@cosmicdrift/kumiko-bundled-features 0.352.0 → 0.354.0

package/dist/tenant/handlers/tenant-directory.query.js

@@ -2,6 +2,7 @@ import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { decryptTenantNames } from "../decrypt-tenant-names.js";
 import { tenantTable } from "../schema/tenant.js";
 import { isSystemAdmin } from "./is-system-admin.js";
 // Label source behind every `tenant:tenant` reference column (fw#3142). The
@@ -38,7 +39,7 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
             tenants = await selectMany(db, tenantTable, undefined, {
                 limit: scanLimit,
                 orderBy: [
-                    { col: "name", direction: "asc" },
+                    { col: "key", direction: "asc" },
                     { col: "id", direction: "asc" },
                 ],
             });
@@ -48,10 +49,15 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
             const row = await fetchOne(db, tenantTable, { id: query.user.tenantId });
             tenants = row ? [row] : [];
         }
-        const labeled = tenants.map((tenant) => {
+        // name is ciphertext at rest, so the SQL page is keyed by the plaintext
+        // `key`; label order and search happen in memory after decrypting.
+        const decrypted = await decryptTenantNames(tenants, "tenant:tenant-directory");
+        const labeled = decrypted
+            .map((tenant) => {
             const id = String(tenant.id);
             return { id, label: typeof tenant.name === "string" ? tenant.name : id };
-        });
+        })
+            .sort((a, b) => a.label.localeCompare(b.label) || a.id.localeCompare(b.id));
         const needle = search?.toLowerCase();
         const rows = needle === undefined
             ? labeled

package/dist/tenant/handlers/toggle-enabled.write.js

@@ -12,6 +12,8 @@ function createToggleTenantHandler(enable) {
         name: verbName,
         schema: z.object({ id: z.uuid() }),
         access: { roles: ["SystemAdmin"] },
+        // Disabling locks every member out; enabling is its undo.
+        ...(enable ? {} : { agent: { risk: "high" } }),
         description: enable
             ? "Re-enables a disabled tenant so its members can sign in and switch to it again; this is the undo for tenant:write:disable."
             : "Marks a tenant disabled so it stops counting as a membership — its members can no longer sign in to it or switch to it — while leaving all of its data in place.",

package/dist/tenant/handlers/update-member-roles.write.js

@@ -41,6 +41,7 @@ export const updateMemberRolesWrite = defineWriteHandler({
     // are session-scoped (event.user.tenantId).
     access: { roles: ["system", ...access.admin] },
     description: "Sets the roles a user holds in a tenant, rejecting reserved role names and any grant that would raise the target above the caller; roles the caller could not grant (platform roles such as DataProtectionOfficer or TenantOwner, undeclared or higher-tier app roles) are kept, only the system user replaces the full list; admins act on their own tenant, SystemAdmins on any.",
+    agent: { risk: "high" },
     handler: async (event, ctx) => {
         if (!ctx.systemDb) {
             throw new InternalError({

package/dist/tenant/index.d.ts

@@ -1,6 +1,7 @@
 export { cancelPendingInvitation } from "./cancel-pending-invitation.js";
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
+export { decryptTenantNames } from "./decrypt-tenant-names.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export type { InvitationStatus } from "./invitation-table.js";
 export { INVITATION_STATUS, INVITATION_STATUSES, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";

package/dist/tenant/index.js

@@ -1,6 +1,7 @@
 export { cancelPendingInvitation } from "./cancel-pending-invitation.js";
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
+export { decryptTenantNames } from "./decrypt-tenant-names.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export { INVITATION_STATUS, INVITATION_STATUSES, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";
 export { isTenantServingPublicContent } from "./is-tenant-serving-public-content.js";

