@cosmicdrift/kumiko-framework 0.307.0 → 0.308.0

package/src/api/sse-broker.ts

@@ -12,6 +12,26 @@ export type SseEvent = {
   data: Record<string, unknown>;
 };
 
+// What a publish invalidates. "user" is the broadest (and the historical
+// default — every scope narrower than this is an opt-in from a caller that
+// knows exactly which credential(s) it revoked).
+export type AccessInvalidationScope =
+  | { readonly kind: "user" }
+  | { readonly kind: "all-except-session"; readonly keptSessionId: string }
+  | { readonly kind: "sessions"; readonly sessionIds: readonly string[] }
+  | { readonly kind: "pat-tokens"; readonly tokenIds: readonly string[] };
+
+// What a stream's own listener is authenticated as — used to decide whether
+// a narrow scope (sessions/pat-tokens) applies to it. A listener with
+// neither field (should not normally happen — dispatch-stream.ts always
+// passes at least one) is treated as unidentifiable and closed by every
+// narrow scope, same fail-closed stance as a PAT stream facing a
+// sessions-scope.
+export type AccessInvalidationCredential = {
+  readonly sid?: string;
+  readonly patTokenId?: string;
+};
+
 export type SseBroker = {
   addClient(channel: string, send: (event: SseEvent) => void, close: () => void): string;
   removeClient(channel: string, clientId: string): void;
@@ -27,22 +47,37 @@ export type SseBroker = {
   subscribeAccessInvalidation(
     userId: string,
     onInvalidate: () => void,
-    ownSid?: string,
+    credential?: AccessInvalidationCredential,
   ): () => void;
-  // `keptSessionId` spares exactly one stream: the caller's own session on a
-  // "revoke all others" write. It is a keep-list, not a list of revoked
-  // sessions, so a stream of a session already revoked without an event
-  // (plain logout) still closes. Every other reason stays userwide.
-  publishAccessInvalidation(userId: string, keptSessionId?: string): void;
+  // `scope` narrows which credential(s) close; omitted = userwide (every
+  // listener), the historical default and still what unrelated
+  // reasons (role change, membership removal) use.
+  publishAccessInvalidation(userId: string, scope?: AccessInvalidationScope): void;
 };
 
-// Fail-closed: without a kept sid, or for a listener without its own sid
-// (PAT/bearer), nothing is spared.
-function isSparedByKeptSessionId(
-  ownSid: string | undefined,
-  keptSessionId: string | undefined,
+// Fail-closed: a narrow scope only spares/limits a listener it can positively
+// match against its own credential. A listener with neither sid nor
+// patTokenId of its own can't be matched by "sessions"/"pat-tokens", so it
+// closes — same reasoning "all-except-session" already used for a sidless
+// (PAT/bearer) listener.
+export function shouldInvalidateListener(
+  credential: AccessInvalidationCredential,
+  scope: AccessInvalidationScope,
 ): boolean {
-  return keptSessionId !== undefined && ownSid === keptSessionId;
+  switch (scope.kind) {
+    case "user":
+      return true;
+    case "all-except-session":
+      return credential.sid !== scope.keptSessionId;
+    case "sessions":
+      return credential.sid !== undefined
+        ? scope.sessionIds.includes(credential.sid)
+        : credential.patTokenId === undefined;
+    case "pat-tokens":
+      return credential.patTokenId !== undefined
+        ? scope.tokenIds.includes(credential.patTokenId)
+        : credential.sid === undefined;
+  }
 }
 
 export function createSseBroker(): SseBroker {
@@ -51,11 +86,14 @@ export function createSseBroker(): SseBroker {
   // makes pushToChannel/publishAccessInvalidation reach every replica's
   // clients — this reference implementation stays single-process only.
   const channels = new Map<string, Map<string, SseClient>>();
-  // Keyed by callback reference, value is the subscriber's own sid. Every
-  // subscriber must pass a distinct closure (dispatch-stream.ts does, one per
-  // stream). Two subscribes with the SAME reference for the same user
-  // collapse into one listener, and the first unsubscribe kills both.
-  const accessInvalidationListeners = new Map<string, Map<() => void, string | undefined>>();
+  // Keyed by callback reference, value is the subscriber's own credential.
+  // Every subscriber must pass a distinct closure (dispatch-stream.ts does,
+  // one per stream). Two subscribes with the SAME reference for the same
+  // user collapse into one listener, and the first unsubscribe kills both.
+  const accessInvalidationListeners = new Map<
+    string,
+    Map<() => void, AccessInvalidationCredential>
+  >();
 
