@cosmicdrift/kumiko-bundled-features 0.307.0 → 0.309.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.307.0",
+  "version": "0.309.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -133,12 +133,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.307.0",
-    "@cosmicdrift/kumiko-framework": "0.307.0",
-    "@cosmicdrift/kumiko-headless": "0.307.0",
-    "@cosmicdrift/kumiko-renderer": "0.307.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.307.0",
-    "@cosmicdrift/kumiko-types": "0.307.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.309.0",
+    "@cosmicdrift/kumiko-framework": "0.309.0",
+    "@cosmicdrift/kumiko-headless": "0.309.0",
+    "@cosmicdrift/kumiko-renderer": "0.309.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.309.0",
+    "@cosmicdrift/kumiko-types": "0.309.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -167,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.307.0",
-    "@cosmicdrift/kumiko-locale-es": "0.307.0",
+    "@cosmicdrift/kumiko-locale-de": "0.309.0",
+    "@cosmicdrift/kumiko-locale-es": "0.309.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/__tests__/access-invalidation-consumer.integration.test.ts

@@ -44,6 +44,11 @@ import { createAuthEmailPasswordFeature } from "../auth-email-password/feature";
 import { createConfigFeature } from "../config";
 import { createConfigResolver } from "../config/resolver";
 import { configValuesTable } from "../config/table";
+import { PatHandlers } from "../personal-access-tokens/constants";
+import { createPersonalAccessTokensFeature } from "../personal-access-tokens/feature";
+import { revokeAllPatTokensForUser } from "../personal-access-tokens/revoke-for-user";
+import { apiTokenEntity, apiTokenTable } from "../personal-access-tokens/schema/api-token";
+import type { PatScopeConfig } from "../personal-access-tokens/scopes";
 import { makeSessionHelpers } from "../sessions/__tests__/test-helpers";
 import { SessionHandlers } from "../sessions/constants";
 import { createSessionsFeature } from "../sessions/feature";
@@ -66,6 +71,10 @@ const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
 const encryptionKey = randomBytes(32).toString("base64");
 const TENANT = testTenantId(1);
 
+const PAT_SCOPES: PatScopeConfig = {
+  probe: { label: "Probe", read: ["personal-access-tokens:query:mine"] },
+};
+
 // Collects every userId the consumer pushed an invalidation for during the
 // running test, in push order. Reset in beforeEach.
 let invalidated: string[];
@@ -90,6 +99,10 @@ beforeAll(async () => {
       createAuthEmailPasswordFeature(),
       authFoundationFeature,
       createSessionsFeature({ autoRevokeOnPasswordChange: bound.asMassRevoker() }),
+      createPersonalAccessTokensFeature({
+        scopes: PAT_SCOPES,
+        autoRevokeOnPasswordChange: (userId) => revokeAllPatTokensForUser(stack.db, userId),
+      }),
     ],
     extraContext: { configResolver: resolver, configEncryption: encryption },
     authConfig: {
@@ -107,6 +120,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafeCreateEntityTable(stack.db, apiTokenEntity);
   await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
 });
 
@@ -119,6 +133,7 @@ beforeEach(async () => {
     userTable,
     tenantMembershipsTable,
     userSessionTable,
+    apiTokenTable,
     eventsTable,
   ]);
   invalidated = [];
@@ -309,4 +324,96 @@ describe("access-invalidation event consumer", () => {
     expect(sessionRow).toBeTruthy();
     expect(sessionRow?.revokedAt).not.toBeNull();
   });
+
+  test("session-revoked via logout (sessionRevoker, streamScope: revoked-sessions) still pushes an invalidation for that user", async () => {
+    const { userId } = await h.seedUser("logout-invalidates@example.com", "pw-long-enough");
+    const { token } = await h.login("logout-invalidates@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    // The raw sessionRevoker callback behind /api/auth/logout used to append
+    // no event at all — it now sets streamScope: "revoked-sessions"
+    // instead of the old userwide default, but a broad
+    // subscribeAccessInvalidation listener (no credential passed here, same
+    // as every other test in this file) still fires: this proves the new
+    // narrow scope still reaches the consumer, not just the pre-existing
+    // userwide paths above.
+    const logoutRes = await h.authedPost("/api/auth/logout", token);
+    expect(logoutRes.status).toBe(200);
+
+    const events = await selectMany(stack.db, eventsTable, {
+      type: "sessions:event:session-revoked",
+    });
+    expect(events.length).toBeGreaterThan(0);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("pat-revoked (self-service PAT revoke) pushes an invalidation for that user", async () => {
+    const { userId } = await h.seedUser("pat-revoke-invalidates@example.com", "pw-long-enough");
+    const { token } = await h.login("pat-revoke-invalidates@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    const mint = await h.authedPost("/api/write", token, {
+      type: PatHandlers.create,
+      payload: {
+        name: "probe",
+        scopes: ["probe:read"],
+        currentPassword: "pw-long-enough",
+      },
+    });
+    expect(mint.status).toBe(200);
+    const { data } = (await mint.json()) as { data: { id: string } };
+
+    const revokeRes = await h.authedPost("/api/write", token, {
+      type: PatHandlers.revoke,
+      payload: { id: data.id },
+    });
+    expect(revokeRes.status).toBe(200);
+
+    const events = await selectMany(stack.db, eventsTable, {
+      type: "personal-access-tokens:event:pat-revoked",
+    });
+    expect(events.length).toBeGreaterThan(0);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("revokeAllPatTokensForUser (password-change auto-revoke) pushes an invalidation for that user", async () => {
+    const { userId } = await h.seedUser("pat-mass-invalidates@example.com", "old-pw-long-enough");
+    const { token } = await h.login("pat-mass-invalidates@example.com", "old-pw-long-enough");
+    trackInvalidation(userId);
+
+    const mint = await h.authedPost("/api/write", token, {
+      type: PatHandlers.create,
+      payload: {
+        name: "probe",
+        scopes: ["probe:read"],
+        currentPassword: "old-pw-long-enough",
+      },
+    });
+    expect(mint.status).toBe(200);
+
+    const res = await h.authedPost("/api/write", token, {
+      type: AuthHandlers.changePassword,
+      payload: { oldPassword: "old-pw-long-enough", newPassword: "new-pw-long-enough" },
+    });
+    expect(res.status).toBe(200);
+
+    const events = await selectMany(stack.db, eventsTable, {
+      type: "personal-access-tokens:event:pat-revoked",
+    });
+    expect(events.length).toBeGreaterThan(0);
+
+    await stack.eventDispatcher?.runOnce();
+
+    // A password change fires both sessionMassRevoker (userwide,
+    // session-revoked) and this suite's PAT autoRevokeOnPasswordChange
+    // (pat-tokens-scoped, pat-revoked) — the broad listener here (no
+    // credential passed) fires once per publish, so twice for the same user.
+    expect(invalidated).toEqual([userId, userId]);
+  });
 });

package/src/__tests__/access-invalidation-stream.integration.test.ts

@@ -26,7 +26,7 @@ import {
   createTestEnvelopeCipher,
   resetTestTables,
 } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { AuthHandlers } from "../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../auth-email-password/feature";
 import { createConfigFeature } from "../config";

package/src/__tests__/credential-scoped-sse-revoke.integration.test.ts

@@ -0,0 +1,296 @@
+// Credential-scoped SSE revoke.
+//
+// Logout/tenant-switch (sessionRevoker, session-callbacks.ts) and PAT revoke
+// (revoke.write.ts / revokeAllPatTokensForUser) used to make no event at
+// all, so the access-invalidation consumer never heard about them and an
+// already-open SSE stream on that exact credential survived until its
+// JWT/token expired on its own. Both now append a scoped session-revoked /
+// pat-revoked event and the consumer closes exactly the matching stream(s),
+// leaving every other credential's stream of the same user open.
+//
+// Real stack throughout: setupTestStack + real HTTP (createLiveDispatcher for
+// the SSE streams, stack.http/h.authedPost for the writes), never
+// createTestDispatcher.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import {
+  authFoundationFeature,
+  resolveTokenVerifier,
+} from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createLiveDispatcher } from "@cosmicdrift/kumiko-dispatcher-live";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { createInMemoryLoginRateLimiter, generateToken } from "@cosmicdrift/kumiko-framework/api";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  resetTestTables,
+} from "@cosmicdrift/kumiko-framework/testing";
+import * as z from "zod";
+import { AuthHandlers } from "../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../auth-email-password/feature";
+import { createConfigFeature } from "../config";
+import { createConfigResolver } from "../config/resolver";
+import { configValuesTable } from "../config/table";
+import { PatHandlers } from "../personal-access-tokens/constants";
+import { createPersonalAccessTokensFeature } from "../personal-access-tokens/feature";
+import { revokeAllPatTokensForUser } from "../personal-access-tokens/revoke-for-user";
+import { apiTokenEntity, apiTokenTable } from "../personal-access-tokens/schema/api-token";
+import type { PatScopeConfig } from "../personal-access-tokens/scopes";
+import { makeSessionHelpers } from "../sessions/__tests__/test-helpers";
+import { createSessionsFeature } from "../sessions/feature";
+import { userSessionEntity, userSessionTable } from "../sessions/schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../sessions/session-callbacks";
+import { sessionCallbacksFromLateBound } from "../sessions/testing";
+import { createTenantFeature } from "../tenant";
+import { tenantMembershipsTable } from "../tenant/membership-table";
+import { tenantEntity } from "../tenant/schema/tenant";
+import { createUserFeature } from "../user/feature";
+import { userEntity, userTable } from "../user/schema/user";
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+const TENANT = testTenantId(1);
+
+const SCOPES: PatScopeConfig = {
+  probe: { label: "Probe stream", read: ["stream-probe:stream:probe:tail"] },
+};
+
+const chunkGates = new Map<string, { promise: Promise<void>; release: () => void }>();
+
+function createGate(gateId: string): () => void {
+  let release!: () => void;
+  const promise = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  chunkGates.set(gateId, { promise, release });
+  return release;
+}
+
+const streamProbeFeature = defineFeature("stream-probe", (r) => {
+  r.streamHandler(
+    "probe:tail",
+    z.object({ gateId: z.string().min(1) }),
+    async function* (event) {
+      yield { phase: "open" as const };
+      const gate = chunkGates.get(event.payload.gateId);
+      if (!gate) throw new Error(`missing gate ${event.payload.gateId}`);
+      await gate.promise;
+      yield { phase: "survived" as const };
+    },
+    { access: { roles: ["User"] } },
+  );
+});
+
+function buildLiveFetch(bearerToken: string): {
+  readonly fetch: typeof fetch;
+  readonly csrfToken: string;
+} {
+  const csrfToken = generateToken();
+  const fetchImpl = (async (url: unknown, init: RequestInit | undefined) => {
+    const reqInit: RequestInit = {
+      ...(init ?? {}),
+      headers: {
+        ...(init?.headers ?? {}),
+        Authorization: `Bearer ${bearerToken}`,
+      },
+    };
+    return stack.app.request(String(url), reqInit);
+  }) as unknown as typeof fetch;
+  return { fetch: fetchImpl, csrfToken };
+}
+
+async function openProbeStream(bearerToken: string): Promise<{
+  iter: AsyncIterator<{ phase: string }>;
+  release: () => void;
+}> {
+  const gateId = generateToken();
+  const release = createGate(gateId);
+  const { fetch, csrfToken } = buildLiveFetch(bearerToken);
+  const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
+  const iter = dispatcher
+    .stream<{ phase: string }>("stream-probe:stream:probe:tail", { gateId })
+    [Symbol.asyncIterator]();
+  const first = await iter.next();
+  expect(first.done).toBe(false);
+  expect(first.value).toEqual({ phase: "open" });
+  return { iter, release };
+}
+
+// The append's NOTIFY can wake a dispatcher pass before the test's own
+// runOnce(), and runOnce() skips a consumer that pass is still busy with.
+// Draining first makes the invalidation land before the stream assertions.
+async function deliverPendingEvents(): Promise<void> {
+  await stack.eventDispatcher?.drain();
+  await stack.eventDispatcher?.runOnce();
+}
+
+async function mintPat(cookieToken: string): Promise<{ id: string; token: string }> {
+  const res = await h.authedPost("/api/write", cookieToken, {
+    type: PatHandlers.create,
+    payload: {
+      name: "probe-token",
+      scopes: ["probe:read"],
+      currentPassword: "pw-long-enough",
+    },
+  });
+  expect(res.status).toBe(200);
+  const body = (await res.json()) as { data: { id: string; token: string } };
+  return body.data;
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature({ autoRevokeOnPasswordChange: bound.asMassRevoker() }),
+      createPersonalAccessTokensFeature({
+        scopes: SCOPES,
+        autoRevokeOnPasswordChange: (userId) => revokeAllPatTokensForUser(stack.db, userId),
+      }),
+      streamProbeFeature,
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      tokenVerifier: (raw: string) =>
+        resolveTokenVerifier({ db: stack.db, registry: stack.registry }, raw),
+      patRateLimiter: createInMemoryLoginRateLimiter(100, 60_000),
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator as SessionCreator);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafeCreateEntityTable(stack.db, apiTokenEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [
+    userTable,
+    tenantMembershipsTable,
+    userSessionTable,
+    apiTokenTable,
+    eventsTable,
+  ]);
+  chunkGates.clear();
+});
+
+// Tests release a stream's gate BEFORE asserting it closed: the invalidation
+// already fired during runOnce(), so a revoked stream still rejects, while a
+// stream that was wrongly left open yields its next chunk and fails the
+// assertion instead of hanging on a gate nobody releases.
+describe("logout closes only that cookie session's SSE stream", () => {
+  test("session 1 logs out, session 1's stream closes, session 2's stream survives", async () => {
+    await h.seedUser("logout-scope@example.com", "pw-long-enough");
+    const session1 = await h.login("logout-scope@example.com", "pw-long-enough");
+    const session2 = await h.login("logout-scope@example.com", "pw-long-enough");
+
+    const stream1 = await openProbeStream(session1.token);
+    const stream2 = await openProbeStream(session2.token);
+
+    const logoutRes = await h.authedPost("/api/auth/logout", session1.token);
+    expect(logoutRes.status).toBe(200);
+
+    await deliverPendingEvents();
+
+    stream1.release();
+
+    await expect(stream1.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+
+    stream2.release();
+    const survivedChunk = await stream2.iter.next();
+    expect(survivedChunk.done).toBe(false);
+    expect(survivedChunk.value).toEqual({ phase: "survived" });
+  });
+});
+
+describe("PAT revoke closes only that token's SSE stream", () => {
+  test("revoking PAT1 closes PAT1's stream, PAT2's stream and the cookie stream survive", async () => {
+    await h.seedUser("pat-scope@example.com", "pw-long-enough");
+    const session = await h.login("pat-scope@example.com", "pw-long-enough");
+    const pat1 = await mintPat(session.token);
+    const pat2 = await mintPat(session.token);
+
+    const cookieStream = await openProbeStream(session.token);
+    const pat1Stream = await openProbeStream(pat1.token);
+    const pat2Stream = await openProbeStream(pat2.token);
+
+    const revokeRes = await h.authedPost("/api/write", session.token, {
+      type: PatHandlers.revoke,
+      payload: { id: pat1.id },
+    });
+    expect(revokeRes.status).toBe(200);
+
+    await deliverPendingEvents();
+
+    pat1Stream.release();
+
+    await expect(pat1Stream.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+
+    cookieStream.release();
+    pat2Stream.release();
+    const cookieSurvived = await cookieStream.iter.next();
+    expect(cookieSurvived.done).toBe(false);
+    expect(cookieSurvived.value).toEqual({ phase: "survived" });
+    const pat2Survived = await pat2Stream.iter.next();
+    expect(pat2Survived.done).toBe(false);
+    expect(pat2Survived.value).toEqual({ phase: "survived" });
+  });
+
+  test("revokeAllPatTokensForUser closes every PAT stream of the user, cookie stream survives", async () => {
+    const { userId } = await h.seedUser("pat-mass-scope@example.com", "pw-long-enough");
+    const session = await h.login("pat-mass-scope@example.com", "pw-long-enough");
+    const pat1 = await mintPat(session.token);
+    const pat2 = await mintPat(session.token);
+
+    const cookieStream = await openProbeStream(session.token);
+    const pat1Stream = await openProbeStream(pat1.token);
+    const pat2Stream = await openProbeStream(pat2.token);
+
+    const revokedCount = await revokeAllPatTokensForUser(stack.db, userId);
+    expect(revokedCount).toBe(2);
+
+    await deliverPendingEvents();
+
+    pat1Stream.release();
+
+    await expect(pat1Stream.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+    pat2Stream.release();
+    await expect(pat2Stream.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+
+    cookieStream.release();
+    const cookieSurvived = await cookieStream.iter.next();
+    expect(cookieSurvived.done).toBe(false);
+    expect(cookieSurvived.value).toEqual({ phase: "survived" });
+  });
+});

package/src/agent-tools/__tests__/agent-doc-lint.test.ts

@@ -4,7 +4,7 @@ import {
   defineWriteHandler,
   resolveAgentExposure,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { AgentDocGapKinds, findAgentDocGaps, formatAgentDocGap } from "../agent-doc-lint";
 
 const OPEN_ACCESS = {

package/src/agent-tools/__tests__/agent-manifest.test.ts

@@ -7,7 +7,7 @@ import {
   defineFeature,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { ReferenceFieldDef, TextFieldDef } from "@cosmicdrift/kumiko-framework/engine/types";
-import { z } from "zod";
+import * as z from "zod";
 import { buildAgentManifest } from "../agent-manifest";
 
 const gatedEntity = createEntity({

package/src/agent-tools/__tests__/agent-optout.test.ts

@@ -7,7 +7,7 @@ import {
   defineEntityListHandler,
   defineFeature,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { authFoundationFeature } from "../../auth-foundation";
 import { AuthMfaHandlers, AuthMfaQueries, createAuthMfaFeature } from "../../auth-mfa";
 import { createConfigFeature } from "../../config";

package/src/agent-tools/__tests__/agent-tools.integration.test.ts

@@ -16,7 +16,7 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { buildAgentManifest } from "../agent-manifest";
 import { buildToolCatalog, toolNameForQn } from "../tool-catalog";
 import type { ToolDispatcher } from "../tool-dispatch";

package/src/agent-tools/__tests__/feature.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, spyOn, test } from "bun:test";
 import { defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { AGENT_TOOLS_FEATURE_NAME, createAgentToolsFeature } from "../feature";
 
 async function noopWriteHandler() {

package/src/agent-tools/__tests__/tool-catalog.test.ts

@@ -6,7 +6,7 @@ import {
   createTextField,
   defineFeature,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { buildAgentManifest } from "../agent-manifest";
 import { buildToolCatalog, toolNameForQn } from "../tool-catalog";
 import type { AgentManifest, AgentToolMode, RegistrySearchView } from "../types";

package/src/agent-tools/agent-manifest.ts

@@ -15,7 +15,7 @@ import {
   isAgentVisibleScreen,
   resolveAgentExposure,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import type {
   AgentManifest,
   AgentManifestEntity,

package/src/audit/__tests__/escape-hatch-audit.integration.test.ts

@@ -12,7 +12,7 @@ import {
   type TestStack,
   testTenantId,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { z } from "zod";
+import * as z from "zod";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant";
 import { createUserFeature } from "../../user";

package/src/audit/escape-hatch-audit-sink.ts

@@ -2,7 +2,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { EscapeHatchAuditSink, EscapeHatchKind } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 
 export const ESCAPE_HATCH_USED_EVENT = "audit:event:escape-hatch-used";
 export const ESCAPE_HATCH_USE_AGGREGATE_TYPE = "escapeHatchUse";

package/src/audit/handlers/details.query.ts

@@ -5,7 +5,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
-import { z } from "zod";
+import * as z from "zod";
 
 export const detailsQuery = defineQueryHandler({
   name: "details",

package/src/audit/handlers/list.query.ts

@@ -15,7 +15,7 @@ import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 
 const MAX_LIMIT = 100;
 

package/src/auth-email-password/__tests__/query-as-member.integration.test.ts

@@ -31,7 +31,7 @@ import {
   updateRows,
   waitFor,
 } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,

package/src/auth-email-password/__tests__/seed-admin-guarded.integration.test.ts

@@ -179,4 +179,35 @@ describe("seedAdminGuarded (offlot#114)", () => {
     expect(await userIds()).toHaveLength(2);
     expect((await userIds()).slice().sort()).toEqual([unrelated.id, admin.id].sort());
   });
+
+  test("a KMS without a blind-index key aborts instead of seeding a blind duplicate", async () => {
+    await seedAdminGuarded(stack.db, seedOptions);
+    resetBlindIndexKeyForTests();
+
+    await expect(seedAdminGuarded(stack.db, seedOptions)).rejects.toThrow(/blind-index key/);
+    expect(await userIds()).toHaveLength(1);
+  });
+
+  test("existing-user branch reconciles emailVerified onto the canonical row", async () => {
+    const first = await seedAdminGuarded(stack.db, seedOptions);
+    await blankBlindIndex();
+
+    const second = await seedAdminGuarded(stack.db, { ...seedOptions, emailVerified: true });
+
+    expect(second.id).toBe(first.id);
+    expect(await userIds()).toEqual([first.id]);
+    const rows = await selectMany<{ id: string; emailVerified: boolean }>(stack.db, userTable);
+    expect(rows.find((r) => r.id === first.id)?.emailVerified).toBe(true);
+  });
+
+  test("without a configured KMS, seeding runs the plaintext path unguarded", async () => {
+    resetPiiSubjectKmsForTests();
+    resetBlindIndexKeyForTests();
+
+    const first = await seedAdminGuarded(stack.db, seedOptions);
+    const second = await seedAdminGuarded(stack.db, seedOptions);
+
+    expect(second.id).toBe(first.id);
+    expect(await userIds()).toEqual([first.id]);
+  });
 });

package/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.309.0",
+    "type": "fix",
+    "title": "Boot admin seed no longer duplicates the admin when the email blind-index lookup misses (fw#3101)",
+    "detail": "runProdApp and runDevApp used to call the unguarded `seedAdmin`, whose idempotency check is a plain email fetchOne that the query layer rewrites into `(email = $plaintext OR email_bidx = $hmac)` once a blind-index key is configured. Under KMS encryption `email` holds per-row ciphertext, so only the bidx arm can ever match — and it misses whenever a row's `email_bidx` is NULL (written before the key existed, or after a subject-key erase), silently inserting a second admin account for the same email. Both boot paths now call `seedAdminGuarded`, which under KMS decrypt-scans the active users for the email and reuses the oldest matching row instead of duplicating it. `seedAdminGuarded` also now aborts with a named error if a PII KMS is configured but no blind-index key is — that combination makes the lookup blind by construction — and reconciles `emailVerified: true` onto the existing row it resolves through the decrypt-scan branch, matching the existing-row reconcile `seedUser` already does on its own idempotency hit."
+  },
   {
     "version": "0.307.0",
     "type": "improvement",

package/src/auth-email-password/feature.ts

@@ -1,5 +1,5 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { MIN_HMAC_SECRET_LENGTH } from "./constants";
 import type { AuthMailLocale } from "./email-templates";
 import { changePasswordWrite } from "./handlers/change-password.write";