@cosmicdrift/kumiko-samples 0.352.0 → 0.353.0

package/packages/bundled-features/src/jobs/handlers/list.query.ts

@@ -1,11 +1,13 @@
 import { countWhere, selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
 import { jobRunsTable } from "../job-run-table.js";
 
 const KMS_POOL_CONCURRENCY = 4;
+const DEFAULT_PAGE_SIZE = 50;
 
 const jobRunStatusSchema = z.enum(["queued", "running", "completed", "failed"]);
 
@@ -23,6 +25,31 @@ async function decryptRunRow<T extends Record<string, unknown>>(row: T): Promise
   return result;
 }
 
+type JobRunStatus = z.infer<typeof jobRunStatusSchema>;
+
+function buildListWhere(payload: {
+  readonly jobName?: string | undefined;
+  readonly status?: JobRunStatus | undefined;
+  readonly filters?: readonly { readonly value: readonly JobRunStatus[] }[] | undefined;
+}): WhereObject {
+  const where: WhereObject = {};
+  if (payload.jobName) where["jobName"] = payload.jobName;
+  const statuses = payload.filters?.[0]?.value ?? (payload.status ? [payload.status] : []);
+  if (statuses.length === 1) where["status"] = statuses[0];
+  else if (statuses.length > 1) where["status"] = { in: statuses };
+  return where;
+}
+
+function parseOffsetCursor(cursor: string | undefined): number {
+  const offset = cursor ? Number(decodeCursor(cursor)) : 0;
+  if (!Number.isInteger(offset) || offset < 0) {
+    throw new ValidationError({
+      fields: [{ path: "cursor", code: "invalid_cursor", i18nKey: "jobs.errors.invalidCursor" }],
+    });
+  }
+  return offset;
+}
+
 export const listQuery = defineQueryHandler({
   name: "list",
   description:
@@ -42,6 +69,7 @@ export const listQuery = defineQueryHandler({
     sort: z.enum(["jobName", "status", "startedAt", "duration"]).optional(),
     sortDirection: z.enum(["asc", "desc"]).optional(),
     limit: z.number().optional(),
+    cursor: z.string().optional(),
     totalCount: z.boolean().optional(),
   }),
   access: { roles: ["SystemAdmin"] },
@@ -54,17 +82,22 @@ export const listQuery = defineQueryHandler({
     const db = ctx.systemDb.unsafeRaw(
       "cross-tenant job monitoring: SystemAdmin lists job runs of every tenant",
     );
-    const where: WhereObject = {};
-    if (query.payload.jobName) where["jobName"] = query.payload.jobName;
-    const statusFilter = query.payload.filters?.find((filter) => filter.field === "status");
-    const statuses = statusFilter?.value ?? (query.payload.status ? [query.payload.status] : []);
-    if (statuses.length === 1) where["status"] = statuses[0];
-    else if (statuses.length > 1) where["status"] = { in: statuses };
+    const where = buildListWhere(query.payload);
     const sortColumn = query.payload.sort ?? "startedAt";
-    const rows = await selectMany(db, jobRunsTable, where, {
-      orderBy: { col: sortColumn, direction: query.payload.sortDirection ?? "desc" },
-      limit: query.payload.limit ?? 50,
+    const limit = query.payload.limit ?? DEFAULT_PAGE_SIZE;
+    const offset = parseOffsetCursor(query.payload.cursor);
+    const direction = query.payload.sortDirection ?? "desc";
+    // selectMany has no OFFSET: read through the end of the page plus one probe
+    // row, then slice. `id` as tiebreaker keeps pages stable for non-unique sorts.
+    const fetched = await selectMany(db, jobRunsTable, where, {
+      orderBy: [
+        { col: sortColumn, direction },
+        { col: "id", direction },
+      ],
+      limit: offset + limit + 1,
     });
+    const hasMore = fetched.length > offset + limit;
+    const rows = fetched.slice(offset, offset + limit);
     // countWhere reruns the SAME `where` without the limit — `rows.length` is
     // capped at the page size and would silently undercount the total.
     const total =
@@ -72,7 +105,7 @@ export const listQuery = defineQueryHandler({
     // payload/error are stored encrypted under the triggering user's DEK (#799, #2307).
     return {
       rows: await mapWithConcurrency(rows, KMS_POOL_CONCURRENCY, decryptRunRow),
-      nextCursor: null,
+      nextCursor: hasMore ? encodeCursor(String(offset + limit)) : null,
       ...(total !== undefined && { total }),
     };
   },

