@cosmicdrift/kumiko-framework 0.353.0 → 0.354.0

package/dist/api/index.d.ts

@@ -19,7 +19,7 @@ export type { PostAuthLandingArgs, PostAuthLandingFlow, PostAuthLandingResolver,
 export { isSafeLandingPath } from "./post-auth-landing.js";
 export type { RedisSseBroker, RedisSseBrokerOptions } from "./redis-sse-broker.js";
 export { createDefaultSseBroker, createRedisSseBroker, isRedisSseBroker, } from "./redis-sse-broker.js";
-export { type RequestContextData, requestContext, runAsDirectCallEntry, } from "./request-context.js";
+export { type RequestContextData, readonlyRequestContext as requestContext, } from "./request-context.js";
 export { buildRequestContextDataFromRequest, requestIdMiddleware, } from "./request-id-middleware.js";
 export type { MetricsRouteOptions } from "./route-registrars.js";
 export { createMetricsApp, DEFAULT_MAX_REQUEST_BYTES, isPrometheusMeter, } from "./route-registrars.js";

package/dist/api/index.js

@@ -10,7 +10,7 @@ export { createJwtHelper, loadJwtSecretOrKeyring } from "./jwt.js";
 export { patAllows, qnMatches } from "./pat-scope.js";
 export { isSafeLandingPath } from "./post-auth-landing.js";
 export { createDefaultSseBroker, createRedisSseBroker, isRedisSseBroker, } from "./redis-sse-broker.js";
-export { requestContext, runAsDirectCallEntry, } from "./request-context.js";
+export { readonlyRequestContext as requestContext, } from "./request-context.js";
 export { buildRequestContextDataFromRequest, requestIdMiddleware, } from "./request-id-middleware.js";
 export { createMetricsApp, DEFAULT_MAX_REQUEST_BYTES, isPrometheusMeter, } from "./route-registrars.js";
 export { createApiRoutes } from "./routes.js";

package/dist/api/redis-sse-broker.d.ts

@@ -3,6 +3,7 @@ import { type SseBroker } from "./sse-broker.js";
 export type RedisSseBrokerOptions = {
     readonly redisUrl: string;
     readonly clientOptions?: RedisClientOptions;
+    readonly channelPrefix?: string;
 };
 export type RedisSseBroker = SseBroker & {
     readonly kind: "redis";

