@cosmicdrift/kumiko-framework 0.394.0 → 0.396.0

package/agents/examples/ownership.md

@@ -203,14 +203,14 @@ describe("entity-level write: create/update/delete blocked on foreign rows", ()
   });
 
   test("TeamMember eng CANNOT update the ops row (not visible → not modifiable)", async () => {
-    // The row exists but entity-level ownership rejects the update.
-    // version is guessed — doesn't matter, the ownership check fires first.
+    // The row exists, but a row the caller cannot read answers like a missing
+    // one, so the write does not reveal it. The guessed version never matters.
     const err = await stack.http.writeErr(
       "contracts:write:contract:update",
       { id: opsRowId, version: 1, changes: { propA: "hack" } },
       teamMemberEng,
     );
-    expectErrorIncludes(err, "ownership_denied");
+    expectErrorIncludes(err, "not_found");
   });
 
   test("TeamMember eng CANNOT move their row to another team (teamId rewrite blocked)", async () => {

package/agents/features.md

@@ -473,7 +473,7 @@ Secrets:
 
 ## managed-pages
 
-Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.
+Tenant-editable, server-rendered public pages with per-tenant branding. Stores one `page` (Markdown or editor-document HTML body, per `bodyFormat`) per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core and document bodies through the template-resolver document sanitizer, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.
 
 Category: content
 
@@ -673,7 +673,7 @@ Category: data
 
 ## template-resolver
 
-Every piece of editable text lives here, in one entity: mail bodies, notification texts, PDF document templates, AI prompts and plain text blocks. What a record is used for is the `kind` (`notification`, `mail`, `mail-layout`, `document-pdf`, `pdf-layout`, `ai-prompt`, `text-block`, `snippet`, `image-snapshot`). Reading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away. Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host's roles. The same list decides delivery: a tenant override is served (mail, PDF, layouts, text blocks) only while its template is listed in tenantEditable; otherwise the system version is served. A locked override stays stored, a SystemAdmin sees it in the overview marked as not delivered, and listing the template makes it effective again. Tenant rows of a collection mounted with `access` are always served. A collection mounted without `access` is SystemAdmin only. Text an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation. How a collection is edited follows from `contentFormat`: `plain` gives a text area, `rich` a small WYSIWYG (bold, italic, headings, lists, links), `markdown` a text area that stores markdown text (same insertable chips as `plain`). All three offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning). A collection is tenant-wide by default. With `ownership: "user"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side. `validate` dry-runs the write pipeline for a draft (sanitizer, layout rules, placeholders) and reports what the template uses and misses. `export-bundle` / `import-bundle` (and `import-bundle-system`) move one template with all locales and resource files between tenants or environments; `copy-locale` starts a translation from an existing locale. Layouts are structured: a mail or PDF layout is `data-header` / `data-content` / `data-signature` / `data-footer` regions, and mjml layout source is system-only. `preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted. `send-test-status` tells an editor beforehand whether that send can work for the caller (`canSend`, else `reason` `no_channel` or `no_address`), never returning the address. Images used by a template (`<img data-resource="logo">`) are uploaded with `resourceUpload`, which re-encodes them, stores a file and links it under the key; `resourceRemove` unlinks it. `linkedResources` is written only through these two handlers. With `purpose: "attachment"` and a `fileName`, `resourceUpload` stores a PDF, PNG or JPEG as a file attachment of a mail template (original bytes, at most 10) that the mail renderer attaches after the inline images. `resourceLinkPdf` instead links a `document-pdf` template under a key: every mail sent from the template then carries that PDF, rendered at send time with the mail's own variables and locale, under a file name pattern such as `invoice-{{number}}.pdf`; files and linked PDFs share the limit of 10. Replaces the former `text-content` feature; its blocks now live here as kind `text-block`.
+Every piece of editable text lives here, in one entity: mail bodies, notification texts, PDF document templates, AI prompts and plain text blocks. What a record is used for is the `kind` (`notification`, `mail`, `mail-layout`, `document-pdf`, `pdf-layout`, `ai-prompt`, `text-block`, `snippet`, `image-snapshot`). Reading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away. Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host's roles. The same list decides delivery: a tenant override is served (mail, PDF, layouts, text blocks) only while its template is listed in tenantEditable; otherwise the system version is served. A locked override stays stored, a SystemAdmin sees it in the overview marked as not delivered, and listing the template makes it effective again. Tenant rows of a collection mounted with `access` are always served. A collection mounted without `access` is SystemAdmin only. Text an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation. How a collection is edited follows from `contentFormat`: `plain` gives a text area that stores text, `document` a WYSIWYG document editor that stores sanitized HTML (bold, italic, headings, lists, links, variable chips). Both offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning). A collection is tenant-wide by default. With `ownership: "user"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side. `validate` dry-runs the write pipeline for a draft (sanitizer, layout rules, placeholders) and reports what the template uses and misses. `export-bundle` / `import-bundle` (and `import-bundle-system`) move one template with all locales and resource files between tenants or environments; `copy-locale` starts a translation from an existing locale. Layouts are structured: a mail or PDF layout is `data-header` / `data-content` / `data-signature` / `data-footer` regions, and mjml layout source is system-only. `preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted. `send-test-status` tells an editor beforehand whether that send can work for the caller (`canSend`, else `reason` `no_channel` or `no_address`), never returning the address. Images used by a template (`<img data-resource="logo">`) are uploaded with `resourceUpload`, which re-encodes them, stores a file and links it under the key; `resourceRemove` unlinks it. `linkedResources` is written only through these two handlers. With `purpose: "attachment"` and a `fileName`, `resourceUpload` stores a PDF, PNG or JPEG as a file attachment of a mail template (original bytes, at most 10) that the mail renderer attaches after the inline images. `resourceLinkPdf` instead links a `document-pdf` template under a key: every mail sent from the template then carries that PDF, rendered at send time with the mail's own variables and locale, under a file name pattern such as `invoice-{{number}}.pdf`; files and linked PDFs share the limit of 10. Replaces the former `text-content` feature; its blocks now live here as kind `text-block`.
 
