@cosmicdrift/kumiko-framework 0.351.0 → 0.353.0

package/dist/pipeline/pre-transaction-reservations.d.ts

@@ -1,12 +1,20 @@
+import type { ReservationHandle } from "@cosmicdrift/kumiko-types/handlers";
 import type { SessionUser } from "../engine/types/index.js";
 import { type WriteErrorInfo } from "../errors/index.js";
 import type { BatchCommand, DispatchContext } from "./dispatch-shared.js";
 import type { WriteOrigin } from "./write-origin.js";
-export declare function runAsCommand<T>(reservedType: string | undefined, fn: () => Promise<T>): Promise<T>;
-export declare function consumeReservation(type: string): boolean;
+type ReservationConfirm = ReservationHandle["confirmInTransaction"];
+export type ConsumedReservation = {
+    readonly confirmInTransaction: ReservationConfirm | undefined;
+};
+export declare function runAsCommand<T>(reserved: {
+    readonly type: string;
+    readonly reservation: ConsumedReservation;
+} | undefined, fn: () => Promise<T>): Promise<T>;
+export declare function consumeReservation(type: string): ConsumedReservation | undefined;
 export type PreTransactionReservations = {
     readonly isSuccess: true;
-    readonly reservedIndexes: ReadonlySet<number>;
+    readonly reservedCommands: ReadonlyMap<number, ConsumedReservation>;
     releaseAll(): Promise<void>;
 } | {
     readonly isSuccess: false;
@@ -14,3 +22,4 @@ export type PreTransactionReservations = {
     readonly failedIndex: number;
 };
 export declare function reserveBeforeTransaction(ctx: DispatchContext, commands: readonly BatchCommand[], user: SessionUser, inheritedOrigin: WriteOrigin | undefined): Promise<PreTransactionReservations>;
+export {};

package/dist/pipeline/pre-transaction-reservations.js

@@ -1,19 +1,33 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-import { hasAccess } from "../engine/access.js";
 import { toWriteErrorInfo } from "../errors/index.js";
 import { createFallbackLogger } from "../logging/utils.js";
-import { buildHandlerContext, checkFeatureEnabled, isMemberResolutionPrincipal, } from "./dispatch-shared.js";
+import { buildHandlerContext, isMemberResolutionPrincipal } from "./dispatch-shared.js";
 import { wrapToKumiko } from "./dispatcher-utils.js";
+import { runPreHandlerGates } from "./pre-handler-gates.js";
 import { effectiveWriteOrigin, rootWriteOrigin } from "./write-origin.js";
 // One-shot permission per top-level command: the handler that reserved before the transaction
 // consumes it on entry. A capped handler reached any other way (nested ctx.write, writeAs, a
 // second execution of the same type) finds it spent and is rejected instead of running unreserved.
 const reservedForCommand = new AsyncLocalStorage();
-export function runAsCommand(reservedType, fn) {
-    return reservedForCommand.run(new Set(reservedType === undefined ? [] : [reservedType]), fn);
+export function runAsCommand(reserved, fn) {
+    const store = new Map();
+    if (reserved)
+        store.set(reserved.type, reserved.reservation);
+    return reservedForCommand.run(store, fn);
 }
 export function consumeReservation(type) {
-    return reservedForCommand.getStore()?.delete(type) === true;
+    const store = reservedForCommand.getStore();
+    const reservation = store?.get(type);
+    store?.delete(type);
+    return reservation;
+}
+function toReservationHandle(taken) {
+    if (taken === undefined)
+        return undefined;
+    if (typeof taken === "function") {
+        return { release: taken, confirmInTransaction: async () => { } };
+    }
+    return taken;
 }
 async function releaseAll(ctx, releases) {
     const log = createFallbackLogger("dispatcher", ctx.appContext.log);
@@ -26,36 +40,35 @@ async function releaseAll(ctx, releases) {
         }
     }
 }
-// Same phase as the access/schema gates but before any transaction: a caller who would be denied
-// or sends an invalid payload never reserves anything.
+// Same gates as the in-transaction run, but before any transaction: a caller who is rate limited,
+// denied or sends an invalid payload never reserves anything, so a rejected request cannot consume
+// capacity or trigger the reservation's side effects.
 export async function reserveBeforeTransaction(ctx, commands, user, inheritedOrigin) {
     const releases = [];
-    const reservedIndexes = new Set();
+    const reservedCommands = new Map();
     if (isMemberResolutionPrincipal(user))
-        return { isSuccess: true, reservedIndexes, releaseAll: async () => { } };
+        return { isSuccess: true, reservedCommands, releaseAll: async () => { } };
     for (const [index, command] of commands.entries()) {
         try {
             const handler = ctx.registry.getWriteHandler(command.type);
             if (!handler?.reserveBeforeTransaction)
                 continue;
-            if (!hasAccess(user, handler.access))
-                continue;
-            if (await checkFeatureEnabled(ctx, command.type, user.tenantId))
-                continue;
-            const parsed = handler.schema.safeParse(command.payload);
-            if (!parsed.success)
-                continue;
+            const gates = await runPreHandlerGates(ctx, handler, command.type, command.payload, user, "charge");
+            if (!gates.isSuccess) {
+                await releaseAll(ctx, releases);
+                return { isSuccess: false, error: gates.error, failedIndex: index };
+            }
             const origin = effectiveWriteOrigin(rootWriteOrigin(ctx.registry, command.type, user), inheritedOrigin);
             const handlerContext = await buildHandlerContext(ctx, command.type, user, origin);
-            const release = await handler.reserveBeforeTransaction({ type: command.type, payload: parsed.data, user }, handlerContext);
-            if (release)
-                releases.push(release);
-            reservedIndexes.add(index);
+            const handle = toReservationHandle(await handler.reserveBeforeTransaction({ type: command.type, payload: gates.payload, user }, handlerContext));
+            if (handle)
+                releases.push(handle.release);
+            reservedCommands.set(index, { confirmInTransaction: handle?.confirmInTransaction });
         }
         catch (error) {
             await releaseAll(ctx, releases);
             return { isSuccess: false, error: toWriteErrorInfo(wrapToKumiko(error)), failedIndex: index };
         }
     }
-    return { isSuccess: true, reservedIndexes, releaseAll: () => releaseAll(ctx, releases) };
+    return { isSuccess: true, reservedCommands, releaseAll: () => releaseAll(ctx, releases) };
 }

