@cosmicdrift/kumiko-samples 0.377.0 → 0.379.0

package/packages/bundled-features/src/form-draft/handlers/get.query.ts

@@ -1,8 +1,8 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { FORM_DRAFT_ACCESS } from "../constants.ts";
 import { lookupDraft } from "../lookup.ts";
 import type { FormDraftBlob } from "../schemas.ts";
-import { formDraftBlobSchema, getDraftPayloadSchema } from "../schemas.ts";
+import { getDraftPayloadSchema } from "../schemas.ts";
+import { FORM_DRAFT_ACCESS } from "../web/constants.ts";
 
 export type GetDraftResult = { readonly draft: FormDraftBlob | null };
 
@@ -24,15 +24,14 @@ export const getDraftQuery = defineQueryHandler({
       query.payload.draftKey,
     );
     if (!row) return { draft: null };
-    const parsed = formDraftBlobSchema.safeParse(row.draft);
-    if (!parsed.success) {
-      // Schema evolution or a corrupt jsonb row: surface it to operators
+    if (!row.draft) {
+      // Schema evolution or a corrupt/erased row: surface it to operators
       // instead of silently making the user's draft vanish.
       ctx.log?.warn?.(
-        `[form-draft:get] stored blob for draftKey=${query.payload.draftKey} failed schema, treating as absent: ${parsed.error.message}`,
+        `[form-draft:get] stored blob for draftKey=${query.payload.draftKey} failed schema or decryption, treating as absent`,
       );
       return { draft: null };
     }
-    return { draft: parsed.data };
+    return { draft: row.draft };
   },
 });

package/packages/bundled-features/src/form-draft/handlers/list.query.ts

@@ -1,7 +1,7 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { FORM_DRAFT_ACCESS } from "../constants.ts";
 import { listDraftsByScreen } from "../lookup.ts";
 import { listDraftsPayloadSchema } from "../schemas.ts";
+import { FORM_DRAFT_ACCESS } from "../web/constants.ts";
 
 export type ListDraftsResult = {
   readonly drafts: readonly {
@@ -39,12 +39,18 @@ export const listDraftsQuery = defineQueryHandler({
       query.payload.screenId,
     );
     const drafts = rows
-      .map((row) => ({
-        id: row.id,
-        draftKey: row.draftKey,
-        stepIndex: row.draft.stepIndex,
-        savedAt: row.draft.savedAt,
-      }))
+      .flatMap((row) =>
+        row.draft
+          ? [
+              {
+                id: row.id,
+                draftKey: row.draftKey,
+                stepIndex: row.draft.stepIndex,
+                savedAt: row.draft.savedAt,
+              },
+            ]
+          : [],
+      )
       .sort(byNewestFirst)
       // Matches listDraftsByScreen selectMany limit — JS sort cannot push the
       // ceiling into SQL while savedAt lives inside jsonb.

package/packages/bundled-features/src/form-draft/handlers/save.write.ts

@@ -1,15 +1,15 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failUnprocessable, type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import {
-  FORM_DRAFT_ACCESS,
-  FORM_DRAFT_MAX_PER_OWNER,
-  FORM_DRAFT_UNIQUE_KEY_CONSTRAINT,
-} from "../constants.ts";
 import { countDraftsByOwner } from "../db/queries/draft-count.ts";
 import { formDraftExecutor } from "../executor.ts";
 import { lookupDraft } from "../lookup.ts";
 import { saveDraftPayloadSchema } from "../schemas.ts";
+import {
+  FORM_DRAFT_ACCESS,
+  FORM_DRAFT_MAX_PER_OWNER,
+  FORM_DRAFT_UNIQUE_KEY_CONSTRAINT,
+} from "../web/constants.ts";
 