package/dist/api/redis-sse-broker.js

@@ -1,4 +1,4 @@
-import { redisClientOptionsFromEnv } from "../redis/client.js";
+import { redisChannelPrefixFromEnv, redisClientOptionsFromEnv, } from "../redis/client.js";
 import { createRedisPubSubSignal } from "../redis/pubsub-signal.js";
 import { createSseBroker, readNonEmptyStringArray, } from "./sse-broker.js";
 // Channel namespace for cross-replica fanout (fw#2625). Every pod publishes
@@ -8,7 +8,7 @@ import { createSseBroker, readNonEmptyStringArray, } from "./sse-broker.js";
 // cursor stays the mechanism for "read every event exactly once".
 const CHANNEL_PREFIX = "kumiko:sse:ch:";
 const INVALIDATION_PREFIX = "kumiko:sse:inval:";
-const PSUBSCRIBE_PATTERN = "kumiko:sse:*";
+const PSUBSCRIBE_SUFFIX = "kumiko:sse:*";
 // Narrows on the `kind` discriminant, not on `close`: an app-owned SseBroker
 // may have its own close() and must not be mistaken for the Redis one.
 export function isRedisSseBroker(broker) {
@@ -26,7 +26,11 @@ export function isRedisSseBroker(broker) {
 export function createDefaultSseBroker(env = process.env) {
     const redisUrl = env["REDIS_URL"];
     const ownedRedisSseBroker = redisUrl
-        ? createRedisSseBroker({ redisUrl, clientOptions: redisClientOptionsFromEnv(env) })
+        ? createRedisSseBroker({
+            redisUrl,
+            clientOptions: redisClientOptionsFromEnv(env),
+            channelPrefix: redisChannelPrefixFromEnv(env),
+        })
         : undefined;
     return { sseBroker: ownedRedisSseBroker ?? createSseBroker(), ownedRedisSseBroker };
 }
@@ -92,26 +96,28 @@ function encodeInvalidationScope(scope) {
 // the request.
 export function createRedisSseBroker(opts) {
     const inner = createSseBroker();
+    const channelPrefix = `${opts.channelPrefix ?? ""}${CHANNEL_PREFIX}`;
+    const invalidationPrefix = `${opts.channelPrefix ?? ""}${INVALIDATION_PREFIX}`;
     const signal = createRedisPubSubSignal({
         redisUrl: opts.redisUrl,
-        channelPattern: PSUBSCRIBE_PATTERN,
+        channelPattern: `${opts.channelPrefix ?? ""}${PSUBSCRIBE_SUFFIX}`,
         label: "sse-broker",
         ...(opts.clientOptions ? { clientOptions: opts.clientOptions } : {}),
     });
     signal.onMessage((channel, payload) => {
-        if (channel.startsWith(CHANNEL_PREFIX)) {
+        if (channel.startsWith(channelPrefix)) {
             if (!isSseEvent(payload)) {
                 console.error(`[kumiko:sse-broker] dropping malformed event on "${channel}"`);
                 // skip: malformed payload already logged above, nothing to deliver
                 return;
             }
-            inner.pushToChannel(channel.slice(CHANNEL_PREFIX.length), payload);
+            inner.pushToChannel(channel.slice(channelPrefix.length), payload);
             // skip: channel already routed to the SSE-event branch above, the
             // invalidation branch below is mutually exclusive with this one
             return;
         }
-        if (channel.startsWith(INVALIDATION_PREFIX)) {
-            inner.publishAccessInvalidation(channel.slice(INVALIDATION_PREFIX.length), parseInvalidationScope(payload));
+        if (channel.startsWith(invalidationPrefix)) {
+            inner.publishAccessInvalidation(channel.slice(invalidationPrefix.length), parseInvalidationScope(payload));
         }
     });
     return {
@@ -122,14 +128,14 @@ export function createRedisSseBroker(opts) {
         getTotalClientCount: inner.getTotalClientCount,
         subscribeAccessInvalidation: inner.subscribeAccessInvalidation,
         pushToChannel(channel, event) {
-            signal.publish(`${CHANNEL_PREFIX}${channel}`, event);
+            return signal.publishConfirmed(`${channelPrefix}${channel}`, event);
         },
         // fw#1601: this is the security-critical call — a revoked session's
         // stream must close on every replica, not just the one that observed
         // the revocation event. Publishing (rather than calling inner directly,
         // like the in-memory broker does) is what makes that true here.
         publishAccessInvalidation(userId, scope) {
-            signal.publish(`${INVALIDATION_PREFIX}${userId}`, encodeInvalidationScope(scope));
+            return signal.publishConfirmed(`${invalidationPrefix}${userId}`, encodeInvalidationScope(scope));
         },
         close: signal.close,
     };

package/dist/api/request-context.d.ts

@@ -25,6 +25,7 @@ export declare const requestContext: {
     get(): RequestContextData | undefined;
     generateId(): string;
 };
+export declare const readonlyRequestContext: Pick<typeof requestContext, "get">;
 export declare function runWithOrigin<T>(origin: {
     readonly feature?: string;
     readonly handler?: string;

package/dist/api/request-context.js

@@ -13,6 +13,11 @@ export const requestContext = {
         return generateId();
     },
 };
+// Public view: `run` would let a caller replace the request scope (entryHandler,
+// writeOrigin), so only the read side is exposed through the /api barrel.
+export const readonlyRequestContext = {
+    get: requestContext.get,
+};
 // Enter a scope that attributes every event written inside it. Keeps the
 // surrounding request's ids so correlation survives, and mints fresh ones
 // when there is no surrounding request (job-runner, event-dispatcher) —

