@cosmicdrift/kumiko-framework 0.334.0 → 0.335.0

package/dist/api/auth-routes.js

@@ -866,7 +866,12 @@ export function createAuthRoutes(dispatcher, jwt, config) {
     api.post(Routes.authSwitchTenant, async (c) => {
         const user = getUser(c);
         const body = await c.req.json();
-        const targetTenantId = body.tenantId;
+        // The id seeds a SYSTEM identity in resolveActiveMembership — reject anything
+        // that is not a non-empty string before it gets that far.
+        if (!isNonEmptyString(body.tenantId)) {
+            return c.json({ error: "invalid_tenant" }, 400);
+        }
+        const targetTenantId = body.tenantId; // @cast-boundary request-body
         if (targetTenantId === user.tenantId) {
             return c.json({ error: "already_in_tenant" }, 400);
         }
@@ -929,8 +934,7 @@ export function createAuthRoutes(dispatcher, jwt, config) {
             tenantId: targetTenantId,
             roles: mergedRoles,
             // Tenant-independent prefs must survive the switch (fw#2343).
-            ...(user.timezone ? { timezone: user.timezone } : {}),
-            ...(user.locale ? { locale: user.locale } : {}),
+            ...tenantIndependentPrefs(user),
         };
         const claims = await dispatcher.resolveAuthClaims(targetSession);
         const sessionForJwt = Object.keys(claims).length > 0 ? { ...targetSession, claims } : targetSession;
@@ -959,6 +963,15 @@ export function createAuthRoutes(dispatcher, jwt, config) {
 // validates the token + does the state change → typed failure or 200. Keeping
 // the silent-success invariant in one place means changing how the framework
 // handles "invalid_body" on a public token endpoint is one edit, not three.
+function tenantIndependentPrefs(user) {
+    return {
+        ...(user.timezone ? { timezone: user.timezone } : {}),
+        ...(user.locale ? { locale: user.locale } : {}),
+    };
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
 function registerTokenRequestRoute(opts) {
     const body = opts.schema ?? RequestTokenBody;
     opts.api.post(opts.path, async (c) => {
@@ -974,7 +987,9 @@ function registerTokenRequestRoute(opts) {
         // they are logged — otherwise the mail silently never goes out. No email in
         // the log line (PII).
         const result = await opts.dispatcher.write(opts.requestHandler, parsed.data, createAnonymousUser(SYSTEM_TENANT_ID));
-        if (!result.isSuccess) {
+        // rate_limited is an expected, attacker-triggerable outcome; logging it
+        // would flood the sink and bury real misconfiguration errors.
+        if (!result.isSuccess && result.error.code !== "rate_limited") {
             console.error(`[kumiko] token request handler "${opts.requestHandler}" failed: ${result.error.code}`);
         }
         return c.json({ isSuccess: true });

package/dist/api/client-ip.js

@@ -50,16 +50,13 @@ export const TRUSTED_PROXY_HOPS_ENV = "KUMIKO_TRUSTED_PROXY_HOPS";
 // worse than staying on the default. Digits-only (not parseInt) —
 // parseInt("0x10")/("1e3")/("2x") would silently coerce instead of failing.
 export function parseTrustedProxyHopsEnv(raw, context) {
-    if (raw === undefined)
+    // Empty string = unset, matching readEnv's normalization (e.g. a blank .env template line).
+    if (raw === undefined || raw === "")
         return undefined;
     if (!/^\d+$/.test(raw)) {
         throw new Error(`${context}: ${TRUSTED_PROXY_HOPS_ENV} must be a non-negative integer, got "${raw}".`);
     }
-    const parsed = Number.parseInt(raw, 10);
-    if (!Number.isInteger(parsed) || parsed < 0) {
-        throw new Error(`${context}: ${TRUSTED_PROXY_HOPS_ENV} must be a non-negative integer, got "${raw}".`);
-    }
-    return parsed;
+    return Number(raw);
 }
 // Instance-scoped, NOT a module singleton: the warn-once flag must reset
 // per server boot (and per test), otherwise the first test to trigger it

