@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/engine/codemod/pipeline-codemod.ts

@@ -370,7 +370,7 @@ export function generatePerformBlock(
   const pipelineType = schemaType ? `<${schemaType}, unknown>` : "";
 
   return [
-    `perform: pipeline${pipelineType}(({ event, r }) => [`,
+    `perform: stepsPipeline${pipelineType}(({ event, r }) => [`,
     stepsStr,
     `  ${stepIndent}]),`,
   ].join("\n");
@@ -513,7 +513,7 @@ function contentHasPipelineImport(content: string): boolean {
   const importLine = content
     .split("\n")
     .find((l) => l.includes("import") && l.includes("@cosmicdrift/kumiko-framework/engine"));
-  return !!importLine && importLine.includes("pipeline");
+  return !!importLine && importLine.includes("stepsPipeline");
 }
 
 function ensurePipelineImport(content: string): string | null {
@@ -525,7 +525,7 @@ function ensurePipelineImport(content: string): string | null {
   const match = content.match(importRegex);
   if (match) {
     const existingImports = (match[1] as string).trim();
-    const newImports = existingImports ? `${existingImports}, pipeline` : "pipeline";
+    const newImports = existingImports ? `${existingImports}, stepsPipeline` : "stepsPipeline";
     return content.replace(
       importRegex,
       `import { ${newImports} } from "@cosmicdrift/kumiko-framework/engine"`,
@@ -611,7 +611,7 @@ export async function convertFile(
       if (importResult) {
         content = importResult;
       } else if (options.verbose) {
-        console.log(`  ~ ${filePath}: pipeline import not needed or already present`);
+        console.log(`  ~ ${filePath}: stepsPipeline import not needed or already present`);
       }
     }
 
@@ -621,7 +621,7 @@ export async function convertFile(
 
     const status = hadChanges ? "converted" : "skipped";
     const reason = hadChanges
-      ? "handler replaced with perform: pipeline(...)"
+      ? "handler replaced with perform: stepsPipeline(...)"
       : "no convertible handler";
     return { filePath, status, reason };
   } catch (err) {

package/src/engine/config-helpers.ts

@@ -14,6 +14,17 @@ import type {
   CreateUserSeedOptions,
 } from "./types";
 
+// A key backed by "secrets" is at-rest encrypted by the secrets store itself
+// (MasterKeyProvider), even without an explicit `encrypted: true` — callers
+// that gate on encryption (boot-validator mutual-exclusion checks, config
+// query redaction) must treat the two as equivalent or a secrets-backed key
+// silently skips the encrypted-only guard.
+export function isEncryptedAtRest(
+  def: Pick<ConfigKeyDefinition, "encrypted" | "backing">,
+): boolean {
+  return def.encrypted === true || def.backing === "secrets";
+}
+
 // --- Access Presets ---
 
 export const access = {
@@ -70,6 +81,7 @@ type ConfigKeyOptions<T extends ConfigKeyType> = {
   read?: readonly string[];
   default?: ConfigValue<T>;
   encrypted?: boolean;
+  piiEncrypted?: T extends "text" ? boolean : never;
   options?: readonly string[]; // for select type
   bounds?: T extends "number" ? ConfigBounds : never;
   // Regex enforced at write (set.write) — only meaningful for text keys
@@ -84,6 +96,7 @@ type ConfigKeyOptions<T extends ConfigKeyType> = {
   inheritedToTenant?: boolean;
   backing?: ConfigBacking;
   mask?: ConfigMask;
+  group?: string;
 };
 
 // --- Scope Defaults ---
@@ -111,6 +124,7 @@ function createConfigKey<T extends ConfigKeyType>(
     },
     default: opts.default,
     ...(opts.encrypted ? { encrypted: true } : {}),
+    ...(opts.piiEncrypted ? { piiEncrypted: true } : {}),
     ...(opts.options ? { options: opts.options } : {}),
     bounds: opts.bounds as ConfigBounds | undefined, // @cast-boundary schema-walk
     ...(opts.pattern ? { pattern: opts.pattern } : {}),
@@ -121,6 +135,7 @@ function createConfigKey<T extends ConfigKeyType>(
     ...(opts.inheritedToTenant === false ? { inheritedToTenant: false } : {}),
     ...(opts.backing === "secrets" ? { backing: "secrets" } : {}),
     ...(opts.mask ? { mask: opts.mask } : {}),
+    ...(opts.group ? { group: opts.group } : {}),
   };
 }
 

package/src/engine/constants.ts

@@ -1,3 +1,6 @@
+import type { ConcurrencyMode } from "@cosmicdrift/kumiko-types/concurrency-mode";
+import type { ConfigScope } from "@cosmicdrift/kumiko-types/config-scope";
+import type { OnDeleteStrategy as OnDeleteStrategyType } from "@cosmicdrift/kumiko-types/relations";
 import type { TenantId } from "./types/identifiers";
 
