@cosmicdrift/kumiko-framework 0.389.0 → 0.390.1

package/dist/search/meilisearch-adapter-internals.js

@@ -0,0 +1,9 @@
+// Exported for unit tests (index-name / primary-key shape) without a live Meili.
+export function meilisearchTenantIndex(prefix, tenantId) {
+    return `${prefix}t${tenantId}`;
+}
+// Meilisearch primary-key-ids: alphanumerics, `-`, `_`. UUIDs contain `-` —
+// legal. Replace anything else just in case callers pass unexpected shapes.
+export function meilisearchDocId(entityType, entityId) {
+    return `${entityType}_${String(entityId).replace(/[^0-9A-Za-z_-]/g, "_")}`;
+}

package/dist/search/meilisearch-adapter.d.ts

@@ -1,10 +1,3 @@
-import type { EntityId, TenantId } from "../engine/types/identifiers.ts";
+import { type MeilisearchAdapterOptions } from "./meilisearch-adapter-internals.ts";
 import type { SearchAdapter } from "./types.ts";
-export type MeilisearchAdapterOptions = {
-    url: string;
-    apiKey: string;
-    indexPrefix?: string;
-};
-export declare function meilisearchTenantIndex(prefix: string, tenantId: TenantId): string;
-export declare function meilisearchDocId(entityType: string, entityId: EntityId): string;
 export declare function createMeilisearchAdapter(options: MeilisearchAdapterOptions): SearchAdapter;

package/dist/search/meilisearch-adapter.js

@@ -1,5 +1,10 @@
 import { errorCodeOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { ErrorStatusCode, Meilisearch } from "meilisearch";
+import { importOptionalPeer } from "../utils/import-optional-peer.js";
+import { meilisearchDocId, meilisearchTenantIndex, } from "./meilisearch-adapter-internals.js";
+import { MEILISEARCH_PEER } from "./meilisearch-peer.js";
+// meilisearch is an optional peer; a static import would fail with the runtime's bare
+// "Cannot find package" error instead of naming the peer and how to install it.
+const { ErrorStatusCode, Meilisearch } = await importOptionalPeer(MEILISEARCH_PEER, () => import("meilisearch"));
 // meilisearch's waitTask() RESOLVES (never rejects) once the server task
 // reaches a terminal state, even "failed" — a rejected doc (e.g. an id over
 // Meili's 511-byte limit) otherwise fails silently and the caller thinks
@@ -50,14 +55,8 @@ function isIndexNotFound(err) {
     return errorCodeOf(cause) === ErrorStatusCode.INDEX_NOT_FOUND;
 }
 // Exported for unit tests (index-name / primary-key shape) without a live Meili.
-export function meilisearchTenantIndex(prefix, tenantId) {
-    return `${prefix}t${tenantId}`;
-}
 // Meilisearch primary-key-ids: alphanumerics, `-`, `_`. UUIDs contain `-` —
 // legal. Replace anything else just in case callers pass unexpected shapes.
-export function meilisearchDocId(entityType, entityId) {
-    return `${entityType}_${String(entityId).replace(/[^0-9A-Za-z_-]/g, "_")}`;
-}
 export function createMeilisearchAdapter(options) {
     const client = new Meilisearch({ host: options.url, apiKey: options.apiKey });
     const prefix = options.indexPrefix ?? "kumiko_";

package/dist/search/meilisearch-peer.d.ts

@@ -0,0 +1,2 @@
+import type { OptionalPeer } from "../utils/import-optional-peer.ts";
+export declare const MEILISEARCH_PEER: OptionalPeer;

package/dist/search/meilisearch-peer.js

@@ -0,0 +1,5 @@
+export const MEILISEARCH_PEER = {
+    name: "meilisearch",
+    range: "^0.58.0",
+    requiredBy: "@cosmicdrift/kumiko-framework/search/meilisearch",
+};

