@cosmicdrift/kumiko-framework 0.334.0 → 0.335.0

package/dist/files/file-routes.js

@@ -3,7 +3,7 @@ import { bodyLimit } from "hono/body-limit";
 import { getUser } from "../api/auth-middleware.js";
 import { requestContext } from "../api/request-context.js";
 import { selectMany } from "../bun-db/index.js";
-import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "../crypto/index.js";
+import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
 import { createEventStoreExecutor } from "../db/event-store-executor.js";
 import { createTenantDb } from "../db/tenant-db.js";
 import { createDerivativesContext, resolveFieldVariant, resolveRenderer, } from "../derivatives/index.js";
@@ -106,11 +106,27 @@ export function createFileRoutes(options) {
         if (!isPiiCiphertext(fileRef.fileName))
             return fileRef.fileName;
         const kms = configuredPiiSubjectKms();
+        // skip: the framework has no logger at this route layer and the file bytes are
+        // still served; the "download" fallback only hides the stored ciphertext name.
         if (!kms) {
             return "download";
         }
-        const decrypted = await decryptPiiFieldValues({ fileName: fileRef.fileName }, piiSubjectFields, kms, kmsContextFor());
-        return typeof decrypted["fileName"] === "string" ? decrypted["fileName"] : "download";
+        try {
+            const decrypted = await decryptPiiFieldValues({ fileName: fileRef.fileName }, piiSubjectFields, kms, kmsContextFor());
+            const name = decrypted["fileName"];
+            // decryptPiiFieldValues returns the row untouched when fileName isn't
+            // annotated as PII (annotation drift), so ciphertext/erased sentinel
+            // can still be here and must never reach a header.
+            if (typeof name !== "string" || isPiiCiphertext(name) || name === PII_ERASED_SENTINEL) {
+                return "download";
+            }
+            return name;
+        }
+        catch {
+            // skip: broken crypto metadata (malformed ciphertext, auth failure, missing key)
+            // must not make intact bytes unreachable; the route layer has no logger.
+            return "download";
+        }
     }
     // Runs before parseBody buffers the request below: checks Content-Length
     // upfront, counts chunked bodies while streaming.
@@ -397,11 +413,10 @@ export function createFileRoutes(options) {
         if (!row)
             return c.json({ error: "not_found" }, 404);
         const fileRef = row; // @cast-boundary db-row (decrypted via executor.detail)
-        // detail()'s "pass"-ownership read widens to tenantId IN (self, SYSTEM)
-        // and doesn't filter isDeleted (list() does, detail() doesn't) — both
+        // detail()'s "pass"-ownership read widens to tenantId IN (self, SYSTEM),
         // narrower in loadFileForTenant's selectMany. Restore that here so meta
-        // doesn't leak reference-tenant or soft-deleted rows.
-        if (fileRef.tenantId !== user.tenantId || fileRef.isDeleted) {
+        // doesn't leak reference-tenant rows.
+        if (fileRef.tenantId !== user.tenantId) {
             return c.json({ error: "not_found" }, 404);
         }
         const decision = await guard({ fileRef, user, operation: "read" });

