@cosmicdrift/kumiko-framework 0.360.0 → 0.361.0

package/dist/api/server.js

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import { ROLES } from "../auth/roles.js";
+import { createTenantDb } from "../db/tenant-db.js";
 import { createDerivativesContext } from "../derivatives/derivatives-context.js";
 import { buildAppSchema } from "../engine/build-app-schema.js";
 import { EXT_FILE_PROVIDER, EXT_PRINCIPAL_STATUS } from "../engine/extension-names.js";
@@ -12,6 +13,7 @@ import { createFileContext } from "../files/file-handle.js";
 import { createFileRoutes, readFilesRouteOptions } from "../files/file-routes.js";
 import { makeFileProviderResolver } from "../files/provider-resolver.js";
 import { createRecordReadCheck } from "../files/record-read-check.js";
+import { createRecordWriteCheck } from "../files/record-write-check.js";
 import { createFallbackLogger } from "../logging/index.js";
 import { createNoopProvider, DEFAULT_SENSITIVE_CONFIG, mergeSensitiveConfig, registerStandardMetrics, wrapRedisClient, } from "../observability/index.js";
 import { resolveTenantLifecyclePlugin } from "../pipeline/active-membership.js";
@@ -687,11 +689,19 @@ export function buildServer(options) {
         if (!fileDb)
             throw new Error("file routes require db in context");
         const routeOptions = readFilesRouteOptions(options.registry);
+        const canReadRecord = createRecordReadCheck(options.registry, dispatcher.query);
         app.route("/api", createFileRoutes({
             db: fileDb,
             registry: options.registry,
             resolveProvider: fileProviderResolver,
-            canReadRecord: createRecordReadCheck(options.registry, dispatcher.query),
+            canReadRecord,
+            canWriteRecord: createRecordWriteCheck({
+                registry: options.registry,
+                canReadRecord,
+                tenantDbFor: (tenantId) => createTenantDb(fileDb, tenantId, "tenant", undefined, undefined, undefined, {
+                    projectionRegistry: options.registry,
+                }),
+            }),
             ...(routeOptions.accessGuard ? { accessGuard: routeOptions.accessGuard } : {}),
             ...(routeOptions.privilegedRoles ? { privilegedRoles: routeOptions.privilegedRoles } : {}),
             ...(routeOptions.maxUploadSize ? { maxUploadSize: routeOptions.maxUploadSize } : {}),

package/dist/crypto/index.d.ts

@@ -8,4 +8,4 @@ export { type ActiveKmsWiring, buildPgKmsOptions, type KmsWiring, type KmsWiring
 export { createPgKmsAdapter, PgKmsAdapter, type PgKmsAdapterOptions, type RewrapOptions, type RewrapResult, rewrapSubjectKeys, } from "./pg-kms-adapter.js";
 export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, type EncryptPiiOptions, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
 export { createRequestKmsCache, type RequestKmsCache, } from "./request-kms-cache.js";
-export { collectPiiSubjectFields, collectSearchableSubjectFields, type ResolveSubjectOptions, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";
+export { collectPiiEncryptedFields, collectPiiSubjectFields, collectSearchableSubjectFields, type ResolveSubjectOptions, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";

package/dist/crypto/index.js

@@ -8,4 +8,4 @@ export { buildPgKmsOptions, requireKmsWiring, requireKmsWiringAsync, resolveKmsW
 export { createPgKmsAdapter, PgKmsAdapter, rewrapSubjectKeys, } from "./pg-kms-adapter.js";
 export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
 export { createRequestKmsCache, } from "./request-kms-cache.js";
-export { collectPiiSubjectFields, collectSearchableSubjectFields, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";
+export { collectPiiEncryptedFields, collectPiiSubjectFields, collectSearchableSubjectFields, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";

package/dist/crypto/owner-transition-rekey.d.ts

@@ -0,0 +1,2 @@
+import type { EntityDefinition } from "../engine/types/fields.js";
+export declare function personalFieldsRekeyedOnOwnerTransition(entity: EntityDefinition, previous: Record<string, unknown>, mergedNew: Record<string, unknown>, submittedChanges: Record<string, unknown>): Record<string, unknown>;

