@cosmicdrift/kumiko-framework 0.113.1 → 1.0.0

package/src/secrets/types.ts

@@ -56,11 +56,6 @@ type Primitive = string | number | boolean | bigint | symbol | null | undefined;
 
 // Opaque built-in leaves a response legitimately carries; never recurse into
 // them. Extend when the bundled-features tsc sweep surfaces a real leaf type.
-// Map/Set (556/2): `keyof Map<K,V>` yields method names, not V, so these
-// already fell through to `false` via the object-mapped-type branch — listed
-// explicitly here so the compile-time treatment matches leak-guard.ts's
-// runtime `instanceof Map`/`instanceof Set` branch (walk entries separately)
-// instead of looking like an oversight.
 type SafeLeaf =
   | Date
   | RegExp
@@ -71,9 +66,7 @@ type SafeLeaf =
   | Temporal.PlainTime
   | Temporal.PlainYearMonth
   | Temporal.PlainMonthDay
-  | Temporal.Duration
-  | Map<unknown, unknown>
-  | Set<unknown>;
+  | Temporal.Duration;
 
 export type ContainsSecret<T> = [T] extends [never]
   ? false
@@ -144,14 +137,6 @@ export type Envelope = {
   readonly kekVersion: number;
 };
 
-// BYOK hook: callers pass the tenant a value belongs to; a per-tenant-KMS
-// provider keys its wrap/unwrap on it. EnvMasterKeyProvider (app-wide
-// keyring) ignores it — the param exists so the contract doesn't have to
-// break when a tenant-scoped provider ships.
-export type KeyScope = {
-  readonly tenantId?: TenantId;
-};
-
 // The contract a KEK backend must fulfil. The framework sees only this
 // interface; concrete implementations live in separate packages
 // (@cosmicdrift/kumiko-secrets-vault, @cosmicdrift/kumiko-secrets-aws-kms, ...). The default is
@@ -160,12 +145,12 @@ export interface MasterKeyProvider {
   // Wrap a fresh DEK with the current KEK. Returns the wrapped bytes + the
   // KEK version used — the version ends up in the Envelope so decryption
   // later knows which KEK to ask for.
-  wrapDek(dek: Buffer, scope?: KeyScope): Promise<{ encryptedDek: Buffer; kekVersion: number }>;
+  wrapDek(dek: Buffer): Promise<{ encryptedDek: Buffer; kekVersion: number }>;
 
   // Unwrap a previously-wrapped DEK. During rotation the provider must
   // accept older kekVersion values (2-version window minimum), otherwise
   // old rows become unreadable.
-  unwrapDek(encryptedDek: Buffer, kekVersion: number, scope?: KeyScope): Promise<Buffer>;
+  unwrapDek(encryptedDek: Buffer, kekVersion: number): Promise<Buffer>;
 
   // Which KEK version new wraps use. Rotation flips this to a new value
   // and older-version reads continue to work until rows are re-wrapped.

package/src/testing/e2e-generator.ts

@@ -112,9 +112,6 @@ export function generateE2ESpec(
     // pro Field geschrieben, ohne CRUD-Zustand zu generieren wäre der
     // Spec wertlos. Branding/SMTP/etc. sind Author-spezifisch.
     if (screen.type === "configEdit") continue;
-    // projectionList: query-getrieben, Author-spezifische Projection —
-    // kein generischer CRUD-Spec ableitbar (wie actionForm/configEdit).
-    if (screen.type === "projectionList") continue;
     const { scope: feature, name: short } = parseQn(screenQn);
     const urlPath = `/t/${tenant}/${feature}/${short}`;
     const title = `${feature}/${short}`;

package/src/testing/index.ts

@@ -25,8 +25,6 @@ export { createLateBoundHolder, type LateBoundHolder } from "./late-bound";
 export { buildMultipartBody, patchFileInstanceofForBunTest } from "./multipart-helper";
 export {
   createMutableMasterKeyProvider,
-  createTestEnvelopeCipher,
-  createTestMasterKeyProvider,
   type MutableMasterKeyProvider,
 } from "./mutable-master-key-provider";
 export {

package/src/testing/mutable-master-key-provider.ts

@@ -6,14 +6,7 @@
 // tests that want to exercise pre- and post-rotation behaviour in a
 // single suite.
 
