@cosmicdrift/kumiko-samples 0.351.0 → 0.353.0

package/packages/bundled-features/src/renderer-simple/mail-blocks.ts

@@ -0,0 +1,138 @@
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+
+export type MailTone = "neutral" | "info" | "success" | "warning" | "danger";
+export type MailStageState = "done" | "current" | "upcoming";
+
+export type MailBadge = { readonly label: string; readonly tone?: MailTone };
+export type MailStage = { readonly label: string; readonly state: MailStageState };
+export type MailChip = { readonly label: string; readonly tone?: MailTone };
+
+// Literal types (as const) keep the colors compile-time known, so they can go into style
+// attributes without escaping.
+const TONE_COLORS = {
+  neutral: { bg: "#f3f4f6", fg: "#374151" },
+  info: { bg: "#dbeafe", fg: "#1e40af" },
+  success: { bg: "#dcfce7", fg: "#166534" },
+  warning: { bg: "#fef3c7", fg: "#92400e" },
+  danger: { bg: "#fee2e2", fg: "#991b1b" },
+} as const satisfies Readonly<Record<MailTone, { readonly bg: string; readonly fg: string }>>;
+
+type ToneColors = (typeof TONE_COLORS)[MailTone];
+type PillMargin = "0" | "0 6px 6px 0";
+
+const STAGE_STATES: readonly MailStageState[] = ["done", "current", "upcoming"];
+const STAGE_DONE_COLOR = "#16a34a";
+const STAGE_UPCOMING_BG = "#e5e7eb";
+const STAGE_UPCOMING_FG = "#9ca3af";
+
+function isRecord(value: unknown): value is Readonly<Record<string, unknown>> {
+  return typeof value === "object" && value !== null;
+}
+
+function isMailTone(value: unknown): value is MailTone {
+  return typeof value === "string" && Object.hasOwn(TONE_COLORS, value);
+}
+
+function toneColors(tone: unknown): ToneColors {
+  return TONE_COLORS[isMailTone(tone) ? tone : "neutral"];
+}
+
+function isStageState(value: unknown): value is MailStageState {
+  return STAGE_STATES.some((state) => state === value);
+}
+
+// Template data is runtime data (variables of a stored template): entries that do not match are
+// skipped instead of failing the whole mail.
+function isStage(value: unknown): value is MailStage {
+  return isRecord(value) && typeof value["label"] === "string" && isStageState(value["state"]);
+}
+
+function isChip(value: unknown): value is MailChip {
+  return isRecord(value) && typeof value["label"] === "string";
+}
+
+export function parseBadge(value: unknown): MailBadge | undefined {
+  return isChip(value) && value.label !== "" ? value : undefined;
+}
+
+function validStages(value: unknown): readonly MailStage[] {
+  return Array.isArray(value) ? value.filter(isStage) : [];
+}
+
+function validChips(value: unknown): readonly MailChip[] {
+  return Array.isArray(value) ? value.filter(isChip) : [];
+}
+
+function pill(chip: MailChip, margin: PillMargin): string {
+  const { bg, fg } = toneColors(chip.tone);
+  return `<span style="display:inline-block;margin:${margin};padding:2px 10px;border-radius:999px;background:${bg};color:${fg};font-size:12px;font-weight:600;line-height:18px">${escapeHtml(chip.label)}</span>`;
