@cosmicdrift/kumiko-framework 0.165.1 → 0.165.3

package/src/pipeline/dispatch-stream.ts

@@ -53,19 +53,25 @@ async function* executeStreamInner(
     throw validationErrorFromZod(parsed.error);
   }
 
-  // Mid-stream access revocation must also cut *idle* SSE streams (heartbeat
-  // only — no chunk). A boolean flag read only after the next chunk would
-  // leave revoked sessions open indefinitely (fw#1563). Race each pull
-  // against an invalidated Deferred instead.
+  // Idle (heartbeat-only) streams must also cut on access revoke — race each
+  // pull against an invalidated Deferred instead of a post-chunk boolean.
   let resolveInvalidated: (() => void) | undefined;
   const invalidated = new Promise<void>((resolve) => {
     resolveInvalidated = resolve;
   });
-  const unsubscribeAccessInvalidation = ctx.sseBroker?.subscribeAccessInvalidation(user.id, () => {
-    resolveInvalidated?.();
-  });
+  const unsubscribeAccessInvalidation = ctx.sseBroker?.subscribeAccessInvalidation?.(
+    user.id,
+    () => {
+      resolveInvalidated?.();
+    },
+  );
 
   let iterator: AsyncIterator<unknown> | undefined;
+  // When access is revoked mid-pull, `iterator.next()` is still in flight.
+  // Awaiting `iterator.return()` in that state deadlocks async generators in
+  // Bun (overlapping next+return). Track abandonment so finally skips the
+  // await; close is fire-and-forget instead (#1563).
+  let abandonedForInvalidation = false;
   try {
     const handlerContext = buildHandlerContext(ctx, type, user);
     const chunks = handler.handler({ type, payload: parsed.data, user }, handlerContext);
@@ -78,6 +84,9 @@ async function* executeStreamInner(
         invalidated.then(() => ({ kind: "invalidated" as const })),
       ]);
       if (outcome.kind === "invalidated") {
+        abandonedForInvalidation = true;
+        void nextPull.catch(() => {});
+        void iterator.return?.(undefined)?.then(undefined, () => {});
         throw new AccessDeniedError({
           message: `access revoked mid-stream for ${type}`,
           details: { handler: type },
@@ -90,11 +99,12 @@ async function* executeStreamInner(
     }
   } finally {
     unsubscribeAccessInvalidation?.();
-    // Consumer break / access revoke / throw — always close the handler
-    // generator so its finally (cleanup) runs (for-await would do this).
-    // Do NOT swallow return() errors — close-time cleanup failures must
-    // surface to runStreamInstrumented (#1543).
-    if (iterator !== undefined) {
+    // Consumer break / throw — always close the handler generator so its
+    // finally (cleanup) runs (for-await would do this). Do NOT swallow
+    // return() errors — close-time cleanup failures must surface to
+    // runStreamInstrumented (#1543). Skip the await after access-revoke
+    // abandonment (overlapping next+return deadlocks — see above).
+    if (iterator !== undefined && !abandonedForInvalidation) {
       await iterator.return?.(undefined);
     }
   }

package/src/pipeline/system-hooks.ts

@@ -1,4 +1,11 @@
 import type { SseBroker } from "../api/sse-broker";
+import {
+  collectSearchableSubjectFields,
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+  isPiiCiphertext,
+  PII_ERASED_SENTINEL,
+} from "../crypto";
 import type { DbRow } from "../db/connection";
 import { tenantChannel } from "../engine/constants";
 import type { EntityId, JobRunnerRef, Registry, SessionUser } from "../engine/types";
@@ -53,10 +60,9 @@ export function createSearchEventConsumer(
       const verb = event.type.split(".").pop();
       const tenantId = event.tenantId;
 
-      // skip: delete takes an early-return after removing the index entry —
-      // the "reconstruct state" path below only makes sense for created/
-      // updated/restored, which carry field data in the payload.
-      if (verb === "deleted") {
+      // skip: delete/forgotten remove the index entry — reconstruct only
+      // makes sense for created/updated/restored (field data in payload).
+      if (verb === "deleted" || verb === "forgotten") {
         await searchAdapter.remove(tenantId, entityName, event.aggregateId);
         return;
       }
@@ -68,7 +74,13 @@ export function createSearchEventConsumer(
         return;
       }
 
