@cosmicdrift/kumiko-framework 0.368.0 → 0.370.0

package/dist/db/tenant-db.js

@@ -311,18 +311,8 @@ export async function runInOwnTransaction(tenantDb, fn) {
     }
     return rebind(fn);
 }
-// Runners (postgres-js Sql/tx handles) are functions and RawDbClient mocks carry no own
-// `tenantId`/`db`, so a runner is never mistaken for the options object.
-function isCreateTenantDbOptions(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        Object.hasOwn(value, "tenantId") &&
-        Object.hasOwn(value, "db"));
-}
-export function createTenantDb(dbOrOptions, tenantId, mode, tracer, meter, signal, grants) {
-    if (isCreateTenantDbOptions(dbOrOptions))
-        return buildTenantDb(dbOrOptions);
-    return buildTenantDb({ db: dbOrOptions, tenantId, mode, tracer, meter, signal, grants });
+export function createTenantDb(options) {
+    return buildTenantDb(options);
 }
 // Untyped JS callers or an `as` cast can still hand in undefined; a scoped handle
 // without a tenant would bind `tenant_id = NULL` instead of failing loudly.

package/dist/derivatives/derivatives-context.d.ts

@@ -1,7 +1,7 @@
 import type { DerivativeRendererPlugin, DerivativesContext } from "@cosmicdrift/kumiko-types/derivatives-types";
-import { type AnyDb } from "../db/query.js";
-import type { Registry, TenantId } from "../engine/types/index.js";
-import type { FileContext } from "../files/file-handle.js";
+import { type AnyDb } from "../db/query.ts";
+import type { Registry, TenantId } from "../engine/types/index.ts";
+import type { FileContext } from "../files/file-handle.ts";
 export type DerivativesContextDeps = {
     readonly files: FileContext;
     readonly registry: Registry;

package/dist/derivatives/field-variants.d.ts

@@ -1,3 +1,3 @@
 import type { VariantSpec } from "@cosmicdrift/kumiko-types/derivatives-types";
-import type { Registry } from "../engine/types/index.js";
+import type { Registry } from "../engine/types/index.ts";
 export declare function resolveFieldVariant(registry: Registry, entityType: string | null, fieldName: string | null, name: string): VariantSpec | undefined;

package/dist/derivatives/index.d.ts

@@ -1,6 +1,6 @@
-export type { StoredFileStore } from "./delete-stored-file.js";
-export { deleteFileRefBytes, deleteStoredFileAndDerivatives, listDerivativeKeys, } from "./delete-stored-file.js";
-export type { DerivativesContextDeps } from "./derivatives-context.js";
-export { createDerivativesContext, resolveRenderer } from "./derivatives-context.js";
-export { resolveFieldVariant } from "./field-variants.js";
-export { canonicalJson, derivativeListPrefix, isDerivativeKeyOf, parseDerivativeKey, specHash, VARIANT_NAME_PATTERN, variantSuffix, } from "./variant-key.js";
+export type { StoredFileStore } from "./delete-stored-file.ts";
+export { deleteFileRefBytes, deleteStoredFileAndDerivatives, listDerivativeKeys, } from "./delete-stored-file.ts";
+export type { DerivativesContextDeps } from "./derivatives-context.ts";
+export { createDerivativesContext, resolveRenderer } from "./derivatives-context.ts";
+export { resolveFieldVariant } from "./field-variants.ts";
+export { canonicalJson, derivativeListPrefix, isDerivativeKeyOf, parseDerivativeKey, specHash, VARIANT_NAME_PATTERN, variantSuffix, } from "./variant-key.ts";

package/dist/engine/access.d.ts

@@ -1,2 +1,2 @@
-import type { AccessRule, SessionUser } from "./types/index.js";
+import type { AccessRule, SessionUser } from "./types/index.ts";
 export declare function hasAccess(user: Pick<SessionUser, "roles">, access: AccessRule | undefined): boolean;

