@cosmicdrift/kumiko-bundled-features 0.351.0 → 0.353.0

package/dist/tenant/schema/tenant.d.ts

@@ -5,6 +5,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -58,14 +60,15 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly active?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyFailed?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyRequested?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyed?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroying?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly active?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyFailed?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyRequested?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyed?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroying?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -88,6 +91,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -156,6 +160,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -177,6 +182,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -209,14 +215,15 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly active?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyFailed?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyRequested?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyed?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroying?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly active?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyFailed?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyRequested?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyed?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroying?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -239,6 +246,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/tenant/schema/tenant.js

@@ -17,19 +17,17 @@ export const tenantEntity = createEntity({
         key: createTextField({
             required: true,
             maxLength: 50,
+            sortable: true,
             personal: false,
             reason: "technical_reference",
         }),
-        // Workspace/company display name, not an individual's identity —
-        // same class as the `company.legalName` example in the boot-validator's
-        // own PII-heuristic doc-comment.
+        // Subject is the tenant record itself: tenant events live in the writer's (system) tenant stream, so `personal: "tenant"` would not resolve to this tenant.
         name: createTextField({
             required: true,
             maxLength: 200,
             searchable: true,
-            sortable: true,
-            personal: false,
-            reason: "is_business_data",
+            personal: { of: "id" },
+            find: "none",
         }),
         isEnabled: createBooleanField({ default: true, filterable: true }),
         // Tenant-destroy lifecycle (tenant-lifecycle feature). Defaults keep

package/dist/tenant/screens.js

@@ -23,7 +23,7 @@ export const tenantListScreen = {
             entityId: "id",
         },
     ],
-    defaultSort: { field: "name", dir: "asc" },
+    defaultSort: { field: "key", dir: "asc" },
     searchable: true,
     access: { roles: ["SystemAdmin"] },
     // Inert until an app navs it (see file header) — no nav area to resolve

package/dist/tenant-handover/move-entity-graph.js

@@ -174,7 +174,7 @@ export async function moveTransferGraph(args) {
     let pending = [
         { entityName: rootEntityName, rowIds: [rootRowId] },
     ];
-    for (let round = 0; round < MAX_TRANSFER_DEPTH && pending.length > 0; round++) {
+    for (let round = 0; round <= MAX_TRANSFER_DEPTH && pending.length > 0; round++) {
         // Merged per type so an edge leaving a type runs once per round, not once
         // per edge that reached it.
         const discovered = new Map();
@@ -231,24 +231,17 @@ export async function moveTransferGraph(args) {
                 }));
             }
         }
+        // The extra round past the limit is a probe: it only exists to find out
+        // whether rows still hang below the last allowed hop. Its moves are rolled
+        // back with the transaction when this throws.
+        const [strandedEntityName] = discovered.keys();
+        if (round === MAX_TRANSFER_DEPTH && strandedEntityName !== undefined) {
+            throw new UnprocessableError("transfer_graph_too_deep", {
+                i18nKey: "errors.tenantHandover.transferGraphTooDeep",
+                details: { entityName: strandedEntityName },
+            });
+        }
         pending = [...discovered].map(([entityName, rowIds]) => ({ entityName, rowIds }));
     }
-    // The depth limit is a safety net, not a licence to move part of a graph: if
-    // rounds ran out while rows remain whose type still leads somewhere, the
-    // declaration reaches further than the mover does, and returning quietly
-    // would leave exactly the orphaned rows #3088 is about.
-    //
-    // Rounds count hops of both edge kinds, while the boot validator measures
-    // reference chains between transferable entities only. A graph that fills the
-    // limit with reference hops and then adds a parentRef child therefore boots
-    // clean and fails here instead — the residual the validator cannot see, and
-    // the reason this check has to exist rather than trusting boot alone.
-    const stranded = pending.find(({ entityName }) => (adjacency.get(entityName) ?? []).length > 0);
-    if (stranded !== undefined) {
-        throw new UnprocessableError("transfer_graph_too_deep", {
-            i18nKey: "errors.tenantHandover.transferGraphTooDeep",
-            details: { entityName: stranded.entityName },
-        });
-    }
     return movedCounts;
 }

package/dist/tenant-lifecycle/feature.js

@@ -85,6 +85,7 @@ export function createTenantLifecycleFeature() {
                     now,
                     log: (message) => ctx.log?.warn(message),
                     fileProviderResolver: ctx._fileProviderResolver,
+                    searchAdapter: ctx.searchAdapter,
                     escapeHatchAuditSink: ctx._escapeHatchAuditSink,
                     actor: ctx.systemUser.id,
                 });

