@cosmicdrift/kumiko-bundled-features 0.352.0 → 0.353.0

package/dist/agent-tools/agent-manifest.js

@@ -1,6 +1,7 @@
 import { hasAccess, isAgentVisibleScreen, resolveAgentExposure, SYSTEM_ONLY_JSON_SCHEMA_KEY, } from "@cosmicdrift/kumiko-framework/engine";
 import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-types";
 import * as z from "zod";
+import { recordManifestDenyQns } from "./manifest-deny-qns.js";
 /** The manifest surfaces one string per locale — a plural entry reads as its
  *  CLDR `other` form since the manifest has no `count` to select a category. */
 function entryAsLabels(entry) {
@@ -232,6 +233,9 @@ function lastSegment(qualifiedId) {
 function detailIdParam(screen) {
     return screen.type === "projectionDetail" ? (screen.idParam ?? "id") : "id";
 }
+function screenTitles(translations, screenId, shortId) {
+    return entryAsLabels(translations[`${screenId}.title`] ?? translations[`screen:${shortId}.title`] ?? {});
+}
 function buildScreens(screens, navs, workspaces, translations, roles, visibleNavIds) {
     const allNavs = [...navs.values()];
     const result = [];
@@ -257,7 +261,7 @@ function buildScreens(screens, navs, workspaces, translations, roles, visibleNav
         result.push({
             id: screen.id,
             type: screen.type,
-            titles: labelsForSuffix(translations, `screen:${shortId}.title`),
+            titles: screenTitles(translations, screen.id, shortId),
             // `screen.description` may be a raw i18n key (`registry.getAllTranslations()`
             // double-prefixes it, see build-app-schema.ts:77-81) — match on suffix like
             // `labelsForSuffix` does for entity/field labels, else fall back to the
@@ -304,7 +308,7 @@ export function buildAgentManifest(registry, options) {
     const navs = buildNavs(navMap, workspaceMap, translations, roles, screenMap);
     const screens = buildScreens(screenMap, navMap, workspaceMap, translations, roles, new Set(navs.map((nav) => nav.id)));
     const workspaces = buildWorkspaces(workspaceMap, translations, roles);
-    return {
+    const manifest = {
         builtForRoles: [...roles],
         features: sortedByKey(features, (f) => f.name),
         entities: sortedByKey(entities, (e) => e.name),
@@ -317,4 +321,6 @@ export function buildAgentManifest(registry, options) {
             ...(options.currency && { currency: options.currency }),
         },
     };
+    recordManifestDenyQns(manifest, new Set(options.denyQns ?? []));
+    return manifest;
 }

package/dist/agent-tools/manifest-deny-qns.d.ts

@@ -0,0 +1,3 @@
+import type { AgentManifest } from "./types.js";
+export declare function recordManifestDenyQns(manifest: AgentManifest, denyQns: ReadonlySet<string>): void;
+export declare function assertCatalogMirrorsManifestDenyQns(manifest: AgentManifest, catalogDenyQns: ReadonlySet<string>): void;

package/dist/agent-tools/manifest-deny-qns.js

@@ -0,0 +1,17 @@
+// The deny list is deliberately not a manifest field (the manifest is prompt
+// payload), so the catalog builder learns it through this side channel to
+// detect a manifest cut that the catalog would silently not mirror.
+const denyQnsByManifest = new WeakMap();
+export function recordManifestDenyQns(manifest, denyQns) {
+    denyQnsByManifest.set(manifest, denyQns);
+}
+export function assertCatalogMirrorsManifestDenyQns(manifest, catalogDenyQns) {
+    const manifestDenyQns = denyQnsByManifest.get(manifest);
+    // skip: manifest has no registered deny list, nothing to mirror
+    if (!manifestDenyQns)
+        return;
+    const missing = [...manifestDenyQns].filter((qn) => !catalogDenyQns.has(qn));
+    if (missing.length > 0) {
+        throw new Error(`agent denyQns passed to buildAgentManifest but not to buildToolCatalog: ${missing.join(", ")} — the catalog would still expose their entity CRUD tools`);
+    }
+}

