@cosmicdrift/kumiko-framework 0.306.0 → 0.308.0

package/src/db/tenant-db.ts

@@ -51,6 +51,41 @@ const declaredUnsafeRawRunners = new WeakMap<
 // (withUnsafeRawGrant, acknowledgeConventionCrossTenant) carry it too.
 const personalDataGates = new WeakMap<TenantDb, PersonalDataGate>();
 
+// Lets createTenantDb(ctx.db.unsafeRaw(reason), ...) inherit the gate. Keyed by a
+// per-grant proxy, never the shared pool/tx: tagging that would gate every sibling TenantDb.
+const runnerPersonalDataGates = new WeakMap<DbRunner, PersonalDataGate>();
+
+function gatedRunner(runner: DbRunner, gate: PersonalDataGate): DbRunner {
+  const proxy = new Proxy(runner as object, {
+    // Tagged-template calls need the real driver object as `this`.
+    apply(target, _thisArg, args) {
+      return Reflect.apply(target as (...callArgs: unknown[]) => unknown, target, args);
+    },
+    get(target, prop, _receiver) {
+      const value = Reflect.get(target, prop, target);
+      if (typeof value !== "function") return value;
+      if (prop === "begin" || prop === "savepoint") {
+        // createTenantDb(tx, ...) inside the callback must inherit the gate too.
+        return (...args: unknown[]) => {
+          const callback = args[args.length - 1];
+          if (typeof callback !== "function") {
+            return Reflect.apply(value, target, args);
+          }
+          const gatedArgs = [
+            ...args.slice(0, -1),
+            (tx: unknown) => callback(gatedRunner(tx as DbRunner, gate)),
+          ];
+          return Reflect.apply(value, target, gatedArgs);
+        };
+      }
+      return value.bind(target);
+    },
+    // @cast-boundary proxy-erasure — Proxy<object> re-tags as the wrapped DbRunner shape.
+  }) as DbRunner;
+  runnerPersonalDataGates.set(proxy, gate);
+  return proxy;
+}
+
 // The executor passes its entity so the check does not depend on the table-name lookup.
 export function assertPersonalDataWrite(
   db: TenantDb,
@@ -151,7 +186,9 @@ function buildUncheckedSystemDb(
       });
     }
     report("unsafe-raw", reason);
-    return tenantDbRunner(db);
+    const runner = tenantDbRunner(db);
+    const personalDataGate = personalDataGates.get(db);
+    return personalDataGate ? gatedRunner(runner, personalDataGate) : runner;
   }
 
   const uncheckedSystemDb: UncheckedSystemDb = {
@@ -352,6 +389,7 @@ export function createTenantDb(
 ): TenantDb {
   if (meter) registerStandardMetrics(meter);
   const report = grants?.report ?? fallbackEscapeHatchReporter(tenantId);
+  const personalDataGate = grants?.personalDataGate ?? runnerPersonalDataGates.get(db);
 
   function withDbSpan<T>(
     operation: "select" | "insert" | "update" | "delete",
@@ -452,9 +490,9 @@ export function createTenantDb(
     table: Table | EntityTableMeta,
     keys: readonly string[],
   ): AccessDeniedError | undefined {
-    if (!grants?.personalDataGate) return undefined;
+    if (!personalDataGate) return undefined;
     try {
-      grants.personalDataGate(tableNameOf(table), keys);
+      personalDataGate(tableNameOf(table), keys);
       return undefined;
     } catch (e) {
       if (e instanceof AccessDeniedError) return e;
@@ -553,7 +591,7 @@ export function createTenantDb(
       });
     }
     report("unsafe-raw", reason);
-    return db;
+    return personalDataGate ? gatedRunner(db, personalDataGate) : db;
   }
 
   const tenantDb: TenantDb = {
@@ -648,7 +686,7 @@ export function createTenantDb(
     return createTenantDb(db, tenantId, "system", tracer, meter, signal, grants);
   });
   bindTenantDbRunner(tenantDb, db);
-  if (grants?.personalDataGate) personalDataGates.set(tenantDb, grants.personalDataGate);
+  if (personalDataGate) personalDataGates.set(tenantDb, personalDataGate);
   return tenantDb;
 }
 

package/src/derivatives/__tests__/derivatives-context.integration.test.ts

@@ -6,7 +6,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import type { DerivativeRendererPlugin } from "@cosmicdrift/kumiko-types/derivatives-types";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature, EXT_DERIVATIVE_RENDERER } from "../../engine";
 import { InternalError, NotFoundError, writeFailure } from "../../errors";
 import { createFilesFeature } from "../../files/feature";

package/src/engine/__tests__/boot-validator-action-wiring.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";

package/src/engine/__tests__/boot-validator-dashboard.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { requiredKeysFromScreen } from "../../i18n/required-surface-keys";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator-nav-area.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator-pii-retention.test.ts

@@ -15,7 +15,7 @@
 // allowPlaintext-Marker unterdrückt Heuristik-Warnings.
 
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";
 import {

package/src/engine/__tests__/boot-validator-projection-list.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";

package/src/engine/__tests__/boot-validator-query-output-schema.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator-query-refs.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator-ref-entity.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator-s0-integration.test.ts

@@ -14,7 +14,7 @@
 //                        + handler-access mit ROLES.TenantAdmin
 
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { ROLES } from "../../auth";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, spyOn, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import type { SchemaTable } from "../../db/dialect";
 import { table, text } from "../../db/dialect";
 import { rowMetaFieldNames } from "../../db/table-builder";
@@ -4673,6 +4673,40 @@ describe("boot-validator", () => {
       );
     });
 
+    test("projectionDetail tabs-mode fields section with both groups and actions → throw", () => {
+      const feature = defineFeature("shop", (r) => {
+        r.screen({
+          id: "order-detail",
+          type: "projectionDetail",
+          query: "shop:query:order-detail",
+          layout: {
+            mode: "tabs",
+            sections: [
+              {
+                id: "billing",
+                title: "Billing",
+                fields: [],
+                groups: [{ title: "Amounts", fields: ["name"] }],
+                actions: [
+                  { kind: "navigate", id: "edit", label: "actions.edit", screen: "order-detail" },
+                ],
+              },
+              {
+                id: "positions",
+                kind: "relatedList",
+                title: "Positions",
+                query: "shop:query:order-positions",
+                columns: [{ field: "name" }],
+              },
+            ],
+          },
+        });
+      });
+      expect(() => validateBoot([feature])).toThrow(
+        /section "billing" declares both groups and actions in tabs mode/,
+      );
+    });
+
     test("projectionDetail relatedList defaultSort.field not a listed column → throw", () => {
       const feature = defineFeature("shop", (r) => {
         r.screen({

package/src/engine/__tests__/build-app-schema.test.ts

@@ -8,7 +8,7 @@
 //      im Browser-Bundle.
 
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { buildAppSchema, findNonJsonSafePath } from "../build-app-schema";
 import { defineFeature } from "../define-feature";
 import { createRegistry } from "../registry";

package/src/engine/__tests__/build-config-feature-schema-secrets.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { buildConfigFeatureSchema } from "../build-config-feature-schema";
 import { createTenantConfig } from "../config-helpers";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/define-feature-entity-mapping.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";
 

package/src/engine/__tests__/engine.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createTestUser } from "../../stack";
 import { rolesOf } from "../../testing/access-assertions";
 import { hasAccess } from "../access";

package/src/engine/__tests__/event-helpers.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, mock, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { emitEvent, typedPayload } from "../event-helpers";
 import type { EventDef } from "../types/handlers";
 

package/src/engine/__tests__/event-migration-declarative.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../define-feature";
 import type { DeclarativeEventMigration, EventUpcastCtx } from "../types";
 

package/src/engine/__tests__/extend-entity-projection.test.ts

@@ -3,7 +3,7 @@
 // custom-fields/__tests__/custom-fields.integration.test.ts.
 