-      const state = reconstructStateForSearch(event.payload, verb);
+      let state = reconstructStateForSearch(event.payload, verb);
+      state = await decryptSearchableSubjectFields(entityName, state, registry);
+      // skip: erased subject — drop the doc so a rebuild cannot resurrect plaintext.
+      if (hasErasedSearchableSubjectField(entityName, state, registry)) {
+        await searchAdapter.remove(tenantId, entityName, event.aggregateId);
+        return;
+      }
       const doc = await buildSearchDocument(entityName, event.aggregateId, state, registry);
       if (!doc) {
         // skip: entity isn't searchable (no searchable fields declared)
@@ -79,6 +91,41 @@ export function createSearchEventConsumer(
   };
 }
 
+// #1610 — subject-annotated searchable fields are ciphertext in the event
+// payload; decrypt into the derived index only. No KMS → omit ciphertext
+// values rather than indexing blobs.
+async function decryptSearchableSubjectFields(
+  entityName: string,
+  state: Record<string, unknown>,
+  registry: Registry,
+): Promise<Record<string, unknown>> {
+  const entity = registry.getEntity(entityName);
+  if (!entity) return state;
+  const fields = collectSearchableSubjectFields(entity);
+  if (fields.length === 0) return state;
+  const kms = configuredPiiSubjectKms();
+  if (!kms) {
+    const out = { ...state };
+    for (const name of fields) {
+      if (isPiiCiphertext(out[name])) delete out[name];
+    }
+    return out;
+  }
+  return decryptPiiFieldValues(state, fields, kms, {
+    requestId: "system:consumer:search",
+  });
+}
+
+function hasErasedSearchableSubjectField(
+  entityName: string,
+  state: Record<string, unknown>,
+  registry: Registry,
+): boolean {
+  const entity = registry.getEntity(entityName);
+  if (!entity) return false;
+  return collectSearchableSubjectFields(entity).some((name) => state[name] === PII_ERASED_SENTINEL);
+}
+
 // Rebuild the entity-state a search index needs from the event-payload alone.
 // Three shapes to handle — see event-store-executor.ts for the emitter side.
 function reconstructStateForSearch(
@@ -369,7 +416,7 @@ export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): Eve
         // poison would otherwise permanently stop access-invalidation for
         // every user behind one bad row).
         if (typeof userId !== "string" || userId.length === 0) return;
-        sseBroker.publishAccessInvalidation(userId);
+        sseBroker.publishAccessInvalidation?.(userId);
       }
 
       if (
@@ -380,7 +427,7 @@ export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): Eve
         // skip: previous snapshot missing/malformed userId — same fail-open
         // reasoning as above.
         if (userId === undefined) return;
-        sseBroker.publishAccessInvalidation(userId);
+        sseBroker.publishAccessInvalidation?.(userId);
       }
     },
   };

package/src/schema-cli.ts

@@ -273,11 +273,10 @@ export async function runSchemaCli(
 
       // 3. Migration-content drift — replay the committed *.sql files and
       // diff the reconstructed schema against .snapshot.json.
-      const committedSnapshot = existsSync(snapshotPath) ? loadSnapshotJson(snapshotPath) : null;
-      if (existsSync(migrationsDir) && committedSnapshot !== null) {
+      if (existsSync(migrationsDir) && prevSnapshot !== null) {
         try {
           const replayed = replayMigrationsDir(migrationsDir);
-          const mismatches = diffReplayAgainstSnapshot(replayed, committedSnapshot);
+          const mismatches = diffReplayAgainstSnapshot(replayed, prevSnapshot);
           if (mismatches.length === 0) {
             out.log("  ✓ migrations: table/column names match .snapshot.json");
           } else {