package/dist/files/local-provider.js

@@ -1,6 +1,6 @@
 import { createReadStream, createWriteStream } from "node:fs";
 import { mkdir, readdir, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { dirname, join, resolve, sep } from "node:path";
+import { dirname, join, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { assertSafeStorageKey } from "./types.js";
 // Local-filesystem backend — intended for dev + tests. Production deploys
@@ -101,25 +101,28 @@ export function createLocalProvider(basePath) {
             }
         },
         async list(prefix) {
-            // recursive:true returns POSIX- or OS-sep-joined relative paths for
-            // both files and directories; normalize to "/" (storage keys are
-            // always "/"-joined, matching S3) before the prefix match, then stat
-            // only the (few) matches to drop directory entries.
+            // Walk only the directory part of the prefix: a tenant-scoped sweep must
+            // not traverse every other tenant's files in a shared storage root.
+            // Keys are normalized to "/" (storage keys are always "/"-joined,
+            // matching S3) before the final prefix match.
+            const prefixDir = prefix.slice(0, prefix.lastIndexOf("/") + 1);
+            const walkRoot = prefixDir === "" ? resolvedBase : resolveContainedPath(prefixDir);
             let entries;
             try {
-                entries = await readdir(resolvedBase, { recursive: true });
+                entries = await readdir(walkRoot, { recursive: true, withFileTypes: true });
             }
             catch (err) {
-                if (err.code === "ENOENT")
+                const code = err.code;
+                if (code === "ENOENT" || code === "ENOTDIR")
                     return [];
                 throw err;
             }
             const results = [];
             for (const entry of entries) {
-                const key = entry.split(sep).join("/");
-                if (!key.startsWith(prefix))
+                if (!entry.isFile())
                     continue;
-                if ((await stat(join(resolvedBase, entry))).isFile())
+                const key = relative(resolvedBase, join(entry.parentPath, entry.name)).split(sep).join("/");
+                if (key.startsWith(prefix))
                     results.push(key);
             }
             return results;

package/dist/files/provider-resolver.js

@@ -50,8 +50,27 @@ export async function createFileProviderForTenant(ctx, tenantId, handlerName = "
         throw new Error(`${FEATURE_NAME}: provider "${provider}" registered without a build() — ` +
             `extension options must be a FileProviderPlugin.`);
     }
-    return usage.options.build(ctx, tenantId);
+    const built = await usage.options.build(ctx, tenantId);
+    // Extension payloads are never type-checked, so a plugin predating a
+    // required method (list) would otherwise surface as a misleading
+    // "missing s3:ListBucket permission" hint during erasure.
+    for (const method of REQUIRED_PROVIDER_METHODS) {
+        if (typeof built[method] !== "function") {
+            throw new Error(`${FEATURE_NAME}: provider "${provider}" built without the required method ${method}() — ` +
+                `update the file-provider plugin to the current FileStorageProvider contract.`);
+        }
+    }
+    return built;
 }
+const REQUIRED_PROVIDER_METHODS = [
+    "write",
+    "writeStream",
+    "read",
+    "readStream",
+    "delete",
+    "exists",
+    "list",
+];
 // Builds the resolver from the ambient AppContext fields — the framework-side
 // equivalent of the GDPR `makeTenantStorageProviderResolver`. The config
 // accessor (and therefore the s3.secretAccessKey secret-read) runs under

package/dist/files/types.js

@@ -207,6 +207,15 @@ export function validateFileContent(fileName, content, accept) {
     const ext = extractExtension(fileName);
     if (!ext)
         return { kind: "ok" };
+    // validateFile accepts aliased declared MIMEs (csv as vnd.ms-excel) on
+    // metadata alone, so the byte check has to live on this exported path too:
+    // a text-format extension with an alias must never carry a binary signature.
+    if (Object.hasOwn(EXTENSION_MIME_ALIASES, ext) && sniffMimeType(content) !== null) {
+        return {
+            kind: "rejected",
+            error: `content_mismatch: ".${ext}" upload bytes are a binary format`,
+        };
+    }
     const signatureMimeTypes = signatureMimeTypesForExtension(ext);
     if (signatureMimeTypes.length === 0)
         return { kind: "ok" };
@@ -261,9 +270,15 @@ extensionOverride) {
     const ext = /^[A-Za-z0-9]+$/.test(rawExt) ? rawExt.toLowerCase() : "bin";
     return `${tenantId}/${entityType}/${entityId}/${fieldName}/${uniqueId}.${ext}`;
 }
+const EXPORTS_PREFIX_SEGMENT = "exports";
 /** Fixed leading segment so one S3 lifecycle rule (Prefix: "exports/") can expire export bundles for every tenant without matching a buildStorageKey() upload. */
 export function tenantExportPrefix(tenantId) {
-    return `exports/${tenantId}/`;
+    // A tenant named like the reserved segment would make the sweep prefix
+    // "exports/" match every tenant's export bundles.
+    if (tenantId === EXPORTS_PREFIX_SEGMENT) {
+        throw new Error(`tenantId "${tenantId}" collides with the reserved storage segment`);
+    }
+    return `${EXPORTS_PREFIX_SEGMENT}/${tenantId}/`;
 }
 /**
  * Every storage-key prefix a tenant's binaries can live under. A tenant-destroy

