@cosmicdrift/kumiko-samples 0.378.0 → 0.380.0

package/packages/bundled-features/src/legal-pages/README.md

@@ -36,7 +36,7 @@ runProdApp({
   //      only uses the API via ctx)
   anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
   extraContext: ({ db }) => ({
-    templateResolver: createTemplateResolverApi(db),
+    templateResolver: createTemplateResolverApi(db, registry),
   }),
 });
 ```

package/packages/bundled-features/src/legal-pages/feature.ts

@@ -11,16 +11,16 @@ import {
   redirectToCanonicalPath,
   slashVariantOf,
 } from "../page-render/index.ts";
+import { runLegalPagesBootCheck } from "./lib/boot-check.ts";
+import { validateRoutes } from "./lib/validate-routes.ts";
+import { renderMarkdownToHtml, wrapInLayout } from "./markdown.ts";
 import {
   LEGAL_REQUIRED_BLOCKS,
   LEGAL_ROUTES,
   LEGAL_TERMS_ROUTES,
   type LegalPageRoute,
   type LegalRequiredBlock,
-} from "./constants.ts";
-import { runLegalPagesBootCheck } from "./lib/boot-check.ts";
-import { validateRoutes } from "./lib/validate-routes.ts";
-import { renderMarkdownToHtml, wrapInLayout } from "./markdown.ts";
+} from "./web/constants.ts";
 
 export { type LegalPagesBootCheckCtx, runLegalPagesBootCheck } from "./lib/boot-check.ts";
 
@@ -61,7 +61,7 @@ const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 //     nicht gegen Cross-Feature-Coupling
 //
 // Voraussetzungen für Production:
-//   • App-Bootstrap muss extraContext: { templateResolver: createTemplateResolverApi(db) }
+//   • App-Bootstrap muss extraContext: { templateResolver: createTemplateResolverApi(db, registry) }
 //     setzen — sonst wirft Boot-Check beim Start
 //   • anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID } — sonst
 //     antworten die Routes mit 503

package/packages/bundled-features/src/legal-pages/index.ts

@@ -1,14 +1,3 @@
-export {
-  LEGAL_OPTIONAL_BLOCKS,
-  LEGAL_PAGES_FEATURE,
-  LEGAL_REQUIRED_BLOCKS,
-  LEGAL_ROUTES,
-  LEGAL_TERMS_ROUTES,
-  type LegalPageRoute,
-  LegalPagesErrors,
-  type LegalRequiredBlock,
-  legalPagePath,
-} from "./constants.ts";
 export {
   createLegalPagesFeature,
   type LegalPagesBootCheckCtx,
@@ -23,3 +12,14 @@ export {
   type LegalContentSeedSource,
   legalContentSeed,
 } from "./seed.ts";
+export {
+  LEGAL_OPTIONAL_BLOCKS,
+  LEGAL_PAGES_FEATURE,
+  LEGAL_REQUIRED_BLOCKS,
+  LEGAL_ROUTES,
+  LEGAL_TERMS_ROUTES,
+  type LegalPageRoute,
+  LegalPagesErrors,
+  type LegalRequiredBlock,
+  legalPagePath,
+} from "./web/constants.ts";

package/packages/bundled-features/src/legal-pages/lib/boot-check.ts

@@ -4,7 +4,7 @@ import {
   type TemplateResolverApi,
 } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-import { LEGAL_REQUIRED_BLOCKS, type LegalRequiredBlock } from "../constants.ts";
+import { LEGAL_REQUIRED_BLOCKS, type LegalRequiredBlock } from "../web/constants.ts";
 
 // Only the fields the check reads, so HandlerContext, AppContext or a hand-built
 // object in a unit test all fit.

package/packages/bundled-features/src/legal-pages/lib/validate-routes.ts

@@ -1,4 +1,4 @@
-import type { LegalPageRoute } from "../constants.ts";
+import type { LegalPageRoute } from "../web/constants.ts";
 
 // Validated once at feature-build time (not per-request) so a config typo
 // fails app startup instead of surfacing as a confusing 404 later.

