@cosmicdrift/kumiko-framework 0.334.0 → 0.336.0

package/dist/api/anonymous-live-entities.d.ts

@@ -0,0 +1,2 @@
+import type { Registry } from "../engine/types/index.js";
+export declare function collectAnonymousLiveEntities(registry: Registry): ReadonlySet<string>;

package/dist/api/anonymous-live-entities.js

@@ -0,0 +1,17 @@
+import { hasAccess } from "../engine/access.js";
+import { ANONYMOUS_ROLE } from "../engine/system-user.js";
+const ANONYMOUS_PRINCIPAL = { roles: [ANONYMOUS_ROLE] };
+// Entities an anonymous /api/sse connection may receive change signals for:
+// only those an anonymously callable query declares via liveEntities. No
+// inference from the query name, because a signal carries the id of every
+// row of the entity, including rows that query filters out (drafts).
+export function collectAnonymousLiveEntities(registry) {
+    const entities = new Set();
+    for (const handler of registry.getAllQueryHandlers().values()) {
+        if (!hasAccess(ANONYMOUS_PRINCIPAL, handler.access))
+            continue;
+        for (const entityName of handler.liveEntities ?? [])
+            entities.add(entityName);
+    }
+    return entities;
+}

package/dist/api/auth-routes.js

@@ -866,7 +866,12 @@ export function createAuthRoutes(dispatcher, jwt, config) {
     api.post(Routes.authSwitchTenant, async (c) => {
         const user = getUser(c);
         const body = await c.req.json();
-        const targetTenantId = body.tenantId;
+        // The id seeds a SYSTEM identity in resolveActiveMembership — reject anything
+        // that is not a non-empty string before it gets that far.
+        if (!isNonEmptyString(body.tenantId)) {
+            return c.json({ error: "invalid_tenant" }, 400);
+        }
+        const targetTenantId = body.tenantId; // @cast-boundary request-body
         if (targetTenantId === user.tenantId) {
             return c.json({ error: "already_in_tenant" }, 400);
         }
@@ -929,8 +934,7 @@ export function createAuthRoutes(dispatcher, jwt, config) {
             tenantId: targetTenantId,
             roles: mergedRoles,
             // Tenant-independent prefs must survive the switch (fw#2343).
-            ...(user.timezone ? { timezone: user.timezone } : {}),
-            ...(user.locale ? { locale: user.locale } : {}),
+            ...tenantIndependentPrefs(user),
         };
         const claims = await dispatcher.resolveAuthClaims(targetSession);
         const sessionForJwt = Object.keys(claims).length > 0 ? { ...targetSession, claims } : targetSession;
@@ -959,6 +963,15 @@ export function createAuthRoutes(dispatcher, jwt, config) {
 // validates the token + does the state change → typed failure or 200. Keeping
 // the silent-success invariant in one place means changing how the framework
 // handles "invalid_body" on a public token endpoint is one edit, not three.
+function tenantIndependentPrefs(user) {
+    return {
+        ...(user.timezone ? { timezone: user.timezone } : {}),
+        ...(user.locale ? { locale: user.locale } : {}),
+    };
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
 function registerTokenRequestRoute(opts) {
     const body = opts.schema ?? RequestTokenBody;
     opts.api.post(opts.path, async (c) => {
@@ -974,7 +987,9 @@ function registerTokenRequestRoute(opts) {
         // they are logged — otherwise the mail silently never goes out. No email in
         // the log line (PII).
         const result = await opts.dispatcher.write(opts.requestHandler, parsed.data, createAnonymousUser(SYSTEM_TENANT_ID));
-        if (!result.isSuccess) {
+        // rate_limited is an expected, attacker-triggerable outcome; logging it
+        // would flood the sink and bury real misconfiguration errors.
+        if (!result.isSuccess && result.error.code !== "rate_limited") {
             console.error(`[kumiko] token request handler "${opts.requestHandler}" failed: ${result.error.code}`);
         }
         return c.json({ isSuccess: true });

