@cosmicdrift/kumiko-framework 0.336.1 → 0.337.1

package/dist/engine/build-config-feature-schema.js

@@ -409,6 +409,7 @@ function buildSecretsEditScreen(screenId, secrets, access, declaredTranslationKe
     const fieldLabels = {};
     const fieldHints = {};
     const requiredFields = [];
+    const fieldAccess = {};
     // Mutable outer record — TranslationKeys' Readonly<Record<...>> index
     // signature only permits reading, so the top-level assignments below
     // need a writable local type; each entry is still a fresh, never-mutated object.
@@ -430,6 +431,8 @@ function buildSecretsEditScreen(screenId, secrets, access, declaredTranslationKe
             }
             if (s.def.required === true)
                 requiredFields.push(fieldId);
+            if (s.def.writeRoles !== undefined)
+                fieldAccess[fieldId] = { roles: [...s.def.writeRoles] };
         }
         const titleKey = `${feature}.settings`;
         sections.push({
@@ -444,6 +447,7 @@ function buildSecretsEditScreen(screenId, secrets, access, declaredTranslationKe
         fieldLabels,
         ...(Object.keys(fieldHints).length > 0 && { fieldHints }),
         ...(requiredFields.length > 0 && { requiredFields }),
+        ...(Object.keys(fieldAccess).length > 0 && { fieldAccess }),
         sections,
         ...(access !== undefined && { access }),
     };

package/dist/engine/define-feature.js

@@ -124,6 +124,7 @@ export function defineFeature(name, setup, settings) {
         handlerEntityMappings: state.handlerEntityMappings,
         metrics: state.metrics,
         secretKeys: state.secretKeys,
+        secretNamespaces: state.secretNamespaces,
         projections: state.projections,
         entityProjectionExtensions: state.entityProjectionExtensions,
         multiStreamProjections: state.multiStreamProjections,

package/dist/engine/feature-ast/extractors/index.d.ts

@@ -7,7 +7,7 @@ export { collectScreenOpaqueProps, extractMultiStreamProjection, extractProjecti
 export { findImportBindingForLocalName, resolveModuleFile, } from "./resolve-import.js";
 export { extractDescribe, extractOptionalRequires, extractReadsConfig, extractRequires, extractSystemScope, extractToggleable, extractUiHints, } from "./round1.js";
 export { extractEntity, extractNav, extractRelation, extractWorkspace, } from "./round2.js";
-export { extractClaimKey, extractConfig, extractMetric, extractReferenceData, extractSecret, extractTranslations, extractUseExtension, isClaimKeyType, type NamedOptionsResult, readNamedOptions, } from "./round3.js";
+export { extractClaimKey, extractConfig, extractMetric, extractReferenceData, extractSecret, extractSecretNamespace, extractTranslations, extractUseExtension, isClaimKeyType, type NamedOptionsResult, readNamedOptions, } from "./round3.js";
 export { extractBootCheck, extractEnvSchema, extractExposesApi, extractExtendsRegistrar, extractStoreTable, extractUsesApi, } from "./round5.js";
 export { extractTreeActions } from "./round6.js";
 export type { ExtractOutput } from "./shared.js";

package/dist/engine/feature-ast/extractors/index.js

@@ -7,7 +7,7 @@ export { collectScreenOpaqueProps, extractMultiStreamProjection, extractProjecti
 export { findImportBindingForLocalName, resolveModuleFile, } from "./resolve-import.js";
 export { extractDescribe, extractOptionalRequires, extractReadsConfig, extractRequires, extractSystemScope, extractToggleable, extractUiHints, } from "./round1.js";
 export { extractEntity, extractNav, extractRelation, extractWorkspace, } from "./round2.js";
-export { extractClaimKey, extractConfig, extractMetric, extractReferenceData, extractSecret, extractTranslations, extractUseExtension, isClaimKeyType, readNamedOptions, } from "./round3.js";
+export { extractClaimKey, extractConfig, extractMetric, extractReferenceData, extractSecret, extractSecretNamespace, extractTranslations, extractUseExtension, isClaimKeyType, readNamedOptions, } from "./round3.js";
 export { extractBootCheck, extractEnvSchema, extractExposesApi, extractExtendsRegistrar, extractStoreTable, extractUsesApi, } from "./round5.js";
 export { extractTreeActions } from "./round6.js";
 export { fail, findFunctionLiteral, isPlainObject, ok, readBooleanProperty, readDataLiteralNode, readNameOrRef, readNameOrRefOrList, readObjectPropertyInitializer, readPropertyKey, readStringLiteralArgs, readVarargsOrArrayProp, resolveSameFileObjectLiteral, } from "./shared.js";

