@cosmicdrift/kumiko-samples 0.356.0 → 0.358.0

package/packages/bundled-features/src/jobs/job-run-logger.ts

@@ -14,6 +14,7 @@ import {
   KeyErasedError,
   type LocalKeyKmsAdapter,
   PII_ERASED_SENTINEL,
+  type SubjectId,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import { acquireNamespacedAdvisoryLock, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
@@ -71,6 +72,15 @@ const DEFAULT_CACHE_MAX_ENTRIES = 10_000;
 // to DB-lookup if actually needed.
 const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 
+// Run rows hang on SYSTEM_TENANT_ID and a null trigger is a cron/system run;
+// job-run-table.ts declares whenAbsent: "tenant" for exactly that case, so the
+// logger must resolve the same subject the entity chain would (fw#3654).
+function jobRunSubject(triggeredById: string | null): SubjectId {
+  return triggeredById === null
+    ? { kind: "tenant", tenantId: SYSTEM_TENANT_ID }
+    : { kind: "user", userId: triggeredById };
+}
+
 // Same per-subject encryption as encryptFailureError/encryptStartedPayload,
 // applied to a single value — shared so payload/message/error all go
 // through the identical erased-key fallback. A key erased right before (or
@@ -81,14 +91,14 @@ const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 // whole run row.
 async function encryptOrSentinel(
   kms: LocalKeyKmsAdapter,
-  subjectUserId: string,
+  subject: SubjectId,
   value: string,
   field: string,
 ): Promise<string> {
   try {
     return await encryptPiiValueForSubject(
       kms,
-      { kind: "user", userId: subjectUserId },
+      subject,
       value,
       { requestId: "jobs:job-run-logger" },
       field,
@@ -104,20 +114,20 @@ async function encryptOrSentinel(
 // jobRunLogsTable — that table is unmanaged/direct-write, so there is no
 // event-piiFields catalog to lean on here either. "message" is the AAD
 // field name and must match the field passed to decryptStoredPii on read
-// (detail.query.ts) or decrypt fails loud. Same skip rules as the payload:
-// null subject (system/cron runs) and absent KMS (rollout mode) both stay
-// plaintext. Bounded concurrency (#2307) — unbounded Promise.all would fire
-// one getOrCreateDek per log line at once against the KMS adapter's pool.
+// (detail.query.ts) or decrypt fails loud. Same skip rule as the payload:
+// absent KMS (rollout mode) stays plaintext. Bounded concurrency (#2307) —
+// unbounded Promise.all would fire one getOrCreateDek per log line at once
+// against the KMS adapter's pool.
 async function encryptLogMessages<T extends { readonly message: string }>(
   logs: readonly T[],
   triggeredById: string | null,
 ): Promise<T[]> {
-  if (triggeredById === null) return [...logs];
   const kms = configuredPiiSubjectKms();
   if (!kms) return [...logs];
+  const subject = jobRunSubject(triggeredById);
   return mapWithConcurrency(logs, KMS_POOL_CONCURRENCY, async (log) => ({
     ...log,
-    message: await encryptOrSentinel(kms, triggeredById, log.message, "message"),
+    message: await encryptOrSentinel(kms, subject, log.message, "message"),
   }));
 }
 
@@ -131,29 +141,27 @@ export async function encryptFailureError(
   error: string,
   triggeredById: string | null,
 ): Promise<string> {
-  if (triggeredById === null) return error;
   const kms = configuredPiiSubjectKms();
   if (!kms) return error;
-  return encryptOrSentinel(kms, triggeredById, error, "error");
+  return encryptOrSentinel(kms, jobRunSubject(triggeredById), error, "error");
 }
 
