@cosmicdrift/kumiko-samples 0.404.0 → 0.405.0

package/packages/bundled-features/src/managed-pages/render-page-body.ts

@@ -1,4 +1,5 @@
 import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework/logging";
+import { createLruCache } from "@cosmicdrift/kumiko-framework/utils";
 import { renderSafeMarkdown } from "../page-render/index.ts";
 import { sanitizeDocumentHtml } from "../template-resolver/index.ts";
 import type { BodyFormat } from "./constants.ts";
@@ -29,8 +30,7 @@ export type PageBodyRendererDeps = {
 };
 
 // Every write bumps the version, so a (page, version) key never serves stale
-// HTML. A Map keeps insertion order: delete+reinsert on a hit makes the first
-// key the least recently used one.
+// HTML.
 function cacheKeyOf(page: RenderablePageBody): string {
   return [page.tenantId, page.slug, page.lang, page.version, page.updatedAt, page.bodyFormat].join(
     "\u0000",
@@ -47,7 +47,7 @@ export function createPageBodyRenderer(
   const sanitizeDocument = deps.sanitizeDocument ?? sanitizeDocumentHtml;
   const renderMarkdown = deps.renderMarkdown ?? renderSafeMarkdown;
   const maxEntries = deps.maxEntries ?? MAX_CACHED_BODIES;
-  const cache = new Map<string, string>();
+  const cache = createLruCache<string, string>({ maxEntries });
 
   function renderUncached(page: RenderablePageBody, log: WarnLogger): string {
     if (page.bodyFormat === "markdown") return renderMarkdown(page.body);
@@ -63,18 +63,10 @@ export function createPageBodyRenderer(
   return (page, log = defaultLog) => {
     const key = cacheKeyOf(page);
     const cached = cache.get(key);
-    if (cached !== undefined) {
-      cache.delete(key);
-      cache.set(key, cached);
-      return cached;
-    }
+    if (cached !== undefined) return cached;
     const html = renderUncached(page, log);
     if (html.length > MAX_CACHED_BODY_LENGTH) return html;
     cache.set(key, html);
-    if (cache.size > maxEntries) {
-      const oldest = cache.keys().next();
-      if (!oldest.done) cache.delete(oldest.value);
-    }
     return html;
   };
 }

package/packages/bundled-features/src/notes-history/feature.ts

@@ -20,7 +20,7 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.ts";
+import { assertNoWhereRuleInOwnershipWrite, resolveFeatureAccess } from "../shared/index.ts";
 import { createNoteEntryEntity, noteMentionEntity } from "./entity.ts";
 import { createNoteEntryExecutor } from "./executor.ts";
 import { createAddNoteHandler } from "./handlers/add-note.write.ts";
@@ -104,12 +104,6 @@ export type NotesHistoryFeatureOptions = {
   readonly parents?: readonly string[];
 };
 
-function resolveAccess(opts: NotesHistoryFeatureOptions): AccessRule {
-  if (opts.access !== undefined) return opts.access;
-  if (opts.roles !== undefined) return { roles: opts.roles };
-  return DEFAULT_NOTES_HISTORY_ACCESS;
-}
-
 // Options wrapper. Without options returns the module-level singleton (no
 // rebuild). access/roles/ownership build a fresh feature-definition.
 export function createNotesHistoryFeature(
@@ -135,6 +129,11 @@ export function createNotesHistoryFeature(
     );
   }
   return defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) =>
-    registerNotesHistory(r, resolveAccess(opts), opts.ownership, opts.parents),
+    registerNotesHistory(
+      r,
+      resolveFeatureAccess(opts, DEFAULT_NOTES_HISTORY_ACCESS),
+      opts.ownership,
+      opts.parents,
+    ),
   );
 }

package/packages/bundled-features/src/personal-access-tokens/handlers/list.query.ts

@@ -4,6 +4,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.ts";
 import { isExpiredAt } from "../expiry.ts";
+import { parseScopeNames } from "../parse-scope-names.ts";
 import { apiTokenTable } from "../schema/api-token.ts";
 
