@cosmicdrift/kumiko-bundled-features 0.351.0 → 0.353.0

package/dist/personal-access-tokens/screens.js

@@ -1,6 +1,11 @@
 import { i18nKey, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
-import { PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries } from "./constants.js";
+import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
+import { fieldOptionLabelKeyPrefix } from "@cosmicdrift/kumiko-headless";
+import { PAT_FEATURE, PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries, } from "./constants.js";
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
+// Same keys the mint form's `scopes` multiSelect options resolve through
+// (see patScopeOptionTranslations), so list and form show identical labels.
+const PAT_SCOPE_OPTION_KEY_PREFIX = fieldOptionLabelKeyPrefix(PAT_FEATURE, ACTION_FORM_ENTITY, "scopes");
 // Both screens render only for tenants whose tier includes the feature; the
 // availability query is rejected by the feature gate otherwise.
 const PAT_SCREEN_VISIBLE_WHEN = {
@@ -20,11 +25,17 @@ export const patListScreen = {
     defaultSort: { field: "createdAt", dir: "desc" },
     columns: [
         { field: "name", label: i18nKey("pat.list.col.name") },
-        { field: "prefix", label: i18nKey("pat.list.col.prefix") },
-        { field: "scopes", label: i18nKey("pat.list.col.scopes") },
+        { field: "prefix", label: i18nKey("pat.list.col.prefix"), sortable: false },
+        {
+            field: "scopes",
+            label: i18nKey("pat.list.col.scopes"),
+            sortable: false,
+            renderer: { format: "enumOption", keyPrefix: PAT_SCOPE_OPTION_KEY_PREFIX },
+        },
         {
             field: "status",
             label: i18nKey("pat.list.col.status"),
+            sortable: false,
             renderer: { format: "enumOption", keyPrefix: PAT_STATUS_OPTION_KEY_PREFIX },
         },
         {

package/dist/renderer-foundation/types.d.ts

@@ -19,6 +19,7 @@ export type RenderRequest = {
 export type RenderResponse = {
     kind: "notification";
     html: string;
+    text?: string;
 } | {
     kind: "mail-html";
     html: string;

package/dist/renderer-simple/feature.js

@@ -16,12 +16,10 @@ export async function adaptToFoundation(req, ctx, renderer = simpleRenderer) {
         throw new RendererError(`renderer-simple supports only kind="notification", got "${req.kind}"`, "invalid_payload");
     }
     const variables = await resolveNotificationVariables(req, ctx);
-    const html = await renderer.render({
-        template: req.payload.template ?? "",
-        variables,
-        locale: req.payload.locale,
-    });
-    return { kind: "notification", html };
+    const input = { template: req.payload.template ?? "", variables, locale: req.payload.locale };
+    const html = await renderer.render(input);
+    const text = renderer.renderText ? await renderer.renderText(input) : undefined;
+    return text === undefined ? { kind: "notification", html } : { kind: "notification", html, text };
 }
 export function createRendererSimpleFeature(options) {
     const renderer = options?.mailBranding

package/dist/renderer-simple/index.d.ts

@@ -1,2 +1,3 @@
 export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
+export type { MailBadge, MailChip, MailStage, MailStageState, MailTone } from "./mail-blocks.js";
 export { createSimpleRenderer, type LocalizedText, type MailBranding, simpleRenderer, } from "./simple-renderer.js";

package/dist/renderer-simple/mail-blocks.d.ts

@@ -0,0 +1,21 @@
+export type MailTone = "neutral" | "info" | "success" | "warning" | "danger";
+export type MailStageState = "done" | "current" | "upcoming";
+export type MailBadge = {
+    readonly label: string;
+    readonly tone?: MailTone;
+};
+export type MailStage = {
+    readonly label: string;
+    readonly state: MailStageState;
+};
+export type MailChip = {
+    readonly label: string;
+    readonly tone?: MailTone;
+};
+export declare function parseBadge(value: unknown): MailBadge | undefined;
+export declare function renderBadge(badge: MailBadge): string;
+export declare function renderChips(chips: unknown): string;
+export declare function renderStages(stages: unknown, primaryColor: string): string;
+export declare function badgeText(badge: MailBadge): string;
+export declare function stagesText(stages: unknown): string;
+export declare function chipsText(chips: unknown): string;

