@cosmicdrift/kumiko-framework 0.368.0 → 0.370.0

package/dist/random/index.d.ts

@@ -1,2 +1,2 @@
-export { type AdjNounNameOptions, type GenerateUniqueNameOptions, generateAdjNounName, generateNoConfusableId, generateUniqueName, } from "./generate.js";
-export { ADJECTIVES, NOUNS } from "./words.js";
+export { type AdjNounNameOptions, type GenerateUniqueNameOptions, generateAdjNounName, generateNoConfusableId, generateUniqueName, } from "./generate.ts";
+export { ADJECTIVES, NOUNS } from "./words.ts";

package/dist/rate-limit/bucket.d.ts

@@ -1,4 +1,4 @@
-import type { PayloadBucketNormalization, RateLimitOption, SessionUser } from "../engine/types/index.js";
+import type { PayloadBucketNormalization, RateLimitOption, SessionUser } from "../engine/types/index.ts";
 export type BucketContext = {
     readonly handlerName: string;
     readonly user: SessionUser;

package/dist/rate-limit/index.d.ts

@@ -1,3 +1,3 @@
-export { type BucketContext, type BucketResult, buildBucketKey, buildPayloadBucketKey, createPayloadDigest, normalizePayloadBucketValue, } from "./bucket.js";
-export { type AuthEndpointRateLimitOptions, authEndpointRateLimit, type GlobalIpRateLimitOptions, globalIpRateLimit, type HttpRouteRateLimitOptions, httpRouteRateLimit, } from "./middleware.js";
-export { createRateLimitResolver, type RateLimitConfig, type RateLimitDecision, type RateLimitResolver, type RateLimitResolverOptions, } from "./resolver.js";
+export { type BucketContext, type BucketResult, buildBucketKey, buildPayloadBucketKey, createPayloadDigest, normalizePayloadBucketValue, } from "./bucket.ts";
+export { type AuthEndpointRateLimitOptions, authEndpointRateLimit, type GlobalIpRateLimitOptions, globalIpRateLimit, type HttpRouteRateLimitOptions, httpRouteRateLimit, } from "./middleware.ts";
+export { createRateLimitResolver, type RateLimitConfig, type RateLimitDecision, type RateLimitResolver, type RateLimitResolverOptions, } from "./resolver.ts";

package/dist/rate-limit/middleware.d.ts

@@ -1,7 +1,7 @@
 import type { Context, MiddlewareHandler } from "hono";
-import { type ClientIpResolver } from "../api/client-ip.js";
-import type { HttpRouteRateLimit } from "../engine/types/http-route.js";
-import type { RateLimitResolver } from "./resolver.js";
+import { type ClientIpResolver } from "../api/client-ip.ts";
+import type { HttpRouteRateLimit } from "../engine/types/http-route.ts";
+import type { RateLimitResolver } from "./resolver.ts";
 export type GlobalIpRateLimitOptions = {
     readonly resolver: RateLimitResolver;
     readonly limit?: number;

package/dist/redis/cache-sync-bus.d.ts

@@ -1,6 +1,6 @@
 import type { CacheSyncBus, ClosableCacheSyncBus } from "@cosmicdrift/kumiko-types/cache-sync-types";
-import { type RedisClientOptions } from "./client.js";
-import { type PubSubSignal } from "./pubsub-signal.js";
+import { type RedisClientOptions } from "./client.ts";
+import { type PubSubSignal } from "./pubsub-signal.ts";
 export type { CacheSyncBus, ClosableCacheSyncBus };
 export declare function createLocalCacheSyncBus(): ClosableCacheSyncBus;
 export type CacheSyncBusOverSignalOptions = {

package/dist/redis/cache-sync-topics.d.ts

@@ -1,4 +1,4 @@
-import type { TenantId } from "../engine/types/identifiers.js";
+import type { TenantId } from "../engine/types/identifiers.ts";
 export declare const CACHE_SYNC_TOPICS: {
     readonly tenantConfig: "tenant-config";
     readonly tierAssignment: "tier-assignment";