 // `sort` arrives raw from the client's query string. selectMany's orderBy has
@@ -28,15 +29,6 @@ function tokenStatus(row: {
   return "active";
 }
 
-function parseScopeNames(raw: string): string[] {
-  try {
-    const parsed: unknown = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed.filter((s): s is string => typeof s === "string") : [];
-  } catch {
-    return [];
-  }
-}
-
 // The caller's own tokens — metadata only, never the hash or plaintext.
 // Includes revoked/expired rows so the UI can show history; `prefix` is the
 // only fragment of the secret ever exposed.

package/packages/bundled-features/src/personal-access-tokens/hash.ts

@@ -1,5 +1,5 @@
-import { createHash } from "node:crypto";
 import { generateToken, PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
+import { hashOpaqueTokenSync } from "@cosmicdrift/kumiko-framework/crypto";
 import { PAT_PREFIX_DISPLAY_LENGTH } from "./web/constants.ts";
 
 // A PAT is high-entropy (32 random bytes from generateToken). A single SHA-256
@@ -8,7 +8,7 @@ import { PAT_PREFIX_DISPLAY_LENGTH } from "./web/constants.ts";
 // passwords). Only the hash is persisted — the plaintext exists once, in the
 // create response.
 export function hashPatToken(rawToken: string): string {
-  return createHash("sha256").update(rawToken).digest("hex");
+  return hashOpaqueTokenSync(rawToken);
 }
 
 export function mintPatToken(): { raw: string; hash: string; prefix: string } {

package/packages/bundled-features/src/personal-access-tokens/parse-scope-names.ts

@@ -0,0 +1,9 @@
+// Drops non-string entries rather than rejecting the whole array.
+export function parseScopeNames(raw: string): string[] {
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed.filter((s): s is string => typeof s === "string") : [];
+  } catch {
+    return [];
+  }
+}

package/packages/bundled-features/src/personal-access-tokens/resolver.ts

@@ -4,6 +4,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { isExpiredAt } from "./expiry.ts";
 import { hashPatToken } from "./hash.ts";
+import { parseScopeNames } from "./parse-scope-names.ts";
 import { resolvePatRoles } from "./roles.ts";
 import { apiTokenTable } from "./schema/api-token.ts";
 import { expandScopes, type PatScopeConfig } from "./web/scopes.ts";
@@ -42,12 +43,3 @@ export function createPatResolver(opts: {
     };
   };
 }
-
-function parseScopeNames(raw: string): string[] {
-  try {
-    const parsed: unknown = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed.filter((s): s is string => typeof s === "string") : [];
-  } catch {
-    return [];
-  }
-}

