@cosmicdrift/kumiko-framework 0.165.1 → 0.165.3

package/src/db/index.ts

@@ -59,7 +59,11 @@ export type {
   PgType,
   UnmanagedTableInput,
 } from "./entity-table-meta";
-export { buildEntityTableMeta, defineUnmanagedTable } from "./entity-table-meta";
+export {
+  buildEntityTableMeta,
+  defineUnmanagedTable,
+  deriveEntityTableMeta,
+} from "./entity-table-meta";
 export type {
   EntityLifecycleVerb,
   EventStoreExecutor,

package/src/db/migrate-runner.ts

@@ -74,22 +74,14 @@ CREATE TABLE IF NOT EXISTS "_kumiko_migrations" (
 )
 `.trim();
 
-// Splits SQL-file text into individual statements on top-level `;`. A plain
-// `text.split(";")` breaks the moment a `--` line comment or `/* */` block
-// comment contains a semicolon (#1542) — it splits mid-comment before the
-// comment is ever stripped. This scans char-by-char tracking whether we're
-// inside a line comment, block comment, single-quoted string, or
-// double-quoted identifier, so `;` only ends a statement in plain SQL text;
-// comments are dropped, quoted/identifier content (incl. `''`/`""` escapes)
-// is kept verbatim. Does not handle dollar-quoted (`$$...$$`) bodies — none
-// of this repo's checked-in migrations use them; add that state if one ever
-// does.
+// Plain `;`-split breaks on `;` inside comments/string literals (#1542).
 type SqlScanState = "normal" | "lineComment" | "blockComment" | "singleQuote" | "doubleQuote";
 
 export function splitSqlStatements(sqlText: string): readonly string[] {
   const statements: string[] = [];
   let current = "";
   let state: SqlScanState = "normal";
+  let blockCommentDepth = 0;
 
   for (let i = 0; i < sqlText.length; i++) {
     const ch = sqlText.charAt(i);
@@ -103,9 +95,21 @@ export function splitSqlStatements(sqlText: string): readonly string[] {
       continue;
     }
     if (state === "blockComment") {
+      // Postgres nests block comments — track depth so the first `*/` does
+      // not leave trailing comment text in the statement.
+      if (ch === "/" && next === "*") {
+        blockCommentDepth++;
+        i++;
+        continue;
+      }
       if (ch === "*" && next === "/") {
-        state = "normal";
         i++;
+        blockCommentDepth--;
+        if (blockCommentDepth === 0) {
+          state = "normal";
+          // Keep a space so `a/*x*/AS` does not become `aAS`.
+          current += " ";
+        }
       }
       continue;
     }
@@ -142,6 +146,7 @@ export function splitSqlStatements(sqlText: string): readonly string[] {
     }
     if (ch === "/" && next === "*") {
       state = "blockComment";
+      blockCommentDepth = 1;
       i++;
       continue;
     }
@@ -163,6 +168,8 @@ export function splitSqlStatements(sqlText: string): readonly string[] {
     current += ch;
   }
   if (state === "blockComment" || state === "singleQuote" || state === "doubleQuote") {
+    // Does not track dollar-quoted (`$$...$$`) bodies — none of this repo's
+    // migrations use them; add that state if one ever does.
     throw new Error(
       `splitSqlStatements: unterminated ${state} — migration SQL is malformed, refusing to split`,
     );

package/src/db/table-builder.ts

@@ -526,7 +526,7 @@ export function buildEntityTable<E extends EntityDefinition>(
         }
       }
       // lookupable-Felder: Index auf der bidx-Spalte (lock-step mit
-      // buildEntityTableMeta).
+      // deriveEntityTableMeta).
       const bidxFieldByField = new Map<string, string>();
       for (const [name, field] of Object.entries(entity.fields)) {
         if (field.type !== "text" || field.lookupable !== true) continue;
@@ -558,7 +558,7 @@ export function buildEntityTable<E extends EntityDefinition>(
         }
         indexes[indexName] = chain;
         // Partielles bidx-Pendant für unique-Indices über lookupable-Spalten
-        // (lock-step mit buildEntityTableMeta).
+        // (lock-step mit deriveEntityTableMeta).
         if (def.unique === true && def.where === undefined) {
           const bidxFieldNames = def.columns.map((c) => bidxFieldByField.get(c) ?? c);
           if (bidxFieldNames.some((c, i) => c !== def.columns[i])) {

