@cosmicdrift/kumiko-samples 0.338.0

package/packages/bundled-features/src/notes-history/index.ts

@@ -0,0 +1,25 @@
+export {
+  DEFAULT_NOTES_HISTORY_ACCESS,
+  DEFAULT_NOTES_HISTORY_ROLES,
+  NOTES_HISTORY_FEATURE_NAME,
+  NOTES_SECTION_EXTENSION_NAME,
+  NotesHistoryHandlers,
+  NotesHistoryQueries,
+} from "./constants.js";
+export { noteEntryEntity, noteMentionEntity } from "./entity.js";
+export {
+  noteEntryExecutor,
+  noteEntryTable,
+  noteMentionExecutor,
+  noteMentionTable,
+} from "./executor.js";
+export {
+  createNotesHistoryFeature,
+  type NotesHistoryFeatureOptions,
+  notesHistoryFeature,
+} from "./feature.js";
+export {
+  addNoteHandler,
+  createAddNoteHandler,
+} from "./handlers/add-note.write.js";
+export { type AddNotePayload, addNotePayloadSchema } from "./schemas.js";

package/packages/bundled-features/src/notes-history/schemas.ts

@@ -0,0 +1,17 @@
+import * as z from "zod";
+
+// entityType/entityId are app-supplied — mirror tags' NO_PIPE guard isn't
+// needed here since note-entry has no deterministic aggregate-id derived
+// from these fields (see aggregate-id note in entity.ts): a literal value
+// can't shift stream-id tuple boundaries when there is no such tuple.
+// `mentions` carries structured @-mentions from the editor as user ids —
+// never parsed out of `body` text (regex/NLP over free text is unreliable,
+// see entity.ts). Capped well above any realistic note; a client sending more
+// is a bug, not a use case worth accommodating.
+export const addNotePayloadSchema = z.object({
+  entityType: z.string().min(1).max(64),
+  entityId: z.string().min(1).max(128),
+  body: z.string().trim().min(1).max(20_000),
+  mentions: z.array(z.uuid()).max(50).optional(),
+});
+export type AddNotePayload = z.infer<typeof addNotePayloadSchema>;

package/packages/bundled-features/src/notes-history/web/client-plugin.tsx

@@ -0,0 +1,16 @@
+// @runtime client
+
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import { NOTES_HISTORY_FEATURE_NAME, NOTES_SECTION_EXTENSION_NAME } from "../constants.js";
+import { defaultTranslations } from "./i18n.js";
+import { NotesSection } from "./notes-section.js";
+
+export function notesHistoryClient(): ClientFeatureDefinition {
+  return {
+    name: NOTES_HISTORY_FEATURE_NAME,
+    extensionSectionComponents: {
+      [NOTES_SECTION_EXTENSION_NAME]: NotesSection,
+    },
+    translations: defaultTranslations,
+  };
+}

package/packages/bundled-features/src/notes-history/web/i18n.ts

@@ -0,0 +1,22 @@
+// @runtime client
+// Default translation bundle for the notes-history UI. notesHistoryClient()
+// hangs it into the LocaleProvider as a fallback bundle — apps override
+// individual keys via notesHistoryClient({ translations }).
+// Keys follow `notesHistory.<area>.<slug>`.
+
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+
+export const defaultTranslations: TranslationsByLocale = {
+  en: {
+    "notesHistory.section.createMode": "Save the entity first to add notes.",
+    "notesHistory.section.loading": "Loading…",
+    "notesHistory.section.empty": "No notes yet.",
+    "notesHistory.section.working": "Saving…",
+    "notesHistory.section.add": "Add note",
+    "notesHistory.section.meta": "{author} · {date}",
+    "notesHistory.section.authorUnknown": "Unknown author",
+    "notesHistory.section.newNoteTitle": "New note",
+    "notesHistory.section.historyTitle": "History",
+    "notesHistory.section.shortcutHint": "Ctrl+Enter saves",
+  },
+};

package/packages/bundled-features/src/notes-history/web/index.ts

@@ -0,0 +1,8 @@
+// @runtime client
+export {
+  NOTES_SECTION_EXTENSION_NAME,
+  NotesHistoryHandlers,
+  NotesHistoryQueries,
+} from "../constants.js";
+export { notesHistoryClient } from "./client-plugin.js";
+export { NotesSection } from "./notes-section.js";

