@cosmicdrift/kumiko-framework 0.368.0 → 0.370.0

package/dist/engine/build-config-feature-schema.js

@@ -17,9 +17,10 @@
 import { isOptionsQueryFieldRef } from "@cosmicdrift/kumiko-types/fields";
 import { CONFIG_EDIT_ENTITY, fieldLabelKey } from "../i18n/required-surface-keys.js";
 import { isEncryptedAtRest } from "./config-helpers.js";
-import { EXTENSION_SELECTOR_HINT_KEY, SELECTED_EXTENSIONS_QUERY, selectablePluginIds, } from "./extension-selector-plugins.js";
+import { EXTENSION_SELECTOR_HINT_KEY, isSelectableInSettings, settingsSelectablePluginIds, } from "./extension-selector-plugins.js";
 import { createBooleanField, createNumberField, createSelectField, createTextField, } from "./factories.js";
 import { isKebabSegment, toKebab } from "./qualified-name.js";
+import { isFieldsEditSection, sectionFieldSpecs } from "./screen-helpers.js";
 import { isOpenToAllGranted } from "./types/handlers.js";
 // Namespace, unter dem buildAppSchema die generierten Screens/Navs einhängt
 // (find-or-create FeatureSchema). MUSS gleich CONFIG_FEATURE aus dem config
@@ -45,7 +46,7 @@ const PROVIDER_PANEL_TITLE_ENTRY = {
     es: "Proveedor",
 };
 const PROVIDER_SECTION_TITLE_KEY = "config.settings.provider";
-const SAVE_PROVIDER_LABEL_KEY = "config.settings.saveProvider";
+const SECRETS_SECTION_DESCRIPTION_KEY = "config.secrets.description";
 const audienceNavShortId = (scope) => `audience-${scope}`;
 // Generated post-boot, never via r.nav() — the boot validator exempts exactly these QNs (an app references one to place the settings group inline).
 export const SETTINGS_HUB_AUDIENCE_NAV_QNS = SCOPES_BROAD_TO_DEEP.map((scope) => `${SETTINGS_HUB_FEATURE}:nav:${audienceNavShortId(scope)}`);
@@ -73,25 +74,43 @@ const NO_SELECTOR_GATING = {
 };
 // Verbatim (unprefixed) keys as the client sees them — NOT getAllTranslations()
 // (server-merged, "feature:"-prefixed, see build-app-schema.ts:77-81).
+// Merged per locale: a locale feature (localeDe) declares the same key with only its
+// own language, and mounted first it must not drop the owning feature's en text.
 function collectDeclaredTranslations(registry) {
     const declared = new Map();
     for (const f of registry.features.values()) {
         for (const [key, values] of Object.entries(f.translations ?? {})) {
-            if (!declared.has(key))
-                declared.set(key, values);
+            declared.set(key, { ...values, ...declared.get(key) });
         }
     }
     return declared;
 }
+// A selector whose plugins are all hidden from settings still renders as a select
+// (with no option), never as a free text field.
 function collectSelectorOptions(registry) {
     const options = new Map();
     for (const [extensionName, selectorKey] of registry.getAllExtensionSelectors()) {
-        const pluginIds = selectablePluginIds(registry, extensionName);
-        if (pluginIds.length > 0)
-            options.set(selectorKey, pluginIds);
+        if (registry.getExtensionUsages(extensionName).length === 0)
+            continue;
+        options.set(selectorKey, settingsSelectablePluginIds(registry, extensionName));
     }
     return options;
 }
+// selector key → plugin id → plugin feature, for every selectable plugin, also those
+// without settings of their own (no panel, but still an option with a name).
+function collectSelectorOptionFeatures(registry) {
+    const byKey = new Map();
+    for (const [extensionName, selectorKey] of registry.getAllExtensionSelectors()) {
+        const featureByPluginId = new Map();
+        for (const usage of registry.getExtensionUsages(extensionName).filter(isSelectableInSettings)) {
+            if (usage.featureName === undefined || featureByPluginId.has(usage.entityName))
+                continue;
+            featureByPluginId.set(usage.entityName, toKebab(usage.featureName));
+        }
+        byKey.set(selectorKey, featureByPluginId);
+    }
+    return byKey;
+}
 function collectVisibleSelectorOwners(registry, visible) {
     const ownerGroupByExtension = new Map();
     const selectorFeatures = new Set();
@@ -141,6 +160,9 @@ function planSelectorGating(registry, visible, declaredSecrets, secretsEnabled)
     const secretQns = new Set();
