@cosmicdrift/kumiko-framework 0.196.0 → 0.197.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.196.0",
+  "version": "0.197.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -186,7 +186,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.196.0",
+    "@cosmicdrift/kumiko-types": "0.197.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -202,7 +202,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.196.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.197.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/db/__tests__/build-filter-where.test.ts

@@ -10,6 +10,14 @@ describe("buildFilterWhere", () => {
     expect(buildFilterWhere("status", "ne", "active")).toEqual({ status: { ne: "active" } });
   });
 
+  test("eq with null: returns a direct null WhereObject (IS NULL downstream)", () => {
+    expect(buildFilterWhere("status", "eq", null)).toEqual({ status: null });
+  });
+
+  test("ne with null: wraps null in a { ne } clause (IS NOT NULL downstream, #2015)", () => {
+    expect(buildFilterWhere("status", "ne", null)).toEqual({ status: { ne: null } });
+  });
+
   test("lt: wraps the value in a { lt } clause", () => {
     expect(buildFilterWhere("createdAt", "lt", 100)).toEqual({ createdAt: { lt: 100 } });
   });

package/src/db/__tests__/event-store-executor-list.integration.test.ts

@@ -224,6 +224,38 @@ describe("event-store-executor.list — filter (Tier 2.7c)", () => {
     expect(res.rows).toHaveLength(0);
   });
 
+  test("filter ne mit value null: matcht rows mit gesetztem Feld (#2015)", async () => {
+    // #2015: rank is optional — pre-fix, `ne` compiled to `rank <> NULL`,
+    // which is never true in SQL and returned 0 rows.
+    await seed(3);
+    await exec.create({ title: "no-rank" }, admin, tdb);
+    const res = await exec.list(
+      {
+        limit: 50,
+        sort: "rank",
+        sortDirection: "asc",
+        filter: { field: "rank", op: "ne", value: null },
+      },
+      admin,
+      tdb,
+    );
+    expect(res.rows.map((r) => r["rank"])).toEqual([0, 1, 2]);
+  });
+
+  test("filter eq mit value null: matcht rows mit ungesetztem Feld (#2015)", async () => {
+    await seed(3);
+    await exec.create({ title: "no-rank" }, admin, tdb);
+    const res = await exec.list(
+      {
+        limit: 50,
+        filter: { field: "rank", op: "eq", value: null },
+      },
+      admin,
+      tdb,
+    );
+    expect(res.rows.map((r) => r["title"])).toEqual(["no-rank"]);
+  });
+
   test("filter unknown-field: silent skip — kein Crash, alle rows zurück", async () => {
     // Boot-Validator pinst das normalerweise; Runtime-Defense für den
     // Fall dass ein Test/Caller direkt am executor vorbei ein bogus-

package/src/db/event-store-executor-read.ts

@@ -116,13 +116,21 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
           return;
         }
         for (const [field, value] of Object.entries(screen)) {
-          if (Array.isArray(value)) {
+          // #2015: `x <> NULL` is never true — mirror buildWhereClause's IS [NOT] NULL handling in bun-db/query.ts.
+          if (value === null) {
+            whereSql.push(`${colSql(field)} IS NULL`);
+          } else if (Array.isArray(value)) {
             const placeholders = value.map((v) => {
               params.push(v);
               return `$${params.length}`;
             });
             whereSql.push(`${colSql(field)} IN (${placeholders.join(", ")})`);
-          } else if (typeof value === "object" && value !== null) {
+          } else if (typeof value === "object") {
+            const valueObj = value as Record<string, unknown>;
+            if (valueObj["ne"] === null && Object.keys(valueObj).length === 1) {
+              whereSql.push(`${colSql(field)} IS NOT NULL`);
+              continue;
+            }
             const opMap: Record<string, string> = {
               gt: ">",
               gte: ">=",

package/src/derivatives/__tests__/variant-route.integration.test.ts

@@ -98,6 +98,19 @@ describe("GET /api/files/:id/variant/:name", () => {
     expect(new Uint8Array(await res.arrayBuffer())).toEqual(VARIANT_BYTES);
   });
 
+  // setupTestStack doesn't wrap with the app-wide security-headers default, so a pass proves the route sets its own.
+  test("sets X-Content-Type-Options: nosniff on the response itself", async () => {
+    const fileId = await uploadFile();
+    const token = await stack.jwt.sign(user);
+
+    const res = await stack.app.request(`/api/files/${fileId}/variant/thumb`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get("X-Content-Type-Options")).toBe("nosniff");
+  });
+
   test("a second call hits the cache — the renderer runs only once", async () => {
     renderCalls = 0;
     const fileId = await uploadFile();

