@cosmicdrift/kumiko-framework 0.388.0 → 0.389.0

package/dist/engine/feature-builder-state.js

@@ -57,6 +57,7 @@ export function createInitialFeatureBuilderState() {
         translations: {},
         isSystemScoped: false,
         toggleableDefault: undefined,
+        adoptsBundledLists: false,
         description: undefined,
         uiHints: undefined,
         treeActions: undefined,

package/dist/engine/feature-manifest.d.ts

@@ -40,6 +40,7 @@ export type ManifestFeature = {
     readonly name: string;
     readonly description: string | null;
     readonly toggleableDefault: boolean | null;
+    readonly adoptsBundledLists?: true;
     readonly requires: readonly string[];
     readonly optionalRequires: readonly string[];
     readonly configReads: readonly string[];

package/dist/engine/feature-manifest.js

@@ -59,6 +59,7 @@ export function buildManifestFromRegistry(registry, options) {
             name: feature.name,
             description: feature.description ?? null,
             toggleableDefault: feature.toggleableDefault ?? null,
+            ...(feature.adoptsBundledLists && { adoptsBundledLists: true }),
             requires: [...feature.requires],
             optionalRequires: [...feature.optionalRequires],
             configReads: [...feature.configReads],

package/dist/engine/field-access.d.ts

@@ -1,6 +1,7 @@
 import type { EntityDefinition, SessionUser } from "./types/index.ts";
 export declare function maskWriteOnlyFields<T extends Readonly<Record<string, unknown>>>(entity: EntityDefinition, row: T): T;
 export declare function dropEmptyWriteOnlyValues<T extends Readonly<Record<string, unknown>>>(entity: EntityDefinition, values: T): T;
+export declare function userMayReadFieldInBulk(entity: EntityDefinition, fieldName: string, user: Pick<SessionUser, "roles">): boolean;
 export declare function filterReadFields(entity: EntityDefinition, data: Readonly<Record<string, unknown>>, user: SessionUser): Record<string, unknown>;
 export declare function checkWriteFieldRoles(entity: EntityDefinition, changes: Readonly<Record<string, unknown>>, user: SessionUser): string | null;
 export declare function checkWriteFieldOwnership(entity: EntityDefinition, submittedChanges: Readonly<Record<string, unknown>>, user: SessionUser, oldRow?: Readonly<Record<string, unknown>>, rowContext?: Readonly<Record<string, unknown>>): string | null;

package/dist/engine/field-access.js

@@ -35,6 +35,18 @@ export function dropEmptyWriteOnlyValues(entity, values) {
         delete kept[name];
     return kept; // @cast-boundary engine-payload
 }
+// Role-level gate for bulk exports: false for writeOnly fields and for fields whose read-access
+// map grants none of the user's roles. Per-row ownership rules are not evaluated here; those
+// cells come back empty from the list query itself.
+export function userMayReadFieldInBulk(entity, fieldName, user) {
+    const field = entity.fields[fieldName];
+    if (!field)
+        return false;
+    if (field.type === "text" && field.writeOnly === true)
+        return false;
+    const accessMap = normalizeAccessEntry(field.access?.read);
+    return accessMap === undefined || user.roles.some((role) => accessMap[role] !== undefined);
+}
 // Field-level read filtering. Returns a copy of `data` with fields stripped
 // if the user's roles don't grant read access OR the ownership-rule for the
 // matching role doesn't accept this concrete row. Fields without access