package/packages/bundled-features/src/renderer-foundation/README.md

@@ -21,9 +21,7 @@ const features = [
 const app = createKumikoApp({
   features,
   extraContext: ({ registry }) => ({
-    rendererFoundation: createRendererFoundationApi(
-      collectRendererPlugins(registry),
-    ),
+    rendererFoundation: createRendererFoundationApi(collectRendererPlugins(registry)),
   }),
 });
 ```
@@ -39,7 +37,11 @@ async function sendMail(ctx, tenantId) {
   const result = await renderer.render(
     {
       kind: "mail",
-      payload: { slug: "billing:notify:invoice-ready", locale: "de", variables: { name: "Frau Schmidt" } },
+      payload: {
+        slug: "billing:notify:invoice-ready",
+        locale: "de",
+        variables: { name: "Frau Schmidt" },
+      },
     },
     { db: ctx.db, registry: ctx.registry, tenantId, config: ctx.config },
   );

package/packages/bundled-features/src/renderer-foundation/feature.ts

@@ -1,4 +1,5 @@
 import { defineFeature, type Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { collectExtensionOptions } from "../shared/index.ts";
 import { RENDERER_EXTENSION } from "./constants.ts";
 import { isRendererRegistrationPlugin, type RendererPlugin } from "./types.ts";
 
@@ -22,13 +23,7 @@ export function createRendererFoundationFeature() {
     });
     r.requires({ features: ["template-resolver"] });
 
-    r.extendsRegistrar(RENDERER_EXTENSION, {
-      onRegister: () => {
-        // Plugin conformance check could go here: validate the shape of
-        // options (kinds, render function present). No shape check currently —
-        // the caller's TypeScript type safety applies.
-      },
-    });
+    r.extendsRegistrar(RENDERER_EXTENSION, {});
 
     return {};
   });
@@ -40,13 +35,5 @@ export function createRendererFoundationFeature() {
 //
 // Symmetric to collectChannels / collectRenderers in delivery-service.
 export function collectRendererPlugins(registry: Registry): RendererPlugin[] {
-  const usages = registry.getExtensionUsages(RENDERER_EXTENSION);
-  return usages.map((usage) => {
-    if (!isRendererRegistrationPlugin(usage.options)) {
-      throw new Error(
-        `${RENDERER_EXTENSION} registration for "${usage.entityName}" has invalid options`,
-      );
-    }
-    return { name: usage.entityName, ...usage.options };
-  });
+  return collectExtensionOptions(registry, RENDERER_EXTENSION, isRendererRegistrationPlugin);
 }

package/packages/bundled-features/src/renderer-pdf/README.md

@@ -11,7 +11,11 @@ const { pdfBytes, pageCount } = await renderTablePdf(
   {
     title: "Prüfprotokoll",
     meta: [{ label: "Anlage", value: "Kessel 3" }],
-    columns: [{ header: "Datum" }, { header: "Prüfer", weight: 2 }, { header: "Kosten", align: "right" }],
+    columns: [
+      { header: "Datum" },
+      { header: "Prüfer", weight: 2 },
+      { header: "Kosten", align: "right" },
+    ],
     rows: [["03.02.2026", "Müller", "120,00 €"]],
     footerText: "Kumiko GmbH",
     pageLabel: "Seite {page} von {pages}",

package/packages/bundled-features/src/secrets/handlers/rotate.job.ts

@@ -22,7 +22,6 @@ import {
   createTenantDb,
   type DbConnection,
   selectMany,
-  type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { JobContext, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
@@ -31,7 +30,11 @@ import {
   encodeStoredEnvelope,
   rewrapDek,
 } from "@cosmicdrift/kumiko-framework/secrets";
-import { type ChunkedMigrationStopReason, runChunkedMigration } from "../../shared/index.ts";
+import {
+  type ChunkedMigrationStopReason,
+  createTenantDbCache,
+  runChunkedMigration,
+} from "../../shared/index.ts";
 import { type StoredEnvelope, tenantSecretEntity, tenantSecretsTable } from "../table.ts";
 
 const DEFAULT_BATCH_SIZE = 100;
@@ -74,23 +77,14 @@ export async function rotateJob(
     ? Date.now() + payload.maxDurationMs
     : Number.POSITIVE_INFINITY;
 
-  // Reuse a TenantDb-per-tenant map so we don't rebuild the wrapper for
-  // each row in the same tenant. Rotation typically hits one tenant in a
-  // batch; the map trims an allocation without adding complexity.
-  const tdbCache = new Map<TenantId, TenantDb>();
