@cosmicdrift/kumiko-samples 0.338.0

package/packages/bundled-features/src/template-resolver/web/client-plugin.tsx

@@ -0,0 +1,516 @@
+// @runtime client
+// Client feature factory for the text-block content tree. Apps mount it via
+// createKumikoApp({ clientFeatures: [textBlocksClient()] }); it loads the
+// blocks from the by-tenant query, groups them by their `folder` field and
+// emits them as TreeNode[], plus the editor behind the edit action.
+//
+// **Folder grouping**: block.folder !== null puts the node under a container
+// node labelled with the folder; folder === null keeps it at the root.
+//
+// **State**: TreeNode.state = "filled" when content is set, otherwise "stub"
+// (a hint that the slug exists but is empty).
+
+import { useShellUser } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web";
+import { CSRF_HEADER_NAME, readCsrfToken } from "@cosmicdrift/kumiko-dispatcher-live";
+import type {
+  TargetRef,
+  TreeChildrenSubscribe,
+  TreeNode,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  ContentPreview,
+  type FeatureSchema,
+  useAppFeatures,
+  useContentEditor,
+  useDispatcher,
+  usePrimitives,
+  useQuery,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
+import {
+  type ClientFeatureDefinition,
+  PlainContentEditor,
+  RichContentEditor,
+} from "@cosmicdrift/kumiko-renderer-web";
+import type { ContentEditorFormat } from "@cosmicdrift/kumiko-types/nav";
+import { type FormEvent, type ReactNode, useEffect, useId, useState } from "react";
+import {
+  collectionHandlerName,
+  collectionQueryName,
+  TemplateResolverHandlers,
+  TemplateResolverQueries,
+} from "../qualified-names.js";
+import { defaultTranslations } from "./i18n.js";
+
+// Exported for the unit test — groupBlocksByFolder is a pure function.
+export type BlockSummary = {
+  readonly slug: string;
+  readonly locale: string;
+  readonly title: string | null;
+  readonly content: string | null;
+  readonly folder: string | null;
+  readonly modifiedAt: string | null;
+};
+
+type ByTenantResponse = {
+  readonly data: { readonly blocks: readonly BlockSummary[] };
+};
+
+// Multi-level folder splitting: `folder` is a `/`-separated path, the tree
+// splits per segment and creates nested folder nodes:
+//   block.folder = null              → root leaf
+//   block.folder = "page"            → folder page > leaf
+//   block.folder = "page/marketing"  → folder page > folder marketing > leaf
+//
+// **Folder/leaf collision**: a block with `folder=null, slug="page"` and
+// another with `folder="page"` both live on the same level — the folder with
+// children plus a clickable leaf. Visually distinct (chevron + folder icon),
+// no crash, no surprise.
+
+type FolderNode = {
+  readonly leaves: TreeNode[];
+  readonly subFolders: Map<string, FolderNode>;
+};
+
+function newFolderNode(): FolderNode {
+  return { leaves: [], subFolders: new Map() };
+}
+
+function attachBlock(
+  root: FolderNode,
+  block: BlockSummary,
+  tenantIdOverride?: string,
+  collectionId?: string,
+): void {
+  const leaf: TreeNode = {
+    label: block.title || block.slug,
+    icon: "file",
+    target: {
+      featureId: "template-resolver",
+      action: "edit",
+      // tenantIdOverride and collectionId travel with the node → the editor
+      // reads and writes through the same tenant and the same collection the
+      // tree was loaded from. Omitted → session tenant, public text-blocks.
+      args: {
+        slug: block.slug,
+        locale: block.locale,
+        ...(tenantIdOverride !== undefined && { tenantIdOverride }),
+        ...(collectionId !== undefined && { collectionId }),
+      },
+    },
+    state: block.content ? "filled" : "stub",
+  };
+  if (block.folder === null) {
+    root.leaves.push(leaf);
+    return;
+  }
+  let cur = root;
+  for (const segment of block.folder.split("/")) {
+    let next = cur.subFolders.get(segment);
+    if (next === undefined) {
+      next = newFolderNode();
+      cur.subFolders.set(segment, next);
+    }
+    cur = next;
+  }
+  cur.leaves.push(leaf);
+}
+
+function renderFolderNode(node: FolderNode): TreeNode[] {
+  // Leaves first (root items), then folders alphabetically.
+  const result: TreeNode[] = [...node.leaves];
+  for (const folderName of [...node.subFolders.keys()].sort()) {
+    const subNode = node.subFolders.get(folderName);
+    if (subNode === undefined) continue;
+    result.push({
+      label: folderName,
+      icon: "folder",
+      state: "filled",
+      children: renderFolderNode(subNode),
+    });
+  }
+  return result;
+}
+
+export function groupBlocksByFolder(
+  blocks: readonly BlockSummary[],
+  tenantIdOverride?: string,
+  collectionId?: string,
+): readonly TreeNode[] {
+  const root = newFolderNode();
+  for (const block of blocks) {
+    attachBlock(root, block, tenantIdOverride, collectionId);
+  }
+  const rendered = renderFolderNode(root);
+  if (rendered.length === 0) return [];
+  return [
+    {
