@yunsoft/yuncms-core 0.1.23 → 0.1.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunsoft/yuncms-core",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "Core services, schema, authentication, permissions and storage primitives for YunCMS.",
   "license": "MIT",
   "type": "module",
@@ -31,6 +31,10 @@
   "dependencies": {
     "@aws-sdk/client-s3": "3.1100.0",
     "mysql2": "3.23.2",
-    "nodemailer": "9.1.1"
+    "nodemailer": "10.0.13"
+  },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/Yunsoft-Software"
   }
 }

package/src/bootstrap.js

@@ -20,6 +20,7 @@ import { mcpSettingsMigration } from './migrations/0017-mcp-settings.js';
 import { publicRegistrationSettingsMigration } from './migrations/0018-public-registration-settings.js';
 import { publicRegistrationEmailVerificationMigration } from './migrations/0019-public-registration-email-verification.js';
 import { studioLocalesMigration } from './migrations/0020-studio-locales.js';
+import { aiAutomationsMigration } from './migrations/0021-ai-automations.js';
 import { readSchemaVersion } from './schema-version.js';
 import { ensurePublicRole } from './setup.js';
 
@@ -44,6 +45,7 @@ export const CORE_MIGRATIONS = Object.freeze([
   publicRegistrationSettingsMigration,
   publicRegistrationEmailVerificationMigration,
   studioLocalesMigration,
+  aiAutomationsMigration,
 ]);
 
 export const REQUIRED_CORE_MIGRATION_IDS = Object.freeze(

package/src/migrations/0021-ai-automations.js

@@ -0,0 +1,43 @@
+export const aiAutomationsMigration = Object.freeze({
+  id: '0021-ai-automations',
+  statements: [
+    `CREATE TABLE yuncms_ai_automations (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      name VARCHAR(120) NOT NULL,
+      collection VARCHAR(64) NOT NULL,
+      run_as CHAR(36) NOT NULL,
+      enabled TINYINT(1) NOT NULL DEFAULT 0,
+      on_create TINYINT(1) NOT NULL DEFAULT 1,
+      on_update TINYINT(1) NOT NULL DEFAULT 0,
+      input_fields JSON NOT NULL,
+      output_fields JSON NOT NULL,
+      instruction TEXT NOT NULL,
+      revision INT UNSIGNED NOT NULL DEFAULT 1,
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+      INDEX idx_ai_automations_collection (collection, enabled),
+      CONSTRAINT fk_ai_automation_collection FOREIGN KEY (collection)
+        REFERENCES yuncms_collections (collection) ON DELETE CASCADE,
+      CONSTRAINT fk_ai_automation_user FOREIGN KEY (run_as)
+        REFERENCES yuncms_users (id) ON DELETE RESTRICT
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+    `CREATE TABLE yuncms_ai_automation_runs (
+      id CHAR(36) NOT NULL PRIMARY KEY,
+      automation_id CHAR(36) NOT NULL,
+      revision INT UNSIGNED NOT NULL,
+      item_key VARCHAR(191) NOT NULL,
+      status VARCHAR(16) NOT NULL DEFAULT 'pending',
+      attempts INT UNSIGNED NOT NULL DEFAULT 0,
+      error_code VARCHAR(100) NULL,
+      available_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+      finished_at DATETIME(3) NULL,
+      INDEX idx_ai_automation_queue (status, available_at),
+      INDEX idx_ai_automation_history (automation_id, created_at),
+      CONSTRAINT fk_ai_automation_run FOREIGN KEY (automation_id)
+        REFERENCES yuncms_ai_automations (id) ON DELETE CASCADE,
+      CONSTRAINT chk_ai_automation_run_status
+        CHECK (status IN ('pending', 'running', 'succeeded', 'failed', 'skipped'))
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+  ],
+});

package/src/query.js

@@ -47,6 +47,9 @@ function normalizeDelimited(value, label, { maxItems }) {
 
 function normalizeInteger(value, fallback, { label, min, max }) {
   if (value == null || value === '') return fallback;
+  if (typeof value === 'object' || typeof value === 'boolean') {
+    throw queryError(`${label} must be an integer between ${min} and ${max}`, label);
+  }
   const number = Number(value);
   if (!Number.isInteger(number) || number < min || number > max) {
     throw queryError(`${label} must be an integer between ${min} and ${max}`, label);
@@ -222,26 +225,60 @@ export function compileAggregate(aggregate, groupBy, schema) {
   };
 }
 