package/dist/tenant/invitation-table.d.ts

@@ -11,6 +11,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -32,6 +33,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -62,14 +64,15 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly accepted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly cancelled?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly expired?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly accepted?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly cancelled?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly expired?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly pending?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"accepted" | "cancelled" | "expired" | "pending">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -77,6 +80,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -94,6 +98,25 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
+    membershipVersion: {
+        readonly type: "number";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly default?: number;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly min?: number;
+        readonly max?: number;
+        readonly integer?: boolean;
+        readonly unit?: string | {
+            readonly field: string;
+        };
+        readonly grouping?: boolean;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
     expiresAt: {
         readonly type: "timestamp";
         readonly description?: string;
@@ -115,6 +138,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -136,6 +160,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -166,14 +191,15 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly accepted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly cancelled?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly expired?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly accepted?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly cancelled?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly expired?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly pending?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"accepted" | "cancelled" | "expired" | "pending">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -181,6 +207,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -198,6 +225,25 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
+    membershipVersion: {
+        readonly type: "number";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly default?: number;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly min?: number;
+        readonly max?: number;
+        readonly integer?: boolean;
+        readonly unit?: string | {
+            readonly field: string;
+        };
+        readonly grouping?: boolean;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
     expiresAt: {
         readonly type: "timestamp";
         readonly description?: string;

package/dist/tenant/invitation-table.js

@@ -22,7 +22,7 @@
 // pending → re-use existing row + refresh Redis-token + send mail
 // (analog zu signup-Resend).
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
-import { createEntity, createMultiSelectField, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+import { createEntity, createMultiSelectField, createNumberField, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
 // kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
 import { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
 // Status-const-Object damit Handler-Code keine Magic-Strings nutzt.
@@ -83,6 +83,11 @@ export const tenantInvitationEntity = createEntity({
             personal: { of: "invitedBy" },
             find: "exact",
         }),
+        // Version of the invitee's membership row when the invitation was issued
+        // (0 = no membership yet). Accept compares it against the current version
+        // to detect a membership decision made after the invite. NULL only on rows
+        // issued before this field existed.
+        membershipVersion: createNumberField({ integer: true, min: 0 }),
         // UI-Anzeige — Wahrheit liegt in Redis-TTL.
         expiresAt: createTimestampField({ required: true }),
     },

package/dist/tenant/invited-membership.d.ts

@@ -1,12 +1,18 @@
-import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { type DbRunner, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 export type InvitedMembershipOptions = {
     readonly userId: string;
     readonly tenantId: TenantId;
     readonly role: string;
-    readonly invitationIssuedAt: Temporal.Instant;
+    readonly invitation: InvitationIssuance;
 };
+export type InvitationIssuance = {
+    readonly membershipVersion: number | null;
+    readonly insertedAt: Temporal.Instant;
+    readonly modifiedAt: Temporal.Instant | null;
+};
+export declare function membershipVersionOf(db: Pick<TenantDb, "fetchOne">, tenantId: string, userId: string): Promise<number>;
 export declare function grantInvitedMembershipRole(db: DbRunner, options: InvitedMembershipOptions): Promise<import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure | {
     readonly isSuccess: true;
     readonly data: {
@@ -14,7 +20,3 @@ export declare function grantInvitedMembershipRole(db: DbRunner, options: Invite
         readonly roles: readonly string[];
     };
 }>;
-export declare function invitationIssuedAt(invitation: {
-    readonly insertedAt: Temporal.Instant;
-    readonly modifiedAt: Temporal.Instant | null;
-}): Temporal.Instant;