package/src/db/tenant-db.ts

@@ -30,7 +30,7 @@ function tableNameOf(table: Table): string {
 }
 
 // Checks the canonical EntityTableMeta (branded EntityTable's KUMIKO_META_SYMBOL
-// or a plain buildEntityTableMeta/defineUnmanagedTable result), not a direct
+// or a plain deriveEntityTableMeta/defineUnmanagedTable result), not a direct
 // `table.tenantId` property read — the latter only exists on branded EntityTables
 // and silently returned false (no tenant filter!) for plain EntityTableMeta
 // tables like unmanaged direct-write stores, e.g. userSessionTable.

package/src/engine/__tests__/boot-validator-pii-retention.test.ts

@@ -680,7 +680,7 @@ describe("validateBoot — lookupable / blind-index (#818)", () => {
     expect(() => validateBoot([feature])).toThrow(/only apply to text fields/);
   });
 
-  test("searchable combined with a subject annotation throws", () => {
+  test("searchable combined with a subject annotation passes (#1610)", () => {
     const feature = defineFeature("test", (r) => {
       r.entity(
         "user",
@@ -691,7 +691,7 @@ describe("validateBoot — lookupable / blind-index (#818)", () => {
         }),
       );
     });
-    expect(() => validateBoot([feature])).toThrow(/searchable.*cannot work/);
+    expect(() => validateBoot([feature])).not.toThrow();
   });
 
   test("sortable combined with a subject annotation throws", () => {
@@ -705,7 +705,25 @@ describe("validateBoot — lookupable / blind-index (#818)", () => {
         }),
       );
     });
-    expect(() => validateBoot([feature])).toThrow(/sortable.*cannot work/);
+    expect(() => validateBoot([feature])).toThrow(/sortable/);
+  });
+
+  test("searchable combined with sensitive throws (#1610)", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "user",
+        createEntity({
+          fields: {
+            passwordHash: createTextField({
+              pii: true,
+              sensitive: true,
+              searchable: true,
+            }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/sensitive.*searchable/);
   });
 });
 
@@ -758,7 +776,7 @@ describe("validateBoot — piiEncrypted (kumiko-platform#231/#456)", () => {
     expect(() => validateBoot([feature])).toThrow(/piiEncrypted.*without a subject annotation/);
   });
 
-  test("piiEncrypted combined with searchable throws", () => {
+  test("piiEncrypted combined with searchable passes (#1610)", () => {
     const feature = defineFeature("test", (r) => {
       r.entity(
         "tenant",
@@ -774,7 +792,7 @@ describe("validateBoot — piiEncrypted (kumiko-platform#231/#456)", () => {
         }),
       );
     });
-    expect(() => validateBoot([feature])).toThrow(/piiEncrypted.*searchable.*cannot work/);
+    expect(() => validateBoot([feature])).not.toThrow();
   });
 
   test("piiEncrypted combined with sortable throws", () => {
@@ -793,7 +811,7 @@ describe("validateBoot — piiEncrypted (kumiko-platform#231/#456)", () => {
         }),
       );
     });
-    expect(() => validateBoot([feature])).toThrow(/piiEncrypted.*sortable.*cannot work/);
+    expect(() => validateBoot([feature])).toThrow(/sortable/);
   });
 