package/packages/bundled-features/src/jobs/i18n.ts

@@ -36,6 +36,7 @@ export const JOBS_I18N: Readonly<Record<string, LocalizedString>> = {
   "jobs.detail.logs": { en: "Logs" },
   "jobs.detail.retry": { en: "Retry" },
   "jobs.trigger.title": { en: "Run a job" },
+  "jobs.errors.invalidCursor": { en: "The pagination cursor is invalid." },
   "jobs.trigger.submit": { en: "Run" },
   "jobs.errors.unknownJob": { en: "Unknown job." },
   "jobs.errors.notManual": {

package/packages/bundled-features/src/ledger/entity.ts

@@ -94,12 +94,14 @@ export const transactionEntity = createEntity({
     // Optional business-object reference (e.g. a lease contract) so entries can
     // be filtered by what they're about, not just grepped out of `reference`.
     subjectType: createTextField({
+      minLength: 1,
       maxLength: 64,
       personal: false,
       reason: "technical_reference",
       filterable: true,
     }),
     subjectId: createTextField({
+      minLength: 1,
       maxLength: 128,
       personal: false,
       reason: "technical_reference",
@@ -147,12 +149,14 @@ export const scheduleEntity = createEntity({
     // Confirmed periods inherit this from the schedule (see
     // confirm-schedule-period.write.ts) rather than repeating it per period.
     subjectType: createTextField({
+      minLength: 1,
       maxLength: 64,
       personal: false,
       reason: "technical_reference",
       filterable: true,
     }),
     subjectId: createTextField({
+      minLength: 1,
       maxLength: 128,
       personal: false,
       reason: "technical_reference",

package/packages/bundled-features/src/ledger/schemas.ts

@@ -28,8 +28,14 @@ export const createTransactionPayloadSchema = z
     status: z.enum(TRANSACTION_STATUS).optional(),
     lines: z.array(postingSchema).min(2),
     // Business-object reference (e.g. a lease contract) this entry is about.
-    subjectType: z.string().max(64).optional(),
-    subjectId: z.string().max(128).optional(),
+    subjectType: z.string().min(1).max(64).optional(),
+    subjectId: z.string().min(1).max(128).optional(),
+  })
+  // Ids are only unique within their type, so a lone subjectId would match
+  // bookings of a different object type.
+  .refine((p) => (p.subjectType === undefined) === (p.subjectId === undefined), {
+    message: "subjectType and subjectId must be set together",
+    path: ["subjectId"],
   })
   .refine((p) => sumIsZero(p.lines), {
     message: "Transaction must balance: Σ of posting amounts must equal 0",

package/packages/bundled-features/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "A rate-limited page request answers 429 with Retry-After instead of 503 or an unbranded page",
+    "detail": "Managed pages and sitemap answer 429 when rate limited, agent catalog checks the deny list, draft cleanup continues past skipped rows\nA rate-limited managed-page request now answers 429 with `Retry-After` instead of 503 or an unbranded page, and `sitemap.xml` and `llms.txt` answer 429 instead of silently dropping the managed-page entries. `buildToolCatalog` throws when its manifest was built with `denyQns` that the catalog options lack. The form-draft cleanup no longer stops when a whole batch was re-saved by users in the meantime."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -1,5 +1,6 @@
 import { computeRevisionEtag, etagMatches } from "@cosmicdrift/kumiko-framework/api";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
 import {
   type BrandingTokens,
   cachedSecurePageResponse,
@@ -7,7 +8,7 @@ import {
   renderSafeMarkdown,
   wrapInLayout,
 } from "../page-render/index.js";
-import type { SystemQueryFn } from "../shared/index.js";
+import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.js";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding.js";
 import { createBrandingQuery } from "./handlers/branding.query.js";
 import { bySlugQuery } from "./handlers/by-slug.query.js";
@@ -51,16 +52,18 @@ function brandingRevisionSeed(branding: BrandingTokens): string {
   ]);
 }
 
