@cosmicdrift/kumiko-bundled-features 0.355.0 → 0.357.0

package/dist/template-resolver/table.d.ts

@@ -5,6 +5,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -53,6 +54,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -75,6 +77,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -97,6 +100,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -213,6 +217,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -260,6 +265,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -308,6 +314,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -330,6 +337,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -352,6 +360,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -468,6 +477,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/template-resolver/user-content-table.d.ts

@@ -5,6 +5,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -27,6 +28,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -75,6 +77,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -97,6 +100,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -119,6 +123,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -183,6 +188,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -205,6 +211,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -253,6 +260,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -275,6 +283,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -297,6 +306,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/tenant/cancel-pending-invitation.d.ts

@@ -1,8 +1,8 @@
 import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type { Redis } from "ioredis";
 export declare function cancelPendingInvitation(db: TenantDb, invitation: {
     readonly id: string;
     readonly version: number;
-}, actor: SessionUser, redis: Redis | undefined): Promise<WriteFailure | undefined>;
+}, actor: SessionUser, redis: Redis | undefined, streamTenantId?: TenantId): Promise<WriteFailure | undefined>;

package/dist/tenant/cancel-pending-invitation.js

@@ -5,12 +5,12 @@ import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } fr
 const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
 // Shared by cancel-invitation and remove-member so the cancel behavior
 // (status transition + token invalidation) cannot drift between them.
-export async function cancelPendingInvitation(db, invitation, actor, redis) {
+export async function cancelPendingInvitation(db, invitation, actor, redis, streamTenantId) {
     const updateResult = await invitationExecutor.update({
         id: invitation.id,
         version: invitation.version,
         changes: { status: INVITATION_STATUS.cancelled },
-    }, actor, db);
+    }, actor, db, { streamTenantId });
     if (!updateResult.isSuccess)
         return updateResult;
     // Delete the token from Redis (if still there). If Redis is

package/dist/tenant/constants.d.ts

@@ -33,6 +33,7 @@ export declare const TenantQueries: {
     readonly resolveUserIds: "tenant:query:resolve-user-ids";
     readonly invitations: "tenant:query:invitations";
     readonly teamList: "tenant:query:team:list";
+    readonly memberRoleAvailability: "tenant:query:member-role-availability";
 };
 export declare const TenantErrors: {
     readonly membershipNotFound: "membership_not_found";

package/dist/tenant/constants.js

@@ -19,9 +19,10 @@ export const MEMBER_ROLES_CELL_COMPONENT = "MemberRolesCell";
 // Admin (rank 2) shares the invite-create screen with TenantAdmin — TenantAdmin
 // must not appear here or Admin sees an unassignable option (fw#2414).
 export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin"];
-// Full assignable rank list, used by memberRolesEditScreen: that screen is
-// prefilled with a member's *current* roles, so it must be able to represent
-// every rank a membership can actually hold, including TenantAdmin (fw#2452).
+// Full rank list for memberRolesEditScreen: it is prefilled with a member's
+// *current* roles, so it must represent every rank a membership can hold,
+// including TenantAdmin (fw#2452). The screen hides what the caller may not
+// assign via TenantQueries.memberRoleAvailability.
 export const OWNER_INVITE_ROLE_OPTIONS = [
     "User",
     "Member",
@@ -58,6 +59,8 @@ export const TenantQueries = {
     invitations: "tenant:query:invitations",
     // Combined active-members + pending-invitations list backing /members.
     teamList: "tenant:query:team:list",
+    // Per-role assignability for the caller, mirrors the rank rule of updateMemberRoles.
+    memberRoleAvailability: "tenant:query:member-role-availability",
 };
 // Error codes
 export const TenantErrors = {