package/dist/redis/index.d.ts

@@ -1,8 +1,8 @@
-export type { CacheSyncBus, CacheSyncBusOverSignalOptions, ClosableCacheSyncBus, RedisCacheSyncBusOptions, ResolvedCacheSyncBus, } from "./cache-sync-bus.js";
-export { createCacheSyncBusOverSignal, createDefaultCacheSyncBus, createLocalCacheSyncBus, createRedisCacheSyncBus, resolveCacheSyncBus, } from "./cache-sync-bus.js";
-export type { TenantConfigSyncMessage, TierAssignmentSyncMessage } from "./cache-sync-topics.js";
-export { CACHE_SYNC_TOPICS, isTenantConfigSyncMessage, isTierAssignmentSyncMessage, } from "./cache-sync-topics.js";
-export type { RedisClientOptions } from "./client.js";
-export { createRedisClient, redisChannelPrefixFromEnv, redisClientOptionsFromEnv, } from "./client.js";
-export type { PubSubSignal, PubSubSignalOptions } from "./pubsub-signal.js";
-export { createRedisPubSubSignal } from "./pubsub-signal.js";
+export type { CacheSyncBus, CacheSyncBusOverSignalOptions, ClosableCacheSyncBus, RedisCacheSyncBusOptions, ResolvedCacheSyncBus, } from "./cache-sync-bus.ts";
+export { createCacheSyncBusOverSignal, createDefaultCacheSyncBus, createLocalCacheSyncBus, createRedisCacheSyncBus, resolveCacheSyncBus, } from "./cache-sync-bus.ts";
+export type { TenantConfigSyncMessage, TierAssignmentSyncMessage } from "./cache-sync-topics.ts";
+export { CACHE_SYNC_TOPICS, isTenantConfigSyncMessage, isTierAssignmentSyncMessage, } from "./cache-sync-topics.ts";
+export type { RedisClientOptions } from "./client.ts";
+export { createRedisClient, redisChannelPrefixFromEnv, redisClientOptionsFromEnv, } from "./client.ts";
+export type { PubSubSignal, PubSubSignalOptions } from "./pubsub-signal.ts";
+export { createRedisPubSubSignal } from "./pubsub-signal.ts";

package/dist/redis/pubsub-signal.d.ts

@@ -1,4 +1,4 @@
-import { type RedisClientOptions } from "./client.js";
+import { type RedisClientOptions } from "./client.ts";
 export type PubSubSignal = {
     publish(channel: string, payload: unknown): void;
     publishConfirmed(channel: string, payload: unknown): Promise<void>;

package/dist/schema-cli.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureDefinition } from "./engine/types/feature.js";
+import type { FeatureDefinition } from "./engine/types/feature.ts";
 export type SchemaCliOut = {
     readonly log: (line: string) => void;
     readonly err: (line: string) => void;

package/dist/schema-cli.js

@@ -7,6 +7,14 @@
 // NO-MAGIC-ON-DATA: reads only checked-in artifacts (kumiko/schema.ts →
 // ENTITY_METAS, kumiko/migrations/*.sql). Never auto-generates at runtime,
 // never applies on app-boot — apply/baseline are explicit deploy-steps.
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
 import { existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
 import { join, resolve as resolvePath } from "node:path";
 import { configureBlindIndexKey, configurePiiSubjectKms, resolveKmsWiringAsync, } from "./crypto/index.js";
@@ -25,7 +33,7 @@ const SNAPSHOT_FILENAME = ".snapshot.json";
 // want a graceful exit code (validate) catch it themselves.
 async function loadSchemaModFromApp(schemaFile) {
     // bun imports TS directly — no spawn needed.
-    const mod = (await import(schemaFile));
+    const mod = (await import(__rewriteRelativeImportExtension(schemaFile)));
     if (!Array.isArray(mod.ENTITY_METAS)) {
         throw new Error(`Schema file ${schemaFile} muss \`export const ENTITY_METAS: EntityTableMeta[]\` haben.`);
     }