package/dist/tenant/invited-membership.js

@@ -9,6 +9,15 @@ import { findForbiddenMembershipRole, reservedMembershipRoleError } from "./memb
 import { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table.js";
 import { seedTenantMembership } from "./seeding.js";
 const membershipExecutor = createEventStoreExecutor(tenantMembershipsTable, tenantMembershipEntity, { entityName: "tenant-membership" });
+const MEMBERSHIP_CREATED_VERSION = 1;
+// 0 = the user has no membership in the tenant yet.
+export async function membershipVersionOf(db, tenantId, userId) {
+    const membership = await db.fetchOne(tenantMembershipsTable, {
+        tenantId,
+        userId,
+    });
+    return membership?.version ?? 0;
+}
 // Add-only, so unlike updateMemberRoles no session revoke or last-TenantAdmin check.
 // Read unfiltered: tenant:query:memberships hides disabled tenants.
 export async function grantInvitedMembershipRole(db, options) {
@@ -28,7 +37,7 @@ export async function grantInvitedMembershipRole(db, options) {
         return grantedMembership(false, [options.role]);
     }
     // A membership decision made after the invitation was issued wins over it.
-    if (isMembershipChangedAfter(existing, options.invitationIssuedAt)) {
+    if (isSupersededByMembership(existing, options.invitation)) {
         return writeFailure(invitationSupersededError());
     }
     const currentRoles = parseRoles(existing.roles);
@@ -40,13 +49,25 @@ export async function grantInvitedMembershipRole(db, options) {
         return updateResult;
     return grantedMembership(true, roles);
 }
-// Resend reuses the invitation row, so its last modification is the latest issuance.
-export function invitationIssuedAt(invitation) {
-    return invitation.modifiedAt ?? invitation.insertedAt;
-}
-function isMembershipChangedAfter(membership, instant) {
+// The pinned version is the membership's version when the invitation was issued
+// (0 = none yet). A different version now means the membership was decided after
+// the invite. Pin 0: a membership that appeared afterwards is an additive grant
+// only while it is untouched since its creation (version 1). A role change bumps
+// the version above 1 and counts as a decision. A removal in between hard-deletes
+// the row and cancels the invitation (remove-member), so it never reaches this check.
+// Rows issued before the pin existed (null) fall back to wall-clock timestamps,
+// which can misjudge changes within the same millisecond but is all they carry.
+function isSupersededByMembership(membership, invitation) {
+    if (invitation.membershipVersion !== null) {
+        if (invitation.membershipVersion === 0) {
+            return membership.version > MEMBERSHIP_CREATED_VERSION;
+        }
+        return membership.version !== invitation.membershipVersion;
+    }
+    // Resend reuses the invitation row, so its last modification is the latest issuance.
+    const issuedAt = invitation.modifiedAt ?? invitation.insertedAt;
     const lastChangedAt = membership.modifiedAt ?? membership.insertedAt;
-    return Temporal.Instant.compare(lastChangedAt, instant) > 0;
+    return Temporal.Instant.compare(lastChangedAt, issuedAt) > 0;
 }
 function invitationSupersededError() {
     return new ConflictError({

package/dist/tenant/membership-table.d.ts

@@ -3,6 +3,7 @@ export declare const tenantMembershipEntity: import("@cosmicdrift/kumiko-types/f
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const tenantMembershipEntity: import("@cosmicdrift/kumiko-types/f
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -47,6 +49,7 @@ export declare const tenantMembershipsTable: import("@cosmicdrift/kumiko-framewo
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -68,6 +71,7 @@ export declare const tenantMembershipsTable: import("@cosmicdrift/kumiko-framewo
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/tenant/schema/tenant.d.ts

@@ -5,6 +5,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -58,15 +60,16 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly active?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyFailed?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyRequested?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyed?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroying?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly active?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyFailed?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyRequested?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyed?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroying?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"active" | "destroyFailed" | "destroyRequested" | "destroyed" | "destroying">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -89,6 +92,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -157,6 +161,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -178,6 +183,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -210,15 +216,16 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly active?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyFailed?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyRequested?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroyed?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly destroying?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly active?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyFailed?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyRequested?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroyed?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly destroying?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"active" | "destroyFailed" | "destroyRequested" | "destroyed" | "destroying">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -241,6 +248,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/tenant/schema/tenant.js

@@ -17,19 +17,17 @@ export const tenantEntity = createEntity({
         key: createTextField({
             required: true,
             maxLength: 50,
+            sortable: true,
             personal: false,
             reason: "technical_reference",
         }),
-        // Workspace/company display name, not an individual's identity —
-        // same class as the `company.legalName` example in the boot-validator's
-        // own PII-heuristic doc-comment.
+        // Subject is the tenant record itself: tenant events live in the writer's (system) tenant stream, so `personal: "tenant"` would not resolve to this tenant.
         name: createTextField({
             required: true,
             maxLength: 200,
             searchable: true,
-            sortable: true,
-            personal: false,
-            reason: "is_business_data",
+            personal: { of: "id" },
+            find: "none",
         }),
         isEnabled: createBooleanField({ default: true, filterable: true }),
         // Tenant-destroy lifecycle (tenant-lifecycle feature). Defaults keep