   function getOrCreateChannel(channel: string): Map<string, SseClient> {
     let clients = channels.get(channel);
@@ -103,14 +141,14 @@ export function createSseBroker(): SseBroker {
       return total;
     },
 
-    subscribeAccessInvalidation(userId, onInvalidate, ownSid) {
+    subscribeAccessInvalidation(userId, onInvalidate, credential) {
       const channel = userAccessChannel(userId);
       let listeners = accessInvalidationListeners.get(channel);
       if (!listeners) {
         listeners = new Map();
         accessInvalidationListeners.set(channel, listeners);
       }
-      listeners.set(onInvalidate, ownSid);
+      listeners.set(onInvalidate, credential ?? {});
       return () => {
         const current = accessInvalidationListeners.get(channel);
         // skip: already unsubscribed (e.g. stream ended after a publish already fired)
@@ -120,15 +158,16 @@ export function createSseBroker(): SseBroker {
       };
     },
 
-    publishAccessInvalidation(userId, keptSessionId) {
+    publishAccessInvalidation(userId, scope) {
       const channel = userAccessChannel(userId);
       const listeners = accessInvalidationListeners.get(channel);
       // skip: no live stream is watching this user right now
       if (!listeners) return;
+      const resolvedScope: AccessInvalidationScope = scope ?? { kind: "user" };
       // Snapshot before iterating — a fired listener unsubscribes itself,
       // which would mutate `listeners` mid-iteration otherwise.
-      for (const [onInvalidate, ownSid] of [...listeners]) {
-        if (isSparedByKeptSessionId(ownSid, keptSessionId)) continue;
+      for (const [onInvalidate, credential] of [...listeners]) {
+        if (!shouldInvalidateListener(credential, resolvedScope)) continue;
         onInvalidate();
       }
     },

package/src/changes.json

@@ -1,4 +1,41 @@
 [
+  {
+    "version": "0.308.0",
+    "type": "fix",
+    "title": "startFrom \"now\" and MSP rebuild hand-off no longer lose out-of-order commits"
+  },
+  {
+    "version": "0.308.0",
+    "type": "fix",
+    "title": "Idle event-dispatcher passes no longer lock consumer rows or write WAL"
+  },
+  {
+    "version": "0.308.0",
+    "type": "breaking",
+    "title": "Boot validator rejects a projectionDetail screen/section/emptyState action with no resolvable icon (fw#3234)",
+    "migration": "Every screen.actions / section.actions / section.emptyState.action entry on a projectionDetail screen, and every section.actions entry on an entityEdit screen, must resolve an icon: either an explicit `icon` on the action, or an id the shared action-icon map (@cosmicdrift/kumiko-types resolveActionIcon) already derives from the full id or its last/first kebab segment. entityEdit's own screen-level `actions` are not checked (unchanged, out of scope for this rule). An action that fails this now fails boot instead of rendering without an icon; give it an explicit `icon` or rename it to an id the map covers."
+  },
+  {
+    "version": "0.308.0",
+    "type": "improvement",
+    "title": "EventConsumer.batchHandler — turn-level batching with per-event fallback, used by the search consumer"
+  },
+  {
+    "version": "0.308.0",
+    "type": "fix",
+    "title": "Meilisearch tenant indexes are configured automatically on first access"
+  },
+  {
+    "version": "0.308.0",
+    "type": "breaking",
+    "title": "Session and PAT revoke now close their own credential's open SSE stream, not just other reasons' userwide invalidations",
+    "migration": "An app-injected SseBroker implementation must update its subscribeAccessInvalidation/publishAccessInvalidation signatures: the third parameter of subscribeAccessInvalidation is now an AccessInvalidationCredential object (`{ sid?, patTokenId? }`) instead of a bare sid string, and the second parameter of publishAccessInvalidation is now an AccessInvalidationScope object (`{ kind: \"user\" } | { kind: \"all-except-session\"; keptSessionId } | { kind: \"sessions\"; sessionIds } | { kind: \"pat-tokens\"; tokenIds }`) instead of a bare keptSessionId string. Example: `subscribeAccessInvalidation(userId, cb, sid)` becomes `subscribeAccessInvalidation(userId, cb, { sid })`, and `publishAccessInvalidation(userId, keptSessionId)` becomes `publishAccessInvalidation(userId, { kind: \"all-except-session\", keptSessionId })`."
+  },
+  {
+    "version": "0.308.0",
+    "type": "fix",
+    "title": "zod namespace import lets client bundles tree-shake unused locales"
+  },
   {
     "version": "0.307.0",
     "type": "fix",

