@cosmicdrift/kumiko-framework 0.350.0 → 0.352.0

package/dist/pipeline/dispatch-batch.js

@@ -18,12 +18,16 @@ function rewrapHooksWithOrigin(afterCommitHooks, fromIndex, origin) {
         afterCommitHooks[i] = () => runWithWriteOrigin(origin, original);
     }
 }
+function toReservedScope(reservations, index, cmd) {
+    const reservation = reservations.reservedCommands.get(index);
+    return reservation && { type: cmd.type, reservation };
+}
 async function runReservedCommand(scope, cmd, index, tx) {
     const { ctx, user, inheritedOrigin, reservations, origins, afterCommitHooks } = scope;
     const origin = effectiveWriteOrigin(rootWriteOrigin(ctx.registry, cmd.type, user), inheritedOrigin);
     origins.push(origin);
     const hookStart = afterCommitHooks.length;
-    const res = await runAsCommand(reservations.reservedIndexes.has(index) ? cmd.type : undefined, () => runWithWriteOrigin(origin, () => executeNestedWrite(ctx, cmd.type, cmd.payload, user, origin, tx, afterCommitHooks)));
+    const res = await runAsCommand(toReservedScope(reservations, index, cmd), () => runWithWriteOrigin(origin, () => executeNestedWrite(ctx, cmd.type, cmd.payload, user, origin, tx, afterCommitHooks)));
     rewrapHooksWithOrigin(afterCommitHooks, hookStart, origin);
     return res;
 }

