-ast/pattern-change-schema.d.ts

@@ -202,6 +202,7 @@ export declare const PATTERN_SCHEMAS_BY_KIND: {
             limit: z.ZodNumber;
             windowSeconds: z.ZodNumber;
             cost: z.ZodOptional<z.ZodNumber>;
+            normalize: z.ZodOptional<z.ZodLiteral<"email">>;
         }, z.core.$strict>>, z.ZodObject<{
             __raw: z.ZodString;
         }, z.core.$strict>]>>;
@@ -724,6 +725,7 @@ export declare const patternSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         limit: z.ZodNumber;
         windowSeconds: z.ZodNumber;
         cost: z.ZodOptional<z.ZodNumber>;
+        normalize: z.ZodOptional<z.ZodLiteral<"email">>;
     }, z.core.$strict>>, z.ZodObject<{
         __raw: z.ZodString;
     }, z.core.$strict>]>>;

package/dist/engine/feature-ast/pattern-change-schema.js

@@ -163,6 +163,7 @@ const additionalRateLimitsSchema = z.array(z
     limit: z.number(),
     windowSeconds: z.number(),
     cost: z.number().optional(),
+    normalize: z.literal("email").optional(),
 })
     .strict());
 const agentHandlerHintsSchema = z

package/dist/engine/feature-ast/render.js

@@ -240,18 +240,26 @@ function renderMetric(p) {
     const merged = { name: p.shortName, ...p.options };
     return `r.metric(${renderValue(merged)});`;
 }
+// r.secret / r.secretNamespace throw on an empty writeRoles list; the designer's
+// string-list input emits [] when cleared, which means "rely on handler access alone".
+function dropEmptyWriteRoles(options) {
+    if (options.writeRoles?.length !== 0)
+        return options;
+    const { writeRoles: _emptyWriteRoles, ...rest } = options;
+    return rest;
+}
 function renderSecret(p) {
     if (isRawRefSentinel(p.options)) {
         return `r.secret(${JSON.stringify(p.shortName)}, ${p.options.__raw});`;
     }
-    const merged = { name: p.shortName, ...p.options };
+    const merged = { name: p.shortName, ...dropEmptyWriteRoles(p.options) };
     return `r.secret(${renderValue(merged)});`;
 }
 function renderSecretNamespace(p) {
     if (isRawRefSentinel(p.options)) {
         return `r.secretNamespace(${JSON.stringify(p.shortName)}, ${p.options.__raw});`;
     }
-    const merged = { name: p.shortName, ...p.options };
+    const merged = { name: p.shortName, ...dropEmptyWriteRoles(p.options) };
     return `r.secretNamespace(${renderValue(merged)});`;
 }
 function renderClaimKey(p) {

package/dist/engine/feature-entity-handlers.d.ts

@@ -3,7 +3,7 @@ import type { ZodType } from "zod";
 import { type QueryHandlerDefinition, type StreamHandlerDefinition, type WriteHandlerDefinition } from "./define-handler.js";
 import type { RegisterEntityCrudOptions } from "./entity-handlers.js";
 import type { FeatureBuilderState } from "./feature-builder-state.js";
-import type { AccessRule, AgentHandlerHints, EntityDefinition, EntityRef, EscapeHatchDeclaration, HandlerRef, NameOrRef, PayloadRateLimitOption, QueryHandlerFn, RateLimitDeclaration, RelationDefinition, StreamHandlerFn, WriteHandlerFn } from "./types/index.js";
+import type { AccessRule, AgentHandlerHints, EntityDefinition, EntityRef, EscapeHatchDeclaration, HandlerRef, KumikoEventTypeMap, NameOrRef, PayloadRateLimitOption, QueryHandlerFn, RateLimitDeclaration, RelationDefinition, StreamHandlerFn, WriteHandlerFn } from "./types/index.js";
 export declare function buildEntityHandlerMethods<TName extends string>(state: FeatureBuilderState, name: TName): {
     entity(nameOrDefinition: string | ({
         readonly name: string;
@@ -14,7 +14,7 @@ export declare function buildEntityHandlerMethods<TName extends string>(state: F
         readonly entity: NameOrRef;
         readonly name: string;
     } & RelationDefinition), relationName?: string, definition?: RelationDefinition): void;
-    writeHandler<TName_1 extends string, TSchema extends ZodType>(nameOrDef: string | WriteHandlerDefinition<TName_1, TSchema>, schema?: TSchema, handler?: WriteHandlerFn<z.infer<TSchema>>, options?: {
+    writeHandler<TName_1 extends string, TSchema extends ZodType, TPrepared = undefined>(nameOrDef: string | WriteHandlerDefinition<TName_1, TSchema, unknown, KumikoEventTypeMap, TPrepared>, schema?: TSchema, handler?: WriteHandlerFn<z.infer<TSchema>>, options?: {
         access: AccessRule;
         rateLimit?: RateLimitDeclaration;
         additionalRateLimits?: readonly PayloadRateLimitOption[];

