@cosmicdrift/kumiko-framework 0.306.0 → 0.307.0

package/src/pipeline/pending-gap-ranges.ts

@@ -0,0 +1,72 @@
+import type { PendingIdRange } from "../db/queries/event-store";
+import type { PendingGapEntry } from "./event-consumer-state";
+
+export function toIdRanges(gaps: readonly PendingGapEntry[]): PendingIdRange[] {
+  return gaps.map((g) => ({ from: BigInt(g.from), to: BigInt(g.to) }));
+}
+
+export function rangeContainsId(range: PendingGapEntry, id: bigint): boolean {
+  return id >= BigInt(range.from) && id <= BigInt(range.to);
+}
+
+// A range is only provably burnt (rolled back, not just slow) once it's
+// certain the fetch would have surfaced any of its ids had they been
+// visible. LIMIT can cut a fetch off before reaching the range's ids —
+// `to < maxFetchedId` proves the scan passed the range regardless of the
+// cutoff, since ORDER BY id ASC LIMIT N always includes every matching id
+// below the largest one it did return.
+export function isRangeFullyCoveredByFetch(
+  range: PendingGapEntry,
+  truncated: boolean,
+  maxFetchedId: bigint | null,
+): boolean {
+  if (!truncated) return true;
+  if (maxFetchedId === null) return false;
+  return BigInt(range.to) < maxFetchedId;
+}
+
+// A gap is burnt when none of its ids showed up in this turn's fetch, the
+// fetch is proven to have covered it, and its recorded xmax is behind this
+// turn's xmin (every xact that could still produce a row has finished).
+export function partitionBurntGaps(
+  gaps: readonly PendingGapEntry[],
+  fetchedIds: readonly bigint[],
+  truncated: boolean,
+  xminNow: string,
+): { readonly burnt: PendingGapEntry[]; readonly surviving: PendingGapEntry[] } {
+  const maxFetchedId = fetchedIds.at(-1) ?? null;
+  const burnt: PendingGapEntry[] = [];
+  const surviving: PendingGapEntry[] = [];
+  for (const gap of gaps) {
+    const hasVisibleId = fetchedIds.some((id) => rangeContainsId(gap, id));
+    const isBurnt =
+      !hasVisibleId &&
+      isRangeFullyCoveredByFetch(gap, truncated, maxFetchedId) &&
+      BigInt(gap.xmax) <= BigInt(xminNow);
+    (isBurnt ? burnt : surviving).push(gap);
+  }
+  return { burnt, surviving };
+}
+
+// Carves `excludeIds` (delivered or skip-applied this turn) out of `range`,
+// yielding 0-2 sub-ranges. xmax is preserved on every surviving piece.
+export function splitRangeExcludingIds(
+  range: PendingGapEntry,
+  excludeIds: readonly bigint[],
+): PendingGapEntry[] {
+  const from = BigInt(range.from);
+  const to = BigInt(range.to);
+  const inRange = excludeIds
+    .filter((id) => id >= from && id <= to)
+    .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+  if (inRange.length === 0) return [range];
+  const parts: PendingGapEntry[] = [];
+  let cursor = from;
+  for (const id of inRange) {
+    if (id > cursor)
+      parts.push({ from: cursor.toString(), to: (id - 1n).toString(), xmax: range.xmax });
+    cursor = id + 1n;
+  }
+  if (cursor <= to) parts.push({ from: cursor.toString(), to: to.toString(), xmax: range.xmax });
+  return parts;
+}

package/src/pipeline/system-hooks.ts

@@ -490,6 +490,13 @@ function readUserIdFromPreviousSnapshot(payload: Record<string, unknown>): strin
   return typeof userId === "string" && userId.length > 0 ? userId : undefined;
 }
 
+// A "revoke all others" write must not cut the caller's own live stream, so
+// session-revoked carries the spared sid. Missing or malformed → userwide.
+function readSessionRevokedKeptSessionId(payload: Record<string, unknown>): string | undefined {
+  const keptSessionId = payload["keptSessionId"];
+  return typeof keptSessionId === "string" && keptSessionId.length > 0 ? keptSessionId : undefined;
+}
+
 export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): EventConsumer {
   return {
     name: ACCESS_INVALIDATION_CONSUMER_NAME,
@@ -511,7 +518,7 @@ export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): Eve
         // poison would otherwise permanently stop access-invalidation for
         // every user behind one bad row).
         if (typeof userId !== "string" || userId.length === 0) return;
-        sseBroker.publishAccessInvalidation(userId);
+        sseBroker.publishAccessInvalidation(userId, readSessionRevokedKeptSessionId(event.payload));
       }
 