package/dist/pipeline/dispatch-write.js

@@ -3,18 +3,16 @@ import { asEntityTableMeta, selectMany } from "../db/query.js";
 import { buildEntityTable, toSnakeCase } from "../db/table-builder.js";
 import { createTenantDb, hasTenantColumn } from "../db/tenant-db.js";
 import { tenantDbRunner } from "../db/tenant-db-runner.js";
-import { hasAccess } from "../engine/access.js";
 import { ConfigScopes } from "../engine/constants.js";
-import { checkWriteFieldOwnership, checkWriteFieldRoles, maskWriteOnlyFields, } from "../engine/field-access.js";
+import { checkWriteFieldOwnership, maskWriteOnlyFields } from "../engine/field-access.js";
 import { defineTransitions, guardTransition } from "../engine/state-machine.js";
 import { HookPhases } from "../engine/types/index.js";
-import { runValidation } from "../engine/validation.js";
-import { AccessDeniedError, FrameworkReasons, InternalError, isKumikoError, memberResolutionReadOnlyDenied, NotFoundError, ValidationError, validationErrorFromZod, writeFailure, } from "../errors/index.js";
+import { AccessDeniedError, FrameworkReasons, InternalError, memberResolutionReadOnlyDenied, NotFoundError, ValidationError, writeFailure, } from "../errors/index.js";
 import { CACHE_SYNC_TOPICS } from "../redis/cache-sync-topics.js";
 import { assertNoSecretLeak } from "../secrets/index.js";
-import { buildHandlerContext, CONFIG_WRITE_RESET_TYPE, CONFIG_WRITE_SET_TYPE, checkFeatureEnabled, enforcePayloadRateLimits, enforceRateLimit, isMemberResolutionPrincipal, resolveDbSource, runHandlerInstrumented, TENANT_TIMEZONE_CONFIG_KEY, } from "./dispatch-shared.js";
+import { buildHandlerContext, CONFIG_WRITE_RESET_TYPE, CONFIG_WRITE_SET_TYPE, isMemberResolutionPrincipal, resolveDbSource, runHandlerInstrumented, TENANT_TIMEZONE_CONFIG_KEY, } from "./dispatch-shared.js";
 import { describeShape, extractNestedSpecs, isLifecycleResult, isWriteResultShape, prefixValidationPath, wrapToKumiko, } from "./dispatcher-utils.js";
-import { handlerAccessError } from "./handler-access-error.js";
+import { runPreHandlerGates } from "./pre-handler-gates.js";
 import { consumeReservation } from "./pre-transaction-reservations.js";
 import { runProjections } from "./projections-runner.js";
 function getTable(ctx, entityName) {
@@ -306,6 +304,22 @@ export async function executeNestedWrite(ctx, type, payload, user, origin, tx, a
     }
     return parentResult;
 }
+async function confirmReservation(reservation, tx, user) {
+    if (!reservation.confirmInTransaction)
+        return undefined;
+    if (!tx) {
+        return writeFailure(new InternalError({
+            message: "a reservation that settles in the transaction needs a transaction",
+        }));
+    }
+    try {
+        await reservation.confirmInTransaction({ tx, tenantId: user.tenantId });
+    }
+    catch (e) {
+        return writeFailure(wrapToKumiko(e));
+    }
+    return undefined;
+}
 async function executeWriteInner(ctx, type, payload, user, origin, tx, afterCommitHooks) {
     const { registry, jobRunner } = ctx;
     const handler = registry.getWriteHandler(type);
@@ -316,87 +330,22 @@ async function executeWriteInner(ctx, type, payload, user, origin, tx, afterComm
     if (isMemberResolutionPrincipal(user)) {
         return writeFailure(memberResolutionReadOnlyDenied());
     }
-    // Feature-toggle gate: disabled handlers must short-circuit before any
-    // rate-limit/access/validation work — see executeQueryInner comment.
-    const disabledErr = await checkFeatureEnabled(ctx, type, user.tenantId);
-    if (disabledErr)
-        return writeFailure(disabledErr);
-    // Rate-limit gate before access (same reasoning as in executeQueryInner).
-    // Throws RateLimitError; the outer wrapper turns it into a 429
-    // WriteFailure via toWriteErrorInfo. Apps that don't use L3 pay zero cost
-    // for non-systemScope handlers with no rateLimit declared; systemScope
-    // handlers pay one isHandlerSystemScoped lookup to check whether the
-    // default per-tenant limit applies.
-    try {
-        await enforceRateLimit(ctx, handler.rateLimit, type, user, registry.isHandlerSystemScoped(type));
-    }
-    catch (e) {
-        if (isKumikoError(e))
-            return writeFailure(e);
-        throw e;
-    }
-    // Default-deny: missing access rule is treated as "no one has access".
-    // The registry boot-validator refuses to register handlers without one,
-    // so in normal boots this branch shouldn't fire — the guard is belt-and-
-    // suspenders in case a handler sneaks through (e.g. runtime injection).
-    if (!hasAccess(user, handler.access)) {
-        return writeFailure(handlerAccessError(user, type));
-    }
-    const parsed = handler.schema.safeParse(payload);
-    if (!parsed.success) {
-        return writeFailure(validationErrorFromZod(parsed.error));
-    }
+    // A command the dispatcher reserved for was already billed against the rate limits; the
+    // gates only run again against the in-transaction state.
+    const reservation = handler.reserveBeforeTransaction ? consumeReservation(type) : undefined;
+    const gates = await runPreHandlerGates(ctx, handler, type, payload, user, reservation ? "recheck" : "charge");
+    if (!gates.isSuccess)
+        return gates;
+    const parsedPayload = gates.payload;
     // A handler that reserves before the transaction cannot do so from inside an open one; running
     // it unreserved would skip the check entirely, so a nested ctx.write of a different capped
     // handler is rejected instead.
-    if (handler.reserveBeforeTransaction && !consumeReservation(type)) {
+    if (handler.reserveBeforeTransaction && !reservation) {
         return writeFailure(new InternalError({
             message: `handler "${type}" reserves before the transaction and cannot run as a nested write unless the top-level command reserved it`,
         }));
     }
-    try {
-        await enforcePayloadRateLimits(ctx, handler.additionalRateLimits, type, user, parsed.data);
-    }
-    catch (e) {
-        if (isKumikoError(e))
-            return writeFailure(e);
-        throw e;
-    }
-    const hookErrors = runValidation(registry, type, parsed.data); // @cast-boundary engine-payload
-    if (hookErrors) {
-        return writeFailure(new ValidationError({
-            fields: hookErrors.map((e) => ({
-                path: e.field,
-                code: e.error,
-                i18nKey: `errors.validation.${e.error}`,
-            })),
-        }));
-    }
-    // Field-level write access check
     const entityName = registry.getHandlerEntity(type);
-    if (entityName) {
-        const entity = registry.getEntity(entityName);
-        if (entity) {
-            const fieldsToCheck = parsed.data["changes"]; // @cast-boundary engine-payload
-            const writePayload = fieldsToCheck ?? parsed.data; // @cast-boundary engine-payload
-            // Pre-handler check: role-only gate. Ownership-level row-match runs
-            // later in the executor where oldRow is loaded — that split lets
-            // updates with partial changes still pass the pre-handler check and
-            // get their full evaluation at save time.
-            const deniedField = checkWriteFieldRoles(entity, writePayload, user);
-            if (deniedField) {
-                return writeFailure(new AccessDeniedError({
-                    message: `field access denied: ${deniedField}`,
-                    i18nKey: "errors.access.fieldDenied",
-                    details: {
-                        reason: FrameworkReasons.fieldAccessDenied,
-                        field: deniedField,
-                        handler: type,
-                    },
-                }));
-            }
-        }
-    }
     const handlerContext = await buildHandlerContext(ctx, type, user, origin, tx, afterCommitHooks);
     // Auto transition guard: if entity has transitions and handler doesn't skip it.
     // Reads via the guard's own db handle — for r.systemScope() handlers
@@ -409,7 +358,7 @@ async function executeWriteInner(ctx, type, payload, user, origin, tx, afterComm
     if (entityName && !handler.unsafeSkipTransitionGuard) {
         const entity = registry.getEntity(entityName);
         if (entity?.transitions && transitionGuardDb) {
-            const parsedData = parsed.data; // @cast-boundary engine-payload
+            const parsedData = parsedPayload; // @cast-boundary engine-payload
             const changes = parsedData["changes"] ?? parsedData; // @cast-boundary engine-payload
             const id = parsedData["id"] ?? undefined; // @cast-boundary engine-payload
             for (const [fieldName, transitionMap] of Object.entries(entity.transitions)) {
@@ -454,7 +403,7 @@ async function executeWriteInner(ctx, type, payload, user, origin, tx, afterComm
     // writeFailure, not via a rethrow) so batches roll back naturally.
     let result;
     try {
-        result = await handler.handler({ type, payload: parsed.data, user }, handlerContext);
+        result = await handler.handler({ type, payload: parsedPayload, user }, handlerContext);
     }
     catch (e) {
         return writeFailure(wrapToKumiko(e));
@@ -472,6 +421,11 @@ async function executeWriteInner(ctx, type, payload, user, origin, tx, afterComm
                 `Use defineWriteHandler() or wrap the return as { isSuccess: true as const, data: ... }.`,
         }));
     }
+    if (result.isSuccess && reservation) {
+        const confirmFailure = await confirmReservation(reservation, tx, user);
+        if (confirmFailure)
+            return confirmFailure;
+    }
     if (result.isSuccess) {
         try {
             const runner = resolveDbSource(ctx, tx);
@@ -483,7 +437,7 @@ async function executeWriteInner(ctx, type, payload, user, origin, tx, afterComm
         // jobRunner has external side-effects (BullMQ enqueue) — must NOT
         // fire for rolled-back writes. Defer to afterCommit.
         if (jobRunner) {
-            const eventData = (parsed.data ?? {}); // @cast-boundary engine-payload
+            const eventData = (parsedPayload ?? {}); // @cast-boundary engine-payload
             afterCommitHooks.push(() => jobRunner.handleEvent(type, eventData, user));
         }
         invalidateTenantTimezoneCache(ctx, type, user, result);