package/dist/testing/shared-entities.d.ts

@@ -3,6 +3,7 @@ export declare const sharedWidgetEntity: import("@cosmicdrift/kumiko-types/field
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const sharedWidgetTable: import("../db/table-builder.js").EntityT
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -49,6 +51,7 @@ export declare const sharedUserEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -70,6 +73,7 @@ export declare const sharedUserEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -91,6 +95,7 @@ export declare const sharedUserEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -117,6 +122,7 @@ export declare const sharedUserTable: import("../db/table-builder.js").EntityTab
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -138,6 +144,7 @@ export declare const sharedUserTable: import("../db/table-builder.js").EntityTab
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -159,6 +166,7 @@ export declare const sharedUserTable: import("../db/table-builder.js").EntityTab
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -185,6 +193,7 @@ export declare const sharedItemEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -227,6 +236,7 @@ export declare const sharedItemTable: import("../db/table-builder.js").EntityTab
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.351.0",
+  "version": "0.353.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -206,8 +206,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.351.0",
-    "@cosmicdrift/kumiko-types": "0.351.0",
+    "@cosmicdrift/kumiko-http": "0.353.0",
+    "@cosmicdrift/kumiko-types": "0.353.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -223,7 +223,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.351.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.353.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,61 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "improvement",
+    "title": "Boot validation rejects public-intake handlers without rate limit and serial-id unmanaged entities with recordOwned fields",
+    "detail": "Boot validation rejects `personalData: \"public-intake\"` handlers with `rateLimit: { disabled: true }` and unmanaged `idType: \"serial\"` entities with `recordOwned` fields\nBoth combinations were silently accepted before: the first left an anonymous personal-data write without its only abuse protection, the second produced record-owned ciphertext that `forgetSubject` can never shred."
+  },
+  {
+    "version": "0.353.0",
+    "type": "improvement",
+    "title": "r.crud accepts per-verb agent hints and dedupeFeatures no longer drops a same-named feature that registers different handlers",
+    "detail": "`r.crud` takes per-verb `agents` hints, and same-named features only dedupe when their registered surface matches\n`registerEntityCrud` accepts `agents: { delete: { risk: \"high\" } }` so one irreversible verb can be raised without raising create/update. `dedupeFeatures` additionally requires equal entity and handler key sets before collapsing two same-named features with equal `dedupeOptions`; otherwise it throws the existing duplicate-feature error instead of silently dropping the second one. `i18nKey()` marks live on a `globalThis` registry so two installed framework copies agree."
+  },
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Event piiFields reject owner field \"id\" instead of encrypting under a phantom user key",
+    "detail": "`defineEvent` rejects `personal: { of: \"id\" }` in `piiFields` at boot\nOn entities `of: \"id\"` means record-owned, but on events it encrypted under a user key named after the payload id, which a forget never reaches, so crypto-shredding silently did nothing. Declare a record-owned event field with `personal: \"self\"` instead."
+  },
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Webhook signature 401 hides verify() error details; boot rejects silently dropped drawer prefills, colliding secret field ids and unlintable where-rule tables",
