@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/template-resolver/user-content-table.d.ts

@@ -1,3 +1,4 @@
+import type { EntityAuditColumns } from "./table.js";
 export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
     ownerId: {
         readonly type: "text";
@@ -9,6 +10,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +31,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -59,7 +62,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
             readonly "text-block"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -73,6 +76,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -93,6 +97,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -113,6 +118,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -157,7 +163,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
             readonly plain?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -173,6 +179,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -193,6 +200,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -223,7 +231,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
             readonly "text-block"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -237,6 +245,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -257,6 +266,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -277,6 +287,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -321,7 +332,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
             readonly plain?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -338,8 +349,4 @@ export type UserContentEntryRow = {
     readonly folder: string | null;
     readonly content: string | null;
     readonly contentFormat: string;
-    readonly createdAt: Date;
-    readonly updatedAt: Date;
-    readonly createdBy: string;
-    readonly updatedBy: string;
-};
+} & EntityAuditColumns;

package/dist/template-resolver/web/client-plugin.d.ts

@@ -6,7 +6,7 @@ export type BlockSummary = {
     readonly title: string | null;
     readonly content: string | null;
     readonly folder: string | null;
-    readonly updatedAt: string;
+    readonly modifiedAt: string | null;
 };
 export declare function groupBlocksByFolder(blocks: readonly BlockSummary[], tenantIdOverride?: string, collectionId?: string): readonly TreeNode[];
 export declare function textBlocksClient(opts?: {

package/dist/template-resolver-user-data/hooks.js

@@ -21,7 +21,7 @@ export const userContentExportHook = async (ctx) => {
             title: r["title"],
             content: r["content"],
             folder: r["folder"],
-            updatedAt: String(r["updatedAt"] ?? ""),
+            modifiedAt: String(r["modifiedAt"] ?? ""),
         })),
     };
 };

package/dist/tenant/cancel-pending-invitation.d.ts

@@ -0,0 +1,8 @@
+import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { Redis } from "ioredis";
+export declare function cancelPendingInvitation(db: TenantDb, invitation: {
+    readonly id: string;
+    readonly version: number;
+}, actor: SessionUser, redis: Redis | undefined): Promise<WriteFailure | undefined>;

package/dist/tenant/cancel-pending-invitation.js

@@ -0,0 +1,22 @@
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+// kumiko-lint-ignore cross-feature-import cancel needs invite-token-store for Redis cleanup
+import { invalidateExistingInviteToken } from "../auth-email-password/invite-token-store.js";
+import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";
+const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
+// Shared by cancel-invitation and remove-member so the cancel behavior
+// (status transition + token invalidation) cannot drift between them.
+export async function cancelPendingInvitation(db, invitation, actor, redis) {
+    const updateResult = await invitationExecutor.update({
+        id: invitation.id,
+        version: invitation.version,
+        changes: { status: INVITATION_STATUS.cancelled },
+    }, actor, db);
+    if (!updateResult.isSuccess)
+        return updateResult;
+    // Delete the token from Redis (if still there). If Redis is
+    // unavailable or the token already expired: not a problem, the DB
+    // row is the single source of truth for the UI.
+    if (redis)
+        await invalidateExistingInviteToken(redis, invitation.id);
+    return undefined;
+}

package/dist/tenant/feature.js

@@ -121,7 +121,8 @@ export function createTenantFeature(options) {
         // for existing callers). Cross-tenant because the feature is systemScope.
         r.queryHandler(defineEntityListHandler("tenant", tenantEntity, {
             access: { roles: ["SystemAdmin"] },
-            description: "Lists tenants under the entity-convention name the generated SystemAdmin tenant-list screen resolves; tenant:query:list is the hand-written equivalent.",
+            // Duplicate of tenant:query:list for agents.
+            agent: { expose: false },
         }));
         r.queryHandler(defineEntityDetailHandler("tenant", tenantEntity, {
             access: { roles: ["SystemAdmin"] },
@@ -129,7 +130,8 @@ export function createTenantFeature(options) {
         }));
         r.writeHandler(defineEntityUpdateHandler("tenant", tenantEntity, {
             access: { roles: ["SystemAdmin"] },
-            description: "Saves edits to a tenant's own fields under the entity-convention name the generated SystemAdmin tenant-edit screen resolves; tenant:write:update is the hand-written equivalent.",
+            // Duplicate of tenant:write:update with weaker logic.
+            agent: { expose: false },
         }));
         r.screen(tenantListScreen);
         r.screen(tenantEditScreen);