-// Never throws: a query failure or malformed result degrades to the
-// unbranded default (branding is decoration, not a hard dependency of the
-// page render).
+// A query failure or malformed result degrades to the unbranded default
+// (branding is decoration, not a hard dependency of the page render). A rate
+// limit is rethrown so the route answers 429 instead of serving (and caching)
+// an unbranded page.
 async function readBrandingViaSystemQuery(
   systemQuery: SystemQueryFn,
   tenantId: string,
 ): Promise<BrandingTokens> {
   try {
     return coerceBranding(await systemQuery(BRANDING_QUERY_QN, {}, tenantId));
-  } catch {
+  } catch (error) {
+    if (error instanceof RateLimitError) throw error;
     return EMPTY_BRANDING;
   }
 }
@@ -207,12 +210,22 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
         // von resolverTrust: "authoritative" zurecht abgelehnt; siehe
         // systemQuery's Doc in http-route.ts). Branding ist Deko → ein
         // Fehlschlag degradiert zum unbranded Default, blockt nie die Page.
-        const [pageSettled, brandingResult] = await Promise.all([
-          systemQuery(BY_SLUG_QN, { slug, lang }, tenantId)
-            .then((data) => ({ ok: true as const, data: data as BySlugQueryResult }))
-            .catch(() => ({ ok: false as const, data: null as BySlugQueryResult })),
-          readBrandingViaSystemQuery(systemQuery, tenantId),
-        ]);
+        let pageSettled: { ok: true; data: BySlugQueryResult } | { ok: false };
+        let brandingResult: BrandingTokens;
+        try {
+          [pageSettled, brandingResult] = await Promise.all([
+            systemQuery(BY_SLUG_QN, { slug, lang }, tenantId)
+              .then((data) => ({ ok: true as const, data: data as BySlugQueryResult }))
+              .catch((error: unknown) => {
+                if (error instanceof RateLimitError) throw error;
+                return { ok: false as const };
+              }),
+            readBrandingViaSystemQuery(systemQuery, tenantId),
+          ]);
+        } catch (error) {
+          if (error instanceof RateLimitError) return rateLimitedTextResponse(error);
+          throw error;
+        }
         if (!pageSettled.ok) return c.text("page unavailable", 503);
 
         const data = pageSettled.data;

package/packages/bundled-features/src/notes-history/feature.ts

@@ -20,7 +20,7 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { hasWhereRule } from "../shared/index.js";
+import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
 import { DEFAULT_NOTES_HISTORY_ACCESS, NOTES_HISTORY_FEATURE_NAME } from "./constants.js";
 import { createNoteEntryEntity, noteMentionEntity } from "./entity.js";
 import { createNoteEntryExecutor } from "./executor.js";
@@ -123,17 +123,7 @@ export function createNotesHistoryFeature(
   ) {
     return notesHistoryFeature;
   }
-  if (hasWhereRule(opts.ownership?.write)) {
-    throw new Error(
-      "createNotesHistoryFeature({ ownership }): ownership.write must not contain a " +
-        '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
-        "layer (the read path, via buildOwnershipClause). Write paths that " +
-        "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them, so such a rule can only ever deny — boot validation " +
-        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
-        "leave it unset.",
-    );
-  }
+  assertNoWhereRuleInOwnershipWrite("createNotesHistoryFeature", opts.ownership?.write);
   // A mount that accepts no parents at all can never take a note write —
   // that's a config mistake, not a valid allowlist. Omit `parents` instead
   // of passing an empty array.

