@cosmicdrift/kumiko-framework 0.336.0 → 0.336.1

package/dist/api/routes.js

@@ -301,7 +301,7 @@ function clientFaultLoggingEnabled() {
     return !FAULT_LOG_SILENCED_LEVELS.has(process.env["LOG_LEVEL"] ?? "");
 }
 // A failing request must leave a trace even when it ends in 4xx — a paid
-// external call that 422s was invisible before (offlot#117). Status, error
+// external call that 422s was invisible before. Status, error
 // code and duration only: message/details/stack can carry submitted values.
 function logClientWarn(message, requestId, type, fields) {
     if (!clientFaultLoggingEnabled()) {

package/dist/crypto/event-pii.js

@@ -45,9 +45,9 @@ function resolvePiiStance(eventType) {
 // (user/tenant/self — resolveEventSubject, fw#2801). No-op when the event
 // type is uncatalogued or no subject KMS is configured (plaintext rollout
 // mode — the hard boot gate governs whether that is acceptable). A
-// user-subject field with no resolvable owner (system cron runs,
-// recipient-less skip attempts) leaves the value plaintext: there is no
-// user key to shred. This is the ONLY live-write encrypt path — the backfill
+// user-subject field with an empty owner follows its declared `whenAbsent`
+// (tenant key or acknowledged plaintext) and aborts the append when none is
+// declared. This is the ONLY live-write encrypt path — the backfill
 // catalog branch (`backfill-pii.ts`) resolves through the same
 // resolveEventSubject so a field never ends up encrypted under different
 // subjects depending on which path wrote it.

package/dist/engine/boot-validator/access-declarations.js

@@ -53,7 +53,8 @@ function validateEscapeHatchReason(feature, kind, handlerName, escapeHatch) {
         return;
     throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ` +
         `{ escapeHatch: { reason: "" } } — the reason must be a non-empty string ` +
-        "explaining why this handler needs db.global() write access or a SYSTEM identity switch.");
+        "explaining why this handler needs db.global() write access, a SYSTEM identity switch " +
+        "or a cross-tenant ctx.queryProjection({ unsafeAllTenants: true }) read.");
 }
 function validatePersonalDataOnlyOnWrite(feature, kind, handlerName, access) {
     // skip: write handlers may declare personalData, or it wasn't declared here

package/dist/engine/build-app-schema.js

@@ -432,7 +432,8 @@ function projectField(fieldDef) {
         out["multiple"] = def["multiple"];
     // MultiSelect: display picks checkboxes vs. combobox in the renderer,
     // columns/maxRows size the checkbox grid — without these the renderer
-    // always falls back to the combobox (fw#2494).
+    // always falls back to the combobox (fw#2494). Select: display picks
+    // "radio" | "dropdown" the same way.
     if (typeof def["display"] === "string")
         out["display"] = def["display"];
     if (typeof def["columns"] === "number")

package/dist/engine/define-handler.js

@@ -70,11 +70,9 @@ export function defineQueryHandler(def,
     return def;
 }
 // Runtime marker set only by definePagedQueryHandler. A plain
-// defineQueryHandler-built object never carries it. Kept as a type-level
-// signal (fw#2216) even though no validator gates on it — QueryHandlerDef
-// has no output schema, so a boot check can't distinguish "returns
-// PagedRows" from "doesn't" without running the handler; the actual
-// enforcement is a runtime shape guard in the renderer (kumiko-screen.tsx).
+// defineQueryHandler-built object never carries it. query-output-columns.ts
+// reads it to gate the paged envelope check on outputSchema; the renderer's
+// runtime shape guard (kumiko-screen.tsx) remains as a second line.
 //
 // A string key, not a Symbol: bundled-features imports this module through
 // the package's "@cosmicdrift/kumiko-framework/engine" subpath (symlinked

package/dist/migrations/pending-rebuilds.js

@@ -65,9 +65,10 @@ export async function clearPendingRebuilds(db, rows) {
     }
 }
 // buildProjectionTableIndex maps both single-stream and multi-stream projection
-// tables to their name, so the rebuild has to pick the matching path. Queue
-// drains are automatic rebuilds: a failed MSP replay rolls back, stays queued
-// and must not park the still-intact live consumer as dead.
+// tables to their name, so the rebuild has to pick the matching path. Callers
+// (queue drains, inline enqueue, the manual rebuild job) all rethrow the error,
+// so it is recorded there; a failed MSP replay rolls back and must not park
+// the still-intact live consumer as dead.
 export async function rebuildProjectionOrMultiStream(name, deps) {
     const { db, registry, signal, errorPolicy } = deps;
     if (registry.getAllMultiStreamProjections().has(name)) {

package/dist/pipeline/dispatch-batch.js

@@ -24,8 +24,8 @@ export async function runBatch(ctx, commands, user, requestId, inheritedOrigin)
     if (!current?.signal) {
         return runBatchBody(ctx, commands, user, requestId, inheritedOrigin);
     }
-    // Strip the signal: a disconnect would roll back the tx, idempotency would
-    // cache a 500 for the uncommitted write and afterCommit effects would be lost.
+    // Strip the signal: a client disconnect must not roll back a write whose
+    // afterCommit effects would then be lost.
     const { signal: _signal, ...withoutSignal } = current;
     return requestContext.run(withoutSignal, () => runBatchBody(ctx, commands, user, requestId, inheritedOrigin));
 }