package/dist/engine/feature-entity-handlers.js

@@ -54,6 +54,17 @@ function agentSlots(source) {
         ...(source.agent && { agent: source.agent }),
     };
 }
+function transactionPhaseSlots(def) {
+    return {
+        ...(def.reserveBeforeTransaction && {
+            reserveBeforeTransaction: def.reserveBeforeTransaction,
+        }),
+        ...(def.beforeTransaction && {
+            beforeTransaction: def.beforeTransaction, // @cast-boundary engine-bridge
+        }),
+        ...(def.transaction && { transaction: def.transaction }),
+    };
+}
 function requireInlineHandlerArgs(kind, schema, handler, options) {
     if (!schema || !handler || !options?.access) {
         throw new Error(`${kind} inline form requires schema + handler + options.access`);
@@ -108,9 +119,7 @@ export function buildEntityHandlerMethods(state, name) {
                     ...(def.rateLimit && { rateLimit: def.rateLimit }),
                     ...(def.additionalRateLimits && { additionalRateLimits: def.additionalRateLimits }),
                     ...(def.escapeHatch && { escapeHatch: def.escapeHatch }),
-                    ...(def.reserveBeforeTransaction && {
-                        reserveBeforeTransaction: def.reserveBeforeTransaction,
-                    }),
+                    ...transactionPhaseSlots(def),
                     ...(def.tenantlessAnonymous && { tenantlessAnonymous: true }),
                     // Forward the pipeline-build closure so boot-validators and
                     // Designer/AI tooling can inspect the step list. Absent on

package/dist/engine/handler-field-references.d.ts

@@ -1,3 +1,22 @@
-import { type ZodType } from "zod";
+import * as z from "zod";
 export declare const HANDLER_FIELD_REFERENCES_META_KEY = "references";
-export declare function handlerFieldReference(schema: ZodType, field: string): string | undefined;
+export type HandlerFieldReferenceMeta = string | {
+    readonly entity: string;
+    readonly by?: string;
+};
+export type HandlerFieldReference = {
+    readonly entity: string;
+    readonly by: string | undefined;
+    readonly multiple: boolean;
+};
+export type HandlerFieldReferenceReading = {
+    readonly kind: "none";
+} | {
+    readonly kind: "invalid";
+    readonly raw: unknown;
+} | {
+    readonly kind: "ok";
+    readonly reference: HandlerFieldReference;
+};
+export declare function readHandlerFieldReference(schema: z.ZodType, field: string): HandlerFieldReferenceReading;
+export declare function handlerFieldReference(schema: z.ZodType, field: string): HandlerFieldReference | undefined;