package/packages/bundled-features/src/legal-pages/web/client-plugin.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Client-Feature-Factory für legal-pages Visual-Tree. Liefert statische
 // Tree-Knoten für die DACH-Compliance-Blöcke (imprint, privacy in de/en).
 // Jeder Knoten linkt auf text-content's edit-Action — reines Cross-Feature-
@@ -18,7 +17,7 @@
 
 import type { TreeChildrenSubscribe, TreeNode } from "@cosmicdrift/kumiko-framework/engine";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
-import { LEGAL_OPTIONAL_BLOCKS, LEGAL_REQUIRED_BLOCKS } from "../constants.ts";
+import { LEGAL_OPTIONAL_BLOCKS, LEGAL_REQUIRED_BLOCKS } from "./constants.ts";
 
 const treeProvider: TreeChildrenSubscribe = () => (emit) => {
   // V.1.5d Slug-first Verschachtelung (Variante C):

package/packages/bundled-features/src/legal-pages/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // Feature name
 export const LEGAL_PAGES_FEATURE = "legal-pages" as const;
 
@@ -22,23 +21,22 @@ export type LegalRequiredBlock = {
 };
 
 // Required slugs that must exist as text-blocks for production-boot.
-// Pro Sprache + Slug eine Pflicht-Kombo. Wer mehr Sprachen will, ergänzt
-// die Liste — Boot-Check wird dynamisch aus der Liste generiert.
+// One mandatory slug per language; anyone who wants more languages extends
+// the list, the boot check is generated dynamically from it.
 export const LEGAL_REQUIRED_BLOCKS = [
   { slug: "imprint", lang: "de" },
   { slug: "privacy", lang: "de" },
 ] as const;
 
-// Optionale Blocks die NICHT Boot-fail-relevant sind, aber die Routes
-// servieren falls vorhanden. EN-Versionen sind in DACH-Apps oft nur
-// "nice-to-have".
+// Optional blocks that are NOT boot-fail relevant, but whose routes are
+// served when present. EN versions are often only nice-to-have in DACH apps.
 export const LEGAL_OPTIONAL_BLOCKS = [
   { slug: "imprint", lang: "en" },
   { slug: "privacy", lang: "en" },
 ] as const;
 
-// Public-Route-Mapping: URL-Path → (slug, lang). DE nutzt die deutschen
-// Standard-Bezeichnungen, EN die englischen.
+// Public route mapping: URL path -> (slug, lang). DE uses the German
+// standard names, EN the English ones.
 export const LEGAL_ROUTES = [
   { path: "/legal/impressum", slug: "imprint", lang: "de", titleFallback: "Impressum" },
   {

package/packages/bundled-features/src/legal-pages/web/index.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Public exports für die Browser-Seite des legal-pages Features.
 
 export { legalPagesClient } from "./client-plugin.ts";

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -15,10 +15,10 @@ import { bySlugQuery } from "./handlers/by-slug.query.ts";
 import { byTenantPublishedQuery } from "./handlers/by-tenant-published.query.ts";
 import { pageCrudQueries, pageCrudWrites } from "./handlers/page-crud.ts";
 import { setWrite } from "./handlers/set.write.ts";
-import { MANAGED_PAGES_I18N } from "./i18n.ts";
 import { createBrandingSettingsScreen } from "./screens/branding-screen.ts";
 import { pageEditScreen, pageListScreen } from "./screens/page-screens.ts";
 import { pageEntity } from "./table.ts";
+import { MANAGED_PAGES_I18N } from "./web/i18n.ts";
 
 // 60s-shared-cache saves the origin-revalidate roundtrip; CMS edits are live within 60s.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;

package/packages/bundled-features/src/managed-pages/web/client-plugin.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // Client-Feature-Factory für managed-pages. Bringt NUR die Übersetzungen mit —
 // die Screens (page-list/page-edit/branding-settings) sind schema-driven
 // (entityList/entityEdit/configEdit), also keine custom-React-Components zu
@@ -7,7 +6,7 @@
 
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
-import { defaultTranslations } from "./i18n.ts";
+import { defaultTranslations } from "./default-translations.ts";
 
 export type ManagedPagesClientOptions = {
   /** Key-wise Overrides über die Default-Bundles (de/en). */

package/packages/bundled-features/src/managed-pages/web/default-translations.ts

@@ -0,0 +1,17 @@
+// Client i18n bundle for the managed-pages admin screens. The browser renderer
+// builds its fallback locale store ONLY from clientFeatures[].translations; the
+// server-side r.translations bundle (feature.ts) never reaches it. To render the
+// configEdit/entityEdit labels translated instead of raw, we mirror the same keys here.