package/dist/crypto/owner-transition-rekey.js

@@ -0,0 +1,30 @@
+import { PII_ERASED_SENTINEL } from "./kms-adapter.js";
+import { isPiiCiphertext } from "./pii-ciphertext-format.js";
+import { nonEmptyString } from "./subject-resolver.js";
+// Personal fields keep their stored value when an update moves the row to a
+// new owner, so without re-keying they would stay shreddable only by the old
+// owner. Returns the unchanged-by-the-caller values that must be written again
+// so they encrypt under the new owner. Owner → absent is not a transition:
+// the value stays with the last owner so that owner's forget still erases it.
+export function personalFieldsRekeyedOnOwnerTransition(entity, previous, mergedNew, submittedChanges) {
+    const rekeyed = {};
+    for (const [name, field] of Object.entries(entity.fields)) {
+        if (!("userOwned" in field) || field.userOwned === undefined)
+            continue;
+        if ("recordOwned" in field && field.recordOwned === true)
+            continue;
+        if (name in submittedChanges)
+            continue;
+        const { ownerField } = field.userOwned;
+        const nextOwner = nonEmptyString(mergedNew[ownerField]);
+        if (nextOwner === null || nextOwner === nonEmptyString(previous[ownerField]))
+            continue;
+        const value = previous[name];
+        if (value === null || value === undefined || value === PII_ERASED_SENTINEL)
+            continue;
+        if (typeof value === "string" && isPiiCiphertext(value))
+            continue;
+        rekeyed[name] = value;
+    }
+    return rekeyed;
+}

package/dist/crypto/pii-field-encryption.d.ts

@@ -3,6 +3,7 @@ import type { TenantId } from "../engine/types/identifiers.js";
 import { type KmsAdapter, type KmsContext, type LocalKeyKmsAdapter, PII_ERASED_SENTINEL, type SubjectId } from "./kms-adapter.js";
 import { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON } from "./pii-ciphertext-format.js";
 export { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL };
+export declare function piiCiphertextSubject(value: string): SubjectId;
 export declare function encryptPiiValueForSubject(kms: LocalKeyKmsAdapter, subject: SubjectId, value: string, kmsCtx: KmsContext, field: string): Promise<string>;
 export declare function encryptPiiJsonValueForSubject(kms: LocalKeyKmsAdapter, subject: SubjectId, value: unknown, kmsCtx: KmsContext, field: string): Promise<string>;
 export declare function decryptPiiValueForSubject(kms: LocalKeyKmsAdapter, value: string, kmsCtx: KmsContext, field: string): Promise<string>;

package/dist/crypto/pii-field-encryption.js

@@ -87,6 +87,11 @@ async function getOrCreateDek(kms, subject, ctx) {
     }
     return kms.getKey(subject, ctx);
 }
+// The subject a ciphertext is keyed under, read from its inline prefix without
+// touching the KMS.
+export function piiCiphertextSubject(value) {
+    return parseCiphertext(value).subject;
+}
 // Single-value encrypt for callers that resolve the subject themselves
 // (event-pii catalog, backfill). Ciphertext/sentinel inputs pass through —
 // idempotent like the field-map variant. `field` names the value's storage

package/dist/crypto/subject-resolver.d.ts

@@ -12,6 +12,7 @@ export interface ResolveSubjectOptions {
     readonly ownerFallback?: Record<string, unknown>;
     readonly ignoreWhenAbsent?: boolean;
 }
+export declare function nonEmptyString(value: unknown): string | null;
 /**
  * Maps a pii-annotated field to the subject whose key encrypts it.
  * Returns null for fields without any PII annotation (stored plaintext).
@@ -28,5 +29,6 @@ export interface EventSubjectEnvelope {
 }
 export declare function resolveEventSubject(fieldName: string, spec: EventPiiSubject, payload: Record<string, unknown>, envelope: EventSubjectEnvelope): SubjectId | null;
 export declare function collectPiiSubjectFields(entity: EntityDefinition): readonly string[];
+export declare function collectPiiEncryptedFields(entity: EntityDefinition): readonly string[];
 /** Subject-annotated fields that may be plaintext in the derived search index (#1610). */
 export declare function collectSearchableSubjectFields(entity: EntityDefinition): readonly string[];

