@cosmicdrift/kumiko-framework 0.306.0 → 0.308.0

package/src/engine/boot-validator/screens.ts

@@ -4,7 +4,10 @@
 // into validateColumnRendererForm, splitting them would create a
 // same-folder require cycle.
 
+import { resolveActionIcon } from "@cosmicdrift/kumiko-types/action-icon";
 import { NO_WIDGET_FIELD_TYPES } from "@cosmicdrift/kumiko-types/fields";
+import type { IconKey } from "@cosmicdrift/kumiko-types/nav-icon";
+import { NAV_ICON_KEYS } from "@cosmicdrift/kumiko-types/nav-icon";
 import { rowMetaFieldNames } from "../../db/table-builder";
 import { LIST_ROW_META_COLUMNS } from "../../ui-types/list-row-meta";
 import { parseRefTarget } from "../parse-ref-target";
@@ -319,6 +322,41 @@ function validateWizardLayout(
 // are NOT validated here — the r.uiComponent registry that would resolve
 // them ships in M4/M5. Until then those are kept opaque on purpose.
 
+// every action rendered in a Card title row (screen-level
+// `actions`, section-level `actions`, `emptyState.action`) must draw an
+// icon — declared or id-derived (resolveActionIcon, same resolver the
+// renderer uses). Uncovered here: entityList/projectionList rowActions —
+// those render inside a DataTable row, not a Card title row, so they keep
+// today's "icon optional" behavior.
+//
+// Registration check (not just "resolved is not undefined"): action.icon is
+// typed IconKey, a closed union — but that only protects call sites this
+// repo's own `tsc --build` actually covers (samples and external consumers
+// aren't in that project graph). The renderer's actionIconFor
+// (renderer-web/src/primitives/index.tsx) already falls back to "no icon"
+// for an unregistered key instead of crashing — this check makes the same
+// gap fail loudly at boot instead of silently at render.
+function isRegisteredIcon(icon: IconKey): boolean {
+  return (NAV_ICON_KEYS as readonly string[]).includes(icon);
+}
+
+export function validateActionHasIcon(
+  featureName: string,
+  screenId: string,
+  screenType: "projectionDetail" | "entityEdit",
+  context: string,
+  action: { readonly id: string; readonly icon?: IconKey },
+): void {
+  const resolved = resolveActionIcon(action.id, action.icon);
+  if (resolved === undefined || !isRegisteredIcon(resolved)) {
+    throw new Error(
+      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${context} "${action.id}" has no ` +
+        `resolvable icon — set icon to a key registered in NAV_ICONS, or use an id that resolves one of ` +
+        `its kebab segments via the default icon map (resolveActionIcon).`,
+    );
+  }
+}
+
 // Tier 2.7e-3: deklarative Feld-Referenzen einer Action gegen die Entity-
 // Felder pinnen — ein Tippfehler in pick/map-Quellfeldern oder
 // visible.field erzeugte sonst still `undefined` im Payload bzw. dauerhaft
@@ -1137,6 +1175,17 @@ export function validateScreens(
       }
       if (screen.layout.mode === "tabs") {
         validateTabSections(feature.name, screenId, "projectionDetail", screen.layout.sections);
+        for (const section of screen.layout.sections) {
+          const isFieldsSection = section.kind === undefined || section.kind === "fields";
+          if (isFieldsSection && section.groups !== undefined && section.actions !== undefined) {
+            throw new Error(
+              `[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.id}" ` +
+                `declares both groups and actions in tabs mode — actions has no single group's Card to sit ` +
+                `in, and an extra title-less Card around the group cards would nest a Card inside a Card. ` +
+                `Move the actions onto one group's title, or drop groups for a flat fields grid.`,
+            );
+          }
+        }
       }
       if (screen.metrics !== undefined) {
         for (const metric of screen.metrics) {
@@ -1166,6 +1215,27 @@ export function validateScreens(
         }
       }
       for (const section of screen.layout.sections) {
+        const sectionLabel = section.title ?? section.id ?? "(untitled)";
+        if (section.actions !== undefined) {
+          for (const action of section.actions) {
+            validateActionHasIcon(
+              feature.name,
+              screenId,
+              "projectionDetail",
+              `section "${sectionLabel}" action`,
+              action,
+            );
+          }
+        }
+        if (section.kind === "relatedList" && section.emptyState?.action !== undefined) {
+          validateActionHasIcon(
+            feature.name,
+            screenId,
+            "projectionDetail",
+            `section "${sectionLabel}" emptyState action`,
+            section.emptyState.action,
+          );
+        }
         if (isExtensionEditSection(section)) {
           // projectionDetail is read-only (no composed form submit) — an
           // extension that persists through the host's Save button has
@@ -1402,6 +1472,7 @@ export function validateScreens(
       // a detail screen has no row to click.
       if (screen.actions !== undefined) {
         for (const action of screen.actions) {
+          validateActionHasIcon(feature.name, screenId, "projectionDetail", "action", action);
           if (action.kind === "navigate" && action.rowClick === true) {
             throw new Error(
               `[Feature ${feature.name}] Screen "${qualifyEntityName(feature.name, "screen", screenId)}" ` +
@@ -1902,6 +1973,18 @@ export function validateScreens(
         );
       }
       for (const section of screen.layout.sections) {
+        if (section.actions !== undefined) {
+          const sectionLabel = section.title ?? section.id ?? "(untitled)";
+          for (const action of section.actions) {
+            validateActionHasIcon(
+              feature.name,
+              screenId,
+              "entityEdit",
+              `section "${sectionLabel}" action`,
+              action,
+            );
+          }
+        }
         if (isExtensionEditSection(section)) {
           if (section.component?.react === undefined && section.component?.native === undefined) {
             throw new Error(