package/dist/api/client-ip.js

@@ -50,16 +50,13 @@ export const TRUSTED_PROXY_HOPS_ENV = "KUMIKO_TRUSTED_PROXY_HOPS";
 // worse than staying on the default. Digits-only (not parseInt) —
 // parseInt("0x10")/("1e3")/("2x") would silently coerce instead of failing.
 export function parseTrustedProxyHopsEnv(raw, context) {
-    if (raw === undefined)
+    // Empty string = unset, matching readEnv's normalization (e.g. a blank .env template line).
+    if (raw === undefined || raw === "")
         return undefined;
     if (!/^\d+$/.test(raw)) {
         throw new Error(`${context}: ${TRUSTED_PROXY_HOPS_ENV} must be a non-negative integer, got "${raw}".`);
     }
-    const parsed = Number.parseInt(raw, 10);
-    if (!Number.isInteger(parsed) || parsed < 0) {
-        throw new Error(`${context}: ${TRUSTED_PROXY_HOPS_ENV} must be a non-negative integer, got "${raw}".`);
-    }
-    return parsed;
+    return Number(raw);
 }
 // Instance-scoped, NOT a module singleton: the warn-once flag must reset
 // per server boot (and per test), otherwise the first test to trigger it

package/dist/api/extra-route.js

@@ -39,8 +39,9 @@ export class ExtraRouteRejection extends Error {
             if (status !== 503) {
                 throw new RangeError("ExtraRouteRejection: retryAfterSeconds is only valid with status 503");
             }
-            if (!Number.isInteger(retryAfterSeconds) || retryAfterSeconds < 0) {
-                throw new RangeError("ExtraRouteRejection: retryAfterSeconds must be a non-negative integer");
+            // isSafeInteger, not isInteger: String(1e21) is "1e+21", not 1*DIGIT.
+            if (!Number.isSafeInteger(retryAfterSeconds) || retryAfterSeconds < 0) {
+                throw new RangeError("ExtraRouteRejection: retryAfterSeconds must be a non-negative safe integer");
             }
         }
         this.retryAfterSeconds = retryAfterSeconds;

package/dist/api/index.d.ts

@@ -1,5 +1,6 @@
 export type { SetTenantCookieOptions } from "./anonymous-cookie.js";
 export { deleteTenantCookie, setTenantCookie } from "./anonymous-cookie.js";
+export { collectAnonymousLiveEntities } from "./anonymous-live-entities.js";
 export { LOCALE_HEADER_NAME, NO_ROUTE_MATCH_HEADER_NAME } from "./api-constants.js";
 export type { AnonymousAccessConfig, AnonymousAccessResolved, AuthMiddlewareOptions, AuthSessionChecker, AuthSessionCheckResult, AuthSessionStatus, TenantExists, TenantLifecycleStatusResolver, TenantResolver, TokenVerifier, } from "./auth-middleware.js";
 export { AUTH_COOKIE_NAME, authMiddleware, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.js";
@@ -26,7 +27,7 @@ export type { KumikoServer, ServerOptions } from "./server.js";
 export { buildServer, makeDispatchSystemQuery, makeDispatchSystemWrite } from "./server.js";
 export type { SseBroker, SseClient, SseEvent } from "./sse-broker.js";
 export { createSseBroker } from "./sse-broker.js";
-export { createSseRoute, SSE_HEARTBEAT_INTERVAL_MS } from "./sse-route.js";
+export { createSseRoute, SSE_HEARTBEAT_INTERVAL_MS, type SseRouteOptions } from "./sse-route.js";
 export { generateToken } from "./tokens.js";
 export type { KumikoServeEnv, KumikoServerWebSocket, KumikoWebSocketData, WebSocketUpgradeServer, } from "./websocket-route.js";
 export { createKumikoWebSocketHandler, isWebSocketUpgradeRequest, kumikoWebSocketHandler, WEBSOCKET_BACKPRESSURE_LIMIT_BYTES, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_HEARTBEAT_INTERVAL_MS, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_PENDING_BUFFER_LIMIT_BYTES, WEBSOCKET_REVALIDATION_FAILURE_LIMIT, WEBSOCKET_ROUTE_PATH_PREFIX, } from "./websocket-route.js";

