@cosmicdrift/kumiko-framework 0.215.1 → 0.215.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.215.1",
+  "version": "0.215.3",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -194,7 +194,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.215.1",
+    "@cosmicdrift/kumiko-types": "0.215.3",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -210,7 +210,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.215.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.215.3",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/__tests__/upgrade-cli.test.ts

@@ -151,6 +151,47 @@ describe("upgrade command — framework core changelog", () => {
     expect(spy.errs.join("\n")).toContain("Invalid version format");
     expect(spy.logs).toEqual([]);
   });
+
+  test("--json installedVersion reflects the actually installed version, not an echo of --from", async () => {
+    const cwd = tmp({
+      "packages/framework/src/changes.json": CORE_ENTRY,
+      "packages/bundled-features/package.json": JSON.stringify({ version: "0.190.0" }),
+    });
+    const spy = makeSpyOutput();
+
+    const exit = await runUpgradeCli(["--from", "0.165.0", "--json"], cwd, spy.out);
+
+    expect(exit).toBe(0);
+    const result = JSON.parse(spy.logs.join("\n"));
+    expect(result.currentVersion).toBe("0.165.0");
+    expect(result.installedVersion).toBe("0.190.0");
+  });
+
+  test("--json without --from: currentVersion and installedVersion both come from the installed package", async () => {
+    const cwd = tmp({
+      "packages/framework/src/changes.json": CORE_ENTRY,
+      "packages/bundled-features/package.json": JSON.stringify({ version: "0.190.0" }),
+    });
+    const spy = makeSpyOutput();
+
+    const exit = await runUpgradeCli(["--json"], cwd, spy.out);
+
+    expect(exit).toBe(0);
+    const result = JSON.parse(spy.logs.join("\n"));
+    expect(result.currentVersion).toBe("0.190.0");
+    expect(result.installedVersion).toBe("0.190.0");
+  });
+
+  test("--json installedVersion is null when nothing is installed and --from is given", async () => {
+    const cwd = tmp({ "packages/framework/src/changes.json": CORE_ENTRY });
+    const spy = makeSpyOutput();
+
+    const exit = await runUpgradeCli(["--from", "0.165.0", "--json"], cwd, spy.out);
+
+    expect(exit).toBe(0);
+    const result = JSON.parse(spy.logs.join("\n"));
+    expect(result.installedVersion).toBeNull();
+  });
 });
 
 describe("upgrade command — enterprise package layout", () => {

package/src/db/blind-index-cleanup.ts

@@ -44,3 +44,41 @@ export async function nullBlindIndexesForSubject(
     }
   }
 }
+
+// Tenant-scope oracle for crypto-shredding's forget-subject (mh#349): a
+// "user"-kind subject id is often not a real user (share-token recipient,
+// email subscriber, ...) — those entities self-own their PII (`personal:
+// "self"`, i.e. their own row id IS the subject) and carry a real tenant_id,
+// unlike read_users (systemStream, tenant_id always SYSTEM_TENANT_ID). This
+// checks whether the subject row lives in the given tenant, so a tenant-
+// scoped DPO can still forget subjects it truly owns without needing a
+// tenant-membership row (which only exists for real users).
+export async function subjectRowExistsInTenant(
+  db: DbRunner,
+  features: ReadonlyMap<string, FeatureDefinition>,
+  subjectId: string,
+  tenantId: string,
+): Promise<boolean> {
+  for (const feature of features.values()) {
+    for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
+      const hasSelfPiiField = Object.values(entity.fields).some(
+        (field) => "pii" in field && field.pii === true,
+      );
+      if (!hasSelfPiiField) continue;
+      const tableName = resolveTableName(entityName, entity, undefined);
+      try {
+        const rows = await executeRawQuery(
+          db,
+          `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`,
+          [subjectId, tenantId],
+        );
+        if (rows.length > 0) return true;
+      } catch {
+        // Table missing, id-type mismatch, ... — not evidence the subject is
+        // owned here. Fail-closed must come from an honest "not found" across
+        // every entity, never from a query blowing up on one of them.
+      }
+    }
+  }
+  return false;
+}

package/src/db/index.ts

@@ -1,5 +1,5 @@
 export { assertExistsIn } from "./assert-exists-in";
-export { nullBlindIndexesForSubject } from "./blind-index-cleanup";
+export { nullBlindIndexesForSubject, subjectRowExistsInTenant } from "./blind-index-cleanup";
 export { collectTableMetas } from "./collect-table-metas";
 export { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types";
 export { seedConfigValues } from "./config-seed";

package/src/upgrade-cli.ts

@@ -355,7 +355,10 @@ export async function runUpgradeCli(
   const verbose = getFlag(args, "verbose");
   const fromFlag = getStringFlag(args, "from");
 
-  const currentVersion = fromFlag ?? readCurrentVersion(cwd);
+  // Always resolve the actually installed version, even when --from is set,
+  // so --json can report both the filter baseline and what's really there.
+  const installedVersion = readCurrentVersion(cwd);
+  const currentVersion = fromFlag ?? installedVersion;
   if (!currentVersion) {
     out.err("");
     out.err("  Could not detect Kumiko version.");
@@ -401,7 +404,7 @@ export async function runUpgradeCli(
   }
 
   if (jsonMode) {
-    out.log(JSON.stringify({ currentVersion, pending }, null, 2));
+    out.log(JSON.stringify({ currentVersion, installedVersion, pending }, null, 2));
     return 0;
   }