@cosmicdrift/kumiko-types 0.355.0 → 0.357.0

package/dist/event-store-executor-types.d.ts

@@ -13,7 +13,7 @@ export type StreamTenantOption = {
     readonly streamTenantId?: TenantId | undefined;
 };
 export type EventStoreExecutor = {
-    create: (payload: Record<string, unknown>, user: SessionUser, db: TenantDb, options?: {
+    create: (payload: Record<string, unknown>, user: SessionUser, db: TenantDb, options?: StreamTenantOption & {
         preSave?: PreSaveRunner;
     }) => Promise<WriteResult<SaveContext>>;
     update: (payload: {
@@ -23,6 +23,7 @@ export type EventStoreExecutor = {
     }, user: SessionUser, db: TenantDb, options?: StreamTenantOption & {
         skipOptimisticLock?: boolean;
         skipUnchanged?: boolean;
+        includeDeleted?: boolean;
         preSave?: PreSaveRunner;
         expect?: Readonly<Record<string, string | number | boolean | null>>;
     }) => Promise<WriteResult<SaveContext>>;

package/dist/fields.d.ts

@@ -85,6 +85,9 @@ export type TextFieldDef = {
     /** Lower bound enforced by the generated write schema, so short input is
      *  rejected by validation instead of reaching the handler. */
     readonly minLength?: number;
+    /** HTML `autocomplete` token for the rendered input (e.g. "one-time-code"),
+     *  so browsers and password managers offer or suppress autofill correctly. */
+    readonly autoComplete?: string;
     readonly required?: boolean;
     readonly searchable?: boolean;
     readonly sortable?: boolean;
@@ -273,6 +276,11 @@ export type MultiSelectFieldDef<TOptions extends readonly string[] = readonly st
      *  `"checkboxes"` grid becomes scrollable. Omitted = the grid grows with its
      *  content and never scrolls. Ignored unless `display: "checkboxes"`. */
     readonly maxRows?: number;
+    /** Query returning `{ rows: { value, disabled?, hint? }[] }`. The renderer hides
+     *  options whose row has `disabled: true` unless the value is currently selected;
+     *  `hint` is ignored. Static `options` stay authoritative and the write path must
+     *  enforce the same rule, the renderer only mirrors it. Called with an empty payload. */
+    readonly optionsAvailabilityQuery?: string;
 } & ResolvedPiiFlags;
 /**
  * Storage: `integer` flag decides the Postgres column type, not just Zod

package/dist/handlers.d.ts

@@ -183,6 +183,10 @@ export type EscapeHatchUseEvent = {
 };
 export type EscapeHatchAuditSink = (event: EscapeHatchUseEvent) => Promise<void>;
 export type EscapeHatchReporter = (kind: EscapeHatchKind, reason: string, target?: EscapeHatchTarget) => void;
+export type TenantWriteTarget = {
+    readonly db: TenantDb;
+    readonly streamTenantId: TenantId | undefined;
+};
 type SharedContextFields = {
     readonly redis?: Redis;
     readonly cacheSync?: CacheSyncBus;
@@ -197,6 +201,15 @@ type SharedContextFields = {
      * the config feature wired its accessor factory.
      */
     readonly configFor?: (tenantId: TenantId) => ConfigAccessor;
+    /**
+     * Write target for ANOTHER tenant: a tenant-mode db bound to it plus the
+     * `streamTenantId` to hand the executor, so the event actor stays the
+     * operator. Cross-tenant calls throw AccessDeniedError unless the caller is
+     * SystemAdmin (the tenantIdOverride gate); the caller's own tenant needs no
+     * privilege and yields `streamTenantId: undefined`. Write handlers only;
+     * absent for r.systemScope() handlers and without a db.
+     */
+    readonly forTenant?: (tenantId: TenantId) => TenantWriteTarget;
     readonly _configAccessorFactory?: ConfigAccessorFactory;
     readonly configEncryption?: import("./envelope-cipher-types.js").EnvelopeCipher;
     readonly rateLimit?: import("./rate-limit-types.js").RateLimitResolver;

package/dist/screen.d.ts

@@ -1299,16 +1299,24 @@ export type EntityEditScreenDefinition = {
      *  das `mask.title`-Label des Config-Keys. Fehlt ein Eintrag, gilt die
      *  Konvention. */
     readonly fieldLabels?: Readonly<Record<string, string>>;
-    /** Header action buttons. Reuses `RowAction` — analogous to
+    /** Record actions. Reuses `RowAction` — analogous to
      *  `ProjectionDetailScreenDefinition.actions` (the loaded record stands
      *  in for the "row"). `rowClick` has no target here and is rejected by
      *  the boot-validator, same as on projectionDetail. Not rendered in
      *  create mode — every action targets an existing record, which the
-     *  create branch doesn't have yet. */
-    readonly actions?: readonly RowAction[];
+     *  create branch doesn't have yet. By default an action renders with the
+     *  secondary form actions (footer, next to copy-link/delete/cancel);
+     *  `placement: "menu"` moves it into the header "…" menu, ahead of
+     *  copy-link/delete. Without a header menu (drawer, card form, shell
+     *  without a header slot) a "menu" action falls back to inline. */
+    readonly actions?: readonly EntityEditAction[];
     readonly slots?: ScreenSlots;
     readonly access?: AccessRule;
 };
+export type EntityEditActionPlacement = "inline" | "menu";
+export type EntityEditAction = RowAction & {
+    readonly placement?: EntityEditActionPlacement;
+};
 export type ActionFormScreenDefinition = {
     readonly id: string;
     readonly type: "actionForm";
@@ -1480,6 +1488,10 @@ export type SecretReveal = {
     readonly warning?: string;
     /** i18n key for the acknowledge button. Default "kumiko.secretMint.confirm". */
     readonly confirmLabel?: string;
+    /** i18n key for a checkbox on the reveal card ("I have saved my recovery
+     *  codes"). While unchecked, the confirm step's submit or the acknowledge
+     *  button stays disabled. The tick is UI-only and never part of a payload. */
+    readonly acknowledge?: string;
 };
 /** Mint form → one-time reveal → explicit confirm. The secret (API token,
  *  recovery codes) lives only in the write-handler's own success payload —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.355.0",
+  "version": "0.357.0",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "MultiSelectFieldDef.optionsAvailabilityQuery hides static multiSelect options per caller",
+    "detail": "The query returns { rows: { value, disabled?, hint? }[] }; disabled options are hidden unless currently selected."
+  },
   {
     "version": "0.352.0",
     "type": "improvement",