-import { randomBytes } from "node:crypto";
-import {
-  createEnvelopeCipher,
-  createEnvMasterKeyProvider,
-  type EnvelopeCipher,
-  type EnvelopeCipherOptions,
-  type MasterKeyProvider,
-} from "../secrets";
+import type { MasterKeyProvider } from "../secrets";
 
 export type MutableMasterKeyProvider = MasterKeyProvider & {
   // Replace the backing provider. All future wrapDek/unwrapDek/currentVersion
@@ -27,8 +20,8 @@ export function createMutableMasterKeyProvider(
 ): MutableMasterKeyProvider {
   let current = initial;
   return {
-    wrapDek: (dek, scope) => current.wrapDek(dek, scope),
-    unwrapDek: (e, v, scope) => current.unwrapDek(e, v, scope),
+    wrapDek: (dek) => current.wrapDek(dek),
+    unwrapDek: (e, v) => current.unwrapDek(e, v),
     currentVersion: () => current.currentVersion(),
     isAvailable: () => current.isAvailable(),
     replace: (next) => {
@@ -36,22 +29,3 @@ export function createMutableMasterKeyProvider(
     },
   };
 }
-
-// Single-version env provider for tests — the shape every integration test
-// needs to exercise encrypted config keys / entity fields without caring
-// about keyring mechanics. Pass a fixed key to share it across stacks.
-export function createTestMasterKeyProvider(keyBase64?: string): MasterKeyProvider {
-  return createEnvMasterKeyProvider({
-    env: {
-      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
-      KUMIKO_SECRETS_MASTER_KEY_V1: keyBase64 ?? randomBytes(32).toString("base64"),
-    },
-  });
-}
-
-export function createTestEnvelopeCipher(
-  keyBase64?: string,
-  opts?: EnvelopeCipherOptions,
-): EnvelopeCipher {
-  return createEnvelopeCipher(createTestMasterKeyProvider(keyBase64), opts ?? {});
-}

package/src/time/__tests__/tz-dateline.test.ts

@@ -1,7 +1,9 @@
-// Pacific/Apia sits far east of the dateline at UTC+13/+14 — a morning wall
-// clock there falls on the PREVIOUS UTC calendar day. Phrased as a date-
-// ordering property (not a fixed offset) so the test stays green regardless
-// of the tzdata DST view (UTC+13 and +14 both push 10:00 to the prior day).
+// Pacific/Apia (Samoa) liegt weit östlich der Datumsgrenze bei UTC+13/+14 —
+// eine Vormittags-Wall-Clock dort fällt in UTC auf den VORHERIGEN Kalendertag.
+// Das Plan-Doc (timezones.md) nennt Apia explizit als Datumsgrenzen-Edge-Case
+// der TZ-Matrix. Als Datums-Ordnungs-Eigenschaft formuliert, damit der Test
+// unabhängig von der DST-Sicht der tzdata grün bleibt (UTC+13 wie +14 schieben
+// 10:00 auf den Vortag).
 
 import { beforeAll, describe, expect, test } from "bun:test";
 import { ensureTemporalPolyfill } from "../polyfill";
@@ -11,8 +13,8 @@ beforeAll(async () => {
   await ensureTemporalPolyfill();
 });
 
-describe("ctx.tz — Pacific/Apia dateline", () => {
-  test("a morning wall clock in Apia maps to the previous UTC calendar day", () => {
+describe("ctx.tz — Pacific/Apia Datumsgrenze", () => {
+  test("Vormittags-Wall-Clock in Apia mappt auf den vorherigen UTC-Kalendertag", () => {
     const tz = createTzContext();
     const zdt = tz.parse("2026-01-15T10:00:00", "Pacific/Apia");
     expect(zdt.timeZoneId).toBe("Pacific/Apia");
@@ -20,11 +22,11 @@ describe("ctx.tz — Pacific/Apia dateline", () => {
     const utcDate = zdt.toInstant().toZonedDateTimeISO("UTC").toPlainDate().toString();
     expect(utcDate).toBe("2026-01-14");
 
