@cosmicdrift/kumiko-types 0.385.0 → 0.386.0

package/dist/db-connection.d.ts

@@ -1,7 +1,7 @@
 import type postgres from "postgres";
 export type RawDbClient = {
-    unsafe: (...args: any[]) => any;
-    begin: (...args: any[]) => any;
+    unsafe: (sql: string, params?: readonly unknown[]) => PromiseLike<readonly unknown[]>;
+    begin: <T>(fn: (tx: DbTx) => Promise<T>) => Promise<T>;
     end?: (options?: {
         timeout?: number;
     }) => Promise<void>;

package/dist/handlers.d.ts

@@ -30,7 +30,7 @@ export type RoleAccessRule = {
     readonly personalData?: RoleAccessPersonalData;
 };
 export type AccessRule = RoleAccessRule | OpenToAllAccessRule;
-export declare const ESCAPE_HATCH_GRANTS: readonly ["systemIdentity", "globalWrites", "unsafeRaw"];
+export declare const ESCAPE_HATCH_GRANTS: readonly ["systemIdentity", "globalWrites", "unsafeRaw", "crossTenantReads"];
 export type EscapeHatchGrant = (typeof ESCAPE_HATCH_GRANTS)[number];
 export type EscapeHatchDeclaration = {
     readonly reason: string;
@@ -39,6 +39,7 @@ export type EscapeHatchDeclaration = {
 export declare function isEscapeHatchGrant(value: unknown): value is EscapeHatchGrant;
 export declare function escapeHatchAllows(declaration: EscapeHatchDeclaration | undefined, grant: EscapeHatchGrant): boolean;
 export declare function escapeHatchFor(declaration: EscapeHatchDeclaration | undefined, grant: EscapeHatchGrant): EscapeHatchDeclaration | undefined;
+export declare function crossTenantReadsGrantFor(declaration: EscapeHatchDeclaration | undefined): EscapeHatchDeclaration | undefined;
 export declare function escapeHatchGrantsProblem(declaration: {
     readonly grants?: unknown;
 }): string | undefined;
@@ -304,6 +305,7 @@ export type HandlerContext<TMap extends object = KumikoEventTypeMap> = SharedCon
      */
     readonly dbOutsideTransaction: TenantDb | undefined;
     readonly systemDb?: UncheckedSystemDb;
+    readonly crossTenantReads?: CrossTenantReads;
     readonly registry: Registry;
     /** Aktiver SessionUser des Handler-Aufrufs — Convenience-Alias zu
      *  `event.user`. Existiert weil Handler intuitiv `ctx.user.tenantId`

package/dist/handlers.js

@@ -1,5 +1,10 @@
 import { isOneOf, propertyOf } from "./type-guards.js";
-export const ESCAPE_HATCH_GRANTS = ["systemIdentity", "globalWrites", "unsafeRaw"];
+export const ESCAPE_HATCH_GRANTS = [
+    "systemIdentity",
+    "globalWrites",
+    "unsafeRaw",
+    "crossTenantReads",
+];
 export function isEscapeHatchGrant(value) {
     return ESCAPE_HATCH_GRANTS.some((grant) => grant === value);
 }
@@ -13,6 +18,13 @@ export function escapeHatchAllows(declaration, grant) {
 export function escapeHatchFor(declaration, grant) {
     return escapeHatchAllows(declaration, grant) ? declaration : undefined;
 }
+// unsafeRaw hands out a raw runner that reads everything anyway, so it implies the read-only grant.
+export function crossTenantReadsGrantFor(declaration) {
+    return escapeHatchAllows(declaration, "crossTenantReads") ||
+        escapeHatchAllows(declaration, "unsafeRaw")
+        ? declaration
+        : undefined;
+}
 // Boot-time check of `grants` (untyped sources can carry anything): must be a non-empty list of known grants.
 export function escapeHatchGrantsProblem(declaration) {
     const { grants } = declaration;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.385.0",
+  "version": "0.386.0",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.386.0",
+    "type": "improvement",
+    "title": "RawDbClient is typed instead of any",
+    "detail": "`RawDbClient.unsafe` and `begin` have real signatures, so `db.unsafe(...)` on a `DbConnection` no longer collapses to `any`. A hand-built fake runner needs `unsafe(sql, params?)` returning rows and a `begin` that takes a callback."
+  },
   {
     "version": "0.385.0",
     "type": "improvement",