@cosmicdrift/kumiko-framework 0.158.2 → 0.160.0

package/src/db/__tests__/event-store-executor-write-verbs.integration.test.ts

@@ -0,0 +1,396 @@
+// The five write-verbs (create/update/delete/forget/restore) have several
+// error paths the existing suites (event-store-executor.integration.test.ts,
+// unique-violation-mapping.integration.test.ts) don't touch: entity- and
+// field-level ownership denials, explicit version conflicts, the forget()
+// verb entirely, and restore()'s two precondition failures.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "../../db/query";
+import { createEntity, createTextField } from "../../engine";
+import { from } from "../../engine/ownership";
+import { createEventsTable } from "../../event-store";
+import type { EntityCache } from "../../pipeline/entity-cache";
+import { createTestDb, type TestDb, TestUsers, unsafeCreateEntityTable } from "../../stack";
+import { createEventStoreExecutor } from "../event-store-executor";
+import { buildEntityTable } from "../table-builder";
+import { createTenantDb, type TenantDb } from "../tenant-db";
+
+let testDb: TestDb;
+let tdb: TenantDb;
+const admin = TestUsers.admin;
+const nonAdmin = TestUsers.user;
+
+beforeAll(async () => {
+  testDb = await createTestDb();
+  await createEventsTable(testDb.db);
+  tdb = createTenantDb(testDb.db, admin.tenantId);
+});
+
+afterAll(async () => {
+  await testDb.cleanup();
+});
+
+// =============================================================================
+// entity-level ownership_denied — create/update/delete/forget/restore
+// =============================================================================
+
+const restrictedEntity = createEntity({
+  table: "read_es_write_restricted",
+  fields: {
+    email: createTextField({ required: true }),
+  },
+  softDelete: true,
+  access: { write: { Admin: "all" } },
+});
+const restrictedTable = buildEntityTable("esWriteRestricted", restrictedEntity);
+
+describe("event-store-executor write-verbs — entity-level ownership_denied", () => {
+  const crud = createEventStoreExecutor(restrictedTable, restrictedEntity, {
+    entityName: "esWriteRestricted",
+  });
+
+  beforeAll(async () => {
+    await unsafeCreateEntityTableFor(restrictedEntity, "esWriteRestricted");
+  });
+
+  beforeEach(async () => {
+    await asRawClient(testDb.db).unsafe(
+      `TRUNCATE kumiko_events, read_es_write_restricted RESTART IDENTITY CASCADE`,
+    );
+  });
+
+  test("create: role without a write-rule → ownership_denied", async () => {
+    const result = await crud.create({ email: "denied@test.de" }, nonAdmin, tdb);
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    expect((result.error.details as { reason?: string }).reason).toBe("ownership_denied");
+  });
+
+  test("update: role without a write-rule → ownership_denied", async () => {
+    const created = await crud.create({ email: "owner@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.update(
+      { id: created.data.id, version: 1, changes: { email: "changed@test.de" } },
+      nonAdmin,
+      tdb,
+    );
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    expect((result.error.details as { reason?: string }).reason).toBe("ownership_denied");
+  });
+
+  test("delete: role without a write-rule → ownership_denied", async () => {
+    const created = await crud.create({ email: "todelete@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.delete({ id: created.data.id }, nonAdmin, tdb);
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    expect((result.error.details as { reason?: string }).reason).toBe("ownership_denied");
+  });
+
+  test("forget: role without a write-rule → ownership_denied", async () => {
+    const created = await crud.create({ email: "toforget@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.forget({ id: created.data.id }, nonAdmin, tdb);
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    expect((result.error.details as { reason?: string }).reason).toBe("ownership_denied");
+  });
+
+  test("forget: happy path hard-deletes the row and appends a forgotten event", async () => {
+    const created = await crud.create({ email: "gone@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.forget({ id: created.data.id }, admin, tdb);
+    expect(result.isSuccess).toBe(true);
+
+    const rows = (await asRawClient(testDb.db).unsafe(
+      `SELECT id FROM read_es_write_restricted WHERE email = 'gone@test.de'`,
+    )) as unknown[];
+    expect(rows).toHaveLength(0);
+
+    const events = (await asRawClient(testDb.db).unsafe(
+      `SELECT type FROM kumiko_events WHERE type = 'esWriteRestricted.forgotten'`,
+    )) as unknown[];
+    expect(events).toHaveLength(1);
+  });
+
+  test("restore: role without a write-rule → ownership_denied", async () => {
+    const created = await crud.create({ email: "torestore@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+    await crud.delete({ id: created.data.id }, admin, tdb);