package/packages/bundled-features/src/notes-history/web/notes-section.tsx

@@ -0,0 +1,190 @@
+// @runtime client
+// NotesSection — drop-in note history for ANY entity. Shows every note
+// chronologically (newest first) with author + timestamp, plus a textarea to
+// append a new one. Append-only: there is no edit/delete affordance because
+// the write-handler doesn't expose one (see ../entity.ts) — a correction is a
+// new entry.
+//
+// Two ways to mount (both need notesHistoryClient() registered once, for i18n):
+//   - standalone:   <NotesSection entityName="contact" entityId={id} />
+//   - extension:    a screen-schema section with
+//                   component: { react: { __component: NOTES_SECTION_EXTENSION_NAME } }
+//                   (RenderEdit passes { entityName, entityId }).
+
+import {
+  formatWhen,
+  useDispatcher,
+  usePrimitives,
+  useQuery,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
+import { type ReactNode, useState } from "react";
+import { NotesHistoryHandlers, NotesHistoryQueries } from "../constants.js";
+
+type NoteRow = {
+  readonly id: string;
+  readonly entityType: string;
+  readonly entityId: string;
+  readonly authorId: string;
+  // Null for pre-authorName history; shredded authors arrive as PII_ERASED_SENTINEL.
+  readonly authorName: string | null;
+  readonly body: string;
+  readonly insertedAt: string;
+};
+
+// Matches @cosmicdrift/kumiko-framework/crypto PII_ERASED_SENTINEL — cannot
+// import that module from @runtime client (runtime-isolation).
+const PII_ERASED_SENTINEL = "[[erased]]";
+
+function displayAuthorName(authorName: string | null, unknownLabel: string): string {
+  return authorName && authorName !== PII_ERASED_SENTINEL ? authorName : unknownLabel;
+}
+type NoteListResponse = { readonly rows: readonly NoteRow[] };
+
+export function NotesSection({
+  entityName,
+  entityId,
+}: {
+  readonly entityName: string;
+  readonly entityId: string | null;
+}): ReactNode {
+  const { Banner, Button, Grid, Heading, Text, Input } = usePrimitives();
+  const t = useTranslation();
+  const dispatcher = useDispatcher();
+  const enabled = entityId !== null;
+  const notes = useQuery<NoteListResponse>(
+    NotesHistoryQueries.noteList,
+    {
+      // entityType server-side, not just entityId: it collapses the parent-ref
+      // read gate to this one host entity instead of every registered one.
+      filters: [
+        { field: "entityType", op: "eq", value: entityName },
+        { field: "entityId", op: "eq", value: entityId },
+      ],
+      sort: "insertedAt",
+      sortDirection: "desc",
+      // ponytail: fixed page, no "load more" — an entity with a note history
+      // longer than this shows only its 200 newest. Upgrade to cursor
+      // pagination (the query already supports `cursor`) if that's hit.
+      limit: 200,
+    },
+    { enabled },
+  );
+  const [draft, setDraft] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [errorKey, setErrorKey] = useState<string | null>(null);
+
+  if (entityId === null) {
+    return (
+      <Banner variant="info" testId="notes-section-create-mode">
+        <Text>{t("notesHistory.section.createMode")}</Text>
+      </Banner>
+    );
+  }
+  if (notes.loading && notes.data === null) {
+    return (
+      <Banner variant="loading" testId="notes-section-loading">
+        <Text>{t("notesHistory.section.loading")}</Text>
+      </Banner>
+    );
+  }