package/dist/tenant-lifecycle/run-tenant-destroy.d.ts

@@ -2,12 +2,14 @@
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type EscapeHatchAuditSink, type Registry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
+import type { SearchAdapter } from "@cosmicdrift/kumiko-framework/search";
 export declare function runNextDestructionStage(args: {
     readonly db: DbRunner;
     readonly registry: Registry;
     readonly tenantId: TenantId;
     readonly log?: (message: string) => void;
     readonly fileProviderResolver?: FileProviderResolver;
+    readonly searchAdapter?: SearchAdapter;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
     readonly actor?: string;
 }): Promise<{
@@ -23,6 +25,7 @@ export declare function runTenantDestructionSweep(args: {
     readonly now?: Temporal.Instant;
     readonly log?: (message: string) => void;
     readonly fileProviderResolver?: FileProviderResolver;
+    readonly searchAdapter?: SearchAdapter;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
     readonly actor?: string;
 }): Promise<{

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -133,6 +133,7 @@ export async function runNextDestructionStage(args) {
         tenantId: args.tenantId,
         log: args.log,
         fileProviderResolver: args.fileProviderResolver,
+        searchAdapter: args.searchAdapter,
         escapeHatchAuditSink: args.escapeHatchAuditSink,
         actor: args.actor,
     };
@@ -215,6 +216,7 @@ export async function runTenantDestructionSweep(args) {
                 tenantId: row.id,
                 log: args.log,
                 fileProviderResolver: args.fileProviderResolver,
+                searchAdapter: args.searchAdapter,
                 escapeHatchAuditSink: args.escapeHatchAuditSink,
                 actor: args.actor,
             });

package/dist/tenant-lifecycle/stages.d.ts

@@ -1,6 +1,7 @@
 import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { type EscapeHatchAuditSink, type Registry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
+import { type SearchAdapter } from "@cosmicdrift/kumiko-framework/search";
 import type { TenantDestructionStageName } from "./constants.js";
 export type DestructionStageCtx = {
     readonly db: DbRunner;
@@ -8,6 +9,7 @@ export type DestructionStageCtx = {
     readonly tenantId: TenantId;
     readonly log?: (message: string) => void;
     readonly fileProviderResolver?: FileProviderResolver;
+    readonly searchAdapter?: SearchAdapter;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
     readonly actor?: string;
 };

package/dist/tenant-lifecycle/stages.js

@@ -1,8 +1,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
+import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, extensionUsageEscapeHatchReason, isTenantDataExtensionHooks, isTenantResourceExtensionHooks, } from "@cosmicdrift/kumiko-framework/engine";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
+import { purgeSearchDocumentsForSubject, } from "@cosmicdrift/kumiko-framework/search";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantEntity, tenantMembershipEntity, tenantMembershipsTable, tenantTable, } from "../tenant/index.js";
 import { invalidateTenantLifecycleGate } from "./lifecycle-gate.js";
@@ -56,8 +57,10 @@ async function eraseSubjectKeys(ctx) {
     const memberships = await selectMany(ctx.db, tenantMembershipsTable, {
         tenantId: ctx.tenantId,
     });
+    const tenantRecordSubject = { kind: "record", entity: "tenant", id: ctx.tenantId };
     const subjects = [
         { kind: "tenant", tenantId: ctx.tenantId },
+        tenantRecordSubject,
         ...memberships.map((m) => ({ kind: "user", userId: m.userId })),
     ];
     for (const subject of subjects) {
@@ -66,6 +69,9 @@ async function eraseSubjectKeys(ctx) {
             eraseReason: "tenant-destroy stage subject-keys",
         });
     }
+    if (ctx.searchAdapter) {
+        await purgeSearchDocumentsForSubject(ctx.db, ctx.registry.features, ctx.searchAdapter, subjectIdToKey(tenantRecordSubject), tenantRecordSubject);
+    }
 }
 async function purgeTenantCache(ctx) {
     // ponytail: Redis SCAN+DEL is wired when ctx carries a redis client; until

package/dist/tier-engine/entity.d.ts

@@ -3,6 +3,7 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/tier-engine/index.d.ts

@@ -3,5 +3,6 @@ export { type AddOnDefinition, type AddOnMap, type ComposeAppInput, type Compose
 export { TIER_ENGINE_FEATURE, TierAssignmentSources, TierEngineHandlers, TierEngineQueries, } from "./constants.js";
 export { tierAssignmentEntity } from "./entity.js";
 export { type CreateTierEngineOptions, createTierEngineFeature, tierEngineFeature, } from "./feature.js";
+export { createTierOptionGate, type TierOptionAvailability, type TierOptionGate, type TierOptionGateDeps, type TierOptionSpec, } from "./tier-option-gate.js";
 export { createTierResolver, type TierResolver, type TierResolverDeps, } from "./tier-resolver.js";
 export { isTrialActive, type TrialPolicy } from "./trial.js";