+
+    const result = await crud.restore({ id: created.data.id }, nonAdmin, tdb);
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    expect((result.error.details as { reason?: string }).reason).toBe("ownership_denied");
+  });
+
+  test("restore: not yet deleted row → not_deleted", async () => {
+    const created = await crud.create({ email: "notdeleted@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.restore({ id: created.data.id }, admin, tdb);
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    expect((result.error.details as { reason?: string }).reason).toBe("not_deleted");
+  });
+});
+
+// =============================================================================
+// restore() on a non-soft-delete entity → soft_delete_not_enabled
+// =============================================================================
+
+const hardDeleteEntity = createEntity({
+  table: "read_es_write_hard",
+  fields: {
+    email: createTextField({ required: true }),
+  },
+});
+const hardDeleteTable = buildEntityTable("esWriteHard", hardDeleteEntity);
+
+describe("event-store-executor write-verbs — restore without softDelete", () => {
+  const crud = createEventStoreExecutor(hardDeleteTable, hardDeleteEntity, {
+    entityName: "esWriteHard",
+  });
+
+  beforeAll(async () => {
+    await unsafeCreateEntityTableFor(hardDeleteEntity, "esWriteHard");
+  });
+
+  beforeEach(async () => {
+    await asRawClient(testDb.db).unsafe(
+      `TRUNCATE kumiko_events, read_es_write_hard RESTART IDENTITY CASCADE`,
+    );
+  });
+
+  test("restore on an entity without softDelete → soft_delete_not_enabled", async () => {
+    const created = await crud.create({ email: "hard@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.restore({ id: created.data.id }, admin, tdb);
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    expect((result.error.details as { reason?: string }).reason).toBe("soft_delete_not_enabled");
+  });
+});
+
+// =============================================================================
+// field-level ownership_denied — checkWriteFieldOwnership via a row-scoped rule
+// =============================================================================
+
+const ownedFieldEntity = createEntity({
+  table: "read_es_write_owned_field",
+  fields: {
+    authorId: createTextField({ required: true }),
+    note: createTextField({
+      access: { write: { Admin: "all", User: from("user:id", "authorId") } },
+    }),
+  },
+});
+const ownedFieldTable = buildEntityTable("esWriteOwnedField", ownedFieldEntity);
+
+describe("event-store-executor write-verbs — field-level ownership_denied", () => {
+  const crud = createEventStoreExecutor(ownedFieldTable, ownedFieldEntity, {
+    entityName: "esWriteOwnedField",
+  });
+
+  beforeAll(async () => {
+    await unsafeCreateEntityTableFor(ownedFieldEntity, "esWriteOwnedField");
+  });
+
+  beforeEach(async () => {
+    await asRawClient(testDb.db).unsafe(
+      `TRUNCATE kumiko_events, read_es_write_owned_field RESTART IDENTITY CASCADE`,
+    );
+  });
+
+  test("create: writing `note` while authorId names someone else → ownership_denied (field scope)", async () => {
+    const result = await crud.create(
+      { authorId: TestUsers.driver.id, note: "not mine" },
+      nonAdmin,
+      tdb,
+    );
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    const details = result.error.details as { reason?: string; scope?: string; field?: string };
+    expect(details.reason).toBe("ownership_denied");
+    expect(details.scope).toBe("field");
+    expect(details.field).toBe("note");
+  });
+
+  test("create: writing `note` as the named author succeeds", async () => {
+    const result = await crud.create({ authorId: nonAdmin.id, note: "mine" }, nonAdmin, tdb);
+    expect(result.isSuccess).toBe(true);
+  });
+
+  test("update: changing `note` on someone else's row → ownership_denied (field scope)", async () => {
+    const created = await crud.create(
+      { authorId: TestUsers.driver.id, note: "original" },
+      admin,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.update(
+      { id: created.data.id, version: 1, changes: { note: "hijacked" } },
+      nonAdmin,
+      tdb,
+    );
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    expect((result.error.details as { reason?: string }).reason).toBe("ownership_denied");
+  });
+});
+
+// =============================================================================
+// version_conflict — explicit-id create collision, missing version on update
+// =============================================================================
+
+const versionEntity = createEntity({
+  table: "read_es_write_version",
+  fields: {
+    email: createTextField({ required: true }),
+  },
+});
+const versionTable = buildEntityTable("esWriteVersion", versionEntity);
+
+describe("event-store-executor write-verbs — version_conflict edge cases", () => {
