@cosmicdrift/kumiko-framework 0.385.0 → 0.387.0

package/src/changes.json

@@ -1,4 +1,58 @@
 [
+  {
+    "version": "0.387.0",
+    "type": "improvement",
+    "title": "English source comments without issue references in bundled-features",
+    "detail": "Comments in bundled-features are translated to English, and issue numbers and planning labels are removed while the reason they stood for stays. Pure paraphrases of the code are dropped. No code changes."
+  },
+  {
+    "version": "0.387.0",
+    "type": "improvement",
+    "title": "English source comments without issue references in the framework package",
+    "detail": "Comments in packages/framework are translated to English, and issue numbers and planning labels are removed while the reason they stood for stays. Pure paraphrases of the code are dropped. The ZIP entry path doc now states the UTF-8 flag the writer actually sets. No code changes."
+  },
+  {
+    "version": "0.387.0",
+    "type": "improvement",
+    "title": "English source comments without issue references in the renderer",
+    "detail": "Comments in the renderer are translated to English, and issue numbers and planning labels are removed while the reason they stood for stays. Pure paraphrases of the code are dropped. No code changes; the generated widget reference (agents/widgets.md) follows the translated JSDoc."
+  },
+  {
+    "version": "0.387.0",
+    "type": "improvement",
+    "title": "English source comments without issue references in the smaller packages",
+    "detail": "Comments in types, server-runtime, dev-server, guards, testing, cli, create-kumiko-app and renderer-mail-html are translated to English, and issue numbers and planning labels are removed while the reason they stood for stays. Pure paraphrases of the code are dropped. No code changes; the comment-language baseline is lowered accordingly."
+  },
+  {
+    "version": "0.387.0",
+    "type": "fix",
+    "title": "Runtime log lines go through the process logger",
+    "detail": "Modules that wrote to console now use createFallbackLogger, so once setProcessLogger is wired their lines reach the configured logger with namespace and structured fields; before that they still fall back to console. createFallbackLogger gained an info method. The `[kumiko]` prefix now comes from the logger namespace, errors travel as structured fields, and the non-JSON-safe schema assertion in buildAppSchema logs the offending path instead of the whole schema. In production the boot warnings arrive as pino JSON with a `component` field (set by the process-logger child or by `context.log.child({ component })`) instead of `[kumiko:boot]` plain text. The KEK source, the seed migration and \"idle pre-check recovered\" lines are logged at `info`. An app that sets its own `extraContext.log` receives the boot and event-dispatcher warnings in that logger."
+  },
+  {
+    "version": "0.387.0",
+    "type": "improvement",
+    "title": "MIT License for all public packages",
+    "detail": "Every @cosmicdrift package and create-kumiko-app are published under MIT instead of BUSL-1.1, so hosting and platform use no longer need a commercial agreement. Earlier releases keep their BUSL-1.1 terms."
+  },
+  {
+    "version": "0.387.0",
+    "type": "fix",
+    "title": "Fewer unchecked casts, runtime checks at boundaries",
+    "detail": "bridgeStub needs no casts, the db dialect types drop any (TableColumns is SchemaTable, SelectQuery is unknown). Malformed input now fails at the boundary instead of later, for example a step that returns a non-WriteResult as the pipeline result, a non-numeric Redis counter in the login rate limiter, or r.useExtension, r.referenceData, r.job, r.notification, r.metric, r.secret, r.secretNamespace, r.claimKey and r.relation called without their required argument. Snapshot.generatedAt is optional, so snapshots written without it still load. The cast baseline is rewritten so new suspect casts in a file fail the As-Casts Audit."
+  },
+  {
+    "version": "0.387.0",
+    "type": "fix",
+    "title": "Fail-closed projection allowlist walk, cleaner fallback log lines",
+    "detail": "createFallbackLogger no longer prints a trailing `undefined` when a log call carries no data. The step walker shared by the projection allowlist check and the workflow event-trigger registration now aborts with path and index when a sub-step list holds an entry that is not a step, instead of skipping it. The `unknown` overload of `runInSavepoint` hands its callback a `DbRunner`. Log lines drop doubled namespace prefixes, and the remaining errors in eager-load, the event store and the token request route travel as structured fields."
+  },
+  {
+    "version": "0.386.0",
+    "type": "improvement",
+    "title": "ctx.crossTenantReads for handlers with the crossTenantReads grant",
+    "detail": "A handler whose `escapeHatch` lists `grants: [\"crossTenantReads\"]` (or `unsafeRaw`, which implies it) gets `ctx.crossTenantReads` with `selectMany`, `fetchOne` and `count`, unfiltered by tenant and including the events table. Every call is audited as `cross-tenant-read`; `ctx.db.unsafeRaw()` stays denied for the read-only grant, and neither a member-resolution read nor an agent tool call (`dispatchToolCall`, including handlers it reaches through nested `ctx.query`/`ctx.write`) ever receives the surface, so cross-tenant rows cannot reach an LLM context. Jobs use the same grant. The internal `runAsDirectCallEntry` (`/internal/request-context`) now also marks its scope as an agent tool call. Without the grant nothing changes."
+  },
   {
     "version": "0.385.0",
     "type": "improvement",

