@cosmicdrift/kumiko-framework 0.361.0 → 0.362.0

package/dist/api/server.js

@@ -704,6 +704,9 @@ export function buildServer(options) {
             }),
             ...(routeOptions.accessGuard ? { accessGuard: routeOptions.accessGuard } : {}),
             ...(routeOptions.privilegedRoles ? { privilegedRoles: routeOptions.privilegedRoles } : {}),
+            ...(routeOptions.unclaimedUploadReaders
+                ? { unclaimedUploadReaders: routeOptions.unclaimedUploadReaders }
+                : {}),
             ...(routeOptions.maxUploadSize ? { maxUploadSize: routeOptions.maxUploadSize } : {}),
         }));
     }

package/dist/engine/boot-validator/access-declarations.js

@@ -67,16 +67,25 @@ function validateEscapeHatchReason(feature, kind, handlerName, escapeHatch) {
         }
     }
 }
-function validatePersonalDataOnlyOnWrite(feature, kind, handlerName, access) {
-    // skip: write handlers may declare personalData, or it wasn't declared here
-    if (kind === "write" || declaredPersonalData(access) === undefined)
+function validatePersonalDataSupportedForKind(feature, kind, handlerName, access) {
+    // skip: nothing declared
+    if (declaredPersonalData(access) === undefined)
         return;
-    const property = "openToAll" in access ? "openToAll.personalData" : "access.personalData";
-    throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ` +
-        `${property} — it only applies to write handlers, whose input is ` +
-        "checked for personal-data fields.");
+    // skip: write handlers accept every personalData declaration
+    if (kind === "write")
+        return;
+    const isOpenToAll = "openToAll" in access;
+    // skip: query handlers may declare access.personalData, its value is validated separately
+    if (kind === "query" && !isOpenToAll)
+        return;
+    const property = isOpenToAll ? "openToAll.personalData" : "access.personalData";
+    const onlyAllowed = kind === "query"
+        ? 'only access.personalData: "public-intake" applies to query handlers, which write ' +
+            "personal data through nested writes of an anonymous request."
+        : "it only applies to write handlers, whose input is checked for personal-data fields.";
+    throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ${property} — ${onlyAllowed}`);
 }
-function validatePersonalDataValue(feature, handlerName, access) {
+function validatePersonalDataValue(feature, kind, handlerName, access) {
     const declared = declaredPersonalData(access);
     // skip: nothing declared
     if (declared === undefined)
@@ -85,17 +94,17 @@ function validatePersonalDataValue(feature, handlerName, access) {
         // skip: the one supported value on openToAll
         if (declared === "tenant-members")
             return;
-        throw new Error(`[Feature ${feature.name}] write handler "${handlerName}" declares an unknown ` +
+        throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares an unknown ` +
             `openToAll.personalData ${JSON.stringify(declared)} — the only supported value is "tenant-members".`);
     }
     if (declared !== "public-intake") {
-        throw new Error(`[Feature ${feature.name}] write handler "${handlerName}" declares an unknown ` +
+        throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares an unknown ` +
             `access.personalData ${JSON.stringify(declared)} — the only supported value is "public-intake".`);
     }
     // skip: roles include "anonymous", which personalData: "public-intake" requires
     if (accessAllowsAnonymous(access))
         return;
-    throw new Error(`[Feature ${feature.name}] write handler "${handlerName}" declares ` +
+    throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ` +
         'access.personalData: "public-intake" but its roles do not include ' +
         `"${ANONYMOUS_ROLE}" — personalData: "public-intake" only applies to handlers ` +
         "that allow anonymous callers.");
@@ -150,14 +159,14 @@ function validateAnonymousPersonalData(feature, handlerName, handler) {
 }
 // The rateLimit is the only protection of a public-intake handler, so the
 // generic anonymous opt-out (rateLimit: { disabled: true }) must not apply.
-function validatePublicIntakeRateLimit(feature, handlerName, handler) {
-    // skip: not a public-intake handler, or its rateLimit is active
+function validatePublicIntakeRateLimit(feature, kind, handlerName, handler) {
+    // skip: not a public-intake handler
     if (declaredPersonalData(handler.access) !== "public-intake")
         return;
     // skip: rateLimit is active
     if (!isRateLimitDisabled(handler.rateLimit))
         return;
-    throw new Error(`[Feature ${feature.name}] write handler "${handlerName}" declares ` +
+    throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ` +
         'access.personalData: "public-intake" with rateLimit: { disabled: true } — the rateLimit ' +
         'is the only protection for anonymous personal-data writes. Declare rateLimit: { per: "ip" ' +
         'or "ip+handler", ... } instead.');
@@ -166,19 +175,21 @@ export function validateAccessDeclarations(feature) {
     for (const [handlerName, handler] of Object.entries(feature.writeHandlers)) {
         validateOpenToAllReason(feature, "write", handlerName, handler.access);
         validateEscapeHatchReason(feature, "write", handlerName, handler.escapeHatch);
-        validatePersonalDataValue(feature, handlerName, handler.access);
+        validatePersonalDataValue(feature, "write", handlerName, handler.access);
         validateOpenToAllPersonalData(feature, handlerName, handler);
         validateAnonymousPersonalData(feature, handlerName, handler);
-        validatePublicIntakeRateLimit(feature, handlerName, handler);
+        validatePublicIntakeRateLimit(feature, "write", handlerName, handler);
     }
     for (const [handlerName, handler] of Object.entries(feature.queryHandlers)) {
         validateOpenToAllReason(feature, "query", handlerName, handler.access);
         validateEscapeHatchReason(feature, "query", handlerName, handler.escapeHatch);
-        validatePersonalDataOnlyOnWrite(feature, "query", handlerName, handler.access);
+        validatePersonalDataSupportedForKind(feature, "query", handlerName, handler.access);
+        validatePersonalDataValue(feature, "query", handlerName, handler.access);
+        validatePublicIntakeRateLimit(feature, "query", handlerName, handler);
     }
     for (const [handlerName, handler] of Object.entries(feature.streamHandlers)) {
         validateOpenToAllReason(feature, "stream", handlerName, handler.access);
         validateEscapeHatchReason(feature, "stream", handlerName, handler.escapeHatch);
-        validatePersonalDataOnlyOnWrite(feature, "stream", handlerName, handler.access);
+        validatePersonalDataSupportedForKind(feature, "stream", handlerName, handler.access);
     }
 }