+  const crud = createEventStoreExecutor(versionTable, versionEntity, {
+    entityName: "esWriteVersion",
+  });
+
+  beforeAll(async () => {
+    await unsafeCreateEntityTableFor(versionEntity, "esWriteVersion");
+  });
+
+  beforeEach(async () => {
+    await asRawClient(testDb.db).unsafe(
+      `TRUNCATE kumiko_events, read_es_write_version RESTART IDENTITY CASCADE`,
+    );
+  });
+
+  test("create with an explicit id that already has a stream → version_conflict", async () => {
+    const first = await crud.create({ email: "first@test.de" }, admin, tdb);
+    if (!first.isSuccess) throw new Error("setup failed");
+
+    const collision = await crud.create({ id: first.data.id, email: "second@test.de" }, admin, tdb);
+    expect(collision.isSuccess).toBe(false);
+    if (collision.isSuccess) return;
+    expect(collision.error.code).toBe("version_conflict");
+  });
+
+  test("update without a version field (and no skipOptimisticLock) → version_conflict", async () => {
+    const created = await crud.create({ email: "noversion@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.update(
+      { id: created.data.id, changes: { email: "changed@test.de" } },
+      admin,
+      tdb,
+    );
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    expect(result.error.code).toBe("version_conflict");
+  });
+});
+
+async function unsafeCreateEntityTableFor(
+  entity: Parameters<typeof buildEntityTable>[1],
+  name: string,
+): Promise<void> {
+  await unsafeCreateEntityTable(testDb.db, entity, name);
+}
+
+// =============================================================================
+// Concurrent update race → EventStoreVersionConflict catch + entityCache.del
+// on forget/restore (create/update/delete already exercise cache in the
+// main suite; forget/restore del() stayed uncovered).
+// =============================================================================
+
+const raceEntity = createEntity({
+  table: "read_es_write_race",
+  fields: {
+    email: createTextField({ required: true }),
+  },
+  softDelete: true,
+});
+const raceTable = buildEntityTable("esWriteRace", raceEntity);
+
+describe("event-store-executor write-verbs — concurrent version race + cache", () => {
+  const store = new Map<string, Record<string, unknown>>();
+  const entityCache: EntityCache = {
+    get: async (tenantId, name, id) => store.get(`${tenantId}:${name}:${id}`) ?? null,
+    mget: async () => new Map(),
+    set: async (tenantId, name, id, data) => {
+      store.set(`${tenantId}:${name}:${id}`, data);
+    },
+    mset: async (tenantId, name, entries) => {
+      for (const { id, data } of entries) store.set(`${tenantId}:${name}:${id}`, data);
+    },
+    del: async (tenantId, name, id) => {
+      store.delete(`${tenantId}:${name}:${id}`);
+    },
+  };
+  const crud = createEventStoreExecutor(raceTable, raceEntity, {
+    entityName: "esWriteRace",
+    entityCache,
+  });
+
+  beforeAll(async () => {
+    await unsafeCreateEntityTableFor(raceEntity, "esWriteRace");
+  });
+
+  beforeEach(async () => {
+    store.clear();
+    await asRawClient(testDb.db).unsafe(
+      `TRUNCATE kumiko_events, read_es_write_race RESTART IDENTITY CASCADE`,
+    );
+  });
+
+  test("two concurrent updates with the same version → one wins, one version_conflict", async () => {
+    const created = await crud.create({ email: "race@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+    const id = created.data.id;
+
+    const [a, b] = await Promise.all([
+      crud.update({ id, version: 1, changes: { email: "a@test.de" } }, admin, tdb),
+      crud.update({ id, version: 1, changes: { email: "b@test.de" } }, admin, tdb),
+    ]);
+
+    const results = [a, b];
+    expect(results.filter((r) => r.isSuccess)).toHaveLength(1);
+    expect(results.filter((r) => !r.isSuccess && r.error.code === "version_conflict")).toHaveLength(
+      1,
+    );
+  });
+
+  test("forget with entityCache clears the cache entry", async () => {
+    const created = await crud.create({ email: "cache-forget@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+    const id = created.data.id;
+    const key = `${admin.tenantId}:esWriteRace:${id}`;
+    store.set(key, { email: "poison" });
+
+    const result = await crud.forget({ id }, admin, tdb);
+    expect(result.isSuccess).toBe(true);
+    expect(store.has(key)).toBe(false);
+  });
+
+  test("restore with entityCache clears the cache entry", async () => {
+    const created = await crud.create({ email: "cache-restore@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+    const id = created.data.id;
+    await crud.delete({ id }, admin, tdb);
+
+    const key = `${admin.tenantId}:esWriteRace:${id}`;
+    store.set(key, { email: "poison" });
+
+    const result = await crud.restore({ id }, admin, tdb);
+    expect(result.isSuccess).toBe(true);
+    expect(store.has(key)).toBe(false);
+  });
+});