package/dist/tenant/screens.js

@@ -23,7 +23,7 @@ export const tenantListScreen = {
             entityId: "id",
         },
     ],
-    defaultSort: { field: "name", dir: "asc" },
+    defaultSort: { field: "key", dir: "asc" },
     searchable: true,
     access: { roles: ["SystemAdmin"] },
     // Inert until an app navs it (see file header) — no nav area to resolve

package/dist/tenant-handover/move-entity-graph.js

@@ -174,7 +174,7 @@ export async function moveTransferGraph(args) {
     let pending = [
         { entityName: rootEntityName, rowIds: [rootRowId] },
     ];
-    for (let round = 0; round < MAX_TRANSFER_DEPTH && pending.length > 0; round++) {
+    for (let round = 0; round <= MAX_TRANSFER_DEPTH && pending.length > 0; round++) {
         // Merged per type so an edge leaving a type runs once per round, not once
         // per edge that reached it.
         const discovered = new Map();
@@ -231,24 +231,17 @@ export async function moveTransferGraph(args) {
                 }));
             }
         }
+        // The extra round past the limit is a probe: it only exists to find out
+        // whether rows still hang below the last allowed hop. Its moves are rolled
+        // back with the transaction when this throws.
+        const [strandedEntityName] = discovered.keys();
+        if (round === MAX_TRANSFER_DEPTH && strandedEntityName !== undefined) {
+            throw new UnprocessableError("transfer_graph_too_deep", {
+                i18nKey: "errors.tenantHandover.transferGraphTooDeep",
+                details: { entityName: strandedEntityName },
+            });
+        }
         pending = [...discovered].map(([entityName, rowIds]) => ({ entityName, rowIds }));
     }
-    // The depth limit is a safety net, not a licence to move part of a graph: if
-    // rounds ran out while rows remain whose type still leads somewhere, the
-    // declaration reaches further than the mover does, and returning quietly
-    // would leave exactly the orphaned rows #3088 is about.
-    //
-    // Rounds count hops of both edge kinds, while the boot validator measures
-    // reference chains between transferable entities only. A graph that fills the
-    // limit with reference hops and then adds a parentRef child therefore boots
-    // clean and fails here instead — the residual the validator cannot see, and
-    // the reason this check has to exist rather than trusting boot alone.
-    const stranded = pending.find(({ entityName }) => (adjacency.get(entityName) ?? []).length > 0);
-    if (stranded !== undefined) {
-        throw new UnprocessableError("transfer_graph_too_deep", {
-            i18nKey: "errors.tenantHandover.transferGraphTooDeep",
-            details: { entityName: stranded.entityName },
-        });
-    }
     return movedCounts;
 }

package/dist/tenant-handover/transfer-graph.d.ts

@@ -1,23 +1,4 @@
-import { type EntityDefinition, type Registry } from "@cosmicdrift/kumiko-framework/engine";
-export type TransferEdgeLink = {
-    readonly kind: "parentRef";
-    readonly typeField: string;
-    readonly idField: string;
-} | {
-    readonly kind: "reference";
-    readonly field: string;
-};
-export type TransferEdge = {
-    readonly entityName: string;
-    readonly entity: EntityDefinition;
-    /** The already-resolved type this edge hangs off — its moved row ids are
-     *  the parent ids the mover matches this edge's rows against. */
-    readonly parentEntityName: string;
-    readonly link: TransferEdgeLink;
-};
+import { type EntityDefinition, type Registry, type TransferAdjacency } from "@cosmicdrift/kumiko-framework/engine";
+export type { TransferAdjacency, TransferEdge, TransferEdgeLink, } from "@cosmicdrift/kumiko-framework/engine";
 export declare function resolveTransferableRoot(registry: Registry, entityType: string): EntityDefinition | undefined;
-/** Outgoing edges per type: keyed by the type an edge hangs off, so the mover
- *  can ask "what hangs off the rows I just moved" for any type it reaches, at
- *  any depth, as often as it reaches it. */
-export type TransferAdjacency = ReadonlyMap<string, readonly TransferEdge[]>;
 export declare function resolveTransferAdjacency(registry: Registry, rootEntityType: string): TransferAdjacency;