@cosmicdrift/kumiko-framework 0.113.1 → 1.0.0

package/src/engine/types/screen.ts

@@ -296,34 +296,6 @@ export type EntityListScreenDefinition = {
   readonly access?: AccessRule;
 };
 
-// --- projectionList ---
-
-// Like entityList, but bound to an EXPLICIT query instead of an entity. The
-// list-query is taken verbatim from `query` (a fully qualified QN like
-// "ledger:query:schedule:list") — NOT derived from the screen's own feature —
-// so a screen can render any read-projection, including one owned by a
-// different feature (the entityList feature-local resolution can't). Columns
-// carry their own labels (no entity to derive field-labels from); there is no
-// auto create-navigation (a projection isn't an editable entity list). Row
-// interaction is explicit via `rowActions`. The query must return the same
-// paged envelope as an entity list-query: `{ rows, nextCursor, total? }`.
-export type ProjectionListScreenDefinition = {
-  readonly id: string;
-  readonly type: "projectionList";
-  readonly query: string;
-  readonly columns: readonly ListColumnSpec[];
-  readonly rowRenderer?: PlatformComponent;
-  readonly cardRenderer?: PlatformComponent;
-  readonly rowActions?: readonly RowAction[];
-  readonly toolbarActions?: readonly ToolbarAction[];
-  readonly pagination?: ListPaginationMode;
-  readonly pageSize?: number;
-  readonly defaultSort?: ListSortSpec;
-  readonly searchable?: boolean;
-  readonly slots?: ScreenSlots;
-  readonly access?: AccessRule;
-};
-
 // --- entityEdit ---
 
 // camelCase `readOnly` instead of the spec's lowercase `readonly`: TS's
@@ -554,7 +526,6 @@ export type ScreenSlots = {
 
 export type ScreenDefinition =
   | EntityListScreenDefinition
-  | ProjectionListScreenDefinition
   | EntityEditScreenDefinition
   | ActionFormScreenDefinition
   | ConfigEditScreenDefinition

package/src/event-store/__tests__/row-to-stored-event.test.ts

@@ -48,8 +48,8 @@ describe("toStoredEvent", () => {
   });
 
   test("Feld-Vollständigkeit: das Mapping deckt genau die StoredEvent-Keys ab", () => {
-    // Guards required fields staying in sync with StoredEvent (event-store.ts);
-    // optional fields consistently omitted on both sides must be added manually.
+    // Pin gegen versehentliches Weglassen eines Feldes im Mapping. Muss mit
+    // der StoredEvent-Definition (event-store.ts) synchron bleiben.
     const expectedKeys: ReadonlyArray<keyof StoredEvent> = [
       "id",
       "aggregateId",

package/src/event-store/index.ts

@@ -24,14 +24,6 @@ export {
   streamAllEventsByType,
 } from "./event-store";
 export { createEventsTable, eventsTable } from "./events-schema";
-export {
-  createRebuildDeadLetterTable,
-  listRebuildDeadLetters,
-  type RebuildDeadLetterRow,
-  rebuildDeadLetterTable,
-  recordRebuildDeadLetters,
-  type SkippedApply,
-} from "./rebuild-dead-letter";
 export { toStoredEvent } from "./row-to-stored-event";
 export {
   createSnapshotsTable,

