@cosmicdrift/kumiko-samples 0.352.0 → 0.354.0

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -1,5 +1,6 @@
 import { computeRevisionEtag, etagMatches } from "@cosmicdrift/kumiko-framework/api";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
 import {
   type BrandingTokens,
   cachedSecurePageResponse,
@@ -7,7 +8,7 @@ import {
   renderSafeMarkdown,
   wrapInLayout,
 } from "../page-render/index.js";
-import type { SystemQueryFn } from "../shared/index.js";
+import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.js";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding.js";
 import { createBrandingQuery } from "./handlers/branding.query.js";
 import { bySlugQuery } from "./handlers/by-slug.query.js";
@@ -51,16 +52,18 @@ function brandingRevisionSeed(branding: BrandingTokens): string {
   ]);
 }
 
-// Never throws: a query failure or malformed result degrades to the
-// unbranded default (branding is decoration, not a hard dependency of the
-// page render).
+// A query failure or malformed result degrades to the unbranded default
+// (branding is decoration, not a hard dependency of the page render). A rate
+// limit is rethrown so the route answers 429 instead of serving (and caching)
+// an unbranded page.
 async function readBrandingViaSystemQuery(
   systemQuery: SystemQueryFn,
   tenantId: string,
 ): Promise<BrandingTokens> {
   try {
     return coerceBranding(await systemQuery(BRANDING_QUERY_QN, {}, tenantId));
-  } catch {
+  } catch (error) {
+    if (error instanceof RateLimitError) throw error;
     return EMPTY_BRANDING;
   }
 }
@@ -207,12 +210,22 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
         // von resolverTrust: "authoritative" zurecht abgelehnt; siehe
         // systemQuery's Doc in http-route.ts). Branding ist Deko → ein
         // Fehlschlag degradiert zum unbranded Default, blockt nie die Page.
-        const [pageSettled, brandingResult] = await Promise.all([
-          systemQuery(BY_SLUG_QN, { slug, lang }, tenantId)
-            .then((data) => ({ ok: true as const, data: data as BySlugQueryResult }))
-            .catch(() => ({ ok: false as const, data: null as BySlugQueryResult })),
-          readBrandingViaSystemQuery(systemQuery, tenantId),
-        ]);
+        let pageSettled: { ok: true; data: BySlugQueryResult } | { ok: false };
+        let brandingResult: BrandingTokens;
+        try {
+          [pageSettled, brandingResult] = await Promise.all([
+            systemQuery(BY_SLUG_QN, { slug, lang }, tenantId)
+              .then((data) => ({ ok: true as const, data: data as BySlugQueryResult }))
+              .catch((error: unknown) => {
+                if (error instanceof RateLimitError) throw error;
+                return { ok: false as const };
+              }),
+            readBrandingViaSystemQuery(systemQuery, tenantId),
+          ]);
+        } catch (error) {
+          if (error instanceof RateLimitError) return rateLimitedTextResponse(error);
+          throw error;
+        }
         if (!pageSettled.ok) return c.text("page unavailable", 503);
 
         const data = pageSettled.data;

package/packages/bundled-features/src/notes-history/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "notes-history adds a composite index on (tenantId, entityType, entityId) for note entries, so the schema-drift check fails until the app regenerates",
+    "detail": "Review batch H2: framework parts of consumer-app findings.\n- `file-derivatives`: the `isPublic` predicate args carry `fileRefId`, so a predicate can reject a client-spoofed FileRef that claims another entity's `entityId`/`fieldName`.\n- `sessions`: `createSessionsFeature({ adminAccess: \"systemAdmin\" })` narrows the admin list/detail queries and both admin screens together (default `\"admin\"`, unchanged).\n- `user-profile`: `change-email` is open to every signed-in user (`openToAll`), so a tenant member whose only role is `TenantAdmin` can change their own email; the handler still re-checks the password.\n- `notes-history`: composite index on `(tenantId, entityType, entityId)` for note entries. Apps run `kumiko-schema generate` after the bump.\n- guards: `// kumiko-lint-ignore a,b reason` suppresses several guards on one line (`lineHasIgnoreTag`); `primitives-discipline` and `no-custom-primitives` honour it.\n- dev-server: `kumiko-build --check` verifies `.kumiko/` is current without writing (exit 1 on drift); `runCodegen` takes `checkOnly`.",
+    "migration": "Run `kumiko-schema generate` in apps that mount notes-history and commit the generated migration."
+  },
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "read_note_mentions gets a tenant, subject index",
+    "migration": "Run `kumiko schema generate`; it emits an in-place CREATE INDEX with no DROP and no rebuild."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",

