@cosmicdrift/kumiko-samples 0.377.0 → 0.379.0

package/packages/bundled-features/src/personal-access-tokens/handlers/create.write.ts

@@ -11,9 +11,9 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { encryptForDirectWrite, verifyPassword } from "../../shared/index.ts";
 import { UserQueries } from "../../user/index.ts";
-import { API_TOKEN_ENTITY_NAME, PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors } from "../constants.ts";
 import { mintPatToken } from "../hash.ts";
 import { apiTokenEntity, apiTokenTable } from "../schema/api-token.ts";
+import { API_TOKEN_ENTITY_NAME, PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors } from "../web/constants.ts";
 
 export type PatMfaVerifyResult = { readonly enrolled: boolean; readonly ok: boolean };
 

package/packages/bundled-features/src/personal-access-tokens/handlers/revoke.write.ts

@@ -4,9 +4,9 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { API_TOKEN_ENTITY_NAME, PatErrors } from "../constants.ts";
 import { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN } from "../pat-revoked-event.ts";
 import { apiTokenTable } from "../schema/api-token.ts";
+import { API_TOKEN_ENTITY_NAME, PatErrors } from "../web/constants.ts";
 
 // Revoke one of the caller's own tokens. Ownership is enforced in the WHERE
 // (userId = caller), so a caller can't revoke another user's token and a miss

package/packages/bundled-features/src/personal-access-tokens/hash.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { generateToken, PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
-import { PAT_PREFIX_DISPLAY_LENGTH } from "./constants.ts";
+import { PAT_PREFIX_DISPLAY_LENGTH } from "./web/constants.ts";
 
 // A PAT is high-entropy (32 random bytes from generateToken). A single SHA-256
 // is the right hash here: fast on the per-request auth path, and there's no

package/packages/bundled-features/src/personal-access-tokens/i18n.ts

@@ -1,7 +1,7 @@
 import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
 import { fieldLabelKey, fieldOptionLabelKey } from "@cosmicdrift/kumiko-renderer/headless";
-import { PAT_FEATURE } from "./constants.ts";
-import type { PatScopeConfig } from "./scopes.ts";
+import { PAT_FEATURE } from "./web/constants.ts";
+import type { PatScopeConfig } from "./web/scopes.ts";
 
 const mintFieldKey = (field: string): string =>
   fieldLabelKey(PAT_FEATURE, ACTION_FORM_ENTITY, field);

package/packages/bundled-features/src/personal-access-tokens/index.ts

@@ -1,8 +1,6 @@
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { PAT_DEFAULT_RATE_LIMIT, type PatRateLimit } from "./constants.ts";
+import { PAT_DEFAULT_RATE_LIMIT, type PatRateLimit } from "./web/constants.ts";
 
-export type { PatRateLimit } from "./constants.ts";
-export { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PatHandlers, PatQueries } from "./constants.ts";
 export type { BindPatAutoRevokeOnPasswordChange, PersonalAccessTokensOptions } from "./feature.ts";
 export {
   bindPatAutoRevokeOnPasswordChangeFromFeature,
@@ -20,8 +18,10 @@ export {
 export { createPatResolver } from "./resolver.ts";
 export { revokeAllPatTokensForUser } from "./revoke-for-user.ts";
 export { apiTokenEntity, apiTokenTable } from "./schema/api-token.ts";
-export type { PatScopeConfig, PatScopeDef } from "./scopes.ts";
-export { expandScopes } from "./scopes.ts";
+export type { PatRateLimit } from "./web/constants.ts";
+export { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PatHandlers, PatQueries } from "./web/constants.ts";
+export type { PatScopeConfig, PatScopeDef } from "./web/scopes.ts";
+export { expandScopes } from "./web/scopes.ts";
 
 // Reads the per-token rate-limit config off a mounted PAT feature's exports.
 // Falls back to the default when absent. run-prod-app uses this to build the

package/packages/bundled-features/src/personal-access-tokens/resolver.ts

@@ -6,7 +6,7 @@ import { isExpiredAt } from "./expiry.ts";
 import { hashPatToken } from "./hash.ts";
 import { resolvePatRoles } from "./roles.ts";
 import { apiTokenTable } from "./schema/api-token.ts";
-import { expandScopes, type PatScopeConfig } from "./scopes.ts";
+import { expandScopes, type PatScopeConfig } from "./web/scopes.ts";
 