package/src/search/__tests__/search-pii-derived-index.integration.test.ts

@@ -0,0 +1,164 @@
+// fw#1610 — subject-annotated searchable fields: ciphertext in events,
+// plaintext in derived search index, purged on subject erase.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetPiiSubjectKmsForTests,
+  subjectIdToKey,
+} from "../../crypto";
+import { asRawClient, buildEntityTable, createEventStoreExecutor, createTenantDb } from "../../db";
+import { createEntity, createTextField, defineFeature } from "../../engine";
+import { createEventsTable } from "../../event-store";
+import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } from "../../stack";
+import { purgeSearchDocumentsForSubject } from "../purge-subject";
+
+const contactEntity = createEntity({
+  table: "read_search_pii_contacts",
+  fields: {
+    // pii: true → subject = entity id (self). searchable via derived index.
+    label: createTextField({ required: true, maxLength: 100, pii: true, searchable: true }),
+    note: createTextField({ required: true, maxLength: 100, searchable: true }),
+  },
+});
+
+const contactTable = buildEntityTable("contact", contactEntity);
+
+const contactFeature = defineFeature("search-pii-probe", (r) => {
+  r.entity("contact", contactEntity);
+});
+
+let stack: TestStack;
+let kms: InMemoryKmsAdapter;
+const admin = TestUsers.admin;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [contactFeature] });
+  await unsafeCreateEntityTable(stack.db, contactEntity, "contact");
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(() => {
+  kms = new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+function executor() {
+  return createEventStoreExecutor(contactTable, contactEntity, {
+    entityName: "contact",
+    searchAdapter: stack.search,
+  });
+}
+
+function tenantDb() {
+  return createTenantDb(stack.db, admin.tenantId, "system");
+}
+
+describe("searchable PII derived index (#1610)", () => {
+  test("create indexes plaintext; event payload stays ciphertext; erase purges search", async () => {
+    const plain = "UniqueSearchPiiLabel1610";
+    const created = await executor().create(
+      { label: plain, note: "public-note" },
+      admin,
+      tenantDb(),
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = String(created.data.id);
+
+    const events = await asRawClient(stack.db).unsafe(
+      `SELECT payload FROM kumiko_events WHERE aggregate_id = $1 AND type = 'contact.created' LIMIT 1`,
+      [id],
+    );
+    const payload = (events as { payload: Record<string, unknown> }[])[0]?.payload;
+    expect(isPiiCiphertext(payload?.["label"])).toBe(true);
+    expect(payload?.["label"]).not.toBe(plain);
+
+    await stack.eventDispatcher?.runOnce();
+
+    const hits = await stack.search.search(admin.tenantId, plain, { filterType: "contact" });
+    expect(hits.some((h) => String(h.entityId) === id)).toBe(true);
+
+    // pii: true → subject key is the entity id itself.
+    const subject = { kind: "user" as const, userId: id };
+    await kms.eraseKey(subject);
+    await purgeSearchDocumentsForSubject(
+      stack.db,
+      stack.registry.features,
+      stack.search,
+      subjectIdToKey(subject),
+      subject,
+    );
+
+    const after = await stack.search.search(admin.tenantId, plain, { filterType: "contact" });
+    expect(after.some((h) => String(h.entityId) === id)).toBe(false);
+  });
+
+  test("consumer treats erased decrypt as remove (no sentinel index)", async () => {
+    const plain = "SentinelRebuildLabel1610";
+    const created = await executor().create({ label: plain, note: "x" }, admin, tenantDb());
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = String(created.data.id);
+
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, plain, { filterType: "contact" })).some(
+        (h) => String(h.entityId) === id,
+      ),
+    ).toBe(true);
+
+    await kms.eraseKey({ kind: "user", userId: id });
+    // Force re-index path by updating a non-PII field — consumer decrypts
+    // label → [[erased]] → remove.
+    const updated = await executor().update(
+      { id: created.data.id, changes: { note: "y" } },
+      admin,
+      tenantDb(),
+      { skipOptimisticLock: true },
+    );
+    if (!updated.isSuccess) throw new Error("update failed");
+    await stack.eventDispatcher?.runOnce();
+
+    const after = await stack.search.search(admin.tenantId, plain, { filterType: "contact" });
+    expect(after.some((h) => String(h.entityId) === id)).toBe(false);
+  });
+  test("purge finds rows after anonymize rewrote ciphertext (#1610 bugbot)", async () => {
+    const plain = "AnonymizedStillPurge1610";
+    const created = await executor().create({ label: plain, note: "n" }, admin, tenantDb());
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = String(created.data.id);
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, plain, { filterType: "contact" })).some(
+        (h) => String(h.entityId) === id,
+      ),
+    ).toBe(true);
+
+    // Simulate forget-cleanup anonymize: overwrite searchable PII with plaintext.
+    await asRawClient(stack.db).unsafe(
+      `UPDATE read_search_pii_contacts SET label = $1 WHERE id = $2`,
+      ["[[erased]]", id],
+    );
+
+    const subject = { kind: "user" as const, userId: id };
+    await purgeSearchDocumentsForSubject(
+      stack.db,
+      stack.registry.features,
+      stack.search,
+      subjectIdToKey(subject),
+      subject,
+    );
+
+    const after = await stack.search.search(admin.tenantId, plain, { filterType: "contact" });
+    expect(after.some((h) => String(h.entityId) === id)).toBe(false);
+  });
+});