package/dist/crypto/subject-resolver.js

@@ -11,7 +11,7 @@ export class SubjectResolutionError extends Error {
         this.name = "SubjectResolutionError";
     }
 }
-function nonEmptyString(value) {
+export function nonEmptyString(value) {
     return typeof value === "string" && value.length > 0 ? value : null;
 }
 function rowIdAsString(row) {
@@ -142,6 +142,19 @@ export function collectPiiSubjectFields(entity) {
         .filter(([, field]) => hasSubjectAnnotation(field))
         .map(([name]) => name);
 }
+function isFileReferenceField(field) {
+    return (field.type === "file" ||
+        field.type === "image" ||
+        field.type === "files" ||
+        field.type === "images");
+}
+// File columns hold only the fileRef uuid; the binary is erased by the file-ref
+// user-data hook, so these stay annotated (forget) but are never ciphertext.
+export function collectPiiEncryptedFields(entity) {
+    return Object.entries(entity.fields)
+        .filter(([, field]) => hasSubjectAnnotation(field) && !isFileReferenceField(field))
+        .map(([name]) => name);
+}
 /** Subject-annotated fields that may be plaintext in the derived search index (#1610). */
 export function collectSearchableSubjectFields(entity) {
     return Object.entries(entity.fields)

package/dist/db/apply-entity-event.js

@@ -109,9 +109,6 @@ export async function applyEntityEvent(event, table, entity, tx) {
         case "updated": {
             // payload-Shape: { changes, previous } — siehe event-store-executor.ts.
             const rawChanges = (event.payload["changes"] ?? {}); // @cast-boundary engine-payload
-            // Plural file fields (files/images) have no entity-table column — the
-            // array of UUIDs lives in the event payload only. Strip them from the
-            // UPDATE so Postgres doesn't error with "column X does not exist".
             const changes = {};
             for (const [key, value] of Object.entries(rawChanges)) {
                 const field = entity.fields[key];
@@ -121,8 +118,6 @@ export async function applyEntityEvent(event, table, entity, tx) {
                 // columns without an entity field and must still be applied.
                 if (field === undefined && !(key in table))
                     continue;
-                if (field?.type === "files" || field?.type === "images")
-                    continue;
                 changes[key] = value;
             }
             const rows = await updateMany(tx, table, {

package/dist/db/eagerload.js

@@ -18,7 +18,7 @@
 // Custom handlers must pass the viewer explicitly so the parentRef gate is
 // never skipped silently.
 import { requestContext } from "../api/request-context.js";
-import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, } from "../crypto/index.js";
+import { collectPiiEncryptedFields, configuredPiiSubjectKms, decryptPiiFieldValues, } from "../crypto/index.js";
 import { selectMany } from "../db/query.js";
 import { filterReadFields } from "../engine/field-access.js";
 import { buildOwnershipClause, combineClauses, shiftParams, tableNameOf, } from "../engine/ownership.js";
@@ -162,7 +162,7 @@ export async function enrichWithReferences(rows, entity, resolveEntity, db, view
         const rawRefRows = scope.kind === "restricted"
             ? lookedUpRows.filter((r) => scope.readableIds.has(String(r["id"])))
             : lookedUpRows;
-        const piiFields = collectPiiSubjectFields(refEntity);
+        const piiFields = collectPiiEncryptedFields(refEntity);
         const encryptedFields = collectEncryptedFieldNames(refEntity);
         const kms = configuredPiiSubjectKms();
         const map = await buildRefLookupMap(rawRefRows, refEntity, rf.refEntityName, viewer, piiFields, encryptedFields, kms);

package/dist/db/entity-field-encryption.js

@@ -3,7 +3,7 @@
 // StoredEnvelope in the TEXT column, kekVersion per value, legacy
 // single-key ciphertexts (pre-envelope ENCRYPTION_KEY era) readable via
 // the cipher's legacy fallback until re-encrypted.
-import { collectPiiSubjectFields } from "../crypto/index.js";
+import { collectPiiEncryptedFields } from "../crypto/index.js";
 import { createLogger } from "../logging/index.js";
 import { createEnvMasterKeyProvider } from "../secrets/env-master-key-provider.js";
 export function collectEncryptedFieldNames(entity) {
@@ -19,7 +19,8 @@ export function collectEncryptedFieldNames(entity) {
 // depending on runtime KMS wiring (PII) — either way it has no plaintext
 // column to compare against directly.
 export function isSensitiveLabelField(entity, field) {
-    return (collectEncryptedFieldNames(entity).has(field) || collectPiiSubjectFields(entity).includes(field));
+    return (collectEncryptedFieldNames(entity).has(field) ||
+        collectPiiEncryptedFields(entity).includes(field));
 }
 // `searchable: true` on a text field means it is indexed plaintext
 // somewhere findable by term — a plain text field's own column, or (for a