 // Hot-path resolver — raw-DB like session-callbacks (a dispatcher roundtrip on
 // every request buys nothing here). Hash the bearer token, point-read the row,

package/packages/bundled-features/src/personal-access-tokens/schema/api-token.ts

@@ -5,7 +5,7 @@ import {
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { API_TOKEN_ENTITY_NAME } from "../constants.ts";
+import { API_TOKEN_ENTITY_NAME } from "../web/constants.ts";
 
 // One row per Personal Access Token. Like store_user_sessions this is a
 // direct-write store (r.unmanagedTable): the create/revoke handlers write it and

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -12,8 +12,8 @@ import {
   PAT_SCREEN_ID,
   PatHandlers,
   PatQueries,
-} from "./constants.ts";
-import type { PatScopeConfig } from "./scopes.ts";
+} from "./web/constants.ts";
+import type { PatScopeConfig } from "./web/scopes.ts";
 
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
 // Same keys the mint form's `scopes` multiSelect options resolve through

package/packages/bundled-features/src/personal-access-tokens/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure constants — client-marked so the web screen (web/) may import screen-id
 // and QN names without pulling the feature's server runtime barrel.
 export const PAT_FEATURE = "personal-access-tokens";

package/packages/bundled-features/src/personal-access-tokens/{scopes.ts → web/scopes.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure scope helpers + types — client-marked so the web screen (web/) may import
 // parseGrant without pulling the feature's server runtime barrel.
 //

package/packages/bundled-features/src/presets/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "dsgvoSelfServiceFeatures removed",
+    "detail": "The deprecated preset dsgvoSelfServiceFeatures and its DsgvoSelfServiceOptions type are gone. composeGdprStack covers the same features.",
+    "migration": "Use composeGdprStack({ selfService: { userDataRights } }), or mount createSessionsFeature, createDataRetentionFeature, createComplianceProfilesFeature, createUserDataRightsFeature and createUserProfileFeature yourself."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/packages/bundled-features/src/presets/index.ts

@@ -1,2 +1 @@
-export { type DsgvoSelfServiceOptions, dsgvoSelfServiceFeatures } from "./dsgvo-self-service.ts";
 export { type SecurityBaselineOptions, securityBaselineFeatures } from "./security-baseline.ts";

package/packages/bundled-features/src/presets/security-baseline.ts

@@ -9,7 +9,7 @@ export type SecurityBaselineOptions = {
 };
 
 // Host app must mount user, tenant, auth-foundation (sessions/audit requires).
-/** @deprecated Removed in the next release. Use `composeSecurityStack({ includeSessions })`
+/** @deprecated Removed in 0.390.0. Use `composeSecurityStack({ includeSessions })`
  *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export function securityBaselineFeatures(opts: SecurityBaselineOptions = {}): FeatureDefinition[] {
   return [

package/packages/bundled-features/src/renderer-foundation/types.ts

@@ -165,7 +165,7 @@ export type ImageOptions = {
 //
 // **Beispiel renderer-mail-html:**
 //   import { createTemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
-//   const tplApi = createTemplateResolverApi(ctx.db);
+//   const tplApi = createTemplateResolverApi(ctx.db, ctx.registry);
 //   const layout = await tplApi.resolveTemplate({ tenantId: ctx.tenantId, slug, kind });
 export type RendererContext = {
   readonly db: DbRunner | TenantDb;

package/packages/bundled-features/src/secrets/feature.ts

@@ -10,7 +10,6 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
-import { DEFAULT_SECRETS_ACCESS } from "./constants.ts";
 import { createDeleteHandler } from "./handlers/delete.write.ts";
 import { createListHandler } from "./handlers/list.query.ts";
 import { rotateJob } from "./handlers/rotate.job.ts";
@@ -18,6 +17,7 @@ import { createSetHandler } from "./handlers/set.write.ts";
 import { SECRETS_I18N } from "./i18n.ts";
 import { secretReadSchema } from "./secrets-context.ts";
 import { tenantSecretEntity, tenantSecretsTable } from "./table.ts";
+import { DEFAULT_SECRETS_ACCESS } from "./web/constants.ts";
 