     for (const [extension, ownerGroup] of [...ownerGroupByExtension].sort(([a], [b]) => a.localeCompare(b))) {
         const usages = [...registry.getExtensionUsages(extension)].sort((a, b) => (a.featureName ?? "").localeCompare(b.featureName ?? ""));
+        const selectorQn = registry.getAllExtensionSelectors().get(extension);
+        if (selectorQn === undefined)
+            continue;
         for (const usage of usages) {
             if (usage.featureName === undefined)
                 continue;
@@ -148,11 +170,22 @@ function planSelectorGating(registry, visible, declaredSecrets, secretsEnabled)
             if (usageCountByFeature.get(feature) !== 1 || selectorFeatures.has(feature))
                 continue;
             const scopedKeys = visible.filter((v) => v.key.ownerFeature === feature);
-            const secrets = secretsEnabled ? declaredSecrets.filter((s) => s.feature === feature) : [];
+            // The provider form has no per-field access gate, so a secret with its own write
+            // roles stays on the secrets screen, which enforces them.
+            const secrets = secretsEnabled
+                ? declaredSecrets.filter((s) => s.feature === feature && s.def.writeRoles === undefined)
+                : [];
             if (scopedKeys.length === 0 && secrets.length === 0)
                 continue;
             const plugins = pluginsByOwnerGroup.get(ownerGroup) ?? [];
-            plugins.push({ feature, extension, pluginId: usage.entityName, scopedKeys, secrets });
+            plugins.push({
+                feature,
+                extension,
+                selectorQn,
+                pluginId: usage.entityName,
+                scopedKeys,
+                secrets,
+            });
             pluginsByOwnerGroup.set(ownerGroup, plugins);
             pluginFeatures.add(feature);
             for (const s of secrets)
@@ -204,9 +237,6 @@ function buildFeatureScreensAndNavs(scope, visible, hub, gating, secretsAccess)
     }
     return out;
 }
-function pluginTenantScreenId(plugin) {
-    return `${plugin.feature}-tenant`;
-}
 function assertUniquePanelIds(ownerGroup, panels) {
     const seen = new Set();
     for (const panel of panels) {
@@ -218,63 +248,38 @@ function assertUniquePanelIds(ownerGroup, panels) {
     }
     return panels;
 }
-// Plugin screens keep their `${F}-tenant` ids so consumer title keys stay valid;
-// they are dormant because only this dashboard embeds them.
+// One form for the provider and the settings of every provider: a single save writes
+// all of it, so switching sections can't drop typed input. Each plugin's fields are
+// shown only while its provider is picked in the form; hidden fields are not saved.
 function buildSelectorOwnerDashboard(ownerGroup, ownerKeys, ownerAccess, plugins, ownerPanels, hub, secretsAccess) {
     const selectionScreenId = `${ownerGroup}-tenant-selection`;
-    const selectionScreen = {
-        ...buildScreen(selectionScreenId, "tenant", ownerGroup, ownerKeys, ownerAccess, hub, {
-            description: EXTENSION_SELECTOR_HINT_KEY,
-            sectionTitle: PROVIDER_SECTION_TITLE_KEY,
-            submitLabel: SAVE_PROVIDER_LABEL_KEY,
-        }),
-        dormant: true,
-    };
-    const screens = [selectionScreen];
-    const configPanels = [];
-    const secretsPanels = [];
+    const form = new ProviderFormBuilder(selectionScreenId, buildScreen(selectionScreenId, "tenant", ownerGroup, ownerKeys, ownerAccess, hub, {
+        description: EXTENSION_SELECTOR_HINT_KEY,
+        sectionTitle: PROVIDER_SECTION_TITLE_KEY,
+    }));
     const accessRules = [ownerAccess];
     const translations = {};
     translations[`screen:${selectionScreenId}.title`] = PROVIDER_PANEL_TITLE_ENTRY;
-    Object.assign(translations, providerOptionTranslations(selectionScreen, plugins, hub));
+    Object.assign(translations, providerOptionTranslations(form.base, hub));
     for (const plugin of plugins) {
-        const visibleWhen = {
-            query: SELECTED_EXTENSIONS_QUERY,
-            field: plugin.extension,
-            eq: plugin.pluginId,
-        };
+        const providerFieldId = form.fieldIdOfConfigKey(plugin.selectorQn);
+        const visible = { field: providerFieldId, eq: plugin.pluginId };
+        let pluginSection;