package/src/files/provider-resolver.ts

@@ -138,34 +138,21 @@ export type FileProviderResolverDeps = {
 // SYSTEM identity: provider construction is an infra read, distinct from the
 // request user's authorization which stays at the route accessGuard.
 export function makeFileProviderResolver(deps: FileProviderResolverDeps): FileProviderResolver {
-  // Per-tenant cache (698/2) — without it, every resolveProvider(tenantId)
-  // call re-reads config + secrets from the DB, even though the provider is
-  // effectively static per tenant for the process lifetime. A rejected
-  // promise is evicted so a transient failure (or a secret genuinely not
-  // configured yet) doesn't permanently poison this tenant's entry.
-  const cache = new Map<string, Promise<FileStorageProvider>>();
-  return (tenantId) => {
-    const cached = cache.get(tenantId);
-    if (cached) return cached;
-    const built = (async () => {
-      if (!deps.registry || !deps._configAccessorFactory || !deps.db) {
-        throw new Error(
-          "makeFileProviderResolver: registry/_configAccessorFactory/db missing — " +
-            "mount the config + file-foundation features and wire context.db",
-        );
-      }
-      const config = deps._configAccessorFactory({
-        user: { id: SYSTEM_USER_ID, tenantId },
-        db: deps.db,
-        secrets: deps.secrets,
-      });
-      return createFileProviderForTenant(
-        { config, registry: deps.registry, secrets: deps.secrets, _userId: SYSTEM_USER_ID },
-        tenantId,
+  return async (tenantId) => {
+    if (!deps.registry || !deps._configAccessorFactory || !deps.db) {
+      throw new Error(
+        "makeFileProviderResolver: registry/_configAccessorFactory/db missing — " +
+          "mount the config + file-foundation features and wire context.db",
       );
-    })();
-    built.catch(() => cache.delete(tenantId));
-    cache.set(tenantId, built);
-    return built;
+    }
+    const config = deps._configAccessorFactory({
+      user: { id: SYSTEM_USER_ID, tenantId },
+      db: deps.db,
+      secrets: deps.secrets,
+    });
+    return createFileProviderForTenant(
+      { config, registry: deps.registry, secrets: deps.secrets, _userId: SYSTEM_USER_ID },
+      tenantId,
+    );
   };
 }

package/src/i18n/required-surface-keys.ts

@@ -5,7 +5,6 @@ import type {
   EntityListScreenDefinition,
   FeatureDefinition,
   NavDefinition,
-  ProjectionListScreenDefinition,
   RowAction,
   ScreenDefinition,
   ToolbarAction,
@@ -77,17 +76,6 @@ export function requiredKeysFromScreen(
       for (const action of list.toolbarActions ?? []) pushToolbarActionKeys(out, action);
       break;
     }
-    case "projectionList": {
-      const list = screen as ProjectionListScreenDefinition;
-      // Keine Entity → keine field-label-Fallbacks; nur explizite Column-Labels.
-      for (const col of list.columns) {
-        const normalized = normalizeListColumn(col);
-        if (normalized.label !== undefined) pushKey(out, normalized.label);
-      }
-      for (const action of list.rowActions ?? []) pushRowActionKeys(out, action);
-      for (const action of list.toolbarActions ?? []) pushToolbarActionKeys(out, action);
-      break;
-    }
     case "entityEdit": {
       const edit = screen as EntityEditScreenDefinition;
       pushKey(out, edit.submitLabel);

package/src/observability/__tests__/observability.integration.test.ts

@@ -1,6 +1,5 @@
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from "bun:test";
 import { z } from "zod";
-import type { TableColumns } from "../../db/dialect";
 import { buildEntityTable } from "../../db/table-builder";
 import { createRegistry, defineFeature } from "../../engine";
 import type { AppContext, SaveContext } from "../../engine/types";
@@ -66,9 +65,7 @@ const todoEntity = {
 
 let postSaveInvocations = 0;
 const todoFeature = defineFeature("todo", (r) => {
-  // Brand (#742) is compile-time-only; the unbranded TableColumns view keeps the
-  // method-form insert (and its observability span) working — runtime shape is identical.
-  const todoTable: TableColumns = buildEntityTable("todo", todoEntity);
+  const todoTable = buildEntityTable("todo", todoEntity);
   r.entity("todo", todoEntity);
 
