@cosmicdrift/kumiko-types 0.306.0 → 0.307.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.306.0",
+  "version": "0.307.0",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/event-store-types.ts

@@ -45,8 +45,23 @@ export type EventMetadata = {
   // every new row carries both, falling back to UNATTRIBUTED_ORIGIN.
   readonly feature?: string;
   readonly handler?: string;
+  // Only set under an anonymous root without public-intake, so event-triggered
+  // jobs keep the personal-data gate.
+  readonly writeOrigin?: WriteOrigin;
 };
 
+export type WriteOrigin = {
+  readonly rootHandler: string;
+  readonly anonymousRoot: boolean;
+  // Only a write-handler root can declare public-intake; a query/stream root never does.
+  readonly publicIntake: boolean;
+  readonly viaJob?: string;
+};
+
+export function isPersonalDataGated(origin: WriteOrigin): boolean {
+  return origin.anonymousRoot && !origin.publicIntake;
+}
+
 // Stamped when an append runs outside any attributed scope (seed scripts,
 // tests, direct event-store use). A distinct value, not an omission —
 // omitted would be indistinguishable from a pre-#3043 row.

package/src/handlers.ts

@@ -4,6 +4,7 @@ import type { ConfigAccessor, ConfigAccessorFactory, ConfigResolver } from "./co
 import type { DbConnection } from "./db-connection";
 import type { DerivativesContext } from "./derivatives-types";
 import type { EntityCache } from "./entity-cache";
+import type { WriteOrigin } from "./event-store-types";
 import type { KumikoEventTypeMap } from "./event-type-map";
 import type { FileContext } from "./file-handle-types";
 import type { FileProviderResolver } from "./file-provider-resolver-types";
@@ -260,8 +261,20 @@ export type JobRunnerRef = {
 // singleton, not bound to one caller's identity. Only write+queryAs — no
 // .query/.stream/.command/.batch/.resolveAuthClaims, that stays Dispatcher-only.
 export type DispatchWriteRef = {
-  readonly write: (user: SessionUser, qn: string, payload: unknown) => Promise<WriteResult>;
-  readonly queryAs: (user: SessionUser, qn: string, payload: unknown) => Promise<unknown>;
+  // A job under a gated anonymous origin passes it, else the target would
+  // reset to the job's own non-anonymous root.
+  readonly write: (
+    user: SessionUser,
+    qn: string,
+    payload: unknown,
+    inheritedOrigin?: WriteOrigin,
+  ) => Promise<WriteResult>;
+  readonly queryAs: (
+    user: SessionUser,
+    qn: string,
+    payload: unknown,
+    inheritedOrigin?: WriteOrigin,
+  ) => Promise<unknown>;
   // Builds a tenant-scoped MemberReader — one per JobContext.queryAsMember
   // caller (job-runner.ts lazily creates one per job run).
   readonly createMemberReader: (tenantId: TenantId) => MemberReader;