+      label: "Content",
+      icon: "folder",
+      state: "filled",
+      children: rendered,
+    },
+  ];
+}
+
+// tenantIdOverride (SystemAdmin-only) lets an app point the content tree at a
+// tenant other than the session's — publicstatus seeds marketing/legal blocks
+// on SYSTEM_TENANT_ID, so its SystemAdmin must read that tenant, not their own.
+// Without a collection id: the anonymous-capable by-tenant query, so a public
+// page keeps its content sidebar without a session. With one: that
+// collection's own list handler, which carries the collection's access rule.
+function makeTreeProvider(tenantIdOverride?: string, collectionId?: string): TreeChildrenSubscribe {
+  const queryType =
+    collectionId === undefined
+      ? TemplateResolverQueries.byTenant
+      : collectionQueryName(collectionId, "list");
+  return () => (emit, emitError) => {
+    // CSRF header is mandatory on authenticated requests (auth-middleware
+    // double-submit pattern). Anonymous/pre-login has no token → header
+    // omitted → the server takes the anonymous path.
+    const headers: Record<string, string> = { "content-type": "application/json" };
+    const csrf = readCsrfToken();
+    if (csrf !== undefined) headers[CSRF_HEADER_NAME] = csrf;
+    // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+    fetch("/api/query", {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        type: queryType,
+        payload: tenantIdOverride !== undefined ? { tenantIdOverride } : {},
+      }),
+    })
+      .then(async (r) => {
+        if (!r.ok) {
+          // 403 (CSRF/auth) or 5xx — explicit error instead of silent empty.
+          const text = await r.text().catch(() => r.statusText);
+          throw new Error(`text-block load failed: ${r.status} ${text}`);
+        }
+        return r.json();
+      })
+      .then((data: ByTenantResponse) => {
+        // The app-side r.nav node IS the "Content" container → the provider's
+        // children are the folders/leaves below it, not the wrapper.
+        const content = groupBlocksByFolder(data.data.blocks, tenantIdOverride, collectionId)[0];
+        emit(content !== undefined && Array.isArray(content.children) ? content.children : []);
+      })
+      .catch((e) => {
+        // Explicit error signal via emitError; ProviderBranch shows a banner
+        // plus retry. Falls back to emit([]) for consumers without emitError.
+        if (emitError) {
+          emitError(e instanceof Error ? e : new Error(String(e)));
+        } else {
+          emit([]);
+        }
+      });
+    return () => {};
+  };
+}
+
+type ContentCollectionSchema = NonNullable<FeatureSchema["contentCollections"]>[number];
+
+// A node without a collectionId (the hand-wired text-block tree) has no
+// collection to look up — contentFormat/variableSchema then fall back to
+// their own callers' defaults.
+function findCollection(
+  features: readonly FeatureSchema[],
+  collectionId?: string,
+): ContentCollectionSchema | undefined {
+  if (collectionId === undefined) return undefined;
+  for (const feature of features) {
+    const match = feature.contentCollections?.find((c) => c.id === collectionId);
+    if (match !== undefined) return match;
+  }
+  return undefined;
+}
+
+function findContentFormat(
+  features: readonly FeatureSchema[],
+  collectionId?: string,
+): ContentEditorFormat | undefined {
+  return findCollection(features, collectionId)?.contentFormat;
+}
+
+// The collection's fixed variable names (ContentCollectionDefinition.
+// variableSchema) — the chip bar's data source and, keyed, the example
+// values the Preview substitutes in for `{{name}}`.
+function findVariableExamples(
+  features: readonly FeatureSchema[],
+  collectionId?: string,
+): Readonly<Record<string, string>> {
+  return findCollection(features, collectionId)?.variableSchema ?? {};
+}
+
+// Edit form: loads the current values via by-slug, lets TenantAdmin and
+// SystemAdmin edit title + content, dispatches set on submit. Other users see
+// the form read-only with a hint banner — write permission stays opinionated
+// TenantAdmin-only, apps widen it via dual-role mapping if they want to.
+
+type TextBlock = {
+  readonly slug: string;
+  readonly locale: string;
+  readonly title: string | null;
+  readonly content: string | null;
+  readonly contentFormat: string;
+  readonly folder: string | null;
+  readonly modifiedAt: string | null;
+};
+
+// The collection's declared contentFormat ("plain" | "rich" | "markdown",
+// see ContentCollectionDefinition.contentFormat) uses a different vocabulary
+// than the stored entry's contentFormat ("plain" | "html" | "markdown" |
+// "mjml", see CONTENT_FORMATS) — "rich" always stores HTML. Without this,
+// handleSave omitting contentFormat let the write schema's
+// contentFormatSchema.default("markdown") silently stamp every save as
+// markdown, clobbering e.g. a "plain" entry. Undefined (no collection, or
