@cosmicdrift/kumiko-framework 0.344.0 → 0.345.0

package/dist/api/auth-routes.d.ts

@@ -28,6 +28,7 @@ export type AuthRoutesConfig = {
     loginErrorStatusMap?: Readonly<Record<string, number>>;
     loginRateLimit?: LoginRateLimiter | null;
     mfaVerifyHandler?: string;
+    switchTenantMfaGateHandler?: string;
     mfaVerifyErrorStatusMap?: Readonly<Record<string, number>>;
     mfaVerifyRateLimit?: LoginRateLimiter | null;
     mfaPreauthEnableStartHandler?: string;

package/dist/api/auth-routes.js

@@ -336,6 +336,20 @@ export function createAuthRoutes(dispatcher, jwt, config) {
     // shared "unknown" bucket.
     const clientIpResolver = config.resolver ?? createClientIpResolver(config.trustedProxyHops ?? 0, "createAuthRoutes");
     const getClientIp = (c) => clientIpResolver.resolve(clientIpSourceFromHonoContext(c));
+    async function switchTenantMfaGateResponse(c, user, targetTenantId) {
+        if (!config.switchTenantMfaGateHandler)
+            return undefined;
+        const gate = await dispatcher.write(config.switchTenantMfaGateHandler, { userId: user.id, tenantId: targetTenantId }, createSystemUser(user.tenantId));
+        if (!gate.isSuccess) {
+            const status = gate.error.httpStatus; // @cast-boundary engine-payload
+            return c.json({ isSuccess: false, error: gate.error }, status);
+        }
+        // @cast-boundary engine-payload — the gate handler's three-shape result
+        const gateData = gate.data;
+        if (gateData.kind === "mfa-gate-clear")
+            return undefined;
+        return pendingMfaStepResponse(c, gateData);
+    }
     // Shared tail of every route that ends a request logged-in: create the
     // session record (if wired), sign the JWT, set the auth+csrf cookies. Was
     // duplicated 5x (login/signup-confirm/invite-accept-with-login/invite-
@@ -668,10 +682,8 @@ export function createAuthRoutes(dispatcher, jwt, config) {
             schema: VerifyEmailBody,
         });
     }
-    // Self-Signup (Magic-Link). Request mountet wie reset/verify den
-    // silent-success-Pfad mit Token-Mail. Confirm ist anders: returnt
-    // SessionUser → die Route mintet JWT + setzt Cookies (Auto-Login
-    // direkt nach Activation, kein zweiter Login-Roundtrip nötig).
+    // Signup confirm mints the session (auto-login) unless the MFA gate applies;
+    // then it answers with the MFA step only, no session or cookies.
     if (config.signup) {
         const sg = config.signup;
         registerTokenRequestRoute({
@@ -696,6 +708,8 @@ export function createAuthRoutes(dispatcher, jwt, config) {
             }
             // @cast-boundary engine-payload — generic dispatcher.write result for signup-confirm
             const data = result.data;
+            if (data.kind !== "auth-session")
+                return pendingMfaStepResponse(c, data);
             // Session creation + JWT sign + cookies — see mintSessionAndRespond.
             const token = await mintSessionAndRespond(c, data.session);
             const landingPath = landingPathFragment({
@@ -824,7 +838,10 @@ export function createAuthRoutes(dispatcher, jwt, config) {
                 const status = result.error.httpStatus; // @cast-boundary engine-payload
                 return c.json({ isSuccess: false, error: result.error }, status);
             }
-            const data = result.data; // @cast-boundary engine-payload
+            // @cast-boundary engine-payload — same three-shape union as invite-accept-with-login
+            const data = result.data;
+            if (data.kind !== "auth-session")
+                return pendingMfaStepResponse(c, data);
             const token = await mintSessionAndRespond(c, data.session);
             const landingPath = landingPathFragment({
                 flow: "invite",
@@ -982,6 +999,9 @@ export function createAuthRoutes(dispatcher, jwt, config) {
         // membership role that a projection rebuild resurrected past command-time
         // validation (see engine/membership-roles).
         const mergedRoles = buildSessionRoles(globalRoles, membership.roles);
+        const pendingMfaStep = await switchTenantMfaGateResponse(c, user, targetTenantId);
+        if (pendingMfaStep !== undefined)
+            return pendingMfaStep;
         const targetSession = {
             id: user.id,
             tenantId: targetTenantId,
@@ -1008,6 +1028,16 @@ export function createAuthRoutes(dispatcher, jwt, config) {
     });
     return api;
 }
+function pendingMfaStepResponse(c, step) {
+    if (step.kind === "mfa-setup-required") {
+        return c.json({
+            isSuccess: true,
+            mfaSetupRequired: true,
+            preauthSetupToken: step.preauthSetupToken,
+        });
+    }
+    return c.json({ isSuccess: true, mfaRequired: true, challengeToken: step.challengeToken });
+}
 // --- shared route builders for token flows ---------------------------------
 // Password-reset, email-verification and signup share the exact same request
 // HTTP-shape: parse body → dispatch the request handler → always-200 (no

package/dist/crypto/system-event-pii.d.ts

@@ -1,4 +1,6 @@
 import type { EventPiiStance } from "@cosmicdrift/kumiko-types/handlers";
 export declare const SYSTEM_EVENT_PREFIX = "kumiko:system:";
 export declare const AGGREGATE_TRANSFERRED_EVENT_TYPE = "kumiko:system:aggregate.transferred";
+export declare const APP_STARTED_EVENT_TYPE = "kumiko:system:app.started";
+export declare const APP_INSTANCE_STREAM_TYPE = "app-instance";
 export declare const SYSTEM_EVENT_PII_STANCES: ReadonlyMap<string, EventPiiStance>;

package/dist/crypto/system-event-pii.js

@@ -8,6 +8,9 @@ export const SYSTEM_EVENT_PREFIX = "kumiko:system:";
 // Lives here (not in event-store/transfer.ts) so this module stays free of
 // an event-store import cycle; transfer.ts re-exports it.
 export const AGGREGATE_TRANSFERRED_EVENT_TYPE = `${SYSTEM_EVENT_PREFIX}aggregate.transferred`;
+// Payload is version/commit/pod name/start time — no personal data.
+export const APP_STARTED_EVENT_TYPE = `${SYSTEM_EVENT_PREFIX}app.started`;
+export const APP_INSTANCE_STREAM_TYPE = "app-instance";
 const SELF = { personal: "self" };
 // Workflow run-stream payloads carry references and step bookkeeping only,
 // never a copy of a foreign event payload, so "none" leaves nothing to shred.
@@ -27,6 +30,7 @@ export const SYSTEM_EVENT_PII_STANCES = new Map([
     [STEP_DISPATCHED_TYPE, "none"],
     [STEP_DISPATCH_FAILED_TYPE, "none"],
     [AGGREGATE_TRANSFERRED_EVENT_TYPE, "none"],
+    [APP_STARTED_EVENT_TYPE, "none"],
     [WORKFLOW_WAITING_TYPE, "none"],
     [WORKFLOW_WAITING_FOR_EVENT_TYPE, "none"],
     [WORKFLOW_RESUMED_TYPE, "none"],

