@cosmicdrift/kumiko-framework 0.196.1 → 0.197.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.196.1",
+  "version": "0.197.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -186,7 +186,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.196.1",
+    "@cosmicdrift/kumiko-types": "0.197.1",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -202,7 +202,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.196.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.197.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/db/__tests__/build-filter-where.test.ts

@@ -10,6 +10,14 @@ describe("buildFilterWhere", () => {
     expect(buildFilterWhere("status", "ne", "active")).toEqual({ status: { ne: "active" } });
   });
 
+  test("eq with null: returns a direct null WhereObject (IS NULL downstream)", () => {
+    expect(buildFilterWhere("status", "eq", null)).toEqual({ status: null });
+  });
+
+  test("ne with null: wraps null in a { ne } clause (IS NOT NULL downstream, #2015)", () => {
+    expect(buildFilterWhere("status", "ne", null)).toEqual({ status: { ne: null } });
+  });
+
   test("lt: wraps the value in a { lt } clause", () => {
     expect(buildFilterWhere("createdAt", "lt", 100)).toEqual({ createdAt: { lt: 100 } });
   });

package/src/db/__tests__/event-store-executor-list.integration.test.ts

@@ -224,6 +224,38 @@ describe("event-store-executor.list — filter (Tier 2.7c)", () => {
     expect(res.rows).toHaveLength(0);
   });
 
+  test("filter ne mit value null: matcht rows mit gesetztem Feld (#2015)", async () => {
+    // #2015: rank is optional — pre-fix, `ne` compiled to `rank <> NULL`,
+    // which is never true in SQL and returned 0 rows.
+    await seed(3);
+    await exec.create({ title: "no-rank" }, admin, tdb);
+    const res = await exec.list(
+      {
+        limit: 50,
+        sort: "rank",
+        sortDirection: "asc",
+        filter: { field: "rank", op: "ne", value: null },
+      },
+      admin,
+      tdb,
+    );
+    expect(res.rows.map((r) => r["rank"])).toEqual([0, 1, 2]);
+  });
+
+  test("filter eq mit value null: matcht rows mit ungesetztem Feld (#2015)", async () => {
+    await seed(3);
+    await exec.create({ title: "no-rank" }, admin, tdb);
+    const res = await exec.list(
+      {
+        limit: 50,
+        filter: { field: "rank", op: "eq", value: null },
+      },
+      admin,
+      tdb,
+    );
+    expect(res.rows.map((r) => r["title"])).toEqual(["no-rank"]);
+  });
+
   test("filter unknown-field: silent skip — kein Crash, alle rows zurück", async () => {
     // Boot-Validator pinst das normalerweise; Runtime-Defense für den
     // Fall dass ein Test/Caller direkt am executor vorbei ein bogus-

package/src/db/event-store-executor-read.ts

@@ -116,13 +116,21 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
           return;
         }
         for (const [field, value] of Object.entries(screen)) {
-          if (Array.isArray(value)) {
+          // #2015: `x <> NULL` is never true — mirror buildWhereClause's IS [NOT] NULL handling in bun-db/query.ts.
+          if (value === null) {
+            whereSql.push(`${colSql(field)} IS NULL`);
+          } else if (Array.isArray(value)) {
             const placeholders = value.map((v) => {
               params.push(v);
               return `$${params.length}`;
             });
             whereSql.push(`${colSql(field)} IN (${placeholders.join(", ")})`);
-          } else if (typeof value === "object" && value !== null) {
+          } else if (typeof value === "object") {
+            const valueObj = value as Record<string, unknown>;
+            if (valueObj["ne"] === null && Object.keys(valueObj).length === 1) {
+              whereSql.push(`${colSql(field)} IS NOT NULL`);
+              continue;
+            }
             const opMap: Record<string, string> = {
               gt: ">",
               gte: ">=",

