@cosmicdrift/kumiko-framework 0.377.0 → 0.379.0

package/dist/rate-limit/index.js

@@ -1,4 +1,4 @@
 export { buildBucketKey, buildPayloadBucketKey, createPayloadDigest, normalizePayloadBucketValue, } from "./bucket.js";
-export { authEndpointRateLimit, globalIpRateLimit, httpRouteRateLimit, } from "./middleware.js";
+export { authEndpointRateLimit, DEFAULT_GLOBAL_RATE_LIMIT, globalIpRateLimit, httpRouteRateLimit, } from "./middleware.js";
 export { createRateLimitResolver, } from "./resolver.js";
 export { createUnlimitedRateLimitResolver } from "./unlimited-resolver.js";

package/dist/rate-limit/middleware.d.ts

@@ -11,6 +11,10 @@ export type GlobalIpRateLimitOptions = {
     readonly extractIp?: (c: Context) => string | undefined;
     readonly onFailClosed?: (err: unknown) => void;
 };
+export declare const DEFAULT_GLOBAL_RATE_LIMIT: {
+    readonly limit: 600;
+    readonly windowSeconds: 60;
+};
 export declare function globalIpRateLimit(opts: GlobalIpRateLimitOptions): MiddlewareHandler;
 export type HttpRouteRateLimitOptions = {
     readonly resolver: RateLimitResolver;

package/dist/rate-limit/middleware.js

@@ -3,9 +3,12 @@ import { clientIpSourceFromHonoContext, createClientIpResolver, } from "../api/c
 import { requestContext } from "../api/request-context.js";
 import { RateLimitError, serializeError } from "../errors/index.js";
 import { toPublicBucketName } from "./bucket.js";
+// Shared with runProdApp (server-runtime re-exports it). The auth middleware default stays
+// stricter than runProdApp's auth limit (30): a bare authEndpointRateLimit guards brute force.
+export const DEFAULT_GLOBAL_RATE_LIMIT = { limit: 600, windowSeconds: 60 };
 export function globalIpRateLimit(opts) {
-    const limit = opts.limit ?? 1000;
-    const windowSeconds = opts.windowSeconds ?? 60;
+    const limit = opts.limit ?? DEFAULT_GLOBAL_RATE_LIMIT.limit;
+    const windowSeconds = opts.windowSeconds ?? DEFAULT_GLOBAL_RATE_LIMIT.windowSeconds;
     const clientIpResolver = opts.clientIpResolver ??
         createClientIpResolver(opts.trustedProxyHops ?? 0, "globalIpRateLimit");
     const extractIp = opts.extractIp ?? ((c) => clientIpResolver.resolve(clientIpSourceFromHonoContext(c)));

package/dist/search/configure-tenant-index.d.ts

@@ -0,0 +1,4 @@
+import type { Registry, TenantId } from "../engine/types/index.ts";
+import type { SearchAdapter } from "./types.ts";
+export declare function collectSearchableFieldNames(registry: Registry): readonly string[];
+export declare function configureTenantSearchIndex(searchAdapter: SearchAdapter, registry: Registry, tenantId: TenantId): Promise<void>;

package/dist/search/configure-tenant-index.js

@@ -0,0 +1,8 @@
+import { deriveSearchAdapterConfig } from "./derive-search-adapter-config.js";
+export function collectSearchableFieldNames(registry) {
+    return deriveSearchAdapterConfig(registry)?.searchableFields ?? [];
+}
+export async function configureTenantSearchIndex(searchAdapter, registry, tenantId) {
+    const fields = collectSearchableFieldNames(registry);
+    await searchAdapter.configure(tenantId, { searchableFields: fields, rankingFields: fields });
+}

package/dist/search/index.d.ts

@@ -1,3 +1,4 @@
+export { collectSearchableFieldNames, configureTenantSearchIndex, } from "./configure-tenant-index.ts";
 export { deriveSearchAdapterConfig } from "./derive-search-adapter-config.ts";
 export { createInMemorySearchAdapter } from "./in-memory-adapter.ts";
 export { purgeSearchDocumentsForSubject } from "./purge-subject.ts";