+  if (notes.error) {
+    return (
+      <Banner variant="error" testId="notes-section-error">
+        <Text>{t(notes.error.i18nKey, notes.error.i18nParams)}</Text>
+      </Banner>
+    );
+  }
+
+  const rows = (notes.data?.rows ?? []).filter((n) => n.entityType === entityName);
+
+  const addNote = (): void => {
+    const body = draft.trim();
+    if (body === "") return;
+    setBusy(true);
+    setErrorKey(null);
+    void (async () => {
+      try {
+        const result = await dispatcher.write(NotesHistoryHandlers.addNote, {
+          entityType: entityName,
+          entityId,
+          body,
+        });
+        if (!result.isSuccess) {
+          setErrorKey(result.error.i18nKey);
+          return;
+        }
+        setDraft("");
+        await notes.refetch();
+      } finally {
+        setBusy(false);
+      }
+    })();
+  };
+
+  // No own Card/SectionCard here — the host (ExtensionSectionMount) already
+  // frames this whole component in one card; a nested card would double the
+  // border/padding. "New note" and "History" are sub-headers within that
+  // single frame instead.
+  return (
+    <Grid columns={1} testId="notes-section">
+      <div className="flex flex-col gap-3" data-testid="notes-section-new">
+        <Heading variant="section">{t("notesHistory.section.newNoteTitle")}</Heading>
+        <Input
+          kind="textarea"
+          id="notes-section-draft"
+          name="draft"
+          value={draft}
+          onChange={setDraft}
+          onSubmitShortcut={() => {
+            if (!busy && draft.trim() !== "") addNote();
+          }}
+        />
+        <div className="flex items-center justify-between gap-2">
+          <Text variant="small">{t("notesHistory.section.shortcutHint")}</Text>
+          <Button
+            variant="primary"
+            disabled={busy || draft.trim() === ""}
+            onClick={() => addNote()}
+            testId="notes-section-add"
+          >
+            {busy ? t("notesHistory.section.working") : t("notesHistory.section.add")}
+          </Button>
+        </div>
+        {errorKey !== null && (
+          <Banner variant="error" testId="notes-section-action-error">
+            <Text>{t(errorKey)}</Text>
+          </Banner>
+        )}
+      </div>
+
+      <div className="flex flex-col gap-3" data-testid="notes-section-history">
+        <Heading variant="section">{t("notesHistory.section.historyTitle")}</Heading>
+        {rows.length === 0 ? (
+          <Text variant="small">{t("notesHistory.section.empty")}</Text>
+        ) : (
+          <div className="flex flex-col divide-y">
+            {rows.map((n) => (
+              <div
+                key={n.id}
+                data-testid={`notes-section-row-${n.id}`}
+                className="flex flex-col gap-1 py-3 first:pt-0 last:pb-0"
+              >
+                <Text testId={`notes-section-body-${n.id}`}>{n.body}</Text>
+                <Text variant="small" testId={`notes-section-meta-${n.id}`}>
+                  {t("notesHistory.section.meta", {
+                    author: displayAuthorName(
+                      n.authorName,
+                      t("notesHistory.section.authorUnknown"),
+                    ),
+                    date: formatWhen(n.insertedAt),
+                  })}
+                </Text>
+              </div>
+            ))}
+          </div>
+        )}
+      </div>
+    </Grid>
+  );
+}

