@cosmicdrift/kumiko-framework 0.294.0 → 0.294.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.294.0",
+  "version": "0.294.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,8 +198,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.294.0",
-    "@cosmicdrift/kumiko-types": "0.294.0",
+    "@cosmicdrift/kumiko-http": "0.294.1",
+    "@cosmicdrift/kumiko-types": "0.294.1",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -215,7 +215,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.294.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.294.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.294.1",
+    "type": "fix",
+    "title": "Fix parseEnv for refined env schemas with ciphertext-only Key Manager slots",
+    "detail": "Relaxing a `kms` slot that is present only as `<NAME>_CIPHERTEXT` used `schema.extend`, which Zod 4 rejects for object schemas carrying refinements (\"Cannot overwrite keys on object schemas containing refinements\"). An app whose composed env schema ends in `.superRefine(...)` therefore failed at boot as soon as its slots were delivered as ciphertext. The relaxation now uses `safeExtend`, which keeps the refinements running."
+  },
   {
     "version": "0.294.0",
     "type": "improvement",

package/src/env/__tests__/compose-env-schema.test.ts

@@ -334,6 +334,23 @@ describe("kms env slots", () => {
   it("parseEnv still validates a kms slot that is set", () => {
     expect(() => parseEnv(schema, { MASTER_KEY: "" })).toThrow(KumikoBootError);
   });
+
+  describe("schema carrying a refinement", () => {
+    const refined = schema.superRefine((value, ctx) => {
+      if (value.PLAIN === "forbidden") {
+        ctx.addIssue({ code: "custom", path: ["PLAIN"], message: "PLAIN is forbidden" });
+      }
+    });
+
+    it("parseEnv relaxes a ciphertext-only slot without dropping the refinement", () => {
+      expect(parseEnv(refined, { MASTER_KEY_CIPHERTEXT: "abc" })["MASTER_KEY_CIPHERTEXT"]).toBe(
+        "abc",
+      );
+      expect(() => parseEnv(refined, { MASTER_KEY_CIPHERTEXT: "abc", PLAIN: "forbidden" })).toThrow(
+        KumikoBootError,
+      );
+    });
+  });
 });
 
 describe("composeEnvSchema kms twins", () => {

package/src/env/index.ts

@@ -76,7 +76,8 @@ export function kmsSlotsOf(schema: z.ZodObject<z.ZodRawShape>): readonly string[
 
 // A ciphertext-only slot is satisfied by its `_CIPHERTEXT` twin: the plaintext
 // only exists after the boot-time decrypt, so requiring it here would reject
-// exactly the deployment this meta enables.
+// exactly the deployment this meta enables. safeExtend, not extend: Zod 4 throws
+// on extend for schemas carrying refinements (app-level superRefine).
 function relaxCiphertextOnlySlots<S extends z.ZodObject<z.ZodRawShape>>(
   schema: S,
   env: Readonly<Record<string, string>>,
@@ -88,7 +89,7 @@ function relaxCiphertextOnlySlots<S extends z.ZodObject<z.ZodRawShape>>(
     if (field && env[name] === undefined && env[`${name}_CIPHERTEXT`])
       relaxed[name] = field.optional();
   }
-  return Object.keys(relaxed).length === 0 ? schema : schema.extend(relaxed);
+  return Object.keys(relaxed).length === 0 ? schema : schema.safeExtend(relaxed);
 }
 
 // --- Field-classification helpers (Zod v4 introspection) ---