+}
+
+export function renderBadge(badge: MailBadge): string {
+  return `<p style="margin:0 0 12px">${pill(badge, "0")}</p>`;
+}
+
+export function renderChips(chips: unknown): string {
+  const valid = validChips(chips);
+  if (valid.length === 0) return "";
+  return `<p style="margin:0 0 16px">${valid.map((chip) => pill(chip, "0 6px 6px 0")).join("")}</p>`;
+}
+
+function stageMarker(stage: MailStage, position: number, primaryColor: string): string {
+  const base =
+    "display:inline-block;width:24px;height:24px;line-height:24px;border-radius:12px;text-align:center;font-size:12px;font-weight:700";
+  const primary = escapeHtmlAttr(primaryColor);
+  if (stage.state === "done") {
+    return `<span style="${base};background:${STAGE_DONE_COLOR};color:#fff">&#10003;</span>`;
+  }
+  if (stage.state === "current") {
+    return `<span style="${base};background:#fff;border:2px solid ${primary};line-height:20px;width:20px;height:20px;color:${primary}">${position}</span>`;
+  }
+  return `<span style="${base};background:${STAGE_UPCOMING_BG};color:${STAGE_UPCOMING_FG}">${position}</span>`;
+}
+
+function stageCell(stage: MailStage, position: number, primaryColor: string): string {
+  const labelColor = stage.state === "upcoming" ? STAGE_UPCOMING_FG : "#111";
+  const weight = stage.state === "current" ? 700 : 400;
+  return `<td align="center" valign="top" style="padding:0 4px;font-family:sans-serif">${stageMarker(stage, position, primaryColor)}<div style="margin:4px 0 0;font-size:12px;font-weight:${weight};color:${labelColor}">${escapeHtml(stage.label)}</div></td>`;
+}
+
+function stageConnector(previous: MailStage): string {
+  const color = previous.state === "done" ? STAGE_DONE_COLOR : STAGE_UPCOMING_BG;
+  return `<td valign="top" style="padding:11px 0 0"><div style="width:24px;height:2px;line-height:2px;font-size:2px;background:${color}">&nbsp;</div></td>`;
+}
+
+export function renderStages(stages: unknown, primaryColor: string): string {
+  const valid = validStages(stages);
+  if (valid.length === 0) return "";
+  const cellsHtml = valid
+    .map((stage, index) => {
+      const previous = valid[index - 1];
+      const connector = previous ? stageConnector(previous) : "";
+      return `${connector}${stageCell(stage, index + 1, primaryColor)}`;
+    })
+    .join("");
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:0 0 16px"><tr>${cellsHtml}</tr></table>`;
+}
+
+const STAGE_TEXT_MARKER: Readonly<Record<MailStageState, string>> = {
+  done: "✓",
+  current: "▶",
+  upcoming: "○",
+};
+
+export function badgeText(badge: MailBadge): string {
+  return `[${badge.label}]`;
+}
+
+export function stagesText(stages: unknown): string {
+  return validStages(stages)
+    .map((stage) => `${STAGE_TEXT_MARKER[stage.state]} ${stage.label}`)
+    .join(" → ");
+}
+
+export function chipsText(chips: unknown): string {
+  return validChips(chips)
+    .map((chip) => chip.label)
+    .join(" · ");
+}