package/dist/pipeline/event-dispatcher-delivery.d.ts

@@ -1,4 +1,5 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { DbConnection, DbRunner, DbTx } from "../db/connection.js";
 import { type PendingIdRange } from "../db/queries/event-store.js";
 import type { AppContext } from "../engine/types/index.js";

package/dist/pipeline/event-dispatcher-delivery.js

@@ -1,8 +1,5 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-// Value-only import, aliased to avoid shadowing the ambient global
-// `Temporal` TYPE that ConsumerStateRow.updatedAt/StoredEventRow.createdAt
-// resolve against (same #1438 dual-package-hazard pattern as event-store.ts).
-import { Temporal as TemporalPolyfill } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { requestContext } from "../api/request-context.js";
 import { insertConsumerIfAbsent, markConsumerProcessing, rearmDeadConsumer, selectConsumerForUpdate, selectConsumerForUpdateSkipLocked, selectProvablyIdleConsumerPairs, updateConsumerDeliveryOutcome, } from "../db/queries/event-consumer.js";
 import { selectEventsHeadId, selectPendingAndNewEventRows, } from "../db/queries/event-store.js";
@@ -54,14 +51,10 @@ export async function acquireConsumerState(tx, name, instanceId, rearmCooldownMs
         // a prior re-arm) gates the retry; maxRearmCount stops a poison event
         // from looping forever (re-arm → same event fails → dead → re-arm →
         // ...) — after the cap it stays dead until a human intervenes.
-        const cooldownDeadline = TemporalPolyfill.Now.instant().subtract({
+        const cooldownDeadline = Temporal.Now.instant().subtract({
             milliseconds: rearmCooldownMs,
         });
-        // @cast-boundary temporal-polyfill-vs-ambient: same TC39 Temporal.Instant
-        // at runtime — state.updatedAt is DB-row-typed against the ambient
-        // global, two distinct nominal types across the two .d.ts sources (see
-        // event-store.ts).
-        const cooldownElapsed = TemporalPolyfill.Instant.compare(state.updatedAt, cooldownDeadline) <= 0;
+        const cooldownElapsed = Temporal.Instant.compare(state.updatedAt, cooldownDeadline) <= 0;
         if (cooldownElapsed && state.rearmCount < maxRearmCount) {
             const rearmed = await rearmDeadConsumer(tx, name, instanceId);
             const rearmedState = rearmed &&

