@cosmicdrift/kumiko-bundled-features 0.332.0 → 0.334.0

package/dist/tenant/index.d.ts

@@ -1,6 +1,6 @@
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries } from "./constants.js";
-export { createTenantFeature } from "./feature.js";
+export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export type { InvitationStatus } from "./invitation-table.js";
 export { INVITATION_STATUS, INVITATION_STATUSES, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";
 export { isTenantServingPublicContent } from "./is-tenant-serving-public-content.js";

package/dist/tenant/index.js

@@ -1,6 +1,6 @@
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries } from "./constants.js";
-export { createTenantFeature } from "./feature.js";
+export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export { INVITATION_STATUS, INVITATION_STATUSES, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";
 export { isTenantServingPublicContent } from "./is-tenant-serving-public-content.js";
 export { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table.js";

package/dist/tenant/invitation-table.d.ts

@@ -17,6 +17,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -37,6 +38,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -65,7 +67,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
             readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -79,6 +81,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -116,6 +119,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -136,6 +140,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -164,7 +169,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
             readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -178,6 +183,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/tenant/membership-table.d.ts

@@ -9,6 +9,7 @@ export declare const tenantMembershipEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const tenantMembershipEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -51,6 +53,7 @@ export declare const tenantMembershipsTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -71,6 +74,7 @@ export declare const tenantMembershipsTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/tenant/schema/tenant.d.ts

@@ -11,6 +11,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -31,6 +32,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -63,7 +65,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
             readonly destroying?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -92,6 +94,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -159,6 +162,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -179,6 +183,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -211,7 +216,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
             readonly destroying?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -240,6 +245,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/tenant/screens.d.ts

@@ -1,9 +1,35 @@
-import { type EntityEditScreenDefinition, type EntityListScreenDefinition, type ScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type AssignableAppRoles, type EntityEditScreenDefinition, type EntityListScreenDefinition, type ScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export declare const tenantListScreen: EntityListScreenDefinition;
 export declare const tenantEditScreen: EntityEditScreenDefinition;
 export declare function createMembersScreen(options?: {
     readonly inviteScreen?: boolean;
 }): ScreenDefinition;
+export declare function createInviteCreateScreen(assignableAppRoles?: AssignableAppRoles): {
+    id: "invite-create";
+    type: "actionForm";
+    handler: "auth-email-password:write:invite-create";
+    fields: {
+        email: {
+            type: "text";
+            required: true;
+            format: "email";
+        };
+        role: {
+            type: "select";
+            options: string[];
+            required: true;
+        };
+    };
+    layout: {
+        sections: {
+            fields: string[];
+        }[];
+    };
+    submitLabel: string;
+    access: {
+        roles: readonly string[];
+    };
+};
 export declare const inviteCreateScreen: {
     id: "invite-create";
     type: "actionForm";
@@ -16,7 +42,7 @@ export declare const inviteCreateScreen: {
         };
         role: {
             type: "select";
-            options: readonly ["User", "Editor", "Admin"];
+            options: string[];
             required: true;
         };
     };
@@ -30,6 +56,36 @@ export declare const inviteCreateScreen: {
         roles: readonly string[];
     };
 };
+export declare function createMemberRolesEditScreen(assignableAppRoles?: AssignableAppRoles): {
+    id: "member-roles-edit";
+    type: "actionForm";
+    handler: "tenant:write:update-member-roles";
+    redirect: "members";
+    cancelTarget: "members";
+    fields: {
+        userId: {
+            type: "text";
+            required: true;
+        };
+        roles: {
+            type: "multiSelect";
+            options: string[];
+            required: true;
+        };
+    };
+    layout: {
+        sections: {
+            fields: (string | {
+                field: string;
+                readOnly: true;
+            })[];
+        }[];
+    };
+    submitLabel: string;
+    access: {
+        roles: readonly string[];
+    };
+};
 export declare const memberRolesEditScreen: {
     id: "member-roles-edit";
     type: "actionForm";
@@ -43,7 +99,7 @@ export declare const memberRolesEditScreen: {
         };
         roles: {
             type: "multiSelect";
-            options: readonly ["User", "Editor", "Admin", "TenantAdmin"];
+            options: string[];
             required: true;
         };
     };