package/dist/engine/handler-field-references.js

@@ -1,31 +1,69 @@
-import { ZodObject } from "zod";
+import * as z from "zod";
 import { zodDef, zodMeta, zodShapeField } from "../env/_zod-introspect.js";
 export const HANDLER_FIELD_REFERENCES_META_KEY = "references";
 const MAX_WRAPPER_DEPTH = 8;
-function referencesFromMeta(field) {
+const referenceMetaSchema = z.union([
+    z.string().min(1),
+    z.object({ entity: z.string().min(1), by: z.string().min(1).optional() }),
+]);
+function rawReferenceMeta(field) {
     const meta = zodMeta(field);
     if (typeof meta !== "object" || meta === null)
         return undefined;
-    const value = Reflect.get(meta, HANDLER_FIELD_REFERENCES_META_KEY);
-    return typeof value === "string" ? value : undefined;
+    return Reflect.get(meta, HANDLER_FIELD_REFERENCES_META_KEY);
 }
-// `.optional()` / `.nullable()` / `.default()` after `.meta()` hide the meta
-// from the outer type, so every wrapper layer is probed on the way in.
-export function handlerFieldReference(schema, field) {
+function unwrapObjectSchema(schema) {
     let current = schema;
     for (let depth = 0; depth < MAX_WRAPPER_DEPTH && current !== undefined; depth++) {
-        if (current instanceof ZodObject)
-            break;
+        if (current instanceof z.ZodObject)
+            return current;
         current = zodDef(current)?.innerType;
     }
-    if (!(current instanceof ZodObject))
-        return undefined;
-    let fieldSchema = zodShapeField(current, field);
-    for (let depth = 0; depth < MAX_WRAPPER_DEPTH && fieldSchema !== undefined; depth++) {
-        const reference = referencesFromMeta(fieldSchema);
-        if (reference !== undefined)
-            return reference;
-        fieldSchema = zodDef(fieldSchema)?.innerType;
+    return undefined;
+}
+// `.optional()` / `.nullable()` / `.default()` after `.meta()` hide the meta from the outer
+// type, so every wrapper layer is probed on the way in; array elements are probed too.
+function findRawReferenceMeta(field) {
+    let current = field;
+    for (let depth = 0; depth < MAX_WRAPPER_DEPTH && current !== undefined; depth++) {
+        const raw = rawReferenceMeta(current);
+        if (raw !== undefined)
+            return raw;
+        current = current instanceof z.ZodArray ? zodDef(current)?.element : zodDef(current)?.innerType;
     }
     return undefined;
 }
+function isArrayField(field) {
+    let current = field;
+    for (let depth = 0; depth < MAX_WRAPPER_DEPTH && current !== undefined; depth++) {
+        if (current instanceof z.ZodArray)
+            return true;
+        current = zodDef(current)?.innerType;
+    }
+    return false;
+}
+export function readHandlerFieldReference(schema, field) {
+    const objectSchema = unwrapObjectSchema(schema);
+    const fieldSchema = objectSchema && zodShapeField(objectSchema, field);
+    if (fieldSchema === undefined)
+        return { kind: "none" };
+    const raw = findRawReferenceMeta(fieldSchema);
+    if (raw === undefined)
+        return { kind: "none" };
+    const parsed = referenceMetaSchema.safeParse(raw);
+    if (!parsed.success)
+        return { kind: "invalid", raw };
+    const meta = parsed.data;
+    return {
+        kind: "ok",
+        reference: {
+            entity: typeof meta === "string" ? meta : meta.entity,
+            by: typeof meta === "string" ? undefined : meta.by,
+            multiple: isArrayField(fieldSchema),
+        },
+    };
+}
+export function handlerFieldReference(schema, field) {
+    const reading = readHandlerFieldReference(schema, field);
+    return reading.kind === "ok" ? reading.reference : undefined;
+}