package/packages/bundled-features/src/notes-history/entity.ts

@@ -91,6 +91,8 @@ export function createNoteEntryEntity(
         find: "none",
       }),
     },
+    // Every host detail screen reads its notes by tenant + host entity.
+    indexes: [{ columns: ["tenantId", "entityType", "entityId"] }],
   });
 }
 
@@ -122,6 +124,8 @@ export function createNoteMentionEntity() {
       }),
       subjectId: createTextField({ required: true, maxLength: 64, personal: "ref" }),
     },
+    // The forget cascade looks mentions up by subject within one tenant.
+    indexes: [{ columns: ["tenantId", "subjectId"] }],
   });
 }
 

package/packages/bundled-features/src/notes-history/feature.ts

@@ -20,7 +20,7 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { hasWhereRule } from "../shared/index.js";
+import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
 import { DEFAULT_NOTES_HISTORY_ACCESS, NOTES_HISTORY_FEATURE_NAME } from "./constants.js";
 import { createNoteEntryEntity, noteMentionEntity } from "./entity.js";
 import { createNoteEntryExecutor } from "./executor.js";
@@ -123,17 +123,7 @@ export function createNotesHistoryFeature(
   ) {
     return notesHistoryFeature;
   }
-  if (hasWhereRule(opts.ownership?.write)) {
-    throw new Error(
-      "createNotesHistoryFeature({ ownership }): ownership.write must not contain a " +
-        '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
-        "layer (the read path, via buildOwnershipClause). Write paths that " +
-        "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them, so such a rule can only ever deny — boot validation " +
-        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
-        "leave it unset.",
-    );
-  }
+  assertNoWhereRuleInOwnershipWrite("createNotesHistoryFeature", opts.ownership?.write);
   // A mount that accepts no parents at all can never take a note write —
   // that's a config mistake, not a valid allowlist. Omit `parents` instead
   // of passing an empty array.

package/packages/bundled-features/src/personal-access-tokens/handlers/create.write.ts

@@ -66,6 +66,7 @@ export function createPatCreateHandler(opts: CreatePatOptions = {}) {
       },
     },
     escapeHatch: {
+      grants: ["systemIdentity"],
       reason:
         "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, " +
         "user:findForAuth) to re-verify the current password before minting the token. Also " +

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -4,10 +4,25 @@ import {
   type ProjectionListScreenDefinition,
   type SecretMintScreenDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries } from "./constants.js";
+import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
+import { fieldOptionLabelKeyPrefix } from "@cosmicdrift/kumiko-headless";
+import {
+  PAT_FEATURE,
+  PAT_MINT_SCREEN_ID,
+  PAT_SCREEN_ID,
+  PatHandlers,
+  PatQueries,
+} from "./constants.js";
 import type { PatScopeConfig } from "./scopes.js";
 
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
+// Same keys the mint form's `scopes` multiSelect options resolve through
+// (see patScopeOptionTranslations), so list and form show identical labels.
+const PAT_SCOPE_OPTION_KEY_PREFIX = fieldOptionLabelKeyPrefix(
+  PAT_FEATURE,
+  ACTION_FORM_ENTITY,
+  "scopes",
+);
 
 // Both screens render only for tenants whose tier includes the feature; the
 // availability query is rejected by the feature gate otherwise.
@@ -29,11 +44,17 @@ export const patListScreen: ProjectionListScreenDefinition = {
   defaultSort: { field: "createdAt", dir: "desc" },
   columns: [
     { field: "name", label: i18nKey("pat.list.col.name") },
-    { field: "prefix", label: i18nKey("pat.list.col.prefix") },
-    { field: "scopes", label: i18nKey("pat.list.col.scopes") },
+    { field: "prefix", label: i18nKey("pat.list.col.prefix"), sortable: false },
+    {
+      field: "scopes",
+      label: i18nKey("pat.list.col.scopes"),
+      sortable: false,
+      renderer: { format: "enumOption", keyPrefix: PAT_SCOPE_OPTION_KEY_PREFIX },
+    },
     {
       field: "status",
       label: i18nKey("pat.list.col.status"),
+      sortable: false,
       renderer: { format: "enumOption", keyPrefix: PAT_STATUS_OPTION_KEY_PREFIX },
     },
     {

