@cosmicdrift/kumiko-bundled-features 0.394.0 → 0.395.0

package/dist/inbound-provider-imap/feature.js

@@ -35,11 +35,12 @@ import { downloadBatch } from "./download-batch.js";
 import { fetchMessageContent } from "./fetch-content.js";
 import { INBOUND_PROVIDER_IMAP_I18N } from "./i18n.js";
 import { assertUidValidity, closeOnAbort, connectOnce, createImapClient, IMAP_MAILBOX, imapMailHostGuard, mapImapError, parseImapCursor, } from "./imap-client.js";
-import { buildProviderMessageId, coerceDate, parseOrReject } from "./parse-message.js";
+import { buildProviderMessageId } from "./parse-message.js";
 import { createReconnectMailboxHandler } from "./reconnect-mailbox.js";
 import { createReconnectPrefillQuery } from "./reconnect-prefill.query.js";
 import { createImapScreens } from "./screens.js";
 import { sendFromImapAccount } from "./send-mail.js";
+import { watchMailbox } from "./watch-mailbox.js";
 export { IMAP_PROVIDER_KEY } from "./constants.js";
 export { setImapMailHostLookup } from "./imap-client.js";
 // =============================================================================
@@ -102,96 +103,6 @@ async function fetchMessages(ctx, account, cursor, opts) {
     }
 }
 // =============================================================================
-// watch — IMAP IDLE (imapflow idles automatically while the mailbox is open
-// and emits 'exists' for new messages).
-// =============================================================================
-async function watchMailbox(ctx, account, handlers) {
-    const doc = await readCredentialDocument(ctx, account);
-    const client = await createImapClient(doc, imapMailHostGuard());
-    let stopped = false;
-    try {
-        await client.connect();
-        const mailbox = (await client.mailboxOpen(IMAP_MAILBOX));
-        const uidValidity = String(mailbox.uidValidity);
-        // uidNext is the next UID to be assigned, so everything from here is
-        // "new".
-        let nextUid = Number(mailbox.uidNext ?? 1);
-        const drainNew = async () => {
-            const messages = [];
-            const rejected = [];
-            let maxSeen = nextUid - 1;
-            for await (const msg of client.fetch(`${nextUid}:*`, { uid: true, internalDate: true, source: true }, { uid: true })) {
-                // `N:*` gotcha (see fetch): filter out the previous last message.
-                if (msg.uid < nextUid || !msg.source)
-                    continue;
-                const parsed = await parseOrReject({
-                    source: msg.source,
-                    uid: msg.uid,
-                    uidValidity,
-                    internalDate: coerceDate(msg.internalDate ?? undefined),
-                    trustedAuthservId: account.trustedAuthservId ?? null,
-                });
-                if ("message" in parsed)
-                    messages.push(parsed.message);
-                else
-                    rejected.push(parsed.rejected);
-                if (msg.uid > maxSeen)
-                    maxSeen = msg.uid;
-            }
-            nextUid = maxSeen + 1;
-            if (messages.length > 0 || rejected.length > 0)
-                await handlers.onMessages(messages, rejected);
-        };
-        client.on("exists", () => {
-            // skip: ignore delayed exists events after the watcher has stopped.
-            if (stopped)
-                return;
-            void drainNew().catch((err) => {
-                if (!stopped)
-                    handlers.onError(mapImapError(err, doc.host));
-            });
-        });
-        const die = (err) => {
-            // skip: already stopped or terminated; fire onError only once.
-            if (stopped)
-                return;
-            stopped = true;
-            handlers.onError(mapImapError(err, doc.host));
-        };
-        client.on("error", die);
-        client.on("close", () => die(new Error("connection closed")));
-        // IDLE loop: 'exists' fires ONLY while client.idle() is running
-        // (verified empirically against greenmail). Each intervening command
-        // (drainNew-fetch) ends idle(), so the loop re-enters idle() until
-        // stop() closes the connection.
-        void (async () => {
-            while (!stopped) {
-                try {
-                    await client.idle();
-                }
-                catch (err) {
-                    if (!stopped)
-                        die(err);
-                    // skip: the idle loop ends; die() has informed the supervisor (or stop()
-                    // was the cause).
-                    return;
-                }
-            }
-        })();
-        return async () => {
-            stopped = true;
-            client.removeAllListeners("exists");
-            client.removeAllListeners("error");
-            client.removeAllListeners("close");
-            await client.logout().catch(() => { });
-        };
-    }
-    catch (err) {
-        await client.logout().catch(() => { });
-        throw mapImapError(err, doc.host);
-    }
-}
-// =============================================================================
 // Plugin + Feature-definition
 // =============================================================================
 /** Exported for the live test (imap-live.integration.test.ts) —

package/dist/inbound-provider-imap/watch-mailbox.d.ts

@@ -0,0 +1,5 @@
+import type { InboundMailContext, MailAccountRecord, RawInboundMessage, RejectedInboundMessage } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+export declare function watchMailbox(ctx: InboundMailContext, account: MailAccountRecord, handlers: {
+    readonly onMessages: (msgs: readonly RawInboundMessage[], rejected?: readonly RejectedInboundMessage[]) => Promise<void>;
+    readonly onError: (err: unknown) => void;
+}): Promise<() => Promise<void>>;

package/dist/inbound-provider-imap/watch-mailbox.js

@@ -0,0 +1,92 @@
+import { readCredentialDocument } from "./credential-document.js";
+import { createImapClient, IMAP_MAILBOX, imapMailHostGuard, mapImapError } from "./imap-client.js";
+import { coerceDate, parseOrReject } from "./parse-message.js";
+// IMAP IDLE (imapflow idles automatically while the mailbox is open
+// and emits 'exists' for new messages).
+export async function watchMailbox(ctx, account, handlers) {
+    const doc = await readCredentialDocument(ctx, account);
+    const client = await createImapClient(doc, imapMailHostGuard());
+    let stopped = false;
+    try {
+        await client.connect();
+        const mailbox = await client.mailboxOpen(IMAP_MAILBOX);
+        const uidValidity = String(mailbox.uidValidity);
+        // uidNext is the next UID to be assigned, so everything from here is
+        // "new".
+        let nextUid = Number(mailbox.uidNext ?? 1);
+        const drainNew = async () => {
+            const messages = [];
+            const rejected = [];
+            let maxSeen = nextUid - 1;
+            for await (const msg of client.fetch(`${nextUid}:*`, { uid: true, internalDate: true, source: true, envelope: true }, { uid: true })) {
+                // `N:*` gotcha (see fetch): filter out the previous last message.
+                if (msg.uid < nextUid || !msg.source)
+                    continue;
+                const parsed = await parseOrReject({
+                    source: msg.source,
+                    envelope: msg.envelope,
+                    uid: msg.uid,
+                    uidValidity,
+                    internalDate: coerceDate(msg.internalDate ?? undefined),
+                    trustedAuthservId: account.trustedAuthservId ?? null,
+                });
+                if ("message" in parsed)
+                    messages.push(parsed.message);
+                else
+                    rejected.push(parsed.rejected);
+                if (msg.uid > maxSeen)
+                    maxSeen = msg.uid;
+            }
+            nextUid = maxSeen + 1;
+            if (messages.length > 0 || rejected.length > 0)
+                await handlers.onMessages(messages, rejected);
+        };
+        client.on("exists", () => {
+            // skip: ignore delayed exists events after the watcher has stopped.
+            if (stopped)
+                return;
+            void drainNew().catch((err) => {
+                if (!stopped)
+                    handlers.onError(mapImapError(err, doc.host));
+            });
+        });
+        const die = (err) => {
+            // skip: already stopped or terminated; fire onError only once.
+            if (stopped)
+                return;
+            stopped = true;
+            handlers.onError(mapImapError(err, doc.host));
+        };
+        client.on("error", die);
+        client.on("close", () => die(new Error("connection closed")));
+        // IDLE loop: 'exists' fires ONLY while client.idle() is running
+        // (verified empirically against greenmail). Each intervening command
+        // (drainNew-fetch) ends idle(), so the loop re-enters idle() until
+        // stop() closes the connection.
+        void (async () => {
+            while (!stopped) {
+                try {
+                    await client.idle();
+                }
+                catch (err) {
+                    if (!stopped)
+                        die(err);
+                    // skip: the idle loop ends; die() has informed the supervisor (or stop()
+                    // was the cause).
+                    return;
+                }
+            }
+        })();
+        return async () => {
+            stopped = true;
+            client.removeAllListeners("exists");
+            client.removeAllListeners("error");
+            client.removeAllListeners("close");
+            await client.logout().catch(() => { });
+        };
+    }
+    catch (err) {
+        await client.logout().catch(() => { });
+        throw mapImapError(err, doc.host);
+    }
+}

package/dist/managed-pages/constants.d.ts

@@ -1 +1,2 @@
 export declare const MANAGED_PAGES_FEATURE: "managed-pages";
+export { BODY_FORMATS, type BodyFormat, DEFAULT_BODY_FORMAT, effectiveBodyFormat, } from "./web/constants.ts";

package/dist/managed-pages/constants.js

@@ -1 +1,2 @@
 export const MANAGED_PAGES_FEATURE = "managed-pages";
+export { BODY_FORMATS, DEFAULT_BODY_FORMAT, effectiveBodyFormat, } from "./web/constants.js";

package/dist/managed-pages/feature.js

@@ -1,7 +1,7 @@
 import { computeRevisionEtag, etagMatches } from "@cosmicdrift/kumiko-framework/api";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
-import { cachedSecurePageResponse, EMPTY_BRANDING, renderSafeMarkdown, wrapInLayout, } from "../page-render/index.js";
+import { cachedSecurePageResponse, EMPTY_BRANDING, wrapInLayout, } from "../page-render/index.js";
 import { rateLimitedTextResponse } from "../shared/index.js";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding.js";
 import { MANAGED_PAGES_FEATURE } from "./constants.js";
@@ -10,6 +10,7 @@ import { bySlugQuery } from "./handlers/by-slug.query.js";
 import { byTenantPublishedQuery } from "./handlers/by-tenant-published.query.js";
 import { pageCrudQueries, pageCrudWrites } from "./handlers/page-crud.js";
 import { setWrite } from "./handlers/set.write.js";
+import { renderPageBody } from "./render-page-body.js";
 import { createBrandingSettingsScreen } from "./screens/branding-screen.js";
 import { pageEditScreen, pageListScreen } from "./screens/page-screens.js";
 import { pageEntity } from "./table.js";
@@ -82,7 +83,7 @@ export function createManagedPagesFeature(opts) {
     const allowCustomCss = opts.allowCustomCss ?? false;
     return defineFeature(MANAGED_PAGES_FEATURE, (r) => {
         r.adoptsBundledLists();
-        r.describe("Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.");
+        r.describe("Tenant-editable, server-rendered public pages with per-tenant branding. Stores one `page` (Markdown or editor-document HTML body, per `bodyFormat`) per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core and document bodies through the template-resolver document sanitizer, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.");
         r.uiHints({
             displayLabel: "Managed Pages · Public CMS",
             category: "content",
@@ -163,6 +164,7 @@ export function createManagedPagesFeature(opts) {
                     slug,
                     lang,
                     String(data.version),
+                    data.bodyFormat,
                     data.updatedAt,
                     brandingRevisionSeed(branding),
                 ]);
@@ -182,7 +184,7 @@ export function createManagedPagesFeature(opts) {
                 }
                 const html = wrapLayout({
                     title: data.title,
-                    bodyHtml: renderSafeMarkdown(data.body),
+                    bodyHtml: renderPageBody({ slug, body: data.body, bodyFormat: data.bodyFormat }),
                     lang: data.lang,
                     slug,
                     description: data.description,

package/dist/managed-pages/handlers/by-slug.query.d.ts

@@ -7,6 +7,7 @@ export declare const bySlugQuery: import("@cosmicdrift/kumiko-types/define-handl
     lang: string;
     title: string;
     body: string;
+    bodyFormat: "document" | "markdown";
     description: string | null;
     ogImage: string | null;
     version: number;

package/dist/managed-pages/handlers/by-slug.query.js

@@ -1,6 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { effectiveBodyFormat } from "../constants.js";
 import { pagesTable } from "../table.js";
 // Public read by (tenantId, slug, lang), including anonymous access for landing and
 // marketing pages. The tenant comes from query.user.tenantId, set on the render path
@@ -29,6 +30,7 @@ export const bySlugQuery = defineQueryHandler({
             lang: row.lang,
             title: row.title,
             body: row.body,
+            bodyFormat: effectiveBodyFormat(row.bodyFormat),
             description: row.description,
             ogImage: row.ogImage,
             version: row.version,

package/dist/managed-pages/handlers/page-body-guard.d.ts

@@ -0,0 +1,2 @@
+import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+export declare function withBodyValidation(def: WriteHandlerDef, verb: "create" | "update"): WriteHandlerDef;

package/dist/managed-pages/handlers/page-body-guard.js

@@ -0,0 +1,46 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
+import { ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { pagesTable } from "../table.js";
+import { sanitizePageBody } from "./page-body-issues.js";
+function stringOrNull(value) {
+    return typeof value === "string" ? value : null;
+}
+// preSave hooks cannot report field errors (the executor maps every throw to
+// presave_hook_failed), so the convention handlers are checked before they run.
+// An update may touch only body or only bodyFormat, so the pair is completed
+// from the stored row. A document body is handed on as the rebuilt html.
+async function guardUpdate(payload, ctx) {
+    if (!isPlainObject(payload) || !isPlainObject(payload["changes"]))
+        return { ok: true, payload };
+    const changes = payload["changes"];
+    if (!("body" in changes) && !("bodyFormat" in changes))
+        return { ok: true, payload };
+    const id = payload["id"];
+    const stored = typeof id === "string" ? await fetchOne(ctx.db, pagesTable, { id }) : null;
+    const body = "body" in changes ? stringOrNull(changes["body"]) : (stored?.body ?? null);
+    const format = "bodyFormat" in changes ? changes["bodyFormat"] : stored?.bodyFormat;
+    const result = sanitizePageBody(body, format);
+    if (!result.ok)
+        return result;
+    return { ok: true, payload: { ...payload, changes: { ...changes, body: result.body } } };
+}
+function guardCreate(payload) {
+    if (!isPlainObject(payload))
+        return { ok: true, payload };
+    const result = sanitizePageBody(stringOrNull(payload["body"]), payload["bodyFormat"]);
+    if (!result.ok)
+        return result;
+    return { ok: true, payload: { ...payload, body: result.body } };
+}
+export function withBodyValidation(def, verb) {
+    return {
+        ...def,
+        handler: async (event, ctx) => {
+            const guarded = verb === "create" ? guardCreate(event.payload) : await guardUpdate(event.payload, ctx);
+            if (!guarded.ok)
+                return writeFailure(new ValidationError({ fields: guarded.issues }));
+            return def.handler({ ...event, payload: guarded.payload }, ctx);
+        },
+    };
+}

package/dist/managed-pages/handlers/page-body-issues.d.ts

@@ -0,0 +1,10 @@
+import type { FieldIssue } from "@cosmicdrift/kumiko-framework/errors";
+export declare const BODY_REJECTED_I18N_KEY = "managed-pages.errors.document.rejected";
+export type PageBodyResult = {
+    readonly ok: true;
+    readonly body: string | null;
+} | {
+    readonly ok: false;
+    readonly issues: FieldIssue[];
+};
+export declare function sanitizePageBody(body: string | null | undefined, format: unknown): PageBodyResult;

package/dist/managed-pages/handlers/page-body-issues.js

@@ -0,0 +1,21 @@
+import { sanitizeDocumentHtml } from "../../template-resolver/index.js";
+import { effectiveBodyFormat } from "../constants.js";
+export const BODY_REJECTED_I18N_KEY = "managed-pages.errors.document.rejected";
+// The single write-time gate for document bodies (create, update, set, seed): a
+// document body is stored as the sanitizer's rebuilt html, never as the raw input.
+export function sanitizePageBody(body, format) {
+    if (effectiveBodyFormat(format) !== "document" || !body)
+        return { ok: true, body: body ?? null };
+    const result = sanitizeDocumentHtml(body);
+    if (result.ok)
+        return { ok: true, body: result.html };
+    return {
+        ok: false,
+        issues: result.violations.map((violation) => ({
+            path: "body",
+            code: violation.code,
+            i18nKey: BODY_REJECTED_I18N_KEY,
+            params: { detail: violation.detail },
+        })),
+    };
+}

package/dist/managed-pages/handlers/page-crud.js

@@ -1,5 +1,6 @@
 import { defineEntityCreateHandler, defineEntityDeleteHandler, defineEntityDetailHandler, defineEntityListHandler, defineEntityUpdateHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { pageEntity } from "../table.js";
+import { withBodyValidation } from "./page-body-guard.js";
 // Admin authoring runs as TenantAdmin (self-service) or SystemAdmin (app-wide
 // pages). Mirrors set.write's ACL — an app with its own role alias
 // (publicstatus = "Admin") has to grant or map TenantAdmin.
@@ -9,14 +10,14 @@ const ADMIN_ACCESS = { roles: ["TenantAdmin", "SystemAdmin"] };
 // `managed-pages:query:page:{list,detail}` by convention. The `set` write
 // handler in feature.ts is NOT used by them and stays the provisioning API.
 export const pageCrudWrites = [
-    defineEntityCreateHandler("page", pageEntity, {
+    withBodyValidation(defineEntityCreateHandler("page", pageEntity, {
         access: ADMIN_ACCESS,
         description: "Creates a managed page from the admin form's field values, failing if that slug and language already exist; use it from the page catalog screen, whereas managed-pages:write:set upserts a page addressed by slug and language.",
-    }),
-    defineEntityUpdateHandler("page", pageEntity, {
+    }), "create"),
+    withBodyValidation(defineEntityUpdateHandler("page", pageEntity, {
         access: ADMIN_ACCESS,
         description: "Updates one managed page addressed by row id from the admin form's `{ id, version, changes }` envelope; use it from the page edit screen, whereas managed-pages:write:set addresses a page by slug and language instead.",
-    }),
+    }), "update"),
     defineEntityDeleteHandler("page", pageEntity, {
         access: ADMIN_ACCESS,
         description: "Deletes one managed page by row id so its URL stops resolving entirely; use it to retire a page for good, not to take it offline temporarily — that is a published:false write through managed-pages:write:set.",

package/dist/managed-pages/handlers/set.write.d.ts

@@ -4,6 +4,10 @@ export declare const setWrite: import("@cosmicdrift/kumiko-types/define-handler"
     lang: z.ZodString;
     title: z.ZodString;
     body: z.ZodNullable<z.ZodString>;
+    bodyFormat: z.ZodOptional<z.ZodEnum<{
+        document: "document";
+        markdown: "markdown";
+    }>>;
     description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     ogImage: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     published: z.ZodOptional<z.ZodBoolean>;

package/dist/managed-pages/handlers/set.write.js

@@ -1,8 +1,11 @@
 import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
+import { BODY_FORMATS, DEFAULT_BODY_FORMAT } from "../constants.js";
 import { pageEntity, pagesTable } from "../table.js";
+import { sanitizePageBody } from "./page-body-issues.js";
 const slugSchema = z
     .string()
     .min(1)
@@ -17,7 +20,8 @@ const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName:
 // Upserts one page per (tenantId, slug, lang). The tenant scope defaults to event.user;
 // SystemAdmin can write to another tenant via `tenantIdOverride` (typically SYSTEM_TENANT_ID
 // for app-wide pages). On update, omitted published/description/ogImage values are preserved
-// so a publish toggle does not overwrite the body, and vice versa.
+// so a publish toggle does not overwrite the body, and vice versa. bodyFormat is the
+// exception: omitted means markdown, so provisioning callers that only know markdown stay valid.
 export const setWrite = defineWriteHandler({
     name: "set",
     schema: z.object({
@@ -25,6 +29,7 @@ export const setWrite = defineWriteHandler({
         lang: langSchema,
         title: z.string().min(1).max(200),
         body: z.string().max(100_000).nullable(),
+        bodyFormat: z.enum(BODY_FORMATS).optional(),
         description: z.string().max(500).nullable().optional(),
         ogImage: z.string().max(2000).nullable().optional(),
         published: z.boolean().optional(),
@@ -32,10 +37,15 @@ export const setWrite = defineWriteHandler({
         tenantIdOverride: z.string().min(1).optional(),
     }),
     access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Creates or overwrites one managed page addressed by slug and language, keeping the existing published flag, description and OG image when the payload omits them; use it for content edits and publish toggles, and as SystemAdmin to write another tenant's pages.",
+    description: "Creates or overwrites one managed page addressed by slug and language, keeping the existing published flag, description and OG image when the payload omits them and resetting bodyFormat to markdown (the default) when it is omitted; use it for content edits and publish toggles, and as SystemAdmin to write another tenant's pages.",
     handler: async (event, ctx) => {
         const override = event.payload.tenantIdOverride;
         const tenantId = (override ?? event.user.tenantId); // @cast-boundary engine-bridge
+        const bodyFormat = event.payload.bodyFormat ?? DEFAULT_BODY_FORMAT;
+        const sanitized = sanitizePageBody(event.payload.body, bodyFormat);
+        if (!sanitized.ok)
+            return writeFailure(new ValidationError({ fields: sanitized.issues }));
+        const { body } = sanitized;
         // ctx.db is scoped to the executing user's tenant, wrong for a cross-tenant override
         // on both the existing-check and the executor's stream reads; re-scope to the target.
         const { db: scopedDb, streamTenantId } = requireForTenant(ctx, tenantId);
@@ -50,7 +60,8 @@ export const setWrite = defineWriteHandler({
                 version: existing.version,
                 changes: {
                     title: event.payload.title,
-                    body: event.payload.body,
+                    body,
+                    bodyFormat,
                     description: event.payload.description !== undefined
                         ? event.payload.description
                         : existing.description,
@@ -69,7 +80,8 @@ export const setWrite = defineWriteHandler({
             slug: event.payload.slug,
             lang: event.payload.lang,
             title: event.payload.title,
-            body: event.payload.body,
+            body,
+            bodyFormat,
             description: event.payload.description ?? null,
             ogImage: event.payload.ogImage ?? null,
             published: event.payload.published ?? false,

package/dist/managed-pages/render-page-body.d.ts

@@ -0,0 +1,10 @@
+import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
+import type { BodyFormat } from "./constants.ts";
+type WarnLogger = Pick<Logger, "warn">;
+export type RenderablePageBody = {
+    readonly slug: string;
+    readonly body: string;
+    readonly bodyFormat: BodyFormat;
+};
+export declare function renderPageBody(page: RenderablePageBody, log?: WarnLogger): string;
+export {};

package/dist/managed-pages/render-page-body.js

@@ -0,0 +1,19 @@
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { renderSafeMarkdown } from "../page-render/index.js";
+import { sanitizeDocumentHtml } from "../template-resolver/index.js";
+const defaultLog = createFallbackLogger("managed-pages");
+// A document body is re-sanitized at render time even though writes validate it:
+// rows can predate the validation or arrive through other writers. A rejected
+// document renders as an empty body (never the raw HTML) and is logged.
+export function renderPageBody(page, log = defaultLog) {
+    if (page.bodyFormat === "markdown")
+        return renderSafeMarkdown(page.body);
+    const result = sanitizeDocumentHtml(page.body);
+    if (result.ok)
+        return result.html;
+    log.warn("managed page document body rejected at render, serving an empty body", {
+        slug: page.slug,
+        violations: result.violations.map((violation) => violation.code),
+    });
+    return "";
+}

package/dist/managed-pages/screens/page-screens.js

@@ -1,3 +1,4 @@
+import { PAGE_BODY_EXTENSION_NAME } from "../web/constants.js";
 // Admin authoring screens for the `page` entity. These are JSON-safe data only —
 // the generic DataTable/form renderer mounts them, so no React component is
 // needed. Both MUST be registered in the managed-pages feature (not in the
@@ -70,10 +71,13 @@ export const pageEditScreen = {
                     { field: "published", span: 1 },
                 ],
             },
+            // Not a plain field: the body is edited as a document and a Markdown
+            // body is converted on open, so the section also patches `bodyFormat`.
             {
+                kind: "extension",
                 title: "managed-pages:section.body",
-                columns: 1,
-                fields: [{ field: "body", span: 1 }],
+                component: { react: { __component: PAGE_BODY_EXTENSION_NAME } },
+                entityName: "page",
             },
         ],
     },

package/dist/managed-pages/seeding.d.ts

@@ -1,12 +1,14 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
+import { type BodyFormat } from "./constants.ts";
 export type SeedPageOptions = {
     readonly tenantId: TenantId;
     readonly slug: string;
     readonly lang: string;
     readonly title: string;
     readonly body?: string | null;
+    readonly bodyFormat?: BodyFormat;
     readonly description?: string | null;
     readonly ogImage?: string | null;
     readonly published?: boolean;

package/dist/managed-pages/seeding.js

@@ -4,6 +4,8 @@
 import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { runEventStoreSeed } from "@cosmicdrift/kumiko-framework/seeding";
+import { DEFAULT_BODY_FORMAT } from "./constants.js";
+import { sanitizePageBody } from "./handlers/page-body-issues.js";
 import { pageEntity, pagesTable } from "./table.js";
 const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName: "page" });
 export async function seedPage(db, opts) {
@@ -25,6 +27,12 @@ export async function seedPage(db, opts) {
     const description = opts.description ?? null;
     const ogImage = opts.ogImage ?? null;
     const published = opts.published ?? false;
+    const bodyFormat = opts.bodyFormat ?? DEFAULT_BODY_FORMAT;
+    const sanitized = sanitizePageBody(opts.body, bodyFormat);
+    if (!sanitized.ok) {
+        throw new Error(`seedPage rejected the body: ${JSON.stringify(sanitized.issues)}`);
+    }
+    const { body } = sanitized;
     return runEventStoreSeed({
         existing,
         ifExists: opts.ifExists,
@@ -33,7 +41,8 @@ export async function seedPage(db, opts) {
                 slug: opts.slug,
                 lang: opts.lang,
                 title: opts.title,
-                body: opts.body ?? null,
+                body,
+                bodyFormat,
                 description,
                 ogImage,
                 published,
@@ -56,7 +65,8 @@ export async function seedPage(db, opts) {
                 version: row.version,
                 changes: {
                     title: opts.title,
-                    body: opts.body ?? null,
+                    body,
+                    bodyFormat,
                     description,
                     ogImage,
                     published,