+//
+// Single source: pivots MANAGED_PAGES_I18N (key-first { key: {de,en} }, server
+// form) into the locale-first TranslationsByLocale form the client expects, so
+// there is no key duplication and no drift.
+
+import {
+  type TranslationsByLocale,
+  translationsByLocaleFromKeys,
+} from "@cosmicdrift/kumiko-renderer";
+import { MANAGED_PAGES_I18N } from "./i18n.ts";
+
+export const defaultTranslations: TranslationsByLocale =
+  translationsByLocaleFromKeys(MANAGED_PAGES_I18N);

package/packages/bundled-features/src/managed-pages/web/i18n.ts

@@ -1,19 +1,62 @@
-// @runtime client
-// Client-i18n-Bundle für die managed-pages Admin-Screens. Der Browser-Renderer
-// baut seinen Fallback-Locale-Store NUR aus clientFeatures[].translations — der
-// server-seitige r.translations-Bundle (feature.ts) erreicht ihn nie. Damit die
-// configEdit/entityEdit-Labels im Client übersetzt rendern statt roh, spiegeln
-// wir hier dieselben Keys.
+// Pure data (i18n keys) that lives under web/ so the web bundle may pivot it into
+// the browser store; feature.ts (server) imports it as well (the server may import
+// client-safe pure data, like PAT constants.ts).
 //
-// Single source: pivotiert MANAGED_PAGES_I18N (key-first { key: {de,en} },
-// Server-Form) in die locale-first TranslationsByLocale-Form die der Client
-// erwartet — kein Key-Duplikat, kein Drift.
+// Translation bundle for the managed-pages admin screens. Without these keys the
+// UI renders the raw i18n keys (screen:*.title, entity:*:field:*, section
+// headers). Once a feature calls r.translations, the boot validator
+// (required-surface-keys) demands the COMPLETE required-surface set in de+en;
+// this file covers every screen/field/section key managed-pages registers. The
+// two customCss keys are always supplied (harmless with allowCustomCss:false, but
+// required for consumers that enable it).