package/dist/api/index.js

@@ -1,4 +1,5 @@
 export { deleteTenantCookie, setTenantCookie } from "./anonymous-cookie.js";
+export { collectAnonymousLiveEntities } from "./anonymous-live-entities.js";
 export { LOCALE_HEADER_NAME, NO_ROUTE_MATCH_HEADER_NAME } from "./api-constants.js";
 export { AUTH_COOKIE_NAME, authMiddleware, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.js";
 export { createAuthRoutes, createInMemoryLoginRateLimiter, createRedisLoginRateLimiter, } from "./auth-routes.js";

package/dist/api/pii-leak-guard.js

@@ -2,8 +2,11 @@ import { PII_CIPHERTEXT_PREFIX } from "../crypto/index.js";
 const isProductionEnv = () => process.env["NODE_ENV"] === "production";
 // Version-agnostic: catches both the current PII_CIPHERTEXT_PREFIX and any
 // older/decrypt-only format version still present in unmigrated rows.
-const CIPHERTEXT_MARKER = "kumiko-pii:v";
-const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^"\s<>\\]*/g;
+// Bound to the full ciphertext shape (prefix, "<kind>:<id>" subject key, base64
+// blob of at least IV + GCM tag = 28 bytes) so a user-typed "kumiko-pii:v" in a
+// note or name field cannot turn every read of that record into a 500.
+const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^:"\s<>\\]+:[^:"\s<>\\]+:[A-Za-z0-9+/=]{40,}/;
+const CIPHERTEXT_REDACT_RE = new RegExp(CIPHERTEXT_RE.source, "g");
 // A PII subject ciphertext never belongs in an API response — its presence
 // means a raw DB read (fetchOne/selectMany) leaked to the surface. Dev/test
 // fail loud (500) so a forgotten decrypt turns the first integration test
@@ -19,7 +22,7 @@ export function piiCiphertextResponseGuard() {
             return;
         const text = await c.res.clone().text();
         // skip: clean response — the common case
-        if (!text.includes(CIPHERTEXT_MARKER))
+        if (!CIPHERTEXT_RE.test(text))
             return;
         const detail = `[api] JSON response for ${c.req.method} ${c.req.path} contains a PII ciphertext ` +
             `("${PII_CIPHERTEXT_PREFIX}…") — a raw DB read leaked to the API surface. ` +
@@ -32,7 +35,7 @@ export function piiCiphertextResponseGuard() {
         console.error(detail);
         const headers = new Headers(c.res.headers);
         headers.delete("content-length");
-        c.res = new Response(text.replace(CIPHERTEXT_RE, "[pii-redacted]"), {
+        c.res = new Response(text.replace(CIPHERTEXT_REDACT_RE, "[pii-redacted]"), {
             status: c.res.status,
             headers,
         });

package/dist/api/redis-sse-broker.d.ts

@@ -1,6 +1,8 @@
+import { type RedisClientOptions } from "../redis/client.js";
 import { type SseBroker } from "./sse-broker.js";
 export type RedisSseBrokerOptions = {
     readonly redisUrl: string;
+    readonly clientOptions?: RedisClientOptions;
 };
 export type RedisSseBroker = SseBroker & {
     close(): Promise<void>;

package/dist/api/redis-sse-broker.js

@@ -1,5 +1,6 @@
+import { redisClientOptionsFromEnv } from "../redis/client.js";
 import { createRedisPubSubSignal } from "../redis/pubsub-signal.js";
-import { createSseBroker } from "./sse-broker.js";
+import { createSseBroker, readNonEmptyStringArray, } from "./sse-broker.js";
 // Channel namespace for cross-replica fanout (fw#2625). Every pod publishes
 // here and every pod's psubscribe listens here, so a push on one instance
 // reaches SSE clients connected to any other instance without a shared
@@ -26,7 +27,9 @@ export function isRedisSseBroker(broker) {
 // buildServer, so its own REDIS_URL-based default never ran.
 export function createDefaultSseBroker(env = process.env) {
     const redisUrl = env["REDIS_URL"];
-    const ownedRedisSseBroker = redisUrl ? createRedisSseBroker({ redisUrl }) : undefined;
+    const ownedRedisSseBroker = redisUrl
+        ? createRedisSseBroker({ redisUrl, clientOptions: redisClientOptionsFromEnv(env) })
+        : undefined;
     return { sseBroker: ownedRedisSseBroker ?? createSseBroker(), ownedRedisSseBroker };
 }
 function isSseEvent(value) {
@@ -71,11 +74,6 @@ function parseInvalidationScope(payload) {
     }
     return { kind: "user" };
 }
-function readNonEmptyStringArray(value) {
-    if (!Array.isArray(value) || value.length === 0)
-        return undefined;
-    return value.every((v) => typeof v === "string") ? value : undefined;
-}
 // Mirror of parseInvalidationScope's wire shapes. "sessions"/"pat-tokens"
 // deliberately never include a `keptSessionId` key — see the parser comment.
 function encodeInvalidationScope(scope) {
@@ -100,6 +98,7 @@ export function createRedisSseBroker(opts) {
         redisUrl: opts.redisUrl,
         channelPattern: PSUBSCRIBE_PATTERN,
         label: "sse-broker",
+        ...(opts.clientOptions ? { clientOptions: opts.clientOptions } : {}),
     });
     signal.onMessage((channel, payload) => {
         if (channel.startsWith(CHANNEL_PREFIX)) {