package/packages/bundled-features/src/renderer-simple/simple-renderer.ts

@@ -1,6 +1,18 @@
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import type { NotificationRenderer } from "../delivery/index.js";
 import { renderSafeMarkdown } from "../page-render/index.js";
+import {
+  badgeText,
+  chipsText,
+  type MailBadge,
+  type MailChip,
+  type MailStage,
+  parseBadge,
+  renderBadge,
+  renderChips,
+  renderStages,
+  stagesText,
+} from "./mail-blocks.js";
 
 export type MailBranding = {
   /** Shown as text when there is no logo, and as the logo alt text. */
@@ -170,10 +182,13 @@ type Section =
   | { readonly text: string }
   | { readonly heading: string }
   | { readonly markdown: string }
-  | { readonly button: { readonly label: string; readonly url: string } };
+  | { readonly button: { readonly label: string; readonly url: string } }
+  | { readonly stages: readonly MailStage[] }
+  | { readonly chips: readonly MailChip[] };
 
 type EmailTemplateData = {
   // Preferred: structured email data
+  readonly badge?: MailBadge;
   readonly header?: string;
   readonly sections?: readonly Section[];
   readonly footer?: string;
@@ -183,6 +198,7 @@ type EmailTemplateData = {
 };
 
 function templateContent(variables: Readonly<Record<string, unknown>>): {
+  readonly badge: MailBadge | undefined;
   readonly header: string | undefined;
   readonly sections: readonly Section[] | undefined;
   readonly footer: string | undefined;
@@ -190,6 +206,7 @@ function templateContent(variables: Readonly<Record<string, unknown>>): {
   const data = variables as EmailTemplateData; // @cast-boundary render-helper
   // Without structured fields, title + body become the header and a single text section.
   return {
+    badge: parseBadge(data.badge),
     header: data.header ?? data.title,
     sections: data.sections ?? (data.body ? [{ text: data.body }] : undefined),
     footer: data.footer,
@@ -202,6 +219,8 @@ function sectionText(section: Section): string {
   if ("heading" in section) return section.heading;
   if ("markdown" in section) return section.markdown;
   if ("button" in section) return `${section.button.label}: ${section.button.url}`;
+  if ("stages" in section) return stagesText(section.stages);
+  if ("chips" in section) return chipsText(section.chips);
   return "";
 }
 
@@ -219,6 +238,8 @@ function renderSection(section: Section, primaryColor: string): string {
   if ("button" in section) {
     return `<p style="margin:0 0 16px"><a href="${escapeHtml(section.button.url)}" style="display:inline-block;padding:10px 24px;background:${escapeHtmlAttr(primaryColor)};color:#fff;text-decoration:none;border-radius:4px;font-size:14px">${escapeHtml(section.button.label)}</a></p>`;
   }
+  if ("stages" in section) return renderStages(section.stages, primaryColor);
+  if ("chips" in section) return renderChips(section.chips);
   return "";
 }
 
@@ -232,13 +253,15 @@ export function createSimpleRenderer(branding?: MailBranding): NotificationRende
     name: "simple",
 
     async render(input) {
-      const { header, sections, footer } = templateContent(input.variables);
+      const { badge, header, sections, footer } = templateContent(input.variables);
 
       const parts: string[] = [];
       parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
       parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
       parts.push(renderBrandingHeader(branding, primaryColor, logoUrl));
 
+      if (badge) parts.push(renderBadge(badge));
+
       if (header) {
         parts.push(
           `<h1 style="margin:0 0 24px;color:#111;font-size:20px;font-weight:600">${escapeHtml(header)}</h1>`,
@@ -263,9 +286,15 @@ export function createSimpleRenderer(branding?: MailBranding): NotificationRende
     },
 
     async renderText(input) {
-      const { header, sections, footer } = templateContent(input.variables);
+      const { badge, header, sections, footer } = templateContent(input.variables);
       const brandingFooter = brandingFooterLines(branding, input.locale).join("\n");
-      return [header, ...(sections ?? []).map(sectionText), footer, brandingFooter]
+      return [
+        badge ? badgeText(badge) : undefined,
+        header,
+        ...(sections ?? []).map(sectionText),
+        footer,
+        brandingFooter,
+      ]
         .filter((block): block is string => block !== undefined && block !== "")
         .join("\n\n");
     },

package/packages/bundled-features/src/seo/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "sitemap.xml and llms.txt answer 429 when the managed-pages read is rate limited instead of omitting the pages"
+  },
   {
     "version": "0.147.3",
     "type": "fix",

