@cosmicdrift/kumiko-framework 0.201.0 → 0.203.0

package/src/engine/boot-validator/projection-list-screens.ts

@@ -0,0 +1,82 @@
+import { ZodObject } from "zod";
+import { QnTypes, qualifyEntityName } from "../qualified-name";
+import type { FeatureDefinition, ProjectionListScreenDefinition, QueryHandlerDef } from "../types";
+import { SEARCHABLE_FALSE_WHITELIST } from "./entity-list-screens";
+
+// Sibling to entity-list-screens.ts rather than an extension of it:
+// validateOneEntityListScreen is typed to EntityListScreenDefinition and
+// reaches into feature.entities[screen.entity] — a projectionList has no
+// entity, so sharing the function would mean threading a discriminated
+// union through every entity-bound helper it calls.
+
+function buildQueryHandlerMap(
+  features: readonly FeatureDefinition[],
+): ReadonlyMap<string, QueryHandlerDef> {
+  const out = new Map<string, QueryHandlerDef>();
+  for (const feature of features) {
+    for (const [name, handler] of Object.entries(feature.queryHandlers ?? {})) {
+      out.set(qualifyEntityName(feature.name, QnTypes.query, name), handler);
+    }
+  }
+  return out;
+}
+
+// Non-ZodObject schemas (e.g. a z.union across payload shapes) and
+// unresolved query handlers both fall through to "capability absent" —
+// consistent with buildAppSchema's derivation, no throw either way.
+function schemaAccepts(schema: QueryHandlerDef["schema"] | undefined, key: string): boolean {
+  const shape = schema instanceof ZodObject ? schema.shape : undefined;
+  return shape !== undefined && key in shape;
+}
+
+function validateOneProjectionListScreen(
+  feature: FeatureDefinition,
+  screen: ProjectionListScreenDefinition,
+  queryHandlers: ReadonlyMap<string, QueryHandlerDef>,
+): void {
+  const prefix = `[projectionList] Feature "${feature.name}" screen "${screen.id}"`;
+  const schema = queryHandlers.get(screen.query)?.schema;
+
+  if (screen.searchable === true && !schemaAccepts(schema, "search")) {
+    throw new Error(
+      `${prefix}: searchable: true but query "${screen.query}" has no "search" parameter in its Zod schema`,
+    );
+  }
+
+  if (
+    screen.searchable === false &&
+    schemaAccepts(schema, "search") &&
+    !SEARCHABLE_FALSE_WHITELIST.has(screen.id)
+  ) {
+    throw new Error(
+      `${prefix}: query "${screen.query}" accepts "search" but searchable: false disables it — remove searchable: false or add "${screen.id}" to SEARCHABLE_FALSE_WHITELIST`,
+    );
+  }
+
+  // sortable/paginated are derived by buildAppSchema from the query's Zod
+  // schema (fw#2165) — there is no separate wire type from the author-facing
+  // ProjectionListScreenDefinition, so hand-authoring them would otherwise be
+  // silently overwritten with no signal to the author. Reject outright.
+  if (screen.sortable !== undefined) {
+    throw new Error(`${prefix}: sortable is derived from the query's Zod schema, don't set it`);
+  }
+  if (screen.paginated !== undefined) {
+    throw new Error(`${prefix}: paginated is derived from the query's Zod schema, don't set it`);
+  }
+
+  const searchActive = screen.searchable !== false && schemaAccepts(schema, "search");
+  const sortActive = schemaAccepts(schema, "sort");
+  if ((searchActive || sortActive) && screen.defaultSort === undefined) {
+    throw new Error(`${prefix}: defaultSort required when search or sort is active`);
+  }
+}
+
+export function validateProjectionListScreens(features: readonly FeatureDefinition[]): void {
+  const queryHandlers = buildQueryHandlerMap(features);
+  for (const feature of features) {
+    for (const screen of Object.values(feature.screens)) {
+      if (screen.type !== "projectionList") continue;
+      validateOneProjectionListScreen(feature, screen, queryHandlers);
+    }
+  }
+}