package/dist/api/extra-route.js

@@ -39,8 +39,9 @@ export class ExtraRouteRejection extends Error {
             if (status !== 503) {
                 throw new RangeError("ExtraRouteRejection: retryAfterSeconds is only valid with status 503");
             }
-            if (!Number.isInteger(retryAfterSeconds) || retryAfterSeconds < 0) {
-                throw new RangeError("ExtraRouteRejection: retryAfterSeconds must be a non-negative integer");
+            // isSafeInteger, not isInteger: String(1e21) is "1e+21", not 1*DIGIT.
+            if (!Number.isSafeInteger(retryAfterSeconds) || retryAfterSeconds < 0) {
+                throw new RangeError("ExtraRouteRejection: retryAfterSeconds must be a non-negative safe integer");
             }
         }
         this.retryAfterSeconds = retryAfterSeconds;

package/dist/api/pii-leak-guard.js

@@ -2,8 +2,11 @@ import { PII_CIPHERTEXT_PREFIX } from "../crypto/index.js";
 const isProductionEnv = () => process.env["NODE_ENV"] === "production";
 // Version-agnostic: catches both the current PII_CIPHERTEXT_PREFIX and any
 // older/decrypt-only format version still present in unmigrated rows.
-const CIPHERTEXT_MARKER = "kumiko-pii:v";
-const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^"\s<>\\]*/g;
+// Bound to the full ciphertext shape (prefix, "<kind>:<id>" subject key, base64
+// blob of at least IV + GCM tag = 28 bytes) so a user-typed "kumiko-pii:v" in a
+// note or name field cannot turn every read of that record into a 500.
+const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^:"\s<>\\]+:[^:"\s<>\\]+:[A-Za-z0-9+/=]{40,}/;
+const CIPHERTEXT_REDACT_RE = new RegExp(CIPHERTEXT_RE.source, "g");
 // A PII subject ciphertext never belongs in an API response — its presence
 // means a raw DB read (fetchOne/selectMany) leaked to the surface. Dev/test
 // fail loud (500) so a forgotten decrypt turns the first integration test
@@ -19,7 +22,7 @@ export function piiCiphertextResponseGuard() {
             return;
         const text = await c.res.clone().text();
         // skip: clean response — the common case
-        if (!text.includes(CIPHERTEXT_MARKER))
+        if (!CIPHERTEXT_RE.test(text))
             return;
         const detail = `[api] JSON response for ${c.req.method} ${c.req.path} contains a PII ciphertext ` +
             `("${PII_CIPHERTEXT_PREFIX}…") — a raw DB read leaked to the API surface. ` +
@@ -32,7 +35,7 @@ export function piiCiphertextResponseGuard() {
         console.error(detail);
         const headers = new Headers(c.res.headers);
         headers.delete("content-length");
-        c.res = new Response(text.replace(CIPHERTEXT_RE, "[pii-redacted]"), {
+        c.res = new Response(text.replace(CIPHERTEXT_REDACT_RE, "[pii-redacted]"), {
             status: c.res.status,
             headers,
         });

package/dist/api/redis-sse-broker.d.ts

@@ -1,6 +1,8 @@
+import { type RedisClientOptions } from "../redis/client.js";
 import { type SseBroker } from "./sse-broker.js";
 export type RedisSseBrokerOptions = {
     readonly redisUrl: string;
+    readonly clientOptions?: RedisClientOptions;
 };
 export type RedisSseBroker = SseBroker & {
     close(): Promise<void>;