 /**
  * save is an upsert keyed on (tenantId, ownerId, draftKey) — same

package/packages/bundled-features/src/form-draft/index.ts

@@ -1,11 +1,3 @@
-export {
-  FORM_DRAFT_ACCESS,
-  FORM_DRAFT_FEATURE_NAME,
-  FORM_DRAFT_KEY_MAX_LENGTH,
-  FORM_DRAFT_UNIQUE_KEY_CONSTRAINT,
-  FormDraftHandlers,
-  FormDraftQueries,
-} from "./constants.ts";
 export { formDraftEntity } from "./entity.ts";
 export { formDraftExecutor, formDraftTable } from "./executor.ts";
 export { createFormDraftFeature } from "./feature.ts";
@@ -26,3 +18,11 @@ export {
   type SaveDraftPayload,
   saveDraftPayloadSchema,
 } from "./schemas.ts";
+export {
+  FORM_DRAFT_ACCESS,
+  FORM_DRAFT_FEATURE_NAME,
+  FORM_DRAFT_KEY_MAX_LENGTH,
+  FORM_DRAFT_UNIQUE_KEY_CONSTRAINT,
+  FormDraftHandlers,
+  FormDraftQueries,
+} from "./web/constants.ts";

package/packages/bundled-features/src/form-draft/lookup.ts

@@ -2,13 +2,14 @@ import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { readStoredDraft } from "./decrypt-draft.ts";
 import { formDraftTable } from "./executor.ts";
 import type { FormDraftBlob } from "./schemas.ts";
 
 export type FormDraftRow = {
   readonly id: string;
   readonly version: number;
-  readonly draft: FormDraftBlob;
+  readonly draft: FormDraftBlob | null;
   readonly insertedAt: Temporal.Instant;
 };
 
@@ -21,13 +22,15 @@ export async function lookupDraft(
   ownerId: string,
   draftKey: string,
 ): Promise<FormDraftRow | undefined> {
-  return fetchOne<FormDraftRow>(db, formDraftTable, { tenantId, ownerId, draftKey });
+  const row = await fetchOne<FormDraftRow>(db, formDraftTable, { tenantId, ownerId, draftKey });
+  if (!row) return undefined;
+  return { ...row, draft: await readStoredDraft(row.draft) };
 }
 
 export type FormDraftSummaryRow = {
   readonly id: string;
   readonly draftKey: string;
-  readonly draft: FormDraftBlob;
+  readonly draft: FormDraftBlob | null;
 };
 
 // LIKE metacharacters in a caller-controlled screenId must not widen the
@@ -49,7 +52,7 @@ export async function listDraftsByScreen(
 ): Promise<readonly FormDraftSummaryRow[]> {
   // ponytail: hard cap — savedAt lives in jsonb so SQL ORDER BY+LIMIT is wrong;
   // promote savedAt to a column when callers need correct newest-N under the ceiling.
-  return selectMany<FormDraftSummaryRow>(
+  const rows = await selectMany<FormDraftSummaryRow>(
     db,
     formDraftTable,
     {
@@ -59,4 +62,7 @@ export async function listDraftsByScreen(
     },
     { limit: 200 },
   );
+  return Promise.all(
+    rows.map(async (row) => ({ ...row, draft: await readStoredDraft(row.draft) })),
+  );
 }

package/packages/bundled-features/src/form-draft/schemas.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_VALUES_MAX_BYTES } from "./constants.ts";
+import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_VALUES_MAX_BYTES } from "./web/constants.ts";
 
 const draftKeySchema = z.string().trim().min(1).max(FORM_DRAFT_KEY_MAX_LENGTH);
 

package/packages/bundled-features/src/form-draft/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // form-draft bundle constants — feature-name + qualified handler/query names.
 //
 // Part of CosmicDriftGameStudio/kumiko-framework#1883 (wizard mode), issue #1889.

package/packages/bundled-features/src/form-draft-user-data/hooks.ts

@@ -27,8 +27,8 @@ export const formDraftExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
-// Real physical delete, not crypto-shredding — `draft` is jsonb (entity.ts
-// explains why it can't use the string-only PII field-encryption engine).
+// Deletes the row through the event store; `draft` is ciphertext under the
+// owner's key in the row and in every event (previous of the delete included).
 // A drafted form is pure pre-submit scratch state with no value once the
 // owner is gone, so both forget strategies (delete/anonymize) remove the
 // row outright rather than anonymizing in place. Per-row via the executor

package/packages/bundled-features/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.378.0",
+    "type": "fix",
+    "title": "Mailbox list accepts the screen's limit",
+    "detail": "account:list accepted an empty payload only, so the projectionList screen's limit was rejected. It now takes limit up to MAX_LIST_LIMIT and returns the visible mailboxes ordered by id."
+  },
   {
     "version": "0.377.0",
     "type": "improvement",

package/packages/bundled-features/src/inbound-mail-foundation/handlers/list-accounts.query.ts

