@cosmicdrift/kumiko-bundled-features 0.254.0 → 0.255.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.254.0",
+  "version": "0.255.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.254.0",
-    "@cosmicdrift/kumiko-framework": "0.254.0",
-    "@cosmicdrift/kumiko-headless": "0.254.0",
-    "@cosmicdrift/kumiko-renderer": "0.254.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.254.0",
-    "@cosmicdrift/kumiko-types": "0.254.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.255.0",
+    "@cosmicdrift/kumiko-framework": "0.255.0",
+    "@cosmicdrift/kumiko-headless": "0.255.0",
+    "@cosmicdrift/kumiko-renderer": "0.255.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.255.0",
+    "@cosmicdrift/kumiko-types": "0.255.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.254.0",
-    "@cosmicdrift/kumiko-locale-es": "0.254.0"
+    "@cosmicdrift/kumiko-locale-de": "0.255.0",
+    "@cosmicdrift/kumiko-locale-es": "0.255.0"
   }
 }

package/src/crypto-shredding/__tests__/subject-id-schema.test.ts

@@ -0,0 +1,42 @@
+// Mint/shred parity (fw#2801 security review): a record subject key is
+// minted via subjectKeyForRecord (framework crypto) but shredded via a
+// forget-subject request validated against subjectIdSchema (this feature).
+// If the two ever disagreed on which entity names are valid, a field could
+// encrypt cleanly and then never be reachable by forgetSubject — the
+// "encrypted but not shreddable" state fw#2809 was built to prevent. This
+// pins the invariant down without needing a DB.
+
+import { describe, expect, test } from "bun:test";
+import { subjectKeyForRecord } from "@cosmicdrift/kumiko-framework/crypto";
+import { subjectIdSchema } from "../handlers/forget-subject.write";
+
+const UUID_A = "6b2f4a0e-1c9d-4f3a-9d2e-00000000000a";
+
+const VALID_ENTITY_NAMES = [
+  "mail-account",
+  "note-entry",
+  "documentExtract",
+  "a",
+  "A1",
+  "tenant_membership",
+];
+
+const INVALID_ENTITY_NAMES = ["v2.digest", "_internal", "3rd", "bad:name", ""];
+
+describe("record subject mint/shred parity", () => {
+  test("every entity name subjectKeyForRecord accepts, subjectIdSchema also accepts", () => {
+    for (const entity of VALID_ENTITY_NAMES) {
+      expect(() => subjectKeyForRecord(entity, UUID_A)).not.toThrow();
+      const result = subjectIdSchema.safeParse({ kind: "record", entity, id: UUID_A });
+      expect(result.success).toBe(true);
+    }
+  });
+
+  test("every entity name subjectKeyForRecord rejects, subjectIdSchema also rejects", () => {
+    for (const entity of INVALID_ENTITY_NAMES) {
+      expect(() => subjectKeyForRecord(entity, UUID_A)).toThrow();
+      const result = subjectIdSchema.safeParse({ kind: "record", entity, id: UUID_A });
+      expect(result.success).toBe(false);
+    }
+  });
+});

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -3,6 +3,7 @@ import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import {
   configuredPiiSubjectKms,
+  RECORD_ENTITY_PATTERN,
   type SubjectId,
   subjectIdToKey,
 } from "@cosmicdrift/kumiko-framework/crypto";
@@ -48,9 +49,6 @@ import {
   TARGET_TENANT_NOT_ADMIN_TENANT,
 } from "../constants";
 
-// Registry entity names are identifier-shaped; ":" would break the subject-key round-trip.
-const RECORD_ENTITY_PATTERN = /^[A-Za-z][A-Za-z0-9_-]*$/;
-
 export const subjectIdSchema = z.discriminatedUnion("kind", [
   z.object({ kind: z.literal("user"), userId: z.uuid() }),
   z.object({ kind: z.literal("tenant"), tenantId: z.uuid() }),

package/src/delivery/feature.ts

@@ -64,7 +64,7 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
     // recipientAddress is the real PII (email address); recipientId stays
     // plaintext — pseudonymous fk, same line as config.userId (#821).
     r.defineEvent("attempt", deliveryAttemptSchema, {
-      piiFields: { recipientAddress: { subjectField: "recipientId" } },
+      piiFields: { recipientAddress: { personal: { of: "recipientId" } } },
     });
 
     // Inline projection that materialises every delivery attempt into