package/dist/search/reindex-entity.js

@@ -7,6 +7,7 @@
 import { resolveTableName } from "../db/entity-table-meta.js";
 import { executeRawQueryRead } from "../db/queries/raw-sql.js";
 import { runInNewTransaction, runnerCanBeginTransaction } from "../db/query.js";
+import { runInSystemRowLevelSecurityScope } from "../db/row-level-security-scope.js";
 import { buildSearchDocument, decryptSearchableSubjectFields, hasErasedSearchableSubjectField, } from "../pipeline/system-hooks.js";
 import { toSnakeCase } from "../utils/case.js";
 function quoteIdent(name) {
@@ -40,107 +41,112 @@ async function readBatchWithoutStatementTimeout(db, sqlText, params) {
     });
 }
 export async function reindexEntity(db, registry, searchAdapter, entityName, tenantId, options = {}) {
-    const entity = registry.getEntity(entityName);
-    if (!entity) {
-        throw new Error(`reindexEntity: unknown entity "${entityName}"`);
-    }
-    const searchableFields = registry.getSearchableFields(entityName);
-    const extensions = registry.getSearchPayloadExtensions(entityName);
-    if (searchableFields.length === 0 && extensions.length === 0) {
-        throw new Error(`reindexEntity: entity "${entityName}" has no searchable fields and no search-payload ` +
-            `extensions — nothing to index.`);
-    }
-    const batchSize = options.batchSize ?? 500;
-    const tableName = resolveTableName(entityName, entity, undefined);
-    const fieldNames = Object.keys(entity.fields);
-    // Soft-deleted rows already left the live index (the .deleted consumer
-    // calls searchAdapter.remove()) — resurrecting them here would make
-    // erased entities findable again.
-    const deletedFilter = entity.softDelete === true ? `AND ${quoteIdent("is_deleted")} IS NOT TRUE` : "";
-    const failures = [];
-    const result = { scannedRows: 0, indexedRows: 0, wouldIndexRows: 0, failures };
-    let lastId;
-    // Whether a searchable field lacks a matching read-table column depends
-    // only on the table's column set (rowToState/Object.hasOwn), not on any
-    // particular row's data — every row from the same SELECT * has the same
-    // columns. Check once against the first row instead of every row, so a
-    // dropped/never-migrated column fails fast with one clear error instead
-    // of one identical failures[] entry per scanned row (1M rows → 1M
-    // entries, and the real schema problem is buried in "x failed").
-    let uncheckedSchema = true;
-    for (;;) {
-        // Keyset, not OFFSET: rows deleted or changed while the loop runs must not shift the window.
-        const afterLastId = lastId === undefined ? "" : `AND ${quoteIdent("id")} > $3`;
-        const rows = await readBatchWithoutStatementTimeout(db, `SELECT * FROM ${quoteIdent(tableName)}
+    return runInSystemRowLevelSecurityScope("search reindex reads entity rows of all tenants", async () => {
+        const entity = registry.getEntity(entityName);
+        if (!entity) {
+            throw new Error(`reindexEntity: unknown entity "${entityName}"`);
+        }
+        const searchableFields = registry.getSearchableFields(entityName);
+        const extensions = registry.getSearchPayloadExtensions(entityName);
+        if (searchableFields.length === 0 && extensions.length === 0) {
+            throw new Error(`reindexEntity: entity "${entityName}" has no searchable fields and no search-payload ` +
+                `extensions — nothing to index.`);
+        }
+        const batchSize = options.batchSize ?? 500;
+        const tableName = resolveTableName(entityName, entity, undefined);
+        const fieldNames = Object.keys(entity.fields);
+        // Soft-deleted rows already left the live index (the .deleted consumer
+        // calls searchAdapter.remove()) — resurrecting them here would make
+        // erased entities findable again.
+        const deletedFilter = entity.softDelete === true ? `AND ${quoteIdent("is_deleted")} IS NOT TRUE` : "";
+        const failures = [];
+        const result = { scannedRows: 0, indexedRows: 0, wouldIndexRows: 0, failures };
+        let lastId;
+        // Whether a searchable field lacks a matching read-table column depends
+        // only on the table's column set (rowToState/Object.hasOwn), not on any
+        // particular row's data — every row from the same SELECT * has the same
+        // columns. Check once against the first row instead of every row, so a
+        // dropped/never-migrated column fails fast with one clear error instead
+        // of one identical failures[] entry per scanned row (1M rows → 1M
+        // entries, and the real schema problem is buried in "x failed").
+        let uncheckedSchema = true;
+        for (;;) {
+            // Keyset, not OFFSET: rows deleted or changed while the loop runs must not shift the window.
+            const afterLastId = lastId === undefined ? "" : `AND ${quoteIdent("id")} > $3`;
+            const rows = await readBatchWithoutStatementTimeout(db, `SELECT * FROM ${quoteIdent(tableName)}
         WHERE ${quoteIdent("tenant_id")} = $1 ${deletedFilter} ${afterLastId}
         ORDER BY ${quoteIdent("id")} ASC
         LIMIT $2`, lastId === undefined ? [tenantId, batchSize] : [tenantId, batchSize, lastId]);
-        const [firstRow] = rows;
-        if (firstRow === undefined)
-            break;
-        if (uncheckedSchema) {
-            uncheckedSchema = false;
-            const sampleState = rowToState(firstRow, fieldNames);
-            const unmappedField = searchableFields.find((fieldName) => !(fieldName in sampleState));
-            if (unmappedField !== undefined) {
-                throw new Error(`reindexEntity: searchable field "${unmappedField}" is not mappable from read-table ` +
-                    `column ${quoteIdent(tableName)} — likely a dropped/never-migrated column.`);
-            }
-        }