         if (plugin.scopedKeys.length > 0) {
             const pluginAccess = rolesToAccess(plugin.scopedKeys.flatMap((v) => v.roles));
-            const ordered = sortByMaskOrder(plugin.scopedKeys.map((v) => v.key));
-            screens.push({
-                ...buildScreen(pluginTenantScreenId(plugin), "tenant", plugin.feature, ordered, pluginAccess, hub, { description: null }),
-                dormant: true,
-            });
+            const pluginScreen = buildScreen(`${plugin.feature}-tenant`, "tenant", plugin.feature, sortByMaskOrder(plugin.scopedKeys.map((v) => v.key)), pluginAccess, hub, { description: null, fieldIdOf: qualifiedFieldId });
+            pluginSection = form.addConfigFields(pluginScreen, visible);
             accessRules.push(pluginAccess);
-            configPanels.push({
-                kind: "screen",
-                id: `${plugin.feature}-config`,
-                screen: pluginTenantScreenId(plugin),
-                visibleWhen,
-                chromeless: true,
-            });
         }
         if (plugin.secrets.length > 0) {
-            const secretsScreenId = `${plugin.feature}-tenant-secrets`;
-            const generated = buildSecretsEditScreen(secretsScreenId, plugin.secrets, secretsAccess, hub.declaredTranslationKeys);
-            screens.push({ ...generated.screen, dormant: true });
+            const generated = buildSecretsEditScreen(`${plugin.feature}-tenant-secrets`, plugin.secrets, secretsAccess, hub.declaredTranslationKeys);
+            form.addSecretFields(generated.screen, plugin.feature, visible, pluginSection);
             Object.assign(translations, generated.translations);
             accessRules.push(secretsAccess);
-            secretsPanels.push({
-                kind: "screen",
-                id: `${plugin.feature}-secrets`,
-                screen: secretsScreenId,
-                visibleWhen,
-                chromeless: true,
-            });
         }
     }
     const access = unionAccessRules(accessRules);
+    const selectionScreen = { ...form.build(access), dormant: true };
     const dashboard = {
         id: `${ownerGroup}-tenant`,
         type: "dashboard",
@@ -282,16 +287,136 @@ function buildSelectorOwnerDashboard(ownerGroup, ownerKeys, ownerAccess, plugins
         panels: assertUniquePanelIds(ownerGroup, [
             { kind: "screen", id: "selection", screen: selectionScreenId, chromeless: true },
             ...ownerPanels,
-            ...configPanels,
-            ...secretsPanels,
         ]),
         access,
     };
-    return { screens: [dashboard, ...screens], access, translations };
+    return { screens: [dashboard, selectionScreen], access, translations };
+}
+// A plugin key keeps its feature in the field id: the provider form holds the keys of
+// several features side by side.
+function qualifiedFieldId(k) {
+    return `${k.ownerFeature}-${k.shortKey}`;
+}
+class ProviderFormBuilder {
+    screenId;
+    base;
+    configKeys;
+    secretKeys = {};
+    fields;
+    fieldLabels;
+    fieldDescriptions;
+    requiredFields;
+    sections;
+    constructor(screenId, base) {
+        this.screenId = screenId;
+        this.base = base;
+        this.configKeys = { ...base.configKeys };
+        this.fields = { ...base.fields };
+        this.fieldLabels = { ...base.fieldLabels };
+        this.fieldDescriptions = { ...base.fieldDescriptions };
+        this.requiredFields = [...(base.requiredFields ?? [])];
+        this.sections = base.layout.sections.filter(isFieldsEditSection);
+    }
+    fieldIdOfConfigKey(qn) {
+        const entry = Object.entries(this.base.configKeys).find(([, keyQn]) => keyQn === qn);
+        if (entry === undefined) {
+            throw new Error(`[Settings-Hub] selector key "${qn}" is not on "${this.screenId}".`);
+        }
+        return entry[0];
+    }
+    addConfigFields(pluginScreen, visible) {
+        for (const [id, qn] of Object.entries(pluginScreen.configKeys)) {
+            this.claim(id, qn);
+            this.configKeys[id] = qn;
+            const field = pluginScreen.fields[id];
+            if (field !== undefined)
+                this.fields[id] = field;
+        }
+        Object.assign(this.fieldLabels, pluginScreen.fieldLabels);