package/dist/api/redis-sse-broker.js

@@ -1,5 +1,6 @@
+import { redisClientOptionsFromEnv } from "../redis/client.js";
 import { createRedisPubSubSignal } from "../redis/pubsub-signal.js";
-import { createSseBroker } from "./sse-broker.js";
+import { createSseBroker, readNonEmptyStringArray, } from "./sse-broker.js";
 // Channel namespace for cross-replica fanout (fw#2625). Every pod publishes
 // here and every pod's psubscribe listens here, so a push on one instance
 // reaches SSE clients connected to any other instance without a shared
@@ -26,7 +27,9 @@ export function isRedisSseBroker(broker) {
 // buildServer, so its own REDIS_URL-based default never ran.
 export function createDefaultSseBroker(env = process.env) {
     const redisUrl = env["REDIS_URL"];
-    const ownedRedisSseBroker = redisUrl ? createRedisSseBroker({ redisUrl }) : undefined;
+    const ownedRedisSseBroker = redisUrl
+        ? createRedisSseBroker({ redisUrl, clientOptions: redisClientOptionsFromEnv(env) })
+        : undefined;
     return { sseBroker: ownedRedisSseBroker ?? createSseBroker(), ownedRedisSseBroker };
 }
 function isSseEvent(value) {
@@ -71,11 +74,6 @@ function parseInvalidationScope(payload) {
     }
     return { kind: "user" };
 }
-function readNonEmptyStringArray(value) {
-    if (!Array.isArray(value) || value.length === 0)
-        return undefined;
-    return value.every((v) => typeof v === "string") ? value : undefined;
-}
 // Mirror of parseInvalidationScope's wire shapes. "sessions"/"pat-tokens"
 // deliberately never include a `keptSessionId` key — see the parser comment.
 function encodeInvalidationScope(scope) {
@@ -100,6 +98,7 @@ export function createRedisSseBroker(opts) {
         redisUrl: opts.redisUrl,
         channelPattern: PSUBSCRIBE_PATTERN,
         label: "sse-broker",
+        ...(opts.clientOptions ? { clientOptions: opts.clientOptions } : {}),
     });
     signal.onMessage((channel, payload) => {
         if (channel.startsWith(CHANNEL_PREFIX)) {

package/dist/api/routes.js

@@ -292,26 +292,33 @@ const FAULT_LOG_SILENCED_LEVELS = new Set(["error", "fatal", "silent"]);
 // `type` is client-supplied on an unknown-handler 404, so cap it before it
 // reaches the log — an unbounded field would let a caller flood the sink.
 const MAX_LOGGED_TYPE_LENGTH = 120;
+// The body's `type` is only typed as string — a client can send an object, and
+// a throw from inside the fault logger would turn a clean 4xx into a 500.
+function loggableType(type) {
+    return typeof type === "string" ? type.slice(0, MAX_LOGGED_TYPE_LENGTH) : undefined;
+}
 function clientFaultLoggingEnabled() {
     return !FAULT_LOG_SILENCED_LEVELS.has(process.env["LOG_LEVEL"] ?? "");
 }
 // A failing request must leave a trace even when it ends in 4xx — a paid
 // external call that 422s was invisible before (offlot#117). Status, error
 // code and duration only: message/details/stack can carry submitted values.
-function logClientFault(err, requestId, type) {
+function logClientWarn(message, requestId, type, fields) {
     if (!clientFaultLoggingEnabled()) {
         // skip: LOG_LEVEL silences the 4xx tier — the deployment opted out of client-fault volume
         return;
     }
     const startedAt = requestContext.get()?.startedAt;
-    createFallbackLogger("api").warn("handler rejected", {
+    createFallbackLogger("api").warn(message, {
         requestId,
-        type: type?.slice(0, MAX_LOGGED_TYPE_LENGTH),
-        status: err.httpStatus,
-        code: err.code,
+        type: loggableType(type),
+        ...fields,
         ...(startedAt === undefined ? {} : { durationMs: Math.round(performance.now() - startedAt) }),
     });
 }
+function logClientFault(err, requestId, type) {
+    logClientWarn("handler rejected", requestId, type, { status: err.httpStatus, code: err.code });
+}
 // Identity-checked against THIS request's signal — signal.aborted alone
 // would also match a real 5xx that happens to race a disconnect.
 function isClientAbort(err) {
@@ -333,7 +340,7 @@ function logServerFault(err, requestId, type) {
     const cause = err.cause;
     createFallbackLogger("api").error("handler failed", {
         requestId,
-        type,
+        type: loggableType(type),
         code: err.code,
         message: err.message,
         cause: cause instanceof Error ? cause.message : cause,
@@ -354,17 +361,9 @@ function writeErrorResponse(c, err, type) {
 function queryErrorResponse(c, err, type) {
     const requestId = requestContext.get()?.requestId;
     if (isClientAbort(err)) {
-        if (clientFaultLoggingEnabled()) {
-            const startedAt = requestContext.get()?.startedAt;
-            createFallbackLogger("api").warn("request aborted by client", {
-                requestId,
-                type: type?.slice(0, MAX_LOGGED_TYPE_LENGTH),
-                status: CLIENT_CLOSED_REQUEST_STATUS,
-                ...(startedAt === undefined
-                    ? {}
-                    : { durationMs: Math.round(performance.now() - startedAt) }),
-            });
-        }
+        logClientWarn("request aborted by client", requestId, type, {
+            status: CLIENT_CLOSED_REQUEST_STATUS,
+        });
         return c.body(null, CLIENT_CLOSED_REQUEST_STATUS); // @cast-boundary non-standard client-closed-request status, Hono's union doesn't include it
     }
     logServerFault(err, requestId, type);