package/dist/search/derive-search-adapter-config.d.ts

@@ -1,3 +1,3 @@
-import type { Registry } from "../engine/types/index.js";
-import type { SearchAdapterConfig } from "./types.js";
+import type { Registry } from "../engine/types/index.ts";
+import type { SearchAdapterConfig } from "./types.ts";
 export declare function deriveSearchAdapterConfig(registry: Registry): SearchAdapterConfig | undefined;

package/dist/search/in-memory-adapter.d.ts

@@ -1,2 +1,2 @@
-import type { SearchAdapter } from "./types.js";
+import type { SearchAdapter } from "./types.ts";
 export declare function createInMemorySearchAdapter(): SearchAdapter;

package/dist/search/index.d.ts

@@ -1,6 +1,6 @@
-export { deriveSearchAdapterConfig } from "./derive-search-adapter-config.js";
-export { createInMemorySearchAdapter } from "./in-memory-adapter.js";
-export { purgeSearchDocumentsForSubject } from "./purge-subject.js";
-export type { ReindexEntityFailure, ReindexEntityOptions, ReindexEntityResult, } from "./reindex-entity.js";
-export { reindexEntity } from "./reindex-entity.js";
-export type { SearchAdapter, SearchAdapterConfig, SearchDocument, SearchOptions, SearchResult, } from "./types.js";
+export { deriveSearchAdapterConfig } from "./derive-search-adapter-config.ts";
+export { createInMemorySearchAdapter } from "./in-memory-adapter.ts";
+export { purgeSearchDocumentsForSubject } from "./purge-subject.ts";
+export type { ReindexEntityFailure, ReindexEntityOptions, ReindexEntityResult, } from "./reindex-entity.ts";
+export { reindexEntity } from "./reindex-entity.ts";
+export type { SearchAdapter, SearchAdapterConfig, SearchDocument, SearchOptions, SearchResult, } from "./types.ts";

package/dist/search/meilisearch-adapter.d.ts

@@ -1,5 +1,5 @@
-import type { EntityId, TenantId } from "../engine/types/identifiers.js";
-import type { SearchAdapter } from "./types.js";
+import type { EntityId, TenantId } from "../engine/types/identifiers.ts";
+import type { SearchAdapter } from "./types.ts";
 export type MeilisearchAdapterOptions = {
     url: string;
     apiKey: string;

package/dist/search/purge-subject.d.ts

@@ -1,7 +1,7 @@
-import type { SubjectId } from "../crypto/kms-adapter.js";
-import type { DbRunner } from "../db/connection.js";
-import type { FeatureDefinition } from "../engine/types/index.js";
-import type { SearchAdapter } from "./types.js";
+import type { SubjectId } from "../crypto/kms-adapter.ts";
+import type { DbRunner } from "../db/connection.ts";
+import type { FeatureDefinition } from "../engine/types/index.ts";
+import type { SearchAdapter } from "./types.ts";
 export declare function purgeSearchDocumentsForSubject(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, search: SearchAdapter, subjectKey: string, 
 /** When set, also match rows by ownership — needed after anonymize rewrites ciphertext. */
 subject?: SubjectId): Promise<void>;

package/dist/search/reindex-entity.d.ts

@@ -1,6 +1,6 @@
-import type { DbRunner } from "../db/connection.js";
-import type { Registry, TenantId } from "../engine/types/index.js";
-import type { SearchAdapter } from "./types.js";
+import type { DbRunner } from "../db/connection.ts";
+import type { Registry, TenantId } from "../engine/types/index.ts";
+import type { SearchAdapter } from "./types.ts";
 export type ReindexEntityFailure = {
     readonly entityId: string;
     readonly reason: string;