 
-import {
-  type TranslationsByLocale,
-  translationsByLocaleFromKeys,
-} from "@cosmicdrift/kumiko-renderer";
-import { MANAGED_PAGES_I18N } from "../i18n.ts";
+type LocalizedString = { readonly en: string };
 
-export const defaultTranslations: TranslationsByLocale =
-  translationsByLocaleFromKeys(MANAGED_PAGES_I18N);
+export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
+  // Screen titles (global/unprefixed, screenTitleKey = screen:<id>.title)
+  "screen:page-list.title": { en: "Pages" },
+  "screen:page-edit.title": { en: "Edit page" },
+  "screen:branding-settings.title": { en: "Branding" },
+
+  // Page-Entity Feld-Labels (managed-pages:entity:page:field:*)
+  "managed-pages:entity:page:field:slug": { en: "Slug" },
+  "managed-pages:entity:page:field:lang": { en: "Language" },
+  "managed-pages:entity:page:field:title": { en: "Title" },
+  "managed-pages:entity:page:field:published": { en: "Published" },
+  "managed-pages:entity:page:field:published:option:true": {
+    en: "Published",
+  },
+  "managed-pages:entity:page:field:published:option:false": { en: "Draft" },
+  "managed-pages:entity:page:field:description": { en: "Description" },
+  "managed-pages:entity:page:field:ogImage": { en: "OG image" },
+  "managed-pages:entity:page:field:body": { en: "Content" },
+
+  // Config-Edit Feld-Labels (managed-pages:entity:__config-edit__:field:*, camelCase Form-Keys)
+  "managed-pages:entity:__config-edit__:field:title": { en: "Site title" },
+  "managed-pages:entity:__config-edit__:field:description": {
+    en: "Description",
+  },
+  "managed-pages:entity:__config-edit__:field:siteUrl": { en: "Site URL" },
+  "managed-pages:entity:__config-edit__:field:accentColor": {
+    en: "Accent color",
+  },
+  "managed-pages:entity:__config-edit__:field:logoUrl": { en: "Logo URL" },
+  "managed-pages:entity:__config-edit__:field:logoFile": { en: "Logo file" },
+  "managed-pages:entity:__config-edit__:field:layoutPreset": { en: "Layout" },
+
+  // Section-Header
+  "managed-pages:section.meta": { en: "Metadata" },
+  "managed-pages:section.body": { en: "Content" },
+  "managed-pages:branding.section.identity": { en: "Identity" },
+
+  // Row-Actions + Confirm (pageListScreen)
+  "managed-pages:actions.edit": { en: "Edit" },
+  "managed-pages:actions.delete": { en: "Delete" },
+  "managed-pages:confirms.page-delete": {
+    en: "Delete this page?",
+  },
+
+  // Nur bei allowCustomCss:true im Screen — unconditional geliefert
+  "managed-pages:entity:__config-edit__:field:customCss": { en: "Custom CSS" },
+  "managed-pages:branding.section.custom-css": { en: "Custom CSS" },
+};

package/packages/bundled-features/src/managed-pages/web/index.ts

@@ -1,3 +1,2 @@
-// @runtime client
 export { type ManagedPagesClientOptions, managedPagesClient } from "./client-plugin.tsx";
-export { defaultTranslations } from "./i18n.ts";
+export { defaultTranslations } from "./default-translations.ts";

package/packages/bundled-features/src/metrics/compute.ts

@@ -6,7 +6,6 @@ import type {
 } from "@cosmicdrift/kumiko-types/aggregate-types";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { TenantDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
-import { MAX_GROUP_ROWS, type MetricRange } from "./constants.ts";
 import type {
   MetricDefinition,
   MetricDeltaDirection,
@@ -16,6 +15,7 @@ import type {
   MetricSegment,
   MetricSeries,
 } from "./types.ts";
+import { MAX_GROUP_ROWS, type MetricRange } from "./web/constants.ts";
 import { bucketStartsMs, computeWindow, resolveBucket } from "./window.ts";
 
 export type MetricRunParams = {

package/packages/bundled-features/src/metrics/feature.ts

@@ -9,12 +9,6 @@ import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/er
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { runMetric } from "./compute.ts";
-import {
-  METRIC_RANGES,
-  METRICS_FEATURE,
-  METRICS_SYSTEM_FEATURE,
-  type MetricScope,
-} from "./constants.ts";
 import {
   metricFilterPayloadShape,
   metricFilterWhere,
@@ -23,6 +17,12 @@ import {
 import { METRICS_I18N } from "./i18n.ts";
 import type { MetricDefinition, MetricsFeatureOptions } from "./types.ts";
 import { metricHasTenantColumn, validateMetrics } from "./validate.ts";
+import {
+  METRIC_RANGES,
+  METRICS_FEATURE,
+  METRICS_SYSTEM_FEATURE,
+  type MetricScope,
+} from "./web/constants.ts";
 import { isValidTimeZone } from "./window.ts";
 
 const DEFAULT_RANGE = "7d";

package/packages/bundled-features/src/metrics/index.ts

@@ -1,13 +1,5 @@
 // Public API of the metrics bundled-feature.