 const ROTATE_ESCAPE_HATCH_REASON = "re-encrypts every tenant's secrets with the new master key";
 

package/packages/bundled-features/src/secrets/handlers/delete.write.ts

@@ -2,8 +2,8 @@ import { type AccessRule, defineWriteHandler } from "@cosmicdrift/kumiko-framewo
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.ts";
-import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.ts";
 import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.ts";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../web/constants.ts";
 import { checkSecretKeyWrite } from "../write-gate.ts";
 
 export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {

package/packages/bundled-features/src/secrets/handlers/list.query.ts

@@ -1,7 +1,7 @@
 import { type AccessRule, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.ts";
 import { tenantSecretsTable } from "../table.ts";
+import { DEFAULT_SECRETS_ACCESS } from "../web/constants.ts";
 
 // Lists all secrets for the current tenant. Returns redactedPreview, never
 // the plaintext. Decryption would be pointless here anyway — this is the

package/packages/bundled-features/src/secrets/handlers/set.write.ts

@@ -1,8 +1,8 @@
 import { type AccessRule, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.ts";
-import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.ts";
 import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.ts";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../web/constants.ts";
 import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.ts";
 
 export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {

package/packages/bundled-features/src/secrets/i18n.ts

@@ -1,4 +1,4 @@
-import { SECRETS_ERROR_KEYS } from "./constants.ts";
+import { SECRETS_ERROR_KEYS } from "./web/constants.ts";
 
 export const SECRETS_I18N = {
   [SECRETS_ERROR_KEYS.unknownKey]: {

package/packages/bundled-features/src/secrets/index.ts

@@ -1,11 +1,3 @@
-export {
-  DEFAULT_SECRETS_ACCESS,
-  DEFAULT_SECRETS_ROLES,
-  INVALID_SECRET_VALUE_CODE,
-  SECRETS_ERROR_KEYS,
-  SecretsHandlers,
-  SecretsQueries,
-} from "./constants.ts";
 export {
   createSecretsContext,
   createSecretsFeature,
@@ -29,4 +21,12 @@ export {
   rotateJob,
 } from "./handlers/rotate.job.ts";
 export { createSetHandler } from "./handlers/set.write.ts";
+export {
+  DEFAULT_SECRETS_ACCESS,
+  DEFAULT_SECRETS_ROLES,
+  INVALID_SECRET_VALUE_CODE,
+  SECRETS_ERROR_KEYS,
+  SecretsHandlers,
+  SecretsQueries,
+} from "./web/constants.ts";
 export { isInvalidSecretValueError } from "./write-gate.ts";

package/packages/bundled-features/src/secrets/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // secrets bundle constants — default RBAC for set/delete/list (#2296).
 
 import type { AccessRule } from "@cosmicdrift/kumiko-framework/engine";

package/packages/bundled-features/src/secrets/write-gate.ts

@@ -11,7 +11,7 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS } from "./constants.ts";
+import { INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS } from "./web/constants.ts";
 
 // Fixed keys carry their definition (redact fn, writeRoles); namespace keys
 // only the namespace, which has no redact fn.

package/packages/bundled-features/src/sessions/feature.ts

@@ -17,7 +17,6 @@ import { mineQuery } from "./handlers/mine.query.ts";
 import { revokeWrite } from "./handlers/revoke.write.ts";
 import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write.ts";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write.ts";
-import { SESSIONS_I18N } from "./i18n.ts";
 import { userSessionEntity } from "./schema/user-session.ts";
 import {
   createSessionDetailScreen,
@@ -30,6 +29,7 @@ import {
   type SessionMassRevoker,
 } from "./session-callbacks.ts";
 import { SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema } from "./session-revoked-event.ts";
+import { SESSIONS_I18N } from "./web/i18n.ts";
 
 const CLEANUP_ESCAPE_HATCH_REASON = "deletes expired session rows of every tenant";
 
