@cosmicdrift/kumiko-samples 0.374.0 → 0.377.0

package/packages/bundled-features/src/page-render/layout.ts

@@ -1,5 +1,5 @@
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
-import { type ApexHead, renderApexHeadTags } from "@cosmicdrift/kumiko-headless/apex";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
+import { type ApexHead, renderApexHeadTags } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock } from "./branding.ts";
 import { sanitizeTenantCss } from "./css-sanitize.ts";
 

package/packages/bundled-features/src/page-render/markdown.ts

@@ -1,4 +1,4 @@
-import { escapeHtml, isSafeHref } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml, isSafeHref } from "@cosmicdrift/kumiko-renderer/headless";
 import { Marked } from "marked";
 
 // Geteilter, gehärteter Markdown→HTML-Kern für server-gerenderte Public-

package/packages/bundled-features/src/personal-access-tokens/i18n.ts

@@ -1,5 +1,5 @@
 import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
-import { fieldLabelKey, fieldOptionLabelKey } from "@cosmicdrift/kumiko-headless";
+import { fieldLabelKey, fieldOptionLabelKey } from "@cosmicdrift/kumiko-renderer/headless";
 import { PAT_FEATURE } from "./constants.ts";
 import type { PatScopeConfig } from "./scopes.ts";
 

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -5,7 +5,7 @@ import {
   type SecretMintScreenDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
-import { fieldOptionLabelKeyPrefix } from "@cosmicdrift/kumiko-headless";
+import { fieldOptionLabelKeyPrefix } from "@cosmicdrift/kumiko-renderer/headless";
 import {
   PAT_FEATURE,
   PAT_MINT_SCREEN_ID,

package/packages/bundled-features/src/secrets/feature.ts

@@ -79,11 +79,11 @@ export const JOIN_REQUEST_TRANSACTION_REASON =
 // FileProviderContext-Pfade (S3-Plugin im Worker) liefern dieselben
 // zwei Felder, also reicht die schmale ctx-shape — kein voller
 // HandlerContext-Import noetig.
-// Handler contexts carry the caller as ctx.user, provider contexts set _userId (takes precedence).
+// Handler contexts carry the caller as ctx.user, provider contexts set auditUserId (takes precedence).
 export function requireSecretsContext(
   ctx: {
     readonly secrets?: SecretsContext;
-    readonly _userId?: string | undefined;
+    readonly auditUserId?: string | undefined;
     readonly user?: { readonly id: string };
   },
   handlerName: string,
@@ -95,10 +95,10 @@ export function requireSecretsContext(
         "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
     });
   }
-  const userId = ctx._userId ?? ctx.user?.id;
+  const userId = ctx.auditUserId ?? ctx.user?.id;
   if (!userId) {
     throw new InternalError({
-      message: `[${handlerName}] ctx._userId missing (and no ctx.user) — cannot audit secret reads without a caller identity.`,
+      message: `[${handlerName}] ctx.auditUserId missing (and no ctx.user) — cannot audit secret reads without a caller identity.`,
     });
   }
   const withAudit = (raw: SecretsContext): SecretsContext => ({

package/packages/bundled-features/src/seo/sitemap.ts

@@ -1,4 +1,4 @@
-import { escapeXml } from "@cosmicdrift/kumiko-headless";
+import { escapeXml } from "@cosmicdrift/kumiko-renderer/headless";
 
 export type SitemapEntry = {
   readonly loc: string;

package/packages/bundled-features/src/shared/mail-template-body.ts

@@ -1,4 +1,4 @@
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
 
 const SLOT_PATTERN = /\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 

package/packages/bundled-features/src/shared/purge-files-reaching-subject.ts

@@ -16,9 +16,14 @@ import {
   type EntityDefinition,
   parseTenantId,
   type Registry,
+  SYSTEM_USER_ID,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import {
+  FILE_REF_ENTITY_NAME,
+  fileRefEntity,
+  fileRefsTable,
+} from "@cosmicdrift/kumiko-framework/files";
 import {
   collectSingleFileHolders,
   type FileRefPurgeOutcome,
@@ -155,7 +160,8 @@ export async function purgeFilesReachingSubject(args: {
   const storageByTenant = new Map<TenantId, Promise<DeleteFileBytes | undefined>>();
   let firstFailure: FileSweepError | undefined;
 