package/src/scripts/codemod/crypto-shredding-testing-move.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 // Rewrites `import { resetPiiSubjectKmsForTests, resetBlindIndexKeyForTests }
 // from "@cosmicdrift/kumiko-framework/crypto"` to import both names from
-// "@cosmicdrift/kumiko-framework/testing" instead (fw#1631). Only the
+// "@cosmicdrift/kumiko-framework/testing" instead. Only the
 // package barrel specifier is rewritten — relative deep-imports of the
 // defining module are left untouched, per the changes.json migration note.
 // Idempotent: an already-migrated file has nothing left to move.
@@ -21,7 +21,7 @@ const EXCLUDE_DIRS = new Set(["node_modules", "dist", "build"]);
 function findTargetFiles(rootDir: string): string[] {
   // Walk the tree and skip excluded dirs while descending — filtering the
   // absolute path after a full Glob scan silently no-ops when the repo root
-  // itself contains "/build/" or "/node_modules/" (fw#2289).
+  // itself contains "/build/" or "/node_modules/".
   const files: string[] = [];
   const walk = (dir: string): void => {
     let entries: Dirent[];

package/src/scripts/codemod/migrate-cross-tenant.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 // migrate-cross-tenant — rewrites `crossTenant: true` on entity-convention
 // handlers to `escapeHatch: { reason }` where the handler name and verb can
-// be derived from the call, and reports every other site for review (fw#2915).
+// be derived from the call, and reports every other site for review.
 //
 // Usage:
 //   bun scripts/codemod/migrate-cross-tenant.ts [--dry-run] <path...>

package/src/scripts/codemod/migrate-open-to-all.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 // migrate-open-to-all — rewrites deprecated `openToAll: true` to the required
 // `{ reason }` form in test files, and reports every remaining non-test site
-// for a human to pick a reason (fw#2858).
+// for a human to pick a reason.
 //
 // Usage:
 //   bun scripts/codemod/migrate-open-to-all.ts [--dry-run] [--test-reason "<text>"] <path...>

package/src/scripts/codemod/pii-personal-migration.ts

@@ -1,9 +1,9 @@
 #!/usr/bin/env bun
 // Migrates create*Field(...) calls from the old flag-based PII API (pii,
 // userOwned, tenantOwned, subjectRef, allowPlaintext, lookupable,
-// searchable, sensitive) to the author-facing personal/find API
-// (kumiko-framework#2250). Idempotent — re-running is a no-op on already
-// migrated fields (skipped once a `personal` property is present).
+// searchable, sensitive) to the author-facing personal/find API.
+// Idempotent — re-running is a no-op on already migrated fields (skipped once
+// a `personal` property is present).
 //
 // Mapping table (exact):
 //   pii: true                           -> personal: "self"
@@ -87,7 +87,16 @@ const OVERRIDES_ARG_INDEX_1 = new Set(["createEmbeddedField", "createEmbeddedLis
 const FIELD_FACTORY_RE = /^create\w*Field$/;
 
 type ReportEntry = { readonly file: string; readonly line: number; readonly note: string };
-type FindBucket = "exact" | "fuzzy" | "none" | "secret" | "ref" | "personal-false" | "no-find";
+const FIND_BUCKETS = [
+  "exact",
+  "fuzzy",
+  "none",
+  "secret",
+  "ref",
+  "personal-false",
+  "no-find",
+] as const;
+type FindBucket = (typeof FIND_BUCKETS)[number];
 
 const reports: ReportEntry[] = [];
 const newLookupableSites: ReportEntry[] = [];
@@ -411,7 +420,9 @@ function applyTransform(
   const removedSet = new Set<PropertyAssignment>(removedProps);
   let insertIndex = 0;
   for (let i = 0; i < anchorIndex; i++) {
-    if (!removedSet.has(properties[i] as PropertyAssignment)) insertIndex++;
+    const property = properties[i];
+    if (!(property && Node.isPropertyAssignment(property) && removedSet.has(property)))
+      insertIndex++;
   }
 
   for (const p of removedProps) p.remove();
@@ -746,9 +757,7 @@ async function main(): Promise<void> {
 
     const countsBefore = { ...counts };
     for (const { name, objArg } of calls) processObjectLiteral(objArg, name);
-    const changed = (Object.keys(counts) as FindBucket[]).some(
-      (k) => counts[k] !== countsBefore[k],
-    );
+    const changed = FIND_BUCKETS.some((k) => counts[k] !== countsBefore[k]);
 
     if (changed) {
       touchedFiles++;

package/src/scripts/codemod/unprocessable-error-details-reason.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-// `UnprocessableOpts.details` was tightened (fw#2460) to `& { readonly reason?:
+// `UnprocessableOpts.details` was tightened to `& { readonly reason?:
 // never }` — `reason` is owned exclusively by the ctor's first positional
 // argument, which already folds it into `details` internally
 // (`{ ...opts?.details, reason }`). Any consumer that ALSO puts `reason`
@@ -26,7 +26,7 @@ const KUMIKO_MODULE_RE = /^@cosmicdrift\/kumiko-/;
 function findTargetFiles(rootDir: string): string[] {
   // Walk the tree and skip excluded dirs while descending — filtering the
   // absolute path after a full scan silently no-ops when the repo root
-  // itself contains "/build/" or "/node_modules/" (fw#2289).
+  // itself contains "/build/" or "/node_modules/."
   const files: string[] = [];
   const walk = (dir: string): void => {
     let entries: Dirent[];