package/src/engine/define-handler.ts

@@ -1,6 +1,7 @@
 import type { CursorResult } from "@cosmicdrift/kumiko-types/cursor-types";
 import { ENTITY_CONVENTION_QUERY_BRAND } from "@cosmicdrift/kumiko-types/handlers";
-import type { ZodType, z } from "zod";
+import type * as z from "zod";
+import type { ZodType } from "zod";
 import type { ContainsSecret } from "../secrets/types";
 import { runPipeline } from "./run-pipeline";
 import type { HandlerContext, KumikoEventTypeMap, WriteEvent, WriteResult } from "./types";

package/src/engine/entity-handlers.ts

@@ -1,5 +1,6 @@
 import { ENTITY_CONVENTION_QUERY_BRAND } from "@cosmicdrift/kumiko-types/handlers";
-import { type ZodType, z } from "zod";
+import type { ZodType } from "zod";
+import * as z from "zod";
 import type { DbRow } from "../db/connection";
 import {
   collectReferenceFields,

package/src/engine/feature-ast/__tests__/pattern-change-schema.test.ts

@@ -6,7 +6,7 @@
 import { describe, expect, test } from "bun:test";
 import { resolve } from "node:path";
 import { Project, type SourceFile } from "ts-morph";
-import type { z } from "zod";
+import type * as z from "zod";
 import { parseFeatureFile, parseSourceFile } from "../parse";
 import { applyChanges, type PatternId } from "../patch";
 import {

package/src/engine/feature-ast/pattern-change-schema.ts

@@ -22,7 +22,7 @@
 // additionally checked for field-type membership via the shared
 // `findUnknownEntityFieldTypes` helper (kept in sync with `extractEntity`).
 
-import { z } from "zod";
+import * as z from "zod";
 import { type LifecycleHookType, LifecycleHookTypes } from "../constants";
 import type {
   ConfigKeyDefinition,

package/src/engine/feature-builder-state.ts

@@ -1,4 +1,5 @@
-import type { ZodType, z } from "zod";
+import type * as z from "zod";
+import type { ZodType } from "zod";
 import { LifecycleHookTypes } from "./constants";
 import type {
   AuthClaimsFn,

package/src/engine/feature-config-events-jobs.ts

@@ -1,5 +1,6 @@
 import { normalizeEventPiiSubject } from "@cosmicdrift/kumiko-types/handlers";
-import { ZodObject, type ZodType, type z } from "zod";
+import type * as z from "zod";
+import { ZodObject, type ZodType } from "zod";
 import type { FeatureBuilderState } from "./feature-builder-state";
 import { resolveName } from "./handler-helpers";
 import { splitNamedDefinition, unwrapArrayForm } from "./object-form";

package/src/engine/feature-entity-handlers.ts

@@ -1,5 +1,6 @@
 import { ENTITY_CONVENTION_QUERY_BRAND } from "@cosmicdrift/kumiko-types/handlers";
-import type { ZodType, z } from "zod";
+import type * as z from "zod";
+import type { ZodType } from "zod";
 import { toTableName } from "../db/table-builder";
 import {
   isEntityConventionQueryHandler,

package/src/engine/schema-builder.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 import { moneyPayloadToMinorUnits } from "../db/money";
 import { isValidIanaTimeZone } from "../time";
 import { assertUnreachable } from "../utils";

package/src/entrypoint/__tests__/entrypoint-attach-dispatcher.integration.test.ts