package/dist/engine/boot-validator/card-meta-overflow.js

@@ -1,4 +1,4 @@
-import { CARD_META_MAX, cardColumnRoles } from "../../ui-types/card-column-roles.js";
+import { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind, } from "../../ui-types/card-column-roles.js";
 import { LIST_ROW_META_COLUMNS } from "../../ui-types/list-row-meta.js";
 import { parseRefTarget } from "../parse-ref-target.js";
 import { normalizeListColumn } from "../screen-helpers.js";
@@ -19,11 +19,14 @@ function resolveColumnType(spec, storedType, entity) {
 function countOverflow(feature, screen, location, columns, storedTypeOf, entity) {
     const cardColumns = columns.map((spec) => {
         const col = normalizeListColumn(spec);
+        const type = resolveColumnType(spec, storedTypeOf(col.field), entity);
+        const fileKind = cardFileDisplayKind(type, col.renderer);
         return {
             field: col.field,
-            type: resolveColumnType(spec, storedTypeOf(col.field), entity),
+            type,
             renderer: col.renderer,
             hideOnNarrow: col.hideOnNarrow,
+            ...(fileKind !== undefined && { fileDisplay: { kind: fileKind } }),
         };
     });
     const { meta } = cardColumnRoles(cardColumns);

package/dist/engine/build-app-schema.js

@@ -409,6 +409,7 @@ function projectEntity(entityName, entity) {
         ...(typeof entity.defaultCurrency === "string" && {
             defaultCurrency: entity.defaultCurrency,
         }),
+        ...(entity.lockedWhen !== undefined && { lockedWhen: entity.lockedWhen }),
     };
 }
 // Nur valueType durch — die derive-fn ist Server-only und NICHT JSON-safe