   test("piiEncrypted without access.read throws (kumiko-platform#460)", () => {

package/src/engine/__tests__/store-table.test.ts

@@ -7,8 +7,8 @@
 
 import { describe, expect, test } from "bun:test";
 import {
-  buildEntityTableMeta,
   defineUnmanagedTable,
+  deriveEntityTableMeta,
   resolveTableName,
 } from "../../db/entity-table-meta";
 import { defineFeature } from "../define-feature";
@@ -67,7 +67,7 @@ describe("r.storeTable — declaration", () => {
       table: "rt_probe_managed",
       fields: { name: createTextField() },
     });
-    const managedMeta = buildEntityTableMeta("rt-probe-managed", managedEntity);
+    const managedMeta = deriveEntityTableMeta("rt-probe-managed", managedEntity);
     expect(() =>
       defineFeature("probe", (r) => {
         r.storeTable(managedMeta, { reason: "test" });
@@ -75,14 +75,11 @@ describe("r.storeTable — declaration", () => {
     ).toThrow(/requires source: "unmanaged"/);
   });
 
-  test("rejects a table name with the reserved read_ prefix (#1220)", () => {
-    const readPrefixed = defineUnmanagedTable({
-      tableName: "read_rt_probe",
-      columns: [{ name: "id", pgType: "text", notNull: true, primaryKey: true }],
-    });
+  test("rejects a table name with the reserved read_ prefix (#1220/#1208)", () => {
     expect(() =>
-      defineFeature("probe", (r) => {
-        r.storeTable(readPrefixed, { reason: "test" });
+      defineUnmanagedTable({
+        tableName: "read_rt_probe",
+        columns: [{ name: "id", pgType: "text", notNull: true, primaryKey: true }],
       }),
     ).toThrow(/the "read_" prefix is reserved/);
   });
@@ -195,9 +192,9 @@ describe("createRegistry — store tables with PII-annotated fields (#820)", ()
       ip: createTextField({ userOwned: { ownerField: "userId" } }),
     },
   });
-  const piiMeta = buildEntityTableMeta("rt-pii-probe", piiEntity, { source: "unmanaged" });
+  const piiMeta = deriveEntityTableMeta("rt-pii-probe", piiEntity, { source: "unmanaged" });
 
-  test("buildEntityTableMeta records the subject-annotated field names", () => {
+  test("deriveEntityTableMeta records the subject-annotated field names", () => {
     expect(piiMeta.piiSubjectFields).toEqual(["ip"]);
   });
 

package/src/engine/boot-validator/pii-retention.ts

@@ -129,15 +129,25 @@ export function validatePiiAndRetention(feature: FeatureDefinition): void {
         );
       }
 
-      // Substring-Suche/Sortierung auf Ciphertext ist prinzipbedingt
-      // unmöglich — searchable würde Plaintext-Kopien in den Suchindex
-      // schieben, sortable sortiert Base64-Blobs. Equality → lookupable.
-      if (annotCount > 0 || piiEncryptedFlag.piiEncrypted === true) {
-        const flags = field as { readonly searchable?: boolean; readonly sortable?: boolean }; // @cast-boundary schema-walk
-        if (flags.searchable === true || flags.sortable === true) {
-          const offending = flags.searchable === true ? "searchable" : "sortable";
+      // Sortierung liest die Projection-Spalte — die bleibt Ciphertext, also
+      // sortable + Subject-Annotation bleibt Boot-Fail. searchable ist seit
+      // #1610 erlaubt: der Search-Consumer decryptet in den abgeleiteten
+      // Index und forget purgt die Docs (siehe createSearchEventConsumer).
+      // sensitive + searchable bleibt verboten (nobody-may-read-back).
+      {
+        const flags = field as {
+          readonly searchable?: boolean;
+          readonly sortable?: boolean;
+          readonly sensitive?: boolean;
+        }; // @cast-boundary schema-walk
+        if ((annotCount > 0 || piiEncryptedFlag.piiEncrypted === true) && flags.sortable === true) {
           throw new Error(
-            `[Feature ${feature.name}] Field "${fieldName}" on entity "${entityName}" combines a subject-key annotation or { piiEncrypted: true } with { ${offending}: true } — ${offending} on encrypted fields cannot work (ciphertext at rest). For equality lookups use { lookupable: true }; for search/sort the field must stay plaintext (allowPlaintext).`,
+            `[Feature ${feature.name}] Field "${fieldName}" on entity "${entityName}" combines a subject-key annotation or { piiEncrypted: true } with { sortable: true } — sorting reads the projection column, which is ciphertext at rest. For equality lookups use { lookupable: true }; drop sortable or keep the field plaintext (allowPlaintext).`,
+          );
+        }
+        if (flags.sensitive === true && flags.searchable === true) {
+          throw new Error(
+            `[Feature ${feature.name}] Field "${fieldName}" on entity "${entityName}" combines { sensitive: true } with { searchable: true } — sensitive means nobody may read the value back (passwords, tokens, tax IDs). Subject-annotated identity fields may be searchable (#1610); sensitive fields may not.`,
           );
         }
       }