@@ -211,11 +211,15 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       // sessionChecker blocks a status-locked principal on its next request
       // regardless.
       const REVOKE_TRIGGERING_FIELDS = ["passwordHash"] as const;
-      let autoRevoke = options?.autoRevokeOnPasswordChange;
+      // Explicit option wins; the runtime binding is replaceable so a second boot of the same
+      // feature instance (a new app or test stack in one process) binds its own database.
+      const explicitAutoRevoke = options?.autoRevokeOnPasswordChange;
+      let boundAutoRevoke: SessionMassRevoker | undefined;
       r.hook({
         type: "postSave",
         target: { allOf: "user" },
         handler: async (ctx) => {
+          const autoRevoke = explicitAutoRevoke ?? boundAutoRevoke;
           // skip: nothing bound — stateless-JWT deployments without a runtime
           // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
           if (!autoRevoke) return;
@@ -231,8 +235,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       });
 
       const bindAutoRevokeOnPasswordChange: BindAutoRevokeOnPasswordChange = (revoker) => {
-        // explicit constructor option wins over the runtime binding
-        autoRevoke ??= revoker;
+        boundAutoRevoke = revoker;
       };
 
       r.translations({ keys: SESSIONS_I18N });

package/packages/bundled-features/src/sessions/{i18n.ts → web/i18n.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // Server + client i18n for the sessions operator screens.
 
 type LocalizedString = { readonly en: string };

package/packages/bundled-features/src/shared/index.ts

@@ -22,7 +22,12 @@ export { isWithinGracePeriod } from "./grace-period.ts";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.ts";
 export { isTenantDb } from "./is-tenant-db.ts";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.ts";
-export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.ts";
+export {
+  mailHeading,
+  mailParagraph,
+  mailParagraphWithLink,
+  mailRepeatedRows,
+} from "./mail-template-body.ts";
 export { mapWithConcurrency } from "./map-with-concurrency.ts";
 export {
   denyUnlessJoinRowParentVisible,

package/packages/bundled-features/src/shared/purge-files-reaching-subject.ts

@@ -23,6 +23,7 @@ import {
   FILE_REF_ENTITY_NAME,
   fileRefEntity,
   fileRefsTable,
+  listActionFormFileFields,
 } from "@cosmicdrift/kumiko-framework/files";
 import {
   collectSingleFileHolders,
@@ -213,7 +214,7 @@ export async function purgeFilesReachingSubject(args: {
     db,
     registry,
     subject,
-    fileFieldKeys: pendingFieldKeys(fileEntities),
+    fileFieldKeys: pendingFieldKeys(fileEntities, registry),
     fileHolders,
     storageByTenant,
     resolveDeleteBytes,
@@ -226,8 +227,15 @@ export async function purgeFilesReachingSubject(args: {
 const pendingFieldKey = (entityType: unknown, fieldName: unknown) =>
   `${entityType}\u0000${fieldName}`;
 
-function pendingFieldKeys(fileEntities: readonly FileEntity[]): ReadonlySet<string> {
+// A pending upload of an actionForm files field is keyed by the screen QN, like an entity's by its name.
+function pendingFieldKeys(
+  fileEntities: readonly FileEntity[],
+  registry: Registry,
+): ReadonlySet<string> {
   const keys = new Set<string>();
+  for (const { screenQn, fieldName } of listActionFormFileFields(registry)) {
+    keys.add(pendingFieldKey(screenQn, fieldName));
+  }
   for (const { entityName, fileFields } of fileEntities) {
     for (const fieldName of fileFields) keys.add(pendingFieldKey(entityName, fieldName));
   }

package/packages/bundled-features/src/shared/web/translate-or-raw.ts

@@ -1,4 +1,3 @@
-// @runtime client
 import type { useTranslation } from "@cosmicdrift/kumiko-renderer";
 
 type Translate = ReturnType<typeof useTranslation>;

package/packages/bundled-features/src/subscription-stripe/feature.ts

@@ -53,6 +53,7 @@ import {
   createStripePlanSwitchSession,
   createStripePortalSession,
   createStripePriceCache,
+  createStripeResumeSubscription,
   createStripeRetrievePrices,
   createStripeRetrieveSubscription,
 } from "./plugin-methods.ts";
@@ -258,6 +259,7 @@ export function createSubscriptionStripeFeature(
       }),
       createPortalSession: createStripePortalSession(runtimes.ctx),
       cancelSubscription: createStripeCancelSubscription(runtimes.ctx),
+      resumeSubscription: createStripeResumeSubscription(runtimes.ctx),
       priceToTier: options.priceToTier ?? {},
       oneOffPriceIds: options.oneOffPriceIds ?? [],
       isBillingEnabled: runtimes.ctx.isBillingEnabled,

package/packages/bundled-features/src/subscription-stripe/plugin-methods.ts

@@ -219,6 +219,25 @@ export function createStripePortalSession(runtime: StripeCtxRuntime) {
   };
 }
 
