@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/files/file-routes.js

@@ -1,3 +1,4 @@
+import { isUuid } from "@cosmicdrift/kumiko-types/identifiers";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
@@ -5,17 +6,20 @@ import { getUser } from "../api/auth-middleware.js";
 import { requestContext } from "../api/request-context.js";
 import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
 import { selectMany } from "../db/query.js";
+import { runInRowLevelSecurityScope, tenantRowLevelSecurityScope, } from "../db/row-level-security-scope.js";
 import { createProjectingTenantDb } from "../db/tenant-db.js";
-import { createDerivativesContext, resolveFieldVariant, resolveRenderer, } from "../derivatives/index.js";
+import { createDerivativesContext, resolveRenderer } from "../derivatives/derivatives-context.js";
+import { resolveFieldVariant } from "../derivatives/index.js";
+import { isFileField } from "../engine/field-helpers.js";
 import { isAnonymousSessionUser, SYSTEM_USER_ID } from "../engine/system-user.js";
-import { isFileField, isUuid, } from "../engine/types/index.js";
+import { createFailOpenReporter, respondRateLimited } from "../rate-limit/middleware.js";
 import { listActionFormFileFields, mayUseActionForm } from "./action-form-upload.js";
 import { buildContentDispositionHeader } from "./content-disposition.js";
 import { DEFAULT_MAX_UPLOAD_SIZE, getFileRefExecutor, storeFileAsFileRef, } from "./create-file-ref.js";
 import { createFileContext, createTenantFileContext } from "./file-handle.js";
 import { fileRefEntity } from "./file-ref-entity.js";
 import { fileRefsTable } from "./file-ref-table.js";
-import { RecordWriteDecisions } from "./record-write-check.js";
+import { isStoredRecordLocked, RecordWriteDecisions, } from "./record-write-check.js";
 import { neutralFileNameForMimeType } from "./resolve-content-type.js";
 import { parseMaxSize, resolveServedContentType } from "./types.js";
 import { withUploadLedger } from "./upload-ledger.js";
@@ -31,6 +35,8 @@ const DEFAULT_PRIVILEGED_ROLES = ["Admin", "SystemAdmin"];
 // credential (see "Signed-URL default expiry" in core-files.md).
 const SIGNED_URL_DEFAULT_EXPIRY_SECONDS = 15 * 60;
 const MAX_BATCH_META_IDS = 100;
+const META_BATCH_IDS_PER_WINDOW = 1_000;
+const META_BATCH_WINDOW_SECONDS = 60;
 // Each detail() read decrypts through the KMS pool; a bounded chunk keeps one batch from hogging it.
 const BATCH_META_CONCURRENCY = 10;
 // Default guard: on attached files, allow the uploader or a privileged role,
@@ -101,7 +107,8 @@ export function readFilesRouteOptions(registry) {
     return {};
 }
 export function createFileRoutes(options) {
-    const { db } = options;
+    const { db, metaBatchRateLimitResolver } = options;
+    const reportMetaBatchLimiterFailOpen = createFailOpenReporter("files-meta-batch");
     // Plain resolvers (not built via withFileProviderResolver) get the ledger on the route's own root connection.
     const resolveProvider = options.resolveProvider.uploadLedgerFor
         ? options.resolveProvider
@@ -112,6 +119,13 @@ export function createFileRoutes(options) {
     const executor = getFileRefExecutor();
     const piiSubjectFields = collectPiiSubjectFields(fileRefEntity);
     const api = new Hono();
+    // These routes read the file table on the root connection, outside the dispatcher, so the caller's tenant scope is opened here.
+    api.use("*", async (c, next) => {
+        const user = getUser(c);
+        if (user === undefined)
+            return next();
+        return runInRowLevelSecurityScope(tenantRowLevelSecurityScope(user.tenantId), next);
+    });
     const tenantDbFor = (tenantId) => createProjectingTenantDb(db, tenantId, options.registry);
     const fileNameIsPersonal = piiSubjectFields.includes("fileName");
     function kmsContextFor() {
@@ -205,6 +219,10 @@ export function createFileRoutes(options) {
         }
         const data = new Uint8Array(await file.arrayBuffer());
         const files = createTenantFileContext(resolveProvider, user.tenantId);
+        const { registry } = options;
+        const isAttachTargetLocked = registry !== undefined && entityType !== undefined && entityId !== undefined
+            ? (rowDb) => isStoredRecordLocked({ registry, db: rowDb, entityType, entityId })
+            : undefined;
         const outcome = await storeFileAsFileRef({
             user,
             tenantDb: tenantDbFor(user.tenantId),
@@ -216,6 +234,7 @@ export function createFileRoutes(options) {
                 await files.ref(key).delete();
                 await files.forgetUploadBytes(key);
             },
+            ...(isAttachTargetLocked ? { isAttachTargetLocked } : {}),
         }, {
             fileName: file.name,
             declaredMimeType: file.type,
@@ -227,6 +246,9 @@ export function createFileRoutes(options) {
         });
         if (outcome.kind === "rejected")
             return c.json({ error: outcome.error }, 400);
+        if (outcome.kind === "target-locked") {
+            return c.json({ error: "record_locked: the record is locked" }, 409);
+        }
         if (outcome.kind === "failed")
             return c.json({ error: "upload_failed" }, 500);
         return c.json(outcome.fileRef, 201);
@@ -240,6 +262,21 @@ export function createFileRoutes(options) {
         const ids = [...new Set((c.req.query("ids") ?? "").split(",").filter((id) => isUuid(id)))];
         if (ids.length > MAX_BATCH_META_IDS)
             return c.json({ error: "too_many_ids" }, 400);
+        if (metaBatchRateLimitResolver && ids.length > 0) {
+            const bucket = `files-meta:${user.tenantId}:${user.id}`;
+            try {
+                const decision = await metaBatchRateLimitResolver.check(bucket, {
+                    limit: META_BATCH_IDS_PER_WINDOW,
+                    windowSeconds: META_BATCH_WINDOW_SECONDS,
+                    cost: ids.length,
+                });
+                if (!decision.allowed)
+                    return respondRateLimited(c, decision, bucket);
+            }
+            catch (e) {
+                reportMetaBatchLimiterFailOpen(e);
+            }
+        }
         const files = [];
         for (let start = 0; start < ids.length; start += BATCH_META_CONCURRENCY) {
             const chunk = ids.slice(start, start + BATCH_META_CONCURRENCY);