@@ -11,13 +11,16 @@ import {
   configuredPiiSubjectKms,
   decryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { MAX_LIST_LIMIT, type QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { MAIL_ACCOUNT_PII_FIELDS } from "../entities.ts";
 import { mailAccountsProjectionTable } from "../projection.ts";
 import { isVisibleToCaller } from "./scope-visibility.ts";
 
-const listAccountsSchema = z.object({}).strict();
+// The projectionList screen always sends `limit`; unknown keys stay rejected.
+const listAccountsSchema = z
+  .object({ limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT) })
+  .strict();
 
 export const listAccountsQuery: QueryHandlerDef = {
   name: "account:list",
@@ -25,11 +28,15 @@ export const listAccountsQuery: QueryHandlerDef = {
   access: { roles: ["SystemAdmin", "TenantAdmin", "User"] },
   description:
     "Lists the connected mailboxes of the caller's tenant with the mailbox address decrypted, hiding personal mailboxes the caller neither owns nor administers; use it for the mail connect and settings views.",
-  handler: async (_query, ctx) => {
+  handler: async (query, ctx) => {
+    const { limit } = listAccountsSchema.parse(query.payload);
     const allRows = await ctx.db.selectMany(mailAccountsProjectionTable, {
       tenantId: ctx.user.tenantId,
     });
-    const rows = allRows.filter((row) => isVisibleToCaller(row, ctx.user));
+    const rows = allRows
+      .filter((row) => isVisibleToCaller(row, ctx.user))
+      .sort((a, b) => String(a["id"]).localeCompare(String(b["id"])))
+      .slice(0, limit);
     const piiKms = configuredPiiSubjectKms();
     if (!piiKms) return { rows };
     const decryptedRows = await Promise.all(

package/packages/bundled-features/src/inbound-mail-foundation/retention-sweep.ts

@@ -24,14 +24,12 @@
 // erst bei tenant-destroy (Key-Erase). Read-Row + Body-File sind nach dem
 // Sweep weg; das Event-Log ist append-only by design.
 
-import {
-  type DbRunner,
-  deleteMany,
-  type EntityTableMeta,
-  selectMany,
-} from "@cosmicdrift/kumiko-framework/db";
+import { type DbRunner, deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { archiveStream } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  archiveStream,
+  deleteRowsWithoutReplayableStream,
+} from "@cosmicdrift/kumiko-framework/event-store";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { seenMessageTable } from "./entities.ts";
 import { INBOUND_MESSAGE_AGGREGATE_TYPE } from "./events.ts";
@@ -136,10 +134,12 @@ async function purgeExpiredMessages(
       ids.push(row.id);
     }
     if (ids.length > 0) {
-      await deleteMany(args.db, inboundMessagesProjectionTable as EntityTableMeta, {
-        id: { in: ids },
+      const deleted = await deleteRowsWithoutReplayableStream(args.db, {
+        table: inboundMessagesProjectionTable,
+        ids,
+        tenantId: args.tenantId,
       });
-      messagesPurged += ids.length;
+      messagesPurged += deleted.length;
     }
 
     if (rows.length < BATCH_LIMIT) break;

