@cosmicdrift/kumiko-bundled-features 0.394.0 → 0.396.0

package/dist/managed-pages/table.d.ts

@@ -1,3 +1,4 @@
+import { type BodyFormat } from "./constants.ts";
 export declare const pageEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
     readonly slug: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: true;
@@ -11,6 +12,28 @@ export declare const pageEntity: import("@cosmicdrift/kumiko-types/fields").Enti
     readonly body: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: false;
     };
+    readonly bodyFormat: {
+        readonly type: "select";
+        readonly description?: string;
+        readonly options: readonly ["markdown", "document"];
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly default?: "document" | "markdown" | undefined;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly display?: "radio" | "dropdown";
+        readonly optionTones?: {
+            readonly document?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly markdown?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+        } | undefined;
+        readonly optionsQuery?: string;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"document" | "markdown">[] | undefined;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
     readonly description: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: false;
     };
@@ -35,6 +58,28 @@ export declare const pagesTable: import("@cosmicdrift/kumiko-framework/db").Enti
     readonly body: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: false;
     };
+    readonly bodyFormat: {
+        readonly type: "select";
+        readonly description?: string;
+        readonly options: readonly ["markdown", "document"];
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly default?: "document" | "markdown" | undefined;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly display?: "radio" | "dropdown";
+        readonly optionTones?: {
+            readonly document?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+            readonly markdown?: "accent" | "bad" | "critical" | "neutral" | "ok" | "warn" | undefined;
+        } | undefined;
+        readonly optionsQuery?: string;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"document" | "markdown">[] | undefined;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
     readonly description: import("@cosmicdrift/kumiko-types/fields").EntityTextFieldDef & {
         required: false;
     };
@@ -54,6 +99,7 @@ export type PageRow = {
     readonly lang: string;
     readonly title: string;
     readonly body: string | null;
+    readonly bodyFormat: BodyFormat | null;
     readonly description: string | null;
     readonly ogImage: string | null;
     readonly published: boolean;

package/dist/managed-pages/table.js

@@ -1,15 +1,16 @@
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
-import { createBooleanField, createEntity, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
+import { createBooleanField, createEntity, createSelectField, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
+import { BODY_FORMATS, DEFAULT_BODY_FORMAT } from "./constants.js";
 // Page — a tenant-editable, server-rendered public page (landing,
 // about, custom). Exactly one row per (tenantId, slug, lang). The body is
-// Markdown, rendered securely on the server via page-render. `published`
+// Markdown or an editor document (bodyFormat), rendered securely on the server. `published`
 // gates delivery to anonymous visitors: drafts return 404. description and
 // ogImage support SEO and social previews. SYSTEM_TENANT_ID is used for
 // app-wide pages; otherwise the page belongs to the tenant resolved from the
 // host via resolveApexTenant during rendering.
 export const pageEntity = createEntity({
     table: "read_pages",
-    description: "One tenant-editable public web page, unique per slug and language, holding a markdown body plus the title, SEO description and OG image, with a published flag that decides whether anonymous visitors are served it or get a 404.",
+    description: "One tenant-editable public web page, unique per slug and language, holding a markdown or document (HTML) body plus the title, SEO description and OG image, with a published flag that decides whether anonymous visitors are served it or get a 404.",
     fields: {
         slug: createTextField({
             required: true,
@@ -45,6 +46,7 @@ export const pageEntity = createEntity({
             personal: false,
             reason: "is_business_data",
         }),
+        bodyFormat: createSelectField({ options: BODY_FORMATS, default: DEFAULT_BODY_FORMAT }),
         description: createTextField({ maxLength: 500, personal: false, reason: "is_business_data" }),
         ogImage: createTextField({ maxLength: 2000, personal: false, reason: "is_business_data" }),
         published: createBooleanField({ default: false }),