 // The run-started payload can carry arbitrary user data; triggeredById
 // names its owning user. No event-PII catalog involved (#2243 removed the
 // jobRun r.defineEvent registrations, so there is nothing to catalog) —
 // the subject is known statically, so we encrypt directly. A null subject
-// (system cron runs, recipient-less triggers) stays plaintext: there is no
-// user key to shred, mirroring the previous event-pii catalog's own skip
-// rule. Absent KMS adapter stays plaintext too (rollout mode, unchanged).
+// (system cron runs, recipient-less triggers) encrypts under the system
+// tenant key. Absent KMS adapter stays plaintext (rollout mode, unchanged).
 // A key already erased by the time the trigger lands (#2307) must not fail
 // the whole run-start write — sentinel like the log/error paths.
 async function encryptStartedPayload(
   payload: string | null,
   triggeredById: string | null,
 ): Promise<string | null> {
-  if (payload === null || triggeredById === null) return payload;
+  if (payload === null) return payload;
   const kms = configuredPiiSubjectKms();
   if (!kms) return payload;
-  return encryptOrSentinel(kms, triggeredById, payload, "payload");
+  return encryptOrSentinel(kms, jobRunSubject(triggeredById), payload, "payload");
 }
 
 // pg_advisory_xact_lock namespace (int4): 'tjfl' as ASCII, disjoint from the

package/packages/bundled-features/src/jobs/job-run-table.ts

@@ -46,11 +46,18 @@ export const jobRunEntity = createEntity({
     status: createTextField({ required: true, personal: false, reason: "system_metadata" }),
     // The run-started payload can carry arbitrary caller-supplied data,
     // encrypted by job-run-logger.ts under the triggering user's DEK (see
-    // jobs-pii-kms.integration.test.ts) — same subject as `triggeredById`.
-    payload: createTextField({ personal: { of: "triggeredById" }, find: "none" }),
+    // jobs-pii-kms.integration.test.ts) — same subject as `triggeredById`;
+    // cron runs have none and use the system tenant key (whenAbsent).
+    payload: createTextField({
+      personal: { of: "triggeredById", whenAbsent: "tenant" },
+      find: "none",
+    }),
     // Failure messages can echo payload content back — same subject/DEK as
     // `payload` (job-run-logger.ts encryptFailureError).
-    error: createTextField({ personal: { of: "triggeredById" }, find: "none" }),
+    error: createTextField({
+      personal: { of: "triggeredById", whenAbsent: "tenant" },
+      find: "none",
+    }),
     attempt: createNumberField({ required: true, default: 1, integer: true }),
     startedAt: createTimestampField({ required: true }),
     finishedAt: createTimestampField(),

package/packages/bundled-features/src/notes-history/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.358.0",
+    "type": "fix",
+    "title": "forget-subject shreds note bodies even when the host entity has anonymize or blockDelete retention",
+    "detail": "Note bodies that @-mention the forgotten subject or hang on it as host entity were skipped when the host entity's retention strategy was anonymize or blockDelete, so the note text stayed readable while the host's own PII fields were anonymized. The note text is free-form PII, and a retention strategy protects the row, not its content, so these bodies are now always crypto-shredded. This applies to the manual `forget-subject` command and to the automated Art. 17 delete hook."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/notes-history/entity.ts

@@ -26,17 +26,18 @@ import {
 //
 // `body` is instead `personal: { of: "id" }` (Row-Subject, fw#2596/#2786):
 // the note's OWN row is its content's subject, so `body` is encrypted under a
-// per-note key that nothing else shares. That key gets erased only when
-// `note-mention` (below) names this note as reached by a forgotten subject
-// (see `notes-history-user-data/hooks.ts`) — a note with no mention on the
-// forgotten subject is untouched. GDPR erasure of the AUTHOR still separately
+// per-note key that nothing else shares. That key gets erased only when the
+// note is reached by a forgotten subject: `note-mention` (below) names the
+// subject, or the note hangs on the subject as host (entityId, plus entityType
+// for record subjects). See `notes-history-user-data/hooks.ts`; any other note
+// is untouched. GDPR erasure of the AUTHOR still separately
 // shreds `authorName` (`personal: { of: "authorId" }`, the name as stamped at
 // write time); the two erasures are independent.
 //
 // Known gap (fw#2596, not fixed by this entity): prose that names a third
 // party without a structured @-mention is not tracked — regex/NLP over
-// free text is unreliable. The operator's manual `forget-subject` path
-// covers what this structured trigger misses.
+// free text is unreliable. An operator must erase such a note's own record
+// subject (`forget-subject` kind "record", entity "note-entry") to cover it.
 export function createNoteEntryEntity(
   access?: EntityDefinition["access"],
   parents?: readonly string[],
@@ -76,9 +77,10 @@ export function createNoteEntryEntity(
       }),
       // Stamped once at write time, never re-resolved later — the history
       // needs the name as it was then, not whatever the account is called now.
+      // whenAbsent: authorless notes (system-written) encrypt under the tenant key.
       authorName: createTextField({
         maxLength: 200,
-        personal: { of: "authorId" },
+        personal: { of: "authorId", whenAbsent: "tenant" },
         find: "none",
       }),
       body: createLongTextField({