-    // Offset is a large positive value (UTC+13 or +14).
+    // Offset ist ein großer positiver Wert (UTC+13 oder +14).
     expect(zdt.offsetNanoseconds).toBeGreaterThan(12 * 3600 * 1e9);
   });
 
-  test("round-trip preserves wall clock + instant across the dateline", () => {
+  test("Round-Trip bewahrt Wall-Clock + Instant über die Datumsgrenze", () => {
     const tz = createTzContext();
     const original = tz.parse("2026-01-15T10:00:00", "Pacific/Apia");
     const restored = tz.fromLocatedJson(tz.toLocatedJson(original));

package/src/ui-types/index.ts

@@ -57,7 +57,6 @@ export type {
   FieldRenderer,
   ListColumnSpec,
   PlatformComponent,
-  ProjectionListScreenDefinition,
   RowAction,
   RowActionNavigate,
   RowActionWriteHandler,

package/src/api/__tests__/pat-scope.test.ts

@@ -1,36 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import { patAllows, qnMatches } from "../pat-scope";
-
-describe("qnMatches", () => {
-  it("exact match", () => {
-    expect(qnMatches("credit:query:schedule", "credit:query:schedule")).toBe(true);
-    expect(qnMatches("credit:query:schedule", "credit:query:credit:list")).toBe(false);
-  });
-
-  it("wildcard suffix matches on prefix", () => {
-    expect(qnMatches("credit:write:bauspar:*", "credit:write:bauspar:create")).toBe(true);
-    expect(qnMatches("credit:write:bauspar:*", "credit:write:bauspar:delete")).toBe(true);
-    expect(qnMatches("credit:write:bauspar:*", "credit:write:create")).toBe(false);
-  });
-
-  it("bare wildcard matches everything", () => {
-    expect(qnMatches("*", "anything:at:all")).toBe(true);
-  });
-});
-
-describe("patAllows", () => {
-  const allowed = ["credit:write:create", "credit:write:bauspar:*"];
-
-  it("permits an exact or wildcard-covered type", () => {
-    expect(patAllows(allowed, "credit:write:create")).toBe(true);
-    expect(patAllows(allowed, "credit:write:bauspar:update")).toBe(true);
-  });
-
-  it("denies a type no scope covers", () => {
-    expect(patAllows(allowed, "credit:write:credit:delete")).toBe(false);
-  });
-
-  it("fail-closed on an empty allow-list", () => {
-    expect(patAllows([], "credit:write:create")).toBe(false);
-  });
-});

package/src/api/pat-scope.ts

@@ -1,14 +0,0 @@
-// QN scope-matching for Personal Access Tokens. A token's granted scopes
-// expand (in the PAT feature's resolver) to QN globs like "credit:write:*" or
-// "credit:query:credit:list". A glob ending in "*" matches any dispatch type
-// sharing the prefix; otherwise it is an exact match. Fail-closed: an empty
-// allow-list matches nothing, so a PAT with no scopes can call nothing.
-
-export function qnMatches(pattern: string, type: string): boolean {
-  if (pattern.endsWith("*")) return type.startsWith(pattern.slice(0, -1));
-  return pattern === type;
-}
-
-export function patAllows(allowedQns: readonly string[], type: string): boolean {
-  return allowedQns.some((pattern) => qnMatches(pattern, type));
-}