package/dist/engine/index.d.ts

@@ -43,7 +43,7 @@ export { addPattern, applyChanges, createFeaturePatcher, getPatternSchema, group
 export { type ChangelogEntry, type ChangelogType, compareVersions, type FeatureChangelog, filterEntriesAfter, parseFeatureChangelog, sortEntries, validateChangelog, } from "./feature-changelog.js";
 export { type BuildManifestOptions, buildManifestFromRegistry, type FeatureManifest, type ManifestConfigKey, type ManifestExtension, type ManifestFeature, type ManifestSecret, type ManifestSystemEvent, serializeManifest, } from "./feature-manifest.js";
 export { checkWriteFieldOwnership, checkWriteFieldRoles, filterReadFields, maskWriteOnlyFields, } from "./field-access.js";
-export { HANDLER_FIELD_REFERENCES_META_KEY, handlerFieldReference, } from "./handler-field-references.js";
+export { HANDLER_FIELD_REFERENCES_META_KEY, type HandlerFieldReference, type HandlerFieldReferenceMeta, handlerFieldReference, } from "./handler-field-references.js";
 export { resolveName, withResponseData } from "./handler-helpers.js";
 export { i18nKey } from "./i18n-key.js";
 export { buildSessionRoles, findForbiddenMembershipRole, isForbiddenMembershipRole, stripForbiddenMembershipRoles, } from "./membership-roles.js";
@@ -81,7 +81,7 @@ export { assertNotificationVariables, templateVariable, templateVariablesToZod,
 export { type EffectiveFeaturesResolver, findTierResolverUsage, isTierResolverPlugin, TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin, type TrialGate, } from "./tier-resolver-extension.js";
 export { findOverDeepTransferChain, resolveTransferAdjacency as resolveEntityTransferAdjacency, type TransferAdjacency, type TransferEdge, type TransferEdgeLink, } from "./transfer-adjacency.js";
 export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID } from "./types/identifiers.js";
-export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.js";
+export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.js";
 export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HookPhases, HTTP_ERROR_CODE_PATTERN, isAgentVisibleScreen, isDeliveryErrorCode, isOpenToAllGranted, resolveAgentExposure, } from "./types/index.js";
 export type { AwaitedEventType, PipelineBuildCtx, PipelineCtx, PipelineDef, StepBuilder, StepDef, StepFailureStrategy, StepInstance, StepKind, StepNamespace, StepResolver, } from "./types/step.js";
 export { runValidation } from "./validation.js";

package/dist/engine/schema-builder.js

@@ -288,7 +288,8 @@ export function fieldToZod(field, currencies, opts = {}) {
             // Multi file: array of fileRef UUIDs. Same story as the singular
             // variant — the element type has to match the UUID column on
             // fileRefsTable.id.
-            return z.array(z.uuid());
+            const ids = z.array(z.uuid());
+            return field.maxCount === undefined ? ids : ids.max(field.maxCount);
         }
         case "reference":
             // Tier 2.7e-3: Validiert UUID-shape. Existenz-Check der Reference

package/dist/engine/soft-delete-cleanup.js

@@ -80,13 +80,20 @@ export const softDeleteCleanupJob = async (_payload, ctx) => {
         if (isSystemScopedSoftDeleteTable(proj.table, entity))
             continue;
         const where = { isDeleted: true, deletedAt: { lt: cutoff }, tenantId };
-        await purgeExpiredRows(db, proj.source, proj.table, where, ctx);
+        await purgeExpiredRows(db, proj.source, proj.table, where, cutoff, ctx);
     }
 };
-async function purgeExpiredRows(db, source, table, where, ctx) {
+async function purgeExpiredRows(db, source, table, where, cutoff, ctx) {
     if (source === FILE_REF_ENTITY_NAME) {
         // The row is the only record of the storageKey, so its bytes go first.
-        await purgeExpiredFileRefsWithBytes({ db, table, where, files: ctx.files, log: ctx.log });
+        await purgeExpiredFileRefsWithBytes({
+            db,
+            table,
+            where,
+            expiredBefore: cutoff,
+            files: ctx.files,
+            log: ctx.log,
+        });
     }
     else {
         await deleteMany(db, table, where);