package/packages/bundled-features/src/notes-history-user-data/hooks.ts

@@ -4,14 +4,15 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 
-import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
-import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  resolveRetentionPolicyForTenant,
-  resolveTenantRetentionPreset,
-} from "../data-retention/index.js";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configuredPiiSubjectKms, type SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type {
+  TenantId,
+  UserDataDeleteHook,
+  UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { noteEntryTable, noteMentionTable } from "../notes-history/index.js";
-import { policyToStrategy } from "../user-data-rights/index.js";
 
 // note-entry has no per-tenant scope quirk (unlike folders) — it's genuinely
 // per-user content, so the export filters by authorId directly.
@@ -32,95 +33,102 @@ export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
+type NoteRow = {
+  readonly id: string;
+  readonly tenantId: TenantId;
+  readonly entityType: string;
+  readonly entityId: string;
+  readonly body: unknown;
+  readonly insertedAt: unknown;
+};
+
+// What erasing a subject's key reaches: notes that @-mention the subject plus notes
+// attached to it as host. Export and erasure both go through this, so Art. 15
+// lists exactly what Art. 17 shreds.
+async function selectNotesReachingSubject(
+  db: DbRunner | TenantDb,
+  subject: SubjectId,
+): Promise<readonly NoteRow[]> {
+  if (subject.kind === "tenant") return [];
+  const subjectId = subject.kind === "user" ? subject.userId : subject.id;
+  const attachedWhere =
+    subject.kind === "record"
+      ? { entityType: subject.entity, entityId: subjectId }
+      : { entityId: subjectId };
+
+  const mentions = await selectMany<{ noteId: string }>(db, noteMentionTable, { subjectId });
+  const mentioned =
+    mentions.length === 0
+      ? []
+      : await selectMany<NoteRow>(db, noteEntryTable, {
+          id: { in: [...new Set(mentions.map((m) => m.noteId))] },
+        });
+  const attached = await selectMany<NoteRow>(db, noteEntryTable, attachedWhere);
+
+  const byId = new Map<string, NoteRow>();
+  for (const note of [...mentioned, ...attached]) byId.set(note.id, note);
+  return [...byId.values()];
+}
+
 // `authorName` is separately annotated `personal: { of: "authorId" }`
 // (entity.ts), so forgetting the AUTHOR already crypto-shreds that field on
-// its own — unrelated to this hook. `body` is Row-Subject (`personal: { of:
-// "id" }`): its key is per-note, not per-user, so forgetting a user only
-// reaches a note's body when that note structurally @-mentions the user via
-// a `note-mention` row (fw#2787). Free-text mentions are NOT detected —
-// that's the documented gap in entity.ts, not a bug here.
+// its own. `body` is Row-Subject (`personal: { of: "id" }`): its key is per
+// note, so forgetting a subject only reaches a body when the note structurally
+// @-mentions the subject (`note-mention`, fw#2787) or hangs on it as host.
+// Free-text mentions are NOT detected — the documented gap in entity.ts.
 //
-// Per reached note: consult the HOST entity's (entityType, not note-entry's
-// own) retention strategy first — blockDelete/anonymize must win over
-// erasure, same rule the automated forget-cleanup pipeline applies to every
-// other entity. The `strategy` this hook itself is called with is resolved
-// for note-entry, not the host, so it is deliberately unused here.
+// Reached bodies are shredded regardless of the host entity's retention strategy:
+// the note text is free-form PII, and a host's anonymize/blockDelete protects the
+// row, not its content, just like the host's own PII fields get anonymized.
 //
-// Precondition: this ONLY erases anything if the app mounts a KMS adapter —
-// without one, record-owned fields fall back to plaintext storage
-// framework-wide (see pii-field-encryption.ts) and forget is a true no-op.
-// That gap is a property of the framework's crypto-shredding design, not
-// specific to this hook; apps that need Art.17 coverage without KMS must
-// mount one.
-export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
+// Without a mounted KMS this erases nothing: record-owned fields fall back to
+// plaintext framework-wide (see pii-field-encryption.ts), so apps that need
+// Art. 17 coverage must mount one.
+export async function eraseNoteBodiesReachingSubject(args: {
+  readonly db: DbRunner | TenantDb;
+  readonly subject: SubjectId;
+  readonly erasedBy: string;
+  readonly requestId: string;
+}): Promise<void> {
   const kms = configuredPiiSubjectKms();
-  // skip: no KMS adapter mounted — record-owned fields stay plaintext framework-wide, forget is a true no-op
+  // skip: no KMS adapter mounted — forget is a true no-op
   if (!kms) return;
 
