@cosmicdrift/kumiko-framework 0.327.0 → 0.328.1

package/dist/compliance/sub-processors.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Bundle-Tier-Marker fuer SubProcessor.appliesTo. "all-tiers" matched
+ * unabhaengig vom konkreten Tenant-Bundle (z.B. Hetzner als Hosting-
+ * Provider). Konkrete Tier-Namen koennen per-Tenant gefiltert werden.
+ */
+export type BundleTier = "all-tiers" | "standard" | "business" | "enterprise";
+/**
+ * Beschreibt einen Auftragsverarbeiter (Art. 28 DSGVO) der von Kumiko
+ * fuer den Plattform-Betrieb eingesetzt wird.
+ */
+export interface SubProcessor {
+    /** Voller juristischer Name. */
+    readonly name: string;
+    /** Was macht der Sub-Processor fuer uns? */
+    readonly purpose: string;
+    /** Sitz / Datenverarbeitungs-Region. */
+    readonly region: string;
+    /** Link zum Auftragsverarbeitungsvertrag (DPA/AVV). */
+    readonly dpa: string;
+    /** Wann wurde der Sub-Processor zu unserer Plattform hinzugefuegt? */
+    readonly addedAt: string;
+    /**
+     * Welche Bundle-Tiers nutzen diesen Sub-Processor?
+     * Tenants nicht-betroffener Tiers brauchen keine Notification bei
+     * Aenderungen.
+     */
+    readonly appliesTo: readonly BundleTier[];
+    /**
+     * Standard Contractual Clauses (SCC) fuer Drittlandsuebermittlung
+     * abgeschlossen. Pflicht fuer alle Sub-Processors mit Sitz ausserhalb
+     * EU/EWR.
+     */
+    readonly sccRequired?: boolean;
+    /**
+     * Tenant muss explizit aktivieren (z.B. AI-Feature). Ohne Opt-In
+     * werden keine Daten an diesen Sub-Processor gesendet.
+     */
+    readonly optInOnly?: boolean;
+    /**
+     * Business Associate Agreement fuer HIPAA-Customers verfuegbar.
+     * Relevant nur fuer hipaa-healthcare Compliance-Profile.
+     */
+    readonly hipaaBaaAvailable?: boolean;
+    /**
+     * Geplant aber noch nicht aktiv (Vorbereitung fuer kommenden Sprint).
+     * Wird im Sub-Processor-Endpoint als "planned"-Sektion separat
+     * ausgegeben damit Tenants schon Lead-Time bekommen.
+     */
+    readonly status?: "active" | "planned";
+}
+/**
+ * Plattform-weite Sub-Processor-Liste.
+ *
+ * Reihenfolge: nach addedAt (aelteste zuerst). Bei Aenderungen
+ * Snapshot-Test im Test-File explizit updaten — der detektiert
+ * stille Aenderungen.
+ */
+export declare const KUMIKO_SUB_PROCESSORS: readonly SubProcessor[];
+/**
+ * Filter helper — nur aktive Sub-Processors (kein status="planned").
+ * Genutzt vom oeffentlichen JSON-Endpoint (Sprint 1).
+ */
+export declare function getActiveSubProcessors(): readonly SubProcessor[];
+/**
+ * Filter helper — nur geplante Sub-Processors (status="planned"). Werden
+ * separat als "demnaechst aktiv"-Sektion ausgegeben damit Tenant-Admins
+ * schon Lead-Time fuer Compliance-Profile-Konfiguration bekommen.
+ */
+export declare function getPlannedSubProcessors(): readonly SubProcessor[];