package/src/engine/boot-validator/screens.ts

@@ -67,7 +67,7 @@ function validateNoWidgetRequiredField(
 function validateRowActionNavigateParams(
   featureName: string,
   screenId: string,
-  screenType: "entityList" | "projectionList",
+  screenType: "entityList" | "projectionList" | "projectionDetail",
   screenEntity: string | undefined,
   action: RowAction,
   target: { readonly featureName: string; readonly screen: ScreenDefinition } | undefined,
@@ -388,6 +388,47 @@ export function validateScreens(
           );
         }
       }
+      // Header actions reuse RowAction (the displayed record stands in for
+      // the row), so the same navigate/writeHandler existence checks as
+      // entityList/projectionList apply. `rowClick` is rejected outright —
+      // a detail screen has no row to click.
+      if (screen.actions !== undefined) {
+        for (const action of screen.actions) {
+          if (action.kind === "navigate" && action.rowClick === true) {
+            throw new Error(
+              `[Feature ${feature.name}] Screen "${qualifyEntityName(feature.name, "screen", screenId)}" ` +
+                `(projectionDetail) action "${action.id}" sets rowClick: true — there is no row to ` +
+                `click on a detail screen. Remove rowClick.`,
+            );
+          }
+          if (action.kind === "navigate") {
+            const candidateQn = qualifyEntityName(feature.name, "screen", action.screen);
+            if (!allScreenQns.has(candidateQn) && !navTargetShortIds.has(action.screen)) {
+              throw new Error(
+                `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) action "${action.id}" ` +
+                  `navigate-target "${action.screen}" does not resolve to a registered screen in any feature.`,
+              );
+            }
+            const target = screensByShortId.get(action.screen)?.[0];
+            validateRowActionNavigateParams(
+              feature.name,
+              screenId,
+              "projectionDetail",
+              screen.detailFor,
+              action,
+              target,
+            );
+          } else {
+            if (!allWriteHandlerQns.has(action.handler)) {
+              throw new Error(
+                `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) action "${action.id}" ` +
+                  `handler "${action.handler}" is not a registered write-handler. Check the QN spelling ` +
+                  `(expected "<feature>:write:<short>") and that the handler is declared via r.writeHandler(...).`,
+              );
+            }
+          }
+        }
+      }
       continue;
     }
 

package/src/engine/build-app-schema.ts

@@ -27,7 +27,15 @@
 // Kontext um sie zu lesen. TODO wenn das ein realer Use-Case wird:
 // `effectiveFeatures` Argument annehmen und über alle iterations filtern.
 
-import type { AppSchema, EntityDefinition, FeatureSchema, WorkspaceSchema } from "../ui-types";
+import { ZodObject, type ZodType } from "zod";
+import type {
+  AppSchema,
+  EntityDefinition,
+  FeatureSchema,
+  ProjectionListScreenDefinition,
+  ScreenDefinition,
+  WorkspaceSchema,
+} from "../ui-types";
 import {
   buildConfigFeatureSchema,
   type ConfigFeatureSchema,
@@ -63,7 +71,7 @@ export function buildAppSchema(registry: Registry, options: BuildAppSchemaOption
     const featureSchema: FeatureSchema = {
       featureName,
       entities: projectEntities(feature.entities ?? {}),
-      screens: Object.values(feature.screens),
+      screens: projectScreens(feature.screens, registry),
       ...(navs.length > 0 && { navs }),
       ...(contentCollections.length > 0 && { contentCollections }),
       // #1059: verbatim r.translations({keys}) — see FeatureSchema.translations
@@ -289,6 +297,51 @@ export function findNonJsonSafePath(value: unknown, path: string): string | null
   return path;
 }
 
+// projectionList screens don't declare searchable/sortable/paginated as
+// authoring intent — they're derived here from the bound query handler's
+// Zod schema, the source of truth for what parameters it actually accepts
+// (fw#2165). A hand-written `searchable: true` still wins over the derived
+// default (screen.searchable ?? derived); the boot-validator (3a) rejects
+// one that contradicts the schema.
+function projectScreens(
+  screens: Readonly<Record<string, ScreenDefinition>>,
+  registry: Registry,
+): ScreenDefinition[] {
+  return Object.values(screens).map((screen) =>
+    screen.type === "projectionList" ? projectProjectionListScreen(screen, registry) : screen,
+  );
+}
+
+function projectProjectionListScreen(
+  screen: ProjectionListScreenDefinition,
+  registry: Registry,
+): ProjectionListScreenDefinition {
+  const schema = registry.getQueryHandler(screen.query)?.schema;
+  const capabilities = deriveProjectionListCapabilities(schema);
+  return {
+    ...screen,
+    searchable: screen.searchable ?? capabilities.searchable,
+    sortable: capabilities.sortable,
+    paginated: capabilities.paginated,
+  };
+}
+
+// Zod v4: a ZodObject's param names live on `.shape`. A schema that isn't a
+// ZodObject (e.g. a z.union across payload shapes) yields no capability
+// instead of throwing — same as a missing/unresolved query handler.
+function deriveProjectionListCapabilities(schema: ZodType | undefined): {
+  searchable: boolean;
+  sortable: boolean;
+  paginated: boolean;
+} {
+  const shape = schema instanceof ZodObject ? schema.shape : undefined;
+  return {
+    searchable: shape !== undefined && "search" in shape,
+    sortable: shape !== undefined && "sort" in shape,
+    paginated: shape !== undefined && ("cursor" in shape || "offset" in shape),
+  };
+}
+
 function projectEntities(
   entities: Readonly<Record<string, EntityDefinition>>,
 ): Readonly<Record<string, EntityDefinition>> {