package/packages/bundled-features/src/seo/feature.ts

@@ -5,9 +5,10 @@ import {
   type FeatureDefinition,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
 import { LEGAL_ROUTES } from "../legal-pages/index.js";
 import { cachedSecurePageResponse } from "../page-render/index.js";
-import type { SystemQueryFn } from "../shared/index.js";
+import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.js";
 import { SEO_CONFIG_KEYS, SEO_DEFAULT_PATHS } from "./constants.js";
 import { seoConfigQuery } from "./handlers/seo-config.query.js";
 import { buildLlmsTxt } from "./llms-txt.js";
@@ -125,7 +126,9 @@ async function gatherEntries(
             lastmod: page.updatedAt,
           });
         }
-      } catch {
+      } catch (error) {
+        // A rate limit must not look like "pages removed" to a crawler.
+        if (error instanceof RateLimitError) throw error;
         // managed-pages unreachable/not mounted — degrade to callback-only entries.
       }
     }
@@ -188,7 +191,13 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
       anonymous: true,
       handler: async (c, { systemQuery }) => {
         const { origin, host } = requestHost(c);
-        const entries = await gatherEntries(opts, systemQuery, origin, host);
+        let entries: SitemapEntry[];
+        try {
+          entries = await gatherEntries(opts, systemQuery, origin, host);
+        } catch (error) {
+          if (error instanceof RateLimitError) return rateLimitedTextResponse(error);
+          throw error;
+        }
         const xml = buildSitemapXml(entries);
         const etag = computeRevisionEtag([host, xml]);
         return cachedSecurePageResponse(c.req.raw, {
@@ -209,10 +218,17 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
         const tenantId = opts.managedPages
           ? ((await opts.managedPages.resolveApexTenant(host)) ?? SYSTEM_TENANT_ID)
           : SYSTEM_TENANT_ID;
-        const [entries, seoConfig] = await Promise.all([
-          gatherEntries(opts, systemQuery, origin, host),
-          readSeoConfig(systemQuery, tenantId),
-        ]);
+        let entries: SitemapEntry[];
+        let seoConfig: SeoConfigValues;
+        try {
+          [entries, seoConfig] = await Promise.all([
+            gatherEntries(opts, systemQuery, origin, host),
+            readSeoConfig(systemQuery, tenantId),
+          ]);
+        } catch (error) {
+          if (error instanceof RateLimitError) return rateLimitedTextResponse(error);
+          throw error;
+        }
         const sections =
           entries.length > 0
             ? [

package/packages/bundled-features/src/shared/assert-no-where-rule-in-ownership-write.ts

@@ -0,0 +1,25 @@
+import type { OwnershipMap } from "@cosmicdrift/kumiko-framework/engine";
+
+// Boot validation rejects `{ kind: "where" }` in access.write too (fw#2626);
+// failing at factory time names the option instead of an entity scope.
+export function assertNoWhereRuleInOwnershipWrite(
+  factoryName: string,
+  writeOwnership: OwnershipMap | undefined,
+): void {
+  // skip: no write ownership declared, nothing to validate
+  if (!writeOwnership) return;
+  const hasWhereRule = Object.values(writeOwnership).some(
+    (rule) => rule !== "all" && rule.kind === "where",
+  );
+  // skip: no where-rule present, the option is valid
+  if (!hasWhereRule) return;
+  throw new Error(
+    `${factoryName}({ ownership }): ownership.write must not contain a ` +
+      '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
+      "layer (the read path, via buildOwnershipClause). Write paths that " +
+      "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
+      "evaluate them, so such a rule can only ever deny — boot validation " +
+      "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
+      "leave it unset.",
+  );
+}

package/packages/bundled-features/src/shared/index.ts

@@ -1,4 +1,5 @@
 export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
+export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
 export {
   type ChunkedMigrationOptions,
   type ChunkedMigrationResult,
@@ -14,7 +15,6 @@ export { decryptStoredPii } from "./decrypt-stored-pii.js";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
 export { entitiesOf } from "./entities-of.js";
 export { isWithinGracePeriod } from "./grace-period.js";
-export { hasWhereRule } from "./has-where-rule.js";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
@@ -25,6 +25,7 @@ export {
   parentRowIsVisible,
 } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
+export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export {
   redactBotTokens,
   redactEmailAddresses,

package/packages/bundled-features/src/shared/rate-limited-text-response.ts

@@ -0,0 +1,11 @@
+import type { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
+
+export function rateLimitedTextResponse(error: RateLimitError): Response {
+  return new Response("rate limited", {
+    status: 429,
+    headers: {
+      "content-type": "text/plain; charset=utf-8",
+      "retry-after": String(error.details.retryAfterSeconds),
+    },
+  });
+}

