@cosmicdrift/kumiko-bundled-features 0.334.0 → 0.335.0

package/dist/template-resolver/seeding.js

@@ -64,6 +64,13 @@ export async function seedSystemTemplate(db, opts) {
         parentTemplateId,
         status: "active",
     };
+    const applyUpdate = async (row) => {
+        const result = await executor.update({ id: row.id, version: row.version, changes: rowFields }, by, tdb);
+        if (!result.isSuccess) {
+            throw new Error(`seedSystemTemplate update failed: ${JSON.stringify(result)}`);
+        }
+        return { id: String(row.id) };
+    };
     return runEventStoreSeed({
         existing,
         ifExists: opts.ifExists,
@@ -83,11 +90,13 @@ export async function seedSystemTemplate(db, opts) {
                     if (resolved == null) {
                         throw new Error(`seedSystemTemplate create unique_violation but row missing`);
                     }
-                    const upd = await executor.update({ id: resolved.id, version: resolved.version, changes: rowFields }, by, tdb);
-                    if (!upd.isSuccess) {
-                        throw new Error(`seedSystemTemplate race-update failed: ${JSON.stringify(upd)}`);
-                    }
-                    return { id: resolved.id };
+                    // Race loser goes through the same skip/update contract as a normal re-seed.
+                    return runEventStoreSeed({
+                        existing: resolved,
+                        ifExists: opts.ifExists,
+                        create: () => Promise.reject(new Error("seedSystemTemplate: unreachable create")),
+                        update: applyUpdate,
+                    });
                 }
                 throw new Error(`seedSystemTemplate create failed: ${JSON.stringify(result)}`);
             }
@@ -97,13 +106,7 @@ export async function seedSystemTemplate(db, opts) {
             }
             return { id: String(data.id) };
         },
-        update: async (row) => {
-            const result = await executor.update({ id: row.id, version: row.version, changes: rowFields }, by, tdb);
-            if (!result.isSuccess) {
-                throw new Error(`seedSystemTemplate update failed: ${JSON.stringify(result)}`);
-            }
-            return { id: String(row.id) };
-        },
+        update: applyUpdate,
     });
 }
 // Boot/test seed for kind=text-block. Same projection path as set.write,
@@ -132,6 +135,24 @@ export async function seedTextBlock(db, opts) {
         parentTemplateId: null,
         status: "active",
     };
+    const applyUpdate = async (row, current) => {
+        // Skip no-op updates so a legal re-seed on every pod boot does not bump
+        // version/modifiedAt (ETag, "last changed", event-store growth).
+        if (current?.title === fields.title &&
+            current?.content === fields.content &&
+            current?.folder === fields.folder) {
+            return { id: String(row.id) };
+        }
+        const result = await executor.update({
+            id: row.id,
+            version: row.version,
+            changes: { title: fields.title, content: fields.content, folder: fields.folder },
+        }, by, tdb);
+        if (!result.isSuccess) {
+            throw new Error(`seedTextBlock update failed: ${JSON.stringify(result)}`);
+        }
+        return { id: String(row.id) };
+    };
     return runEventStoreSeed({
         existing,
         ifExists: opts.ifExists,
@@ -149,15 +170,13 @@ export async function seedTextBlock(db, opts) {
                     if (resolved == null) {
                         throw new Error("seedTextBlock create unique_violation but row missing");
                     }
-                    const upd = await executor.update({
-                        id: resolved.id,
-                        version: resolved.version,
-                        changes: { title: fields.title, content: fields.content, folder: fields.folder },
-                    }, by, tdb);
-                    if (!upd.isSuccess) {
-                        throw new Error(`seedTextBlock race-update failed: ${JSON.stringify(upd)}`);
-                    }
-                    return { id: resolved.id };
+                    // Race loser goes through the same skip/no-op/update contract as a normal re-seed.
+                    return runEventStoreSeed({
+                        existing: resolved,
+                        ifExists: opts.ifExists,
+                        create: () => Promise.reject(new Error("seedTextBlock: unreachable create")),
+                        update: (row) => applyUpdate(row, again),
+                    });
                 }
                 throw new Error(`seedTextBlock create failed: ${JSON.stringify(result)}`);
             }
@@ -169,24 +188,7 @@ export async function seedTextBlock(db, opts) {
             }
             return { id: String(data.id) };
         },
-        update: async (row) => {
-            // Skip no-op updates so a legal re-seed on every pod boot does not bump
-            // version/updatedAt (ETag, "last changed", event-store growth).
-            if (existingRow?.title === fields.title &&
-                existingRow?.content === fields.content &&
-                existingRow?.folder === fields.folder) {
-                return { id: String(row.id) };
-            }
-            const result = await executor.update({
-                id: row.id,
-                version: row.version,
-                changes: { title: fields.title, content: fields.content, folder: fields.folder },
-            }, by, tdb);
-            if (!result.isSuccess) {
-                throw new Error(`seedTextBlock update failed: ${JSON.stringify(result)}`);
-            }
-            return { id: String(row.id) };
-        },
+        update: (row) => applyUpdate(row, existingRow),
     });
 }
 // Boot seed for legal/marketing copy from a JSON template. `ifExists: "update"`