package/dist/managed-pages/web/client-plugin.js

@@ -1,13 +1,15 @@
-// Client feature factory for managed-pages. It provides ONLY translations —
-// the screens (page-list/page-edit/branding-settings) are schema-driven
-// (entityList/entityEdit/configEdit), so no custom React components are
-// registered. Apps mount it in createKumikoApp({ clientFeatures:
+// Client feature factory for managed-pages: translations plus the page-body
+// extension section (document editor) of the page-edit screen. The screens
+// themselves are schema-driven. Apps mount it in createKumikoApp({ clientFeatures:
 // [managedPagesClient()] }) so the admin labels render translated.
 import { mergeTranslations } from "@cosmicdrift/kumiko-renderer";
+import { PAGE_BODY_EXTENSION_NAME } from "./constants.js";
 import { defaultTranslations } from "./default-translations.js";
+import { PageBodySection } from "./page-body-section.js";
 export function managedPagesClient(options) {
     return {
         name: "managed-pages",
         translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+        extensionSectionComponents: { [PAGE_BODY_EXTENSION_NAME]: PageBodySection },
     };
 }

package/dist/managed-pages/web/constants.d.ts

@@ -0,0 +1,5 @@
+export declare const PAGE_BODY_EXTENSION_NAME = "managed-pages:page-body";
+export declare const BODY_FORMATS: readonly ["markdown", "document"];
+export type BodyFormat = (typeof BODY_FORMATS)[number];
+export declare const DEFAULT_BODY_FORMAT: BodyFormat;
+export declare function effectiveBodyFormat(value: unknown): BodyFormat;

package/dist/managed-pages/web/constants.js

@@ -0,0 +1,9 @@
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+// Pure data shared by the server (screen, handlers, render) and the client plugin.
+export const PAGE_BODY_EXTENSION_NAME = "managed-pages:page-body";
+export const BODY_FORMATS = ["markdown", "document"];
+// Rows and events written before bodyFormat existed carry no value.
+export const DEFAULT_BODY_FORMAT = "markdown";
+export function effectiveBodyFormat(value) {
+    return isOneOf(BODY_FORMATS, value) ? value : DEFAULT_BODY_FORMAT;
+}

package/dist/managed-pages/web/i18n.js

@@ -43,6 +43,18 @@ export const MANAGED_PAGES_I18N = {
     "managed-pages:section.meta": { en: "Metadata" },
     "managed-pages:section.body": { en: "Content" },
     "managed-pages:branding.section.identity": { en: "Identity" },
+    // Document body: write-time rejection and the Markdown conversion warning
+    "managed-pages.errors.document.rejected": {
+        en: "The content contains elements that are not allowed: {detail}",
+    },
+    "managed-pages:body.lossy.warning": {
+        en: "This page was written in Markdown. Converting it to the editor drops: {features}. Check the result before saving.",
+    },
+    "managed-pages:body.lossy.image": { en: "images" },
+    "managed-pages:body.lossy.blockquote": { en: "block quotes" },
+    "managed-pages:body.lossy.code": { en: "code" },
+    "managed-pages:body.lossy.deepHeading": { en: "headings below level 3" },
+    "managed-pages:body.lossy.relativeLink": { en: "relative links" },
     // Row-Actions + Confirm (pageListScreen)
     "managed-pages:actions.edit": { en: "Edit" },
     "managed-pages:actions.delete": { en: "Delete" },

package/dist/managed-pages/web/lossy-markdown.d.ts

@@ -0,0 +1,3 @@
+export declare const LOSSY_MARKDOWN_FEATURES: readonly ["image", "blockquote", "code", "deepHeading", "relativeLink"];
+export type LossyMarkdownFeature = (typeof LOSSY_MARKDOWN_FEATURES)[number];
+export declare function detectLossyMarkdown(markdown: string): readonly LossyMarkdownFeature[];

