@cosmicdrift/kumiko-samples 0.400.0 → 0.402.0

package/packages/bundled-features/src/documents/feature.ts

@@ -23,7 +23,11 @@ import {
   DOCUMENT_LINK_ENTITY,
   DOCUMENTS_FEATURE_NAME,
 } from "./constants.ts";
-import { createDocumentEntity, createDocumentLinkEntity } from "./entity.ts";
+import {
+  createDocumentEntity,
+  createDocumentLinkEntity,
+  type DocumentLinkReadMode,
+} from "./entity.ts";
 import { createDocumentExecutors } from "./executor.ts";
 import { createImportDocumentHandler } from "./handlers/import.write.ts";
 import { createLinkDocumentHandler, createUnlinkDocumentHandler } from "./handlers/link.write.ts";
@@ -38,14 +42,23 @@ import { createDocumentWriteGuard } from "./write-guard.ts";
 export type DocumentsFeatureOptions = {
   /** Allowed document categories; they become the options of the category field. */
   readonly categories: readonly [string, ...string[]];
-  /** Entities a document can be linked to. Each needs an update handler, which linking requires. */
+  /** Entities a document can be linked to. Linking needs write access to the target: its update handler, or its entity write roles when it has none. */
   readonly linkTargets: readonly [string, ...string[]];
+  /** Display label per category (de, en); a category without one shows its raw value. */
+  readonly categoryLabels?: Readonly<Record<string, { readonly de: string; readonly en: string }>>;
   /** Files saved into these fields become documents automatically. */
   readonly capture?: readonly DocumentCaptureRule[];
   /** Retention of the document rows, in the entity's own retention vocabulary. */
   readonly retention?: EntityDefinition["retention"];
   /** Row-level read rule on the document, AND-ed with the link and file-owner gate. */
   readonly readAccess?: NonNullable<EntityDefinition["access"]>["read"];
+  /**
+   * "anyLink" (default): one readable linked record shows the document. "allLinks": the viewer
+   * must read every record it is linked to, so a link to a shared record (a contact) does not
+   * open a document that also hangs off a record of another team. The file-owner check applies
+   * either way.
+   */
+  readonly linkReadMode?: DocumentLinkReadMode;
   /**
    * Who may use the document handlers. One rule applies to read, write and delete; the split form
    * sets them apart. Default TenantAdmin and TenantMember; a missing delete follows write.
@@ -84,11 +97,14 @@ function resolveAccess(access: AccessRule | DocumentsAccess | undefined): Resolv
   return { read: access.read ?? DEFAULT_DOCUMENT_ACCESS, write, delete: access.delete ?? write };
 }
 
-function categoryOptionLabels(categories: readonly string[]) {
+function categoryOptionLabels(
+  categories: readonly string[],
+  labels: DocumentsFeatureOptions["categoryLabels"],
+) {
   return Object.fromEntries(
     categories.map((category) => [
       `documents:entity:filed-document:field:category:option:${category}`,
-      { en: category, de: category },
+      labels?.[category] ?? { en: category, de: category },
     ]),
   );
 }
@@ -103,6 +119,7 @@ function registerDocuments(
     categories: opts.categories,
     adminRoles: opts.adminRoles ?? DEFAULT_ADMIN_ROLES,
     ...(opts.readAccess !== undefined && { readAccess: opts.readAccess }),
+    ...(opts.linkReadMode !== undefined && { linkReadMode: opts.linkReadMode }),
     ...(opts.retention !== undefined && { retention: opts.retention }),
   });
   const linkEntity = createDocumentLinkEntity(linkTargets);
@@ -123,6 +140,7 @@ function registerDocuments(
       access: access.write,
       description:
         "Files a new document from an uploaded file; it stays invisible to everyone but the admin roles until it is linked to a record.",
+      agent: { risk: "mid" },
     }),
   );
   const writeGuard = createDocumentWriteGuard(executors, opts.adminRoles ?? DEFAULT_ADMIN_ROLES);
@@ -131,6 +149,7 @@ function registerDocuments(
       access: access.write,
       description:
         "Edits a document's title, category and dates from the entity-edit envelope; it does not change what the document is linked to.",
+      agent: { risk: "mid" },
     }),
   );
   r.writeHandler(
@@ -185,7 +204,10 @@ function registerDocuments(
 