package/dist/api/routes.js

@@ -5,7 +5,7 @@ import { AccessDeniedError, reraiseAsKumikoError, serializeError, toKumikoError,
 import { createFallbackLogger } from "../logging/index.js";
 import { stringifyJson } from "../utils/safe-json.js";
 import { Routes } from "./api-constants.js";
-import { getUser } from "./auth-middleware.js";
+import { getAuthTokenExpiry, getUser } from "./auth-middleware.js";
 import { patAllows } from "./pat-scope.js";
 import { requestContext } from "./request-context.js";
 import { SSE_HEARTBEAT_INTERVAL_MS } from "./sse-route.js";
@@ -133,7 +133,9 @@ export function createApiRoutes(dispatcher, options = {}) {
         try {
             assertPayloadDepthAllowed(body.payload);
             assertPatAllowed(user, body.type);
-            generator = dispatcher.stream(body.type, body.payload, user);
+            generator = dispatcher.stream(body.type, body.payload, user, {
+                tokenExpiresAtSec: getAuthTokenExpiry(c),
+            });
         }
         catch (e) {
             return queryErrorResponse(c, toKumiko(e), body.type);

package/dist/api/server.js

@@ -130,6 +130,9 @@ export function buildServer(options) {
         const defaults = createDefaultSseBroker();
         sseBroker = defaults.sseBroker;
         ownedRedisSseBroker = defaults.ownedRedisSseBroker;
+        if (!ownedRedisSseBroker) {
+            console.warn("[kumiko:boot] REDIS_URL is not set: cross-replica fanout disabled. SSE, access-invalidation and toggle-sync reach only the cursor-owning process, so with more than one replica clients on the other replicas miss events and revoked sessions stay open there.");
+        }
     }
     // Same decision as the SSE broker: an explicit dispatcherOptions value
     // (incl. null = opt out) wins, otherwise REDIS_URL turns on cross-replica
@@ -215,6 +218,21 @@ export function buildServer(options) {
         : (options.jwtSecret.keys[options.jwtSecret.signKid] ?? ""));
     const rateLimitResolver = options.context.rateLimit ??
         (wrappedRedis && wantsResolver ? createRateLimitResolver({ redis: wrappedRedis }) : undefined);
+    if (!rateLimitResolver) {
+        // The systemScope default limit only exists once a resolver does, and an app that
+        // declared no explicit rateLimit anywhere never gets one auto-wired (wantsL3 stays
+        // false) — so its cross-tenant handlers are silently unlimited.
+        const unlimitedSystemScopeFeatures = [...options.registry.features.values()]
+            .filter((feature) => feature.systemScope &&
+            Object.keys(feature.writeHandlers).length + Object.keys(feature.queryHandlers).length > 0)
+            .map((feature) => feature.name);
+        if (unlimitedSystemScopeFeatures.length > 0) {
+            console.warn(`[kumiko:boot] r.systemScope() features have handlers but no RateLimitResolver is configured, ` +
+                `so their default rate limit is not enforced: ${unlimitedSystemScopeFeatures.join(", ")}. ` +
+                "Wire a Redis client on context.redis and declare rateLimit on at least one handler (or pass " +
+                "context.rateLimit) to enable the resolver.");
+        }
+    }
     const contextWithObservability = {
         ...contextWithFiles,
         ...(wrappedRedis ? { redis: wrappedRedis } : {}),
@@ -342,7 +360,7 @@ export function buildServer(options) {
             // cross-feature ctx.appendEvent calls at emit-site.
             const mspOwner = msp.name.split(":")[0];
             const mspFiles = fileProviderResolver
-                ? createFileContext(() => fileProviderResolver(event.tenantId))
+                ? createFileContext(() => fileProviderResolver(event.tenantId), event.tenantId)
                 : undefined;
             const applyCtx = createMultiStreamApplyContext({
                 registry: options.registry,
@@ -438,17 +456,19 @@ export function buildServer(options) {
     // resolver is the auto-wired one (or `context.rateLimit` if set);
     // boot-fails loudly when the caller asked for middleware without a
     // working Redis to back it.
+    let globalRateLimitGuard;
     if (wantsL1L2) {
         if (!rateLimitResolver) {
             throw new Error("rateLimit middleware requested but no resolver available — pass `context.redis` " +
                 "or `context.rateLimit` so the resolver can be built.");
         }
         if (options.rateLimit?.global) {
-            app.use("/api/*", globalIpRateLimit({
+            globalRateLimitGuard = globalIpRateLimit({
                 ...options.rateLimit.global,
                 resolver: rateLimitResolver,
                 clientIpResolver,
-            }));
+            });
+            app.use("/api/*", globalRateLimitGuard);
         }
         if (options.rateLimit?.auth) {
             const { path: l2Path = "/api/auth/*", ...l2Opts } = options.rateLimit.auth;
@@ -564,7 +584,12 @@ export function buildServer(options) {
         return csrfGuard(c, next);
     });
     // No PAT rate-limit here: patRouteGuardMiddleware rejects every PAT on httpRoutes before it could count.
+    // httpRoutes sit outside /api/*, so the pre-auth /api/* middlewares do not run for them: the
+    // global IP limit (an unauthenticated flood must not reach JWT verify / session checks) and the
+    // PII ciphertext tripwire are re-attached here. requestId, body limit and observability are not.
     const sessionOnlyHttpRouteGuards = [
+        ...(globalRateLimitGuard ? [globalRateLimitGuard] : []),
+        piiCiphertextResponseGuard(),
         sessionOnlyGuard,
         patRouteGuardMiddleware,
         ...(originGuard ? [originGuard] : []),