package/src/engine/__tests__/extend-entity-projection.test.ts

@@ -1,123 +0,0 @@
-// r.extendEntityProjection — registrar/registry contracts (#759). The
-// runtime rebuild-replay behaviour is proven in
-// custom-fields/__tests__/custom-fields.integration.test.ts.
-
-import { describe, expect, test } from "bun:test";
-import { z } from "zod";
-import { defineFeature } from "../define-feature";
-import { createEntity, createTextField } from "../factories";
-import { createRegistry } from "../registry";
-
-function exampleEntity(name = "unit") {
-  return createEntity({
-    table: name,
-    fields: { name: createTextField() },
-  });
-}
-
-const noopApply = async (): Promise<void> => {};
-
-describe("r.extendEntityProjection — registration", () => {
-  test("merges apply keys + extraSources into the implicit projection", () => {
-    const feature = defineFeature("test", (r) => {
-      r.entity("unit", exampleEntity());
-      const setEvent = r.defineEvent("custom-field-set", z.object({ fieldKey: z.string() }));
-      r.extendEntityProjection("unit", {
-        sources: ["field-definition"],
-        apply: { [setEvent.name]: noopApply },
-      });
-    });
-    const registry = createRegistry([feature]);
-    const projection = registry.getAllProjections().get("test:projection:unit-entity");
-    expect(projection).toBeDefined();
-    expect(projection?.apply["test:event:custom-field-set"]).toBe(noopApply);
-    expect(projection?.apply["unit.created"]).toBeDefined();
-    expect(projection?.extraSources).toEqual(["field-definition"]);
-    expect(projection?.source).toBe("unit");
-  });
-
-  test("extension source equal to the entity name is not duplicated into extraSources", () => {
-    const feature = defineFeature("test", (r) => {
-      r.entity("unit", exampleEntity());
-      const setEvent = r.defineEvent("custom-field-set", z.object({ fieldKey: z.string() }));
-      r.extendEntityProjection("unit", {
-        sources: ["unit"],
-        apply: { [setEvent.name]: noopApply },
-      });
-    });
-    const registry = createRegistry([feature]);
-    const projection = registry.getAllProjections().get("test:projection:unit-entity");
-    expect(projection?.extraSources).toBeUndefined();
-  });
-
-  test("auto-verb of a registered extraSources entity is a valid apply-key", () => {
-    const feature = defineFeature("test", (r) => {
-      r.entity("unit", exampleEntity());
-      r.entity("field-definition", exampleEntity("field_definitions"));
-      r.extendEntityProjection("unit", {
-        sources: ["field-definition"],
-        apply: { "field-definition.deleted": noopApply },
-      });
-    });
-    const registry = createRegistry([feature]);
-    const projection = registry.getAllProjections().get("test:projection:unit-entity");
-    expect(projection?.apply["field-definition.deleted"]).toBe(noopApply);
-  });
-
-  test("registration order is free: extension before r.entity in the same feature", () => {
-    const feature = defineFeature("test", (r) => {
-      const setEvent = r.defineEvent("custom-field-set", z.object({ fieldKey: z.string() }));
-      r.extendEntityProjection("unit", { apply: { [setEvent.name]: noopApply } });
-      r.entity("unit", exampleEntity());
-    });
-    const registry = createRegistry([feature]);
-    const projection = registry.getAllProjections().get("test:projection:unit-entity");
-    expect(projection?.apply["test:event:custom-field-set"]).toBe(noopApply);
-  });
-
-  test("empty apply throws at registration time", () => {
-    expect(() =>
-      defineFeature("test", (r) => {
-        r.entity("unit", exampleEntity());
-        r.extendEntityProjection("unit", { apply: {} });
-      }),
-    ).toThrow(/no apply handlers/);
-  });
-});
-
-describe("r.extendEntityProjection — registry-build validation", () => {
-  test("unknown entity fails at registry build", () => {
-    const feature = defineFeature("test", (r) => {
-      r.entity("unit", exampleEntity());
-      const setEvent = r.defineEvent("custom-field-set", z.object({ fieldKey: z.string() }));
-      r.extendEntityProjection("typo-entity", { apply: { [setEvent.name]: noopApply } });
-    });
-    expect(() => createRegistry([feature])).toThrow(/no r\.entity/);
-  });
-
-  test("apply-key collision with a lifecycle apply fails at registry build", () => {
-    const feature = defineFeature("test", (r) => {
-      r.entity("unit", exampleEntity());
-      r.extendEntityProjection("unit", { apply: { "unit.created": noopApply } });
-    });
-    expect(() => createRegistry([feature])).toThrow(/collides/);
-  });
-
-  test("apply-key collision between two extensions fails at registry build", () => {
-    const feature = defineFeature("test", (r) => {
-      r.entity("unit", exampleEntity());
-      const setEvent = r.defineEvent("custom-field-set", z.object({ fieldKey: z.string() }));
-      r.extendEntityProjection("unit", { apply: { [setEvent.name]: noopApply } });
-      r.extendEntityProjection("unit", { apply: { [setEvent.name]: noopApply } });
-    });
-    expect(() => createRegistry([feature])).toThrow(/collides/);
-  });
-
-  test("unknown apply-key (neither auto-verb nor domain event) fails at registry build", () => {
-    const feature = defineFeature("test", (r) => {
-      r.entity("unit", exampleEntity());
-      r.extendEntityProjection("unit", { apply: { "customField.set": noopApply } });
-    });
-    expect(() => createRegistry([feature])).toThrow(/no such event/);
-  });
-});