package/dist/compliance/sub-processors.js

@@ -0,0 +1,109 @@
+// Sub-Processor-Liste der Kumiko-Plattform.
+//
+// Auftragsverarbeiter im Sinne von DSGVO Art. 28 die Kumiko fuer den
+// Plattform-Betrieb einsetzt. Wird oeffentlich exposed unter
+//   /api/compliance/sub-processors        (JSON, Sprint 1)
+//   /api/compliance/sub-processors.rss    (RSS, Sprint 1)
+//
+// Separate from the public marketing overview (kumiko.rocks/subprocessors),
+// which is compiled independently from templates/legal/_shared/subprocessors/
+// catalog.*.md. The two lists are not synced.
+//
+// Tenant-Admins muessen ueber Add/Change/Remove informiert werden mit
+// Lead-Time aus dem Compliance-Profile (typisch 30d). Cron-Job kommt
+// in Sprint 1 (compliance-profiles).
+//
+// Quelle: docs/plans/datenschutz/compliance-profiles.md "Sub-Processor-
+// Management" + docs/plans/datenschutz/legal-artifacts.md.
+/**
+ * Plattform-weite Sub-Processor-Liste.
+ *
+ * Reihenfolge: nach addedAt (aelteste zuerst). Bei Aenderungen
+ * Snapshot-Test im Test-File explizit updaten — der detektiert
+ * stille Aenderungen.
+ */
+export const KUMIKO_SUB_PROCESSORS = [
+    {
+        name: "Hetzner Online GmbH",
+        purpose: "Cloud-Infrastructure (CNPG-Postgres-Cluster, K8s-Pods, Volumes, Object-Storage)",
+        region: "EU (Germany)",
+        dpa: "https://www.hetzner.com/legal/dpa",
+        addedAt: "2024-01-01",
+        appliesTo: ["all-tiers"],
+        status: "active",
+    },
+    {
+        name: "Cloudflare, Inc.",
+        purpose: "DNS, CDN, DDoS-Protection, WAF",
+        region: "Global (US-headquartered)",
+        dpa: "https://www.cloudflare.com/cloudflare-customer-dpa",
+        addedAt: "2024-01-01",
+        appliesTo: ["all-tiers"],
+        sccRequired: true,
+        status: "active",
+    },
+    {
+        name: "Sendinblue SAS (Brevo)",
+        purpose: "Transactional Email Delivery",
+        region: "EU (France)",
+        dpa: "https://www.brevo.com/legal/dpa/",
+        addedAt: "2024-03-01",
+        appliesTo: ["standard", "business", "enterprise"],
+        status: "active",
+    },
+    {
+        name: "Anthropic PBC",
+        purpose: "AI Model Inference (L2 Composition Layer, AI-Foundation)",
+        region: "US",
+        dpa: "https://www.anthropic.com/legal/dpa",
+        addedAt: "2026-06-01",
+        appliesTo: ["business", "enterprise"],
+        sccRequired: true,
+        optInOnly: true,
+        hipaaBaaAvailable: true,
+        status: "active",
+    },
+    {
+        name: "Stripe, Inc.",
+        purpose: "Payment Processing (Subscription-Stripe-Plugin)",
+        region: "Global (US-headquartered)",
+        dpa: "https://stripe.com/legal/dpa",
+        addedAt: "2026-06-01",
+        appliesTo: ["all-tiers"],
+        sccRequired: true,
+        status: "active",
+    },
+    {
+        name: "ALL-INKL.COM – Neue Medien Münnich",
+        purpose: "Mailbox Hosting (support and contact mailboxes)",
+        region: "EU (Germany)",
+        dpa: "https://all-inkl.com/members/avv_muster_print.php",
+        addedAt: "2026-09-02",
+        appliesTo: ["all-tiers"],
+        status: "active",
+    },
+    {
+        name: "Scaleway SAS",
+        purpose: "Offsite Backup Mirror (Object Storage); planned: platform key custody (Key Manager) and Transactional Email",
+        region: "EU (France)",
+        dpa: "https://www.scaleway.com/en/contracts/",
+        addedAt: "2026-09-18",
+        appliesTo: ["all-tiers"],
+        status: "active",
+    },
+];
+/**
+ * Filter helper — nur aktive Sub-Processors (kein status="planned").
+ * Genutzt vom oeffentlichen JSON-Endpoint (Sprint 1).
+ */
+export function getActiveSubProcessors() {
+    return KUMIKO_SUB_PROCESSORS.filter((sp) => sp.status !== "planned");
+}
+/**
+ * Filter helper — nur geplante Sub-Processors (status="planned"). Werden
+ * separat als "demnaechst aktiv"-Sektion ausgegeben damit Tenant-Admins
+ * schon Lead-Time fuer Compliance-Profile-Konfiguration bekommen.
+ */
+export function getPlannedSubProcessors() {
+    return KUMIKO_SUB_PROCESSORS.filter((sp) => sp.status === "planned");
+}