package/src/engine/__tests__/qualified-name.test.ts

@@ -45,6 +45,48 @@ describe("qn()", () => {
     expect(qn("feature2", QnTypes.job, "sync-v2")).toBe("feature2:job:sync-v2");
     expect(qn("my-app", QnTypes.event, "user:created")).toBe("my-app:event:user:created");
   });
+
+  test("rejects a name that starts with '<scope>:<reserved-type>:' (#1991)", () => {
+    // The exact shape from the issue: an already-qualified string
+    // ("ai-orchestration:query:duplicate-candidates") passed in as the short
+    // name for a handler on the "ai-orchestration" feature.
+    expect(() =>
+      qn("ai-orchestration", "query", "ai-orchestration:query:duplicate-candidates"),
+    ).toThrow(/double-qualification/);
+  });
+
+  test("error suggests the corrected short name (#1991)", () => {
+    expect(() =>
+      qn("ai-orchestration", "query", "ai-orchestration:query:duplicate-candidates"),
+    ).toThrow(/Did you mean "duplicate-candidates"\?/);
+  });
+
+  test("omits the suggestion when stripping the prefix leaves nothing", () => {
+    expect(() => qn("billing", "write", "billing:write")).toThrow(/double-qualification/);
+    expect(() => qn("billing", "write", "billing:write")).not.toThrow(/Did you mean/);
+  });
+
+  // Both signals — scope repeating in segment 0 AND a reserved type in
+  // segment 1 — must hold together. Either alone is common, legitimate
+  // sub-structure across the real codebase; these are the exact shapes that
+  // regressed when the check first fired on either signal independently.
+  test("allows the scope repeating as an entity prefix without a reserved type next (#1991)", () => {
+    expect(qn("user", "write", "user:create")).toBe("user:write:user:create");
+    expect(qn("accounts", "write", "accounts:create")).toBe("accounts:write:accounts:create");
+    expect(qn("profile", "query", "profile:me")).toBe("profile:query:profile:me");
+  });
+
+  test("allows a reserved type appearing mid-name without the scope repeating first (#1991)", () => {
+    expect(qn("events", "write", "event:create")).toBe("events:write:event:create");
+    expect(qn("compliance-profiles", "query", "compliance:query:for-tenant")).toBe(
+      "compliance-profiles:query:compliance:query:for-tenant",
+    );
+  });
+
+  test("allows a sub-structured name whose first segment merely resembles the scope", () => {
+    // "invoice" != "invoices" — no false positive from a near-miss prefix.
+    expect(qn("invoices", "query", "invoice:mark-paid")).toBe("invoices:query:invoice:mark-paid");
+  });
 });
 
 describe("parseQn()", () => {

package/src/engine/__tests__/registry.test.ts

@@ -177,6 +177,28 @@ describe("getAllStreamHandlers", () => {
   });
 });
 
+describe("double-qualified handler names (#1991)", () => {
+  test("createRegistry throws at boot when a query handler's short name is already fully-qualified", () => {
+    const feature = defineFeature("registry-test-ai-orch", (r) => {
+      r.queryHandler(
+        "registry-test-ai-orch:query:duplicate-candidates",
+        z.object({}),
+        async () => ({}),
+      );
+    });
+
+    expect(() => createRegistry([feature])).toThrow(/double-qualification/);
+  });
+
+  test("createRegistry allows a sub-structured short name whose entity prefix merely resembles the feature name", () => {
+    const feature = defineFeature("registry-test-invoices", (r) => {
+      r.queryHandler("invoice:mark-paid", z.object({}), async () => ({}));
+    });
+
+    expect(() => createRegistry([feature])).not.toThrow();
+  });
+});
+
 describe("extensionSelector boot-validation", () => {
   function foundationFeature() {
     return defineFeature("probe-foundation", (r) => {

package/src/engine/qualified-name.ts

@@ -45,14 +45,47 @@ function validateSegment(value: string, label: string, context?: string): void {
   }
 }
 
+// registry-ingest.ts also qualifies handlers/projections with these two —
+// not in the public QnTypes enum, but reachable as a type segment the same
+// way (#1991).
+const NON_ENUM_QN_TYPES = ["stream", "projection", "workspace"] as const;
+
+// Every segment word that a fully-qualified QN can carry as its type.
+const RESERVED_QN_SEGMENTS: ReadonlySet<string> = new Set<string>([
+  ...Object.values(QnTypes),
+  ...NON_ENUM_QN_TYPES,
+]);
+
+// A double-qualified `name` looks like "<scope>:<type>:<realName>" — the
+// caller accidentally passed the full QN as the short name instead of just
+// the trailing part. Both signals must hold together: the scope alone
+// repeating (e.g. entity "user:create" on feature "user") or a reserved word
+// alone appearing (e.g. "compliance:query:for-tenant") are both common,
+// legitimate sub-structure on their own (#1991).
+function isDoubleQualified(scope: string, segments: readonly string[]): boolean {
+  const [first, second] = segments;
+  return first === scope && second !== undefined && RESERVED_QN_SEGMENTS.has(second);
+}
+
 // Build a qualified name from parts. Validates all segments.
 // The name can contain colons for sub-structure (e.g. "task:create").
 export function qn(scope: string, type: QnType, name: string): string {
   validateSegment(scope, "scope");
   validateSegment(type, "type");
-  for (const part of name.split(":")) {
+  const nameSegments = name.split(":");
+  for (const part of nameSegments) {
     validateSegment(part, "name");
   }
+  if (isDoubleQualified(scope, nameSegments)) {
+    const suggestion = nameSegments.slice(2).join(":");
+    const suggestionText = suggestion.length > 0 ? ` Did you mean "${suggestion}"?` : "";
+    throw new Error(
+      `Invalid QN name "${name}" for scope "${scope}": starts with "${scope}:${nameSegments[1]}:" — this looks ` +
+        `like an already-qualified name passed in as the short name (double-qualification), not legitimate ` +
+        `sub-structure.${suggestionText} Pass only the short name; qn()/qualifyEntityName already add the ` +
+        `"${scope}:${type}:" prefix.`,
+    );
+  }
   return `${scope}:${type}:${name}`;
 }
 

package/src/files/file-routes.ts

@@ -289,6 +289,8 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
       headers: {
         "Content-Type": result.mimeType,
         "Cache-Control": "private, max-age=31536000, immutable",
+        // Explicit here, not left to the app-wide security-headers default, so the route stays safe standalone.
+        "X-Content-Type-Options": "nosniff",
       },
     });
   });