package/dist/api/routes.js

@@ -292,26 +292,33 @@ const FAULT_LOG_SILENCED_LEVELS = new Set(["error", "fatal", "silent"]);
 // `type` is client-supplied on an unknown-handler 404, so cap it before it
 // reaches the log — an unbounded field would let a caller flood the sink.
 const MAX_LOGGED_TYPE_LENGTH = 120;
+// The body's `type` is only typed as string — a client can send an object, and
+// a throw from inside the fault logger would turn a clean 4xx into a 500.
+function loggableType(type) {
+    return typeof type === "string" ? type.slice(0, MAX_LOGGED_TYPE_LENGTH) : undefined;
+}
 function clientFaultLoggingEnabled() {
     return !FAULT_LOG_SILENCED_LEVELS.has(process.env["LOG_LEVEL"] ?? "");
 }
 // A failing request must leave a trace even when it ends in 4xx — a paid
 // external call that 422s was invisible before (offlot#117). Status, error
 // code and duration only: message/details/stack can carry submitted values.
-function logClientFault(err, requestId, type) {
+function logClientWarn(message, requestId, type, fields) {
     if (!clientFaultLoggingEnabled()) {
         // skip: LOG_LEVEL silences the 4xx tier — the deployment opted out of client-fault volume
         return;
     }
     const startedAt = requestContext.get()?.startedAt;
-    createFallbackLogger("api").warn("handler rejected", {
+    createFallbackLogger("api").warn(message, {
         requestId,
-        type: type?.slice(0, MAX_LOGGED_TYPE_LENGTH),
-        status: err.httpStatus,
-        code: err.code,
+        type: loggableType(type),
+        ...fields,
         ...(startedAt === undefined ? {} : { durationMs: Math.round(performance.now() - startedAt) }),
     });
 }
+function logClientFault(err, requestId, type) {
+    logClientWarn("handler rejected", requestId, type, { status: err.httpStatus, code: err.code });
+}
 // Identity-checked against THIS request's signal — signal.aborted alone
 // would also match a real 5xx that happens to race a disconnect.
 function isClientAbort(err) {
@@ -333,7 +340,7 @@ function logServerFault(err, requestId, type) {
     const cause = err.cause;
     createFallbackLogger("api").error("handler failed", {
         requestId,
-        type,
+        type: loggableType(type),
         code: err.code,
         message: err.message,
         cause: cause instanceof Error ? cause.message : cause,
@@ -354,17 +361,9 @@ function writeErrorResponse(c, err, type) {
 function queryErrorResponse(c, err, type) {
     const requestId = requestContext.get()?.requestId;
     if (isClientAbort(err)) {
-        if (clientFaultLoggingEnabled()) {
-            const startedAt = requestContext.get()?.startedAt;
-            createFallbackLogger("api").warn("request aborted by client", {
-                requestId,
-                type: type?.slice(0, MAX_LOGGED_TYPE_LENGTH),
-                status: CLIENT_CLOSED_REQUEST_STATUS,
-                ...(startedAt === undefined
-                    ? {}
-                    : { durationMs: Math.round(performance.now() - startedAt) }),
-            });
-        }
+        logClientWarn("request aborted by client", requestId, type, {
+            status: CLIENT_CLOSED_REQUEST_STATUS,
+        });
         return c.body(null, CLIENT_CLOSED_REQUEST_STATUS); // @cast-boundary non-standard client-closed-request status, Hono's union doesn't include it
     }
     logServerFault(err, requestId, type);