package/dist/tenant/handlers/cancel-invitation.write.js

@@ -10,19 +10,14 @@
 // invitation = no-op + 200. Cancelling a non-existent invitation
 // = invitation_not_found.
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-// kumiko-lint-ignore cross-feature-import cancel needs invite-token-store for Redis cleanup
-import { invalidateExistingInviteToken } from "../../auth-email-password/invite-token-store.js";
-import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../invitation-table.js";
+import { cancelPendingInvitation } from "../cancel-pending-invitation.js";
+import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table.js";
 const CancelInvitationSchema = z.object({
     invitationId: z.string(),
 });
-const executor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, {
-    entityName: "tenant-invitation",
-});
 export const cancelInvitationWrite = defineWriteHandler({
     name: "cancel-invitation",
     schema: CancelInvitationSchema,
@@ -51,20 +46,10 @@ export const cancelInvitationWrite = defineWriteHandler({
         if (invitation["status"] !== INVITATION_STATUS.pending) {
             return { isSuccess: true, data: { id: event.payload.invitationId, alreadyDone: true } };
         }
-        // Status update via event-store
-        const updateResult = await executor.update({
-            id: event.payload.invitationId,
-            version: invitation["version"], // @cast-boundary db-row
-            changes: { status: INVITATION_STATUS.cancelled },
-        }, event.user, db);
-        if (!updateResult.isSuccess)
-            return updateResult;
-        // Delete the token from Redis (if still there). If Redis is
-        // unavailable or the token already expired: not a problem, the DB
-        // row is the single source of truth for the UI.
-        if (ctx.redis) {
-            await invalidateExistingInviteToken(ctx.redis, event.payload.invitationId);
-        }
+        const cancelFailure = await cancelPendingInvitation(db, { id: event.payload.invitationId, version: invitation["version"] }, // @cast-boundary db-row
+        event.user, ctx.redis);
+        if (cancelFailure)
+            return cancelFailure;
         return { isSuccess: true, data: { id: event.payload.invitationId, alreadyDone: false } };
     },
 });

package/dist/tenant/handlers/member-directory.query.d.ts

@@ -1,6 +1,7 @@
 import * as z from "zod";
 export declare const memberDirectoryQuery: import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"memberDirectory", z.ZodObject<{
     limit: z.ZodDefault<z.ZodNumber>;
+    search: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, {
     id: string;
     label: string;