package/dist/template-resolver/table.d.ts

@@ -1,3 +1,4 @@
+import type { Temporal } from "temporal-polyfill";
 export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
     slug: {
         readonly type: "text";
@@ -482,6 +483,12 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         required: true;
     };
 }, "tenant">>;
+export type EntityAuditColumns = {
+    readonly insertedAt: Temporal.Instant;
+    readonly modifiedAt: Temporal.Instant | null;
+    readonly insertedById: string | null;
+    readonly modifiedById: string | null;
+};
 export type TemplateResourceRow = {
     readonly id: string | number;
     readonly version: number;
@@ -498,8 +505,4 @@ export type TemplateResourceRow = {
     readonly scope: string;
     readonly parentTemplateId: string | null;
     readonly status: string;
-    readonly createdAt: Date;
-    readonly updatedAt: Date;
-    readonly createdBy: string;
-    readonly updatedBy: string;
-};
+} & EntityAuditColumns;

package/dist/template-resolver/testing.js

@@ -24,8 +24,8 @@ async function seedTemplate(db, args) {
         variableSchema: JSON.stringify(args.variableSchema ?? {}),
         linkedResources: JSON.stringify(args.linkedResources ?? {}),
         parentTemplateId: args.parentTemplateId ?? null,
-        createdBy: "conformance",
-        updatedBy: "conformance",
+        insertedById: "conformance",
+        modifiedById: "conformance",
     });
 }
 export async function assertConsumerHandlesNotFound(consumer, opts) {

package/dist/template-resolver/user-content-table.d.ts

@@ -1,3 +1,4 @@
+import type { EntityAuditColumns } from "./table.js";
 export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
     ownerId: {
         readonly type: "text";
@@ -348,8 +349,4 @@ export type UserContentEntryRow = {
     readonly folder: string | null;
     readonly content: string | null;
     readonly contentFormat: string;
-    readonly createdAt: Date;
-    readonly updatedAt: Date;
-    readonly createdBy: string;
-    readonly updatedBy: string;
-};
+} & EntityAuditColumns;

package/dist/template-resolver/web/client-plugin.d.ts

@@ -6,7 +6,7 @@ export type BlockSummary = {
     readonly title: string | null;
     readonly content: string | null;
     readonly folder: string | null;
-    readonly updatedAt: string;
+    readonly modifiedAt: string | null;
 };
 export declare function groupBlocksByFolder(blocks: readonly BlockSummary[], tenantIdOverride?: string, collectionId?: string): readonly TreeNode[];
 export declare function textBlocksClient(opts?: {

package/dist/template-resolver-user-data/hooks.js

@@ -21,7 +21,7 @@ export const userContentExportHook = async (ctx) => {
             title: r["title"],
             content: r["content"],
             folder: r["folder"],
-            updatedAt: String(r["updatedAt"] ?? ""),
+            modifiedAt: String(r["modifiedAt"] ?? ""),
         })),
     };
 };

package/dist/tenant/cancel-pending-invitation.d.ts

@@ -0,0 +1,8 @@
+import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { Redis } from "ioredis";
+export declare function cancelPendingInvitation(db: TenantDb, invitation: {
+    readonly id: string;
+    readonly version: number;
+}, actor: SessionUser, redis: Redis | undefined): Promise<WriteFailure | undefined>;

