@cosmicdrift/kumiko-bundled-features 0.382.0 → 0.383.0

package/dist/personal-access-tokens/schema/api-token.d.ts

@@ -13,7 +13,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -59,7 +59,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -82,7 +82,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -105,7 +105,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -128,7 +128,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/secrets/table.d.ts

@@ -18,7 +18,7 @@ export declare const tenantSecretEntity: import("@cosmicdrift/kumiko-types/field
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/sessions/schema/user-session.d.ts

@@ -13,7 +13,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -119,7 +119,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -142,7 +142,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/sessions/session-callbacks.js

@@ -11,6 +11,9 @@ import { userSessionEntity, userSessionTable } from "./schema/user-session.js";
 import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, sessionRevokedSchema, } from "./session-revoked-event.js";
 // Re-exported so existing `../sessions` importers keep working unchanged.
 export { isPrincipalBlocked };
+function settleLookup(lookup) {
+    return lookup.then((value) => ({ ok: true, value }), () => ({ ok: false }));
+}
 export function createSessionCallbacks(opts) {
     const ttlMs = opts.expiresInMs ?? DEFAULT_SESSION_EXPIRY_MS;
     const { db } = opts;
@@ -69,6 +72,12 @@ export function createSessionCallbacks(opts) {
         },
         // kumiko-lint-ignore complexity-budget session check + lastSeen refresh on hot path
         async sessionChecker(sid, expectedUserId) {
+            // The user lookup is keyed by the JWT's userId, not the session row, so it
+            // overlaps the session read. Settled eagerly: a throwing session read must
+            // not leave this promise as an unhandled rejection.
+            const userLookup = settleLookup(fetchOne(db, userTable, {
+                id: expectedUserId,
+            }));
             const row = await fetchOne(db, userSessionTable, { id: sid });
             if (!row)
                 return "missing";
@@ -85,6 +94,12 @@ export function createSessionCallbacks(opts) {
             if (row.expiresAt.epochMilliseconds <= Temporal.Now.instant().epochMilliseconds) {
                 return "expired";
             }
+            // Membership is keyed by the session's tenantId, so it can only start now;
+            // it overlaps the user lookup and the lastSeen refresh.
+            const membershipLookup = settleLookup(fetchOne(db, tenantMembershipsTable, {
+                userId: expectedUserId,
+                tenantId: row.tenantId,
+            }));
             // Hourly, not per-request: this check runs on every authenticated
             // request, so a write here has to stay off the hot path.
             const nowMs = Temporal.Now.instant().epochMilliseconds;
@@ -110,13 +125,10 @@ export function createSessionCallbacks(opts) {
             // missing row is a legitimate "no tenant roles" outcome. Both branches
             // return the bare "live" string (no re-derived roles) — the middleware
             // falls back to the JWT's frozen roles claim.
-            let user;
-            try {
-                user = await fetchOne(db, userTable, { id: expectedUserId });
-            }
-            catch {
+            const userResult = await userLookup;
+            if (!userResult.ok)
                 return "live";
-            }
+            const user = userResult.value;
             if (!user)
                 return "live";
             if (isPrincipalRowBlocked(user))
@@ -125,17 +137,12 @@ export function createSessionCallbacks(opts) {
             // DB error on the membership read must not lock the user out. A
             // missing row (not a throw) is a valid outcome: the user genuinely has
             // no tenant-scoped roles for row.tenantId, so membershipRoles is [].
-            let membershipRoles;
-            try {
-                const membership = await fetchOne(db, tenantMembershipsTable, {
-                    userId: expectedUserId,
-                    tenantId: row.tenantId,
-                });
-                membershipRoles = membership ? parseRoles(membership.roles) : [];
-            }
-            catch {
+            const membershipResult = await membershipLookup;
+            if (!membershipResult.ok)
                 return "live";
-            }
+            const membershipRoles = membershipResult.value
+                ? parseRoles(membershipResult.value.roles)
+                : [];
             const globalRoles = parseRoles(user.roles);
             const roles = buildSessionRoles(globalRoles, membershipRoles);
             return { status: "live", roles };

package/dist/tags/entity.d.ts

@@ -14,7 +14,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -37,7 +37,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -60,7 +60,7 @@ export declare const tagEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -85,7 +85,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -108,7 +108,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -131,7 +131,7 @@ export declare function createTagAssignmentEntity(access?: EntityDefinition["acc
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -156,7 +156,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -179,7 +179,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -202,7 +202,7 @@ export declare const tagAssignmentEntity: EntityDefinition<{
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/template-resolver/table.d.ts

