@cosmicdrift/kumiko-framework 0.336.1 → 0.337.1

package/dist/upgrade-cli.js

@@ -109,10 +109,12 @@ export function findPackageChangelogFiles(cwd) {
             for (const name of pkgNames) {
                 if (seenNames.has(name))
                     continue;
+                // Claimed by the nearest scope even without a changelog, so a farther
+                // node_modules can't contribute another version of the same package.
+                seenNames.add(name);
                 const changelogPath = join(scopeDir, name, "src", "changes.json");
                 if (!existsSync(changelogPath))
                     continue;
-                seenNames.add(name);
                 const realPath = realpathSync(changelogPath);
                 if (seenRealPaths.has(realPath))
                     continue;
@@ -305,9 +307,30 @@ function logManualMarkerOutcome(out, manualEntries, markerVersion) {
             : `  ⚠ Marker moved past the manual change(s) above to ${markerVersion}; the upgrade guard no longer lists them, so make sure they are migrated.`);
     }
 }
+// Records the codemods that already wrote files before a later one failed, so
+// a re-run resumes after them instead of replaying non-idempotent codemods.
+function writePartialMarker(out, targetDir, pending, manualEntries, failedVersion, ran) {
+    // skip: no codemod wrote files before the failure, nothing to resume after
+    if (ran.length === 0)
+        return;
+    const doneBeforeFailure = pending.filter((e) => compareVersions(e.version, failedVersion) < 0);
+    const version = markerVersionForPending(doneBeforeFailure, manualEntries, "");
+    // skip: no pending entry completed before the failure, so no marker version to record
+    if (version === "")
+        return;
+    const pendingManual = manualEntries.map((e) => ({ version: e.version, title: e.title }));
+    writeUpgradeMarker(targetDir, {
+        version,
+        appliedAt: Temporal.Now.instant().toString(),
+        codemods: ran,
+        ...(pendingManual.length > 0 && { pendingManual }),
+    });
+    out.err(`  ⚠ ${ran.length} codemod(s) already applied; wrote marker at ${version} so a re-run resumes at the failed one.`);
+}
 // Runs every pending breaking entry's codemod, oldest version first (so a
 // later codemod can assume an earlier one already ran). Stops on the first
-// failure — no partial marker. Writes the marker whenever dryRun is false —
+// failure; codemods that already ran are kept in a partial marker. Writes the
+// marker whenever dryRun is false —
 // even with zero pending entries, so an already-current app still gets a
 // bootstrap marker recording its installed version (fw#2299).
 // kumiko-lint-ignore complexity-budget sequential codemod runner with zero-pending bootstrap marker
@@ -364,6 +387,8 @@ markerVersion) {
         const scriptPath = resolveCodemodScript(repoRoot, e.codemod);
         if (!scriptPath) {
             out.err(`  ✗ ${e.version} · ${e.title} — invalid codemod path "${e.codemod}"`);
+            if (!dryRun)
+                writePartialMarker(out, targetDir, pending, manualEntries, e.version, ran);
             return 1;
         }
         out.log(`  → ${e.version} · running ${e.codemod}${dryRun ? " (dry-run)" : ""}`);
@@ -372,6 +397,8 @@ markerVersion) {
             out.log(result.output);
         if (!result.ok) {
             out.err(`  ✗ ${e.version} · ${e.codemod} failed`);
+            if (!dryRun)
+                writePartialMarker(out, targetDir, pending, manualEntries, e.version, ran);
             return 1;
         }
         ran.push({ version: e.version, codemod: e.codemod, title: e.title });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.336.1",
+  "version": "0.337.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -206,8 +206,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.336.1",
-    "@cosmicdrift/kumiko-types": "0.336.1",
+    "@cosmicdrift/kumiko-http": "0.337.1",
+    "@cosmicdrift/kumiko-types": "0.337.1",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -223,7 +223,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.336.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.337.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,96 @@
 [
+  {
+    "version": "0.337.1",
+    "type": "improvement",
+    "title": "Designer reads and creates r.secretNamespace, edits writeRoles on secrets",
+    "detail": "The Designer source model now parses `r.secretNamespace(...)` as its own pattern kind `secretNamespace` instead of falling back to `unknown`, renders it back and can add it through the pattern library. A Zod `nameSchema` or an options identifier is kept verbatim. The `r.secret` form gains a `writeRoles` list and no longer offers the `system` scope, which the secret type never allowed."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "variant() ignores caller-supplied resolvedOverlays",
+    "detail": "`derivatives.variant()` now discards a caller-supplied `resolvedOverlays`, so a literal overlay payload can no longer bypass the overlay resolver. The guarded admin seed throws instead of silently picking by id when a user row's `insertedAt` is not an instant."
+  },
+  {
+    "version": "0.337.0",
+    "type": "breaking",
+    "title": "Anonymous callers on protected handlers get 401 unauthenticated, and a stale auth cookie no longer blocks public handlers",
+    "migration": "Tests or clients that expect 403 / access_denied for an anonymous caller (no session, the anonymousAccess user, or a JWT carrying only the anonymous role) on a role-gated or openToAll handler now get 401 / unauthenticated; update those assertions. Signed-in callers without the role still get 403 access_denied. With anonymousAccess wired, a request whose auth cookie fails verification or whose session is no longer live continues as anonymous outside /api/auth/* (public handlers answer 200, protected ones 401 unauthenticated) instead of failing with 401 invalid_token / session_invalid; bearer tokens and /api/auth/* keep the explicit 401."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "Anonymous SSE signals no longer carry row id or version",
+    "detail": "An anonymous /api/sse connection gets every row signal of a declared liveEntities entity, including rows the anonymous query hides. The frame now carries only aggregateType, eventType and createdAt, so a public viewer can no longer see which hidden rows exist or change; signed-in connections keep id and version. LiveEvent.data.id and version are optional in kumiko-renderer accordingly."
+  },
+  {
+    "version": "0.337.0",
+    "type": "breaking",
+    "title": "buildServer refuses partially wired session callbacks",