   r.screen(createDocumentListScreen(access.read, opts.categories));
   r.translations({
-    keys: { ...DOCUMENTS_FEATURE_I18N, ...categoryOptionLabels(opts.categories) },
+    keys: {
+      ...DOCUMENTS_FEATURE_I18N,
+      ...categoryOptionLabels(opts.categories, opts.categoryLabels),
+    },
   });
 }
 
@@ -193,5 +215,12 @@ export function createDocumentsFeature(opts: DocumentsFeatureOptions) {
   if (opts.expiringWithinDays !== undefined && opts.expiringWithinDays < 0) {
     throw new Error("createDocumentsFeature({ expiringWithinDays }) must not be negative.");
   }
+  for (const category of Object.keys(opts.categoryLabels ?? {})) {
+    if (!opts.categories.includes(category)) {
+      throw new Error(
+        `createDocumentsFeature({ categoryLabels }) names "${category}", which is not in categories.`,
+      );
+    }
+  }
   return defineFeature(DOCUMENTS_FEATURE_NAME, (r) => registerDocuments(r, opts));
 }

package/packages/bundled-features/src/documents/handlers/import.write.ts

@@ -97,7 +97,7 @@ export function createImportDocumentHandler(args: ImportArgs) {
     name: "import",
     schema: importDocumentPayloadSchema,
     access: { roles: [SYSTEM_ROLE] },
-    agent: { expose: false },
+    agent: { expose: false, risk: "high" },
     description:
       "Creates a document with a caller-chosen id from an existing file, links it to the given records and optionally leaves it deleted; a repeat call with the same id changes nothing, and an id already used by another record fails. The document's createdAt is the time of the import; issuedAt carries the business date. Reserved for the system user, meant for data migrations.",
     handler: async (event, ctx) => {

package/packages/bundled-features/src/documents/handlers/link.write.ts

@@ -26,6 +26,7 @@ export function createLinkDocumentHandler(args: LinkHandlerArgs) {
     name: "link",
     schema: documentLinkPayloadSchema,
     access,
+    agent: { risk: "mid" },
     description:
       "Makes a document visible on another record by linking it to that record; the caller must be able to read the document and edit the record.",
     handler: async (event, ctx): Promise<WriteResult<unknown>> => {
@@ -63,6 +64,7 @@ export function createUnlinkDocumentHandler(args: LinkHandlerArgs) {
     name: "unlink",
     schema: documentLinkPayloadSchema,
     access,
+    agent: { risk: "mid" },
     description:
       "Removes a document from a record it was linked to, reporting success when no link existed; the document and its file stay.",
     handler: async (event, ctx): Promise<WriteResult<unknown>> => {

package/packages/bundled-features/src/documents/i18n.ts

@@ -20,6 +20,20 @@ export const DOCUMENTS_FEATURE_I18N: Readonly<Record<string, LocalizedString>> =
   "documents:list.expiry.expiring": { en: "Expiring soon", de: "Läuft bald ab" },
   "documents:list.expiry.valid": { en: "Valid", de: "Gültig" },
   "documents:list.expiry.none": { en: "No expiry date", de: "Ohne Ablaufdatum" },
+  "documents:write:link:title": {
+    en: "Link document to record",
+    de: "Dokument mit Datensatz verknüpfen",
+  },
+  "documents:write:link:field:documentId": { en: "Document", de: "Dokument" },
+  "documents:write:link:field:entityType": { en: "Record type", de: "Datensatztyp" },
+  "documents:write:link:field:entityId": { en: "Record", de: "Datensatz" },
+  "documents:write:unlink:title": {
+    en: "Remove document from record",
+    de: "Dokument von Datensatz lösen",
+  },
+  "documents:write:unlink:field:documentId": { en: "Document", de: "Dokument" },
+  "documents:write:unlink:field:entityType": { en: "Record type", de: "Datensatztyp" },
+  "documents:write:unlink:field:entityId": { en: "Record", de: "Datensatz" },
   "documents.errors.unknown-category": {
     en: "Unknown document category",
     de: "Unbekannte Dokumentenkategorie",