@@ -14,7 +14,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -66,7 +66,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -89,7 +89,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -112,7 +112,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -245,7 +245,7 @@ export declare const templateResourceEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -343,7 +343,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -395,7 +395,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -418,7 +418,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -441,7 +441,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -574,7 +574,7 @@ export declare const templateResourcesTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/template-resolver/user-content-table.d.ts

@@ -14,7 +14,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -37,7 +37,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -89,7 +89,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -112,7 +112,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -135,7 +135,7 @@ export declare const userContentEntryEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -200,7 +200,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -223,7 +223,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -275,7 +275,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -298,7 +298,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -321,7 +321,7 @@ export declare const userContentEntriesTable: import("@cosmicdrift/kumiko-framew
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/tenant/decrypt-tenant-names.d.ts

@@ -1,3 +1,7 @@
 export declare function decryptTenantNames<T extends {
     readonly name?: unknown;
 }>(rows: readonly T[], fallbackRequestId: string): Promise<T[]>;
+export declare function takeTenantsMatchingDecryptedName<T extends {
+    readonly id: unknown;
+    readonly name?: unknown;
+}>(rows: readonly T[], labelMatches: (label: string) => boolean, limit: number, fallbackRequestId: string): Promise<T[]>;

package/dist/tenant/decrypt-tenant-names.js

@@ -8,3 +8,18 @@ export async function decryptTenantNames(rows, fallbackRequestId) {
         ? { ...row, name: await decryptStoredPii(row.name, "name", fallbackRequestId) }
         : row);
 }
+// Tenant names are not in the search index (find: "none"), so a name search has to decrypt;
+// stopping at `limit` matches keeps a typed prefix from decrypting the whole scan window.
+export async function takeTenantsMatchingDecryptedName(rows, labelMatches, limit, fallbackRequestId) {
+    const batchSize = Math.max(limit, KMS_POOL_CONCURRENCY);
+    const matches = [];
+    for (let start = 0; start < rows.length && matches.length < limit; start += batchSize) {
+        const decrypted = await decryptTenantNames(rows.slice(start, start + batchSize), fallbackRequestId);
+        for (const row of decrypted) {
+            const label = typeof row.name === "string" ? row.name : String(row.id);
+            if (labelMatches(label))
+                matches.push(row);
+        }
+    }
+    return matches.slice(0, limit);
+}

package/dist/tenant/handlers/tenant-directory.query.js

@@ -2,7 +2,7 @@ import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { decryptTenantNames } from "../decrypt-tenant-names.js";
+import { decryptTenantNames, takeTenantsMatchingDecryptedName } from "../decrypt-tenant-names.js";
 import { tenantTable } from "../schema/tenant.js";
 import { isSystemAdmin } from "./is-system-admin.js";
 // Label source behind every `tenant:tenant` reference column (fw#3142). The
@@ -51,17 +51,16 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
         }
         // name is ciphertext at rest, so the SQL page is keyed by the plaintext
         // `key`; label order and search happen in memory after decrypting.
-        const decrypted = await decryptTenantNames(tenants, "tenant:tenant-directory");
-        const labeled = decrypted
+        const needle = search?.toLowerCase();
+        const named = needle === undefined
+            ? await decryptTenantNames(tenants, "tenant:tenant-directory")
+            : await takeTenantsMatchingDecryptedName(tenants, (label) => label.toLowerCase().includes(needle), limit, "tenant:tenant-directory");
+        const rows = named
             .map((tenant) => {
             const id = String(tenant.id);
             return { id, label: typeof tenant.name === "string" ? tenant.name : id };
         })
             .sort((a, b) => a.label.localeCompare(b.label) || a.id.localeCompare(b.id));
-        const needle = search?.toLowerCase();
-        const rows = needle === undefined
-            ? labeled
-            : labeled.filter((row) => row.label.toLowerCase().includes(needle)).slice(0, limit);
         return { rows, nextCursor: null };
     },
 });

package/dist/tenant/invitation-table.d.ts

@@ -21,7 +21,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -44,7 +44,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -92,7 +92,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -151,7 +151,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -174,7 +174,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -222,7 +222,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/tenant/membership-table.d.ts

@@ -13,7 +13,7 @@ export declare const tenantMembershipEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const tenantMembershipEntity: import("@cosmicdrift/kumiko-types/f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -61,7 +61,7 @@ export declare const tenantMembershipsTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -84,7 +84,7 @@ export declare const tenantMembershipsTable: import("@cosmicdrift/kumiko-framewo
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {