@cosmicdrift/kumiko-cli 0.389.0 → 0.390.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-cli",
-  "version": "0.389.0",
+  "version": "0.390.0",
   "description": "CLI for Kumiko apps. `bunx @cosmicdrift/kumiko-cli new app <name>` scaffolds a runnable workspace; `add feature <name>` mounts a feature; `check` runs boot validation plus the guard suites with the step list derived from kumiko.json; `agent lint`, `project` and `consumer` operate on an existing app; `handbuch build` renders the HTML handbuch.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -36,18 +36,19 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "0.389.0",
-    "@cosmicdrift/kumiko-guards": "0.389.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.389.0",
-    "@cosmicdrift/kumiko-testing": "0.389.0",
+    "@cosmicdrift/kumiko-dev-server": "0.390.0",
+    "@cosmicdrift/kumiko-feature-ast": "0.390.0",
+    "@cosmicdrift/kumiko-guards": "0.390.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.390.0",
+    "@cosmicdrift/kumiko-testing": "0.390.0",
     "marked": "^18.0.3",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
     "sharp": "^0.35.5",
-    "@cosmicdrift/kumiko-bundled-features": "0.389.0",
-    "@cosmicdrift/kumiko-framework": "0.389.0",
-    "@cosmicdrift/kumiko-renderer": "0.389.0"
+    "@cosmicdrift/kumiko-bundled-features": "0.390.0",
+    "@cosmicdrift/kumiko-framework": "0.390.0",
+    "@cosmicdrift/kumiko-renderer": "0.390.0"
   },
   "peerDependenciesMeta": {
     "sharp": {
@@ -64,9 +65,9 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.389.0",
-    "@cosmicdrift/kumiko-framework": "0.389.0",
-    "@cosmicdrift/kumiko-renderer": "0.389.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.390.0",
+    "@cosmicdrift/kumiko-framework": "0.390.0",
+    "@cosmicdrift/kumiko-renderer": "0.390.0",
     "sharp": "^0.35.5"
   },
   "publishConfig": {

package/src/commands/codemod.ts

@@ -39,13 +39,13 @@ async function runCodemod(ctx: CliCommandContext): Promise<number> {
 
   const { resolveCodemodScript } = await import("@cosmicdrift/kumiko-framework/upgrade-cli");
   const scriptField = `scripts/codemod/${name}.ts`;
-  // The project's own install wins; the framework next to this CLI is the fallback.
+  // The project's own install wins; the feature-ast package next to this CLI is the fallback.
   const script =
     resolveCodemodScript(ctx.cwd, scriptField) ??
     resolveCodemodScript(import.meta.dir, scriptField);
   if (script === null) {
     ctx.out.err(
-      "  Codemod script not found. Install @cosmicdrift/kumiko-framework in this project.",
+      "  Codemod script not found. Install @cosmicdrift/kumiko-feature-ast in this project.",
     );
     return 1;
   }

package/src/commands/consumer.ts

@@ -62,30 +62,44 @@ export const consumerCommand: CliCommand = {
       SEARCH_CONSUMER_NAME,
       ...registry.getAllMultiStreamProjections().keys(),
     ];
+    const { runInSystemRowLevelSecurityScope } = await import(
+      "@cosmicdrift/kumiko-framework/internal/row-level-security"
+    );
     const { db, close } = createDbConnection({ url: databaseUrl });
 
     try {
       await createEventConsumerStateTable(db);
-      switch (sub) {
-        case "list":
-          return await listConsumers(ctx, db, registeredConsumerNames, listConsumersWithState);
-        case "status":
-          return await showConsumerStatus(ctx, db, arg, registeredConsumerNames, getConsumerState);
-        case "restart":
-          return await transitionOne(ctx, "restart", arg, "restarted", (name) =>
-            restartConsumer(db, name),
-          );
-        case "disable":
-          return await transitionOne(ctx, "disable", arg, "disabled", (name) =>
-            disableConsumer(db, name),
-          );
-        case "enable":
-          return await transitionOne(ctx, "enable", arg, "enabled", (name) =>
-            enableConsumer(db, name),
-          );
-        case "skip":
-          return await skipOne(ctx, db, arg, skipPoisonEvent);
-      }
+      return await runInSystemRowLevelSecurityScope(
+        "operator consumer tool skips poison events, which reads the events of every tenant",
+        async () => {
+          switch (sub) {
+            case "list":
+              return await listConsumers(ctx, db, registeredConsumerNames, listConsumersWithState);
+            case "status":
+              return await showConsumerStatus(
+                ctx,
+                db,
+                arg,
+                registeredConsumerNames,
+                getConsumerState,
+              );
+            case "restart":
+              return await transitionOne(ctx, "restart", arg, "restarted", (name) =>
+                restartConsumer(db, name),
+              );
+            case "disable":
+              return await transitionOne(ctx, "disable", arg, "disabled", (name) =>
+                disableConsumer(db, name),
+              );
+            case "enable":
+              return await transitionOne(ctx, "enable", arg, "enabled", (name) =>
+                enableConsumer(db, name),
+              );
+            case "skip":
+              return await skipOne(ctx, db, arg, skipPoisonEvent);
+          }
+        },
+      );
     } catch (e) {
       ctx.out.err("");
       ctx.out.err(`  ✗ ${e instanceof Error ? e.message : String(e)}`);

package/src/commands/ops/backfill-pii.ts

@@ -223,11 +223,18 @@ export async function runBackfillPii(ctx: CliCommandContext): Promise<number> {
     crypto.configurePiiSubjectKms(wiring.kms);
     crypto.configureBlindIndexKey(wiring.blindIndexKey);
     const registry = createRegistry(config.features);
+    const { runInSystemRowLevelSecurityScope } = await import(
+      "@cosmicdrift/kumiko-framework/internal/row-level-security"
+    );
     const { db, close } = createDbConnection({ url: databaseUrl, maxConnections: 4 });
     try {
-      return args.mode === "rebuild"
-        ? await rebuildPiiProjections(ctx, db, registry, crypto)
-        : await backfillPii(ctx, db, registry, args);
+      return await runInSystemRowLevelSecurityScope(
+        "operator PII backfill rewrites events and projections of every tenant",
+        () =>
+          args.mode === "rebuild"
+            ? rebuildPiiProjections(ctx, db, registry, crypto)
+            : backfillPii(ctx, db, registry, args),
+      );
     } finally {
       await close();
     }

package/src/commands/ops/waitlist-migrate.ts

@@ -68,6 +68,9 @@ export const waitlistMigrateOp = {
 
     const dryRun = ctx.argv.includes("--dry-run");
     const { createDbConnection } = await import("@cosmicdrift/kumiko-framework/db");
+    const { runInSystemRowLevelSecurityScope } = await import(
+      "@cosmicdrift/kumiko-framework/internal/row-level-security"
+    );
     const { db, close } = createDbConnection({ url: checked.databaseUrl });
     let wiring: Awaited<ReturnType<typeof wireKmsFromEnv>> | undefined;
     try {
@@ -80,12 +83,16 @@ export const waitlistMigrateOp = {
         allowPlaintextPii: flagValue(ctx.argv, "--allow-plaintext-pii"),
         consequence: "The import would store personal data as plaintext in the event log.",
       });
-      const report = await migrateLegacyWaitlist(db, {
-        from,
-        dryRun,
-        sourceTable: flagValue(ctx.argv, "--source-table") ?? DEFAULT_LEGACY_SOURCE_TABLE[from],
-        defaultLocale: flagValue(ctx.argv, "--locale") ?? DEFAULT_IMPORT_LOCALE,
-      });
+      const report = await runInSystemRowLevelSecurityScope(
+        "operator waitlist migration imports signups into the platform tenant and archives legacy streams",
+        () =>
+          migrateLegacyWaitlist(db, {
+            from,
+            dryRun,
+            sourceTable: flagValue(ctx.argv, "--source-table") ?? DEFAULT_LEGACY_SOURCE_TABLE[from],
+            defaultLocale: flagValue(ctx.argv, "--locale") ?? DEFAULT_IMPORT_LOCALE,
+          }),
+      );
       ctx.out.log("");
       ctx.out.log(
         `  ${dryRun ? "[dry-run] " : ""}waitlist-migrate --from ${from}: read ${report.read}, ${dryRun ? "would create" : "created"} ${report.created}, already present ${report.skipped}, unreadable ${report.unreadable}, legacy streams ${dryRun ? "would archive" : "archived"} ${report.archivedStreams}`,

package/src/commands/project.ts

@@ -67,6 +67,9 @@ export const projectCommand: CliCommand = {
     } = await import("@cosmicdrift/kumiko-framework/pipeline");
 
     const registry = createRegistry(config.features);
+    const { runInSystemRowLevelSecurityScope } = await import(
+      "@cosmicdrift/kumiko-framework/internal/row-level-security"
+    );
     const { db, close } = createDbConnection({ url: databaseUrl });
     let wiring: Awaited<ReturnType<typeof wireKmsFromEnv>> | undefined;
 
@@ -80,14 +83,19 @@ export const projectCommand: CliCommand = {
         });
       }
       await createProjectionStateTable(db);
-      switch (sub) {
-        case "list":
-          return await listProjections(ctx, db, registry, listProjectionsWithState);
-        case "status":
-          return await showProjectionStatus(ctx, db, arg, registry, getProjectionState);
-        case "rebuild":
-          return await rebuildOne(ctx, db, arg, registry, rebuildProjection);
-      }
+      return await runInSystemRowLevelSecurityScope(
+        "operator projection tool reads and rebuilds projections of every tenant",
+        async () => {
+          switch (sub) {
+            case "list":
+              return await listProjections(ctx, db, registry, listProjectionsWithState);
+            case "status":
+              return await showProjectionStatus(ctx, db, arg, registry, getProjectionState);
+            case "rebuild":
+              return await rebuildOne(ctx, db, arg, registry, rebuildProjection);
+          }
+        },
+      );
     } catch (e) {
       ctx.out.err("");
       ctx.out.err(`  ✗ ${e instanceof Error ? e.message : String(e)}`);