@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.334.0

package/dist/tenant/schema/tenant.d.ts

@@ -11,6 +11,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -31,6 +32,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -63,7 +65,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
             readonly destroying?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -92,6 +94,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -159,6 +162,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -179,6 +183,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -211,7 +216,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
             readonly destroying?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -240,6 +245,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/tenant-settings/feature.js

@@ -21,21 +21,24 @@ export function createTenantSettingsFeature(opts = {}) {
         r.config({ keys: buildTenantSettingsKeys(opts) });
         r.translations({
             keys: {
-                "tenant-settings.currency": { en: "Default Currency" },
-                "tenant-settings.locale": { en: "Default Locale" },
+                "tenant-settings.currency": { en: "Default currency" },
+                "tenant-settings.locale": { en: "Default locale" },
                 // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
                 // required by the i18n boot-validator whenever a feature masks config keys.
-                "screen:tenant-settings-system.title": { en: "Tenant Settings" },
-                "screen:tenant-settings-tenant.title": { en: "Tenant Settings" },
+                "screen:tenant-settings-system.title": { en: "Tenant defaults" },
+                "screen:tenant-settings-tenant.title": { en: "Tenant settings" },
                 // Settings-Hub nav label + configEdit section heading (same key, both
                 // scopes fall back here — see buildConfigFeatureSchema).
-                "tenant-settings.settings": { en: "Tenant Settings" },
+                "tenant-settings.settings": { en: "Tenant settings" },
+                // Section heading below the page title (the page title is the same words as
+                // `.settings`, which RenderEdit would drop as a repeat).
+                "tenant-settings.settings.section": { en: "Currency and language" },
                 // Both currency/locale are tenant-home with admin write access, which
                 // cascades a SystemAdmin-only "set the platform default" screen up to
                 // the system audience — scoped override so its nav entry reads
                 // differently from the tenant-home entry instead of repeating the
                 // same words under both "Platform" and "Organization".
-                "tenant-settings.settings.system": { en: "Tenant Settings (Platform Default)" },
+                "tenant-settings.settings.system": { en: "Tenant defaults" },
             },
         });
     });

package/dist/tier-engine/entity.d.ts

@@ -9,6 +9,7 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/tier-engine/tier-resolver.d.ts

@@ -17,6 +17,7 @@ export declare function createTierResolver<TTier extends string, TCaps>(deps: Ti
             readonly filterable?: boolean;
             readonly encrypted?: boolean;
             readonly sensitive?: boolean;
+            readonly writeOnly?: boolean;
             readonly readAsInstruction?: boolean;
             readonly format?: "email" | "url" | "phone" | "password";
             readonly default?: string;
@@ -37,6 +38,7 @@ export declare function createTierResolver<TTier extends string, TCaps>(deps: Ti
             readonly filterable?: boolean;
             readonly encrypted?: boolean;
             readonly sensitive?: boolean;
+            readonly writeOnly?: boolean;
             readonly readAsInstruction?: boolean;
             readonly format?: "email" | "url" | "phone" | "password";
             readonly default?: string;

package/dist/user/schema/user.d.ts

@@ -38,6 +38,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -58,6 +59,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -78,6 +80,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -98,6 +101,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -127,6 +131,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -159,7 +164,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
             readonly restricted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -188,6 +193,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -210,6 +216,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -230,6 +237,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -250,6 +258,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -270,6 +279,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -299,6 +309,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -331,7 +342,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
             readonly restricted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -360,6 +371,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/user-data-rights/run-user-export.js

@@ -22,7 +22,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "@cosmicdrift/kumiko-framework/crypto";
 import { collectEncryptedFieldNames, configuredEntityFieldEncryption, createTenantDb, decryptEntityFieldValues, } from "@cosmicdrift/kumiko-framework/db";
-import { EXT_USER_DATA, extensionUsageEscapeHatchReason, } from "@cosmicdrift/kumiko-framework/engine";
+import { EXT_USER_DATA, extensionUsageEscapeHatchReason, maskWriteOnlyFields, } from "@cosmicdrift/kumiko-framework/engine";
 import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
 import { tenantMembershipsTable } from "../tenant/index.js";
 import { buildFileRefZipPath } from "./zip-path.js";
@@ -214,7 +214,11 @@ async function decryptSnippetFields(registry, hookEntityName, snippet) {
     const entity = registry.getEntity(snippet.entity) ?? registry.getEntity(hookEntityName);
     const encryptedFields = entity ? collectEncryptedFieldNames(entity) : new Set();
     const kms = configuredPiiSubjectKms();
-    const rows = await decryptRecords(snippet.rows, encryptedFields, kms);
+    const decryptedRows = await decryptRecords(snippet.rows, encryptedFields, kms);
+    // Decrypting would otherwise hand writeOnly secrets out as plaintext.
+    const rows = entity
+        ? decryptedRows.map((row) => maskWriteOnlyFields(entity, row))
+        : decryptedRows;
     if (!snippet.fileRefs || snippet.fileRefs.length === 0) {
         return { ...snippet, rows };
     }

package/dist/user-data-rights/schema/download-attempt.d.ts

@@ -9,6 +9,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -49,6 +51,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -69,6 +72,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -89,6 +93,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -109,6 +114,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -129,6 +135,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -166,6 +173,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -186,6 +194,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -206,6 +215,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -226,6 +236,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -246,6 +257,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -266,6 +278,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -286,6 +299,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/user-data-rights/schema/download-token.d.ts

@@ -9,6 +9,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -106,6 +108,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -126,6 +129,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -148,6 +152,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -168,6 +173,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -245,6 +251,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -265,6 +272,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/user-data-rights/schema/export-job.d.ts

@@ -23,6 +23,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -43,6 +44,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -71,7 +73,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
             readonly running?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -130,6 +132,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -195,6 +198,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -215,6 +219,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -243,7 +248,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
             readonly running?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -302,6 +307,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.333.0",
+  "version": "0.334.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -483,12 +483,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.333.0",
-    "@cosmicdrift/kumiko-framework": "0.333.0",
-    "@cosmicdrift/kumiko-headless": "0.333.0",
-    "@cosmicdrift/kumiko-renderer": "0.333.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.333.0",
-    "@cosmicdrift/kumiko-types": "0.333.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.334.0",
+    "@cosmicdrift/kumiko-framework": "0.334.0",
+    "@cosmicdrift/kumiko-headless": "0.334.0",
+    "@cosmicdrift/kumiko-renderer": "0.334.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.334.0",
+    "@cosmicdrift/kumiko-types": "0.334.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -983,8 +983,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.333.0",
-    "@cosmicdrift/kumiko-locale-es": "0.333.0",
+    "@cosmicdrift/kumiko-locale-de": "0.334.0",
+    "@cosmicdrift/kumiko-locale-es": "0.334.0",
     "jsqr": "^1.4.0"
   }
 }