package/packages/bundled-features/src/documents/index.ts

@@ -12,6 +12,7 @@ export {
   EXPIRY_STATES,
   type ExpiryState,
 } from "./constants.ts";
+export type { DocumentLinkReadMode } from "./entity.ts";
 export {
   createDocumentsFeature,
   type DocumentsAccess,

package/packages/bundled-features/src/documents/tab.ts

@@ -1,6 +1,6 @@
 import type { EditRelatedListSection } from "@cosmicdrift/kumiko-framework/engine";
 import type { DashboardStatPanel } from "@cosmicdrift/kumiko-framework/ui-types";
-import { DocumentsQueries } from "./constants.ts";
+import { DOCUMENT_ENTITY, DOCUMENTS_FEATURE_NAME, DocumentsQueries } from "./constants.ts";
 import { forTypeQueryQn } from "./queries/for-record.query.ts";
 
 // "Documents" tab for the edit screen of a link target. The tab id is the same on every screen,
@@ -11,7 +11,7 @@ export function documentsTab(entityType: string): EditRelatedListSection {
     kind: "relatedList",
     title: "documents:tab.title",
     query: forTypeQueryQn(entityType),
-    entity: "documents:document",
+    entity: `${DOCUMENTS_FEATURE_NAME}:${DOCUMENT_ENTITY}`,
     columns: [
       { field: "title", sortable: true },
       { field: "category", sortable: true },

package/packages/bundled-features/src/documents/target-write-check.ts

@@ -18,8 +18,10 @@ function updateHandlerAccessOf(registry: Registry, entityType: string) {
 }
 
 // Linking a document changes what readers of the target see, so it needs what saving the target
-// needs: read visibility, the entity's update handler and its row-level write rule. A target that
-// is not visible answers like a missing one.
+// needs: read visibility, a write gate and its row-level write rule. The gate is the entity's
+// update handler; an entity saved only through custom handlers has none, so its declared write
+// roles stand in, and without either the target stays unlinkable. A target that is not visible
+// answers like a missing one.
 export async function canWriteLinkTarget(
   registry: Registry,
   entityType: string,
@@ -31,7 +33,11 @@ export async function canWriteLinkTarget(
   const entity = registry.getEntity(entityType);
   if (entity === undefined) return false;
   const updateAccess = updateHandlerAccessOf(registry, entityType);
-  if (updateAccess === undefined || !hasAccess(user, updateAccess)) return false;
+  if (updateAccess !== undefined) {
+    if (!hasAccess(user, updateAccess)) return false;
+  } else if (!hasAccess(user, { roles: Object.keys(entity.access?.write ?? {}) })) {
+    return false;
+  }
   const row = await createEntityExecutor(entityType, entity).executor.detail(
     { id: entityId },
     user,

package/packages/bundled-features/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "breaking",
+    "title": "The inbound mail supervisor requires a lock and the dedup anchor is unique",
+    "detail": "`createInboundMailSupervisor` takes a required `lock` (a DistributedLock) instead of an optional one, so only one worker holds the IMAP watch per account; the single-process path without a lock is gone. The unmanaged table store_mail_seen_messages gets a unique index on (account_id, provider_message_id), which the ingest comment always promised; ingest-message already serialized concurrent ingests of one mail with a per-message advisory lock, so the second one reports duplicate.",
+    "migration": "Pass `lock: createDistributedLock(redis, \"kumiko:lock:inbound-mail:watch:\")` to createInboundMailSupervisor. Run `kumiko-schema generate <name>` in each app that mounts inbound-mail-foundation to get the migration for the unique index on store_mail_seen_messages; existing rows must hold no duplicate (account_id, provider_message_id)."
+  },
   {
     "version": "0.394.0",
     "type": "improvement",