package/src/engine/constants.ts

@@ -103,10 +103,6 @@ export function tenantChannel(tenantId: TenantId): string {
   return `tenant:${tenantId}`;
 }
 
-// Access-invalidation channel key for a single user's live streams. Both
-// the subscribe side (dispatch-stream.ts) and the publish side (session-
-// revoke / tenant-membership consumers, issue #1559/#1560) must derive the
-// key through this helper — never build the string inline on either side.
 export function userAccessChannel(userId: string): string {
   return `user:${userId}:access`;
 }

package/src/engine/feature-ast/extractors/round5.ts

@@ -100,7 +100,7 @@ export function extractStoreTable(
   sourceFile: SourceFile,
 ): ExtractOutput<never> {
   // The meta argument is always a factory call (defineUnmanagedTable /
-  // buildEntityTableMeta) or a captured identifier — never an inline literal,
+  // deriveEntityTableMeta) or a captured identifier — never an inline literal,
   // so there is nothing to extract statically. A clean ParseError (not
   // UnknownPattern) marks it design-time-unreadable, like entity-by-identifier.
   return fail(

package/src/engine/feature-changelog.ts

@@ -0,0 +1,93 @@
+// Per-feature changelog — each bundled feature has a `changes.json` that
+// tracks breaking changes, improvements, and fixes per version. The CLI
+// (`kumiko upgrade`) reads these to show apps what they need to migrate.
+// All fields should be in English for consistency across the codebase.
+//
+// File I/O stays in the CLI (`bin/commands/upgrade.ts`) — this module is
+// pure parse/validate so engine stays off the node:fs allowlist.
+
+export type ChangelogType = "breaking" | "improvement" | "fix";
+
+export type ChangelogEntry = {
+  readonly version: string;
+  readonly type: ChangelogType;
+  readonly title: string;
+  readonly detail?: string;
+  /** Required when type=breaking. Shown in `kumiko upgrade` output. */
+  readonly migration?: string;
+};
+
+export type FeatureChangelog = {
+  readonly feature: string;
+  readonly entries: readonly ChangelogEntry[];
+};
+
+/** Parse a changes.json body. Callers own file I/O. */
+export function parseFeatureChangelog(raw: string, featureName: string): FeatureChangelog | null {
+  try {
+    const entries = JSON.parse(raw) as unknown;
+    if (!Array.isArray(entries)) return null;
+
+    const validated: ChangelogEntry[] = [];
+    for (const entry of entries) {
+      if (!isChangelogEntry(entry)) continue;
+      validated.push(entry);
+    }
+
+    return { feature: featureName, entries: validated };
+  } catch {
+    return null;
+  }
+}
+
+function isChangelogEntry(value: unknown): value is ChangelogEntry {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value as Record<string, unknown>;
+  if (typeof obj["version"] !== "string") return false;
+  if (!["breaking", "improvement", "fix"].includes(obj["type"] as string)) return false;
+  if (typeof obj["title"] !== "string") return false;
+  return true;
+}
+
+export function validateChangelog(entry: ChangelogEntry): string[] {
+  const errors: string[] = [];
+  if (entry.type === "breaking" && !entry.migration) {
+    errors.push(`breaking change "${entry.title}" missing migration field`);
+  }
+  if (entry.type === "breaking" && entry.migration?.trim() === "") {
+    errors.push(`breaking change "${entry.title}" has empty migration field`);
+  }
+  return errors;
+}
+
+export function compareVersions(a: string, b: string): number {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const na = pa[i] ?? 0;
+    const nb = pb[i] ?? 0;
+    if (na > nb) return 1;
+    if (na < nb) return -1;
+  }
+  return 0;
+}
+
+export function filterEntriesAfter(
+  entries: readonly ChangelogEntry[],
+  version: string,
+): readonly ChangelogEntry[] {
+  return entries.filter((e) => compareVersions(e.version, version) > 0);
+}
+
+export function sortEntries(entries: readonly ChangelogEntry[]): readonly ChangelogEntry[] {
+  const order: Record<ChangelogType, number> = {
+    breaking: 0,
+    improvement: 1,
+    fix: 2,
+  };
+  return [...entries].sort((a, b) => {
+    const typeDiff = order[a.type] - order[b.type];
+    if (typeDiff !== 0) return typeDiff;
+    return compareVersions(b.version, a.version);
+  });
+}

