@cosmicdrift/kumiko-bundled-features 0.217.0 → 0.219.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.217.0",
+  "version": "0.219.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.217.0",
-    "@cosmicdrift/kumiko-framework": "0.217.0",
-    "@cosmicdrift/kumiko-headless": "0.217.0",
-    "@cosmicdrift/kumiko-renderer": "0.217.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.217.0",
-    "@cosmicdrift/kumiko-types": "0.217.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.219.0",
+    "@cosmicdrift/kumiko-framework": "0.219.0",
+    "@cosmicdrift/kumiko-headless": "0.219.0",
+    "@cosmicdrift/kumiko-renderer": "0.219.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.219.0",
+    "@cosmicdrift/kumiko-types": "0.219.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,7 +160,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.217.0",
-    "@cosmicdrift/kumiko-locale-es": "0.217.0"
+    "@cosmicdrift/kumiko-locale-de": "0.219.0",
+    "@cosmicdrift/kumiko-locale-es": "0.219.0"
   }
 }

package/src/auth-email-password/__tests__/signup-flow.integration.test.ts

@@ -275,7 +275,7 @@ describe("POST /api/auth/signup-confirm", () => {
     expect(body.token).toBeTruthy();
     expect(body.user?.id).toBeTruthy();
     expect(body.user?.tenantId).toBeTruthy();
-    expect(body.user?.roles).toContain("Admin");
+    expect(body.user?.roles).toContain("TenantAdmin");
     expect(body.tenantKey).toBeTruthy();
 
     // Cookies gesetzt (auth + csrf)
@@ -299,7 +299,7 @@ describe("POST /api/auth/signup-confirm", () => {
     expect(memberships).toHaveLength(1);
     const rolesRaw = memberships[0]?.["roles"];
     if (typeof rolesRaw === "string") {
-      expect(JSON.parse(rolesRaw) as string[]).toContain("Admin");
+      expect(JSON.parse(rolesRaw) as string[]).toContain("TenantAdmin");
     }
 