package/dist/secrets/dek-cache.d.ts

@@ -1,4 +1,4 @@
-import type { KeyScope, MasterKeyProvider } from "./types.js";
+import type { KeyScope, MasterKeyProvider } from "./types.ts";
 export type DekCacheOptions = {
     readonly ttlMs?: number;
     readonly maxEntries?: number;

package/dist/secrets/env-master-key-provider.d.ts

@@ -1,4 +1,4 @@
-import type { MasterKeyProvider } from "./types.js";
+import type { MasterKeyProvider } from "./types.ts";
 export type EnvMasterKeyProviderOptions = {
     readonly env?: Readonly<Record<string, string | undefined>>;
 };

package/dist/secrets/env-master-key-provider.js

@@ -3,6 +3,7 @@
 // without a maintenance window. See loadKeyring + resolveCurrentVersion at
 // the bottom for the env contract.
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { isDryRunEnvActive } from "../env/dry-run.js";
 import { InternalError } from "../errors/index.js";
 const ALGORITHM = "aes-256-gcm";
 const KEK_LENGTH = 32; // AES-256
@@ -10,21 +11,22 @@ const IV_LENGTH = 12;
 const TAG_LENGTH = 16;
 export function createEnvMasterKeyProvider(opts = {}) {
     const env = opts.env ?? process.env;
-    const keyring = loadKeyring(env);
-    const current = resolveCurrentVersion(env);
-    // --- Boot validation (after keyring + current are known) -------------
-    if (!keyring.has(current)) {
-        throw new InternalError({
-            message: `[secrets] currentVersion=${current} not present in keyring ` +
-                `(have versions: ${[...keyring.keys()].sort().join(",")}). ` +
-                `Check KUMIKO_SECRETS_MASTER_KEY_V${current} is set.`,
-        });
-    }
+    let loaded;
+    const keyringState = () => {
+        loaded ??= loadValidatedKeyring(env);
+        return loaded;
+    };
+    // Apps build this provider at module load, before runProdApp runs. A dry
+    // run inspects an env that may hold no key yet, so the check moves to the
+    // first key operation there; a real boot still fails here, at construction.
+    if (!isDryRunEnvActive(env) && !isDryRunEnvActive(process.env))
+        keyringState();
     // --- KEK-wrap / unwrap boilerplate (AES-256-GCM) ---------------------
     // The DEK is the plaintext here; we encrypt it with the KEK. Same
     // algorithm as the value encryption, just a different role.
     return {
         async wrapDek(dek) {
+            const { keyring, current } = keyringState();
             const kek = keyring.get(current);
             if (!kek) {
                 // Should never reach here — boot validation above guarantees the
@@ -47,6 +49,7 @@ export function createEnvMasterKeyProvider(opts = {}) {
             };
         },
         async unwrapDek(encryptedDek, kekVersion) {
+            const { keyring } = keyringState();
             const kek = keyring.get(kekVersion);
             if (!kek) {
                 throw new InternalError({
@@ -63,7 +66,7 @@ export function createEnvMasterKeyProvider(opts = {}) {
             return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
         },
         currentVersion() {
-            return current;
+            return keyringState().current;
         },
         async isAvailable() {
             // Env-backed provider is always "available" once boot passed — the
@@ -73,6 +76,18 @@ export function createEnvMasterKeyProvider(opts = {}) {
         },
     };
 }
+function loadValidatedKeyring(env) {
+    const keyring = loadKeyring(env);
+    const current = resolveCurrentVersion(env);
+    if (!keyring.has(current)) {
+        throw new InternalError({
+            message: `[secrets] currentVersion=${current} not present in keyring ` +
+                `(have versions: ${[...keyring.keys()].sort().join(",")}). ` +
+                `Check KUMIKO_SECRETS_MASTER_KEY_V${current} is set.`,
+        });
+    }
+    return { keyring, current };
+}
 // ENV schema (Decision 1 — per-version variables):
 //   KUMIKO_SECRETS_MASTER_KEY_V1=<base64 32 bytes>
 //   KUMIKO_SECRETS_MASTER_KEY_V2=<base64 32 bytes>

