@cosmicdrift/kumiko-framework 0.176.1 → 0.176.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.176.1",
+  "version": "0.176.2",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -182,7 +182,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.176.1",
+    "@cosmicdrift/kumiko-types": "0.176.2",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.12.27",
@@ -198,7 +198,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.176.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.176.2",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/sse-broker.ts

@@ -32,6 +32,10 @@ export function createSseBroker(): SseBroker {
   // Cross-replica fanout lives one level up: the SSE + access-invalidation
   // consumers (system-hooks.ts) run delivery: "per-instance" (#1718).
   const channels = new Map<string, Map<string, SseClient>>();
+  // Set, not Map<listenerId, fn> — dedup key is callback reference. Every
+  // subscriber must pass a distinct closure (dispatch-stream.ts does, one
+  // per stream). Two subscribes with the SAME reference for the same user
+  // collapse into one listener, and the first unsubscribe kills both.
   const accessInvalidationListeners = new Map<string, Set<() => void>>();
 
   function getOrCreateChannel(channel: string): Map<string, SseClient> {

package/src/engine/__tests__/boot-validator.test.ts

@@ -591,7 +591,7 @@ describe("boot-validator", () => {
   });
 
   test("warns when a role is used by exactly one handler, reached through the real validateBoot wiring", () => {
-    const warnSpy = spyOn(console, "warn");
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
     try {
       const features = [
         defineFeature("a", (r) => {
@@ -616,7 +616,7 @@ describe("boot-validator", () => {
   });
 
   test("does NOT warn on unique access roles by default — opt-in only (#1711)", () => {
-    const warnSpy = spyOn(console, "warn");
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
     try {
       const features = [
         defineFeature("b", (r) => {

package/src/engine/boot-validator/__tests__/access-roles.test.ts

@@ -15,7 +15,7 @@ describe("warnOnUniqueAccessRoles", () => {
   let warnSpy: ReturnType<typeof spyOn<Console, "warn">>;
 
   beforeEach(() => {
-    warnSpy = spyOn(console, "warn");
+    warnSpy = spyOn(console, "warn").mockImplementation(() => {});
   });
 
   afterEach(() => {

package/src/pipeline/dispatch-shared.ts

@@ -73,6 +73,13 @@ import {
 import type { IdempotencyGuard } from "./idempotency";
 import type { LifecycleHooks } from "./lifecycle-pipeline";
 
+// Framework/pipeline stays bundled-features-free, so this can't import the
+// `tenant` feature — the literal below IS the coupling to its `timezone`
+// config key. Renaming that key (or the "tenant" feature name) must update
+// this constant too; tenant-timezone-boot.integration.test.ts boots the real
+// createTenantFeature() and would catch a drift.
+const TENANT_TIMEZONE_CONFIG_KEY = "tenant:config:timezone";
+
 export type BatchCommand = {
   readonly type: string;
   readonly payload: unknown;
@@ -522,7 +529,7 @@ export async function buildHandlerContext(
   // comes from SessionUser.timezone (set at login), else falls back to
   // tenant (createTzContext's own default). An app-injected GeoTzProvider
   // (context.geoTzProvider) feeds ctx.tz.fromCoordinates / fromAddress.
-  const tenantTz = config !== undefined ? await config("tenant:config:timezone") : undefined;
+  const tenantTz = config !== undefined ? await config(TENANT_TIMEZONE_CONFIG_KEY) : undefined;
   // Guarded against garbage: an unvalidated string here (free-form config
   // key, legacy JWT claim predating validation) blows up every ctx.tz call
   // for the whole tenant with a RangeError. Fall back to UTC/tenant instead

package/src/search/purge-subject.ts

@@ -61,6 +61,66 @@ function ownershipPredicates(
   return { sql: parts.join(" OR "), params };
 }
 
+type MatchedRow = { id: string; tenant_id: string };
+
+// ponytail: LIMIT/OFFSET, not a keyset cursor — mirrors reindexEntity's same
+// tradeoff (id type varies uuid/serial across entities). A tenant-destroy
+// purge is a one-time sweep, not a hot path.
+const PURGE_BATCH_SIZE = 500;
+
+async function collectMatchingRowsForEntity(
+  db: DbRunner,
+  tableName: string,
+  whereSql: string,
+  params: readonly unknown[],
+): Promise<readonly MatchedRow[]> {
+  const rows: MatchedRow[] = [];
+  let offset = 0;
+  for (;;) {
+    const offsetN = params.length + 1;
+    const page = await executeRawQuery<MatchedRow>(
+      db,
+      `SELECT id, tenant_id FROM ${quoteIdent(tableName)} WHERE ${whereSql}
+        ORDER BY ${quoteIdent("id")} ASC
+        LIMIT ${PURGE_BATCH_SIZE} OFFSET $${offsetN}`,
+      [...params, offset],
+    );
+    if (page.length === 0) break;
+    rows.push(...page);
+    offset += page.length;
+    if (page.length < PURGE_BATCH_SIZE) break;
+  }
+  return rows;
+}
+
+function buildSubjectPredicate(
+  entity: EntityDefinition,
+  fields: readonly string[],
+  likePattern: string,
+  subject: SubjectId | undefined,
+): { sql: string; params: unknown[] } {
+  let paramIdx = 0;
+  const nextParam = () => ++paramIdx;
+  const params: unknown[] = [];
+  const orParts: string[] = [];
+
+  const likeN = nextParam();
+  params.push(likePattern);
+  orParts.push(
+    `(${fields.map((f) => `${quoteIdent(toSnakeCase(f))} LIKE $${likeN}`).join(" OR ")})`,
+  );
+
+  if (subject) {
+    const owned = ownershipPredicates(entity, fields, subject, nextParam);
+    if (owned) {
+      params.push(...owned.params);
+      orParts.push(`(${owned.sql})`);
+    }
+  }
+
+  return { sql: orParts.join(" OR "), params };
+}
+
 export async function purgeSearchDocumentsForSubject(
   db: DbRunner,
   features: ReadonlyMap<string, FeatureDefinition>,
@@ -78,30 +138,12 @@ export async function purgeSearchDocumentsForSubject(
       const fields = collectSearchableSubjectFields(entity);
       if (fields.length === 0) continue;
       const tableName = resolveTableName(entityName, entity, undefined);
-
-      let paramIdx = 0;
-      const nextParam = () => ++paramIdx;
-      const params: unknown[] = [];
-      const orParts: string[] = [];
-
-      const likeN = nextParam();
-      params.push(likePattern);
-      orParts.push(
-        `(${fields.map((f) => `${quoteIdent(toSnakeCase(f))} LIKE $${likeN}`).join(" OR ")})`,
-      );
-
-      if (subject) {
-        const owned = ownershipPredicates(entity, fields, subject, nextParam);
-        if (owned) {
-          params.push(...owned.params);
-          orParts.push(`(${owned.sql})`);
-        }
-      }
-
-      const rows = await executeRawQuery<{ id: string; tenant_id: string }>(
+      const predicate = buildSubjectPredicate(entity, fields, likePattern, subject);
+      const rows = await collectMatchingRowsForEntity(
         db,
-        `SELECT id, tenant_id FROM ${quoteIdent(tableName)} WHERE ${orParts.join(" OR ")}`,
-        params,
+        tableName,
+        predicate.sql,
+        predicate.params,
       );
       for (const row of rows) {
         const key = `${row.tenant_id}:${entityName}:${row.id}`;