package/packages/bundled-features/src/tags/feature.ts

@@ -27,7 +27,7 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { hasWhereRule } from "../shared/index.js";
+import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
 import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./constants.js";
 import { createTagAssignmentEntity, tagEntity } from "./entity.js";
 import { createTagAssignmentExecutor } from "./executor.js";
@@ -201,17 +201,7 @@ export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof tagsFea
         "admissible as a host instead.",
     );
   }
-  if (hasWhereRule(opts.ownership?.write)) {
-    throw new Error(
-      "createTagsFeature({ ownership }): ownership.write must not contain a " +
-        '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
-        "layer (the read path, via buildOwnershipClause). Write paths that " +
-        "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them, so such a rule can only ever deny — boot validation " +
-        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
-        "leave it unset.",
-    );
-  }
+  assertNoWhereRuleInOwnershipWrite("createTagsFeature", opts.ownership?.write);
   const access = resolveAccess(opts);
   return defineFeature(TAGS_FEATURE_NAME, (r) =>
     registerTags(r, access, opts.toggleable, opts.ownership, opts.parents),

package/packages/bundled-features/src/tenant/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "breaking",
+    "title": "Tenant names are encrypted under the tenant record and crypto-shredded when the tenant is destroyed",
+    "detail": "Tenant names are PII encrypted under the tenant record and crypto-shredded on tenant destroy\n`tenant.name` is now `personal: { of: \"id\" }`, so it is stored as `kumiko-pii:` ciphertext in events and in `read_tenants`. Signup no longer writes the email into the tenant name; it uses the generated tenant key. The tenant destroy job erases the tenant record key and purges the tenant's search documents. The tenant queries (`me`, memberships, tenant-directory, user list, cap-overview, tenants-missing-profile) decrypt the name, and the tenant list sorts by `key` because encrypted names are not sortable.",
+    "migration": "After the bump run the PII backfill (backfillEventPiiEncryption), then rebuild the read_tenants projection; the backfill only encrypts event payloads. Raw reads of read_tenants.name in apps now return ciphertext and must go through decryptStoredPii or the tenant query handlers. Tenants that were already destroyed (read_tenants.destroyed_at set) get the erased sentinel instead of a fresh record key."
+  },
   {
     "version": "0.341.0",
     "type": "improvement",

package/packages/bundled-features/src/tenant/decrypt-tenant-names.ts

@@ -0,0 +1,17 @@
+import { decryptStoredPii, mapWithConcurrency } from "../shared/index.js";
+
+// Bounded like tenant:query:members: each decrypt hits the KMS adapter's small pool.
+const KMS_POOL_CONCURRENCY = 4;
+
+// Raw reads of read_tenants return the stored column, which is ciphertext
+// under an active KMS; executor reads (crud.list/detail) decrypt on their own.
+export async function decryptTenantNames<T extends { readonly name?: unknown }>(
+  rows: readonly T[],
+  fallbackRequestId: string,
+): Promise<T[]> {
+  return mapWithConcurrency(rows, KMS_POOL_CONCURRENCY, async (row) =>
+    typeof row.name === "string"
+      ? { ...row, name: await decryptStoredPii(row.name, "name", fallbackRequestId) }
+      : row,
+  );
+}

package/packages/bundled-features/src/tenant/handlers/me.query.ts

@@ -2,6 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { decryptTenantNames } from "../decrypt-tenant-names.js";
 import { tenantTable } from "../schema/tenant.js";
 
 // Direct query — query handlers don't have a tenant-crud handle. A direct
@@ -33,6 +34,8 @@ export const meQuery = defineQueryHandler({
     }
     const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
     const row = await fetchOne(db, tenantTable, { id: query.user.tenantId });
-    return row ?? null;
+    if (row === undefined) return null;
+    const [decrypted] = await decryptTenantNames([row], "tenant:me");
+    return decrypted ?? null;
   },
 });

package/packages/bundled-features/src/tenant/handlers/memberships.query.ts

@@ -3,6 +3,7 @@ import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/e
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
+import { decryptTenantNames } from "../decrypt-tenant-names.js";
 import { tenantMembershipsTable } from "../membership-table.js";
 import { tenantTable } from "../schema/tenant.js";
 