+        Object.assign(this.fieldDescriptions, pluginScreen.fieldDescriptions);
+        this.requiredFields.push(...(pluginScreen.requiredFields ?? []));
+        const section = pluginScreen.layout.sections.find(isFieldsEditSection);
+        if (section === undefined)
+            return undefined;
+        const { groups: _groups, ...flatSection } = section;
+        const gated = {
+            ...flatSection,
+            fields: gateFields(sectionFieldSpecs(section), visible),
+        };
+        this.sections.push(gated);
+        return gated;
+    }
+    // A plugin's sign-in data gets its own section when the plugin names one, else it
+    // continues the plugin's settings section.
+    addSecretFields(secretsScreen, feature, visible, pluginSection) {
+        for (const [id, qn] of Object.entries(secretsScreen.secretKeys)) {
+            this.claim(id, qn);
+            this.secretKeys[id] = qn;
+            this.fields[id] = createTextField({
+                personal: false,
+                reason: "system_metadata",
+                writeOnly: true,
+            });
+        }
+        Object.assign(this.fieldLabels, secretsScreen.fieldLabels);
+        Object.assign(this.fieldDescriptions, secretsScreen.fieldHints);
+        this.requiredFields.push(...(secretsScreen.requiredFields ?? []));
+        const secretsTitleKey = `${feature}.settings.secrets`;
+        for (const section of secretsScreen.sections) {
+            // kumiko-lint-ignore section-fields-raw a secretsEdit section is a flat key list without groups
+            const fields = gateFields(section.fields, visible);
+            const ownSection = section.title === secretsTitleKey || pluginSection === undefined;
+            if (ownSection) {
+                this.sections.push({
+                    title: section.title ?? `${feature}.settings`,
+                    description: SECRETS_SECTION_DESCRIPTION_KEY,
+                    fields,
+                });
+                continue;
+            }
+            const index = this.sections.indexOf(pluginSection);
+            this.sections[index] = {
+                ...pluginSection,
+                fields: [...sectionFieldSpecs(pluginSection), ...fields],
+            };
+        }
+    }
+    build(access) {
+        const { fieldDescriptions: _baseDescriptions, requiredFields: _baseRequired, ...base } = this.base;
+        return {
+            ...base,
+            configKeys: this.configKeys,
+            ...(Object.keys(this.secretKeys).length > 0 && { secretKeys: this.secretKeys }),
+            fields: this.fields,
+            fieldLabels: this.fieldLabels,
+            ...(Object.keys(this.fieldDescriptions).length > 0 && {
+                fieldDescriptions: this.fieldDescriptions,
+            }),
+            ...(this.requiredFields.length > 0 && { requiredFields: this.requiredFields }),
+            layout: { ...base.layout, sections: this.sections },
+            access,
+        };
+    }
+    claim(id, qn) {
+        const previous = this.configKeys[id] ?? this.secretKeys[id];
+        if (previous !== undefined) {
+            throw new Error(`[Settings-Hub] "${previous}" and "${qn}" both resolve to field id "${id}" on "${this.screenId}" — rename one key.`);
+        }
+    }
+}
+function gateFields(fields, visible) {
+    return fields.map((spec) => typeof spec === "string" ? { field: spec, visible } : { ...spec, visible });
 }
 // Everything generated for one audience scope: the audience-parent nav, the
 // per-feature configEdit screens+navs, and (tenant-scope only, when secrets
 // are enabled) the secrets screen. Null when nothing is visible at this scope.
+// The secrets set handler also admits the machine role for server-side writes; like the
+// config keys' write roles, that role must not reach a screen or nav access gate.
+function withoutMachineRole(rule) {
+    if (rule === undefined || !("roles" in rule))
+        return rule;
+    return { ...rule, roles: rule.roles.filter((role) => role !== MACHINE_WRITE_ROLE) };
+}
 function buildScopeResult(scope, masked, secretsEnabled, secretsWriteHandler, declaredSecrets, hub, registry) {
     const visible = scopedKeysAt(masked, scope);
