@cosmicdrift/kumiko-framework 0.83.0 → 0.85.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.83.0",
+  "version": "0.85.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -181,7 +181,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.83.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.85.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/engine/__tests__/boot-validator-gdpr-storage.test.ts

@@ -1,9 +1,14 @@
 // V1 — GDPR storage-persistence boot guard. Catches the prod failure class:
 // user-data-rights mounted but exports land in an ephemeral / missing store,
 // and s3-env selected as the GDPR store without its env vars set.
+// V2 — export-without-erase guard. Catches features that register an export
+// hook but no delete hook (Art.17 violation).
 
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
-import { validateGdprStoragePersistence } from "../boot-validator/gdpr-storage";
+import {
+  validateGdprHookCompleteness,
+  validateGdprStoragePersistence,
+} from "../boot-validator/gdpr-storage";
 import { defineFeature } from "../define-feature";
 
 const udr = () => defineFeature("user-data-rights", () => {});
@@ -72,3 +77,66 @@ describe("validateGdprStoragePersistence (V1)", () => {
     expect(warnSpy).not.toHaveBeenCalled();
   });
 });
+
+describe("validateGdprHookCompleteness (V2)", () => {
+  let warnSpy: ReturnType<typeof spyOn>;
+
+  beforeEach(() => {
+    warnSpy = spyOn(console, "warn").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  const exportFn = async () => null;
+  const deleteFn = async () => {};
+
+  test("export + delete hooks → no warn", () => {
+    const f = defineFeature("my-feature", (r) => {
+      r.useExtension("userData", "myEntity", { export: exportFn, delete: deleteFn });
+    });
+    validateGdprHookCompleteness([f]);
+    expect(warnSpy).not.toHaveBeenCalled();
+  });
+
+  test("export hook without delete hook → Art.17 warn", () => {
+    const f = defineFeature("my-feature", (r) => {
+      r.useExtension("userData", "myEntity", { export: exportFn });
+    });
+    validateGdprHookCompleteness([f]);
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const msg = String(warnSpy.mock.calls[0]?.[0]);
+    expect(msg).toContain("my-feature");
+    expect(msg).toContain("myEntity");
+    expect(msg).toContain("Art.17");
+  });
+
+  test("delete hook only (no export) → no warn", () => {
+    const f = defineFeature("my-feature", (r) => {
+      r.useExtension("userData", "myEntity", { delete: deleteFn });
+    });
+    validateGdprHookCompleteness([f]);
+    expect(warnSpy).not.toHaveBeenCalled();
+  });
+
+  test("no EXT_USER_DATA hooks at all → no warn", () => {
+    const f = defineFeature("my-feature", (r) => {
+      r.useExtension("fileProvider", "s3");
+    });
+    validateGdprHookCompleteness([f]);
+    expect(warnSpy).not.toHaveBeenCalled();
+  });
+
+  test("multiple features, one missing delete → one warn per missing hook", () => {
+    const good = defineFeature("good", (r) => {
+      r.useExtension("userData", "entityA", { export: exportFn, delete: deleteFn });
+    });
+    const bad = defineFeature("bad", (r) => {
+      r.useExtension("userData", "entityB", { export: exportFn });
+    });
+    validateGdprHookCompleteness([good, bad]);
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    expect(String(warnSpy.mock.calls[0]?.[0])).toContain("entityB");
+  });
+});

package/src/engine/__tests__/build-config-feature-schema.test.ts

@@ -220,8 +220,7 @@ describe("buildConfigFeatureSchema — machine-role does not leak into screen ac
   test("a key with write ['system','SystemAdmin'] yields a SystemAdmin-only screen (no 'system')", () => {
     const s = buildConfigFeatureSchema(createRegistry([mixedWrite]));
     const screen = s.screens.find((x) => x.id === "mixed-system");
-    if (!screen || screen.type !== "configEdit")
-      throw new Error("no mixed-system configEdit screen");
+    if (screen?.type !== "configEdit") throw new Error("no mixed-system configEdit screen");
     expect(screen.access).toEqual({ roles: ["SystemAdmin"] });
     const roles = screen.access && "roles" in screen.access ? screen.access.roles : [];
     expect(roles).not.toContain("system");

package/src/engine/boot-validator/gdpr-storage.ts

@@ -57,3 +57,23 @@ export function validateGdprStoragePersistence(features: readonly FeatureDefinit
     }
   }
 }
+
+// V2: export-without-erase guard. A feature that registers an EXT_USER_DATA
+// export hook without a matching delete hook exports data under Art.20 but
+// never erases it on forget — an Art.17 violation. Registry-level signal only;
+// runtime no-ops (a delete hook that silently skips) are not detectable here.
+export function validateGdprHookCompleteness(features: readonly FeatureDefinition[]): void {
+  for (const feature of features) {
+    for (const usage of feature.extensionUsages) {
+      if (usage.extensionName !== "userData") continue;
+      const hasExport = typeof usage.options?.["export"] === "function";
+      const hasDelete = typeof usage.options?.["delete"] === "function";
+      if (hasExport && !hasDelete) {
+        // biome-ignore lint/suspicious/noConsole: boot-time dev hint, no logger available yet
+        console.warn(
+          `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 risk). Add a delete hook, or a no-op with a comment explaining why erasure is intentionally skipped.`,
+        );
+      }
+    }
+  }
+}

package/src/engine/boot-validator/index.ts

@@ -25,7 +25,7 @@ import {
   validateReferenceFields,
   validateTransitions,
 } from "./entity-handler";
-import { validateGdprStoragePersistence } from "./gdpr-storage";
+import { validateGdprHookCompleteness, validateGdprStoragePersistence } from "./gdpr-storage";
 import { validateOwnershipRules } from "./ownership";
 import { validatePiiAndRetention } from "./pii-retention";
 import {
@@ -162,6 +162,7 @@ export function validateBoot(features: readonly FeatureDefinition[]): void {
   validateDefaultWorkspaceUniqueness(allWorkspaceQns);
   validateExtensionPreSaveWiring(features);
   validateGdprStoragePersistence(features);
+  validateGdprHookCompleteness(features);
 
   if (hasEncryptedFields && !process.env["ENCRYPTION_KEY"]) {
     throw new Error("ENCRYPTION_KEY environment variable is required (encrypted fields in use)");