package/dist/pipeline/pre-handler-gates.d.ts

@@ -0,0 +1,9 @@
+import type { SessionUser, WriteHandlerDef } from "../engine/types/index.js";
+import { type WriteFailure } from "../errors/index.js";
+import type { DispatchContext } from "./dispatch-shared.js";
+export type PreHandlerGateMode = "charge" | "recheck";
+export type PreHandlerGateResult = {
+    readonly isSuccess: true;
+    readonly payload: unknown;
+} | WriteFailure;
+export declare function runPreHandlerGates(ctx: DispatchContext, handler: WriteHandlerDef, type: string, rawPayload: unknown, user: SessionUser, mode: PreHandlerGateMode): Promise<PreHandlerGateResult>;

package/dist/pipeline/pre-handler-gates.js

@@ -0,0 +1,104 @@
+import { hasAccess } from "../engine/access.js";
+import { checkWriteFieldRoles } from "../engine/field-access.js";
+import { runValidation } from "../engine/validation.js";
+import { AccessDeniedError, FrameworkReasons, isKumikoError, ValidationError, validationErrorFromZod, writeFailure, } from "../errors/index.js";
+import { checkFeatureEnabled, enforcePayloadRateLimits, enforceRateLimit, } from "./dispatch-shared.js";
+import { handlerAccessError } from "./handler-access-error.js";
+async function rejectDisabledFeature(ctx, type, user) {
+    const disabledErr = await checkFeatureEnabled(ctx, type, user.tenantId);
+    return disabledErr ? writeFailure(disabledErr) : undefined;
+}
+async function rejectRateLimited(ctx, handler, type, user) {
+    try {
+        await enforceRateLimit(ctx, handler.rateLimit, type, user, ctx.registry.isHandlerSystemScoped(type));
+    }
+    catch (e) {
+        if (isKumikoError(e))
+            return writeFailure(e);
+        throw e;
+    }
+    return undefined;
+}
+async function rejectPayloadRateLimited(ctx, handler, type, user, payload) {
+    try {
+        await enforcePayloadRateLimits(ctx, handler.additionalRateLimits, type, user, payload);
+    }
+    catch (e) {
+        if (isKumikoError(e))
+            return writeFailure(e);
+        throw e;
+    }
+    return undefined;
+}
+function rejectInvalidByHooks(ctx, type, payload) {
+    const hookErrors = runValidation(ctx.registry, type, payload); // @cast-boundary engine-payload
+    if (!hookErrors)
+        return undefined;
+    return writeFailure(new ValidationError({
+        fields: hookErrors.map((e) => ({
+            path: e.field,
+            code: e.error,
+            i18nKey: `errors.validation.${e.error}`,
+        })),
+    }));
+}
+// Role-only gate; ownership-level row matching runs later in the executor where oldRow is loaded,
+// so updates with partial changes still pass here and get their full evaluation at save time.
+function rejectDeniedFieldRoles(ctx, type, payload, user) {
+    const { registry } = ctx;
+    const entityName = registry.getHandlerEntity(type);
+    const entity = entityName ? registry.getEntity(entityName) : undefined;
+    if (!entity)
+        return undefined;
+    const fieldsToCheck = payload["changes"]; // @cast-boundary engine-payload
+    const writePayload = fieldsToCheck ?? payload; // @cast-boundary engine-payload
+    const deniedField = checkWriteFieldRoles(entity, writePayload, user);
+    if (!deniedField)
+        return undefined;
+    return writeFailure(new AccessDeniedError({
+        message: `field access denied: ${deniedField}`,
+        i18nKey: "errors.access.fieldDenied",
+        details: {
+            reason: FrameworkReasons.fieldAccessDenied,
+            field: deniedField,
+            handler: type,
+        },
+    }));
+}
+async function rejectBeforeParse(ctx, handler, type, user, mode) {
+    const disabled = await rejectDisabledFeature(ctx, type, user);
+    if (disabled)
+        return disabled;
+    if (mode === "charge") {
+        const rateLimited = await rejectRateLimited(ctx, handler, type, user);
+        if (rateLimited)
+            return rateLimited;
+    }
+    // Default-deny: boot validation refuses handlers without an access rule, so this only guards
+    // against a handler injected at runtime.
+    if (!hasAccess(user, handler.access))
+        return writeFailure(handlerAccessError(user, type));
+    return undefined;
+}
+async function rejectAfterParse(ctx, handler, type, user, payload, mode) {
+    if (mode === "charge") {
+        const rateLimited = await rejectPayloadRateLimited(ctx, handler, type, user, payload);
+        if (rateLimited)
+            return rateLimited;
+    }
+    return (rejectInvalidByHooks(ctx, type, payload) ?? rejectDeniedFieldRoles(ctx, type, payload, user));
+}
+// Every check that runs before a write handler may do work, in dispatch order. A handler that
+// reserves capacity must only reserve for callers who passed all of them.
+export async function runPreHandlerGates(ctx, handler, type, rawPayload, user, mode) {
+    const beforeParse = await rejectBeforeParse(ctx, handler, type, user, mode);
+    if (beforeParse)
+        return beforeParse;
+    const parsed = handler.schema.safeParse(rawPayload);
+    if (!parsed.success)
+        return writeFailure(validationErrorFromZod(parsed.error));
+    const afterParse = await rejectAfterParse(ctx, handler, type, user, parsed.data, mode);
+    if (afterParse)
+        return afterParse;
+    return { isSuccess: true, payload: parsed.data };
+}

