@cosmicdrift/kumiko-framework 0.208.0 → 0.208.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.208.0",
+  "version": "0.208.2",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -190,7 +190,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.208.0",
+    "@cosmicdrift/kumiko-types": "0.208.2",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -206,7 +206,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.208.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.208.2",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/db/__tests__/event-store-executor-list.integration.test.ts

@@ -126,6 +126,81 @@ describe("event-store-executor.list — offset + totalCount (Tier 2.6d)", () =>
   });
 });
 
+describe("event-store-executor.list — stable order (#2198)", () => {
+  const exec = createEventStoreExecutor(table, entity, { entityName: "pagerItem" });
+
+  test("offset paging mit identischem sort-Wert: keine Row auf beiden Seiten, Union = alle Rows", async () => {
+    // All rows share the same rank value. Postgres picks a Top-N heapsort
+    // for LIMIT queries, which is not stable across ties — and different
+    // offsets sort differently-sized heaps (LIMIT 3 OFFSET 0 sorts the
+    // top 3, LIMIT 3 OFFSET 3 sorts the top 6), so without an id
+    // tie-breaker the same row can surface on multiple pages while
+    // another is skipped entirely. Needs enough rows + small enough
+    // pages to make the heap sizes diverge; 10 rows / page 5 (the
+    // previous setup) was too forgiving and stayed green without the fix.
+    const total = 25;
+    const pageSize = 3;
+    for (let i = 0; i < total; i++) {
+      await exec.create({ title: `item-${String(i).padStart(3, "0")}`, rank: 1 }, admin, tdb);
+    }
+    const page1 = await exec.list(
+      { limit: pageSize, offset: 0, sort: "rank", sortDirection: "asc" },
+      admin,
+      tdb,
+    );
+    const page2 = await exec.list(
+      { limit: pageSize, offset: pageSize, sort: "rank", sortDirection: "asc" },
+      admin,
+      tdb,
+    );
+    const ids1 = page1.rows.map((r) => r["id"]);
+    const ids2 = page2.rows.map((r) => r["id"]);
+    expect(ids1.filter((id) => ids2.includes(id))).toHaveLength(0);
+
+    const allIds = new Set<unknown>();
+    for (let offset = 0; offset < total; offset += pageSize) {
+      const page = await exec.list(
+        { limit: pageSize, offset, sort: "rank", sortDirection: "asc" },
+        admin,
+        tdb,
+      );
+      for (const id of page.rows.map((r) => r["id"])) allIds.add(id);
+    }
+    expect(allIds.size).toBe(total);
+  });
+
+  test("cursor paging ohne sort: jede Row genau einmal", async () => {
+    // Plain sequential inserts keep heap physical order == uuidv7 id order,
+    // so a Seq Scan without ORDER BY happens to come out sorted anyway and
+    // the missing-ORDER-BY bug stays invisible. Delete half the rows and
+    // VACUUM to free their heap space, then insert more rows so their
+    // (higher) uuidv7 ids get placed into the reused (earlier) pages —
+    // now physical scan order diverges from id order.
+    const client = asRawClient(testDb.db);
+    for (let i = 0; i < 100; i++) {
+      await exec.create({ title: `item-${String(i).padStart(3, "0")}`, rank: i }, admin, tdb);
+    }
+    await client.unsafe(`DELETE FROM read_pager_items WHERE rank::int % 2 = 1`);
+    await client.unsafe(`VACUUM read_pager_items`);
+    for (let i = 100; i < 150; i++) {
+      await exec.create({ title: `item-${String(i).padStart(3, "0")}`, rank: i }, admin, tdb);
+    }
+    const countRow = await client.unsafe(`SELECT count(*)::int AS c FROM read_pager_items`);
+    const total = (countRow as unknown as Array<{ c: number }>)[0]?.c ?? 0;
+
+    const seenIds: string[] = [];
+    let cursor: string | undefined;
+    for (let page = 0; page < total + 5; page++) {
+      const res = await exec.list({ limit: 3, cursor }, admin, tdb);
+      seenIds.push(...res.rows.map((r) => r["id"] as string));
+      if (res.nextCursor === null) break;
+      cursor = res.nextCursor;
+    }
+    expect(seenIds).toHaveLength(total);
+    expect(new Set(seenIds).size).toBe(total);
+  });
+});
+
 describe("event-store-executor.list — filter (Tier 2.7c)", () => {
   const exec = createEventStoreExecutor(table, entity, { entityName: "pagerItem" });
 