package/dist/renderer-simple/mail-blocks.js

@@ -0,0 +1,107 @@
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+// Literal types (as const) keep the colors compile-time known, so they can go into style
+// attributes without escaping.
+const TONE_COLORS = {
+    neutral: { bg: "#f3f4f6", fg: "#374151" },
+    info: { bg: "#dbeafe", fg: "#1e40af" },
+    success: { bg: "#dcfce7", fg: "#166534" },
+    warning: { bg: "#fef3c7", fg: "#92400e" },
+    danger: { bg: "#fee2e2", fg: "#991b1b" },
+};
+const STAGE_STATES = ["done", "current", "upcoming"];
+const STAGE_DONE_COLOR = "#16a34a";
+const STAGE_UPCOMING_BG = "#e5e7eb";
+const STAGE_UPCOMING_FG = "#9ca3af";
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function isMailTone(value) {
+    return typeof value === "string" && Object.hasOwn(TONE_COLORS, value);
+}
+function toneColors(tone) {
+    return TONE_COLORS[isMailTone(tone) ? tone : "neutral"];
+}
+function isStageState(value) {
+    return STAGE_STATES.some((state) => state === value);
+}
+// Template data is runtime data (variables of a stored template): entries that do not match are
+// skipped instead of failing the whole mail.
+function isStage(value) {
+    return isRecord(value) && typeof value["label"] === "string" && isStageState(value["state"]);
+}
+function isChip(value) {
+    return isRecord(value) && typeof value["label"] === "string";
+}
+export function parseBadge(value) {
+    return isChip(value) && value.label !== "" ? value : undefined;
+}
+function validStages(value) {
+    return Array.isArray(value) ? value.filter(isStage) : [];
+}
+function validChips(value) {
+    return Array.isArray(value) ? value.filter(isChip) : [];
+}
+function pill(chip, margin) {
+    const { bg, fg } = toneColors(chip.tone);
+    return `<span style="display:inline-block;margin:${margin};padding:2px 10px;border-radius:999px;background:${bg};color:${fg};font-size:12px;font-weight:600;line-height:18px">${escapeHtml(chip.label)}</span>`;
+}
+export function renderBadge(badge) {
+    return `<p style="margin:0 0 12px">${pill(badge, "0")}</p>`;
+}
+export function renderChips(chips) {
+    const valid = validChips(chips);
+    if (valid.length === 0)
+        return "";
+    return `<p style="margin:0 0 16px">${valid.map((chip) => pill(chip, "0 6px 6px 0")).join("")}</p>`;
+}
+function stageMarker(stage, position, primaryColor) {
+    const base = "display:inline-block;width:24px;height:24px;line-height:24px;border-radius:12px;text-align:center;font-size:12px;font-weight:700";
+    const primary = escapeHtmlAttr(primaryColor);
+    if (stage.state === "done") {
+        return `<span style="${base};background:${STAGE_DONE_COLOR};color:#fff">&#10003;</span>`;
+    }
+    if (stage.state === "current") {
+        return `<span style="${base};background:#fff;border:2px solid ${primary};line-height:20px;width:20px;height:20px;color:${primary}">${position}</span>`;
+    }
+    return `<span style="${base};background:${STAGE_UPCOMING_BG};color:${STAGE_UPCOMING_FG}">${position}</span>`;
+}
+function stageCell(stage, position, primaryColor) {
+    const labelColor = stage.state === "upcoming" ? STAGE_UPCOMING_FG : "#111";
+    const weight = stage.state === "current" ? 700 : 400;
+    return `<td align="center" valign="top" style="padding:0 4px;font-family:sans-serif">${stageMarker(stage, position, primaryColor)}<div style="margin:4px 0 0;font-size:12px;font-weight:${weight};color:${labelColor}">${escapeHtml(stage.label)}</div></td>`;
+}
+function stageConnector(previous) {
+    const color = previous.state === "done" ? STAGE_DONE_COLOR : STAGE_UPCOMING_BG;
+    return `<td valign="top" style="padding:11px 0 0"><div style="width:24px;height:2px;line-height:2px;font-size:2px;background:${color}">&nbsp;</div></td>`;
+}
+export function renderStages(stages, primaryColor) {
+    const valid = validStages(stages);
+    if (valid.length === 0)
+        return "";
+    const cellsHtml = valid
+        .map((stage, index) => {
+        const previous = valid[index - 1];
+        const connector = previous ? stageConnector(previous) : "";
+        return `${connector}${stageCell(stage, index + 1, primaryColor)}`;
+    })
+        .join("");
+    return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:0 0 16px"><tr>${cellsHtml}</tr></table>`;
+}
+const STAGE_TEXT_MARKER = {
+    done: "✓",
+    current: "▶",
+    upcoming: "○",
+};
+export function badgeText(badge) {
+    return `[${badge.label}]`;
+}
+export function stagesText(stages) {
+    return validStages(stages)
+        .map((stage) => `${STAGE_TEXT_MARKER[stage.state]} ${stage.label}`)
+        .join(" → ");
+}
+export function chipsText(chips) {
+    return validChips(chips)
+        .map((chip) => chip.label)
+        .join(" · ");
+}