-        const docs = [];
-        for (const row of rows) {
-            result.scannedRows++;
-            const entityId = String(row["id"]);
-            try {
-                const rawState = rowToState(row, fieldNames);
-                // `pii + searchable` fields hold ciphertext on the read-table row —
-                // decrypt the same way the live write-path consumer does. An
-                // erased subject key doesn't throw, it swaps the value for
-                // PII_ERASED_SENTINEL (see decryptSearchableSubjectFields) — check
-                // for that AFTER decrypting, mirroring the softDelete filter above:
-                // resurrecting a crypto-shredded row here would undo
-                // purgeSearchDocumentsForSubject and make it findable again.
-                const state = await decryptSearchableSubjectFields(entityName, rawState, registry);
-                if (hasErasedSearchableSubjectField(entityName, state, registry))
-                    continue;
-                const doc = await buildSearchDocument(entityName, entityId, state, registry);
-                if (doc)
-                    docs.push({ entityId, doc });
-            }
-            catch (e) {
-                result.failures.push({ entityId, reason: e instanceof Error ? e.message : String(e) });
+            const [firstRow] = rows;
+            if (firstRow === undefined)
+                break;
+            if (uncheckedSchema) {
+                uncheckedSchema = false;
+                const sampleState = rowToState(firstRow, fieldNames);
+                const unmappedField = searchableFields.find((fieldName) => !(fieldName in sampleState));
+                if (unmappedField !== undefined) {
+                    throw new Error(`reindexEntity: searchable field "${unmappedField}" is not mappable from read-table ` +
+                        `column ${quoteIdent(tableName)} — likely a dropped/never-migrated column.`);
+                }
             }
-        }
-        if (!options.dryRun && docs.length > 0) {
-            if (searchAdapter.indexBatch) {
+            const docs = [];
+            for (const row of rows) {
+                result.scannedRows++;
+                const entityId = String(row["id"]);
                 try {
-                    await searchAdapter.indexBatch(tenantId, docs.map((d) => d.doc));
-                    result.indexedRows += docs.length;
+                    const rawState = rowToState(row, fieldNames);
+                    // `pii + searchable` fields hold ciphertext on the read-table row —
+                    // decrypt the same way the live write-path consumer does. An
+                    // erased subject key doesn't throw, it swaps the value for
+                    // PII_ERASED_SENTINEL (see decryptSearchableSubjectFields) — check
+                    // for that AFTER decrypting, mirroring the softDelete filter above:
+                    // resurrecting a crypto-shredded row here would undo
+                    // purgeSearchDocumentsForSubject and make it findable again.
+                    const state = await decryptSearchableSubjectFields(entityName, rawState, registry);
+                    if (hasErasedSearchableSubjectField(entityName, state, registry))
+                        continue;
+                    const doc = await buildSearchDocument(entityName, entityId, state, registry);
+                    if (doc)
+                        docs.push({ entityId, doc });
                 }
                 catch (e) {
-                    const reason = e instanceof Error ? e.message : String(e);
-                    for (const { entityId } of docs)
-                        result.failures.push({ entityId, reason });
+                    result.failures.push({ entityId, reason: e instanceof Error ? e.message : String(e) });
                 }
             }
-            else {
-                for (const { entityId, doc } of docs) {
+            if (!options.dryRun && docs.length > 0) {
+                if (searchAdapter.indexBatch) {
                     try {
-                        await searchAdapter.index(tenantId, doc);
-                        result.indexedRows++;
+                        await searchAdapter.indexBatch(tenantId, docs.map((d) => d.doc));
+                        result.indexedRows += docs.length;
                     }
                     catch (e) {
-                        result.failures.push({ entityId, reason: e instanceof Error ? e.message : String(e) });
+                        const reason = e instanceof Error ? e.message : String(e);
+                        for (const { entityId } of docs)
+                            result.failures.push({ entityId, reason });
+                    }
+                }
+                else {
+                    for (const { entityId, doc } of docs) {
+                        try {
+                            await searchAdapter.index(tenantId, doc);
+                            result.indexedRows++;
+                        }
+                        catch (e) {
+                            result.failures.push({
+                                entityId,
+                                reason: e instanceof Error ? e.message : String(e),
+                            });
+                        }
                     }
                 }
             }
+            else if (options.dryRun) {
+                result.wouldIndexRows += docs.length;
+            }
+            lastId = rows[rows.length - 1]?.["id"];
+            if (rows.length < batchSize)
+                break;
         }
-        else if (options.dryRun) {
-            result.wouldIndexRows += docs.length;
-        }
-        lastId = rows[rows.length - 1]?.["id"];
-        if (rows.length < batchSize)
-            break;
-    }
-    return result;
+        return result;
+    });
 }