package/dist/tier-engine/index.js

@@ -11,5 +11,6 @@ export { composeApp, } from "./compose-app.js";
 export { TIER_ENGINE_FEATURE, TierAssignmentSources, TierEngineHandlers, TierEngineQueries, } from "./constants.js";
 export { tierAssignmentEntity } from "./entity.js";
 export { createTierEngineFeature, tierEngineFeature, } from "./feature.js";
+export { createTierOptionGate, } from "./tier-option-gate.js";
 export { createTierResolver, } from "./tier-resolver.js";
 export { isTrialActive } from "./trial.js";

package/dist/tier-engine/tier-option-gate.d.ts

@@ -0,0 +1,32 @@
+import type { EntityTableMeta, SchemaTable, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { type CapGuardContext, type CapLimitContext } from "../cap-counter/index.js";
+export type TierOptionSpec<TCaps> = {
+    readonly field: string;
+    readonly options: readonly string[];
+    readonly isOptionAllowed: (option: string, caps: TCaps) => boolean;
+    readonly code: string;
+    readonly i18nKey: string;
+    /** Lets an update that resends the unchanged stored value of a no longer allowed
+     *  option pass (edit forms submit the whole row). Without it the stored value is not looked up. */
+    readonly table?: SchemaTable | EntityTableMeta;
+};
+export type TierOptionAvailability = {
+    readonly value: string;
+    readonly disabled: boolean;
+    readonly hint?: string;
+};
+export type TierOptionGateDeps<TTier extends string, TCaps> = {
+    /** Ascending: the first tier that allows an option is the one named as required. */
+    readonly tierOrder: readonly TTier[];
+    readonly capsForTier: (tier: TTier, context: CapLimitContext) => TCaps | Promise<TCaps>;
+    readonly resolveTier: (db: TenantDb) => Promise<TTier>;
+};
+export type TierOptionGate<TTier extends string, TCaps> = {
+    readonly optionAvailability: (db: TenantDb, context: CapLimitContext, spec: Pick<TierOptionSpec<TCaps>, "options" | "isOptionAllowed">, hintFor: (requiredTier: TTier) => string) => Promise<readonly TierOptionAvailability[]>;
+    /** `recordId` is the id of the edited row; with `spec.table` it enables the unchanged-value pass. */
+    readonly checkTierOption: (ctx: CapGuardContext, value: unknown, spec: TierOptionSpec<TCaps>, recordId?: string) => Promise<WriteFailure | null>;
+    readonly withTierOptionGate: (handler: WriteHandlerDef, spec: TierOptionSpec<TCaps>) => WriteHandlerDef;
+};
+export declare function createTierOptionGate<TTier extends string, TCaps>(deps: TierOptionGateDeps<TTier, TCaps>): TierOptionGate<TTier, TCaps>;

package/dist/tier-engine/tier-option-gate.js

@@ -0,0 +1,62 @@
+// Tier-gated options of a select field: one spec drives the availability query the
+// renderer shows (disabled option + "from <tier>" hint) and the write-path check that
+// actually enforces it, so the two cannot drift apart.
+import { UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { isPlainObject } from "@cosmicdrift/kumiko-framework/utils";
+import { readPayloadField, } from "../cap-counter/index.js";
+function limitContextOf(ctx) {
+    return ctx.config ? { config: ctx.config } : {};
+}
+function recordIdOf(payload) {
+    return isPlainObject(payload) && typeof payload["id"] === "string" ? payload["id"] : undefined;
+}
+export function createTierOptionGate(deps) {
+    async function capsPerTier(context) {
+        return Promise.all(deps.tierOrder.map(async (tier) => ({ tier, caps: await deps.capsForTier(tier, context) })));
+    }
+    async function optionAvailability(db, context, spec, hintFor) {
+        const currentCaps = await deps.capsForTier(await deps.resolveTier(db), context);
+        const tiers = await capsPerTier(context);
+        return spec.options.map((value) => {
+            if (spec.isOptionAllowed(value, currentCaps))
+                return { value, disabled: false };
+            const required = tiers.find(({ caps }) => spec.isOptionAllowed(value, caps));
+            return required === undefined
+                ? { value, disabled: true }
+                : { value, disabled: true, hint: hintFor(required.tier) };
+        });
+    }
+    async function storedValueMatches(ctx, spec, value, recordId) {
+        if (spec.table === undefined || recordId === undefined)
+            return false;
+        const stored = await ctx.db.fetchOne(spec.table, { id: recordId });
+        return stored?.[spec.field] === value;
+    }
+    async function checkTierOption(ctx, value, spec, recordId) {
+        // skip: an absent or non-string value is the schema's business, not a tier violation.
+        if (typeof value !== "string")
+            return null;
+        const context = limitContextOf(ctx);
+        const currentCaps = await deps.capsForTier(await deps.resolveTier(ctx.db), context);
+        if (spec.isOptionAllowed(value, currentCaps))
+            return null;
+        if (await storedValueMatches(ctx, spec, value, recordId))
+            return null;
+        const required = (await capsPerTier(context)).find(({ caps }) => spec.isOptionAllowed(value, caps));
+        return writeFailure(new UnprocessableError(spec.code, {
+            i18nKey: spec.i18nKey,
+            details: { field: spec.field, value, requiredTier: required?.tier },
+        }));
+    }
+    function withTierOptionGate(handler, spec) {
+        return {
+            ...handler,
+            handler: async (event, ctx) => {
+                const value = readPayloadField(event.payload, spec.field);
+                const failure = await checkTierOption(ctx, value, spec, recordIdOf(event.payload));
+                return failure ?? handler.handler(event, ctx);
+            },
+        };
+    }
+    return { optionAvailability, checkTierOption, withTierOptionGate };
+}