package/dist/engine/feature-ast/extractors/jobs-routes.js

@@ -126,10 +126,14 @@ export function extractHttpRoute(call, sourceFile) {
     if (!fn) {
         return fail("httpRoute", sourceLocationFromNode(call, sourceFile), "handler must be an inline arrow function or function expression");
     }
-    // Missing/non-boolean `anonymous` reads as false (the safe side — mounted
+    // Missing `anonymous` reads as false (the safe side — mounted
     // behind the session auth chain, not public) so a source file that predates
     // the required field still parses instead of erroring here.
-    const anonymous = readBooleanProperty(arg, "anonymous") === true;
+    const anonymousValue = readBooleanProperty(arg, "anonymous");
+    if (anonymousValue === undefined && arg.getProperty("anonymous") !== undefined) {
+        return fail("httpRoute", sourceLocationFromNode(call, sourceFile), "anonymous must be a boolean literal — a non-literal value would be rewritten to a literal on round-trip");
+    }
+    const anonymous = anonymousValue === true;
     return ok({
         kind: "httpRoute",
         source: sourceLocationFromNode(call, sourceFile),

package/dist/engine/feature-ast/extractors/round3.d.ts

@@ -1,7 +1,7 @@
 import type { CallExpression, SourceFile } from "ts-morph";
 import type { ClaimKeyType } from "../../types/handlers.js";
 import type { ParseError } from "../parse.js";
-import type { ClaimKeyPattern, ConfigPattern, MetricPattern, ReferenceDataPattern, SecretPattern, TranslationsPattern, UseExtensionPattern } from "../patterns.js";
+import type { ClaimKeyPattern, ConfigPattern, MetricPattern, ReferenceDataPattern, SecretNamespacePattern, SecretPattern, TranslationsPattern, UseExtensionPattern } from "../patterns.js";
 import { type ExtractOutput } from "./shared.js";
 export type NamedOptionsResult = {
     readonly kind: "ok";
@@ -16,6 +16,7 @@ export declare function extractConfig(call: CallExpression, sourceFile: SourceFi
 export declare function extractTranslations(call: CallExpression, sourceFile: SourceFile): ExtractOutput<TranslationsPattern>;
 export declare function extractMetric(call: CallExpression, sourceFile: SourceFile): ExtractOutput<MetricPattern>;
 export declare function extractSecret(call: CallExpression, sourceFile: SourceFile): ExtractOutput<SecretPattern>;
+export declare function extractSecretNamespace(call: CallExpression, sourceFile: SourceFile): ExtractOutput<SecretNamespacePattern>;
 export declare function isClaimKeyType(value: unknown): value is ClaimKeyType;
 export declare function extractClaimKey(call: CallExpression, sourceFile: SourceFile): ExtractOutput<ClaimKeyPattern>;
 export declare function extractReferenceData(call: CallExpression, sourceFile: SourceFile): ExtractOutput<ReferenceDataPattern>;

package/dist/engine/feature-ast/extractors/round3.js

@@ -98,6 +98,17 @@ export function extractSecret(call, sourceFile) {
         options: parsed.options,
     });
 }
+export function extractSecretNamespace(call, sourceFile) {
+    const parsed = readNamedOptions(call, sourceFile, "secretNamespace");
+    if (parsed.kind === "error")
+        return parsed;
+    return ok({
+        kind: "secretNamespace",
+        source: sourceLocationFromNode(call, sourceFile),
+        shortName: parsed.name,
+        options: parsed.options,
+    });
+}
 export function isClaimKeyType(value) {
     return (value === "string" ||
         value === "number" ||

package/dist/engine/feature-ast/extractors/shared.js

@@ -195,9 +195,7 @@ function resolveIdentifierToStringLiteral(identifier) {
     const scoped = findScopedVariableDeclaration(id, name);
     if (scoped) {
         const init = scoped.getInitializer();
-        const value = init ? unwrapLiteralInitializer(init) : undefined;
-        if (value !== undefined)
-            return value;
+        return init ? unwrapLiteralInitializer(init) : undefined;
     }
     const binding = findImportBindingForLocalName(id.getSourceFile(), name);
     if (!binding)