+    "detail": "Signature extra routes no longer return the verify() error text in the 401 body, drawer prefill and secret field ids fail at boot when they would silently misbehave\nA non-`ExtraRouteRejection` throw from a signature route's `verify()` now answers with the generic message \"signature verification failed\" and logs the detail server-side. Boot now rejects a drawer `params` prefill that targets a sensitive or password field or a field the target layout does not render, a secrets screen whose field ids collide across hyphenated feature names, and a where-rule subquery on a table whose column set cannot be derived."
+  },
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Unknown status tones fail boot and secretMint confirm actions respect role gating",
+    "detail": "Stricter boot checks and role projection for screens and handlers\nInline handler registration without `options.access` now throws immediately, a section with `fields: []` and `groups: []` fails boot, and unknown tones in `header.statusTones` or select `optionTones` fail boot instead of dropping the badge colour. The renderer falls back to the value heuristic for an unknown tone, and `statusToneForOptionTone` now returns `undefined` for it. `secretMint` confirm-step actions are stripped for roles that cannot see the target screen.\nEntity convention `create` handlers keep tenant-filtered lookups even when the handler declares `escapeHatch`/`crossTenant`. Duplicate `waitForEvent` steps on the same `awaits` event are rejected when the workflow pipeline is built. An empty `PROMETHEUS_METRICS_TOKEN` counts as unset instead of failing boot.\n`GET /api/sse` now closes itself when the JWT it was opened with expires. File uploads must attach to a registered file field (a non-file field answers 400 `unresolvable_field`), and a `.docx` upload must be a ZIP containing `word/` entries. Signature extra routes outside `/api` get the request-body cap (`maxRequestBytes`) before their body is read. `EXT_USER_DATA` registrations with neither an export nor a delete hook fail boot. The dashboard updated-at stamp follows live refetches and retries.\nText fields accept `minLength` (enforced by the generated write schema), `enumOption` renders array values per entry, list columns can opt out of sorting with `sortable: false`, and `BUILT_IN_MEMBERSHIP_ROLES` exposes the ranked membership roles. The PAT list translates its scopes column, MFA code fields enforce their minimum length, plan checkout no longer repeats the billing-enabled and active-subscription gates."
+  },
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "appendEventInTenantDb and getStreamVersionInTenantDb append and read stream versions through a TenantDb, optionally running inline projections",
+    "detail": "`appendEventInTenantDb` appends an event on a TenantDb's own connection or transaction\nFramework-side code that holds a `TenantDb` (for example inside `runInOwnTransaction`) could not append to the event store without a raw runner. `appendEventInTenantDb(tenantDb, event, { registry })` and `getStreamVersionInTenantDb(tenantDb, aggregateId)` from `@cosmicdrift/kumiko-framework/event-store` do it: the tenant is always the TenantDb's own, the append goes through `append()` (PII encryption, origin stamping), and with `registry` the inline projections run on the same runner."
+  },
+  {
+    "version": "0.352.0",
+    "type": "fix",
+    "title": "Rate-limited, denied or invalid callers no longer consume cap usage or trigger soft-warn, because pre-handler gates run before reserveBeforeTransaction"
+  },
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "reserveBeforeTransaction may return a ReservationHandle whose confirmInTransaction settles the reservation inside the handler transaction"
+  },
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "Seeds can find template rows with ctx.findTemplateResources",
+    "detail": "Seeds can replace a raw SELECT … FROM read_template_resources with ctx.findTemplateResources, which binds every filter value as a parameter."
+  },
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "Boot validation and the client schema cover select optionsAvailabilityQuery on entity and screen fields"
+  },
   {
     "version": "0.349.0",
     "type": "improvement",