@cosmicdrift/kumiko-framework 0.146.1 → 0.146.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.146.1",
+  "version": "0.146.3",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -189,7 +189,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.146.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.146.3",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/auth-routes.ts

@@ -2,7 +2,7 @@ import type { Context } from "hono";
 import { Hono } from "hono";
 import { deleteCookie, setCookie } from "hono/cookie";
 import { z } from "zod";
-import { stripForbiddenMembershipRoles } from "../engine/membership-roles";
+import { buildSessionRoles } from "../engine/membership-roles";
 import { createSystemUser } from "../engine/system-user";
 import { type SessionUser, SYSTEM_TENANT_ID, type TenantId } from "../engine/types";
 import { NotFoundError } from "../errors";
@@ -870,13 +870,12 @@ export function createAuthRoutes(
     // tenant A accidentally surviving into tenant B's session). The
     // resolver runs each feature's r.authClaims() hook under the new
     // TenantDb scope.
-    // Strip reserved roles from the membership portion only — globalRoles
+    // buildSessionRoles calls stripForbiddenMembershipRoles internally and
+    // strips reserved roles from the membership side only — globalRoles
     // (where SystemAdmin legitimately lives) is never filtered. Backstop for a
     // membership role that a projection rebuild resurrected past command-time
     // validation (see engine/membership-roles).
-    const mergedRoles = Array.from(
-      new Set([...globalRoles, ...stripForbiddenMembershipRoles(membership.roles)]),
-    );
+    const mergedRoles = buildSessionRoles(globalRoles, membership.roles);
     const targetSession: SessionUser = {
       id: user.id,
       tenantId: targetTenantId,

package/src/engine/__tests__/codemod-pipeline.test.ts

@@ -103,14 +103,14 @@ export const myHandler = defineWriteHandler({
 `;
 
 const alreadyPipelineContent = `\
-import { access, defineWriteHandler, pipeline } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 
 export const myHandler = defineWriteHandler({
   name: "test:pipeline",
   schema: z.object({}),
   access: { roles: access.authenticated },
-  perform: pipeline(({ event, r }) => [
+  perform: stepsPipeline(({ event, r }) => [
     r.step.return((ctx) => ({ isSuccess: true, data: { ok: true } })),
   ]),
 });
@@ -173,14 +173,14 @@ describe("analyzeFile", () => {
 
 describe("convertFile", () => {
   describe("static return handler", () => {
-    it("converts handler to perform: pipeline(...)", async () => {
+    it("converts handler to perform: stepsPipeline(...)", async () => {
       const p = writeFixture("static-convert.write.ts", staticReturnContent);
       const result = await convertFile(p);
       expect(result.status).toBe("converted");
       const content = readFileSync(p, "utf8");
-      expect(content).toContain("perform: pipeline");
+      expect(content).toContain("perform: stepsPipeline");
       expect(content).toContain("r.step.return");
-      expect(content).toContain("import { access, defineWriteHandler, pipeline }");
+      expect(content).toContain("import { access, defineWriteHandler, stepsPipeline }");
       expect(content).not.toContain("handler:");
     });
 
@@ -198,7 +198,7 @@ export const h = defineWriteHandler({
       const result = await convertFile(p);
       expect(result.status).toBe("converted");
       const converted = readFileSync(p, "utf8");
-      expect(converted).toContain("pipeline<typeof MySchema, unknown>");
+      expect(converted).toContain("stepsPipeline<typeof MySchema, unknown>");
     });
   });
 