package/src/search/index.ts

@@ -3,6 +3,7 @@
 // von SearchAdapter-Types. Apps die Meilisearch nicht nutzen, ziehen den
 // Client-Code nicht mit rein.
 export { createInMemorySearchAdapter } from "./in-memory-adapter";
+export { purgeSearchDocumentsForSubject } from "./purge-subject";
 export type {
   ReindexEntityFailure,
   ReindexEntityOptions,

package/src/search/purge-subject.ts

@@ -0,0 +1,135 @@
+// Purge derived search documents for an erased PII subject (#1610).
+//
+// After kms.eraseKey the projection/event ciphertext is unreadable, but Meili
+// still holds the plaintext that createSearchEventConsumer decrypted into the
+// index. Discovery is dual-path:
+//   1. Ownership: pii self-id / userOwned.ownerField / tenantOwned.tenantId
+//      (survives anonymize hooks that overwrite ciphertext with plaintext).
+//   2. Ciphertext LIKE prefix (same as nullBlindIndexesForSubject) for rows
+//      that still carry the subject key in encrypted columns.
+
+import type { SubjectId } from "../crypto/kms-adapter";
+import { collectSearchableSubjectFields } from "../crypto/subject-resolver";
+import type { DbRunner } from "../db/connection";
+import { resolveTableName } from "../db/entity-table-meta";
+import { executeRawQuery } from "../db/queries/raw-sql";
+import type { FeatureDefinition } from "../engine/types";
+import type { EntityDefinition } from "../engine/types/fields";
+import type { EntityId, TenantId } from "../engine/types/identifiers";
+import { toSnakeCase } from "../utils/case";
+import type { SearchAdapter } from "./types";
+
+function quoteIdent(name: string): string {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+
+function escapeLikePattern(value: string): string {
+  return value.replace(/[\\%_]/g, (m) => `\\${m}`);
+}
+
+/** Build OR predicates for rows owned by `subject` (id / ownerField / tenant_id). */
+function ownershipPredicates(
+  entity: EntityDefinition,
+  searchableFields: readonly string[],
+  subject: SubjectId,
+  nextParam: () => number,
+): { sql: string; params: unknown[] } | null {
+  const parts: string[] = [];
+  const params: unknown[] = [];
+  let selfIdN: number | undefined;
+  let tenantIdN: number | undefined;
+  const ownerFieldN = new Map<string, number>();
+
+  for (const fieldName of searchableFields) {
+    const field = entity.fields[fieldName];
+    if (!field) continue;
+    if (subject.kind === "user") {
+      if ("userOwned" in field && field.userOwned !== undefined) {
+        const col = toSnakeCase(field.userOwned.ownerField);
+        let n = ownerFieldN.get(col);
+        if (n === undefined) {
+          n = nextParam();
+          ownerFieldN.set(col, n);
+          params.push(subject.userId);
+          parts.push(`${quoteIdent(col)} = $${n}`);
+        }
+      } else if ("pii" in field && field.pii === true && selfIdN === undefined) {
+        selfIdN = nextParam();
+        params.push(subject.userId);
+        parts.push(`${quoteIdent("id")} = $${selfIdN}`);
+      }
+    } else if ("tenantOwned" in field && field.tenantOwned === true && tenantIdN === undefined) {
+      tenantIdN = nextParam();
+      params.push(subject.tenantId);
+      parts.push(`${quoteIdent("tenant_id")} = $${tenantIdN}`);
+    }
+  }
+  if (parts.length === 0) return null;
+  return { sql: parts.join(" OR "), params };
+}
+
+export async function purgeSearchDocumentsForSubject(
+  db: DbRunner,
+  features: ReadonlyMap<string, FeatureDefinition>,
+  search: SearchAdapter,
+  subjectKey: string,
+  /** When set, also match rows by ownership — needed after anonymize rewrites ciphertext. */
+  subject?: SubjectId,
+): Promise<void> {
+  const likePattern = `kumiko-pii:v%:${escapeLikePattern(subjectKey)}:%`;
+  const byTenant = new Map<string, { entityType: string; entityId: EntityId }[]>();
+  const seen = new Set<string>();
+
+  for (const feature of features.values()) {
+    for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
+      const fields = collectSearchableSubjectFields(entity);
+      if (fields.length === 0) continue;
+      const tableName = resolveTableName(entityName, entity, undefined);
+
+      let paramIdx = 0;
+      const nextParam = () => ++paramIdx;
+      const params: unknown[] = [];
+      const orParts: string[] = [];
+
+      const likeN = nextParam();
+      params.push(likePattern);
+      orParts.push(
+        `(${fields.map((f) => `${quoteIdent(toSnakeCase(f))} LIKE $${likeN}`).join(" OR ")})`,
+      );
+
+      if (subject) {
+        const owned = ownershipPredicates(entity, fields, subject, nextParam);
+        if (owned) {
+          params.push(...owned.params);
+          orParts.push(`(${owned.sql})`);
+        }
+      }
+
+      const rows = await executeRawQuery<{ id: string; tenant_id: string }>(
+        db,
+        `SELECT id, tenant_id FROM ${quoteIdent(tableName)} WHERE ${orParts.join(" OR ")}`,
+        params,
+      );
+      for (const row of rows) {
+        const key = `${row.tenant_id}:${entityName}:${row.id}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        const list = byTenant.get(row.tenant_id) ?? [];
+        list.push({ entityType: entityName, entityId: row.id as EntityId });
+        byTenant.set(row.tenant_id, list);
+      }
+    }
+  }
+
+  for (const [tenantId, items] of byTenant) {
+    if (items.length === 0) continue;
+    const tid = tenantId as TenantId;
+    if (search.removeBatch) {
+      await search.removeBatch(tid, items);
+    } else {
+      for (const item of items) {
+        await search.remove(tid, item.entityType, item.entityId);
+      }
+    }
+  }
+}