package/dist/secrets/envelope-cipher.d.ts

@@ -1,6 +1,6 @@
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-types/envelope-cipher-types";
-import type { DekCache } from "./dek-cache.js";
-import type { MasterKeyProvider } from "./types.js";
+import type { DekCache } from "./dek-cache.ts";
+import type { MasterKeyProvider } from "./types.ts";
 export type { EnvelopeCipher } from "@cosmicdrift/kumiko-types/envelope-cipher-types";
 export type EnvelopeCipherOptions = {
     readonly dekCache?: DekCache;

package/dist/secrets/envelope.d.ts

@@ -1,3 +1,3 @@
-import type { Envelope, KeyScope, MasterKeyProvider } from "./types.js";
+import type { Envelope, KeyScope, MasterKeyProvider } from "./types.ts";
 export declare function encryptValue(plaintext: string, provider: MasterKeyProvider, scope?: KeyScope): Promise<Envelope>;
 export declare function decryptValue(envelope: Envelope, provider: MasterKeyProvider, scope?: KeyScope): Promise<string>;

package/dist/secrets/index.d.ts

@@ -1,9 +1,9 @@
-export { createDekCache, type DekCache, type DekCacheOptions, withDekCache } from "./dek-cache.js";
-export { derivePurposeSecret } from "./derive-purpose-secret.js";
-export { createEnvMasterKeyProvider, type EnvMasterKeyProviderOptions, type Keyring, } from "./env-master-key-provider.js";
-export { decryptValue, encryptValue } from "./envelope.js";
-export { createEnvelopeCipher, type EnvelopeCipher, type EnvelopeCipherOptions, } from "./envelope-cipher.js";
-export { assertNoSecretLeak } from "./leak-guard.js";
-export { rewrapDek } from "./rotation.js";
-export { decodeStoredEnvelope, encodeStoredEnvelope, isStoredEnvelope, type StoredEnvelope, } from "./stored-envelope.js";
-export { type ContainsSecret, createSecret, type Envelope, isSecret, type KeyScope, type MasterKeyProvider, type Secret, type SecretAuditContext, type SecretKeyRef, type SecretsContext, } from "./types.js";
+export { createDekCache, type DekCache, type DekCacheOptions, withDekCache } from "./dek-cache.ts";
+export { derivePurposeSecret } from "./derive-purpose-secret.ts";
+export { createEnvMasterKeyProvider, type EnvMasterKeyProviderOptions, type Keyring, } from "./env-master-key-provider.ts";
+export { decryptValue, encryptValue } from "./envelope.ts";
+export { createEnvelopeCipher, type EnvelopeCipher, type EnvelopeCipherOptions, } from "./envelope-cipher.ts";
+export { assertNoSecretLeak } from "./leak-guard.ts";
+export { rewrapDek } from "./rotation.ts";
+export { decodeStoredEnvelope, encodeStoredEnvelope, isStoredEnvelope, type StoredEnvelope, } from "./stored-envelope.ts";
+export { type ContainsSecret, createSecret, type Envelope, isSecret, type KeyScope, type MasterKeyProvider, type Secret, type SecretAuditContext, type SecretKeyRef, type SecretsContext, } from "./types.ts";

package/dist/secrets/rotation.d.ts

@@ -1,2 +1,2 @@
-import type { Envelope, MasterKeyProvider } from "./types.js";
+import type { Envelope, MasterKeyProvider } from "./types.ts";
 export declare function rewrapDek(envelope: Envelope, provider: MasterKeyProvider): Promise<Envelope>;

package/dist/secrets/stored-envelope.d.ts

@@ -1,4 +1,4 @@
-import type { Envelope } from "./types.js";
+import type { Envelope } from "./types.ts";
 export type StoredEnvelope = {
     readonly ciphertext: string;
     readonly iv: string;