package/dist/search/index.js

@@ -2,6 +2,7 @@
 // Damit lädt der Main-Barrel keinen Meilisearch-Client beim bloßen Anfassen
 // von SearchAdapter-Types. Apps die Meilisearch nicht nutzen, ziehen den
 // Client-Code nicht mit rein.
+export { collectSearchableFieldNames, configureTenantSearchIndex, } from "./configure-tenant-index.js";
 export { deriveSearchAdapterConfig } from "./derive-search-adapter-config.js";
 export { createInMemorySearchAdapter } from "./in-memory-adapter.js";
 export { purgeSearchDocumentsForSubject } from "./purge-subject.js";

package/dist/ui-types/index.d.ts

@@ -1,10 +1,12 @@
 export { NO_WIDGET_FIELD_TYPES } from "@cosmicdrift/kumiko-types/fields";
 export type { DerivedCellRoundingTarget } from "../engine/embedded-derived.ts";
 export { computeDerivedCellValue, roundDerivedCellValue } from "../engine/embedded-derived.ts";
+export type { FormDerivationScreen } from "../engine/form-derivations.ts";
+export { applyFormDerivations, isFormDerivationInputMode, isUnusedFallbackOperand, } from "../engine/form-derivations.ts";
 export type { ParsedRefTarget } from "../engine/parse-ref-target.ts";
 export { parseRefTarget } from "../engine/parse-ref-target.ts";
 export type { FieldsOrGroupsSection, UnavailableSelectOption } from "../engine/screen-helpers.ts";
-export { availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.ts";
+export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.ts";
 export type { BooleanFieldDef, DateFieldDef, EmbeddedDerivedCellDef, EntityDefinition, FieldDefinition, FileFieldDef, FilesFieldDef, ImageFieldDef, ImagesFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, SelectFieldDef, SelectOptionTone, TextFieldDef, } from "../engine/types/fields.ts";
 export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, RoleAccessPersonalData, RoleAccessRule, } from "../engine/types/handlers.ts";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.ts";
@@ -20,5 +22,5 @@ export type { CardColumnRoles, CardRoleColumn } from "./card-column-roles.ts";
 export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.ts";
 export { type Formality, formalLocaleTag } from "./formality.ts";
 export type { ListRowMetaColumnType, ListRowMetaReference, ReferenceLookupSource, SystemReferenceLabel, } from "./list-row-meta.ts";
-export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, } from "./list-row-meta.ts";
+export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, UNRESOLVED_REFERENCE_LABEL_KEYS, } from "./list-row-meta.ts";
 export { type PluralForms, resolveTranslationValue, type TranslationValue, translationValueOtherText, } from "./plural.ts";

package/dist/ui-types/index.js

@@ -21,12 +21,13 @@
 // helper with no cross-module side-effects.
 export { NO_WIDGET_FIELD_TYPES } from "@cosmicdrift/kumiko-types/fields";
 export { computeDerivedCellValue, roundDerivedCellValue } from "../engine/embedded-derived.js";
+export { applyFormDerivations, isFormDerivationInputMode, isUnusedFallbackOperand, } from "../engine/form-derivations.js";
 export { parseRefTarget } from "../engine/parse-ref-target.js";
-export { availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
+export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
 export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
 export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.js";
 export { formalLocaleTag } from "./formality.js";
-export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, } from "./list-row-meta.js";
+export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, UNRESOLVED_REFERENCE_LABEL_KEYS, } from "./list-row-meta.js";
 export { resolveTranslationValue, translationValueOtherText, } from "./plural.js";

package/dist/ui-types/list-row-meta.d.ts

@@ -13,6 +13,9 @@ export type ReferenceLookupSource = {
 export declare const REFERENCE_LOOKUP_SOURCES: Readonly<Record<string, ReferenceLookupSource>>;
 export type SystemReferenceLabel = {
     readonly id: string;
+    /** Further literals that mean the same system identity (e.g. the "system" createdBy literal). */
+    readonly aliases?: readonly string[];
     readonly labelKey: string;
 };
 export declare const SYSTEM_REFERENCE_LABELS: Readonly<Record<string, SystemReferenceLabel>>;
+export declare const UNRESOLVED_REFERENCE_LABEL_KEYS: Readonly<Record<string, string>>;