package/packages/bundled-features/src/jobs/feature.ts

@@ -3,12 +3,6 @@ import {
   type FeatureDefinition,
   i18nKey,
 } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  JOB_RUN_DETAIL_SCREEN_ID,
-  JOB_RUNS_SCREEN_ID,
-  JobHandlers,
-  JobQueries,
-} from "./constants.ts";
 import { catalogQuery } from "./handlers/catalog.query.ts";
 import { detailQuery } from "./handlers/detail.query.ts";
 import { listQuery } from "./handlers/list.query.ts";
@@ -29,10 +23,16 @@ import {
 import { tenantFailuresQuery } from "./handlers/tenant-failures.query.ts";
 import { tenantRunsQuery } from "./handlers/tenant-runs.query.ts";
 import { triggerWrite } from "./handlers/trigger.write.ts";
-import { JOBS_I18N } from "./i18n.ts";
 import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table.ts";
 import { tenantJobFailuresTableMeta } from "./tenant-job-failure-table.ts";
 import { tenantJobRunsTableMeta } from "./tenant-job-run-table.ts";
+import {
+  JOB_RUN_DETAIL_SCREEN_ID,
+  JOB_RUNS_SCREEN_ID,
+  JobHandlers,
+  JobQueries,
+} from "./web/constants.ts";
+import { JOBS_I18N } from "./web/i18n.ts";
 
 export type JobsFeatureOptions = {
   // How long a job run (and its logs) stays in store_job_runs/

package/packages/bundled-features/src/jobs/handlers/retry.write.ts

@@ -11,8 +11,8 @@ import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
-import { JobErrors } from "../constants.ts";
 import { jobRunsTable } from "../job-run-table.ts";
+import { JobErrors } from "../web/constants.ts";
 
 type JobRunRow = {
   readonly status: string;

package/packages/bundled-features/src/jobs/handlers/trigger.write.ts

@@ -8,8 +8,8 @@ import {
 } from "@cosmicdrift/kumiko-framework/errors";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import * as z from "zod";
-import { JobErrors } from "../constants.ts";
 import { isManualTrigger } from "../is-manual-trigger.ts";
+import { JobErrors } from "../web/constants.ts";
 
 function invalidPayloadError(): UnprocessableError {
   return new UnprocessableError(JobErrors.invalidPayload, {

package/packages/bundled-features/src/jobs/index.ts

@@ -1,4 +1,3 @@
-export { JOBS_FEATURE, JobErrors, JobHandlers, JobQueries } from "./constants.ts";
 export { createJobsFeature, type JobsFeatureOptions } from "./feature.ts";
 export type { JobRunLoggerCallbacks } from "./job-run-logger.ts";
 export { createJobRunLogger } from "./job-run-logger.ts";
@@ -7,3 +6,4 @@ export { jobRunLogsTable, jobRunsTable } from "./job-run-table.ts";
 export { tenantJobFailuresTable } from "./tenant-job-failure-table.ts";
 export type { TenantJobRunStatus } from "./tenant-job-run-table.ts";
 export { tenantJobRunsTable } from "./tenant-job-run-table.ts";
+export { JOBS_FEATURE, JobErrors, JobHandlers, JobQueries } from "./web/constants.ts";

package/packages/bundled-features/src/jobs/web/client-plugin.tsx

@@ -1,8 +1,7 @@
-// @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
-import { JOBS_FEATURE } from "../constants.ts";
-import { defaultTranslations } from "./i18n.ts";
+import { JOBS_FEATURE } from "./constants.ts";
+import { defaultTranslations } from "./default-translations.ts";
 
 export type JobsClientOptions = {
   readonly translations?: TranslationsByLocale;

package/packages/bundled-features/src/jobs/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // Feature name + qualified names for server handlers and web screens.
 export const JOBS_FEATURE = "jobs" as const;
 

package/packages/bundled-features/src/jobs/web/default-translations.ts

@@ -0,0 +1,7 @@
+import {
+  type TranslationsByLocale,
+  translationsByLocaleFromKeys,
+} from "@cosmicdrift/kumiko-renderer";
+import { JOBS_I18N } from "./i18n.ts";
+
+export const defaultTranslations: TranslationsByLocale = translationsByLocaleFromKeys(JOBS_I18N);

package/packages/bundled-features/src/jobs/web/i18n.ts

@@ -1,8 +1,54 @@
-// @runtime client
-import {
-  type TranslationsByLocale,
-  translationsByLocaleFromKeys,
-} from "@cosmicdrift/kumiko-renderer";
-import { JOBS_I18N } from "../i18n.ts";
+// Server + client i18n for jobs operator screens.
 