 
-export {
-  METRIC_RANGES,
-  METRICS_FEATURE,
-  METRICS_SYSTEM_FEATURE,
-  type MetricRange,
-  type MetricScope,
-  metricQueryName,
-} from "./constants.ts";
 export {
   activeTenantsMetric,
   activeUsersMetric,
@@ -32,3 +24,11 @@ export {
   type MetricSeries,
   type MetricsFeatureOptions,
 } from "./types.ts";
+export {
+  METRIC_RANGES,
+  METRICS_FEATURE,
+  METRICS_SYSTEM_FEATURE,
+  type MetricRange,
+  type MetricScope,
+  metricQueryName,
+} from "./web/constants.ts";

package/packages/bundled-features/src/metrics/types.ts

@@ -7,7 +7,7 @@ import type {
 import type { SchemaTable } from "@cosmicdrift/kumiko-types/schema-table-types";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { WhereObject } from "@cosmicdrift/kumiko-types/where-clause-types";
-import type { MetricRange, MetricScope } from "./constants.ts";
+import type { MetricRange, MetricScope } from "./web/constants.ts";
 
 /** Maps a payload value (e.g. a folder id) to the values `column` may have (e.g. the folder and its subfolders' loan ids). Runs with the tenant handler context, so reads stay tenant-scoped; the result only narrows. An empty result yields no rows. */
 export type MetricFilterResolver = {

package/packages/bundled-features/src/metrics/validate.ts

@@ -1,7 +1,7 @@
 import { extractTableInfo, isTimestamptzType } from "@cosmicdrift/kumiko-framework/db";
-import { METRIC_RANGES } from "./constants.ts";
 import { filterValueKindOf, metricFilterEntries, RESERVED_PAYLOAD_KEYS } from "./filters.ts";
 import type { MetricDefinition } from "./types.ts";
+import { METRIC_RANGES } from "./web/constants.ts";
 
 const KEBAB_ID = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const FILTER_PAYLOAD_KEY = /^[a-z][a-zA-Z0-9]*$/;

package/packages/bundled-features/src/metrics/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure constants — imported by server (feature.ts) and by panel declarations,
 // so no runtime import from the engine barrel here.
 

package/packages/bundled-features/src/metrics/window.ts

@@ -1,7 +1,7 @@
 import type { AggregateTimeBucket } from "@cosmicdrift/kumiko-types/aggregate-types";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import type { MetricRange } from "./constants.ts";
 import type { MetricDefinition } from "./types.ts";
+import type { MetricRange } from "./web/constants.ts";
 
 export type MetricWindow = {
   readonly start: Temporal.Instant;

package/packages/bundled-features/src/notes-history/feature.ts

@@ -21,11 +21,11 @@ import {
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.ts";
-import { DEFAULT_NOTES_HISTORY_ACCESS, NOTES_HISTORY_FEATURE_NAME } from "./constants.ts";
 import { createNoteEntryEntity, noteMentionEntity } from "./entity.ts";
 import { createNoteEntryExecutor } from "./executor.ts";
 import { createAddNoteHandler } from "./handlers/add-note.write.ts";
 import { NOTES_HISTORY_FEATURE_I18N } from "./i18n.ts";
+import { DEFAULT_NOTES_HISTORY_ACCESS, NOTES_HISTORY_FEATURE_NAME } from "./web/constants.ts";
 
 function registerNotesHistory(
   r: FeatureRegistrar<typeof NOTES_HISTORY_FEATURE_NAME>,

package/packages/bundled-features/src/notes-history/handlers/add-note.write.ts

@@ -4,9 +4,9 @@ import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/err
 import { decryptStoredPii, denyUnlessJoinRowParentVisible } from "../../shared/index.ts";
 import { tenantMembershipsTable } from "../../tenant/index.ts";
 import { userTable } from "../../user/index.ts";
-import { DEFAULT_NOTES_HISTORY_ACCESS } from "../constants.ts";