 // All framework constants as `as const` objects with inferred union types.
@@ -47,14 +50,23 @@ export const LifecycleHookTypes = {
 export type LifecycleHookType = (typeof LifecycleHookTypes)[keyof typeof LifecycleHookTypes];
 
 // --- Config Scopes ---
+// Value object satisfies the canonical ConfigScope union from kumiko-types —
+// a scope added here without a matching kumiko-types member is now a
+// compile error instead of silent drift (#1423/#1439).
 
 export const ConfigScopes = {
   system: "system",
   tenant: "tenant",
   user: "user",
-} as const;
+} as const satisfies Record<string, ConfigScope>;
+
+export type { ConfigScope };
 
-export type ConfigScope = (typeof ConfigScopes)[keyof typeof ConfigScopes];
+// Reverse direction: a member added only to kumiko-types' ConfigScope
+// (not to ConfigScopes above) would otherwise pass the `satisfies` check
+// above unnoticed — this line forces exhaustiveness the other way too.
+const _configScopeExhaustive: Record<ConfigScope, unknown> = ConfigScopes;
+void _configScopeExhaustive;
 
 // --- On Delete Strategies ---
 
@@ -63,11 +75,13 @@ export const OnDeleteStrategies = {
   restrict: "restrict",
   setNull: "setNull",
   nothing: "nothing",
-} as const;
+} as const satisfies Record<OnDeleteStrategyType, OnDeleteStrategyType>;
 
-export type OnDeleteStrategy = (typeof OnDeleteStrategies)[keyof typeof OnDeleteStrategies];
+export type OnDeleteStrategy = OnDeleteStrategyType;
 
 // --- Concurrency Modes ---
+// Value object satisfies the canonical ConcurrencyMode union from
+// kumiko-types — same drift-guard as ConfigScopes above.
 
 export const ConcurrencyModes = {
   parallel: "parallel",
@@ -75,12 +89,24 @@ export const ConcurrencyModes = {
   replace: "replace",
   sequential: "sequential",
   debounce: "debounce",
-} as const;
+} as const satisfies Record<string, ConcurrencyMode>;
 
-export type ConcurrencyMode = (typeof ConcurrencyModes)[keyof typeof ConcurrencyModes];
+export type { ConcurrencyMode };
+
+// Reverse-direction exhaustiveness guard — see the ConfigScope one above.
+const _concurrencyModeExhaustive: Record<ConcurrencyMode, unknown> = ConcurrencyModes;
+void _concurrencyModeExhaustive;
 
 // --- SSE Channels ---
 
 export function tenantChannel(tenantId: TenantId): string {
   return `tenant:${tenantId}`;
 }
+
+// Access-invalidation channel key for a single user's live streams. Both
+// the subscribe side (dispatch-stream.ts) and the publish side (session-
+// revoke / tenant-membership consumers, issue #1559/#1560) must derive the
+// key through this helper — never build the string inline on either side.
+export function userAccessChannel(userId: string): string {
+  return `user:${userId}:access`;
+}

package/src/engine/create-app.ts

@@ -53,6 +53,17 @@ export function createApp(config: AppConfig): App {
         }
       }
     }
+    for (const handler of Object.values(feature.streamHandlers)) {
+      if (handler.access && "roles" in handler.access) {
+        for (const role of handler.access.roles) {
+          if (!validRoles.has(role)) {
+            throw new Error(
+              `Unknown role "${role}" in stream handler "${handler.name}" of feature "${feature.name}". Valid roles: ${config.roles.join(", ")}`,
+            );
+          }
+        }
+      }
+    }
     for (const [key, keyDef] of Object.entries(feature.configKeys)) {
       for (const role of [...keyDef.access.read, ...keyDef.access.write]) {
         if (!systemRoles.has(role) && !validRoles.has(role)) {