package/dist/seeding/entity-seed.d.ts

@@ -1,4 +1,4 @@
-import { type SeedIfExists } from "./types.js";
+import { type SeedIfExists } from "./types.ts";
 export type EventStoreSeedExisting<TId extends string | number = string> = {
     readonly id: TId;
     readonly version: number;

package/dist/seeding/index.d.ts

@@ -1,3 +1,3 @@
-export { type EventStoreSeedExisting, type RunEventStoreSeedOptions, runEventStoreSeed, } from "./entity-seed.js";
-export { createTestUser, TestUsers, testTenantId, testUserId } from "./seed-users.js";
-export { DEFAULT_SEED_IF_EXISTS, type SeedIfExists } from "./types.js";
+export { type EventStoreSeedExisting, type RunEventStoreSeedOptions, runEventStoreSeed, } from "./entity-seed.ts";
+export { createTestUser, TestUsers, testTenantId, testUserId } from "./seed-users.ts";
+export { DEFAULT_SEED_IF_EXISTS, type SeedIfExists } from "./types.ts";

package/dist/seeding/seed-users.d.ts

@@ -1,4 +1,4 @@
-import type { SessionUser, TenantId } from "../engine/types/index.js";
+import type { SessionUser, TenantId } from "../engine/types/index.ts";
 export declare function testTenantId(n: number): TenantId;
 export declare function testUserId(n: number): string;
 export declare const TestUsers: {

package/dist/time/index.d.ts

@@ -1,6 +1,6 @@
-export { warnIfNonUtcServerTimeZone } from "./boot-tz-warning.js";
-export type { GeoAddress, GeoCoordinates, GeoTzProvider } from "./geo-tz.js";
-export { isValidIanaTimeZone } from "./iana.js";
-export { instantToLegacyDate, legacyDateToInstant } from "./legacy-date.js";
-export { ensureTemporalPolyfill, getTemporal } from "./polyfill.js";
-export { type Clock, createTzContext, createTzContextAsync, type LocatedTimestampJson, type TzContext, type TzContextOptions, } from "./tz-context.js";
+export { warnIfNonUtcServerTimeZone } from "./boot-tz-warning.ts";
+export type { GeoAddress, GeoCoordinates, GeoTzProvider } from "./geo-tz.ts";
+export { isValidIanaTimeZone } from "./iana.ts";
+export { instantToLegacyDate, legacyDateToInstant } from "./legacy-date.ts";
+export { ensureTemporalPolyfill, getTemporal } from "./polyfill.ts";
+export { type Clock, createTzContext, createTzContextAsync, type LocatedTimestampJson, type TzContext, type TzContextOptions, } from "./tz-context.ts";

package/dist/ui-types/app-schema.d.ts

@@ -1,8 +1,8 @@
-import type { TranslationKeys } from "../engine/types/config.js";
-import type { EntityDefinition } from "../engine/types/fields.js";
-import type { ContentCollectionDefinition, NavDefinition } from "../engine/types/nav.js";
-import type { ScreenDefinition } from "../engine/types/screen.js";
-import type { WorkspaceDefinition } from "../engine/types/workspace.js";
+import type { TranslationKeys } from "../engine/types/config.ts";
+import type { EntityDefinition } from "../engine/types/fields.ts";
+import type { ContentCollectionDefinition, NavDefinition } from "../engine/types/nav.ts";
+import type { ScreenDefinition } from "../engine/types/screen.ts";
+import type { WorkspaceDefinition } from "../engine/types/workspace.ts";
 export type FeatureSchema = {
     readonly featureName: string;
     readonly entities: Readonly<Record<string, EntityDefinition>>;