package/dist/engine/feature-ast/extractors/round3.d.ts

@@ -2,7 +2,7 @@ import type { CallExpression, SourceFile } from "ts-morph";
 import type { ClaimKeyType } from "../../types/handlers.js";
 import type { ParseError } from "../parse.js";
 import type { ClaimKeyPattern, ConfigPattern, MetricPattern, ReferenceDataPattern, SecretNamespacePattern, SecretPattern, TranslationsPattern, UseExtensionPattern } from "../patterns.js";
-import { type ExtractOutput } from "./shared.js";
+import { type ExtractOutput, type ReadDataLiteralOptions } from "./shared.js";
 export type NamedOptionsResult = {
     readonly kind: "ok";
     readonly name: string;
@@ -11,7 +11,7 @@ export type NamedOptionsResult = {
     readonly kind: "error";
     readonly error: ParseError;
 };
-export declare function readNamedOptions(call: CallExpression, sourceFile: SourceFile, methodName: string): NamedOptionsResult;
+export declare function readNamedOptions(call: CallExpression, sourceFile: SourceFile, methodName: string, readOptions?: ReadDataLiteralOptions): NamedOptionsResult;
 export declare function extractConfig(call: CallExpression, sourceFile: SourceFile): ExtractOutput<ConfigPattern>;
 export declare function extractTranslations(call: CallExpression, sourceFile: SourceFile): ExtractOutput<TranslationsPattern>;
 export declare function extractMetric(call: CallExpression, sourceFile: SourceFile): ExtractOutput<MetricPattern>;

package/dist/engine/feature-ast/extractors/round3.js

@@ -1,7 +1,7 @@
 import { SyntaxKind } from "ts-morph";
 import { sourceLocationFromNode } from "../source-location.js";
 import { fail, isPlainObject, ok, readDataLiteralNode, readNameLiteral, readNameLiteralRef, readNameOrRef, } from "./shared.js";
-export function readNamedOptions(call, sourceFile, methodName) {
+export function readNamedOptions(call, sourceFile, methodName, readOptions = {}) {
     const args = call.getArguments();
     const first = args[0];
     if (!first) {
@@ -17,7 +17,7 @@ export function readNamedOptions(call, sourceFile, methodName) {
         if (!nameInit) {
             return fail(methodName, sourceLocationFromNode(call, sourceFile), "object form requires a string-literal `name` property");
         }
-        const data = readDataLiteralNode(obj);
+        const data = readDataLiteralNode(obj, readOptions);
         if (!isPlainObject(data)) {
             return fail(methodName, sourceLocationFromNode(call, sourceFile), "argument could not be read as a plain object");
         }
@@ -32,7 +32,7 @@ export function readNamedOptions(call, sourceFile, methodName) {
     if (!optionsArg) {
         return fail(methodName, sourceLocationFromNode(call, sourceFile), "expected an options object as second argument");
     }
-    const options = readDataLiteralNode(optionsArg);
+    const options = readDataLiteralNode(optionsArg, readOptions);
     if (!isPlainObject(options)) {
         return fail(methodName, sourceLocationFromNode(call, sourceFile), "options could not be read as a plain object");
     }
@@ -88,7 +88,7 @@ export function extractMetric(call, sourceFile) {
     });
 }
 export function extractSecret(call, sourceFile) {
-    const parsed = readNamedOptions(call, sourceFile, "secret");
+    const parsed = readNamedOptions(call, sourceFile, "secret", { functionValuesAsRaw: true });
     if (parsed.kind === "error")
         return parsed;
     return ok({

package/dist/files/bind-referenced-files.write.d.ts

@@ -0,0 +1,16 @@
+import * as z from "zod";
+export type BindReferencedFilesResult = {
+    readonly bound: number;
+    readonly skipped: number;
+    readonly nextAfterId: string | null;
+};
+export declare const bindReferencedFilesWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"bindReferencedFiles", z.ZodObject<{
+    entityType: z.ZodString;
+    entityIds: z.ZodOptional<z.ZodArray<z.ZodUUID>>;
+    afterId: z.ZodOptional<z.ZodUUID>;
+    limit: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>, {
+    bound: number;
+    skipped: number;
+    nextAfterId: string | null;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/files/bind-referenced-files.write.js