package/src/engine/feature-ast/__tests__/patch.test.ts

@@ -650,3 +650,61 @@ defineFeature("inventory", (r) => {
     expect(reparsed.patterns).toEqual([]);
   });
 });
+
+// #2133 — matchArgString (shared by relation's second positional arg,
+// hook's target, and useExtension's entity) only accepted a string literal
+// or a name-resolving identifier. The parser itself is more permissive at
+// two of those positions: useExtension's entity (round3.ts:445) and hook's
+// target (hooks.ts:75) both additionally accept an inline `{ name: "..." }`
+// object ref, same as the object-form fix in #2121 — so findCallForId
+// couldn't locate a call authored that way. relation's second positional
+// arg stays narrow on purpose: round2.ts:170 parses it via readNameLiteral,
+// not readNameOrRef, so widening it would exceed what the parser accepts.
+describe("callMatchesId — positional inline-ref args (#2133)", () => {
+  test("removePattern finds a positional useExtension whose entity is an inline { name } ref", () => {
+    const sf = makeSourceFile(`
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+
+defineFeature("inventory", (r) => {
+  r.useExtension("audit", { name: "item" });
+});
+`);
+    removePattern(sf, { kind: "useExtension", extensionName: "audit", entityName: "item" });
+    const reparsed = parseSourceFile(sf);
+    expect(reparsed.errors).toEqual([]);
+    expect(reparsed.patterns).toEqual([]);
+  });
+
+  test("removePattern finds a positional hook whose target is an inline { name } ref", () => {
+    const sf = makeSourceFile(`
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+
+defineFeature("hooks", (r) => {
+  r.hook("postSave", { name: "task" }, () => {});
+});
+`);
+    removePattern(sf, { kind: "hook", hookType: "postSave", target: "task" });
+    const reparsed = parseSourceFile(sf);
+    expect(reparsed.errors).toEqual([]);
+    expect(reparsed.patterns).toEqual([]);
+  });
+
+  // Boundary, not a gap left open by this fix: readDataLiteralNode (used by
+  // readNameOrRef's object-literal branch) keeps a nested Identifier as a
+  // RawRefSentinel instead of resolving it — same as the parser side, which
+  // is why this call fails to extract too (not just to patch-match).
+  test("does not resolve an identifier nested inside an inline-ref positional arg", () => {
+    const sf = makeSourceFile(`
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+
+const ENTITY_NAME = "item";
+
+defineFeature("inventory", (r) => {
+  r.useExtension("audit", { name: ENTITY_NAME });
+});
+`);
+    expect(() =>
+      removePattern(sf, { kind: "useExtension", extensionName: "audit", entityName: "item" }),
+    ).toThrow(/no call found/);
+  });
+});