package/dist/files/index.d.ts

@@ -1,25 +1,23 @@
 export { listActionFormFileFields, resolveActionFormFileField } from "./action-form-upload.ts";
-export type { BindPendingFileRefOutcome, PendingFileRef, PendingFileRefBindTarget, } from "./bind-pending-file-refs.ts";
+export type { PendingFileRef } from "./bind-pending-file-refs.ts";
 export { bindPendingFileRef, loadPendingFileRef } from "./bind-pending-file-refs.ts";
-export type { CreatedFileRef, CreateFileRefContext, CreateFileRefInput, UploadedFileBytes, UploadFileBytesContext, } from "./create-file-ref-from-bytes.ts";
+export type { CreatedFileRef, CreateFileRefInput, UploadedFileBytes, } from "./create-file-ref-from-bytes.ts";
 export { createFileRefFromBytes, createFileRefFromUploadedBytes, uploadFileBytesBeforeTransaction, } from "./create-file-ref-from-bytes.ts";
 export { createFilesFeature, FILES_FEATURE } from "./feature.ts";
-export type { FileContext, FileHandle } from "./file-handle.ts";
+export type { FileContext } from "./file-handle.ts";
 export { createFileContext, createTenantFileContext, deriveKey, storageKeyStemPrefix, } from "./file-handle.ts";
 export { FILE_REF_ENTITY_NAME, fileRefEntity } from "./file-ref-entity.ts";
 export { fileRefsTable } from "./file-ref-table.ts";
-export type { FileAccessDecision, FileAccessGuard, FileRef, FileRoutesOptions, } from "./file-routes.ts";
-export { createFileRoutes, readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.ts";
+export type { FileAccessGuard } from "./file-routes.ts";
+export { readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.ts";
 export type { InMemoryFileProvider } from "./in-memory-provider.ts";
 export { createInMemoryFileProvider } from "./in-memory-provider.ts";
 export { createLocalProvider } from "./local-provider.ts";
-export type { FileProviderContext, FileProviderPlugin, FileProviderResolver, FileProviderResolverDeps, } from "./provider-resolver.ts";
-export { createFileProviderForTenant, isFileProviderPlugin, makeFileProviderResolver, } from "./provider-resolver.ts";
-export { resolveContentType } from "./resolve-content-type.ts";
-export { fileRefStorageDelta, filesStorageTrackingFeature, tenantStorageUsageTable, transferTenantStorageUsage, } from "./storage-tracking.ts";
-export { DEFAULT_UPLOAD_SWEEP_GRACE_HOURS, MIN_UPLOAD_SWEEP_GRACE_HOURS, sweepOrphanedUploads, } from "./sweep-orphaned-uploads.ts";
-export type { FileContentValidationResult, FileMetadata, FileStorageProvider, FileValidationOptions, SignedUrlOptions, UploadMimeTypeResolution, WriteStreamOptions, } from "./types.ts";
-export { assertSafeStorageKey, buildStorageKey, normalizeMimeType, parseMaxSize, resolveUploadMimeType, sniffMimeType, tenantExportPrefix, tenantStoragePrefixes, validateFile, validateFileContent, } from "./types.ts";
-export { createFileUploadLedger, fileUploadLedgerTable, withUploadLedger, } from "./upload-ledger.ts";
+export type { FileProviderContext, FileProviderPlugin, FileProviderResolver, } from "./provider-resolver.ts";
+export { createFileProviderForTenant, isFileProviderPlugin, } from "./provider-resolver.ts";
+export { filesStorageTrackingFeature, tenantStorageUsageTable, transferTenantStorageUsage, } from "./storage-tracking.ts";
+export type { FileStorageProvider, SignedUrlOptions, } from "./types.ts";
+export { assertSafeStorageKey, buildStorageKey, normalizeMimeType, sniffMimeType, tenantExportPrefix, tenantStoragePrefixes, validateFile, } from "./types.ts";
+export { fileUploadLedgerTable, withUploadLedger, } from "./upload-ledger.ts";
 export type { ZipEntry } from "./zip-stream.ts";
 export { createZipStream } from "./zip-stream.ts";