     // #1463 regression: seedTenant fires the tenant entity's postSave

package/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.218.0",
+    "type": "improvement",
+    "title": "Self-signup provisions TenantAdmin on the new tenant",
+    "detail": "INITIAL_SIGNUP_ROLES is TenantAdmin (was Admin) so the first user on a new tenant can invite peers and manage memberships without elevation dead-ends."
+  },
   {
     "version": "0.165.1",
     "type": "breaking",
@@ -10,8 +16,8 @@
     "version": "0.167.1",
     "type": "improvement",
     "title": "accountLockout is reachable through runProdApp/runDevApp (fw#1627).",
-    "detail": "accountLockout was an option on createAuthEmailPasswordFeature, but both wrappers mount auth-email-password themselves and their auth options only knew accountUnlock — an app on either entrypoint had no way to turn brute-force protection on. RunProdAppAuthOptions and RunDevAppAuthOptions now carry accountLockout and composeFeatures passes it through.",
-    "migration": "Opt-in, nothing breaks without it. Two things to know before relying on it: without ctx.redis the lockout is silently skipped in login.write.ts — no error, no warning, no protection — so treat Redis as a deploy invariant, and prove the lockout with a behavioural test instead of assuming the mount is enough."
+    "detail": "accountLockout was an option on createAuthEmailPasswordFeature, but both wrappers mount auth-email-password themselves and their auth options only knew accountUnlock \u2014 an app on either entrypoint had no way to turn brute-force protection on. RunProdAppAuthOptions and RunDevAppAuthOptions now carry accountLockout and composeFeatures passes it through.",
+    "migration": "Opt-in, nothing breaks without it. Two things to know before relying on it: without ctx.redis the lockout is silently skipped in login.write.ts \u2014 no error, no warning, no protection \u2014 so treat Redis as a deploy invariant, and prove the lockout with a behavioural test instead of assuming the mount is enough."
   },
   {
     "version": "0.162.0",
@@ -22,19 +28,19 @@
   {
     "version": "0.154.1",
     "type": "fix",
-    "title": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled…",
-    "detail": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled-features/auth-email-password/web`. Every other auth screen (ForgotPasswordScreen, SignupScreen, ResetPasswordScreen, …) was already exported from the barrel with its props type; `LoginScreen` was missed. `makeAuthGate`'s second parameter is typed `LoginScreenProps`, so consumers passing a typed `loginScreenProps` override (e.g. `@cosmicdriftgamestudio/kumiko-designer`) couldn't import the type at all. - @cosmicdrift/kumiko-framework@0.154.1 - @cosmicdrift/kumiko-dispatcher-live@0.154.1 - @cosmicdrift/kumiko-headless@0.154.1 - @cosmicdrift/kumiko-renderer@0.154.1 - @cosmicdrift/kumiko-renderer-web@0.154.1"
+    "title": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled\u2026",
+    "detail": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled-features/auth-email-password/web`. Every other auth screen (ForgotPasswordScreen, SignupScreen, ResetPasswordScreen, \u2026) was already exported from the barrel with its props type; `LoginScreen` was missed. `makeAuthGate`'s second parameter is typed `LoginScreenProps`, so consumers passing a typed `loginScreenProps` override (e.g. `@cosmicdriftgamestudio/kumiko-designer`) couldn't import the type at all. - @cosmicdrift/kumiko-framework@0.154.1 - @cosmicdrift/kumiko-dispatcher-live@0.154.1 - @cosmicdrift/kumiko-headless@0.154.1 - @cosmicdrift/kumiko-renderer@0.154.1 - @cosmicdrift/kumiko-renderer-web@0.154.1"
   },
   {
     "version": "0.151.0",
     "type": "improvement",
-    "title": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly — u…",
-    "detail": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly — use the new `createLoginRoute({ loginScreenProps, mfaVerifyScreen, unaffected (they already build on the same logic internally now). Why: a raw `<LoginScreen />` render has no MFA-challenge handling unless the caller remembers to hand-wire `onMfaChallenge` + swap in a verify screen itself — exactly how kumiko-framework#266's login-time MFA step went missing in a real app's standalone apex/marketing login route (it renders outside `emailPasswordClient`'s own gate, which already handled this correctly). `createLoginRoute` is the one place this logic lives now, for both the gated and standalone cases — there's no lower-level piece left to misuse. The `apex-surface-auth` recipe is updated to match."
+    "title": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly \u2014 u\u2026",
+    "detail": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly \u2014 use the new `createLoginRoute({ loginScreenProps, mfaVerifyScreen, unaffected (they already build on the same logic internally now). Why: a raw `<LoginScreen />` render has no MFA-challenge handling unless the caller remembers to hand-wire `onMfaChallenge` + swap in a verify screen itself \u2014 exactly how kumiko-framework#266's login-time MFA step went missing in a real app's standalone apex/marketing login route (it renders outside `emailPasswordClient`'s own gate, which already handled this correctly). `createLoginRoute` is the one place this logic lives now, for both the gated and standalone cases \u2014 there's no lower-level piece left to misuse. The `apex-surface-auth` recipe is updated to match."
   },
   {
     "version": "0.131.0",
     "type": "improvement",
-    "title": "App-Mounting 2.0 Säule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, Secti…",
-    "detail": "App-Mounting 2.0 Säule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, SectionCard, StatusBadge, ProgressBar, CollapsibleSection, DetailList, ModeSwitch, StatusBarChart, TimeseriesChart, EmptyState/LoadingState/ErrorState, QueryTable) + Status-Farb-Tokens (--color-status-\\*). Neue Hooks useMutation + useDisclosure. Neues Core-Primitive Link (default/button/muted), Button-Variant \"link\", Text-Variant \"muted\"; auth-email-password nutzt sie (authButtonClass/authMutedLinkClass entfernt)."
+    "title": "App-Mounting 2.0 S\u00e4ule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, Secti\u2026",
+    "detail": "App-Mounting 2.0 S\u00e4ule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, SectionCard, StatusBadge, ProgressBar, CollapsibleSection, DetailList, ModeSwitch, StatusBarChart, TimeseriesChart, EmptyState/LoadingState/ErrorState, QueryTable) + Status-Farb-Tokens (--color-status-\\*). Neue Hooks useMutation + useDisclosure. Neues Core-Primitive Link (default/button/muted), Button-Variant \"link\", Text-Variant \"muted\"; auth-email-password nutzt sie (authButtonClass/authMutedLinkClass entfernt)."
   }
 ]