package/src/compliance/override-schema.ts

@@ -17,7 +17,7 @@
 // Schema — wer die overriden will, würde die Profile-Identitaet
 // zerstören.
 
-import { z } from "zod";
+import * as z from "zod";
 
 // DurationSpec: { days } | { hours } — strict bedeutet beide Forms
 // muessen exakt 1 property haben (kein "{ days: 30, hours: 1 }").

package/src/crypto/__tests__/event-pii.test.ts

@@ -5,7 +5,7 @@
 
 import { afterEach, describe, expect, test } from "bun:test";
 import { normalizeEventPiiSubject } from "@cosmicdrift/kumiko-types/handlers";
-import { z } from "zod";
+import * as z from "zod";
 import { createRegistry, defineFeature } from "../../engine";
 import type { TenantId } from "../../engine/types/identifiers";
 import {

package/src/crypto/kms-adapter.ts

@@ -3,7 +3,7 @@ import {
   type SubjectId,
   subjectIdToKey,
 } from "@cosmicdrift/kumiko-types/kms-adapter-types";
-import { z } from "zod";
+import * as z from "zod";
 import type { TenantId } from "../engine/types/identifiers";
 
 export * from "@cosmicdrift/kumiko-types/kms-adapter-types";

package/src/db/__tests__/tenant-db-where-merge.integration.test.ts

@@ -6,7 +6,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { updateRows } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { selectMany } from "../../bun-db";
 import {
   createEntity,

package/src/db/queries/event-consumer.ts

@@ -30,9 +30,60 @@ export async function lockEventConsumersShareMode(db: AnyDb): Promise<void> {
   await asRawClient(db).unsafe(`LOCK TABLE "kumiko_event_consumers" IN SHARE MODE`);
 }
 