package/src/derivatives/__tests__/derivatives-context.test.ts

@@ -171,4 +171,47 @@ describe("createDerivativesContext — variant()", () => {
     expect(provider.mimeTypeOf(result.storageKey)).toBe(result.mimeType);
     expect(result.mimeType).toBe("image/webp");
   });
+
+  // #2021 — a variant with no spec.format used to fall straight through to
+  // the source's mimeType, which is client-controlled (`file.type` off the
+  // upload). A field without `accept` plus a broad `image/*` renderer
+  // wildcard (like `setup()`'s here) let a client ride an active-content
+  // type like `image/svg+xml` all the way to the response Content-Type.
+  test("no spec.format + a non-allowlisted source mimeType does not take over that mimeType", async () => {
+    const { ctx, provider } = await setup("image/svg+xml");
+    const spec = {} as const;
+
+    const result = await ctx.variant(FILE_REF_ID, spec, "thumb");
+
+    expect(result.mimeType).not.toBe("image/svg+xml");
+    expect(result.mimeType).toBe("application/octet-stream");
+    expect(provider.mimeTypeOf(result.storageKey)).toBe("application/octet-stream");
+  });
+
+  test("no spec.format + a non-allowlisted source mimeType — a cache hit returns the same normalized value", async () => {
+    const { ctx } = await setup("image/svg+xml");
+    const spec = {} as const;
+
+    const first = await ctx.variant(FILE_REF_ID, spec, "thumb");
+    const second = await ctx.variant(FILE_REF_ID, spec, "thumb");
+
+    expect(first.mimeType).toBe("application/octet-stream");
+    expect(second.mimeType).toBe("application/octet-stream");
+  });
+
+  test("no spec.format keeps a known-safe source mimeType — resize-without-reformat stays intact", async () => {
+    const { ctx } = await setup("image/png");
+
+    const result = await ctx.variant(FILE_REF_ID, { maxEdge: 320 }, "thumb");
+
+    expect(result.mimeType).toBe("image/png");
+  });
+
+  test("no spec.format normalizes a `; charset=` suffix off the source mimeType instead of leaking it raw", async () => {
+    const { ctx } = await setup("image/jpeg; charset=binary");
+
+    const result = await ctx.variant(FILE_REF_ID, {}, "thumb");
+
+    expect(result.mimeType).toBe("image/jpeg");
+  });
 });

package/src/derivatives/__tests__/variant-route.integration.test.ts

@@ -27,7 +27,14 @@ const fakeRender: DerivativeRendererPlugin["render"] = async () => {
 const photoEntity = createEntity({
   table: "variant_route_photos",
   fields: {
-    avatar: createImageField({ variants: { thumb: { maxEdge: 100, format: "webp" } } }),
+    avatar: createImageField({
+      variants: {
+        thumb: { maxEdge: 100, format: "webp" },
+        // No format — resize-without-reformat, the legitimate reason
+        // spec.format can be omitted (see #2021).
+        raw: { maxEdge: 100 },
+      },
+    }),
   },
 });
 
@@ -98,6 +105,19 @@ describe("GET /api/files/:id/variant/:name", () => {
     expect(new Uint8Array(await res.arrayBuffer())).toEqual(VARIANT_BYTES);
   });
 
+  // setupTestStack doesn't wrap with the app-wide security-headers default, so a pass proves the route sets its own.
+  test("sets X-Content-Type-Options: nosniff on the response itself", async () => {
+    const fileId = await uploadFile();
+    const token = await stack.jwt.sign(user);
+
+    const res = await stack.app.request(`/api/files/${fileId}/variant/thumb`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get("X-Content-Type-Options")).toBe("nosniff");
+  });
+
   test("a second call hits the cache — the renderer runs only once", async () => {
     renderCalls = 0;
     const fileId = await uploadFile();
@@ -194,4 +214,44 @@ describe("GET /api/files/:id/variant/:name", () => {
     expect(res.status).toBe(415);
     expect(await res.json()).toEqual({ error: "unsupported_media_type" });
   });
+
+  // #2021 — the "raw" variant has no `format`, so its mimeType comes from
+  // outputMimeType's fallback branch. `avatar` has no `accept`, so the
+  // source mimeType is exactly the client-controlled `file.type` from the
+  // upload — this proves the route no longer echoes it verbatim.
+  test("a variant with no spec.format never echoes a non-safe, client-controlled source mimeType", async () => {
+    const token = await stack.jwt.sign(user);
+    const fd = new FormData();
+    fd.append("file", new File([Buffer.from([1, 2, 3])], "avatar.svg", { type: "image/svg+xml" }));
+    fd.append("entityType", "photo");
+    fd.append("fieldName", "avatar");
+    const { body, contentType } = await buildMultipartBody(fd);
+    const uploadRes = await stack.app.request("/api/files", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": contentType },
+      body,
+    });
+    expect(uploadRes.status).toBe(201);
+    const { id: fileId } = (await uploadRes.json()) as { id: string };
+
+    const res = await stack.app.request(`/api/files/${fileId}/variant/raw`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).not.toBe("image/svg+xml");
+    expect(res.headers.get("Content-Type")).toBe("application/octet-stream");
+  });
+
+  test("a variant with no spec.format keeps a known-safe source mimeType through the full route (resize without reformat)", async () => {
+    const fileId = await uploadFile();
+    const token = await stack.jwt.sign(user);
+
+    const res = await stack.app.request(`/api/files/${fileId}/variant/raw`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get("Content-Type")).toBe("image/jpeg");
+  });
 });