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";
 import { createRegistry } from "../registry";

package/src/engine/__tests__/extends-registrar.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, mock, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { AccessDeniedError } from "../../errors";
 import { createGatedIdentitySwitch, type QueryAsFn } from "../../pipeline/system-identity-switch";
 import {

package/src/engine/__tests__/hook-phases.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createEntity, createRegistry, defineFeature, HookPhases } from "../index";
 import type { AppContext, PostSaveHookFn, SaveContext } from "../types";
 

package/src/engine/__tests__/lifecycle-hooks.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createEntity, createRegistry, defineFeature } from "../index";
 import type { PostSaveHookFn, PreDeleteHookFn, PreSaveHookFn, SaveContext } from "../types";
 

package/src/engine/__tests__/pipeline-engine.test.ts

@@ -5,7 +5,7 @@
 
 import { describe, expect, it } from "bun:test";
 import { randomUUID } from "node:crypto";
-import { z } from "zod";
+import * as z from "zod";
 import { TestUsers } from "../../stack";
 import { defineWriteHandler } from "../define-handler";
 import { defineStep } from "../define-step";

package/src/engine/__tests__/pipeline-handler.integration.test.ts

@@ -44,7 +44,7 @@
 // surface against an empty ctx mock; this file is the real-stack gate.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { table, text, timestamp, uuid } from "../../db/dialect";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient, selectMany } from "../../db/query";

package/src/engine/__tests__/pipeline-observability.integration.test.ts

@@ -14,7 +14,7 @@
 // and we wouldn't notice until a prod incident lacks the breadcrumbs.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { createRecordingProvider, type RecordingProvider } from "../../testing";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/pipeline-performance.integration.test.ts

@@ -23,7 +23,7 @@
 // here with a longer-pipeline handler variant.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";

package/src/engine/__tests__/pipeline-sub-pipelines.test.ts

@@ -6,7 +6,7 @@
 // hygiene, error-propagation and build-time guards.
 
 import { describe, expect, it } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { TestUsers } from "../../stack";
 import { defineWriteHandler } from "../define-handler";
 import { stepsPipeline } from "../pipeline";

package/src/engine/__tests__/post-query-hook.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createEntity, createRegistry, defineFeature } from "../index";
 import type { AppContext, PostQueryHookFn } from "../types";
 

package/src/engine/__tests__/projection-detail-actions.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/projection-detail-singleton.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/projection-detail-tabs.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/read-steps-tenant-filter.integration.test.ts

@@ -8,7 +8,7 @@
 // escape-hatch-audit.integration.test.ts.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { table, text, uuid } from "../../db/dialect";
 import { insertOne } from "../../db/query";
 import { defineFeature, defineWriteHandler } from "../../engine";

package/src/engine/__tests__/registry.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createTenantConfig } from "../config-helpers";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";

package/src/engine/__tests__/screen.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { createTenantConfig } from "../config-helpers";

package/src/engine/__tests__/validate-projection-allowlist.test.ts

@@ -5,7 +5,7 @@
 
 import { describe, expect, it } from "bun:test";
 import { randomUUID } from "node:crypto";
-import { z } from "zod";
+import * as z from "zod";
 import { table as pgTable, text, uuid } from "../../db/dialect";
 import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";

package/src/engine/boot-validator/__tests__/access-declarations.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../../define-feature";
 import { createEntity, createTextField } from "../../factories";
 import { from } from "../../ownership";