@@ -32,9 +33,12 @@ export const membershipsQuery = defineQueryHandler({
     // prefix would be indistinguishable). A single IN-batch over all
     // tenantIds instead of fetchOne per membership (#324).
     type TenantRow = { id: unknown; name?: unknown; key?: unknown; isEnabled?: unknown };
-    const tenants = await selectMany<TenantRow>(db, tenantTable, {
-      id: rows.map((row) => row["tenantId"]),
-    });
+    const tenants = await decryptTenantNames(
+      await selectMany<TenantRow>(db, tenantTable, {
+        id: rows.map((row) => row["tenantId"]),
+      }),
+      "tenant:memberships",
+    );
     const tenantById = new Map<unknown, TenantRow>(tenants.map((t) => [t.id, t]));
 
     return rows

package/packages/bundled-features/src/tenant/handlers/tenant-directory.query.ts

@@ -6,6 +6,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { decryptTenantNames } from "../decrypt-tenant-names.js";
 import { tenantTable } from "../schema/tenant.js";
 import { isSystemAdmin } from "./is-system-admin.js";
 
@@ -48,7 +49,7 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
       tenants = await selectMany(db, tenantTable, undefined, {
         limit: scanLimit,
         orderBy: [
-          { col: "name", direction: "asc" },
+          { col: "key", direction: "asc" },
           { col: "id", direction: "asc" },
         ],
       });
@@ -57,10 +58,15 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
       const row = await fetchOne(db, tenantTable, { id: query.user.tenantId });
       tenants = row ? [row] : [];
     }
-    const labeled = tenants.map((tenant) => {
-      const id = String(tenant.id);
-      return { id, label: typeof tenant.name === "string" ? tenant.name : id };
-    });
+    // name is ciphertext at rest, so the SQL page is keyed by the plaintext
+    // `key`; label order and search happen in memory after decrypting.
+    const decrypted = await decryptTenantNames(tenants, "tenant:tenant-directory");
+    const labeled = decrypted
+      .map((tenant) => {
+        const id = String(tenant.id);
+        return { id, label: typeof tenant.name === "string" ? tenant.name : id };
+      })
+      .sort((a, b) => a.label.localeCompare(b.label) || a.id.localeCompare(b.id));
     const needle = search?.toLowerCase();
     const rows =
       needle === undefined

package/packages/bundled-features/src/tenant/index.ts

@@ -7,6 +7,7 @@ export {
   TenantHandlers,
   TenantQueries,
 } from "./constants.js";
+export { decryptTenantNames } from "./decrypt-tenant-names.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export type { InvitationStatus } from "./invitation-table.js";
 export {

package/packages/bundled-features/src/tenant/schema/tenant.ts

@@ -28,19 +28,17 @@ export const tenantEntity = createEntity({
     key: createTextField({
       required: true,
       maxLength: 50,
+      sortable: true,
       personal: false,
       reason: "technical_reference",
     }),
-    // Workspace/company display name, not an individual's identity —
-    // same class as the `company.legalName` example in the boot-validator's
-    // own PII-heuristic doc-comment.
+    // Subject is the tenant record itself: tenant events live in the writer's (system) tenant stream, so `personal: "tenant"` would not resolve to this tenant.
     name: createTextField({
       required: true,
       maxLength: 200,
       searchable: true,
-      sortable: true,
-      personal: false,
-      reason: "is_business_data",
+      personal: { of: "id" },
+      find: "none",
     }),
     isEnabled: createBooleanField({ default: true, filterable: true }),
     // Tenant-destroy lifecycle (tenant-lifecycle feature). Defaults keep