package/src/derivatives/derivatives-context.ts

@@ -69,6 +69,23 @@ function isFileRefRow(row: Record<string, unknown>): row is FileRefRow {
   return typeof row["storageKey"] === "string" && typeof row["mimeType"] === "string";
 }
 
+// sourceMimeType is client-controlled (it's `file.type` off the upload — see
+// file-routes.ts's "a field without `accept` lets a client upload anything")
+// and, when spec.format is unset, a renderer is documented to preserve the
+// source's own format (DerivativeRendererPlugin's doc comment) — so the
+// bytes really are in this format, but the STRING itself must still be
+// allowlisted before it becomes a response Content-Type or storage-provider
+// metadata. Otherwise an app whose renderer wildcard is broad enough (e.g.
+// `image/*`) would let a client-declared `image/svg+xml` ride straight
+// through as an honestly-declared (non-sniffed) active-content type (#2021).
+const KNOWN_SAFE_VARIANT_MIME_TYPES: ReadonlySet<string> = new Set([
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/avif",
+  "image/gif",
+]);
+
 // The spec — not the renderer — determines the output mimeType, so it's the
 // single source of truth for both what gets written to storage and what the
 // caller receives; a cache hit never runs the renderer, so there's nothing
@@ -81,8 +98,12 @@ function outputMimeType(spec: VariantSpec, sourceMimeType: string): string {
       return "image/avif";
     case "jpeg":
       return "image/jpeg";
-    default:
-      return sourceMimeType;
+    default: {
+      const normalized = normalizeMimeType(sourceMimeType);
+      return KNOWN_SAFE_VARIANT_MIME_TYPES.has(normalized)
+        ? normalized
+        : "application/octet-stream";
+    }
   }
 }
 

package/src/engine/__tests__/qualified-name.test.ts

@@ -45,6 +45,48 @@ describe("qn()", () => {
     expect(qn("feature2", QnTypes.job, "sync-v2")).toBe("feature2:job:sync-v2");
     expect(qn("my-app", QnTypes.event, "user:created")).toBe("my-app:event:user:created");
   });
+
+  test("rejects a name that starts with '<scope>:<reserved-type>:' (#1991)", () => {
+    // The exact shape from the issue: an already-qualified string
+    // ("ai-orchestration:query:duplicate-candidates") passed in as the short
+    // name for a handler on the "ai-orchestration" feature.
+    expect(() =>
+      qn("ai-orchestration", "query", "ai-orchestration:query:duplicate-candidates"),
+    ).toThrow(/double-qualification/);
+  });
+
+  test("error suggests the corrected short name (#1991)", () => {
+    expect(() =>
+      qn("ai-orchestration", "query", "ai-orchestration:query:duplicate-candidates"),
+    ).toThrow(/Did you mean "duplicate-candidates"\?/);
+  });
+
+  test("omits the suggestion when stripping the prefix leaves nothing", () => {
+    expect(() => qn("billing", "write", "billing:write")).toThrow(/double-qualification/);
+    expect(() => qn("billing", "write", "billing:write")).not.toThrow(/Did you mean/);
+  });
+
+  // Both signals — scope repeating in segment 0 AND a reserved type in
+  // segment 1 — must hold together. Either alone is common, legitimate
+  // sub-structure across the real codebase; these are the exact shapes that
+  // regressed when the check first fired on either signal independently.
+  test("allows the scope repeating as an entity prefix without a reserved type next (#1991)", () => {
+    expect(qn("user", "write", "user:create")).toBe("user:write:user:create");
+    expect(qn("accounts", "write", "accounts:create")).toBe("accounts:write:accounts:create");
+    expect(qn("profile", "query", "profile:me")).toBe("profile:query:profile:me");
+  });
+
+  test("allows a reserved type appearing mid-name without the scope repeating first (#1991)", () => {
+    expect(qn("events", "write", "event:create")).toBe("events:write:event:create");
+    expect(qn("compliance-profiles", "query", "compliance:query:for-tenant")).toBe(
+      "compliance-profiles:query:compliance:query:for-tenant",
+    );
+  });
+
+  test("allows a sub-structured name whose first segment merely resembles the scope", () => {
+    // "invoice" != "invoices" — no false positive from a near-miss prefix.
+    expect(qn("invoices", "query", "invoice:mark-paid")).toBe("invoices:query:invoice:mark-paid");
+  });
 });
 