package/dist/agent-tools/tool-catalog.d.ts

@@ -24,5 +24,6 @@ export declare const OPEN_FORM_TOOL_NAME = "open_form";
  *  to drop an entity CRUD tool, which no `agent.expose` on the manifest side can reach. It is
  *  NOT read off the manifest on purpose — the manifest is prompt payload, and a list of the
  *  handlers the model may not call has no business travelling to the provider. Pass the same
- *  list to `buildAgentManifest` so the manifest stops describing what the catalog withholds. */
+ *  list to `buildAgentManifest` so the manifest stops describing what the catalog withholds;
+ *  a manifest built with `denyQns` that the catalog lacks throws. */
 export declare function buildToolCatalog(registry: RegistrySearchView, manifest: AgentManifest, options: ToolCatalogOptions): ToolCatalog;

package/dist/agent-tools/tool-catalog.js

@@ -1,5 +1,6 @@
 import { hasAccess, normalizeAccessEntry } from "@cosmicdrift/kumiko-framework/engine";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
+import { assertCatalogMirrorsManifestDenyQns } from "./manifest-deny-qns.js";
 const MAX_TOOL_NAME_LENGTH = 64;
 /** Field types that declare `filterable` (per `packages/framework/src/engine/types/fields.ts`).
  *  Mapped to the JSON-Schema type an LLM tool-call argument should use. `undefined` = field type
@@ -466,13 +467,15 @@ function addClientTools(manifest, mode, sink) {
  *  to drop an entity CRUD tool, which no `agent.expose` on the manifest side can reach. It is
  *  NOT read off the manifest on purpose — the manifest is prompt payload, and a list of the
  *  handlers the model may not call has no business travelling to the provider. Pass the same
- *  list to `buildAgentManifest` so the manifest stops describing what the catalog withholds. */
+ *  list to `buildAgentManifest` so the manifest stops describing what the catalog withholds;
+ *  a manifest built with `denyQns` that the catalog lacks throws. */
 export function buildToolCatalog(registry, manifest, options) {
     const sink = { tools: [], dispatchTable: new Map(), usedNames: new Set() };
     const roleFilter = { roles: manifest.builtForRoles };
     const locale = manifest.tenantSettings.locale;
     const entityByName = new Map(manifest.entities.map((entity) => [entity.name, entity]));
     const denyQns = new Set(options.denyQns ?? []);
+    assertCatalogMirrorsManifestDenyQns(manifest, denyQns);
     addRegistrySearchTools(registry, roleFilter, denyQns, sink);
     const { detailQnByEntity, listQnByEntity, entityListDetailQns } = collectEntityHandlerQns(registry, roleFilter, denyQns);
     addGetTools(registry, detailQnByEntity, entityByName, locale, sink);

package/dist/audit/handlers/list.query.js

@@ -34,7 +34,7 @@ function buildDateRange(from, to) {
 function escapeLikePattern(value) {
     return value.replace(/[\\%_]/g, (m) => `\\${m}`);
 }
-function buildAuditWhere(tenantId, p) {
+function buildAuditWhere(tenantId, p, direction) {
     const where = { tenantId };
     if (p.aggregateType)
         where["aggregateType"] = p.aggregateType;
@@ -50,8 +50,10 @@ function buildAuditWhere(tenantId, p) {
     if (range)
         where["createdAt"] = range;
     const cursor = p.cursor ?? p.before;
+    // The cursor is an event id, so it only walks pages in id order: ascending
+    // pages continue past it, descending pages stop before it.
     if (cursor)
-        where["id"] = { lt: BigInt(cursor) };
+        where["id"] = direction === "asc" ? { gt: BigInt(cursor) } : { lt: BigInt(cursor) };
     return where;
 }
 export const listQuery = defineQueryHandler({
@@ -81,15 +83,17 @@ export const listQuery = defineQueryHandler({
     handler: async (query, ctx) => {
         const p = query.payload;
         const scopeFilter = resolveAuditScopeFilter(query.user, p.scope);
+        const direction = p.sortDirection ?? "desc";
         const where = buildAuditWhere(scopeFilter.tenantId, {
             ...p,
             aggregateType: scopeFilter.aggregateType ?? p.aggregateType,
-        });
+        }, direction);
         const rows = await selectMany(ctx.db, eventsTable, where, {
-            orderBy: {
-                col: query.payload.sort === "type" ? "type" : "createdAt",
-                direction: query.payload.sortDirection ?? "desc",
-            },
+            // `id` as tie-breaker keeps the order total, so pages never overlap.
+            orderBy: [
+                { col: p.sort === "type" ? "type" : "createdAt", direction },
+                { col: "id", direction },
+            ],
             limit: p.limit,
         });
         const serialised = rows.map((r) => ({
@@ -104,7 +108,8 @@ export const listQuery = defineQueryHandler({
             createdBy: r.createdBy,
         }));
         const last = serialised[serialised.length - 1];
-        const nextId = serialised.length === p.limit && last ? last.id : null;
+        // An id cursor cannot resume a type-ordered listing, so that sort is one page.
+        const nextId = serialised.length === p.limit && last && p.sort !== "type" ? last.id : null;
         return {
             rows: serialised,
             nextCursor: nextId,