package/dist/pipeline/dispatcher.js

@@ -67,7 +67,7 @@ export function createDispatcher(registry, context, options = {}) {
         if (isDeprecatedCrossTenantHandler(def.handler)) {
             context.log?.warn(DEPRECATED_CROSS_TENANT_SIGNAL, {
                 handler: def.name,
-                migration: 'replace crossTenant: true with escapeHatch: { reason: "<why this operator handler reads/writes every tenant>" } (bun scripts/codemod/migrate-cross-tenant.ts)',
+                migration: 'replace crossTenant: true with escapeHatch: { reason: "<why this operator handler reads/writes every tenant>" } (bun node_modules/@cosmicdrift/kumiko-framework/src/scripts/codemod/migrate-cross-tenant.ts)',
             });
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.336.0",
+  "version": "0.336.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -206,8 +206,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.336.0",
-    "@cosmicdrift/kumiko-types": "0.336.0",
+    "@cosmicdrift/kumiko-http": "0.336.1",
+    "@cosmicdrift/kumiko-types": "0.336.1",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -223,7 +223,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.336.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.336.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.1",
+    "type": "fix",
+    "title": "Cross-tenant deprecation warning names a runnable codemod path",
+    "detail": "The `deprecation:entity-handler-cross-tenant` boot warning now names the codemod path that runs from a consumer repo. The `reason` strings on the `passwordHash`, PAT `tokenHash` and PAT `prefix` fields no longer carry an issue-number suffix. The `pii-personal-migration` codemod now skips `.d.ts` files in `--report-stance` mode as well."
+  },
   {
     "version": "0.336.0",
     "type": "fix",

package/src/scripts/codemod/pii-personal-migration.ts

@@ -21,7 +21,9 @@
 // packages/types/src/fields.ts). Never guesses: anything outside this
 // table is reported (file:line) instead of transformed.
 //
-// Usage: bun scripts/codemod/pii-personal-migration.ts <targetDir> [--dry-run]
+// Usage: bun scripts/codemod/pii-personal-migration.ts <targetDir> [--dry-run | --report-stance]
+// --report-stance is read-only: it writes nothing and classifies fields
+// that carry no personal stance.
 
 import { readFileSync } from "node:fs";
 import { relative, resolve } from "node:path";
@@ -423,14 +425,12 @@ function applyTransform(
   obj.insertPropertyAssignments(insertIndex, newProps);
 }
 
-function findTargetFiles(rootDir: string): string[] {
+function findSourceFiles(rootDir: string, extraExcludes: readonly string[] = []): string[] {
   const glob = new Glob("**/*.{ts,tsx}");
-  // engine/factories.ts constructs raw ResolvedPiiFlags literals as the
-  // *implementation* of expandPersonalAnnotations (personal -> flags) —
-  // not an authored override, so it's not a migration target.
-  const EXCLUDE = ["/node_modules/", "/dist/", "/build/", "/engine/factories.ts"];
+  const EXCLUDE = ["/node_modules/", "/dist/", "/build/", ...extraExcludes];
   const files: string[] = [];
   for (const file of glob.scanSync({ cwd: rootDir, dot: false })) {
+    if (file.endsWith(".d.ts")) continue;
     const abs = resolve(rootDir, file);
     if (EXCLUDE.some((p) => abs.includes(p))) continue;
     files.push(abs);
@@ -666,19 +666,6 @@ function collectStanceSites(sourceFile: SourceFile): StanceSite[] {
   return sites;
 }
 
-function findReportStanceFiles(rootDir: string): string[] {
-  const glob = new Glob("**/*.{ts,tsx}");
-  const EXCLUDE = ["/node_modules/", "/dist/", "/build/"];
-  const files: string[] = [];
-  for (const file of glob.scanSync({ cwd: rootDir, dot: false })) {
-    if (file.endsWith(".d.ts")) continue;
-    const abs = resolve(rootDir, file);
-    if (EXCLUDE.some((p) => abs.includes(p))) continue;
-    files.push(abs);
-  }
-  return files.sort();
-}
-
 function formatHintSuffix(site: StanceSite): string {
   if (!site.hint) return "";
   return site.nearMissOf
@@ -701,7 +688,7 @@ function reportStance(rootDir: string): void {
   let total = 0;
 
   const project = createReportStanceProject();
-  for (const file of findReportStanceFiles(rootDir)) {
+  for (const file of findSourceFiles(rootDir)) {
     const sites = reportStanceForSource(readFileSync(file, "utf8"), file, project);
     if (sites.length === 0) continue;
 
@@ -741,7 +728,10 @@ async function main(): Promise<void> {
   }
 
   const dryRun = process.argv.includes("--dry-run");
-  const files = findTargetFiles(rootDir);
+  // engine/factories.ts constructs raw ResolvedPiiFlags literals as the
+  // *implementation* of expandPersonalAnnotations (personal -> flags) —
+  // not an authored override, so it's not a migration target.
+  const files = findSourceFiles(rootDir, ["/engine/factories.ts"]);
   const project = new Project({
     skipAddingFilesFromTsConfig: true,
     skipFileDependencyResolution: true,