@@ -0,0 +1,109 @@
+import * as z from "zod";
+import { defineWriteHandler, SYSTEM_ROLE, SYSTEM_USER_ID } from "../engine/index.js";
+import { isFileField } from "../engine/types/index.js";
+import { ValidationError } from "../errors/index.js";
+import { fileRefIdsOf } from "./bind-pending-file-refs.js";
+import { getFileRefExecutor } from "./create-file-ref.js";
+import { FILE_REF_ENTITY_NAME } from "./file-ref-entity.js";
+import { findImplicitEntityTable } from "./record-write-check.js";
+const MAX_PAGE_SIZE = 500;
+const DEFAULT_PAGE_SIZE = 200;
+const payloadSchema = z.object({
+    entityType: z.string().min(1),
+    entityIds: z.array(z.uuid()).min(1).max(MAX_PAGE_SIZE).optional(),
+    afterId: z.uuid().optional(),
+    limit: z.number().int().min(1).max(MAX_PAGE_SIZE).default(DEFAULT_PAGE_SIZE),
+});
+function invalidEntityType() {
+    return new ValidationError({
+        fields: [
+            {
+                path: "entityType",
+                code: "invalid_value",
+                i18nKey: "errors.validation.invalid_value",
+            },
+        ],
+    });
+}
+// The entity must have an implicit table and declared file fields, and the files
+// feature must be mounted; anything else is a caller error, not an empty page.
+function resolveFileBearingEntity(registry, entityType) {
+    const entity = registry.getEntity(entityType);
+    const table = findImplicitEntityTable(registry, entityType);
+    if (entity === undefined || table === undefined)
+        throw invalidEntityType();
+    if (registry.getEntity(FILE_REF_ENTITY_NAME) === undefined)
+        throw invalidEntityType();
+    const fileFieldNames = Object.entries(entity.fields)
+        .filter(([, fieldDef]) => isFileField(fieldDef))
+        .map(([fieldName]) => fieldName);
+    if (fileFieldNames.length === 0)
+        throw invalidEntityType();
+    return { entity, table, fileFieldNames };
+}
+// Either the named records or one id-ordered page after afterId.
+function loadRecordPage(db, { entity, table }, { entityIds, afterId, limit }) {
+    return db.selectMany(table, {
+        ...(entity.softDelete === true && { isDeleted: false }),
+        ...(entityIds !== undefined
+            ? { id: entityIds }
+            : afterId !== undefined && { id: { gt: afterId } }),
+    }, { orderBy: { col: "id", direction: "asc" }, ...(entityIds === undefined && { limit }) });
+}
+// Unbound, same tenant, uploaded by the record's creator (or the system), and either
+// unclaimed or pending for exactly this entity field.
+function isBindableToRecord(fileRef, target) {
+    const uploader = fileRef["insertedById"];
+    return (typeof uploader === "string" &&
+        (uploader === target.record["insertedById"] || uploader === SYSTEM_USER_ID) &&
+        fileRef["tenantId"] === target.tenantId &&
+        fileRef["entityId"] === null &&
+        (fileRef["entityType"] === null ||
+            (fileRef["entityType"] === target.entityType && fileRef["fieldName"] === target.fieldName)));
+}
+// The binding follows only the record's declared file fields; the caller names
+// no file ids. The record's creator must have uploaded the file themselves (or the
+// system generated it), otherwise a foreign reference would pull someone else's
+// private upload into the referencing user's record and make it readable there.
+export const bindReferencedFilesWrite = defineWriteHandler({
+    name: "bindReferencedFiles",
+    schema: payloadSchema,
+    access: { roles: [SYSTEM_ROLE, "SystemAdmin"] },
+    // Maintenance backfill run by ops or system jobs, not a task an assistant performs.
+    agent: { expose: false },
+    description: "Binds the files a record references through its declared file fields to that record, so readers of the record see them through record access. Covers files uploaded before pending-upload binding existed (entityId null) and records created without a save lifecycle (custom handlers, system jobs). Binds only files uploaded by the record's creator or generated by the system; skips files already bound elsewhere, uploaded by someone else, of another tenant or missing; never rebinds.",
+    handler: async (event, ctx) => {
+        const { entityType, entityIds, limit } = event.payload;
+        const { fileFieldNames, ...source } = resolveFileBearingEntity(ctx.registry, entityType);
+        const records = await loadRecordPage(ctx.db, source, event.payload);
+        const executor = getFileRefExecutor();
+        let bound = 0;
+        let skipped = 0;
+        for (const record of records) {
+            for (const fieldName of fileFieldNames) {
+                for (const fileRefId of fileRefIdsOf(record[fieldName])) {
+                    const row = await executor.detail({ id: fileRefId }, event.user, ctx.db);
+                    if (row === null ||
+                        !isBindableToRecord(row, {
+                            record,
+                            entityType,
+                            fieldName,
+                            tenantId: event.user.tenantId,
+                        })) {
+                        skipped += 1;
+                        continue;
+                    }
+                    const version = typeof row["version"] === "number" ? row["version"] : undefined;
+                    const result = await executor.update({ id: fileRefId, version, changes: { entityType, entityId: record.id, fieldName } }, event.user, ctx.db);
+                    if (!result.isSuccess)
+                        return result;
+                    bound += 1;
+                }
+            }
+        }
+        const lastRecord = records[records.length - 1];
+        const pageIsFull = entityIds === undefined && records.length === limit;
+        const nextAfterId = pageIsFull ? (lastRecord?.id ?? null) : null;
+        return { isSuccess: true, data: { bound, skipped, nextAfterId } };
+    },
+});