package/dist/engine/index.d.ts

@@ -1,6 +1,7 @@
 export { handlerFieldLabelKey, handlerTitleKey } from "../i18n/required-surface-keys.ts";
 export { hasAccess } from "./access.ts";
 export { isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, type PrincipalProfile, type PrincipalStatus, type PrincipalStatusPlugin, TENANT_TEARDOWN_STATUSES, type TenantLifecycleStatusPlugin, } from "./active-membership.ts";
+export { validateBundledListsOptions } from "./boot-validator/bundled-lists-table.ts";
 export { PII_DIRECT_NAME_HINTS, PII_USER_OWNED_NAME_HINTS, PII_USER_REFERENCE_NAME_HINTS, } from "./boot-validator/entity-handler.ts";
 export { entityHasAnonymizableSubjectField } from "./boot-validator/pii-retention.ts";
 export { type CardMetaOverflow, collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.ts";
@@ -59,7 +60,6 @@ export { parseRefTarget, parseRefTargetEntityName } from "./parse-ref-target.ts"
 export { buildPipelineSteps, stepsPipeline } from "./pipeline.ts";
 export { projectAppSchemaForRoles } from "./project-app-schema-for-roles.ts";
 export { defineApply, defineMspApply, setFields } from "./projection-helpers.ts";
-export { providerPluginContextFromHandler, providerPluginContextFromJob, } from "./provider-plugin-context.ts";
 export type { BuiltinQnType, ParsedQn, QnType } from "./qualified-name.ts";
 export { isValidQn, parseQn, QnTypes, qn, toKebab } from "./qualified-name.ts";
 export { readClaim } from "./read-claim.ts";
@@ -87,7 +87,7 @@ export { assertNotificationVariables, templateVariable, templateVariablesToZod,
 export { type EffectiveFeaturesResolver, findTierResolverUsage, isTierResolverPlugin, requireTierResolverPlugin, TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin, type TrialGate, } from "./tier-resolver-extension.ts";
 export { findOverDeepTransferChain, resolveTransferAdjacency as resolveEntityTransferAdjacency, type TransferAdjacency, type TransferEdge, type TransferEdgeLink, } from "./transfer-adjacency.ts";
 export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID } from "./types/identifiers.ts";
-export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BootOptionName, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityObjectDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookDefinition, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDeferral, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, ProviderPluginContext, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StackBootRequirement, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.ts";
+export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BootOptionName, BundledListsOptions, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityObjectDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExpandableRowGrouping, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookDefinition, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDeferral, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, ListTableOptions, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StackBootRequirement, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.ts";
 export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HookPhases, HTTP_ERROR_CODE_PATTERN, isAgentVisibleScreen, isDeliveryErrorCode, isOpenToAllGranted, resolveAgentExposure, } from "./types/index.ts";
 export type { AwaitedEventType, PipelineBuildCtx, PipelineCtx, PipelineDef, StepBuilder, StepDef, StepFailureStrategy, StepInstance, StepKind, StepNamespace, StepResolver, } from "./types/step.ts";
 export { runValidation } from "./validation.ts";

package/dist/engine/index.js

@@ -2,6 +2,7 @@
 export { handlerFieldLabelKey, handlerTitleKey } from "../i18n/required-surface-keys.js";
 export { hasAccess } from "./access.js";
 export { isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, TENANT_TEARDOWN_STATUSES, } from "./active-membership.js";
+export { validateBundledListsOptions } from "./boot-validator/bundled-lists-table.js";
 export { PII_DIRECT_NAME_HINTS, PII_USER_OWNED_NAME_HINTS, PII_USER_REFERENCE_NAME_HINTS, } from "./boot-validator/entity-handler.js";
 export { entityHasAnonymizableSubjectField } from "./boot-validator/pii-retention.js";
 export { collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.js";
@@ -56,7 +57,6 @@ export { parseRefTarget, parseRefTargetEntityName } from "./parse-ref-target.js"
 export { buildPipelineSteps, stepsPipeline } from "./pipeline.js";
 export { projectAppSchemaForRoles } from "./project-app-schema-for-roles.js";
 export { defineApply, defineMspApply, setFields } from "./projection-helpers.js";
-export { providerPluginContextFromHandler, providerPluginContextFromJob, } from "./provider-plugin-context.js";
 export { isValidQn, parseQn, QnTypes, qn, toKebab } from "./qualified-name.js";
 export { readClaim } from "./read-claim.js";
 export { createRegistry } from "./registry.js";

package/dist/engine/pattern-library/library.js

@@ -14,12 +14,13 @@
 // the Designer/LLM relies on.
 import { aiClassifySchema, aiExtractSchema, aiGenerateSchema, authClaimsSchema, defineEventSchema, hookSchema, httpRouteSchema, jobSchema, multiStreamProjectionSchema, notificationSchema, projectionSchema, queryHandlerSchema, screenSchema, streamHandlerSchema, writeHandlerSchema, } from "./mixed-schemas.js";
 import { envSchemaSchema, exposesApiSchema, extendsRegistrarSchema, treeActionsSchema, unknownSchema, usesApiSchema, } from "./opaque-schemas.js";
-import { claimKeySchema, configSchema, describeSchema, entitySchema, metricSchema, navSchema, optionalRequiresSchema, readsConfigSchema, referenceDataSchema, relationSchema, requiresSchema, secretNamespaceSchema, secretSchema, systemScopeSchema, toggleableSchema, translationsSchema, uiHintsSchema, useExtensionSchema, workspaceSchema, } from "./static-schemas.js";
+import { adoptsBundledListsSchema, claimKeySchema, configSchema, describeSchema, entitySchema, metricSchema, navSchema, optionalRequiresSchema, readsConfigSchema, referenceDataSchema, relationSchema, requiresSchema, secretNamespaceSchema, secretSchema, systemScopeSchema, toggleableSchema, translationsSchema, uiHintsSchema, useExtensionSchema, workspaceSchema, } from "./static-schemas.js";
 export const PATTERN_LIBRARY = {
     requires: requiresSchema,
     optionalRequires: optionalRequiresSchema,
     readsConfig: readsConfigSchema,
     systemScope: systemScopeSchema,
+    adoptsBundledLists: adoptsBundledListsSchema,
     toggleable: toggleableSchema,
     describe: describeSchema,
     uiHints: uiHintsSchema,