package/dist/engine/active-membership.d.ts

@@ -1,5 +1,5 @@
-import type { DbConnection } from "../db/connection.js";
-import type { TenantId } from "./types/identifiers.js";
+import type { DbConnection } from "../db/connection.ts";
+import type { TenantId } from "./types/identifiers.ts";
 export type PrincipalStatus = "active" | "blocked" | "unknown";
 export type PrincipalProfile = {
     readonly globalRoles: readonly string[];

package/dist/engine/boot-validator/access-declarations.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateAccessDeclarations(feature: FeatureDefinition): void;

package/dist/engine/boot-validator/access-roles.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function warnOnUniqueAccessRoles(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/action-wiring.d.ts

@@ -1,3 +1,3 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateActionWiring(feature: FeatureDefinition): void;
 export declare function validateFieldWiring(feature: FeatureDefinition): void;

package/dist/engine/boot-validator/api-ext.d.ts

@@ -1,3 +1,3 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateApiExposureMatching(feature: FeatureDefinition, allExposedApis: ReadonlyMap<string, string>, featureMap: ReadonlyMap<string, FeatureDefinition>): void;
 export declare function validateExtensionUsages(feature: FeatureDefinition, extensionProviders: ReadonlyMap<string, string>): void;

package/dist/engine/boot-validator/boot-check.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateFeatureBootChecks(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/card-meta-overflow.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export type CardMetaOverflow = {
     readonly feature: string;
     readonly screen: string;

package/dist/engine/boot-validator/config-deps.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function warnOnToggleableDependencies(features: readonly FeatureDefinition[], featureMap: ReadonlyMap<string, FeatureDefinition>): void;
 export declare function validateConfigKeyBounds(feature: FeatureDefinition): void;
 export declare function validateConfigKeyComputed(feature: FeatureDefinition): void;

package/dist/engine/boot-validator/detail-screens.d.ts

@@ -1,5 +1,5 @@
-import type { FeatureDefinition } from "../types/index.js";
-import type { ScreenDefinition } from "../types/screen.js";
+import type { FeatureDefinition } from "../types/index.ts";
+import type { ScreenDefinition } from "../types/screen.ts";
 export declare function collectDetailForScreens(features: readonly FeatureDefinition[], featureMap: ReadonlyMap<string, FeatureDefinition>): Map<string, {
     readonly featureName: string;
     readonly screen: ScreenDefinition;

package/dist/engine/boot-validator/entity-handler.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureDefinition, QueryHandlerDef } from "../types/index.js";
+import type { FeatureDefinition, QueryHandlerDef } from "../types/index.ts";
 export declare const FILE_FIELD_TYPES: Set<string>;
 export declare const PII_DIRECT_NAME_HINTS: ReadonlySet<string>;
 export declare const PII_USER_OWNED_NAME_HINTS: ReadonlySet<string>;

package/dist/engine/boot-validator/entity-list-screens.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 /** Operator lists default searchable; low-cardinality audit trails stay opt-out. */
 export declare const SEARCHABLE_FALSE_WHITELIST: Set<string>;
 export declare const LIST_ROW_META_COLUMN_NAMES: Set<string>;

package/dist/engine/boot-validator/gdpr-storage.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateGdprStoragePersistence(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/global-tenancy.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateGlobalTenancyEntities(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/handler-field-references.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateHandlerFieldReferences(feature: FeatureDefinition, featureMap: ReadonlyMap<string, FeatureDefinition>): void;

package/dist/engine/boot-validator/i18n-keys.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateI18nSurfaceKeys(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/index.d.ts