package/dist/tier-engine/tier-resolver.d.ts

@@ -11,6 +11,7 @@ export declare function createTierResolver<TTier extends string, TCaps>(deps: Ti
             readonly type: "text";
             readonly description?: string;
             readonly maxLength?: number;
+            readonly minLength?: number;
             readonly required?: boolean;
             readonly searchable?: boolean;
             readonly sortable?: boolean;
@@ -32,6 +33,7 @@ export declare function createTierResolver<TTier extends string, TCaps>(deps: Ti
             readonly type: "text";
             readonly description?: string;
             readonly maxLength?: number;
+            readonly minLength?: number;
             readonly required?: boolean;
             readonly searchable?: boolean;
             readonly sortable?: boolean;

package/dist/user/handlers/list.query.js

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineEntityListHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 // kumiko-lint-ignore cross-feature-import SystemAdmin user-list joins memberships for tenants column
-import { tenantMembershipsTable, tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantMembershipsTable, tenantTable } from "../../tenant/index.js";
 import { userEntity } from "../schema/user.js";
 const baseList = defineEntityListHandler("user", userEntity, {
     access: { roles: access.systemAdmin },
@@ -59,7 +59,7 @@ export async function attachTenantLabels(rows, db) {
         ...new Set(memberships.map((m) => String(m.tenantId ?? "")).filter((id) => id !== "")),
     ];
     const tenants = tenantIds.length > 0
-        ? await selectMany(db, tenantTable, { id: { in: tenantIds } })
+        ? await decryptTenantNames(await selectMany(db, tenantTable, { id: { in: tenantIds } }), "user:list")
         : [];
     const byUser = labelsByUserId(memberships, tenantLabelById(tenants));
     return rows.map((row) => {

package/dist/user/schema/user.d.ts

@@ -32,6 +32,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -53,6 +54,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -74,6 +76,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -95,6 +98,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -125,6 +129,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -158,13 +163,14 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly active?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly deleted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly deletionRequested?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly restricted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly active?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly deleted?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly deletionRequested?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly restricted?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -187,6 +193,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -210,6 +217,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -231,6 +239,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -252,6 +261,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -273,6 +283,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -303,6 +314,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -336,13 +348,14 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly active?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly deleted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly deletionRequested?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly restricted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly active?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly deleted?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly deletionRequested?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly restricted?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -365,6 +378,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/user-data-rights/boot-checks.js

@@ -20,6 +20,11 @@ export function validateGdprHookCompleteness(features) {
                 continue;
             const hasExport = typeof usage.options?.["export"] === "function";
             const hasDelete = typeof usage.options?.["delete"] === "function";
+            // The compile-time "at least one hook" type is bypassed by string-typed
+            // extension names and casts; without this an empty bag registers nothing.
+            if (!hasExport && !hasDelete) {
+                throw new Error(`[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`);
+            }
             if (hasExport && !hasDelete) {
                 throw new Error(`[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`);
             }

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.js

@@ -28,7 +28,7 @@ async function readPendingDeletionRequestId(ctx, userId) {
 }
 // Anonymous apex flow step 2: verify-link target. Verifies the HMAC token,
 // extracts the userId, and flips the grace period through the shared logic —
-// in ONE atomic step with the anchor spend (#3024): commitDeletion carries
+// in ONE atomic step with the anchor spend: commitDeletion carries
 // the actual grace-period transition, so a crash after the spend can no
 // longer lose the write step.
 //
@@ -38,7 +38,7 @@ async function readPendingDeletionRequestId(ctx, userId) {
 // a cancel-deletion (status → Active, pendingDeletionRequestId → null), a
 // replayed token fails against the nulled/renewed requestId — no re-arm.
 //
-// Concurrency (#3024): two simultaneous confirms of the same token both read
+// Concurrency: two simultaneous confirms of the same token both read
 // the same requestId and both verify the HMAC — commitDeletion spends the
 // anchor AND writes the transition atomically (expect: status===Active &&
 // pendingDeletionRequestId===requestId), so exactly one wins. The loser gets