-export const defaultTranslations: TranslationsByLocale = translationsByLocaleFromKeys(JOBS_I18N);
+type LocalizedString = { readonly en: string };
+
+export const JOBS_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:job-runs.title": { en: "Job runs" },
+  "screen:job-run-detail.title": { en: "Job run" },
+  "screen:job-trigger.title": { en: "Trigger job" },
+  "jobs.screen.job-trigger.subtitle": {
+    en: "Start a job manually by name, with an optional JSON payload.",
+  },
+  "jobs.screen.job-run-detail.subtitle": {
+    en: "Status, timings, error and log lines of one job run.",
+  },
+  "jobs:entity:__action-form__:field:jobName": { en: "Job name" },
+  "jobs:entity:__action-form__:field:payload": { en: "JSON payload" },
+  "jobs:nav.jobRuns": { en: "Jobs" },
+  "jobs.runs.open": { en: "Details" },
+  "jobs.runs.filter.status": { en: "Status" },
+  "jobs.runs.filter.completed": { en: "Completed" },
+  "jobs.runs.filter.failed": { en: "Failed" },
+  "jobs.runs.filter.running": { en: "Running" },
+  "jobs.runs.filter.queued": { en: "Queued" },
+  "jobs.runs.col.job": { en: "Job" },
+  "jobs.runs.col.status": { en: "Status" },
+  "jobs.runs.col.started": { en: "Started" },
+  "jobs.runs.col.duration": { en: "Duration (ms)" },
+  "jobs.detail.field.job": { en: "Job" },
+  "jobs.detail.field.status": { en: "Status" },
+  "jobs.detail.field.id": { en: "Run ID" },
+  "jobs.detail.field.started": { en: "Started" },
+  "jobs.detail.field.finished": { en: "Finished" },
+  "jobs.detail.field.duration": { en: "Duration (ms)" },
+  "jobs.detail.field.error": { en: "Error" },
+  "jobs.detail.logs": { en: "Logs" },
+  "jobs.detail.retry": { en: "Retry" },
+  "jobs.trigger.title": { en: "Run a job" },
+  "jobs.errors.invalidCursor": { en: "The pagination cursor is invalid." },
+  "jobs.trigger.submit": { en: "Run" },
+  "jobs.errors.unknownJob": { en: "Unknown job." },
+  "jobs.errors.notManual": {
+    en: "This job cannot be triggered manually.",
+  },
+  "jobs.errors.invalidPayload": {
+    en: "The payload must be a valid JSON object.",
+  },
+  "jobs.errors.notFound": { en: "Not found." },
+  "jobs.errors.onlyFailedCanRetry": {
+    en: "Only failed runs can be retried.",
+  },
+  "jobs.errors.payloadErased": {
+    en: "This run's payload can no longer be read — the triggering user's data was erased.",
+  },
+};

package/packages/bundled-features/src/jobs/web/index.ts

@@ -1,2 +1 @@
-// @runtime client
 export { type JobsClientOptions, jobsClient } from "./client-plugin.tsx";

package/packages/bundled-features/src/ledger/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "ledger confirm-schedule-period takes its lock through TenantDb",
+    "detail": "confirm-schedule-period serializes parallel confirms of one schedule period with ctx.db.advisoryXactLock instead of an unsafeRaw connection and an escapeHatch declaration. The lock key is unchanged (tenant id plus reference), so nothing changes for running installations.",
+    "migration": "None."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/packages/bundled-features/src/ledger/entity.ts

@@ -7,7 +7,7 @@ import {
   createSelectField,
   createTextField,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { ACCOUNT_TYPES, SCHEDULE_INTERVALS, TRANSACTION_STATUS } from "./constants.ts";
+import { ACCOUNT_TYPES, SCHEDULE_INTERVALS, TRANSACTION_STATUS } from "./web/constants.ts";
 