package/dist/ui-types/index.d.ts

@@ -1,24 +1,24 @@
 export { NO_WIDGET_FIELD_TYPES } from "@cosmicdrift/kumiko-types/fields";
-export type { DerivedCellRoundingTarget } from "../engine/embedded-derived.js";
-export { computeDerivedCellValue, roundDerivedCellValue } from "../engine/embedded-derived.js";
-export type { ParsedRefTarget } from "../engine/parse-ref-target.js";
-export { parseRefTarget } from "../engine/parse-ref-target.js";
-export type { FieldsOrGroupsSection, UnavailableSelectOption } from "../engine/screen-helpers.js";
-export { availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
-export type { BooleanFieldDef, DateFieldDef, EmbeddedDerivedCellDef, EntityDefinition, FieldDefinition, FileFieldDef, FilesFieldDef, ImageFieldDef, ImagesFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, SelectFieldDef, SelectOptionTone, TextFieldDef, } from "../engine/types/fields.js";
-export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, RoleAccessPersonalData, RoleAccessRule, } from "../engine/types/handlers.js";
-export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
-export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav.js";
-export type { ActionFormFooterAction, ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.js";
-export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
-export type { TargetRef } from "../engine/types/target-ref.js";
-export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.js";
-export type { WorkspaceDefinition } from "../engine/types/workspace.js";
-export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
-export type { AppSchema, FeatureSchema, QualifiedContentCollection, WorkspaceSchema, } from "./app-schema.js";
-export type { CardColumnRoles, CardRoleColumn } from "./card-column-roles.js";
-export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.js";
-export { type Formality, formalLocaleTag } from "./formality.js";
-export type { ListRowMetaColumnType, ListRowMetaReference, ReferenceLookupSource, SystemReferenceLabel, } from "./list-row-meta.js";
-export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, } from "./list-row-meta.js";
-export { type PluralForms, resolveTranslationValue, type TranslationValue, translationValueOtherText, } from "./plural.js";
+export type { DerivedCellRoundingTarget } from "../engine/embedded-derived.ts";
+export { computeDerivedCellValue, roundDerivedCellValue } from "../engine/embedded-derived.ts";
+export type { ParsedRefTarget } from "../engine/parse-ref-target.ts";
+export { parseRefTarget } from "../engine/parse-ref-target.ts";
+export type { FieldsOrGroupsSection, UnavailableSelectOption } from "../engine/screen-helpers.ts";
+export { availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.ts";
+export type { BooleanFieldDef, DateFieldDef, EmbeddedDerivedCellDef, EntityDefinition, FieldDefinition, FileFieldDef, FilesFieldDef, ImageFieldDef, ImagesFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, SelectFieldDef, SelectOptionTone, TextFieldDef, } from "../engine/types/fields.ts";
+export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, RoleAccessPersonalData, RoleAccessRule, } from "../engine/types/handlers.ts";
+export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.ts";
+export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav.ts";
+export type { ActionFormFooterAction, ActionFormRedirect, ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, FieldCondition, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.ts";
+export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.ts";
+export type { TargetRef } from "../engine/types/target-ref.ts";
+export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.ts";
+export type { WorkspaceDefinition } from "../engine/types/workspace.ts";
+export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.ts";
+export type { AppSchema, FeatureSchema, QualifiedContentCollection, WorkspaceSchema, } from "./app-schema.ts";
+export type { CardColumnRoles, CardRoleColumn } from "./card-column-roles.ts";
+export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.ts";
+export { type Formality, formalLocaleTag } from "./formality.ts";
+export type { ListRowMetaColumnType, ListRowMetaReference, ReferenceLookupSource, SystemReferenceLabel, } from "./list-row-meta.ts";
+export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, } from "./list-row-meta.ts";
+export { type PluralForms, resolveTranslationValue, type TranslationValue, translationValueOtherText, } from "./plural.ts";

