@cosmicdrift/kumiko-types 0.353.0 → 0.354.1

package/dist/config.d.ts

@@ -173,6 +173,9 @@ export type JobDefinition = {
         readonly messageKey: string;
         readonly subjectFields?: readonly string[] | undefined;
     } | undefined;
+    readonly tenantVisibleRun?: {
+        readonly subjectFields?: readonly string[] | undefined;
+    } | undefined;
 };
 export type NotificationRecipientFn = (result: import("./hooks.js").SaveContext) => string | readonly string[] | {
     readonly tenant: string;

package/dist/cursor-types.d.ts

@@ -13,4 +13,7 @@ export type CursorResult<T> = {
     /** Optional total row count — only present when the caller sets
      *  `totalCount: true` on the query. */
     total?: number;
+    /** Set when the search backend returned as many candidates as it can in one
+     *  response, so matches beyond that may be missing from `rows`. */
+    searchTruncated?: true;
 };

package/dist/entity-handlers.d.ts

@@ -9,13 +9,11 @@ export type EntityHandlerOptions = {
      *  otherwise tenant-scoped entity. Every use reports an
      *  `acknowledge-cross-tenant` escape-hatch audit event. On write handlers
      *  update/delete/restore address the target row's own tenant stream.
-     *  `access` stays the only caller gate. Unlike `escapeHatch` on a
+     *  `access` stays the only caller gate, except that a write handler's
+     *  `access` must be SystemAdmin-only. Unlike `escapeHatch` on a
      *  hand-written handler this does NOT grant `ctx.db.unsafeRaw`,
      *  `db.global()` writes or identity switches. */
     readonly escapeHatch?: EscapeHatchDeclaration;
-    /** @deprecated Use `escapeHatch: { reason }` — removed in a future release;
-     *  run `scripts/codemod/migrate-cross-tenant.ts`. */
-    readonly crossTenant?: boolean;
 };
 /** Options for the generic create/update handlers. */
 export type EntityWriteHandlerOptions = EntityHandlerOptions & {

package/dist/entity-table-meta-types.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { EntityRelations } from "./relations.js";
 import type { EntityTenancy } from "./tenancy-brand.js";
 export type PgType = "uuid" | "text" | "boolean" | "integer" | "double precision" | "bigint" | "serial" | "bigserial" | "jsonb" | "timestamptz" | "timestamptz(3)" | "date" | `numeric(${number},${number})`;

package/dist/entity-table-meta-types.js

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 // Plain-data types for EntityTableMeta — split from the runtime
 // (deriveEntityTableMeta, resolveTableName, defineUnmanagedTable) in
 // entity-table-meta.ts. Prep step for the types-only package extraction

package/dist/event-store-types.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { TenantId } from "./identifiers.js";
 export interface VersionConflict extends Error {
     readonly aggregateId: string;