package/dist/api/sse-broker.d.ts

@@ -29,11 +29,15 @@ export declare function accessInvalidationCredentialFor(user: Pick<SessionUser,
 export type SseBroker = {
     addClient(channel: string, send: (event: SseEvent) => void, close: () => void): string;
     removeClient(channel: string, clientId: string): void;
-    pushToChannel(channel: string, event: SseEvent): void;
+    pushToChannel(channel: string, event: SseEvent): void | Promise<void>;
     getClientCount(channel: string): number;
     getTotalClientCount(): number;
     subscribeAccessInvalidation(userId: string, onInvalidate: () => void, credential?: AccessInvalidationCredential): () => void;
-    publishAccessInvalidation(userId: string, scope?: AccessInvalidationScope): void;
+    publishAccessInvalidation(userId: string, scope?: AccessInvalidationScope): void | Promise<void>;
 };
 export declare function shouldInvalidateListener(credential: AccessInvalidationCredential, scope: AccessInvalidationScope): boolean;
-export declare function createSseBroker(): SseBroker;
+export type LocalSseBroker = Omit<SseBroker, "publishAccessInvalidation" | "pushToChannel"> & {
+    pushToChannel(channel: string, event: SseEvent): void;
+    publishAccessInvalidation(userId: string, scope?: AccessInvalidationScope): void;
+};
+export declare function createSseBroker(): LocalSseBroker;

package/dist/api/sse-route.js

@@ -5,6 +5,7 @@ import { isAnonymousSessionUser } from "../engine/system-user.js";
 import { Routes } from "./api-constants.js";
 import { getAuthTokenExpiry, getUser } from "./auth-middleware.js";
 import { accessInvalidationCredentialFor } from "./sse-broker.js";
+import { scheduleTokenExpiry } from "./token-expiry-timer.js";
 /**
  * Heartbeat-Cadence für SSE-Streams.
  *
@@ -81,9 +82,6 @@ function decideWireFrame(event, user, options) {
         return undefined;
     return { name: event.type, data };
 }
-// setTimeout overflows (fires immediately) above 2^31-1 ms; a token that
-// outlives it just gets its stream recycled early, the client reconnects.
-const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
 export function createSseRoute(broker, options) {
     const route = new Hono();
     route.get(Routes.sse, async (c) => {
@@ -111,9 +109,7 @@ export function createSseRoute(broker, options) {
                 stream.writeSSE({ event: frame.name, data: JSON.stringify(frame.data) });
             }, closeStream);
             const unsubscribeAccessInvalidation = broker.subscribeAccessInvalidation(user.id, closeStream, accessInvalidationCredentialFor(user));
-            const expiryTimer = tokenExpiresAtSec === undefined
-                ? undefined
-                : setTimeout(closeStream, Math.min(MAX_TIMER_DELAY_MS, Math.max(0, tokenExpiresAtSec * 1000 - Date.now())));
+            const expiryTimer = scheduleTokenExpiry(tokenExpiresAtSec, closeStream);
             let released = false;
             const release = () => {
                 // skip: onAbort and the finally block both release, the second call is a no-op