package/dist/files/feature.d.ts

@@ -4,6 +4,7 @@ export { fileRefEntity } from "./file-ref-entity.js";
 export type FilesFeatureOptions = {
     readonly accessGuard?: FileAccessGuard;
     readonly privilegedRoles?: readonly string[];
+    readonly unclaimedUploadReaders?: readonly string[];
     readonly maxUploadSize?: string;
 };
 export declare function createFilesFeature(options?: FilesFeatureOptions): FeatureDefinition;

package/dist/files/feature.js

@@ -1,4 +1,5 @@
 import { defineFeature } from "../engine/index.js";
+import { bindReferencedFilesWrite } from "./bind-referenced-files.write.js";
 import { FILE_REF_ENTITY_NAME, fileRefEntity } from "./file-ref-entity.js";
 export { fileRefEntity } from "./file-ref-entity.js";
 // files — `fileRef` als ganz normales ES-Entity. Upload/Delete laufen über
@@ -21,6 +22,7 @@ export function createFilesFeature(options = {}) {
             recommended: false,
         });
         r.entity(FILE_REF_ENTITY_NAME, fileRefEntity);
+        r.writeHandler(bindReferencedFilesWrite);
         return { routeOptions: options };
     });
 }

package/dist/files/file-routes.d.ts

@@ -28,10 +28,11 @@ export type FileRoutesOptions = {
     readonly registry?: Registry;
     readonly maxUploadSize?: string;
     readonly privilegedRoles?: readonly string[];
+    readonly unclaimedUploadReaders?: readonly string[];
     readonly accessGuard?: FileAccessGuard;
     readonly canReadRecord?: RecordReadCheck;
     readonly canWriteRecord?: RecordWriteCheck;
 };
 export declare function resolveMaxUploadBodyBytes(options: Pick<FileRoutesOptions, "registry" | "maxUploadSize">): number;
-export declare function readFilesRouteOptions(registry: Registry): Pick<FileRoutesOptions, "accessGuard" | "privilegedRoles" | "maxUploadSize">;
+export declare function readFilesRouteOptions(registry: Registry): Pick<FileRoutesOptions, "accessGuard" | "privilegedRoles" | "unclaimedUploadReaders" | "maxUploadSize">;
 export declare function createFileRoutes(options: FileRoutesOptions): Hono;

