@cosmicdrift/kumiko-bundled-features 0.352.0 → 0.354.0

package/dist/user/handlers/list.query.js

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineEntityListHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 // kumiko-lint-ignore cross-feature-import SystemAdmin user-list joins memberships for tenants column
-import { tenantMembershipsTable, tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantMembershipsTable, tenantTable } from "../../tenant/index.js";
 import { userEntity } from "../schema/user.js";
 const baseList = defineEntityListHandler("user", userEntity, {
     access: { roles: access.systemAdmin },
@@ -59,7 +59,7 @@ export async function attachTenantLabels(rows, db) {
         ...new Set(memberships.map((m) => String(m.tenantId ?? "")).filter((id) => id !== "")),
     ];
     const tenants = tenantIds.length > 0
-        ? await selectMany(db, tenantTable, { id: { in: tenantIds } })
+        ? await decryptTenantNames(await selectMany(db, tenantTable, { id: { in: tenantIds } }), "user:list")
         : [];
     const byUser = labelsByUserId(memberships, tenantLabelById(tenants));
     return rows.map((row) => {
@@ -90,6 +90,10 @@ export const listQuery = {
             return result;
         }
         const envelope = result;
+        // Without the tenant feature there are no membership tables to join; with
+        // it, a failing lookup must surface instead of rendering a silent empty column.
+        if (!ctx.registry.features.has("tenant"))
+            return result;
         const rows = await attachTenantLabels(envelope.rows, dbForList(ctx));
         return { ...envelope, rows };
     },

package/dist/user/handlers/update.write.js

@@ -49,6 +49,7 @@ export const updateWrite = defineWriteHandler({
         },
     },
     description: "Changes a user's display name, locale, timezone, email, verification flag, last active tenant or global roles against the version the caller read; callers may edit themselves, while editing someone else or granting roles needs a privileged actor.",
+    agent: { risk: "high" },
     escapeHatch: {
         reason: SYSTEM_ADMIN_DEMOTION_COUNT_REASON,
     },

package/dist/user/schema/user.d.ts

@@ -32,6 +32,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -53,6 +54,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -74,6 +76,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -95,6 +98,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -125,6 +129,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -158,14 +163,15 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly active?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly deleted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly deletionRequested?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly restricted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly active?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly deleted?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly deletionRequested?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly restricted?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"active" | "deleted" | "deletionRequested" | "restricted">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -188,6 +194,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -211,6 +218,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -232,6 +240,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -253,6 +262,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -274,6 +284,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -304,6 +315,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -337,14 +349,15 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly active?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly deleted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly deletionRequested?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly restricted?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly active?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly deleted?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly deletionRequested?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly restricted?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"active" | "deleted" | "deletionRequested" | "restricted">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -367,6 +380,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/user/seeding.d.ts

@@ -31,3 +31,4 @@ export declare function seedUser(db: DbConnection, options: SeedUserOptions, hoo
     id: string;
 }>;
 export declare function reconcileSeededUserEmailVerified(db: DbConnection, existingRow: Record<string, unknown>, by: SessionUser): Promise<void>;
+export declare function rewriteSeededUserEmail(db: DbConnection, existingRow: Record<string, unknown>, email: string, by: SessionUser): Promise<void>;

package/dist/user/seeding.js

@@ -73,6 +73,26 @@ export async function reconcileSeededUserEmailVerified(db, existingRow, by) {
         throw new Error(`reconcileSeededUserEmailVerified failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`);
     }
 }
+// Re-writes `email` through the executor so the PII write pipeline recomputes
+// `email_bidx`. Repairs rows whose blind index is NULL or stale (written before
+// the key existed, key rotated, subject-key erased), which would otherwise stay
+// invisible to every `fetchOne(userTable, { email })` lookup.
+export async function rewriteSeededUserEmail(db, existingRow, email, by) {
+    const id = existingRow["id"];
+    if (typeof id !== "string") {
+        throw new Error("rewriteSeededUserEmail: existing user row has no string id");
+    }
+    const tdb = createTenantDb(db, by.tenantId, "system");
+    const result = await userExecutor.update({ id, version: existingRow["version"], changes: { email } }, by, tdb);
+    // version_conflict: a concurrent write already changed the row — fine for a seed helper.
+    // unique_violation: a duplicate row already holds the blind index; the repair
+    // has to wait for a manual duplicate cleanup.
+    if (!result.isSuccess &&
+        result.error.code !== "version_conflict" &&
+        result.error.code !== "unique_violation") {
+        throw new Error(`rewriteSeededUserEmail failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`);
+    }
+}
 // Extrahiert die `id`-Spalte aus dem executor.create-Result. Der
 // Executor liefert ein Record<string, unknown> (die Projection-Row), in
 // das die DB die Aggregat-id reinschreibt — wir prüfen runtime statt