   r.writeHandler(

package/src/pipeline/dispatcher.ts

@@ -717,8 +717,12 @@ export function createDispatcher(
       user,
       ip: reqCtx?.ip,
     });
-    // skip: ip-bucket + no IP (non-HTTP entry point) — pass through before
-    // requiring a resolver; HTTP path always has an IP + L1/L2 middleware.
+    // skip: ip-bucketed handler called from a non-HTTP entry point (job, seed,
+    //       MSP-apply) — no client IP to bucket on, nothing to enforce. Pass
+    //       through BEFORE requiring a resolver, so system/seed writes through
+    //       such a handler don't need a RateLimitResolver wired (the es-ops
+    //       seed dispatcher has none). L1/L2 middleware handle the HTTP-side
+    //       ip caps.
     if (bucket.kind === "skip") return;
     if (!context.rateLimit) {
       throw new InternalError({

package/src/pipeline/msp-rebuild.ts

@@ -11,16 +11,11 @@ import {
   rebuildMetaOrThrow,
   swapShadowIntoLive,
 } from "../db/queries/shadow-swap";
-import { runInSavepoint, selectMany } from "../db/query";
+import { selectMany } from "../db/query";
 import type { Registry, TenantId } from "../engine/types";
 import { InternalError } from "../errors";
 import { eventsTable, type StoredEvent, upcastStoredEvent } from "../event-store";
 import { loadAggregate, loadAggregateAsOf } from "../event-store/event-store";
-import {
-  createRebuildDeadLetterTable,
-  recordRebuildDeadLetters,
-  type SkippedApply,
-} from "../event-store/rebuild-dead-letter";
 import { upcastStoredEvents } from "../event-store/upcaster";
 import { emitProjectionRebuild } from "../observability/standard-metrics";
 import type { Meter } from "../observability/types/metric";
@@ -128,21 +123,12 @@ export async function rebuildMultiStreamProjection(
 
   const meta = rebuildMetaOrThrow(msp.table, mspName);
 
-  // Declared per-projection (MspErrorMode): the rebuild policy falls back to
-  // continuous when omitted — previously declared but never honored here.
-  const skipApplyErrors =
-    (msp.errorMode?.rebuild ?? msp.errorMode?.continuous)?.skipApplyErrors === true;
-
   const startedAt = Date.now();
   let eventsProcessed = 0;
   let lastProcessedEventId = 0n;
-  const skipped: SkippedApply[] = [];
 
   try {
     await ensureRebuildSchema(db);
-    // Outside the rebuild tx, like the schema: idempotent DDL colliding
-    // inside the tx would roll the whole replay back.
-    if (skipApplyErrors) await createRebuildDeadLetterTable(db);
     await db.begin(async (tx: DbTx) => {
       await resetConsumerForMspRebuild(tx, mspName, SHARED_INSTANCE_SENTINEL);
       await selectConsumerForUpdate(tx, mspName, SHARED_INSTANCE_SENTINEL);
@@ -192,31 +178,13 @@ export async function rebuildMultiStreamProjection(
           });
           const applyFn = msp.apply[row.type];
           if (!applyFn) continue;
-          if (skipApplyErrors) {
-            // Driver-native savepoint: a throwing SQL statement would
-            // otherwise poison the rebuild tx (25P02) AND make the driver
-            // reject the whole begin() even after a caught error. Apply +
-            // ctx run on the savepoint-scoped handle.
-            try {
-              await runInSavepoint(tx, async (sp) => {
-                const rebuildCtx = createRebuildCtx(registry, sp as DbRunner, row.tenantId);
-                await applyFn(storedEvent, sp as DbRunner, rebuildCtx);
-              });
-            } catch (e) {
-              skipped.push({ event: storedEvent, error: e });
-            }
-          } else {
-            const rebuildCtx = createRebuildCtx(registry, tx, row.tenantId);
-            await applyFn(storedEvent, tx, rebuildCtx);
-          }
+          const rebuildCtx = createRebuildCtx(registry, tx, row.tenantId);
+          await applyFn(storedEvent, tx, rebuildCtx);
           eventsProcessed++;
           lastProcessedEventId = row.id;
         }
       }
 