+// the collection didn't declare a format) keeps whatever was already saved
+// instead of guessing.
+function resolveWriteContentFormat(
+  collectionContentFormat: string | undefined,
+  loadedContentFormat: string | undefined,
+): string | undefined {
+  if (collectionContentFormat === "plain") return "plain";
+  if (collectionContentFormat === "rich") return "html";
+  if (collectionContentFormat === "markdown") return "markdown";
+  return loadedContentFormat;
+}
+
+type SetResponse = { readonly slug: string; readonly locale: string; readonly isNew: boolean };
+
+function TextBlockEditor({
+  target,
+}: {
+  readonly target: TargetRef;
+  // onClose stays part of the resolver contract (the visual panel passes it)
+  // but is unused: tree selection navigates, there is no close button.
+  readonly onClose: () => void;
+}): ReactNode {
+  // @cast-boundary visual-tree-args — TargetRef.args is erased to
+  // Record<string, unknown>; the resolver knows the action shape (see the
+  // treeActions.edit definition in feature.ts) and de-erases per action, the
+  // same way event payloads do. Optional chaining absorbs missing fields so a
+  // hand-edited URL cannot crash the editor.
+  const args = target.args as
+    | { slug?: string; locale?: string; collectionId?: string; tenantIdOverride?: string }
+    | undefined;
+  const slug = args?.slug ?? "";
+  const locale = args?.locale ?? "";
+  const tenantIdOverride = args?.tenantIdOverride;
+  // Which collection the node came from. Absent → the public text-block pair,
+  // which is what the hand-wired content tree uses.
+  const collectionId = args?.collectionId;
+
+  const { Form, Field, Input, Button, Banner } = usePrimitives();
+  const dispatcher = useDispatcher();
+  const user = useShellUser();
+  const t = useTranslation();
+  const contentEditorId = useId();
+  const features = useAppFeatures();
+  const contentFormat = findContentFormat(features, collectionId);
+  const variableExamples = findVariableExamples(features, collectionId);
+  const variables = Object.keys(variableExamples);
+  const ContentEditor = useContentEditor(contentFormat);
+  const canWrite =
+    user?.roles.includes("TenantAdmin") === true || user?.roles.includes("SystemAdmin") === true;
+
+  // Same split as the tree provider: a node without a collection reads through
+  // the public by-slug, a collection node through that collection's handlers.
+  const readQuery =
+    collectionId === undefined
+      ? TemplateResolverQueries.bySlug
+      : collectionQueryName(collectionId, "item");
+  const writeHandler =
+    collectionId === undefined ? TemplateResolverHandlers.set : collectionHandlerName(collectionId);
+  const {
+    data: loaded,
+    loading,
+    error: loadError,
+  } = useQuery<TextBlock | null>(
+    readQuery,
+    { slug, locale, ...(tenantIdOverride !== undefined && { tenantIdOverride }) },
+    { enabled: slug !== "" && locale !== "" },
+  );
+
+  const [title, setTitle] = useState("");
+  const [content, setContent] = useState("");
+  const [previewing, setPreviewing] = useState(false);
+  const [submitting, setSubmitting] = useState(false);
+  const [saveError, setSaveError] = useState<string | null>(null);
+  const [savedMsg, setSavedMsg] = useState<string | null>(null);
+
+  // Sync loaded data into the form state. loaded === null means the block does
+  // not exist yet — empty form for the create flow.
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+  useEffect(() => {
+    if (loading) return;
+    setTitle(loaded?.title ?? "");
+    setContent(loaded?.content ?? "");
+    setSaveError(null);
+    setSavedMsg(null);
+  }, [loading, loaded]);
+
+  const handleSave = async (): Promise<void> => {
+    setSubmitting(true);
+    setSaveError(null);
+    setSavedMsg(null);
+    try {
+      const resolvedContentFormat = resolveWriteContentFormat(contentFormat, loaded?.contentFormat);
+      const result = await dispatcher.write<SetResponse>(writeHandler, {
+        slug,
+        locale,
+        title,
+        content: content.length > 0 ? content : null,
+        folder: loaded?.folder ?? null,
+        ...(resolvedContentFormat !== undefined && { contentFormat: resolvedContentFormat }),
+        ...(tenantIdOverride !== undefined && { tenantIdOverride }),
+      });
+      if (result.isSuccess) {
+        setSavedMsg(
+          result.data.isNew
+            ? t("template-resolver.editor.created")
+            : t("template-resolver.editor.saved"),
+        );
+        return;
+      }
+      setSaveError(
+        result.error.message ?? result.error.code ?? t("template-resolver.editor.saveFailed"),
+      );
+    } catch (e) {
+      // Network blip / dispatcher throw — otherwise submitting stays true and
+      // the save button is locked forever with no feedback.
+      setSaveError(e instanceof Error ? e.message : t("template-resolver.editor.networkError"));
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  const onSubmit = (e?: FormEvent): void => {