       if (

package/src/pipeline/write-origin.ts

@@ -1,6 +1,8 @@
 // The static check in boot-validator/access-declarations.ts only sees a handler's own
 // input schema; writes reached via ctx.write/writeAs/queryAs, hooks or foreign-feature
 // tables are only visible at the actual write, so the gate runs there at runtime.
+import { isPersonalDataGated, type WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
+import { z } from "zod";
 import { buildEntityTable } from "../db/table-builder";
 import { type PersonalDataGate, tableNameOf } from "../db/tenant-db";
 import {
@@ -15,12 +17,29 @@ import { AccessDeniedError } from "../errors";
 import { FrameworkReasons } from "../errors/reasons";
 import { toSnakeCase } from "../utils/case";
 
-export type WriteOrigin = {
-  readonly rootHandler: string;
-  readonly anonymousRoot: boolean;
-  // Only a write-handler root can declare public-intake; a query/stream root never does.
-  readonly publicIntake: boolean;
-};
+export { isPersonalDataGated, type WriteOrigin };
+
+// Only narrows: an inherited origin can add a gate, never lift the root's.
+export function effectiveWriteOrigin(root: WriteOrigin, inherited?: WriteOrigin): WriteOrigin {
+  if (!inherited) return root;
+  if (isPersonalDataGated(root)) return root;
+  if (isPersonalDataGated(inherited)) return inherited;
+  return root;
+}
+
+const writeOriginSchema = z
+  .object({
+    rootHandler: z.string(),
+    anonymousRoot: z.boolean(),
+    publicIntake: z.boolean(),
+    viaJob: z.string().optional(),
+  })
+  .strict();
+
+export function parseWriteOrigin(value: unknown): WriteOrigin | undefined {
+  const parsed = writeOriginSchema.safeParse(value);
+  return parsed.success ? parsed.data : undefined;
+}
 
 function declaresPublicIntake(access: AccessRule): boolean {
   return accessAllowsAnonymous(access) && declaredPersonalData(access) === "public-intake";
@@ -67,7 +86,7 @@ function personalDataTableMap(registry: Registry): ReadonlyMap<string, ReadonlyS
 }
 
 // Names fields only, never values: the error reaches the anonymous HTTP caller.
-function publicIntakeRequiredError(
+export function publicIntakeRequiredError(
   origin: WriteOrigin,
   target: string,
   fields: readonly string[],
@@ -75,14 +94,16 @@ function publicIntakeRequiredError(
   return new AccessDeniedError({
     message:
       `Anonymous root handler "${origin.rootHandler}" wrote personal-data field(s) ` +
-      `${fields.map((f) => `"${f}"`).join(", ")} on "${target}". Declare ` +
-      'access: { roles: [..., "anonymous"], personalData: "public-intake" } on ' +
+      `${fields.map((f) => `"${f}"`).join(", ")} on "${target}"` +
+      (origin.viaJob ? ` via job "${origin.viaJob}"` : "") +
+      '. Declare access: { roles: [..., "anonymous"], personalData: "public-intake" } on ' +
       `"${origin.rootHandler}" to allow anonymous callers to write personal data.`,
     details: {
       reason: FrameworkReasons.publicIntakeRequired,
       rootHandler: origin.rootHandler,
       target,
       fields,
+      ...(origin.viaJob !== undefined && { job: origin.viaJob }),
     },
   });
 }
@@ -93,7 +114,7 @@ export function buildPersonalDataGate(
   registry: Registry,
   origin: WriteOrigin,
 ): PersonalDataGate | undefined {
-  if (!origin.anonymousRoot || origin.publicIntake) return undefined;
+  if (!isPersonalDataGated(origin)) return undefined;
   const map = personalDataTableMap(registry);
   return (tableName, keys, entity) => {
     const personalFields = entity ? personalColumnNames(entity) : map.get(tableName);

package/src/stack/test-stack.ts

@@ -470,7 +470,7 @@ export async function setupTestStack(options: TestStackOptions): Promise<TestSta
 
     // Pre-register consumer state rows so tests can call runOnce() directly
     // without a preceding explicit start(). Timer fires at pollIntervalMs=50
-    // but passInFlight serialises concurrent passes — tests that drain via
+    // but each consumer runs at most one turn at a time — tests that drain via
     // runOnce() remain deterministic. Tests that specifically exercise the
     // timer loop call start() again (idempotent) after setup.
     if (eventDispatcher) await eventDispatcher.ensureRegistered();