@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/db/__tests__/implicit-projection-equivalence.integration.test.ts

@@ -15,7 +15,7 @@
 //   5. Snapshot erneut nehmen
 //   6. deep-equal: identische Rows in identischer Reihenfolge
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { createBooleanField, createEntity, createTextField, defineFeature } from "../../engine";
 import { createRegistry } from "../../engine/registry";
@@ -222,26 +222,33 @@ describe("implicit-projection / Live==Rebuild equivalence", () => {
   });
 });
 
-// Sensitive-Drift ist eine bekannte Welle-3-Lücke: das Event-Log strippt
-// sensitive-Felder VOR dem Append (GDPR-Annahme), die Live-Read-Tabelle
-// bekommt sie über den unstripped flatData, der Rebuild-Pfad nur den
-// stripped event.payload. Bei Schema-Rebuilds gehen sensitive Daten
-// verloren.
-//
-// Dieser Test pinst die Drift explizit: Live row hat das sensitive Feld,
-// Rebuild row hat NULL. Wenn Welle 3 das fixt (z.B. via separater
-// sensitive-Spalte oder verschlüsseltem Event-Payload), bricht der Test
-// und zwingt zu Aufmerksamkeit.
-
+// Sensitive-Rebuild-Parität (#967): das Event-Log trägt für sensitive-Felder
+// den Tabellen-Ciphertext (boot-validiert pii/encrypted) — Live==Rebuild gilt
+// damit auch für sensitive Spalten + Blind-Index. Einzige legitime Divergenz
+// bleibt Crypto-Shredding: DEK erased → bidx NULL, Wert unlesbar.
+
+import {
+  computeBlindIndex,
+  configureBlindIndexKey,
+  configurePiiSubjectKms,
+  decodeBlindIndexKey,
+  decryptPiiFieldValues,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "../../crypto";
 import { asRawClient, selectMany } from "../../db/query";
 
 const sensitiveTable = "read_implicit_sensitive_users";
+const SENSITIVE_BIDX_KEY_B64 = Buffer.alloc(32, 9).toString("base64");
+const SENSITIVE_BIDX_KEY = decodeBlindIndexKey(SENSITIVE_BIDX_KEY_B64);
 
 const sensitiveEntity = createEntity({
   table: sensitiveTable,
   fields: {
     email: createTextField({ required: true }),
-    apiKey: createTextField({ sensitive: true }),
+    apiKey: createTextField({ sensitive: true, pii: true, lookupable: true }),
   },
 });
 
@@ -250,8 +257,11 @@ const sensitiveFeature = defineFeature("implicitsensitive", (r) => {
 });
 
 const sensitiveEntityTable = buildEntityTable("sensitive-user", sensitiveEntity);
+const sensitiveProjection = "implicitsensitive:projection:sensitive-user-entity";
+
+describe("implicit-projection / sensitive Rebuild-Parität (#967)", () => {
+  let kms: InMemoryKmsAdapter;
 
-describe("implicit-projection / dokumentierte Sensitive-Drift", () => {
   beforeAll(async () => {
     await unsafeCreateEntityTable(testDb.db, sensitiveEntity, "sensitive-user");
   });
@@ -260,29 +270,46 @@ describe("implicit-projection / dokumentierte Sensitive-Drift", () => {
     await asRawClient(testDb.db).unsafe(
       `TRUNCATE ${sensitiveTable}, kumiko_events, kumiko_projections RESTART IDENTITY CASCADE`,
     );
+    kms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(kms);
+    configureBlindIndexKey(SENSITIVE_BIDX_KEY_B64);
   });
 
-  test("Live schreibt sensitive-Felder, Rebuild lässt sie NULL (Welle-3-Roadmap)", async () => {
-    const crud = createEventStoreExecutor(sensitiveEntityTable, sensitiveEntity, {
-      entityName: "sensitive-user",
-    });
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+    resetBlindIndexKeyForTests();
+  });
 
-    // 1. Live: create mit apiKey (sensitive). Read-Tabelle bekommt den
-    //    Wert direkt vom Live-Pfad (unstripped flatData).
+  const crud = createEventStoreExecutor(sensitiveEntityTable, sensitiveEntity, {
+    entityName: "sensitive-user",
+  });
+
+  async function rawSensitiveRow(id: string): Promise<Record<string, unknown>> {
+    const rows = await asRawClient(testDb.db).unsafe<Record<string, unknown>>(
+      `SELECT * FROM ${sensitiveTable} WHERE id = $1`,
+      [id],
+    );
+    const row = rows[0];
+    if (!row) throw new Error(`no row for ${id}`);
+    return row;
+  }
+
+  test("Live==Rebuild inkl. sensitive-Ciphertext + bidx (byte-gleiche Kopie aus dem Event)", async () => {
     const created = await crud.create(
       { email: "x@test.de", apiKey: "secret-token-abc" },
       adminUser,
       tdb,
     );
     if (!created.isSuccess) throw new Error("setup failed");
+    const id = String(created.data.id);
 