 import { noteEntryExecutor, noteMentionExecutor } from "../executor.ts";
 import { type AddNotePayload, addNotePayloadSchema } from "../schemas.ts";
+import { DEFAULT_NOTES_HISTORY_ACCESS } from "../web/constants.ts";
 
 const READ_AUTHOR_DISPLAY_NAME_REASON =
   "reads the author's displayName from the global users table inside a savepoint so a missing user feature cannot poison the note transaction";

package/packages/bundled-features/src/notes-history/index.ts

@@ -1,11 +1,3 @@
-export {
-  DEFAULT_NOTES_HISTORY_ACCESS,
-  DEFAULT_NOTES_HISTORY_ROLES,
-  NOTES_HISTORY_FEATURE_NAME,
-  NOTES_SECTION_EXTENSION_NAME,
-  NotesHistoryHandlers,
-  NotesHistoryQueries,
-} from "./constants.ts";
 export { noteEntryEntity, noteMentionEntity } from "./entity.ts";
 export {
   noteEntryExecutor,
@@ -22,3 +14,11 @@ export {
   createAddNoteHandler,
 } from "./handlers/add-note.write.ts";
 export { type AddNotePayload, addNotePayloadSchema } from "./schemas.ts";
+export {
+  DEFAULT_NOTES_HISTORY_ACCESS,
+  DEFAULT_NOTES_HISTORY_ROLES,
+  NOTES_HISTORY_FEATURE_NAME,
+  NOTES_SECTION_EXTENSION_NAME,
+  NotesHistoryHandlers,
+  NotesHistoryQueries,
+} from "./web/constants.ts";

package/packages/bundled-features/src/notes-history/web/client-plugin.tsx

@@ -1,7 +1,5 @@
-// @runtime client
-
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
-import { NOTES_HISTORY_FEATURE_NAME, NOTES_SECTION_EXTENSION_NAME } from "../constants.ts";
+import { NOTES_HISTORY_FEATURE_NAME, NOTES_SECTION_EXTENSION_NAME } from "./constants.ts";
 import { defaultTranslations } from "./i18n.ts";
 import { NotesSection } from "./notes-section.tsx";
 

package/packages/bundled-features/src/notes-history/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // notes-history bundle constants — feature-name + qualified handler/query names.
 //
 // Spec: kumiko-platform/docs/plans/notes-history-bundle.md

package/packages/bundled-features/src/notes-history/web/i18n.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Default translation bundle for the notes-history UI. notesHistoryClient()
 // hangs it into the LocaleProvider as a fallback bundle — apps override
 // individual keys via notesHistoryClient({ translations }).

package/packages/bundled-features/src/notes-history/web/index.ts

@@ -1,8 +1,7 @@
-// @runtime client
+export { notesHistoryClient } from "./client-plugin.tsx";
 export {
   NOTES_SECTION_EXTENSION_NAME,
   NotesHistoryHandlers,
   NotesHistoryQueries,
-} from "../constants.ts";
-export { notesHistoryClient } from "./client-plugin.tsx";
+} from "./constants.ts";
 export { NotesSection } from "./notes-section.tsx";

package/packages/bundled-features/src/notes-history/web/notes-section.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // NotesSection — drop-in note history for ANY entity. Shows every note
 // chronologically (newest first) with author + timestamp, plus a textarea to
 // append a new one. Append-only: there is no edit/delete affordance because
@@ -19,7 +18,7 @@ import {
   useTranslation,
 } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
-import { NotesHistoryHandlers, NotesHistoryQueries } from "../constants.ts";
+import { NotesHistoryHandlers, NotesHistoryQueries } from "./constants.ts";
 
 type NoteRow = {
   readonly id: string;
@@ -33,7 +32,7 @@ type NoteRow = {
 };
 
 // Matches @cosmicdrift/kumiko-framework/crypto PII_ERASED_SENTINEL — cannot
-// import that module from @runtime client (runtime-isolation).