+    "migration": "If you call buildServer with auth.sessionCreator or auth.sessionRevoker, also wire the other two of sessionCreator, sessionRevoker and sessionChecker (the sessions feature's sessionStore provides all three; runProdApp and runDevApp already do this). Without a sessionChecker a logout never invalidated the JWT. A sessionChecker alone stays allowed."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "Job triggers accept short handler and event names",
+    "detail": "r.job trigger.on now qualifies a short name against the job's own feature (write handler, then query handler, then defineEvent), like notification triggers, and the boot error lists every name it tried."
+  },
+  {
+    "version": "0.337.0",
+    "type": "improvement",
+    "title": "Boot rejects a collapsed relatedList group without a header; expandableRow groupBy keys are required i18n keys",
+    "detail": "Boot fails when `groupBy.collapsedWhen` names a group that has neither `label` nor a `labels` entry, because its rows could never be opened. The required surface keys now include `groupBy.label` and `groupBy.labels` of an entityList `expandableRow`, as they already did for projectionDetail relatedList sections.",
+    "migration": "Add translations for expandableRow `groupBy` header keys if the i18n check reports them missing."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "json format falls back to text, IPv4-first egress pin, structural claim comparison for identity switch",
+    "detail": "The `json` format no longer throws on BigInt or circular values and falls back to text. `resolvePublicHost` prefers an IPv4 address on dual-stack hosts. Identity-switch claim comparison no longer treats structurally equal object claims in a different key order as a different identity."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "reference search and sort skip soft-deleted targets, blind-index sweep resolves tables in public, key-manager retry releases 5xx bodies",
+    "detail": "List search and sort by a reference field now ignore soft-deleted target rows: a deleted customer's name no longer matches a reference search and no longer decides the position in a label sort. The blind-index sweep checks table existence in the `public` schema instead of relying on the session `search_path`. The Scaleway key-manager retry cancels the response body of a retried 5xx instead of leaving it open."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "boot validator rejects redirect on list row actions, httpRoute with non-literal anonymous is a parse error, local const shadows same-named import in feature-ast, r.nav strips undefined properties",
+    "detail": "The boot validator now rejects a `redirect` on `entityList`, `projectionList` and `relatedList` row actions, where it was silently ignored. The feature-ast parser reports an `httpRoute` whose `anonymous` is a non-literal expression as a parse error instead of rewriting it to `false` on round-trip, and a local non-literal `const` no longer resolves to a same-named import. `r.nav()` strips explicitly-`undefined` properties for every registration path."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "isRedisSseBroker narrows on a kind discriminant, tenant-lifecycle gate cache is bounded",
+    "detail": "`isRedisSseBroker` now narrows on a `kind: \"redis\"` discriminant that `createRedisSseBroker` sets, so an app-owned broker that happens to expose `close()` is no longer mistaken for the Redis one. The tenant-lifecycle gate cache is capped at 5000 entries, so anonymous requests with random `X-Tenant` ids can no longer grow it without bound."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "search extensions never see sensitive row fields on named events, streams cannot hard-delete (gate message now says so), codemod walkers and namespace imports hardened",
+    "detail": "The search consumer no longer hands `sensitive` columns of the projection row to `searchPayloadExtension` contributors when a named domain event triggers the re-index. A `skipApplyErrors` rebuild option passed for a multi-stream projection is now logged as ignored instead of dropped silently. The irreversible-operation gate error for stream entry handlers says that streams cannot declare an agent risk (streams always resolve `mid`, so a hard delete or `forget` inside a stream is denied; dispatch a risk `high` write handler directly). The `migrate-open-to-all` codemod skips symlinks and `dist`/`build`/`.next`/`.git`, and the `unprocessable-error-details-reason` codemod follows namespace imports and reports member-access callees it cannot resolve."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "search remove no longer creates indexes, upgrade --apply keeps a partial marker on codemod failure, test stack syncs indexes and cleans queue keys, codemod walkers skip symlinks",
+    "detail": "Meilisearch `remove` and `removeBatch` no longer configure (and thereby implicitly create) the tenant index before deleting. `kumiko-upgrade --apply` writes a partial upgrade marker when a later codemod fails, so a re-run resumes at the failed codemod instead of replaying the ones that already wrote files. The changelog lookup claims a package name in the nearest `node_modules` even when it has no `changes.json`, instead of listing a farther version's changelog. The test stack syncs missing indexes (including unique) on a persistent dev DB and removes the BullMQ keys of its derived per-stack queues on cleanup. `bridgeStub` defaults to the real anonymous identity. The `migrate-cross-tenant` and `migrate-db-raw` codemods share one walker with `migrate-open-to-all` that skips symlinks and `dist`/`build`/`.next`/`.git`."
+  },
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "Removed unreachable PAT rate-limit guard from the httpRoute chain",
+    "detail": "The httpRoute guard chain no longer includes the PAT rate-limit guard. PATs are rejected on httpRoutes before it could count, so behavior is unchanged."
+  },
+  {
+    "version": "0.337.0",
+    "type": "improvement",
+    "title": "r.secretNamespace declares a family of runtime-named secret keys",
+    "detail": "`r.secretNamespace(name, { label, scope: \"tenant\", writeRoles?, nameSchema? })` declares the prefix `<feature>:<name>.` (kebab-cased) and returns `{ prefix, keyFor(name) }`. `secrets:write:set` and `secrets:write:delete` accept a key under that prefix when the suffix is non-empty and passes `nameSchema`; `writeRoles` applies to every key in the namespace. Namespaces are kept out of `getAllSecretKeys` and the generated secrets screen. `Registry.findSecretNamespace(key)` resolves the namespace of a key. step-dispatcher declares `webhook-auth`, so webhook auth secrets (`step-dispatcher:webhook-auth.<name>`) stay settable through the API.",
+    "migration": "No code change needed. A feature that stores secrets under a runtime-chosen suffix declares a namespace instead of one `r.secret` per key."
+  },
   {
     "version": "0.336.1",
     "type": "fix",