package/dist/tenant/cancel-pending-invitation.js

@@ -0,0 +1,22 @@
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+// kumiko-lint-ignore cross-feature-import cancel needs invite-token-store for Redis cleanup
+import { invalidateExistingInviteToken } from "../auth-email-password/invite-token-store.js";
+import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";
+const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
+// Shared by cancel-invitation and remove-member so the cancel behavior
+// (status transition + token invalidation) cannot drift between them.
+export async function cancelPendingInvitation(db, invitation, actor, redis) {
+    const updateResult = await invitationExecutor.update({
+        id: invitation.id,
+        version: invitation.version,
+        changes: { status: INVITATION_STATUS.cancelled },
+    }, actor, db);
+    if (!updateResult.isSuccess)
+        return updateResult;
+    // Delete the token from Redis (if still there). If Redis is
+    // unavailable or the token already expired: not a problem, the DB
+    // row is the single source of truth for the UI.
+    if (redis)
+        await invalidateExistingInviteToken(redis, invitation.id);
+    return undefined;
+}

package/dist/tenant/feature.js

@@ -121,7 +121,8 @@ export function createTenantFeature(options) {
         // for existing callers). Cross-tenant because the feature is systemScope.
         r.queryHandler(defineEntityListHandler("tenant", tenantEntity, {
             access: { roles: ["SystemAdmin"] },
-            description: "Lists tenants under the entity-convention name the generated SystemAdmin tenant-list screen resolves; tenant:query:list is the hand-written equivalent.",
+            // Duplicate of tenant:query:list for agents.
+            agent: { expose: false },
         }));
         r.queryHandler(defineEntityDetailHandler("tenant", tenantEntity, {
             access: { roles: ["SystemAdmin"] },
@@ -129,7 +130,8 @@ export function createTenantFeature(options) {
         }));
         r.writeHandler(defineEntityUpdateHandler("tenant", tenantEntity, {
             access: { roles: ["SystemAdmin"] },
-            description: "Saves edits to a tenant's own fields under the entity-convention name the generated SystemAdmin tenant-edit screen resolves; tenant:write:update is the hand-written equivalent.",
+            // Duplicate of tenant:write:update with weaker logic.
+            agent: { expose: false },
         }));
         r.screen(tenantListScreen);
         r.screen(tenantEditScreen);

package/dist/tenant/handlers/cancel-invitation.write.js

@@ -10,19 +10,14 @@
 // invitation = no-op + 200. Cancelling a non-existent invitation
 // = invitation_not_found.
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-// kumiko-lint-ignore cross-feature-import cancel needs invite-token-store for Redis cleanup
-import { invalidateExistingInviteToken } from "../../auth-email-password/invite-token-store.js";
-import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../invitation-table.js";
+import { cancelPendingInvitation } from "../cancel-pending-invitation.js";
+import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table.js";
 const CancelInvitationSchema = z.object({
     invitationId: z.string(),
 });
-const executor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, {
-    entityName: "tenant-invitation",
-});
 export const cancelInvitationWrite = defineWriteHandler({
     name: "cancel-invitation",
     schema: CancelInvitationSchema,
@@ -51,20 +46,10 @@ export const cancelInvitationWrite = defineWriteHandler({
         if (invitation["status"] !== INVITATION_STATUS.pending) {
             return { isSuccess: true, data: { id: event.payload.invitationId, alreadyDone: true } };
         }
-        // Status update via event-store
-        const updateResult = await executor.update({
-            id: event.payload.invitationId,
-            version: invitation["version"], // @cast-boundary db-row
-            changes: { status: INVITATION_STATUS.cancelled },
-        }, event.user, db);
-        if (!updateResult.isSuccess)
-            return updateResult;
-        // Delete the token from Redis (if still there). If Redis is
-        // unavailable or the token already expired: not a problem, the DB
-        // row is the single source of truth for the UI.
-        if (ctx.redis) {
-            await invalidateExistingInviteToken(ctx.redis, event.payload.invitationId);
-        }
+        const cancelFailure = await cancelPendingInvitation(db, { id: event.payload.invitationId, version: invitation["version"] }, // @cast-boundary db-row
+        event.user, ctx.redis);
+        if (cancelFailure)
+            return cancelFailure;
         return { isSuccess: true, data: { id: event.payload.invitationId, alreadyDone: false } };
     },
 });

