@saasicat/ui-vue 0.2.0

package/src/testing-e2e/admin-pages-suite.ts

@@ -0,0 +1,187 @@
+// Shared E2E test skeleton for the SuperAdmin UI pages.
+//
+// App-specific specs (the consumer admins' `tests-e2e/`) pass their
+// configuration through via `runAdminPagesSuite(config)` — the suite then
+// clicks through login + all declared standard pages and checks for each:
+//   - no pageerror events
+//   - no console.error events (except whitelisted)
+//   - no HTTP 4xx/5xx on `/api/` calls (except whitelisted)
+//
+// Plus a dashboard test that asserts the KPI card labels, distribution headers
+// and shortcut titles against a declarative list.
+//
+// `import { test, expect } from '@playwright/test'` must be imported by the
+// consumer so that Playwright's test runner finds the `test` calls.
+
+import type { Page, expect as PwExpect, test as PwTest } from '@playwright/test';
+
+export interface AdminPagesSuiteConfig {
+    /** Display name, e.g. 'demoapp' / 'clubapp'. */
+    appName: string;
+    /** URL of the login page (full). */
+    loginUrl: string;
+    /** Test account. */
+    email: string;
+    password: string;
+    /** Paths the smoke test should click through. */
+    pages: ReadonlyArray<{
+        /** Display name in the test description. */
+        name: string;
+        /** Path relative to the origin (e.g. '/admin/tenants'). */
+        path: string;
+        /** Optional: if set, check that this selector exists. */
+        expectVisible?: string;
+        /** Optional: HTTP patterns that are OK as 4xx/5xx (e.g. missing backend endpoints). */
+        allowedFailures?: readonly RegExp[];
+    }>;
+    /** Expected KPI card labels on the dashboard page. */
+    expectedKpiLabels: readonly string[];
+    /** Expected distribution section titles. */
+    expectedDistributionTitles?: readonly string[];
+    /** Expected shortcut titles on the dashboard. */
+    expectedShortcutTitles: readonly string[];
+    /** Shortcuts that must NOT appear (e.g. "Dashboard"). */
+    forbiddenShortcutTitles?: readonly string[];
+    /** Console error patterns that should be ignored. */
+    consoleErrorAllowlist?: readonly RegExp[];
+    /** Path to the dashboard page (default `/admin/`). */
+    dashboardPath?: string;
+}
+
+interface PageErrors {
+    pageErrors: string[];
+    consoleErrors: string[];
+    networkErrors: string[];
+}
+
+// "Failed to load resource: the server responded with a status of …" is
+// duplicated by the browser with the separately captured network errors. We
+// don't treat it as a standalone console.error — otherwise every 404 counts
+// twice and the signal from real app code gets lost in the noise.
+const RESOURCE_FAILURE_MARKER = /Failed to load resource:/;
+
+function attachListeners(
+    page: Page,
+    consoleAllowlist: readonly RegExp[] = [],
+    networkAllowlist: readonly RegExp[] = [],
+): PageErrors {
+    const out: PageErrors = { pageErrors: [], consoleErrors: [], networkErrors: [] };
+    page.on('pageerror', (err) => out.pageErrors.push(err.message));
+    page.on('console', (msg) => {
+        if (msg.type() !== 'error') return;
+        const text = msg.text();
+        if (RESOURCE_FAILURE_MARKER.test(text)) return;
+        if (consoleAllowlist.some((re) => re.test(text))) return;
+        out.consoleErrors.push(text);
+    });
+    page.on('response', (resp) => {
+        if (resp.status() < 400) return;
+        const url = resp.url();
+        if (!url.includes('/api/')) return;
+        if (networkAllowlist.some((re) => re.test(url))) return;
+        out.networkErrors.push(`HTTP ${resp.status()} ${url}`);
+    });
+    return out;
+}
+
+async function loginIfNeeded(page: Page, config: AdminPagesSuiteConfig): Promise<void> {
+    if (!page.url().includes('/login')) {
+        await page.goto(config.loginUrl, { waitUntil: 'networkidle' });
+    }
+    if (!page.url().includes('/login')) return; // already logged in
+    await page.locator('input[type="email"]').first().fill(config.email);
+    const pw = page.locator('input[type="password"]').first();
+    await pw.fill(config.password);