package/dist/engine/steps/retry.js

@@ -11,6 +11,7 @@ import { defineStep } from "../define-step.js";
 import { runStepList } from "../run-pipeline.js";
 import { SUSPEND_SENTINEL, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, } from "./_step-dispatch-constants.js";
 import { describeWorkflowStepError } from "./describe-workflow-step-error.js";
+import { unwrapWorkflowStepError } from "./workflow-step-error.js";
 const log = createFallbackLogger("workflow-retry");
 defineStep({
     kind: "workflow.retry",
@@ -38,7 +39,7 @@ defineStep({
                 workflowName: ctx.workflow.workflowName,
                 stepIndex: ctx.workflow.stepIndex,
                 attempt,
-                error: String(error),
+                error: String(unwrapWorkflowStepError(error)),
             });
             const backoffMs = calculateBackoff(attempt, args.backoff);
             const wakeAt = Temporal.Now.instant().add({ milliseconds: backoffMs }).toString();

package/dist/engine/steps/unsafe-projection-delete.js

@@ -16,7 +16,7 @@
 // must commit in the same TX as the aggregate-mutation that triggered
 // it (stronger consistency than an async projection). Reviewer judges.
 import { deleteMany } from "../../db/query.js";
-import { tenantDbRunner } from "../../db/tenant-db-runner.js";
+import { tenantDbWriteRunner } from "../../db/tenant-db-runner.js";
 import { defineStep } from "../define-step.js";
 import { resolveRequired } from "./_resolver-utils.js";
 defineStep({
@@ -27,7 +27,7 @@ defineStep({
         // The `unsafe*`-step IS the sanctioned direct projection write — it exists
         // to bypass the executor deliberately (boot-validated allowlist + reviewer
         // gate). The brand-strip cast makes that explicit at the one blessed seam.
-        await deleteMany(tenantDbRunner(ctx.db), args.table, where);
+        await deleteMany(tenantDbWriteRunner(ctx.db, "unsafe projection delete"), args.table, where);
     },
 });
 export function buildUnsafeProjectionDeleteStep(args) {

package/dist/engine/steps/unsafe-projection-upsert.js

@@ -13,7 +13,7 @@
 import { extractTableName } from "../../db/index.js";
 import { executeRawQuery } from "../../db/queries/raw-sql.js";
 import { columnSqlNameOf } from "../../db/table-introspection.js";
-import { tenantDbRunner } from "../../db/tenant-db-runner.js";
+import { tenantDbWriteRunner } from "../../db/tenant-db-runner.js";
 import { defineStep } from "../define-step.js";
 import { resolveRequired } from "./_resolver-utils.js";
 function resolveColumnName(table, field) {
@@ -54,7 +54,7 @@ defineStep({
         }
         const sqlText = `INSERT INTO ${quoteIdent(tableName)} (${colNames.join(", ")}) VALUES (${placeholders.join(", ")}) ` +
             `ON CONFLICT (${conflictCols}) DO UPDATE SET ${setClauses.join(", ")}`;
-        await executeRawQuery(tenantDbRunner(ctx.db), sqlText, params);
+        await executeRawQuery(tenantDbWriteRunner(ctx.db, "unsafe projection upsert"), sqlText, params);
     },
 });
 export function buildUnsafeProjectionUpsertStep(args) {

package/dist/engine/template-variables.d.ts

@@ -11,6 +11,9 @@ export declare const templateVariable: {
     readonly link: (opts?: CommonOptions & {
         readonly example?: string;
     }) => TemplateScalarVariableDef;
+    readonly richText: (opts?: CommonOptions & {
+        readonly example?: string;
+    }) => TemplateScalarVariableDef;
     readonly money: (opts?: CommonOptions & {
         readonly example?: number | {
             readonly amount: number;