+// import that module from client code (runtime-isolation).
 const PII_ERASED_SENTINEL = "[[erased]]";
 
 function displayAuthorName(authorName: string | null, unknownLabel: string): string {

package/packages/bundled-features/src/personal-access-tokens/feature.ts

@@ -9,12 +9,6 @@ import {
   type FeatureDefinition,
   type ProjectionListScreenDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  API_TOKEN_ENTITY_NAME,
-  PAT_DEFAULT_RATE_LIMIT,
-  PAT_FEATURE,
-  type PatRateLimit,
-} from "./constants.ts";
 import { availabilityQuery } from "./handlers/availability.query.ts";
 import { buildAvailableScopesQuery } from "./handlers/available-scopes.query.ts";
 import { type CreatePatOptions, createPatCreateHandler } from "./handlers/create.write.ts";
@@ -24,8 +18,14 @@ import { PAT_FEATURE_I18N, patScopeOptionTranslations } from "./i18n.ts";
 import { PAT_REVOKED_EVENT_SHORT, patRevokedSchema } from "./pat-revoked-event.ts";
 import { createPatResolver } from "./resolver.ts";
 import { apiTokenEntity } from "./schema/api-token.ts";
-import type { PatScopeConfig } from "./scopes.ts";
 import { createPatMintScreen, patListScreen } from "./screens.ts";
+import {
+  API_TOKEN_ENTITY_NAME,
+  PAT_DEFAULT_RATE_LIMIT,
+  PAT_FEATURE,
+  type PatRateLimit,
+} from "./web/constants.ts";
+import type { PatScopeConfig } from "./web/scopes.ts";
 
 // Password-change is the only field-level trigger — see the postSave hook
 // below. MFA-enable/disable is wired separately (auth-mfa's
@@ -148,11 +148,14 @@ export function createPersonalAccessTokensFeature(
     // is r.systemScope()'d (the user aggregate is a systemStream, framework
     // #497), so a postSave hook on "user" gets a poisoned ctx.db here. The
     // concrete revoker is bound once run{Prod,Dev}App has a real db handle.
-    let autoRevokeOnPasswordChange = options.autoRevokeOnPasswordChange;
+    // Explicit option wins; the runtime binding is replaceable so a second boot of the same
+    // feature instance binds its own database.
+    let boundAutoRevoke: ((userId: string) => Promise<number>) | undefined;
     r.hook({
       type: "postSave",
       target: { allOf: "user" },
       handler: async (result) => {
+        const autoRevokeOnPasswordChange = options.autoRevokeOnPasswordChange ?? boundAutoRevoke;
         // skip: nothing bound — same late-bind pattern as sessions/feature.ts
         if (!autoRevokeOnPasswordChange) return;
         // skip: brand-new user, no PATs can exist yet
@@ -165,8 +168,7 @@ export function createPersonalAccessTokensFeature(
       },
     });
     const bindAutoRevokeOnPasswordChange: BindPatAutoRevokeOnPasswordChange = (revoker) => {
-      // explicit constructor option wins over the runtime binding
-      autoRevokeOnPasswordChange ??= revoker;
+      boundAutoRevoke = revoker;
     };
 
     const handlers = {

package/packages/bundled-features/src/personal-access-tokens/handlers/available-scopes.query.ts

@@ -1,6 +1,6 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import type { PatScopeConfig } from "../scopes.ts";
+import type { PatScopeConfig } from "../web/scopes.ts";
 
 // Returns the app-declared scope domains ({name, label, canWrite}) so the mint
 // UI can render a per-domain level picker (no access / read / read & write).