@@ -1,10 +1,10 @@
-import type { EnvelopeCipher } from "../../secrets/envelope-cipher.js";
-import type { FeatureDefinition } from "../types/index.js";
-export { type CardMetaOverflow, collectCardMetaOverflow } from "./card-meta-overflow.js";
-export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns.js";
-export { collectWriteHandlerQns } from "./nav.js";
-export { SECURITY_BASELINE_FEATURE_NAMES } from "./security-baseline.js";
-export { MAX_TRANSFER_DEPTH } from "./transfer-graph.js";
+import type { EnvelopeCipher } from "../../secrets/envelope-cipher.ts";
+import type { FeatureDefinition } from "../types/index.ts";
+export { type CardMetaOverflow, collectCardMetaOverflow } from "./card-meta-overflow.ts";
+export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns.ts";
+export { collectWriteHandlerQns } from "./nav.ts";
+export { SECURITY_BASELINE_FEATURE_NAMES } from "./security-baseline.ts";
+export { MAX_TRANSFER_DEPTH } from "./transfer-graph.ts";
 export type ValidateBootOptions = {
     /** Warn when an access role is used by exactly one handler/config-key/
      *  field across the whole boot scan — often a typo, but also the normal

package/dist/engine/boot-validator/nav.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureDefinition, NavDefinition, WorkspaceDefinition } from "../types/index.js";
+import type { FeatureDefinition, NavDefinition, WorkspaceDefinition } from "../types/index.ts";
 export declare function collectWriteHandlerQns(features: readonly FeatureDefinition[]): Set<string>;
 export declare function collectNavQns(features: readonly FeatureDefinition[]): Map<string, NavDefinition & {
     readonly featureName: string;

package/dist/engine/boot-validator/ownership.d.ts

@@ -1,5 +1,5 @@
-import { type OwnershipMap, type WhereRule } from "../ownership.js";
-import type { ClaimKeyDefinition, FeatureDefinition } from "../types/index.js";
+import { type OwnershipMap, type WhereRule } from "../ownership.ts";
+import type { ClaimKeyDefinition, FeatureDefinition } from "../types/index.ts";
 export type WhereRuleProbe = {
     readonly table: unknown;
     readonly tableName: string;

package/dist/engine/boot-validator/parent-ref.d.ts

@@ -1,3 +1,3 @@
-import type { EntityDefinition, FeatureDefinition } from "../types/index.js";
+import type { EntityDefinition, FeatureDefinition } from "../types/index.ts";
 export declare function findEntity(featureMap: ReadonlyMap<string, FeatureDefinition>, entityName: string): EntityDefinition | undefined;
 export declare function validateParentRefs(feature: FeatureDefinition, featureMap: ReadonlyMap<string, FeatureDefinition>): void;

package/dist/engine/boot-validator/pii-retention.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "../types/fields.js";
-import type { FeatureDefinition } from "../types/index.js";
+import type { EntityDefinition } from "../types/fields.ts";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function entityHasAnonymizableSubjectField(fields: EntityDefinition["fields"]): boolean;
 export declare function validatePiiAndRetention(feature: FeatureDefinition): void;

package/dist/engine/boot-validator/projection-list-screens.d.ts

@@ -1,4 +1,4 @@
-import { type FeatureDefinition, type QueryHandlerDef } from "../types/index.js";
+import { type FeatureDefinition, type QueryHandlerDef } from "../types/index.ts";
 export declare function buildQueryHandlerMap(features: readonly FeatureDefinition[]): ReadonlyMap<string, QueryHandlerDef>;
 export declare function validateProjectionListScreens(features: readonly FeatureDefinition[]): void;
 export declare function validateRelatedListSectionQueries(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/query-output-columns.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateQueryOutputColumns(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/query-refs.d.ts

@@ -1,3 +1,3 @@
-import type { FeatureDefinition, QueryHandlerDef } from "../types/index.js";
+import type { FeatureDefinition, QueryHandlerDef } from "../types/index.ts";
 export declare function checkQueryRef(queryHandlers: ReadonlyMap<string, QueryHandlerDef>, query: string, buildPrefix: () => string): void;
 export declare function validateQueryRefs(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/record-owned.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateRecordOwnedSubjects(feature: FeatureDefinition): void;