package/dist/secrets/index.d.ts

@@ -1,9 +1,8 @@
-export { createDekCache, type DekCache, type DekCacheOptions, withDekCache } from "./dek-cache.ts";
+export { createDekCache, type DekCache, withDekCache } from "./dek-cache.ts";
 export { derivePurposeSecret } from "./derive-purpose-secret.ts";
-export { createEnvMasterKeyProvider, type EnvMasterKeyProviderOptions, type Keyring, } from "./env-master-key-provider.ts";
+export { createEnvMasterKeyProvider } from "./env-master-key-provider.ts";
 export { decryptValue, encryptValue } from "./envelope.ts";
 export { createEnvelopeCipher, type EnvelopeCipher, type EnvelopeCipherOptions, } from "./envelope-cipher.ts";
-export { assertNoSecretLeak } from "./leak-guard.ts";
 export { rewrapDek } from "./rotation.ts";
 export { decodeStoredEnvelope, encodeStoredEnvelope, isStoredEnvelope, type StoredEnvelope, } from "./stored-envelope.ts";
-export { type ContainsSecret, createSecret, type Envelope, isSecret, type KeyScope, type MasterKeyProvider, type Secret, type SecretAuditContext, type SecretKeyRef, type SecretsContext, } from "./types.ts";
+export { createSecret, type MasterKeyProvider, type Secret, type SecretsContext, } from "./types.ts";