+// =============================================================================
+// resumeSubscription
+// =============================================================================
+//
+// Takes back a period-end cancel; the following `customer.subscription.updated`
+// carries cancel_at null, which the projection stores as "renews".
+
+export function createStripeResumeSubscription(runtime: StripeCtxRuntime) {
+  return async (
+    ctx: HandlerContext,
+    options: { readonly providerSubscriptionId: string },
+  ): Promise<void> => {
+    const stripe = await runtime.clientForCtx(ctx);
+    await stripe.subscriptions.update(options.providerSubscriptionId, {
+      cancel_at_period_end: false,
+    });
+  };
+}
+
 // =============================================================================
 // cancelSubscription
 // =============================================================================

package/packages/bundled-features/src/subscription-stripe/verify-webhook.ts

@@ -176,6 +176,7 @@ export function verifyAndParseStripeWebhook(
       ...(consentId !== undefined && { consentId }),
       providerCustomerId: typeof sub.customer === "string" ? sub.customer : sub.customer.id,
       providerSubscriptionId: sub.id,
+      providerEventAt: Temporal.Instant.fromEpochMilliseconds(event.created * 1000).toString(),
       ...state,
     };
   };

package/packages/bundled-features/src/tags/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "assign-tag and delete-tag no longer race",
+    "detail": "Re-assigning a tag after it was deleted no longer restores the assignment of a gone tag. assign-tag and delete-tag now take the same per-tag advisory lock, so a parallel assign can no longer leave an assignment for a deleted tag."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/packages/bundled-features/src/tags/feature.ts

@@ -28,7 +28,6 @@ import {
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.ts";
-import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./constants.ts";
 import { createTagAssignmentEntity, tagEntity } from "./entity.ts";
 import { createTagAssignmentExecutor } from "./executor.ts";
 import { createAssignTagHandler } from "./handlers/assign-tag.write.ts";
@@ -38,6 +37,7 @@ import { createRemoveTagHandler } from "./handlers/remove-tag.write.ts";
 import { createUpdateTagHandler } from "./handlers/update-tag.write.ts";
 import { TAGS_FEATURE_I18N } from "./i18n.ts";
 import { createTagEditScreen, createTagListScreen } from "./screens.ts";
+import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./web/constants.ts";
 
 // Opt-in tier-gating: when set, the feature declares itself r.toggleable so the
 // dispatcher gate + feature-toggles + tier-engine can switch the WHOLE feature

package/packages/bundled-features/src/tags/handlers/assign-tag.write.ts

@@ -3,9 +3,9 @@ import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/error
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { denyUnlessJoinRowParentVisible } from "../../shared/index.ts";
 import { tagAssignmentAggregateId } from "../aggregate-id.ts";
-import { DEFAULT_TAG_ACCESS } from "../constants.ts";
 import { tagAssignmentExecutor, tagExecutor } from "../executor.ts";
 import { type AssignTagPayload, assignTagPayloadSchema } from "../schemas.ts";
+import { DEFAULT_TAG_ACCESS, TAG_LOCK_NAMESPACE } from "../web/constants.ts";
 
 // assign-tag — links a tag to a host entity by (entityType, entityId). The
 // assignment id is deterministic, so the row is unique per (tag, entity).
@@ -20,9 +20,9 @@ import { type AssignTagPayload, assignTagPayloadSchema } from "../schemas.ts";
 // create(), the loser's create() version_conflicts, and the handler treats
 // that as success since the winner already wrote the desired end state.
 //
-// Referential integrity: there is no FK (event-sourced, no JOIN), so before a
-// first-time create we verify the tag exists in the catalog — a malformed call
-// with an unknown tagId would otherwise project a dangling assignment.
+// Referential integrity: there is no FK (event-sourced, no JOIN), so we verify
+// the tag exists in the catalog before any restore/create — otherwise a call
+// racing delete-tag would resurrect or project an assignment for a gone tag.
 //
 // Host reference: entityType/entityId are never trusted client input either —
 // the aggregate-id is tenant-scoped, so this is not a cross-tenant hole, but
@@ -49,6 +49,13 @@ export function createAssignTagHandler(
       );
       if (denied) return denied;
 