package/dist/api/token-expiry-timer.d.ts

@@ -0,0 +1 @@
+export declare function scheduleTokenExpiry(tokenExpiresAtSec: number | undefined, onExpired: () => void): ReturnType<typeof setTimeout> | undefined;

package/dist/api/token-expiry-timer.js

@@ -0,0 +1,10 @@
+// setTimeout overflows (fires immediately) above 2^31-1 ms; a token that
+// outlives it just gets its stream recycled early, the client reconnects.
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+// JWT expiry raises no access-invalidation event, so a long-lived stream must end itself
+// when the token it was opened with expires. Callers clear the returned timer on release.
+export function scheduleTokenExpiry(tokenExpiresAtSec, onExpired) {
+    if (tokenExpiresAtSec === undefined)
+        return undefined;
+    return setTimeout(onExpired, Math.min(MAX_TIMER_DELAY_MS, Math.max(0, tokenExpiresAtSec * 1000 - Date.now())));
+}

package/dist/bun-db/query.js

@@ -309,7 +309,20 @@ function isTemporalPlainDateTimeLike(v) {
 // back deterministically without ever touching a local Date getter — the
 // same +value idiom instantFromDriver uses (guard-no-date-api: no
 // `.getTime()`), just anchored to a fixed zone instead of process-local.
-function plainDateFromDriver(value) {
+// A real `date` column always arrives as a UTC-midnight Date. Anything else means the column is
+// still timestamptz (declared `date` before its ALTER ran); the UTC anchor then silently shifts
+// the day, so say so once per column instead of returning the wrong day quietly.
+const warnedNonMidnightDateColumns = new Set();
+const MS_PER_DAY = 86_400_000;
+const dateColumnDriftLog = createFallbackLogger("bun-db");
+function warnIfNotDateColumn(epochMs, column) {
+    // skip: midnight value is a correct date column, and an already-warned column is deduped
+    if (epochMs % MS_PER_DAY === 0 || warnedNonMidnightDateColumns.has(column))
+        return;
+    warnedNonMidnightDateColumns.add(column);
+    dateColumnDriftLog.warn(`column "${column}" is declared as date but returned a non-midnight timestamp; it is probably still timestamptz. Run the ALTER ... TYPE date migration, otherwise days can shift.`);
+}
+function plainDateFromDriver(value, column) {
     if (value === null || value === undefined)
         return null;
     if (isTemporalPlainDate(value))
@@ -326,6 +339,7 @@ function plainDateFromDriver(value) {
         }
     }
     if (value instanceof Date) {
+        warnIfNotDateColumn(+value, column);
         return Temporal.Instant.fromEpochMilliseconds(+value).toZonedDateTimeISO("UTC").toPlainDate();
     }
     return null;
@@ -357,7 +371,7 @@ export function coerceRow(row, info) {
                 coerced = t;
         }
         else if (pgType === "date") {
-            const d = plainDateFromDriver(value);
+            const d = plainDateFromDriver(value, key);
             if (d !== null)
                 coerced = d;
         }
@@ -594,6 +608,19 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                     conditions.push("FALSE");
                     continue;
                 }
+                // Mirrors applyMultiSelectFilter: an array `ne` means "does not contain all of these".
+                if (opKey === "ne" && pgType === "jsonb" && Array.isArray(opVal)) {
+                    if (opVal.length === 0) {
+                        conditions.push("FALSE");
+                        continue;
+                    }
+                    const p = prepareJsonbValue(opVal);
+                    if (p && p.kind === "param") {
+                        conditions.push(`(${ref(col)} IS NULL OR NOT (${ref(col)} @> $${idx++}${p.sql}))`);
+                        values.push(p.bound);
+                        continue;
+                    }
+                }
                 if (opKey === "ne" && pgType === "jsonb" && isJsonbScalar(opVal)) {
                     const p = prepareJsonbValue([opVal]);
                     if (p && p.kind === "param") {