package/src/db/event-store-executor-read.ts

@@ -200,8 +200,8 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
 
       const orderByClause =
         payload.sort && table[payload.sort]
-          ? ` ORDER BY ${colSql(payload.sort)} ${payload.sortDirection === "desc" ? "DESC" : "ASC"}`
-          : "";
+          ? ` ORDER BY ${colSql(payload.sort)} ${payload.sortDirection === "desc" ? "DESC" : "ASC"}, ${colSql("id")} ASC`
+          : ` ORDER BY ${colSql("id")} ASC`;
       const useOffset = !payload.cursor && offset > 0;
       const offsetClause = useOffset ? ` OFFSET ${offset}` : "";
 

package/src/engine/define-handler.ts

@@ -1,3 +1,4 @@
+import type { CursorResult } from "@cosmicdrift/kumiko-types/cursor-types";
 import type { ZodType, z } from "zod";
 import type { ContainsSecret } from "../secrets/types";
 import { runPipeline } from "./run-pipeline";
@@ -116,3 +117,68 @@ export function defineQueryHandler<
 ): QueryHandlerDefinition<TName, TSchema, TResult, TMap> {
   return def;
 }
+
+// Runtime marker set only by definePagedQueryHandler. A plain
+// defineQueryHandler-built object never carries it. Kept as a type-level
+// signal (fw#2216) even though no validator gates on it — QueryHandlerDef
+// has no output schema, so a boot check can't distinguish "returns
+// PagedRows" from "doesn't" without running the handler; the actual
+// enforcement is a runtime shape guard in the renderer (kumiko-screen.tsx).
+//
+// A string key, not a Symbol: bundled-features imports this module through
+// the package's "@cosmicdrift/kumiko-framework/engine" subpath (symlinked
+// node_modules entry) via a different resolution route than a same-package
+// relative import — two routes to the same file that can end up as two
+// separate module instances under bundler symlink handling. A Symbol()
+// evaluated twice would produce two unequal brands; a string literal doesn't
+// have that failure mode.
+// Exported (not just the predicate) so feature-entity-handlers.ts's
+// queryHandler() registrar — which rebuilds a fresh QueryHandlerDef from an
+// explicit field whitelist rather than spreading `def` — can carry the
+// brand through into the stored registry entry.
+export const PAGED_QUERY_HANDLER_BRAND = "__kumikoPagedQueryHandler";
+
+export function isPagedQueryHandler(def: object): boolean {
+  // @cast-boundary brand-probe — reading an internal marker key off an
+  // otherwise-typed handler definition; the property may legitimately be
+  // absent, which is exactly the case this function distinguishes.
+  return (def as Record<string, unknown>)[PAGED_QUERY_HANDLER_BRAND] === true;
+}
+
+export type PagedQueryHandlerDefinition<
+  TName extends string = string,
+  TSchema extends ZodType = ZodType,
+  TRow = unknown,
+  TMap extends object = KumikoEventTypeMap,
+> = QueryHandlerDefinition<TName, TSchema, CursorResult<TRow>, TMap> & {
+  readonly [PAGED_QUERY_HANDLER_BRAND]: true;
+};
+
+// A projectionList screen's query must resolve to { rows, nextCursor, total? }
+// (CursorResult<T>) — the renderer used to read rowsQuery.data?.rows and
+// silently show an empty list otherwise (fw#2216: session-list); the
+// renderer now guards against a malformed shape at runtime instead. Use this
+// instead of defineQueryHandler for any query wired to a projectionList
+// screen's `query` so the contract is documented at the definition site.
+//
+// Deliberately does NOT merge cursor/limit/sort/search into the input
+// schema — that would change sortable/paginated derivation for existing
+// screens (a behavior change, not a wrapper change). Callers that want
+// those params add them to `schema` themselves.
+export function definePagedQueryHandler<
+  const TName extends string,
+  TSchema extends ZodType,
+  TRow = unknown,
+  TMap extends object = KumikoEventTypeMap,
+>(
+  def: QueryHandlerDefinition<TName, TSchema, CursorResult<TRow>, TMap>,
+  // R6: phantom rest-param — see defineWriteHandler. CursorResult<TRow> wraps
+  // TRow in `rows`, so ContainsSecret recurses through the array element.
+  ..._noSecretInResponse: true extends ContainsSecret<CursorResult<TRow>>
+    ? [
+        secretLeak: "A handler response must not contain a Secret<> — call .reveal() and return the plaintext, or drop the field.",
+      ]
+    : []
+): PagedQueryHandlerDefinition<TName, TSchema, TRow, TMap> {
+  return { ...def, [PAGED_QUERY_HANDLER_BRAND]: true };
+}