package/dist/files/file-routes.js

@@ -26,12 +26,18 @@ const SIGNED_URL_DEFAULT_EXPIRY_SECONDS = 15 * 60;
 // files. Pending uploads (entityType set, record not yet created) are the
 // uploader's own until bound; so are uploads without an entityType, which no
 // record can ever claim.
-function createDefaultGuard(privilegedRoles, canReadRecord) {
+function createDefaultGuard(privilegedRoles, canReadRecord, unclaimedUploadReaders) {
     return async ({ fileRef, user, operation }) => {
         if (fileRef.insertedById === user.id)
             return "allow";
         if (privilegedRoles.some((role) => user.roles.includes(role)))
             return "allow";
+        const isUnclaimed = fileRef.entityType === null && fileRef.entityId === null;
+        if (isUnclaimed &&
+            operation === "read" &&
+            unclaimedUploadReaders.some((role) => user.roles.includes(role))) {
+            return "allow";
+        }
         if (fileRef.entityType === null || fileRef.entityId === null)
             return "deny";
         if (operation !== "read" || canReadRecord === undefined)
@@ -77,7 +83,8 @@ export function readFilesRouteOptions(registry) {
 export function createFileRoutes(options) {
     const { db } = options;
     const privilegedRoles = options.privilegedRoles ?? DEFAULT_PRIVILEGED_ROLES;
-    const guard = options.accessGuard ?? createDefaultGuard(privilegedRoles, options.canReadRecord);
+    const guard = options.accessGuard ??
+        createDefaultGuard(privilegedRoles, options.canReadRecord, options.unclaimedUploadReaders ?? []);
     const executor = getFileRefExecutor();
     const piiSubjectFields = collectPiiSubjectFields(fileRefEntity);
     const api = new Hono();

package/dist/files/record-write-check.d.ts

@@ -14,6 +14,7 @@ export type RecordWriteCheck = (args: {
     readonly fieldName: string | undefined;
     readonly user: SessionUser;
 }) => Promise<RecordWriteDecision>;
+export declare function findImplicitEntityTable(registry: Registry, entityType: string): import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable | undefined;
 export declare function createRecordWriteCheck(args: {
     readonly registry: Registry;
     readonly canReadRecord: RecordReadCheck;

package/dist/files/record-write-check.js

@@ -8,6 +8,14 @@ export const RecordWriteDecisions = {
     forbidden: "forbidden",
     locked: "locked",
 };
+export function findImplicitEntityTable(registry, entityType) {
+    for (const projection of registry.getAllProjections().values()) {
+        if (projection.isImplicit === true && projection.source === entityType) {
+            return projection.table;
+        }
+    }
+    return undefined;
+}
 function isEntityUpdateWrite(qn, entityName) {
     return qn.endsWith(`:write:${toKebab(entityName)}:update`);
 }
@@ -25,20 +33,12 @@ export function createRecordWriteCheck(args) {
         }
         return undefined;
     }
-    function findEntityTable(entityType) {
-        for (const projection of registry.getAllProjections().values()) {
-            if (projection.isImplicit === true && projection.source === entityType) {
-                return projection.table;
-            }
-        }
-        return undefined;
-    }
     return async ({ entityType, entityId, fieldName, user }) => {
         if (!(await canReadRecord({ entityType, entityId, user }))) {
             return RecordWriteDecisions.notFound;
         }
         const entity = registry.getEntity(entityType);
-        const table = findEntityTable(entityType);
+        const table = findImplicitEntityTable(registry, entityType);
         if (!entity || !table)
             return RecordWriteDecisions.notFound;
         // The stored row, not the detail output: the detail query can hide ownership fields.