package/dist/pipeline/pre-transaction-reservations.d.ts

@@ -1,12 +1,20 @@
+import type { ReservationHandle } from "@cosmicdrift/kumiko-types/handlers";
 import type { SessionUser } from "../engine/types/index.js";
 import { type WriteErrorInfo } from "../errors/index.js";
 import type { BatchCommand, DispatchContext } from "./dispatch-shared.js";
 import type { WriteOrigin } from "./write-origin.js";
-export declare function runAsCommand<T>(reservedType: string | undefined, fn: () => Promise<T>): Promise<T>;
-export declare function consumeReservation(type: string): boolean;
+type ReservationConfirm = ReservationHandle["confirmInTransaction"];
+export type ConsumedReservation = {
+    readonly confirmInTransaction: ReservationConfirm | undefined;
+};
+export declare function runAsCommand<T>(reserved: {
+    readonly type: string;
+    readonly reservation: ConsumedReservation;
+} | undefined, fn: () => Promise<T>): Promise<T>;
+export declare function consumeReservation(type: string): ConsumedReservation | undefined;
 export type PreTransactionReservations = {
     readonly isSuccess: true;
-    readonly reservedIndexes: ReadonlySet<number>;
+    readonly reservedCommands: ReadonlyMap<number, ConsumedReservation>;
     releaseAll(): Promise<void>;
 } | {
     readonly isSuccess: false;
@@ -14,3 +22,4 @@ export type PreTransactionReservations = {
     readonly failedIndex: number;
 };
 export declare function reserveBeforeTransaction(ctx: DispatchContext, commands: readonly BatchCommand[], user: SessionUser, inheritedOrigin: WriteOrigin | undefined): Promise<PreTransactionReservations>;
+export {};