package/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -1,7 +1,7 @@
 // Magic-Link-Signup, Step 2 (confirm).
 //
 // Token aus URL + Password vom User → wir lösen den Token in Redis ein
-// und legen Tenant + User + Admin-Membership atomar an. emailVerified
+// und legen Tenant + User + TenantAdmin membership atomically. emailVerified
 // wird sofort auf true gesetzt — der Magic-Link IST der Beweis.
 //
 // Pipeline:
@@ -141,7 +141,7 @@ export function createSignupConfirmHandler() {
 
         // SessionUser für JWT-Mint. Roles aus INITIAL_SIGNUP_ROLES
         // damit DB-write (provisionSignupAccount) und Session-claim
-        // dieselbe Quelle teilen — sonst hätten zwei Stellen "Admin"
+        // dieselbe Quelle teilen — sonst hätten zwei Stellen "TenantAdmin"
         // hardcoded und ein Refactor würde role-mismatch zwischen DB
         // und JWT erzeugen.
         const session: SessionUser = {

package/src/auth-email-password/seeding.ts

@@ -103,12 +103,12 @@ export async function seedUserWithPassword(
  *  minten (Account-Takeover, #365). `seedUser` selbst bleibt idempotent
  *  add-only (für Bootstrap/Tests); die create-only-Garantie sitzt hier.
  *  tenantKey-Kollisionen löst der Caller via generateUniqueName. */
-/** Default-Roles für den Self-Signup-Admin. Geteilt zwischen
+/** Default membership roles for self-signup tenant owners. Shared between
  *  provisionSignupAccount (DB-write) und signup-confirm-handler
  *  (SessionUser-Konstruktion für JWT-Mint) — sonst hätten zwei
- *  Stellen unabhängig "Admin" hardcoded und würden bei einem
+ *  Stellen unabhängig "TenantAdmin" hardcoded und würden bei einem
  *  Refactor zu role-mismatch zwischen DB und Session leiden. */
-export const INITIAL_SIGNUP_ROLES = ["Admin"] as const;
+export const INITIAL_SIGNUP_ROLES = ["TenantAdmin"] as const;
 
 export type ProvisionSignupAccountOptions = {
   readonly email: string;

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -321,6 +321,19 @@ describe("privilege escalation via invite role", () => {
     expectErrorIncludes(err, "unassignable_membership_role");
   });
 
+  test("TenantAdmin can invite as TenantAdmin (same-rank owner invite)", async () => {
+    await stack.http.write(
+      AuthHandlers.inviteCreate,
+      { email: "co-owner@example.com", role: "TenantAdmin" },
+      tenantAdminA(),
+    );
+    const rows = await selectMany(stack.db, tenantInvitationsTable, {
+      email: "co-owner@example.com",
+    });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.["role"]).toBe("TenantAdmin");
+  });
+
   test("TenantAdmin cannot invite with unknown unranked role (elevation guard)", async () => {
     const err = await stack.http.writeErr(
       AuthHandlers.inviteCreate,