package/dist/engine/boot-validator/screens.d.ts

@@ -1,6 +1,6 @@
 import type { IconKey } from "@cosmicdrift/kumiko-types/nav-icon";
-import type { ConfigKeyDefinition, FeatureDefinition } from "../types/index.js";
-import type { ActionFormScreenDefinition, DashboardCustomPanel, DashboardScreenPanel, RelatedListToolbarAction, RowAction, RowFieldExtractor, ScreenDefinition, SecretMintScreenDefinition, ToolbarAction } from "../types/screen.js";
+import type { ConfigKeyDefinition, FeatureDefinition } from "../types/index.ts";
+import type { ActionFormScreenDefinition, DashboardCustomPanel, DashboardScreenPanel, RelatedListToolbarAction, RowAction, RowFieldExtractor, ScreenDefinition, SecretMintScreenDefinition, ToolbarAction } from "../types/screen.ts";
 export declare function rowFieldExtractorKeys(params: RowFieldExtractor): readonly string[];
 export declare function readsNavigateParamsAsFormPrefill(target: ScreenDefinition, explicitEntityId: string | undefined, sourceScreenEntity: string | undefined): boolean;
 export declare function validateActionHasIcon(featureName: string, screenId: string, screenType: "projectionDetail" | "entityEdit" | "entityList" | "projectionList", context: string, action: {

package/dist/engine/boot-validator/screens.js

@@ -551,6 +551,25 @@ function validateOptionsQueryFieldRefs(where, fieldName, payload, siblingFieldNa
 function isWriteOnlyField(fdef) {
     return fdef?.writeOnly === true; // @cast-boundary schema-walk
 }
+// A secret on a configEdit form keeps its value out of the client like an encrypted
+// config key does, and the secrets store only exists per tenant.
+function validateConfigEditSecretField(featureName, screen, fieldName, secretQn, featureMap) {
+    const where = `[Feature ${featureName}] Screen "${screen.id}" (configEdit) field "${fieldName}"`;
+    if (screen.configKeys[fieldName] !== undefined) {
+        throw new Error(`${where} is mapped in both configKeys and secretKeys — keep one.`);
+    }
+    if (screen.scope !== "tenant") {
+        throw new Error(`${where} maps secret "${secretQn}" on a ${screen.scope}-scope screen — secrets are tenant-scoped.`);
+    }
+    const fdef = screen.fields[fieldName];
+    if (fdef?.type !== "text" || !isWriteOnlyField(fdef)) {
+        throw new Error(`${where} maps secret "${secretQn}" but is no writeOnly text field — a stored secret never goes back to the client.`);
+    }
+    const declared = [...featureMap.values()].some((feature) => Object.values(feature.secretKeys ?? {}).some((def) => def.qualifiedName === secretQn));
+    if (!declared) {
+        throw new Error(`${where} → secret "${secretQn}" is not declared via r.secret() in any feature.`);
+    }
+}
 // Inline forms have no stored value to hide or keep: writeOnly there would
 // render a "set / keep" affordance with nothing behind it.
 function rejectWriteOnlyFormField(featureName, screenId, context, fieldName, fdef) {
@@ -1477,9 +1496,19 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                 }
             }
             validateWizardLayout(feature.name, screenId, "configEdit", screen.layout, featureMap);
+            for (const fname of Object.keys(screen.secretKeys ?? {})) {
+                if (!fieldNames.has(fname)) {
+                    throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (configEdit) secretKeys names unknown field "${fname}".`);
+                }
+            }
             // configKeys: jeder fieldName muss einen Mapping-Eintrag haben,
             // jeder qualifizierte Key muss in der Registry existieren.
             for (const fname of fieldNames) {
+                const secretQn = screen.secretKeys?.[fname];
+                if (secretQn !== undefined) {
+                    validateConfigEditSecretField(feature.name, screen, fname, secretQn, featureMap);
+                    continue;
+                }
                 const qualified = screen.configKeys[fname];
                 if (qualified === undefined) {
                     throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (configEdit) field "${fname}" has ` +

package/dist/engine/boot-validator/security-baseline.d.ts

@@ -1,3 +1,3 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare const SECURITY_BASELINE_FEATURE_NAMES: readonly ["sessions", "crypto-shredding", "rate-limiting", "audit"];
 export declare function warnOnMissingSecurityBaseline(features: readonly FeatureDefinition[], nodeEnv?: string | undefined): void;

package/dist/engine/boot-validator/selector-owner-panels.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function validateExtensionSelectorPanels(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/transfer-graph.d.ts

