@cosmicdrift/kumiko-bundled-features 0.383.1 → 0.385.0

package/dist/audit/web/audit-event-labels.js

@@ -0,0 +1,23 @@
+import { AUDIT_EVENT_ACTIONS } from "./constants.js";
+export function isAuditEventAction(value) {
+    return AUDIT_EVENT_ACTIONS.some((action) => action === value);
+}
+function humanizeEntityName(aggregateType) {
+    const spaced = aggregateType.replaceAll("-", " ").replace(/([a-z])([A-Z])/g, "$1 $2");
+    return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();
+}
+/** Singular entity noun: the entity's own `:noun` key, then the audit log's label for bundled entities, then the humanized aggregate type. */
+export function auditEntityLabel(t, row) {
+    const aggregateType = row["aggregateType"];
+    if (typeof aggregateType !== "string")
+        return null;
+    const nounKey = row["entityNounKey"];
+    if (typeof nounKey === "string") {
+        const noun = t(nounKey, { count: 1 });
+        if (noun !== nounKey)
+            return noun;
+    }
+    const bundledKey = `audit.log.entity.${aggregateType}`;
+    const bundledLabel = t(bundledKey);
+    return bundledLabel === bundledKey ? humanizeEntityName(aggregateType) : bundledLabel;
+}

package/dist/audit/web/client-plugin.js

@@ -1,9 +1,14 @@
 import { mergeTranslations } from "@cosmicdrift/kumiko-renderer";
-import { AUDIT_FEATURE } from "./constants.js";
+import { AuditEventCell, AuditObjectCell } from "./audit-event-cell.js";
+import { AUDIT_EVENT_CELL_COMPONENT, AUDIT_FEATURE, AUDIT_OBJECT_CELL_COMPONENT, } from "./constants.js";
 import { defaultTranslations } from "./default-translations.js";
 export function auditClient(options) {
     return {
         name: AUDIT_FEATURE,
         translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+        columnRenderers: {
+            [AUDIT_EVENT_CELL_COMPONENT]: AuditEventCell,
+            [AUDIT_OBJECT_CELL_COMPONENT]: AuditObjectCell,
+        },
     };
 }

package/dist/audit/web/constants.d.ts

@@ -5,6 +5,14 @@ export declare const SYSTEM_ACTOR_ID: "system";
 export declare const ANONYMOUS_USER_ID: "anonymous";
 /** All `createdBy` values that mean "system" in the audit UI (nil-UUID from createSystemUser + literal). */
 export declare const SYSTEM_ACTOR_IDS: ReadonlySet<string>;
+/** Column-renderer names shared by screens.ts and `auditClient()`. */
+export declare const AUDIT_EVENT_CELL_COMPONENT: "audit-event-cell";
+export declare const AUDIT_OBJECT_CELL_COMPONENT: "audit-object-cell";
+/** Action suffix of entity events (`<entity>.<action>`); other event types have none. */
+export declare const AUDIT_EVENT_ACTIONS: readonly ["created", "updated", "deleted", "restored"];
+export type AuditEventAction = (typeof AUDIT_EVENT_ACTIONS)[number];
+/** Value of the facet that brings technical entries (escape-hatch use) back into the log. */
+export declare const INCLUDE_TECHNICAL_FILTER: "include-technical";
 export declare const AuditQueries: {
     readonly list: "audit:query:list";
     readonly details: "audit:query:details";

package/dist/audit/web/constants.js

@@ -9,6 +9,13 @@ export const SYSTEM_ACTOR_IDS = new Set([
     SYSTEM_ACTOR_ID,
     "00000000-0000-0000-0000-000000000000",
 ]);
+/** Column-renderer names shared by screens.ts and `auditClient()`. */
+export const AUDIT_EVENT_CELL_COMPONENT = "audit-event-cell";
+export const AUDIT_OBJECT_CELL_COMPONENT = "audit-object-cell";
+/** Action suffix of entity events (`<entity>.<action>`); other event types have none. */
+export const AUDIT_EVENT_ACTIONS = ["created", "updated", "deleted", "restored"];
+/** Value of the facet that brings technical entries (escape-hatch use) back into the log. */
+export const INCLUDE_TECHNICAL_FILTER = "include-technical";
 export const AuditQueries = {
     list: "audit:query:list",
     details: "audit:query:details",

package/dist/audit/web/i18n.js

@@ -21,8 +21,55 @@ export const AUDIT_I18N = {
     "audit.log.col.tenant": { en: "Tenant" },
     "audit.log.col.when": { en: "When" },
     "audit.log.col.type": { en: "Event" },
-    "audit.log.col.aggregateType": { en: "Aggregate type" },
     "audit.log.col.aggregateId": { en: "Aggregate ID" },
+    "audit.log.col.aggregateType": { en: "Object" },
+    "audit.log.event": { en: "{entity} {action}" },
+    "audit.log.action.created": { en: "created" },
+    "audit.log.action.updated": { en: "updated" },
+    "audit.log.action.deleted": { en: "deleted" },
+    "audit.log.action.restored": { en: "restored" },
+    "audit.log.facet.technical": { en: "Technical entries" },
+    "audit.log.facet.technical.include": { en: "Show technical entries" },
+    "audit.log.event.custom-field-set": { en: "Custom field value set" },
+    "audit.log.event.custom-field-cleared": { en: "Custom field value cleared" },
+    "audit.log.event.field-definition-deleted": { en: "Custom field deleted" },
+    "audit.log.event.secret-read": { en: "Secret read" },
+    "audit.log.event.session-revoked": { en: "Session ended" },
+    "audit.log.event.subject-forgotten": { en: "Person forgotten (data erased)" },
+    "audit.log.event.forget-denied": { en: "Erasure request denied" },
+    "audit.log.event.pat-revoked": { en: "Access token revoked" },
+    "audit.log.event.mail-account-connected": { en: "Mail account connected" },
+    "audit.log.event.mail-account-updated": { en: "Mail account updated" },
+    "audit.log.event.mail-account-disconnected": { en: "Mail account disconnected" },
+    "audit.log.event.subscription-created": { en: "Subscription created" },
+    "audit.log.event.subscription-updated": { en: "Subscription updated" },
+    "audit.log.event.subscription-canceled": { en: "Subscription canceled" },
+    "audit.log.event.invoice-paid": { en: "Invoice paid" },
+    "audit.log.event.invoice-payment-failed": { en: "Invoice payment failed" },
+    "audit.log.event.payment-received": { en: "Payment received" },
+    "audit.log.event.checkout-consent-recorded": { en: "Checkout consent recorded" },
+    "audit.log.event.contract-confirmation-issued": { en: "Contract confirmation issued" },
+    "audit.log.event.contract-termination-revoked": { en: "Contract termination revoked" },
+    "audit.log.event.destruction-requested": { en: "Tenant deletion requested" },
+    "audit.log.event.destruction-cancelled": { en: "Tenant deletion cancelled" },
+    "audit.log.event.tenant-destruction-started": { en: "Tenant deletion started" },
+    "audit.log.event.tenant-destruction-completed": { en: "Tenant deletion completed" },
+    "audit.log.event.tenant-destruction-failed": { en: "Tenant deletion failed" },
+    "audit.log.event.tenant-handover-claimed": { en: "Tenant handover claimed" },
+    "audit.log.event.waitlist-exported": { en: "Waitlist exported" },
+    "audit.log.event.waitlist-purged": { en: "Waitlist purged" },
+    "audit.log.event.feature-toggle-set": { en: "Feature toggle changed" },
+    "audit.log.event.contract-termination-requested": { en: "Contract termination requested" },
+    "audit.log.event.contract-termination-declared": { en: "Contract termination declared" },
+    "audit.log.event.contract-termination-unmatched": { en: "Contract termination not matched" },
+    "audit.log.entity.tenant": { en: "Tenant" },
+    "audit.log.entity.tenant-membership": { en: "Membership" },
+    "audit.log.entity.tenant-invitation": { en: "Invitation" },
+    "audit.log.entity.user": { en: "User" },
+    "audit.log.entity.folder": { en: "Folder" },
+    "audit.log.entity.folder-assignment": { en: "Folder assignment" },
+    "audit.log.entity.field-definition": { en: "Custom field" },
+    "audit.log.entity.template-resource": { en: "Template" },
     "audit.log.col.actor": { en: "Actor" },
     "audit.log.details": { en: "Details" },
     "audit.log.detail.payload": { en: "Event payload" },

package/dist/auth-email-password/feature.js

@@ -9,6 +9,7 @@ import { createInviteCreateHandler, createSystemInviteCreateHandler, } from "./h
 import { inviteInfoQuery } from "./handlers/invite-info.query.js";
 import { createInviteSignupCompleteHandler } from "./handlers/invite-signup-complete.write.js";
 import { createLoginHandler } from "./handlers/login.write.js";
+import { loginOptionsQuery } from "./handlers/login-options.query.js";
 import { logoutWrite } from "./handlers/logout.write.js";
 import { createRequestAccountUnlockHandler, } from "./handlers/request-account-unlock.write.js";
 import { createRequestEmailVerificationHandler } from "./handlers/request-email-verification.write.js";
@@ -83,8 +84,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
                 { key: "accountUnlock", label: "Account-Unlock-Flow", type: "boolean", default: false },
             ],
         });
-        r.requires({ features: ["user"] });
-        r.requires({ features: ["tenant"] });
+        r.requires({ features: ["user", "tenant"] });
         // All five magic-link flows (reset/verify/signup/invite/unlock) dispatch
         // via ctx.notify → delivery must be mounted. Fail closed at boot instead
         // of silently dropping the mail.
@@ -135,6 +135,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
             r.writeHandler(createVerifyEmailHandler(opts.emailVerification));
         }
         const queries = {
+            loginOptions: r.queryHandler(loginOptionsQuery),
             ...(opts.signup && {
                 signupRegistrationStatus: r.queryHandler(selfRegistrationStatusQuery),
             }),

package/dist/auth-email-password/handlers/login-options.query.d.ts

@@ -0,0 +1,5 @@
+import * as z from "zod";
+export declare const loginOptionsQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"login-options", z.ZodObject<{}, z.core.$strip>, {
+    passwordReset: boolean;
+    accountUnlock: boolean;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/auth-email-password/handlers/login-options.query.js

@@ -0,0 +1,17 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { AuthHandlers } from "../web/constants.js";
+// Anonymous-readable so the (unauthenticated) login screen can show the
+// forgot-password and unlock links only when the matching mail flows are
+// actually mounted, without every app having to pass hrefs by hand.
+export const loginOptionsQuery = defineQueryHandler({
+    name: "login-options",
+    schema: z.object({}),
+    access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+    rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
+    description: "Reports which optional login-page flows (password reset, account unlock) are available, readable without signing in, so the login screen links only to flows that exist.",
+    handler: async (_query, ctx) => ({
+        passwordReset: ctx.registry.getWriteHandler(AuthHandlers.requestPasswordReset) !== undefined,
+        accountUnlock: ctx.registry.getWriteHandler(AuthHandlers.requestAccountUnlock) !== undefined,
+    }),
+});

package/dist/auth-email-password/index.d.ts

@@ -1,5 +1,4 @@
 export { hashPassword, verifyPassword } from "../shared/password-hashing.ts";
-export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.ts";
 export type { BootstrapConfigValue, BootstrapDeps, BootstrapInvite, BootstrapInviteOutcome, BootstrapPlan, BootstrapReport, BootstrapSeedDeps, BootstrapSystemAdmin, BootstrapTenant, BootstrapTenantOutcome, } from "./bootstrap.ts";
 export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.ts";
 export type { AuthMailLocale } from "./email-templates.ts";
@@ -10,4 +9,5 @@ export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature
 export { signToken, TokenPurpose, type VerifyResult, verifyToken } from "./signed-token.ts";
 export { type IssuedSignupActivation, type IssueSignupActivationArgs, issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.ts";
 export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.ts";
+export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH, makeAuthPaths, } from "./web/auth-paths.ts";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries, } from "./web/constants.ts";

package/dist/auth-email-password/index.js

@@ -5,7 +5,6 @@
 // hashPassword/verifyPassword; removing it is a breaking change that needs
 // its own changeset + deliberate deprecation window, not a silent drop.
 export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
-export { DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
 export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
 export { AuthMailNotificationTypes } from "./mail-notifications.js";
@@ -18,4 +17,5 @@ export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature
 export { signToken, TokenPurpose, verifyToken } from "./signed-token.js";
 export { issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";
 export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.js";
+export { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH, makeAuthPaths, } from "./web/auth-paths.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries, } from "./web/constants.js";

package/dist/auth-email-password/password-policy.d.ts

@@ -1,3 +1,4 @@
 import * as z from "zod";
+export declare const commonPasswordCount: number;
 export declare function isCommonPassword(password: string): boolean;
 export declare const passwordSchema: z.ZodString;