package/dist/db/tenant-db.js

@@ -12,10 +12,12 @@ const declaredUnsafeRawRunners = new WeakMap();
 // TenantDb it was handed for its gate. Bound inside createTenantDb so rebound instances
 // (withUnsafeRawGrant, acknowledgeConventionCrossTenant) carry it too.
 const personalDataGates = new WeakMap();
-// Lets createTenantDb(ctx.db.unsafeRaw(), ...) inherit the gate. Keyed by a
-// per-grant proxy, never the shared pool/tx: tagging that would gate every sibling TenantDb.
+// Lets createTenantDb(ctx.db.unsafeRaw(), ...) inherit the gate and the projection registry.
+// Keyed by a per-grant proxy, never the shared pool/tx: tagging that would leak onto every sibling TenantDb.
 const runnerPersonalDataGates = new WeakMap();
-function gatedRunner(runner, gate, projectionRegistry) {
+function boundRunner(runner, gate, projectionRegistry) {
+    if (!gate && !projectionRegistry)
+        return runner;
     const proxy = new Proxy(runner, {
         // Tagged-template calls need the real driver object as `this`.
         apply(target, _thisArg, args) {
@@ -34,7 +36,7 @@ function gatedRunner(runner, gate, projectionRegistry) {
                     }
                     const gatedArgs = [
                         ...args.slice(0, -1),
-                        (tx) => callback(gatedRunner(tx, gate, projectionRegistry)),
+                        (tx) => callback(boundRunner(tx, gate, projectionRegistry)),
                     ];
                     return Reflect.apply(value, target, gatedArgs);
                 };
@@ -43,7 +45,8 @@ function gatedRunner(runner, gate, projectionRegistry) {
         },
         // @cast-boundary proxy-erasure — Proxy<object> re-tags as the wrapped DbRunner shape.
     });
-    runnerPersonalDataGates.set(proxy, gate);
+    if (gate)
+        runnerPersonalDataGates.set(proxy, gate);
     if (projectionRegistry)
         bindProjectionRegistry(proxy, projectionRegistry);
     return proxy;
@@ -121,10 +124,7 @@ function buildUncheckedSystemDb(db, dbOutsideTransaction, report, gate) {
         // Engine-forwarded steps carry their own declared reason; a caller-supplied one never reaches the audit trail.
         report("unsafe-raw", forwardedDeclaredStep ? reason : (gate?.grant?.reason ?? reason));
         const runner = tenantDbRunner(db);
-        const personalDataGate = personalDataGates.get(db);
-        return personalDataGate
-            ? gatedRunner(runner, personalDataGate, projectionRegistryOf(db))
-            : runner;
+        return boundRunner(runner, personalDataGates.get(db), projectionRegistryOf(db));
     }
     const uncheckedSystemDb = {
         [SYSTEM_SCOPE_CHECK_BRAND]: true,
@@ -456,7 +456,7 @@ export function createTenantDb(db, tenantId, mode = "tenant", tracer, meter, sig
         }
         // Engine-forwarded steps carry their own declared reason; otherwise the grant's reason is audited.
         report("unsafe-raw", declaredStepReason ?? grants?.unsafeRaw?.reason ?? "");
-        return personalDataGate ? gatedRunner(db, personalDataGate, projectionRegistry) : db;
+        return boundRunner(db, personalDataGate, projectionRegistry);
     }
     const tenantDb = {
         tenantId,

package/dist/event-store/index.d.ts

@@ -1,3 +1,4 @@
+export { APP_INSTANCE_STREAM_TYPE, APP_STARTED_EVENT_TYPE } from "../crypto/system-event-pii.js";
 export { backfillEventPiiEncryption, backfillEventPiiEncryptionBatch, type PiiBackfillBatchOptions, type PiiBackfillBatchResult, type PiiBackfillFailure, type PiiBackfillOptions, type PiiBackfillResult, type PiiBackfillScanCache, } from "../db/queries/backfill-pii.js";
 export { type ArchiveStreamArgs, archivedStreamsTable, archiveStream, createArchivedStreamsTable, isStreamArchived, restoreStream, } from "./archive.js";
 export { ArchivedStreamError, IdempotentAppendConflictError, VersionConflictError, } from "./errors.js";

package/dist/event-store/index.js

@@ -1,3 +1,4 @@
+export { APP_INSTANCE_STREAM_TYPE, APP_STARTED_EVENT_TYPE } from "../crypto/system-event-pii.js";
 export { backfillEventPiiEncryption, backfillEventPiiEncryptionBatch, } from "../db/queries/backfill-pii.js";
 export { archivedStreamsTable, archiveStream, createArchivedStreamsTable, isStreamArchived, restoreStream, } from "./archive.js";
 export { ArchivedStreamError, IdempotentAppendConflictError, VersionConflictError, } from "./errors.js";