package/dist/engine/pattern-library/static-schemas.d.ts

@@ -3,6 +3,7 @@ export declare const requiresSchema: PatternFormSchema;
 export declare const optionalRequiresSchema: PatternFormSchema;
 export declare const readsConfigSchema: PatternFormSchema;
 export declare const systemScopeSchema: PatternFormSchema;
+export declare const adoptsBundledListsSchema: PatternFormSchema;
 export declare const toggleableSchema: PatternFormSchema;
 export declare const describeSchema: PatternFormSchema;
 export declare const uiHintsSchema: PatternFormSchema;

package/dist/engine/pattern-library/static-schemas.js

@@ -59,6 +59,15 @@ export const systemScopeSchema = {
     singleton: true,
     fields: [],
 };
+export const adoptsBundledListsSchema = {
+    kind: "adoptsBundledLists",
+    label: { en: "Adopts bundled lists", de: "Übernimmt Bundled-Listen" },
+    summary: { en: "Feature packages only: takes the app-wide bundledLists table block." },
+    category: "meta",
+    editability: "opaque",
+    singleton: true,
+    fields: [],
+};
 export const toggleableSchema = {
     kind: "toggleable",
     label: { en: "Toggleable", de: "Umschaltbar" },

package/dist/engine/screen-filter-ops.js

@@ -28,6 +28,8 @@ export function getAllowedFilterOps(field) {
         case "select":
         case "multiSelect":
             return EQUALITY_ONLY;
+        case "reference":
+            return field.multiple === true ? EQUALITY_ONLY : [];
         case "boolean":
             return BOOL_OPS;
         case "number":

package/dist/engine/strip-disabled-features-from-app-schema.js

@@ -13,6 +13,7 @@
 // pointing at a missing nav; that is pruned here.
 import { createFallbackLogger, scrubLogText } from "../logging/index.js";
 import { resolveScreenTargetQn } from "./boot-validator/screens.js";
+import { workspaceOwnerOf } from "./build-app-schema.js";
 import { isToggleableFeature } from "./effective-features.js";
 import { isPureGroupingNav } from "./project-app-schema-for-roles.js";
 import { isValidQn, qualifyEntityName } from "./qualified-name.js";
@@ -141,10 +142,13 @@ export function stripDisabledFeaturesFromAppSchema(schema, registry, disabledFea
         const { navs: _navs, ...rest } = feature;
         return navs.length > 0 ? { ...rest, navs } : rest;
     });
-    // Workspace definitions carry the short id the author declared; the owning
-    // feature is only known to the registry.
+    // Workspace ids are unique per feature only, so the owner decides. A definition the build did
+    // not register (schema assembled elsewhere) falls back to the short id.
     const disabledWorkspaceIds = new Set(disabledFeatureNames.flatMap((featureName) => Object.keys(registry.features.get(featureName)?.workspaces ?? {})));
-    const workspaces = schema.workspaces?.filter((ws) => !disabledWorkspaceIds.has(ws.definition.id));
+    const workspaces = schema.workspaces?.filter((ws) => {
+        const owner = workspaceOwnerOf(ws.definition);
+        return owner === undefined ? !disabledWorkspaceIds.has(ws.definition.id) : !disabled.has(owner);
+    });
     const { workspaces: _original, ...restSchema } = schema;
     return {
         ...restSchema,

package/dist/engine/types/feature.d.ts

@@ -1 +1,2 @@
 export type * from "@cosmicdrift/kumiko-types/feature";
+export type * from "@cosmicdrift/kumiko-types/feature-registrar";