+    // Enter triggers q-form @submit more reliably than a button click (Quasar
+    // unifies form submit on the submit event, not on the button).
+    await pw.press('Enter');
+    await page.waitForURL((u) => !u.toString().includes('/login'), {
+        timeout: 15_000,
+    });
+}
+
+export function runAdminPagesSuite(
+    test: typeof PwTest,
+    expect: typeof PwExpect,
+    config: AdminPagesSuiteConfig,
+): void {
+    const dashboardPath = config.dashboardPath ?? '/admin/';
+
+    test.describe(`${config.appName}: SuperAdmin-Pages Smoke`, () => {
+        for (const pageDef of config.pages) {
+            test(`${pageDef.name} rendert ohne Fehler`, async ({ page }) => {
+                const errors = attachListeners(
+                    page,
+                    config.consoleErrorAllowlist,
+                    pageDef.allowedFailures,
+                );
+                await loginIfNeeded(page, config);
+                const origin = new URL(config.loginUrl).origin;
+                await page.goto(`${origin}${pageDef.path}`, {
+                    waitUntil: 'networkidle',
+                    timeout: 15_000,
+                });
+                await page.waitForTimeout(800);
+                if (pageDef.expectVisible) {
+                    await expect(page.locator(pageDef.expectVisible).first()).toBeVisible({
+                        timeout: 5_000,
+                    });
+                }
+                expect(errors.pageErrors, `pageerror-Events auf ${pageDef.path}`).toHaveLength(0);
+                expect(
+                    errors.consoleErrors,
+                    `console.error-Events auf ${pageDef.path}`,
+                ).toHaveLength(0);
+                expect(
+                    errors.networkErrors,
+                    `HTTP-Errors auf /api/ während ${pageDef.path}`,
+                ).toHaveLength(0);
+            });
+        }
+
+        test('Dashboard zeigt erwartete KPIs, Distributions und Shortcuts', async ({ page }) => {
+            attachListeners(page, config.consoleErrorAllowlist);
+            await loginIfNeeded(page, config);
+            const origin = new URL(config.loginUrl).origin;
+            await page.goto(`${origin}${dashboardPath}`, {
+                waitUntil: 'networkidle',
+                timeout: 15_000,
+            });
+            // KPI strip: platform CSS class `.sa-kpi__label`
+            const kpiLabels = await page.locator('.sa-kpi__label').allTextContents();
+            const normalizedKpis = kpiLabels.map((s) => s.trim());
+            for (const expected of config.expectedKpiLabels) {
+                expect(normalizedKpis, `KPI '${expected}' fehlt auf Dashboard`).toContain(expected);
+            }
+
+            if (config.expectedDistributionTitles?.length) {
+                const distTitles = await page
+                    .locator('.sa-dashboard__row-head h2')
+                    .allTextContents();
+                const normalizedDist = distTitles.map((s) => s.trim());
+                for (const expected of config.expectedDistributionTitles) {
+                    expect(
+                        normalizedDist,
+                        `Distribution '${expected}' fehlt auf Dashboard`,
+                    ).toContain(expected);
+                }
+            }
+
+            const shortcutTitles = await page
+                .locator('.sa-dashboard__shortcut-title')
+                .allTextContents();
+            const normalizedShortcuts = shortcutTitles.map((s) => s.trim());
+            for (const expected of config.expectedShortcutTitles) {
+                expect(normalizedShortcuts, `Shortcut '${expected}' fehlt auf Dashboard`).toContain(
+                    expected,
+                );
+            }
+            for (const forbidden of config.forbiddenShortcutTitles ?? []) {
+                expect(
+                    normalizedShortcuts,
+                    `Shortcut '${forbidden}' darf nicht auf Dashboard sein`,
+                ).not.toContain(forbidden);
+            }
+        });
+    });
+}