-  function tdbFor(tenantId: TenantId): TenantDb {
-    let existing = tdbCache.get(tenantId);
-    if (!existing) {
-      existing = createTenantDb({
-        db,
-        tenantId,
-        mode: "system",
-        reason: "secret key rotation job re-encrypts secrets of every tenant",
-      });
-      tdbCache.set(tenantId, existing);
-    }
-    return existing;
-  }
+  const tdbFor = createTenantDbCache((tenantId) =>
+    createTenantDb({
+      db,
+      tenantId,
+      mode: "system",
+      reason: "secret key rotation job re-encrypts secrets of every tenant",
+    }),
+  );
 
   type SecretRow = {
     id: string;

package/packages/bundled-features/src/shared/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.405.0",
+    "type": "improvement",
+    "title": "Bundled features share internal helpers",
+    "detail": "Access resolution for folders, ledger, notes-history and tags, the folders/tags write hook, the system-mode TenantDb cache of the re-encryption and rotation jobs, the mail locale templates of auth-email-password and user-data-rights, extension option collection for delivery and renderers, PAT scope parsing, user-data-rights hook DBs, unique-constraint failure checks, tenant member PII decryption, the status banner, the invite-accept request, the tenant label and the jobs subject parser each live in one internal module now. Empty onRegister callbacks are dropped. No behavior change."
+  },
   {
     "version": "0.364.0",
     "type": "improvement",

package/packages/bundled-features/src/shared/collect-extension-options.ts

@@ -0,0 +1,14 @@
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+
+export function collectExtensionOptions<TOptions extends object>(
+  registry: Registry,
+  extension: string,
+  isOptions: (candidate: unknown) => candidate is TOptions,
+): Array<{ name: string } & TOptions> {
+  return registry.getExtensionUsages(extension).map((usage) => {
+    if (!isOptions(usage.options)) {
+      throw new Error(`${extension} registration for "${usage.entityName}" has invalid options`);
+    }
+    return { name: usage.entityName, ...usage.options };
+  });
+}

package/packages/bundled-features/src/shared/hmac-signature.ts

@@ -0,0 +1,15 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+export function signHmacSha256Base64Url(input: string, secret: string): string {
+  return createHmac("sha256", secret).update(input).digest("base64url");
+}
+
+export function hmacSignatureMatches(
+  expectedBase64Url: string,
+  providedBase64Url: string,
+): boolean {
+  const expectedBuf = Buffer.from(expectedBase64Url, "base64url");
+  const providedBuf = Buffer.from(providedBase64Url, "base64url");
+  // timingSafeEqual throws on a length mismatch, and the throw itself is a timing signal.
+  return expectedBuf.length === providedBuf.length && timingSafeEqual(expectedBuf, providedBuf);
+}

package/packages/bundled-features/src/shared/index.ts

@@ -15,13 +15,17 @@ export {
   classifyStoredEnvelope,
   type StoredEnvelopeClassification,
 } from "./classify-stored-envelope.ts";
+export { collectExtensionOptions } from "./collect-extension-options.ts";
 export { decryptStoredPii, decryptStoredUserEmail } from "./decrypt-stored-pii.ts";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.ts";
 export { entitiesOf } from "./entities-of.ts";
 export { isWithinGracePeriod } from "./grace-period.ts";
+export { hmacSignatureMatches, signHmacSha256Base64Url } from "./hmac-signature.ts";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.ts";
 export { isTenantDb } from "./is-tenant-db.ts";
+export { isUniqueConstraintFailure } from "./is-unique-constraint-failure.ts";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.ts";
+export { createMailLocaleTemplates } from "./mail-locale-templates.ts";
 export {
   mailHeading,
   mailParagraph,
@@ -59,6 +63,7 @@ export {
 } from "./redact.ts";
 export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.ts";
 export { requireForTenant } from "./require-for-tenant.ts";
+export { resolveFeatureAccess } from "./resolve-feature-access.ts";
 export {
   extensionForResourceContentType,
   isResourceImageContentType,
@@ -108,4 +113,5 @@ export {