+// The MAX(id) horizon plus every currently-open id gap below it, read from a
+// single snapshot (READ COMMITTED gives each statement its own). A gap can
+// only later fill in if some transaction holding a lower id was still
+// in-flight in that same snapshot — pg_snapshot_xip is empty otherwise, so
+// the gap CTEs short-circuit and the window scan over kumiko_events never
+// runs. Used both to seed startFrom "now" (#3231) and to seed an MSP
+// rebuild's handoff to the live dispatcher (msp-rebuild.ts).
+export async function selectEventIdHorizonWithMissingRanges(
+  db: AnyDb,
+): Promise<{ readonly horizon: bigint; readonly gaps: PendingGapEntry[] }> {
+  const rows = (await asRawClient(db).unsafe(
+    `WITH b AS (
+       SELECT COALESCE(MAX("id"), 0) AS horizon, MIN("id") AS min_id FROM "kumiko_events"
+     ),
+     r AS (
+       SELECT 1::bigint AS f, b.min_id - 1 AS t FROM b
+        WHERE b.min_id > 1 AND EXISTS (SELECT 1 FROM pg_snapshot_xip(pg_current_snapshot()))
+       UNION ALL
+       SELECT w."id" + 1, w.next_id - 1
+         FROM (SELECT "id", lead("id") OVER (ORDER BY "id") AS next_id FROM "kumiko_events") w
+        WHERE w.next_id > w."id" + 1 AND EXISTS (SELECT 1 FROM pg_snapshot_xip(pg_current_snapshot()))
+     )
+     SELECT b.horizon::text AS horizon,
+            pg_snapshot_xmax(pg_current_snapshot())::text AS xmax,
+            r.f::text AS gap_from,
+            r.t::text AS gap_to
+       FROM b LEFT JOIN r ON true
+      ORDER BY r.f`,
+  )) as ReadonlyArray<{
+    horizon: string;
+    xmax: string;
+    gap_from: string | null;
+    gap_to: string | null;
+  }>;
+  const first = rows[0];
+  if (first === undefined)
+    throw new Error("selectEventIdHorizonWithMissingRanges: no row returned");
+  const gaps: PendingGapEntry[] = [];
+  for (const row of rows) {
+    if (row.gap_from === null || row.gap_to === null) continue;
+    gaps.push({ from: row.gap_from, to: row.gap_to, xmax: row.xmax });
+  }
+  return { horizon: BigInt(first.horizon), gaps };
+}
+
 // startFrom "now" seeds the FIRST-registration cursor at the current
 // MAX(events.id) instead of the column default 0 — mounting a consumer into
-// an existing app then skips the historical log instead of replaying it.
+// an existing app then skips the historical log instead of replaying it. The
+// horizon and pending_gaps are read from one snapshot (selectEventIdHorizon
+// WithMissingRanges): a transaction holding a lower id can still be
+// in-flight at boot, and without seeding those gaps its event would commit
+// after the cursor already sits above it, so `id > cursor` would never
+// deliver it (#3231). The cheap existence check skips the scan entirely for
+// the (overwhelmingly common) case of an already-registered consumer.
 // ON CONFLICT DO NOTHING keeps both branches safe for an existing row: the
 // subquery only ever affects the row this statement inserts.
 export async function insertConsumerIfAbsent(
@@ -42,11 +93,18 @@ export async function insertConsumerIfAbsent(
   startFrom: "beginning" | "now" = "beginning",
 ): Promise<void> {
   if (startFrom === "now") {
+    const existing = (await asRawClient(db).unsafe(
+      `SELECT 1 FROM "kumiko_event_consumers" WHERE "name" = $1 AND "instance_id" = $2`,
+      [name, instanceId],
+    )) as ReadonlyArray<unknown>;
+    // skip: already registered — an existing cursor is never re-seeded.
+    if (existing.length > 0) return;
+    const { horizon, gaps } = await selectEventIdHorizonWithMissingRanges(db);
     await asRawClient(db).unsafe(
-      `INSERT INTO "kumiko_event_consumers" ("name", "instance_id", "status", "last_processed_event_id")
-       VALUES ($1, $2, 'idle', COALESCE((SELECT MAX("id") FROM "kumiko_events"), 0))
+      `INSERT INTO "kumiko_event_consumers" ("name", "instance_id", "status", "last_processed_event_id", "pending_gaps")
+       VALUES ($1, $2, 'idle', $3, $4::text::jsonb)
        ON CONFLICT ("name", "instance_id") DO NOTHING`,
-      [name, instanceId],
+      [name, instanceId, horizon, JSON.stringify(gaps)],
     );
   } else {
     await asRawClient(db).unsafe(
@@ -83,6 +141,37 @@ export async function deleteOrphanedPerInstanceConsumerRows(
   );
 }
 