@@ -10,7 +10,7 @@
 // throws the #2043 stub).
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient } from "../../db/query";
 import { createRegistry, defineFeature } from "../../engine";

package/src/entrypoint/__tests__/entrypoint-job-wiring.integration.test.ts

@@ -13,7 +13,7 @@
 // regressing to the Welle-2.5 state.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { createRegistry, defineFeature } from "../../engine";
 import { createArchivedStreamsTable } from "../../event-store";

package/src/entrypoint/__tests__/split-deploy.integration.test.ts

@@ -13,7 +13,7 @@
 //      fires with systemConsumers explicitly disabled).
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient } from "../../db/query";
 import { createRegistry, defineFeature } from "../../engine";

package/src/env/__tests__/compose-env-schema.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../../engine/define-feature";
 import {
   camelCase,

package/src/env/__tests__/dry-run.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../../engine/define-feature";
 import { prometheusMetricsEnvSchema } from "../../observability/metrics-wiring";
 import { renderDryRun } from "../dry-run";

package/src/env/__tests__/parse-env-dry-run.test.ts

@@ -2,7 +2,7 @@
 // undefined. parseEnvDryRun liefert stattdessen ein ehrliches Partial.
 
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { parseEnvDryRun } from "../index";
 
 const schema = z.object({

package/src/env/_zod-introspect.ts

@@ -6,7 +6,7 @@
 // All helpers accept the *runtime* Zod instance — TypeScript wrapper
 // (`z.ZodType`) and core (`$ZodType`) are the same object at runtime.
 
-import type { z } from "zod";
+import type * as z from "zod";
 
 export type ZodDef = {
   readonly innerType?: z.ZodType;

package/src/env/dry-run.ts

@@ -8,7 +8,7 @@
 // The same schema introspection (`classifyField`, `readKumikoMeta`) used
 // by parseEnv drives the output here — single source of truth.
 
-import type { z } from "zod";
+import type * as z from "zod";
 import { zodShape } from "./_zod-introspect";
 import {
   type ComposedEnvSchema,

package/src/env/index.ts

@@ -14,7 +14,7 @@
 // Without meta, defaults: `camelCase(envVarName)` for the Pulumi key,
 // `<set-me>` placeholder for the value, no `--secret` flag.
 
-import { z } from "zod";
+import * as z from "zod";
 import type { FeatureDefinition } from "../engine/types/feature";
 import { zodDef, zodDescription, zodMeta, zodShape, zodShapeField } from "./_zod-introspect";
 

package/src/errors/__tests__/classes.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import {
   AccessDeniedError,
   buildErrorLog,

package/src/es-ops/__tests__/runner.integration.test.ts

@@ -17,7 +17,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { z } from "zod";
+import * as z from "zod";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient, insertOne, selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";

package/src/event-store/__tests__/backfill-pii.integration.test.ts

@@ -12,7 +12,7 @@ import {
   resetBlindIndexKeyForTests,
   resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import {
   configureBlindIndexKey,
   configurePiiSubjectKms,

package/src/event-store/__tests__/event-attribution.integration.test.ts

@@ -14,12 +14,13 @@
 //      and stay readable without the new fields.
 
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
-import { UNATTRIBUTED_ORIGIN } from "@cosmicdrift/kumiko-types/event-store-types";
-import { z } from "zod";
+import { UNATTRIBUTED_ORIGIN, type WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
+import * as z from "zod";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";
 import { createEntity, createTextField, defineFeature } from "../../engine";
+import type { TenantId } from "../../engine/types";
 import {
   resetEventStore,
   setupTestStack,
@@ -43,8 +44,11 @@ const orderTable = buildEntityTable("attr-order", orderEntity);
 
 const PLACED = "attribution:event:placed";
 const CONFIRMED = "attribution:event:confirmed";
+const PROBED = "attribution:event:probed";
 const PLACE_HANDLER = "attribution:write:order:place";
+const PROBE_HANDLER = "attribution:write:order:probe";
 const CONFIRMER_MSP = "attribution:projection:confirmer";
+const TENANT_ID = "00000000-0000-4000-8000-000000000002" as TenantId;
 
 const attributionFeature = defineFeature("attribution", (r) => {
   r.entity("attr-order", orderEntity);
@@ -75,6 +79,26 @@ const attributionFeature = defineFeature("attribution", (r) => {
     { access: { roles: ["Admin"] } },
   );
 