 Category: notifications
 

package/agents/widgets.md

@@ -77,7 +77,6 @@ Value exports of `@cosmicdrift/kumiko-renderer/web`.
 | `ResizablePanelGroup` |  |
 | `ResultPanel` | Result section for a calculator: SectionCard with an empty state (Banner) or a metric list (DetailList) plus optional extras (table, notes). |
 | `ResultTable` | Static, prop-driven result table for calculated rows (tranches, scenarios). |
-| `RichContentEditor` |  |
 | `ScreenWidthProvider` |  |
 | `SectionCard` | Section with a title and optional action slot (range switcher, filter) — replaces repeated `<section className={CARD}>…<h2>` blocks in custom screens. |
 | `SelectField` | Select field = Field + Input(kind:"select"). |
@@ -115,6 +114,7 @@ Value exports of `@cosmicdrift/kumiko-renderer/web`.
 | --- | --- |
 | `useBrowserNavApi` | React hook that builds a NavApi from browser history. |
 | `useBrowserTokensApi` | Builds a TokensApi for the browser. |
+| `useDispatchTarget` | Recommended production dispatch. |
 | `useDispatcher` |  |
 | `useDispatcherStatus` |  |
 | `useDraft` | Form state for calculator screens: a draft object plus `patch` for partial updates, and `field(name)` that provides `{ id, name, value, onChange }` props ready for field widgets (NumberField/MoneyField/PercentField). |

package/dist/db/event-store-executor-context.d.ts

@@ -1,3 +1,4 @@
+import type { ParentVisibilityOption } from "@cosmicdrift/kumiko-types/event-store-executor-types";
 import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { EntityId } from "@cosmicdrift/kumiko-types/identifiers";
 import type { ErasedSubjectHandling } from "../crypto/pii-field-encryption.ts";
@@ -44,6 +45,7 @@ export type ExecutorContext = {
         readonly owned: boolean;
         readonly streamVersion: number;
     }>;
+    readonly isRowReadable: (id: EntityId, user: SessionUser, db: TenantDb, parentVisibility: ParentVisibilityOption | undefined) => Promise<boolean>;
     readonly loadDetailSnapshot: (db: TenantDb, idWhere: WhereObject, ownership: {
         kind: "pass";
     } | {