+    e?.preventDefault();
+    void handleSave();
+  };
+
+  const disabled = submitting || loading || !canWrite;
+
+  return (
+    <Form
+      onSubmit={onSubmit}
+      testId="text-block-editor"
+      title={title || slug || "—"}
+      subtitle={locale !== "" ? `${slug} · (${locale})` : slug}
+      actions={
+        canWrite ? (
+          <Button type="submit" loading={submitting} disabled={disabled}>
+            {submitting ? t("template-resolver.editor.saving") : t("template-resolver.editor.save")}
+          </Button>
+        ) : undefined
+      }
+    >
+      {loading && <Banner variant="loading">{t("template-resolver.editor.loading")}</Banner>}
+      {loadError !== null && (
+        <Banner variant="error">
+          {t("template-resolver.editor.loadFailed")}: {loadError.code}
+        </Banner>
+      )}
+      {!canWrite && !loading && (
+        <Banner variant="info">{t("template-resolver.editor.readOnly")}</Banner>
+      )}
+      <Field id="text-block-title" label={t("template-resolver.editor.titleLabel")} required>
+        <Input
+          kind="text"
+          id="text-block-title"
+          name="text-block-title"
+          value={title}
+          onChange={setTitle}
+          disabled={disabled}
+          required
+        />
+      </Field>
+      <Field
+        id={contentEditorId}
+        label={t("template-resolver.editor.contentLabel")}
+        labelAppendix={
+          <Button
+            type="button"
+            variant="secondary"
+            size="sm"
+            onClick={() => setPreviewing((p) => !p)}
+          >
+            {previewing ? t("kumiko.contentEditor.editMode") : t("kumiko.contentEditor.preview")}
+          </Button>
+        }
+      >
+        {previewing ? (
+          <ContentPreview
+            content={content}
+            variables={variableExamples}
+            contentFormat={contentFormat}
+          />
+        ) : (
+          <ContentEditor
+            id={contentEditorId}
+            value={content}
+            onChange={setContent}
+            variables={variables}
+            readOnly={disabled}
+          />
+        )}
+      </Field>
+      {saveError !== null && <Banner variant="error">{saveError}</Banner>}
+      {savedMsg !== null && <Banner variant="info">{savedMsg}</Banner>}
+    </Form>
+  );
+}
+
+// `navId` = the QN of the r.nav({ provider: true }) node the app registers for
+// the content tree (e.g. "publicstatus:nav:content"). The app owns the node's
+// label/icon/access, the feature only supplies children plus the editor.
+// Without navId: resolver only, no sidebar node (server-only consumers such as
+// money-horse leak nothing).
+// `tenantId` (SystemAdmin-only): which tenant the tree and editor serve —
+// SYSTEM_TENANT_ID for apps that seed marketing/legal there. Omit for the
+// session tenant (default, no cross-tenant access).
+//
+// Beyond that single tree, this client also serves every content collection
+// the app declares via r.contentCollection() — one provider per collection,
+// filtered to its kind. Those need no navId here; their nav QN comes from the
+// schema, so navId and kind can't drift apart.
+export function textBlocksClient(opts?: {
+  readonly navId?: string;
+  readonly tenantId?: string;
+}): ClientFeatureDefinition {
+  const navId = opts?.navId;
+  const tenantId = opts?.tenantId;
+  return {
+    name: "template-resolver",
+    ...(navId !== undefined && {
+      navProviders: { [navId]: makeTreeProvider(tenantId) },
+      // SSE refresh: every template-resource event re-fires the provider.
+      navEntities: { [navId]: ["template-resource"] },
+    }),
+    // Every r.contentCollection() in the app gets its own tree, filtered to
+    // that collection's kind. The explicit navId above stays independent of
+    // this — an app can have both a hand-wired content tree and collections.
+    navProvidersFromCollections: (collections) => ({
+      providers: Object.fromEntries(
+        collections.map((c) => [c.navQn, makeTreeProvider(tenantId, c.id)]),
+      ),
+      entities: Object.fromEntries(collections.map((c) => [c.navQn, ["template-resource"]])),
+    }),
+    resolvers: {
+      "template-resolver:edit": TextBlockEditor,
+    },
+    // The default for every "plain" collection (ai-prompt, mail-html without
+    // an explicit rich override) — an app-registered "plain" editor on
+    // another clientFeature still wins, last-wins same as columnRenderers.
+    contentEditors: {
+      plain: PlainContentEditor,
+      rich: RichContentEditor,
+      // ponytail: same textarea+chips as "plain" — markdown is stored as
+      // text either way. Shares PlainContentEditor's fixed-DOM-id ceiling
+      // (see its own file comment); swap for a live-preview widget or a
+      // forwarded-ref variant if a collection actually needs one.
+      markdown: PlainContentEditor,
+    },
+    translations: defaultTranslations,
+  };
+}