     // Secrets attach to the tenant-audience nav regardless of whether any
@@ -300,7 +425,7 @@ function buildScopeResult(scope, masked, secretsEnabled, secretsWriteHandler, de
     if (visible.length === 0 && !includeSecrets)
         return null;
     const configAccess = rolesToAccess(visible.flatMap((v) => v.roles));
-    const secretsAccess = secretsWriteHandler?.access;
+    const secretsAccess = withoutMachineRole(secretsWriteHandler?.access);
     const gating = scope === "tenant"
         ? planSelectorGating(registry, visible, declaredSecrets, secretsEnabled)
         : NO_SELECTOR_GATING;
@@ -346,6 +471,7 @@ export function buildConfigFeatureSchema(registry) {
     const hub = {
         declaredTranslationKeys: new Set(translationsByKey.keys()),
         selectorOptions: collectSelectorOptions(registry),
+        selectorOptionFeatures: collectSelectorOptionFeatures(registry),
         translationsByKey,
     };
     const screens = [];
@@ -440,7 +566,12 @@ function buildSecretsEditScreen(screenId, secrets, access, declaredTranslationKe
             if (s.def.writeRoles !== undefined)
                 fieldAccess[fieldId] = { roles: [...s.def.writeRoles] };
         }
-        const titleKey = `${feature}.settings`;
+        // Opt-in `${feature}.settings.secrets`: in a selector dashboard this section sits right
+        // under the plugin's own settings section, which already carries `${feature}.settings`.
+        const secretsTitleKey = `${feature}.settings.secrets`;
+        const titleKey = declaredTranslationKeys.has(secretsTitleKey)
+            ? secretsTitleKey
+            : `${feature}.settings`;
         sections.push({
             ...(declaredTranslationKeys.has(titleKey) && { title: titleKey }),
             fields: fieldIds,
@@ -514,7 +645,8 @@ function buildScreen(shortId, scope, feature, keys, access, hub, options = {}) {
     // feature's group (100% of today's apps — byte-identical output). Only a
     // cross-feature `group` (feature !== ownerFeature) needs the owner prefix,
     // to keep two features sharing a group from clobbering the same shortKey.
-    const fieldId = (k) => k.feature === k.ownerFeature ? k.shortKey : `${k.ownerFeature}-${k.shortKey}`;
+    const fieldId = options.fieldIdOf ??
+        ((k) => (k.feature === k.ownerFeature ? k.shortKey : qualifiedFieldId(k)));
     const seenFieldIds = new Map();
     for (const k of keys) {
         const id = fieldId(k);
@@ -544,7 +676,6 @@ function buildScreen(shortId, scope, feature, keys, access, hub, options = {}) {
         ...(Object.keys(fieldDescriptions).length > 0 && { fieldDescriptions }),
         ...(requiredFields.length > 0 && { requiredFields }),
         ...(screenDescription !== undefined && { description: screenDescription }),
-        ...(options.submitLabel !== undefined && { submitLabel: options.submitLabel }),
         layout: { sections: [section], width: "full", variant: "settings-list" },
         access,
     };
@@ -589,16 +720,17 @@ function buildSettingsSection(feature, scope, fieldIds, hub, options) {
 }
 // Option labels of the provider select: each plugin feature's `<feature>.settings`
 // copy, under the option-label key the configEdit renderer already derives.
-function providerOptionTranslations(selectionScreen, plugins, hub) {
+function providerOptionTranslations(selectionScreen, hub) {
     const out = {};
     for (const [fieldId, qn] of Object.entries(selectionScreen.configKeys)) {
-        if (!hub.selectorOptions.has(qn))
+        const featureByPluginId = hub.selectorOptionFeatures.get(qn);
+        if (featureByPluginId === undefined)
             continue;
-        for (const plugin of plugins) {
-            const label = hub.translationsByKey.get(`${plugin.feature}.settings`);
+        for (const [pluginId, feature] of featureByPluginId) {
+            const label = hub.translationsByKey.get(`${feature}.settings`);
             if (label === undefined)
                 continue;
-            const key = `${fieldLabelKey(SETTINGS_HUB_FEATURE, CONFIG_EDIT_ENTITY, fieldId)}:option:${plugin.pluginId}`;
+            const key = `${fieldLabelKey(SETTINGS_HUB_FEATURE, CONFIG_EDIT_ENTITY, fieldId)}:option:${pluginId}`;
             out[key] = label;
         }
     }