package/dist/files/index.js

@@ -7,13 +7,11 @@ export { createFilesFeature, FILES_FEATURE } from "./feature.js";
 export { createFileContext, createTenantFileContext, deriveKey, storageKeyStemPrefix, } from "./file-handle.js";
 export { FILE_REF_ENTITY_NAME, fileRefEntity } from "./file-ref-entity.js";
 export { fileRefsTable } from "./file-ref-table.js";
-export { createFileRoutes, readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.js";
+export { readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.js";
 export { createInMemoryFileProvider } from "./in-memory-provider.js";
 export { createLocalProvider } from "./local-provider.js";
-export { createFileProviderForTenant, isFileProviderPlugin, makeFileProviderResolver, } from "./provider-resolver.js";
-export { resolveContentType } from "./resolve-content-type.js";
-export { fileRefStorageDelta, filesStorageTrackingFeature, tenantStorageUsageTable, transferTenantStorageUsage, } from "./storage-tracking.js";
-export { DEFAULT_UPLOAD_SWEEP_GRACE_HOURS, MIN_UPLOAD_SWEEP_GRACE_HOURS, sweepOrphanedUploads, } from "./sweep-orphaned-uploads.js";
-export { assertSafeStorageKey, buildStorageKey, normalizeMimeType, parseMaxSize, resolveUploadMimeType, sniffMimeType, tenantExportPrefix, tenantStoragePrefixes, validateFile, validateFileContent, } from "./types.js";
-export { createFileUploadLedger, fileUploadLedgerTable, withUploadLedger, } from "./upload-ledger.js";
+export { createFileProviderForTenant, isFileProviderPlugin, } from "./provider-resolver.js";
+export { filesStorageTrackingFeature, tenantStorageUsageTable, transferTenantStorageUsage, } from "./storage-tracking.js";
+export { assertSafeStorageKey, buildStorageKey, normalizeMimeType, sniffMimeType, tenantExportPrefix, tenantStoragePrefixes, validateFile, } from "./types.js";
+export { fileUploadLedgerTable, withUploadLedger, } from "./upload-ledger.js";
 export { createZipStream } from "./zip-stream.js";

package/dist/files/load-save-file-refs.d.ts

@@ -1,5 +1,6 @@
+import type { SaveContext } from "@cosmicdrift/kumiko-types/hooks";
 import type { TenantDb } from "../db/tenant-db.ts";
-import { type Registry, type SaveContext, type SessionUser } from "../engine/types/index.ts";
+import type { Registry, SessionUser } from "../engine/types/index.ts";
 export type FileRefRows = ReadonlyMap<string, Readonly<Record<string, unknown>>>;
 export declare function loadSaveFileRefs(args: {
     readonly registry: Registry;

package/dist/files/load-save-file-refs.js

@@ -1,6 +1,6 @@
 import { selectMany } from "../db/query.js";
 import { tenantDbRunner } from "../db/tenant-db-runner.js";
-import { isFileField, } from "../engine/types/index.js";
+import { isFileField } from "../engine/field-helpers.js";
 import { getStreamVersions } from "../event-store/event-store.js";
 import { fileRefIdsOf } from "./bind-pending-file-refs.js";
 import { FILE_REF_ENTITY_NAME } from "./file-ref-entity.js";