package/packages/bundled-features/src/inbound-mail-foundation/entities.ts

@@ -231,6 +231,7 @@ export const syncCursorEntity = createEntity({
 export const seenMessageEntity = createEntity({
   table: "store_mail_seen_messages",
   softDelete: false,
+  indexes: [{ unique: true, columns: ["accountId", "providerMessageId"] }],
   fields: {
     accountId: createTextField({
       required: true,

package/packages/bundled-features/src/inbound-mail-foundation/watch-lease.ts

@@ -10,7 +10,7 @@ export type WatchLease = {
 // The cross-worker claim on one account's watch: acquired before plugin.watch(), renewed by a
 // heartbeat for as long as the watcher state exists, and given up locally once it is lost.
 export function createWatchLease(deps: {
-  readonly lock: DistributedLock | undefined;
+  readonly lock: DistributedLock;
   readonly ttlSeconds: number;
   readonly renewIntervalMs: number;
   readonly watchers: ReadonlyMap<string, WatcherState>;
@@ -53,7 +53,7 @@ export function createWatchLease(deps: {
   ): Promise<void> {
     state.renewTimer = null;
     // skip: supervisor stopped, generation superseded, or lease already lost — stale timer fire, nothing to renew.
-    if (!isRunning() || state.generation !== generation || !state.lockToken || !lock) return;
+    if (!isRunning() || state.generation !== generation || !state.lockToken) return;
     let renewed: boolean;
     try {
       renewed = await lock.renew(account.id, state.lockToken, ttlSeconds);
@@ -97,7 +97,7 @@ export function createWatchLease(deps: {
     account: MailAccountRecord,
     state: WatcherState,
   ): Promise<WatchLeaseResult> {
-    if (!lock || state.lockToken) return "acquired";
+    if (state.lockToken) return "acquired";
     // A throwing lock (Redis outage) reads as "not claimed": the next tick retries instead of leaving the start flag set.
     const token = await lock.acquire(account.id, { ttlSeconds: ttlSeconds }).catch((err) => {
       log(

package/packages/bundled-features/src/inbound-mail-foundation/watch-supervisor-types.ts

@@ -41,15 +41,15 @@ export type InboundMailSupervisorDeps = {
   /** Coordinates the IMAP watch (not the poll) across worker processes:
    *  before `plugin.watch()`, ensureWatcher claims a TTL lease for the
    *  account via `lock.acquire` and renews it via `lock.renew` while the
-   *  watcher lives. Omit for single-process deployments — every active
-   *  account is watched locally, same as before. */
-  readonly lock?: DistributedLock;
+   *  watcher lives. Required: without it every worker would hold its own
+   *  IDLE connection per account. */
+  readonly lock: DistributedLock;
   /** Access-token lifecycle for OAuth accounts. Defaults to a manager built
    *  from `db` + `providerCtx.secrets`; pass the instance shared with
    *  `createInboundMailConnectRoutes` so a fresh connect primes this cache. */
   readonly oauthTokens?: OAuthAccessTokenManager;
   /** TTL (seconds) for the per-account watch lease. Default 90s, renewed
-   *  every ttl/3. Only used when `lock` is set. */
+   *  every ttl/3. */
   readonly watchLeaseTtlSeconds?: number;
   readonly log?: (line: string) => void;
 };
@@ -62,7 +62,7 @@ export type WatcherState = {
    *  an already stopped watcher. */
   generation: number;
   /** Token from `deps.lock.acquire` while this worker owns the account's
-   *  watch lease; null when unclaimed (no `deps.lock`, or claim lost). */
+   *  watch lease; null when unclaimed (claim lost). */
   lockToken: string | null;
   renewTimer: ReturnType<typeof setTimeout> | null;
   /** Consecutive renew() throws — tear down once failures span a full TTL. */

package/packages/bundled-features/src/inbound-mail-foundation/watch-supervisor.ts