+      // Same lock as delete-tag: the existence check below and the assignment
+      // write must not interleave with a delete-tag cascade, or the cascade
+      // misses the new assignment and leaves an orphan.
+      await ctx.db.advisoryXactLock(TAG_LOCK_NAMESPACE, payload.tagId);
+      const tag = await tagExecutor.detail({ id: payload.tagId }, event.user, ctx.db);
+      if (!tag) return writeFailure(new NotFoundError("tag", payload.tagId));
+
       const id = tagAssignmentAggregateId(
         event.user.tenantId,
         payload.tagId,
@@ -76,9 +83,6 @@ export function createAssignTagHandler(
       }
       if (restored.error.code !== "not_found") return restored;
 
-      const tag = await tagExecutor.detail({ id: payload.tagId }, event.user, ctx.db);
-      if (!tag) return writeFailure(new NotFoundError("tag", payload.tagId));
-
       const created = await assignmentExecutor.create(
         {
           id,

package/packages/bundled-features/src/tags/handlers/create-tag.write.ts

@@ -1,7 +1,7 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_TAG_ACCESS } from "../constants.ts";
 import { tagExecutor } from "../executor.ts";
 import { type CreateTagPayload, createTagPayloadSchema } from "../schemas.ts";
+import { DEFAULT_TAG_ACCESS } from "../web/constants.ts";
 
 // create-tag — adds a tag to the tenant's catalog. The framework mints a fresh
 // UUIDv7 id (no explicit id passed). Tag names are not unique by design: the

package/packages/bundled-features/src/tags/handlers/delete-tag.write.ts

@@ -1,7 +1,7 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_TAG_ACCESS } from "../constants.ts";
 import { tagAssignmentExecutor, tagExecutor } from "../executor.ts";
 import { type DeleteTagPayload, deleteTagPayloadSchema } from "../schemas.ts";
+import { DEFAULT_TAG_ACCESS, TAG_LOCK_NAMESPACE } from "../web/constants.ts";
 
 const CASCADE_PAGE = 200;
 
@@ -30,6 +30,9 @@ export function createDeleteTagHandler(
     handler: async (event, ctx) => {
       const payload = event.payload as DeleteTagPayload; // @cast-boundary engine-payload
 
+      // Serialises with assign-tag (see there): the cascade must see every
+      // assignment that a concurrent assign-tag committed before the tag goes.
+      await ctx.db.advisoryXactLock(TAG_LOCK_NAMESPACE, payload.id);
       const existing = await tagExecutor.detail({ id: payload.id }, event.user, ctx.db);
       if (!existing) {
         return { isSuccess: true as const, data: { id: payload.id } };

package/packages/bundled-features/src/tags/handlers/remove-tag.write.ts

@@ -1,9 +1,9 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { denyUnlessJoinRowParentVisible } from "../../shared/index.ts";
 import { tagAssignmentAggregateId } from "../aggregate-id.ts";
-import { DEFAULT_TAG_ACCESS } from "../constants.ts";
 import { tagAssignmentExecutor } from "../executor.ts";
 import { type RemoveTagPayload, removeTagPayloadSchema } from "../schemas.ts";
+import { DEFAULT_TAG_ACCESS } from "../web/constants.ts";
 
 // remove-tag — unlinks a tag from a host entity. Idempotent: removing an
 // assignment that doesn't exist is already the requested end state (not

package/packages/bundled-features/src/tags/handlers/update-tag.write.ts

@@ -1,7 +1,7 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_TAG_ACCESS } from "../constants.ts";
 import { tagExecutor } from "../executor.ts";
 import { type UpdateTagPayload, updateTagPayloadSchema } from "../schemas.ts";
+import { DEFAULT_TAG_ACCESS } from "../web/constants.ts";
 