package/dist/managed-pages/web/lossy-markdown.js

@@ -0,0 +1,59 @@
+import { isAllowedDocumentLinkHref } from "@cosmicdrift/kumiko-bundled-features/template-resolver/document-schema";
+import { Lexer } from "marked";
+export const LOSSY_MARKDOWN_FEATURES = [
+    "image",
+    "blockquote",
+    "code",
+    "deepHeading",
+    "relativeLink",
+];
+// The document editor has no image, quote or code nodes, only three heading
+// levels, and links must pass the document link policy (absolute http(s),
+// mailto, tel, placeholders).
+const MAX_DOCUMENT_HEADING_DEPTH = 3;
+function tokenList(value) {
+    return Array.isArray(value) ? value : [];
+}
+function childTokens(token) {
+    const nested = [...tokenList("tokens" in token ? token.tokens : undefined)];
+    if (token.type === "list")
+        nested.push(...tokenList("items" in token ? token.items : undefined));
+    return nested;
+}
+function isDeepHeading(token) {
+    return ("depth" in token && typeof token.depth === "number" && token.depth > MAX_DOCUMENT_HEADING_DEPTH);
+}
+function isRelativeLink(token) {
+    return ("href" in token && typeof token.href === "string" && !isAllowedDocumentLinkHref(token.href));
+}
+function featuresOf(token) {
+    switch (token.type) {
+        case "image":
+            return ["image"];
+        case "blockquote":
+            return ["blockquote"];
+        case "code":
+        case "codespan":
+            return ["code"];
+        case "heading":
+            return isDeepHeading(token) ? ["deepHeading"] : [];
+        case "link":
+            return isRelativeLink(token) ? ["relativeLink"] : [];
+        default:
+            return [];
+    }
+}
+function collect(tokens, found) {
+    for (const token of tokens) {
+        for (const feature of featuresOf(token))
+            found.add(feature);
+        collect(childTokens(token), found);
+    }
+}
+// Lexer options match the renderer used for conversion (gfm off), so the
+// warning lists exactly what the converted HTML loses.
+export function detectLossyMarkdown(markdown) {
+    const found = new Set();
+    collect(new Lexer({ gfm: false, breaks: false }).lex(markdown), found);
+    return LOSSY_MARKDOWN_FEATURES.filter((feature) => found.has(feature));
+}

package/dist/managed-pages/web/markdown-to-document.d.ts

@@ -0,0 +1 @@
+export declare function markdownToDocumentHtml(markdown: string): string;

package/dist/managed-pages/web/markdown-to-document.js

@@ -0,0 +1,26 @@
+import { isAllowedDocumentLinkHref } from "@cosmicdrift/kumiko-bundled-features/template-resolver/document-schema";
+import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
+import { Marked } from "marked";
+// The server sanitizer rejects what it cannot keep, so the conversion drops it up front and the
+// lossy banner stays true: a link outside the document link policy keeps its text, an image
+// (no uploaded resource to point at) is dropped, and raw HTML is shown as text.
+const converter = new Marked({ gfm: false, breaks: false });
+converter.use({
+    renderer: {
+        html({ text }) {
+            return escapeHtml(text);
+        },
+        link({ href, tokens }) {
+            return isAllowedDocumentLinkHref(href) ? false : this.parser.parseInline(tokens);
+        },
+        image() {
+            return "";
+        },
+    },
+});
+export function markdownToDocumentHtml(markdown) {
+    const html = converter.parse(markdown, { async: false });
+    if (typeof html !== "string")
+        throw new Error("marked returned a promise for a sync parse");
+    return html;
+}

package/dist/managed-pages/web/page-body-section.d.ts

@@ -0,0 +1,3 @@
+import { type ExtensionSectionProps } from "@cosmicdrift/kumiko-renderer";
+import { type ReactNode } from "react";
+export declare function PageBodySection({ values, patch }: ExtensionSectionProps): ReactNode;