package/packages/bundled-features/src/notes-history-user-data/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.215.3",
+    "type": "improvement",
+    "title": "note-entry GDPR export now includes authorName",
+    "detail": "The Art. 20 export for `note-entry` (noteEntryExportHook) enumerates fields explicitly and did not know about the new `authorName` field added alongside `body`. The export row now also carries the stamped `authorName` (null on legacy/shredded rows, same as the read path)."
+  }
+]

package/packages/bundled-features/src/notes-history-user-data/hooks.ts

@@ -0,0 +1,131 @@
+// EXT_USER_DATA hooks for the notes-history feature's `note-entry` entity
+// (GDPR Art. 20 export / Art. 17 erasure). Lives apart from notes-history so
+// notes consumers without the user-data-rights pipeline don't pull a hard
+// dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
+// export-only, erasure via crypto-shredding.
+
+import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  resolveRetentionPolicyForTenant,
+  resolveTenantRetentionPreset,
+} from "../data-retention/index.js";
+import { noteEntryTable, noteMentionTable } from "../notes-history/index.js";
+import { policyToStrategy } from "../user-data-rights/index.js";
+
+// note-entry has no per-tenant scope quirk (unlike folders) — it's genuinely
+// per-user content, so the export filters by authorId directly.
+export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
+  const rows = await ctx.db.selectMany(noteEntryTable, {
+    authorId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "note-entry",
+    rows: rows.map((r) => ({
+      entityType: r["entityType"],
+      entityId: r["entityId"],
+      body: r["body"],
+      authorName: r["authorName"],
+      insertedAt: r["insertedAt"],
+    })),
+  };
+};
+
+// `authorName` is separately annotated `personal: { of: "authorId" }`
+// (entity.ts), so forgetting the AUTHOR already crypto-shreds that field on
+// its own — unrelated to this hook. `body` is Row-Subject (`personal: { of:
+// "id" }`): its key is per-note, not per-user, so forgetting a user only
+// reaches a note's body when that note structurally @-mentions the user via
+// a `note-mention` row (fw#2787). Free-text mentions are NOT detected —
+// that's the documented gap in entity.ts, not a bug here.
+//
+// Per reached note: consult the HOST entity's (entityType, not note-entry's
+// own) retention strategy first — blockDelete/anonymize must win over
+// erasure, same rule the automated forget-cleanup pipeline applies to every
+// other entity. The `strategy` this hook itself is called with is resolved
+// for note-entry, not the host, so it is deliberately unused here.
+//
+// Precondition: this ONLY erases anything if the app mounts a KMS adapter —
+// without one, record-owned fields fall back to plaintext storage
+// framework-wide (see pii-field-encryption.ts) and forget is a true no-op.
+// That gap is a property of the framework's crypto-shredding design, not
+// specific to this hook; apps that need Art.17 coverage without KMS must
+// mount one.
+export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
+  const kms = configuredPiiSubjectKms();
+  // skip: no KMS adapter mounted — record-owned fields stay plaintext framework-wide, forget is a true no-op
+  if (!kms) return;
+
+  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
+    subjectId: ctx.userId,
+  });
+  // skip: no note-mention rows for this user — nothing structurally reaches this user's data to shred
+  if (mentions.length === 0) return;
+
+  const noteIds = new Set(mentions.map((m) => m.noteId));
+  // Once per hook run: the preset depends on the tenant only, not the note.
+  const tenantPreset = await resolveTenantRetentionPreset({
+    db: ctx.db,
+    registry: ctx.registry,
+    tenantId: ctx.tenantId,
+  });
+  // Append-only rows are never hard-deleted, so every mentioned note should
+  // resolve; a missing one has no host and thus no retention policy to consult.
+  const notes = await ctx.db.selectMany<{ id: string; entityType: string }>(noteEntryTable, {
+    id: { in: [...noteIds] },
+  });
+  const strategyByEntityType = new Map<string, ReturnType<typeof policyToStrategy>>();
+  for (const note of notes) {
+    let strategy = strategyByEntityType.get(note.entityType);
+    if (strategy === undefined) {
+      const hostPolicy = await resolveRetentionPolicyForTenant({
+        db: ctx.db,
+        registry: ctx.registry,
+        tenantId: ctx.tenantId,
+        entityName: note.entityType,
+        preloadedTenantPreset: tenantPreset,
+      });
+      strategy = policyToStrategy(hostPolicy.policy?.strategy ?? null);
+      strategyByEntityType.set(note.entityType, strategy);
+    }
+    if (strategy === "anonymize") continue;
+    const noteId = note.id;
+
+    await kms.eraseKey(
+      { kind: "record", entity: "note-entry", id: noteId },
+      {
+        requestId: "notes-history-user-data:forget-mentioned-notes",
+        userId: ctx.userId,
+        eraseReason: "notes-history:mention-forget",
+      },
+    );
+  }
+};
+
+// Erasure reaches every note that structurally mentions the user (see
+// noteEntryDeleteHook), so the Art. 15/20 export must list those notes too.
+export const noteMentionExportHook: UserDataExportHook = async (ctx) => {
+  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
+    subjectId: ctx.userId,
+  });
+  if (mentions.length === 0) return null;
+  const noteIds = [...new Set(mentions.map((m) => m.noteId))];
+  const notes = await ctx.db.selectMany(noteEntryTable, { id: { in: noteIds } });
+  if (notes.length === 0) return null;
+  return {
+    entity: "note-mention",
+    rows: notes.map((note) => ({
+      noteId: note["id"],
+      entityType: note["entityType"],
+      entityId: note["entityId"],
+      body: note["body"],
+      insertedAt: note["insertedAt"],
+    })),
+  };
+};
+
+// note-mention rows are a plain (noteId, subjectId) pointer: forgetting the mentioned
+// user's data is already handled by noteEntryDeleteHook shredding the mentioned NOTE's
+// row-subject key, so this delete hook has nothing of its own to erase.
+export const noteMentionDeleteHook: UserDataDeleteHook = async () => {};