package/src/types.ts

@@ -0,0 +1,58 @@
+// Shared configuration types for all UI-Vue loaders/composables.
+
+/**
+ * Minimal abstraction over `fetch`. Consumers may pass their own
+ * implementation (e.g. an axios wrapper that already injects auth headers
+ * and tenant headers).
+ */
+export type HttpClient = (
+    url: string,
+    init?: {
+        method?: string;
+        headers?: Record<string, string>;
+        body?: string;
+    },
+) => Promise<HttpResponse>;
+
+export interface HttpResponse {
+    status: number;
+    headers: { get(name: string): string | null };
+    json(): Promise<unknown>;
+    text(): Promise<string>;
+}
+
+/** Simple persistence adapter; default is `localStorage`. */
+export interface KvStore {
+    get(key: string): string | null;
+    set(key: string, value: string): void;
+    remove(key: string): void;
+}
+
+/**
+ * Returns a `KvStore` wrapper around `localStorage` (or `null` under SSR).
+ * Tests may pass an in-memory stub.
+ */
+export function defaultKvStore(): KvStore {
+    if (typeof globalThis.localStorage === 'undefined') {
+        // SSR / non-browser → no-op stub.
+        return {
+            get: () => null,
+            set: () => {},
+            remove: () => {},
+        };
+    }
+    const ls = globalThis.localStorage;
+    return {
+        get: (k) => ls.getItem(k),
+        set: (k, v) => ls.setItem(k, v),
+        remove: (k) => ls.removeItem(k),
+    };
+}
+
+/**
+ * Default `HttpClient` over `fetch`. Consumers pass their own variant
+ * through when they need auth headers / tenant headers / retry logic.
+ */
+export function defaultHttpClient(): HttpClient {
+    return (url, init) => fetch(url, init);
+}

package/src/use-actions.ts

@@ -0,0 +1,25 @@
+// useActions — Vue 3 composable over ActionRegistry.
+//
+// Wraps a reactive `Ref<AdminManifest | null>` and a static
+// `actions:` map (consumer shell build) and returns a reactive
+// registry object that is automatically rebuilt as soon as the
+// manifest changes (e.g. after `manifest reload`).
+
+import { computed, type ComputedRef, type Ref } from 'vue';
+import type { AdminManifest } from '@saasicat/types';
+import { ActionRegistry, type ActionHandler } from './action-registry.js';
+
+export interface UseActionsResult {
+    registry: ComputedRef<ActionRegistry | null>;
+}
+
+export function useActions(
+    manifest: Ref<AdminManifest | null>,
+    actions: Record<string, ActionHandler>,
+): UseActionsResult {
+    const registry = computed<ActionRegistry | null>(() => {
+        if (!manifest.value) return null;
+        return new ActionRegistry(manifest.value, actions);
+    });
+    return { registry };
+}