   stepFailures,
 } from "./stream-tenant-derived-state.ts";
 export type { SystemQueryFn } from "./system-query.ts";
+export { createTenantDbCache } from "./tenant-db-cache.ts";
 export { type BurnResult, burnToken, unburnToken } from "./token-burn-store.ts";

package/packages/bundled-features/src/shared/is-unique-constraint-failure.ts

@@ -0,0 +1,11 @@
+import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
+
+// The executor reports a unique-index race as a WriteFailure(unique_violation)
+// whose details name the violated constraint.
+export function isUniqueConstraintFailure(failure: WriteFailure, constraint: string): boolean {
+  return (
+    propertyOf(failure.error, "code") === "unique_violation" &&
+    propertyOf(propertyOf(failure.error, "details"), "constraintName") === constraint
+  );
+}

package/packages/bundled-features/src/shared/mail-locale-templates.ts

@@ -0,0 +1,64 @@
+import type { NotificationLocalizedTemplate } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  hasMailTranslationKey,
+  listMailLocales,
+  mailT,
+  resolveMailLocale,
+} from "@cosmicdrift/kumiko-framework/i18n";
+
+type MailLocaleTemplateConfig<Kind extends string> = {
+  readonly kinds: readonly Kind[];
+  readonly notificationTypes: Readonly<Record<Kind, string>>;
+  readonly subjectKey: (kind: Kind) => string;
+  readonly bodyFor: (kind: Kind, locale: string) => string;
+};
+
+export function createMailLocaleTemplates<Kind extends string>(
+  config: MailLocaleTemplateConfig<Kind>,
+): {
+  templateLocale: (notificationType: string, requestedLocale: string) => string;
+  localizedTemplate: (kind: Kind) => () => NotificationLocalizedTemplate;
+} {
+  const subjectKeyByType: ReadonlyMap<string, string> = new Map(
+    config.kinds.map((kind) => [config.notificationTypes[kind], config.subjectKey(kind)]),
+  );
+
+  // A registered locale whose bundle lacks the subject key has no template (see
+  // localizedTemplate); the renderer has no locale fallback, so the sender must
+  // pick a locale that has one or the mail would not go out at all.
+  const templateLocale = (notificationType: string, requestedLocale: string): string => {
+    const locale = resolveMailLocale(requestedLocale);
+    const key = subjectKeyByType.get(notificationType);
+    return key !== undefined && hasMailTranslationKey(locale, key) ? locale : "en";
+  };
+
+  // Evaluated when the registry is built, after every locale feature has
+  // registered its mail translations. English always ships; another locale only
+  // gets a template when it has its own subject, so a missing translation never
+  // silently becomes an English mail in that locale's slot.
+  const localizedTemplate = (kind: Kind): (() => NotificationLocalizedTemplate) => {
+    const kindSubjectKey = config.subjectKey(kind);
+    return () => {
+      const locales = [
+        "en",
+        ...listMailLocales().filter(
+          (locale) => locale !== "en" && hasMailTranslationKey(locale, kindSubjectKey),
+        ),
+      ];
+      return Object.fromEntries(
+        locales.map((locale) => [
+          locale,
+          {
+            body: config.bodyFor(kind, locale),
+            meta: {
+              subject: mailT(locale, kindSubjectKey, { app: "{{appName}}" }),
+              category: "transactional" as const,
+            },
+          },
+        ]),
+      );
+    };
+  };
+
+  return { templateLocale, localizedTemplate };
+}

package/packages/bundled-features/src/shared/resolve-feature-access.ts

@@ -0,0 +1,16 @@
+import type { AccessRule } from "@cosmicdrift/kumiko-framework/engine";
+
+type FeatureAccessOptions = {
+  readonly access?: AccessRule;
+  readonly roles?: readonly string[];
+};
+
+// `access` wins over the `roles` shorthand; neither set falls back to the feature default.
+export function resolveFeatureAccess(
+  opts: FeatureAccessOptions,
+  defaultAccess: AccessRule,
+): AccessRule {
+  if (opts.access !== undefined) return opts.access;
+  if (opts.roles !== undefined) return { roles: opts.roles };
+  return defaultAccess;
+}

package/packages/bundled-features/src/shared/signed-token.ts

@@ -12,17 +12,13 @@