package/dist/managed-pages/web/page-body-section.js

@@ -0,0 +1,41 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { usePrimitives, useTranslation, } from "@cosmicdrift/kumiko-renderer";
+import { useMemo, useState } from "react";
+import { DocumentContentEditor } from "../../template-resolver/web/index.js";
+import { effectiveBodyFormat } from "./constants.js";
+import { detectLossyMarkdown } from "./lossy-markdown.js";
+import { markdownToDocumentHtml } from "./markdown-to-document.js";
+const LOSSY_LABEL_KEYS = {
+    image: "managed-pages:body.lossy.image",
+    blockquote: "managed-pages:body.lossy.blockquote",
+    code: "managed-pages:body.lossy.code",
+    deepHeading: "managed-pages:body.lossy.deepHeading",
+    relativeLink: "managed-pages:body.lossy.relativeLink",
+};
+const BODY_EDITOR_ID = "managed-pages-page-body";
+function stringValue(value) {
+    return typeof value === "string" ? value : "";
+}
+// A Markdown body is converted for display only: nothing is patched until the
+// user edits, so merely opening a page never turns it into a document.
+export function PageBodySection({ values, patch }) {
+    const t = useTranslation();
+    const { Banner } = usePrimitives();
+    const body = stringValue(values?.["body"]);
+    const isMarkdown = effectiveBodyFormat(values?.["bodyFormat"]) === "markdown";
+    const [editedHtml, setEditedHtml] = useState(null);
+    const [lossyAtFirstEdit, setLossyAtFirstEdit] = useState(null);
+    const pristine = editedHtml === null;
+    const convertedHtml = useMemo(() => (isMarkdown ? markdownToDocumentHtml(body) : body), [isMarkdown, body]);
+    const liveLossy = useMemo(() => (pristine && isMarkdown ? detectLossyMarkdown(body) : []), [pristine, isMarkdown, body]);
+    const lossy = lossyAtFirstEdit ?? liveLossy;
+    const handleChange = (next) => {
+        if (pristine)
+            setLossyAtFirstEdit(liveLossy);
+        setEditedHtml(next);
+        patch?.({ body: next, bodyFormat: "document" });
+    };
+    return (_jsxs(_Fragment, { children: [lossy.length > 0 && (_jsx(Banner, { variant: "warning", children: t("managed-pages:body.lossy.warning", {
+                    features: lossy.map((feature) => t(LOSSY_LABEL_KEYS[feature])).join(", "),
+                }) })), _jsx(DocumentContentEditor, { id: BODY_EDITOR_ID, value: editedHtml ?? convertedHtml, onChange: handleChange, variables: [], readOnly: false })] }));
+}

package/dist/template-resolver/document-sanitizer.d.ts

@@ -28,10 +28,14 @@ export declare function sanitizeDocumentHtml(html: string): SanitizeHtmlResult;
 export declare function parseDocumentJson(html: string): JSONContent;
 export declare function serializeDocumentJson(doc: JSONContent): string;
 export declare function flattenParagraphsToLineBreaks(sanitizedHtml: string): string;
-export declare function sanitizeTemplateBody(input: {
+type SanitizeBodyInput = {
     readonly kind: string;
     readonly contentFormat: ContentFormat;
     readonly content: string | null;
-}): SanitizeBodyResult;
+    /** A document collection stores html whatever its kind, so its html is always rebuilt. */
+    readonly alwaysSanitizeHtml?: boolean;
+};
+export declare function sanitizeTemplateBody(input: SanitizeBodyInput): SanitizeBodyResult;
 export declare function documentViolationsToFieldIssues(violations: readonly DocumentViolation[]): FieldIssue[];
 export declare function conditionScopeElement(block: ScanElement): ScanElement;
+export {};