package/dist/api/server.js

@@ -5,7 +5,7 @@ import { buildAppSchema } from "../engine/build-app-schema.js";
 import { EXT_FILE_PROVIDER, EXT_PRINCIPAL_STATUS } from "../engine/extension-names.js";
 import { projectAppSchemaForRoles } from "../engine/project-app-schema-for-roles.js";
 import { runsInLane } from "../engine/run-in.js";
-import { ANONYMOUS_ROLE, createAnonymousUser, createSystemUser } from "../engine/system-user.js";
+import { createAnonymousUser, createSystemUser, isAnonymousSessionUser, } from "../engine/system-user.js";
 import { isFileField, } from "../engine/types/index.js";
 import { createFileContext } from "../files/file-handle.js";
 import { createFileRoutes, readFilesRouteOptions } from "../files/file-routes.js";
@@ -22,6 +22,7 @@ import { createAccessInvalidationEventConsumer, createJobTriggerEventConsumer, c
 import { authEndpointRateLimit, createRateLimitResolver, globalIpRateLimit, } from "../rate-limit/index.js";
 import { deriveSearchAdapterConfig } from "../search/derive-search-adapter-config.js";
 import { assertUnreachable, generateId } from "../utils/index.js";
+import { collectAnonymousLiveEntities } from "./anonymous-live-entities.js";
 import { NO_ROUTE_MATCH_HEADER_NAME, PUBLIC_API_PATHS, Routes } from "./api-constants.js";
 import { authMiddleware, getAuthTokenExpiry, getUser, } from "./auth-middleware.js";
 import { createAuthRoutes } from "./auth-routes.js";
@@ -537,20 +538,29 @@ export function buildServer(options) {
     // Public auth routes (login) need to be registered BEFORE the generic
     // api routes so Hono matches them first.
     if (options.auth) {
-        // A membershipQuery handler is registered but nothing fulfils
-        // principalStatus — surface that misconfig at boot instead of an InternalError on first login/switch-tenant.
-        if (options.registry.getQueryHandler(options.auth.membershipQuery) &&
-            options.registry.getExtensionUsages(EXT_PRINCIPAL_STATUS).length === 0) {
-            throw new Error(`[kumiko] auth membershipQuery "${options.auth.membershipQuery}" is registered but no feature ` +
-                'provides the "principalStatus" contract — mount the user feature (tenant switch and sign-in ' +
-                "need it to reject blocked principals).");
+        // A membershipQuery handler is registered but principalStatus is not provided by exactly
+        // one feature — surface that misconfig at boot instead of an InternalError on first login/switch-tenant.
+        if (options.registry.getQueryHandler(options.auth.membershipQuery)) {
+            const principalStatusProviders = options.registry.getExtensionUsages(EXT_PRINCIPAL_STATUS).length;
+            if (principalStatusProviders === 0) {
+                throw new Error(`[kumiko] auth membershipQuery "${options.auth.membershipQuery}" is registered but no feature ` +
+                    'provides the "principalStatus" contract — mount the user feature (tenant switch and sign-in ' +
+                    "need it to reject blocked principals).");
+            }
+            if (principalStatusProviders > 1) {
+                throw new Error(`[kumiko] auth membershipQuery "${options.auth.membershipQuery}" is registered but ` +
+                    `${principalStatusProviders} features provide the "principalStatus" contract — exactly one ` +
+                    "is expected (the bundled user feature already provides it).");
+            }
         }
         app.route("/api", createAuthRoutes(dispatcher, jwt, { ...options.auth, resolver: clientIpResolver }));
     }
     app.route("/api", createApiRoutes(dispatcher, {
         ...(options.sseHeartbeatMs !== undefined ? { sseHeartbeatMs: options.sseHeartbeatMs } : {}),
     }));
-    app.route("/api", createSseRoute(sseBroker));
+    app.route("/api", createSseRoute(sseBroker, {
+        anonymousLiveEntities: collectAnonymousLiveEntities(options.registry),
+    }));
     // GET /api/schema — the only way a client obtains the AppSchema. Behind
     // jwtGuard (NON_PUBLIC_API_PATHS), so anonymousAccess's synthesised user
     // also gets rejected below — the schema never reaches an unauthenticated
@@ -843,7 +853,7 @@ c, dispatcher) {
 // real, signed-in principal and reject the synthesised anonymousAccess user
 // (SessionUser.roles includes ANONYMOUS_ROLE) the same way.
 function isMissingOrAnonymousUser(user) {
-    return !user || user.roles.includes(ANONYMOUS_ROLE);
+    return !user || isAnonymousSessionUser(user);
 }
 function unauthenticatedResponse(c) {
     return c.json({