 // Timing-safe comparison on verify so a valid-length forgery can't leak
 // signal through a short-circuit.
 
-import { createHmac, timingSafeEqual } from "node:crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { hmacSignatureMatches, signHmacSha256Base64Url } from "./hmac-signature.ts";
 
 export type VerifyResult =
   | { readonly ok: true; readonly userId: string; readonly expiresAtMs: number }
   | { readonly ok: false; readonly reason: "malformed" | "bad_signature" | "expired" };
 
-function sign(input: string, secret: string): string {
-  return createHmac("sha256", secret).update(input).digest("base64url");
-}
-
 function payload(purpose: string, userId: string, expiresAtMs: number): string {
   return `${purpose}:${userId}.${expiresAtMs}`;
 }
@@ -36,7 +32,7 @@ export function signToken(
 ): { token: string; expiresAt: Temporal.Instant } {
   const expiresAt = now.add({ minutes: ttlMinutes });
   const expiresAtMs = expiresAt.epochMilliseconds;
-  const signature = sign(payload(purpose, userId, expiresAtMs), secret);
+  const signature = signHmacSha256Base64Url(payload(purpose, userId, expiresAtMs), secret);
   return {
     token: `${userId}.${expiresAtMs}.${signature}`,
     expiresAt,
@@ -74,14 +70,8 @@ export function verifyToken(
     return { ok: false, reason: "malformed" };
   }
 
-  const expected = sign(payload(purpose, userId, expiresAtMs), secret);
-  const expectedBuf = Buffer.from(expected, "base64url");
-  const providedBuf = Buffer.from(providedSig, "base64url");
-  // Length mismatch fails BEFORE timingSafeEqual, which throws on different
-  // lengths — but that throw itself leaks via timing. Explicit length check
-  // keeps the path uniform.
-  if (expectedBuf.length !== providedBuf.length) return { ok: false, reason: "bad_signature" };
-  if (!timingSafeEqual(expectedBuf, providedBuf)) return { ok: false, reason: "bad_signature" };
+  const expected = signHmacSha256Base64Url(payload(purpose, userId, expiresAtMs), secret);
+  if (!hmacSignatureMatches(expected, providedSig)) return { ok: false, reason: "bad_signature" };
 
   if (Temporal.Instant.compare(now, Temporal.Instant.fromEpochMilliseconds(expiresAtMs)) > 0) {
     return { ok: false, reason: "expired" };

package/packages/bundled-features/src/shared/single-use-token-store.ts

@@ -38,14 +38,14 @@
 // permanently tax Redis, long enough to catch replays inside any realistic
 // race window).
 
-import { createHash } from "node:crypto";
+import { hashOpaqueTokenSync } from "@cosmicdrift/kumiko-framework/crypto";
 import type { Redis } from "ioredis";
 
 // Exported so a caller that needs a byte-compatible key in a sibling Redis
 // namespace (e.g. a token↔binding side-mapping) can derive it without
 // re-implementing sha256-of-token — see auth-email-password/signup-token-store.ts.
 export function hashSingleUseToken(token: string): string {
-  return createHash("sha256").update(token).digest("hex");
+  return hashOpaqueTokenSync(token);
 }
 
 export function createSingleUseTokenStore(prefixes: {

package/packages/bundled-features/src/shared/stream-tenant-derived-state.ts

@@ -5,7 +5,11 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
-import { reindexEntity, type SearchAdapter } from "@cosmicdrift/kumiko-framework/search";
+import {
+  isEntitySearchable,
+  reindexEntity,
+  type SearchAdapter,
+} from "@cosmicdrift/kumiko-framework/search";
 import type { StreamBackfillCandidate, StreamBackfillFailure } from "./stream-tenant-backfill.ts";
 
 export type StreamBackfillStepFailure = StreamBackfillFailure & { readonly step: string };
@@ -88,13 +92,6 @@ export async function rebuildAndReindex(deps: {
   return { projectionsRebuilt, reindexedRows, failures };
 }
 
-function isEntitySearchable(registry: Registry, entityName: string): boolean {
-  return (
-    registry.getSearchableFields(entityName).length > 0 ||
-    registry.getSearchPayloadExtensions(entityName).length > 0
-  );
-}
-
 export function stepFailures(
   step: string,
   failed: readonly StreamBackfillFailure[],

package/packages/bundled-features/src/shared/tenant-db-cache.ts

@@ -0,0 +1,19 @@
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+