package/dist/tenant/handlers/member-directory.query.js

@@ -9,6 +9,10 @@ import { isSystemAdmin } from "./is-system-admin.js";
 // Shares the KMS adapter's small dedicated pool, same rationale as
 // members.query.ts.
 const KMS_POOL_CONCURRENCY = 4;
+// Display names are encrypted PII, so a search cannot run in SQL: candidates
+// are decrypted and filtered in memory. The cap keeps a SystemAdmin's global
+// search from decrypting every user.
+const SEARCH_SCAN_CAP = 1000;
 async function loadMemberUserIds(db, tenantId) {
     const memberships = await selectMany(db, tenantMembershipsTable, { tenantId });
     return [...new Set(memberships.map((row) => String(row["userId"])))];
@@ -29,6 +33,8 @@ export const memberDirectoryQuery = definePagedQueryHandler({
     name: "memberDirectory",
     schema: z.object({
         limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT),
+        // Sent by the reference combobox while the user types.
+        search: z.string().trim().min(1).optional(),
     }),
     access: { roles: access.admin },
     description: "Lists users as id/label pairs for resolving user references to display names: the caller's own tenant members for an admin, every user for a SystemAdmin; carries no email or role data.",
@@ -39,24 +45,31 @@ export const memberDirectoryQuery = definePagedQueryHandler({
                 message: "tenant:query:member-directory requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
             });
         }
-        const { limit } = query.payload;
+        const { limit, search } = query.payload;
+        // Without a search the first `limit` rows are enough; with one, every
+        // candidate must be decrypted before the limit can apply.
+        const scanLimit = search === undefined ? limit : SEARCH_SCAN_CAP;
         let users;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as user:query:user:list did");
-            users = await selectMany(db, userTable, undefined, { limit });
+            users = await selectMany(db, userTable, undefined, { limit: scanLimit });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-            const userIds = (await loadMemberUserIds(db, query.user.tenantId)).slice(0, limit);
+            const userIds = (await loadMemberUserIds(db, query.user.tenantId)).slice(0, scanLimit);
             users = userIds.length > 0 ? await selectMany(db, userTable, { id: [...userIds] }) : [];
         }
-        const rows = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
+        const resolved = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
             const id = String(user.id);
             const label = typeof user.displayName === "string"
                 ? await decryptStoredPii(user.displayName, "displayName", "tenant:member-directory")
                 : null;
             return { id, label: label ?? id };
         });
+        const needle = search?.toLowerCase();
+        const rows = needle === undefined
+            ? resolved
+            : resolved.filter((row) => row.label.toLowerCase().includes(needle)).slice(0, limit);
         return { rows, nextCursor: null };
     },
 });

package/dist/tenant/handlers/remove-member.write.js

@@ -4,17 +4,15 @@ import { createSystemUser, defineWriteHandler, withResponseData, } from "@cosmic
 import { InternalError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-// kumiko-lint-ignore cross-feature-import cancel needs invite-token-store for Redis cleanup
-import { invalidateExistingInviteToken } from "../../auth-email-password/invite-token-store.js";
 import { decryptStoredPii } from "../../shared/index.js";
 import { userTable } from "../../user/index.js";
-import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../invitation-table.js";
+import { cancelPendingInvitation } from "../cancel-pending-invitation.js";
+import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table.js";
 import { assertNotLastTenantAdmin } from "../last-tenant-admin.js";
 import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-table.js";
 const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembershipEntity, {
     entityName: "tenant-membership",
 });
-const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
 async function cancelPendingInvitationsOfUser(db, options) {
     const user = await fetchOne(db, userTable, { id: options.userId });
     if (!user?.email)
@@ -22,15 +20,9 @@ async function cancelPendingInvitationsOfUser(db, options) {
     const email = (await decryptStoredPii(user.email, "email", "tenant:remove-member")).toLowerCase();
     const pendingInvitations = await selectMany(db, tenantInvitationsTable, { tenantId: options.tenantId, email, status: INVITATION_STATUS.pending });
     for (const invitation of pendingInvitations) {
-        const updateResult = await invitationExecutor.update({
-            id: invitation.id,
-            version: invitation.version,
-            changes: { status: INVITATION_STATUS.cancelled },
-        }, options.actor, db);
-        if (!updateResult.isSuccess)
-            return updateResult;
-        if (options.redis)
-            await invalidateExistingInviteToken(options.redis, invitation.id);
+        const failure = await cancelPendingInvitation(db, invitation, options.actor, options.redis);
+        if (failure)
+            return failure;
     }
     return undefined;
 }
@@ -63,7 +55,10 @@ export const removeMemberWrite = defineWriteHandler({
         }
         const currentRoles = parseRoles(existing["roles"]);
         if (currentRoles.includes("TenantAdmin")) {
-            const lastAdmin = await assertNotLastTenantAdmin(db, event.payload.tenantId, event.payload.userId);
+            // assertNotLastTenantAdmin issues raw SQL, so it needs the raw runner, not
+            // the tenant-scoped `db` — the count is filtered by the explicit tenantId.
+            const lockRunner = ctx.systemDb.unsafeRaw("tenant:write:removeMember last-TenantAdmin advisory lock + membership count");
+            const lastAdmin = await assertNotLastTenantAdmin(lockRunner, event.payload.tenantId, event.payload.userId, "remove");
             if (lastAdmin !== undefined)
                 return lastAdmin;
         }