@@ -271,12 +271,12 @@ export const h = defineWriteHandler({
       const result = await convertFile(p);
       expect(result.status).toBe("converted");
       const content = readFileSync(p, "utf8");
-      expect(content).toContain("import { access, defineWriteHandler, pipeline }");
+      expect(content).toContain("import { access, defineWriteHandler, stepsPipeline }");
     });
 
     it("does not duplicate pipeline import when already present", async () => {
       const content = `\
-import { access, defineWriteHandler, pipeline } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 
 export const h = defineWriteHandler({
@@ -288,7 +288,9 @@ export const h = defineWriteHandler({
       const result = await convertFile(p);
       expect(result.status).toBe("converted");
       const final = readFileSync(p, "utf8").split("\n");
-      const pipelineImports = final.filter((l) => l.includes("import") && l.includes("pipeline"));
+      const pipelineImports = final.filter(
+        (l) => l.includes("import") && l.includes("stepsPipeline"),
+      );
       // Only one import line should contain "pipeline"
       expect(pipelineImports.length).toBe(1);
     });
@@ -513,14 +515,14 @@ describe("generatePerformBlock", () => {
   it("generates pipeline block for static return", () => {
     const analysis = analyzeHandlerArrow("async () => ({ isSuccess: true, data: { ok: true } })");
     const block = generatePerformBlock(analysis, "", "  ");
-    expect(block).toContain("perform: pipeline(");
+    expect(block).toContain("perform: stepsPipeline(");
     expect(block).toContain("r.step.return((ctx) => ({ isSuccess: true, data: { ok: true } })");
   });
 
   it("generates pipeline block with schema type parameter", () => {
     const analysis = analyzeHandlerArrow("async () => ({ isSuccess: true, data: { ok: true } })");
     const block = generatePerformBlock(analysis, "typeof InvoiceSchema", "  ");
-    expect(block).toContain("pipeline<typeof InvoiceSchema, unknown>");
+    expect(block).toContain("stepsPipeline<typeof InvoiceSchema, unknown>");
   });
 
   it("returns null for non-convertible analysis", () => {

package/src/engine/__tests__/pipeline-engine.test.ts

@@ -1,4 +1,4 @@
-// Pipeline-engine unit tests — defineWriteHandler({ perform: pipeline(...) })
+// Pipeline-engine unit tests — defineWriteHandler({ perform: stepsPipeline(...) })
 // boundary, run-pipeline runner contract, defineStep registry guards.
 // Sub-step-builders (branch, forEach) live in pipeline-sub-pipelines.test.ts;
 // boot-validator in validate-projection-allowlist.test.ts.
@@ -9,7 +9,7 @@ import { z } from "zod";
 import { TestUsers } from "../../stack";
 import { defineWriteHandler } from "../define-handler";
 import { defineStep } from "../define-step";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 import type { WriteEvent } from "../types/handlers";
 import { buildMinimalCtx } from "./_pipeline-test-utils";
 
@@ -19,7 +19,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:noop",
       schema: z.object({ greeting: z.string() }),
       access: { roles: ["User"] },
-      perform: pipeline<{ greeting: string }, { echoed: string }>(({ event, r }) => [
+      perform: stepsPipeline<{ greeting: string }, { echoed: string }>(({ event, r }) => [
         r.step.return(() => ({
           isSuccess: true as const,
           data: { echoed: event.payload.greeting },
@@ -49,7 +49,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:static",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ok: boolean }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: boolean }>(({ r }) => [
         r.step.return({ isSuccess: true as const, data: { ok: true } }),
       ]),
     });
@@ -89,7 +89,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:no-return",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, never>(() => []),
+      perform: stepsPipeline<Record<string, never>, never>(() => []),
     });
 
     await expect(
@@ -105,7 +105,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:thread",
       schema: z.object({ base: z.number() }),
       access: { roles: ["User"] },
-      perform: pipeline<{ base: number }, { sum: number }>(({ event, r }) => [
+      perform: stepsPipeline<{ base: number }, { sum: number }>(({ event, r }) => [
         r.step.compute("offset", () => 10),
         r.step.compute("doubledBase", () => event.payload.base * 2),
         r.step.return(({ steps }) => ({
@@ -133,7 +133,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:fresh",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { tick: number }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { tick: number }>(({ r }) => [
         r.step.compute("tick", () => ++counter),
         r.step.return(({ steps }) => ({
           isSuccess: true as const,
@@ -161,7 +161,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:unknown-kind",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, never>(() => [
+      perform: stepsPipeline<Record<string, never>, never>(() => [
         // Hand-crafted instance with a kind that's never been registered —
         // simulates a typo in a future step-builder factory.
         { kind: "this-step-does-not-exist", args: {} },
@@ -190,7 +190,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       schema: z.object({}),
       access: { roles: ["User"] },
       handler: async () => ({ isSuccess: true as const, data: {} }),
-      perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
         r.step.return({ isSuccess: true as const, data: { ok: true } }),
       ]),
     } as unknown as Parameters<typeof defineWriteHandler>[0];