-      if (skipped.length > 0) {
-        await recordRebuildDeadLetters(tx, mspName, skipped);
-      }
       await updateConsumerRebuildCursor(
         tx,
         mspName,
@@ -242,7 +210,6 @@ export async function rebuildMultiStreamProjection(
   const result: RebuildResult = {
     projection: mspName,
     eventsProcessed,
-    eventsSkipped: skipped.length,
     lastProcessedEventId,
     durationMs: Date.now() - startedAt,
   };

package/src/pipeline/projection-rebuild.ts

@@ -13,7 +13,7 @@ import {
   rebuildMetaOrThrow,
   swapShadowIntoLive,
 } from "../db/queries/shadow-swap";
-import { coerceRow, extractTableInfo, runInSavepoint, selectMany } from "../db/query";
+import { coerceRow, extractTableInfo, selectMany } from "../db/query";
 import type { Registry, TenantId } from "../engine/types";
 import {
   eventsTable,
@@ -22,11 +22,6 @@ import {
   upcastStoredEvent,
 } from "../event-store";
 import type { EventMetadata } from "../event-store/event-store";
-import {
-  createRebuildDeadLetterTable,
-  recordRebuildDeadLetters,
-  type SkippedApply,
-} from "../event-store/rebuild-dead-letter";
 import { emitProjectionRebuild } from "../observability/standard-metrics";
 import type { Meter } from "../observability/types/metric";
 import { projectionStateTable } from "./projection-state";
@@ -124,12 +119,7 @@ function rowToStoredEvent(row: StoredEventRow): StoredEvent {
 
 export type RebuildResult = {
   readonly projection: string;
-  // Events consumed from the log — includes quarantined ones (the cursor
-  // advanced past them).
   readonly eventsProcessed: number;
-  // Poison events quarantined into kumiko_rebuild_dead_letters this run.
-  // Always 0 unless quarantine mode was active (#760).
-  readonly eventsSkipped: number;
   readonly lastProcessedEventId: bigint;
   readonly durationMs: number;
 };
@@ -155,15 +145,6 @@ type RebuildDeps = {
   // on the live table; if a long-running writer holds it past this, the rebuild
   // fails loud instead of hanging. Defaults to DEFAULT_FENCE_LOCK_TIMEOUT_MS.
   readonly fenceLockTimeoutMs?: number;
-  // Apply-error policy for THIS run. Default strict: the first throwing
-  // apply aborts the rebuild (tx rollback, status "failed") — a poison
-  // event makes the projection permanently un-rebuildable (#760).
-  // skipApplyErrors: true confines every apply to a savepoint; a throwing
-  // apply is rolled back, recorded into kumiko_rebuild_dead_letters and
-  // skipped, and the rebuild completes without its effect. Opt-in for
-  // operators unblocking a pinned rebuild — the projection then knowingly
-  // misses the quarantined events until they are repaired and replayed.
-  readonly errorPolicy?: { readonly skipApplyErrors?: boolean };
   // Test-only seam: fires once after the unlocked bulk drain and before the
   // cutover fence. Lets a concurrency test inject a committed write into the
   // replay window deterministically. The `__test_` prefix marks it test-only:
@@ -193,7 +174,7 @@ export async function rebuildProjection(
   const meta = rebuildMetaOrThrow(projection.table, projectionName);
 
   const sources = Array.isArray(projection.source) ? projection.source : [projection.source];
-  const sourcesList = [...sources, ...(projection.extraSources ?? [])];
+  const sourcesList = [...sources];
   const subscribedList = Object.keys(projection.apply);
   // Upcasters run at read time: older stored payloads get walked through the
   // registered r.eventMigration chain until their shape matches the current
@@ -204,11 +185,6 @@ export async function rebuildProjection(
   const startedAt = Date.now();
   let eventsProcessed = 0;
   let lastProcessedEventId = 0n;
-  const skipApplyErrors = deps.errorPolicy?.skipApplyErrors === true;
-  // Quarantined events, collected in memory and written once after the
-  // replay settles — the #443 full-re-replay path would otherwise duplicate
-  // the dead-letter rows.
-  let skipped: SkippedApply[] = [];
 