package/dist/db/entity-table-meta.js

@@ -15,7 +15,7 @@
 //      entity-shaped base columns. Escape hatch: no forced audit trail for the
 //      hand-built path; app author owns tenant scoping / versioning. Prefer a
 //      `store_` table name — `read_` is reserved for managed projections (#1208/#1220).
-import { collectPiiSubjectFields } from "../crypto/index.js";
+import { collectPiiEncryptedFields } from "../crypto/index.js";
 import { SQL_EXPR_BRAND } from "./dialect.js";
 import { READ_MODEL_PREFIX, SOFT_DELETE_LIVE_ROW_PREDICATE, toSnakeCase, toTableName, } from "./table-builder.js";
 // Standard base columns for event-sourced read-model tables. Mirrors
@@ -192,7 +192,7 @@ function fieldToColumnMeta(name, field, entity) {
             return [{ name: snake, pgType: "uuid", notNull: field.required === true }];
         case "files":
         case "images":
-            return [];
+            return [{ name: snake, pgType: "jsonb", notNull: true, defaultSql: "'[]'::jsonb" }];
         default:
             return [];
     }
@@ -345,7 +345,7 @@ export function deriveEntityTableMeta(entityName, entity, options) {
             }
         }
     }
-    const piiSubjectFields = collectPiiSubjectFields(entity);
+    const piiSubjectFields = collectPiiEncryptedFields(entity);
     return {
         tableName,
         columns,

package/dist/db/event-store-executor-context.d.ts

@@ -65,6 +65,7 @@ export type ExecutorContext = {
         ownerFallback?: Record<string, unknown>;
     }) => Promise<Record<string, unknown>>;
     readonly decryptForRead: (row: Record<string, unknown>, opts?: DecryptForReadOptions) => Promise<Record<string, unknown>>;
+    readonly ownerTransitionRekeys: (previous: Record<string, unknown>, mergedNew: Record<string, unknown>, submittedChanges: Record<string, unknown>) => Record<string, unknown>;
     readonly applyDefaults: (payload: Record<string, unknown>) => Record<string, unknown>;
     readonly stripSensitive: (payload: Record<string, unknown> | undefined) => Record<string, unknown>;
 };

package/dist/db/event-store-executor-context.js

@@ -1,6 +1,7 @@
 import { KUMIKO_NAME_SYMBOL } from "@cosmicdrift/kumiko-types/schema-table-types";
 import { requestContext } from "../api/request-context.js";
-import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, encryptPiiFieldValues, KeyErasedError, } from "../crypto/index.js";
+import { collectPiiEncryptedFields, configuredPiiSubjectKms, decryptPiiFieldValues, encryptPiiFieldValues, KeyErasedError, } from "../crypto/index.js";
+import { personalFieldsRekeyedOnOwnerTransition } from "../crypto/owner-transition-rekey.js";
 import { executeRawQueryRead } from "../db/queries/raw-sql.js";
 import { shiftParams } from "../engine/ownership.js";
 import { SYSTEM_TENANT_ID } from "../engine/types/identifiers.js";
@@ -170,7 +171,7 @@ export function buildExecutorContext(table, entity, options) {
     }
     const encryptedFields = collectEncryptedFieldNames(entity);
     const hasEncryptedFields = encryptedFields.size > 0;
-    const piiSubjectFields = collectPiiSubjectFields(entity);
+    const piiSubjectFields = collectPiiEncryptedFields(entity);
     const hasPiiFields = piiSubjectFields.length > 0;
     function fieldCipher() {
         if (options.encryption)
@@ -244,6 +245,11 @@ export function buildExecutorContext(table, entity, options) {
         }
         return out;
     }
+    function ownerTransitionRekeys(previous, mergedNew, submittedChanges) {
+        if (!hasPiiFields || !piiKms())
+            return {};
+        return personalFieldsRekeyedOnOwnerTransition(entity, previous, mergedNew, submittedChanges);
+    }
     function applyDefaults(payload) {
         if (Object.keys(fieldDefaults).length === 0)
             return payload;
@@ -430,6 +436,7 @@ export function buildExecutorContext(table, entity, options) {
         loadExpectSnapshot,
         encryptForStorage,
         decryptForRead,
+        ownerTransitionRekeys,
         applyDefaults,
         stripSensitive,
     };