package/dist/renderer-simple/simple-renderer.js

@@ -1,5 +1,6 @@
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { renderSafeMarkdown } from "../page-render/index.js";
+import { badgeText, chipsText, parseBadge, renderBadge, renderChips, renderStages, stagesText, } from "./mail-blocks.js";
 const DEFAULT_PRIMARY_COLOR = "#2563eb";
 const HEX_COLOR_PATTERN = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
 function isHttpUrl(value) {
@@ -107,6 +108,7 @@ function templateContent(variables) {
     const data = variables; // @cast-boundary render-helper
     // Without structured fields, title + body become the header and a single text section.
     return {
+        badge: parseBadge(data.badge),
         header: data.header ?? data.title,
         sections: data.sections ?? (data.body ? [{ text: data.body }] : undefined),
         footer: data.footer,
@@ -122,6 +124,10 @@ function sectionText(section) {
         return section.markdown;
     if ("button" in section)
         return `${section.button.label}: ${section.button.url}`;
+    if ("stages" in section)
+        return stagesText(section.stages);
+    if ("chips" in section)
+        return chipsText(section.chips);
     return "";
 }
 function renderSection(section, primaryColor) {
@@ -138,6 +144,10 @@ function renderSection(section, primaryColor) {
     if ("button" in section) {
         return `<p style="margin:0 0 16px"><a href="${escapeHtml(section.button.url)}" style="display:inline-block;padding:10px 24px;background:${escapeHtmlAttr(primaryColor)};color:#fff;text-decoration:none;border-radius:4px;font-size:14px">${escapeHtml(section.button.label)}</a></p>`;
     }
+    if ("stages" in section)
+        return renderStages(section.stages, primaryColor);
+    if ("chips" in section)
+        return renderChips(section.chips);
     return "";
 }
 // Simple Renderer: turns structured email template data into HTML with inline CSS.
@@ -150,11 +160,13 @@ export function createSimpleRenderer(branding) {
     return {
         name: "simple",
         async render(input) {
-            const { header, sections, footer } = templateContent(input.variables);
+            const { badge, header, sections, footer } = templateContent(input.variables);
             const parts = [];
             parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
             parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
             parts.push(renderBrandingHeader(branding, primaryColor, logoUrl));
+            if (badge)
+                parts.push(renderBadge(badge));
             if (header) {
                 parts.push(`<h1 style="margin:0 0 24px;color:#111;font-size:20px;font-weight:600">${escapeHtml(header)}</h1>`);
             }
@@ -171,9 +183,15 @@ export function createSimpleRenderer(branding) {
             return parts.join("");
         },
         async renderText(input) {
-            const { header, sections, footer } = templateContent(input.variables);
+            const { badge, header, sections, footer } = templateContent(input.variables);
             const brandingFooter = brandingFooterLines(branding, input.locale).join("\n");
-            return [header, ...(sections ?? []).map(sectionText), footer, brandingFooter]
+            return [
+                badge ? badgeText(badge) : undefined,
+                header,
+                ...(sections ?? []).map(sectionText),
+                footer,
+                brandingFooter,
+            ]
                 .filter((block) => block !== undefined && block !== "")
                 .join("\n\n");
         },