   // One chronological batch of events after lastProcessedEventId, applied into
   // the shadow. Returns the batch size so the caller can detect the tail
@@ -232,21 +208,7 @@ export async function rebuildProjection(
       // skip: apply-key validation ensures every subscribed type has a handler;
       //       defensive check against runtime-mutated registry
       if (!applyFn) continue;
-      if (skipApplyErrors) {
-        // Driver-native savepoint: a throwing SQL statement would otherwise
-        // poison the rebuild tx (25P02) AND make the driver reject the whole
-        // begin() even after a caught error. The apply runs on the
-        // savepoint-scoped handle so its statements are confined.
-        try {
-          await runInSavepoint(tx, async (sp) => {
-            await applyFn(storedEvent, sp as DbTx, projection.table);
-          });
-        } catch (e) {
-          skipped.push({ event: storedEvent, error: e });
-        }
-      } else {
-        await applyFn(storedEvent, tx, projection.table);
-      }
+      await applyFn(storedEvent, tx, projection.table);
       eventsProcessed++;
       lastProcessedEventId = row.id;
     }
@@ -255,9 +217,6 @@ export async function rebuildProjection(
 
   try {
     await ensureRebuildSchema(db);
-    // Outside the rebuild tx, like the schema: idempotent DDL colliding
-    // inside the tx would roll the whole replay back.
-    if (skipApplyErrors) await createRebuildDeadLetterTable(db);
     await db.begin(async (tx: DbTx) => {
       await markProjectionRebuilding(tx, projectionName);
       await buildShadowTable(tx, meta);
@@ -302,28 +261,12 @@ export async function rebuildProjection(
           deps.__test_onBuildShadowTable?.();
           lastProcessedEventId = 0n;
           eventsProcessed = 0;
-          skipped = [];
           while ((await drainBatch(tx)) === REBUILD_BATCH_SIZE) {
             // re-replay the full log into the fresh shadow
           }
-          // 656/2: drainBatch increments eventsProcessed for every drained row
-          // regardless of quarantine (skipApplyErrors), so this must hold
-          // exactly under the fence — a mismatch means drainBatch silently
-          // dropped a row instead of counting it, which the rest of this
-          // function has no other way to detect.
-          if (eventsProcessed < Number(expectedEvents)) {
-            throw new Error(
-              `projection-rebuild "${projectionName}": fenced re-replay processed ` +
-                `${eventsProcessed} events but ${expectedEvents} were expected — drainBatch ` +
-                "silently dropped rows instead of counting them.",
-            );
-          }
         }
       }
 
-      if (skipped.length > 0) {
-        await recordRebuildDeadLetters(tx, projectionName, skipped);
-      }
       await finalizeProjectionRebuild(tx, projectionName, lastProcessedEventId);
       await swapShadowIntoLive(tx, meta.tableName);
     });
@@ -349,7 +292,6 @@ export async function rebuildProjection(
   const result: RebuildResult = {
     projection: projectionName,
     eventsProcessed,
-    eventsSkipped: skipped.length,
     lastProcessedEventId,
     durationMs: Date.now() - startedAt,
   };

package/src/schema-cli.ts

@@ -44,28 +44,17 @@ export type SchemaCliOut = {
 
 const SNAPSHOT_FILENAME = ".snapshot.json";
 