package/src/engine/__tests__/pipeline-handler.integration.test.ts

@@ -60,7 +60,7 @@ import {
 import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";
 import { createEntity, createTextField } from "../factories";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 
 const echoSchema = z.object({ greeting: z.string() });
 
@@ -70,7 +70,7 @@ const echoHandler = defineWriteHandler({
   name: "echo",
   schema: echoSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof echoSchema>, { echoed: string; from: string }>(
+  perform: stepsPipeline<z.infer<typeof echoSchema>, { echoed: string; from: string }>(
     ({ event, r }) => [
       r.step.return(() => ({
         isSuccess: true as const,
@@ -90,7 +90,7 @@ const explodeHandler = defineWriteHandler({
   name: "explode",
   schema: explodeSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof explodeSchema>, never>(({ r }) => [
+  perform: stepsPipeline<z.infer<typeof explodeSchema>, never>(({ r }) => [
     r.step.return(() => {
       throw new Error("boom");
     }),
@@ -106,7 +106,7 @@ const compoundHandler = defineWriteHandler({
   name: "compound",
   schema: compoundSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof compoundSchema>, { sum: number; userId: string }>(
+  perform: stepsPipeline<z.infer<typeof compoundSchema>, { sum: number; userId: string }>(
     ({ event, r }) => [
       r.step.compute("offset", () => 100),
       r.step.compute("doubledBase", () => event.payload.base * 2),
@@ -147,7 +147,7 @@ const logHandler = defineWriteHandler({
   schema: logSchema,
   access: { roles: ["Admin"] },
   // Outer-`event`-capture pattern — see compoundHandler above for the why.
-  perform: pipeline<z.infer<typeof logSchema>, { correlationId: string }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof logSchema>, { correlationId: string }>(({ event, r }) => [
     r.step.unsafeProjectionUpsert({
       table: pipelineDemoLogTable,
       on: ["correlationId"],
@@ -182,7 +182,7 @@ const widgetCreateHandler = defineWriteHandler({
   name: "widget:create",
   schema: widgetSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof widgetSchema>, { id: string }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof widgetSchema>, { id: string }>(({ event, r }) => [
     r.step.aggregate.create("widget", {
       executor: widgetExecutor,
       data: () => ({ label: event.payload.label }),
@@ -202,7 +202,7 @@ const annotateHandler = defineWriteHandler({
   name: "widget:annotate",
   schema: annotateSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof annotateSchema>, { id: string }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof annotateSchema>, { id: string }>(({ event, r }) => [
     r.step.aggregate.create("widget", {
       executor: widgetExecutor,
       data: () => ({ label: event.payload.label }),
@@ -230,7 +230,7 @@ const widgetUpdateHandler = defineWriteHandler({
   name: "widget:update",
   schema: widgetUpdateSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof widgetUpdateSchema>, { id: string }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof widgetUpdateSchema>, { id: string }>(({ event, r }) => [
     r.step.aggregate.update("widget", {
       executor: widgetExecutor,
       id: () => event.payload.id,
@@ -254,7 +254,7 @@ const widgetBrokenHandler = defineWriteHandler({
   name: "widget:create-broken",
   schema: z.object({}),
   access: { roles: ["Admin"] },
-  perform: pipeline<Record<string, never>, { id: string }>(({ r }) => [
+  perform: stepsPipeline<Record<string, never>, { id: string }>(({ r }) => [
     r.step.aggregate.create("widget", {
       executor: widgetExecutor,
