@cosmicdrift/kumiko-guards 0.285.0 → 0.285.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.285.0",
+  "version": "0.285.1",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -27,7 +27,7 @@
     "kumiko-guards": "./src/cli.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.285.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.285.1",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.285.1",
+    "type": "fix",
+    "title": "Fix false-positive BLOCK in the Direct-Entity-Writes Guard for repos with no event store",
+    "detail": "An empty `esTables` set had one meaning: the scan lost track of ES definitions while table-write code still exists, so the guard reported a misconfiguration canary and blocked (the guard is `security: true`, so this always failed CI). That conflated two different situations: a repo with no event store at all (e.g. `kumiko-platform`, an Astro docs/marketing site) also has an empty `esTables` set, but there is nothing to guard against there. The guard now checks whether any table write is present at all before treating an empty `esTables` set as a misconfiguration; a repo with no ES and no table writes is green, while a repo with table writes but no resolvable ES tables still blocks as before."
+  },
   {
     "version": "0.284.0",
     "type": "fix",

package/src/guard-direct-entity-writes.ts

@@ -287,6 +287,16 @@ function resolveWrite(
   return undefined;
 }
 
+function hasAnyTableWrite(files: readonly SourceFile[]): boolean {
+  for (const sf of files) {
+    if (EXCLUDE.test(sf.getFilePath())) continue;
+    for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+      if (resolveWrite(call)) return true;
+    }
+  }
+  return false;
+}
+
 export function scanDirectWrites(
   sf: SourceFile,
   esTables: ReadonlySet<TableId>,
@@ -351,13 +361,16 @@ export const guard: AstGuard = {
       ...collectEntityProjectionTables(files),
     ]);
     if (esTables.size === 0) {
+      // An empty set means either the repo has no event store at all, or the
+      // scan lost the ES definitions while table writes are still present.
+      if (!hasAnyTableWrite(files)) return { violations: [] };
       return {
         violations: [
           {
             file: "<scan>",
             line: 0,
             message:
-              "BLOCKED: guard found no createEventStoreExecutor or r.entity projection tables — scan is probably misconfigured.",
+              "BLOCKED: guard found table writes but no createEventStoreExecutor or r.entity projection tables — scan is probably misconfigured.",
           },
         ],
       };