+  const probed = r.defineEvent("probed", z.object({ orderId: z.uuid() }), { piiFields: "none" });
+
+  // Anonymous, no public-intake declared, no PII field written (nothing to gate).
+  r.writeHandler(
+    "order:probe",
+    z.object({ item: z.string() }),
+    async (event, ctx) => {
+      const created = await orderExecutor.create({ item: event.payload.item }, event.user, ctx.db);
+      if (!created.isSuccess) return created;
+      await ctx.unsafeAppendEvent({
+        aggregateId: String(created.data.id),
+        aggregateType: "attr-order",
+        type: probed.name,
+        payload: { orderId: String(created.data.id) },
+      });
+      return created;
+    },
+    { access: { roles: ["anonymous"] } },
+  );
+
   r.multiStreamProjection({
     name: "confirmer",
     apply: {
@@ -95,7 +119,11 @@ let stack: TestStack;
 const admin = TestUsers.admin;
 
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [attributionFeature], systemHooks: [] });
+  stack = await setupTestStack({
+    features: [attributionFeature],
+    systemHooks: [],
+    anonymousAccess: { defaultTenantId: TENANT_ID },
+  });
   await unsafeCreateEntityTable(stack.db, orderEntity, "attr-order");
 });
 
@@ -107,7 +135,7 @@ afterEach(async () => {
   await resetEventStore(stack, ["read_attribution_orders"]);
 });
 
-type Origin = { feature?: string; handler?: string };
+type Origin = { feature?: string; handler?: string; writeOrigin?: WriteOrigin };
 
 async function originOf(type: string): Promise<Origin> {
   const rows = await selectMany(stack.db, eventsTable);
@@ -165,6 +193,28 @@ describe("#3043 — event attribution from the execution scope", () => {
     });
   });
 
+  test("authenticated write: the event carries no writeOrigin at all", async () => {
+    await stack.http.writeOk(PLACE_HANDLER, { item: "cog" }, admin);
+
+    const origin = await originOf(PLACED);
+    expect(origin.writeOrigin).toBeUndefined();
+  });
+
+  test("anonymous non-intake write: the event is stamped with the gated origin", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: PROBE_HANDLER,
+      payload: { item: "washer" },
+    });
+    expect(res.status).toBe(200);
+
+    const origin = await originOf(PROBED);
+    expect(origin.writeOrigin).toMatchObject({
+      rootHandler: PROBE_HANDLER,
+      anonymousRoot: true,
+      publicIntake: false,
+    });
+  });
+
   test("appendRaw keeps historical metadata verbatim and stays readable", async () => {
     const aggregateId = uuid();
     await appendRaw(stack.db, {

package/src/event-store/__tests__/upcaster.integration.test.ts

@@ -9,7 +9,7 @@
 //      can never silently hand half-migrated data to consumers.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { integer as pgInteger, table as pgTable, text as pgText } from "../../db/dialect";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient, insertOne, selectMany } from "../../db/query";

package/src/event-store/admin-api.ts

@@ -9,6 +9,7 @@
 
 import type { DbRunner } from "../db";
 import { constraintOf, isUniqueViolation } from "../db/pg-error";
+import { claimXactId } from "../db/queries/event-store";
 import {
   eventPredecessorExists,
   findExistingEventVersion,
@@ -54,6 +55,9 @@ export async function appendRaw(runner: DbRunner, event: RawEventToAppend): Prom
   const eventVersion = event.eventVersion ?? 1;
 
   try {
+    // See db/queries/event-store.ts's claimXactId — gap-finality needs a
+    // real xact id assigned before this holder's insert.
+    await claimXactId(runner);
     if (event.expectedVersion === 0) {
       await insertRawFirst(runner, event, newVersion, eventVersion);
     } else {
@@ -145,6 +149,7 @@ export async function appendRawBatch(
   });
 