package/dist/engine/types/index.d.ts

@@ -4,10 +4,11 @@ export type { QueryHandlerDefinition, StreamHandlerDefinition, WriteHandlerDefin
 export type { EntityCrudRegistrar, EntityCrudVerb, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions, } from "@cosmicdrift/kumiko-types/entity-handlers";
 export type { KumikoEntityTypeMap, KumikoEventTypeMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, } from "@cosmicdrift/kumiko-types/event-type-map";
 export type { ExtensionOptionsArgs, ExtensionOptionsFor, KumikoExtensionOptionsMap, } from "@cosmicdrift/kumiko-types/extension-options-map";
-export type { BootCheckContext, BootCheckFn, BootOptionName, EntityObjectDefinition, FeatureDefinition, FeatureMetricDef, FeatureMetricType, FeatureRegistrar, HookDefinition, MetricOptions, Registry, SecretKeyDefinition, SecretKeyHandle, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, StackBootRequirement, StoreTableDef, StoreTableEntry, StoreTableOptions, UiHintOption, UiHints, } from "@cosmicdrift/kumiko-types/feature";
+export type { BootCheckContext, BootCheckFn, BootOptionName, FeatureDefinition, FeatureMetricDef, FeatureMetricType, MetricOptions, Registry, SecretKeyDefinition, SecretKeyHandle, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, StackBootRequirement, StoreTableDef, StoreTableEntry, StoreTableOptions, UiHintOption, UiHints, } from "@cosmicdrift/kumiko-types/feature";
+export type { EntityObjectDefinition, FeatureRegistrar, HookDefinition, } from "@cosmicdrift/kumiko-types/feature-registrar";
 export type { FieldIconKey } from "@cosmicdrift/kumiko-types/field-icon";
 export type { AnyFileFieldDef, BigIntFieldDef, BooleanFieldDef, ClientDerivedFieldDef, DateFieldDef, DecimalFieldDef, DefaultCurrency, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EmbeddedDerivedCellDef, EmbeddedFieldDef, EmbeddedSubFieldDef, EntityDefinition, EntityEventMigration, EntityFieldDefinition, EntityIndexDef, EntityLongTextFieldDef, EntityTextFieldDef, FieldAccess, FieldDefinition, FieldsMap, FileFieldDef, FilesFieldDef, Findability, ImageFieldDef, ImagesFieldDef, JsonbFieldDef, LocatedTimestampFieldDef, LongTextFieldDef, LongTextFindability, MoneyCurrencySource, MoneyFieldDef, MultiSelectFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, ReferenceFieldDef, ResolvedPiiFlags, ResolvedPiiStance, RetentionDef, SelectFieldDef, SelectOptionTone, TextFieldDef, TimestampFieldDef, TransitionMap, TzFieldDef, } from "@cosmicdrift/kumiko-types/fields";
-export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobDeferral, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadBucketNormalization, PayloadRateLimitOption, PreparedWriteEvent, ProviderPluginContext, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitOptions, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
+export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobDeferral, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadBucketNormalization, PayloadRateLimitOption, PreparedWriteEvent, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitOptions, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
 export { DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, declaredRateLimitOptions, HTTP_ERROR_CODE_PATTERN, isDeliveryErrorCode, isOpenToAllGranted, isRateLimitDisabled, isRateLimitOption, isUiAccessGranted, } from "@cosmicdrift/kumiko-types/handlers";
 export type { DeleteContext, EntityHookMap, HookMap, HookOwner, HookPhase, LifecycleHookFn, LifecycleResult, OwnedFn, PhasedHook, PostDeleteBatchHookFn, PostDeleteHookFn, PostQueryHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, SaveContext, SearchPayloadContributorFn, ValidationError, ValidationHookFn, } from "@cosmicdrift/kumiko-types/hooks";
 export type { HttpRouteDefinition, HttpRouteHandler, HttpRouteHandlerDeps, HttpRouteMethod, } from "@cosmicdrift/kumiko-types/http-route";
@@ -17,7 +18,7 @@ export type { ContentCollectionDefinition, NavDefinition, NavIconKey, } from "@c
 export type { FromRule, FromRuleKind, OwnershipClause, OwnershipMap, OwnershipRef, OwnershipRule, SqlFragment, WhereRule, WhereRuleContext, } from "@cosmicdrift/kumiko-types/ownership";
 export type { EntityProjectionExtension, MspErrorMode, MspErrorPolicy, MultiStreamApplyFn, MultiStreamProjectionDefinition, ProjectionDefinition, ProjectionRowIdOf, ProjectionTable, SingleStreamApplyFn, } from "@cosmicdrift/kumiko-types/projection";
 export type { BelongsToRelation, EntityRelations, HasManyRelation, ManyToManyRelation, RelationDefinition, } from "@cosmicdrift/kumiko-types/relations";
-export type { ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelGate, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, FieldCondition, FieldFormatRegistry, FieldRenderer, FormatSpec, FormFieldDerivation, FormWidth, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RecordHeaderSubtitlePart, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, UnitKey, } from "@cosmicdrift/kumiko-types/screen";
+export type { ActionFormScreenDefinition, BundledListsOptions, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelGate, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, ExpandableRowGrouping, FieldCondition, FieldFormatRegistry, FieldRenderer, FormatSpec, FormFieldDerivation, FormWidth, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, ListTableOptions, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RecordHeaderSubtitlePart, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, UnitKey, } from "@cosmicdrift/kumiko-types/screen";
 export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
 export type { TargetRef } from "@cosmicdrift/kumiko-types/target-ref";
 export type { Subscribe, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, } from "@cosmicdrift/kumiko-types/tree-node";