-    const [liveRow] = await selectMany(testDb.db, sensitiveEntityTable, {
-      id: created.data.id as string,
-    });
-    expect(liveRow?.["apiKey"]).toBe("secret-token-abc");
-    expect(liveRow?.["email"]).toBe("x@test.de");
+    // Live-Row: Ciphertext + bidx, nie Klartext.
+    const liveRow = await rawSensitiveRow(id);
+    const liveCipher = liveRow["api_key"];
+    expect(isPiiCiphertext(liveCipher)).toBe(true);
+    expect(liveRow["api_key_bidx"]).toBe(computeBlindIndex(SENSITIVE_BIDX_KEY, "secret-token-abc"));
 
-    // 2. Verifiziere dass das Event-Log das Feld NICHT enthält (stripped).
+    // Event-Payload trägt exakt den Tabellen-Ciphertext (byte-gleich).
     const { eventsTable } = await import("../../event-store");
     const [event] = await selectMany(
       testDb.db,
@@ -290,23 +317,75 @@ describe("implicit-projection / dokumentierte Sensitive-Drift", () => {
       { aggregateId: created.data.id },
       { orderBy: { col: "version", direction: "asc" } },
     );
-    expect(event?.payload?.["apiKey"]).toBeUndefined();
+    expect(event?.payload?.["apiKey"]).toBe(liveCipher);
     expect(event?.payload?.["email"]).toBe("x@test.de");
+    expect(JSON.stringify(event?.payload)).not.toContain("secret-token-abc");
 
-    // 3. Rebuild über die ImplicitProjection. Read-Tabelle wird aus
-    //    event.payload neu materialisiert — apiKey ist nicht im Log,
-    //    landet also als NULL/undefined in der rebuilt Row.
     const registry = createRegistry([sensitiveFeature]);
-    await rebuildProjection("implicitsensitive:projection:sensitive-user-entity", {
-      db: testDb.db,
-      registry,
-    });
+    await rebuildProjection(sensitiveProjection, { db: testDb.db, registry });
+
+    const rebuiltRow = await rawSensitiveRow(id);
+    expect(rebuiltRow["email"]).toBe("x@test.de");
+    expect(rebuiltRow["api_key"]).toBe(liveCipher);
+    expect(rebuiltRow["api_key_bidx"]).toBe(liveRow["api_key_bidx"]);
+  });
 
-    const [rebuiltRow] = await selectMany(testDb.db, sensitiveEntityTable, {
-      id: created.data.id as string,
+  test("DEK-Stabilität: Update re-encryptet mit demselben Subject-DEK — alter Event-Ciphertext bleibt lesbar", async () => {
+    const created = await crud.create(
+      { email: "y@test.de", apiKey: "first-secret" },
+      adminUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("setup failed");
+    const updated = await crud.update(
+      { id: created.data.id, version: 1, changes: { apiKey: "second-secret" } },
+      adminUser,
+      tdb,
+    );
+    if (!updated.isSuccess) throw new Error("update failed");
+
+    // Created-Event (v1-Ciphertext) muss mit dem aktuellen DEK lesbar bleiben —
+    // eine DEK-Rotation beim Update würde das immutable Log unlesbar machen.
+    const { eventsTable } = await import("../../event-store");
+    const [createdEvent] = await selectMany(
+      testDb.db,
+      eventsTable,
+      { aggregateId: created.data.id },
+      { orderBy: { col: "version", direction: "asc" } },
+    );
+    const v1Cipher = createdEvent?.payload?.["apiKey"];
+    expect(isPiiCiphertext(v1Cipher)).toBe(true);
+    const decrypted = await decryptPiiFieldValues({ apiKey: v1Cipher }, ["apiKey"], kms, {
+      requestId: "test",
     });
-    expect(rebuiltRow?.["email"]).toBe("x@test.de");
-    // DAS ist die Drift: sensitive Feld ist nach Rebuild weg.
-    expect(rebuiltRow?.["apiKey"]).toBeNull();
+    expect(decrypted["apiKey"]).toBe("first-secret");
+
+    // Rebuild spielt created+updated: bidx-Recompute entschlüsselt beide
+    // Ciphertexte — schlägt bei rotiertem DEK fehl statt still zu heilen.
+    const registry = createRegistry([sensitiveFeature]);
+    await rebuildProjection(sensitiveProjection, { db: testDb.db, registry });
+    const rebuiltRow = await rawSensitiveRow(String(created.data.id));
+    expect(rebuiltRow["api_key_bidx"]).toBe(computeBlindIndex(SENSITIVE_BIDX_KEY, "second-secret"));
+  });
+
+  test("Erase-Divergenz bleibt die einzige legitime: DEK erased → Rebuild bidx NULL, Wert unlesbar", async () => {
+    const created = await crud.create(
+      { email: "z@test.de", apiKey: "gone-after-forget" },
+      adminUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("setup failed");
+    const id = String(created.data.id);
+
+    await kms.eraseKey({ kind: "user", userId: id });
+
+    const registry = createRegistry([sensitiveFeature]);
+    await rebuildProjection(sensitiveProjection, { db: testDb.db, registry });
+
+    const rebuiltRow = await rawSensitiveRow(id);
+    expect(rebuiltRow["api_key_bidx"]).toBeNull();
+    // Ciphertext-Bytes werden kopiert, sind aber ohne DEK unlesbar.
+    expect(isPiiCiphertext(rebuiltRow["api_key"])).toBe(true);
+    expect(rebuiltRow["api_key"]).not.toBe("gone-after-forget");
   });
 });