package/dist/consumer-cli.d.ts

@@ -0,0 +1,5 @@
+export type ConsumerCliOut = {
+    readonly log: (line: string) => void;
+    readonly err: (line: string) => void;
+};
+export declare function runConsumerCli(argv: readonly string[], out: ConsumerCliOut): Promise<number>;

package/dist/consumer-cli.js

@@ -0,0 +1,116 @@
+// Shared core for the standalone consumer-ops CLI (status | restart).
+//
+// A dead event consumer (halt-on-poison after maxAttempts) previously had no
+// recovery surface in the standalone prod bundle — only raw SQL against
+// kumiko_event_consumers. Mirrors schema-cli.ts's shape (single runXCli(argv,
+// out) entry point, own DB connection) so `kumiko-consumer` ships the same
+// way `kumiko-schema` does.
+import { createConnection } from "./db/api.js";
+import { dbConnectionOptionsFromEnv } from "./db/connection.js";
+import { getConsumerState, restartConsumer } from "./pipeline/index.js";
+import { ensureTemporalPolyfill } from "./time/index.js";
+// Single pass: pulls --instance-id (both "--instance-id <id>" and
+// "--instance-id=<id>") out of argv regardless of position, leaving the
+// remaining positionals for sub/name — instead of two independent
+// positional/flag reads that silently misparse "--instance-id" with no
+// value, the "=" form, or a flag placed before the positionals (#1412).
+function parseConsumerCliArgs(argv) {
+    const positionals = [];
+    let instanceId;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === undefined)
+            continue;
+        if (arg === "--instance-id") {
+            const value = argv[i + 1];
+            if (value === undefined || value.startsWith("--")) {
+                return {
+                    sub: undefined,
+                    name: undefined,
+                    instanceId: undefined,
+                    error: "--instance-id braucht einen Wert.",
+                };
+            }
+            instanceId = value;
+            i++;
+            continue;
+        }
+        if (arg.startsWith("--instance-id=")) {
+            instanceId = arg.slice("--instance-id=".length);
+            continue;
+        }
+        positionals.push(arg);
+    }
+    return { sub: positionals[0], name: positionals[1], instanceId, error: undefined };
+}
+export async function runConsumerCli(argv, out) {
+    // The standalone bundle never runs runProdApp/runDevApp's boot, which is
+    // where Temporal normally gets installed — ConsumerRecoveryState.updatedAt
+    // is a Temporal.Instant, so without this every subcommand throws "Temporal
+    // is not defined" (same failure mode as schema-cli, see its polyfill test).
+    await ensureTemporalPolyfill();
+    const parsed = parseConsumerCliArgs(argv);
+    if (parsed.error) {
+        out.err(`  ${parsed.error}`);
+        return 1;
+    }
+    const { sub, name, instanceId } = parsed;
+    if (sub !== "status" && sub !== "restart") {
+        // Unknown subcommand must be visible on stderr, not just a bare exit 1 —
+        // ops invocations piping `2>&1 >/dev/null` or log pipelines that only
+        // watch stderr would otherwise see a failure with zero explanation
+        // (#1412). A bare help call (no subcommand at all) is not an error, so
+        // it keeps exit 0 + stdout.
+        const write = sub === undefined ? out.log : out.err;
+        if (sub !== undefined)
+            out.err(`  Unknown subcommand: ${sub}`);
+        write("");
+        write("  Subcommands:");
+        write("    status <name> [--instance-id <id>]   Zeigt Status + Cursor eines Consumers");
+        write("    restart <name> [--instance-id <id>]  Reaktiviert einen dead-Consumer (idle)");
+        write("");
+        return sub === undefined ? 0 : 1;
+    }
+    if (!name) {
+        out.err(`  Usage: consumer ${sub} <name> [--instance-id <id>]`);
+        return 1;
+    }
+    const dbUrl = process.env["DATABASE_URL"];
+    if (!dbUrl) {
+        out.err("  DATABASE_URL not set.");
+        return 1;
+    }
+    const { db, close } = await createConnection(dbUrl, dbConnectionOptionsFromEnv());
+    try {
+        if (sub === "status") {
+            const state = await getConsumerState(db, name, instanceId);
+            if (!state) {
+                out.err(`  Consumer "${name}" (instance_id="${instanceId ?? "__shared__"}") not found.`);
+                return 1;
+            }
+            out.log("");
+            out.log(`  ${state.name} (instance_id="${state.instanceId}")`);
+            out.log(`    status:      ${state.status}`);
+            out.log(`    cursor:      ${state.lastProcessedEventId}`);
+            out.log(`    attempts:    ${state.attempts}`);
+            out.log(`    rearmCount:  ${state.rearmCount}`);
+            out.log(`    lastError:   ${state.lastError ?? "-"}`);
+            out.log(`    updatedAt:   ${state.updatedAt.toString()}`);
+            out.log("");
+            return 0;
+        }
+        // restart
+        const result = await restartConsumer(db, name, instanceId);
+        out.log("");
+        out.log(`  ✓ ${result.name} (instance_id="${result.instanceId}") → ${result.status}`);
+        out.log("");
+        return 0;
+    }
+    catch (e) {
+        out.err(`  ✗ ${e instanceof Error ? e.message : String(e)}`);
+        return 1;
+    }
+    finally {
+        await close();
+    }
+}