+// Lock-free pre-check for doPass: which (name, instance_id) pairs are
+// provably idle — no locking, no xid, no WAL. A pair only qualifies when its
+// row exists, its status isn't dead (dead must still go through
+// acquireConsumerState for auto-rearm), it has no pending_gaps, and no event
+// exists past its cursor. Paired via unnest so the two positional arrays
+// zip element-wise into rows instead of a cartesian product.
+//
+// `deadStatus` is passed in rather than imported from event-consumer-state.ts
+// (which defines ConsumerStatuses) — that module already imports from this
+// one, so importing back would be a require cycle (same pattern as
+// deleteOrphanedPerInstanceConsumerRows above).
+export async function selectProvablyIdleConsumerPairs(
+  db: AnyDb,
+  names: readonly string[],
+  instanceIds: readonly string[],
+  deadStatus: string,
+): Promise<ReadonlyArray<{ readonly name: string; readonly instanceId: string }>> {
+  const rows = (await asRawClient(db).unsafe(
+    `SELECT c."name" AS name, c."instance_id" AS instance_id
+     FROM "kumiko_event_consumers" c
+     WHERE ("name", "instance_id") = ANY (SELECT * FROM unnest($1::text[], $2::text[]))
+       AND "status" != $3
+       AND "pending_gaps" = '[]'::jsonb
+       AND NOT EXISTS (
+         SELECT 1 FROM "kumiko_events" e WHERE e."id" > c."last_processed_event_id"
+       )`,
+    [names, instanceIds, deadStatus],
+  )) as ReadonlyArray<{ name: string; instance_id: string }>;
+  return rows.map((r) => ({ name: r.name, instanceId: r.instance_id }));
+}
+
 export async function selectConsumerForUpdateSkipLocked(
   db: AnyDb,
   name: string,
@@ -249,6 +338,7 @@ export async function updateConsumerRebuildCursor(
   name: string,
   instanceId: string,
   lastProcessedEventId: bigint,
+  pendingGaps: readonly PendingGapEntry[],
 ): Promise<void> {
   await asRawClient(db).unsafe(
     `UPDATE "kumiko_event_consumers" SET
@@ -256,9 +346,11 @@ export async function updateConsumerRebuildCursor(
        "status" = 'idle',
        "attempts" = 0,
        "last_error" = NULL,
+       -- text param + cast: a JS string bound straight to ::jsonb double-encodes under Bun.SQL
+       "pending_gaps" = $2::text::jsonb,
        "updated_at" = now()
-     WHERE "name" = $2 AND "instance_id" = $3`,
-    [lastProcessedEventId, name, instanceId],
+     WHERE "name" = $3 AND "instance_id" = $4`,
+    [lastProcessedEventId, JSON.stringify(pendingGaps), name, instanceId],
   );
 }
 

package/src/derivatives/__tests__/derivatives-context.integration.test.ts

@@ -6,7 +6,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import type { DerivativeRendererPlugin } from "@cosmicdrift/kumiko-types/derivatives-types";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature, EXT_DERIVATIVE_RENDERER } from "../../engine";
 import { InternalError, NotFoundError, writeFailure } from "../../errors";
 import { createFilesFeature } from "../../files/feature";

package/src/engine/__tests__/boot-validator-action-wiring.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";

package/src/engine/__tests__/boot-validator-dashboard.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { requiredKeysFromScreen } from "../../i18n/required-surface-keys";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator-nav-area.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator-pii-retention.test.ts

@@ -15,7 +15,7 @@
 // allowPlaintext-Marker unterdrückt Heuristik-Warnings.
 
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";
 import {

package/src/engine/__tests__/boot-validator-projection-list.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";

package/src/engine/__tests__/boot-validator-query-output-schema.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator-query-refs.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator-ref-entity.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
 import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator-s0-integration.test.ts

@@ -14,7 +14,7 @@
 //                        + handler-access mit ROLES.TenantAdmin
 
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { ROLES } from "../../auth";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/boot-validator.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, spyOn, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import type { SchemaTable } from "../../db/dialect";
 import { table, text } from "../../db/dialect";
 import { rowMetaFieldNames } from "../../db/table-builder";
@@ -4673,6 +4673,40 @@ describe("boot-validator", () => {
       );
     });
 