package/packages/bundled-features/src/personal-access-tokens/handlers/create.write.ts

@@ -11,9 +11,9 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { encryptForDirectWrite, verifyPassword } from "../../shared/index.ts";
 import { UserQueries } from "../../user/index.ts";
-import { API_TOKEN_ENTITY_NAME, PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors } from "../constants.ts";
 import { mintPatToken } from "../hash.ts";
 import { apiTokenEntity, apiTokenTable } from "../schema/api-token.ts";
+import { API_TOKEN_ENTITY_NAME, PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors } from "../web/constants.ts";
 
 export type PatMfaVerifyResult = { readonly enrolled: boolean; readonly ok: boolean };
 

package/packages/bundled-features/src/personal-access-tokens/handlers/revoke.write.ts

@@ -4,9 +4,9 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { API_TOKEN_ENTITY_NAME, PatErrors } from "../constants.ts";
 import { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN } from "../pat-revoked-event.ts";
 import { apiTokenTable } from "../schema/api-token.ts";
+import { API_TOKEN_ENTITY_NAME, PatErrors } from "../web/constants.ts";
 
 // Revoke one of the caller's own tokens. Ownership is enforced in the WHERE
 // (userId = caller), so a caller can't revoke another user's token and a miss

package/packages/bundled-features/src/personal-access-tokens/hash.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { generateToken, PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
-import { PAT_PREFIX_DISPLAY_LENGTH } from "./constants.ts";
+import { PAT_PREFIX_DISPLAY_LENGTH } from "./web/constants.ts";
 
 // A PAT is high-entropy (32 random bytes from generateToken). A single SHA-256
 // is the right hash here: fast on the per-request auth path, and there's no

package/packages/bundled-features/src/personal-access-tokens/i18n.ts

@@ -1,7 +1,7 @@
 import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
 import { fieldLabelKey, fieldOptionLabelKey } from "@cosmicdrift/kumiko-renderer/headless";
-import { PAT_FEATURE } from "./constants.ts";
-import type { PatScopeConfig } from "./scopes.ts";
+import { PAT_FEATURE } from "./web/constants.ts";
+import type { PatScopeConfig } from "./web/scopes.ts";
 
 const mintFieldKey = (field: string): string =>
   fieldLabelKey(PAT_FEATURE, ACTION_FORM_ENTITY, field);

package/packages/bundled-features/src/personal-access-tokens/index.ts

@@ -1,8 +1,6 @@
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { PAT_DEFAULT_RATE_LIMIT, type PatRateLimit } from "./constants.ts";
+import { PAT_DEFAULT_RATE_LIMIT, type PatRateLimit } from "./web/constants.ts";
 
-export type { PatRateLimit } from "./constants.ts";
-export { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PatHandlers, PatQueries } from "./constants.ts";
 export type { BindPatAutoRevokeOnPasswordChange, PersonalAccessTokensOptions } from "./feature.ts";
 export {
   bindPatAutoRevokeOnPasswordChangeFromFeature,
@@ -20,8 +18,10 @@ export {
 export { createPatResolver } from "./resolver.ts";
 export { revokeAllPatTokensForUser } from "./revoke-for-user.ts";
 export { apiTokenEntity, apiTokenTable } from "./schema/api-token.ts";
-export type { PatScopeConfig, PatScopeDef } from "./scopes.ts";
-export { expandScopes } from "./scopes.ts";
+export type { PatRateLimit } from "./web/constants.ts";
+export { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PatHandlers, PatQueries } from "./web/constants.ts";
+export type { PatScopeConfig, PatScopeDef } from "./web/scopes.ts";
+export { expandScopes } from "./web/scopes.ts";
 
 // Reads the per-token rate-limit config off a mounted PAT feature's exports.
 // Falls back to the default when absent. run-prod-app uses this to build the