package/dist/crypto/event-pii.js

@@ -62,8 +62,6 @@ export async function encryptEventPayloadPii(eventType, payload, envelope) {
     if (!piiFields || piiFields === "none")
         return payload;
     const kms = configuredPiiSubjectKms();
-    if (!kms)
-        return payload;
     let out;
     for (const [field, spec] of Object.entries(piiFields)) {
         const value = payload[field];
@@ -75,6 +73,10 @@ export async function encryptEventPayloadPii(eventType, payload, envelope) {
         const subject = resolveEventSubject(field, spec, payload, envelope);
         if (subject === null)
             continue;
+        // Resolved before this skip so a missing owner fails in dev exactly as it
+        // does in prod, instead of surfacing only once a KMS is configured.
+        if (!kms)
+            continue;
         const kmsCtx = { requestId: requestContext.get()?.requestId ?? "append-event" };
         const encrypted = typeof value === "string"
             ? await encryptPiiValueForSubject(kms, subject, value, kmsCtx, field)

package/dist/crypto/kms-wiring.js

@@ -58,7 +58,25 @@ export function buildPgKmsOptions(env) {
         previousKeks: { [previousVersion]: env.PLATFORM_KEK_PREVIOUS },
     };
 }
-function assertTrioConsistent(env, logPrefix) {
+const CIPHERTEXT_CAPABLE_SLOTS = [
+    "PLATFORM_KEK",
+    "PLATFORM_KEK_PREVIOUS",
+    "KUMIKO_BLIND_INDEX_KEY",
+];
+// The sync entry points only read plaintext slots. A ciphertext-only slot
+// would otherwise surface as a misleading "trio required" error or, worse,
+// a silent plaintext-PII fallback in dev.
+function assertNoUnresolvedCiphertext(env, logPrefix) {
+    for (const slot of CIPHERTEXT_CAPABLE_SLOTS) {
+        if (!env[slot] && env[`${slot}_CIPHERTEXT`]) {
+            throw new Error(`${logPrefix ? `${logPrefix} ` : ""}${slot}_CIPHERTEXT is set but ${slot} is not — ` +
+                "the sync KMS wiring cannot resolve ciphertext slots; use resolveKmsWiringAsync / requireKmsWiringAsync.");
+        }
+    }
+}
+function assertTrioConsistent(env, logPrefix, rejectUnresolvedCiphertext) {
+    if (rejectUnresolvedCiphertext)
+        assertNoUnresolvedCiphertext(env, logPrefix);
     const trio = [env.PLATFORM_KEK, env.SUBJECT_KEYS_DATABASE_URL, env.KUMIKO_BLIND_INDEX_KEY];
     const complete = trio.every(Boolean);
     if (!complete && trio.some(Boolean)) {
@@ -81,7 +99,13 @@ function assertTrioConsistent(env, logPrefix) {
  *
  *  Prod entry points that must never fall back: use `requireKmsWiring`. */
 export function resolveKmsWiring(env, options = {}) {
-    const complete = assertTrioConsistent(env, options.logPrefix);
+    return wireKms(env, options, true);
+}
+// The async entry points resolve only their declared slots; a ciphertext slot
+// outside that list is the caller's deliberate choice, so only the sync entry
+// points treat a leftover ciphertext as a wiring error.
+function wireKms(env, options, rejectUnresolvedCiphertext) {
+    const complete = assertTrioConsistent(env, options.logPrefix, rejectUnresolvedCiphertext);
     if (complete && env.PLATFORM_KEK && env.SUBJECT_KEYS_DATABASE_URL && env.KUMIKO_BLIND_INDEX_KEY) {
         const kms = createPgKmsAdapter(buildPgKmsOptions({
             ...env,
@@ -104,7 +128,9 @@ export function resolveKmsWiring(env, options = {}) {
  *  flag so the return type is the active wiring, with no narrowing at the call
  *  site. */
 export function requireKmsWiring(env, options = {}) {
-    const wiring = resolveKmsWiring(env, options);
+    return requireActive(wireKms(env, options, true), options);
+}
+function requireActive(wiring, options) {
     if ("allowPlaintextPii" in wiring) {
         throw new Error(`${options.logPrefix ? `${options.logPrefix} ` : ""}PLATFORM_KEK / ` +
             "SUBJECT_KEYS_DATABASE_URL / KUMIKO_BLIND_INDEX_KEY are required here — " +
@@ -117,9 +143,9 @@ export function requireKmsWiring(env, options = {}) {
  *  `resolvePlatformKeks`. The validation stays in the sync function; this only
  *  adds the KEK-fetching step in front of it. */
 export async function resolveKmsWiringAsync(env, options) {
-    return resolveKmsWiring(await resolvePlatformKeks(env, options), options);
+    return wireKms(await resolvePlatformKeks(env, options), options, false);
 }
 /** Async counterpart to `requireKmsWiring`, KEK-resolving like `resolveKmsWiringAsync`. */
 export async function requireKmsWiringAsync(env, options) {
-    return requireKmsWiring(await resolvePlatformKeks(env, options), options);
+    return requireActive(wireKms(await resolvePlatformKeks(env, options), options, false), options);
 }