package/dist/engine/types/screen.d.ts

@@ -1,2 +1,2 @@
 export type * from "@cosmicdrift/kumiko-types/screen";
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
+export { DEFAULT_EXPORT_MAX_ROWS, LIST_BULK_ACTION_KEYS, LIST_COLUMN_PINS, LIST_TABLE_DENSITIES, LIST_TABLE_DENSITY_KEYS, LIST_TABLE_EXPORT_KEYS, LIST_TABLE_GROUPING_KEYS, LIST_TABLE_OPTION_KEYS, LIST_TABLE_TOTAL_KEYS, MAX_BULK_SELECTION, MAX_EXPORT_MAX_ROWS, relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";

package/dist/engine/types/screen.js

@@ -1 +1 @@
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
+export { DEFAULT_EXPORT_MAX_ROWS, LIST_BULK_ACTION_KEYS, LIST_COLUMN_PINS, LIST_TABLE_DENSITIES, LIST_TABLE_DENSITY_KEYS, LIST_TABLE_EXPORT_KEYS, LIST_TABLE_GROUPING_KEYS, LIST_TABLE_OPTION_KEYS, LIST_TABLE_TOTAL_KEYS, MAX_BULK_SELECTION, MAX_EXPORT_MAX_ROWS, relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";

package/dist/entrypoint/index.d.ts

@@ -63,6 +63,7 @@ export type ApiEntrypoint = {
     readonly lifecycle: Lifecycle;
     readonly observability: ObservabilityProvider;
     readonly dispatcher: Dispatcher;
+    readonly context: AppContext;
     readonly lifecycleHooks: LifecycleHooks;
     readonly eventDispatcher?: EventDispatcher;
     readonly mode: "api";
@@ -74,6 +75,7 @@ export type WorkerEntrypoint = {
     readonly eventDispatcher: EventDispatcher;
     readonly jobRunner: JobRunner;
     readonly observability: ObservabilityProvider;
+    readonly context: AppContext;
     readonly dispatcher: Dispatcher;
     readonly mode: "worker";
     start(): Promise<void>;

package/dist/entrypoint/index.js

@@ -244,6 +244,7 @@ export function createApiEntrypoint(options) {
         lifecycle,
         observability: server.observability,
         dispatcher: server.dispatcher,
+        context: server.context,
         lifecycleHooks: server.lifecycleHooks,
         ...(server.eventDispatcher && { eventDispatcher: server.eventDispatcher }),
         mode: "api",
@@ -279,6 +280,7 @@ export function createWorkerEntrypoint(options) {
         jobRunner,
         observability: server.observability,
         dispatcher: server.dispatcher,
+        context: server.context,
         mode: "worker",
         async start() {
             await eventDispatcher.start();
@@ -324,6 +326,7 @@ export function createAllInOneEntrypoint(options) {
         jobRunner: workerJobRunner,
         observability: server.observability,
         dispatcher: server.dispatcher,
+        context: server.context,
         lifecycleHooks: server.lifecycleHooks,
         mode: "all-in-one",
         async start() {

package/dist/event-store/event-store.d.ts

@@ -19,6 +19,7 @@ export declare function append(db: DbRunner, event: EventToAppend): Promise<Stor
 export declare function loadAggregate(db: DbRunner, aggregateId: string, tenantId: TenantId, options?: {
     readonly includeArchived?: boolean;
     readonly aggregateType?: string;
+    readonly atVersion?: number;
 }): Promise<readonly StoredEvent[]>;
 export declare function loadAggregateForWriting(db: DbRunner, aggregateId: string, tenantId: TenantId, options: {
     readonly aggregateType: string;

package/dist/event-store/event-store.js

@@ -213,9 +213,12 @@ export async function loadAggregate(db, aggregateId, tenantId, options) {
         if (archived)
             return [];
     }
-    const rows = await selectMany(db, eventsTable, options?.aggregateType !== undefined
-        ? { aggregateId, tenantId, aggregateType: options.aggregateType }
-        : { aggregateId, tenantId }, { orderBy: { col: "version", direction: "asc" } });
+    const rows = await selectMany(db, eventsTable, {
+        aggregateId,
+        tenantId,
+        ...(options?.aggregateType !== undefined && { aggregateType: options.aggregateType }),
+        ...(options?.atVersion !== undefined && { version: options.atVersion }),
+    }, { orderBy: { col: "version", direction: "asc" } });
     return rows.map(toStoredEvent);
 }
 // Events and the stream's latest version from ONE read, so both come from the same
@@ -311,7 +314,7 @@ export async function loadEventsAfterVersion(db, aggregateId, tenantId, afterVer
 // abort iteration. Checked both at batch boundaries (before the next
 // fetch) AND between yields (so abort lands within one event regardless
 // of batch size). Throws AbortError on the first check after abort;
-// in-flight queries are not actively cancelled (postgres-js connection-
+// in-flight queries are not actively cancelled (connection
 // cancel is a separate, riskier concern handled per-query at the TenantDb
 // boundary).
 export async function* streamAllEventsByType(db, aggregateType, batchSize = 1000, signal) {