package/dist/api/server.js

@@ -537,13 +537,20 @@ export function buildServer(options) {
     // Public auth routes (login) need to be registered BEFORE the generic
     // api routes so Hono matches them first.
     if (options.auth) {
-        // A membershipQuery handler is registered but nothing fulfils
-        // principalStatus — surface that misconfig at boot instead of an InternalError on first login/switch-tenant.
-        if (options.registry.getQueryHandler(options.auth.membershipQuery) &&
-            options.registry.getExtensionUsages(EXT_PRINCIPAL_STATUS).length === 0) {
-            throw new Error(`[kumiko] auth membershipQuery "${options.auth.membershipQuery}" is registered but no feature ` +
-                'provides the "principalStatus" contract — mount the user feature (tenant switch and sign-in ' +
-                "need it to reject blocked principals).");
+        // A membershipQuery handler is registered but principalStatus is not provided by exactly
+        // one feature — surface that misconfig at boot instead of an InternalError on first login/switch-tenant.
+        if (options.registry.getQueryHandler(options.auth.membershipQuery)) {
+            const principalStatusProviders = options.registry.getExtensionUsages(EXT_PRINCIPAL_STATUS).length;
+            if (principalStatusProviders === 0) {
+                throw new Error(`[kumiko] auth membershipQuery "${options.auth.membershipQuery}" is registered but no feature ` +
+                    'provides the "principalStatus" contract — mount the user feature (tenant switch and sign-in ' +
+                    "need it to reject blocked principals).");
+            }
+            if (principalStatusProviders > 1) {
+                throw new Error(`[kumiko] auth membershipQuery "${options.auth.membershipQuery}" is registered but ` +
+                    `${principalStatusProviders} features provide the "principalStatus" contract — exactly one ` +
+                    "is expected (the bundled user feature already provides it).");
+            }
         }
         app.route("/api", createAuthRoutes(dispatcher, jwt, { ...options.auth, resolver: clientIpResolver }));
     }

package/dist/api/sse-broker.d.ts

@@ -1,3 +1,4 @@
+import type { SessionUser } from "../engine/types/index.js";
 export type SseClient = {
     id: string;
     send: (event: SseEvent) => void;
@@ -7,6 +8,7 @@ export type SseEvent = {
     type: string;
     data: Record<string, unknown>;
 };
+export declare function readNonEmptyStringArray(value: unknown): string[] | undefined;
 export type AccessInvalidationScope = {
     readonly kind: "user";
 } | {
@@ -23,6 +25,7 @@ export type AccessInvalidationCredential = {
     readonly sid?: string;
     readonly patTokenId?: string;
 };
+export declare function accessInvalidationCredentialFor(user: Pick<SessionUser, "sid" | "pat">): AccessInvalidationCredential;
 export type SseBroker = {
     addClient(channel: string, send: (event: SseEvent) => void, close: () => void): string;
     removeClient(channel: string, clientId: string): void;

package/dist/api/sse-broker.js

@@ -1,5 +1,19 @@
 import { userAccessChannel } from "../engine/constants.js";
 import { generateId } from "../utils/index.js";
+// What a publish invalidates. "user" is the broadest (and the historical
+// default — every scope narrower than this is an opt-in from a caller that
+// knows exactly which credential(s) it revoked).
+export function readNonEmptyStringArray(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return undefined;
+    return value.every((v) => typeof v === "string") ? value : undefined;
+}
+export function accessInvalidationCredentialFor(user) {
+    return {
+        ...(user.sid !== undefined && { sid: user.sid }),
+        ...(user.pat?.tokenId !== undefined && { patTokenId: user.pat.tokenId }),
+    };
+}
 // Fail-closed: a narrow scope only spares/limits a listener it can positively
 // match against its own credential. A listener with neither sid nor
 // patTokenId of its own can't be matched by "sessions"/"pat-tokens", so it