package/src/event-store/rebuild-dead-letter.ts

@@ -1,111 +0,0 @@
-// Dead-letter storage for apply-handler failures during projection rebuild.
-//
-// Background: rebuildProjection / rebuildMultiStreamProjection replay the
-// event log through apply handlers inside ONE transaction. A single event
-// whose (possibly years-old) payload makes its apply throw rolls the whole
-// replay back — the projection stays permanently un-rebuildable until the
-// event is repaired by hand. The upcaster dead-letter only quarantines
-// upcast-TRANSFORM failures, not apply failures (#760).
-//
-// Quarantine mode (errorPolicy.skipApplyErrors on RebuildDeps, or
-// MspErrorMode.rebuild.skipApplyErrors on the MSP definition) confines each
-// apply to a savepoint: a throwing apply is rolled back, captured into
-// `kumiko_rebuild_dead_letters`, and the replay continues. Replay-after-fix
-// is a separate ops step — same stance as the upcaster dead-letter.
-
-import type { DbConnection, DbRunner } from "../db/connection";
-import { bigint, index, jsonb, table as pgTable, text, timestamp, uuid } from "../db/dialect";
-import { tableExists } from "../db/schema-inspection";
-import { unsafePushTables } from "../stack";
-import type { StoredEvent } from "./event-store";
-
-export const rebuildDeadLetterTable = pgTable(
-  "kumiko_rebuild_dead_letters",
-  {
-    // Surrogate PK — the same event can land here across multiple rebuild
-    // attempts before the fix ships, without unique-violation noise.
-    id: bigint("id", { mode: "bigint" }).primaryKey().generatedAlwaysAsIdentity(),
-    projectionName: text("projection_name").notNull(),
-    // StoredEvent.id is surfaced as `string` (bigint serialised for JSON
-    // safety) — stored as text to keep the round-trip identity.
-    eventId: text("event_id").notNull(),
-    tenantId: uuid("tenant_id").notNull(),
-    aggregateId: text("aggregate_id").notNull(),
-    aggregateType: text("aggregate_type").notNull(),
-    eventType: text("event_type").notNull(),
-    errorMessage: text("error_message").notNull(),
-    payload: jsonb("payload").notNull(),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-  },
-  (t) => ({
-    projectionIdx: index("rebuild_dead_letters_projection_idx").on(t.projectionName),
-    createdAtIdx: index("rebuild_dead_letters_created_at_idx").on(t.createdAt),
-  }),
-);
-
-// Idempotent table-create. The rebuild runners call this before the rebuild
-// tx whenever quarantine mode is active, so the opt-in works on databases
-// provisioned before this table existed.
-export async function createRebuildDeadLetterTable(db: DbConnection): Promise<void> {
-  // skip: table already exists — bootstrap called from multiple paths
-  if (await tableExists(db, "public.kumiko_rebuild_dead_letters")) return;
-  await unsafePushTables(db, { kumikoRebuildDeadLetters: rebuildDeadLetterTable });
-}
-
-export type SkippedApply = {
-  readonly event: StoredEvent;
-  readonly error: unknown;
-};
-
-// Bulk-write, called ONCE at the end of a quarantining rebuild (inside its
-// tx). Unqualified insert — during the rebuild the search_path points at the
-// shadow schema, and this table exists only in public, so it falls through.
-export async function recordRebuildDeadLetters(
-  db: DbRunner,
-  projectionName: string,
-  skipped: readonly SkippedApply[],
-): Promise<void> {
-  const { insertMany } = await import("../bun-db/query");
-  await insertMany(
-    db,
-    rebuildDeadLetterTable,
-    skipped.map(({ event, error }) => ({
-      projectionName,
-      eventId: event.id,
-      tenantId: event.tenantId,
-      aggregateId: event.aggregateId,
-      aggregateType: event.aggregateType,
-      eventType: event.type,
-      errorMessage: error instanceof Error ? error.message : String(error),
-      payload: event.payload,
-    })),
-  );
-}
-
-export type RebuildDeadLetterRow = {
-  readonly id: bigint;
-  readonly projectionName: string;
-  readonly eventId: string;
-  readonly tenantId: string;
-  readonly aggregateId: string;
-  readonly aggregateType: string;
-  readonly eventType: string;
-  readonly errorMessage: string;
-  readonly payload: Record<string, unknown>;
-  readonly createdAt: Date;
-};
-
-// Ops-side triage query, optionally scoped to one projection.
-export async function listRebuildDeadLetters(
-  db: DbConnection,
-  options: { projectionName?: string; limit?: number } = {},
-): Promise<readonly RebuildDeadLetterRow[]> {
-  const { selectMany } = await import("../bun-db/query");
-  const limit = options.limit ?? 100;
-  const where =
-    options.projectionName !== undefined ? { projectionName: options.projectionName } : undefined;
-  return selectMany<RebuildDeadLetterRow>(db, rebuildDeadLetterTable, where, {
-    orderBy: { col: "createdAt", direction: "desc" },
-    limit,
-  });
-}