package/dist/engine/build-target.d.ts

@@ -1,5 +1,5 @@
-import type { TargetRef } from "./types/target-ref.js";
-import type { TreeActionDef } from "./types/tree-node.js";
+import type { TargetRef } from "./types/target-ref.ts";
+import type { TreeActionDef } from "./types/tree-node.ts";
 type FeatureWithTreeActions<TActions extends Record<string, TreeActionDef>> = {
     readonly id: string;
     readonly treeActions: TActions;

package/dist/engine/changeset-changes.d.ts

@@ -1,4 +1,4 @@
-import { type ChangelogType } from "./feature-changelog.js";
+import { type ChangelogType } from "./feature-changelog.ts";
 export type PendingChange = {
     readonly feature: string;
     readonly type: ChangelogType;

package/dist/engine/codemod/index.d.ts

@@ -1,2 +1,2 @@
-export type { CodemodOptions, CodemodReport, CodemodResult, FileAnalysis, ParsedHandlerInfo, } from "./pipeline-codemod.js";
-export { analyzeFile, analyzeHandlerArrow, convertFile, generatePerformBlock, runCodemod, scanForCandidates, } from "./pipeline-codemod.js";
+export type { CodemodOptions, CodemodReport, CodemodResult, FileAnalysis, ParsedHandlerInfo, } from "./pipeline-codemod.ts";
+export { analyzeFile, analyzeHandlerArrow, convertFile, generatePerformBlock, runCodemod, scanForCandidates, } from "./pipeline-codemod.ts";

package/dist/engine/config-helpers.d.ts

@@ -1,4 +1,4 @@
-import type { ConfigBacking, ConfigBounds, ConfigComputedFn, ConfigKeyDefinition, ConfigKeyType, ConfigMask, ConfigSeedDef, ConfigValidateFn, ConfigValue, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, OptionsQueryPayload } from "./types/index.js";
+import type { ConfigBacking, ConfigBounds, ConfigComputedFn, ConfigKeyDefinition, ConfigKeyType, ConfigMask, ConfigSeedDef, ConfigValidateFn, ConfigValue, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, OptionsQueryPayload } from "./types/index.ts";
 export declare function isEncryptedAtRest(def: Pick<ConfigKeyDefinition, "encrypted" | "backing">): boolean;
 export declare const access: {
     readonly all: readonly string[];

package/dist/engine/constants.d.ts

@@ -1,7 +1,7 @@
 import type { ConcurrencyMode } from "@cosmicdrift/kumiko-types/concurrency-mode";
 import type { ConfigScope } from "@cosmicdrift/kumiko-types/config-scope";
 import type { OnDeleteStrategy as OnDeleteStrategyType } from "@cosmicdrift/kumiko-types/relations";
-import type { TenantId } from "./types/identifiers.js";
+import type { TenantId } from "./types/identifiers.ts";
 export declare const SystemHookNames: {
     readonly cascadeDelete: "system:hook:cascade-delete";
 };

package/dist/engine/create-app.d.ts

@@ -1,5 +1,5 @@
-import { type ValidateBootOptions } from "./boot-validator.js";
-import type { FeatureDefinition, Registry } from "./types/index.js";
+import { type ValidateBootOptions } from "./boot-validator.ts";
+import type { FeatureDefinition, Registry } from "./types/index.ts";
 export type AppConfig = {
     roles: readonly string[];
     features: readonly FeatureDefinition[];

package/dist/engine/cross-tenant.d.ts

@@ -1,4 +1,4 @@
-import { AccessDeniedError } from "../errors/index.js";
-import type { SessionUser } from "./types/index.js";
+import { AccessDeniedError } from "../errors/index.ts";
+import type { SessionUser } from "./types/index.ts";
 export declare function mayOverrideTenant(user: SessionUser): boolean;
 export declare function tenantOverrideDenied(user: SessionUser, parsedPayload: unknown): AccessDeniedError | undefined;

package/dist/engine/dedupe-features.d.ts

@@ -1,2 +1,2 @@
-import type { FeatureDefinition } from "./types/index.js";
+import type { FeatureDefinition } from "./types/index.ts";
 export declare function dedupeFeatures(features: readonly FeatureDefinition[]): FeatureDefinition[];