package/dist/pipeline/pre-transaction-reservations.js

@@ -1,19 +1,33 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-import { hasAccess } from "../engine/access.js";
 import { toWriteErrorInfo } from "../errors/index.js";
 import { createFallbackLogger } from "../logging/utils.js";
-import { buildHandlerContext, checkFeatureEnabled, isMemberResolutionPrincipal, } from "./dispatch-shared.js";
+import { buildHandlerContext, isMemberResolutionPrincipal } from "./dispatch-shared.js";
 import { wrapToKumiko } from "./dispatcher-utils.js";
+import { runPreHandlerGates } from "./pre-handler-gates.js";
 import { effectiveWriteOrigin, rootWriteOrigin } from "./write-origin.js";
 // One-shot permission per top-level command: the handler that reserved before the transaction
 // consumes it on entry. A capped handler reached any other way (nested ctx.write, writeAs, a
 // second execution of the same type) finds it spent and is rejected instead of running unreserved.
 const reservedForCommand = new AsyncLocalStorage();
-export function runAsCommand(reservedType, fn) {
-    return reservedForCommand.run(new Set(reservedType === undefined ? [] : [reservedType]), fn);
+export function runAsCommand(reserved, fn) {
+    const store = new Map();
+    if (reserved)
+        store.set(reserved.type, reserved.reservation);
+    return reservedForCommand.run(store, fn);
 }
 export function consumeReservation(type) {
-    return reservedForCommand.getStore()?.delete(type) === true;
+    const store = reservedForCommand.getStore();
+    const reservation = store?.get(type);
+    store?.delete(type);
+    return reservation;
+}
+function toReservationHandle(taken) {
+    if (taken === undefined)
+        return undefined;
+    if (typeof taken === "function") {
+        return { release: taken, confirmInTransaction: async () => { } };
+    }
+    return taken;
 }
 async function releaseAll(ctx, releases) {
     const log = createFallbackLogger("dispatcher", ctx.appContext.log);
@@ -26,36 +40,35 @@ async function releaseAll(ctx, releases) {
         }
     }
 }
-// Same phase as the access/schema gates but before any transaction: a caller who would be denied
-// or sends an invalid payload never reserves anything.
+// Same gates as the in-transaction run, but before any transaction: a caller who is rate limited,
+// denied or sends an invalid payload never reserves anything, so a rejected request cannot consume
+// capacity or trigger the reservation's side effects.
 export async function reserveBeforeTransaction(ctx, commands, user, inheritedOrigin) {
     const releases = [];
-    const reservedIndexes = new Set();
+    const reservedCommands = new Map();
     if (isMemberResolutionPrincipal(user))
-        return { isSuccess: true, reservedIndexes, releaseAll: async () => { } };
+        return { isSuccess: true, reservedCommands, releaseAll: async () => { } };
     for (const [index, command] of commands.entries()) {
         try {
             const handler = ctx.registry.getWriteHandler(command.type);
             if (!handler?.reserveBeforeTransaction)
                 continue;
-            if (!hasAccess(user, handler.access))
-                continue;
-            if (await checkFeatureEnabled(ctx, command.type, user.tenantId))
-                continue;
-            const parsed = handler.schema.safeParse(command.payload);
-            if (!parsed.success)
-                continue;
+            const gates = await runPreHandlerGates(ctx, handler, command.type, command.payload, user, "charge");
+            if (!gates.isSuccess) {
+                await releaseAll(ctx, releases);
+                return { isSuccess: false, error: gates.error, failedIndex: index };
+            }
             const origin = effectiveWriteOrigin(rootWriteOrigin(ctx.registry, command.type, user), inheritedOrigin);
             const handlerContext = await buildHandlerContext(ctx, command.type, user, origin);
-            const release = await handler.reserveBeforeTransaction({ type: command.type, payload: parsed.data, user }, handlerContext);
-            if (release)
-                releases.push(release);
-            reservedIndexes.add(index);
+            const handle = toReservationHandle(await handler.reserveBeforeTransaction({ type: command.type, payload: gates.payload, user }, handlerContext));
+            if (handle)
+                releases.push(handle.release);
+            reservedCommands.set(index, { confirmInTransaction: handle?.confirmInTransaction });
         }
         catch (error) {
             await releaseAll(ctx, releases);
             return { isSuccess: false, error: toWriteErrorInfo(wrapToKumiko(error)), failedIndex: index };
         }
     }
-    return { isSuccess: true, reservedIndexes, releaseAll: () => releaseAll(ctx, releases) };
+    return { isSuccess: true, reservedCommands, releaseAll: () => releaseAll(ctx, releases) };
 }