package/dist/secrets/index.js

@@ -1,9 +1,8 @@
 export { createDekCache, withDekCache } from "./dek-cache.js";
 export { derivePurposeSecret } from "./derive-purpose-secret.js";
-export { createEnvMasterKeyProvider, } from "./env-master-key-provider.js";
+export { createEnvMasterKeyProvider } from "./env-master-key-provider.js";
 export { decryptValue, encryptValue } from "./envelope.js";
 export { createEnvelopeCipher, } from "./envelope-cipher.js";
-export { assertNoSecretLeak } from "./leak-guard.js";
 export { rewrapDek } from "./rotation.js";
 export { decodeStoredEnvelope, encodeStoredEnvelope, isStoredEnvelope, } from "./stored-envelope.js";
-export { createSecret, isSecret, } from "./types.js";
+export { createSecret, } from "./types.js";

package/dist/seeding/index.d.ts

@@ -1,3 +1,3 @@
-export { type EventStoreSeedExisting, type RunEventStoreSeedOptions, runEventStoreSeed, } from "./entity-seed.ts";
+export { runEventStoreSeed } from "./entity-seed.ts";
 export { createTestUser, TestUsers, testTenantId, testUserId } from "./seed-users.ts";
-export { DEFAULT_SEED_IF_EXISTS, type SeedIfExists } from "./types.ts";
+export type { SeedIfExists } from "./types.ts";

package/dist/seeding/index.js

@@ -1,3 +1,2 @@
-export { runEventStoreSeed, } from "./entity-seed.js";
+export { runEventStoreSeed } from "./entity-seed.js";
 export { createTestUser, TestUsers, testTenantId, testUserId } from "./seed-users.js";
-export { DEFAULT_SEED_IF_EXISTS } from "./types.js";

package/dist/time/index.d.ts

@@ -1,6 +1,6 @@
 export { warnIfNonUtcServerTimeZone } from "./boot-tz-warning.ts";
-export type { GeoAddress, GeoCoordinates, GeoTzProvider } from "./geo-tz.ts";
+export type { GeoTzProvider } from "./geo-tz.ts";
 export { isValidIanaTimeZone } from "./iana.ts";
 export { instantToLegacyDate, legacyDateToInstant } from "./legacy-date.ts";
 export { ensureTemporalPolyfill, getTemporal } from "./polyfill.ts";
-export { type Clock, createTzContext, createTzContextAsync, type LocatedTimestampJson, type TzContext, type TzContextOptions, } from "./tz-context.ts";
+export { createTzContext, type TzContext, } from "./tz-context.ts";

package/dist/time/index.js

@@ -12,4 +12,4 @@ export { warnIfNonUtcServerTimeZone } from "./boot-tz-warning.js";
 export { isValidIanaTimeZone } from "./iana.js";
 export { instantToLegacyDate, legacyDateToInstant } from "./legacy-date.js";
 export { ensureTemporalPolyfill, getTemporal } from "./polyfill.js";
-export { createTzContext, createTzContextAsync, } from "./tz-context.js";
+export { createTzContext, } from "./tz-context.js";

package/dist/time/tz-context.d.ts

@@ -6,8 +6,3 @@ export type { Clock, LocatedTimestampJson, TzContext, TzContextOptions, } from "
  * buildHandlerContext stays ambient-free.
  */
 export declare function createTzContext(options?: TzContextOptions): TzContext;
-/**
- * Convenience: ensures the polyfill is loaded AND creates the TzContext in
- * one await. Prefer this in boot code.
- */
-export declare function createTzContextAsync(options?: TzContextOptions): Promise<TzContext>;

package/dist/time/tz-context.js

@@ -18,7 +18,6 @@
 // The pure type contracts (TzContext, TzContextOptions, LocatedTimestampJson)
 // live in @cosmicdrift/kumiko-types/tz-context — only the factories are here.
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { ensureTemporalPolyfill } from "./polyfill.js";
 const SYSTEM_CLOCK = {
     now: () => Temporal.Now.instant(), // @wrapper-known semantic-alias
 };
@@ -72,11 +71,3 @@ export function createTzContext(options = {}) {
         },
     };
 }
-/**
- * Convenience: ensures the polyfill is loaded AND creates the TzContext in
- * one await. Prefer this in boot code.
- */
-export async function createTzContextAsync(options) {
-    await ensureTemporalPolyfill();
-    return createTzContext(options);
-}