       // Intentionally omits the `label` field that the entity declares
@@ -278,7 +278,7 @@ const widgetCreateThenThrowHandler = defineWriteHandler({
   name: "widget:create-then-throw",
   schema: z.object({ label: z.string() }),
   access: { roles: ["Admin"] },
-  perform: pipeline<{ label: string }, never>(({ event, r }) => [
+  perform: stepsPipeline<{ label: string }, never>(({ event, r }) => [
     r.step.aggregate.create("widget", {
       executor: widgetExecutor,
       data: () => ({ label: event.payload.label }),
@@ -303,7 +303,7 @@ const forEachThenThrowHandler = defineWriteHandler({
   name: "widget:foreach-then-throw",
   schema: forEachThenThrowSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<{ labels: string[] }, never>(({ event, r }) => [
+  perform: stepsPipeline<{ labels: string[] }, never>(({ event, r }) => [
     r.step.forEach({
       over: () => event.payload.labels,
       as: "label",
@@ -337,7 +337,7 @@ const lookupHandler = defineWriteHandler({
   name: "widget:lookup",
   schema: lookupSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof lookupSchema>, { found: boolean; label: string | null }>(
+  perform: stepsPipeline<z.infer<typeof lookupSchema>, { found: boolean; label: string | null }>(
     ({ event, r }) => [
       r.step.read.findOne("widget", {
         table: widgetTable,
@@ -358,7 +358,7 @@ const listAllHandler = defineWriteHandler({
   name: "widget:list",
   schema: z.object({}),
   access: { roles: ["Admin"] },
-  perform: pipeline<Record<string, never>, { count: number }>(({ r }) => [
+  perform: stepsPipeline<Record<string, never>, { count: number }>(({ r }) => [
     r.step.read.findMany("widgets", { table: widgetTable }),
     r.step.return(({ steps }) => ({
       isSuccess: true as const,
@@ -374,7 +374,7 @@ const listLimitedHandler = defineWriteHandler({
   name: "widget:list-one",
   schema: z.object({}),
   access: { roles: ["Admin"] },
-  perform: pipeline<Record<string, never>, { count: number }>(({ r }) => [
+  perform: stepsPipeline<Record<string, never>, { count: number }>(({ r }) => [
     r.step.read.findMany("widgets", { table: widgetTable, limit: 1 }),
     r.step.return(({ steps }) => ({
       isSuccess: true as const,
@@ -388,7 +388,7 @@ const purgeLogHandler = defineWriteHandler({
   name: "log:purge",
   schema: purgeLogSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof purgeLogSchema>, { ok: true }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof purgeLogSchema>, { ok: true }>(({ event, r }) => [
     r.step.unsafeProjectionDelete({
       table: pipelineDemoLogTable,
       where: () => ({ correlationId: event.payload.correlationId }),
@@ -403,7 +403,7 @@ const conditionalLogHandler = defineWriteHandler({
   name: "log:conditional",
   schema: conditionalLogSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof conditionalLogSchema>, { ok: true }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof conditionalLogSchema>, { ok: true }>(({ event, r }) => [
     r.step.branch({
       if: () => event.payload.message.length > 0,
       onTrue: [
@@ -428,7 +428,7 @@ const bulkLogHandler = defineWriteHandler({
   name: "log:bulk",
   schema: bulkLogSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof bulkLogSchema>, { count: number }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof bulkLogSchema>, { count: number }>(({ event, r }) => [
     r.step.forEach({
       over: () => event.payload.correlationIds,
       as: "correlationId",
@@ -476,7 +476,7 @@ const demoPipelineFeature = defineFeature("demoPipeline", (r) => {
 let stack: TestStack;
 const admin = TestUsers.admin;
 