@@ -17,11 +17,9 @@
 //     db,
 //     dispatchWrite: ({ handlerQn, payload, tenantId }) =>
 //       deps.dispatchSystemWrite({ handlerQn, payload, tenantId: tenantId as TenantId }),
-//     // Multi-worker deployments: share one DistributedLock (same Redis,
-//     // same key prefix) across every worker process so only one of them
-//     // holds the IMAP IDLE connection per account. Omit `lock`
-//     // for a single-process deployment — every active account gets
-//     // watched locally, as before.
+//     // One DistributedLock (same Redis, same key prefix) shared across
+//     // every worker process, so only one of them holds the IMAP IDLE
+//     // connection per account.
 //     lock: createDistributedLock(redis, `${RedisKeys.lock}inbound-mail:watch:`),
 //   });
 //   await supervisor.start();
@@ -34,7 +32,7 @@
 // **Multi-worker coordination:** the reconciliation poll remains deliberately
 // N-fold: every worker polls every active account, which is idempotent and
 // cheap. Only `plugin.watch()` holds a long-lived connection, and only one
-// worker may hold it per account. With `deps.lock`, `ensureWatcher` claims a
+// worker may hold it per account. `ensureWatcher` claims a
 // TTL lease (`lock.acquire`) before connecting; a worker that fails to claim
 // it leaves the account to its current holder, while the poll still covers
 // it. The holder renews the lease via heartbeat (`lock.renew`, every ttl/3)
@@ -435,7 +433,7 @@ export function createInboundMailSupervisor(
         log(`inbound-mail: stop watcher ${accountId} failed: ${describeError(err)}`);
       }
     }
-    if (deps.lock && lockToken) {
+    if (lockToken) {
       try {
         await deps.lock.release(accountId, lockToken);
       } catch (err) {

package/packages/bundled-features/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "The public render caches a sanitized document body per page version",
+    "detail": "The render cache holds up to 500 entries keyed on tenant, slug, language, version and format. Bodies larger than 256 KB are sanitized on every render and not cached."
+  },
   {
     "version": "0.395.0",
     "type": "breaking",

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -263,7 +263,15 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
 
         const html = wrapLayout({
           title: data.title,
-          bodyHtml: renderPageBody({ slug, body: data.body, bodyFormat: data.bodyFormat }),
+          bodyHtml: renderPageBody({
+            tenantId,
+            slug,
+            lang,
+            version: data.version,
+            updatedAt: data.updatedAt,
+            body: data.body,
+            bodyFormat: data.bodyFormat,
+          }),
           lang: data.lang,
           slug,
           description: data.description,

package/packages/bundled-features/src/managed-pages/render-page-body.ts

@@ -7,22 +7,76 @@ type WarnLogger = Pick<Logger, "warn">;
 
 const defaultLog = createFallbackLogger("managed-pages");
 
+const MAX_CACHED_BODIES = 500;
+// Bounds the cache memory: 500 entries of arbitrary size could otherwise pin
+// hundreds of MB. A bigger body is still served, just re-rendered per request.
+const MAX_CACHED_BODY_LENGTH = 256 * 1024;
+
 export type RenderablePageBody = {
+  readonly tenantId: string;
   readonly slug: string;
+  readonly lang: string;
+  readonly version: number;
+  readonly updatedAt: string;
   readonly body: string;
   readonly bodyFormat: BodyFormat;
 };
 