package/dist/tenant/screens.js

@@ -1,5 +1,5 @@
 import { AuthHandlers } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/constants";
-import { access, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, i18nKey, isAssignableByRole, } from "@cosmicdrift/kumiko-framework/engine";
 import { DEFAULT_INVITE_ROLE_OPTIONS, INVITE_CREATE_SCREEN_ID, MEMBER_ROLES_CELL_COMPONENT, MEMBER_ROLES_EDIT_SCREEN_ID, MEMBER_STATUS_CELL_COMPONENT, MEMBERS_SCREEN_ID, OWNER_INVITE_ROLE_OPTIONS, TenantHandlers, TenantQueries, } from "./constants.js";
 // Cross-tenant SystemAdmin platform view of the tenants themselves. The tenant
 // feature runs with `r.systemScope()`, so the entityList returns every tenant.
@@ -138,38 +138,56 @@ export function createMembersScreen(options) {
 // only entry point is the drawer button on /members. Only registered by
 // feature.ts when `TenantFeatureOptions.inviteScreen` is set — see
 // createMembersScreen's doc comment above for why.
-export const inviteCreateScreen = {
-    id: INVITE_CREATE_SCREEN_ID,
-    type: "actionForm",
-    handler: AuthHandlers.inviteCreate,
-    fields: {
-        email: { type: "text", required: true, format: "email" },
-        role: { type: "select", options: DEFAULT_INVITE_ROLE_OPTIONS, required: true },
-    },
-    layout: {
-        sections: [{ fields: ["email", "role"] }],
-    },
-    submitLabel: i18nKey("tenant.members.invite.submit"),
-    access: { roles: access.admin },
-};
-export const memberRolesEditScreen = {
-    id: MEMBER_ROLES_EDIT_SCREEN_ID,
-    type: "actionForm",
-    handler: TenantHandlers.updateMemberRoles,
-    redirect: MEMBERS_SCREEN_ID,
-    cancelTarget: MEMBERS_SCREEN_ID,
-    fields: {
-        userId: { type: "text", required: true },
-        // Prefilled with the member's current roles, so the option list must be
-        // able to represent every assignable rank — DEFAULT_INVITE_ROLE_OPTIONS
-        // omits TenantAdmin and would silently strip it on submit. Escalation
-        // still stays server-side via findForbiddenRoleAssignment (update-member-roles.write.ts).
-        roles: { type: "multiSelect", options: OWNER_INVITE_ROLE_OPTIONS, required: true },
-    },
-    layout: {
-        // Prefill userId from rowAction; readOnly so the operator cannot retarget.
-        sections: [{ fields: [{ field: "userId", readOnly: true }, "roles"] }],
-    },
-    submitLabel: i18nKey("tenant.members.roles.edit.submit"),
-    access: { roles: access.admin },
-};
+export function createInviteCreateScreen(assignableAppRoles = new Map()) {
+    // Admin sees this screen too, so only app roles Admin may grant are offered (fw#2414).
+    const appRoleOptions = [...assignableAppRoles]
+        .filter(([, assignableFrom]) => isAssignableByRole(assignableFrom, "Admin"))
+        .map(([role]) => role);
+    return {
+        id: INVITE_CREATE_SCREEN_ID,
+        type: "actionForm",
+        handler: AuthHandlers.inviteCreate,
+        fields: {
+            email: { type: "text", required: true, format: "email" },
+            role: {
+                type: "select",
+                options: [...DEFAULT_INVITE_ROLE_OPTIONS, ...appRoleOptions],
+                required: true,
+            },
+        },
+        layout: {
+            sections: [{ fields: ["email", "role"] }],
+        },
+        submitLabel: i18nKey("tenant.members.invite.submit"),
+        access: { roles: access.admin },
+    };
+}
+export const inviteCreateScreen = createInviteCreateScreen();
+export function createMemberRolesEditScreen(assignableAppRoles = new Map()) {
+    return {
+        id: MEMBER_ROLES_EDIT_SCREEN_ID,
+        type: "actionForm",
+        handler: TenantHandlers.updateMemberRoles,
+        redirect: MEMBERS_SCREEN_ID,
+        cancelTarget: MEMBERS_SCREEN_ID,
+        fields: {
+            userId: { type: "text", required: true },
+            // Prefilled with the member's current roles, so the option list must be
+            // able to represent every assignable rank — DEFAULT_INVITE_ROLE_OPTIONS
+            // omits TenantAdmin and would silently strip it on submit. Escalation
+            // still stays server-side via findForbiddenRoleAssignment (update-member-roles.write.ts).
+            roles: {
+                type: "multiSelect",
+                options: [...OWNER_INVITE_ROLE_OPTIONS, ...assignableAppRoles.keys()],
+                required: true,
+            },
+        },
+        layout: {
+            // Prefill userId from rowAction; readOnly so the operator cannot retarget.
+            sections: [{ fields: [{ field: "userId", readOnly: true }, "roles"] }],
+        },
+        submitLabel: i18nKey("tenant.members.roles.edit.submit"),
+        access: { roles: access.admin },
+    };
+}
+export const memberRolesEditScreen = createMemberRolesEditScreen();