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -4,10 +4,25 @@ import {
   type ProjectionListScreenDefinition,
   type SecretMintScreenDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries } from "./constants.js";
+import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
+import { fieldOptionLabelKeyPrefix } from "@cosmicdrift/kumiko-headless";
+import {
+  PAT_FEATURE,
+  PAT_MINT_SCREEN_ID,
+  PAT_SCREEN_ID,
+  PatHandlers,
+  PatQueries,
+} from "./constants.js";
 import type { PatScopeConfig } from "./scopes.js";
 
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
+// Same keys the mint form's `scopes` multiSelect options resolve through
+// (see patScopeOptionTranslations), so list and form show identical labels.
+const PAT_SCOPE_OPTION_KEY_PREFIX = fieldOptionLabelKeyPrefix(
+  PAT_FEATURE,
+  ACTION_FORM_ENTITY,
+  "scopes",
+);
 
 // Both screens render only for tenants whose tier includes the feature; the
 // availability query is rejected by the feature gate otherwise.
@@ -29,11 +44,17 @@ export const patListScreen: ProjectionListScreenDefinition = {
   defaultSort: { field: "createdAt", dir: "desc" },
   columns: [
     { field: "name", label: i18nKey("pat.list.col.name") },
-    { field: "prefix", label: i18nKey("pat.list.col.prefix") },
-    { field: "scopes", label: i18nKey("pat.list.col.scopes") },
+    { field: "prefix", label: i18nKey("pat.list.col.prefix"), sortable: false },
+    {
+      field: "scopes",
+      label: i18nKey("pat.list.col.scopes"),
+      sortable: false,
+      renderer: { format: "enumOption", keyPrefix: PAT_SCOPE_OPTION_KEY_PREFIX },
+    },
     {
       field: "status",
       label: i18nKey("pat.list.col.status"),
+      sortable: false,
       renderer: { format: "enumOption", keyPrefix: PAT_STATUS_OPTION_KEY_PREFIX },
     },
     {

package/packages/bundled-features/src/seo/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "sitemap.xml and llms.txt answer 429 when the managed-pages read is rate limited instead of omitting the pages"
+  },
   {
     "version": "0.147.3",
     "type": "fix",

package/packages/bundled-features/src/seo/feature.ts

@@ -5,9 +5,10 @@ import {
   type FeatureDefinition,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
 import { LEGAL_ROUTES } from "../legal-pages/index.js";
 import { cachedSecurePageResponse } from "../page-render/index.js";
-import type { SystemQueryFn } from "../shared/index.js";
+import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.js";
 import { SEO_CONFIG_KEYS, SEO_DEFAULT_PATHS } from "./constants.js";
 import { seoConfigQuery } from "./handlers/seo-config.query.js";
 import { buildLlmsTxt } from "./llms-txt.js";
@@ -125,7 +126,9 @@ async function gatherEntries(
             lastmod: page.updatedAt,
           });
         }
-      } catch {
+      } catch (error) {
+        // A rate limit must not look like "pages removed" to a crawler.
+        if (error instanceof RateLimitError) throw error;
         // managed-pages unreachable/not mounted — degrade to callback-only entries.
       }
     }
@@ -188,7 +191,13 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
       anonymous: true,
       handler: async (c, { systemQuery }) => {
         const { origin, host } = requestHost(c);
-        const entries = await gatherEntries(opts, systemQuery, origin, host);
+        let entries: SitemapEntry[];
+        try {
+          entries = await gatherEntries(opts, systemQuery, origin, host);
+        } catch (error) {
+          if (error instanceof RateLimitError) return rateLimitedTextResponse(error);
+          throw error;
+        }
         const xml = buildSitemapXml(entries);
         const etag = computeRevisionEtag([host, xml]);
         return cachedSecurePageResponse(c.req.raw, {
@@ -209,10 +218,17 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
         const tenantId = opts.managedPages
           ? ((await opts.managedPages.resolveApexTenant(host)) ?? SYSTEM_TENANT_ID)
           : SYSTEM_TENANT_ID;
-        const [entries, seoConfig] = await Promise.all([
-          gatherEntries(opts, systemQuery, origin, host),
-          readSeoConfig(systemQuery, tenantId),
-        ]);
+        let entries: SitemapEntry[];
+        let seoConfig: SeoConfigValues;
+        try {
+          [entries, seoConfig] = await Promise.all([
+            gatherEntries(opts, systemQuery, origin, host),
+            readSeoConfig(systemQuery, tenantId),
+          ]);
+        } catch (error) {
+          if (error instanceof RateLimitError) return rateLimitedTextResponse(error);
+          throw error;
+        }
         const sections =
           entries.length > 0
             ? [