package/packages/bundled-features/src/template-resolver/web/i18n.ts

@@ -0,0 +1,25 @@
+// @runtime client
+// Default translation bundle for the text-block editor. textBlocksClient()
+// hangs it into the LocaleProvider as a fallback bundle — apps override
+// individual keys via mergeTranslations at the createKumikoApp level.
+//
+// Keys follow `template-resolver.editor.<slug>`.
+
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+
+export const defaultTranslations: TranslationsByLocale = {
+  en: {
+    "template-resolver.editor.titleLabel": "Title",
+    "template-resolver.editor.contentLabel": "Content",
+    "template-resolver.editor.save": "Save",
+    "template-resolver.editor.saving": "Saving…",
+    "template-resolver.editor.created": "Created.",
+    "template-resolver.editor.saved": "Saved.",
+    "template-resolver.editor.saveFailed": "Save failed.",
+    "template-resolver.editor.networkError": "Network error while saving.",
+    "template-resolver.editor.loading": "Loading current version…",
+    "template-resolver.editor.loadFailed": "Could not load block",
+    "template-resolver.editor.readOnly":
+      "Read-only — TenantAdmin or SystemAdmin role required to make changes.",
+  },
+};

package/packages/bundled-features/src/template-resolver/web/index.ts

@@ -0,0 +1,8 @@
+// @runtime client
+// Public exports for the browser side of template-resolver. Consumed through
+// the sub-path export `@cosmicdrift/kumiko-bundled-features/template-resolver/web`
+// — the server side (defineFeature) lives in
+// `@cosmicdrift/kumiko-bundled-features/template-resolver` and has no React or
+// DOM deps.
+
+export { textBlocksClient } from "./client-plugin.js";