package/dist/api/sse-broker.d.ts

@@ -1,3 +1,4 @@
+import type { SessionUser } from "../engine/types/index.js";
 export type SseClient = {
     id: string;
     send: (event: SseEvent) => void;
@@ -7,6 +8,7 @@ export type SseEvent = {
     type: string;
     data: Record<string, unknown>;
 };
+export declare function readNonEmptyStringArray(value: unknown): string[] | undefined;
 export type AccessInvalidationScope = {
     readonly kind: "user";
 } | {
@@ -23,6 +25,7 @@ export type AccessInvalidationCredential = {
     readonly sid?: string;
     readonly patTokenId?: string;
 };
+export declare function accessInvalidationCredentialFor(user: Pick<SessionUser, "sid" | "pat">): AccessInvalidationCredential;
 export type SseBroker = {
     addClient(channel: string, send: (event: SseEvent) => void, close: () => void): string;
     removeClient(channel: string, clientId: string): void;

package/dist/api/sse-broker.js

@@ -1,5 +1,19 @@
 import { userAccessChannel } from "../engine/constants.js";
 import { generateId } from "../utils/index.js";
+// What a publish invalidates. "user" is the broadest (and the historical
+// default — every scope narrower than this is an opt-in from a caller that
+// knows exactly which credential(s) it revoked).
+export function readNonEmptyStringArray(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return undefined;
+    return value.every((v) => typeof v === "string") ? value : undefined;
+}
+export function accessInvalidationCredentialFor(user) {
+    return {
+        ...(user.sid !== undefined && { sid: user.sid }),
+        ...(user.pat?.tokenId !== undefined && { patTokenId: user.pat.tokenId }),
+    };
+}
 // Fail-closed: a narrow scope only spares/limits a listener it can positively
 // match against its own credential. A listener with neither sid nor
 // patTokenId of its own can't be matched by "sessions"/"pat-tokens", so it

package/dist/api/sse-route.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import type { SseBroker } from "./sse-broker.js";
+import { type SseBroker } from "./sse-broker.js";
 /**
  * Heartbeat-Cadence für SSE-Streams.
  *
@@ -21,4 +21,7 @@ import type { SseBroker } from "./sse-broker.js";
  * gegen versehentliches Hochsetzen.
  */
 export declare const SSE_HEARTBEAT_INTERVAL_MS = 15000;
-export declare function createSseRoute(broker: SseBroker): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+export type SseRouteOptions = {
+    readonly anonymousLiveEntities: ReadonlySet<string>;
+};
+export declare function createSseRoute(broker: SseBroker, options: SseRouteOptions): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;