package/src/db/__tests__/instant-to-driver-temporal.test.ts

@@ -0,0 +1,21 @@
+// kumiko-framework#1480 twin bug: instantToDriver referenced the global
+// `Temporal` the same way instantFromDriver in bun-db/query.ts did. Fixed
+// the same way — static `import { Temporal } from "temporal-polyfill"` in
+// dialect.ts. This test deletes globalThis.Temporal before calling it,
+// proving the write path no longer depends on the global either.
+
+import { describe, expect, test } from "bun:test";
+import { instantToDriver } from "../dialect";
+
+describe("instantToDriver — without a global Temporal", () => {
+  test("coerces an ISO string without relying on a global Temporal", () => {
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      expect(instantToDriver("2026-04-18T10:00:00Z")).toBe("2026-04-18T10:00:00Z");
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});

package/src/db/__tests__/located-timestamp.test.ts

@@ -103,6 +103,25 @@ describe("flattenLocatedTimestamp — Insert/Update Convert", () => {
   });
 });
 
+describe("rehydrateLocatedTimestamp — kumiko-framework#1490: no ambient Temporal global", () => {
+  test("rehydrates without relying on globalThis.Temporal", () => {
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const out = rehydrateLocatedTimestamp(
+        { pickupUtc: "2026-04-15T09:00:00Z", pickupTz: "Europe/Lisbon" },
+        orderEntity,
+      );
+      expect(out).toEqual({
+        pickup: { at: "2026-04-15T10:00:00", tz: "Europe/Lisbon", utc: "2026-04-15T09:00:00Z" },
+      });
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
 describe("rehydrateLocatedTimestamp — Read Convert", () => {
   test("{ <name>Utc, <name>Tz } DB-Form → { at, tz, utc } API-Form (Pickup-Ort-lokal)", () => {
     const out = rehydrateLocatedTimestamp(

package/src/db/__tests__/migrate-generator.test.ts

@@ -95,6 +95,10 @@ describe("renderMigrationSql — managed recreate vs unmanaged in-place", () =>
     expect(sql).toContain('DROP TABLE IF EXISTS "read_secrets";');
     expect(sql).toContain('CREATE TABLE IF NOT EXISTS "read_secrets"');
     expect(sql).not.toContain("ADD COLUMN");
+    expect(sql).toContain(
+      "-- WARN: destructive change (new NOT NULL column(s) without default: envelope) forces DROP+CREATE + full event replay.",
+    );
+    expect(sql).toContain("Consider an Expand/Contract split across two releases");
   });
 
   test("managed: column rename (drop + add NOT NULL) → DROP+CREATE with new shape", () => {
@@ -121,6 +125,7 @@ describe("renderMigrationSql — managed recreate vs unmanaged in-place", () =>
     const sql = renderMigrationSql(diffSnapshots(prev, next), { name: "note", sequenceNumber: 4 });
     expect(sql).toContain('ALTER TABLE "read_a" ADD COLUMN "note"');
     expect(sql).not.toContain("DROP TABLE");
+    expect(sql).not.toContain("WARN: destructive change");
   });
 