-  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
-    subjectId: ctx.userId,
-  });
-  // skip: no note-mention rows for this user — nothing structurally reaches this user's data to shred
-  if (mentions.length === 0) return;
-
-  const noteIds = new Set(mentions.map((m) => m.noteId));
-  // Once per hook run: the preset depends on the tenant only, not the note.
-  const tenantPreset = await resolveTenantRetentionPreset({
-    db: ctx.db,
-    registry: ctx.registry,
-    tenantId: ctx.tenantId,
-  });
-  // Append-only rows are never hard-deleted, so every mentioned note should
-  // resolve; a missing one has no host and thus no retention policy to consult.
-  const notes = await ctx.db.selectMany<{ id: string; entityType: string }>(noteEntryTable, {
-    id: { in: [...noteIds] },
-  });
-  const strategyByEntityType = new Map<string, ReturnType<typeof policyToStrategy>>();
+  const notes = await selectNotesReachingSubject(args.db, args.subject);
   for (const note of notes) {
-    let strategy = strategyByEntityType.get(note.entityType);
-    if (strategy === undefined) {
-      const hostPolicy = await resolveRetentionPolicyForTenant({
-        db: ctx.db,
-        registry: ctx.registry,
-        tenantId: ctx.tenantId,
-        entityName: note.entityType,
-        preloadedTenantPreset: tenantPreset,
-      });
-      strategy = policyToStrategy(hostPolicy.policy?.strategy ?? null);
-      strategyByEntityType.set(note.entityType, strategy);
-    }
-    if (strategy === "anonymize") continue;
-    const noteId = note.id;
-
     await kms.eraseKey(
-      { kind: "record", entity: "note-entry", id: noteId },
+      { kind: "record", entity: "note-entry", id: note.id },
       {
-        requestId: "notes-history-user-data:forget-mentioned-notes",
-        userId: ctx.userId,
-        eraseReason: "notes-history:mention-forget",
+        requestId: args.requestId,
+        userId: args.erasedBy,
+        eraseReason: "notes-history:subject-forget",
       },
     );
   }
+}
+
+export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
+  await eraseNoteBodiesReachingSubject({
+    db: ctx.db,
+    subject: { kind: "user", userId: ctx.userId },
+    erasedBy: ctx.userId,
+    requestId: "notes-history-user-data:forget-reached-notes",
+  });
 };
 
