@cosmicdrift/kumiko-bundled-features 0.398.0 → 0.400.0

package/dist/documents/target-write-check.js

@@ -0,0 +1,25 @@
+import { createEntityExecutor, hasAccess, toKebab, userCanWriteFieldRow, } from "@cosmicdrift/kumiko-framework/engine";
+import { parentRowIsVisible } from "../shared/index.js";
+function updateHandlerAccessOf(registry, entityType) {
+    const suffix = `:write:${toKebab(entityType)}:update`;
+    for (const [qn, handler] of registry.getAllWriteHandlers()) {
+        if (qn.endsWith(suffix) && registry.getHandlerEntity(qn) === entityType)
+            return handler.access;
+    }
+    return undefined;
+}
+// Linking a document changes what readers of the target see, so it needs what saving the target
+// needs: read visibility, the entity's update handler and its row-level write rule. A target that
+// is not visible answers like a missing one.
+export async function canWriteLinkTarget(registry, entityType, entityId, user, db) {
+    if (!(await parentRowIsVisible(registry, entityType, entityId, user, db)))
+        return false;
+    const entity = registry.getEntity(entityType);
+    if (entity === undefined)
+        return false;
+    const updateAccess = updateHandlerAccessOf(registry, entityType);
+    if (updateAccess === undefined || !hasAccess(user, updateAccess))
+        return false;
+    const row = await createEntityExecutor(entityType, entity).executor.detail({ id: entityId }, user, db);
+    return row !== null && userCanWriteFieldRow(user, entity.access?.write, row, row);
+}

package/dist/documents/write-guard.d.ts

@@ -0,0 +1,6 @@
+import { type DeleteContext, type HandlerContext, type PreSaveHookFn } from "@cosmicdrift/kumiko-framework/engine";
+import type { DocumentExecutors } from "./executor.ts";
+export declare function createDocumentWriteGuard(executors: DocumentExecutors, adminRoles: readonly string[]): {
+    beforeUpdate: PreSaveHookFn;
+    beforeDelete: (payload: DeleteContext, ctx: HandlerContext) => Promise<void>;
+};

package/dist/documents/write-guard.js

@@ -0,0 +1,46 @@
+import { SYSTEM_ROLE, } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
+import { DOCUMENT_ENTITY } from "./constants.js";
+import { canWriteLinkTarget } from "./target-write-check.js";
+const LINK_PAGE_SIZE = 200;
+// Editing or deleting a document changes what every reader of its hosts sees, so it needs what
+// unlink needs: write access to at least one host it is linked to. Admin roles see unlinked
+// documents too and must be able to clean them up, and SYSTEM jobs (import, capture) write on
+// their own authority. A refused caller gets "not found", like a document they cannot read.
+export function createDocumentWriteGuard(executors, adminRoles) {
+    async function assertMayWrite(documentId, ctx) {
+        const { user } = ctx;
+        if (user.roles.includes(SYSTEM_ROLE) || user.roles.some((role) => adminRoles.includes(role))) {
+            // skip: exempt roles write on their own authority
+            return;
+        }
+        let offset = 0;
+        for (;;) {
+            const page = await executors.link.list({
+                filters: [{ field: "documentId", op: "eq", value: documentId }],
+                limit: LINK_PAGE_SIZE,
+                offset,
+            }, user, ctx.db);
+            for (const row of page.rows) {
+                const entityType = String(row["entityType"]);
+                const entityId = String(row["entityId"]);
+                // skip: one writable host is enough
+                if (await canWriteLinkTarget(ctx.registry, entityType, entityId, user, ctx.db))
+                    return;
+            }
+            if (page.rows.length < LINK_PAGE_SIZE)
+                break;
+            offset += LINK_PAGE_SIZE;
+        }
+        throw new NotFoundError(DOCUMENT_ENTITY, documentId);
+    }
+    const beforeUpdate = async (changes, ctx) => {
+        if (!ctx.isNew)
+            await assertMayWrite(String(ctx.previous["id"]), ctx);
+        return changes;
+    };
+    const beforeDelete = async (payload, ctx) => {
+        await assertMayWrite(String(payload.id), ctx);
+    };
+    return { beforeUpdate, beforeDelete };
+}