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -124,9 +124,8 @@ export function createSignupConfirmHandler(opts = {}) {
                         displayName,
                         tenantId,
                         tenantKey,
-                        // Tenant-Display-Name als Default = Email. User wechselt das im
-                        // Settings-Screen. Konzept "Tenant" leakt nicht in die Signup-UI.
-                        tenantName: email,
+                        // Generated slug as default name: no personal data (the email) in the tenant name.
+                        tenantName: tenantKey,
                     }, 
                     // #1463: seedTenant's postSave hooks (tier-engine's auto-default-
                     // tier, an app's auto-default-compliance) must fire on self-signup

package/dist/auth-mfa/schema/user-mfa.d.ts

@@ -3,6 +3,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -45,6 +47,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -98,6 +101,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -119,6 +123,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -140,6 +145,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/auth-mfa/screens.js

@@ -47,7 +47,7 @@ export const mfaEnableScreen = {
     confirm: {
         handler: AuthMfaHandlers.enableConfirm,
         fields: {
-            code: { type: "text", required: true, maxLength: 6 },
+            code: { type: "text", required: true, minLength: 6, maxLength: 6 },
         },
         layout: { sections: [{ fields: ["code"] }] },
         carry: ["setupToken"],
@@ -57,7 +57,7 @@ export const mfaEnableScreen = {
 };
 // Either a 6-digit TOTP code or a 9-char recovery code proves possession —
 // same bounds as the disable/regenerate-recovery handler schemas.
-const possessionCodeField = { type: "text", required: true, maxLength: 9 };
+const possessionCodeField = { type: "text", required: true, minLength: 6, maxLength: 9 };
 export const mfaDisableScreen = {
     id: MFA_DISABLE_SCREEN_ID,
     type: "actionForm",

package/dist/billing-foundation/checkout-core.d.ts

@@ -80,6 +80,13 @@ export type OpenCheckoutOptions = {
     readonly baseUrl?: string;
     readonly catalog?: BillingPlanCatalog;
     readonly now: () => Temporal.Instant;
+    /** The caller already ran `assertBillingEnabled` under its own handler name
+     *  (before a costly provider lookup), so the gate is not repeated here. */
+    readonly billingEnabledChecked?: boolean;
+    /** The caller already ran `assertNoActiveSubscription` and passes its result
+     *  (null = tenant has none); mode:"subscription" skips the second read and
+     *  the providerCustomerId check reuses it. */
+    readonly checkedSubscription?: Awaited<ReturnType<typeof getSubscriptionForTenant>>;
 };
 export type OpenCheckoutInput = {
     readonly providerName: string;

package/dist/billing-foundation/checkout-core.js

@@ -249,7 +249,9 @@ export async function assertCheckoutAllowed(ctx, options, input) {
     // Checked before the redirect-origin hardening for every mode — a
     // disabled provider must reject a mode:"payment" checkout just as much
     // as a mode:"subscription" one.
-    await assertBillingEnabled(ctx, plugin, "create-checkout-session");
+    if (options.billingEnabledChecked !== true) {
+        await assertBillingEnabled(ctx, plugin, "create-checkout-session");
+    }
     assertRedirectOrigins([input.successUrl, input.cancelUrl], options.baseUrl);
     const mode = input.mode ?? "subscription";
     // Reused by the providerCustomerId check below to avoid a second lookup
@@ -257,7 +259,10 @@ export async function assertCheckoutAllowed(ctx, options, input) {
     let ownSubscription;
     if (mode === "subscription") {
         assertSubscriptionPriceAllowed(plugin, options.catalog, input);
-        ownSubscription = await assertNoActiveSubscription(ctx, options.now());
+        ownSubscription =
+            options.checkedSubscription !== undefined
+                ? options.checkedSubscription
+                : await assertNoActiveSubscription(ctx, options.now());
     }
     else {
         assertOneOffPriceAllowed(plugin, input);

package/dist/billing-foundation/entities.d.ts

@@ -3,6 +3,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -45,6 +47,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -66,6 +69,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -87,6 +91,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -141,6 +146,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -162,6 +168,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -183,6 +190,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/billing-foundation/handlers/start-plan-checkout.write.js