package/packages/bundled-features/src/shared/assert-no-where-rule-in-ownership-write.ts

@@ -0,0 +1,25 @@
+import type { OwnershipMap } from "@cosmicdrift/kumiko-framework/engine";
+
+// Boot validation rejects `{ kind: "where" }` in access.write too (fw#2626);
+// failing at factory time names the option instead of an entity scope.
+export function assertNoWhereRuleInOwnershipWrite(
+  factoryName: string,
+  writeOwnership: OwnershipMap | undefined,
+): void {
+  // skip: no write ownership declared, nothing to validate
+  if (!writeOwnership) return;
+  const hasWhereRule = Object.values(writeOwnership).some(
+    (rule) => rule !== "all" && rule.kind === "where",
+  );
+  // skip: no where-rule present, the option is valid
+  if (!hasWhereRule) return;
+  throw new Error(
+    `${factoryName}({ ownership }): ownership.write must not contain a ` +
+      '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
+      "layer (the read path, via buildOwnershipClause). Write paths that " +
+      "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
+      "evaluate them, so such a rule can only ever deny — boot validation " +
+      "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
+      "leave it unset.",
+  );
+}

package/packages/bundled-features/src/shared/index.ts

@@ -1,4 +1,5 @@
 export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
+export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
 export {
   type ChunkedMigrationOptions,
   type ChunkedMigrationResult,
@@ -14,7 +15,6 @@ export { decryptStoredPii } from "./decrypt-stored-pii.js";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
 export { entitiesOf } from "./entities-of.js";
 export { isWithinGracePeriod } from "./grace-period.js";
-export { hasWhereRule } from "./has-where-rule.js";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
@@ -25,6 +25,7 @@ export {
   parentRowIsVisible,
 } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
+export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
 export {
   redactBotTokens,
   redactEmailAddresses,

package/packages/bundled-features/src/shared/rate-limited-text-response.ts

@@ -0,0 +1,11 @@
+import type { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
+
+export function rateLimitedTextResponse(error: RateLimitError): Response {
+  return new Response("rate limited", {
+    status: 429,
+    headers: {
+      "content-type": "text/plain; charset=utf-8",
+      "retry-after": String(error.details.retryAfterSeconds),
+    },
+  });
+}

package/packages/bundled-features/src/tags/feature.ts

@@ -27,7 +27,7 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { hasWhereRule } from "../shared/index.js";
+import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
 import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./constants.js";
 import { createTagAssignmentEntity, tagEntity } from "./entity.js";
 import { createTagAssignmentExecutor } from "./executor.js";
@@ -201,17 +201,7 @@ export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof tagsFea
         "admissible as a host instead.",
     );
   }
-  if (hasWhereRule(opts.ownership?.write)) {
-    throw new Error(
-      "createTagsFeature({ ownership }): ownership.write must not contain a " +
-        '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
-        "layer (the read path, via buildOwnershipClause). Write paths that " +
-        "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them, so such a rule can only ever deny — boot validation " +
-        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
-        "leave it unset.",
-    );
-  }
+  assertNoWhereRuleInOwnershipWrite("createTagsFeature", opts.ownership?.write);
   const access = resolveAccess(opts);
   return defineFeature(TAGS_FEATURE_NAME, (r) =>
     registerTags(r, access, opts.toggleable, opts.ownership, opts.parents),