package/dist/engine/define-feature.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureDefinition, FeatureRegistrar } from "./types/index.js";
+import type { FeatureDefinition, FeatureRegistrar } from "./types/index.ts";
 export type DefineFeatureSettings = {
     readonly dedupeOptions?: Readonly<Record<string, unknown>>;
 };

package/dist/engine/define-feature.js

@@ -2,7 +2,7 @@ import { createInitialFeatureBuilderState } from "./feature-builder-state.js";
 import { buildConfigEventsJobsMethods } from "./feature-config-events-jobs.js";
 import { buildEntityHandlerMethods } from "./feature-entity-handlers.js";
 import { buildUiExtensionsMethods } from "./feature-ui-extensions.js";
-import { isObjectArgument, throwPositionalFormRemoved, unwrapArrayForm } from "./object-form.js";
+import { isObjectArgument, throwObjectArgumentRequired, unwrapArrayForm } from "./object-form.js";
 // `TExports` lets the setup callback hand back a typed object that
 // downstream features can import (e.g. `tenantFeature.exports.config`). The
 // runtime always packs whatever setup returns into `featureDef.exports` —
@@ -49,7 +49,7 @@ export function defineFeature(name, setup, settings) {
         requires: (() => {
             const fn = (...args) => {
                 if (!args.every(isObjectArgument))
-                    throwPositionalFormRemoved(name, "requires");
+                    throwObjectArgumentRequired(name, "requires");
                 state.requires.push(...resolveFeatureNamesArgs(args));
             };
             fn.projection = (tableName) => {

package/dist/engine/define-handler.d.ts

@@ -1,9 +1,9 @@
 import type { CursorResult } from "@cosmicdrift/kumiko-types/cursor-types";
 import type { ZodType } from "zod";
-import type { ContainsSecret } from "../secrets/types.js";
-import type { QueryHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput } from "./types/define-handler.js";
-import type { KumikoEventTypeMap } from "./types/index.js";
-export type { QueryHandlerDefinition, StreamHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput, } from "./types/define-handler.js";
+import type { ContainsSecret } from "../secrets/types.ts";
+import type { QueryHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput } from "./types/define-handler.ts";
+import type { KumikoEventTypeMap } from "./types/index.ts";
+export type { QueryHandlerDefinition, StreamHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput, } from "./types/define-handler.ts";
 export declare function defineWriteHandler<const TName extends string, TSchema extends ZodType, TData = unknown, TMap extends object = KumikoEventTypeMap, TPrepared = undefined>(def: WriteHandlerInput<TName, TSchema, TData, TMap, TPrepared>, ..._noSecretInResponse: true extends ContainsSecret<TData> ? [
     secretLeak: "A handler response must not contain a Secret<> — call .reveal() and return the plaintext, or drop the field."
 ] : []): WriteHandlerDefinition<TName, TSchema, TData, TMap, TPrepared>;

package/dist/engine/define-step.d.ts

@@ -1,4 +1,4 @@
-import type { StepDef, StepKind } from "./types/step.js";
+import type { StepDef, StepKind } from "./types/step.ts";
 export declare function defineStep<TArgs, TResult>(def: StepDef<TArgs, TResult>): StepDef<TArgs, TResult>;
 export declare function getStep(kind: StepKind): StepDef | undefined;
 export declare function listStepKinds(): readonly StepKind[];

package/dist/engine/define-workflow.d.ts

@@ -1,5 +1,5 @@
-import type { WriteEvent } from "./types/handlers.js";
-import type { AwaitedEventType, PipelineDef } from "./types/step.js";
+import type { WriteEvent } from "./types/handlers.ts";
+import type { AwaitedEventType, PipelineDef } from "./types/step.ts";
 /**
  * Trigger configuration for a workflow. Determines what starts a run.
  */

package/dist/engine/effective-features.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureDefinition, Registry } from "./types/index.js";
+import type { FeatureDefinition, Registry } from "./types/index.ts";
 export type ToggleReader = (featureName: string) => boolean | undefined;
 export declare function isToggleableFeature(feature: FeatureDefinition): feature is FeatureDefinition & {
     toggleableDefault: boolean;