package/dist/tenant/handlers/member-directory.query.d.ts

@@ -1,6 +1,7 @@
 import * as z from "zod";
 export declare const memberDirectoryQuery: import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"memberDirectory", z.ZodObject<{
     limit: z.ZodDefault<z.ZodNumber>;
+    search: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, {
     id: string;
     label: string;

package/dist/tenant/handlers/member-directory.query.js

@@ -9,6 +9,10 @@ import { isSystemAdmin } from "./is-system-admin.js";
 // Shares the KMS adapter's small dedicated pool, same rationale as
 // members.query.ts.
 const KMS_POOL_CONCURRENCY = 4;
+// Display names are encrypted PII, so a search cannot run in SQL: candidates
+// are decrypted and filtered in memory. The cap keeps a SystemAdmin's global
+// search from decrypting every user.
+const SEARCH_SCAN_CAP = 1000;
 async function loadMemberUserIds(db, tenantId) {
     const memberships = await selectMany(db, tenantMembershipsTable, { tenantId });
     return [...new Set(memberships.map((row) => String(row["userId"])))];
@@ -29,6 +33,8 @@ export const memberDirectoryQuery = definePagedQueryHandler({
     name: "memberDirectory",
     schema: z.object({
         limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT),
+        // Sent by the reference combobox while the user types.
+        search: z.string().trim().min(1).optional(),
     }),
     access: { roles: access.admin },
     description: "Lists users as id/label pairs for resolving user references to display names: the caller's own tenant members for an admin, every user for a SystemAdmin; carries no email or role data.",
@@ -39,24 +45,31 @@ export const memberDirectoryQuery = definePagedQueryHandler({
                 message: "tenant:query:member-directory requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
             });
         }
-        const { limit } = query.payload;
+        const { limit, search } = query.payload;
+        // Without a search the first `limit` rows are enough; with one, every
+        // candidate must be decrypted before the limit can apply.
+        const scanLimit = search === undefined ? limit : SEARCH_SCAN_CAP;
         let users;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as user:query:user:list did");
-            users = await selectMany(db, userTable, undefined, { limit });
+            users = await selectMany(db, userTable, undefined, { limit: scanLimit });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-            const userIds = (await loadMemberUserIds(db, query.user.tenantId)).slice(0, limit);
+            const userIds = (await loadMemberUserIds(db, query.user.tenantId)).slice(0, scanLimit);
             users = userIds.length > 0 ? await selectMany(db, userTable, { id: [...userIds] }) : [];
         }
-        const rows = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
+        const resolved = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
             const id = String(user.id);
             const label = typeof user.displayName === "string"
                 ? await decryptStoredPii(user.displayName, "displayName", "tenant:member-directory")
                 : null;
             return { id, label: label ?? id };
         });
+        const needle = search?.toLowerCase();
+        const rows = needle === undefined
+            ? resolved
+            : resolved.filter((row) => row.label.toLowerCase().includes(needle)).slice(0, limit);
         return { rows, nextCursor: null };
     },
 });

package/dist/tenant/handlers/remove-member.write.js

@@ -4,17 +4,15 @@ import { createSystemUser, defineWriteHandler, withResponseData, } from "@cosmic
 import { InternalError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-// kumiko-lint-ignore cross-feature-import cancel needs invite-token-store for Redis cleanup
-import { invalidateExistingInviteToken } from "../../auth-email-password/invite-token-store.js";
 import { decryptStoredPii } from "../../shared/index.js";
 import { userTable } from "../../user/index.js";
-import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../invitation-table.js";
+import { cancelPendingInvitation } from "../cancel-pending-invitation.js";
+import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table.js";
 import { assertNotLastTenantAdmin } from "../last-tenant-admin.js";
 import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-table.js";
 const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembershipEntity, {
     entityName: "tenant-membership",
 });
-const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
 async function cancelPendingInvitationsOfUser(db, options) {
     const user = await fetchOne(db, userTable, { id: options.userId });
     if (!user?.email)
@@ -22,15 +20,9 @@ async function cancelPendingInvitationsOfUser(db, options) {
     const email = (await decryptStoredPii(user.email, "email", "tenant:remove-member")).toLowerCase();
     const pendingInvitations = await selectMany(db, tenantInvitationsTable, { tenantId: options.tenantId, email, status: INVITATION_STATUS.pending });
     for (const invitation of pendingInvitations) {
-        const updateResult = await invitationExecutor.update({
-            id: invitation.id,
-            version: invitation.version,
-            changes: { status: INVITATION_STATUS.cancelled },
-        }, options.actor, db);
-        if (!updateResult.isSuccess)
-            return updateResult;
-        if (options.redis)
-            await invalidateExistingInviteToken(options.redis, invitation.id);
+        const failure = await cancelPendingInvitation(db, invitation, options.actor, options.redis);
+        if (failure)
+            return failure;
     }
     return undefined;
 }
@@ -63,7 +55,10 @@ export const removeMemberWrite = defineWriteHandler({
         }
         const currentRoles = parseRoles(existing["roles"]);
         if (currentRoles.includes("TenantAdmin")) {
-            const lastAdmin = await assertNotLastTenantAdmin(db, event.payload.tenantId, event.payload.userId);
+            // assertNotLastTenantAdmin issues raw SQL, so it needs the raw runner, not
+            // the tenant-scoped `db` — the count is filtered by the explicit tenantId.
+            const lockRunner = ctx.systemDb.unsafeRaw("tenant:write:removeMember last-TenantAdmin advisory lock + membership count");
+            const lastAdmin = await assertNotLastTenantAdmin(lockRunner, event.payload.tenantId, event.payload.userId, "remove");
             if (lastAdmin !== undefined)
                 return lastAdmin;
         }