package/src/engine/feature-manifest.ts

@@ -8,6 +8,7 @@
 
 import { compareByCodepoint } from "../utils";
 import { isEncryptedAtRest } from "./config-helpers";
+import type { ChangelogEntry } from "./feature-changelog";
 import { qualifyEntityName } from "./qualified-name";
 import type { Registry, UiHints } from "./types/feature";
 
@@ -64,6 +65,9 @@ export type ManifestFeature = {
   readonly uiHints?: UiHints;
   /** Optionaler Herkunfts-Tag (z.B. "enterprise") — gesetzt via Options. */
   readonly tier?: string;
+  /** Per-feature changelog entries (from changes.json). Optional —
+   *  absent when no changes.json exists or feature has no entries. */
+  readonly changelog?: readonly ChangelogEntry[];
 };
 
 export type FeatureManifest = {

package/src/engine/feature-ui-extensions.ts

@@ -454,7 +454,7 @@ export function buildUiExtensionsMethods<TName extends string>(
         throw new Error(
           `[Feature ${name}] r.storeTable("${tableName}") was given an EntityTableMeta with ` +
             `source: "${meta.source}". r.storeTable() requires source: "unmanaged" (via ` +
-            `defineUnmanagedTable(), or buildEntityTableMeta(..., { source: "unmanaged" })) — ` +
+            `defineUnmanagedTable(), or deriveEntityTableMeta(..., { source: "unmanaged" })) — ` +
             `otherwise the migration generator will treat schema drift on this table as safe ` +
             `to DROP+rebuild, wiping any direct-write data.`,
         );

package/src/engine/index.ts

@@ -163,6 +163,16 @@ export {
   replacePattern,
   VERSION_HEADER,
 } from "./feature-ast";
+export {
+  type ChangelogEntry,
+  type ChangelogType,
+  compareVersions,
+  type FeatureChangelog,
+  filterEntriesAfter,
+  parseFeatureChangelog,
+  sortEntries,
+  validateChangelog,
+} from "./feature-changelog";
 export {
   type BuildManifestOptions,
   buildManifestFromRegistry,

package/src/engine/registry-state.ts

@@ -1,5 +1,5 @@
 import { applyEntityEvent } from "../db/apply-entity-event";
-import { assertBackingTableSuperset, buildEntityTableMeta } from "../db/entity-table-meta";
+import { assertBackingTableSuperset, deriveEntityTableMeta } from "../db/entity-table-meta";
 import { asEntityTableMeta } from "../db/query";
 import { buildEntityTable } from "../db/table-builder";
 import { type QnType, qualifyEntityName } from "./qualified-name";
@@ -143,7 +143,7 @@ function resolveBackingTable(
         "EntityTableMeta — build it via table() / buildEntityTable.",
     );
   }
-  assertBackingTableSuperset(entityName, buildEntityTableMeta(entityName, entity), tableMeta);
+  assertBackingTableSuperset(entityName, deriveEntityTableMeta(entityName, entity), tableMeta);
   return backingTable as ProjectionDefinition["table"];
 }
 