package/dist/pipeline/write-origin.js

@@ -39,11 +39,11 @@ function declaresPublicIntake(access) {
 // Only the public dispatcher entry points compute a root; every nested call inherits
 // it, so switching identity via ctx.writeAs(SYSTEM, ...) cannot shed an anonymous root.
 export function rootWriteOrigin(registry, type, user) {
-    const writeHandler = registry.getWriteHandler(type);
+    const rootHandler = registry.getWriteHandler(type) ?? registry.getQueryHandler(type);
     return {
         rootHandler: type,
         anonymousRoot: user.roles.includes(ANONYMOUS_ROLE),
-        publicIntake: writeHandler !== undefined && declaresPublicIntake(writeHandler.access),
+        publicIntake: rootHandler !== undefined && declaresPublicIntake(rootHandler.access),
     };
 }
 // Owner binding is ignored (honorOwnerBinding=false): all anonymous callers share one

package/dist/ui-types/card-column-roles.d.ts

@@ -5,10 +5,15 @@ export type CardRoleColumn = {
     readonly type?: string;
     readonly renderer?: unknown;
     readonly hideOnNarrow?: boolean;
+    readonly fileDisplay?: {
+        readonly kind: string;
+    };
 };
 export type CardColumnRoles<C extends CardRoleColumn> = {
+    readonly image: C | undefined;
     readonly title: C | undefined;
     readonly status: C | undefined;
     readonly meta: readonly C[];
 };
+export declare function cardFileDisplayKind(type: string | undefined, renderer: unknown): "image" | "file" | undefined;
 export declare function cardColumnRoles<C extends CardRoleColumn>(columns: readonly C[]): CardColumnRoles<C>;

package/dist/ui-types/card-column-roles.js

@@ -1,9 +1,27 @@
 export const CARD_META_MAX = 3;
+// An explicit `{ format: "image" | "file" }` renderer wins over the field type, the
+// same precedence as the list view model's file display.
+export function cardFileDisplayKind(type, renderer) {
+    if (typeof renderer === "object" && renderer !== null && "format" in renderer) {
+        if (renderer.format === "image")
+            return "image";
+        if (renderer.format === "file")
+            return "file";
+    }
+    if (type === "image" || type === "images")
+        return "image";
+    if (type === "file" || type === "files")
+        return "file";
+    return undefined;
+}
 // One rule for the narrow-layout list card, shared by the renderer and the
 // boot validator so the validator counts exactly what the card would draw.
+// The first image column is the card's leading preview, neither title nor meta.
 export function cardColumnRoles(columns) {
-    const title = columns.find((col) => col.highlighted === true) ?? columns[0];
-    const status = columns.find((col) => col !== title && col.type === "select" && col.renderer === undefined);
-    const meta = columns.filter((col) => col !== title && col !== status && col.hideOnNarrow !== true);
-    return { title, status, meta };
+    const image = columns.find((col) => col.fileDisplay?.kind === "image");
+    const textColumns = columns.filter((col) => col !== image);
+    const title = textColumns.find((col) => col.highlighted === true) ?? textColumns[0];
+    const status = textColumns.find((col) => col !== title && col.type === "select" && col.renderer === undefined);
+    const meta = textColumns.filter((col) => col !== title && col !== status && col.hideOnNarrow !== true);
+    return { image, title, status, meta };
 }

package/dist/ui-types/index.d.ts

@@ -17,7 +17,7 @@ export type { WorkspaceDefinition } from "../engine/types/workspace.js";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
 export type { AppSchema, FeatureSchema, QualifiedContentCollection, WorkspaceSchema, } from "./app-schema.js";
 export type { CardColumnRoles, CardRoleColumn } from "./card-column-roles.js";
-export { CARD_META_MAX, cardColumnRoles } from "./card-column-roles.js";
+export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.js";
 export { type Formality, formalLocaleTag } from "./formality.js";
 export type { ListRowMetaColumnType, ListRowMetaReference, ReferenceLookupSource, SystemReferenceLabel, } from "./list-row-meta.js";
 export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, } from "./list-row-meta.js";