package/dist/fields.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { VariantSpec } from "./derivatives-types.js";
 import type { OwnershipMap } from "./ownership.js";
 import type { EntityTenancy } from "./tenancy-brand.js";
@@ -186,6 +187,24 @@ export declare function isOptionsQueryFieldRef(value: OptionsQueryPayloadValue):
     readonly field: string;
 };
 export declare function optionsQueryFieldRefs(payload: OptionsQueryPayload | undefined): string[];
+export type FieldCondition = boolean | {
+    readonly field: string;
+    readonly eq: unknown;
+} | {
+    readonly field: string;
+    readonly ne: unknown;
+} | {
+    readonly field: string;
+    readonly in: readonly unknown[];
+} | {
+    readonly field: string;
+    readonly notIn: readonly unknown[];
+};
+/** Options of a select field that are only available while `when` holds for the row values. */
+export type SelectConditionalOptions<TOption extends string = string> = {
+    readonly options: readonly TOption[];
+    readonly when: Exclude<FieldCondition, boolean>;
+};
 export type SelectFieldDef<TOptions extends readonly string[] = readonly string[]> = {
     readonly type: "select";
     readonly description?: string;
@@ -225,6 +244,10 @@ export type SelectFieldDef<TOptions extends readonly string[] = readonly string[
      *  are ignored. Static `options` stay authoritative, and the write path must enforce
      *  the same rule (see `withTierOptionGate`), the renderer only mirrors it. */
     readonly optionsAvailabilityQuery?: string;
+    /** Options that are only available while `when` holds for the row values; options
+     *  in no rule are always available. The write path enforces it, the renderer only
+     *  filters. Only valid on entity fields. */
+    readonly conditionalOptions?: readonly SelectConditionalOptions<TOptions[number]>[];
 } & ResolvedPiiFlags;
 export type MultiSelectFieldDef<TOptions extends readonly string[] = readonly string[]> = {
     readonly type: "multiSelect";
@@ -407,6 +430,12 @@ export type ReferenceFieldDef = {
      *  the read-only display resolves a stored value against these rows and
      *  falls back to the raw id for one it does not find. */
     readonly optionsQuery?: string;
+    /** tenant-handover opt-out: rows of THIS entity that point at a handed-over
+     *  row through this field stay in the source tenant instead of travelling
+     *  with it (or failing the claim with `entity_not_transferable`). The
+     *  reference then deliberately crosses the tenant boundary after the
+     *  handover. Use it for an entity that must not move with its host. */
+    readonly handover?: "stay";
 } & ResolvedPiiFlags;
 export type DefaultCurrency = "EUR" | "USD" | "GBP" | "CHF" | "JPY" | "SEK" | "NOK" | "DKK" | "PLN" | "CZK" | "CAD" | "AUD" | "NZD" | "CNY" | "INR";
 type EmbeddedSubFieldBase = {

package/dist/fields.js

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 // --- Field Types ---
 export const SELECT_OPTION_TONES = ["ok", "warn", "bad", "neutral"];
 export function isOptionsQueryFieldRef(value) {

package/dist/handlers.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { Redis } from "ioredis";
 import type { ZodType } from "zod";
 import type { CacheSyncBus } from "./cache-sync-types.js";
@@ -254,6 +255,7 @@ export type AppContext = SharedContextFields & {
 export type HandlerContext<TMap extends object = KumikoEventTypeMap> = SharedContextFields & {
     readonly db: TenantDb;
     readonly dbOutsideTransaction: TenantDb | undefined;
+    readonly outsideTransaction?: <T>(fn: (db: TenantDb) => Promise<T>) => Promise<T>;
     readonly systemDb?: UncheckedSystemDb;
     readonly registry: Registry;
     /** Aktiver SessionUser des Handler-Aufrufs — Convenience-Alias zu

package/dist/http-route.d.ts

@@ -50,8 +50,10 @@ export type HttpRouteDefinition = {
     /** URL-Pfad (Hono-Pattern, z.B. "/feed.xml" oder "/og/:tenantId.png"). */
     readonly path: string;
     /** true = public, no session required. false = mounted behind the
-     *  session auth chain (no anonymous fallthrough, PAT rate limit,
-     *  origin + CSRF guards) — a request without a session gets 401. The
+     *  session auth chain (global IP rate limit when configured, PII
+     *  ciphertext tripwire, no anonymous fallthrough, origin + CSRF guards;
+     *  PATs are rejected). requestId, body limit and observability are the
+     *  `/api/*` chain only. A request without a session gets 401. The
      *  handler reads the caller via getUser(c). */
     readonly anonymous: boolean;
     /** Hono-Handler. Bekommt Hono-Context + Framework-Deps; returnt

package/dist/multi-stream-apply-context-types.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { DerivativesContext } from "./derivatives-types.js";
 import type { StoredEvent } from "./event-store-types.js";
 import type { KumikoEventTypeMap } from "./event-type-map.js";

package/dist/rate-limit-types.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { Temporal } from "./temporal.js";
 export type RateLimitDecision = {
     readonly allowed: boolean;