package/src/engine/validate-projection-allowlist.ts

@@ -71,7 +71,7 @@ function resolveTableNameFromStep(table: unknown): string {
       const metaName = (meta as Record<string, unknown>)["tableName"];
       if (typeof metaName === "string") return metaName;
     }
-    // Plain meta (buildEntityTableMeta / defineUnmanagedTable — no handle-spread).
+    // Plain meta (deriveEntityTableMeta / defineUnmanagedTable — no handle-spread).
     if (
       "source" in table &&
       "tableName" in table &&

package/src/jobs/__tests__/scheduler-id.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, test } from "bun:test";
+import { schedulerIdForJobName } from "../job-runner";
+
+describe("schedulerIdForJobName", () => {
+  test("strips dots and colons so BullMQ job ids stay under the 5-segment legacy heuristic", () => {
+    // Job id becomes repeat:<id>:<millis> — colons in <id> previously pushed
+    // the segment count to ≥5 and leaked a permanent hash per cron tick
+    // (fw#1603 / bullmq#3828).
+    const id = schedulerIdForJobName("publicstatus:job:uptime-probe");
+    expect(id).toBe("scheduler-publicstatus-job-uptime-probe");
+    expect(id.includes(":")).toBe(false);
+    expect(`repeat:${id}:1784992080000`.split(":").length).toBeLessThan(5);
+  });
+
+  test("still collapses dotted QNs", () => {
+    expect(schedulerIdForJobName("app.job.tick")).toBe("scheduler-app-job-tick");
+  });
+});

package/src/jobs/index.ts

@@ -1,2 +1,2 @@
 export type { JobLogEntry, JobMeta, JobRunner, JobRunnerOptions } from "./job-runner";
-export { createJobRunner } from "./job-runner";
+export { createJobRunner, schedulerIdForJobName } from "./job-runner";

package/src/jobs/job-runner.ts

@@ -34,6 +34,22 @@ function queueNameFor(prefix: string, lane: JobRunIn): string {
   return `${prefix}-${lane}`;
 }
 
+/**
+ * BullMQ job ids are `repeat:<schedulerId>:<millis>`. Colons inside the
+ * scheduler id push the segment count to ≥5, which BullMQ's legacy heuristic
+ * treated as old repeatables — spawning a new scheduler entry every tick and
+ * leaking permanent `repeat:*` hashes (taskforcesh/bullmq#3828, fw#1603 /
+ * publicstatus Redis OOM). Strip `.` and `:` from the job QN.
+ */
+export function schedulerIdForJobName(jobName: string): string {
+  return `scheduler-${jobName.replace(/[.:]/g, "-")}`;
+}
+
+/** Pre-sanitize id (`.` only) — remove on boot so colon-form ghosts die. */
+function legacySchedulerIdForJobName(jobName: string): string {
+  return `scheduler-${jobName.replace(/\./g, "-")}`;
+}
+
 export type JobLogEntry = {
   level: "info" | "warn" | "error";
   message: string;
@@ -473,12 +489,26 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
       for (const [name, jobDef] of allJobs) {
         if (laneForJob(jobDef) !== consumerLane) continue;
         if ("cron" in jobDef.trigger) {
+          const schedulerId = schedulerIdForJobName(name);
+          const legacyId = legacySchedulerIdForJobName(name);
+          // Drop pre-sanitize scheduler ids so colon-form ghosts stop firing.
+          if (legacyId !== schedulerId) {
+            try {
+              await consumerQueue.removeJobScheduler(legacyId);
+            } catch {
+              // skip: legacy scheduler absent (fresh install / already purged)
+            }
+          }
           await consumerQueue.upsertJobScheduler(
-            `scheduler-${name.replace(/\./g, "-")}`,
+            schedulerId,
             { pattern: jobDef.trigger.cron },
             {
               name: jobDef.perTenant ? `_perTenant:${name}` : name,
               data: {},
+              opts: {
+                removeOnComplete: { count: 100 },
+                removeOnFail: { count: 50 },
+              },
             },
           );
         }