package/src/db/__tests__/event-store-executor.integration.test.ts

@@ -1,5 +1,5 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { InMemoryKmsAdapter, PII_ERASED_SENTINEL } from "../../crypto";
+import { InMemoryKmsAdapter, PII_CIPHERTEXT_PREFIX, PII_ERASED_SENTINEL } from "../../crypto";
 import { asRawClient } from "../../db/query";
 import { createBooleanField, createEntity, createTextField } from "../../engine";
 import { append, createEventsTable, loadEventsAfterVersion } from "../../event-store";
@@ -726,13 +726,13 @@ describe("event-store-executor — pii subject encryption", () => {
     const rawRows = (await asRawClient(testDb.db).unsafe(
       `SELECT email, plain FROM read_es_exec_pii LIMIT 1`,
     )) as Array<{ email: string; plain: string }>;
-    expect(rawRows[0]!.email).toStartWith(`kumiko-pii:v1:user:${result.data.id}:`);
+    expect(rawRows[0]!.email).toStartWith(`${PII_CIPHERTEXT_PREFIX}user:${result.data.id}:`);
     expect(rawRows[0]!.plain).toBe("visible");
 
     const events = (await asRawClient(testDb.db).unsafe(
       `SELECT payload FROM kumiko_events WHERE type = 'esExecPii.created' LIMIT 1`,
     )) as Array<{ payload: { email?: string } }>;
-    expect(events[0]?.payload.email).toStartWith("kumiko-pii:v1:");
+    expect(events[0]?.payload.email).toStartWith(PII_CIPHERTEXT_PREFIX);
 
