@cosmicdrift/kumiko-guards 0.284.0 → 0.285.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.284.0",
+  "version": "0.285.1",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -27,7 +27,7 @@
     "kumiko-guards": "./src/cli.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.284.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.285.1",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/_lib/scan-scope.ts

@@ -9,7 +9,8 @@ export type ScanExtension = "ts" | "tsx";
 
 type ScanSpecBase = {
   readonly extensions: readonly ScanExtension[];
-  /** Manifest roles to scan; omitted = every root. */
+  /** Manifest roles to scan; omitted = every root except "tooling" — a guard
+   *  must opt in to scanning an infra/build-tooling root explicitly. */
   readonly kinds?: readonly RepoKind[];
   /** Repo-relative globs; in a kind "framework" root only files matching one of them are kept (replaces `within` there). */
   readonly frameworkWithin?: readonly string[];
@@ -141,10 +142,13 @@ function scanRoot(spec: ScanSpec, root: RepoRoot): RootScan {
   return { root, files, sourceSurface: sourceSurfaceHits.length };
 }
 
+function keepsRootKind(spec: ScanSpec, root: RepoRoot): boolean {
+  if (spec.kinds) return spec.kinds.includes(root.kind);
+  return root.kind !== "tooling";
+}
+
 export function scanRoots(spec: ScanSpec, roots: readonly RepoRoot[]): RootScan[] {
-  return roots
-    .filter((root) => !spec.kinds || spec.kinds.includes(root.kind))
-    .map((root) => scanRoot(spec, root));
+  return roots.filter((root) => keepsRootKind(spec, root)).map((root) => scanRoot(spec, root));
 }
 
 export function scanFiles(spec: ScanSpec, roots: readonly RepoRoot[]): string[] {

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.285.1",
+    "type": "fix",
+    "title": "Fix false-positive BLOCK in the Direct-Entity-Writes Guard for repos with no event store",
+    "detail": "An empty `esTables` set had one meaning: the scan lost track of ES definitions while table-write code still exists, so the guard reported a misconfiguration canary and blocked (the guard is `security: true`, so this always failed CI). That conflated two different situations: a repo with no event store at all (e.g. `kumiko-platform`, an Astro docs/marketing site) also has an empty `esTables` set, but there is nothing to guard against there. The guard now checks whether any table write is present at all before treating an empty `esTables` set as a misconfiguration; a repo with no ES and no table writes is green, while a repo with table writes but no resolvable ES tables still blocks as before."
+  },
   {
     "version": "0.284.0",
     "type": "fix",

package/src/guard-direct-entity-writes.ts

@@ -287,6 +287,16 @@ function resolveWrite(
   return undefined;
 }
 
+function hasAnyTableWrite(files: readonly SourceFile[]): boolean {
+  for (const sf of files) {
+    if (EXCLUDE.test(sf.getFilePath())) continue;
+    for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+      if (resolveWrite(call)) return true;
+    }
+  }
+  return false;
+}
+
 export function scanDirectWrites(
   sf: SourceFile,
   esTables: ReadonlySet<TableId>,
@@ -351,13 +361,16 @@ export const guard: AstGuard = {
       ...collectEntityProjectionTables(files),
     ]);
     if (esTables.size === 0) {
+      // An empty set means either the repo has no event store at all, or the
+      // scan lost the ES definitions while table writes are still present.
+      if (!hasAnyTableWrite(files)) return { violations: [] };
       return {
         violations: [
           {
             file: "<scan>",
             line: 0,
             message:
-              "BLOCKED: guard found no createEventStoreExecutor or r.entity projection tables — scan is probably misconfigured.",
+              "BLOCKED: guard found table writes but no createEventStoreExecutor or r.entity projection tables — scan is probably misconfigured.",
           },
         ],
       };