@@ -40,7 +40,13 @@ export function createStartPlanCheckoutHandler(options, catalog) {
                 ? await prepareConsent(ctx, consumerProtection, payload.consent, "subscription")
                 : undefined;
             const baseUrl = options.baseUrl ?? "";
-            const result = await openCheckout(ctx, { baseUrl: options.baseUrl, catalog, now: options.now }, {
+            const result = await openCheckout(ctx, {
+                baseUrl: options.baseUrl,
+                catalog,
+                now: options.now,
+                billingEnabledChecked: true,
+                checkedSubscription: existing,
+            }, {
                 providerName,
                 priceId: resolved.priceId,
                 successUrl: joinBaseUrl(baseUrl, catalog.successPath),

package/dist/billing-foundation/projection.d.ts

@@ -3,6 +3,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -45,6 +47,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -66,6 +69,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -87,6 +91,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -140,6 +145,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -161,6 +167,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -182,6 +189,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/cap-counter/entity.d.ts

@@ -3,6 +3,7 @@ export declare const capCounterEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/cap-overview/access.js

@@ -1,4 +1,4 @@
-import { access } from "@cosmicdrift/kumiko-framework/engine";
+import { access, BUILT_IN_MEMBERSHIP_ROLES } from "@cosmicdrift/kumiko-framework/engine";
 // Usage numbers are an operator concern by default; wider visibility is an
 // explicit `usageVisibleTo` opt-in on createCapOverviewFeature. The my-caps
 // screen and the query that fills its cards must carry the SAME rule, or the
@@ -7,14 +7,7 @@ export const DEFAULT_CAP_USAGE_ROLES = access.roles(...access.admin);
 // Roles the engine itself knows (role-assignment.ts ranks). App-declared roles
 // (assignableRole) only exist once the registry is composed, which is after
 // this feature is defined, so they cannot be validated here.
-const BUILT_IN_USAGE_VISIBLE_ROLES = new Set([
-    "User",
-    "Member",
-    "Editor",
-    "Admin",
-    "TenantAdmin",
-    "SystemAdmin",
-]);
+const BUILT_IN_USAGE_VISIBLE_ROLES = new Set(BUILT_IN_MEMBERSHIP_ROLES);
 export function resolveCapUsageRoles(usageVisibleTo) {
     if (usageVisibleTo === undefined)
         return DEFAULT_CAP_USAGE_ROLES;

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -4,7 +4,7 @@ import { definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-fr
 import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { subscriptionsProjectionTable } from "../../billing-foundation/index.js";
-import { tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
 import { tierAssignmentEntity } from "../../tier-engine/index.js";
 import { capFieldName } from "../constants.js";
 import { computeFraction } from "../usage-math.js";
@@ -115,7 +115,7 @@ export function createTenantCapsListQuery(caps, listCaps) {
                 });
             }
             const db = ctx.systemDb.acknowledgeCrossTenant("cap-overview:tenant-caps:list — SystemAdmin platform-wide tenant overview");
-            const tenants = await selectMany(db, tenantTable, {});
+            const tenants = await decryptTenantNames(await selectMany(db, tenantTable, {}), "cap-overview:tenant-caps:list");
             const assignments = await selectMany(db, tierAssignmentTable, {});
             const subscriptions = await selectMany(db, subscriptionsProjectionTable, {});
             const assignmentByTenant = new Map(assignments.map((row) => [row.tenantId, row]));

package/dist/cap-overview/handlers/tenant-options.query.js

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
 export const tenantOptionsQuery = defineQueryHandler({
     name: "tenant-options",
     description: "Returns all tenants as id/name option pairs sorted by name; use it to populate the tenant picker of a platform-wide overview.",
@@ -15,9 +15,8 @@ export const tenantOptionsQuery = defineQueryHandler({
             });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("cap-overview:tenant-options — SystemAdmin dashboard tenant-filter options");
-        const tenants = await selectMany(db, tenantTable, {}, {
-            orderBy: { col: "name", direction: "asc" },
-        });
-        return { rows: tenants.map((tenant) => ({ value: tenant.id, label: tenant.name })) };
+        const tenants = await decryptTenantNames(await selectMany(db, tenantTable, {}), "cap-overview:tenant-options");
+        const sorted = [...tenants].sort((a, b) => a.name.localeCompare(b.name));
+        return { rows: sorted.map((tenant) => ({ value: tenant.id, label: tenant.name })) };
     },
 });