package/src/engine/entity-handlers.ts

@@ -9,6 +9,7 @@ import { createEventStoreExecutor, type EventStoreExecutor } from "../db/event-s
 import { buildEntityTable, type EntityTable } from "../db/table-builder";
 import { createTenantDb, type TenantDb } from "../db/tenant-db";
 import { assertUnreachable } from "../utils";
+import { PAGED_QUERY_HANDLER_BRAND } from "./define-handler";
 import { buildInsertSchema, buildUpdateSchema } from "./schema-builder";
 import type {
   AccessRule,
@@ -366,6 +367,12 @@ export function defineEntityQueryHandler(
     schema,
     handler,
     ...(options?.access && { access: options.access }),
+    // The "list" verb's executor.list() always returns { rows, nextCursor,
+    // total? } (see the handler body above) — brand it so the definition
+    // site documents the PagedRows contract without needing
+    // definePagedQueryHandler on top. The "detail" verb returns a single
+    // row/null, never this shape.
+    ...(verb === "list" && { [PAGED_QUERY_HANDLER_BRAND]: true }),
   };
 }
 

package/src/engine/feature-entity-handlers.ts

@@ -1,9 +1,11 @@
 import type { ZodType, z } from "zod";
 import { toTableName } from "../db/table-builder";
-import type {
-  QueryHandlerDefinition,
-  StreamHandlerDefinition,
-  WriteHandlerDefinition,
+import {
+  isPagedQueryHandler,
+  PAGED_QUERY_HANDLER_BRAND,
+  type QueryHandlerDefinition,
+  type StreamHandlerDefinition,
+  type WriteHandlerDefinition,
 } from "./define-handler";
 import type { RegisterEntityCrudOptions } from "./entity-handlers";
 import { registerEntityCrud } from "./entity-handlers";
@@ -153,6 +155,9 @@ export function buildEntityHandlerMethods<TName extends string>(
           handler: def.handler as QueryHandlerFn, // @cast-boundary engine-bridge
           ...(def.access && { access: def.access }),
           ...(def.rateLimit && { rateLimit: def.rateLimit }),
+          // Carry the definePagedQueryHandler brand through — this rebuild
+          // drops any field not explicitly listed.
+          ...(isPagedQueryHandler(def) && { [PAGED_QUERY_HANDLER_BRAND]: true }),
         };
         tryMapEntity(state, name, def.name);
         return { name: def.name };

package/src/engine/index.ts

@@ -41,12 +41,18 @@ export { createApp } from "./create-app";
 export { crossTenantOverrideDenied } from "./cross-tenant";
 export { defineFeature } from "./define-feature";
 export type {
+  PagedQueryHandlerDefinition,
   QueryHandlerDefinition,
   StreamHandlerDefinition,
   WriteHandlerDefinition,
   WriteHandlerInput,
 } from "./define-handler";
-export { defineQueryHandler, defineWriteHandler } from "./define-handler";
+export {
+  definePagedQueryHandler,
+  defineQueryHandler,
+  defineWriteHandler,
+  isPagedQueryHandler,
+} from "./define-handler";
 export { defineRoles } from "./define-roles";
 export { defineStep, getStep, listStepKinds } from "./define-step";
 export type { WorkflowDefinition, WorkflowInput, WorkflowTrigger } from "./define-workflow";