   test("unmanaged: NOT NULL column without default → in-place ADD (real data, never recreated)", () => {
@@ -134,5 +139,21 @@ describe("renderMigrationSql — managed recreate vs unmanaged in-place", () =>
     });
     expect(sql).toContain('ALTER TABLE "app_data" ADD COLUMN "envelope"');
     expect(sql).not.toContain("DROP TABLE");
+    expect(sql).not.toContain("WARN: destructive change");
+  });
+
+  test("managed: multiple recreate reasons at once → all named in the warning", () => {
+    const prev = snapshotFromMetas([
+      meta("read_b", { name: "old_col", pgType: "text", notNull: false }, "managed"),
+    ]);
+    const next = snapshotFromMetas([
+      meta("read_b", { name: "envelope", pgType: "jsonb", notNull: true }, "managed"),
+    ]);
+    const sql = renderMigrationSql(diffSnapshots(prev, next), {
+      name: "multi",
+      sequenceNumber: 6,
+    });
+    expect(sql).toContain("dropped column(s): old_col");
+    expect(sql).toContain("new NOT NULL column(s) without default: envelope");
   });
 });

package/src/db/__tests__/migrate-runner.test.ts

@@ -16,4 +16,65 @@ describe("splitSqlStatements", () => {
   test("filters empty segments", () => {
     expect(splitSqlStatements("-- only comments\n; ;")).toEqual([]);
   });
+
+  test("does not split mid-statement on a semicolon inside a line comment", () => {
+    const sql = `
+      -- sets default on the entity; the create/update handlers fill it
+      CREATE TABLE "a" ("id" uuid);
+    `;
+    expect(splitSqlStatements(sql)).toEqual(['CREATE TABLE "a" ("id" uuid);']);
+  });
+
+  test("does not split on a semicolon inside a block comment", () => {
+    const sql = `
+      /* multi
+         line; with semi */
+      CREATE TABLE "a" ("id" uuid);
+    `;
+    expect(splitSqlStatements(sql)).toEqual(['CREATE TABLE "a" ("id" uuid);']);
+  });
+
+  test("a block-comment opener inside a line comment does not swallow the next statement", () => {
+    const sql = `
+      -- note: see /* details below
+      CREATE TABLE "a" ("id" uuid);
+      /* real block comment */
+      CREATE TABLE "b" ("id" uuid);
+    `;
+    expect(splitSqlStatements(sql)).toEqual([
+      'CREATE TABLE "a" ("id" uuid);',
+      'CREATE TABLE "b" ("id" uuid);',
+    ]);
+  });
+
+  test("does not split on a semicolon inside a single-quoted string literal", () => {
+    const sql = `INSERT INTO "a" ("v") VALUES ('a;b');`;
+    expect(splitSqlStatements(sql)).toEqual([`INSERT INTO "a" ("v") VALUES ('a;b');`]);
+  });
+
+  test("does not treat a double-dash inside a string literal as a comment", () => {
+    const sql = `INSERT INTO "a" ("v") VALUES ('a--b');`;
+    expect(splitSqlStatements(sql)).toEqual([`INSERT INTO "a" ("v") VALUES ('a--b');`]);
+  });
+
+  test("handles an escaped quote inside a single-quoted string literal ('')", () => {
+    const sql = `INSERT INTO "a" ("v") VALUES ('a'';b');`;
+    expect(splitSqlStatements(sql)).toEqual([`INSERT INTO "a" ("v") VALUES ('a'';b');`]);
+  });
+
+  test("does not split on a semicolon inside a double-quoted identifier", () => {
+    const sql = `CREATE TABLE "weird;name" ("id" uuid);`;
+    expect(splitSqlStatements(sql)).toEqual([`CREATE TABLE "weird;name" ("id" uuid);`]);
+  });
+
+  test("throws fail-loud on an unterminated block comment instead of silently dropping statements", () => {
+    const sql = `/* oops\nCREATE TABLE "a" ("id" uuid);`;
+    expect(() => splitSqlStatements(sql)).toThrow();
+  });
+
+  test("a trailing line comment without a newline terminates cleanly", () => {
+    expect(splitSqlStatements('CREATE TABLE "a" ("id" uuid);\n-- done')).toEqual([
+      'CREATE TABLE "a" ("id" uuid);',
+    ]);
+  });
 });