     const detail = await crud.detail({ id: result.data.id }, adminUser, tdb);
     expect(detail?.["email"]).toBe("pii@test.de");
@@ -759,7 +759,7 @@ describe("event-store-executor — pii subject encryption", () => {
     const rawRows = (await asRawClient(testDb.db).unsafe(
       `SELECT note FROM read_es_exec_pii LIMIT 1`,
     )) as Array<{ note: string }>;
-    expect(rawRows[0]!.note).toStartWith(`kumiko-pii:v1:user:${TestUsers.admin.id}:`);
+    expect(rawRows[0]!.note).toStartWith(`${PII_CIPHERTEXT_PREFIX}user:${TestUsers.admin.id}:`);
   });
 
   test("eraseKey: detail renders the sentinel, stored events stay byte-identical", async () => {
@@ -805,7 +805,7 @@ describe("event-store-executor — pii subject encryption", () => {
     const rawRows = (await asRawClient(testDb.db).unsafe(
       `SELECT email FROM read_es_exec_pii LIMIT 1`,
     )) as Array<{ email: string }>;
-    expect(rawRows[0]!.email).toStartWith("kumiko-pii:v1:");
+    expect(rawRows[0]!.email).toStartWith(PII_CIPHERTEXT_PREFIX);
     expect(rawRows[0]!.email).not.toContain("rebuild@test.de");
 
     const detail = await crud.detail({ id: created.data.id }, adminUser, tdb);

package/src/db/blind-index-cleanup.ts

@@ -31,7 +31,9 @@ export async function nullBlindIndexesForSubject(
   features: ReadonlyMap<string, FeatureDefinition>,
   subjectKey: string,
 ): Promise<void> {
-  const likePattern = `kumiko-pii:v1:${escapeLikePattern(subjectKey)}:%`;
+  // "v%" matches any format version (v1 no-AAD, v2 AAD-bound, #1263) — the
+  // subject key placement is stable across versions.
+  const likePattern = `kumiko-pii:v%:${escapeLikePattern(subjectKey)}:%`;
   for (const feature of features.values()) {
     for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
       const lookupable = collectLookupableFields(entity);

package/src/db/connection.ts

@@ -1,20 +1,12 @@
 // DB-Connection-Types: provider-agnostic via db/api.ts.
 // createConnection delegiert an postgres-provider (default) oder bun-provider (DB_PROVIDER=bun).
+import type { DbConnection, PgClient } from "@cosmicdrift/kumiko-types/db-connection";
 import postgres from "postgres";
 import { readPositiveIntEnv } from "../utils/env-parse";
 
-export { createConnection, type DbConnectionOptions } from "./api";
-
 // Legacy Types — für Aufrufer die direkt diese Module importieren
-// biome-ignore lint/suspicious/noExplicitAny: Bun.SQL global type
-export type DbConnection = ReturnType<typeof postgres> | any;
-// biome-ignore lint/suspicious/noExplicitAny: postgres-js namespace lookup
-export type DbTx = postgres.TransactionSql<any> | any;
-export type DbRunner = DbConnection | DbTx;
-export type DbRow = Record<string, unknown>;
-export type PgClient = ReturnType<typeof postgres>;
-
-export type PgListenClient = ReturnType<typeof postgres>;
+export * from "@cosmicdrift/kumiko-types/db-connection";
+export { createConnection, type DbConnectionOptions } from "./api";
 
 // Legacy: postgres-js only. Neue Aufrufer: createConnection() aus api.ts.
 // guard:dup-ok — andere Layer als createPgConnection (gibt DbConnection zurück, nicht postgres-Instanz)

package/src/db/cursor.ts

@@ -1,21 +1,4 @@
-import type { EntityId, TenantId } from "../engine/types/identifiers";
-
-export type CursorQueryOptions = {
-  tenantId: TenantId;
-  cursor?: string;
-  limit?: number;
-  filterIds?: readonly EntityId[];
-  sort?: string;
-  sortDirection?: "asc" | "desc";
-};
-
-export type CursorResult<T> = {
-  rows: T[];
-  nextCursor: string | null;
-  /** Optional total row count — nur present wenn der Caller `totalCount: true`
-   *  in der Query setzt. */
-  total?: number;
-};
+export type { CursorQueryOptions, CursorResult } from "@cosmicdrift/kumiko-types/cursor-types";
 
 // String-basiert damit UUIDs (Default seit Sprint F) + Integer-Auto-Increment
 // durch denselben Cursor-Pfad laufen. UUIDv7 erfüllt die lex-Monotonie

package/src/db/dialect.ts

@@ -13,6 +13,12 @@
 // The framework no longer imports drizzle-orm at runtime — schema-files
 // use only this module.
 