package/src/tenant/changes.json

@@ -1,33 +1,39 @@
 [
+  {
+    "version": "0.219.0",
+    "type": "improvement",
+    "title": "Invite/member-roles pickers include TenantAdmin",
+    "detail": "DEFAULT_INVITE_ROLE_OPTIONS adds TenantAdmin so SystemAdmin/TenantAdmin can invite owners. SystemAdmin stays global-only (user.roles), never a membership invite option."
+  },
   {
     "version": "0.209.0",
     "type": "improvement",
     "title": "tenant: single /members screen replaces the members-card/pending-card split (#2223)",
-    "detail": "New `tenant:query:team:list` handler merges active memberships and pending invitations into one projectionList screen (`membersScreen`), with a `status` facet, sortable/searchable columns, and a danger-styled `cancel-invitation` row action visible only on pending rows. `createTenantFeature({ inviteScreen: true })` additionally wires a drawer-hosted invite actionForm onto the toolbar (bound to auth-email-password's `invite-create` handler) — off by default, and only safe to enable once the app also configures `createAuthEmailPasswordFeature({ invite: {...} })`, since the boot validator rejects the actionForm's cross-feature handler QN otherwise. The old `members`/`invitations` query handlers and their custom `MembersScreen` component are unaffected and stay registered for existing callers; `updateMemberRoles` stays SystemAdmin-only and off this screen."
+    "detail": "New `tenant:query:team:list` handler merges active memberships and pending invitations into one projectionList screen (`membersScreen`), with a `status` facet, sortable/searchable columns, and a danger-styled `cancel-invitation` row action visible only on pending rows. `createTenantFeature({ inviteScreen: true })` additionally wires a drawer-hosted invite actionForm onto the toolbar (bound to auth-email-password's `invite-create` handler) \u2014 off by default, and only safe to enable once the app also configures `createAuthEmailPasswordFeature({ invite: {...} })`, since the boot validator rejects the actionForm's cross-feature handler QN otherwise. The old `members`/`invitations` query handlers and their custom `MembersScreen` component are unaffected and stay registered for existing callers; `updateMemberRoles` stays SystemAdmin-only and off this screen."
   },
   {
     "version": "0.165.0",
     "type": "fix",
     "title": "resolveRawDb: removed redundant null check",
-    "detail": "CodeQL flagged db !== null after if (!db) — truthiness already excludes null. Internal cleanup, no API break."
+    "detail": "CodeQL flagged db !== null after if (!db) \u2014 truthiness already excludes null. Internal cleanup, no API break."
   },
   {
     "version": "0.165.0",
     "type": "fix",
     "title": "Seed hook: explicit SessionUser typing",
-    "detail": "Fixed tenant seeding type annotation — prevents implicit any propagation in seed handlers."
+    "detail": "Fixed tenant seeding type annotation \u2014 prevents implicit any propagation in seed handlers."
   },
   {
     "version": "0.165.0",
     "type": "fix",
     "title": "Seed afterCommit + real tenant rescope",
-    "detail": "ScheduleAfterCommit now available on HandlerContext — fireEntityPostSave queues after TX commit instead of mid-transaction. DB/notify/hasFeature/_tenantId are correctly rescoped when targeting an entity's tenant.",
-    "migration": "Only affects custom seed handlers using fireEntityPostSave — now afterCommit-compatible."
+    "detail": "ScheduleAfterCommit now available on HandlerContext \u2014 fireEntityPostSave queues after TX commit instead of mid-transaction. DB/notify/hasFeature/_tenantId are correctly rescoped when targeting an entity's tenant.",
+    "migration": "Only affects custom seed handlers using fireEntityPostSave \u2014 now afterCommit-compatible."
   },
   {
     "version": "0.163.0",
     "type": "improvement",
     "title": "tenant: seedTenant fires entity postSave hooks (#1463).",
-    "detail": "tenant: seedTenant fires entity postSave hooks (#1463). `seedTenant` writes through the raw event-store executor, which never fired postSave hooks — self-signup (`provisionSignupAccount` → `signup-confirm`) silently skipped feature-registered entity hooks like tier-engine's auto-default-tier and app-level auto-default-compliance, leaving new tenants without a tier/compliance row. `seedTenant` and `provisionSignupAccount` take a new optional `hooks: { registry, context }` param; passing it fires the same entity-scoped postSave hooks the dispatcher would, without the full dispatch roundtrip. Existing call-sites are unaffected — the param is optional and append-only."
+    "detail": "tenant: seedTenant fires entity postSave hooks (#1463). `seedTenant` writes through the raw event-store executor, which never fired postSave hooks \u2014 self-signup (`provisionSignupAccount` \u2192 `signup-confirm`) silently skipped feature-registered entity hooks like tier-engine's auto-default-tier and app-level auto-default-compliance, leaving new tenants without a tier/compliance row. `seedTenant` and `provisionSignupAccount` take a new optional `hooks: { registry, context }` param; passing it fires the same entity-scoped postSave hooks the dispatcher would, without the full dispatch roundtrip. Existing call-sites are unaffected \u2014 the param is optional and append-only."
   }
 ]