package/dist/tenant/handlers/team-list.query.js

@@ -130,7 +130,7 @@ export const teamListQuery = definePagedQueryHandler({
         const memberRows = membershipRows.map((row) => {
             const userId = String(row["userId"]);
             const decrypted = decryptedByUserId.get(userId);
-            const createdAt = row["createdAt"];
+            const createdAt = row["insertedAt"];
             return {
                 id: String(row["id"]),
                 userId,
@@ -153,7 +153,7 @@ export const teamListQuery = definePagedQueryHandler({
             const decryptedEmail = typeof email === "string"
                 ? await decryptStoredPii(email, "email", "tenant:team-list")
                 : null;
-            const createdAt = row["createdAt"];
+            const createdAt = row["insertedAt"];
             const expiresAt = row["expiresAt"];
             return {
                 id: String(row["id"]),

package/dist/tenant/handlers/tenant-directory.query.d.ts

@@ -1,6 +1,7 @@
 import * as z from "zod";
 export declare const tenantDirectoryQuery: import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"tenantDirectory", z.ZodObject<{
     limit: z.ZodDefault<z.ZodNumber>;
+    search: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, {
     id: string;
     label: string;

package/dist/tenant/handlers/tenant-directory.query.js

@@ -11,10 +11,15 @@ import { isSystemAdmin } from "./is-system-admin.js";
 // them; a TenantAdmin only ever sees their own tenant.
 // ponytail: capped at `limit` (200 list lookup, 50 combobox) like every
 // reference lookup; beyond that the cell falls back to the raw id.
+// A search filters in memory over a bounded scan so the combobox can reach
+// tenants beyond the first `limit`; the cap keeps it from reading every tenant.
+const SEARCH_SCAN_CAP = 1000;
 export const tenantDirectoryQuery = definePagedQueryHandler({
     name: "tenantDirectory",
     schema: z.object({
         limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT),
+        // Sent by the reference combobox while the user types.
+        search: z.string().trim().min(1).optional(),
     }),
     access: { roles: access.admin },
     description: "Lists tenants as id/label pairs for resolving tenant references to display names: the caller's own tenant for an admin, every tenant for a SystemAdmin.",
@@ -25,21 +30,26 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
                 message: "tenant:query:tenant-directory requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
             });
         }
-        const { limit } = query.payload;
+        const { limit, search } = query.payload;
+        const scanLimit = search === undefined ? limit : SEARCH_SCAN_CAP;
         let tenants;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as tenant:query:tenant:list did");
-            tenants = await selectMany(db, tenantTable, undefined, { limit });
+            tenants = await selectMany(db, tenantTable, undefined, { limit: scanLimit });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
             const row = await fetchOne(db, tenantTable, { id: query.user.tenantId });
             tenants = row ? [row] : [];
         }
-        const rows = tenants.map((tenant) => {
+        const labeled = tenants.map((tenant) => {
             const id = String(tenant.id);
             return { id, label: typeof tenant.name === "string" ? tenant.name : id };
         });
+        const needle = search?.toLowerCase();
+        const rows = needle === undefined
+            ? labeled
+            : labeled.filter((row) => row.label.toLowerCase().includes(needle)).slice(0, limit);
         return { rows, nextCursor: null };
     },
 });