package/dist/api/sse-route.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import type { SseBroker } from "./sse-broker.js";
+import { type SseBroker } from "./sse-broker.js";
 /**
  * Heartbeat-Cadence für SSE-Streams.
  *

package/dist/api/sse-route.js

@@ -3,6 +3,7 @@ import { streamSSE } from "hono/streaming";
 import { tenantChannel } from "../engine/constants.js";
 import { Routes } from "./api-constants.js";
 import { getUser } from "./auth-middleware.js";
+import { accessInvalidationCredentialFor } from "./sse-broker.js";
 /**
  * Heartbeat-Cadence für SSE-Streams.
  *
@@ -32,6 +33,12 @@ export const SSE_HEARTBEAT_INTERVAL_MS = 15_000;
 function isEntityEventData(data) {
     return typeof data["aggregateType"] === "string";
 }
+// The tenant channel fans out to every member; user-addressed frames
+// (e.g. channel-in-app:event:delivered) would otherwise reach the whole tenant.
+function isAddressedToOtherUser(event, userId) {
+    const addressee = event.data["userId"];
+    return typeof addressee === "string" && addressee !== userId;
+}
 export function createSseRoute(broker) {
     const route = new Hono();
     route.get(Routes.sse, async (c) => {
@@ -40,20 +47,46 @@ export function createSseRoute(broker) {
         // Allowing ?channel=... would let any authenticated user subscribe to other tenants' feeds.
         const channel = tenantChannel(user.tenantId);
         return streamSSE(c, async (stream) => {
+            let resolveEnded;
+            const ended = new Promise((resolve) => {
+                resolveEnded = resolve;
+            });
+            const closeStream = () => {
+                resolveEnded();
+                void stream.close();
+            };
             const clientId = broker.addClient(channel, (event) => {
+                // skip: user-addressed frames on the shared tenant channel belong to their recipient only
+                if (isAddressedToOtherUser(event, user.id))
+                    return;
                 const wireEventName = isEntityEventData(event.data)
                     ? event.data.aggregateType
                     : event.type;
                 stream.writeSSE({ event: wireEventName, data: JSON.stringify(event.data) });
-            }, () => stream.close());
-            stream.onAbort(() => {
+            }, closeStream);
+            const unsubscribeAccessInvalidation = broker.subscribeAccessInvalidation(user.id, closeStream, accessInvalidationCredentialFor(user));
+            let released = false;
+            const release = () => {
+                // skip: onAbort and the finally block both release, the second call is a no-op
+                if (released)
+                    return;
+                released = true;
+                // A client disconnect must also wake the heartbeat sleep, not only a server close.
+                resolveEnded();
                 broker.removeClient(channel, clientId);
-            });
+                unsubscribeAccessInvalidation();
+            };
+            stream.onAbort(release);
             // Keep connection alive with heartbeat — siehe SSE_HEARTBEAT_INTERVAL_MS
             // header für die Layer-für-Layer-Begründung der 15s-Cadence.
-            while (true) {
-                await stream.writeSSE({ event: "ping", data: "" });
-                await stream.sleep(SSE_HEARTBEAT_INTERVAL_MS);
+            try {
+                while (!stream.closed && !stream.aborted) {
+                    await stream.writeSSE({ event: "ping", data: "" });
+                    await Promise.race([stream.sleep(SSE_HEARTBEAT_INTERVAL_MS), ended]);
+                }
+            }
+            finally {
+                release();
             }
         });
     });

package/dist/bun-db/connection.js

@@ -27,8 +27,6 @@ export function createBunDbConnection(url, options = {}) {
     if (options.connectTimeoutSeconds !== undefined) {
         pgOpts.connect_timeout = options.connectTimeoutSeconds;
     }
-    // ponytail: "postgres" resolves to the @bender0oo0/postgres fork (nextWrite
-    // null-socket guard, porsager/postgres#1209); switch back per kumiko-framework#3248.
     const listenClient = postgres(url, pgOpts);
     return {
         db,