-// Erasure reaches every note that structurally mentions the user (see
-// noteEntryDeleteHook), so the Art. 15/20 export must list those notes too.
+// Erasure reaches every note that mentions the user or hangs on the user as host
+// (see eraseNoteBodiesReachingSubject), so the Art. 15/20 export lists those too.
 export const noteMentionExportHook: UserDataExportHook = async (ctx) => {
-  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
-    subjectId: ctx.userId,
-  });
-  if (mentions.length === 0) return null;
-  const noteIds = [...new Set(mentions.map((m) => m.noteId))];
-  const notes = await ctx.db.selectMany(noteEntryTable, { id: { in: noteIds } });
+  const notes = await selectNotesReachingSubject(ctx.db, { kind: "user", userId: ctx.userId });
   if (notes.length === 0) return null;
   return {
     entity: "note-mention",
     rows: notes.map((note) => ({
-      noteId: note["id"],
-      entityType: note["entityType"],
-      entityId: note["entityId"],
-      body: note["body"],
-      insertedAt: note["insertedAt"],
+      noteId: note.id,
+      entityType: note.entityType,
+      entityId: note.entityId,
+      body: note.body,
+      insertedAt: note.insertedAt,
     })),
   };
 };

package/packages/bundled-features/src/notes-history-user-data/index.ts

@@ -13,9 +13,11 @@ import {
   noteMentionExportHook,
 } from "./hooks.js";
 
+export { eraseNoteBodiesReachingSubject } from "./hooks.js";
+
 export const notesHistoryUserDataFeature = defineFeature("notes-history-user-data", (r) => {
   r.describe(
-    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook looks up `note-mention` for notes that structurally @-mention the forgotten user and crypto-shreds each reached note's row-subject key (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for notes without such a mention. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (regardless of the host entity's retention strategy: the note text is free PII, the host's anonymize/blockDelete protects the row, not the content), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
   );
   // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
   // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -60,11 +60,13 @@ export const patListScreen: ProjectionListScreenDefinition = {
     {
       field: "createdAt",
       label: i18nKey("pat.list.col.created"),
+      hideOnNarrow: true,
       renderer: { format: "timestamp" },
     },
     {
       field: "expiresAt",
       label: i18nKey("pat.list.col.expires"),
+      hideOnNarrow: true,
       renderer: { format: "timestamp" },
     },
   ],

package/packages/bundled-features/src/sessions/screens.ts

@@ -48,6 +48,7 @@ export const createSessionListScreen = (
     {
       field: "revokedAt",
       label: i18nKey("sessions.list.col.revokedAt"),
+      hideOnNarrow: true,
       renderer: { format: "timestamp" },
     },
   ],
@@ -123,6 +124,7 @@ export const sessionMineScreen: ProjectionListScreenDefinition = {
     {
       field: "current",
       label: i18nKey("sessions.mine.col.current"),
+      hideOnNarrow: true,
       renderer: { format: "boolean" },
     },
   ],

package/packages/bundled-features/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "The member roles form only offers roles the signed-in admin may assign",
+    "detail": "New query tenant:query:member-role-availability; TenantAdmin still sees every role."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/tenant/constants.ts

@@ -26,9 +26,10 @@ export const MEMBER_ROLES_CELL_COMPONENT = "MemberRolesCell" as const;
 // Admin (rank 2) shares the invite-create screen with TenantAdmin — TenantAdmin
 // must not appear here or Admin sees an unassignable option (fw#2414).
 export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin"] as const;
-// Full assignable rank list, used by memberRolesEditScreen: that screen is
-// prefilled with a member's *current* roles, so it must be able to represent
-// every rank a membership can actually hold, including TenantAdmin (fw#2452).
+// Full rank list for memberRolesEditScreen: it is prefilled with a member's
+// *current* roles, so it must represent every rank a membership can hold,
+// including TenantAdmin (fw#2452). The screen hides what the caller may not
+// assign via TenantQueries.memberRoleAvailability.
 export const OWNER_INVITE_ROLE_OPTIONS = [
   "User",
   "Member",
@@ -67,6 +68,8 @@ export const TenantQueries = {
   invitations: "tenant:query:invitations",
   // Combined active-members + pending-invitations list backing /members.
   teamList: "tenant:query:team:list",
+  // Per-role assignability for the caller, mirrors the rank rule of updateMemberRoles.
+  memberRoleAvailability: "tenant:query:member-role-availability",
 } as const;
 