package/dist/tenant/handlers/update-member-roles.write.d.ts

@@ -5,6 +5,6 @@ export declare const updateMemberRolesWrite: import("@cosmicdrift/kumiko-types/d
     roles: z.ZodArray<z.ZodString>;
 }, z.core.$strip>, {
     userId: string;
-    roles: string[];
+    roles: readonly string[];
     tenantId: string;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/tenant/handlers/update-member-roles.write.js

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { access, assignableAppRolesFromUsages, createSystemUser, defineWriteHandler, EXT_ASSIGNABLE_ROLE, findForbiddenRoleAssignment, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, assignableAppRolesOf, createSystemUser, defineWriteHandler, findForbiddenRoleAssignment, mergeAssignedRoles, SYSTEM_ROLE, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -19,6 +19,15 @@ const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user"
 function resolveTargetTenantId(isSystem, payloadTenantId, sessionTenantId) {
     return isSystem ? (payloadTenantId ?? sessionTenantId) : sessionTenantId;
 }
+// Editing your OWN roles keeps the current session: roles are re-derived per
+// request, so the new roles apply at once without a re-login. Other sessions
+// of that user and any foreign edit still revoke all.
+function revokeSessionsPayload(targetUserId, targetTenantId, actor) {
+    const payload = { userId: targetUserId, tenantId: targetTenantId };
+    if (targetUserId !== actor.id || actor.sid === undefined)
+        return payload;
+    return { ...payload, exceptSessionId: actor.sid };
+}
 export const updateMemberRolesWrite = defineWriteHandler({
     name: "updateMemberRoles",
     schema: z.object({
@@ -31,14 +40,16 @@ export const updateMemberRolesWrite = defineWriteHandler({
     // manage memberships cross-tenant (payload.tenantId). TenantAdmin and Admin
     // are session-scoped (event.user.tenantId).
     access: { roles: ["system", ...access.admin] },
-    description: "Replaces the roles a user holds in a tenant, rejecting reserved role names and any grant that would raise the target above the caller; admins act on their own tenant, SystemAdmins on any.",
+    description: "Sets the roles a user holds in a tenant, rejecting reserved role names and any grant that would raise the target above the caller; roles the caller could not grant (platform roles such as DataProtectionOfficer or TenantOwner, undeclared or higher-tier app roles) are kept, only the system user replaces the full list; admins act on their own tenant, SystemAdmins on any.",
     handler: async (event, ctx) => {
         if (!ctx.systemDb) {
             throw new InternalError({
                 message: "tenant:write:updateMemberRoles requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
             });
         }
-        const isSystem = event.user.roles.includes("SystemAdmin") || event.user.roles.includes("system");
+        const isSystemActor = event.user.roles.includes(SYSTEM_ROLE);
+        const isSystem = event.user.roles.includes("SystemAdmin") || isSystemActor;
+        const assignableAppRoles = assignableAppRolesOf(ctx.registry);
         const targetTenantId = resolveTargetTenantId(isSystem, event.payload.tenantId, event.user.tenantId);
         if (!targetTenantId) {
             return writeFailure(new ValidationError({
@@ -69,14 +80,18 @@ export const updateMemberRolesWrite = defineWriteHandler({
         }
         const row = existing; // @cast-boundary generic-record
         const currentTargetRoles = parseRoles(row["roles"]);
-        if (!event.user.roles.includes("system")) {
-            const forbiddenElevation = findForbiddenRoleAssignment(event.user.roles, event.payload.roles, currentTargetRoles, assignableAppRolesFromUsages(ctx.registry.getExtensionUsages(EXT_ASSIGNABLE_ROLE)));
+        if (!isSystemActor) {
+            const forbiddenElevation = findForbiddenRoleAssignment(event.user.roles, event.payload.roles, currentTargetRoles, assignableAppRoles);
             if (forbiddenElevation !== undefined) {
                 return writeFailure(unassignableMembershipRoleError(forbiddenElevation));
             }
         }
+        // The system user is programmatic and replaces; human actors keep what they cannot grant.
+        const nextRoles = isSystemActor
+            ? event.payload.roles
+            : mergeAssignedRoles(event.user.roles, event.payload.roles, currentTargetRoles, assignableAppRoles);
         const targetIsTenantAdmin = currentTargetRoles.includes("TenantAdmin");
-        const willBeTenantAdmin = event.payload.roles.includes("TenantAdmin");
+        const willBeTenantAdmin = nextRoles.includes("TenantAdmin");
         if (targetIsTenantAdmin && !willBeTenantAdmin) {
             // assertNotLastTenantAdmin issues raw SQL, so it needs the raw runner, not
             // `db` — the count is already filtered by the explicit targetTenantId.
@@ -99,10 +114,7 @@ export const updateMemberRolesWrite = defineWriteHandler({
         // requires, see above).
         const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
         if (revoker) {
-            await ctx.writeAs(createSystemUser(targetTenantId), REVOKE_ALL_SESSIONS_QN, {
-                userId: event.payload.userId,
-                tenantId: targetTenantId,
-            });
+            await ctx.writeAs(createSystemUser(targetTenantId), REVOKE_ALL_SESSIONS_QN, revokeSessionsPayload(event.payload.userId, targetTenantId, event.user));
         }
         // Stream tenant follows the actor via streamTenantFor — use the
         // membership tenant so SystemAdmin/cross-tenant and TenantAdmin paths
@@ -112,8 +124,12 @@ export const updateMemberRolesWrite = defineWriteHandler({
         const result = await executor.update({
             id: row["id"], // @cast-boundary db-row
             version: row["version"], // @cast-boundary db-row
-            changes: { roles: JSON.stringify(event.payload.roles) },
+            changes: { roles: JSON.stringify(nextRoles) },
         }, { ...event.user, tenantId: targetTenantId }, db);
-        return withResponseData(result, { ...event.payload, tenantId: targetTenantId });
+        return withResponseData(result, {
+            ...event.payload,
+            roles: nextRoles,
+            tenantId: targetTenantId,
+        });
     },
 });

