@cosmicdrift/kumiko-types 0.251.0 → 0.252.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.251.0",
+  "version": "0.252.0",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/fields.ts

@@ -29,12 +29,12 @@ export type FieldAccess = {
 // to prevent: `encrypted: true` looks like the strongest option and is the
 // only one with NO erasure guarantee.
 //
-//   resolved flag                  | at rest    | searchable | Art. 17 erasure
-//   -------------------------------|------------|------------|----------------
-//   (none)                         | plaintext  | yes        | no
-//   allowPlaintext + anonymize     | plaintext  | yes        | read side only
-//   pii / userOwned / tenantOwned  | ciphertext | yes *      | yes, key erase
-//   encrypted: true                | ciphertext | no         | NO
+//   resolved flag                               | at rest    | searchable | Art. 17 erasure
+//   --------------------------------------------|------------|------------|---------------
+//   (none)                                      | plaintext  | yes        | no
+//   allowPlaintext + anonymize                  | plaintext  | yes        | read side only
+//   pii / userOwned / tenantOwned / recordOwned | ciphertext | yes *      | yes, key erase
+//   encrypted: true                             | ciphertext | no         | NO
 //
 //   * Subject-annotated + `searchable: true` (#1610): search consumer
 //     decrypts into Meilisearch. Events/projection stay ciphertext.
@@ -75,6 +75,10 @@ export type FieldAccess = {
 //   - `personal: "ref"`          → `subjectRef: true`. FK into `user` with no
 //                                  annotated content of its own (authorId,
 //                                  assigneeId).
+//   - `personal: { of: "id" }`   → `recordOwned: true`. the row itself is the
+//                                  subject — free-text content with no user
+//                                  reference of its own (a support note keyed
+//                                  only by its own row id).
 //   - `personal: false, reason`  → `allowPlaintext: "<reason>"`. deliberately
 //                                  plaintext; `reason` is mandatory snake_case.
 //
@@ -126,6 +130,7 @@ export type ResolvedPiiFlags = {
   readonly pii?: boolean;
   readonly userOwned?: { readonly ownerField: string };
   readonly tenantOwned?: boolean;
+  readonly recordOwned?: true;
   readonly anonymize?: () => unknown | Promise<unknown>;
   readonly allowPlaintext?: string;
   /** Equality-Lookups (fetchOne/filter eq) bleiben trotz Verschluesselung

package/src/kms-adapter-types.ts

@@ -1,13 +1,15 @@
 import type { TenantId } from "./identifiers";
 
 // The subject a DEK belongs to. User data is shredded on user-forget,
-// tenant data on tenant-destroy — two erase triggers, two subject kinds.
+// tenant data on tenant-destroy, record data on a row-scoped forget —
+// three erase triggers, three subject kinds.
 export type SubjectId =
   | { readonly kind: "user"; readonly userId: string }
-  | { readonly kind: "tenant"; readonly tenantId: TenantId };
+  | { readonly kind: "tenant"; readonly tenantId: TenantId }
+  | { readonly kind: "record"; readonly entity: string; readonly id: string };
 
-// Compact storage key ("user:<uuid>" / "tenant:<uuid>") — primary key in
-// adapter backends and cache key in the request-level DEK cache.
+// Compact storage key ("user:<uuid>" / "tenant:<uuid>" / "record:<entity>:<id>")
+// — primary key in adapter backends and cache key in the request-level DEK cache.
 export type SubjectKey = string;
 
 export function subjectKeyForUser(userId: string): SubjectKey {
@@ -18,10 +20,23 @@ export function subjectKeyForTenant(tenantId: TenantId): SubjectKey {
   return `tenant:${tenantId}`;
 }
 
+export function subjectKeyForRecord(entity: string, id: string): SubjectKey {
+  // The key is parsed back on exactly one ":" — an entity containing ":" would break the round-trip.
+  if (entity === "" || entity.includes(":"))
+    throw new Error(`Invalid record entity for subject key: ${entity}`);
+  if (id === "") throw new Error("Invalid record id for subject key: empty");
+  return `record:${entity}:${id}`;
+}
+
 export function subjectIdToKey(subject: SubjectId): SubjectKey {
-  return subject.kind === "user"
-    ? subjectKeyForUser(subject.userId)
-    : subjectKeyForTenant(subject.tenantId);
+  switch (subject.kind) {
+    case "user":
+      return subjectKeyForUser(subject.userId);
+    case "tenant":
+      return subjectKeyForTenant(subject.tenantId);
+    case "record":
+      return subjectKeyForRecord(subject.entity, subject.id);
+  }
 }
 
 export function subjectIdFromKey(key: SubjectKey): SubjectId {
@@ -29,6 +44,14 @@ export function subjectIdFromKey(key: SubjectKey): SubjectId {
   if (key.startsWith("tenant:")) {
     return { kind: "tenant", tenantId: key.slice("tenant:".length) as TenantId }; // @cast-boundary parse of a key this module minted
   }
+  if (key.startsWith("record:")) {
+    const rest = key.slice("record:".length);
+    const separatorIndex = rest.indexOf(":");
+    const entity = separatorIndex === -1 ? "" : rest.slice(0, separatorIndex);
+    const id = separatorIndex === -1 ? "" : rest.slice(separatorIndex + 1);
+    if (entity === "" || id === "") throw new Error(`Invalid subject key: ${key}`);
+    return { kind: "record", entity, id };
+  }
   throw new Error(`Invalid subject key: ${key}`);
 }