package/dist/files/provider-resolver.d.ts

@@ -1,8 +1,9 @@
 import type { CacheSyncBus } from "@cosmicdrift/kumiko-types/cache-sync-types";
+import type { ConfigAccessor, ConfigAccessorFactory } from "@cosmicdrift/kumiko-types/config";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-types/file-provider-resolver-types";
 import type { DbConnection } from "../db/connection.ts";
 import type { TenantDb } from "../db/tenant-db.ts";
-import type { ConfigAccessor, ConfigAccessorFactory, Registry } from "../engine/types/index.ts";
+import type { Registry } from "../engine/types/index.ts";
 import type { SecretsContext } from "../secrets/index.ts";
 import type { FileStorageProvider } from "./types.ts";
 /**
@@ -28,7 +29,7 @@ import type { FileStorageProvider } from "./types.ts";
 export type FileProviderContext = {
     readonly config?: ConfigAccessor;
     readonly registry?: Registry;
-    readonly secrets?: SecretsContext;
+    readonly secrets: SecretsContext | undefined;
     readonly auditUserId?: string | undefined;
 };
 /**
@@ -38,7 +39,7 @@ export type FileProviderContext = {
  *
  * **Plugin-Author-Warning:** `ctx` is EXPLICITLY a FileProviderContext, not
  * a full HandlerContext. Fields outside the narrow surface (e.g.
- * `ctx.tx`, `ctx.actor`, `ctx.signal`) are NOT available on the worker path.
+ * `ctx.tx`, `ctx.actor`, `ctx.lifecycle.signal`) are NOT available on the worker path.
  * Casting `ctx as unknown as HandlerContext` fails at runtime on the worker —
  * the crash only appears in production with the first S3 tenant. If a plugin
  * needs fields outside FileProviderContext, extend FileProviderContext
@@ -52,9 +53,10 @@ export declare function createFileProviderForTenant(ctx: FileProviderContext, te
 export type { FileProviderResolver } from "@cosmicdrift/kumiko-types/file-provider-resolver-types";
 export type FileProviderResolverDeps = {
     readonly registry?: Registry;
-    readonly _configAccessorFactory?: ConfigAccessorFactory;
+    readonly configAccessorFactory?: ConfigAccessorFactory;
     readonly secrets?: SecretsContext;
     readonly db?: DbConnection | TenantDb;
     readonly cacheSync?: CacheSyncBus;
+    readonly now?: () => Temporal.Instant;
 };
 export declare function makeFileProviderResolver(deps: FileProviderResolverDeps): FileProviderResolver;

package/dist/files/provider-resolver.js

@@ -1,5 +1,5 @@
 // File-provider resolution — lives in the framework so the upload routes,
-// `ctx.files`, AND the GDPR export/forget jobs resolve their FileStorageProvider
+// `ctx.services.files`, AND the GDPR export/forget jobs resolve their FileStorageProvider
 // through ONE path. Divergence (uploads writing one store, erasure deleting
 // another) is structurally impossible: there is a single resolver.
 //
@@ -101,11 +101,11 @@ export function makeFileProviderResolver(deps) {
         if (cached)
             return cached;
         const built = (async () => {
-            if (!deps.registry || !deps._configAccessorFactory || !deps.db) {
-                throw new Error("makeFileProviderResolver: registry/_configAccessorFactory/db missing — " +
+            if (!deps.registry || !deps.configAccessorFactory || !deps.db) {
+                throw new Error("makeFileProviderResolver: registry/configAccessorFactory/db missing — " +
                     "mount the config + file-foundation features and wire context.db");
             }
-            const config = deps._configAccessorFactory({
+            const config = deps.configAccessorFactory({
                 user: { id: SYSTEM_USER_ID, tenantId },
                 db: deps.db,
                 secrets: deps.secrets,
@@ -119,5 +119,5 @@ export function makeFileProviderResolver(deps) {
         cache.set(tenantId, built);
         return built;
     };
-    return deps.db ? withUploadLedger(resolveProvider, deps.db) : resolveProvider;
+    return deps.db ? withUploadLedger(resolveProvider, deps.db, deps.now) : resolveProvider;
 }

package/dist/files/record-write-check.d.ts

@@ -20,3 +20,9 @@ export declare function createRecordWriteCheck(args: {
     readonly canReadRecord: RecordReadCheck;
     readonly tenantDbFor: (tenantId: TenantId) => TenantDb;
 }): RecordWriteCheck;
+export declare function isStoredRecordLocked(args: {
+    readonly registry: Registry;
+    readonly db: TenantDb;
+    readonly entityType: string;
+    readonly entityId: string;
+}): Promise<boolean>;