package/dist/api/sse-route.js

@@ -1,8 +1,10 @@
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { tenantChannel } from "../engine/constants.js";
+import { isAnonymousSessionUser } from "../engine/system-user.js";
 import { Routes } from "./api-constants.js";
 import { getUser } from "./auth-middleware.js";
+import { accessInvalidationCredentialFor } from "./sse-broker.js";
 /**
  * Heartbeat-Cadence für SSE-Streams.
  *
@@ -32,7 +34,41 @@ export const SSE_HEARTBEAT_INTERVAL_MS = 15_000;
 function isEntityEventData(data) {
     return typeof data["aggregateType"] === "string";
 }
-export function createSseRoute(broker) {
+// Whitelist, never a spread: the wire frame is a signal without field
+// values even if a broker or pusher put a payload into event.data.
+function toEntitySignalWire(event, data) {
+    return {
+        id: data["id"],
+        aggregateType: data.aggregateType,
+        eventType: event.type,
+        version: data["version"],
+        createdAt: data["createdAt"],
+    };
+}
+// The tenant channel fans out to every member, so a frame without an entity
+// (e.g. channel-in-app:event:delivered) reaches only its addressee; a frame
+// lacking userId is dropped (fail-closed).
+function isAddressedTo(event, userId) {
+    const addressee = event.data["userId"];
+    return typeof addressee === "string" && addressee === userId;
+}
+function mayReceiveEntitySignal(user, aggregateType, options) {
+    return !isAnonymousSessionUser(user) || options.anonymousLiveEntities.has(aggregateType);
+}
+function decideWireFrame(event, user, options) {
+    const data = event.data;
+    if (isEntityEventData(data)) {
+        // skip: anonymous connections only get signals for entities an anonymous query declares
+        if (!mayReceiveEntitySignal(user, data.aggregateType, options))
+            return undefined;
+        return { name: data.aggregateType, data: toEntitySignalWire(event, data) };
+    }
+    // skip: frames without an entity belong to their addressee only
+    if (!isAddressedTo(event, user.id))
+        return undefined;
+    return { name: event.type, data };
+}
+export function createSseRoute(broker, options) {
     const route = new Hono();
     route.get(Routes.sse, async (c) => {
         const user = getUser(c);
@@ -40,20 +76,44 @@ export function createSseRoute(broker) {
         // Allowing ?channel=... would let any authenticated user subscribe to other tenants' feeds.
         const channel = tenantChannel(user.tenantId);
         return streamSSE(c, async (stream) => {
+            let resolveEnded;
+            const ended = new Promise((resolve) => {
+                resolveEnded = resolve;
+            });
+            const closeStream = () => {
+                resolveEnded();
+                void stream.close();
+            };
             const clientId = broker.addClient(channel, (event) => {
-                const wireEventName = isEntityEventData(event.data)
-                    ? event.data.aggregateType
-                    : event.type;
-                stream.writeSSE({ event: wireEventName, data: JSON.stringify(event.data) });
-            }, () => stream.close());
-            stream.onAbort(() => {
+                const frame = decideWireFrame(event, user, options);
+                // skip: decideWireFrame withholds frames this user must not see
+                if (!frame)
+                    return;
+                stream.writeSSE({ event: frame.name, data: JSON.stringify(frame.data) });
+            }, closeStream);
+            const unsubscribeAccessInvalidation = broker.subscribeAccessInvalidation(user.id, closeStream, accessInvalidationCredentialFor(user));
+            let released = false;
+            const release = () => {
+                // skip: onAbort and the finally block both release, the second call is a no-op
+                if (released)
+                    return;
+                released = true;
+                // A client disconnect must also wake the heartbeat sleep, not only a server close.
+                resolveEnded();
                 broker.removeClient(channel, clientId);
-            });
+                unsubscribeAccessInvalidation();
+            };
+            stream.onAbort(release);
             // Keep connection alive with heartbeat — siehe SSE_HEARTBEAT_INTERVAL_MS
             // header für die Layer-für-Layer-Begründung der 15s-Cadence.
-            while (true) {
-                await stream.writeSSE({ event: "ping", data: "" });
-                await stream.sleep(SSE_HEARTBEAT_INTERVAL_MS);
+            try {
+                while (!stream.closed && !stream.aborted) {
+                    await stream.writeSSE({ event: "ping", data: "" });
+                    await Promise.race([stream.sleep(SSE_HEARTBEAT_INTERVAL_MS), ended]);
+                }
+            }
+            finally {
+                release();
             }
         });
     });

package/dist/bun-db/connection.js

@@ -27,8 +27,6 @@ export function createBunDbConnection(url, options = {}) {
     if (options.connectTimeoutSeconds !== undefined) {
         pgOpts.connect_timeout = options.connectTimeoutSeconds;
     }
-    // ponytail: "postgres" resolves to the @bender0oo0/postgres fork (nextWrite
-    // null-socket guard, porsager/postgres#1209); switch back per kumiko-framework#3248.
     const listenClient = postgres(url, pgOpts);
     return {
         db,