package/src/scripts/codemod/collect-source-files.ts

@@ -0,0 +1,48 @@
+import { lstatSync, readdirSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+const BUILD_AND_VENDOR_DIR_NAMES: readonly string[] = [
+  "node_modules",
+  "dist",
+  "build",
+  ".next",
+  ".git",
+];
+
+export interface CollectSourceFilesOptions {
+  readonly isMigratableFile: (name: string) => boolean;
+  readonly extraSkippedDirNames?: readonly string[];
+}
+
+export function collectSourceFiles(
+  paths: readonly string[],
+  options: CollectSourceFilesOptions,
+): string[] {
+  const skippedDirNames = new Set([
+    ...BUILD_AND_VENDOR_DIR_NAMES,
+    ...(options.extraSkippedDirNames ?? []),
+  ]);
+
+  function walkDir(dir: string, out: string[]): void {
+    for (const name of readdirSync(dir)) {
+      if (skippedDirNames.has(name)) continue;
+      const full = join(dir, name);
+      const stat = lstatSync(full);
+      // Symlinks can point back at a parent directory (workspace links) and loop forever.
+      if (stat.isSymbolicLink()) continue;
+      if (stat.isDirectory()) {
+        walkDir(full, out);
+        continue;
+      }
+      if (options.isMigratableFile(name)) out.push(full);
+    }
+  }
+
+  const files: string[] = [];
+  for (const p of paths) {
+    const abs = resolve(p);
+    if (statSync(abs).isDirectory()) walkDir(abs, files);
+    else if (options.isMigratableFile(abs)) files.push(abs);
+  }
+  return files;
+}

package/src/scripts/codemod/migrate-cross-tenant.ts

@@ -6,8 +6,7 @@
 // Usage:
 //   bun scripts/codemod/migrate-cross-tenant.ts [--dry-run] <path...>
 