   try {
+    await claimXactId(runner);
     await insertRawEventBatch(runner, valuesClauses.join(", "), params);
   } catch (e) {
     if (isUniqueViolation(e)) {

package/src/event-store/event-store.ts

@@ -1,5 +1,6 @@
 import {
   type EventMetadata,
+  isPersonalDataGated,
   type StoredEvent,
   UNATTRIBUTED_ORIGIN,
 } from "@cosmicdrift/kumiko-types/event-store-types";
@@ -15,6 +16,7 @@ import { encryptEventPayloadPii } from "../crypto/event-pii";
 import type { DbRunner } from "../db";
 import { constraintOf, isUniqueViolation } from "../db/pg-error";
 import {
+  claimXactId,
   insertSubsequentEventRow,
   notifyPgChannel,
   selectAggregateMaxVersion,
@@ -93,14 +95,16 @@ export async function append(db: DbRunner, event: EventToAppend): Promise<Stored
   const eventVersion = toStore.eventVersion ?? 1;
 
   try {
+    await claimXactId(db);
+
     const row =
       toStore.expectedVersion === 0
         ? await insertFirstEvent(db, toStore, newVersion, eventVersion)
         : await insertSubsequentEvent(db, toStore, newVersion, eventVersion);
 
-    // NOTIFY fires on commit (PG buffers NOTIFY per TX), so subscribers never
-    // see a wake-up for an event that later rolled back. Harmless no-op when
-    // no LISTENer is attached.
+    // NOTIFY after the INSERT: outside a transaction each statement commits
+    // on its own, so a NOTIFY sent first would wake the dispatcher before
+    // the row exists.
     await notifyPgChannel(db, EVENTS_PUBSUB_CHANNEL);
 
     return buildStoredEvent(toStore, newVersion, eventVersion, row);
@@ -127,12 +131,15 @@ export async function append(db: DbRunner, event: EventToAppend): Promise<Stored
 // bypass this deliberately — they replay historical rows verbatim.
 function stampOrigin(event: EventToAppend): EventToAppend {
   const origin = requestContext.get();
+  const { writeOrigin: _droppedCallerWriteOrigin, ...restMetadata } = event.metadata;
   return {
     ...event,
     metadata: {
-      ...event.metadata,
+      ...restMetadata,
       feature: origin?.feature ?? UNATTRIBUTED_ORIGIN,
       handler: origin?.handler ?? UNATTRIBUTED_ORIGIN,
+      ...(origin?.writeOrigin &&
+        isPersonalDataGated(origin.writeOrigin) && { writeOrigin: origin.writeOrigin }),
     },
   };
 }
@@ -380,9 +387,11 @@ export async function loadAllEventsByType(
 
 // Stream every event for an aggregate_type across all tenants, batchwise
 // instead of buffered. Memory-bounded: never more than `batchSize` rows
-// resident. Cursor walks `events.id` (bigserial monotonic — concurrent
-// inserts get distinct ids in commit order, so no duplicates and no skips
-// past the cursor).
+// resident. Cursor walks `events.id` (bigserial monotonic, but ids are
+// assigned at INSERT time, not commit time — a sweep can overtake a still-
+// open transaction and its lower id, same gap the event-dispatcher's
+// pending_gaps tracks). Fine for this generator's use case: history sweeps
+// (projection-rebuild, tests) that don't need live, just-committed rows.
 //
 // Use case: projection-rebuild on a large event log (>100k events per
 // aggregate-type). loadAllEventsByType would OOM; this iterator yields

package/src/jobs/__tests__/job-backoff.integration.test.ts

@@ -10,7 +10,7 @@
 // so a >= assertion is flake-free without inflating waitFor's budget.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../../engine";
 import { setupTestStack, type TestStack, TestUsers } from "../../stack";
 import { waitFor } from "../../testing";

package/src/jobs/__tests__/job-event-trigger.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import type { Hono } from "hono";
-import { z } from "zod";
+import * as z from "zod";
 import { buildServer, type JwtHelper } from "../../api";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { createRegistry, defineFeature, type SessionUser } from "../../engine";

package/src/jobs/__tests__/job-multi-trigger.integration.test.ts

@@ -8,7 +8,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import type { Hono } from "hono";
-import { z } from "zod";
+import * as z from "zod";
 import { buildServer, type JwtHelper } from "../../api";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { createRegistry, defineFeature, type SessionUser } from "../../engine";