 describe("parseQn()", () => {

package/src/engine/__tests__/registry.test.ts

@@ -177,6 +177,28 @@ describe("getAllStreamHandlers", () => {
   });
 });
 
+describe("double-qualified handler names (#1991)", () => {
+  test("createRegistry throws at boot when a query handler's short name is already fully-qualified", () => {
+    const feature = defineFeature("registry-test-ai-orch", (r) => {
+      r.queryHandler(
+        "registry-test-ai-orch:query:duplicate-candidates",
+        z.object({}),
+        async () => ({}),
+      );
+    });
+
+    expect(() => createRegistry([feature])).toThrow(/double-qualification/);
+  });
+
+  test("createRegistry allows a sub-structured short name whose entity prefix merely resembles the feature name", () => {
+    const feature = defineFeature("registry-test-invoices", (r) => {
+      r.queryHandler("invoice:mark-paid", z.object({}), async () => ({}));
+    });
+
+    expect(() => createRegistry([feature])).not.toThrow();
+  });
+});
+
 describe("extensionSelector boot-validation", () => {
   function foundationFeature() {
     return defineFeature("probe-foundation", (r) => {

package/src/engine/qualified-name.ts

@@ -45,14 +45,47 @@ function validateSegment(value: string, label: string, context?: string): void {
   }
 }
 
+// registry-ingest.ts also qualifies handlers/projections with these two —
+// not in the public QnTypes enum, but reachable as a type segment the same
+// way (#1991).
+const NON_ENUM_QN_TYPES = ["stream", "projection", "workspace"] as const;
+
+// Every segment word that a fully-qualified QN can carry as its type.
+const RESERVED_QN_SEGMENTS: ReadonlySet<string> = new Set<string>([
+  ...Object.values(QnTypes),
+  ...NON_ENUM_QN_TYPES,
+]);
+
+// A double-qualified `name` looks like "<scope>:<type>:<realName>" — the
+// caller accidentally passed the full QN as the short name instead of just
+// the trailing part. Both signals must hold together: the scope alone
+// repeating (e.g. entity "user:create" on feature "user") or a reserved word
+// alone appearing (e.g. "compliance:query:for-tenant") are both common,
+// legitimate sub-structure on their own (#1991).
+function isDoubleQualified(scope: string, segments: readonly string[]): boolean {
+  const [first, second] = segments;
+  return first === scope && second !== undefined && RESERVED_QN_SEGMENTS.has(second);
+}
+
 // Build a qualified name from parts. Validates all segments.
 // The name can contain colons for sub-structure (e.g. "task:create").
 export function qn(scope: string, type: QnType, name: string): string {
   validateSegment(scope, "scope");
   validateSegment(type, "type");
-  for (const part of name.split(":")) {
+  const nameSegments = name.split(":");
+  for (const part of nameSegments) {
     validateSegment(part, "name");
   }
+  if (isDoubleQualified(scope, nameSegments)) {
+    const suggestion = nameSegments.slice(2).join(":");
+    const suggestionText = suggestion.length > 0 ? ` Did you mean "${suggestion}"?` : "";
+    throw new Error(
+      `Invalid QN name "${name}" for scope "${scope}": starts with "${scope}:${nameSegments[1]}:" — this looks ` +
+        `like an already-qualified name passed in as the short name (double-qualification), not legitimate ` +
+        `sub-structure.${suggestionText} Pass only the short name; qn()/qualifyEntityName already add the ` +
+        `"${scope}:${type}:" prefix.`,
+    );
+  }
   return `${scope}:${type}:${name}`;
 }
 

package/src/files/file-routes.ts

@@ -289,6 +289,8 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
       headers: {
         "Content-Type": result.mimeType,
         "Cache-Control": "private, max-age=31536000, immutable",
+        // Explicit here, not left to the app-wide security-headers default, so the route stays safe standalone.
+        "X-Content-Type-Options": "nosniff",
       },
     });
   });