package/dist/ui-types/index.d.ts

@@ -5,22 +5,19 @@ export type { FormDerivationScreen } from "../engine/form-derivations.ts";
 export { applyFormDerivations, isFormDerivationInputMode, isUnusedFallbackOperand, } from "../engine/form-derivations.ts";
 export type { ParsedRefTarget } from "../engine/parse-ref-target.ts";
 export { parseRefTarget } from "../engine/parse-ref-target.ts";
-export type { FieldsOrGroupsSection, UnavailableSelectOption } from "../engine/screen-helpers.ts";
-export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.ts";
-export type { BooleanFieldDef, DateFieldDef, EmbeddedDerivedCellDef, EntityDefinition, FieldDefinition, FileFieldDef, FilesFieldDef, ImageFieldDef, ImagesFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, SelectFieldDef, SelectOptionTone, TextFieldDef, } from "../engine/types/fields.ts";
-export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, RoleAccessPersonalData, RoleAccessRule, } from "../engine/types/handlers.ts";
+export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.ts";
+export type { EmbeddedDerivedCellDef, EntityDefinition, FieldDefinition, OptionsQueryPayload, SelectOptionTone, TextFieldDef, } from "../engine/types/fields.ts";
+export type { AccessRule } from "../engine/types/handlers.ts";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.ts";
 export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav.ts";
-export type { ActionFormFooterAction, ActionFormLoad, ActionFormRedirect, ActionFormScreenDefinition, ActionFormSuccessFact, ActionFormSuccessLink, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, ExpandableRowGrouping, FieldAffix, FieldCondition, FieldFillAction, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListBulkAction, ListColumnDisplay, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListSortSpec, ListTableDensity, ListTableOptions, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionClientAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.ts";
-export { MAX_BULK_SELECTION, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.ts";
+export type { ActionFormFooterAction, ActionFormLoad, ActionFormRedirect, ActionFormScreenDefinition, ActionFormSuccessFact, ActionFormSuccessLink, ConfigEditScreenDefinition, CustomScreenDefinition, DashboardChartMarkerKind, DashboardChartPanel, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRefresh, DashboardRelativeTimeParam, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardTimeRangeDefinition, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditScreenDefinition, EntityListFacetConfig, EntityListScreenDefinition, FieldAffix, FieldCondition, FieldFillAction, FieldIconKey, FieldRenderer, FormWidth, ListBulkAction, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListSortSpec, ListTableOptions, MetricNavigate, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionClientAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretsEditScreenDefinition, ToolbarAction, } from "../engine/types/screen.ts";
+export { MAX_BULK_SELECTION } from "../engine/types/screen.ts";
 export type { TargetRef } from "../engine/types/target-ref.ts";
-export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.ts";
+export type { TreeAction } from "../engine/types/tree-node.ts";
 export type { WorkspaceDefinition } from "../engine/types/workspace.ts";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.ts";
 export type { AppSchema, FeatureSchema, QualifiedContentCollection, WorkspaceSchema, } from "./app-schema.ts";
-export type { CardColumnRoles, CardRoleColumn } from "./card-column-roles.ts";
-export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.ts";
+export { CARD_META_MAX, cardColumnRoles } from "./card-column-roles.ts";
 export { type Formality, formalLocaleTag } from "./formality.ts";
-export type { ListRowMetaColumnType, ListRowMetaReference, ReferenceLookupSource, SystemReferenceLabel, } from "./list-row-meta.ts";
 export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, UNRESOLVED_REFERENCE_LABEL_KEYS, } from "./list-row-meta.ts";
-export { type PluralForms, resolveTranslationValue, type TranslationValue, translationValueOtherText, } from "./plural.ts";
+export { resolveTranslationValue, type TranslationValue, translationValueOtherText, } from "./plural.ts";