package/src/use-api-list.ts

@@ -0,0 +1,151 @@
+// useApiList — generic reactive list composable with filter + pagination.
+//
+// Consumer components ($-table, $-list, …) consume the typed wrappers
+// (`useTenants`, `useAuditEntries`, …), which are based on `useApiList`.
+// Direct use is also allowed for custom endpoints.
+
+import { ref, watch, type Ref } from 'vue';
+import { defaultHttpClient, type HttpClient } from './types.js';
+
+export interface ApiListResponse<T> {
+    items: T[];
+    page?: number;
+    pageSize?: number;
+    total?: number;
+}
+
+export interface UseApiListOptions<TFilter> {
+    endpoint: string;
+    /**
+     * Reactive filter object. The composable serializes it into `?key=value`
+     * pairs (with URL encoding); empty/null values are omitted.
+     */
+    filter?: Ref<TFilter>;
+    http?: HttpClient;
+    getAuthToken?: () => string | null;
+    /**
+     * When `true`, loads automatically on mount. Defaults to `true`.
+     * Set to `false` when the consumer wants to trigger the first load
+     * explicitly (e.g. after auth-state init).
+     */
+    autoLoad?: boolean;
+}
+
+export interface UseApiListResult<T> {
+    items: Ref<T[]>;
+    page: Ref<number>;
+    pageSize: Ref<number>;
+    total: Ref<number>;
+    loading: Ref<boolean>;
+    error: Ref<Error | null>;
+    /** Reloads fresh (e.g. after a mutation). */
+    reload: () => Promise<void>;
+    /** Jumps to a specific page (1-based) and loads. */
+    goToPage: (page: number) => Promise<void>;
+    /** Changes the page size and jumps to page 1. */
+    setPageSize: (size: number) => Promise<void>;
+}
+
+export function useApiList<T, TFilter extends Record<string, unknown> = Record<string, unknown>>(
+    options: UseApiListOptions<TFilter>,
+): UseApiListResult<T> {
+    const http = options.http ?? defaultHttpClient();
+    const items = ref<T[]>([]) as Ref<T[]>;
+    const page = ref(1);
+    const pageSize = ref(50);
+    const total = ref(0);
+    const loading = ref(false);
+    const error = ref<Error | null>(null);
+
+    function buildUrl(): string {
+        const params = new URLSearchParams();
+        params.set('page', String(page.value));
+        params.set('pageSize', String(pageSize.value));
+        const f = options.filter?.value ?? ({} as TFilter);
+        for (const [k, v] of Object.entries(f)) {
+            if (v === undefined || v === null || v === '') continue;
+            params.set(k, String(v));
+        }
+        const sep = options.endpoint.includes('?') ? '&' : '?';
+        return `${options.endpoint}${sep}${params.toString()}`;
+    }
+
+    async function load() {
+        loading.value = true;
+        error.value = null;
+        try {
+            const headers: Record<string, string> = {};
+            const token = options.getAuthToken?.();
+            if (token) headers.Authorization = `Bearer ${token}`;
+            const res = await http(buildUrl(), { method: 'GET', headers });
+            if (res.status !== 200) {
+                throw new Error(`Endpoint ${options.endpoint} → HTTP ${res.status}`);
+            }
+            // Apps deliver different shapes for list endpoints:
+            //   - raw array `[{...}, …]` (no wrapper).
+            //   - paginated: `{ items, total, page, pageSize }`.
+            // The platform composable accepts both — otherwise correctly
+            // delivered array responses would be shown as an empty list.
+            const raw = (await res.json()) as unknown;
+            if (Array.isArray(raw)) {
+                items.value = raw as T[];
+                total.value = raw.length;
+            } else if (raw !== null && typeof raw === 'object') {
+                const body = raw as ApiListResponse<T>;
+                items.value = body.items ?? [];
+                if (typeof body.page === 'number') page.value = body.page;
+                if (typeof body.pageSize === 'number') pageSize.value = body.pageSize;
+                if (typeof body.total === 'number') total.value = body.total;
+            } else {
+                items.value = [];
+                total.value = 0;
+            }
+        } catch (err) {
+            error.value = err instanceof Error ? err : new Error(String(err));
+            items.value = [];
+            total.value = 0;
+        } finally {
+            loading.value = false;
+        }
+    }
+
+    async function goToPage(p: number) {
+        page.value = Math.max(1, Math.floor(p));
+        await load();
+    }
+
+    async function setPageSize(size: number) {
+        pageSize.value = Math.max(1, Math.floor(size));
+        page.value = 1;
+        await load();
+    }
+
+    if (options.filter) {
+        watch(
+            options.filter,
+            () => {
+                page.value = 1;
+                void load();
+            },
+            { deep: true },
+        );
+    }
+
+    if (options.autoLoad !== false) {
+        // One microtask later, so the composable does not block `setup()`
+        // during the initial sync phase.
+        Promise.resolve().then(() => void load());
+    }
+
+    return {
+        items,
+        page,
+        pageSize,
+        total,
+        loading,
+        error,
+        reload: load,
+        goToPage,
+        setPageSize,
+    };
+}

package/src/use-audit-entries.ts

@@ -0,0 +1,48 @@
+// useAuditEntries — Vue composable over the admin audit endpoint.
+//
+// **The endpoint is mandatory** and is supplied by the consuming app
+// (e.g. `/api/admin/audit` or `/api/v1/admin/audit`).
+//
+// The consumer backend exposes the endpoint via an `AuditQueryPort.list` adapter.
+// The composable types the response as `AuditEntry[]`.
+
+import { ref, type Ref } from 'vue';
+import type { AuditEntry, AuditQuery } from '@saasicat/types';
+import { useApiList, type UseApiListOptions, type UseApiListResult } from './use-api-list.js';
+
+export interface UseAuditEntriesOptions {
+    /**
+     * Fully-qualified audit endpoint including the app's globalPrefix
+     * (`/api/admin/audit`, `/api/v1/admin/audit`, …). Mandatory.
+     */
+    endpoint: string;
+    filter?: Ref<AuditQuery>;
+    http?: UseApiListOptions<Record<string, unknown>>['http'];
+    getAuthToken?: () => string | null;
+    autoLoad?: boolean;
+}
+
+export interface UseAuditEntriesResult extends UseApiListResult<AuditEntry> {
+    filter: Ref<AuditQuery>;
+}
+
+export function useAuditEntries(options: UseAuditEntriesOptions): UseAuditEntriesResult {
+    if (!options?.endpoint) {
+        throw new Error(
+            'useAuditEntries: `endpoint` ist Pflicht (z. B. "/api/admin/audit" ' +
+                'oder "/api/v1/admin/audit"). Plattform hat keinen Default, weil ' +
+                'Apps unterschiedliche globalPrefix-Konventionen haben.',
+        );
+    }
+    const filter = options.filter ?? ref<AuditQuery>({});
+    // AuditQuery has optional-only fields; index-signature cast for the
+    // useApiList constraint.
+    const list = useApiList<AuditEntry>({
+        endpoint: options.endpoint,
+        filter: filter as unknown as Ref<Record<string, unknown>>,
+        http: options.http,
+        getAuthToken: options.getAuthToken,
+        autoLoad: options.autoLoad,
+    });
+    return { ...list, filter };
+}