package/dist/tenant/i18n.js

@@ -34,6 +34,10 @@ export const TENANT_I18N = {
     "tenant:entity:__action-form__:field:roles:option:Member": { en: "Member" },
     "tenant:entity:__action-form__:field:roles:option:Admin": { en: "Admin" },
     "tenant:entity:__action-form__:field:roles:option:TenantAdmin": { en: "Tenant Admin" },
+    "tenant:entity:__action-form__:field:roles:option:TenantOwner": { en: "Tenant Owner" },
+    "tenant:entity:__action-form__:field:roles:option:DataProtectionOfficer": {
+        en: "Data Protection Officer",
+    },
     "tenant:entity:__action-form__:field:roles:option:Editor": { en: "Editor" },
     "tenant:entity:tenant:field:key": { en: "Key" },
     "tenant:entity:tenant:field:name": { en: "Name" },

package/dist/tenant/index.d.ts

@@ -1,5 +1,5 @@
 export { TenantCommandSchemas } from "./command-schemas.js";
-export { TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries } from "./constants.js";
+export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export type { InvitationStatus } from "./invitation-table.js";
 export { INVITATION_STATUS, INVITATION_STATUSES, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";

package/dist/tenant/index.js

@@ -1,5 +1,5 @@
 export { TenantCommandSchemas } from "./command-schemas.js";
-export { TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries } from "./constants.js";
+export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export { INVITATION_STATUS, INVITATION_STATUSES, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";
 export { isTenantServingPublicContent } from "./is-tenant-serving-public-content.js";

package/dist/tenant/last-tenant-admin.d.ts

@@ -3,5 +3,5 @@ import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 export declare const LAST_TENANT_ADMIN_LOCK_NAMESPACE = 1952539757;
 type TenantDb = Parameters<typeof acquireNamespacedAdvisoryLock>[0];
 /** Refuse demoting/removing the last TenantAdmin for `tenantId`. */
-export declare function assertNotLastTenantAdmin(db: TenantDb, tenantId: string, userId: string): Promise<ReturnType<typeof writeFailure> | undefined>;
+export declare function assertNotLastTenantAdmin(db: TenantDb, tenantId: string, userId: string, action?: "demote" | "remove"): Promise<ReturnType<typeof writeFailure> | undefined>;
 export {};