package/dist/tenant/handlers/team-list.query.js

@@ -130,7 +130,7 @@ export const teamListQuery = definePagedQueryHandler({
         const memberRows = membershipRows.map((row) => {
             const userId = String(row["userId"]);
             const decrypted = decryptedByUserId.get(userId);
-            const createdAt = row["createdAt"];
+            const createdAt = row["insertedAt"];
             return {
                 id: String(row["id"]),
                 userId,
@@ -153,7 +153,7 @@ export const teamListQuery = definePagedQueryHandler({
             const decryptedEmail = typeof email === "string"
                 ? await decryptStoredPii(email, "email", "tenant:team-list")
                 : null;
-            const createdAt = row["createdAt"];
+            const createdAt = row["insertedAt"];
             const expiresAt = row["expiresAt"];
             return {
                 id: String(row["id"]),

package/dist/tenant/handlers/tenant-directory.query.d.ts

@@ -1,6 +1,7 @@
 import * as z from "zod";
 export declare const tenantDirectoryQuery: import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"tenantDirectory", z.ZodObject<{
     limit: z.ZodDefault<z.ZodNumber>;
+    search: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, {
     id: string;
     label: string;

package/dist/tenant/handlers/tenant-directory.query.js

@@ -11,10 +11,15 @@ import { isSystemAdmin } from "./is-system-admin.js";
 // them; a TenantAdmin only ever sees their own tenant.
 // ponytail: capped at `limit` (200 list lookup, 50 combobox) like every
 // reference lookup; beyond that the cell falls back to the raw id.
+// A search filters in memory over a bounded scan so the combobox can reach
+// tenants beyond the first `limit`; the cap keeps it from reading every tenant.
+const SEARCH_SCAN_CAP = 1000;
 export const tenantDirectoryQuery = definePagedQueryHandler({
     name: "tenantDirectory",
     schema: z.object({
         limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT),
+        // Sent by the reference combobox while the user types.
+        search: z.string().trim().min(1).optional(),
     }),
     access: { roles: access.admin },
     description: "Lists tenants as id/label pairs for resolving tenant references to display names: the caller's own tenant for an admin, every tenant for a SystemAdmin.",
@@ -25,21 +30,26 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
                 message: "tenant:query:tenant-directory requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
             });
         }
-        const { limit } = query.payload;
+        const { limit, search } = query.payload;
+        const scanLimit = search === undefined ? limit : SEARCH_SCAN_CAP;
         let tenants;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as tenant:query:tenant:list did");
-            tenants = await selectMany(db, tenantTable, undefined, { limit });
+            tenants = await selectMany(db, tenantTable, undefined, { limit: scanLimit });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
             const row = await fetchOne(db, tenantTable, { id: query.user.tenantId });
             tenants = row ? [row] : [];
         }
-        const rows = tenants.map((tenant) => {
+        const labeled = tenants.map((tenant) => {
             const id = String(tenant.id);
             return { id, label: typeof tenant.name === "string" ? tenant.name : id };
         });
+        const needle = search?.toLowerCase();
+        const rows = needle === undefined
+            ? labeled
+            : labeled.filter((row) => row.label.toLowerCase().includes(needle)).slice(0, limit);
         return { rows, nextCursor: null };
     },
 });

package/dist/tenant/handlers/update-member-roles.write.d.ts

@@ -5,6 +5,6 @@ export declare const updateMemberRolesWrite: import("@cosmicdrift/kumiko-types/d
     roles: z.ZodArray<z.ZodString>;
 }, z.core.$strip>, {
     userId: string;
-    roles: string[];
+    roles: readonly string[];
     tenantId: string;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/tenant/handlers/update-member-roles.write.js