@@ -1,4 +1,4 @@
-import { MAX_TRANSFER_DEPTH } from "../transfer-adjacency.js";
-import type { FeatureDefinition } from "../types/index.js";
+import { MAX_TRANSFER_DEPTH } from "../transfer-adjacency.ts";
+import type { FeatureDefinition } from "../types/index.ts";
 export { MAX_TRANSFER_DEPTH };
 export declare function validateTransferGraph(feature: FeatureDefinition, featureMap: ReadonlyMap<string, FeatureDefinition>): void;

package/dist/engine/boot-validator/url-prefill-fields.d.ts

@@ -1,3 +1,3 @@
-import type { FeatureDefinition } from "../types/index.js";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function collectUrlPrefillFieldsByScreenQn(features: readonly FeatureDefinition[]): Map<string, Set<string>>;
 export declare function validateSubmitPrefilledHiddenFields(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/workspaces.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureDefinition, NavDefinition, WorkspaceDefinition } from "../types/index.js";
+import type { FeatureDefinition, NavDefinition, WorkspaceDefinition } from "../types/index.ts";
 export declare function collectWorkspaceQns(features: readonly FeatureDefinition[]): Map<string, WorkspaceDefinition & {
     readonly featureName: string;
 }>;

package/dist/engine/boot-validator.d.ts

@@ -1 +1 @@
-export { type CardMetaOverflow, collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";
+export { type CardMetaOverflow, collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.ts";

package/dist/engine/bridge-stub.d.ts

@@ -1,4 +1,4 @@
-import type { HandlerContext, SessionUser } from "./types/index.js";
+import type { HandlerContext, SessionUser } from "./types/index.ts";
 export declare function bridgeStub(opts?: {
     readonly user?: SessionUser;
 }): Pick<HandlerContext, "query" | "queryAs" | "write" | "writeAs" | "appendEvent" | "unsafeAppendEvent" | "tryAppendEvent" | "fetchForWriting" | "loadAggregate" | "archiveStream" | "restoreStream" | "isStreamArchived" | "snapshotAggregate" | "loadAggregateWithSnapshot" | "queryProjection" | "resolveAuthClaims" | "resolveActiveMembership" | "queryAsMember" | "hasFeature" | "metrics" | "metricsFor" | "tracer" | "tz" | "locale" | "user">;

package/dist/engine/build-app-schema.d.ts

@@ -1,5 +1,5 @@
-import type { AppSchema } from "../ui-types/index.js";
-import type { Registry } from "./types/feature.js";
+import type { AppSchema } from "../ui-types/index.ts";
+import type { Registry } from "./types/feature.ts";
 export type BuildAppSchemaOptions = {
     /** Dev-server authoring hints (Settings-Hub placement). Default off — only
      *  `createKumikoServer` opts in; prod boot + unit tests stay silent. */

package/dist/engine/build-config-feature-schema.d.ts

@@ -1,8 +1,8 @@
-import type { WorkspaceSchema } from "../ui-types/index.js";
-import type { TranslationKeys } from "./types/config.js";
-import type { Registry } from "./types/feature.js";
-import type { NavDefinition } from "./types/nav.js";
-import type { ScreenDefinition } from "./types/screen.js";
+import type { WorkspaceSchema } from "../ui-types/index.ts";
+import type { TranslationKeys } from "./types/config.ts";
+import type { Registry } from "./types/feature.ts";
+import type { NavDefinition } from "./types/nav.ts";
+import type { ScreenDefinition } from "./types/screen.ts";
 export declare const SETTINGS_HUB_FEATURE = "config";
 export declare const SETTINGS_HUB_WORKSPACE = "settings";
 export type ConfigFeatureSchema = {