package/dist/upgrade-cli.js

@@ -284,6 +284,18 @@ async function runCodemodScript(scriptPath, targetDir, repoRoot, dryRun) {
     ]);
     return { ok: exitCode === 0, output: `${stdout}${stderr}`.trim() };
 }
+// One codemod can back the breaking entries of many features in the same release
+// (each feature's changelog names its own removed export); it runs once per version.
+function uniqueCodemodRunsPerVersion(entries) {
+    const seenRuns = new Set();
+    return entries.filter((e) => {
+        const runKey = `${e.version}\0${e.codemod}`;
+        if (seenRuns.has(runKey))
+            return false;
+        seenRuns.add(runKey);
+        return true;
+    });
+}
 function hasCodemod(e) {
     return typeof e.codemod === "string" && e.codemod.length > 0;
 }
@@ -446,7 +458,7 @@ function writePartialMarker(out, targetDir, pending, manualEntries, failedVersio
     });
     out.err(`  ⚠ ${ran.length} codemod(s) already applied; wrote marker at ${version} so a re-run resumes at the failed one.`);
 }
-// Runs every pending breaking entry's codemod, oldest version first (so a
+// Runs every pending entry's codemod, oldest version first (so a
 // later codemod can assume an earlier one already ran). Stops on the first
 // failure; codemods that already ran are kept in a partial marker. Writes the
 // marker whenever dryRun is false —
@@ -474,9 +486,9 @@ markerVersion, previous) {
         return 0;
     }
     const breaking = pending.filter((e) => e.type === "breaking");
-    const codemodEntries = breaking
-        .filter(hasCodemod)
-        .sort((a, b) => compareVersions(a.version, b.version));
+    // A codemod is worth running whatever the entry's type: an improvement that
+    // moves a module ships one too, and skipping it leaves the deprecated path in place.
+    const codemodEntries = uniqueCodemodRunsPerVersion(pending.filter(hasCodemod).sort((a, b) => compareVersions(a.version, b.version)));
     const manualEntries = breaking.filter(needsManualMigration);
     for (const e of manualEntries) {
         out.log(hasCodemod(e)
@@ -485,7 +497,7 @@ markerVersion, previous) {
     }
     if (codemodEntries.length === 0) {
         out.log(breaking.length > 0
-            ? "  No automatable codemods among the pending breaking changes."
+            ? "  No automatable codemods among the pending changes."
             : "  ✓ No breaking changes pending.");
         if (!dryRun) {
             const carried = carryOverManual(previous, manualEntries.map(toMarkerManual));
@@ -636,7 +648,7 @@ kumiko-upgrade --resolve <id|version>[,<id|version>...] --reason "<text>" [--not
   --dir <path>       target directory to check/apply against (default: cwd)
   --json             machine-readable output
   --verbose          include full migration details for each pending entry
-  --apply            run codemods for pending breaking changes and write the upgrade marker
+  --apply            run codemods for pending changes and write the upgrade marker
                      (one run moves the marker to the installed version; manual migrations stay listed as open)
   --resolve <refs>   mark open manual migrations as done; ref = full id or a version with exactly one open entry
   --reason <text>    required with --resolve, max 500 characters

package/dist/utils/index.d.ts

@@ -1,9 +1,9 @@
-export { assertUnreachable } from "./assert.js";
-export { toSnakeCase } from "./case.js";
-export { compareByCodepoint } from "./compare.js";
-export { readPositiveIntEnv } from "./env-parse.js";
-export { generateDeterministicId, generateId } from "./ids.js";
-export { isPlainObject } from "./is-plain-object.js";
-export { parseStringArrayJson } from "./parse-string-array-json.js";
-export { parseJsonOrThrow, parseJsonSafe, stringifyJson } from "./safe-json.js";
-export { parseRoles } from "./serialization.js";
+export { assertUnreachable } from "./assert.ts";
+export { toSnakeCase } from "./case.ts";
+export { compareByCodepoint } from "./compare.ts";
+export { readPositiveIntEnv } from "./env-parse.ts";
+export { generateDeterministicId, generateId } from "./ids.ts";
+export { isPlainObject } from "./is-plain-object.ts";
+export { parseStringArrayJson } from "./parse-string-array-json.ts";
+export { parseJsonOrThrow, parseJsonSafe, stringifyJson } from "./safe-json.ts";
+export { parseRoles } from "./serialization.ts";