package/dist/tenant/feature.js

@@ -7,6 +7,7 @@ import { invitationsQuery } from "./handlers/invitations.query.js";
 import { listQuery } from "./handlers/list.query.js";
 import { meQuery } from "./handlers/me.query.js";
 import { memberDirectoryQuery } from "./handlers/member-directory.query.js";
+import { memberRoleAvailabilityQuery } from "./handlers/member-role-availability.query.js";
 import { membersQuery } from "./handlers/members.query.js";
 import { membershipsQuery } from "./handlers/memberships.query.js";
 import { removeMemberWrite } from "./handlers/remove-member.write.js";
@@ -118,6 +119,7 @@ export function createTenantFeature(options) {
             resolveUserIds: r.queryHandler(resolveUserIdsQuery),
             invitations: r.queryHandler(invitationsQuery),
             teamList: r.queryHandler(teamListQuery),
+            memberRoleAvailability: r.queryHandler(memberRoleAvailabilityQuery),
         };
         // Entity-convention handlers for the SystemAdmin entityList/entityEdit
         // screens. The feature's original handlers predate the `<entity>:<verb>`

package/dist/tenant/handlers/member-role-availability.query.d.ts

@@ -0,0 +1,7 @@
+import * as z from "zod";
+export declare const memberRoleAvailabilityQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"member-role-availability", z.ZodObject<{}, z.core.$strip>, {
+    rows: {
+        value: string;
+        disabled: boolean;
+    }[];
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/tenant/handlers/member-role-availability.query.js

@@ -0,0 +1,18 @@
+import { access, assignableAppRolesOf, canActorAssignRole, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { memberRoleOptions } from "../member-role-options.js";
+export const memberRoleAvailabilityQuery = defineQueryHandler({
+    name: "member-role-availability",
+    schema: z.object({}),
+    access: { roles: access.admin },
+    description: "Lists every role the member roles form offers and whether the caller's own rank may assign it; the form hides the roles marked disabled.",
+    handler: async (query, ctx) => {
+        const assignableAppRoles = assignableAppRolesOf(ctx.registry);
+        return {
+            rows: memberRoleOptions(assignableAppRoles).map((value) => ({
+                value,
+                disabled: !canActorAssignRole(query.user.roles, value, assignableAppRoles),
+            })),
+        };
+    },
+});

package/dist/tenant/handlers/remove-member.write.js

@@ -1,6 +1,6 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, defineWriteHandler, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, defineWriteHandler, parseTenantId, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -20,7 +20,7 @@ async function cancelPendingInvitationsOfUser(db, options) {
     const email = (await decryptStoredPii(user.email, "email", "tenant:remove-member")).toLowerCase();
     const pendingInvitations = await selectMany(db, tenantInvitationsTable, { tenantId: options.tenantId, email, status: INVITATION_STATUS.pending });
     for (const invitation of pendingInvitations) {
-        const failure = await cancelPendingInvitation(db, invitation, options.actor, options.redis);
+        const failure = await cancelPendingInvitation(db, invitation, options.actor, options.redis, options.streamTenantId);
         if (failure)
             return failure;
     }
@@ -43,11 +43,14 @@ export const removeMemberWrite = defineWriteHandler({
             });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin manages memberships across tenants");
-        const existing = await fetchOne(db, tenantMembershipsTable, {
-            userId: event.payload.userId,
-            tenantId: event.payload.tenantId,
-        });
-        if (!existing) {
+        const streamTenantId = parseTenantId(event.payload.tenantId);
+        const existing = streamTenantId === null
+            ? undefined
+            : await fetchOne(db, tenantMembershipsTable, {
+                userId: event.payload.userId,
+                tenantId: streamTenantId,
+            });
+        if (!existing || streamTenantId === null) {
             return writeFailure(new NotFoundError("membership", undefined, {
                 i18nKey: "tenant.errors.membershipNotFound",
                 i18nParams: { userId: event.payload.userId, tenantId: event.payload.tenantId },
@@ -75,14 +78,14 @@ export const removeMemberWrite = defineWriteHandler({
             });
         }
         const result = await executor.delete({ id: existing["id"] }, // @cast-boundary db-row
-        event.user, db);
+        event.user, db, { streamTenantId });
         if (!result.isSuccess)
             return result;
-        // Actor tenant = invitation tenant so the update hits the invitation's stream.
         const cancelFailure = await cancelPendingInvitationsOfUser(db, {
             userId: event.payload.userId,
             tenantId: event.payload.tenantId,
-            actor: { ...event.user, tenantId: event.payload.tenantId },
+            actor: event.user,
+            streamTenantId,
             redis: ctx.redis,
         });
         if (cancelFailure !== undefined)