package/dist/template-resolver/document-sanitizer.js

@@ -176,6 +176,9 @@ export function flattenParagraphsToLineBreaks(sanitizedHtml) {
 function isSanitizedHtmlKind(kind) {
     return kind === "snippet" || isOneOf(DOCUMENT_HTML_KINDS, kind);
 }
+function isSanitizedBody(input) {
+    return input.alwaysSanitizeHtml === true || isSanitizedHtmlKind(input.kind);
+}
 const HTML_ONLY_KINDS = new Set(DOCUMENT_HTML_KINDS);
 function requiredFormatViolation(kind, contentFormat) {
     if (HTML_ONLY_KINDS.has(kind) && contentFormat !== "html") {
@@ -188,7 +191,7 @@ const IMAGES_BLOCK_KIND = "document-pdf";
 // rebuild; only a PDF resolves the record's images.
 function imagesBlockViolation(input) {
     if (input.kind === IMAGES_BLOCK_KIND ||
-        !isSanitizedHtmlKind(input.kind) ||
+        !isSanitizedBody(input) ||
         input.contentFormat !== "html" ||
         input.content === null) {
         return null;
@@ -205,9 +208,7 @@ export function sanitizeTemplateBody(input) {
     const imagesViolation = imagesBlockViolation(input);
     if (imagesViolation !== null)
         return { ok: false, violations: [imagesViolation] };
-    if (!isSanitizedHtmlKind(input.kind) ||
-        input.contentFormat !== "html" ||
-        input.content === null) {
+    if (!isSanitizedBody(input) || input.contentFormat !== "html" || input.content === null) {
         return { ok: true, content: input.content };
     }
     const result = sanitizeDocumentHtml(input.content);

package/dist/template-resolver/feature.js

@@ -58,6 +58,13 @@ function assertTenantEditableValid(entries) {
         }
     }
 }
+function newEntryAction(collectionId) {
+    return {
+        icon: "plus",
+        label: "template-resolver.editor.newEntry",
+        target: { featureId: "template-resolver", action: "create", args: { collectionId } },
+    };
+}
 export function createTemplateResolverFeature(opts = {}) {
     const collections = opts.collections ?? [];
     assertCollectionKindsAllowed(collections);
@@ -77,7 +84,7 @@ export function createTemplateResolverFeature(opts = {}) {
             "Reading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away.",
             'Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host\'s roles. The same list decides delivery: a tenant override is served (mail, PDF, layouts, text blocks) only while its template is listed in tenantEditable; otherwise the system version is served. A locked override stays stored, a SystemAdmin sees it in the overview marked as not delivered, and listing the template makes it effective again. Tenant rows of a collection mounted with `access` are always served. A collection mounted without `access` is SystemAdmin only.',
             "Text an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation.",
-            "How a collection is edited follows from `contentFormat`: `plain` gives a text area, `rich` a small WYSIWYG (bold, italic, headings, lists, links), `markdown` a text area that stores markdown text (same insertable chips as `plain`). All three offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).",
+            "How a collection is edited follows from `contentFormat`: `plain` gives a text area that stores text, `document` a WYSIWYG document editor that stores sanitized HTML (bold, italic, headings, lists, links, variable chips). Both offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).",
             'A collection is tenant-wide by default. With `ownership: "user"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side.',
             "`validate` dry-runs the write pipeline for a draft (sanitizer, layout rules, placeholders) and reports what the template uses and misses. `export-bundle` / `import-bundle` (and `import-bundle-system`) move one template with all locales and resource files between tenants or environments; `copy-locale` starts a translation from an existing locale. Layouts are structured: a mail or PDF layout is `data-header` / `data-content` / `data-signature` / `data-footer` regions, and mjml layout source is system-only.",
             "`preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted. `send-test-status` tells an editor beforehand whether that send can work for the caller (`canSend`, else `reason` `no_channel` or `no_address`), never returning the address.",
@@ -143,6 +150,10 @@ export function createTemplateResolverFeature(opts = {}) {
             r.contentCollection({
                 ...collection,
                 access: collection.access ?? DEFAULT_COLLECTION_ACCESS,
+                nav: {
+                    ...collection.nav,
+                    createAction: collection.nav.createAction ?? newEntryAction(collection.id),
+                },
             });
             r.queryHandler(makeCollectionListQuery(collection));
             r.queryHandler(makeCollectionItemQuery(collection));

package/dist/template-resolver/handlers/collection-set.write.d.ts

@@ -6,13 +6,8 @@ export declare function makeCollectionSetWrite(collection: ContentCollectionDefi
     locale: z.ZodString;
     title: z.ZodString;
     content: z.ZodNullable<z.ZodString>;
-    contentFormat: z.ZodDefault<z.ZodEnum<{
-        html: "html";
-        markdown: "markdown";
-        mjml: "mjml";
-        plain: "plain";
-    }>>;
     folder: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    createOnly: z.ZodOptional<z.ZodBoolean>;
     tenantIdOverride: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, {
     slug: string;