package/packages/bundled-features/src/template-resolver-user-data/hooks.ts

@@ -0,0 +1,40 @@
+// EXT_USER_DATA hooks for the template-resolver's `user-content-entry` entity
+// (GDPR Art. 20 export / Art. 17 erasure). Lives apart from template-resolver
+// so apps without the user-data-rights pipeline don't pull a hard dependency.
+// Mirrors notes-history-user-data: export-only, erasure via crypto-shredding.
+
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { userContentEntriesTable } from "../template-resolver/index.js";
+
+// Genuinely per-user content — the export filters by ownerId alone. Tenant
+// scoping comes from the tenant-scoped ctx.db; a user who belongs to two
+// tenants gets each tenant's entries from that tenant's forget run.
+export const userContentExportHook: UserDataExportHook = async (ctx) => {
+  const rows = await ctx.db.selectMany(userContentEntriesTable, {
+    ownerId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "user-content-entry",
+    rows: rows.map((r) => ({
+      slug: r["slug"],
+      kind: r["kind"],
+      locale: r["locale"],
+      title: r["title"],
+      content: r["content"],
+      folder: r["folder"],
+      modifiedAt: String(r["modifiedAt"] ?? ""),
+    })),
+  };
+};
+
+// Deliberate no-op: `content` is annotated `personal: { of: "ownerId" }`, so
+// erasure runs via crypto-shredding — destroying the owner's subject key
+// makes every event AND the projected row unreadable at once. A physical
+// DELETE would not be rebuild-safe here: user-content-entry is
+// event-sourced, so a replay would bring the row back (with unreadable
+// content, but back).
+// Precondition: this only erases anything if the app mounts a KMS adapter —
+// without one, userOwned fields fall back to plaintext framework-wide and
+// forget is a true no-op for `content`. Same property as notes-history.
+export const userContentDeleteHook: UserDataDeleteHook = async () => {};

package/packages/bundled-features/src/template-resolver-user-data/index.ts

@@ -0,0 +1,25 @@
+// Provides the EXT_USER_DATA export/delete hooks for the template-resolver's
+// `user-content-entry` entity — mount it alongside template-resolver and
+// user-data-rights when an app declares a collection with `ownership: "user"`.
+// Kept separate from template-resolver so apps with only tenant-wide
+// collections stay usable without the user-data-rights stack. Mirrors
+// notes-history-user-data.
+
+import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
+import { userContentDeleteHook, userContentExportHook } from "./hooks.js";
+
+export const templateResolverUserDataFeature = defineFeature("template-resolver-user-data", (r) => {
+  r.describe(
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `template-resolver` feature's `user-content-entry` entity — the per-user half of the content store (mail signatures, personal reply snippets). Mounts the EXT_USER_DATA export hook so a user's own entries land in the export bundle; the delete hook is a deliberate no-op because `content` is annotated `userOwned`, so erasure runs via crypto-shredding (destroying the owner's subject key) rather than a physical delete, which would not survive an event replay. Mount this whenever `createTemplateResolverFeature` declares a collection with `ownership: \"user\"` — the boot guard otherwise refuses the entity. Requires `user-data-rights`, optionalRequires `template-resolver`.",
+  );
+  // user-data-rights is the hard dependency (EXT_USER_DATA host).
+  // template-resolver is optional for the same reason as in
+  // notes-history-user-data: a toggleable mount would otherwise trip the
+  // "effectively disabled" boot warning even though the entity is there.
+  r.requires("user-data-rights");
+  r.optionalRequires("template-resolver");
+  r.useExtension(EXT_USER_DATA, "user-content-entry", {
+    export: userContentExportHook,
+    delete: userContentDeleteHook,
+  });
+});

package/packages/bundled-features/src/tenant/cancel-pending-invitation.ts

@@ -0,0 +1,43 @@
+import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { Redis } from "ioredis";
+// kumiko-lint-ignore cross-feature-import cancel needs invite-token-store for Redis cleanup
+import { invalidateExistingInviteToken } from "../auth-email-password/invite-token-store.js";
+import {
+  INVITATION_STATUS,
+  tenantInvitationEntity,
+  tenantInvitationsTable,
+} from "./invitation-table.js";
+
+const invitationExecutor = createEventStoreExecutor(
+  tenantInvitationsTable,
+  tenantInvitationEntity,
+  { entityName: "tenant-invitation" },
+);
+
+// Shared by cancel-invitation and remove-member so the cancel behavior
+// (status transition + token invalidation) cannot drift between them.
+export async function cancelPendingInvitation(
+  db: TenantDb,
+  invitation: { readonly id: string; readonly version: number },
+  actor: SessionUser,
+  redis: Redis | undefined,
+): Promise<WriteFailure | undefined> {
+  const updateResult = await invitationExecutor.update(
+    {
+      id: invitation.id,
+      version: invitation.version,
+      changes: { status: INVITATION_STATUS.cancelled },
+    },
+    actor,
+    db,
+  );
+  if (!updateResult.isSuccess) return updateResult;
+
+  // Delete the token from Redis (if still there). If Redis is
+  // unavailable or the token already expired: not a problem, the DB
+  // row is the single source of truth for the UI.
+  if (redis) await invalidateExistingInviteToken(redis, invitation.id);
+  return undefined;
+}