package/src/use-batch-columns.ts

@@ -0,0 +1,59 @@
+// useBatchColumns — Vue 3 composable on top of BatchColumnFetcher.
+//
+// Reactively reloads the custom TenantColumn data whenever either the
+// `tenantIds` list (pagination → different tenant IDs) or the Manifest
+// changes (e.g. after `manifest reload`). Loading and error state are
+// aggregated per column; granular per-column loading state can be added
+// by consumers via a direct `fetcher.fetchOne` call.
+
+import { ref, watch, type Ref } from 'vue';
+import type { AdminManifest } from '@saasicat/types';
+import {
+    BatchColumnFetcher,
+    type BatchColumnData,
+    type BatchColumnFetcherOptions,
+} from './batch-column-fetcher.js';
+
+export interface UseBatchColumnsResult {
+    /** Data per column key (`columnKey → tenantId → value`). */
+    data: Ref<BatchColumnData>;
+    loading: Ref<boolean>;
+    error: Ref<Error | null>;
+    /** Manual re-fetch (e.g. after a mutation). */
+    reload: () => Promise<void>;
+}
+
+export function useBatchColumns(
+    manifest: Ref<AdminManifest | null>,
+    tenantIds: Ref<string[]>,
+    options: BatchColumnFetcherOptions = {},
+): UseBatchColumnsResult {
+    const fetcher = new BatchColumnFetcher(options);
+    const data = ref<BatchColumnData>({});
+    const loading = ref(false);
+    const error = ref<Error | null>(null);
+
+    async function load() {
+        if (!manifest.value || tenantIds.value.length === 0) {
+            data.value = {};
+            return;
+        }
+        loading.value = true;
+        error.value = null;
+        try {
+            data.value = await fetcher.fetchAll(manifest.value, tenantIds.value);
+        } catch (err) {
+            error.value = err instanceof Error ? err : new Error(String(err));
+            data.value = {};
+        } finally {
+            loading.value = false;
+        }
+    }
+
+    // Reactive: reloads as soon as the Manifest or tenantIds change.
+    watch([manifest, tenantIds], () => {
+        void load();
+    });
+
+    return { data, loading, error, reload: load };
+}