package/dist/i18n/request-locale.d.ts

@@ -1,7 +1,8 @@
 export declare const DEFAULT_LOCALE = "en";
 export declare function isValidLocaleTag(value: string): boolean;
-/** BCP-47 is case-insensitive; canonicalize the primary subtag to lowercase
- *  so registry lookups (`mailT`, `hasMailTranslations`) hit registered keys. */
+/** BCP-47 is case-insensitive; canonicalize to the RFC 5646 conventional form
+ *  (`de-AT`, `zh-Hant-TW`) so registry lookups (`mailT`, `hasMailTranslations`)
+ *  hit registered keys regardless of header casing. */
 export declare function canonicalizeLocaleTag(tag: string): string;
 /**
  * Picks the best well-formed tag from an Accept-Language header (RFC 9110

package/dist/i18n/request-locale.js

@@ -14,13 +14,23 @@ const MAX_LOCALE_TAG_LENGTH = 35;
 export function isValidLocaleTag(value) {
     return value.length <= MAX_LOCALE_TAG_LENGTH && LOCALE_TAG_RE.test(value);
 }
-/** BCP-47 is case-insensitive; canonicalize the primary subtag to lowercase
- *  so registry lookups (`mailT`, `hasMailTranslations`) hit registered keys. */
+/** BCP-47 is case-insensitive; canonicalize to the RFC 5646 conventional form
+ *  (`de-AT`, `zh-Hant-TW`) so registry lookups (`mailT`, `hasMailTranslations`)
+ *  hit registered keys regardless of header casing. */
 export function canonicalizeLocaleTag(tag) {
-    const dash = tag.indexOf("-");
-    if (dash === -1)
-        return tag.toLowerCase();
-    return `${tag.slice(0, dash).toLowerCase()}${tag.slice(dash)}`;
+    return tag
+        .split("-")
+        .map((subtag, index) => {
+        if (index === 0)
+            return subtag.toLowerCase();
+        if (/^[A-Za-z]{2}$/.test(subtag))
+            return subtag.toUpperCase();
+        if (/^[A-Za-z]{4}$/.test(subtag)) {
+            return subtag.charAt(0).toUpperCase() + subtag.slice(1).toLowerCase();
+        }
+        return subtag.toLowerCase();
+    })
+        .join("-");
 }
 /**
  * Picks the best well-formed tag from an Accept-Language header (RFC 9110