package/dist/inbound-mail-foundation/entities.d.ts

@@ -41,7 +41,7 @@ export declare const mailAccountEntity: import("@cosmicdrift/kumiko-types/fields
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
 }, "tenant">;
@@ -89,7 +89,7 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly bodyRef: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
@@ -101,7 +101,17 @@ export declare const inboundMessageEntity: import("@cosmicdrift/kumiko-types/fie
     readonly bodyText: import("@cosmicdrift/kumiko-types/fields").EntityLongTextFieldDef & {
         required: false;
     };
-    readonly bodyTextTruncated: import("@cosmicdrift/kumiko-types/fields").BooleanFieldDef & {
+    readonly bodyTextTruncated: {
+        readonly type: "boolean";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly sortNulls?: import("@cosmicdrift/kumiko-types/fields").SortNulls;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly default?: boolean;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+    } & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
         default: boolean;
     };
@@ -141,7 +151,7 @@ export declare const mailThreadEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly messageCount: {
@@ -161,7 +171,7 @@ export declare const mailThreadEntity: import("@cosmicdrift/kumiko-types/fields"
             readonly field: string;
         };
         readonly grouping?: boolean;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
 }, "tenant">;
@@ -195,7 +205,7 @@ export declare const syncCursorEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
 }, "tenant">;
@@ -223,7 +233,7 @@ export declare const seenMessageEntity: import("@cosmicdrift/kumiko-types/fields
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
 }, "tenant">;

package/dist/inbound-mail-foundation/ingest-failures.d.ts

@@ -25,7 +25,7 @@ export declare const ingestFailureEntity: import("@cosmicdrift/kumiko-types/fiel
             readonly field: string;
         };
         readonly grouping?: boolean;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly lastCountedBucket: {
@@ -45,7 +45,7 @@ export declare const ingestFailureEntity: import("@cosmicdrift/kumiko-types/fiel
             readonly field: string;
         };
         readonly grouping?: boolean;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly lastFailedAt: {
@@ -61,7 +61,7 @@ export declare const ingestFailureEntity: import("@cosmicdrift/kumiko-types/fiel
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
 }, "tenant">;

package/dist/inbound-mail-foundation/projection.d.ts

@@ -39,7 +39,7 @@ export declare const mailAccountsProjectionTable: import("@cosmicdrift/kumiko-fr
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
 }, "tenant">>;
@@ -84,7 +84,7 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly bodyRef: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
@@ -96,7 +96,17 @@ export declare const inboundMessagesProjectionTable: import("@cosmicdrift/kumiko
     readonly bodyText: import("@cosmicdrift/kumiko-types/fields").EntityLongTextFieldDef & {
         required: false;
     };
-    readonly bodyTextTruncated: import("@cosmicdrift/kumiko-types/fields").BooleanFieldDef & {
+    readonly bodyTextTruncated: {
+        readonly type: "boolean";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly sortNulls?: import("@cosmicdrift/kumiko-types/fields").SortNulls;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly default?: boolean;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+    } & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
         default: boolean;
     };
@@ -134,7 +144,7 @@ export declare const mailThreadsProjectionTable: import("@cosmicdrift/kumiko-fra
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly messageCount: {
@@ -154,7 +164,7 @@ export declare const mailThreadsProjectionTable: import("@cosmicdrift/kumiko-fra
             readonly field: string;
         };
         readonly grouping?: boolean;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
 }, "tenant">>;

package/dist/inbound-mail-foundation/quarantine-entities.d.ts

@@ -25,7 +25,7 @@ export declare const quarantineEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly acknowledgedAt: {
@@ -41,7 +41,7 @@ export declare const quarantineEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
     };
     readonly retryRequestedAt: {
@@ -57,7 +57,7 @@ export declare const quarantineEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
     };
 }, "tenant">;

package/dist/jobs/job-run-table.d.ts

@@ -34,7 +34,7 @@ export declare const jobRunEntity: import("@cosmicdrift/kumiko-types/fields").En
             readonly field: string;
         };
         readonly grouping?: boolean;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly startedAt: {
@@ -50,7 +50,7 @@ export declare const jobRunEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly finishedAt: {
@@ -66,7 +66,7 @@ export declare const jobRunEntity: import("@cosmicdrift/kumiko-types/fields").En
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
     };
     readonly duration: {
@@ -86,7 +86,7 @@ export declare const jobRunEntity: import("@cosmicdrift/kumiko-types/fields").En
             readonly field: string;
         };
         readonly grouping?: boolean;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
     };
     readonly triggeredById: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {

package/dist/ledger/entity.d.ts

@@ -25,7 +25,7 @@ export declare const accountEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
         readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"asset" | "equity" | "expense" | "income" | "liability">[] | undefined;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly code: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
@@ -48,7 +48,7 @@ export declare const transactionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly description: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
@@ -77,7 +77,7 @@ export declare const transactionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
         readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"draft" | "posted">[] | undefined;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly lines: {
@@ -93,7 +93,7 @@ export declare const transactionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly derived?: Readonly<Record<string, import("@cosmicdrift/kumiko-types/fields").EmbeddedDerivedCellDef>>;
         readonly totals?: readonly import("@cosmicdrift/kumiko-types/fields").EmbeddedTotalDef[];
         readonly totalsMatch?: Readonly<Record<string, string>>;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         multiple: true;
     };
     readonly subjectType: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
@@ -119,7 +119,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly endDate: {
@@ -134,7 +134,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
     };
     readonly interval: {
@@ -156,7 +156,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
         readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"monthly">[] | undefined;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly amount: {
@@ -176,7 +176,7 @@ export declare const scheduleEntity: import("@cosmicdrift/kumiko-types/fields").
             readonly field: string;
         };
         readonly grouping?: boolean;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly debitAccountId: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {

package/dist/managed-pages/table.d.ts

@@ -32,7 +32,7 @@ export declare const pageEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
         readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"document" | "markdown">[] | undefined;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
     };
     readonly description: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
@@ -41,7 +41,17 @@ export declare const pageEntity: import("@cosmicdrift/kumiko-types/fields").Enti
     readonly ogImage: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: false;
     };
-    readonly published: import("@cosmicdrift/kumiko-types/fields").BooleanFieldDef & {
+    readonly published: {
+        readonly type: "boolean";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly sortNulls?: import("@cosmicdrift/kumiko-types/fields").SortNulls;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly default?: boolean;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+    } & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
         default: boolean;
     };
@@ -79,7 +89,7 @@ export declare const pagesTable: import("@cosmicdrift/kumiko-framework/db").Enti
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
         readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"document" | "markdown">[] | undefined;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
     };
     readonly description: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
@@ -88,7 +98,17 @@ export declare const pagesTable: import("@cosmicdrift/kumiko-framework/db").Enti
     readonly ogImage: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: false;
     };
-    readonly published: import("@cosmicdrift/kumiko-types/fields").BooleanFieldDef & {
+    readonly published: {
+        readonly type: "boolean";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly sortNulls?: import("@cosmicdrift/kumiko-types/fields").SortNulls;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly default?: boolean;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+    } & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
         default: boolean;
     };

package/dist/metrics/compute.d.ts

@@ -1,4 +1,5 @@
 import type { WhereObject } from "@cosmicdrift/kumiko-framework/db";
+import type { AggregateKey } from "@cosmicdrift/kumiko-types/aggregate-types";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { TenantDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
 import type { MetricDefinition, MetricResult } from "./types.ts";
@@ -11,5 +12,7 @@ export type MetricRunParams = {
     readonly filterWhere: WhereObject;
     /** Extra filter that narrows the source to the caller's scope. */
     readonly scopeWhere: WhereObject;
+    /** Names for referenced-row group keys; absent where the caller cannot resolve them (system scope). */
+    readonly referenceLabels?: (keys: readonly AggregateKey[]) => Promise<ReadonlyMap<string, string>>;
 };
 export declare function runMetric(db: TenantDb, metric: MetricDefinition, params: MetricRunParams): Promise<MetricResult>;