package/dist/template-resolver/handlers/collection-set.write.js

@@ -7,8 +7,8 @@ import { systemTemplateExists } from "../api.js";
 import { documentViolationsToFieldIssues, sanitizeTemplateBody } from "../document-sanitizer.js";
 import { refuseTemplateEdit } from "../template-edit-policy.js";
 import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "../web/constants.js";
-import { collectionStore } from "./collection-shared.js";
-import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.js";
+import { collectionStore, storageFormatOf } from "./collection-shared.js";
+import { folderSchema, localeSchema, slugSchema } from "./shared.js";
 // Upsert inside one collection. Mirrors set.write for text-blocks, but the
 // kind comes from the declaration and the access rule is the collection's own,
 // so an app can let agents edit their snippets without letting them near the
@@ -18,6 +18,7 @@ import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./s
 // — the draft stage lives on upsertTenant + publish.
 export function makeCollectionSetWrite(collection, editPolicy) {
     const store = collectionStore(collection);
+    const contentFormat = storageFormatOf(collection);
     return defineWriteHandler({
         name: `${collection.id}-set`,
         schema: z.object({
@@ -25,8 +26,9 @@ export function makeCollectionSetWrite(collection, editPolicy) {
             locale: localeSchema,
             title: z.string().min(1).max(200),
             content: z.string().max(200_000).nullable(),
-            contentFormat: contentFormatSchema.default("markdown"),
             folder: folderSchema.nullable().optional(),
+            /** The create form sets it so a taken slug is reported instead of overwritten. */
+            createOnly: z.boolean().optional(),
             /** Optional cross-tenant write — SystemAdmin only. */
             tenantIdOverride: z.string().min(1).optional(),
         }),
@@ -59,8 +61,9 @@ export function makeCollectionSetWrite(collection, editPolicy) {
             const owner = store.scopeOf(event.user);
             const body = sanitizeTemplateBody({
                 kind: collection.kind,
-                contentFormat: event.payload.contentFormat,
+                contentFormat,
                 content: event.payload.content,
+                alwaysSanitizeHtml: collection.contentFormat === "document",
             });
             if (!body.ok) {
                 return writeFailure(new ValidationError({ fields: documentViolationsToFieldIssues(body.violations) }));
@@ -82,6 +85,18 @@ export function makeCollectionSetWrite(collection, editPolicy) {
                 locale: event.payload.locale,
                 ...owner,
             });
+            if (existing && event.payload.createOnly === true) {
+                return writeFailure(new ValidationError({
+                    fields: [
+                        {
+                            path: "slug",
+                            code: "slug_exists",
+                            i18nKey: "templateResolver.errors.collection.slugExists",
+                            params: { detail: event.payload.slug },
+                        },
+                    ],
+                }));
+            }
             if (existing) {
                 const result = await store.executor.update({
                     id: existing.id,
@@ -92,7 +107,7 @@ export function makeCollectionSetWrite(collection, editPolicy) {
                     changes: {
                         title: event.payload.title,
                         content: body.content,
-                        contentFormat: event.payload.contentFormat,
+                        contentFormat,
                         folder: event.payload.folder ?? null,
                     },
                 }, event.user, db, { streamTenantId });
@@ -110,7 +125,7 @@ export function makeCollectionSetWrite(collection, editPolicy) {
                 locale: event.payload.locale,
                 title: event.payload.title,
                 content: body.content,
-                contentFormat: event.payload.contentFormat,
+                contentFormat,
                 folder: event.payload.folder ?? null,
                 ...store.createDefaults(tenantId),
                 ...owner,

