@cosmicdrift/kumiko-types 0.358.0 → 0.360.0

package/dist/config.d.ts

@@ -145,6 +145,7 @@ export type JobTrigger = {
     readonly where?: Readonly<Record<string, string | number | boolean>>;
 } | {
     readonly cron: string;
+    readonly tz?: string;
 } | {
     readonly manual: true;
 };

package/dist/fields.d.ts

@@ -641,6 +641,9 @@ export type ImagesFieldDef = {
     readonly accept?: readonly string[];
     readonly maxCount?: number;
     readonly variants?: Readonly<Record<string, VariantSpec>>;
+    /** Forwarded to the file input's `capture` attribute so a phone opens the
+     *  camera instead of the file picker. */
+    readonly capture?: "environment" | "user";
     readonly access?: FieldAccess;
 } & ResolvedPiiFlags;
 export type FieldDefinition = TextFieldDef | LongTextFieldDef | BooleanFieldDef | SelectFieldDef | MultiSelectFieldDef | NumberFieldDef | BigIntFieldDef | DecimalFieldDef | MoneyFieldDef | ReferenceFieldDef | EmbeddedFieldDef | JsonbFieldDef | DateFieldDef | TimestampFieldDef | TzFieldDef | LocatedTimestampFieldDef | FileFieldDef | ImageFieldDef | FilesFieldDef | ImagesFieldDef;

package/dist/fields.js

@@ -52,9 +52,4 @@ export const FIELD_TYPE_NAMES = Object.keys(FIELD_TYPE_NAME_FLAGS);
 // A plain array, not a Set: kumiko-types stays free of module-scope runtime
 // identity (guard-types-class-free.test.ts) since a consumer may resolve two
 // copies of this package.
-export const NO_WIDGET_FIELD_TYPES = [
-    "jsonb",
-    "embedded",
-    "files",
-    "images",
-];
+export const NO_WIDGET_FIELD_TYPES = ["jsonb", "embedded"];

package/dist/screen.d.ts

@@ -1340,6 +1340,9 @@ export type ActionFormScreenDefinition = {
     readonly fallback?: string;
     /** Derived by buildAppSchema — see EntityEditScreenDefinition.urlPrefillFields. */
     readonly urlPrefillFields?: readonly string[];
+    /** Derived by buildAppSchema from the `excludedFields` of the called `handler`; the form
+     *  shows these fields read-only, not required and never in the payload. An authored value is overwritten. */
+    readonly writeExcludedFields?: readonly string[];
     /** Submit is enabled without edits: values seeded from navigate `params` count as the
      *  user's intent. Every required field the layout hides with `visible: false` must hold a
      *  value, otherwise submit stays disabled (boot-checked against navigate `params`). */

package/dist/session-cookies.d.ts

@@ -0,0 +1,20 @@
+export declare const AUTH_COOKIE_BASE = "kumiko_auth";
+export declare const CSRF_COOKIE_BASE = "kumiko_csrf";
+export declare const TENANT_COOKIE_BASE = "kumiko_tenant";
+export declare const HOST_COOKIE_PREFIX = "__Host-";
+export type SessionCookieBase = typeof AUTH_COOKIE_BASE | typeof CSRF_COOKIE_BASE | typeof TENANT_COOKIE_BASE;
+export type SessionCookieNames = {
+    readonly auth: string;
+    readonly csrf: string;
+    readonly tenant: string;
+};
+export declare function sessionCookieName(base: SessionCookieBase, options: {
+    readonly secure: boolean;
+    readonly domain?: string | undefined;
+}): string;
+export declare function isHostPrefixedCookieName(name: string): boolean;
+export declare function resolveSessionCookieNames(options: {
+    readonly secure: boolean;
+    readonly domain?: string | undefined;
+}): SessionCookieNames;
+export declare function sessionCookieNameCandidates(base: SessionCookieBase): readonly string[];

package/dist/session-cookies.js

@@ -0,0 +1,31 @@
+// Single source of the session cookie names, shared by the server and by
+// browser/native clients (this package has no server dependencies).
+//
+// A cookie gets the `__Host-` prefix exactly when it is written Secure and
+// without a Domain attribute: the browser then refuses any Set-Cookie for that
+// name that is not Secure, Path=/ and host-only, so a sibling subdomain cannot
+// set or shadow it.
+export const AUTH_COOKIE_BASE = "kumiko_auth";
+export const CSRF_COOKIE_BASE = "kumiko_csrf";
+export const TENANT_COOKIE_BASE = "kumiko_tenant";
+export const HOST_COOKIE_PREFIX = "__Host-";
+export function sessionCookieName(base, options) {
+    return options.secure && options.domain === undefined ? `${HOST_COOKIE_PREFIX}${base}` : base;
+}
+export function isHostPrefixedCookieName(name) {
+    return name.startsWith(HOST_COOKIE_PREFIX);
+}
+// The tenant cookie is always host-only, so a cookieDomain only affects the
+// auth and csrf names.
+export function resolveSessionCookieNames(options) {
+    return {
+        auth: sessionCookieName(AUTH_COOKIE_BASE, options),
+        csrf: sessionCookieName(CSRF_COOKIE_BASE, options),
+        tenant: sessionCookieName(TENANT_COOKIE_BASE, { secure: options.secure }),
+    };
+}
+// Browser-side candidates, preferred first. The client cannot know the server
+// config; when both cookies exist the prefixed one is the trustworthy one.
+export function sessionCookieNameCandidates(base) {
+    return [sessionCookieName(base, { secure: true }), sessionCookieName(base, { secure: false })];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.358.0",
+  "version": "0.360.0",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -26,6 +26,10 @@
       "types": "./dist/identifiers.d.ts",
       "default": "./dist/identifiers.js"
     },
+    "./session-cookies": {
+      "types": "./dist/session-cookies.d.ts",
+      "default": "./dist/session-cookies.js"
+    },
     "./target-ref": {
       "types": "./dist/target-ref.d.ts",
       "default": "./dist/target-ref.js"
@@ -293,6 +297,10 @@
         "types": "./dist/identifiers.d.ts",
         "default": "./dist/identifiers.js"
       },
+      "./session-cookies": {
+        "types": "./dist/session-cookies.d.ts",
+        "default": "./dist/session-cookies.js"
+      },
       "./target-ref": {
         "types": "./dist/target-ref.d.ts",
         "default": "./dist/target-ref.js"