@cosmicdrift/kumiko-headless 0.105.2 → 0.109.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-headless",
-  "version": "0.105.2",
+  "version": "0.109.0",
   "description": "Headless UI logic for Kumiko — Dispatcher contract, Form-Controller, View-Model, Nav-Resolver. Plattform- und React-frei; jeder Renderer (renderer, renderer-web, renderer-native, …) komponiert darauf.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -32,7 +32,7 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.105.2",
+    "@cosmicdrift/kumiko-framework": "0.109.0",
     "zod": "^4.4.3"
   },
   "publishConfig": {

package/src/apex/index.ts

@@ -24,16 +24,27 @@ export type ApexBrand = {
 export type ApexCtaVariant = "primary" | "secondary" | "link";
 export type ApexCta = {
   readonly label: string;
+  /** App-authored only, no user input — escapeHtml encodes entities but does
+   *  NOT sanitize the URL scheme (a `javascript:`/`data:` URI survives it
+   *  unchanged). Trust boundary is the deploy-time apex config, not runtime. */
   readonly href: string;
   /** "link" renders a plain anchor (no .btn). Default "primary". */
   readonly variant?: ApexCtaVariant;
 };
 
-export type ApexLink = { readonly label: string; readonly href: string };
+// `kind` is optional here (footer links / ApexNavMenu.footer don't need it) —
+// it exists so ApexNavEntry (ApexLink | ApexNavMenu) is a real discriminated
+// union: TS narrows on `entry.kind === "menu"` without a structural
+// `"items" in entry` check or an `as` cast.
+export type ApexLink = { readonly kind?: "link"; readonly label: string; readonly href: string };
 
 /** One entry inside a dropdown nav menu: icon + title + optional description. */
 export type ApexNavMenuItem = {
-  /** Inner SVG markup (paths), wrapped by the standard 24px icon <svg>. Trusted. */
+  /** Inner SVG markup (paths), wrapped by the standard 24px icon <svg>.
+   *  ponytail: rendered verbatim, no sanitizer — trusted because it's
+   *  app-authored at deploy time, same trust boundary as ApexCta.href. If an
+   *  app ever sources this from tenant/user content, sanitize at that
+   *  construction boundary before it reaches here. */
   readonly icon?: string;
   readonly title: string;
   readonly desc?: string;
@@ -88,7 +99,11 @@ export type ApexHeroSection = {
 };
 
 export type ApexFeature = {
-  /** Inner SVG markup (paths), wrapped by the standard 24px icon <svg>. Trusted. */
+  /** Inner SVG markup (paths), wrapped by the standard 24px icon <svg>.
+   *  ponytail: rendered verbatim, no sanitizer — trusted because it's
+   *  app-authored at deploy time, same trust boundary as ApexCta.href. If an
+   *  app ever sources this from tenant/user content, sanitize at that
+   *  construction boundary before it reaches here. */
   readonly icon?: string;
   readonly title: string;
   readonly desc: string;
@@ -373,7 +388,7 @@ function renderNavMenu(m: ApexNavMenu): string {
 }
 
 function renderNavEntry(entry: ApexNavEntry): string {
-  return "items" in entry
+  return entry.kind === "menu"
     ? renderNavMenu(entry)
     : `<a href="${escapeHtml(entry.href)}">${escapeHtml(entry.label)}</a>`;
 }

package/src/view-model/__tests__/list.test.ts

@@ -140,6 +140,21 @@ describe("computeListViewModel", () => {
     });
   });
 
+  test("labeled column with no matching field AND no renderer → throws (label alone isn't enough)", () => {
+    // Regression (697/1): renderer is what actually draws a virtual column —
+    // a label with no renderer would otherwise push an empty, unrendered
+    // column into the view model instead of catching the author typo.
+    expect(() =>
+      computeListViewModel({
+        screen: listScreen(["title", { field: "tags", label: "Tags" }]),
+        entity: taskEntity,
+        rows: [],
+        translate,
+        featureName: "tasks",
+      }),
+    ).toThrow(/unknown field "tags"/);
+  });
+
   test("label overrides the field-convention header on a real field", () => {
     const vm = computeListViewModel({
       screen: listScreen([{ field: "title", label: "custom.header" }]),

package/src/view-model/list.ts

@@ -42,19 +42,20 @@ export function computeListViewModel(input: ComputeListViewModelInput): ListView
       // columns carry no reference/select metadata and never server-sort.
       const derivedDef = entity.derivedFields?.[normalized.field];
       if (!derivedDef) {
-        // A labeled column with no matching stored/derived field is a *virtual*
-        // presentational column — drawn entirely by a columnRenderer component
-        // from the row (e.g. tag chips); value is undefined and it never
-        // server-sorts. `field` is just the column key. Without a label it's an
-        // author typo (or a stale field-rename) → fail loud so the renderer
-        // doesn't silently draw an empty column.
-        if (normalized.label !== undefined) {
+        // A virtual presentational column — drawn entirely by a columnRenderer
+        // component from the row (e.g. tag chips); value is undefined and it
+        // never server-sorts. `field` is just the column key. It needs BOTH a
+        // label AND a renderer — renderer is what actually draws it; a label
+        // alone with no renderer would push an empty, unrendered column into
+        // the view model. Missing either is an author typo (or a stale
+        // field-rename) → fail loud instead of silently drawing nothing.
+        if (normalized.label !== undefined && normalized.renderer !== undefined) {
           columns.push({
             field: normalized.field,
             label: translate(normalized.label),
             type: "text",
             sortable: false,
-            ...(normalized.renderer !== undefined && { renderer: normalized.renderer }),
+            renderer: normalized.renderer,
           });
           continue;
         }