package/packages/bundled-features/src/seo/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "sitemap.xml and llms.txt answer 429 when the managed-pages read is rate limited instead of omitting the pages"
+  },
   {
     "version": "0.147.3",
     "type": "fix",

package/packages/bundled-features/src/seo/feature.ts

@@ -5,9 +5,10 @@ import {
   type FeatureDefinition,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
 import { LEGAL_ROUTES } from "../legal-pages/index.js";
 import { cachedSecurePageResponse } from "../page-render/index.js";
-import type { SystemQueryFn } from "../shared/index.js";
+import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.js";
 import { SEO_CONFIG_KEYS, SEO_DEFAULT_PATHS } from "./constants.js";
 import { seoConfigQuery } from "./handlers/seo-config.query.js";
 import { buildLlmsTxt } from "./llms-txt.js";
@@ -125,7 +126,9 @@ async function gatherEntries(
             lastmod: page.updatedAt,
           });
         }
-      } catch {
+      } catch (error) {
+        // A rate limit must not look like "pages removed" to a crawler.
+        if (error instanceof RateLimitError) throw error;
         // managed-pages unreachable/not mounted — degrade to callback-only entries.
       }
     }
@@ -188,7 +191,13 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
       anonymous: true,
       handler: async (c, { systemQuery }) => {
         const { origin, host } = requestHost(c);
-        const entries = await gatherEntries(opts, systemQuery, origin, host);
+        let entries: SitemapEntry[];
+        try {
+          entries = await gatherEntries(opts, systemQuery, origin, host);
+        } catch (error) {
+          if (error instanceof RateLimitError) return rateLimitedTextResponse(error);
+          throw error;
+        }
         const xml = buildSitemapXml(entries);
         const etag = computeRevisionEtag([host, xml]);
         return cachedSecurePageResponse(c.req.raw, {
@@ -209,10 +218,17 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
         const tenantId = opts.managedPages
           ? ((await opts.managedPages.resolveApexTenant(host)) ?? SYSTEM_TENANT_ID)
           : SYSTEM_TENANT_ID;
-        const [entries, seoConfig] = await Promise.all([
-          gatherEntries(opts, systemQuery, origin, host),
-          readSeoConfig(systemQuery, tenantId),
-        ]);
+        let entries: SitemapEntry[];
+        let seoConfig: SeoConfigValues;
+        try {
+          [entries, seoConfig] = await Promise.all([
+            gatherEntries(opts, systemQuery, origin, host),
+            readSeoConfig(systemQuery, tenantId),
+          ]);
+        } catch (error) {
+          if (error instanceof RateLimitError) return rateLimitedTextResponse(error);
+          throw error;
+        }
         const sections =
           entries.length > 0
             ? [

package/packages/bundled-features/src/sessions/feature.ts

@@ -4,18 +4,26 @@ import {
   type SessionStoreProvider,
 } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { type DbConnection, deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  defineFeature,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { USER_SESSION_ENTITY_NAME } from "./constants.js";
 import { cleanupJob } from "./handlers/cleanup.job.js";
-import { detailQuery } from "./handlers/detail.query.js";
-import { listQuery } from "./handlers/list.query.js";
+import { createDetailQuery } from "./handlers/detail.query.js";
+import { createListQuery } from "./handlers/list.query.js";
 import { mineQuery } from "./handlers/mine.query.js";
 import { revokeWrite } from "./handlers/revoke.write.js";
 import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write.js";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write.js";
 import { SESSIONS_I18N } from "./i18n.js";
 import { userSessionEntity } from "./schema/user-session.js";
-import { sessionDetailScreen, sessionListScreen, sessionMineScreen } from "./screens.js";
+import {
+  createSessionDetailScreen,
+  createSessionListScreen,
+  sessionMineScreen,
+} from "./screens.js";
 import {
   createSessionCallbacks,
   type SessionAllOthersRevoker,
@@ -45,6 +53,10 @@ export type SessionsFeatureOptions = {
   // Session JWT / store_user_sessions TTL. Was previously auth.sessions.expiresInMs
   // (#1372) — lives on the sessions feature now that sessionStore is the wiring.
   readonly expiresInMs?: number;
+  // Access preset for the admin list/detail queries and screens; they expose decrypted
+  // IP/user-agent of every session in the tenant. A preset name, not a role array, because
+  // dedupeOptions must stay primitive.
+  readonly adminAccess?: "admin" | "systemAdmin";
 };
 