+// One TenantDb per tenant, so a job touching many rows of the same tenant does
+// not rebuild the wrapper per row. The caller builds the TenantDb itself, so
+// its createTenantDb call keeps the literal system-mode reason the guard needs.
+export function createTenantDbCache(
+  create: (tenantId: TenantId) => TenantDb,
+): (tenantId: TenantId) => TenantDb {
+  const cache = new Map<TenantId, TenantDb>();
+  return (tenantId) => {
+    let existing = cache.get(tenantId);
+    if (!existing) {
+      existing = create(tenantId);
+      cache.set(tenantId, existing);
+    }
+    return existing;
+  };
+}

package/packages/bundled-features/src/shared/web/status-banner.tsx

@@ -0,0 +1,20 @@
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+
+export type SectionStatus =
+  | { kind: "idle" }
+  | { kind: "submitting" }
+  | { kind: "success"; messageKey: string }
+  | { kind: "error"; messageKey: string };
+
+export function StatusBanner({ status }: { readonly status: SectionStatus }): ReactNode {
+  const t = useTranslation();
+  const { Banner } = usePrimitives();
+  if (status.kind === "success") {
+    return <Banner variant="info">{t(status.messageKey)}</Banner>;
+  }
+  if (status.kind === "error") {
+    return <Banner variant="error">{t(status.messageKey)}</Banner>;
+  }
+  return null;
+}

package/packages/bundled-features/src/shared/web/use-dispatched-writes.ts

@@ -0,0 +1,31 @@
+import { useDispatcher } from "@cosmicdrift/kumiko-renderer";
+import { useState } from "react";
+
+// Busy flag + error key shared by the folders/tags management surfaces: every
+// write goes through the dispatcher and a failed one surfaces its i18n key.
+export function useDispatchedWrites(onWriteSucceeded?: () => Promise<void> | void) {
+  const dispatcher = useDispatcher();
+  const [busy, setBusy] = useState(false);
+  const [errorKey, setErrorKey] = useState<string | null>(null);
+
+  const writeOk = async (type: string, payload: Record<string, unknown>): Promise<boolean> => {
+    const result = await dispatcher.write(type, payload);
+    if (!result.isSuccess) {
+      setErrorKey(result.error.i18nKey);
+      return false;
+    }
+    return true;
+  };
+
+  const apply = async (write: () => Promise<boolean>): Promise<void> => {
+    setBusy(true);
+    setErrorKey(null);
+    try {
+      if (await write()) await onWriteSucceeded?.();
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return { busy, setBusy, errorKey, setErrorKey, writeOk, apply };
+}

package/packages/bundled-features/src/subscription-paddle/feature.ts

@@ -6,7 +6,10 @@
 // subscription-stripe. The `apiKey` / `webhookSecret` / `tenantBindingKey` /
 // `clientToken` options are env→config bridge fallbacks.
 
-import type { SubscriptionProviderPlugin } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import {
+  type SubscriptionProviderPlugin,
+  validateOneOffPriceIds,
+} from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import {
   access,
   createSystemConfig,
@@ -122,25 +125,10 @@ export type SubscriptionPaddleOptions = {
   readonly nowSeconds?: () => number;
 };
 
-// Validated once at feature-build time so a typo fails app startup instead of
-// silently widening or narrowing the one-off allowlist at request time.
-function validateOneOffPriceIds(priceIds: readonly string[]): void {
-  const seen = new Set<string>();
-  for (const priceId of priceIds) {
-    if (priceId.length === 0) {
-      throw new Error("subscription-paddle: oneOffPriceIds must not contain an empty string");
-    }
-    if (seen.has(priceId)) {
-      throw new Error(`subscription-paddle: duplicate oneOffPriceIds entry "${priceId}"`);
-    }
-    seen.add(priceId);
-  }
-}
-
 export function createSubscriptionPaddleFeature(
   options: SubscriptionPaddleOptions = {},
 ): FeatureWithEnvSchema<FeatureDefinition, typeof subscriptionPaddleEnvSchema.shape> {
-  validateOneOffPriceIds(options.oneOffPriceIds ?? []);
+  validateOneOffPriceIds("subscription-paddle", options.oneOffPriceIds ?? []);
   const now = options.now ?? (() => Temporal.Now.instant().epochMilliseconds);
   const feature: FeatureDefinition = defineFeature(SUBSCRIPTION_PADDLE_FEATURE, (r) => {
     r.describe(