package/dist/template-resolver/handlers/collection-shared.d.ts

@@ -3,6 +3,7 @@ import type { ContentCollectionDefinition, SessionUser, TenantId } from "@cosmic
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { templateResourcesTable } from "../table.ts";
 import { userContentEntriesTable } from "../user-content-table.ts";
+import type { ContentFormat } from "../web/constants.ts";
 export type CollectionEntryRow = {
     readonly id: string | number;
     readonly version: number;
@@ -43,3 +44,4 @@ export declare function toCollectionEntry(row: CollectionEntryRow): {
     folder: string | null;
     modifiedAt: globalThis.Temporal.Instant | null;
 };
+export declare function storageFormatOf(collection: ContentCollectionDefinition): ContentFormat;

package/dist/template-resolver/handlers/collection-shared.js

@@ -60,3 +60,8 @@ export function toCollectionEntry(row) {
         modifiedAt: row.modifiedAt,
     };
 }
+// The client never names the storage format: the declared editor decides it, so a
+// stale or tampered client cannot stamp a "plain" collection with html or the reverse.
+export function storageFormatOf(collection) {
+    return collection.contentFormat === "document" ? "html" : "plain";
+}

package/dist/template-resolver/handlers/set.write.js

@@ -39,6 +39,7 @@ export function makeSetWrite(policy) {
             kind: z.enum(TEMPLATE_KINDS).optional(),
             title: z.string().min(1).max(200),
             content: z.string().max(200_000).nullable(),
+            // Provisioning callers omit it and rely on markdown.
             contentFormat: contentFormatSchema.default("markdown"),
             /** Folder path for the content tree. Optional + null = root node. */
             folder: folderSchema.nullable().optional(),

package/dist/template-resolver/handlers/shared.js

@@ -2,7 +2,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import * as z from "zod";
 import { templateResourceEntity, templateResourcesTable } from "../table.js";
 import { templateSlugSchema } from "../template-meta.js";
-import { CONTENT_FORMATS, TEMPLATE_STATUSES, UPSERT_KINDS } from "../web/constants.js";
+import { CONTENT_FORMATS, SLUG_MAX_LENGTH, SLUG_PATTERN, TEMPLATE_STATUSES, UPSERT_KINDS, } from "../web/constants.js";
 // One executor per bundle, shared by all four handlers for create/update via
 // event store + optimistic lock.
 export const executor = createEventStoreExecutor(templateResourcesTable, templateResourceEntity, {
@@ -12,8 +12,8 @@ export const executor = createEventStoreExecutor(templateResourcesTable, templat
 export const slugSchema = z
     .string()
     .min(1)
-    .max(80)
-    .regex(/^[a-z0-9][a-z0-9-]*$/, "slug must be kebab-case (lowercase, digits, dashes)");
+    .max(SLUG_MAX_LENGTH)
+    .regex(SLUG_PATTERN, "slug must be kebab-case (lowercase, digits, dashes)");
 export { templateSlugSchema };
 export const localeSchema = z
     .string()

package/dist/template-resolver/web/client-plugin.d.ts

@@ -1,20 +1,5 @@
-import type { TreeNode } from "@cosmicdrift/kumiko-framework/engine";
-import { type FeatureSchema } from "@cosmicdrift/kumiko-renderer";
 import { type ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
-export type BlockSummary = {
-    readonly slug: string;
-    readonly locale: string;
-    readonly title: string | null;
-    readonly content: string | null;
-    readonly folder: string | null;
-    readonly modifiedAt: string | null;
-};
-export declare function groupBlocksByFolder(blocks: readonly BlockSummary[], tenantIdOverride?: string, collectionId?: string): readonly TreeNode[];
-type ContentCollectionSchema = NonNullable<FeatureSchema["contentCollections"]>[number];
-export declare function canWriteContent(collection: Pick<ContentCollectionSchema, "access"> | undefined, roles: readonly string[] | undefined): boolean;
-export declare function resolveWriteContentFormat(collectionContentFormat: string | undefined, loadedContentFormat: string | undefined): string | undefined;
 export declare function textBlocksClient(opts?: {
     readonly navId?: string;
     readonly tenantId?: string;
 }): ClientFeatureDefinition;
-export {};