package/dist/ui-types/index.js

@@ -23,11 +23,11 @@ export { NO_WIDGET_FIELD_TYPES } from "@cosmicdrift/kumiko-types/fields";
 export { computeDerivedCellValue, roundDerivedCellValue } from "../engine/embedded-derived.js";
 export { applyFormDerivations, isFormDerivationInputMode, isUnusedFallbackOperand, } from "../engine/form-derivations.js";
 export { parseRefTarget } from "../engine/parse-ref-target.js";
-export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
+export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
-export { MAX_BULK_SELECTION, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
+export { MAX_BULK_SELECTION } from "../engine/types/screen.js";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
-export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.js";
+export { CARD_META_MAX, cardColumnRoles } from "./card-column-roles.js";
 export { formalLocaleTag } from "./formality.js";
 export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, UNRESOLVED_REFERENCE_LABEL_KEYS, } from "./list-row-meta.js";
 export { resolveTranslationValue, translationValueOtherText, } from "./plural.js";

package/dist/upgrade-changelog.d.ts

@@ -1,3 +1,4 @@
+import type { UpgradeMarkerResolvedManual } from "./upgrade-marker-parse.ts";
 export type UpgradeChangelogManual = {
     readonly id: string;
     readonly version: string;
@@ -23,5 +24,5 @@ export type UpgradeChangelogSection = {
 export declare function renderUpgradeSection(section: UpgradeChangelogSection): string;
 /** Puts the section on top; a section for the same target version is replaced, so a re-run stays idempotent. */
 export declare function mergeUpgradeSection(existing: string | undefined, section: UpgradeChangelogSection): string;
-/** Pure string match on the rendered `- [open] <id> · ` prefix, in every section. */
-export declare function setManualStatusInChangelog(content: string, ids: ReadonlySet<string>, resolution: "migrated" | "not-applicable"): string;
+/** Pure string match on the rendered `- [open] <id> · ` prefix, in every section; each id gets its own resolution. */
+export declare function syncResolvedManualStatuses(content: string, resolved: readonly Pick<UpgradeMarkerResolvedManual, "id" | "resolution">[]): string;

package/dist/upgrade-changelog.js

@@ -46,17 +46,21 @@ export function mergeUpgradeSection(existing, section) {
     const others = sections.filter((candidate) => !candidate.startsWith(prefix));
     return [header, renderUpgradeSection(section), ...others].join("\n");
 }
-/** Pure string match on the rendered `- [open] <id> · ` prefix, in every section. */
-export function setManualStatusInChangelog(content, ids, resolution) {
+/** Pure string match on the rendered `- [open] <id> · ` prefix, in every section; each id gets its own resolution. */
+export function syncResolvedManualStatuses(content, resolved) {
+    const resolutionById = new Map(resolved.map((entry) => [entry.id, entry.resolution]));
+    if (resolutionById.size === 0)
+        return content;
+    const openPrefix = "- [open] ";
     return content
         .split("\n")
         .map((line) => {
-        for (const id of ids) {
-            const open = `- [open] ${id} · `;
-            if (line.startsWith(open))
-                return `- [${resolution}] ${id} · ${line.slice(open.length)}`;
-        }
-        return line;
+        if (!line.startsWith(openPrefix))
+            return line;
+        const rest = line.slice(openPrefix.length);
+        const idEnd = rest.indexOf(" · ");
+        const resolution = idEnd === -1 ? undefined : resolutionById.get(rest.slice(0, idEnd));
+        return resolution === undefined ? line : `- [${resolution}] ${rest}`;
     })
         .join("\n");
 }

package/dist/upgrade-cli-internals.d.ts

@@ -0,0 +1,8 @@
+export declare const CODEMOD_SUBDIR = "scripts/codemod";
+export declare const CODEMOD_PACKAGE_NAME = "@cosmicdrift/kumiko-feature-ast";
+export type UpgradeCliOut = {
+    readonly log: (line: string) => void;
+    readonly err: (line: string) => void;
+};
+export declare function findFeatureChangelogFiles(featuresDir: string): string[];
+export declare function findCodemodScriptsRoot(repoRoot: string): string | null;