package/dist/ui-types/list-row-meta.js

@@ -61,5 +61,16 @@ export const SYSTEM_REFERENCE_LABELS = {
     "tenant:tenant": { id: SYSTEM_TENANT_ID, labelKey: "kumiko.reference.system-tenant" },
     // createdBy on a system write (fw#3103) — SYSTEM_USER_ID is an alias for
     // "no human caller", so read_users never holds a matching row.
-    "user:user": { id: SYSTEM_USER_ID, labelKey: "kumiko.reference.system-user" },
+    "user:user": {
+        id: SYSTEM_USER_ID,
+        aliases: ["system"],
+        labelKey: "kumiko.reference.system-user",
+    },
+};
+// Label for a reference id that is neither a system identity nor has a
+// visible row (deleted user, seed actor, row outside the caller's scope).
+// Without it a reference cell falls back to the raw UUID. Opt-in per entity:
+// for entities whose id is meaningful to the reader the raw id stays.
+export const UNRESOLVED_REFERENCE_LABEL_KEYS = {
+    "user:user": "kumiko.reference.unknown-user",
 };

package/kumiko-es-tables.json

@@ -0,0 +1,6 @@
+[
+  {
+    "module": "files/file-ref-table",
+    "export": "fileRefsTable"
+  }
+]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.377.0",
+  "version": "0.379.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -199,7 +199,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.377.0",
+    "@cosmicdrift/kumiko-types": "0.379.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -215,7 +215,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.377.0",
+    "@cosmicdrift/kumiko-testing": "0.379.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },
@@ -394,6 +394,7 @@
   },
   "files": [
     "dist",
+    "kumiko-es-tables.json",
     "presets",
     "src/changes.json",
     "src/scripts/codemod",