-  for (const fileEntity of collectFileEntities(registry)) {
+  const fileEntities = collectFileEntities(registry);
+  for (const fileEntity of fileEntities) {
     const seenRowIds = new Set<string>();
     for (const where of candidateWheres(subject, recordTenantId, fileEntity)) {
       const rows = await selectMany<Record<string, unknown>>(db, fileEntity.table, where);
@@ -202,5 +208,124 @@ export async function purgeFilesReachingSubject(args: {
       }
     }
   }
+  // Runs even after an entity-sweep failure: one failed row must not leave the pending uploads.
+  const pendingFailure = await purgePendingUploadsOfUser({
+    db,
+    registry,
+    subject,
+    fileFieldKeys: pendingFieldKeys(fileEntities),
+    fileHolders,
+    storageByTenant,
+    resolveDeleteBytes,
+    missingStorage,
+  });
+  firstFailure ??= pendingFailure;
   if (firstFailure) throw firstFailure;
 }
+
+const pendingFieldKey = (entityType: unknown, fieldName: unknown) =>
+  `${entityType}\u0000${fieldName}`;
+
+function pendingFieldKeys(fileEntities: readonly FileEntity[]): ReadonlySet<string> {
+  const keys = new Set<string>();
+  for (const { entityName, fileFields } of fileEntities) {
+    for (const fieldName of fileFields) keys.add(pendingFieldKey(entityName, fieldName));
+  }
+  return keys;
+}
+
+async function isFileRefHeldByRecord(
+  db: DbRunner,
+  holders: readonly SingleFileHolder[],
+  tenantId: TenantId,
+  fileRefId: string,
+): Promise<boolean> {
+  for (const holder of holders) {
+    for (const field of holder.singleFields) {
+      const where: WhereObject = { [field]: fileRefId };
+      if (holder.tableHasTenantId) where["tenantId"] = tenantId;
+      if ((await selectMany(db, holder.table, where, { limit: 1 })).length > 0) return true;
+    }
+  }
+  return false;
+}
+
+// An upload the user made but never bound to a record has no entity row to find it through, so
+// the uploader id is the only link. Only refs that originate from a registered entity file
+// field count as pending uploads: config saves (a tenant logo) and server-made files never
+// bind and must outlive the uploader. A legacy unbound ref a record's single file column still
+// names is not pending but in use and stays with that record.
+async function purgePendingUploadsOfUser(args: {
+  readonly db: DbRunner;
+  readonly registry: Registry;
+  readonly subject: SubjectId;
+  readonly fileFieldKeys: ReadonlySet<string>;
+  readonly fileHolders: readonly SingleFileHolder[];
+  readonly storageByTenant: Map<TenantId, Promise<DeleteFileBytes | undefined>>;
+  readonly resolveDeleteBytes: (tenantId: TenantId) => Promise<DeleteFileBytes | undefined>;
+  readonly missingStorage: MissingStoragePolicy;
+}): Promise<FileSweepError | undefined> {
+  const { db, registry, subject, fileFieldKeys } = args;
+  // skip: only a user uploads files without binding them to a record
+  if (subject.kind !== "user") return undefined;
+  // skip: the system user is not a person; its server-made files are not pending uploads
+  if (subject.userId === SYSTEM_USER_ID) return undefined;
+  // skip: without the files feature there is no file_refs table to sweep
+  if (registry.getEntity(FILE_REF_ENTITY_NAME) === undefined) return undefined;
+  const pending = await selectMany<Record<string, unknown>>(db, fileRefsTable, {
+    insertedById: subject.userId,
+    entityId: null,
+  });
+  let firstFailure: FileSweepError | undefined;
+  for (const fileRef of pending) {
+    // skip: not uploaded for a registered entity file field (config, server-made, unknown origin)
+    if (!fileFieldKeys.has(pendingFieldKey(fileRef["entityType"], fileRef["fieldName"]))) continue;
+    firstFailure ??= await purgePendingFileRef(args, fileRef);
+  }
+  return firstFailure;
+}
+
+async function purgePendingFileRef(
+  args: {
+    readonly db: DbRunner;
+    readonly fileHolders: readonly SingleFileHolder[];
+    readonly storageByTenant: Map<TenantId, Promise<DeleteFileBytes | undefined>>;
+    readonly resolveDeleteBytes: (tenantId: TenantId) => Promise<DeleteFileBytes | undefined>;
+    readonly missingStorage: MissingStoragePolicy;
+  },
+  fileRef: Record<string, unknown>,
+): Promise<FileSweepError | undefined> {
+  const { db, fileHolders, storageByTenant, resolveDeleteBytes, missingStorage } = args;
+  const tenantId = parseTenantId(fileRef["tenantId"]);
+  const fileRefId = String(fileRef["id"]);
+  const storageKey = fileRef["storageKey"];
+  // skip: a ref without tenant or key has no bytes this sweep could address
+  if (tenantId === null || typeof storageKey !== "string" || storageKey === "") return undefined;
+  // skip: a record still uses this file
+  if (await isFileRefHeldByRecord(db, fileHolders, tenantId, fileRefId)) return undefined;
+
+  let storagePromise = storageByTenant.get(tenantId);
+  if (storagePromise === undefined) {
+    storagePromise = resolveDeleteBytes(tenantId);
+    storageByTenant.set(tenantId, storagePromise);
+  }
+  const deleteBytes = await storagePromise;
+  if (deleteBytes === undefined) {
+    if (missingStorage.mode === "skip") {
+      missingStorage.warn(tenantId);
+      return undefined;
+    }
+    return new FileSweepError("missing_file_storage", FILE_REF_ENTITY_NAME);
+  }
+  if ((await deleteBytesFailingClosed(deleteBytes, storageKey)).length > 0) {
+    return new FileSweepError("file_delete_failed", FILE_REF_ENTITY_NAME);
+  }
+  const forgotten = await fileRefExecutor.forget(
+    { id: fileRefId },
+    createSystemUser(tenantId),
+    createTenantDb({ db, tenantId, mode: "system" }),
+  );
+  return forgotten.isSuccess
+    ? undefined
+    : new FileSweepError("file_delete_failed", FILE_REF_ENTITY_NAME);
+}