package/src/files/__tests__/provider-resolver.test.ts

@@ -1,70 +0,0 @@
-import { describe, expect, mock, test } from "bun:test";
-import type { Registry } from "../../engine/types";
-import { makeFileProviderResolver } from "../provider-resolver";
-import type { FileStorageProvider } from "../types";
-
-const fakeProvider = { name: "fake" } as unknown as FileStorageProvider;
-
-function fakeRegistry(): Registry {
-  return {
-    getExtensionUsages: () => [
-      {
-        entityName: "fake",
-        options: { build: async () => fakeProvider },
-      },
-    ],
-  } as unknown as Registry;
-}
-
-// 698/2: resolveProvider must not re-read config + secrets on every call —
-// the provider is effectively static per tenant for the process lifetime.
-describe("makeFileProviderResolver — per-tenant cache", () => {
-  test("a second resolve for the same tenant reuses the cached build, doesn't call configAccessorFactory again", async () => {
-    const configAccessorFactory = mock(() => async (_key: unknown) => "fake");
-    const resolver = makeFileProviderResolver({
-      registry: fakeRegistry(),
-      _configAccessorFactory: configAccessorFactory,
-      db: {} as never,
-    });
-
-    const first = await resolver("tenant-a" as never);
-    const second = await resolver("tenant-a" as never);
-
-    expect(first).toBe(fakeProvider);
-    expect(second).toBe(fakeProvider);
-    expect(configAccessorFactory).toHaveBeenCalledTimes(1);
-  });
-
-  test("different tenants get independent cache entries", async () => {
-    const configAccessorFactory = mock(() => async (_key: unknown) => "fake");
-    const resolver = makeFileProviderResolver({
-      registry: fakeRegistry(),
-      _configAccessorFactory: configAccessorFactory,
-      db: {} as never,
-    });
-
-    await resolver("tenant-a" as never);
-    await resolver("tenant-b" as never);
-
-    expect(configAccessorFactory).toHaveBeenCalledTimes(2);
-  });
-
-  test("a rejected build is evicted — the next call retries instead of staying poisoned", async () => {
-    let calls = 0;
-    const resolver = makeFileProviderResolver({
-      registry: {
-        getExtensionUsages: () => {
-          calls++;
-          if (calls === 1) throw new Error("transient failure");
-          return [{ entityName: "fake", options: { build: async () => fakeProvider } }];
-        },
-      } as unknown as Registry,
-      _configAccessorFactory: () => async (_key: unknown) => "fake",
-      db: {} as never,
-    });
-
-    await expect(resolver("tenant-a" as never)).rejects.toThrow("transient failure");
-    const second = await resolver("tenant-a" as never);
-    expect(second).toBe(fakeProvider);
-  });
-});