 // account — a node in the chart of accounts. Event-sourced (create/update/list/
 // detail via the standard handlers); the framework projects `read_ledger_accounts`

package/packages/bundled-features/src/ledger/feature.ts

@@ -21,7 +21,6 @@ import {
   defineFeature,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_LEDGER_ACCESS, LEDGER_FEATURE_NAME } from "./constants.ts";
 import { accountEntity, scheduleEntity, transactionEntity } from "./entity.ts";
 import { createConfirmSchedulePeriodHandler } from "./handlers/confirm-schedule-period.write.ts";
 import { createCreateTransactionHandler } from "./handlers/create-transaction.write.ts";
@@ -32,6 +31,7 @@ import {
 } from "./handlers/reports.query.ts";
 import { createReverseTransactionHandler } from "./handlers/reverse-transaction.write.ts";
 import { requireScheduleSubjectPair } from "./schedule-subject-pair.ts";
+import { DEFAULT_LEDGER_ACCESS, LEDGER_FEATURE_NAME } from "./web/constants.ts";
 
 // Opt-in tier-gating (mirrors folders): when set, the feature declares itself
 // r.toggleable so the dispatcher gate + tier-engine can switch the WHOLE ledger

package/packages/bundled-features/src/ledger/handlers/confirm-schedule-period.write.ts

@@ -1,4 +1,3 @@
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
 import type {
   AccessRule,
   WriteHandlerDef,
@@ -6,7 +5,6 @@ import type {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.ts";
 import {
   accountExecutor,
   scheduleExecutor,
@@ -19,12 +17,11 @@ import {
   confirmSchedulePeriodPayloadSchema,
 } from "../schemas.ts";
 import { readSubjectReference } from "../subject-reference.ts";
+import { DEFAULT_LEDGER_ACCESS } from "../web/constants.ts";
 
 // pg_advisory_xact_lock namespace (int4): 'lcsp' as ASCII, disjoint from the
 // framework's other fixed advisory-lock keys.
 const CONFIRM_PERIOD_LOCK_NAMESPACE = 0x6c637370;
-const CONFIRM_PERIOD_LOCK_REASON =
-  "takes the per-(tenant, reference) advisory lock so parallel confirms cannot both pass the already-booked check; TenantDb has no lock API";
 
 // confirm-schedule-period — turn ONE projected period of a schedule into a posted,
 // balanced transaction (debit +amount / credit −amount), tagged with
@@ -42,7 +39,6 @@ export function createConfirmSchedulePeriodHandler(
     name: "confirm-schedule-period",
     schema: confirmSchedulePeriodPayloadSchema,
     access,
-    escapeHatch: { grants: ["unsafeRaw"], reason: CONFIRM_PERIOD_LOCK_REASON },
     description:
       "Turns one month of a recurring schedule into a posted balanced entry between its debit and credit account, returning the existing booking instead when that period is already booked and not reversed; use it to move a forecast period into the actual books.",
     handler: async (event, ctx) => {
@@ -78,11 +74,7 @@ export function createConfirmSchedulePeriodHandler(
       // tx's `reference` names its id).
       // No unique index on (tenantId, reference): a Storno makes re-confirming the
       // same reference legitimate, so the check-then-write is serialized by a lock.
-      await acquireNamespacedAdvisoryLock(
-        ctx.db.unsafeRaw(),
-        CONFIRM_PERIOD_LOCK_NAMESPACE,
-        `${event.user.tenantId}:${reference}`,
-      );
+      await ctx.db.advisoryXactLock(CONFIRM_PERIOD_LOCK_NAMESPACE, reference);
       const candidates = await ctx.db.selectMany(transactionTable, {
         tenantId: event.user.tenantId,
         reference,

package/packages/bundled-features/src/ledger/handlers/create-transaction.write.ts

@@ -1,9 +1,9 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.ts";
 import { accountExecutor, transactionExecutor } from "../executor.ts";
 import { type CreateTransactionPayload, createTransactionPayloadSchema } from "../schemas.ts";
+import { DEFAULT_LEDGER_ACCESS } from "../web/constants.ts";
 
 // create-transaction — books a balanced journal entry. The Σ=0 and ≥2-accounts
 // invariants are enforced by createTransactionPayloadSchema (command boundary).