package/dist/crypto/blind-index.d.ts

@@ -0,0 +1,10 @@
+import type { EntityDefinition } from "../engine/types/fields.js";
+export declare function computeBlindIndex(key: Uint8Array, plaintext: string): string;
+export declare function decodeBlindIndexKey(base64Key: string): Uint8Array;
+export declare function configureBlindIndexKey(base64Key: string | undefined): void;
+export declare function configuredBlindIndexKey(): Uint8Array | undefined;
+/** @internal test-only */
+export declare function resetBlindIndexKeyForTests(): void;
+export declare function blindIndexFieldName(fieldName: string): string;
+export declare function collectLookupableFields(entity: EntityDefinition): readonly string[];
+export declare function computeBlindIndexValues(values: Record<string, unknown>, lookupableFields: readonly string[]): Promise<Record<string, unknown>>;

package/dist/crypto/blind-index.js

@@ -0,0 +1,97 @@
+// Blind-Index für PII-Equality-Lookups (kumiko-framework#818).
+// `lookupable: true` auf einem Subject-annotierten text-Feld erzeugt eine
+// generierte Spalte `<snake>_bidx` mit deterministischem HMAC über den
+// KLARTEXT-Wert — Equality-Queries matchen `(col = $1 OR col_bidx = $2)`
+// und funktionieren damit für Klartext-Alt-Rows UND verschlüsselte Rows.
+//
+// Wertformat: kumiko-bidx:v1:<base64url(HMAC-SHA256(key, value))>
+//
+// HMAC ist byte-exact ohne Normalisierung — repliziert exakt die heutige
+// case-sensitive Equality-Semantik (Lowercasing wäre eine Verhaltensänderung).
+//
+// Der Key ist bewusst ein EIGENER 32-Byte-Key (env: KUMIKO_BLIND_INDEX_KEY),
+// nicht vom PLATFORM_KEK abgeleitet und nicht Teil des KmsAdapter-Contracts —
+// BYOK-Adapter dürfen ihn nie sehen. Rotation = Recompute aller bidx-Spalten
+// (Rollout-Fahrplan Schritt 7).
+//
+// bidx-Werte leben NUR in der Projektion, nie in Event-Payloads: ein
+// deterministischer HMAC im immutablen Event wäre permanente Linkage und
+// bräche Forget. applyEntityEvent berechnet sie beim Apply (live + rebuild),
+// nach Key-Erase recomputet der Rebuild sie zu NULL.
+import { createHmac } from "node:crypto";
+import { requestContext } from "../api/request-context.js";
+import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
+const BLIND_INDEX_PREFIX = "kumiko-bidx:v1:";
+const BLIND_INDEX_KEY_LENGTH = 32;
+export function computeBlindIndex(key, plaintext) {
+    const mac = createHmac("sha256", key).update(plaintext, "utf8").digest("base64url");
+    return `${BLIND_INDEX_PREFIX}${mac}`;
+}
+export function decodeBlindIndexKey(base64Key) {
+    const decoded = Buffer.from(base64Key, "base64");
+    if (decoded.length !== BLIND_INDEX_KEY_LENGTH) {
+        throw new Error(`Blind-index key must be ${BLIND_INDEX_KEY_LENGTH} bytes base64-encoded, got ${decoded.length} bytes. ` +
+            `Generate one: openssl rand -base64 32`);
+    }
+    return decoded;
+}