package/src/changes.json

@@ -1,4 +1,146 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "PII backfill encrypts jsonb object and array fields",
+    "detail": "runPiiEventBackfill and backfillEventPiiEncryption now retro-encrypt plaintext jsonb objects and arrays of personal fields and personal jsonb scalars, and createPiiBackfillStateTable bootstraps under an advisory lock so concurrent first boots no longer skip the ALTER. Completed backfill states rerun once because the transform version changed."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "applyEntityEvent is exported from the db barrel, extension sources accept auto-verbs",
+    "detail": "applyEntityEvent can be used by extendEntityProjection apply handlers to project stored entity events of a foreign aggregate type. validateProjectionApplyKeys accepts the entity auto-verbs for an extension source that is not a registered entity."
+  },
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "SSE entity signals follow the read access of the connection",
+    "detail": "A signed-in connection receives an entity signal only when a query reading that entity lets one of its roles in (SseRouteOptions.entityReadAccess, built by collectEntityReadAccess). Entities without a reading query no longer go on the channel. When the reading access depends on a row or owner filter, the signal goes out without id and version, so a client refetches its query instead of learning which row changed.",
+    "migration": "Apps that rely on a signal for an entity no query exposes to the user must add a query for that entity with a matching access rule. Custom buildServer callers that build SseRouteOptions themselves must pass entityReadAccess."
+  },
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "Cause details only with NODE_ENV development or test",
+    "detail": "internal_error responses and write error infos carry the cause snapshot (name, message, stack) only when NODE_ENV is explicitly development or test. A missing or misspelled NODE_ENV no longer exposes stack traces, paths or upstream URLs. kumiko-dev starts the server with NODE_ENV=development when none is set, so local dev keeps the details; a dev script that runs the server directly (bun --watch bin/server.ts) must set NODE_ENV=development itself to see them."
+  },
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "Global IP rate-limit middleware default matches runProdApp",
+    "detail": "globalIpRateLimit defaults to 600 requests per 60 seconds (was 1000). DEFAULT_GLOBAL_RATE_LIMIT is exported from the api barrel and shared with server-runtime. authEndpointRateLimit keeps its default of 5 per 60 seconds.",
+    "migration": "Apps that use globalIpRateLimit directly and relied on 1000 pass limit explicitly. runProdApp users see no change."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Boot warning when /metrics is off in production",
+    "detail": "buildServer logs a warning in production when no metrics option is set, which happens when PROMETHEUS_METRICS_TOKEN is unset."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Package ships its event-store table catalog",
+    "detail": "kumiko-es-tables.json is included in the published files; no runtime change."
+  },
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "Direct writes on event-fed tables throw at runtime",
+    "detail": "buildEntityTable and r.projection mark their tables. insertOne, updateMany, deleteMany, the upsert and counter helpers, ctx.db write methods and db.global() writes throw AccessDeniedError on a marked table unless the runner carries the framework write capability. The executor, projection apply, rebuild, unsafeProjectionDelete, tenant-destroy hooks and deleteRowsWithoutReplayableStream hold it; ctx.db.unsafeRaw() never does. Retention deletes only rows whose stream is gone or archived. The cascade delete hook, the soft-delete purge jobs and seedReferenceData now write through the executor, so their effect survives a rebuild; cascade children are written as the system user, and softDelete children are soft-deleted instead of hard-deleted. The direct-entity-writes guard has no exceptions left.",
+    "migration": "Write event-fed rows through the executor (r.crud, ctx.write, createEventStoreExecutor). Projection apply functions must use the db they receive. Test seeds and teardown use seedRow, seedRows, updateRows, deleteRows and clearTables from kumiko-testing instead of hand-written wipe helpers. Do not pass ctx.db.unsafeRaw() to code that deletes event-fed rows; pass ctx.db inside a tenant-destroy hook. Retention code calls deleteRowsWithoutReplayableStream after pruning or archiving the events. seedReferenceData takes the registry instead of a table map. Affects kumiko-enterprise, kumiko-studio and solon."
+  },
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "Tests pin the money units of form derivations",
+    "detail": "form-derivations tests now cover realistic money values (1234,56 EUR plus 234,57 EUR, 0,10 plus 0,20) and minor-unit list cells; no behaviour change.",
+    "migration": "None."
+  },
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "A slow SSE client no longer buffers without bound",
+    "detail": "The SSE route tracks the writes a client has not consumed. A client whose queued frames make no progress for SSE_STALLED_CLIENT_TIMEOUT_MS (one heartbeat interval), or that queues SSE_MAX_PENDING_WRITES_PER_CLIENT frames, is aborted and unregistered; it reconnects and resyncs. A large broadcast batch does not drop a client that keeps reading, and one failing client no longer stops the broadcast to the others. SseRouteOptions.now makes the clock injectable."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Deprecations name their removal release",
+    "detail": "The three @deprecated APIs without a target release (the minor-units money accessor and the landingPath props of the invite and signup screens) now say they are removed in 0.390.0."
+  },
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "buildEntityTableMeta and observabilityOptions removed",
+    "detail": "buildEntityTableMeta was a deprecated alias of deriveEntityTableMeta. The deprecated observabilityOptions option of the entrypoint and the prod and worker runners is gone as well, it had no effect since the HTTP route label no longer carries a query string.",
+    "migration": "Rename buildEntityTableMeta to deriveEntityTableMeta (same signature). Delete observabilityOptions from the entrypoint and runner options, nothing replaces it."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "readDatabaseNow(db) in framework/db",
+    "detail": "Typed read of the Postgres clock for a TenantDb without unsafeRaw. Inside a transaction now() is the transaction start, so repeated reads agree."
+  },
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "SaveContext.event no longer reaches JSON responses",
+    "detail": "The event echoed on the SaveContext of create, update and restore is non-enumerable, so a handler returning the save result no longer leaks event data (PII) in its response; hooks and projections still read it by property."
+  },
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "Dashboard navigate params may bind a record",
+    "detail": "The boot validator accepts navigate params on a dashboard row action that has a record binding (record.param) but no filter; it still rejects params when the dashboard reads no filter, time range or record binding."
+  },
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "Re-export shim packages removed",
+    "detail": "The shims headless, dispatcher-live, renderer-web, http and repo-manifest are gone. Their code lives in kumiko-renderer (/headless, /live, /web), kumiko-framework (/http) and kumiko-guards (/repo-manifest).",
+    "migration": "Run bun kumiko-upgrade --apply, or bun kumiko codemod package-merge . --write. It rewrites the imports and package.json dependencies of all five shims to their target packages.",
+    "codemod": "scripts/codemod/package-merge.ts"
+  },
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "TenantDb.databaseNow",
+    "detail": "TenantDb has a databaseNow() method returning Postgres now(); custom TenantDb implementations must add it.",
+    "migration": "Add databaseNow(): Promise<Date> to hand-built TenantDb objects and mocks, returning the Postgres now()."
+  },
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "actionForm can derive head totals from an embedded list",
+    "detail": "An actionForm screen declares `derive` for head fields: sum, subtract, multiply, percent over other fields, or listSum over one cell of an embedded list with an optional whenEmpty fallback. The renderer recomputes them live and shows them read-only; a listSum without whenEmpty becomes an input while the list is empty. withFormDerivations(schema, screen) recomputes them on the server before validation, so client totals are never trusted; boot fails when the handler schema is not wrapped with the screen's own derive. A field that only feeds a `whenEmpty` fallback is read-only while the lists have rows. New embedded derived op `percent` (from[0] * from[1] / 100).",
+    "migration": "Add `derive` to the actionForm screen and wrap the handler schema with `withFormDerivations(schema, screen)`; new embedded derived op `percent`."
+  },
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "Extension-selector settings form is one standard configEdit screen",
+    "detail": "Without owner panels the provider form is the `<owner>-tenant` screen itself (no dashboard, no `<owner>-tenant-selection`). The provider select offers an empty \"platform default\" option next to the plugin ids."
+  },
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "Search index setup helpers",
+    "detail": "collectSearchableFieldNames(registry) returns the deduplicated searchable fields of all entities and configureTenantSearchIndex(adapter, registry, tenantId) configures a tenant index with them, both exported from the search entry."
+  },
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "TenantDb.advisoryXactLock",
+    "detail": "ctx.db.advisoryXactLock(namespace, key) takes a transaction-scoped pg_advisory_xact_lock keyed on the handle's own tenantId plus key, so tenants never contend and the caller cannot pick another tenant. It needs no unsafeRaw grant."
+  },
+  {
+    "version": "0.378.0",
+    "type": "breaking",
+    "title": "Boot check for projectionList writeHandler actions",
+    "detail": "Boot now rejects projectionList rowActions and toolbarActions of kind writeHandler whose handler is not a registered write-handler QN. Such actions only failed on click before.",
+    "migration": "Fix the handler QN to \"<feature>:write:<short>\" of a handler declared via r.writeHandler(...), or remove the action. Apps that fail to boot name the screen and action id in the error."
+  },
   {
     "version": "0.377.0",
     "type": "improvement",