package/dist/engine/embedded-derived.d.ts

@@ -1,4 +1,4 @@
-import type { EmbeddedDerivedCellDef, EmbeddedSubFieldDef } from "./types/index.js";
+import type { EmbeddedDerivedCellDef, EmbeddedSubFieldDef } from "./types/index.ts";
 /** Computes a derived cell from its source values. Missing/non-numeric
  *  sources: "multiply" with any missing source → undefined; "sum"/"subtract"
  *  treat missing as 0 only when at least one source is present — if every

package/dist/engine/entity-handlers.d.ts

@@ -1,9 +1,10 @@
 import * as z from "zod";
-import { type EventStoreExecutor } from "../db/event-store-executor.js";
-import { type EntityTable } from "../db/table-builder.js";
-import type { EntityCrudRegistrar, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions } from "./types/entity-handlers.js";
-import type { AccessRule, EntityDefinition, EscapeHatchDeclaration, QueryHandlerDef, WriteHandlerDef } from "./types/index.js";
-export type { EntityCrudHandlerDefaults, EntityCrudRegistrar, EntityCrudVerb, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions, } from "./types/entity-handlers.js";
+import { type EventStoreExecutor } from "../db/event-store-executor.ts";
+import { type EntityTable } from "../db/table-builder.ts";
+import type { EntityCrudRegistrar, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions } from "./types/entity-handlers.ts";
+import type { AccessRule, EntityDefinition, EscapeHatchDeclaration, QueryHandlerDef, WriteHandlerDef } from "./types/index.ts";
+export type { EntityCrudHandlerDefaults, EntityCrudRegistrar, EntityCrudVerb, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions, } from "./types/entity-handlers.ts";
+export declare function assertEscapeHatchAccessIsSystemAdminOnly(name: string, kind: "write" | "query", access: AccessRule): void;
 export declare const MAX_LIST_LIMIT = 200;
 export declare const entityListSchema: z.ZodObject<{
     cursor: z.ZodOptional<z.ZodString>;

package/dist/engine/entity-handlers.js

@@ -66,11 +66,14 @@ function resolveCrossTenantReason(name, options, kind) {
     const placeholderProblem = codemodPlaceholderReasonProblem(options.escapeHatch.reason);
     if (placeholderProblem !== undefined)
         throw new Error(`"${name}": ${placeholderProblem}`);
-    if (!isSystemAdminOnly(options.access)) {
-        throw new Error(`"${name}": a ${kind} handler with escapeHatch reaches across every tenant, so its access must be SystemAdmin-only ({ roles: ["${SYSTEM_ADMIN_ROLE}"] }); got ${JSON.stringify(options.access)}.`);
-    }
+    assertEscapeHatchAccessIsSystemAdminOnly(name, kind, options.access);
     return options.escapeHatch.reason;
 }
+export function assertEscapeHatchAccessIsSystemAdminOnly(name, kind, access) {
+    if (!isSystemAdminOnly(access)) {
+        throw new Error(`"${name}": a ${kind} handler with escapeHatch reaches across every tenant, so its access must be SystemAdmin-only ({ roles: ["${SYSTEM_ADMIN_ROLE}"] }); got ${JSON.stringify(access)}.`);
+    }
+}
 // Upper bound on entity-list `limit`: unbounded/fractional values ran
 // straight into the raw `LIMIT ${limit}` SQL string (event-store-executor-
 // read.ts), letting a client demand a full-table materialisation or trip a

package/dist/engine/event-def.d.ts

@@ -0,0 +1,15 @@
+import { type ZodType } from "zod";
+import type { EventDef, EventPiiStance, QualifiedEventName } from "./types/index.ts";
+export type CreateEventDefOptions<TFeature extends string, TInner extends string, TPayload> = {
+    readonly feature: TFeature;
+    readonly name: TInner;
+    readonly schema: ZodType<TPayload>;
+    readonly version?: number;
+    readonly piiFields: EventPiiStance;
+};
+/**
+ * The EventDef that `r.defineEvent` returns, built outside a feature's setup
+ * callback, so a module can hand the definition to `emitEvent` without the
+ * feature instance. Registration still goes through `r.defineEvent`.
+ */
+export declare function createEventDef<const TFeature extends string, const TInner extends string, TPayload>(options: CreateEventDefOptions<TFeature, TInner, TPayload>): EventDef<TPayload, QualifiedEventName<TFeature, TInner>>;