package/dist/event-store/provenance-append.js

@@ -32,7 +32,7 @@ export async function appendProvenanceEvent(db, event) {
             message: `appendProvenanceEvent: event tenant "${event.tenantId}" does not match the TenantDb's tenant "${db.tenantId}".`,
         });
     }
-    // postgres-js aborts the whole surrounding begin() on a statement
+    // Postgres aborts the whole surrounding transaction on a statement
     // error (25P02) even when the caller's catch swallows it — the savepoint
     // confines that to this scope. Pool connections have no ambient tx to poison.
     await runInSavepointIfSupported(runner, async (sp) => {

package/dist/files/create-file-ref-from-bytes.js

@@ -46,6 +46,9 @@ export async function createFileRefFromBytes(ctx, input) {
             return fileRejectedFailure(outcome.error);
         case "failed":
             return outcome.failure;
+        case "target-locked":
+            // Only the HTTP route supplies the lock re-check, so this path cannot produce it.
+            return writeFailure(new InternalError({ message: "createFileRefFromBytes: unexpected target-locked outcome" }));
     }
 }
 function fileRejectedFailure(error) {

package/dist/files/create-file-ref.d.ts

@@ -50,6 +50,7 @@ export type StoreFileDeps = {
     readonly defaultMaxUploadSize: string;
     readonly writeBytes: (storageKey: string, data: Uint8Array, mimeType: string) => Promise<void>;
     readonly deleteBytes: (storageKey: string) => Promise<void>;
+    readonly isAttachTargetLocked?: (rowDb: TenantDb) => Promise<boolean>;
 };
 export type CreatedFileRef = {
     readonly id: string;
@@ -80,6 +81,8 @@ export type StoreFileOutcome = {
 } | {
     readonly kind: "rejected";
     readonly error: string;
+} | {
+    readonly kind: "target-locked";
 } | {
     readonly kind: "failed";
     readonly failure: WriteFailure;

package/dist/files/create-file-ref.js

@@ -41,6 +41,8 @@ export function resolveAttachedField(registry, entityType, fieldName) {
         return { kind: "unresolvable" };
     return { kind: "resolved", fieldDef };
 }
+class AttachTargetLockedError extends Error {
+}
 function resolveUploadField(registry, input) {
     const { entityType, entityId, fieldName, actionForm } = input;
     if (actionForm === undefined)
@@ -196,14 +198,21 @@ export async function storeFileAsFileRef(deps, input) {
             // skip: the create failure is the error worth reporting; the leftover bytes stay in storage.
         }
     };
+    const createRow = async (rowDb) => {
+        if (await deps.isAttachTargetLocked?.(rowDb))
+            throw new AttachTargetLockedError();
+        return createFileRefRow({ user: deps.user, tenantDb: rowDb }, upload.uploaded);
+    };
     let row;
     try {
         row = deps.rowInOwnTransaction
-            ? await runInOwnTransaction(deps.tenantDb, (txDb) => createFileRefRow({ user: deps.user, tenantDb: txDb }, upload.uploaded))
-            : await createFileRefRow(deps, upload.uploaded);
+            ? await runInOwnTransaction(deps.tenantDb, createRow)
+            : await createRow(deps.tenantDb);
     }
     catch (e) {
         await deleteUploadedBytes();
+        if (e instanceof AttachTargetLockedError)
+            return { kind: "target-locked" };
         throw e;
     }
     if ("failure" in row) {

package/dist/files/file-routes.d.ts

@@ -1,3 +1,4 @@
+import type { RateLimitResolver } from "@cosmicdrift/kumiko-types/rate-limit-types";
 import type { WriteErrorInfo } from "@cosmicdrift/kumiko-types/write-error-info-types";
 import { Hono } from "hono";
 import type { DbConnection } from "../db/connection.ts";
@@ -30,6 +31,7 @@ export type FileAccessGuard = (args: {
 }) => FileAccessDecision | Promise<FileAccessDecision>;
 export type FileRoutesOptions = {
     readonly db: DbConnection;
+    readonly metaBatchRateLimitResolver?: RateLimitResolver;
     readonly resolveProvider: FileProviderResolver;
     readonly registry?: Registry;
     readonly maxUploadSize?: string;