package/src/migrations/__tests__/kumiko-drift.integration.test.ts

@@ -8,7 +8,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
-import { buildEntityTableMeta } from "../../db/entity-table-meta";
+import { deriveEntityTableMeta } from "../../db/entity-table-meta";
 import { generateMigration, writeSnapshotJson } from "../../db/migrate-generator";
 import {
   baselineMigrations,
@@ -200,7 +200,7 @@ describe("kumiko-drift end-to-end (generate → apply → gate)", () => {
       table: "kdrift_gen",
       fields: { name: createTextField({ required: true }) },
     });
-    const meta = buildEntityTableMeta("kdriftGen", entity);
+    const meta = deriveEntityTableMeta("kdriftGen", entity);
     const result = generateMigration({
       metas: [meta],
       prevSnapshot: null,

package/src/migrations/projection-table-index.ts

@@ -3,7 +3,7 @@
 // rebuild-Marker → mappt Tabellen auf Projektionen → rebuildProjection).
 //
 // Drizzle-frei: der Tabellen-Name kommt aus dem kumiko-Symbol das
-// buildEntityTable/buildEntityTableMeta an die Table-Definition hängt.
+// buildEntityTable/deriveEntityTableMeta an die Table-Definition hängt.
 
 import { extractTableName } from "../db";
 import type { Registry } from "../engine/types/feature";

package/src/pipeline/__tests__/dispatcher.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { z } from "zod";
+import type { SseBroker } from "../../api/sse-broker";
 import { createEntity, createRegistry, createTextField, defineFeature } from "../../engine";
 import type { TenantId } from "../../engine/types/identifiers";
 import { createSecret } from "../../secrets/types";
@@ -292,6 +293,66 @@ describe("dispatcher.stream", () => {
     ).rejects.toMatchObject({ code: "access_denied" });
   });
 
+  test("access invalidation mid-stream rejects with AccessDeniedError and unsubscribes", async () => {
+    let onInvalidate: (() => void) | undefined;
+    let unsubscribeCalls = 0;
+    const broker: SseBroker = {
+      addClient() {
+        return "c";
+      },
+      removeClient() {},
+      pushToChannel() {},
+      getClientCount() {
+        return 0;
+      },
+      getTotalClientCount() {
+        return 0;
+      },
+      subscribeAccessInvalidation(_userId, cb) {
+        onInvalidate = cb;
+        return () => {
+          unsubscribeCalls++;
+        };
+      },
+      publishAccessInvalidation() {},
+    };
+
+    let releaseHang: (() => void) | undefined;
+    const hang = new Promise<void>((resolve) => {
+      releaseHang = resolve;
+    });
+
+    const revokeFeature = defineFeature("revoke", (r) => {
+      r.streamHandler(
+        "tail",
+        z.object({}),
+        async function* () {
+          yield { i: 0 };
+          await hang;
+          yield { i: 1 };
+          releaseHang?.();
+        },
+        { access: { roles: ["Admin"] } },
+      );
+    });
+
+    const user = createTestUser({ roles: ["Admin"] });
+    const dispatcher = createDispatcher(createRegistry([revokeFeature]), {}, { sseBroker: broker });
+    const gen = dispatcher.stream("revoke:stream:tail", {}, user);
+    const first = await gen.next();
+    expect(first.value).toEqual({ i: 0 });
+    expect(onInvalidate).toBeDefined();
+    // Start the idle second pull, then revoke — mirrors heartbeat-only SSE
+    // streams that must die without waiting for the next chunk (#1563).
+    const second = gen.next();
+    onInvalidate?.();
+    await expect(second).rejects.toMatchObject({
+      code: "access_denied",
+      message: expect.stringContaining("access revoked mid-stream"),
+    });
+    expect(unsubscribeCalls).toBe(1);
+  });
+
   test("throws for unknown stream handler", async () => {
     const dispatcher = createTestDispatcher();