package/dist/rate-limit/resolver.js

@@ -1,7 +1,4 @@
-// Value-only import, aliased to avoid shadowing the ambient global
-// `Temporal` TYPE that RateLimitDecision.resetAt resolves against (see
-// event-store.ts for the same #1438 dual-package-hazard pattern).
-import { Temporal as TemporalPolyfill } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { RateLimitError } from "../errors/index.js";
 import { RedisKeys } from "../pipeline/redis-keys.js";
 import { toPublicBucketName } from "./bucket.js";
@@ -134,7 +131,7 @@ export function createRateLimitResolver(opts) {
         const nowMs = now();
         const [allowedFlag, remaining, retryAfterMs] = await client.kumikoRateLimit(`${prefix}${bucket}`, String(config.limit), String(refillRatePerMs), String(cost), String(nowMs), String(ttlSeconds));
         const retryAfterSeconds = Math.ceil(retryAfterMs / 1000);
-        const resetAt = TemporalPolyfill.Instant.fromEpochMilliseconds(nowMs + retryAfterMs);
+        const resetAt = Temporal.Instant.fromEpochMilliseconds(nowMs + retryAfterMs);
         return {
             allowed: allowedFlag === 1,
             limit: config.limit,
@@ -162,7 +159,7 @@ export function createRateLimitResolver(opts) {
         const nowMs = now();
         const [remaining, retryAfterMs] = await client.kumikoRateLimitPeek(`${prefix}${bucket}`, String(config.limit), String(refillRatePerMs), String(nowMs));
         const retryAfterSeconds = Math.ceil(retryAfterMs / 1000);
-        const resetAt = TemporalPolyfill.Instant.fromEpochMilliseconds(nowMs + retryAfterMs);
+        const resetAt = Temporal.Instant.fromEpochMilliseconds(nowMs + retryAfterMs);
         return {
             // peek doesn't deduct, so a "would-be" allowed flag is meaningful:
             // true iff at least one token is available right now.

package/dist/time/legacy-date.d.ts

@@ -1,4 +1,4 @@
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 export declare function instantToLegacyDate(instant: Temporal.Instant): Date;
 /** Gegenrichtung: Date aus einer Fremd-Lib (imapflow INTERNALDATE,
  *  mailparser Date-Header) → Temporal.Instant. */

package/dist/time/legacy-date.js

@@ -1,4 +1,4 @@
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 // Temporal→Date-Bridge für Lib-APIs die JS-Date verlangen (imapflow
 // search({since}), nodemailer-Header, ...). Gegenstück zur
 // dateToInstant-Richtung der DB-/Event-Store-Boundaries: Feature-Code

package/dist/time/polyfill.d.ts

@@ -1,4 +1,5 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 /**
  * Ensure `globalThis.Temporal` is available. Idempotent.
  */

package/dist/time/polyfill.js

@@ -1,45 +1,26 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-// Temporal polyfill bootstrap.
+// Temporal bootstrap.
 //
-// Temporal is native in Chromium 144+ / Firefox 139+, but missing in Safari,
-// iOS, and Hermes. Bun/Node coverage is incomplete. Boot installs
-// `temporal-polyfill` once so server/web/mobile share one API.
+// Temporal is native in Bun >= 1.4 and current Chromium/Firefox, but missing in
+// Safari, iOS and Hermes. `@cosmicdrift/kumiko-types/temporal` resolves one
+// implementation (native first, polyfill otherwise) so framework, consumer and
+// ambient-global code all see the same classes.
 //
 // Idempotent: if `globalThis.Temporal` already exists the call is a no-op.
-// The cache is the live global check — not a sticky module flag — so tests
-// that delete the ambient global (fw#1550) still re-install on the next call.
-// Re-install uses the value export + Object.assign (not `temporal-polyfill/global`
-// side-effect import): ESM caches the side-effect module and would not re-run
-// after a teardown.
-let polyfillPromise = null;
+// The check is the live global — not a sticky module flag — so tests that
+// delete the ambient global (fw#1550) still get it back on the next call.
+// Re-install assigns the already-resolved module value: re-importing
+// `temporal-polyfill` here would put a polyfill instance on the global while
+// the rest of the code uses the native classes (instanceof mismatch).
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 /**
  * Ensure `globalThis.Temporal` is available. Idempotent.
  */
 export async function ensureTemporalPolyfill() {
-    if ("Temporal" in globalThis) {
-        // skip: Temporal already on globalThis (native or prior polyfill)
+    // skip: Temporal global already present (native or installed by an earlier call)
+    if ("Temporal" in globalThis)
         return;
-    }
-    if (polyfillPromise) {
-        await polyfillPromise;
-        if ("Temporal" in globalThis) {
-            // skip: Concurrent boot — peer call finished install
-            return;
-        }
-        // Peer resolved but global still missing (torn down mid-flight).
-        polyfillPromise = null;
-    }
-    polyfillPromise = (async () => {
-        if ("Temporal" in globalThis) {
-            // skip: raced native/peer install
-            return;
-        }
-        // Value export — assign ourselves so teardown + re-call still works
-        // (side-effect `temporal-polyfill/global` is ESM-cached and silent on re-import).
-        const { Temporal } = await import("temporal-polyfill");
-        Object.assign(globalThis, { Temporal });
-    })();
-    await polyfillPromise;
+    Object.assign(globalThis, { Temporal });
 }
 /**
  * Type-safe access to globalThis.Temporal. Throws if the polyfill has not