package/dist/compliance-profiles/schema/profile-selection.d.ts

@@ -11,10 +11,10 @@ export declare const tenantComplianceProfileEntity: import("@cosmicdrift/kumiko-
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly "de-hr-dsgvo-hgb"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly "eu-dsgvo"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly "minimal-no-region"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly "swiss-dsg"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly "de-hr-dsgvo-hgb"?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly "eu-dsgvo"?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly "minimal-no-region"?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly "swiss-dsg"?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
@@ -52,10 +52,10 @@ export declare const tenantComplianceProfileTable: import("@cosmicdrift/kumiko-f
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly "de-hr-dsgvo-hgb"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly "eu-dsgvo"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly "minimal-no-region"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly "swiss-dsg"?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly "de-hr-dsgvo-hgb"?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly "eu-dsgvo"?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly "minimal-no-region"?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly "swiss-dsg"?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;

package/dist/compliance-profiles-ops/handlers/tenants-missing-profile.query.js

@@ -3,7 +3,7 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { tenantComplianceProfileTable } from "../../compliance-profiles/index.js";
-import { tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
 // SystemAdmin platform-wide counterpart to needs-profile (#2089).
 //
 // #2084 stopped needs-profile from nagging a TenantAdmin who can no longer
@@ -28,9 +28,7 @@ export const tenantsMissingProfileQuery = defineQueryHandler({
             });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("platform operator scans every tenant for a missing compliance-profile selection");
-        const tenants = await db.selectMany(tenantTable, {
-            isEnabled: true,
-        });
+        const tenants = await decryptTenantNames(await db.selectMany(tenantTable, { isEnabled: true }), "compliance-profiles-ops:tenants-missing-profile");
         const profileRows = await db.selectMany(tenantComplianceProfileTable, {});
         const tenantIdsWithProfile = new Set(profileRows.map((row) => row.tenantId));
         return {

package/dist/config/handlers/values.query.d.ts

@@ -1,6 +1,8 @@
 import { type ConfigScope, type ConfigValueSource } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-export declare const valuesQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"values", z.ZodObject<{}, z.core.$strip>, Record<string, {
+export declare const valuesQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"values", z.ZodObject<{
+    keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, Record<string, {
     value: string | number | boolean | undefined;
     scope: ConfigScope;
     source: ConfigValueSource;

package/dist/config/handlers/values.query.js

@@ -5,8 +5,10 @@ import { MASKED, redactInheritedCascade, shouldRedactInherited } from "../read-r
 import { hasConfigAccess } from "../write-helpers.js";
 export const valuesQuery = defineQueryHandler({
     name: "values",
-    description: "Returns the effective value, scope and winning source for every config key the caller may read, with encrypted and secret-backed values masked; use it to inspect the current settings.",
-    schema: z.object({}),
+    description: "Returns the effective value, scope and winning source for every config key the caller may read (optionally narrowed to `keys`), with encrypted and secret-backed values masked; use it to inspect the current settings.",
+    schema: z.object({
+        keys: z.array(z.string()).optional(),
+    }),
     // Per-key read access enforced via hasConfigAccess inside the handler.
     access: {
         openToAll: {
@@ -26,7 +28,10 @@ export const valuesQuery = defineQueryHandler({
         const allKeys = registry.getAllConfigKeys();
         const keyDefs = new Map();
         const filteredKeys = [];
+        const requestedKeys = query.payload.keys === undefined ? undefined : new Set(query.payload.keys);
         for (const [qualifiedKey, keyDef] of allKeys) {
+            if (requestedKeys !== undefined && !requestedKeys.has(qualifiedKey))
+                continue;
             if (!hasConfigAccess(keyDef.access.read, query.user.roles))
                 continue;
             keyDefs.set(qualifiedKey, keyDef);

package/dist/config/table.d.ts

@@ -3,6 +3,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -45,6 +47,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -68,6 +71,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -89,6 +93,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -110,6 +115,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;