 // update-tag — edits a catalog tag (rename / recolor / re-scope). Optimistic-
 // locked: the client sends the `version` it read (mirrors tenant:update). Only

package/packages/bundled-features/src/tags/index.ts

@@ -1,16 +1,4 @@
 export { tagAssignmentAggregateId } from "./aggregate-id.ts";
-export {
-  DEFAULT_TAG_ACCESS,
-  DEFAULT_TAG_ROLES,
-  TAGS_COLUMN_RENDERER_NAME,
-  TAGS_EDIT_SCREEN_ID,
-  TAGS_FEATURE_NAME,
-  TAGS_FILTER_EXTENSION_NAME,
-  TAGS_SCREEN_ID,
-  TAGS_SECTION_EXTENSION_NAME,
-  TagsHandlers,
-  TagsQueries,
-} from "./constants.ts";
 export { tagAssignmentEntity, tagEntity } from "./entity.ts";
 export { createTagsFeature, type TagsFeatureOptions } from "./feature.ts";
 export {
@@ -46,3 +34,15 @@ export {
   updateTagPayloadSchema,
 } from "./schemas.ts";
 export { createTagEditScreen, createTagListScreen } from "./screens.ts";
+export {
+  DEFAULT_TAG_ACCESS,
+  DEFAULT_TAG_ROLES,
+  TAGS_COLUMN_RENDERER_NAME,
+  TAGS_EDIT_SCREEN_ID,
+  TAGS_FEATURE_NAME,
+  TAGS_FILTER_EXTENSION_NAME,
+  TAGS_SCREEN_ID,
+  TAGS_SECTION_EXTENSION_NAME,
+  TagsHandlers,
+  TagsQueries,
+} from "./web/constants.ts";

package/packages/bundled-features/src/tags/screens.ts

@@ -4,7 +4,7 @@ import {
   type EntityListScreenDefinition,
   i18nKey,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_TAG_ACCESS, TAGS_EDIT_SCREEN_ID, TAGS_SCREEN_ID } from "./constants.ts";
+import { DEFAULT_TAG_ACCESS, TAGS_EDIT_SCREEN_ID, TAGS_SCREEN_ID } from "./web/constants.ts";
 
 // Declarative catalog screens (Phase-3 / #2312). Access matches create/update/
 // delete so createTagsFeature({ access|roles }) stays consistent. TagManager

package/packages/bundled-features/src/tags/web/client-plugin.tsx

@@ -1,12 +1,10 @@
-// @runtime client
-
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import {
   TAGS_COLUMN_RENDERER_NAME,
   TAGS_FEATURE_NAME,
   TAGS_FILTER_EXTENSION_NAME,
   TAGS_SECTION_EXTENSION_NAME,
-} from "../constants.ts";
+} from "./constants.ts";
 import { defaultTranslations } from "./i18n.ts";
 import { TagFilter } from "./tag-filter.tsx";
 import { TagSection } from "./tag-section.tsx";

package/packages/bundled-features/src/tags/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // tags bundle constants — feature-name + qualified handler/query names.
 //
 // Spec: kumiko-platform/docs/plans/features/tags.md
@@ -59,3 +58,7 @@ export const DEFAULT_TAG_ROLES = ["TenantAdmin", "TenantMember"] as const;
 // makes tagging reachable for any authenticated tenant user — matching apps
 // whose other handlers are openToAll rather than role-gated.
 export const DEFAULT_TAG_ACCESS: AccessRule = { roles: DEFAULT_TAG_ROLES };
+
+// Advisory-lock namespace serialising assign-tag against delete-tag per tag id
+// (no FK in the event-sourced catalog, so the DB cannot guard the orphan race).
+export const TAG_LOCK_NAMESPACE = 0x74_61_67_73; // 'tags'

package/packages/bundled-features/src/tags/web/entity-tags.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // EntityTags — read-only colored tag row for ANY entity. Drop it on a card or
 // detail view: <EntityTags entityName="note" entityId={id} />. Loads the
 // catalog (for name+color) and the entity's assignments, renders a TagChip per
@@ -6,7 +5,7 @@
 
 import { useQuery } from "@cosmicdrift/kumiko-renderer";
 import type { ReactNode } from "react";
-import { TagsQueries } from "../constants.ts";
+import { TagsQueries } from "./constants.ts";
 import { TagChip } from "./tag-chip.tsx";
 
 type TagRow = { readonly id: string; readonly name: string; readonly color?: string | null };