package/dist/db/event-store-executor-context.js

@@ -10,6 +10,7 @@ import { isStreamArchived } from "../event-store/index.js";
 import { assertUnreachable } from "../utils/index.js";
 import { rehydrateCompoundTypes } from "./compound-types.js";
 import { collectEncryptedFieldNames, decryptEntityFieldValues, encryptEntityFieldValues, logUndecryptableField, resolveEntityFieldEncryption, } from "./entity-field-encryption.js";
+import { resolveReadOwnership } from "./event-store-executor-read-where.js";
 import { constraintOf, isUniqueViolation } from "./pg-error.js";
 import { toSnakeCase } from "./table-builder.js";
 import { columnHandleName, schemaTableName } from "./table-introspection.js";
@@ -355,6 +356,21 @@ export function buildExecutorContext(table, entity, options) {
         const version = first["__streamVersion"];
         return { owned: true, streamVersion: typeof version === "number" ? version : 0 };
     }
+    // Same read predicate detail applies (access.read plus the parent-ref gate), evaluated
+    // for one row. The row's own isDeleted is not filtered because restore targets a
+    // soft-deleted row; includeDeleted below only concerns the parent host. Writers use it
+    // to treat an unreadable row as nonexistent.
+    async function isRowReadable(id, user, db, parentVisibility) {
+        const ownership = resolveReadOwnership({ entity, table }, String(schemaTableName(table)), user, db, parentVisibility, { includeDeleted: false, narrowTypes: undefined });
+        if (ownership.kind === "pass")
+            return true;
+        if (ownership.kind === "empty")
+            return false;
+        const tableName = String(schemaTableName(table));
+        const { whereParts, params } = buildRawIdWhere(db, { id }, ownership);
+        const rows = await executeRawQueryRead(tenantDbRunner(db), `SELECT 1 AS "__readable" FROM "${tableName}" WHERE ${whereParts.join(" AND ")} LIMIT 1`, params);
+        return rows.length > 0;
+    }
     // Row and MAX(version) in ONE statement: two reads can pair a post-write
     // version with a pre-write row, and update({version: detail.version}) would
     // then pass the optimistic lock and overwrite the newer write (lost update).
@@ -436,6 +452,7 @@ export function buildExecutorContext(table, entity, options) {
         loadById,
         assertStreamWritable,
         probeOwnershipWithStreamVersion,
+        isRowReadable,
         loadDetailSnapshot,
         loadExpectSnapshot,
         encryptForStorage,