package/packages/bundled-features/src/ledger/handlers/reports.query.ts

@@ -1,6 +1,5 @@
 import type { AccessRule, QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.ts";
 import { accountTable, transactionTable } from "../executor.ts";
 import {
   accountBalances,
@@ -11,6 +10,7 @@ import {
   toAccounts,
   toEntries,
 } from "../reports.ts";
+import { DEFAULT_LEDGER_ACCESS } from "../web/constants.ts";
 
 // Reports take an optional reporting period. Balance-sheet is cumulative → pass
 // { to: asOf }; income-statement is a period → { from, to }.

package/packages/bundled-features/src/ledger/handlers/reverse-transaction.write.ts

@@ -6,11 +6,11 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.ts";
 import { transactionExecutor, transactionTable } from "../executor.ts";
 import { normalizeLines } from "../reports.ts";
 import { type ReverseTransactionPayload, reverseTransactionPayloadSchema } from "../schemas.ts";
 import { readSubjectReference } from "../subject-reference.ts";
+import { DEFAULT_LEDGER_ACCESS } from "../web/constants.ts";
 
 // reverse-transaction (Storno) — the ONLY correction path for a posted entry.
 // Books the mirror image (every amount negated) as a new posted entry that

package/packages/bundled-features/src/ledger/index.ts

@@ -1,16 +1,3 @@
-export {
-  ACCOUNT_TYPES,
-  type AccountType,
-  DEFAULT_LEDGER_ACCESS,
-  DEFAULT_LEDGER_ROLES,
-  LEDGER_FEATURE_NAME,
-  LedgerHandlers,
-  LedgerQueries,
-  SCHEDULE_INTERVALS,
-  type ScheduleInterval,
-  TRANSACTION_STATUS,
-  type TransactionStatus,
-} from "./constants.ts";
 export { accountEntity, scheduleEntity, transactionEntity } from "./entity.ts";
 export {
   createLedgerFeature,
@@ -68,3 +55,16 @@ export {
   type ReverseTransactionPayload,
   reverseTransactionPayloadSchema,
 } from "./schemas.ts";
+export {
+  ACCOUNT_TYPES,
+  type AccountType,
+  DEFAULT_LEDGER_ACCESS,
+  DEFAULT_LEDGER_ROLES,
+  LEDGER_FEATURE_NAME,
+  LedgerHandlers,
+  LedgerQueries,
+  SCHEDULE_INTERVALS,
+  type ScheduleInterval,
+  TRANSACTION_STATUS,
+  type TransactionStatus,
+} from "./web/constants.ts";

package/packages/bundled-features/src/ledger/recurring.ts

@@ -13,8 +13,8 @@
 // pure — no DB, no Date API (windows/asOf come in as params) — so the no-date-api
 // guard stays green and the forecast is deterministic.
 
-import type { ScheduleInterval } from "./constants.ts";
 import type { Posting } from "./schemas.ts";
+import type { ScheduleInterval } from "./web/constants.ts";
 
 export type ScheduleDef = {
   readonly startDate: string; // ISO; first period (day ignored for monthly)

package/packages/bundled-features/src/ledger/reports.ts

@@ -1,6 +1,6 @@
 import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
-import type { AccountType } from "./constants.ts";
 import type { Posting } from "./schemas.ts";
+import type { AccountType } from "./web/constants.ts";
 
 // Pure report aggregation over posted journal entries. No DB, no IO — the query
 // handlers fetch accounts + transactions (selectMany) and feed them here, so the

package/packages/bundled-features/src/ledger/schemas.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import { ACCOUNT_TYPES, TRANSACTION_STATUS } from "./constants.ts";
+import { ACCOUNT_TYPES, TRANSACTION_STATUS } from "./web/constants.ts";
 
 // A posting line. amount is integer minor units (cents), SIGNED: Soll/debit > 0,
 // Haben/credit < 0. Integer → the balance check is exact (=== 0), no float epsilon.

package/packages/bundled-features/src/ledger/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // ledger bundle constants — feature-name + qualified handler/query names.
 //
 // Spec: kumiko-platform/docs/plans/ledger-feature.md