@cosmicdrift/kumiko-framework 0.252.0 → 0.253.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.252.0",
+  "version": "0.253.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,7 +198,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.252.0",
+    "@cosmicdrift/kumiko-types": "0.253.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -214,7 +214,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.252.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.253.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/db/queries/backfill-pii.ts

@@ -6,8 +6,12 @@
 // them in place, per field, under the owning subject's DEK:
 //
 //   - entity lifecycle events (<entity>.created/updated/deleted/forgotten/
-//     restored) for every entity with PII subject annotations
-//   - custom events from the event-PII catalog (r.defineEvent piiFields)
+//     restored) for every entity with PII subject annotations — generic over
+//     subject kind (user/tenant/record, fw#2790), since it goes through the
+//     same collectPiiSubjectFields/resolveSubjectForField the live write
+//     path uses
+//   - custom events from the event-PII catalog (r.defineEvent piiFields) —
+//     user-subject only, see the note at its call site (fw#2801)
 //
 // Already-forgotten subjects must NOT get a fresh key minted for their old
 // plaintext — three erased-detection layers write [[erased]] instead:
@@ -282,6 +286,8 @@ export async function backfillEventPiiEncryption(
       for (const [field, spec] of Object.entries(catalogFields)) {
         const subjectId = payload[spec.subjectField];
         if (typeof subjectId !== "string" || subjectId.length === 0) continue;
+        // Catalog entries only ever resolve a user subject — a tenant/record
+        // subject in a custom event is not backfillable today (fw#2801).
         const outcome = await encryptField(payload, field, { kind: "user", userId: subjectId });
         bump(outcome);
       }

package/src/event-store/__tests__/backfill-pii.integration.test.ts

@@ -20,6 +20,7 @@ import {
   isPiiCiphertext,
   KeyNotFoundError,
   PgKmsAdapter,
+  PII_CIPHERTEXT_PREFIX,
   PII_ERASED_SENTINEL,
 } from "../../crypto";
 import { applyEntityEvent } from "../../db/apply-entity-event";
@@ -72,6 +73,20 @@ const notesFeature = defineFeature("notes", (r) => {
   r.entity("note", noteEntity);
 });
 
+// personal: { of: "id" } → recordOwned (kumiko-framework#2786): the row
+// itself is the subject, not a user/tenant reachable via an owner field.
+// fw#2790 — this fixture proves the pre-existing generic backfill already
+// covers the record subject kind for lifecycle events, no new code needed.
+const surveyEntity = createEntity({
+  fields: {
+    answer: createTextField({ personal: { of: "id" }, find: "none" }),
+  },
+});
+const surveyTable = buildEntityTable("survey", surveyEntity);
+const surveyFeature = defineFeature("survey", (r) => {
+  r.entity("survey", surveyEntity);
+});
+
 let testDb: TestDb;
 let registry: Registry;
 let kms: InMemoryKmsAdapter;
@@ -96,10 +111,11 @@ async function appendPlain(
 
 beforeAll(async () => {
   testDb = await createTestDb();
-  registry = createRegistry([crmFeature, mailerFeature, notesFeature]);
+  registry = createRegistry([crmFeature, mailerFeature, notesFeature, surveyFeature]);
   await createEventsTable(testDb.db);
   await unsafeCreateEntityTable(testDb.db, contactEntity, "contact");
   await unsafeCreateEntityTable(testDb.db, noteEntity, "note");
+  await unsafeCreateEntityTable(testDb.db, surveyEntity, "survey");
 });
 
 afterAll(async () => {
@@ -111,6 +127,7 @@ beforeEach(async () => {
   await raw.unsafe(`TRUNCATE "kumiko_events" RESTART IDENTITY`);
   await raw.unsafe(`TRUNCATE "${contactTable.tableName}"`);
   await raw.unsafe(`TRUNCATE "${noteTable.tableName}"`);
+  await raw.unsafe(`TRUNCATE "${surveyTable.tableName}"`);
   // Plaintext era: NO KMS while the legacy events are appended.
   resetPiiSubjectKmsForTests();
   resetBlindIndexKeyForTests();
@@ -590,6 +607,104 @@ describe("backfillEventPiiEncryption: owner-resolution chain (fw#2266)", () => {
   });
 });
 