package/dist/metrics/compute.js

@@ -75,7 +75,7 @@ function groupSegments(stackRows, labelOf) {
     }
     return segmentsByGroup;
 }
-function buildRows(metric, aggregates, total, labelOf) {
+function buildRows(metric, aggregates, total, labelOf, groupLabelOf) {
     const segmentsByGroup = groupSegments(aggregates.stacks, labelOf);
     return aggregates.groups.map((row) => {
         const key = keyText(row.keys[0]);
@@ -83,7 +83,7 @@ function buildRows(metric, aggregates, total, labelOf) {
         return {
             id: key,
             key,
-            label: labelOf(key),
+            label: groupLabelOf(key),
             value: rowValue,
             fraction: fractionOf(rowValue, total),
             ...(metric.stackBy !== undefined && { segments: segmentsByGroup.get(key) ?? [] }),
@@ -104,6 +104,11 @@ function buildSeries(rows, seriesRows, fillBuckets) {
         points: fillBuckets(bucketsByGroup.get(row.key) ?? new Map()),
     }));
 }
+async function resolveReferencedGroupLabels(metric, params, groups) {
+    if (params.referenceLabels === undefined || metric.groupBy === undefined)
+        return new Map();
+    return params.referenceLabels(groups.map((row) => row.keys[0] ?? null));
+}
 export async function runMetric(db, metric, params) {
     const range = metric.window ?? params.range;
     const bucket = resolveBucket(metric, range);
@@ -129,7 +134,9 @@ export async function runMetric(db, metric, params) {
             row.value,
         ])))
         : [];
-    const rows = buildRows(metric, aggregates, value, labelOf);
+    const referencedLabels = await resolveReferencedGroupLabels(metric, params, aggregates.groups);
+    const groupLabelOf = (key) => metric.groupLabels?.[key] ?? referencedLabels.get(key) ?? key;
+    const rows = buildRows(metric, aggregates, value, labelOf, groupLabelOf);
     return {
         value,
         previousValue,

package/dist/metrics/feature.js

@@ -1,4 +1,5 @@
-import { access, defineFeature, defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { extractTableInfo } from "@cosmicdrift/kumiko-framework/db";
+import { access, defineFeature, defineQueryHandler, referenceGroupLabels, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
@@ -45,7 +46,7 @@ function createTenantMetricQuery(metric, now) {
         name: metric.id,
         description: metric.description,
         schema: tenantPayloadSchema(metric),
-        access: { roles: access.admin },
+        access: { roles: metric.access?.roles ?? access.admin },
         handler: async (query, ctx) => runMetric(ctx.db, metric, {
             range: query.payload.range,
             timeZone: query.payload.timeZone,
@@ -53,6 +54,9 @@ function createTenantMetricQuery(metric, now) {
             filterWhere: await resolveMetricFilterWhere(metric, query.payload, ctx),
             // ctx.db already reads own-tenant + SYSTEM reference rows; this narrows to own-tenant only.
             scopeWhere: { tenantId: query.user.tenantId },
+            referenceLabels: (keys) => metric.groupBy === undefined
+                ? Promise.resolve(new Map())
+                : referenceGroupLabels(ctx, query.user, extractTableInfo(metric.source).name, metric.groupBy, keys, ctx.db),
         }),
     });
 }

package/dist/metrics/types.d.ts

@@ -33,8 +33,12 @@ export type MetricDefinition = {
     readonly groupBy?: string;
     /** Second dimension, becomes `rows[].segments`; only without bucket. */
     readonly stackBy?: string;
-    /** Key value → i18n key, applied to groupBy and stackBy keys. */
+    /** Key value → i18n key, applied to groupBy and stackBy keys. Without an entry, a groupBy that is a single reference of an entity-table source is named after the referenced row (tenant scope, through the caller's read access); otherwise the key stays. */
     readonly groupLabels?: Readonly<Record<string, string>>;
+    /** Roles that may read the tenant query; default is the admin roles. Ignored for scope "system", which stays SystemAdmin only. */
+    readonly access?: {
+        readonly roles: readonly string[];
+    };
     readonly scopes: readonly MetricScope[];
 };
 export declare function defineMetric(definition: MetricDefinition): MetricDefinition;

package/dist/metrics/validate.js

@@ -25,6 +25,9 @@ function validateMetric(metric) {
         fail("has an id that is not kebab-case");
     if (metric.scopes.length === 0)
         fail("declares no scopes");
+    if (metric.access !== undefined && metric.access.roles.length === 0) {
+        fail("declares access with an empty roles list");
+    }
     const info = extractTableInfo(metric.source);
     validateColumns(metric, info, fail);
     validateFilters(metric, info, fail);

package/dist/personal-access-tokens/schema/api-token.d.ts

@@ -30,7 +30,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: true;
     };
     readonly expiresAt: {
@@ -46,7 +46,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
     };
     readonly revokedAt: {
@@ -62,7 +62,7 @@ export declare const apiTokenEntity: import("@cosmicdrift/kumiko-types/fields").
         readonly min?: string;
         readonly max?: string;
         readonly locale?: string;
-    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & import("@cosmicdrift/kumiko-types/fields").FieldStateConditions & {
         required: false;
     };
 }, "tenant">;