+// Boot-injected app-wide key, mirroring configurePiiSubjectKms: run{Prod,Dev}App
+// call configureBlindIndexKey once; query compilers + applyEntityEvent resolve
+// lazily. Absent key = blind-indexing off (bidx columns stay NULL, equality
+// lookups match plaintext rows only — pre-#818 behavior).
+let injectedKey;
+export function configureBlindIndexKey(base64Key) {
+    injectedKey = base64Key === undefined ? undefined : decodeBlindIndexKey(base64Key);
+}
+export function configuredBlindIndexKey() {
+    return injectedKey;
+}
+/** @internal test-only */
+export function resetBlindIndexKeyForTests() {
+    injectedKey = undefined;
+}
+export function blindIndexFieldName(fieldName) {
+    return `${fieldName}Bidx`;
+}
+// The field names that carry a blind index — precomputed per apply like
+// collectPiiSubjectFields. Only text fields qualify (boot-validated).
+export function collectLookupableFields(entity) {
+    return Object.entries(entity.fields)
+        .filter(([, field]) => field.type === "text" && field.lookupable === true)
+        .map(([name]) => name);
+}
+// bidx values for every lookupable field PRESENT in `values` (create payload
+// or update changes — absent fields stay untouched). Ciphertext values are
+// decrypted first so the HMAC always covers the plaintext; an erased subject
+// (or the erased sentinel) yields NULL — the lookup stops matching, which is
+// exactly the forget semantics.
+export async function computeBlindIndexValues(values, lookupableFields) {
+    const key = configuredBlindIndexKey();
+    if (key === undefined || lookupableFields.length === 0)
+        return {};
+    const out = {};
+    for (const name of lookupableFields) {
+        if (!(name in values))
+            continue;
+        out[blindIndexFieldName(name)] = await blindIndexForValue(key, name, values[name]);
+    }
+    return out;
+}
+async function blindIndexForValue(key, field, value) {
+    if (typeof value !== "string" || value === PII_ERASED_SENTINEL)
+        return null;
+    if (!isPiiCiphertext(value))
+        return computeBlindIndex(key, value);
+    const kms = configuredPiiSubjectKms();
+    // Ciphertext without a KMS can't be decrypted here; the same read would
+    // also surface raw ciphertext — misconfiguration is caught at boot.
+    if (kms === undefined)
+        return null;
+    const decrypted = await decryptPiiFieldValues({ [field]: value }, [field], kms, {
+        requestId: requestContext.get()?.requestId ?? "blind-index",
+    });
+    const plain = decrypted[field];
+    if (typeof plain !== "string" || plain === PII_ERASED_SENTINEL)
+        return null;
+    return computeBlindIndex(key, plain);
+}

package/dist/crypto/ciphertext-pattern.d.ts

@@ -0,0 +1,3 @@
+export declare function quoteIdent(name: string): string;
+export declare function escapeLikePattern(value: string): string;
+export declare function subjectCiphertextLikePattern(subjectKey: string): string;