package/dist/user-data-rights/boot-checks.js

@@ -20,6 +20,11 @@ export function validateGdprHookCompleteness(features) {
                 continue;
             const hasExport = typeof usage.options?.["export"] === "function";
             const hasDelete = typeof usage.options?.["delete"] === "function";
+            // The compile-time "at least one hook" type is bypassed by string-typed
+            // extension names and casts; without this an empty bag registers nothing.
+            if (!hasExport && !hasDelete) {
+                throw new Error(`[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`);
+            }
             if (hasExport && !hasDelete) {
                 throw new Error(`[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`);
             }

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.js

@@ -28,7 +28,7 @@ async function readPendingDeletionRequestId(ctx, userId) {
 }
 // Anonymous apex flow step 2: verify-link target. Verifies the HMAC token,
 // extracts the userId, and flips the grace period through the shared logic —
-// in ONE atomic step with the anchor spend (#3024): commitDeletion carries
+// in ONE atomic step with the anchor spend: commitDeletion carries
 // the actual grace-period transition, so a crash after the spend can no
 // longer lose the write step.
 //
@@ -38,7 +38,7 @@ async function readPendingDeletionRequestId(ctx, userId) {
 // a cancel-deletion (status → Active, pendingDeletionRequestId → null), a
 // replayed token fails against the nulled/renewed requestId — no re-arm.
 //
-// Concurrency (#3024): two simultaneous confirms of the same token both read
+// Concurrency: two simultaneous confirms of the same token both read
 // the same requestId and both verify the HMAC — commitDeletion spends the
 // anchor AND writes the transition atomically (expect: status===Active &&
 // pendingDeletionRequestId===requestId), so exactly one wins. The loser gets

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -21,6 +21,7 @@ export function createRequestDeletionHandler(opts = {}) {
             },
         },
         escapeHatch: {
+            grants: ["systemIdentity", "unsafeRaw"],
             reason: "resolveGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
                 "...) to compute the grace period end — the calling user's own identity has no read " +
                 "access to that tenant-config projection. startDeletionGracePeriod also appends the " +

package/dist/user-data-rights/index.d.ts

@@ -1,3 +1,4 @@
+export { TENANT_MODEL_CONFIG_KEY } from "./constants.js";
 export { createUserDataRightsFeature, type UserDataRightsOptions } from "./feature.js";
 export type { SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write.js";
 export { denyIfTargetOutsideAdminTenant, TARGET_USER_NOT_IN_ADMIN_TENANT, } from "./lib/deny-if-target-outside-admin-tenant.js";

package/dist/user-data-rights/index.js

@@ -1,3 +1,4 @@
+export { TENANT_MODEL_CONFIG_KEY } from "./constants.js";
 export { createUserDataRightsFeature } from "./feature.js";
 export { denyIfTargetOutsideAdminTenant, TARGET_USER_NOT_IN_ADMIN_TENANT, } from "./lib/deny-if-target-outside-admin-tenant.js";
 export { isSystemAdminActor } from "./lib/is-admin-actor.js";

package/dist/user-data-rights/schema/download-attempt.d.ts

@@ -3,6 +3,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -45,6 +47,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -66,6 +69,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -87,6 +91,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -108,6 +113,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -129,6 +135,7 @@ export declare const downloadAttemptEntity: import("@cosmicdrift/kumiko-types/fi
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -167,6 +174,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -188,6 +196,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -209,6 +218,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -230,6 +240,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -251,6 +262,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -272,6 +284,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -293,6 +306,7 @@ export declare const downloadAttemptsTable: import("@cosmicdrift/kumiko-framewor
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/user-data-rights/schema/download-attempt.js