package/dist/db/event-store-executor-write.js

@@ -2,9 +2,9 @@ import { checkWriteFieldOwnership } from "../engine/field-access.js";
 import { instructionFieldNames } from "../engine/instruction-fields.js";
 import { userCanCreateFieldRow, userCanWriteFieldRow } from "../engine/ownership.js";
 import { buildInsertSchema, buildUpdateSchema } from "../engine/schema-builder.js";
-import { findUnavailableSelectOptions, } from "../engine/screen-helpers.js";
+import { findUnavailableSelectOptions, isRecordLocked, } from "../engine/screen-helpers.js";
 import { SYSTEM_ROLE, SYSTEM_USER_ID } from "../engine/system-user.js";
-import { AccessDeniedError, VersionConflictError as FrameworkVersionConflict, IdempotentReplayError, InternalError, NotFoundError, PreconditionFailedError, UnprocessableError, writeFailure, } from "../errors/index.js";
+import { AccessDeniedError, VersionConflictError as FrameworkVersionConflict, IdempotentReplayError, InternalError, NotFoundError, PreconditionFailedError, RecordLockedError, UnprocessableError, writeFailure, } from "../errors/index.js";
 import { append, IdempotentAppendConflictError as EventStoreIdempotentAppendConflict, VersionConflictError as EventStoreVersionConflict, getStreamVersion, } from "../event-store/index.js";
 import { assertInstructionFieldWriteAllowed, assertIrreversibleOperationAllowed, isIrreversibleEntityVerb, } from "../pipeline/irreversible-operation-gate.js";
 import { hasLiveProjectionsForEvent, runProjectionsForEvent, } from "../pipeline/projections-runner.js";
@@ -118,8 +118,21 @@ async function runPreSave(preSave, changes, previous, isNew, entityName, action,
     }
 }
 export function createWriteVerbs(ctx) {
-    const { table, entity, entityName, entityCache, softDelete, streamTenantFor, streamTenantOverrideFailure, streamTenantCreateFailure, encryptForStorage, decryptForRead, applyDefaults, stripSensitive, loadById, assertStreamWritable, loadExpectSnapshot, } = ctx;
+    const { table, entity, entityName, entityCache, softDelete, streamTenantFor, streamTenantOverrideFailure, streamTenantCreateFailure, encryptForStorage, decryptForRead, ownerTransitionRekeys, applyDefaults, stripSensitive, loadById, assertStreamWritable, loadExpectSnapshot, } = ctx;
     const entityInstructionFieldNames = instructionFieldNames(entity);
+    // update and delete funnel through here, so custom handlers and nested writes cannot
+    // bypass the lock whatever they return. Setting the lock (unlocked row) passes.
+    // Framework system writes that name a writePurpose (retention, erasure) are exempt:
+    // statutory deletion must reach locked rows, and forget (Art. 17) never checks the lock
+    // at all. The options are server-code only; no request field is ever copied into them.
+    function recordLockedFailure(row, id, user, options) {
+        if (options?.unsafeSkipLockGuard === true ||
+            (options?.writePurpose !== undefined && isFrameworkSystemUser(user)) ||
+            !isRecordLocked(entity.lockedWhen, row)) {
+            return undefined;
+        }
+        return writeFailure(new RecordLockedError({ entityName, entityId: id }));
+    }
     const eventVersion = entity.eventVersion ?? 1;
     let insertSchema;
     let updateSchema;
@@ -407,6 +420,9 @@ export function createWriteVerbs(ctx) {
                     },
                 }));
             }
+            const lockedUpdate = recordLockedFailure(previous, payload.id, user, updateOptions);
+            if (lockedUpdate)
+                return lockedUpdate;
             const unavailableOnUpdate = selectOptionNotAvailableFailure(findUnavailableSelectOptions(entity.fields, mergedNew, previous));
             if (unavailableOnUpdate)
                 return unavailableOnUpdate;
@@ -449,9 +465,16 @@ export function createWriteVerbs(ctx) {
                 const submittedChanges = updateOptions?.skipUnchanged
                     ? Object.fromEntries(Object.entries(changes).filter(([key, value]) => !isUnchangedValue(value, previous[key])))
                     : changes;
-                const flatChangesPlain = flattenCompoundTypes(submittedChanges, entity);
+                // fw#3670: crypto-shredding follows the current owner, so personal
+                // fields not in this update are re-written under the new owner's key.
+                // Owner -> absent is not re-keyed; the value stays under the old owner.
+                const changesToPersist = {
+                    ...submittedChanges,
+                    ...ownerTransitionRekeys(previous, mergedNew, submittedChanges),
+                };
+                const flatChangesPlain = flattenCompoundTypes(changesToPersist, entity);
                 const flatChanges = await encryptForStorage(flatChangesPlain, user, {
-                    onlyKeys: Object.keys(submittedChanges),
+                    onlyKeys: Object.keys(changesToPersist),
                     subjectSource: mergedNew,
                     keyTenantId: streamTenantId,
                 });
@@ -583,6 +606,9 @@ export function createWriteVerbs(ctx) {
                     },
                 }));
             }
+            const lockedDelete = recordLockedFailure(existing, payload.id, user, options);
+            if (lockedDelete)
+                return lockedDelete;
             await assertStreamWritable(db, payload.id, streamTenantFor(user, streamTenantId));
             // Stream-version authoritative (see update() for rationale).
             const currentVersion = await getStreamVersion(runner, String(payload.id), streamTenantFor(user, streamTenantId));