package/dist/crypto/ciphertext-pattern.js

@@ -0,0 +1,16 @@
+// Shared SQL helpers for locating a subject's PII ciphertext by its inline
+// subject-key prefix (kumiko-pii:v<version>:<subjectKey>:...). Used by both
+// the blind-index sweep (db/blind-index-cleanup.ts) and the search-index
+// purge (search/purge-subject.ts) — the two sweeps must stay in lockstep
+// across ciphertext format versions.
+export function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+export function escapeLikePattern(value) {
+    return value.replace(/[\\%_]/g, (m) => `\\${m}`);
+}
+// "v%" matches any format version (v1 no-AAD, v2 AAD-bound, #1263) — the
+// subject key placement is stable across versions.
+export function subjectCiphertextLikePattern(subjectKey) {
+    return `kumiko-pii:v%:${escapeLikePattern(subjectKey)}:%`;
+}

package/dist/crypto/event-pii.d.ts

@@ -0,0 +1,8 @@
+import type { EventPiiFields } from "@cosmicdrift/kumiko-types/handlers";
+import { type EventSubjectEnvelope } from "./subject-resolver.js";
+export type EventPiiCatalog = ReadonlyMap<string, EventPiiFields>;
+export declare function configureEventPiiCatalog(next: EventPiiCatalog): void;
+export declare function configuredEventPiiCatalog(): EventPiiCatalog;
+/** @internal test-only */
+export declare function resetEventPiiCatalogForTests(): void;
+export declare function encryptEventPayloadPii(eventType: string, payload: Record<string, unknown>, envelope: EventSubjectEnvelope): Promise<Record<string, unknown>>;

package/dist/crypto/event-pii.js

@@ -0,0 +1,79 @@
+// PII on custom-event payloads (#799). Entity CRUD events get their PII
+// encrypted by the executor; events written via ctx.appendEvent / MSP-apply /
+// low-level append() (delivery attempt-log, jobs run-logger) had no encrypt
+// path at all. `r.defineEvent(name, schema, { piiFields })` declares which
+// payload fields are PII and which payload field names the owning user;
+// createRegistry publishes the catalog and append() — the single write funnel
+// into kumiko_events — encrypts every catalogued field. `kumiko:system:*`
+// events skip the registry and take their stance from system-event-pii.ts
+// instead (fail-closed when missing).
+//
+// `piiFields` is a mandatory, explicit stance (fw#2558): a payload can only
+// go uncatalogued through a declared `piiFields: "none"`, never by omission —
+// defineEvent refuses to register an event without one. What used to be a
+// silent no-op (forgetting the option) is now either an explicit "none" or a
+// missing subject KMS at encrypt-time, both visible states, not a gap.
+import { requestContext } from "../api/request-context.js";
+import { configuredPiiSubjectKms, encryptPiiValueForSubject } from "./pii-field-encryption.js";
+import { resolveEventSubject } from "./subject-resolver.js";
+import { SYSTEM_EVENT_PII_STANCES, SYSTEM_EVENT_PREFIX } from "./system-event-pii.js";
+// Boot-injected like configurePiiSubjectKms — createRegistry calls this with
+// the catalog collected from all defineEvent registrations.
+let catalog = new Map();
+export function configureEventPiiCatalog(next) {
+    catalog = next;
+}
+export function configuredEventPiiCatalog() {
+    return catalog;
+}
+/** @internal test-only */
+export function resetEventPiiCatalogForTests() {
+    catalog = new Map();
+}
+// System types are checked before the KMS gate: an undeclared one throws
+// even in plaintext rollout mode.
+function resolvePiiStance(eventType) {
+    if (!eventType.startsWith(SYSTEM_EVENT_PREFIX))
+        return catalog.get(eventType);
+    const stance = SYSTEM_EVENT_PII_STANCES.get(eventType);
+    if (stance === undefined) {
+        throw new Error(`System event "${eventType}" has no PII stance — declare one in SYSTEM_EVENT_PII_STANCES (crypto/system-event-pii.ts)`);
+    }
+    return stance;
+}
+// Encrypts catalogued payload fields under the declared subject's DEK
+// (user/tenant/self — resolveEventSubject, fw#2801). No-op when the event
+// type is uncatalogued or no subject KMS is configured (plaintext rollout
+// mode — the hard boot gate governs whether that is acceptable). A
+// user-subject field with no resolvable owner (system cron runs,
+// recipient-less skip attempts) leaves the value plaintext: there is no
+// user key to shred. This is the ONLY live-write encrypt path — the backfill
+// catalog branch (`backfill-pii.ts`) resolves through the same
+// resolveEventSubject so a field never ends up encrypted under different
+// subjects depending on which path wrote it.
+export async function encryptEventPayloadPii(eventType, payload, envelope) {
+    const piiFields = resolvePiiStance(eventType);
+    if (!piiFields || piiFields === "none")
+        return payload;
+    const kms = configuredPiiSubjectKms();
+    if (!kms)
+        return payload;
+    let out;
+    for (const [field, spec] of Object.entries(piiFields)) {
+        const value = payload[field];
+        if (value === null || value === undefined)
+            continue;
+        if (typeof value !== "string") {
+            throw new Error(`Event "${eventType}" piiFields."${field}" must be a string payload field, got ${typeof value}`);
+        }
+        const subject = resolveEventSubject(field, spec, payload, envelope);
+        if (subject === null)
+            continue;
+        const encrypted = await encryptPiiValueForSubject(kms, subject, value, { requestId: requestContext.get()?.requestId ?? "append-event" }, field);
+        if (encrypted !== value) {
+            out ??= { ...payload };
+            out[field] = encrypted;
+        }
+    }
+    return out ?? payload;
+}