package/dist/files/record-write-check.js

@@ -62,3 +62,16 @@ export function createRecordWriteCheck(args) {
         return RecordWriteDecisions.writable;
     };
 }
+// The stored row, read through the given db so a transaction sees the lock state it commits against.
+export async function isStoredRecordLocked(args) {
+    const { registry, db, entityType, entityId } = args;
+    const entity = registry.getEntity(entityType);
+    const table = findImplicitEntityTable(registry, entityType);
+    if (!entity || !table || entity.lockedWhen === undefined)
+        return false;
+    const row = await db.fetchOne(table, {
+        id: entityId,
+        ...(entity.softDelete === true && { isDeleted: false }),
+    });
+    return row !== undefined && isRecordLocked(entity.lockedWhen, row);
+}

package/dist/files/storage-tracking.js

@@ -11,11 +11,13 @@
 // consumer-cursor row. Apps that want it pass filesStorageTrackingFeature
 // into createApp / setupTestStack alongside their domain features.
 import { bigint, instant, integer, table as pgTable, sql, uuid } from "../db/dialect.js";
-import { entityEventName, executeRawQueryRead } from "../db/index.js";
+import { entityEventName } from "../db/index.js";
 import { toPostgresArrayLiteral } from "../db/queries/postgres-array-literal.js";
+import { executeRawQueryRead } from "../db/queries/raw-sql.js";
 import { incrementCounter } from "../db/query.js";
 import { defineFeature, qn, toKebab } from "../engine/index.js";
-import { SHARED_INSTANCE_SENTINEL, selectConsumerCursorForUpdate, } from "../pipeline/index.js";
+import { selectConsumerCursorForUpdate } from "../pipeline/event-dispatcher-delivery.js";
+import { SHARED_INSTANCE_SENTINEL } from "../pipeline/index.js";
 import { parseJsonOrThrow } from "../utils/index.js";
 const FILE_REF_AGGREGATE_TYPE = "fileRef";
 const STORAGE_TRACKING_FEATURE_NAME = "files-storage-tracking";

package/dist/files/sweep-orphaned-uploads.d.ts

@@ -1,6 +1,6 @@
 import type { FileContext } from "@cosmicdrift/kumiko-types/file-handle-types";
 import type { Logger } from "@cosmicdrift/kumiko-types/logger";
-import { type TenantDb } from "../db/tenant-db.ts";
+import type { TenantDb } from "../db/tenant-db.ts";
 export declare const ORPHANED_UPLOAD_SWEEP_BATCH = 500;
 export declare const DEFAULT_UPLOAD_SWEEP_GRACE_HOURS = 24;
 export declare const MIN_UPLOAD_SWEEP_GRACE_HOURS = 1;

package/dist/files/sweep-orphaned-uploads.js

@@ -1,5 +1,5 @@
 import { selectMany } from "../db/query.js";
-import { runInOwnTransaction } from "../db/tenant-db.js";
+import { runInOwnTransaction } from "../db/tenant-db-scoped-rebind.js";
 import { deleteFileRefBytes } from "../derivatives/delete-stored-file.js";
 import { fileRefsTable } from "./file-ref-table.js";
 import { fileUploadLedgerTable, takeUploadLedgerEntry } from "./upload-ledger.js";

package/dist/files/upload-ledger.d.ts

@@ -5,6 +5,6 @@ import type { TenantId } from "@cosmicdrift/kumiko-types/identifiers";
 import type { DbConnection } from "../db/connection.ts";
 import { type TenantDb } from "../db/tenant-db.ts";
 export declare const fileUploadLedgerTable: WritableTable;
-export declare function createFileUploadLedger(db: DbConnection | TenantDb, tenantId: TenantId): FileUploadLedger;
-export declare function withUploadLedger(resolver: (tenantId: TenantId) => Promise<FileStorageProvider>, db: DbConnection | TenantDb): FileProviderResolver;
+export declare function createFileUploadLedger(db: DbConnection | TenantDb, tenantId: TenantId, now?: () => Temporal.Instant): FileUploadLedger;
+export declare function withUploadLedger(resolver: (tenantId: TenantId) => Promise<FileStorageProvider>, db: DbConnection | TenantDb, now?: () => Temporal.Instant): FileProviderResolver;
 export declare function takeUploadLedgerEntry(txDb: TenantDb, storageKey: string): Promise<boolean>;