package/dist/bun-db/index.d.ts

@@ -1,4 +1,4 @@
 export type { BunDbConnection, BunDbConnectionOptions, BunDbRunner, BunDbTx, PgListenClient, } from "./connection.js";
 export { bunDbConnectionOptionsFromEnv, createBunDbConnection } from "./connection.js";
 export type { SelectOptions, TableInfo, WhereObject, WhereOperator, WhereValue } from "./query.js";
-export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, type DeleteManyBatchedOptions, type DeleteManyBatchedResult, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, type IncrementCounterOptions, incrementCounter, insertMany, insertOne, isTimestamptzType, runInSavepoint, runInSavepointIfSupported, selectMany, transaction, type UpsertOnConflictOptions, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";
+export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, type DeleteManyBatchedOptions, type DeleteManyBatchedResult, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, type IncrementCounterOptions, incrementCounter, insertMany, insertOne, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, selectMany, transaction, type UpsertOnConflictOptions, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";

package/dist/bun-db/index.js

@@ -1,4 +1,4 @@
 // bun-db: Bun.sql-basierte DB-API ohne drizzle.
 // Production-Pfad nach drizzle-removal.
 export { bunDbConnectionOptionsFromEnv, createBunDbConnection } from "./connection.js";
-export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, incrementCounter, insertMany, insertOne, isTimestamptzType, runInSavepoint, runInSavepointIfSupported, selectMany, transaction, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";
+export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, incrementCounter, insertMany, insertOne, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, selectMany, transaction, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";

package/dist/bun-db/query.d.ts

@@ -5,6 +5,7 @@ import { type NotExecutorOnly } from "../db/table-builder.js";
 import type { DbRunner } from "@cosmicdrift/kumiko-types/db-connection";
 import type { BunDbRunner } from "./connection.js";
 export declare function asEntityTableMeta(table: unknown): EntityTableMeta | undefined;
+export declare function requireEntityTableMeta(table: unknown, tableName: string): EntityTableMeta;
 type RawClient = {
     unsafe: <TRow = unknown>(sql: string, params?: readonly unknown[]) => Promise<readonly TRow[]>;
     begin: <T>(fn: (tx: unknown) => Promise<T>) => Promise<T>;

package/dist/bun-db/query.js

@@ -68,6 +68,13 @@ export function asEntityTableMeta(table) {
         return fromSymbol;
     return isEntityTableMeta(table) ? table : undefined;
 }
+export function requireEntityTableMeta(table, tableName) {
+    const meta = asEntityTableMeta(table);
+    if (!meta) {
+        throw new Error(`${tableName}: table carries no EntityTableMeta — built via table()?`);
+    }
+    return meta;
+}
 export function asRawClient(db) {
     const dbAny = db;
     // Direct: Bun.SQL / postgres-js Sql / postgres-js TransactionSql. All three
@@ -542,10 +549,16 @@ function buildWhereClause(info, where, startIndex) {
                 const opVal = value[opKey];
                 if (opVal === undefined)
                     continue;
+                // Mirrors applyMultiSelectFilter: ordering/pattern ops have no meaning on a jsonb
+                // option array (`like` would crash as `jsonb ~~ jsonb`), so match nothing.
+                if (pgType === "jsonb" && opKey !== "ne") {
+                    conditions.push("FALSE");
+                    continue;
+                }
                 if (opKey === "ne" && pgType === "jsonb" && isJsonbScalar(opVal)) {
                     const p = prepareJsonbValue([opVal]);
                     if (p && p.kind === "param") {
-                        conditions.push(`NOT (${quoteIdent(col)} @> $${idx++}${p.sql})`);
+                        conditions.push(`(${quoteIdent(col)} IS NULL OR NOT (${quoteIdent(col)} @> $${idx++}${p.sql}))`);
                         values.push(p.bound);
                         continue;
                     }
@@ -885,9 +898,7 @@ export async function updateMany(db, table, set, where) {
         return scoped.updateMany(table, set, where);
     }
     const info = extractTableInfo(table);
-    const setEntries = Object.entries(set)
-        .filter(([k]) => info.hasColumn(k))
-        .map(([k, v]) => {
+    const setEntries = Object.entries(set).map(([k, v]) => {
         const col = info.columnOf(k);
         const pgType = info.pgTypeOf(col);
         return { col, prepared: prepareValue(v, pgType) };