-// A document body is re-sanitized at render time even though writes validate it:
-// rows can predate the validation or arrive through other writers. A rejected
-// document renders as an empty body (never the raw HTML) and is logged.
-export function renderPageBody(page: RenderablePageBody, log: WarnLogger = defaultLog): string {
-  if (page.bodyFormat === "markdown") return renderSafeMarkdown(page.body);
-  const result = sanitizeDocumentHtml(page.body);
-  if (result.ok) return result.html;
-  log.warn("managed page document body rejected at render, serving an empty body", {
-    slug: page.slug,
-    violations: result.violations.map((violation) => violation.code),
-  });
-  return "";
+export type PageBodyRendererDeps = {
+  readonly sanitizeDocument?: typeof sanitizeDocumentHtml;
+  readonly renderMarkdown?: (markdown: string) => string;
+  readonly maxEntries?: number;
+};
+
+// Every write bumps the version, so a (page, version) key never serves stale
+// HTML. A Map keeps insertion order: delete+reinsert on a hit makes the first
+// key the least recently used one.
+function cacheKeyOf(page: RenderablePageBody): string {
+  return [page.tenantId, page.slug, page.lang, page.version, page.updatedAt, page.bodyFormat].join(
+    "\u0000",
+  );
+}
+
+// Writes store the rebuilt, sanitized HTML, but rows can predate that validation
+// or arrive through other writers, so a render still sanitizes — once per page
+// version instead of once per request. A rejected document renders as an empty
+// body (never the raw HTML), is logged on the miss, and the empty result is cached.
+export function createPageBodyRenderer(
+  deps: PageBodyRendererDeps = {},
+): (page: RenderablePageBody, log?: WarnLogger) => string {
+  const sanitizeDocument = deps.sanitizeDocument ?? sanitizeDocumentHtml;
+  const renderMarkdown = deps.renderMarkdown ?? renderSafeMarkdown;
+  const maxEntries = deps.maxEntries ?? MAX_CACHED_BODIES;
+  const cache = new Map<string, string>();
+
+  function renderUncached(page: RenderablePageBody, log: WarnLogger): string {
+    if (page.bodyFormat === "markdown") return renderMarkdown(page.body);
+    const result = sanitizeDocument(page.body);
+    if (result.ok) return result.html;
+    log.warn("managed page document body rejected at render, serving an empty body", {
+      slug: page.slug,
+      violations: result.violations.map((violation) => violation.code),
+    });
+    return "";
+  }
+
+  return (page, log = defaultLog) => {
+    const key = cacheKeyOf(page);
+    const cached = cache.get(key);
+    if (cached !== undefined) {
+      cache.delete(key);
+      cache.set(key, cached);
+      return cached;
+    }
+    const html = renderUncached(page, log);
+    if (html.length > MAX_CACHED_BODY_LENGTH) return html;
+    cache.set(key, html);
+    if (cache.size > maxEntries) {
+      const oldest = cache.keys().next();
+      if (!oldest.done) cache.delete(oldest.value);
+    }
+    return html;
+  };
 }
+
+export const renderPageBody = createPageBodyRenderer();

package/packages/bundled-features/src/managed-pages/screens/branding-screen.ts

@@ -65,7 +65,7 @@ export function createBrandingSettingsScreen(opts: {
         reason: "is_business_data",
       }),
       logoFile: createImageField({
-        accept: ["image/png", "image/jpeg", "image/webp"],
+        accept: ["png", "jpg", "jpeg", "webp"],
         personal: false,
         reason: "is_business_data",
       }),

package/packages/bundled-features/src/managed-pages/web/i18n.ts

@@ -57,11 +57,10 @@ export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
   "managed-pages:body.lossy.warning": {
     en: "This page was written in Markdown. Converting it to the editor drops: {features}. Check the result before saving.",
   },
-  "managed-pages:body.lossy.image": { en: "images" },
+  "managed-pages:body.lossy.image": { en: "external images" },
   "managed-pages:body.lossy.blockquote": { en: "block quotes" },
   "managed-pages:body.lossy.code": { en: "code" },
   "managed-pages:body.lossy.deepHeading": { en: "headings below level 3" },
-  "managed-pages:body.lossy.relativeLink": { en: "relative links" },
 