package/src/tenant/constants.ts

@@ -23,7 +23,7 @@ export const MEMBER_STATUS_CELL_COMPONENT = "MemberStatusCell" as const;
 export const MEMBER_ROLES_CELL_COMPONENT = "MemberRolesCell" as const;
 
 /** Closed allowlist for invite-role picker — never free text (escalation guard). */
-export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Admin", "Editor"] as const;
+export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin", "TenantAdmin"] as const;
 
 // Qualified write handler names (QN format: scope:type:name)
 export const TenantHandlers = {

package/src/tenant/i18n.ts

@@ -28,11 +28,13 @@ export const TENANT_I18N: Readonly<Record<string, LocalizedString>> = {
   "tenant:entity:__action-form__:field:role": { en: "Role" },
   "tenant:entity:__action-form__:field:role:option:User": { en: "User" },
   "tenant:entity:__action-form__:field:role:option:Admin": { en: "Admin" },
+  "tenant:entity:__action-form__:field:role:option:TenantAdmin": { en: "TenantAdmin" },
   "tenant:entity:__action-form__:field:role:option:Editor": { en: "Editor" },
   "tenant:entity:__action-form__:field:userId": { en: "User ID" },
   "tenant:entity:__action-form__:field:roles": { en: "Roles" },
   "tenant:entity:__action-form__:field:roles:option:User": { en: "User" },
   "tenant:entity:__action-form__:field:roles:option:Admin": { en: "Admin" },
+  "tenant:entity:__action-form__:field:roles:option:TenantAdmin": { en: "TenantAdmin" },
   "tenant:entity:__action-form__:field:roles:option:Editor": { en: "Editor" },
   "tenant:entity:tenant:field:key": { en: "Key" },
   "tenant:entity:tenant:field:name": { en: "Name" },

package/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.218.0",
+    "type": "fix",
+    "title": "user-list: system-scope search; membership roles on tenants; emailVerified sort",
+    "detail": "systemScope entityList search uses SYSTEM_TENANT_ID (was session tenant → Meili miss/500). Tenants column shows membership roles (Offlot Demo (TenantAdmin)). emailVerified sortable; email also searchable for roster lookup. Global roles stay SystemAdmin-only — TenantAdmin/Admin live on membership (Team → Members)."
+  },
   {
     "version": "0.217.0",
     "type": "improvement",

package/src/user/handlers/list.query.ts

@@ -5,6 +5,7 @@ import {
   defineEntityListHandler,
   type HandlerContext,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 // kumiko-lint-ignore cross-feature-import SystemAdmin user-list joins memberships for tenants column
 import { tenantMembershipsTable, tenantTable } from "../../tenant";
 import { userEntity } from "../schema/user";
@@ -13,7 +14,7 @@ const baseList = defineEntityListHandler("user", userEntity, {
   access: { roles: access.systemAdmin },
 });
 