-type SchemaMod = {
-  readonly entityMetas: Parameters<typeof renderTablesDdl>[0];
-  readonly features?: unknown;
-};
-
-// Single load-path for kumiko/schema.ts (512/3) — `generate` and `validate`
-// both need ENTITY_METAS (and validate additionally wants FEATURES); this is
-// the one place that enforces "ENTITY_METAS must be an array" so the two
-// commands can't drift on the check or its wording. Throws — callers that
-// want a graceful exit code (validate) catch it themselves.
-async function loadSchemaModFromApp(schemaFile: string): Promise<SchemaMod> {
+async function loadEntityMetasFromApp(
+  schemaFile: string,
+): Promise<Parameters<typeof renderTablesDdl>[0]> {
   // bun imports TS directly — no spawn needed.
-  const mod = (await import(schemaFile)) as { ENTITY_METAS?: unknown; FEATURES?: unknown };
+  const mod = (await import(schemaFile)) as { ENTITY_METAS?: unknown };
   if (!Array.isArray(mod.ENTITY_METAS)) {
     throw new Error(
       `Schema file ${schemaFile} muss \`export const ENTITY_METAS: EntityTableMeta[]\` haben.`,
     );
   }
-  return {
-    entityMetas: mod.ENTITY_METAS as Parameters<typeof renderTablesDdl>[0],
-    features: mod.FEATURES,
-  };
+  return mod.ENTITY_METAS as Parameters<typeof renderTablesDdl>[0];
 }
 
 function nextSequenceNumber(migrationsDir: string): number {
@@ -143,7 +132,7 @@ export async function runSchemaCli(
         out.err("    export const ENTITY_METAS: EntityTableMeta[] = [...]");
         return 1;
       }
-      const { entityMetas: metas } = await loadSchemaModFromApp(schemaFile);
+      const metas = await loadEntityMetasFromApp(schemaFile);
       const snapshotPath = join(migrationsDir, SNAPSHOT_FILENAME);
       const prevSnapshot = existsSync(snapshotPath) ? loadSnapshotJson(snapshotPath) : null;
       const result = generateMigration({
@@ -202,18 +191,20 @@ export async function runSchemaCli(
         out.err("    export const ENTITY_METAS: EntityTableMeta[] = [...]");
         return 1;
       }
-      let schemaMod: SchemaMod;
-      try {
-        schemaMod = await loadSchemaModFromApp(schemaFile);
-      } catch (e) {
-        out.err(`  ${e instanceof Error ? e.message : String(e)}`);
+      const mod = (await import(schemaFile)) as {
+        ENTITY_METAS?: unknown;
+        FEATURES?: unknown;
+      };
+      if (!Array.isArray(mod.ENTITY_METAS)) {
+        out.err(
+          `  Schema file ${schemaFile} muss \`export const ENTITY_METAS: EntityTableMeta[]\` haben.`,
+        );
         return 1;
       }
-      const mod = { FEATURES: schemaMod.features };
       let ok = true;
 
       // 1. Schema drift — compute the diff, never write.
-      const metas = schemaMod.entityMetas;
+      const metas = mod.ENTITY_METAS as Parameters<typeof renderTablesDdl>[0];
       const snapshotPath = join(migrationsDir, SNAPSHOT_FILENAME);
       const prevSnapshot = existsSync(snapshotPath) ? loadSnapshotJson(snapshotPath) : null;
       const drift = generateMigration({

package/src/secrets/__tests__/contains-secret.test.ts

@@ -32,18 +32,6 @@ export type _R6TypeAssertions = [
   // the backstop. This is what keeps generic-over-response handlers compiling.
   Expect<Equal<ContainsSecret<unknown>, false>>,
   Expect<Equal<ContainsSecret<never>, false>>,
-  // 556/3: ContainsSecret<A | B> distributes over the union (naked type
-  // param) to `ContainsSecret<A> | ContainsSecret<B>` = `boolean`, not the
-  // literal `true` — pinned here so a future change to this predicate can't
-  // silently regress it. The actual leak-guard in define-handler.ts compares
-  // via `true extends ContainsSecret<TData>` (556/1) instead of `ContainsSecret<
-  // TData> extends true`, which is fail-closed for `boolean` either way.
-  Expect<Equal<ContainsSecret<{ ok: true } | { s: Secret<string> }>, boolean>>,
-  // 556/2: Map/Set are explicit SafeLeaf members now — pins that the runtime
-  // guard's "walk Map/Set entries separately" intent is mirrored, not an
-  // accidental compile-time blind spot.
-  Expect<Equal<ContainsSecret<Map<string, Secret<string>>>, false>>,
-  Expect<Equal<ContainsSecret<Set<Secret<string>>>, false>>,
 ];
 
 const schema = z.object({ q: z.string() });
@@ -69,28 +57,6 @@ function genericResponseHandler<K extends string>(kind: K) {
 }
 void genericResponseHandler;
 