-import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { readFileSync, writeFileSync } from "node:fs";
 import {
   type CallExpression,
   Node,
@@ -16,6 +15,7 @@ import {
   type PropertyAssignment,
   SyntaxKind,
 } from "ts-morph";
+import { collectSourceFiles } from "./collect-source-files.js";
 
 export interface Rewrite {
   readonly file: string;
@@ -264,28 +264,8 @@ function isMigratableFile(name: string): boolean {
   return /\.(ts|tsx)$/.test(name);
 }
 
-function walkDir(dir: string, out: string[]): void {
-  for (const name of readdirSync(dir)) {
-    if (name === "node_modules") continue;
-    const full = join(dir, name);
-    const stat = statSync(full);
-    if (stat.isDirectory()) {
-      walkDir(full, out);
-      continue;
-    }
-    if (isMigratableFile(name)) out.push(full);
-  }
-}
-
 function collectFiles(paths: string[]): string[] {
-  const files: string[] = [];
-  for (const p of paths) {
-    const abs = resolve(p);
-    const stat = statSync(abs);
-    if (stat.isDirectory()) walkDir(abs, files);
-    else if (isMigratableFile(abs)) files.push(abs);
-  }
-  return files;
+  return collectSourceFiles(paths, { isMigratableFile });
 }
 
 async function main(): Promise<void> {

package/src/scripts/codemod/migrate-db-raw.ts

@@ -7,9 +7,9 @@
 // Usage:
 //   bun scripts/codemod/migrate-db-raw.ts [--dry-run] [--global-tables a,b] <path...>
 
-import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { readFileSync, writeFileSync } from "node:fs";
 import { Node, Project, type SourceFile, SyntaxKind, VariableDeclarationKind } from "ts-morph";
+import { collectSourceFiles } from "./collect-source-files.js";
 
 const DEFAULT_GLOBAL_TABLES: ReadonlySet<string> = new Set([
   "userTable",
@@ -334,28 +334,11 @@ function isMigratableFile(name: string): boolean {
   return true;
 }
 
-function walkDir(dir: string, out: string[]): void {
-  for (const name of readdirSync(dir)) {
-    if (name === "node_modules" || name === "__tests__") continue;
-    const full = join(dir, name);
-    const stat = statSync(full);
-    if (stat.isDirectory()) {
-      walkDir(full, out);
-      continue;
-    }
-    if (isMigratableFile(name)) out.push(full);
-  }
-}
-
 function collectFiles(paths: string[]): string[] {
-  const files: string[] = [];
-  for (const p of paths) {
-    const abs = resolve(p);
-    const stat = statSync(abs);
-    if (stat.isDirectory()) walkDir(abs, files);
-    else if (isMigratableFile(abs)) files.push(abs);
-  }
-  return files;
+  return collectSourceFiles(paths, {
+    isMigratableFile,
+    extraSkippedDirNames: ["__tests__"],
+  });
 }
 
 async function main(): Promise<void> {

package/src/scripts/codemod/migrate-open-to-all.ts

@@ -6,8 +6,7 @@
 // Usage:
 //   bun scripts/codemod/migrate-open-to-all.ts [--dry-run] [--test-reason "<text>"] <path...>
 
-import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { readFileSync, writeFileSync } from "node:fs";
 import {
   Node,
   type ObjectLiteralExpression,
@@ -15,6 +14,7 @@ import {
   type PropertyAssignment,
   SyntaxKind,
 } from "ts-morph";
+import { collectSourceFiles } from "./collect-source-files.js";
 
 const DEFAULT_TEST_REASON = "test handler callable by any signed-in test user";
 
@@ -164,28 +164,8 @@ function isMigratableFile(name: string): boolean {
   return /\.(ts|tsx)$/.test(name);
 }
 