package/dist/files/file-routes.js

@@ -9,13 +9,14 @@ import { createProjectingTenantDb } from "../db/tenant-db.js";
 import { createDerivativesContext, resolveFieldVariant, resolveRenderer, } from "../derivatives/index.js";
 import { isAnonymousSessionUser, SYSTEM_USER_ID } from "../engine/system-user.js";
 import { isFileField, isUuid, } from "../engine/types/index.js";
+import { createFailOpenReporter, respondRateLimited } from "../rate-limit/middleware.js";
 import { listActionFormFileFields, mayUseActionForm } from "./action-form-upload.js";
 import { buildContentDispositionHeader } from "./content-disposition.js";
 import { DEFAULT_MAX_UPLOAD_SIZE, getFileRefExecutor, storeFileAsFileRef, } from "./create-file-ref.js";
 import { createFileContext, createTenantFileContext } from "./file-handle.js";
 import { fileRefEntity } from "./file-ref-entity.js";
 import { fileRefsTable } from "./file-ref-table.js";
-import { RecordWriteDecisions } from "./record-write-check.js";
+import { isStoredRecordLocked, RecordWriteDecisions, } from "./record-write-check.js";
 import { neutralFileNameForMimeType } from "./resolve-content-type.js";
 import { parseMaxSize, resolveServedContentType } from "./types.js";
 import { withUploadLedger } from "./upload-ledger.js";
@@ -31,6 +32,8 @@ const DEFAULT_PRIVILEGED_ROLES = ["Admin", "SystemAdmin"];
 // credential (see "Signed-URL default expiry" in core-files.md).
 const SIGNED_URL_DEFAULT_EXPIRY_SECONDS = 15 * 60;
 const MAX_BATCH_META_IDS = 100;
+const META_BATCH_IDS_PER_WINDOW = 1_000;
+const META_BATCH_WINDOW_SECONDS = 60;
 // Each detail() read decrypts through the KMS pool; a bounded chunk keeps one batch from hogging it.
 const BATCH_META_CONCURRENCY = 10;
 // Default guard: on attached files, allow the uploader or a privileged role,
@@ -101,7 +104,8 @@ export function readFilesRouteOptions(registry) {
     return {};
 }
 export function createFileRoutes(options) {
-    const { db } = options;
+    const { db, metaBatchRateLimitResolver } = options;
+    const reportMetaBatchLimiterFailOpen = createFailOpenReporter("files-meta-batch");
     // Plain resolvers (not built via withFileProviderResolver) get the ledger on the route's own root connection.
     const resolveProvider = options.resolveProvider.uploadLedgerFor
         ? options.resolveProvider
@@ -205,6 +209,10 @@ export function createFileRoutes(options) {
         }
         const data = new Uint8Array(await file.arrayBuffer());
         const files = createTenantFileContext(resolveProvider, user.tenantId);
+        const { registry } = options;
+        const isAttachTargetLocked = registry !== undefined && entityType !== undefined && entityId !== undefined
+            ? (rowDb) => isStoredRecordLocked({ registry, db: rowDb, entityType, entityId })
+            : undefined;
         const outcome = await storeFileAsFileRef({
             user,
             tenantDb: tenantDbFor(user.tenantId),
@@ -216,6 +224,7 @@ export function createFileRoutes(options) {
                 await files.ref(key).delete();
                 await files.forgetUploadBytes(key);
             },
+            ...(isAttachTargetLocked ? { isAttachTargetLocked } : {}),
         }, {
             fileName: file.name,
             declaredMimeType: file.type,
@@ -227,6 +236,9 @@ export function createFileRoutes(options) {
         });
         if (outcome.kind === "rejected")
             return c.json({ error: outcome.error }, 400);
+        if (outcome.kind === "target-locked") {
+            return c.json({ error: "record_locked: the record is locked" }, 409);
+        }
         if (outcome.kind === "failed")
             return c.json({ error: "upload_failed" }, 500);
         return c.json(outcome.fileRef, 201);
@@ -240,6 +252,21 @@ export function createFileRoutes(options) {
         const ids = [...new Set((c.req.query("ids") ?? "").split(",").filter((id) => isUuid(id)))];
         if (ids.length > MAX_BATCH_META_IDS)
             return c.json({ error: "too_many_ids" }, 400);
+        if (metaBatchRateLimitResolver && ids.length > 0) {
+            const bucket = `files-meta:${user.tenantId}:${user.id}`;
+            try {
+                const decision = await metaBatchRateLimitResolver.check(bucket, {
+                    limit: META_BATCH_IDS_PER_WINDOW,
+                    windowSeconds: META_BATCH_WINDOW_SECONDS,
+                    cost: ids.length,
+                });
+                if (!decision.allowed)
+                    return respondRateLimited(c, decision, bucket);
+            }
+            catch (e) {
+                reportMetaBatchLimiterFailOpen(e);
+            }
+        }
         const files = [];
         for (let start = 0; start < ids.length; start += BATCH_META_CONCURRENCY) {
             const chunk = ids.slice(start, start + BATCH_META_CONCURRENCY);