package/dist/time/tz-context.d.ts

@@ -2,7 +2,7 @@ import type { TzContext, TzContextOptions } from "@cosmicdrift/kumiko-types/tz-c
 export type { LocatedTimestampJson, TzContext, TzContextOptions, } from "@cosmicdrift/kumiko-types/tz-context";
 /**
  * Factory: creates a TzContext for the current request.
- * Uses temporal-polyfill's module export (not globalThis.Temporal) so
+ * Uses the kumiko-types Temporal module export (not globalThis.Temporal) so
  * buildHandlerContext stays ambient-free (fw#1525/#1550).
  */
 export declare function createTzContext(options?: TzContextOptions): TzContext;

package/dist/time/tz-context.js

@@ -17,33 +17,30 @@
 //
 // The pure type contracts (TzContext, TzContextOptions, LocatedTimestampJson)
 // live in @cosmicdrift/kumiko-types/tz-context — only the factories are here.
-import { Temporal as TemporalPolyfill } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { ensureTemporalPolyfill } from "./polyfill.js";
 /**
  * Factory: creates a TzContext for the current request.
- * Uses temporal-polyfill's module export (not globalThis.Temporal) so
+ * Uses the kumiko-types Temporal module export (not globalThis.Temporal) so
  * buildHandlerContext stays ambient-free (fw#1525/#1550).
  */
 export function createTzContext(options = {}) {
     const tenant = options.tenant ?? "UTC";
     const user = options.user ?? tenant;
     const geoTz = options.geoTz;
-    // @cast-boundary temporal-polyfill-vs-ambient: same TC39 Temporal values at
-    // runtime; TzContext is typed against ambient Temporal from temporal-spec.
-    const T = TemporalPolyfill;
     return {
         tenant,
         user,
-        now: () => T.Now.instant(), // @wrapper-known semantic-alias
-        nowIn: (tz) => T.Now.zonedDateTimeISO(tz), // @wrapper-known semantic-alias
-        today: (tz) => T.Now.plainDateISO(tz), // @wrapper-known semantic-alias
+        now: () => Temporal.Now.instant(), // @wrapper-known semantic-alias
+        nowIn: (tz) => Temporal.Now.zonedDateTimeISO(tz), // @wrapper-known semantic-alias
+        today: (tz) => Temporal.Now.plainDateISO(tz), // @wrapper-known semantic-alias
         todayRange: (tz) => {
-            const today = T.Now.plainDateISO(tz);
+            const today = Temporal.Now.plainDateISO(tz);
             const startZdt = today.toZonedDateTime({ timeZone: tz });
             const endZdt = today.add({ days: 1 }).toZonedDateTime({ timeZone: tz });
             return { start: startZdt.toInstant(), end: endZdt.toInstant() };
         },
-        parse: (wallClock, tz) => T.PlainDateTime.from(wallClock).toZonedDateTime(tz),
+        parse: (wallClock, tz) => Temporal.PlainDateTime.from(wallClock).toZonedDateTime(tz),
         toInstant: (zdt) => zdt.toInstant(),
         toLocatedJson: (zdt) => ({
             // Wall-clock WITHOUT offset (no "Z", no "+01:00") plus the IANA name.
@@ -52,7 +49,7 @@ export function createTzContext(options = {}) {
             at: zdt.toPlainDateTime().toString(),
             tz: zdt.timeZoneId,
         }),
-        fromLocatedJson: (obj) => T.PlainDateTime.from(obj.at).toZonedDateTime(obj.tz),
+        fromLocatedJson: (obj) => Temporal.PlainDateTime.from(obj.at).toZonedDateTime(obj.tz),
         fromCoordinates: async (coords) => {
             if (geoTz === undefined) {
                 throw new Error("ctx.tz.fromCoordinates requires a GeoTzProvider — inject one via the app context (e.g. buildServer({ context: { geoTzProvider } }) or runProdApp({ extraContext: { geoTzProvider } })) or install a provider package.");