package/src/engine/boot-validator/__tests__/action-icon.test.ts

@@ -0,0 +1,81 @@
+// validateActionHasIcon is the single icon-resolvability check shared by
+// every projectionDetail/entityEdit action rendered in a Card title row:
+// screen-level `actions`, section-level `actions`, and relatedList
+// `emptyState.action` (see screens.ts call sites). Tested directly here
+// rather than only via a full feature boot, since all three call sites
+// share this one function.
+
+import { describe, expect, test } from "bun:test";
+import { validateActionHasIcon } from "../screens";
+
+describe("validateActionHasIcon", () => {
+  test("rejects a screen-level action with no declared icon and an id that resolves none", () => {
+    expect(() =>
+      validateActionHasIcon("orders", "order-detail", "projectionDetail", "action", {
+        id: "custom-thing",
+      }),
+    ).toThrow(/no resolvable icon/);
+  });
+
+  test("rejects a section action, naming the section in the error", () => {
+    expect(() =>
+      validateActionHasIcon(
+        "orders",
+        "order-detail",
+        "projectionDetail",
+        'section "Payments" action',
+        { id: "custom-thing" },
+      ),
+    ).toThrow(/section "Payments" action "custom-thing" has no resolvable icon/);
+  });
+
+  test("rejects a relatedList emptyState action, naming it as such in the error", () => {
+    expect(() =>
+      validateActionHasIcon(
+        "orders",
+        "order-detail",
+        "projectionDetail",
+        'section "Payments" emptyState action',
+        { id: "custom-thing" },
+      ),
+    ).toThrow(/emptyState action "custom-thing" has no resolvable icon/);
+  });
+
+  test("passes when the action declares an explicit icon", () => {
+    expect(() =>
+      validateActionHasIcon("orders", "order-detail", "entityEdit", "action", {
+        id: "custom-thing",
+        icon: "lock",
+      }),
+    ).not.toThrow();
+  });
+
+  test("passes when the id resolves a default icon via a kebab segment (no explicit icon needed)", () => {
+    // "deletion" -> "trash" in the shared ACTION_ICON_BY_ID map.
+    expect(() =>
+      validateActionHasIcon("user-data-rights", "privacy-center", "projectionDetail", "action", {
+        id: "request-deletion",
+      }),
+    ).not.toThrow();
+  });
+
+  // action.icon is typed IconKey (a closed union) — but that compile-time
+  // guarantee only covers call sites inside this repo's `tsc --build`
+  // project graph. Samples and external consumers aren't in it, so an
+  // unregistered literal (a typo, or a value copied from a different icon
+  // set) can reach here as plain runtime data. The renderer's actionIconFor
+  // (renderer-web/src/primitives/index.tsx) already falls back to "no icon"
+  // for such a value instead of crashing — this must throw here instead of
+  // silently accepting it, or the renderer/validator resolvers diverge.
+  test("rejects a declared icon that is not a registered NAV_ICON key, even though it resolves to a value", () => {
+    expect(() =>
+      validateActionHasIcon("orders", "order-detail", "projectionDetail", "action", {
+        id: "refresh-order",
+        // @ts-expect-error — exercising a value outside the closed IconKey
+        // union, exactly like an untypechecked caller (a sample, or a JS
+        // consumer) would produce at runtime.
+        icon: "refresh-cw",
+      }),
+    ).toThrow(/no resolvable icon/);
+  });
+});

package/src/engine/boot-validator/__tests__/anonymous-rate-limit-required.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../../define-feature";
 import { validateHandlerAccess } from "../entity-handler";
 

package/src/engine/boot-validator/__tests__/no-all-role-in-handler-access.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../../define-feature";
 import { validateHandlerAccess } from "../entity-handler";
 

package/src/engine/boot-validator/__tests__/parent-ref.test.ts

@@ -5,7 +5,7 @@
 // handler on a parentRef entity must fail boot rather than leak silently.
 
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../../define-feature";
 import { defineEntityDetailHandler, defineEntityListHandler } from "../../entity-handlers";
 import { createEntity, createTextField } from "../../factories";

package/src/engine/boot-validator/__tests__/rate-limit-disabled-reason.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../../define-feature";
 import { validateHandlerAccess } from "../entity-handler";