+    test("projectionDetail tabs-mode fields section with both groups and actions → throw", () => {
+      const feature = defineFeature("shop", (r) => {
+        r.screen({
+          id: "order-detail",
+          type: "projectionDetail",
+          query: "shop:query:order-detail",
+          layout: {
+            mode: "tabs",
+            sections: [
+              {
+                id: "billing",
+                title: "Billing",
+                fields: [],
+                groups: [{ title: "Amounts", fields: ["name"] }],
+                actions: [
+                  { kind: "navigate", id: "edit", label: "actions.edit", screen: "order-detail" },
+                ],
+              },
+              {
+                id: "positions",
+                kind: "relatedList",
+                title: "Positions",
+                query: "shop:query:order-positions",
+                columns: [{ field: "name" }],
+              },
+            ],
+          },
+        });
+      });
+      expect(() => validateBoot([feature])).toThrow(
+        /section "billing" declares both groups and actions in tabs mode/,
+      );
+    });
+
     test("projectionDetail relatedList defaultSort.field not a listed column → throw", () => {
       const feature = defineFeature("shop", (r) => {
         r.screen({

package/src/engine/__tests__/build-app-schema.test.ts

@@ -8,7 +8,7 @@
 //      im Browser-Bundle.
 
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { buildAppSchema, findNonJsonSafePath } from "../build-app-schema";
 import { defineFeature } from "../define-feature";
 import { createRegistry } from "../registry";

package/src/engine/__tests__/build-config-feature-schema-secrets.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { buildConfigFeatureSchema } from "../build-config-feature-schema";
 import { createTenantConfig } from "../config-helpers";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/define-feature-entity-mapping.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";
 

package/src/engine/__tests__/engine.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createTestUser } from "../../stack";
 import { rolesOf } from "../../testing/access-assertions";
 import { hasAccess } from "../access";

package/src/engine/__tests__/event-helpers.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, mock, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { emitEvent, typedPayload } from "../event-helpers";
 import type { EventDef } from "../types/handlers";
 

package/src/engine/__tests__/event-migration-declarative.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../define-feature";
 import type { DeclarativeEventMigration, EventUpcastCtx } from "../types";
 

package/src/engine/__tests__/extend-entity-projection.test.ts

@@ -3,7 +3,7 @@
 // custom-fields/__tests__/custom-fields.integration.test.ts.
 
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";
 import { createRegistry } from "../registry";

package/src/engine/__tests__/extends-registrar.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, mock, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { AccessDeniedError } from "../../errors";
 import { createGatedIdentitySwitch, type QueryAsFn } from "../../pipeline/system-identity-switch";
 import {

package/src/engine/__tests__/hook-phases.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createEntity, createRegistry, defineFeature, HookPhases } from "../index";
 import type { AppContext, PostSaveHookFn, SaveContext } from "../types";
 

package/src/engine/__tests__/lifecycle-hooks.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { createEntity, createRegistry, defineFeature } from "../index";
 import type { PostSaveHookFn, PreDeleteHookFn, PreSaveHookFn, SaveContext } from "../types";
 

package/src/engine/__tests__/pipeline-engine.test.ts

@@ -5,7 +5,7 @@
 
 import { describe, expect, it } from "bun:test";
 import { randomUUID } from "node:crypto";
-import { z } from "zod";
+import * as z from "zod";
 import { TestUsers } from "../../stack";
 import { defineWriteHandler } from "../define-handler";
 import { defineStep } from "../define-step";

package/src/engine/__tests__/pipeline-handler.integration.test.ts

@@ -44,7 +44,7 @@
 // surface against an empty ctx mock; this file is the real-stack gate.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { table, text, timestamp, uuid } from "../../db/dialect";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { asRawClient, selectMany } from "../../db/query";

package/src/engine/__tests__/pipeline-observability.integration.test.ts

@@ -14,7 +14,7 @@
 // and we wouldn't notice until a prod incident lacks the breadcrumbs.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { createRecordingProvider, type RecordingProvider } from "../../testing";
 import { defineFeature } from "../define-feature";

package/src/engine/__tests__/pipeline-performance.integration.test.ts

@@ -23,7 +23,7 @@
 // here with a longer-pipeline handler variant.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";

package/src/engine/__tests__/pipeline-sub-pipelines.test.ts

@@ -6,7 +6,7 @@
 // hygiene, error-propagation and build-time guards.
 
 import { describe, expect, it } from "bun:test";
-import { z } from "zod";
+import * as z from "zod";
 import { TestUsers } from "../../stack";
 import { defineWriteHandler } from "../define-handler";
 import { stepsPipeline } from "../pipeline";