package/dist/tenant-settings/feature.js

@@ -21,21 +21,24 @@ export function createTenantSettingsFeature(opts = {}) {
         r.config({ keys: buildTenantSettingsKeys(opts) });
         r.translations({
             keys: {
-                "tenant-settings.currency": { en: "Default Currency" },
-                "tenant-settings.locale": { en: "Default Locale" },
+                "tenant-settings.currency": { en: "Default currency" },
+                "tenant-settings.locale": { en: "Default locale" },
                 // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
                 // required by the i18n boot-validator whenever a feature masks config keys.
-                "screen:tenant-settings-system.title": { en: "Tenant Settings" },
-                "screen:tenant-settings-tenant.title": { en: "Tenant Settings" },
+                "screen:tenant-settings-system.title": { en: "Tenant defaults" },
+                "screen:tenant-settings-tenant.title": { en: "Tenant settings" },
                 // Settings-Hub nav label + configEdit section heading (same key, both
                 // scopes fall back here — see buildConfigFeatureSchema).
-                "tenant-settings.settings": { en: "Tenant Settings" },
+                "tenant-settings.settings": { en: "Tenant settings" },
+                // Section heading below the page title (the page title is the same words as
+                // `.settings`, which RenderEdit would drop as a repeat).
+                "tenant-settings.settings.section": { en: "Currency and language" },
                 // Both currency/locale are tenant-home with admin write access, which
                 // cascades a SystemAdmin-only "set the platform default" screen up to
                 // the system audience — scoped override so its nav entry reads
                 // differently from the tenant-home entry instead of repeating the
                 // same words under both "Platform" and "Organization".
-                "tenant-settings.settings.system": { en: "Tenant Settings (Platform Default)" },
+                "tenant-settings.settings.system": { en: "Tenant defaults" },
             },
         });
     });

package/dist/tier-engine/entity.d.ts

@@ -9,6 +9,7 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/tier-engine/tier-resolver.d.ts

@@ -17,6 +17,7 @@ export declare function createTierResolver<TTier extends string, TCaps>(deps: Ti
             readonly filterable?: boolean;
             readonly encrypted?: boolean;
             readonly sensitive?: boolean;
+            readonly writeOnly?: boolean;
             readonly readAsInstruction?: boolean;
             readonly format?: "email" | "url" | "phone" | "password";
             readonly default?: string;
@@ -37,6 +38,7 @@ export declare function createTierResolver<TTier extends string, TCaps>(deps: Ti
             readonly filterable?: boolean;
             readonly encrypted?: boolean;
             readonly sensitive?: boolean;
+            readonly writeOnly?: boolean;
             readonly readAsInstruction?: boolean;
             readonly format?: "email" | "url" | "phone" | "password";
             readonly default?: string;

package/dist/user/schema/user.d.ts

@@ -38,6 +38,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -58,6 +59,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -78,6 +80,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -98,6 +101,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -127,6 +131,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -159,7 +164,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
             readonly restricted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -188,6 +193,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -210,6 +216,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -230,6 +237,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -250,6 +258,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -270,6 +279,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -299,6 +309,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -331,7 +342,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
             readonly restricted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -360,6 +371,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/user-data-rights/run-user-export.js

@@ -22,7 +22,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "@cosmicdrift/kumiko-framework/crypto";
 import { collectEncryptedFieldNames, configuredEntityFieldEncryption, createTenantDb, decryptEntityFieldValues, } from "@cosmicdrift/kumiko-framework/db";
-import { EXT_USER_DATA, extensionUsageEscapeHatchReason, } from "@cosmicdrift/kumiko-framework/engine";
+import { EXT_USER_DATA, extensionUsageEscapeHatchReason, maskWriteOnlyFields, } from "@cosmicdrift/kumiko-framework/engine";
 import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
 import { tenantMembershipsTable } from "../tenant/index.js";
 import { buildFileRefZipPath } from "./zip-path.js";
@@ -214,7 +214,11 @@ async function decryptSnippetFields(registry, hookEntityName, snippet) {
     const entity = registry.getEntity(snippet.entity) ?? registry.getEntity(hookEntityName);
     const encryptedFields = entity ? collectEncryptedFieldNames(entity) : new Set();
     const kms = configuredPiiSubjectKms();
-    const rows = await decryptRecords(snippet.rows, encryptedFields, kms);
+    const decryptedRows = await decryptRecords(snippet.rows, encryptedFields, kms);
+    // Decrypting would otherwise hand writeOnly secrets out as plaintext.
+    const rows = entity
+        ? decryptedRows.map((row) => maskWriteOnlyFields(entity, row))
+        : decryptedRows;
     if (!snippet.fileRefs || snippet.fileRefs.length === 0) {
         return { ...snippet, rows };
     }