package/src/testing/__tests__/wait-for.test.ts

@@ -2,15 +2,18 @@ import { describe, expect, test } from "bun:test";
 import { waitFor } from "../wait-for";
 
 describe("waitFor", () => {
-  test("returns immediately once fn succeeds on the first attempt", async () => {
+  test("calls fn exactly once when it passes on the first attempt (no prior sleep)", async () => {
     let calls = 0;
+    const started = Date.now();
     await waitFor(
       () => {
         calls++;
       },
-      { delays: [1, 1, 1] },
+      { delays: [200, 200, 200] },
     );
     expect(calls).toBe(1);
+    // try-first: must not burn the first delay when the condition already holds
+    expect(Date.now() - started).toBeLessThan(100);
   });
 
   test("retries on failure and succeeds once fn passes", async () => {
@@ -35,8 +38,9 @@ describe("waitFor", () => {
         },
         { delays: [1, 1] },
       ),
-    ).rejects.toThrow("fail-2");
-    expect(calls).toBe(2);
+    ).rejects.toThrow("fail-3");
+    // N delays → N+1 attempts (final try after the last backoff)
+    expect(calls).toBe(3);
   });
 
   test("throws a descriptive error for an empty delay schedule", async () => {

package/src/testing/wait-for.ts

@@ -1,8 +1,10 @@
 /**
  * Polls a condition with escalating timeouts.
  *
- * Default schedule: 250ms → 1s → 3s (3 attempts).
- * Returns immediately on success. Throws the last assertion error if all attempts fail.
+ * Default schedule: 250ms → 1s → 3s between attempts. Tries first (already-true
+ * returns immediately), then sleeps `delays[i]` after each failure before the
+ * next try — so N delays yield N+1 attempts and the full backoff budget.
+ * Throws the last assertion error if all attempts fail.
  *
  * Usage:
  *   await waitFor(() => {
@@ -19,15 +21,18 @@ export async function waitFor(
   }
   let lastError: unknown;
 
-  for (let i = 0; i < delays.length; i++) {
-    await new Promise((r) => setTimeout(r, delays[i]));
+  for (let i = 0; ; i++) {
     try {
       await fn();
-      // skip: retry attempt succeeded, no further polling needed
+      // skip: condition already true — no further polling
       return;
     } catch (err) {
       lastError = err;
     }
+    if (i >= delays.length) {
+      break;
+    }
+    await new Promise((r) => setTimeout(r, delays[i]));
   }
 
   throw lastError;