-function compileOperator(fieldSql, operator, value, path, limits) {
+function datetimeFilterValue(value, path, { allowUnresolvedDynamicVariables = false } = {}) {
+  // Schema-only permission validation keeps recognized dynamic values unresolved.
+  // resolveDynamicVariables already validates their syntax before compilation.
+  if (allowUnresolvedDynamicVariables && typeof value === 'string'
+    && (value === '$NOW' || value.toUpperCase().startsWith('$NOW('))) return value;
+  if (value instanceof Date) {
+    if (Number.isNaN(value.getTime()) || value.getUTCFullYear() < 1000 || value.getUTCFullYear() > 9999) {
+      throw queryError('Invalid datetime filter value', path);
+    }
+    return value;
+  }
+  const match = typeof value === 'string'
+    ? /^(\d{4})-(\d{2})-(\d{2})([T ])(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,6}))?(Z|[+-]\d{2}:\d{2})?$/u.exec(value)
+    : null;
+  if (!match || (match[4] === 'T' ? !match[9] : Boolean(match[9]))) {
+    throw queryError('Datetime filters require a timezone-bearing ISO value or a MySQL datetime', path);
+  }
+  const [, year, month, day, , hour, minute, second, , zone] = match;
+  const daysInMonth = new Date(Date.UTC(Number(year), Number(month), 0)).getUTCDate();
+  if (Number(year) < 1000 || Number(month) < 1 || Number(month) > 12
+    || Number(day) < 1 || Number(day) > daysInMonth
+    || Number(hour) > 23 || Number(minute) > 59 || Number(second) > 59) {
+    throw queryError('Invalid datetime filter value', path);
+  }
+  if (!zone) return value;
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime()) || date.getUTCFullYear() < 1000 || date.getUTCFullYear() > 9999) {
+    throw queryError('Invalid datetime filter value', path);
+  }
+  return date;
+}
+
+function compileOperator(fieldSql, operator, value, path, limits, field) {
   if (!FILTER_OPERATORS.has(operator)) throw queryError(`Unknown filter operator: ${operator}`, path);
+  const temporal = field.type === 'datetime' || field.type === 'timestamp';
+  const normalize = (entry) => temporal ? datetimeFilterValue(entry, path, limits) : entry;
   switch (operator) {
     case '_eq':
       if (value === null) throw queryError('Use _null for NULL comparisons', path);
-      return { sql: `${fieldSql} = ?`, params: [value] };
+      return { sql: `${fieldSql} = ?`, params: [normalize(value)] };
     case '_neq':
       if (value === null) throw queryError('Use _nnull for NULL comparisons', path);
-      return { sql: `${fieldSql} <> ?`, params: [value] };
-    case '_lt': return { sql: `${fieldSql} < ?`, params: [value] };
-    case '_lte': return { sql: `${fieldSql} <= ?`, params: [value] };
-    case '_gt': return { sql: `${fieldSql} > ?`, params: [value] };
-    case '_gte': return { sql: `${fieldSql} >= ?`, params: [value] };
+      return { sql: `${fieldSql} <> ?`, params: [normalize(value)] };
+    case '_lt': return { sql: `${fieldSql} < ?`, params: [normalize(value)] };
+    case '_lte': return { sql: `${fieldSql} <= ?`, params: [normalize(value)] };
+    case '_gt': return { sql: `${fieldSql} > ?`, params: [normalize(value)] };
+    case '_gte': return { sql: `${fieldSql} >= ?`, params: [normalize(value)] };
     case '_in':
     case '_nin': {
       if (!Array.isArray(value)) throw queryError(`${operator} requires an array`, path);
       if (value.length > limits.maxInValues) throw queryError(`${operator} accepts at most ${limits.maxInValues} values`, path);
       if (value.length === 0) return { sql: operator === '_in' ? '0 = 1' : '1 = 1', params: [] };
       const placeholders = value.map(() => '?').join(', ');
-      return { sql: `${fieldSql} ${operator === '_in' ? 'IN' : 'NOT IN'} (${placeholders})`, params: value };
+      return { sql: `${fieldSql} ${operator === '_in' ? 'IN' : 'NOT IN'} (${placeholders})`, params: value.map(normalize) };
     }
     case '_null':
     case '_nnull': {
@@ -272,12 +309,12 @@ function compileFilterObject(filter, schema, path, limits, state, depth) {
       for (const child of children) params.push(...child.params);
       continue;
     }
-    resolveField(schema, key, `${path}.${key}`);
+    const field = resolveField(schema, key, `${path}.${key}`);
     if (!value || typeof value !== 'object' || Array.isArray(value)) throw queryError('Field filters must be operator objects', `${path}.${key}`);
     const fieldSql = quoteIdentifier(key, 'field name');
     const fieldFragments = [];
     for (const [operator, operatorValue] of Object.entries(value)) {
-      const compiled = compileOperator(fieldSql, operator, operatorValue, `${path}.${key}.${operator}`, limits);
+      const compiled = compileOperator(fieldSql, operator, operatorValue, `${path}.${key}.${operator}`, limits, field);
       fieldFragments.push(compiled.sql);
       params.push(...compiled.params);
     }
@@ -295,7 +332,7 @@ export function compileFilter(filter, schema, options = {}) {
     allowUnresolvedDynamicVariables = false,
     ...limitOptions
   } = options;
-  const limits = { ...QUERY_LIMITS, ...limitOptions };
+  const limits = { ...QUERY_LIMITS, ...limitOptions, allowUnresolvedDynamicVariables };
   const resolvedFilter = resolveDynamicVariables(filter, dynamicVariables, {
     allowUnresolved: allowUnresolvedDynamicVariables,
     path: 'filter',

package/src/services/items-service.js

@@ -14,7 +14,7 @@ import {
 } from '../query.js';
 import { SchemaCache } from '../schema.js';
 import { isSystemManagedField, systemMutationEntries } from '../system-fields.js';
-import { withTransaction } from '../transaction.js';
+import { dispatchAfterCommit, transactionContext, withTransaction } from '../transaction.js';
 import { BaseService } from './base-service.js';
 import { PermissionsService } from './permissions-service.js';
 