-describe("defineWriteHandler({ perform: pipeline(...) }) — real dispatcher path", () => {
+describe("defineWriteHandler({ perform: stepsPipeline(...) }) — real dispatcher path", () => {
   beforeAll(async () => {
     stack = await setupTestStack({ features: [demoPipelineFeature] });
     // Push the read-side-projection table — not registered as an entity,

package/src/engine/__tests__/pipeline-observability.integration.test.ts

@@ -20,7 +20,7 @@ import { createRecordingProvider, type RecordingProvider } from "../../testing";
 import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";
 import { createEntity, createTextField } from "../factories";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 
 // Handler whose step bodies emit a span + a metric. The recording
 // provider afterwards lets us assert both landed.
@@ -30,7 +30,7 @@ const observedHandler = defineWriteHandler({
   name: "observed",
   schema: observedSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+  perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
     r.step.compute("traced", (ctx) => {
       // Span emitted from inside a step. End it explicitly because
       // step.run is sync-or-async-but-not-otel-instrumented; the

package/src/engine/__tests__/pipeline-performance.integration.test.ts

@@ -1,6 +1,6 @@
 // Pipeline-engine performance smoke-test.
 //
-// Compares the M.1 pipeline-form handler ({ perform: pipeline(...) })
+// Compares the M.1 pipeline-form handler ({ perform: stepsPipeline(...) })
 // against the equivalent free-form handler ({ handler: async (...) })
 // over N identical writes against the real Postgres stack. The point
 // is NOT to optimise — the pipeline-form is a thin wrapper, not a
@@ -28,7 +28,7 @@ import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } fr
 import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";
 import { createEntity, createNumberField, createTextField } from "../factories";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 
 // Same logical operation in both handler-forms: read input, return a
 // trivial transformed payload. No DB-write — the goal is to compare
@@ -41,7 +41,7 @@ const trivialPipeline = defineWriteHandler({
   name: "trivial:pipeline",
   schema: trivialSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<{ n: number }, { doubled: number }>(({ event, r }) => [
+  perform: stepsPipeline<{ n: number }, { doubled: number }>(({ event, r }) => [
     r.step.return(() => ({
       isSuccess: true as const,
       data: { doubled: event.payload.n * 2 },

package/src/engine/__tests__/pipeline-sub-pipelines.test.ts

@@ -9,7 +9,7 @@ import { describe, expect, it } from "bun:test";
 import { z } from "zod";
 import { TestUsers } from "../../stack";
 import { defineWriteHandler } from "../define-handler";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 import { buildBranchStep } from "../steps/branch";
 import { buildForEachStep } from "../steps/for-each";
 import { buildReturnStep } from "../steps/return";
@@ -21,7 +21,7 @@ describe("r.step.branch", () => {
       name: "demo:branch-then",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { value: number }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { value: number }>(({ r }) => [
         r.step.branch({
           if: () => true,
           onTrue: [r.step.compute("inThen", () => 42)],
@@ -47,7 +47,7 @@ describe("r.step.branch", () => {
       name: "demo:branch-else",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { value: number }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { value: number }>(({ r }) => [
         r.step.branch({
           if: () => false,
           onTrue: [r.step.compute("inThen", () => 42)],
@@ -72,7 +72,7 @@ describe("r.step.branch", () => {
       name: "demo:branch-noop",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ran: boolean }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ran: boolean }>(({ r }) => [
         r.step.branch({
           if: () => false,
           onTrue: [r.step.compute("ran", () => true)],
@@ -122,7 +122,7 @@ describe("r.step.forEach", () => {
       name: "demo:foreach",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
         r.step.forEach({
           over: () => [10, 20, 30],
           as: "n",
@@ -153,7 +153,7 @@ describe("r.step.forEach", () => {
       name: "demo:foreach-cleanup",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
         r.step.forEach({
           over: () => [1],
           as: "tmp",
@@ -180,7 +180,7 @@ describe("r.step.forEach", () => {
       name: "demo:foreach-empty",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
         r.step.forEach({
           over: () => [],
           as: "n",
@@ -233,7 +233,7 @@ describe("r.step.forEach", () => {
       name: "demo:foreach-throws",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, never>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, never>(({ r }) => [
         r.step.forEach({
           over: () => [1, 2, 3],
           as: "item",
@@ -266,7 +266,7 @@ describe("r.step.forEach", () => {
       name: "demo:foreach-bad-over",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
         r.step.forEach({
           // Cast: TypeScript would normally catch this; the test exercises
           // the runtime guard for hand-crafted / dynamically built cases.