-// 556/1: ContainsSecret<A | B> distributes over the union (naked type param
-// in the condition) to `ContainsSecret<A> | ContainsSecret<B>` = `boolean`,
-// not the literal `true` — a check written as `ContainsSecret<TData> extends
-// true` silently passes a union with a leak hidden in ONE branch. Both
-// assertions below must hold: the guard rejects the leaking union AND still
-// accepts the clean one, proving the fix (membership form on the phantom
-// param) is fail-closed for unions, not just for a bare Secret<>.
-declare const leakingUnion: { ok: true } | { apiKey: Secret<string> };
-// @ts-expect-error — R6: a Secret<> hidden in one union branch must still leak-guard
-defineQueryHandler({
-  name: "t:query:union-leak",
-  schema,
-  handler: async () => leakingUnion,
-});
-
-declare const cleanUnion: { ok: true } | { id: string };
-defineQueryHandler({
-  name: "t:query:union-clean",
-  schema,
-  handler: async () => cleanUnion,
-});
-
 describe("R6 ContainsSecret", () => {
   test("a clean query handler still builds — the guard param is invisible", () => {
     const def = defineQueryHandler({

package/src/secrets/dek-cache.ts

@@ -9,7 +9,7 @@
 //   - maxEntries (default 1000): LRU eviction kicks in on insert when full.
 
 import { createHash } from "node:crypto";
-import type { KeyScope, MasterKeyProvider } from "./types";
+import type { MasterKeyProvider } from "./types";
 
 const DEFAULT_TTL_MS = 5 * 60 * 1000; // 5 minutes
 const DEFAULT_MAX_ENTRIES = 1000;
@@ -25,16 +25,8 @@ export type DekCacheOptions = {
 
 export type DekCache = {
   // Unwrap via the provider, caching the result. Second call within TTL
-  // returns the cached DEK without hitting the provider. The cache key is
-  // (encryptedDek, kekVersion) — scope is only forwarded to the provider;
-  // encryptedDek bytes are unique per value, so scoped providers can't
-  // collide on the key either.
-  unwrapDek(
-    encryptedDek: Buffer,
-    kekVersion: number,
-    provider: MasterKeyProvider,
-    scope?: KeyScope,
-  ): Promise<Buffer>;
+  // returns the cached DEK without hitting the provider.
+  unwrapDek(encryptedDek: Buffer, kekVersion: number, provider: MasterKeyProvider): Promise<Buffer>;
 
   // Drop every entry. Call after KEK rotation so old cached DEKs (still
   // valid, but referencing the old kekVersion) don't serve reads that
@@ -45,19 +37,6 @@ export type DekCache = {
   size(): number;
 };
 
-// Wrap a provider so its unwrapDek goes through the cache. Callers keep the
-// full MasterKeyProvider contract without knowing about caching —
-// decryptValue handles crypto, the cache handles cost.
-export function withDekCache(provider: MasterKeyProvider, cache: DekCache): MasterKeyProvider {
-  return {
-    wrapDek: (dek, scope) => provider.wrapDek(dek, scope),
-    unwrapDek: (encryptedDek, version, scope) =>
-      cache.unwrapDek(encryptedDek, version, provider, scope),
-    currentVersion: () => provider.currentVersion(),
-    isAvailable: () => provider.isAvailable(),
-  };
-}
-
 export function createDekCache(opts: DekCacheOptions = {}): DekCache {
   const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
   const maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
@@ -95,7 +74,7 @@ export function createDekCache(opts: DekCacheOptions = {}): DekCache {
   }
 