 export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
@@ -89,6 +101,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
   return defineFeature(
     "sessions",
     (r) => {
+      const adminRoles = access[options?.adminAccess ?? "admin"];
       r.describe(
         "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
       );
@@ -162,8 +175,8 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
 
       const queries = {
         mine: r.queryHandler(mineQuery),
-        list: r.queryHandler(listQuery),
-        detail: r.queryHandler(detailQuery),
+        list: r.queryHandler(createListQuery(adminRoles)),
+        detail: r.queryHandler(createDetailQuery(adminRoles)),
       };
 
       // Retention: chunked DELETE of expired/revoked rows. Manual trigger
@@ -222,8 +235,8 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
 
       r.translations({ keys: SESSIONS_I18N });
 
-      r.screen(sessionListScreen);
-      r.screen(sessionDetailScreen);
+      r.screen(createSessionListScreen(adminRoles));
+      r.screen(createSessionDetailScreen(adminRoles));
       r.screen(sessionMineScreen);
       r.nav({
         id: "session-list",

package/packages/bundled-features/src/sessions/handlers/detail.query.ts

@@ -16,36 +16,37 @@ const sessionRowSchema = z.object({
   userAgent: z.string().nullable(),
 });
 
-export const detailQuery = defineQueryHandler({
-  name: "user-session:detail",
-  schema: z.object({ id: z.uuid() }),
-  access: { roles: access.admin },
-  description:
-    "Loads one session of the active tenant by its id with owner, timestamps and decrypted IP/user-agent; use it when an admin investigates a specific session found through the session list.",
-  // Decrypted IP and user-agent.
-  agent: { risk: "high" },
-  outputSchema: sessionRowSchema.nullable(),
-  handler: async (query, ctx) => {
-    const row = await fetchOne<{
-      id: string;
-      userId: string;
-      createdAt: unknown;
-      expiresAt: unknown;
-      revokedAt: unknown;
-      ip: string | null;
-      userAgent: string | null;
-    }>(ctx.db, userSessionTable, { id: query.payload.id });
-    if (!row) return null;
-    return {
-      id: row.id,
-      userId: row.userId,
-      createdAt: row.createdAt,
-      expiresAt: row.expiresAt,
-      revokedAt: row.revokedAt,
-      ip: row.ip ? await decryptStoredPii(row.ip, "ip", "sessions:detail") : row.ip,
-      userAgent: row.userAgent
-        ? await decryptStoredPii(row.userAgent, "userAgent", "sessions:detail")
-        : row.userAgent,
-    };
-  },
-});
+export const createDetailQuery = (adminRoles: readonly string[] = access.admin) =>
+  defineQueryHandler({
+    name: "user-session:detail",
+    schema: z.object({ id: z.uuid() }),
+    access: { roles: adminRoles },
+    description:
+      "Loads one session of the active tenant by its id with owner, timestamps and decrypted IP/user-agent; use it when an admin investigates a specific session found through the session list.",
+    // Decrypted IP and user-agent.
+    agent: { risk: "high" },
+    outputSchema: sessionRowSchema.nullable(),
+    handler: async (query, ctx) => {
+      const row = await fetchOne<{
+        id: string;
+        userId: string;
+        createdAt: unknown;
+        expiresAt: unknown;
+        revokedAt: unknown;
+        ip: string | null;
+        userAgent: string | null;
+      }>(ctx.db, userSessionTable, { id: query.payload.id });
+      if (!row) return null;
+      return {
+        id: row.id,
+        userId: row.userId,
+        createdAt: row.createdAt,
+        expiresAt: row.expiresAt,
+        revokedAt: row.revokedAt,
+        ip: row.ip ? await decryptStoredPii(row.ip, "ip", "sessions:detail") : row.ip,
+        userAgent: row.userAgent
+          ? await decryptStoredPii(row.userAgent, "userAgent", "sessions:detail")
+          : row.userAgent,
+      };
+    },
+  });