package/packages/bundled-features/src/tags/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import {
   TAGS_COLUMN_RENDERER_NAME,
   TAGS_FEATURE_NAME,

package/packages/bundled-features/src/template-resolver/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.377.0",
+    "type": "improvement",
+    "title": "seedSystemTemplateBundle sets a title per template",
+    "detail": "Bundle locale entries accept an optional title, written to the template resource and exported again by the bundle export. SeedSystemTemplateOptions gets title. The template overview shows it instead of the slug."
+  },
+  {
+    "version": "0.375.0",
+    "type": "improvement",
+    "title": "Preview and test mail render with the values of a picked record",
+    "detail": "`template-resolver:query:preview` and `template-resolver:write:send-test` accept an optional `variables` object that replaces the declared example values for the named variables. The values are checked against the template's variable schema like a real send (unknown names and wrong types are rejected as `variables.<name>` validation errors); variables not passed keep their example. The mail editor now passes the values picked through the preview record picker into the preview and the test mail instead of only listing them."
+  },
+  {
+    "version": "0.375.0",
+    "type": "improvement",
+    "title": "Read a mail or PDF template as blocks and change it with structured operations",
+    "detail": "The query `template-resolver:query:document-blocks` returns a document template as blocks with stable ids (b0, b1, ...), its meta, variables, allowed block types and uploaded image keys, plus a `base` (scope and version). The write `template-resolver:write:patch-draft` applies up to 50 operations (insertBlock, replaceText, removeBlock, setResource, setMeta, setVariable) to that state and stores the result as the caller's tenant draft; an active version keeps being served until publish. Block ids refer to the state that was read. If the template changed since `base` was read, the call fails with `version_conflict` and writes nothing; a patch that removes a required placeholder or sets variables a notification declares is refused. `writeTemplateRow` accepts an optional `expectedVersion`. The universal helpers `placeholder-text` and the toolbar block sets moved out of `web/` without changing the web exports."
+  },
   {
     "version": "0.372.0",
     "type": "improvement",

package/packages/bundled-features/src/template-resolver/document-blocks.ts

@@ -0,0 +1,34 @@
+// @runtime client
+export type DocumentToolbarBlock =
+  | "image"
+  | "table"
+  | "button"
+  | "divider"
+  | "repeat"
+  | "pageBreak"
+  | "align"
+  | "steps";
+
+export const MAIL_DOCUMENT_BLOCKS = [
+  "image",
+  "table",
+  "button",
+  "divider",
+  "repeat",
+  "steps",
+] as const satisfies readonly DocumentToolbarBlock[];
+
+export const PDF_DOCUMENT_BLOCKS = [
+  "align",
+  "image",
+  "table",
+  "divider",
+  "repeat",
+  "steps",
+  "pageBreak",
+] as const satisfies readonly DocumentToolbarBlock[];
+
+/** Block set for a template-resource kind; every kind except "document-pdf" gets the mail set. */
+export function documentBlocksForKind(kind: string | undefined): readonly DocumentToolbarBlock[] {
+  return kind === "document-pdf" ? PDF_DOCUMENT_BLOCKS : MAIL_DOCUMENT_BLOCKS;
+}