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { access, assignableAppRolesFromUsages, createSystemUser, defineWriteHandler, EXT_ASSIGNABLE_ROLE, findForbiddenRoleAssignment, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, assignableAppRolesOf, createSystemUser, defineWriteHandler, findForbiddenRoleAssignment, mergeAssignedRoles, SYSTEM_ROLE, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -19,6 +19,15 @@ const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user"
 function resolveTargetTenantId(isSystem, payloadTenantId, sessionTenantId) {
     return isSystem ? (payloadTenantId ?? sessionTenantId) : sessionTenantId;
 }
+// Editing your OWN roles keeps the current session: roles are re-derived per
+// request, so the new roles apply at once without a re-login. Other sessions
+// of that user and any foreign edit still revoke all.
+function revokeSessionsPayload(targetUserId, targetTenantId, actor) {
+    const payload = { userId: targetUserId, tenantId: targetTenantId };
+    if (targetUserId !== actor.id || actor.sid === undefined)
+        return payload;
+    return { ...payload, exceptSessionId: actor.sid };
+}
 export const updateMemberRolesWrite = defineWriteHandler({
     name: "updateMemberRoles",
     schema: z.object({
@@ -31,14 +40,16 @@ export const updateMemberRolesWrite = defineWriteHandler({
     // manage memberships cross-tenant (payload.tenantId). TenantAdmin and Admin
     // are session-scoped (event.user.tenantId).
     access: { roles: ["system", ...access.admin] },
-    description: "Replaces the roles a user holds in a tenant, rejecting reserved role names and any grant that would raise the target above the caller; admins act on their own tenant, SystemAdmins on any.",
+    description: "Sets the roles a user holds in a tenant, rejecting reserved role names and any grant that would raise the target above the caller; roles the caller could not grant (platform roles such as DataProtectionOfficer or TenantOwner, undeclared or higher-tier app roles) are kept, only the system user replaces the full list; admins act on their own tenant, SystemAdmins on any.",
     handler: async (event, ctx) => {
         if (!ctx.systemDb) {
             throw new InternalError({
                 message: "tenant:write:updateMemberRoles requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
             });
         }
-        const isSystem = event.user.roles.includes("SystemAdmin") || event.user.roles.includes("system");
+        const isSystemActor = event.user.roles.includes(SYSTEM_ROLE);
+        const isSystem = event.user.roles.includes("SystemAdmin") || isSystemActor;
+        const assignableAppRoles = assignableAppRolesOf(ctx.registry);
         const targetTenantId = resolveTargetTenantId(isSystem, event.payload.tenantId, event.user.tenantId);
         if (!targetTenantId) {
             return writeFailure(new ValidationError({
@@ -69,14 +80,18 @@ export const updateMemberRolesWrite = defineWriteHandler({
         }
         const row = existing; // @cast-boundary generic-record
         const currentTargetRoles = parseRoles(row["roles"]);
-        if (!event.user.roles.includes("system")) {
-            const forbiddenElevation = findForbiddenRoleAssignment(event.user.roles, event.payload.roles, currentTargetRoles, assignableAppRolesFromUsages(ctx.registry.getExtensionUsages(EXT_ASSIGNABLE_ROLE)));
+        if (!isSystemActor) {
+            const forbiddenElevation = findForbiddenRoleAssignment(event.user.roles, event.payload.roles, currentTargetRoles, assignableAppRoles);
             if (forbiddenElevation !== undefined) {
                 return writeFailure(unassignableMembershipRoleError(forbiddenElevation));
             }
         }
+        // The system user is programmatic and replaces; human actors keep what they cannot grant.
+        const nextRoles = isSystemActor
+            ? event.payload.roles
+            : mergeAssignedRoles(event.user.roles, event.payload.roles, currentTargetRoles, assignableAppRoles);
         const targetIsTenantAdmin = currentTargetRoles.includes("TenantAdmin");
-        const willBeTenantAdmin = event.payload.roles.includes("TenantAdmin");
+        const willBeTenantAdmin = nextRoles.includes("TenantAdmin");
         if (targetIsTenantAdmin && !willBeTenantAdmin) {
             // assertNotLastTenantAdmin issues raw SQL, so it needs the raw runner, not
             // `db` — the count is already filtered by the explicit targetTenantId.
@@ -99,10 +114,7 @@ export const updateMemberRolesWrite = defineWriteHandler({
         // requires, see above).
         const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
         if (revoker) {
-            await ctx.writeAs(createSystemUser(targetTenantId), REVOKE_ALL_SESSIONS_QN, {
-                userId: event.payload.userId,
-                tenantId: targetTenantId,
-            });
+            await ctx.writeAs(createSystemUser(targetTenantId), REVOKE_ALL_SESSIONS_QN, revokeSessionsPayload(event.payload.userId, targetTenantId, event.user));
         }
         // Stream tenant follows the actor via streamTenantFor — use the
         // membership tenant so SystemAdmin/cross-tenant and TenantAdmin paths
@@ -112,8 +124,12 @@ export const updateMemberRolesWrite = defineWriteHandler({
         const result = await executor.update({
             id: row["id"], // @cast-boundary db-row
             version: row["version"], // @cast-boundary db-row
-            changes: { roles: JSON.stringify(event.payload.roles) },
+            changes: { roles: JSON.stringify(nextRoles) },
         }, { ...event.user, tenantId: targetTenantId }, db);
-        return withResponseData(result, { ...event.payload, tenantId: targetTenantId });
+        return withResponseData(result, {
+            ...event.payload,
+            roles: nextRoles,
+            tenantId: targetTenantId,
+        });
     },
 });