package/packages/bundled-features/src/notes-history-user-data/index.ts

@@ -0,0 +1,34 @@
+// Provides the EXT_USER_DATA export/delete hooks for the notes-history
+// feature's `note-entry` entity as a standalone feature — mount it alongside
+// notes-history + user-data-rights when an app needs note histories in its
+// GDPR export/forget pipeline. Kept separate from notes-history (which only
+// requires nothing) so notes-history stays usable without the
+// user-data-rights stack. Mirrors folders-user-data.
+
+import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  noteEntryDeleteHook,
+  noteEntryExportHook,
+  noteMentionDeleteHook,
+  noteMentionExportHook,
+} from "./hooks.js";
+
+export const notesHistoryUserDataFeature = defineFeature("notes-history-user-data", (r) => {
+  r.describe(
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook looks up `note-mention` for notes that structurally @-mention the forgotten user and crypto-shreds each reached note's row-subject key (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for notes without such a mention. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+  );
+  // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
+  // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
+  // would throw an "effectively disabled" boot warning even though the
+  // note-entry entity exists and the hooks work fine.
+  r.requires("user-data-rights");
+  r.optionalRequires("notes-history");
+  r.useExtension(EXT_USER_DATA, "note-entry", {
+    export: noteEntryExportHook,
+    delete: noteEntryDeleteHook,
+  });
+  r.useExtension(EXT_USER_DATA, "note-mention", {
+    export: noteMentionExportHook,
+    delete: noteMentionDeleteHook,
+  });
+});

package/packages/bundled-features/src/page-render/branding.ts

@@ -0,0 +1,100 @@
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+
+// Tenant-branding tokens resolved at render time (managed-pages reads them
+// from config — see managed-pages/branding.ts). Empty string = "unset, use
+// the base-layout default" (mirrors the publicstatus convention). Every value
+// is tenant-supplied + untrusted, so it is re-validated/escaped HERE before it
+// touches HTML/CSS output — independent of the write-time config `pattern`
+// gate. Defense-in-depth: a value could have been seeded or migrated around
+// the write path, so the render path never trusts the stored string.
+export type BrandingTokens = {
+  readonly title: string;
+  readonly description: string;
+  readonly siteUrl: string;
+  readonly accentColor: string;
+  readonly logoUrl: string;
+  readonly layoutPreset: string;
+  // RAW, untrusted tenant CSS — "" unless the custom-css capability is gated on
+  // (managed-pages allowCustomCss + the per-tenant toggle). It is NOT pre-
+  // sanitized here: the layer that emits it MUST run it through
+  // sanitizeTenantCss(value, scopeSelector) with its own scope (the default
+  // wrapInLayout does). Scoping is a render concern, so sanitization lives at
+  // emit, not in transport.
+  readonly customCss: string;
+};
+
+export const EMPTY_BRANDING: BrandingTokens = {
+  title: "",
+  description: "",
+  siteUrl: "",
+  accentColor: "",
+  logoUrl: "",
+  layoutPreset: "",
+  customCss: "",
+};
+
+// CSS hex color: #rgb | #rrggbb | #rrggbbaa, anchored. Contains no `;`/`}`/`<`/
+// whitespace, so a value passing this can never break out of `:root{--x:V}`
+// or the surrounding <style>…</style>. Linear → ReDoS-safe on untrusted input.
+const HEX_COLOR = /^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
+// https URL, length-bounded, no whitespace/quote/angle chars. Anchored +
+// linear (no backtracking).
+const HTTPS_URL = /^https:\/\/[^\s"'<>]{1,2000}$/;
+
+export function isSafeHexColor(value: string): boolean {
+  return HEX_COLOR.test(value);
+}
+
+export function isSafeHttpsUrl(value: string): boolean {
+  return HTTPS_URL.test(value);
+}
+
+// Layout preset → body max-width. Unknown/empty → default. Keeps the
+// `branding-layout-preset` config key live (read at render, not a declared-
+// but-unread key).
+const LAYOUT_MAX_WIDTH: Record<string, string> = {
+  minimal: "640px",
+  centered: "720px",
+  wide: "1100px",
+};
+
+export function layoutMaxWidth(preset: string): string {
+  return LAYOUT_MAX_WIDTH[preset] ?? "720px";
+}
+
+// Scoped CSS-variable block, injected after the base <style> so its :root
+// declarations override the defaults. Only emits a var whose source value
+// passes re-validation — an invalid accent color is dropped (base CSS keeps
+// its var() fallback), never injected. The id is stable so an app's custom
+// layout can target/override it.
+export function brandingStyleBlock(tokens: BrandingTokens): string {
+  const decls: string[] = [];
+  if (isSafeHexColor(tokens.accentColor)) {
+    decls.push(`--accent:${tokens.accentColor}`);
+  }
+  decls.push(`--page-max-width:${layoutMaxWidth(tokens.layoutPreset)}`);
+  // html-ok: decls are CSS custom-property declarations (regex-validated hex color or fixed table lookup), never raw user text.
+  return `<style id="tenant-theme">:root{${decls.join(";")}}</style>`;
+}
+
+// Optional branded page header (logo + title). The logo is only emitted for a
+// re-validated https URL, escaped as an HTML attribute; an invalid/non-https
+// URL is dropped. A re-validated https siteUrl turns the header into a
+// home-link. Returns "" when there is nothing to show.
+export function brandingHeaderHtml(tokens: BrandingTokens): string {
+  const parts: string[] = [];
+  if (isSafeHttpsUrl(tokens.logoUrl)) {
+    const alt = tokens.title ? escapeHtmlAttr(tokens.title) : "logo";
+    parts.push(`<img class="brand-logo" src="${escapeHtmlAttr(tokens.logoUrl)}" alt="${alt}">`);
+  }
+  if (tokens.title) {
+    parts.push(`<span class="brand-title">${escapeHtml(tokens.title)}</span>`);
+  }
+  if (parts.length === 0) return "";
+
+  const innerHtml = parts.join("\n");
+  if (isSafeHttpsUrl(tokens.siteUrl)) {
+    return `<header class="brand-header"><a href="${escapeHtmlAttr(tokens.siteUrl)}">${innerHtml}</a></header>`;
+  }
+  return `<header class="brand-header">${innerHtml}</header>`;
+}