 // Error codes

package/packages/bundled-features/src/tenant/feature.ts

@@ -20,6 +20,7 @@ import { invitationsQuery } from "./handlers/invitations.query.js";
 import { listQuery } from "./handlers/list.query.js";
 import { meQuery } from "./handlers/me.query.js";
 import { memberDirectoryQuery } from "./handlers/member-directory.query.js";
+import { memberRoleAvailabilityQuery } from "./handlers/member-role-availability.query.js";
 import { membersQuery } from "./handlers/members.query.js";
 import { membershipsQuery } from "./handlers/memberships.query.js";
 import { removeMemberWrite } from "./handlers/remove-member.write.js";
@@ -166,6 +167,7 @@ export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefi
       resolveUserIds: r.queryHandler(resolveUserIdsQuery),
       invitations: r.queryHandler(invitationsQuery),
       teamList: r.queryHandler(teamListQuery),
+      memberRoleAvailability: r.queryHandler(memberRoleAvailabilityQuery),
     };
 
     // Entity-convention handlers for the SystemAdmin entityList/entityEdit

package/packages/bundled-features/src/tenant/handlers/member-role-availability.query.ts

@@ -0,0 +1,25 @@
+import {
+  access,
+  assignableAppRolesOf,
+  canActorAssignRole,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { memberRoleOptions } from "../member-role-options.js";
+
+export const memberRoleAvailabilityQuery = defineQueryHandler({
+  name: "member-role-availability",
+  schema: z.object({}),
+  access: { roles: access.admin },
+  description:
+    "Lists every role the member roles form offers and whether the caller's own rank may assign it; the form hides the roles marked disabled.",
+  handler: async (query, ctx) => {
+    const assignableAppRoles = assignableAppRolesOf(ctx.registry);
+    return {
+      rows: memberRoleOptions(assignableAppRoles).map((value) => ({
+        value,
+        disabled: !canActorAssignRole(query.user.roles, value, assignableAppRoles),
+      })),
+    };
+  },
+});

package/packages/bundled-features/src/tenant/member-role-options.ts

@@ -0,0 +1,6 @@
+import type { AssignableAppRoles } from "@cosmicdrift/kumiko-framework/engine";
+import { OWNER_INVITE_ROLE_OPTIONS } from "./constants.js";
+
+export function memberRoleOptions(assignableAppRoles: AssignableAppRoles): readonly string[] {
+  return [...OWNER_INVITE_ROLE_OPTIONS, ...assignableAppRoles.keys()];
+}

package/packages/bundled-features/src/tenant/screens.ts

@@ -15,10 +15,10 @@ import {
   MEMBER_ROLES_EDIT_SCREEN_ID,
   MEMBER_STATUS_CELL_COMPONENT,
   MEMBERS_SCREEN_ID,
-  OWNER_INVITE_ROLE_OPTIONS,
   TenantHandlers,
   TenantQueries,
 } from "./constants.js";
+import { memberRoleOptions } from "./member-role-options.js";
 