package/packages/bundled-features/src/tenant/screens.ts

@@ -43,7 +43,7 @@ export const tenantListScreen: EntityListScreenDefinition = {
       entityId: "id",
     },
   ],
-  defaultSort: { field: "name", dir: "asc" },
+  defaultSort: { field: "key", dir: "asc" },
   searchable: true,
   access: { roles: ["SystemAdmin"] },
   // Inert until an app navs it (see file header) — no nav area to resolve

package/packages/bundled-features/src/tenant-handover/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Tenant handover claims fail with transfer_graph_too_deep only when rows exist beyond the last allowed hop",
+    "detail": "Tenant handover only fails with `transfer_graph_too_deep` when rows really hang below the fifth hop, and failed workflow runs report the suspended step\nA claim used to fail whenever the last round's entity type had outgoing edges, even with no rows behind them, so a chain of exactly five hops with an unrestricted `parentRef` entity registered was rejected. `workflow.run-failed` carries the real `stepIndex` for the unsupported-suspension case instead of always 0."
+  },
   {
     "version": "0.321.0",
     "type": "improvement",

package/packages/bundled-features/src/tenant-handover/move-entity-graph.ts

@@ -268,7 +268,7 @@ export async function moveTransferGraph(args: {
     { entityName: rootEntityName, rowIds: [rootRowId] },
   ];
 
-  for (let round = 0; round < MAX_TRANSFER_DEPTH && pending.length > 0; round++) {
+  for (let round = 0; round <= MAX_TRANSFER_DEPTH && pending.length > 0; round++) {
     // Merged per type so an edge leaving a type runs once per round, not once
     // per edge that reached it.
     const discovered = new Map<string, string[]>();
@@ -330,25 +330,18 @@ export async function moveTransferGraph(args: {
       }
     }
 
-    pending = [...discovered].map(([entityName, rowIds]) => ({ entityName, rowIds }));
-  }
+    // The extra round past the limit is a probe: it only exists to find out
+    // whether rows still hang below the last allowed hop. Its moves are rolled
+    // back with the transaction when this throws.
+    const [strandedEntityName] = discovered.keys();
+    if (round === MAX_TRANSFER_DEPTH && strandedEntityName !== undefined) {
+      throw new UnprocessableError("transfer_graph_too_deep", {
+        i18nKey: "errors.tenantHandover.transferGraphTooDeep",
+        details: { entityName: strandedEntityName },
+      });
+    }
 
-  // The depth limit is a safety net, not a licence to move part of a graph: if
-  // rounds ran out while rows remain whose type still leads somewhere, the
-  // declaration reaches further than the mover does, and returning quietly
-  // would leave exactly the orphaned rows #3088 is about.
-  //
-  // Rounds count hops of both edge kinds, while the boot validator measures
-  // reference chains between transferable entities only. A graph that fills the
-  // limit with reference hops and then adds a parentRef child therefore boots
-  // clean and fails here instead — the residual the validator cannot see, and
-  // the reason this check has to exist rather than trusting boot alone.
-  const stranded = pending.find(({ entityName }) => (adjacency.get(entityName) ?? []).length > 0);
-  if (stranded !== undefined) {
-    throw new UnprocessableError("transfer_graph_too_deep", {
-      i18nKey: "errors.tenantHandover.transferGraphTooDeep",
-      details: { entityName: stranded.entityName },
-    });
+    pending = [...discovered].map(([entityName, rowIds]) => ({ entityName, rowIds }));
   }
 
   return movedCounts;

package/packages/bundled-features/src/tenant-lifecycle/feature.ts

@@ -141,6 +141,7 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
           now,
           log: (message) => ctx.log?.warn(message),
           fileProviderResolver: ctx._fileProviderResolver,
+          searchAdapter: ctx.searchAdapter,
           escapeHatchAuditSink: ctx._escapeHatchAuditSink,
           actor: ctx.systemUser.id,
         });