package/dist/screen.d.ts

@@ -1,5 +1,5 @@
 import type { FieldIconKey } from "./field-icon.js";
-import type { FieldDefinition, FormFieldDefinition, SelectOptionTone } from "./fields.js";
+import type { FieldCondition, FieldDefinition, FormFieldDefinition, SelectOptionTone } from "./fields.js";
 import type { AccessRule, AgentScreenHints } from "./handlers.js";
 import type { IconKey, NavIconKey } from "./nav-icon.js";
 export type { FieldIconKey } from "./field-icon.js";
@@ -62,19 +62,7 @@ export type FormatSpec = {
     } & FieldFormatRegistry[K];
 }[keyof FieldFormatRegistry];
 export type FieldRenderer = PlatformComponent | string | FormatSpec;
-export type FieldCondition = boolean | {
-    readonly field: string;
-    readonly eq: unknown;
-} | {
-    readonly field: string;
-    readonly ne: unknown;
-} | {
-    readonly field: string;
-    readonly in: readonly unknown[];
-} | {
-    readonly field: string;
-    readonly notIn: readonly unknown[];
-};
+export type { FieldCondition } from "./fields.js";
 export type ListColumnSpec = string | {
     readonly field: string;
     readonly renderer?: FieldRenderer;
@@ -88,6 +76,12 @@ export type ListColumnSpec = string | {
      *  label; without one it is rejected at boot as an unknown field. `field`
      *  is then just a stable column key (pick any unique slug). */
     readonly label?: string;
+    /** Marks a column on a query-backed list (projectionList, relatedList,
+     *  dashboard list, expandableRow) as drawn by a renderer rather than read
+     *  from a row field. Without it, a query that declares an `outputSchema`
+     *  must return `field`; a `label` alone does not exempt the column, since
+     *  nearly every column carries one. */
+    readonly virtual?: boolean;
     /** Marks this column as a reference lookup instead of a plain value —
      *  for projectionList/relatedList columns, which have no
      *  `EntityDefinition` to carry a real `reference` field type. Same
@@ -406,6 +400,8 @@ export type EntityListScreenDefinition = {
     readonly entity: string;
     /** Short screen id (same feature) the create button opens instead of the entity's default edit screen. */
     readonly createScreen?: string;
+    /** Set by the role projection when `createScreen` is not reachable for the role: the renderer then shows no create button instead of falling back to the entity's edit screen. Not for app authors. */
+    readonly createUnavailable?: boolean;
     readonly columns: readonly ListColumnSpec[];
     readonly rowRenderer?: PlatformComponent;
     readonly cardRenderer?: PlatformComponent;
@@ -747,6 +743,8 @@ export type DashboardChartTone = "positive" | "negative" | "active" | "neutral";
 export type DashboardChartMarkerKind = {
     readonly tone?: DashboardChartTone;
     readonly color?: string;
+    /** i18n key; with `markerLegend: "legend"` the chart legend lists the markers of this kind under it. */
+    readonly label?: string;
 };
 /** One option of a stacked-area range switch. Without `months` the option
  *  shows every bucket; with it, a window of that many months anchored at
@@ -787,6 +785,15 @@ export type DashboardChartPanel = DashboardPanelQueryOptions & DashboardPanelEmp
     readonly ranges?: DashboardChartRanges;
     /** Only for chart "stacked-area": scrubber under the plot to drag the visible window; starts at today. */
     readonly brush?: boolean;
+    /** Only for chart "stacked-area": date format of axis and marker labels.
+     *  Default automatic: day and month below 18 visible months, month and year above. */
+    readonly dateFormat?: "day" | "month";
+    /** Only for chart "stacked-area": window the uncontrolled chart starts in.
+     *  "from-today" starts at today even when `ranges.default` is set. Default "default-range". */
+    readonly initialWindow?: "default-range" | "from-today";
+    /** Only for chart "stacked-area": "legend" drops the numbered marker list; pins become
+     *  plain dots with a tooltip and the legend lists marker kinds (see `markerKinds[].label`). Default "list". */
+    readonly markerLegend?: "list" | "legend";
 };
 export type DashboardListPanel = DashboardPanelQueryOptions & DashboardPanelEmptyState & DashboardPanelGate & {
     readonly kind: "list";
@@ -1046,7 +1053,9 @@ export type EditRelatedListSection = {
      *  of a bespoke child-rows handler. Mutually exclusive with `parentParam`
      *  (the boot-validator rejects both). `field` must be a real field on the
      *  entity behind `query`, and that query's Zod schema must accept
-     *  `filter` (same requirement `filter`/`facets` already have). */
+     *  `filter` (same requirement `filter`/`facets` already have). The filter is
+     *  client-supplied: any caller may omit it, so the bound query must authorize
+     *  the ENTIRE row set it can return, not just the parent's children. */
     readonly parentFilter?: {
         readonly field: string;
     };
@@ -1313,6 +1322,10 @@ export type ActionFormScreenDefinition = {
     readonly fallback?: string;
     /** Derived by buildAppSchema — see EntityEditScreenDefinition.urlPrefillFields. */
     readonly urlPrefillFields?: readonly string[];
+    /** Submit is enabled without edits: values seeded from navigate `params` count as the
+     *  user's intent. Every required field the layout hides with `visible: false` must hold a
+     *  value, otherwise submit stays disabled (boot-checked against navigate `params`). */
+    readonly submitPrefilled?: boolean;
     /** Write-Handler-QN der bei Submit gerufen wird. Form-Object landet
      *  1:1 als payload — Handler-Schema (Zod) validiert weiter. */
     readonly handler: string;
@@ -1481,6 +1494,10 @@ export type SecretMintScreenDefinition = {
     readonly fallback?: string;
     /** Derived by buildAppSchema — see EntityEditScreenDefinition.urlPrefillFields. */
     readonly urlPrefillFields?: readonly string[];
+    /** Submit is enabled without edits: values seeded from navigate `params` count as the
+     *  user's intent. Every required field the layout hides with `visible: false` must hold a
+     *  value, otherwise submit stays disabled (boot-checked against navigate `params`). */
+    readonly submitPrefilled?: boolean;
     /** Write-handler QN dispatched on submit. */
     readonly handler: string;
     readonly fields: Readonly<Record<string, FormFieldDefinition>>;