 // Cross-tenant SystemAdmin platform view of the tenants themselves. The tenant
 // feature runs with `r.systemScope()`, so the entityList returns every tenant.
@@ -107,6 +107,7 @@ export function createMembersScreen(options?: {
         field: "lastSeenAt",
         label: i18nKey("tenant.members.col.lastActivity"),
         renderer: { format: "timestamp" },
+        hideOnNarrow: true,
       },
     ],
     defaultSort: { field: "createdAt", dir: "desc" },
@@ -199,13 +200,15 @@ export function createMemberRolesEditScreen(assignableAppRoles: AssignableAppRol
     cancelTarget: MEMBERS_SCREEN_ID,
     fields: {
       userId: { type: "text", required: true },
-      // Prefilled with the member's current roles, so the option list must be
-      // able to represent every assignable rank — DEFAULT_INVITE_ROLE_OPTIONS
-      // omits TenantAdmin and would silently strip it on submit. Escalation
-      // still stays server-side via findForbiddenRoleAssignment (update-member-roles.write.ts).
+      // Prefilled with the member's current roles, so the static options must
+      // represent every rank (DEFAULT_INVITE_ROLE_OPTIONS omits TenantAdmin and
+      // would silently strip it on submit); the availability query hides what the
+      // caller may not assign. Enforcement stays server-side via
+      // findForbiddenRoleAssignment (update-member-roles.write.ts).
       roles: {
         type: "multiSelect",
-        options: [...OWNER_INVITE_ROLE_OPTIONS, ...assignableAppRoles.keys()],
+        options: memberRoleOptions(assignableAppRoles),
+        optionsAvailabilityQuery: TenantQueries.memberRoleAvailability,
         required: true,
       },
     },

package/packages/bundled-features/src/user/screens.ts

@@ -17,7 +17,14 @@ export const userListScreen: EntityListScreenDefinition = {
   id: "user-list",
   type: "entityList",
   entity: "user",
-  columns: ["email", "displayName", "roles", "tenants", "status", "emailVerified"],
+  columns: [
+    "email",
+    "displayName",
+    "roles",
+    "tenants",
+    "status",
+    { field: "emailVerified", hideOnNarrow: true },
+  ],
   rowActions: [
     {
       kind: "navigate",

package/packages/bundled-features/src/user-data-rights/screens.ts

@@ -68,7 +68,14 @@ export const downloadAttemptListScreen: EntityListScreenDefinition = {
   id: "download-attempt-list",
   type: "entityList",
   entity: "download-attempt",
-  columns: ["attemptedAt", "result", "via", "ip", "attemptedByUserId", "jobId"],
+  columns: [
+    "attemptedAt",
+    "result",
+    "via",
+    "ip",
+    { field: "attemptedByUserId", hideOnNarrow: true },
+    { field: "jobId", hideOnNarrow: true },
+  ],
   searchable: false,
   access: { roles: access.systemAdmin },
   // Inert until an app navs it (see file header) — no nav area to resolve

package/packages/bundled-features/src/waitlist/screens.ts

@@ -6,7 +6,14 @@ export const waitlistListScreen: EntityListScreenDefinition = {
   id: "waitlist-list",
   type: "entityList",
   entity: "waitlistEntry",
-  columns: ["name", "email", "company", "status", "locale", "submittedAt"],
+  columns: [
+    "name",
+    "email",
+    "company",
+    "status",
+    "locale",
+    { field: "submittedAt", hideOnNarrow: true },
+  ],
   defaultSort: { field: "submittedAt", dir: "desc" },
   access: adminAccess,
   searchable: true,

package/samples/apps/marketing-demo/src/features/assets/schema/asset.ts

@@ -116,10 +116,10 @@ export const assetListScreen: EntityListScreenDefinition = {
     "status",
     "department",
     "owner",
-    "location",
-    "vendor",
-    "purchaseDate",
-    "warrantyUntil",
+    { field: "location", hideOnNarrow: true },
+    { field: "vendor", hideOnNarrow: true },
+    { field: "purchaseDate", hideOnNarrow: true },
+    { field: "warrantyUntil", hideOnNarrow: true },
   ],
   pageSize: 25,
   defaultSort: { field: "name", dir: "asc" },

package/samples/apps/marketing-demo/src/features/helpdesk/schema/ticket.ts

@@ -123,10 +123,10 @@ export const ticketListScreen: EntityListScreenDefinition = {
     "severity",
     "status",
     "department",
-    "assignee",
-    "reporter",
-    "dueDate",
-    "spentMinutes",
+    { field: "assignee", hideOnNarrow: true },
+    { field: "reporter", hideOnNarrow: true },
+    { field: "dueDate", hideOnNarrow: true },
+    { field: "spentMinutes", hideOnNarrow: true },
   ],
   pageSize: 25,
   defaultSort: { field: "severity", dir: "desc" },