package/src/engine/__tests__/validate-projection-allowlist.test.ts

@@ -11,7 +11,7 @@ import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";
 import { defineStep } from "../define-step";
 import { createEntity, createTextField } from "../factories";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 import { validateProjectionAllowlist } from "../validate-projection-allowlist";
 
 describe("validateProjectionAllowlist", () => {
@@ -28,7 +28,7 @@ describe("validateProjectionAllowlist", () => {
           name: "log",
           schema: z.object({ msg: z.string() }),
           access: { roles: ["User"] },
-          perform: pipeline<{ msg: string }, { ok: true }>(({ event, r }) => [
+          perform: stepsPipeline<{ msg: string }, { ok: true }>(({ event, r }) => [
             r.step.unsafeProjectionUpsert({
               table: demoLogTable,
               on: ["id"],
@@ -70,7 +70,7 @@ describe("validateProjectionAllowlist", () => {
           name: "sneaky",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.unsafeProjectionUpsert({
               table: widgetsTable,
               on: ["id"],
@@ -113,7 +113,7 @@ describe("validateProjectionAllowlist", () => {
           name: "sneaky-delete",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.unsafeProjectionDelete({
               table: widgetsTable,
               where: () => ({ id: "anything" }),
@@ -136,7 +136,7 @@ describe("validateProjectionAllowlist", () => {
           name: "purge",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.unsafeProjectionDelete({
               table: demoLogTable,
               where: () => ({ id: "anything" }),
@@ -162,7 +162,7 @@ describe("validateProjectionAllowlist", () => {
           name: "branchedWrite",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.branch({
               if: () => true,
               onTrue: [
@@ -195,7 +195,7 @@ describe("validateProjectionAllowlist", () => {
           name: "nestedWrite",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.forEach({
               over: () => [],
               as: "item",
@@ -230,7 +230,7 @@ describe("validateProjectionAllowlist", () => {
           name: "loopedWrite",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.forEach({
               over: () => [],
               as: "x",
@@ -267,7 +267,7 @@ describe("validateProjectionAllowlist", () => {
           name: "futureBuilder",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             // Hand-crafted StepInstance simulating a future builder
             // whose kind isn't registered via defineStep yet.
             {
@@ -316,7 +316,7 @@ describe("validateProjectionAllowlist", () => {
           name: "futureBuilder",
           schema: z.object({}),
           access: { roles: ["User"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             {
               kind: futureKind,
               args: {
@@ -380,7 +380,7 @@ describe("validateProjectionAllowlist", () => {
           name: "sneak",
           schema: z.object({}),
           access: { roles: ["Admin"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.webhook.send({
               url: "https://hooks.example/sneak",
               mode: "deferred",
@@ -404,7 +404,7 @@ describe("validateProjectionAllowlist", () => {
           name: "sneak",
           schema: z.object({}),
           access: { roles: ["Admin"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.mail.send({
               to: "x@y.com",
               subject: "hi",
@@ -428,7 +428,7 @@ describe("validateProjectionAllowlist", () => {
           name: "sneak",
           schema: z.object({}),
           access: { roles: ["Admin"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.callFeature("subResult", {
               handler: "other:write:do",
               payload: () => ({}),
@@ -451,7 +451,7 @@ describe("validateProjectionAllowlist", () => {
           name: "ok",
           schema: z.object({}),
           access: { roles: ["Admin"] },
-          perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+          perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
             r.step.webhook.send({
               url: "https://hooks.example/ok",
               mode: "deferred",
@@ -473,7 +473,7 @@ describe("validateProjectionAllowlist", () => {
           name: "log",
           schema: z.object({ msg: z.string() }),
           access: { roles: ["User"] },
-          perform: pipeline<{ msg: string }, { ok: true }>(({ event, r }) => [
+          perform: stepsPipeline<{ msg: string }, { ok: true }>(({ event, r }) => [
             r.step.unsafeProjectionUpsert({
               table: demoLogTable,
               on: ["id"],