   return {
-    async unwrapDek(encryptedDek, kekVersion, provider, scope) {
+    async unwrapDek(encryptedDek, kekVersion, provider) {
       const key = cacheKey(encryptedDek, kekVersion);
       const hit = entries.get(key);
       if (hit && hit.expiresAt > now()) {
@@ -113,7 +92,7 @@ export function createDekCache(opts: DekCacheOptions = {}): DekCache {
         entries.delete(key);
       }
 
-      const dek = await provider.unwrapDek(encryptedDek, kekVersion, scope);
+      const dek = await provider.unwrapDek(encryptedDek, kekVersion);
       evictOldestIfFull();
       // Store a copy — caller can zero its own buffer after use.
       entries.set(key, { dek: Buffer.from(dek), expiresAt: now() + ttlMs });

package/src/secrets/envelope.ts

@@ -3,7 +3,7 @@
 // carries everything needed to decrypt later.
 
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import type { Envelope, KeyScope, MasterKeyProvider } from "./types";
+import type { Envelope, MasterKeyProvider } from "./types";
 
 const ALGORITHM = "aes-256-gcm";
 const DEK_LENGTH = 32; // AES-256
@@ -14,7 +14,6 @@ const IV_LENGTH = 12; // GCM standard nonce length
 export async function encryptValue(
   plaintext: string,
   provider: MasterKeyProvider,
-  scope?: KeyScope,
 ): Promise<Envelope> {
   // Fresh DEK per value. Reusing DEKs across rows would break forward
   // secrecy (one compromised ciphertext-IV pair leaks information about
@@ -27,7 +26,7 @@ export async function encryptValue(
     const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
     const authTag = cipher.getAuthTag();
 
-    const { encryptedDek, kekVersion } = await provider.wrapDek(dek, scope);
+    const { encryptedDek, kekVersion } = await provider.wrapDek(dek);
     return { ciphertext, iv, authTag, encryptedDek, kekVersion };
   } finally {
     // Zero the DEK on best effort regardless of success — if provider.wrapDek
@@ -43,9 +42,8 @@ export async function encryptValue(
 export async function decryptValue(
   envelope: Envelope,
   provider: MasterKeyProvider,
-  scope?: KeyScope,
 ): Promise<string> {
-  const dek = await provider.unwrapDek(envelope.encryptedDek, envelope.kekVersion, scope);
+  const dek = await provider.unwrapDek(envelope.encryptedDek, envelope.kekVersion);
   try {
     const decipher = createDecipheriv(ALGORITHM, dek, envelope.iv);
     decipher.setAuthTag(envelope.authTag);

package/src/secrets/index.ts

@@ -1,29 +1,17 @@
-export { createDekCache, type DekCache, type DekCacheOptions, withDekCache } from "./dek-cache";
+export { createDekCache, type DekCache, type DekCacheOptions } from "./dek-cache";
 export {
   createEnvMasterKeyProvider,
   type EnvMasterKeyProviderOptions,
   type Keyring,
 } from "./env-master-key-provider";
 export { decryptValue, encryptValue } from "./envelope";
-export {
-  createEnvelopeCipher,
-  type EnvelopeCipher,
-  type EnvelopeCipherOptions,
-} from "./envelope-cipher";
 export { assertNoSecretLeak } from "./leak-guard";
 export { rewrapDek } from "./rotation";
-export {
-  decodeStoredEnvelope,
-  encodeStoredEnvelope,
-  isStoredEnvelope,
-  type StoredEnvelope,
-} from "./stored-envelope";
 export {
   type ContainsSecret,
   createSecret,
   type Envelope,
   isSecret,
-  type KeyScope,
   type MasterKeyProvider,
   type Secret,
   type SecretAuditContext,