package/dist/engine/feature-ast/index.d.ts

@@ -8,7 +8,7 @@ export type { AddAuthClaimsArgs, AddClaimKeyArgs, AddConfigArgs, AddDefineEventA
 export { createFeaturePatcher } from "./patcher.js";
 export type { PatternChangeIssue, PatternChangesParseResult } from "./pattern-change-schema.js";
 export { parsePatternChanges } from "./pattern-change-schema.js";
-export type { AuthClaimsPattern, ClaimKeyPattern, ConfigPattern, DefineEventPattern, Editability, EntityPattern, ExtendsRegistrarPattern, FeaturePattern, FeaturePatternKind, HookPattern, HttpRoutePattern, JobPattern, MetricPattern, MultiStreamProjectionPattern, NavPattern, NotificationPattern, OptionalRequiresPattern, ProjectionPattern, QueryHandlerPattern, ReadsConfigPattern, ReferenceDataPattern, RelationPattern, RequiresPattern, ScreenPattern, SecretPattern, StreamHandlerPattern, SystemScopePattern, ToggleablePattern, TranslationsPattern, UnknownPattern, UseExtensionPattern, WorkspacePattern, WriteHandlerPattern, } from "./patterns.js";
+export type { AuthClaimsPattern, ClaimKeyPattern, ConfigPattern, DefineEventPattern, Editability, EntityPattern, ExtendsRegistrarPattern, FeaturePattern, FeaturePatternKind, HookPattern, HttpRoutePattern, JobPattern, MetricPattern, MultiStreamProjectionPattern, NavPattern, NotificationPattern, OptionalRequiresPattern, ProjectionPattern, QueryHandlerPattern, ReadsConfigPattern, ReferenceDataPattern, RelationPattern, RequiresPattern, ScreenPattern, SecretNamespacePattern, SecretPattern, StreamHandlerPattern, SystemScopePattern, ToggleablePattern, TranslationsPattern, UnknownPattern, UseExtensionPattern, WorkspacePattern, WriteHandlerPattern, } from "./patterns.js";
 export { getEditability } from "./patterns.js";
 export type { RenderFeatureFileInput } from "./render.js";
 export { FEATURE_FILE_VERSION, renderFeatureFile, renderPattern, renderValue, VERSION_HEADER, } from "./render.js";

package/dist/engine/feature-ast/parse.js

@@ -21,7 +21,7 @@
 // Per-pattern extractors fill in iteratively (C1.5) — each round adds
 // one extractor + a focused test.
 import { Project, SyntaxKind } from "ts-morph";
-import { extractAiClassify, extractAiExtract, extractAiGenerate, extractAuthClaims, extractBootCheck, extractClaimKey, extractConfig, extractDefineEvent, extractDescribe, extractEntity, extractEnvSchema, extractExposesApi, extractExtendsRegistrar, extractHook, extractHttpRoute, extractJob, extractMetric, extractMultiStreamProjection, extractNav, extractNotification, extractOptionalRequires, extractProjection, extractQueryHandler, extractReadsConfig, extractReferenceData, extractRelation, extractRequires, extractScreen, extractSecret, extractStoreTable, extractStreamHandler, extractSystemScope, extractToggleable, extractTranslations, extractTreeActions, extractUiHints, extractUseExtension, extractUsesApi, extractWorkspace, extractWriteHandler, findFunctionLiteral, findImportBindingForLocalName, readObjectPropertyInitializer, resolveModuleFile, resolveSameFileObjectLiteral, } from "./extractors/index.js";
+import { extractAiClassify, extractAiExtract, extractAiGenerate, extractAuthClaims, extractBootCheck, extractClaimKey, extractConfig, extractDefineEvent, extractDescribe, extractEntity, extractEnvSchema, extractExposesApi, extractExtendsRegistrar, extractHook, extractHttpRoute, extractJob, extractMetric, extractMultiStreamProjection, extractNav, extractNotification, extractOptionalRequires, extractProjection, extractQueryHandler, extractReadsConfig, extractReferenceData, extractRelation, extractRequires, extractScreen, extractSecret, extractSecretNamespace, extractStoreTable, extractStreamHandler, extractSystemScope, extractToggleable, extractTranslations, extractTreeActions, extractUiHints, extractUseExtension, extractUsesApi, extractWorkspace, extractWriteHandler, findFunctionLiteral, findImportBindingForLocalName, readObjectPropertyInitializer, resolveModuleFile, resolveSameFileObjectLiteral, } from "./extractors/index.js";
 import { sourceLocationFromNode } from "./source-location.js";
 /**
  * Parse the given feature file and return all recognised r.* calls
@@ -415,6 +415,8 @@ function dispatchExtractor(methodName, call, sourceFile) {
             return extractMetric(call, sourceFile);
         case "secret":
             return extractSecret(call, sourceFile);
+        case "secretNamespace":
+            return extractSecretNamespace(call, sourceFile);
         case "claimKey":
             return extractClaimKey(call, sourceFile);
         case "referenceData":

package/dist/engine/feature-ast/patch.d.ts

@@ -44,6 +44,9 @@ export type PatternId = {
 } | {
     readonly kind: "secret";
     readonly shortName: string;
+} | {
+    readonly kind: "secretNamespace";
+    readonly shortName: string;
 } | {
     readonly kind: "claimKey";
     readonly shortName: string;