package/packages/bundled-features/src/sessions/handlers/list.query.ts

@@ -25,68 +25,71 @@ function isSortableColumn(value: string): value is SortableColumn {
 // tenantId column. Includes revoked rows; UI shows revokedAt distinct.
 // No cursor — nextCursor is always null; `limit` only caps the page size,
 // it doesn't offset into a further one.
-export const listQuery = definePagedQueryHandler({
-  name: "user-session:list",
-  schema: z.object({
-    limit: z.number().int().nonnegative().max(MAX_LIST_LIMIT).optional(),
-    sort: z.string().optional(),
-    sortDirection: z.enum(["asc", "desc"]).optional(),
-  }),
-  access: { roles: access.admin },
-  description:
-    "Lists every session in the active tenant, live and revoked, sortable by id, user, creation, expiry or revocation, for an admin auditing who is signed in.",
-  outputSchema: z.object({
-    rows: z.array(
-      z.object({
-        id: z.string(),
-        userId: z.string(),
-        createdAt: z.unknown(),
-        expiresAt: z.unknown(),
-        revokedAt: z.unknown(),
-        ip: z.string().nullable(),
-        userAgent: z.string().nullable(),
-      }),
-    ),
-    nextCursor: z.string().nullable(),
-  }),
-  handler: async (query, ctx) => {
-    const requestedSort = query.payload.sort;
-    const sortColumn: SortableColumn =
-      requestedSort !== undefined && isSortableColumn(requestedSort) ? requestedSort : "createdAt";
-    const rows = await selectMany<{
-      id: string;
-      userId: string;
-      createdAt: unknown;
-      expiresAt: unknown;
-      revokedAt: unknown;
-      ip: string | null;
-      userAgent: string | null;
-    }>(ctx.db, userSessionTable, undefined, {
-      // `id` as a tie-breaker keeps row order (and, with `limit` set, row
-      // selection) deterministic across identical requests — sortColumn
-      // alone isn't unique (e.g. many NULL revokedAt, or equal timestamps).
-      orderBy:
-        sortColumn === "id"
-          ? { col: "id", direction: query.payload.sortDirection ?? "desc" }
-          : [
-              { col: sortColumn, direction: query.payload.sortDirection ?? "desc" },
-              { col: "id", direction: "asc" },
-            ],
-      ...(query.payload.limit !== undefined && { limit: query.payload.limit }),
-    });
-    const decryptedRows = await Promise.all(
-      rows.map(async (r) => ({
-        id: r.id,
-        userId: r.userId,
-        createdAt: r.createdAt,
-        expiresAt: r.expiresAt,
-        revokedAt: r.revokedAt,
-        ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:list") : r.ip,
-        userAgent: r.userAgent
-          ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:list")
-          : r.userAgent,
-      })),
-    );
-    return { rows: decryptedRows, nextCursor: null };
-  },
-});
+export const createListQuery = (adminRoles: readonly string[] = access.admin) =>
+  definePagedQueryHandler({
+    name: "user-session:list",
+    schema: z.object({
+      limit: z.number().int().nonnegative().max(MAX_LIST_LIMIT).optional(),
+      sort: z.string().optional(),
+      sortDirection: z.enum(["asc", "desc"]).optional(),
+    }),
+    access: { roles: adminRoles },
+    description:
+      "Lists every session in the active tenant, live and revoked, sortable by id, user, creation, expiry or revocation, for an admin auditing who is signed in.",
+    outputSchema: z.object({
+      rows: z.array(
+        z.object({
+          id: z.string(),
+          userId: z.string(),
+          createdAt: z.unknown(),
+          expiresAt: z.unknown(),
+          revokedAt: z.unknown(),
+          ip: z.string().nullable(),
+          userAgent: z.string().nullable(),
+        }),
+      ),
+      nextCursor: z.string().nullable(),
+    }),
+    handler: async (query, ctx) => {
+      const requestedSort = query.payload.sort;
+      const sortColumn: SortableColumn =
+        requestedSort !== undefined && isSortableColumn(requestedSort)
+          ? requestedSort
+          : "createdAt";
+      const rows = await selectMany<{
+        id: string;
+        userId: string;
+        createdAt: unknown;
+        expiresAt: unknown;
+        revokedAt: unknown;
+        ip: string | null;
+        userAgent: string | null;
+      }>(ctx.db, userSessionTable, undefined, {
+        // `id` as a tie-breaker keeps row order (and, with `limit` set, row
+        // selection) deterministic across identical requests — sortColumn
+        // alone isn't unique (e.g. many NULL revokedAt, or equal timestamps).
+        orderBy:
+          sortColumn === "id"
+            ? { col: "id", direction: query.payload.sortDirection ?? "desc" }
+            : [
+                { col: sortColumn, direction: query.payload.sortDirection ?? "desc" },
+                { col: "id", direction: "asc" },
+              ],
+        ...(query.payload.limit !== undefined && { limit: query.payload.limit }),
+      });
+      const decryptedRows = await Promise.all(
+        rows.map(async (r) => ({
+          id: r.id,
+          userId: r.userId,
+          createdAt: r.createdAt,
+          expiresAt: r.expiresAt,
+          revokedAt: r.revokedAt,
+          ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:list") : r.ip,
+          userAgent: r.userAgent
+            ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:list")
+            : r.userAgent,
+        })),
+      );
+      return { rows: decryptedRows, nextCursor: null };
+    },
+  });