@@ -29,16 +29,24 @@ export const downloadAttemptEntity = createEntity({
         jobId: createTextField({ personal: false, reason: "technical_reference" }),
         // User-ID wenn auth-Pfad (job). NULL bei anonymous (token-Pfad).
         attemptedByUserId: createTextField({ personal: false, reason: "pseudonymous_fk" }),
-        // Same reasoning as download-token.ts's lastUsedFromIp/lastUsedUserAgent
-        // (sibling entity, same feature): DPO brute-force-audit data belongs to
-        // the tenant operator, not the (often anonymous) requester. Also avoids
-        // a real hazard on this buildEntityTable-managed entity: attemptedByUserId
-        // is null-by-design for the anonymous token path, so a subject annotation
-        // (`personal: { of: "attemptedByUserId" }`) would throw
-        // SubjectResolutionError on every such row once a KMS is configured
+        // No subject annotation on this buildEntityTable-managed entity:
+        // attemptedByUserId is null-by-design for the anonymous token path, so
+        // `personal: { of: "attemptedByUserId" }` would throw SubjectResolutionError
+        // on every such row once a KMS is configured
         // (crypto/subject-resolver.ts resolveUserOwnedSubject).
-        ip: createTextField({ maxLength: 64, personal: false, reason: "is_business_data" }),
-        userAgent: createTextField({ maxLength: 256, personal: false, reason: "is_business_data" }),
+        // The job path knows the requester and an IP is personal data, so this is a
+        // deliberate waiver, not business data: a user forget does not shred these
+        // values, the 90d hardDelete below is what removes them.
+        ip: createTextField({
+            maxLength: 64,
+            personal: false,
+            reason: "security_audit_retention_bounded",
+        }),
+        userAgent: createTextField({
+            maxLength: 256,
+            personal: false,
+            reason: "security_audit_retention_bounded",
+        }),
         attemptedAt: createTimestampField({ required: true }),
     },
     // 90d hardDelete: unbounded growth = disk-bomb genau gegen das System

package/dist/user-data-rights/schema/download-token.d.ts

@@ -3,6 +3,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -102,6 +104,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -123,6 +126,7 @@ export declare const exportDownloadTokenEntity: import("@cosmicdrift/kumiko-type
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -146,6 +150,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -167,6 +172,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -245,6 +251,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -266,6 +273,7 @@ export declare const exportDownloadTokensTable: import("@cosmicdrift/kumiko-fram
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/user-data-rights/schema/export-job.d.ts

@@ -17,6 +17,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -38,6 +39,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -67,14 +69,15 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly done?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly failed?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly running?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly done?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly failed?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly pending?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly running?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"done" | "failed" | "pending" | "running">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -127,6 +130,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -193,6 +197,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -214,6 +219,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -243,14 +249,15 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly done?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly failed?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly running?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly done?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly failed?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly pending?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly running?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"done" | "failed" | "pending" | "running">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -303,6 +310,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/user-profile/handlers/change-email.write.js

@@ -1,4 +1,4 @@
-import { access, createSystemUser, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { AuthErrors } from "../../auth-email-password/index.js";
@@ -27,8 +27,14 @@ export const changeEmailWrite = defineWriteHandler({
         currentPassword: z.string().min(1),
         newEmail: z.email(),
     }),
-    access: { roles: access.authenticated },
+    access: {
+        openToAll: {
+            reason: "self-service for any signed-in user, including tenant members whose only role is " +
+                "TenantAdmin; the handler only touches event.user.id and re-checks the caller's password",
+        },
+    },
     escapeHatch: {
+        grants: ["systemIdentity"],
         reason: "Reads the caller's own passwordHash via ctx.queryAs(SYSTEM, user:findForAuth), checks " +
             "email uniqueness the same way, and writes the new email via ctx.writeAs(SYSTEM, " +
             "user:update) — field-access on passwordHash/email is privileged-only.",