package/packages/bundled-features/src/page-render/cached-page-response.ts

@@ -0,0 +1,25 @@
+import { type CachePolicy, cachedResponse } from "@cosmicdrift/kumiko-framework/api";
+import { securePageHeaders } from "./security-headers.js";
+
+export type CachedSecurePageResponseInit = {
+  readonly body: BodyInit | null;
+  readonly status?: number;
+  readonly etag: string;
+  readonly cache: CachePolicy;
+  readonly extra?: Record<string, string>;
+  readonly lastModified?: Date;
+};
+
+export function cachedSecurePageResponse(
+  req: Request,
+  init: CachedSecurePageResponseInit,
+): Response {
+  return cachedResponse(req, {
+    body: init.body,
+    status: init.status,
+    etag: init.etag,
+    cache: init.cache,
+    lastModified: init.lastModified,
+    headers: securePageHeaders(init.extra ?? {}),
+  });
+}

package/packages/bundled-features/src/page-render/changes.json

@@ -0,0 +1,14 @@
+[
+  {
+    "version": "0.123.3",
+    "type": "fix",
+    "title": "page-render: neuer `./page-render/web`-Subpath für client-safe Exports (renderSafeMarkdow…",
+    "detail": "page-render: neuer `./page-render/web`-Subpath für client-safe Exports (renderSafeMarkdown, sanitizeTenantCss, wrapInLayout, branding-Helpers, securePageHeaders). Der bestehende `./page-render`-Barrel re-exportierte auch `cachedSecurePageResponse`, das transitiv `@cosmicdrift/kumiko-framework/api` (postgres/ioredis) zieht — jeder Import aus dem Barrel in Client-Code ließ den Browser-Bundle mit \"Bundle failed\" crashen, ohne brauchbare Fehlermeldung. - @cosmicdrift/kumiko-framework@0.123.3 - @cosmicdrift/kumiko-dispatcher-live@0.123.3 - @cosmicdrift/kumiko-headless@0.123.3 - @cosmicdrift/kumiko-renderer@0.123.3 - @cosmicdrift/kumiko-renderer-web@0.123.3"
+  },
+  {
+    "version": "0.123.0",
+    "type": "fix",
+    "title": "headless: new `html` tagged template + `raw()`/`RawHtml` — auto-escapes every interpolati…",
+    "detail": "headless: new `html` tagged template + `raw()`/`RawHtml` — auto-escapes every interpolation, `raw()` marks prerendered markup, nested `html` fragments compose without double-escaping. Structural companion to the new HTML-escape guard (infra#201). Hardening from the guard's first run: apex JSON-LD `<script>` block serializes `<` as `<` (no `</script>` breakout), dev-server `injectSchema` does the same for `window.__KUMIKO_SCHEMA__`; apex/page-render prerendered fragments renamed to the `*Html` convention. - @cosmicdrift/kumiko-headless@0.123.0 - @cosmicdrift/kumiko-dispatcher-live@0.123.0 - @cosmicdrift/kumiko-renderer@0.123.0 - @cosmicdrift/kumiko-renderer-web@0.123.0 - @cosmicdrift/kumiko-framework@0.123.0"
+  }
+]