package/dist/files/upload-ledger.js

@@ -21,7 +21,7 @@ function isTenantDb(db) {
 }
 // The ledger writes on a connection of its own, never on a handler transaction: a rollback of the
 // handler must not take the row with it, or the bytes it uploaded would be unfindable.
-export function createFileUploadLedger(db, tenantId) {
+export function createFileUploadLedger(db, tenantId, now = () => Temporal.Now.instant()) {
     const runner = isTenantDb(db) ? tenantDbRunner(db) : db;
     if (!runnerCanBeginTransaction(runner)) {
         throw new InternalError({
@@ -34,7 +34,7 @@ export function createFileUploadLedger(db, tenantId) {
             await ledgerDb.insertOne(fileUploadLedgerTable, {
                 storageKey,
                 tenantId,
-                createdAt: Temporal.Now.instant(),
+                createdAt: now(),
             });
         },
         forget: async (storageKey) => {
@@ -42,9 +42,9 @@ export function createFileUploadLedger(db, tenantId) {
         },
     };
 }
-export function withUploadLedger(resolver, db) {
+export function withUploadLedger(resolver, db, now) {
     return Object.assign(resolver, {
-        uploadLedgerFor: (tenantId) => createFileUploadLedger(db, tenantId),
+        uploadLedgerFor: (tenantId) => createFileUploadLedger(db, tenantId, now),
     });
 }
 // Runs inside the transaction that creates the fileRef row. False means no ledger row was left to

package/dist/i18n/index.d.ts

@@ -1,12 +1,6 @@
 import type { Registry } from "../engine/types/index.ts";
+import type { I18n, I18nOptions } from "./internals.ts";
 export { hasMailTranslationKey, hasMailTranslations, listMailLocales, mailT, registerMailTranslations, resolveMailLocale, } from "./mail-registry.ts";
-export { canonicalizeLocaleTag, DEFAULT_LOCALE, isValidLocaleTag, pickAcceptLanguage, rankAcceptLanguage, rankPreferredLocales, resolveHeaderLocale, } from "./request-locale.ts";
+export { canonicalizeLocaleTag, isValidLocaleTag, rankPreferredLocales, } from "./request-locale.ts";
 export { SETTINGS_HUB_I18N } from "./settings-hub-keys.ts";
-export type I18nOptions = {
-    defaultLocale: string;
-};
-export type I18n = {
-    t(key: string, locale?: string, params?: Readonly<Record<string, unknown>>): string;
-    getAllKeys(): string[];
-};
 export declare function createI18n(registry: Registry, options: I18nOptions): I18n;

package/dist/i18n/index.js

@@ -1,6 +1,6 @@
 import { resolveTranslationValue } from "../ui-types/plural.js";
 export { hasMailTranslationKey, hasMailTranslations, listMailLocales, mailT, registerMailTranslations, resolveMailLocale, } from "./mail-registry.js";
-export { canonicalizeLocaleTag, DEFAULT_LOCALE, isValidLocaleTag, pickAcceptLanguage, rankAcceptLanguage, rankPreferredLocales, resolveHeaderLocale, } from "./request-locale.js";
+export { canonicalizeLocaleTag, isValidLocaleTag, rankPreferredLocales, } from "./request-locale.js";
 export { SETTINGS_HUB_I18N } from "./settings-hub-keys.js";
 export function createI18n(registry, options) {
     const translations = registry.getAllTranslations();

package/dist/i18n/internals.d.ts

@@ -0,0 +1,7 @@
+export type I18nOptions = {
+    defaultLocale: string;
+};
+export type I18n = {
+    t(key: string, locale?: string, params?: Readonly<Record<string, unknown>>): string;
+    getAllKeys(): string[];
+};

package/dist/i18n/internals.js

@@ -0,0 +1 @@
+export {};

package/dist/i18n/required-surface-keys.d.ts

@@ -1,4 +1,7 @@
-import type { FeatureDefinition, NavDefinition, ScreenDefinition, WorkspaceDefinition } from "../engine/types/index.ts";
+import type { NavDefinition } from "@cosmicdrift/kumiko-types/nav";
+import type { ScreenDefinition } from "@cosmicdrift/kumiko-types/screen";
+import type { WorkspaceDefinition } from "@cosmicdrift/kumiko-types/workspace";
+import type { FeatureDefinition } from "../engine/types/index.ts";
 /** Pseudo-entity for actionForm field labels (renderer action-form-shim). */
 export declare const ACTION_FORM_ENTITY = "__action-form__";
 /** Pseudo-entity for configEdit field labels (renderer config-edit-shim). */

package/dist/i18n/required-surface-keys.js

@@ -199,8 +199,9 @@ function pushRelatedListSectionKeys(out, section) {
     }
     for (const action of section.rowActions ?? [])
         pushRowActionKeys(out, action);
-    pushKey(out, section.groupBy?.label);
-    for (const label of Object.values(section.groupBy?.labels ?? {}))
+    const grouping = section.table?.grouping;
+    pushKey(out, grouping?.label);
+    for (const label of Object.values(grouping?.labels ?? {}))
         pushKey(out, label);
 }
 function pushListEmptyStateKeys(out, emptyState) {
@@ -237,6 +238,8 @@ function pushListChromeKeys(out, list) {
         pushRowActionKeys(out, action);
     for (const action of list.toolbarActions ?? [])
         pushToolbarActionKeys(out, action);
+    for (const bulk of list.bulkActions ?? [])
+        pushKey(out, bulk.confirm);
 }
 function collectEntityListKeys(ctx, list) {
     for (const col of list.columns) {
@@ -372,6 +375,8 @@ function collectProjectionDetailKeys(ctx, detail) {
         }
         if (section.kind === "relatedList") {
             pushRelatedListSectionKeys(ctx.out, section);
+            for (const bulk of section.bulkActions ?? [])
+                pushKey(ctx.out, bulk.confirm);
             continue;
         }
         if (isWriteFormEditSection(section)) {