package/src/scripts/codemod/README.md

@@ -165,3 +165,23 @@ bun node_modules/@cosmicdrift/kumiko-framework/src/scripts/codemod/package-merge
 
 Runs via `bun kumiko-upgrade --apply`. Without a mode flag it writes. `--check` exits 1 while any
 site is left. Run your package manager's install afterwards to refresh the lockfile.
+
+## feature-layout.ts
+
+Applies the feature layout rule "the runtime of a file follows from its path": everything
+under `src/features/<feature>/web/` is client code, the rest of the feature is server or
+isomorphic. Every file that carries a runtime-client marker outside `web/` moves to
+`<feature>/web/` (sub-structure kept), the relative imports, re-exports, `import()` calls and
+`mock.module` strings that point at it or out of it are rewritten, `package.json` export
+targets follow, and the marker is dropped. A marker the path already implies (client in
+`web/`, test in `__tests__/`) is only removed. Idempotent.
+
+```bash
+bun node_modules/@cosmicdrift/kumiko-framework/src/scripts/codemod/feature-layout.ts <dir> [--check | --dry-run | --write] [--no-format]
+```
+
+Features are found as `src/features/<feature>/` and `bundled-features/src/<feature>/` below
+`<dir>`; `--feature-dir <dir>` names a directory that is itself one feature and
+`--features-root <dir>` one whose children are features. A target that already exists in
+`web/` and a marker no path rule covers (for example `dev` outside `dev/`) are reported as
+`manual` and left alone. `--check` exits 1 while anything is left.

package/src/scripts/codemod/codemod-support.ts

@@ -180,7 +180,7 @@ function findBiomeBinary(startDir: string): string | undefined {
 
 const FORMAT_BATCH_SIZE = 50;
 
-async function formatWithBiome(
+export async function formatWithBiome(
   codemodName: string,
   files: readonly string[],
   cwd: string,