@@ -139,6 +139,8 @@ export class ItemsService extends BaseService {
       accountability: this.accountability,
       collection: this.collection,
       requestId: this.requestId,
+      database: this.database,
+      transaction: transactionContext(this.database),
       ...extra,
     };
   }
@@ -150,7 +152,10 @@ export class ItemsService extends BaseService {
 
   async actionMutation(event, payload, context = {}) {
     if (!this.emitter) return;
-    await this.emitter.action(event, payload, this.hookContext(context));
+    const eventContext = this.hookContext(context);
+    const eventPayload = eventContext.transaction ? structuredClone(payload) : payload;
+    await dispatchAfterCommit(this.database, (database, transaction) =>
+      this.emitter.action(event, eventPayload, { ...eventContext, database, transaction }));
   }
 
   async getCollectionSchema(database = this.database) {

package/src/transaction.js

@@ -5,6 +5,33 @@ const ISOLATION_LEVELS = new Set([
   'SERIALIZABLE',
 ]);
 
+const transactions = new WeakMap();
+
+export function transactionContext(database) {
+  return transactions.has(database) ? Object.freeze({ managed: true, state: 'active' }) : null;
+}
+
+export async function dispatchAfterCommit(database, action) {
+  const transaction = transactions.get(database);
+  if (transaction) {
+    transaction.actions.push(action);
+    return;
+  }
+  await action(database, null);
+}
+
+function validateOperation(database, operation) {
+  if (!database) throw new Error('Database connection is required');
+  if (typeof operation !== 'function') throw new Error('Transaction operation is required');
+}
+
+function joinTransaction(connection, operation, options) {
+  if (options.isolationLevel && String(options.isolationLevel).toUpperCase() !== transactions.get(connection).isolationLevel) {
+    throw new Error('A nested transaction cannot change the outer isolation level');
+  }
+  return operation(connection);
+}
+
 async function setIsolationLevel(connection, isolationLevel) {
   if (!isolationLevel) return;
   const level = String(isolationLevel).toUpperCase();
@@ -14,17 +41,16 @@ async function setIsolationLevel(connection, isolationLevel) {
   await connection.query(`SET TRANSACTION ISOLATION LEVEL ${level}`);
 }
 
-export async function withConnectionTransaction(connection, operation, options = {}) {
-  if (!connection) throw new Error('Database connection is required');
-  if (typeof operation !== 'function') throw new Error('Transaction operation is required');
-
+async function executeTransaction(connection, operation, options) {
   await setIsolationLevel(connection, options.isolationLevel);
   await connection.beginTransaction();
+  const transaction = { actions: [], isolationLevel: options.isolationLevel ? String(options.isolationLevel).toUpperCase() : null };
+  transactions.set(connection, transaction);
 
   try {
     const result = await operation(connection);
     await connection.commit();
-    return result;
+    return { result, actions: transaction.actions };
   } catch (error) {
     try {
       await connection.rollback();
@@ -32,15 +58,36 @@ export async function withConnectionTransaction(connection, operation, options =
       error.rollbackError = rollbackError;
     }
     throw error;
+  } finally {
+    transactions.delete(connection);
   }
 }
 
+async function finishActions(committed, database) {
+  const context = Object.freeze({ managed: true, state: 'committed' });
+  for (const action of committed.actions) await action(database, context);
+  return committed.result;
+}
+
+export async function withConnectionTransaction(connection, operation, options = {}) {
+  validateOperation(connection, operation);
+  if (transactions.has(connection)) return joinTransaction(connection, operation, options);
+  const committed = await executeTransaction(connection, operation, options);
+  // This connection belongs to the caller and remains usable for post-commit actions.
+  return finishActions(committed, connection);
+}
+
 export async function withTransaction(pool, operation, options = {}) {
+  validateOperation(pool, operation);
+  if (transactions.has(pool)) return joinTransaction(pool, operation, options);
+  if (typeof pool.getConnection !== 'function') return withConnectionTransaction(pool, operation, options);
   const connection = await pool.getConnection();
-
+  let committed;
   try {
-    return await withConnectionTransaction(connection, operation, options);
+    committed = await executeTransaction(connection, operation, options);
   } finally {
     connection.release();
   }
+  // Return the borrowed connection before hooks acquire connections from the pool.
+  return finishActions(committed, pool);
 }