package/dist/crypto/kek-source.js

@@ -34,12 +34,12 @@ async function decryptCiphertext(ciphertext, keyId, token, region, fetchImpl, lo
                 signal: AbortSignal.timeout(DECRYPT_TIMEOUT_MS),
             });
         }
-        catch {
+        catch (error) {
             if (attempt < maxAttempts) {
                 await sleep(RETRY_DELAYS_MS[attempt - 1] ?? 0);
                 continue;
             }
-            throw new Error(`${prefix}Key Manager decrypt failed for key ${keyId}: network error or timeout`);
+            throw new Error(`${prefix}Key Manager decrypt failed for key ${keyId}: network error or timeout`, { cause: error });
         }
         if (!response.ok) {
             if (isRetryableStatus(response.status) && attempt < maxAttempts) {
@@ -62,60 +62,64 @@ async function decryptCiphertext(ciphertext, keyId, token, region, fetchImpl, lo
     }
     throw new Error(`${prefix}Key Manager decrypt failed for key ${keyId}: retries exhausted`);
 }
+// A leftover plaintext beside a ciphertext boots green while nothing was
+// migrated, which is indistinguishable from a finished cutover unless the
+// boot says which source won. The line is built from the path actually taken.
 async function resolveSlot(name, env, options, fetchImpl) {
     const plaintext = env[name];
-    if (plaintext)
-        return plaintext;
     const ciphertext = env[`${name}_CIPHERTEXT`];
+    if (plaintext) {
+        return {
+            value: plaintext,
+            sourceLine: ciphertext
+                ? `${name} source=plaintext-env (ciphertext present and ignored)`
+                : `${name} source=plaintext-env`,
+        };
+    }
     if (!ciphertext)
-        return undefined;
+        return { value: undefined, sourceLine: undefined };
     const keyId = env.PLATFORM_KEK_KMS_KEY_ID;
     const token = env.PLATFORM_KEK_KMS_TOKEN;
     if (!keyId || !token) {
         const prefix = options.logPrefix ? `${options.logPrefix} ` : "";
-        throw new Error(`${prefix}PLATFORM_KEK_KMS_KEY_ID / PLATFORM_KEK_KMS_TOKEN are all-or-none with a KEK ciphertext (slot ${name}) — a partial set means the KMS wiring is broken.`);
-    }
-    const region = env.PLATFORM_KEK_KMS_REGION ?? DEFAULT_REGION;
-    return decryptCiphertext(ciphertext, keyId, token, region, fetchImpl, options.logPrefix);
-}
-// A leftover plaintext beside a ciphertext boots green while nothing was
-// migrated, which is indistinguishable from a finished cutover unless the
-// boot says which source won. Never carries a key value, only its origin.
-function describeKekSource(name, env) {
-    const plaintext = env[name];
-    const ciphertext = env[`${name}_CIPHERTEXT`];
-    if (plaintext) {
-        return ciphertext
-            ? `${name} source=plaintext-env (ciphertext present and ignored)`
-            : `${name} source=plaintext-env`;
+        throw new Error(`${prefix}${name}_CIPHERTEXT is set but PLATFORM_KEK_KMS_KEY_ID / PLATFORM_KEK_KMS_TOKEN are missing — a partial set means the KMS wiring is broken.`);
     }
-    if (!ciphertext)
-        return undefined;
     const region = env.PLATFORM_KEK_KMS_REGION ?? DEFAULT_REGION;
-    return `${name} source=key-manager keyId=${env.PLATFORM_KEK_KMS_KEY_ID} region=${region}`;
+    const value = await decryptCiphertext(ciphertext, keyId, token, region, fetchImpl, options.logPrefix);
+    return {
+        value,
+        sourceLine: `${name} source=key-manager keyId=${keyId} region=${region}`,
+    };
 }
 // Each slot resolves independently so a rollback that clears one slot's
 // plaintext (leaving its ciphertext/_VERSION behind or gone) never blocks
 // another slot's fallback path — the trio check downstream still applies.
+// Slots resolve in parallel: sequentially, a slow Key Manager would cost up to
+// ~16 s per slot (3 x 5 s timeout + backoff) and could trip startup probes.
 export async function resolvePlatformKeks(env, options = {}) {
     const fetchImpl = options.fetch ?? globalThis.fetch;
+    const prefix = options.logPrefix ? `${options.logPrefix} ` : "";
     const slots = options.slots ?? LEGACY_SLOTS;
-    const resolved = {};
-    for (const name of slots) {
-        resolved[name] = await resolveSlot(name, env, options, fetchImpl);
+    // Misconfiguration must not cost a Key Manager round trip.
+    if (slots.includes("PLATFORM_KEK_PREVIOUS") &&
+        (env.PLATFORM_KEK_PREVIOUS || env.PLATFORM_KEK_PREVIOUS_CIPHERTEXT) &&
+        !env.PLATFORM_KEK_PREVIOUS_VERSION) {
+        throw new Error(`${prefix}PLATFORM_KEK_PREVIOUS_VERSION must be set when PLATFORM_KEK_PREVIOUS is set.`);
     }
-    const prefix = options.logPrefix ? `${options.logPrefix} ` : "";
+    const results = await Promise.all(slots.map((name) => resolveSlot(name, env, options, fetchImpl)));
     // biome-ignore lint/suspicious/noConsole: ops-visible fallback when no logger is wired
     const log = options.log ?? console.info;
-    for (const name of slots) {
-        const line = describeKekSource(name, env);
-        if (line)
-            log(`${prefix}${line}`);
-    }
-    if (resolved["PLATFORM_KEK_PREVIOUS"] && !env.PLATFORM_KEK_PREVIOUS_VERSION) {
-        throw new Error(`${prefix}PLATFORM_KEK_PREVIOUS_VERSION must be set when PLATFORM_KEK_PREVIOUS is set.`);
-    }
-    const changed = slots.some((name) => resolved[name] !== env[name]);
+    const resolved = {};
+    slots.forEach((name, index) => {
+        const result = results[index];
+        // skip: slot without a resolved result stays unset
+        if (!result)
+            return;
+        resolved[name] = result.value;
+        if (result.sourceLine)
+            log(`${prefix}${result.sourceLine}`);
+    });
+    const changed = Object.keys(resolved).some((name) => resolved[name] !== env[name]);
     if (!changed)
         return env;
     return { ...env, ...resolved };