package/dist/ui-types/index.js

@@ -26,7 +26,7 @@ export { availableSelectOptions, evalFieldCondition, explicitListScreenId, findU
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
 export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
-export { CARD_META_MAX, cardColumnRoles } from "./card-column-roles.js";
+export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.js";
 export { formalLocaleTag } from "./formality.js";
 export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, } from "./list-row-meta.js";
 export { resolveTranslationValue, translationValueOtherText, } from "./plural.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.361.0",
+  "version": "0.362.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -210,8 +210,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.361.0",
-    "@cosmicdrift/kumiko-types": "0.361.0",
+    "@cosmicdrift/kumiko-http": "0.362.0",
+    "@cosmicdrift/kumiko-types": "0.362.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -227,7 +227,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.361.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.362.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,48 @@
 [
+  {
+    "version": "0.362.0",
+    "type": "fix",
+    "title": "Client schema carries entity lockedWhen",
+    "detail": "buildAppSchema projects lockedWhen, so an entityEdit screen shows a locked record read-only without a screen-level readOnly."
+  },
+  {
+    "version": "0.362.0",
+    "type": "fix",
+    "title": "r.secret options with function values (redact) no longer fail to parse",
+    "detail": "r.secret(...) options that contain arrow or function expressions (for example redact: () => \"••••••••\") were reported as \"options could not be read as a plain object\", which turned the whole feature into a legacy corpus entry. The functions are now kept verbatim as raw references, option keys stay visible and a parse to render round-trip keeps them (multi-line function bodies may be re-indented). Function values in other patterns (entity, nav, metric, job) are still rejected on purpose.",
+    "migration": "Consumers that ship a checked-in few-shot corpus (Enterprise) should regenerate it on the next framework bump; its drift test enforces that."
+  },
+  {
+    "version": "0.362.0",
+    "type": "improvement",
+    "title": "Binding of referenced files only for the record creator's own uploads",
+    "detail": "files:write:bind-referenced-files now binds a file only if the record creator uploaded it (or the system generated it), so foreign references cannot expose private uploads."
+  },
+  {
+    "version": "0.362.0",
+    "type": "improvement",
+    "title": "files:write:bind-referenced-files binds a record's referenced files",
+    "detail": "System-only handler that binds the files a record references through its declared file fields (legacy uploads with entityId null, records created without a save lifecycle) so record readers can open them. Skips files bound elsewhere, of another tenant or missing. Callable from es-ops seeds via ctx.systemWriteAs; pages with limit and nextAfterId."
+  },
+  {
+    "version": "0.362.0",
+    "type": "breaking",
+    "title": "Optional number fields in entity forms start empty instead of 0",
+    "migration": "An optional number field without default no longer starts at 0 in entityEdit create/edit, and an untouched one is not sent. If a screen relied on the implicit 0, declare default: 0 on the field."
+  },
+  {
+    "version": "0.362.0",
+    "type": "improvement",
+    "title": "unclaimedUploadReaders option for createFilesFeature",
+    "detail": "Roles listed in unclaimedUploadReaders may read (not delete) uploads that have no entityType and entityId, for documents referenced without a file field."
+  },
+  {
+    "version": "0.362.0",
+    "type": "fix",
+    "title": "Query handlers may declare personalData public-intake",
+    "detail": "The personal-data write gate computed the public-intake exemption only for write handlers, so an anonymous query handler that wrote personal data (directly or through a nested write) was always rejected, and the boot validator refused access.personalData on query handlers. Query handlers now follow the same rules as write handlers: access.personalData \"public-intake\" requires the anonymous role and an active rateLimit (not disabled). openToAll.personalData stays write-only, stream handlers still cannot declare personalData.",
+    "migration": "No consumer change; anonymous query handlers that write personal data now declare access.personalData: \"public-intake\" instead of failing at the write gate."
+  },
   {
     "version": "0.361.0",
     "type": "improvement",