package/dist/internal/row-level-security.d.ts

@@ -0,0 +1,3 @@
+export { isRowLevelSecurityViolation } from "../db/pg-error.ts";
+export { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "../db/render-rls-ddl.ts";
+export { appHookScopedRunner, runInRowLevelSecurityScope, runInSystemRowLevelSecurityScope, systemScopedRunner, tenantRowLevelSecurityScope, } from "../db/row-level-security-scope.ts";

package/dist/internal/row-level-security.js

@@ -0,0 +1,3 @@
+export { isRowLevelSecurityViolation } from "../db/pg-error.js";
+export { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "../db/render-rls-ddl.js";
+export { appHookScopedRunner, runInRowLevelSecurityScope, runInSystemRowLevelSecurityScope, systemScopedRunner, tenantRowLevelSecurityScope, } from "../db/row-level-security-scope.js";

package/dist/internal/stack-support.d.ts

@@ -1,6 +1,6 @@
 export { isClosedConnectionError } from "../db/closed-connection.ts";
 export { createDbConnection } from "../db/connection.ts";
-export { acquireSessionAdvisoryLock, createDatabase, databaseExists, dropDatabaseIfExists, listDatabaseNamesWithPrefix, renameDatabase, truncateTablesRestartIdentity, } from "../db/queries/test-stack.ts";
+export { acquireSessionAdvisoryLock, createApplicationRole, createDatabase, databaseExists, dropDatabaseIfExists, listDatabaseNamesWithPrefix, renameDatabase, transferDatabaseOwnership, transferPublicSchemaOwnership, truncateTablesRestartIdentity, } from "../db/queries/test-stack.ts";
 export type { AnyDb } from "../db/query.ts";
 export { columnNamesOf } from "../db/schema-inspection.ts";
 export { schemaTableName } from "../db/table-introspection.ts";

package/dist/internal/stack-support.js

@@ -1,7 +1,7 @@
 // @runtime dev
 export { isClosedConnectionError } from "../db/closed-connection.js";
 export { createDbConnection } from "../db/connection.js";
-export { acquireSessionAdvisoryLock, createDatabase, databaseExists, dropDatabaseIfExists, listDatabaseNamesWithPrefix, renameDatabase, truncateTablesRestartIdentity, } from "../db/queries/test-stack.js";
+export { acquireSessionAdvisoryLock, createApplicationRole, createDatabase, databaseExists, dropDatabaseIfExists, listDatabaseNamesWithPrefix, renameDatabase, transferDatabaseOwnership, transferPublicSchemaOwnership, truncateTablesRestartIdentity, } from "../db/queries/test-stack.js";
 export { columnNamesOf } from "../db/schema-inspection.js";
 export { schemaTableName } from "../db/table-introspection.js";
 export { addMissingColumns, addMissingIndexes, tableToMeta, unsafeCreateEntityTable, unsafeEnsureEntityTable, unsafePushTables, } from "../db/table-push.js";

package/dist/internal/testing.d.ts

@@ -6,6 +6,7 @@ export { resetBlindIndexKeyForTests } from "../crypto/blind-index.ts";
 export { resetEventPiiCatalogForTests } from "../crypto/event-pii.ts";
 export { resetPiiSubjectKmsForTests } from "../crypto/pii-field-encryption.ts";
 export { resetEntityFieldEncryptionCacheForTests } from "../db/entity-field-encryption.ts";
+export { type ExecutorManagedEntitySource, executorManagedEntitySourceOf, } from "../db/executor-managed-tables.ts";
 export declare function withExecutorManagedWritesForTests(db: TenantDb): ExecutorManagedTenantDb;
 export declare function withExecutorManagedWritesForTests(db: DbRunner): ExecutorManagedRunner;
 export declare function withExecutorManagedWritesForTests(db: AnyDb): ExecutorManagedTenantDb | ExecutorManagedRunner;