   // Row-Actions + Confirm (pageListScreen)
   "managed-pages:actions.edit": { en: "Edit" },

package/packages/bundled-features/src/managed-pages/web/lossy-markdown.ts

@@ -1,18 +1,9 @@
-import { isAllowedDocumentLinkHref } from "@cosmicdrift/kumiko-bundled-features/template-resolver/document-schema";
 import { Lexer, type Token } from "marked";
 
-export const LOSSY_MARKDOWN_FEATURES = [
-  "image",
-  "blockquote",
-  "code",
-  "deepHeading",
-  "relativeLink",
-] as const;
+export const LOSSY_MARKDOWN_FEATURES = ["image", "blockquote", "code", "deepHeading"] as const;
 export type LossyMarkdownFeature = (typeof LOSSY_MARKDOWN_FEATURES)[number];
 
-// The document editor has no image, quote or code nodes, only three heading
-// levels, and links must pass the document link policy (absolute http(s),
-// mailto, tel, placeholders).
+// The document editor has no image, quote or code nodes and only three heading levels.
 const MAX_DOCUMENT_HEADING_DEPTH = 3;
 
 function tokenList(value: unknown): readonly Token[] {
@@ -31,12 +22,6 @@ function isDeepHeading(token: Token): boolean {
   );
 }
 
-function isRelativeLink(token: Token): boolean {
-  return (
-    "href" in token && typeof token.href === "string" && !isAllowedDocumentLinkHref(token.href)
-  );
-}
-
 function featuresOf(token: Token): readonly LossyMarkdownFeature[] {
   switch (token.type) {
     case "image":
@@ -48,8 +33,6 @@ function featuresOf(token: Token): readonly LossyMarkdownFeature[] {
       return ["code"];
     case "heading":
       return isDeepHeading(token) ? ["deepHeading"] : [];
-    case "link":
-      return isRelativeLink(token) ? ["relativeLink"] : [];
     default:
       return [];
   }

package/packages/bundled-features/src/managed-pages/web/markdown-to-document.ts

@@ -3,8 +3,8 @@ import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
 import { Marked } from "marked";
 
 // The server sanitizer rejects what it cannot keep, so the conversion drops it up front and the
-// lossy banner stays true: a link outside the document link policy keeps its text, an image
-// (no uploaded resource to point at) is dropped, and raw HTML is shown as text.
+// lossy banner stays true: a link outside the document link policy keeps its text, an external
+// image (no uploaded resource to point at) is dropped, and raw HTML is shown as text.
 const converter = new Marked({ gfm: false, breaks: false });
 converter.use({
   renderer: {

package/packages/bundled-features/src/managed-pages/web/page-body-section.tsx

@@ -14,7 +14,6 @@ const LOSSY_LABEL_KEYS: Readonly<Record<LossyMarkdownFeature, string>> = {
   blockquote: "managed-pages:body.lossy.blockquote",
   code: "managed-pages:body.lossy.code",
   deepHeading: "managed-pages:body.lossy.deepHeading",
-  relativeLink: "managed-pages:body.lossy.relativeLink",
 };
 
 const BODY_EDITOR_ID = "managed-pages-page-body";

package/packages/bundled-features/src/readiness/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "fix",
+    "title": "System-check history keeps runs of the same second in order",
+    "detail": "`probe-run:list` returned `requestedAt` as `Instant.toString()`, which drops trailing zeros in the fraction, and `pageRows` sorts that field as a string. Two runs in the same second could then come out reversed (`…:20Z` sorted after `…:20.001Z`), so the history showed the older run on top and a click opened it. `requestedAt` now always carries six fractional digits, so string order matches time order."
+  },
   {
     "version": "0.392.0",
     "type": "improvement",

package/packages/bundled-features/src/readiness/handlers/run-list.query.ts

@@ -29,7 +29,8 @@ export const runListQuery = defineQueryHandler({
       const { counts, outcome } = viewRun(run, query.user);
       return {
         id: run.id,
-        requestedAt: run.requestedAt.toString(),
+        // Fixed width: pageRows sorts this as a string, and a trimmed fraction ("…20Z" vs "…20.001Z") sorts wrong.
+        requestedAt: run.requestedAt.toString({ fractionalSecondDigits: 6 }),
         triggeredByUserId: run.triggeredByUserId,
         triggeredByName: starterNames.get(run.triggeredByUserId) ?? run.triggeredByUserId,
         status: run.status,