package/dist/engine/template-variables.js

@@ -10,6 +10,7 @@ export const templateVariable = {
         type: "link",
         ...opts,
     }),
+    richText: (opts = {}) => ({ type: "richText", ...opts }),
     money: (opts = {}) => ({ type: "money", ...opts }),
     date: (opts = {}) => ({
         type: "date",
@@ -39,6 +40,8 @@ function scalarToZod(def) {
     switch (def.type) {
         case "text":
             return z.string();
+        case "richText":
+            return z.string();
         case "link":
             return linkSchema;
         case "money":

package/dist/engine/types/index.d.ts

@@ -7,7 +7,7 @@ export type { ExtensionOptionsArgs, ExtensionOptionsFor, KumikoExtensionOptionsM
 export type { BootCheckContext, BootCheckFn, FeatureDefinition, FeatureMetricDef, FeatureMetricType, FeatureRegistrar, MetricOptions, Registry, SecretKeyDefinition, SecretKeyHandle, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, StoreTableDef, StoreTableEntry, StoreTableOptions, UiHintOption, UiHints, } from "@cosmicdrift/kumiko-types/feature";
 export type { FieldIconKey } from "@cosmicdrift/kumiko-types/field-icon";
 export type { AnyFileFieldDef, BigIntFieldDef, BooleanFieldDef, ClientDerivedFieldDef, DateFieldDef, DecimalFieldDef, DefaultCurrency, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EmbeddedDerivedCellDef, EmbeddedFieldDef, EmbeddedSubFieldDef, EntityDefinition, EntityEventMigration, EntityIndexDef, FieldAccess, FieldDefinition, FieldsMap, FileFieldDef, FilesFieldDef, Findability, ImageFieldDef, ImagesFieldDef, JsonbFieldDef, LocatedTimestampFieldDef, LongTextFieldDef, LongTextFindability, MoneyCurrencySource, MoneyFieldDef, MultiSelectFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, ReferenceFieldDef, ResolvedPiiFlags, RetentionDef, SelectFieldDef, SelectOptionTone, TextFieldDef, TimestampFieldDef, TransitionMap, TzFieldDef, } from "@cosmicdrift/kumiko-types/fields";
-export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadRateLimitOption, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
+export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadBucketNormalization, PayloadRateLimitOption, PreparedWriteEvent, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
 export { DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HTTP_ERROR_CODE_PATTERN, isDeliveryErrorCode, isOpenToAllGranted, isRateLimitDisabled, isUiAccessGranted, } from "@cosmicdrift/kumiko-types/handlers";
 export type { DeleteContext, EntityHookMap, HookMap, HookOwner, HookPhase, LifecycleHookFn, LifecycleResult, OwnedFn, PhasedHook, PostDeleteBatchHookFn, PostDeleteHookFn, PostQueryHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, SaveContext, SearchPayloadContributorFn, ValidationError, ValidationHookFn, } from "@cosmicdrift/kumiko-types/hooks";
 export type { HttpRouteDefinition, HttpRouteHandler, HttpRouteHandlerDeps, HttpRouteMethod, } from "@cosmicdrift/kumiko-types/http-route";

package/dist/env/_zod-introspect.d.ts

@@ -2,6 +2,7 @@ import type * as z from "zod";
 export type ZodDef = {
     readonly innerType?: z.ZodType;
     readonly in?: z.ZodType;
+    readonly element?: z.ZodType;
     readonly defaultValue?: unknown;
 };
 /** Read Zod v4 `.meta()` value. Undefined when no meta is set. */

package/dist/errors/classes.js

@@ -223,6 +223,7 @@ export class RateLimitError extends KumikoError {
             message: `rate limited: ${details.bucket} (limit ${details.limit} per ${details.windowSeconds}s)`,
             i18nKey: opts?.i18nKey ?? "errors.rate_limited",
             details,
+            retryAfterSeconds: details.retryAfterSeconds,
             ...(opts?.cause && { cause: opts.cause }),
         });
         this.details = details;