package/dist/upgrade-cli-internals.js

@@ -0,0 +1,63 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
+export const CODEMOD_SUBDIR = "scripts/codemod";
+export const CODEMOD_PACKAGE_NAME = "@cosmicdrift/kumiko-feature-ast";
+export function findFeatureChangelogFiles(featuresDir) {
+    if (!existsSync(featuresDir))
+        return [];
+    const files = [];
+    const features = readdirSync(featuresDir, { withFileTypes: true })
+        .filter((d) => d.isDirectory())
+        .map((d) => d.name);
+    for (const name of features) {
+        // Layout is detected per-package, not guessed from a naming convention:
+        // enterprise packages keep changes.json under src/, framework's
+        // bundled-features keep it flat. A name-prefix heuristic (e.g. "ai-*")
+        // silently drops packages that don't match it.
+        const srcLayout = join(featuresDir, name, "src", "changes.json");
+        const flatLayout = join(featuresDir, name, "changes.json");
+        const changelogPath = existsSync(srcLayout) ? srcLayout : flatLayout;
+        if (existsSync(changelogPath))
+            files.push(changelogPath);
+    }
+    return files;
+}
+// Consumer-facing codemod scripts ship inside the published
+// @cosmicdrift/kumiko-feature-ast package (src/scripts/codemod), not at the
+// git repo root — only the installed package path exists in a consumer's
+// node_modules after a plain npm/bun install.
+export function findCodemodScriptsRoot(repoRoot) {
+    const local = join(repoRoot, "packages/feature-ast/src");
+    if (existsSync(join(local, CODEMOD_SUBDIR))) {
+        // If package.json exists, require it to be kumiko-feature-ast so a generic
+        // monorepo `packages/feature-ast` cannot shadow the installed package.
+        // Missing package.json (test fixtures / incomplete trees) keeps prior behavior.
+        const pkgPath = join(repoRoot, "packages/feature-ast/package.json");
+        if (existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+                if (propertyOf(pkg, "name") === CODEMOD_PACKAGE_NAME)
+                    return local;
+                // wrong name → fall through
+            }
+            catch {
+                // unreadable → fall through
+            }
+        }
+        else {
+            return local;
+        }
+    }
+    let dir = repoRoot;
+    for (let i = 0; i < 10; i++) {
+        const nmSrc = join(dir, "node_modules", CODEMOD_PACKAGE_NAME, "src");
+        if (existsSync(join(nmSrc, CODEMOD_SUBDIR)))
+            return nmSrc;
+        const parent = join(dir, "..");
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}

package/dist/upgrade-cli.d.ts

@@ -1,15 +1,8 @@
-import { type ManualResolution, manualEntryId, type UpgradeMarkerManual, type UpgradeMarkerResolvedManual } from "./upgrade-marker-parse.ts";
-export type { ManualResolution, UpgradeMarkerManual, UpgradeMarkerResolvedManual };
-export { manualEntryId };
-export type UpgradeCliOut = {
-    readonly log: (line: string) => void;
-    readonly err: (line: string) => void;
-};
-export declare function findFeatureChangelogFiles(featuresDir: string): string[];
+import { type UpgradeCliOut } from "./upgrade-cli-internals.ts";
 export declare function findPackageChangelogFiles(cwd: string): string[];
 export declare function findFeaturesDirs(cwd: string): string[];
-export declare function findCodemodScriptsRoot(repoRoot: string): string | null;
 export declare function resolveCodemodScript(repoRoot: string, codemodField: string | undefined): string | null;
 export declare function runUpgradeCli(argv: readonly string[], cwd: string, out: UpgradeCliOut, options?: {
     readonly repoRoot?: string;
+    readonly codemodResolveFrom?: string;
 }): Promise<number>;