-type MembershipRow = { userId: unknown; tenantId: unknown };
+type MembershipRow = { userId: unknown; tenantId: unknown; roles?: unknown };
 type TenantRow = { id: unknown; name?: unknown; key?: unknown };
 
 function isMissingRelation(err: unknown): boolean {
@@ -30,7 +31,6 @@ async function loadMemberships(
       userId: { in: [...userIds] },
     });
   } catch (err) {
-    // User-only test stacks (and mid-migration DBs) may lack membership tables.
     if (isMissingRelation(err)) return null;
     throw err;
   }
@@ -46,6 +46,12 @@ function tenantLabelById(tenants: readonly TenantRow[]): Map<string, string> {
   return map;
 }
 
+/** "Offlot Demo (TenantAdmin)" — membership roles live here, not on user.roles. */
+function membershipLabel(tenantLabel: string, membershipRoles: readonly string[]): string {
+  if (membershipRoles.length === 0) return tenantLabel;
+  return `${tenantLabel} (${membershipRoles.join("+")})`;
+}
+
 function labelsByUserId(
   memberships: readonly MembershipRow[],
   labelByTenantId: Map<string, string>,
@@ -55,7 +61,8 @@ function labelsByUserId(
     const userId = String(m.userId ?? "");
     const tenantId = String(m.tenantId ?? "");
     if (userId === "" || tenantId === "") continue;
-    const label = labelByTenantId.get(tenantId) ?? tenantId;
+    const tenantLabel = labelByTenantId.get(tenantId) ?? tenantId;
+    const label = membershipLabel(tenantLabel, parseRoles(m.roles ?? null));
     const list = map.get(userId) ?? [];
     list.push(label);
     map.set(userId, list);

package/src/user/i18n.ts

@@ -5,8 +5,14 @@ export const USER_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:user-edit.title": { en: "Edit user" },
   "user:entity:user:field:email": { en: "Email" },
   "user:entity:user:field:displayName": { en: "Display name" },
-  "user:entity:user:field:roles": { en: "Roles" },
+  "user:entity:user:field:roles": { en: "Platform roles" },
   "user:entity:user:field:tenants": { en: "Tenants" },
+  "user:entity:user:field:tenants:description": {
+    en: "Membership tenants with roles, e.g. Offlot Demo (TenantAdmin). Edit under Team → Members.",
+  },
+  "user:entity:user:field:roles:description": {
+    en: "Global platform roles only (SystemAdmin). TenantAdmin/Admin are membership roles under Team → Members.",
+  },
   "user:entity:user:field:roles:option:SystemAdmin": { en: "SystemAdmin" },
   "user:entity:user:field:status": { en: "Status" },
   "user:entity:user:field:emailVerified": { en: "Email verified" },

package/src/user/schema/user.ts

@@ -72,6 +72,8 @@ export const userEntity = createEntity({
       maxLength: 320,
       personal: "self",
       find: "exact",
+      // Roster search needs email hits; find:"exact" alone is blind-index only.
+      searchable: true,
       access: { write: access.privileged },
     }),
 
@@ -112,6 +114,7 @@ export const userEntity = createEntity({
     // refuse a session while this is false (strict mode).
     emailVerified: createBooleanField({
       default: false,
+      sortable: true,
       access: { write: access.privileged },
     }),
 

package/src/user/screens.ts

@@ -27,7 +27,8 @@ export const userListScreen: EntityListScreenDefinition = {
     },
   ],
   defaultSort: { field: "status", dir: "asc" },
-  // ponytail: screen searchable but email is encrypted PII — list search uses non-encrypted columns only.
+  // Search uses SYSTEM_TENANT_ID for systemScope lists (see event-store-executor-read).
+  // Apps must boot a user search index on that tenant (offlot: bootWaitlistSearch).
   searchable: true,
   access: { roles: ["SystemAdmin"] },
 };