+// fw#2790 — "Altbestand: Freitext-Klartext in kumiko_events". #2596 added
+// the recordOwned ("record") subject kind for row-scoped free text with no
+// user/tenant owner. Nothing in this file's resolution path (subject-
+// resolver.ts / pii-field-encryption.ts) special-cases subject kind, so the
+// expectation is that this backfill already covers it for lifecycle events
+// with zero new code — these tests pin that down rather than assume it.
+describe("backfillEventPiiEncryption: record subject (kumiko-framework#2786)", () => {
+  test("encrypts a lifecycle payload under record:<entity>:<id>, not user:<id>", async () => {
+    const s1 = generateId();
+    await appendPlain(s1, "survey", "survey.created", { id: s1, answer: "plaintext answer" });
+
+    armKms();
+    const result = await backfillEventPiiEncryption(testDb.db, registry);
+
+    expect(result.failures).toEqual([]);
+    expect(result.updatedEvents).toBe(1);
+    expect(result.encryptedFields).toBe(1);
+    // Neither owner-resolution fallback is needed: the subject is the row's
+    // own id, always present on the event — stage 2/3 stay unused.
+    expect(result.ownerFromProjection).toBe(0);
+    expect(result.erasedUnresolvable).toBe(0);
+
+    const events = await loadAggregate(testDb.db, s1, TENANT);
+    const created = events[0]?.payload as Record<string, unknown>;
+    expect(isPiiCiphertext(created["answer"])).toBe(true);
+    // Exact prefix, not just "contains": the entity segment must be the
+    // registry name forget-subject resolves ("survey"), not the table name
+    // or a divergent aggregate_type — a wrong segment here would make the
+    // ciphertext unreachable by record-forget (fw#2790).
+    expect(String(created["answer"])).toStartWith(`${PII_CIPHERTEXT_PREFIX}record:survey:${s1}:`);
+    expect(String(created["answer"])).not.toContain(`user:${s1}`);
+  });
+
+  test("encrypts changes+previous on an update the same way", async () => {
+    const s2 = generateId();
+    await appendPlain(s2, "survey", "survey.created", { id: s2, answer: "first" });
+    await appendPlain(
+      s2,
+      "survey",
+      "survey.updated",
+      { changes: { answer: "second" }, previous: { id: s2, answer: "first" } },
+      1,
+    );
+
+    armKms();
+    const result = await backfillEventPiiEncryption(testDb.db, registry);
+    expect(result.failures).toEqual([]);
+    expect(result.updatedEvents).toBe(2);
+
+    const events = await loadAggregate(testDb.db, s2, TENANT);
+    const updated = events[1]?.payload as {
+      changes: Record<string, unknown>;
+      previous: Record<string, unknown>;
+    };
+    expect(String(updated.changes["answer"])).toStartWith(
+      `${PII_CIPHERTEXT_PREFIX}record:survey:${s2}:`,
+    );
+    expect(String(updated.previous["answer"])).toStartWith(
+      `${PII_CIPHERTEXT_PREFIX}record:survey:${s2}:`,
+    );
+  });
+
+  test("a pre-KMS-forgotten row gets [[erased]], not a fresh record key", async () => {
+    const s3 = generateId();
+    await appendPlain(s3, "survey", "survey.created", { id: s3, answer: "secret" });
+    await appendPlain(
+      s3,
+      "survey",
+      "survey.forgotten",
+      { previous: { id: s3, answer: "secret" } },
+      1,
+    );
+
+    armKms();
+    const result = await backfillEventPiiEncryption(testDb.db, registry);
+
+    expect(result.failures).toEqual([]);
+    expect(result.erasedFields).toBe(2);
+    const events = await loadAggregate(testDb.db, s3, TENANT);
+    const created = events[0]?.payload as Record<string, unknown>;
+    expect(created["answer"]).toBe(PII_ERASED_SENTINEL);
+    const forgotten = events[1]?.payload as { previous: Record<string, unknown> };
+    expect(forgotten.previous["answer"]).toBe(PII_ERASED_SENTINEL);
+  });
+
+  test("idempotent: a second run touches nothing", async () => {
+    const s4 = generateId();
+    await appendPlain(s4, "survey", "survey.created", { id: s4, answer: "once" });
+
+    armKms();
+    const first = await backfillEventPiiEncryption(testDb.db, registry);
+    expect(first.updatedEvents).toBe(1);
+    const second = await backfillEventPiiEncryption(testDb.db, registry);
+    expect(second.updatedEvents).toBe(0);
+    expect(second.failures).toEqual([]);
+  });
+});
+
 describe("backfillEventPiiEncryption: raw jsonb column type (fw#2253)", () => {
   // The UPDATE used to wrap outcome.payload in JSON.stringify before handing
   // it to the ::jsonb cast — Bun.SQL already serializes objects, so the

package/src/event-store/__tests__/perf.integration.test.ts

@@ -13,7 +13,10 @@
 // are the ceiling.
 //
 // Runs isolated in the `event-store-perf` CI job (test:integration:perf:eventstore,
-// #1940) — gate on p95 for typical latency; p99 keeps a separate tail budget for checkpoint/fsync spikes.
+// #1940) — gate on p95 for typical latency; p99 keeps a separate tail budget for
+// residual scheduling noise. CI's Postgres container runs with fsync/synchronous_commit/
+// full_page_writes off (#2798) — it exists only to be measured and thrown away, so these
+// numbers aren't comparable to a default-config local container.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
@@ -98,12 +101,14 @@ describe("event-store performance — Gate A", () => {
     const p50 = percentile(samples, 0.5);
     const p95 = percentile(samples, 0.95);
     const p99 = percentile(samples, 0.99);
+    const over30 = samples.filter((s) => s >= 30).length;
+    const top5 = samples.slice(-5).map((s) => s.toFixed(1));
     console.log(
-      `  Write-latency: p50=${p50.toFixed(2)}ms, p95=${p95.toFixed(2)}ms, p99=${p99.toFixed(2)}ms (n=200)`,
+      `  Write-latency: p50=${p50.toFixed(2)}ms, p95=${p95.toFixed(2)}ms, p99=${p99.toFixed(2)}ms (n=200) over30=${over30} top5=${top5}`,
     );
 
     expect(p95).toBeLessThan(30);
-    // Tail budget: absorbs cold-checkpoint/fsync spikes (observed up to 102ms at p50=1.2ms) while still catching order-of-magnitude regressions.
+    // Tail budget: absorbs residual runner scheduling noise while still catching order-of-magnitude regressions.
     expect(p99).toBeLessThan(250);
   });