package/dist/i18n/required-surface-keys.js

@@ -46,6 +46,24 @@ function pushSectionTitles(out, section, treatAsKey = false) {
     for (const group of section.groups ?? [])
         pushKey(out, group.title, treatAsKey);
 }
+// Field labels and section titles of a step rendered through the action-form shim.
+function pushActionFormShapedKeys(out, featureName, step) {
+    for (const fieldName of Object.keys(step.fields)) {
+        out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
+    }
+    for (const section of step.layout.sections) {
+        if (isExtensionEditSection(section)) {
+            pushKey(out, section.title);
+            continue;
+        }
+        if (section.kind === "relatedList")
+            continue; // rejected at boot, unreachable here
+        pushSectionTitles(out, section);
+        for (const f of sectionFieldSpecs(section)) {
+            out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, editFieldName(f)));
+        }
+    }
+}
 function pushRowActionKeys(out, action) {
     pushKey(out, action.label);
     if (action.kind === "writeHandler" || action.kind === undefined) {
@@ -242,26 +260,9 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
             break;
         }
         case "secretMint": {
-            // Mirrors the actionForm case above (submitLabel, fields/section titles
-            // via ACTION_FORM_ENTITY) plus the reveal-phase's own i18n surface.
             const mint = screen;
             pushKey(out, mint.submitLabel);
-            for (const fieldName of Object.keys(mint.fields)) {
-                out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
-            }
-            for (const section of mint.layout.sections) {
-                if (isExtensionEditSection(section)) {
-                    pushKey(out, section.title);
-                    continue;
-                }
-                if (section.kind === "relatedList")
-                    continue; // rejected at boot, unreachable here
-                pushSectionTitles(out, section);
-                for (const f of sectionFieldSpecs(section)) {
-                    const fieldName = editFieldName(f);
-                    out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
-                }
-            }
+            pushActionFormShapedKeys(out, featureName, mint);
             pushKey(out, mint.reveal.title);
             pushKey(out, mint.reveal.warning);
             pushKey(out, mint.reveal.confirmLabel);
@@ -271,22 +272,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
             if (mint.confirm !== undefined) {
                 pushKey(out, mint.confirm.submitLabel);
                 pushKey(out, mint.confirm.doneMessage);
-                for (const fieldName of Object.keys(mint.confirm.fields)) {
-                    out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
-                }
-                for (const section of mint.confirm.layout.sections) {
-                    if (isExtensionEditSection(section)) {
-                        pushKey(out, section.title);
-                        continue;
-                    }
-                    if (section.kind === "relatedList")
-                        continue; // rejected at boot, unreachable here
-                    pushSectionTitles(out, section);
-                    for (const f of sectionFieldSpecs(section)) {
-                        const fieldName = editFieldName(f);
-                        out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
-                    }
-                }
+                pushActionFormShapedKeys(out, featureName, mint.confirm);
             }
             break;
         }
@@ -353,6 +339,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
                 }
                 if (isWriteFormEditSection(section)) {
                     pushKey(out, section.title);
+                    pushKey(out, section.description);
                     pushKey(out, section.submitLabel);
                     // kumiko-lint-ignore section-fields-raw writeForm sections carry no groups (EditWriteFormSection)
                     for (const f of section.fields) {
@@ -404,7 +391,8 @@ function collectEntityListFilterKeys(feature, out) {
                     out.add(key);
                 }
             }
-            else if (def.type === "select" && Array.isArray(def.options)) {
+            else if ((def.type === "select" || def.type === "multiSelect") &&
+                Array.isArray(def.options)) {
                 for (const value of def.options) {
                     out.add(selectFacetOptionKey(feature.name, screen.entity, fieldName, value));
                 }

package/dist/i18n/settings-hub-keys.js

@@ -39,5 +39,8 @@ export const SETTINGS_HUB_I18N = {
     "config.secrets.placeholder": { en: "Enter a value" },
     "config.secrets.replacePlaceholder": { en: "Enter a new value to replace it" },
     "config.secrets.delete": { en: "Remove" },
+    "config.secrets.deleteConfirm": {
+        en: "Remove this secret? Anything using it stops working, and it cannot be restored.",
+    },
     "screen:secrets.title": { en: "Secrets" },
 };

package/dist/jobs/index.d.ts

@@ -1,2 +1,2 @@
-export type { JobLogEntry, JobMeta, JobOutcomeMeta, JobRunner, JobRunnerOptions, } from "./job-runner.js";
-export { createJobRunner } from "./job-runner.js";
+export type { JobLogEntry, JobMeta, JobOutcomeMeta, JobRunner, JobRunnerOptions, JobSubjectValue, } from "./job-runner.js";
+export { createJobRunner, serializeJobSubject } from "./job-runner.js";

package/dist/jobs/index.js

@@ -1 +1 @@
-export { createJobRunner } from "./job-runner.js";
+export { createJobRunner, serializeJobSubject } from "./job-runner.js";

package/dist/jobs/job-runner.d.ts

@@ -28,6 +28,8 @@ export type JobOutcomeMeta = {
         readonly messageKey: string | null;
     } | undefined;
 };
+export type JobSubjectValue = string | number | boolean | null;
+export declare function serializeJobSubject(subject: Readonly<Record<string, JobSubjectValue>>): string;
 export type JobRunner = {
     start(): Promise<void>;
     stop(): Promise<void>;