package/packages/bundled-features/src/tenant/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "breaking",
+    "title": "Tenant names are encrypted under the tenant record and crypto-shredded when the tenant is destroyed",
+    "detail": "Tenant names are PII encrypted under the tenant record and crypto-shredded on tenant destroy\n`tenant.name` is now `personal: { of: \"id\" }`, so it is stored as `kumiko-pii:` ciphertext in events and in `read_tenants`. Signup no longer writes the email into the tenant name; it uses the generated tenant key. The tenant destroy job erases the tenant record key and purges the tenant's search documents. The tenant queries (`me`, memberships, tenant-directory, user list, cap-overview, tenants-missing-profile) decrypt the name, and the tenant list sorts by `key` because encrypted names are not sortable.",
+    "migration": "After the bump run the PII backfill (backfillEventPiiEncryption), then rebuild the read_tenants projection; the backfill only encrypts event payloads. Raw reads of read_tenants.name in apps now return ciphertext and must go through decryptStoredPii or the tenant query handlers. Tenants that were already destroyed (read_tenants.destroyed_at set) get the erased sentinel instead of a fresh record key."
+  },
   {
     "version": "0.341.0",
     "type": "improvement",

package/packages/bundled-features/src/tenant/decrypt-tenant-names.ts

@@ -0,0 +1,17 @@
+import { decryptStoredPii, mapWithConcurrency } from "../shared/index.js";
+
+// Bounded like tenant:query:members: each decrypt hits the KMS adapter's small pool.
+const KMS_POOL_CONCURRENCY = 4;
+
+// Raw reads of read_tenants return the stored column, which is ciphertext
+// under an active KMS; executor reads (crud.list/detail) decrypt on their own.
+export async function decryptTenantNames<T extends { readonly name?: unknown }>(
+  rows: readonly T[],
+  fallbackRequestId: string,
+): Promise<T[]> {
+  return mapWithConcurrency(rows, KMS_POOL_CONCURRENCY, async (row) =>
+    typeof row.name === "string"
+      ? { ...row, name: await decryptStoredPii(row.name, "name", fallbackRequestId) }
+      : row,
+  );
+}

package/packages/bundled-features/src/tenant/handlers/me.query.ts

@@ -2,6 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { decryptTenantNames } from "../decrypt-tenant-names.js";
 import { tenantTable } from "../schema/tenant.js";
 
 // Direct query — query handlers don't have a tenant-crud handle. A direct
@@ -33,6 +34,8 @@ export const meQuery = defineQueryHandler({
     }
     const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
     const row = await fetchOne(db, tenantTable, { id: query.user.tenantId });
-    return row ?? null;
+    if (row === undefined) return null;
+    const [decrypted] = await decryptTenantNames([row], "tenant:me");
+    return decrypted ?? null;
   },
 });

package/packages/bundled-features/src/tenant/handlers/memberships.query.ts

@@ -3,6 +3,7 @@ import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/e
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
+import { decryptTenantNames } from "../decrypt-tenant-names.js";
 import { tenantMembershipsTable } from "../membership-table.js";
 import { tenantTable } from "../schema/tenant.js";
 
@@ -32,9 +33,12 @@ export const membershipsQuery = defineQueryHandler({
     // prefix would be indistinguishable). A single IN-batch over all
     // tenantIds instead of fetchOne per membership (#324).
     type TenantRow = { id: unknown; name?: unknown; key?: unknown; isEnabled?: unknown };
-    const tenants = await selectMany<TenantRow>(db, tenantTable, {
-      id: rows.map((row) => row["tenantId"]),
-    });
+    const tenants = await decryptTenantNames(
+      await selectMany<TenantRow>(db, tenantTable, {
+        id: rows.map((row) => row["tenantId"]),
+      }),
+      "tenant:memberships",
+    );
     const tenantById = new Map<unknown, TenantRow>(tenants.map((t) => [t.id, t]));
 
     return rows

package/packages/bundled-features/src/tenant/handlers/tenant-directory.query.ts

@@ -6,6 +6,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { decryptTenantNames } from "../decrypt-tenant-names.js";
 import { tenantTable } from "../schema/tenant.js";
 import { isSystemAdmin } from "./is-system-admin.js";
 