+import {
+  type ColumnHandle,
+  KUMIKO_COLUMNS_SYMBOL,
+  KUMIKO_NAME_SYMBOL,
+  type SchemaTable,
+} from "@cosmicdrift/kumiko-types/schema-table-types";
 import type {
   ColumnMeta,
   CompositePrimaryKeyMeta,
@@ -21,6 +27,8 @@ import type {
   PgType,
 } from "./entity-table-meta";
 
+export type { ColumnHandle, SchemaTable } from "@cosmicdrift/kumiko-types/schema-table-types";
+
 // Public type aliases — historical compat for callers that used to import
 // these from drizzle-orm/pg-core. SelectQuery is no longer a meaningful
 // shape (no chain builder); TableColumns is the new SchemaTable union.
@@ -29,31 +37,12 @@ export type TableColumns<_T = any> = SchemaTable;
 // biome-ignore lint/suspicious/noExplicitAny: legacy type — chain API is gone
 export type SelectQuery = any;
 
-// Column handle exposed on the SchemaTable. The `name` is the SQL column
-// name (snake_case); legacy code accesses `table.fieldName.name` to
-// produce raw SQL.
-export type ColumnHandle = {
-  readonly name: string;
-  readonly pgType: PgType;
-  readonly getSQLType: () => string;
-};
-
-const KUMIKO_NAME_SYMBOL = Symbol.for("kumiko:schema:Name");
-const KUMIKO_COLUMNS_SYMBOL = Symbol.for("kumiko:schema:Columns");
 // Shadow-proof handle on the EntityTableMeta. The column handles below are
 // spread as enumerable props, so an entity field named `source`/`columns`/
 // `tableName`/… would overwrite the matching meta key. extractTableInfo reads
 // the canonical meta from this symbol instead of the (shadowable) props.
 const KUMIKO_META_SYMBOL = Symbol.for("kumiko:schema:Meta");
 
-// SchemaTable — opaque shape with both EntityTableMeta + Symbol-based
-// introspection. Returned by `table(...)`.
-export type SchemaTable = EntityTableMeta & {
-  readonly [KUMIKO_NAME_SYMBOL]: string;
-  readonly [KUMIKO_COLUMNS_SYMBOL]: Record<string, ColumnHandle>;
-  readonly [field: string]: unknown;
-};
-
 function isNumericPgType(t: PgType): t is `numeric(${number},${number})` {
   return t.startsWith("numeric(");
 }

package/src/db/encryption.ts

@@ -12,9 +12,8 @@ export type EncryptionProvider = {
 /**
  * @deprecated Legacy single-key format: base64(iv+tag+ct) with NO key id —
  * a key change makes existing ciphertexts permanently undecryptable. Use
- * `createEnvelopeCipher` (@cosmicdrift/kumiko-framework/secrets) for new code; this
- * provider remains only as the decrypt-fallback for pre-envelope values
- * (EnvelopeCipherOptions.legacy) until a re-encrypt job migrated them.
+ * `createEnvelopeCipher` (@cosmicdrift/kumiko-framework/secrets) for new code;
+ * this provider has no consumers left in the framework.
  */
 export function createEncryptionProvider(key: string): EncryptionProvider {
   // Key must be 32 bytes for AES-256

package/src/db/entity-table-meta-types.ts

@@ -0,0 +1,2 @@
+// Legacy path — re-exported for callers still importing this module directly.
+export * from "@cosmicdrift/kumiko-types/entity-table-meta-types";