package/dist/bun-db/index.d.ts

@@ -1,4 +1,4 @@
 export type { BunDbConnection, BunDbConnectionOptions, BunDbRunner, BunDbTx, PgListenClient, } from "./connection.js";
 export { bunDbConnectionOptionsFromEnv, createBunDbConnection } from "./connection.js";
 export type { SelectOptions, TableInfo, WhereObject, WhereOperator, WhereValue } from "./query.js";
-export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, type DeleteManyBatchedOptions, type DeleteManyBatchedResult, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, type IncrementCounterOptions, incrementCounter, insertMany, insertOne, isTimestamptzType, runInSavepoint, runInSavepointIfSupported, selectMany, transaction, type UpsertOnConflictOptions, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";
+export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, type DeleteManyBatchedOptions, type DeleteManyBatchedResult, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, type IncrementCounterOptions, incrementCounter, insertMany, insertOne, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, selectMany, transaction, type UpsertOnConflictOptions, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";

package/dist/bun-db/index.js

@@ -1,4 +1,4 @@
 // bun-db: Bun.sql-basierte DB-API ohne drizzle.
 // Production-Pfad nach drizzle-removal.
 export { bunDbConnectionOptionsFromEnv, createBunDbConnection } from "./connection.js";
-export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, incrementCounter, insertMany, insertOne, isTimestamptzType, runInSavepoint, runInSavepointIfSupported, selectMany, transaction, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";
+export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, incrementCounter, insertMany, insertOne, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, selectMany, transaction, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";

package/dist/bun-db/query.d.ts

@@ -5,6 +5,7 @@ import { type NotExecutorOnly } from "../db/table-builder.js";
 import type { DbRunner } from "@cosmicdrift/kumiko-types/db-connection";
 import type { BunDbRunner } from "./connection.js";
 export declare function asEntityTableMeta(table: unknown): EntityTableMeta | undefined;
+export declare function requireEntityTableMeta(table: unknown, tableName: string): EntityTableMeta;
 type RawClient = {
     unsafe: <TRow = unknown>(sql: string, params?: readonly unknown[]) => Promise<readonly TRow[]>;
     begin: <T>(fn: (tx: unknown) => Promise<T>) => Promise<T>;

package/dist/bun-db/query.js

@@ -68,6 +68,13 @@ export function asEntityTableMeta(table) {
         return fromSymbol;
     return isEntityTableMeta(table) ? table : undefined;
 }
+export function requireEntityTableMeta(table, tableName) {
+    const meta = asEntityTableMeta(table);
+    if (!meta) {
+        throw new Error(`${tableName}: table carries no EntityTableMeta — built via table()?`);
+    }
+    return meta;
+}
 export function asRawClient(db) {
     const dbAny = db;
     // Direct: Bun.SQL / postgres-js Sql / postgres-js TransactionSql. All three
@@ -542,10 +549,16 @@ function buildWhereClause(info, where, startIndex) {
                 const opVal = value[opKey];
                 if (opVal === undefined)
                     continue;
+                // Mirrors applyMultiSelectFilter: ordering/pattern ops have no meaning on a jsonb
+                // option array (`like` would crash as `jsonb ~~ jsonb`), so match nothing.
+                if (pgType === "jsonb" && opKey !== "ne") {
+                    conditions.push("FALSE");
+                    continue;
+                }
                 if (opKey === "ne" && pgType === "jsonb" && isJsonbScalar(opVal)) {
                     const p = prepareJsonbValue([opVal]);
                     if (p && p.kind === "param") {
-                        conditions.push(`NOT (${quoteIdent(col)} @> $${idx++}${p.sql})`);
+                        conditions.push(`(${quoteIdent(col)} IS NULL OR NOT (${quoteIdent(col)} @> $${idx++}${p.sql}))`);
                         values.push(p.bound);
                         continue;
                     }
@@ -885,9 +898,7 @@ export async function updateMany(db, table, set, where) {
         return scoped.updateMany(table, set, where);
     }
     const info = extractTableInfo(table);
-    const setEntries = Object.entries(set)
-        .filter(([k]) => info.hasColumn(k))
-        .map(([k, v]) => {
+    const setEntries = Object.entries(set).map(([k, v]) => {
         const col = info.columnOf(k);
         const pgType = info.pgTypeOf(col);
         return { col, prepared: prepareValue(v, pgType) };