package/dist/tenant/i18n.js

@@ -34,6 +34,10 @@ export const TENANT_I18N = {
     "tenant:entity:__action-form__:field:roles:option:Member": { en: "Member" },
     "tenant:entity:__action-form__:field:roles:option:Admin": { en: "Admin" },
     "tenant:entity:__action-form__:field:roles:option:TenantAdmin": { en: "Tenant Admin" },
+    "tenant:entity:__action-form__:field:roles:option:TenantOwner": { en: "Tenant Owner" },
+    "tenant:entity:__action-form__:field:roles:option:DataProtectionOfficer": {
+        en: "Data Protection Officer",
+    },
     "tenant:entity:__action-form__:field:roles:option:Editor": { en: "Editor" },
     "tenant:entity:tenant:field:key": { en: "Key" },
     "tenant:entity:tenant:field:name": { en: "Name" },

package/dist/tenant/index.d.ts

@@ -1,5 +1,5 @@
 export { TenantCommandSchemas } from "./command-schemas.js";
-export { TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries } from "./constants.js";
+export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export type { InvitationStatus } from "./invitation-table.js";
 export { INVITATION_STATUS, INVITATION_STATUSES, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";

package/dist/tenant/index.js

@@ -1,5 +1,5 @@
 export { TenantCommandSchemas } from "./command-schemas.js";
-export { TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries } from "./constants.js";
+export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export { INVITATION_STATUS, INVITATION_STATUSES, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";
 export { isTenantServingPublicContent } from "./is-tenant-serving-public-content.js";

package/dist/tenant/invitation-table.d.ts

@@ -17,6 +17,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -37,6 +38,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -65,7 +67,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
             readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -79,6 +81,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -116,6 +119,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -136,6 +140,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -164,7 +169,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
             readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -178,6 +183,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;