package/dist/engine/feature-ast/patch.js

@@ -85,9 +85,7 @@ export function applyChanges(sourceFile, changes) {
  * biome-stable formatting that matches the renderFeatureFile output.
  */
 export function addPattern(sourceFile, pattern) {
-    if (pattern.kind === "ai.generate" ||
-        pattern.kind === "ai.extract" ||
-        pattern.kind === "ai.classify") {
+    if (isAiStepId(pattern)) {
         throw new Error(`addPattern: ${pattern.kind} steps must be inserted into a defineWorkflow steps array, not the setup body`);
     }
     const setup = findSetupCallback(sourceFile);
@@ -430,11 +428,10 @@ function applyEditsDescending(sourceFile, edits) {
     for (const edit of sorted)
         sourceFile.replaceText([edit.start, edit.end], edit.text);
 }
-// =============================================================================
-// Lookup
-// =============================================================================
-function isAiStepId(id) {
-    return id.kind === "ai.generate" || id.kind === "ai.extract" || id.kind === "ai.classify";
+function isAiStepId(idOrPattern) {
+    return (idOrPattern.kind === "ai.generate" ||
+        idOrPattern.kind === "ai.extract" ||
+        idOrPattern.kind === "ai.classify");
 }
 function aiStepPatchSpan(sourceFile, call) {
     const start = call.getStart();
@@ -503,7 +500,7 @@ export const SINGLETON_KINDS = new Set([
  * feature can fix it explicitly.
  */
 function findCallForId(sourceFile, id) {
-    if (id.kind === "ai.generate" || id.kind === "ai.extract" || id.kind === "ai.classify") {
+    if (isAiStepId(id)) {
         return findAiStepCall(sourceFile, id);
     }
     const setup = findSetupCallback(sourceFile);
@@ -561,9 +558,8 @@ function readAiStepKey(call) {
     return undefined;
 }
 function findAiStepCall(sourceFile, id) {
-    if (id.kind !== "ai.generate" && id.kind !== "ai.extract" && id.kind !== "ai.classify") {
+    if (!isAiStepId(id))
         return undefined;
-    }
     const factory = AI_STEP_FACTORY[id.kind];
     const matches = [];
     for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
@@ -629,6 +625,7 @@ function callMatchesId(call, id) {
                 matchObjectProperty(call, "target", id.target));
         case "metric":
         case "secret":
+        case "secretNamespace":
         case "claimKey":
             return (matchFirstArgString(call, id.shortName) || matchObjectProperty(call, "name", id.shortName));
         case "referenceData":

package/dist/engine/feature-ast/patcher.d.ts

@@ -1,7 +1,7 @@
 import type { SourceFile } from "ts-morph";
 import type { LifecycleHookType } from "../constants.js";
 import type { ConfigKeyDefinition, ConfigKeyType, JobDefinition, RunIn, TranslationKeys } from "../types/config.js";
-import type { MetricOptions, SecretOptions } from "../types/feature.js";
+import type { MetricOptions, SecretNamespaceOptions, SecretOptions } from "../types/feature.js";
 import type { EntityDefinition } from "../types/fields.js";
 import type { AccessRule, ClaimKeyType, EscapeHatchDeclaration, RateLimitOption } from "../types/handlers.js";
 import type { HookPhase } from "../types/hooks.js";
@@ -115,6 +115,10 @@ export type AddSecretArgs = {
     readonly name: string;
     readonly options: SecretOptions;
 };
+export type AddSecretNamespaceArgs = {
+    readonly name: string;
+    readonly options: SecretNamespaceOptions;
+};
 export type AddClaimKeyArgs = {
     readonly name: string;
     readonly type: ClaimKeyType;
@@ -177,6 +181,7 @@ export type FeaturePatcher = {
     readonly addTranslations: (args: AddTranslationsArgs) => void;
     readonly addMetric: (args: AddMetricArgs) => void;
     readonly addSecret: (args: AddSecretArgs) => void;
+    readonly addSecretNamespace: (args: AddSecretNamespaceArgs) => void;
     readonly addClaimKey: (args: AddClaimKeyArgs) => void;
     readonly addReferenceData: (args: AddReferenceDataArgs) => void;
     readonly addUseExtension: (args: AddUseExtensionArgs) => void;

package/dist/engine/feature-ast/patcher.js

@@ -110,6 +110,9 @@ export function createFeaturePatcher(sourceFile) {
         addSecret({ name, options }) {
             add({ kind: "secret", source: SYNTHETIC_LOC, shortName: name, options });
         },
+        addSecretNamespace({ name, options }) {
+            add({ kind: "secretNamespace", source: SYNTHETIC_LOC, shortName: name, options });
+        },
         addClaimKey({ name, type }) {
             add({ kind: "claimKey", source: SYNTHETIC_LOC, shortName: name, claimType: type });
         },