package/src/db/__tests__/number-field-fractional.integration.test.ts

@@ -0,0 +1,58 @@
+// Prod-relevant bug: NumberFieldDef mapped unconditionally to a Postgres
+// `integer` column regardless of the `integer` flag. `createNumberField()`
+// (no `integer: true`) accepts fractional values at the Zod boundary but
+// the column rejected them at the DB with "invalid input syntax for type
+// integer" — Monte-Carlo-style stats fields (phronexsis simulation results)
+// hit this on every non-integer result. Fix: `integer: true` → `integer`
+// column, otherwise → `double precision` (fractional values round-trip).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { selectMany } from "../../db/query";
+import { buildEntityTable } from "../../db/table-builder";
+import { createEntity, createNumberField } from "../../engine";
+import { setupTestStack, type TestStack, unsafeCreateEntityTable } from "../../stack";
+
+const statsEntity = createEntity({
+  table: "nff_stats",
+  fields: {
+    expectedValue: createNumberField({ sortable: true }),
+    wholeCount: createNumberField({ integer: true }),
+  },
+});
+const statsTable = buildEntityTable("nff-stats", statsEntity);
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [] });
+  await unsafeCreateEntityTable(stack.db, statsEntity, "nff-stats");
+});
+
+afterAll(async () => stack?.cleanup());
+
+describe("createNumberField() without integer:true — fractional values round-trip", () => {
+  test("INSERT accepts a non-integer value and SELECT returns it unchanged", async () => {
+    await seedRow(stack.db, statsTable, {
+      expectedValue: 77.02269129478736,
+      wholeCount: 3,
+      tenantId: "00000000-0000-4000-8000-000000000001",
+    });
+    const rows = await selectMany(stack.db, statsTable);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.["expectedValue"]).toBe(77.02269129478736);
+    expect(rows[0]?.["wholeCount"]).toBe(3);
+  });
+});
+
+describe("createNumberField({ integer: true }) — still rejects fractional values at the DB", () => {
+  test("INSERT with a non-integer value into an integer-flagged field throws", async () => {
+    await expect(
+      seedRow(stack.db, statsTable, {
+        expectedValue: 1,
+        wholeCount: 3.5,
+        tenantId: "00000000-0000-4000-8000-000000000001",
+      }),
+    ).rejects.toThrow(/invalid input syntax for type integer/);
+  });
+});

package/src/db/__tests__/rebuild-marker.test.ts

@@ -28,14 +28,16 @@ function tmpDir(): string {
 }
 
 describe("rebuildTablesFromDiff", () => {
-  test("managed: new + changed tables included, dropped excluded, sorted + unique", () => {
+  test("managed: new table rebuilt, additive-only change NOT rebuilt, dropped excluded", () => {
+    // read_a: nur eine nullable Spalte dazu → in-place ALTER, kein Rebuild.
+    // read_b: neue Tabelle → Rebuild. read_c gedroppt → nie im Marker.
     const prev = snapshotFromMetas([meta("read_a"), meta("read_c")]);
     const next = snapshotFromMetas([
       meta("read_a", { name: "title", pgType: "text", notNull: false }),
       meta("read_b"),
     ]);
     const diff = diffSnapshots(prev, next);
-    expect(rebuildTablesFromDiff(diff)).toEqual(["read_a", "read_b"]);
+    expect(rebuildTablesFromDiff(diff)).toEqual(["read_b"]);
   });
 
   test("no schema change → empty", () => {
@@ -51,11 +53,19 @@ describe("rebuildTablesFromDiff", () => {
     expect(rebuildTablesFromDiff(diffSnapshots(prev, next))).toEqual([]);
   });
 
-  test("managed new nullable column → rebuild (Backfill aus Events nötig)", () => {
+  test("managed new NULLABLE column → NO rebuild (in-place ADD COLUMN reicht; Rebuild würde die Spalte wischen, #835)", () => {
     const prev = snapshotFromMetas([meta("read_a")]);
     const next = snapshotFromMetas([
       meta("read_a", { name: "title", pgType: "text", notNull: false }),
     ]);
+    expect(rebuildTablesFromDiff(diffSnapshots(prev, next))).toEqual([]);
+  });
+
+  test("managed new NOT-NULL column ohne Default → rebuild (recreate, kann nicht in-place)", () => {
+    const prev = snapshotFromMetas([meta("read_a")]);
+    const next = snapshotFromMetas([
+      meta("read_a", { name: "title", pgType: "text", notNull: true }),
+    ]);
     expect(rebuildTablesFromDiff(diffSnapshots(prev, next))).toEqual(["read_a"]);
   });