package/dist/secrets/table.d.ts

@@ -8,6 +8,7 @@ export declare const tenantSecretEntity: import("@cosmicdrift/kumiko-types/field
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/seo/feature.js

@@ -1,8 +1,10 @@
 // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312 (feature.ts > 300 lines)
 import { computeRevisionEtag } from "@cosmicdrift/kumiko-framework/api";
 import { defineFeature, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
 import { LEGAL_ROUTES } from "../legal-pages/index.js";
 import { cachedSecurePageResponse } from "../page-render/index.js";
+import { rateLimitedTextResponse } from "../shared/index.js";
 import { SEO_CONFIG_KEYS, SEO_DEFAULT_PATHS } from "./constants.js";
 import { seoConfigQuery } from "./handlers/seo-config.query.js";
 import { buildLlmsTxt } from "./llms-txt.js";
@@ -62,7 +64,10 @@ async function gatherEntries(opts, systemQuery, origin, host) {
                     });
                 }
             }
-            catch {
+            catch (error) {
+                // A rate limit must not look like "pages removed" to a crawler.
+                if (error instanceof RateLimitError)
+                    throw error;
                 // managed-pages unreachable/not mounted — degrade to callback-only entries.
             }
         }
@@ -113,7 +118,15 @@ export function createSeoFeature(opts) {
             anonymous: true,
             handler: async (c, { systemQuery }) => {
                 const { origin, host } = requestHost(c);
-                const entries = await gatherEntries(opts, systemQuery, origin, host);
+                let entries;
+                try {
+                    entries = await gatherEntries(opts, systemQuery, origin, host);
+                }
+                catch (error) {
+                    if (error instanceof RateLimitError)
+                        return rateLimitedTextResponse(error);
+                    throw error;
+                }
                 const xml = buildSitemapXml(entries);
                 const etag = computeRevisionEtag([host, xml]);
                 return cachedSecurePageResponse(c.req.raw, {
@@ -133,10 +146,19 @@ export function createSeoFeature(opts) {
                 const tenantId = opts.managedPages
                     ? ((await opts.managedPages.resolveApexTenant(host)) ?? SYSTEM_TENANT_ID)
                     : SYSTEM_TENANT_ID;
-                const [entries, seoConfig] = await Promise.all([
-                    gatherEntries(opts, systemQuery, origin, host),
-                    readSeoConfig(systemQuery, tenantId),
-                ]);
+                let entries;
+                let seoConfig;
+                try {
+                    [entries, seoConfig] = await Promise.all([
+                        gatherEntries(opts, systemQuery, origin, host),
+                        readSeoConfig(systemQuery, tenantId),
+                    ]);
+                }
+                catch (error) {
+                    if (error instanceof RateLimitError)
+                        return rateLimitedTextResponse(error);
+                    throw error;
+                }
                 const sections = entries.length > 0
                     ? [
                         {

package/dist/sessions/schema/user-session.d.ts

@@ -3,6 +3,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -105,6 +107,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -126,6 +129,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/shared/assert-no-where-rule-in-ownership-write.d.ts