-function walkDir(dir: string, out: string[]): void {
-  for (const name of readdirSync(dir)) {
-    if (name === "node_modules") continue;
-    const full = join(dir, name);
-    const stat = statSync(full);
-    if (stat.isDirectory()) {
-      walkDir(full, out);
-      continue;
-    }
-    if (isMigratableFile(name)) out.push(full);
-  }
-}
-
-function collectFiles(paths: string[]): string[] {
-  const files: string[] = [];
-  for (const p of paths) {
-    const abs = resolve(p);
-    const stat = statSync(abs);
-    if (stat.isDirectory()) walkDir(abs, files);
-    else if (isMigratableFile(abs)) files.push(abs);
-  }
-  return files;
+export function collectFiles(paths: string[]): string[] {
+  return collectSourceFiles(paths, { isMigratableFile });
 }
 
 // Remaining manual sites still fail boot validation, so upgrade-cli must not

package/src/scripts/codemod/unprocessable-error-details-reason.ts

@@ -51,14 +51,20 @@ function findTargetFiles(rootDir: string): string[] {
   return files.sort();
 }
 
+const NAMESPACE_IMPORT = "*";
+
 type ImportedBinding = { readonly importedName: string; readonly moduleSpecifier: string };
 
-/** Local-name -> where it's imported from, for every named value import in the file. */
+/** Local-name -> where it's imported from, for every named or namespace value import in the file. */
 function collectImportedNames(sourceFile: SourceFile): Map<string, ImportedBinding> {
   const bindings = new Map<string, ImportedBinding>();
   for (const imp of sourceFile.getImportDeclarations()) {
     if (imp.isTypeOnly()) continue;
     const moduleSpecifier = imp.getModuleSpecifierValue();
+    const namespaceImport = imp.getNamespaceImport();
+    if (namespaceImport) {
+      bindings.set(namespaceImport.getText(), { importedName: NAMESPACE_IMPORT, moduleSpecifier });
+    }
     for (const spec of imp.getNamedImports()) {
       if (spec.isTypeOnly()) continue;
       const importedName = spec.getName();
@@ -264,6 +270,17 @@ const FAIL_UNPROCESSABLE_CALL: MigratableCall = {
   process: processFailUnprocessableCall,
 };
 
+function isKumikoNamespaceReceiver(
+  receiver: Node,
+  importedNames: ReadonlyMap<string, ImportedBinding>,
+): boolean {
+  if (!Node.isIdentifier(receiver)) return false;
+  const binding = importedNames.get(receiver.getText());
+  return (
+    binding?.importedName === NAMESPACE_IMPORT && KUMIKO_MODULE_RE.test(binding.moduleSpecifier)
+  );
+}
+
 function migrateCallSite(
   sourceFile: SourceFile,
   importedNames: ReadonlyMap<string, ImportedBinding>,
@@ -272,11 +289,28 @@ function migrateCallSite(
   skips: SkipEntry[],
 ): boolean {
   const callee = site.getExpression();
-  if (!Node.isIdentifier(callee)) return false;
-  const localName = callee.getText();
   const line = site.getStartLineNumber();
   const file = sourceFile.getFilePath();
 
+  if (!Node.isIdentifier(callee)) {
+    const unresolvedCallee = callee.getText();
+    const resolvedViaNamespace =
+      Node.isPropertyAccessExpression(callee) &&
+      callee.getName() === target.exportName &&
+      isKumikoNamespaceReceiver(callee.getExpression(), importedNames);
+    if (resolvedViaNamespace) return processCall(site, target, skips, file, line);
+    if (unresolvedCallee.endsWith(target.exportName)) {
+      skips.push({
+        file,
+        line,
+        note: `${target.exportName} is called through "${unresolvedCallee}", which is not a @cosmicdrift/kumiko-* namespace import this codemod can resolve`,
+        kind: "manual",
+      });
+    }
+    return false;
+  }
+  const localName = callee.getText();
+
   const binding = importedNames.get(localName);
   if (binding?.importedName !== target.exportName) {
     if (localName !== target.exportName) return false;
@@ -296,6 +330,16 @@ function migrateCallSite(
     return false;
   }
 
+  return processCall(site, target, skips, file, line);
+}
+
+function processCall(
+  site: Node & { getArguments(): Node[] },
+  target: MigratableCall,
+  skips: SkipEntry[],
+  file: string,
+  line: number,
+): boolean {
   const outcome = target.process(site.getArguments(), (note, kind) =>
     skips.push({ file, line, note, kind }),
   );