@cosmicdrift/kumiko-bundled-features 0.254.0 → 0.255.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.254.0",
+  "version": "0.255.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.254.0",
-    "@cosmicdrift/kumiko-framework": "0.254.0",
-    "@cosmicdrift/kumiko-headless": "0.254.0",
-    "@cosmicdrift/kumiko-renderer": "0.254.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.254.0",
-    "@cosmicdrift/kumiko-types": "0.254.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.255.1",
+    "@cosmicdrift/kumiko-framework": "0.255.1",
+    "@cosmicdrift/kumiko-headless": "0.255.1",
+    "@cosmicdrift/kumiko-renderer": "0.255.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.255.1",
+    "@cosmicdrift/kumiko-types": "0.255.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.254.0",
-    "@cosmicdrift/kumiko-locale-es": "0.254.0"
+    "@cosmicdrift/kumiko-locale-de": "0.255.1",
+    "@cosmicdrift/kumiko-locale-es": "0.255.1"
   }
 }

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -855,12 +855,13 @@ describe("scenario 10: PII is encrypted at rest, not just erasable on destroy",
   // is written through the encrypted path above. If that changes (billing-
   // foundation goes live before a KMS is configured somewhere), note for
   // whoever builds the backfill: the existing backfillEventPiiEncryption
-  // (#799, db/queries/backfill-pii.ts) does NOT cover this feature yet —
-  // its lifecycle-event matcher expects `<aggregateType>.<verb>` event
-  // names (billing's are `billing-foundation:event:subscription-created`)
-  // and its custom-event catalog only supports user-subject fields
-  // (`{kind: "user"}`), not the tenant-subject fields billing uses. Closing
-  // that gap is new framework capability, not a wiring fix.
+  // (#799, db/queries/backfill-pii.ts) does NOT cover this feature yet — its
+  // lifecycle-event matcher expects `<aggregateType>.<verb>` event names,
+  // but billing's are `billing-foundation:event:subscription-created`. The
+  // custom-event catalog branch itself already resolves user/tenant/self
+  // subjects (fw#2801/#2819) — no framework gap to close here, only the
+  // lifecycle-event matcher would need widening if this feature ever needs
+  // a backfill.
 });
 
 // =============================================================================

package/src/crypto-shredding/__tests__/subject-id-schema.test.ts

@@ -0,0 +1,42 @@
+// Mint/shred parity (fw#2801 security review): a record subject key is
+// minted via subjectKeyForRecord (framework crypto) but shredded via a
+// forget-subject request validated against subjectIdSchema (this feature).
+// If the two ever disagreed on which entity names are valid, a field could
+// encrypt cleanly and then never be reachable by forgetSubject — the
+// "encrypted but not shreddable" state fw#2809 was built to prevent. This
+// pins the invariant down without needing a DB.
+
+import { describe, expect, test } from "bun:test";
+import { subjectKeyForRecord } from "@cosmicdrift/kumiko-framework/crypto";
+import { subjectIdSchema } from "../handlers/forget-subject.write";
+
+const UUID_A = "6b2f4a0e-1c9d-4f3a-9d2e-00000000000a";
+
+const VALID_ENTITY_NAMES = [
+  "mail-account",
+  "note-entry",
+  "documentExtract",
+  "a",
+  "A1",
+  "tenant_membership",
+];
+
+const INVALID_ENTITY_NAMES = ["v2.digest", "_internal", "3rd", "bad:name", ""];
+
+describe("record subject mint/shred parity", () => {
+  test("every entity name subjectKeyForRecord accepts, subjectIdSchema also accepts", () => {
+    for (const entity of VALID_ENTITY_NAMES) {
+      expect(() => subjectKeyForRecord(entity, UUID_A)).not.toThrow();
+      const result = subjectIdSchema.safeParse({ kind: "record", entity, id: UUID_A });
+      expect(result.success).toBe(true);
+    }
+  });
+
+  test("every entity name subjectKeyForRecord rejects, subjectIdSchema also rejects", () => {
+    for (const entity of INVALID_ENTITY_NAMES) {
+      expect(() => subjectKeyForRecord(entity, UUID_A)).toThrow();
+      const result = subjectIdSchema.safeParse({ kind: "record", entity, id: UUID_A });
+      expect(result.success).toBe(false);
+    }
+  });
+});

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -4,6 +4,7 @@ import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import {
   configuredPiiSubjectKms,
   type SubjectId,
+  subjectIdSchema,
   subjectIdToKey,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import {
@@ -18,7 +19,6 @@ import {
   type FeatureDefinition,
   type HandlerContext,
   type SessionUser,
-  type TenantId,
   type WriteEvent,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -48,18 +48,7 @@ import {
   TARGET_TENANT_NOT_ADMIN_TENANT,
 } from "../constants";
 
-// Registry entity names are identifier-shaped; ":" would break the subject-key round-trip.
-const RECORD_ENTITY_PATTERN = /^[A-Za-z][A-Za-z0-9_-]*$/;
-
-export const subjectIdSchema = z.discriminatedUnion("kind", [
-  z.object({ kind: z.literal("user"), userId: z.uuid() }),
-  z.object({ kind: z.literal("tenant"), tenantId: z.uuid() }),
-  z.object({
-    kind: z.literal("record"),
-    entity: z.string().regex(RECORD_ENTITY_PATTERN),
-    id: z.uuid(),
-  }),
-]);
+export { subjectIdSchema };
 
 export const forgetSubjectSchema = z.object({
   subject: subjectIdSchema,
@@ -298,7 +287,7 @@ export const forgetSubjectWrite = defineWriteHandler({
       raw.kind === "user"
         ? { kind: "user", userId: raw.userId }
         : raw.kind === "tenant"
-          ? { kind: "tenant", tenantId: raw.tenantId as TenantId } // @cast-boundary uuid-validated command payload → branded id
+          ? { kind: "tenant", tenantId: raw.tenantId }
           : { kind: "record", entity: raw.entity, id: raw.id };
     const subjectKey = subjectIdToKey(subject);
 

package/src/delivery/feature.ts

@@ -64,7 +64,7 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
     // recipientAddress is the real PII (email address); recipientId stays
     // plaintext — pseudonymous fk, same line as config.userId (#821).
     r.defineEvent("attempt", deliveryAttemptSchema, {
-      piiFields: { recipientAddress: { subjectField: "recipientId" } },
+      piiFields: { recipientAddress: { personal: { of: "recipientId" } } },
     });
 
     // Inline projection that materialises every delivery attempt into