package/dist/tenant/handlers/update-member-roles.write.js

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { access, assignableAppRolesOf, createSystemUser, defineWriteHandler, findForbiddenRoleAssignment, mergeAssignedRoles, SYSTEM_ROLE, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, assignableAppRolesOf, createSystemUser, defineWriteHandler, findForbiddenRoleAssignment, mayOverrideTenant, mergeAssignedRoles, parseTenantId, SYSTEM_ROLE, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -17,7 +17,12 @@ const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user"
 /** SystemAdmin may pass payload.tenantId (cross-tenant); the members actionForm
  *  only sends userId+roles, so fall back to the active session tenant. */
 function resolveTargetTenantId(isSystem, payloadTenantId, sessionTenantId) {
-    return isSystem ? (payloadTenantId ?? sessionTenantId) : sessionTenantId;
+    if (!isSystem || payloadTenantId === undefined)
+        return sessionTenantId;
+    return parseTenantId(payloadTenantId) ?? undefined;
+}
+function foreignStreamTenant(user, targetTenantId) {
+    return targetTenantId === user.tenantId ? undefined : targetTenantId;
 }
 // Editing your OWN roles keeps the current session: roles are re-derived per
 // request, so the new roles apply at once without a re-login. Other sessions
@@ -49,7 +54,7 @@ export const updateMemberRolesWrite = defineWriteHandler({
             });
         }
         const isSystemActor = event.user.roles.includes(SYSTEM_ROLE);
-        const isSystem = event.user.roles.includes("SystemAdmin") || isSystemActor;
+        const isSystem = mayOverrideTenant(event.user) || isSystemActor;
         const assignableAppRoles = assignableAppRolesOf(ctx.registry);
         const targetTenantId = resolveTargetTenantId(isSystem, event.payload.tenantId, event.user.tenantId);
         if (!targetTenantId) {
@@ -117,16 +122,14 @@ export const updateMemberRolesWrite = defineWriteHandler({
         if (revoker) {
             await ctx.writeAs(createSystemUser(targetTenantId), REVOKE_ALL_SESSIONS_QN, revokeSessionsPayload(event.payload.userId, targetTenantId, event.user));
         }
-        // Stream tenant follows the actor via streamTenantFor — use the
-        // membership tenant so SystemAdmin/cross-tenant and TenantAdmin paths
-        // hit the same stream seedTenantMembership/invite-accept wrote.
-        // Keep the real actor for audit metadata; only override tenantId so
-        // streamTenantFor writes into the membership tenant (#2401).
+        // The membership stream lives on the membership's tenant (where seedTenantMembership/
+        // invite-accept wrote it); a cross-tenant operator addresses it without becoming a member.
+        // Same-tenant writes run on a tenant-mode db, which refuses a stream override.
         const result = await executor.update({
             id: row["id"], // @cast-boundary db-row
             version: row["version"], // @cast-boundary db-row
             changes: { roles: JSON.stringify(nextRoles) },
-        }, { ...event.user, tenantId: targetTenantId }, db);
+        }, event.user, db, { streamTenantId: foreignStreamTenant(event.user, targetTenantId) });
         return withResponseData(result, {
             ...event.payload,
             roles: nextRoles,

package/dist/tenant/invitation-table.d.ts

@@ -12,6 +12,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -34,6 +35,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -81,6 +83,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -139,6 +142,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -161,6 +165,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -208,6 +213,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/tenant/member-role-options.d.ts

@@ -0,0 +1,2 @@
+import type { AssignableAppRoles } from "@cosmicdrift/kumiko-framework/engine";
+export declare function memberRoleOptions(assignableAppRoles: AssignableAppRoles): readonly string[];

package/dist/tenant/member-role-options.js

@@ -0,0 +1,4 @@
+import { OWNER_INVITE_ROLE_OPTIONS } from "./constants.js";
+export function memberRoleOptions(assignableAppRoles) {
+    return [...OWNER_INVITE_ROLE_OPTIONS, ...assignableAppRoles.keys()];
+}

package/dist/tenant/membership-table.d.ts

@@ -4,6 +4,7 @@ export declare const tenantMembershipEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const tenantMembershipEntity: import("@cosmicdrift/kumiko-types/f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -50,6 +52,7 @@ export declare const tenantMembershipsTable: import("@cosmicdrift/kumiko-framewo
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -72,6 +75,7 @@ export declare const tenantMembershipsTable: import("@cosmicdrift/kumiko-framewo
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/tenant/schema/tenant.d.ts