package/dist/crypto/kms-adapter.js

@@ -3,8 +3,8 @@ import * as z from "zod";
 export * from "@cosmicdrift/kumiko-types/kms-adapter-types";
 // The KMS error classes live here and not in kumiko-types (#1629): callers
 // branch on them with `instanceof`, which needs a single copy of the class.
-// `satisfies z.ZodType<SubjectId>` binds this to the TS type at compile time
-// (fw#2801) — mint (subjectKeyForRecord) and shred (forget-subject) can no
+// `satisfies z.ZodType<SubjectId>` plus the reverse check in subject-id-schema.test.ts bind this to the TS type
+// at compile time (fw#2801) — mint (subjectKeyForRecord) and shred (forget-subject) can no
 // longer drift apart on which subjects are valid, the way #2809 happened.
 export const subjectIdSchema = z.discriminatedUnion("kind", [
     z.object({ kind: z.literal("user"), userId: z.uuid() }),

package/dist/db/apply-entity-event.js

@@ -114,8 +114,14 @@ export async function applyEntityEvent(event, table, entity, tx) {
             // UPDATE so Postgres doesn't error with "column X does not exist".
             const changes = {};
             for (const [key, value] of Object.entries(rawChanges)) {
-                const fieldType = entity.fields[key]?.type;
-                if (fieldType === "files" || fieldType === "images")
+                const field = entity.fields[key];
+                // Historical events can carry fields since removed from the entity; the
+                // tolerance lives here (not in updateMany) so a live typo still throws.
+                // Base/soft-delete columns (insertedById, deletedAt, ...) are table
+                // columns without an entity field and must still be applied.
+                if (field === undefined && !(key in table))
+                    continue;
+                if (field?.type === "files" || field?.type === "images")
                     continue;
                 changes[key] = value;
             }