package/dist/crypto/in-memory-kms-adapter.d.ts

@@ -0,0 +1,11 @@
+import { type KmsHealth, type LocalKeyKmsAdapter, type SubjectDek, type SubjectId } from "./kms-adapter.js";
+export declare class InMemoryKmsAdapter implements LocalKeyKmsAdapter {
+    readonly capabilities: {
+        readonly mode: "local-key";
+    };
+    private readonly keys;
+    createKey(subject: SubjectId): Promise<void>;
+    getKey(subject: SubjectId): Promise<SubjectDek>;
+    eraseKey(subject: SubjectId): Promise<void>;
+    health(): Promise<KmsHealth>;
+}

package/dist/crypto/in-memory-kms-adapter.js

@@ -0,0 +1,33 @@
+import { randomBytes } from "node:crypto";
+import { KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, subjectIdToKey, } from "./kms-adapter.js";
+// Non-persistent adapter for tests and dev mode. Erased entries stay as
+// tombstones so the create-after-erase contract holds within a process.
+export class InMemoryKmsAdapter {
+    capabilities = { mode: "local-key" };
+    keys = new Map();
+    async createKey(subject) {
+        const subjectKey = subjectIdToKey(subject);
+        if (this.keys.has(subjectKey))
+            throw new KeyAlreadyExistsError(subject);
+        this.keys.set(subjectKey, { key: randomBytes(32), erased: false });
+    }
+    async getKey(subject) {
+        const entry = this.keys.get(subjectIdToKey(subject));
+        if (!entry)
+            throw new KeyNotFoundError(subject);
+        if (entry.erased || entry.key === null)
+            throw new KeyErasedError(subject);
+        return entry.key;
+    }
+    async eraseKey(subject) {
+        const entry = this.keys.get(subjectIdToKey(subject));
+        // skip: eraseKey is contractually idempotent — unknown subject is a no-op
+        if (!entry)
+            return;
+        entry.key = null;
+        entry.erased = true;
+    }
+    async health() {
+        return { ok: true, latencyMs: 0 };
+    }
+}

package/dist/crypto/index.d.ts

@@ -0,0 +1,11 @@
+export { blindIndexFieldName, collectLookupableFields, computeBlindIndex, computeBlindIndexValues, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.js";
+export { configuredEventPiiCatalog, configureEventPiiCatalog, type EventPiiCatalog, encryptEventPayloadPii, } from "./event-pii.js";
+export { InMemoryKmsAdapter } from "./in-memory-kms-adapter.js";
+export { isSelfPiiField } from "./is-self-pii-field.js";
+export { type KekSourceEnv, type KekSourceOptions, resolvePlatformKeks } from "./kek-source.js";
+export { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, type KmsAdapter, type KmsContext, type KmsHealth, type LocalKeyKmsAdapter, RECORD_ENTITY_PATTERN, type RemoteCryptoKmsAdapter, type SubjectDek, type SubjectId, type SubjectKey, subjectIdFromKey, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForTenant, subjectKeyForUser, } from "./kms-adapter.js";
+export { type ActiveKmsWiring, buildPgKmsOptions, type KmsWiring, type KmsWiringEnv, type KmsWiringOptions, type KmsWiringRelease, type PgKmsRotationEnv, type PlaintextPiiWiring, requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.js";
+export { createPgKmsAdapter, PgKmsAdapter, type PgKmsAdapterOptions, type RewrapOptions, type RewrapResult, rewrapSubjectKeys, } from "./pg-kms-adapter.js";
+export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, type EncryptPiiOptions, encryptPiiFieldValues, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
+export { createRequestKmsCache, type RequestKmsCache, } from "./request-kms-cache.js";
+export { collectPiiSubjectFields, collectSearchableSubjectFields, type ResolveSubjectOptions, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";