package/dist/secrets-types.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { TenantId } from "./identifiers.js";
 declare const SecretBrand: unique symbol;
 export type Secret<T = string> = {

package/dist/secrets-types.js

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 // Envelope Encryption types. Separating DEK (per-value) from KEK (central)
 // is what makes key rotation cheap: on rotation we only re-wrap the small
 // encryptedDek, never touch the ciphertext.

package/dist/tree-node.d.ts

@@ -1,11 +1,16 @@
 import type { TargetRef } from "./target-ref.js";
 export type TreeNodeState = "filled" | "stub" | "empty" | "loading" | "error";
-export type TreeAction = {
+type TreeActionBase = {
     readonly icon: string;
     readonly label: string;
-    readonly screen?: string;
-    readonly target?: TargetRef;
 };
+export type TreeAction = TreeActionBase & ({
+    readonly screen: string;
+    readonly target?: never;
+} | {
+    readonly target: TargetRef;
+    readonly screen?: never;
+});
 export type TreeNode = {
     readonly label: string;
     readonly icon?: string;
@@ -24,3 +29,4 @@ export type TreeActionsHandle<TFeature extends string, TActions extends Record<s
     readonly id: TFeature;
     readonly treeActions: TActions;
 };
+export {};

package/dist/tz-context.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 import type { GeoAddress, GeoCoordinates, GeoTzProvider } from "./geo-tz.js";
 export type LocatedTimestampJson = {
     /** Wall-clock ISO without offset, e.g. "2026-04-03T10:00:00" */

package/dist/tz-context.js

@@ -1,3 +1,4 @@
+/// <reference types="temporal-polyfill/global" preserve="true" />
 // TzContext — the type contract for ctx.tz (pure types; the factory lives in
 // @cosmicdrift/kumiko-framework, time/tz-context.ts).
 //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.353.0",
+  "version": "0.354.1",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -276,7 +276,7 @@
   },
   "peerDependencies": {
     "hono": "^4.13.1",
-    "postgres": "npm:@bender0oo0/postgres@3.4.9-kumiko.1",
+    "postgres": "^3.4.9-0",
     "temporal-polyfill": "^0.3.2",
     "zod": "^4.4.3",
     "ioredis": "^5.10.1"