@@ -48,7 +49,7 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
       tenants = await selectMany(db, tenantTable, undefined, {
         limit: scanLimit,
         orderBy: [
-          { col: "name", direction: "asc" },
+          { col: "key", direction: "asc" },
           { col: "id", direction: "asc" },
         ],
       });
@@ -57,10 +58,15 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
       const row = await fetchOne(db, tenantTable, { id: query.user.tenantId });
       tenants = row ? [row] : [];
     }
-    const labeled = tenants.map((tenant) => {
-      const id = String(tenant.id);
-      return { id, label: typeof tenant.name === "string" ? tenant.name : id };
-    });
+    // name is ciphertext at rest, so the SQL page is keyed by the plaintext
+    // `key`; label order and search happen in memory after decrypting.
+    const decrypted = await decryptTenantNames(tenants, "tenant:tenant-directory");
+    const labeled = decrypted
+      .map((tenant) => {
+        const id = String(tenant.id);
+        return { id, label: typeof tenant.name === "string" ? tenant.name : id };
+      })
+      .sort((a, b) => a.label.localeCompare(b.label) || a.id.localeCompare(b.id));
     const needle = search?.toLowerCase();
     const rows =
       needle === undefined

package/packages/bundled-features/src/tenant/index.ts

@@ -7,6 +7,7 @@ export {
   TenantHandlers,
   TenantQueries,
 } from "./constants.js";
+export { decryptTenantNames } from "./decrypt-tenant-names.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export type { InvitationStatus } from "./invitation-table.js";
 export {

package/packages/bundled-features/src/tenant/schema/tenant.ts

@@ -28,19 +28,17 @@ export const tenantEntity = createEntity({
     key: createTextField({
       required: true,
       maxLength: 50,
+      sortable: true,
       personal: false,
       reason: "technical_reference",
     }),
-    // Workspace/company display name, not an individual's identity —
-    // same class as the `company.legalName` example in the boot-validator's
-    // own PII-heuristic doc-comment.
+    // Subject is the tenant record itself: tenant events live in the writer's (system) tenant stream, so `personal: "tenant"` would not resolve to this tenant.
     name: createTextField({
       required: true,
       maxLength: 200,
       searchable: true,
-      sortable: true,
-      personal: false,
-      reason: "is_business_data",
+      personal: { of: "id" },
+      find: "none",
     }),
     isEnabled: createBooleanField({ default: true, filterable: true }),
     // Tenant-destroy lifecycle (tenant-lifecycle feature). Defaults keep

package/packages/bundled-features/src/tenant/screens.ts

@@ -43,7 +43,7 @@ export const tenantListScreen: EntityListScreenDefinition = {
       entityId: "id",
     },
   ],
-  defaultSort: { field: "name", dir: "asc" },
+  defaultSort: { field: "key", dir: "asc" },
   searchable: true,
   access: { roles: ["SystemAdmin"] },
   // Inert until an app navs it (see file header) — no nav area to resolve

package/packages/bundled-features/src/tenant-handover/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Tenant handover claims fail with transfer_graph_too_deep only when rows exist beyond the last allowed hop",
+    "detail": "Tenant handover only fails with `transfer_graph_too_deep` when rows really hang below the fifth hop, and failed workflow runs report the suspended step\nA claim used to fail whenever the last round's entity type had outgoing edges, even with no rows behind them, so a chain of exactly five hops with an unrestricted `parentRef` entity registered was rejected. `workflow.run-failed` carries the real `stepIndex` for the unsupported-suspension case instead of always 0."
+  },
   {
     "version": "0.321.0",
     "type": "improvement",