package/src/engine/feature-ast/patch.ts

@@ -374,7 +374,7 @@ function callMatchesId(call: CallExpression, id: PatternId): boolean {
         );
       }
       if (matchFirstArgString(call, id.hookType)) {
-        return matchArgString(call, 1, id.target);
+        return matchArgNameOrRef(call, 1, id.target);
       }
       return (
         matchObjectProperty(call, "type", id.hookType) &&
@@ -394,7 +394,7 @@ function callMatchesId(call: CallExpression, id: PatternId): boolean {
     case "useExtension":
       // Positional: r.useExtension(name, entity) | Object: { name, entity }
       if (matchFirstArgString(call, id.extensionName)) {
-        return matchArgString(call, 1, id.entityName);
+        return matchArgNameOrRef(call, 1, id.entityName);
       }
       return (
         matchObjectProperty(call, "name", id.extensionName) &&
@@ -433,6 +433,14 @@ function callMatchesId(call: CallExpression, id: PatternId): boolean {
 // declaration (same-file or imported) to a string-literal initializer —
 // the dominant naming style in the framework's own bundled-features
 // (`r.entity(ENTITY, ...)`, `r.useExtension(EXT_X, ...)`, see #1746).
+//
+// Narrow on purpose: every kind's arg-0 (and relation's arg-1) is parsed
+// via readNameLiteral, never readNameOrRef (see round2.ts/round3.ts) —
+// widening this shared helper to readNameOrRef would let an object-form
+// call's first argument (an ObjectLiteralExpression) match here too,
+// short-circuiting the object-form branch in callMatchesId. Positions
+// where the parser itself accepts an inline `{ name: "..." }` ref use
+// `matchArgNameOrRef` below instead.
 function matchArgString(call: CallExpression, index: number, expected: string): boolean {
   const arg = call.getArguments()[index];
   if (!arg) return false;
@@ -443,6 +451,18 @@ function matchFirstArgString(call: CallExpression, expected: string): boolean {
   return matchArgString(call, 0, expected);
 }
 
+// Like matchArgString, but via readNameOrRef — for the specific positional
+// slots where the parser accepts an inline `{ name: "..." }` object ref in
+// addition to a literal/identifier (useExtension's entity arg, hook's
+// target arg; see round3.ts:445 / hooks.ts:75). Not a drop-in replacement
+// for matchArgString: applying it to an arg-0 position would match an
+// object-form call's first (and only) argument, see the comment above.
+function matchArgNameOrRef(call: CallExpression, index: number, expected: string): boolean {
+  const arg = call.getArguments()[index];
+  if (!arg) return false;
+  return readNameOrRef(arg) === expected;
+}
+
 // Object-form property values are resolved via readNameOrRef, not the
 // narrower readNameLiteral — some properties (useExtension's `entity`,
 // hook's `target`/`allOf`) accept an inline `{ name: "..." }` ref in the

package/src/files/__tests__/files.integration.test.ts

@@ -201,7 +201,7 @@ describe("file validation", () => {
   });
 
   test("sniffMimeType recognizes gif, webp and pdf signatures", () => {
-    expect(sniffMimeType(new TextEncoder().encode("GIF89a" + "x".repeat(20)))).toBe("image/gif");
+    expect(sniffMimeType(new TextEncoder().encode(`GIF89a${"x".repeat(20)}`))).toBe("image/gif");
     const webp = new Uint8Array([
       ...new TextEncoder().encode("RIFF"),
       0,
@@ -212,7 +212,7 @@ describe("file validation", () => {
       ...Array(20).fill(0),
     ]);
     expect(sniffMimeType(webp)).toBe("image/webp");
-    expect(sniffMimeType(new TextEncoder().encode("%PDF-1.4" + "x".repeat(20)))).toBe(
+    expect(sniffMimeType(new TextEncoder().encode(`%PDF-1.4${"x".repeat(20)}`))).toBe(
       "application/pdf",
     );
   });

package/src/http/__tests__/egress-real-endpoint.integration.test.ts

@@ -0,0 +1,37 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import { lookup } from "node:dns/promises";
+import { egress } from "../egress";
+
+// fw#2149 DoD requires proving TLS/SNI validation stays intact against a
+// real HTTPS endpoint, not just a mock — the self-signed-cert tests in
+// egress.test.ts pin the fetch-by-pinned-IP mechanism, this test pins it
+// against a certificate chain issued by a real, publicly trusted CA.
+// example.com is IANA-reserved and kept up for exactly this kind of use.
+const REAL_HOST = "example.com";
+
+let networkAvailable = true;
+
+beforeAll(async () => {
+  try {
+    await lookup(REAL_HOST);
+  } catch {
+    networkAvailable = false;
+  }
+});
+
+describe("egress external: real HTTPS endpoint", () => {
+  test("connects through the pinned IP and validates the real certificate chain", async () => {
+    if (!networkAvailable) {
+      console.warn(
+        `egress real-endpoint test skipped: DNS resolution for ${REAL_HOST} failed (no network in this environment)`,
+      );
+      return;
+    }
+
+    const fetchIt = egress({ kind: "external" });
+    const res = await fetchIt(`https://${REAL_HOST}/`);
+
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain("Example Domain");
+  });
+});