package/dist/db/event-store-executor-write.js

@@ -24,8 +24,17 @@ import { tenantDbWriteRunner } from "./tenant-db-runner.js";
 // store-executor, split out of event-store-executor.ts. They read an explicit
 // ExecutorContext instead of capturing the factory's local scope directly.
 export function createWriteVerbs(ctx) {
-    const { table, entity, entityName, entityCache, softDelete, streamTenantFor, streamTenantOverrideFailure, streamTenantCreateFailure, encryptForStorage, decryptForRead, ownerTransitionRekeys, applyDefaults, stripSensitive, loadById, assertStreamWritable, loadExpectSnapshot, } = ctx;
+    const { table, entity, entityName, entityCache, softDelete, streamTenantFor, streamTenantOverrideFailure, streamTenantCreateFailure, encryptForStorage, decryptForRead, ownerTransitionRekeys, applyDefaults, stripSensitive, loadById, assertStreamWritable, isRowReadable, loadExpectSnapshot, } = ctx;
     const entityInstructionFieldNames = instructionFieldNames(entity);
+    // A row the caller cannot read is reported as missing, like detail does, so a write
+    // can neither change it nor echo its content back. Framework system writes skip the
+    // check as they do for forget: their role never appears in a per-role read map.
+    async function unreadableRowFailure(id, user, db, parentVisibility) {
+        if (isFrameworkSystemUser(user) || (await isRowReadable(id, user, db, parentVisibility))) {
+            return undefined;
+        }
+        return writeFailure(new NotFoundError(entityName, id));
+    }
     // update and delete funnel through here, so custom handlers and nested writes cannot
     // bypass the lock whatever they return. Setting the lock (unlocked row) passes.
     // Framework system writes that name a writePurpose (retention, erasure) are exempt:
@@ -487,6 +496,9 @@ export function createWriteVerbs(ctx) {
             });
             if (!previous)
                 return writeFailure(new NotFoundError(entityName, payload.id));
+            const unreadable = await unreadableRowFailure(payload.id, user, db, updateOptions?.parentVisibility);
+            if (unreadable)
+                return unreadable;
             const streamTenantId = updateOptions?.streamTenantId;
             const streamTenantMismatch = streamTenantOverrideFailure(db, previous, streamTenantId);
             if (streamTenantMismatch)
@@ -561,6 +573,9 @@ export function createWriteVerbs(ctx) {
             const existing = await loadById(payload.id, db);
             if (!existing)
                 return writeFailure(new NotFoundError(entityName, payload.id));
+            const unreadable = await unreadableRowFailure(payload.id, user, db, options?.parentVisibility);
+            if (unreadable)
+                return unreadable;
             const streamTenantId = options?.streamTenantId;
             const streamTenantMismatch = streamTenantOverrideFailure(db, existing, streamTenantId);
             if (streamTenantMismatch)
@@ -645,6 +660,9 @@ export function createWriteVerbs(ctx) {
             const raw = await db.fetchOne(table, { id: payload.id });
             if (!raw)
                 return writeFailure(new NotFoundError(entityName, payload.id));
+            const unreadable = await unreadableRowFailure(payload.id, user, db, options?.parentVisibility);
+            if (unreadable)
+                return unreadable;
             const streamTenantId = options?.streamTenantId;
             const streamTenantMismatch = streamTenantOverrideFailure(db, raw, streamTenantId);
             if (streamTenantMismatch)
@@ -716,6 +734,11 @@ export function createWriteVerbs(ctx) {
             }
             const runner = tenantDbWriteRunner(db, "ctx.db executor restore");
             const streamTenantId = options?.streamTenantId;
+            // Before loadSoftDeletedRow: its not_deleted answer would confirm that an unreadable
+            // live row exists.
+            const unreadable = await unreadableRowFailure(payload.id, user, db, options?.parentVisibility);
+            if (unreadable)
+                return unreadable;
             const target = await loadSoftDeletedRow(db, payload.id, streamTenantId);
             if ("failure" in target)
                 return target.failure;

package/dist/engine/entity-handlers.js

@@ -289,6 +289,7 @@ export function defineEntityWriteHandler(name, entity, options) {
                 // they rely on to intentionally force a fresh event/ciphertext.
                 return executor.update(payload, event.user, db, {
                     streamTenantId,
+                    parentVisibility: { entities: ctx.registry.getAllEntities() },
                     skipUnchanged: true,
                     preSave: runPreSave &&
                         ((changes, previous, isNew) => runPreSave(event.type, changes, previous, isNew)),
@@ -301,7 +302,10 @@ export function defineEntityWriteHandler(name, entity, options) {
                 const db = dbFor(ctx);
                 const payload = event.payload; // @cast-boundary engine-payload
                 const streamTenantId = await foreignRowTenantFor(event.user, payload.id, db, ctx);
-                return executor.delete(payload, event.user, db, { streamTenantId });
+                return executor.delete(payload, event.user, db, {
+                    streamTenantId,
+                    parentVisibility: { entities: ctx.registry.getAllEntities() },
+                });
             };
             break;
         case "restore":
@@ -310,7 +314,10 @@ export function defineEntityWriteHandler(name, entity, options) {
                 const db = dbFor(ctx);
                 const payload = event.payload; // @cast-boundary engine-payload
                 const streamTenantId = await foreignRowTenantFor(event.user, payload.id, db, ctx);
-                return executor.restore(payload, event.user, db, { streamTenantId });
+                return executor.restore(payload, event.user, db, {
+                    streamTenantId,
+                    parentVisibility: { entities: ctx.registry.getAllEntities() },
+                });
             };
             break;
         default:

package/dist/files/file-routes.js

@@ -31,6 +31,10 @@ export function deleteFailureResponseFor(error) {
     const status = isOneOf(ERROR_STATUSES, error.httpStatus) ? error.httpStatus : 500;
     return { status, code: status === 404 ? "not_found" : error.code };
 }
+// 401 (not 403) lets the client tell a revoked or expired session from a missing permission.
+function unauthenticatedUploadResponse(c) {
+    return c.json({ error: "unauthenticated: sign in to upload files", code: "unauthenticated" }, 401);
+}
 // 15 minutes — long enough for a download to start, short enough that a
 // leaked URL (e.g. from a browser history screenshot) isn't a long-lived
 // credential (see "Signed-URL default expiry" in core-files.md).
@@ -144,6 +148,10 @@ export function createFileRoutes(options) {
     // POST /files — multipart upload.
     api.post("/files", uploadBodyLimit, async (c) => {
         const user = getUser(c);
+        // Anonymous visitors share one user id and cannot bind pending uploads (bind-pending-file-refs),
+        // so an anonymous upload could never be used; 401 lets the client tell an ended session apart.
+        if (isAnonymousSessionUser(user))
+            return unauthenticatedUploadResponse(c);
         const body = await c.req.parseBody();
         const file = body["file"];
         if (!file || !(file instanceof File)) {
@@ -161,11 +169,11 @@ export function createFileRoutes(options) {
         }
         // Before any bytes are written, like the record check below. An unresolvable screen falls
         // through to storeFileAsFileRef, which answers 400; a known one must be submittable by the
-        // caller. Anonymous callers cannot bind pending uploads, so they get no upload either.
+        // caller.
         if (actionForm !== undefined &&
             options.registry !== undefined &&
             options.registry.getScreen(actionForm)?.type === "actionForm" &&
-            (isAnonymousSessionUser(user) || !mayUseActionForm(options.registry, actionForm, user))) {
+            !mayUseActionForm(options.registry, actionForm, user)) {
             return c.json({ error: "forbidden: no access to this form" }, 403);
         }
         if (entityId !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.394.0",
+  "version": "0.396.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -203,7 +203,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.394.0",
+    "@cosmicdrift/kumiko-types": "0.396.0",
     "bullmq": "^5.76.7",
     "hono": "^4.13.1",
     "i18next": "^26.1.0",
@@ -225,7 +225,7 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.394.0",
+    "@cosmicdrift/kumiko-testing": "0.396.0",
     "bun-types": "^1.4.4",
     "fflate": "^0.8.2",
     "meilisearch": "^0.58.0",

package/src/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.396.0",
+    "type": "breaking",
+    "title": "Entity writes on a row the caller cannot read fail with not_found",
+    "detail": "update, delete, restore and forget only checked access.write, so on an entity with an owner access.read rule and no access.write any tenant member with handler access could change or delete another member's row, and delete returned the decrypted row. They now apply the same access.read rule and parentRef host-visibility gate as detail and answer not_found, so the row's existence stays hidden. Framework system writes are exempt. A write the caller could not read but that failed the write rule before now reports not_found instead of ownership_denied.",
+    "migration": "Writes on rows the caller cannot read now fail with not_found; give such writers read access or run them as system. Custom handlers that call the executor directly get the parentRef gate by passing parentVisibility: { entities: ctx.registry.getAllEntities() }, as the generated handlers do."
+  },
+  {
+    "version": "0.395.0",
+    "type": "fix",
+    "title": "A file upload with an ended session ends up at the login",
+    "detail": "POST /files answered an anonymous caller (revoked or expired session) with 403 forbidden or a validation error, so the browser showed an upload error instead of the login. Anonymous callers can never use an upload (they cannot bind pending files), so every upload without a session now answers 401 with code unauthenticated before the body is read, and the file upload fields signal the ended session like any other request. Signed-in callers without permission still get 403."
+  },
   {
     "version": "0.394.0",
     "type": "fix",