@@ -0,0 +1,2 @@
+import type { OwnershipMap } from "@cosmicdrift/kumiko-framework/engine";
+export declare function assertNoWhereRuleInOwnershipWrite(factoryName: string, writeOwnership: OwnershipMap | undefined): void;

package/dist/shared/assert-no-where-rule-in-ownership-write.js

@@ -0,0 +1,18 @@
+// Boot validation rejects `{ kind: "where" }` in access.write too (fw#2626);
+// failing at factory time names the option instead of an entity scope.
+export function assertNoWhereRuleInOwnershipWrite(factoryName, writeOwnership) {
+    // skip: no write ownership declared, nothing to validate
+    if (!writeOwnership)
+        return;
+    const hasWhereRule = Object.values(writeOwnership).some((rule) => rule !== "all" && rule.kind === "where");
+    // skip: no where-rule present, the option is valid
+    if (!hasWhereRule)
+        return;
+    throw new Error(`${factoryName}({ ownership }): ownership.write must not contain a ` +
+        '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
+        "layer (the read path, via buildOwnershipClause). Write paths that " +
+        "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
+        "evaluate them, so such a rule can only ever deny — boot validation " +
+        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
+        "leave it unset.");
+}

package/dist/shared/index.d.ts

@@ -1,17 +1,18 @@
 export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
+export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
 export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
 export { entitiesOf } from "./entities-of.js";
 export { isWithinGracePeriod } from "./grace-period.js";
-export { hasWhereRule } from "./has-where-rule.js";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
+export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/index.js

@@ -1,17 +1,18 @@
 export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
+export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
 export { runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
 export { entitiesOf } from "./entities-of.js";
 export { isWithinGracePeriod } from "./grace-period.js";
-export { hasWhereRule } from "./has-where-rule.js";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter } from "./lockout-counter.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
+export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/rate-limited-text-response.d.ts

@@ -0,0 +1,2 @@
+import type { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
+export declare function rateLimitedTextResponse(error: RateLimitError): Response;

package/dist/shared/rate-limited-text-response.js

@@ -0,0 +1,9 @@
+export function rateLimitedTextResponse(error) {
+    return new Response("rate limited", {
+        status: 429,
+        headers: {
+            "content-type": "text/plain; charset=utf-8",
+            "retry-after": String(error.details.retryAfterSeconds),
+        },
+    });
+}

package/dist/tags/entity.d.ts

@@ -4,6 +4,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -25,6 +26,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -46,6 +48,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -69,6 +72,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -90,6 +94,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -111,6 +116,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -134,6 +140,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -155,6 +162,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -176,6 +184,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/tags/feature.js

@@ -18,7 +18,7 @@
 // entityList/entityEdit catalog screens (legacy QNs stay for TagManager).
 // Deferred: optional host-projection decoration (`wireTagsFor`), search indexing.
 import { defineEntityDetailHandler, defineEntityListHandler, defineEntityUpdateHandler, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
-import { hasWhereRule } from "../shared/index.js";
+import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
 import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./constants.js";
 import { createTagAssignmentEntity, tagEntity } from "./entity.js";
 import { createTagAssignmentExecutor } from "./executor.js";
@@ -109,15 +109,7 @@ export function createTagsFeature(opts = {}) {
             "assignment row. Omit `parents` to keep every registered entity " +
             "admissible as a host instead.");
     }
-    if (hasWhereRule(opts.ownership?.write)) {
-        throw new Error("createTagsFeature({ ownership }): ownership.write must not contain a " +
-            '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
-            "layer (the read path, via buildOwnershipClause). Write paths that " +
-            "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-            "evaluate them, so such a rule can only ever deny — boot validation " +
-            "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
-            "leave it unset.");
-    }
+    assertNoWhereRuleInOwnershipWrite("createTagsFeature", opts.ownership?.write);
     const access = resolveAccess(opts);
     return defineFeature(TAGS_FEATURE_NAME, (r) => registerTags(r, access, opts.toggleable, opts.ownership, opts.parents));
 }