package/src/use-bulk-publish.ts

@@ -0,0 +1,150 @@
+// useBulkPublish — bulk-publish modal orchestration.
+//
+// SuperAdmin selects N drafts from the versions page list, enters a shared
+// `changeNote` and triggers the publish. The platform composable runs the
+// publishes **in parallel** and tracks the status per draft (pending/
+// publishing/published/failed) — the modal renders a live table with a
+// progress bar per item.
+//
+// What the platform does NOT do: TOTP code entry + setting the MFA header.
+// The consumer shell (Quasar modal or similar) does that and passes the
+// `mfaCode` parameter through.
+
+import { computed, ref, type ComputedRef, type Ref } from 'vue';
+import { defaultHttpClient, type HttpClient } from './types.js';
+
+export type BulkItemKind = 'plan';
+
+export type BulkItemStatus = 'pending' | 'publishing' | 'published' | 'failed';
+
+export interface BulkPublishItem {
+    /** Composite ID: `<kind>:<draftId>`. Unique within the bulk set. */
+    key: string;
+    kind: BulkItemKind;
+    draftId: string;
+    /** Display label in the modal (e.g. "STANDARD v3"). */
+    label: string;
+    status: BulkItemStatus;
+    error?: string;
+    /** Server response when status='published'. */
+    result?: unknown;
+}
+
+export interface UseBulkPublishOptions {
+    /**
+     * Endpoint mapping per kind. **Required** — the platform does not know
+     * the app's globalPrefix (e.g. `/api/admin/...` or
+     * `/api/v1/admin/...`), so consumers supply the full URL per kind.
+     */
+    endpoints: Record<BulkItemKind, (draftId: string) => string>;
+    http?: HttpClient;
+    getAuthToken?: () => string | null;
+}
+
+export interface UseBulkPublishResult {
+    items: Ref<BulkPublishItem[]>;
+    /** Fraction of items already completed (0..1). */
+    progress: ComputedRef<number>;
+    /** Returns `true` once all items are either `published` or `failed`. */
+    done: ComputedRef<boolean>;
+    /** Number of successful publishes. */
+    successCount: ComputedRef<number>;
+    /** Number of failed publishes. */
+    failureCount: ComputedRef<number>;
+    /** Resets the bulk set — e.g. after modal open. */
+    setItems: (items: Array<Omit<BulkPublishItem, 'status'>>) => void;
+    /**
+     * Triggers the bulk publish. `changeNote` is required for all
+     * drafts; `mfaCode` is optional and is sent in the `X-Mfa-Code`
+     * header when present.
+     */
+    run: (input: { changeNote: string; mfaCode?: string }) => Promise<void>;
+}
+
+export function useBulkPublish(options: UseBulkPublishOptions): UseBulkPublishResult {
+    if (!options?.endpoints) {
+        throw new Error(
+            'useBulkPublish: `endpoints` ist Pflicht (Mapping plan → URL-Builder). ' +
+                'Plattform hat keinen Default, weil Apps unterschiedliche ' +
+                'globalPrefix-Konventionen haben.',
+        );
+    }
+    const http = options.http ?? defaultHttpClient();
+    const endpoints = options.endpoints;
+    const items = ref<BulkPublishItem[]>([]) as Ref<BulkPublishItem[]>;
+
+    const successCount = computed(() => items.value.filter((i) => i.status === 'published').length);
+    const failureCount = computed(() => items.value.filter((i) => i.status === 'failed').length);
+    const progress = computed(() => {
+        if (items.value.length === 0) return 0;
+        const done = successCount.value + failureCount.value;
+        return done / items.value.length;
+    });
+    const done = computed(
+        () =>
+            items.value.length > 0 &&
+            items.value.every((i) => i.status === 'published' || i.status === 'failed'),
+    );
+
+    function setItems(next: Array<Omit<BulkPublishItem, 'status'>>): void {
+        items.value = next.map((i) => ({ ...i, status: 'pending' as BulkItemStatus }));
+    }
+
+    async function publishOne(
+        item: BulkPublishItem,
+        body: { changeNote: string },
+        mfaCode?: string,
+    ): Promise<void> {
+        item.status = 'publishing';
+        try {
+            const url = endpoints[item.kind](item.draftId);
+            const headers: Record<string, string> = {
+                'Content-Type': 'application/json',
+            };
+            const token = options.getAuthToken?.();
+            if (token) headers.Authorization = `Bearer ${token}`;
+            if (mfaCode) headers['X-Mfa-Code'] = mfaCode;
+            const res = await http(url, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(body),
+            });
+            if (res.status >= 200 && res.status < 300) {
+                item.result = await res.json();
+                item.status = 'published';
+            } else {
+                item.error = `HTTP ${res.status}: ${await res.text()}`;
+                item.status = 'failed';
+            }
+        } catch (err) {
+            item.error = err instanceof Error ? err.message : String(err);
+            item.status = 'failed';
+        }
+    }
+
+    async function run(input: { changeNote: string; mfaCode?: string }): Promise<void> {
+        const note = input.changeNote.trim();
+        if (note.length === 0) {
+            // Mark all items as failed with a clear reason.
+            for (const item of items.value) {
+                item.status = 'failed';
+                item.error = 'changeNote ist Pflicht beim Publish.';
+            }
+            return;
+        }
+        // Parallel publishes — the server enforces an optimistic lock per draft.
+        await Promise.all(
+            items.value.map((item) => publishOne(item, { changeNote: note }, input.mfaCode)),
+        );
+    }
+
+    return {
+        items,
+        progress,
+        done,
+        successCount,
+        failureCount,
+        setItems,
+        run,
+    };
+}