package/dist/files/file-routes.js

@@ -86,15 +86,17 @@ export function createFileRoutes(options) {
     const { db } = options;
     const privilegedRoles = options.privilegedRoles ?? DEFAULT_PRIVILEGED_ROLES;
     const guard = options.accessGuard ?? createDefaultGuard(privilegedRoles);
-    // Standard entity executor for fileRef — self-contained (table + entity),
-    // no registry needed. create/delete emit fileRef.created/deleted and write
-    // file_refs via applyEntityEvent in one tx (read-your-own-write), exactly
-    // like any other entity's lifecycle.
+    // Standard entity executor for fileRef — self-contained (table + entity).
+    // create/delete emit fileRef.created/deleted and write file_refs via
+    // applyEntityEvent in one tx (read-your-own-write), exactly like any other
+    // entity's lifecycle. The registry only feeds custom projections on those events.
     const executor = createEventStoreExecutor(fileRefsTable, fileRefEntity, {
         entityName: "fileRef",
     });
     const piiSubjectFields = collectPiiSubjectFields(fileRefEntity);
     const api = new Hono();
+    const projectionGrants = options.registry ? { projectionRegistry: options.registry } : undefined;
+    const tenantDbFor = (tenantId) => createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, projectionGrants);
     function kmsContextFor() {
         return { requestId: requestContext.get()?.requestId ?? "file-routes" };
     }
@@ -227,7 +229,7 @@ export function createFileRoutes(options) {
             entityType: entityType ?? null,
             entityId: entityId ?? null,
             fieldName: fieldName ?? null,
-        }, user, createTenantDb(db, user.tenantId));
+        }, user, tenantDbFor(user.tenantId));
         if (!result.isSuccess) {
             return c.json({ error: "upload_failed" }, 500);
         }
@@ -350,7 +352,7 @@ export function createFileRoutes(options) {
         // erasure of row + binary is the job of the forget-flow (Art. 17) and the
         // generic data-retention cleanup — same lifecycle as any soft-delete
         // entity, not a files-specific path.
-        const result = await executor.delete({ id }, user, createTenantDb(db, user.tenantId));
+        const result = await executor.delete({ id }, user, tenantDbFor(user.tenantId));
         if (!result.isSuccess) {
             // NotFound (race between guard and executor) reuses the 404-masking
             // pattern from the access-deny path above. Everything else (version
@@ -414,7 +416,7 @@ export function createFileRoutes(options) {
         // id shape before it hits the UUID column.
         if (!isUuid(id))
             return c.json({ error: "not_found" }, 404);
-        const row = await executor.detail({ id }, user, createTenantDb(db, user.tenantId));
+        const row = await executor.detail({ id }, user, tenantDbFor(user.tenantId));
         if (!row)
             return c.json({ error: "not_found" }, 404);
         const fileRef = row; // @cast-boundary db-row (decrypted via executor.detail)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.344.0",
+  "version": "0.345.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -206,8 +206,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.344.0",
-    "@cosmicdrift/kumiko-types": "0.344.0",
+    "@cosmicdrift/kumiko-http": "0.345.0",
+    "@cosmicdrift/kumiko-types": "0.345.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -223,7 +223,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.344.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.345.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.345.0",
+    "type": "fix",
+    "title": "TenantDbs built from unsafeRaw() and file routes run custom projections",
+    "detail": "A TenantDb rebuilt from `unsafeRaw()` runs custom projections again\n`ctx.db.unsafeRaw()` used to return the bare connection unless a public-intake gate was active. A `createTenantDb(ctx.db.unsafeRaw(), …)` inside a handler, hook or job therefore lost the projection registry, and its writes skipped custom projections. `unsafeRaw()` now returns a runner bound to the registry (and the gate, if any) whenever one is present. The file routes pass the app registry to their TenantDbs, so file events reach custom projections as well.",
+    "migration": "`unsafeRaw()` on a dispatcher or job TenantDb now returns a proxy instead of the raw connection object. Code that compares the runner by identity with the raw connection must compare against the proxy instead. Standalone seeds that call createTenantDb on a raw connection still have no registry; seed through dispatcher.write. Code that re-ran custom projections by hand after such a write (on a reloaded event, not the returned one) must drop that call, or the projection applies twice. File upload and delete now run custom projections on fileRef events inside the same transaction, so a failing projection rolls the upload back like for any other entity."
+  },
   {
     "version": "0.343.0",
     "type": "breaking",