@@ -6,6 +6,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -28,6 +29,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -93,6 +95,7 @@ export declare const tenantEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -162,6 +165,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -184,6 +188,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -249,6 +254,7 @@ export declare const tenantTable: import("@cosmicdrift/kumiko-framework/db").Ent
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/tenant/screens.d.ts

@@ -69,7 +69,8 @@ export declare function createMemberRolesEditScreen(assignableAppRoles?: Assigna
         };
         roles: {
             type: "multiSelect";
-            options: string[];
+            options: readonly string[];
+            optionsAvailabilityQuery: "tenant:query:member-role-availability";
             required: true;
         };
     };
@@ -99,7 +100,8 @@ export declare const memberRolesEditScreen: {
         };
         roles: {
             type: "multiSelect";
-            options: string[];
+            options: readonly string[];
+            optionsAvailabilityQuery: "tenant:query:member-role-availability";
             required: true;
         };
     };

package/dist/tenant/screens.js

@@ -1,6 +1,7 @@
 import { AuthHandlers } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/constants";
 import { access, i18nKey, isAssignableByRole, } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_INVITE_ROLE_OPTIONS, INVITE_CREATE_SCREEN_ID, MEMBER_ROLES_CELL_COMPONENT, MEMBER_ROLES_EDIT_SCREEN_ID, MEMBER_STATUS_CELL_COMPONENT, MEMBERS_SCREEN_ID, OWNER_INVITE_ROLE_OPTIONS, TenantHandlers, TenantQueries, } from "./constants.js";
+import { DEFAULT_INVITE_ROLE_OPTIONS, INVITE_CREATE_SCREEN_ID, MEMBER_ROLES_CELL_COMPONENT, MEMBER_ROLES_EDIT_SCREEN_ID, MEMBER_STATUS_CELL_COMPONENT, MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries, } from "./constants.js";
+import { memberRoleOptions } from "./member-role-options.js";
 // Cross-tenant SystemAdmin platform view of the tenants themselves. The tenant
 // feature runs with `r.systemScope()`, so the entityList returns every tenant.
 // Both screens are SystemAdmin-gated and inert until an app navs them.
@@ -83,6 +84,7 @@ export function createMembersScreen(options) {
                 field: "lastSeenAt",
                 label: i18nKey("tenant.members.col.lastActivity"),
                 renderer: { format: "timestamp" },
+                hideOnNarrow: true,
             },
         ],
         defaultSort: { field: "createdAt", dir: "desc" },
@@ -172,13 +174,15 @@ export function createMemberRolesEditScreen(assignableAppRoles = new Map()) {
         cancelTarget: MEMBERS_SCREEN_ID,
         fields: {
             userId: { type: "text", required: true },
-            // Prefilled with the member's current roles, so the option list must be
-            // able to represent every assignable rank — DEFAULT_INVITE_ROLE_OPTIONS
-            // omits TenantAdmin and would silently strip it on submit. Escalation
-            // still stays server-side via findForbiddenRoleAssignment (update-member-roles.write.ts).
+            // Prefilled with the member's current roles, so the static options must
+            // represent every rank (DEFAULT_INVITE_ROLE_OPTIONS omits TenantAdmin and
+            // would silently strip it on submit); the availability query hides what the
+            // caller may not assign. Enforcement stays server-side via
+            // findForbiddenRoleAssignment (update-member-roles.write.ts).
             roles: {
                 type: "multiSelect",
-                options: [...OWNER_INVITE_ROLE_OPTIONS, ...assignableAppRoles.keys()],
+                options: memberRoleOptions(assignableAppRoles),
+                optionsAvailabilityQuery: TenantQueries.memberRoleAvailability,
                 required: true,
             },
         },

package/dist/tier-engine/entity.d.ts

@@ -4,6 +4,7 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;