package/dist/crypto/index.js

@@ -0,0 +1,11 @@
+export { blindIndexFieldName, collectLookupableFields, computeBlindIndex, computeBlindIndexValues, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.js";
+export { configuredEventPiiCatalog, configureEventPiiCatalog, encryptEventPayloadPii, } from "./event-pii.js";
+export { InMemoryKmsAdapter } from "./in-memory-kms-adapter.js";
+export { isSelfPiiField } from "./is-self-pii-field.js";
+export { resolvePlatformKeks } from "./kek-source.js";
+export { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, RECORD_ENTITY_PATTERN, subjectIdFromKey, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForTenant, subjectKeyForUser, } from "./kms-adapter.js";
+export { buildPgKmsOptions, requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.js";
+export { createPgKmsAdapter, PgKmsAdapter, rewrapSubjectKeys, } from "./pg-kms-adapter.js";
+export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, encryptPiiFieldValues, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
+export { createRequestKmsCache, } from "./request-kms-cache.js";
+export { collectPiiSubjectFields, collectSearchableSubjectFields, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";

package/dist/crypto/is-self-pii-field.d.ts

@@ -0,0 +1,5 @@
+import type { EntityDefinition } from "../engine/types/fields.js";
+type AnyField = EntityDefinition["fields"][string];
+/** True when the field's own row id is the PII subject (`pii: true`). */
+export declare function isSelfPiiField(field: AnyField): boolean;
+export {};

package/dist/crypto/is-self-pii-field.js

@@ -0,0 +1,4 @@
+/** True when the field's own row id is the PII subject (`pii: true`). */
+export function isSelfPiiField(field) {
+    return "pii" in field && field.pii === true;
+}

package/dist/crypto/kek-source.d.ts

@@ -0,0 +1,23 @@
+export type KekSourceEnv = {
+    readonly PLATFORM_KEK?: string | undefined;
+    readonly PLATFORM_KEK_CIPHERTEXT?: string | undefined;
+    readonly PLATFORM_KEK_PREVIOUS?: string | undefined;
+    readonly PLATFORM_KEK_PREVIOUS_CIPHERTEXT?: string | undefined;
+    readonly PLATFORM_KEK_PREVIOUS_VERSION?: string | undefined;
+    readonly PLATFORM_KEK_KMS_KEY_ID?: string | undefined;
+    readonly PLATFORM_KEK_KMS_TOKEN?: string | undefined;
+    readonly PLATFORM_KEK_KMS_REGION?: string | undefined;
+    readonly KUMIKO_BLIND_INDEX_KEY?: string | undefined;
+    readonly KUMIKO_BLIND_INDEX_KEY_CIPHERTEXT?: string | undefined;
+    readonly [key: string]: string | undefined;
+};
+export type KekSourceOptions = {
+    readonly fetch?: typeof globalThis.fetch;
+    readonly logPrefix?: string;
+    /** Where the boot line naming the KEK source goes. Defaults to `console.info`. */
+    readonly log?: (message: string) => void;
+    /** Env names to resolve, e.g. `kmsSlotsOf(schema)`. Defaults to the three
+     *  platform slots. */
+    readonly slots?: readonly string[];
+};
+export declare function resolvePlatformKeks(env: KekSourceEnv, options?: KekSourceOptions): Promise<KekSourceEnv>;