package/dist/db/eagerload.d.ts

@@ -1,4 +1,5 @@
-import type { EntityDefinition } from "../engine/types/index.js";
+import type { EntityDefinition, SessionUser } from "../engine/types/index.js";
+import { type ParentVisibilityOption } from "./parent-ref-clause.js";
 import type { TenantDb } from "./tenant-db.js";
 export type EagerLoadEntityResolver = (entityName: string) => EntityDefinition | undefined;
 export type EagerloadedRow<T extends Record<string, unknown> = Record<string, unknown>> = T & {
@@ -10,9 +11,13 @@ type ReferenceFieldEntry = {
     readonly multiple: boolean;
 };
 export declare function collectReferenceFields(entity: EntityDefinition): readonly ReferenceFieldEntry[];
+export type EagerLoadViewer = {
+    readonly user: SessionUser;
+    readonly parentVisibility: ParentVisibilityOption;
+};
 /** Eagerload für eine Liste von Rows. Mutiert nicht — gibt eine
  *  flache Kopie der Rows mit hinzugefügtem `_refs`-Property zurück. */
-export declare function enrichWithReferences(rows: ReadonlyArray<Record<string, unknown>>, entity: EntityDefinition, resolveEntity: EagerLoadEntityResolver, db: TenantDb): Promise<Array<Record<string, unknown>>>;
+export declare function enrichWithReferences(rows: ReadonlyArray<Record<string, unknown>>, entity: EntityDefinition, resolveEntity: EagerLoadEntityResolver, db: TenantDb, viewer: EagerLoadViewer): Promise<Array<Record<string, unknown>>>;
 /** Single-Row-Variante für detail-Calls. */
-export declare function enrichRowWithReferences(row: Record<string, unknown>, entity: EntityDefinition, resolveEntity: EagerLoadEntityResolver, db: TenantDb): Promise<Record<string, unknown>>;
+export declare function enrichRowWithReferences(row: Record<string, unknown>, entity: EntityDefinition, resolveEntity: EagerLoadEntityResolver, db: TenantDb, viewer: EagerLoadViewer): Promise<Record<string, unknown>>;
 export {};