package/packages/bundled-features/src/sessions/screens.ts

@@ -13,9 +13,9 @@ import {
   SessionQueries,
 } from "./constants.js";
 
-const listAccess = { roles: access.admin };
-
-export const sessionListScreen: ProjectionListScreenDefinition = {
+export const createSessionListScreen = (
+  adminRoles: readonly string[] = access.admin,
+): ProjectionListScreenDefinition => ({
   id: SESSION_LIST_SCREEN_ID,
   type: "projectionList",
   query: SessionQueries.list,
@@ -61,10 +61,12 @@ export const sessionListScreen: ProjectionListScreenDefinition = {
       rowClick: true,
     },
   ],
-  access: listAccess,
-};
+  access: { roles: adminRoles },
+});
 
-export const sessionDetailScreen: ProjectionDetailScreenDefinition = {
+export const createSessionDetailScreen = (
+  adminRoles: readonly string[] = access.admin,
+): ProjectionDetailScreenDefinition => ({
   id: SESSION_DETAIL_SCREEN_ID,
   type: "projectionDetail",
   query: SessionQueries.detail,
@@ -97,8 +99,8 @@ export const sessionDetailScreen: ProjectionDetailScreenDefinition = {
     ip: i18nKey("sessions.detail.field.ip"),
     userAgent: i18nKey("sessions.detail.field.userAgent"),
   },
-  access: listAccess,
-};
+  access: { roles: adminRoles },
+});
 
 // Revoke is hidden on the current session — it would sign the user out mid-click; logout covers it.
 export const sessionMineScreen: ProjectionListScreenDefinition = {

package/packages/bundled-features/src/shared/assert-no-where-rule-in-ownership-write.ts

@@ -0,0 +1,25 @@
+import type { OwnershipMap } from "@cosmicdrift/kumiko-framework/engine";
+
+// Boot validation rejects `{ kind: "where" }` in access.write too (fw#2626);
+// failing at factory time names the option instead of an entity scope.
+export function assertNoWhereRuleInOwnershipWrite(
+  factoryName: string,
+  writeOwnership: OwnershipMap | undefined,
+): void {
+  // skip: no write ownership declared, nothing to validate
+  if (!writeOwnership) return;
+  const hasWhereRule = Object.values(writeOwnership).some(
+    (rule) => rule !== "all" && rule.kind === "where",
+  );
+  // skip: no where-rule present, the option is valid
+  if (!hasWhereRule) return;
+  throw new Error(
+    `${factoryName}({ ownership }): ownership.write must not contain a ` +
+      '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
+      "layer (the read path, via buildOwnershipClause). Write paths that " +
+      "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
+      "evaluate them, so such a rule can only ever deny — boot validation " +
+      "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
+      "leave it unset.",
+  );
+}