package/packages/bundled-features/src/readiness/run-view.ts

@@ -1,5 +1,6 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { PROBE_RUN_STATUS, probeRunsTable } from "./schema/probe-run.ts";
 import {
   countResults,
@@ -10,14 +11,12 @@ import {
   visibleResults,
 } from "./visible-results.ts";
 
-type InstantLike = { readonly toString: () => string };
-
 export type RunRow = {
   readonly id: string;
   readonly status: string;
-  readonly requestedAt: InstantLike;
-  readonly startedAt: InstantLike | null;
-  readonly finishedAt: InstantLike | null;
+  readonly requestedAt: Temporal.Instant;
+  readonly startedAt: Temporal.Instant | null;
+  readonly finishedAt: Temporal.Instant | null;
   readonly triggeredByUserId: string;
   readonly durationMs: number | null;
   readonly results: unknown;

package/packages/bundled-features/src/template-resolver/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Document anchors accept relative links",
+    "detail": "An anchor href in a document body may be relative (/path, ./, ../, #, ?); never // or a backslash. Other URL attributes (image src and similar) and mail links still accept only explicit schemes or placeholders. The sanitizer, the editor schema, compileDocumentBody and the confirmation mail use the same split."
+  },
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Collection nav takes entryLabel for the create title",
+    "detail": "A collection's nav takes an optional entryLabel (singular i18n key, new in the nav type and in the required surface keys of all locale packages). The create screen title reads \"New {label}\", or \"New entry\" without it."
+  },
   {
     "version": "0.395.0",
     "type": "breaking",

package/packages/bundled-features/src/template-resolver/compile-document-body.ts

@@ -7,7 +7,7 @@ import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.
 import {
   DOCUMENT_CONDITION_ATTRIBUTE,
   DOCUMENT_TEXT_ALIGNMENTS,
-  isAllowedDocumentLinkHref,
+  isAllowedDocumentUrlHref,
   isDocumentPlaceholderHref,
   isDocumentReferenceName,
   isDocumentResourceKey,
@@ -170,7 +170,7 @@ function rewriteLink(element: ScanElement, state: CompileState): void {
     } else {
       element.setAttribute("href", "#");
     }
-  } else if (!isAllowedDocumentLinkHref(href)) {
+  } else if (!isAllowedDocumentUrlHref(href)) {
     element.setAttribute("href", "#");
   }
 }

package/packages/bundled-features/src/template-resolver/document-sanitizer.ts

@@ -11,6 +11,7 @@ import {
   DOCUMENT_CONDITION_ATTRIBUTE,
   documentExtensions,
   isAllowedDocumentLinkHref,
+  isAllowedDocumentUrlHref,
   isDocumentPlaceholderHref,
   isDocumentReferenceName,
   isDocumentResourceKey,
@@ -101,7 +102,7 @@ function scanAnchor(element: ScanElement, out: DocumentViolation[]): void {
       violation(
         "disallowed_link_href",
         href,
-        `Link target "${href}" is not allowed; use https, http, mailto, tel or a {{placeholder}}`,
+        `Link target "${href}" is not allowed; use https, http, mailto, tel, a relative path or a {{placeholder}}`,
       ),
     );
   }
@@ -197,7 +198,7 @@ function scanUrlAttributes(tag: string, element: ScanElement, out: DocumentViola
           `Images must reference an uploaded resource via data-resource; image source "${value}" is not allowed`,
         ),
       );
-    } else if (tag === "base" || !isAllowedDocumentLinkHref(value)) {
+    } else if (tag === "base" || !isAllowedDocumentUrlHref(value)) {
       out.push(
         violation(
           "disallowed_link_href",