package/dist/files/provider-resolver.d.ts

@@ -56,5 +56,6 @@ export type FileProviderResolverDeps = {
     readonly secrets?: SecretsContext;
     readonly db?: DbConnection | TenantDb;
     readonly cacheSync?: CacheSyncBus;
+    readonly now?: () => Temporal.Instant;
 };
 export declare function makeFileProviderResolver(deps: FileProviderResolverDeps): FileProviderResolver;

package/dist/files/provider-resolver.js

@@ -119,5 +119,5 @@ export function makeFileProviderResolver(deps) {
         cache.set(tenantId, built);
         return built;
     };
-    return deps.db ? withUploadLedger(resolveProvider, deps.db) : resolveProvider;
+    return deps.db ? withUploadLedger(resolveProvider, deps.db, deps.now) : resolveProvider;
 }

package/dist/files/record-write-check.d.ts

@@ -20,3 +20,9 @@ export declare function createRecordWriteCheck(args: {
     readonly canReadRecord: RecordReadCheck;
     readonly tenantDbFor: (tenantId: TenantId) => TenantDb;
 }): RecordWriteCheck;
+export declare function isStoredRecordLocked(args: {
+    readonly registry: Registry;
+    readonly db: TenantDb;
+    readonly entityType: string;
+    readonly entityId: string;
+}): Promise<boolean>;

package/dist/files/record-write-check.js

@@ -62,3 +62,16 @@ export function createRecordWriteCheck(args) {
         return RecordWriteDecisions.writable;
     };
 }
+// The stored row, read through the given db so a transaction sees the lock state it commits against.
+export async function isStoredRecordLocked(args) {
+    const { registry, db, entityType, entityId } = args;
+    const entity = registry.getEntity(entityType);
+    const table = findImplicitEntityTable(registry, entityType);
+    if (!entity || !table || entity.lockedWhen === undefined)
+        return false;
+    const row = await db.fetchOne(table, {
+        id: entityId,
+        ...(entity.softDelete === true && { isDeleted: false }),
+    });
+    return row !== undefined && isRecordLocked(entity.lockedWhen, row);
+}

package/dist/files/upload-ledger.d.ts

@@ -5,6 +5,6 @@ import type { TenantId } from "@cosmicdrift/kumiko-types/identifiers";
 import type { DbConnection } from "../db/connection.ts";
 import { type TenantDb } from "../db/tenant-db.ts";
 export declare const fileUploadLedgerTable: WritableTable;
-export declare function createFileUploadLedger(db: DbConnection | TenantDb, tenantId: TenantId): FileUploadLedger;
-export declare function withUploadLedger(resolver: (tenantId: TenantId) => Promise<FileStorageProvider>, db: DbConnection | TenantDb): FileProviderResolver;
+export declare function createFileUploadLedger(db: DbConnection | TenantDb, tenantId: TenantId, now?: () => Temporal.Instant): FileUploadLedger;
+export declare function withUploadLedger(resolver: (tenantId: TenantId) => Promise<FileStorageProvider>, db: DbConnection | TenantDb, now?: () => Temporal.Instant): FileProviderResolver;
 export declare function takeUploadLedgerEntry(txDb: TenantDb, storageKey: string): Promise<boolean>;

package/dist/files/upload-ledger.js

@@ -21,7 +21,7 @@ function isTenantDb(db) {
 }
 // The ledger writes on a connection of its own, never on a handler transaction: a rollback of the
 // handler must not take the row with it, or the bytes it uploaded would be unfindable.
-export function createFileUploadLedger(db, tenantId) {
+export function createFileUploadLedger(db, tenantId, now = () => Temporal.Now.instant()) {
     const runner = isTenantDb(db) ? tenantDbRunner(db) : db;
     if (!runnerCanBeginTransaction(runner)) {
         throw new InternalError({
@@ -34,7 +34,7 @@ export function createFileUploadLedger(db, tenantId) {
             await ledgerDb.insertOne(fileUploadLedgerTable, {
                 storageKey,
                 tenantId,
-                createdAt: Temporal.Now.instant(),
+                createdAt: now(),
             });
         },
         forget: async (storageKey) => {
@@ -42,9 +42,9 @@ export function createFileUploadLedger(db, tenantId) {
         },
     };
 }
-export function withUploadLedger(resolver, db) {
+export function withUploadLedger(resolver, db, now) {
     return Object.assign(resolver, {
-        uploadLedgerFor: (tenantId) => createFileUploadLedger(db, tenantId),
+        uploadLedgerFor: (tenantId) => createFileUploadLedger(db, tenantId, now),
     });
 }
 // Runs inside the transaction that creates the fileRef row. False means no ledger row was left to