package/dist/internal/testing.js

@@ -4,15 +4,19 @@ export { resetBlindIndexKeyForTests } from "../crypto/blind-index.js";
 export { resetEventPiiCatalogForTests } from "../crypto/event-pii.js";
 export { resetPiiSubjectKmsForTests } from "../crypto/pii-field-encryption.js";
 export { resetEntityFieldEncryptionCacheForTests } from "../db/entity-field-encryption.js";
+export { executorManagedEntitySourceOf, } from "../db/executor-managed-tables.js";
 export function withExecutorManagedWritesForTests(db) {
     if (isBoundTenantDb(db)) {
-        return createTenantDb({
-            db: withExecutorManagedWrites(tenantDbRunner(db)),
-            tenantId: db.tenantId,
-            mode: db.mode,
-        });
+        const options = { db: withExecutorManagedWrites(tenantDbRunner(db)), tenantId: db.tenantId };
+        return db.mode === "system"
+            ? createTenantDb({
+                ...options,
+                mode: "system",
+                reason: "test seeding mirrors a system-mode TenantDb",
+            })
+            : createTenantDb(options);
     }
     if (isDbRunner(db))
         return withExecutorManagedWrites(db);
-    throw new Error("withExecutorManagedWritesForTests: expected a TenantDb or a postgres-js runner");
+    throw new Error("withExecutorManagedWritesForTests: expected a TenantDb or a Bun.SQL runner");
 }

package/dist/jobs/index.d.ts

@@ -1,2 +1,2 @@
-export type { JobDroppedMeta, JobLogEntry, JobMeta, JobOutcomeMeta, JobQueuedMeta, JobRunner, JobRunnerOptions, JobSubjectValue, } from "./job-runner.ts";
+export type { JobDroppedMeta, JobLogEntry, JobMeta, JobOutcomeMeta, JobQueuedMeta, JobRunner, JobRunnerOptions, } from "./job-runner.ts";
 export { createJobRunner, serializeJobSubject } from "./job-runner.ts";

package/dist/jobs/job-append-event.d.ts

@@ -0,0 +1,12 @@
+import type { AppendEventFn } from "@cosmicdrift/kumiko-types/handlers";
+import type { TenantDb } from "../db/tenant-db.ts";
+import type { Registry, SessionUser } from "../engine/types/index.ts";
+type JobAppendEventInput = {
+    readonly registry: Registry;
+    readonly jobDb: TenantDb | undefined;
+    readonly tenantId: string;
+    readonly systemUser: SessionUser;
+    readonly jobName: string;
+};
+export declare function createJobAppendEvent(input: JobAppendEventInput): AppendEventFn;
+export {};

package/dist/jobs/job-append-event.js

@@ -0,0 +1,30 @@
+import { tenantDbWriteRunner } from "../db/tenant-db-runner.js";
+import { runInOwnTransaction } from "../db/tenant-db-scoped-rebind.js";
+import { InternalError } from "../errors/index.js";
+import { appendDomainEventCore } from "../pipeline/append-event-core.js";
+import { asTypedAppendEventFn } from "../pipeline/typed-append-event.js";
+const CALL_SITE_LABEL = "job ctx.events.append";
+export function createJobAppendEvent(input) {
+    const { registry, jobDb, tenantId, systemUser, jobName } = input;
+    return asTypedAppendEventFn(async (args) => {
+        if (jobDb === undefined) {
+            throw new InternalError({
+                message: `Job ${jobName}: ctx.events.append needs a tenant db`,
+            });
+        }
+        const callerFeature = registry.getJobFeature(jobName);
+        if (callerFeature === undefined) {
+            throw new InternalError({
+                message: `Job ${jobName}: ctx.events.append needs an owning feature, none is registered for this job`,
+            });
+        }
+        await runInOwnTransaction(jobDb, (txDb) => appendDomainEventCore({
+            registry,
+            db: tenantDbWriteRunner(txDb, CALL_SITE_LABEL),
+            tenantId,
+            userId: String(systemUser.id),
+            callSiteLabel: CALL_SITE_LABEL,
+            callerFeature,
+        }, args));
+    });
+}

package/dist/jobs/job-runner-context.d.ts

@@ -1,8 +1,8 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { ConfigAccessor } from "@cosmicdrift/kumiko-types/config";
+import type { ConfigAccessor, JobDefinition } from "@cosmicdrift/kumiko-types/config";
 import type { WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
+import type { JobContext } from "@cosmicdrift/kumiko-types/handlers";
 import type { DbRow } from "../db/connection.ts";
-import type { JobContext, JobDefinition } from "../engine/types/index.ts";
 import type { JobRunnerScope } from "./job-runner-scope.ts";
 import type { JobInvocation, JobLogEntry, JobMeta } from "./job-runner-types.ts";
 export type TenantVisibleSubjects = {