package/dist/db/event-store-executor.d.ts

@@ -5,7 +5,8 @@ import type { EntityCache } from "../pipeline/entity-cache.js";
 import type { SearchAdapter } from "../search/types.js";
 import type { EnvelopeCipher } from "../secrets/envelope-cipher.js";
 import { type Table } from "./event-store-executor-context.js";
-export type { EventStoreExecutor } from "@cosmicdrift/kumiko-types/event-store-executor-types";
+export type { EventStoreExecutor, LockGuardOption, WritePurpose, } from "@cosmicdrift/kumiko-types/event-store-executor-types";
+export { WritePurposes } from "@cosmicdrift/kumiko-types/event-store-executor-types";
 export type { EntityLifecycleVerb } from "./event-store-executor-context.js";
 export { entityEventName } from "./event-store-executor-context.js";
 export type EventStoreExecutorOptions = {

package/dist/db/event-store-executor.js

@@ -1,6 +1,7 @@
 import { buildExecutorContext } from "./event-store-executor-context.js";
 import { createReadVerbs } from "./event-store-executor-read.js";
 import { createWriteVerbs } from "./event-store-executor-write.js";
+export { WritePurposes } from "@cosmicdrift/kumiko-types/event-store-executor-types";
 export { entityEventName } from "./event-store-executor-context.js";
 export function createEventStoreExecutor(table, entity, options) {
     const ctx = buildExecutorContext(table, entity, options);

package/dist/db/index.d.ts

@@ -15,11 +15,11 @@ export { collectEncryptedFieldNames, configuredEntityFieldEncryption, configureE
 export { entityTableFromRegistry } from "./entity-table-from-registry.js";
 export type { BuildEntityTableMetaOptions, ColumnMeta, CompositePrimaryKeyMeta, EntityTableMeta, IndexMeta, PgType, UnmanagedTableInput, } from "./entity-table-meta.js";
 export { buildEntityTableMeta, defineUnmanagedTable, deriveEntityTableMeta, } from "./entity-table-meta.js";
-export type { EntityLifecycleVerb, EventStoreExecutor, EventStoreExecutorOptions, } from "./event-store-executor.js";
-export { createEventStoreExecutor, entityEventName } from "./event-store-executor.js";
+export type { EntityLifecycleVerb, EventStoreExecutor, EventStoreExecutorOptions, LockGuardOption, WritePurpose, } from "./event-store-executor.js";
+export { createEventStoreExecutor, entityEventName, WritePurposes, } from "./event-store-executor.js";
 export { enumerateFeatureTableSources, type FeatureTableSource, } from "./feature-table-sources.js";
 export { flattenLocatedTimestamp, rehydrateLocatedTimestamp } from "./located-timestamp.js";
-export { assertValidMigrationName, diffSnapshots, type GenerateMigrationInput, type GenerateMigrationOutput, generateMigration, loadSnapshotJson, renderMigrationSql, type SchemaDiff, type Snapshot, snapshotFromMetas, writeSnapshotJson, } from "./migrate-generator.js";
+export { assertUniqueTableNames, assertValidMigrationName, diffSnapshots, type GenerateMigrationInput, type GenerateMigrationOutput, generateMigration, loadSnapshotJson, renderMigrationSql, type SchemaDiff, type Snapshot, snapshotFromMetas, writeSnapshotJson, } from "./migrate-generator.js";
 export { type AppliedMigration, type ApplyResult, type BaselineResult, baselineMigrations, fetchAppliedMigrations, loadMigrationsFromDir, type Migration, MigrationChecksumMismatchError, readMigrationSqlTexts, runMigrations, runMigrationsFromDir, splitSqlStatements, } from "./migrate-runner.js";
 export { flattenMoney, type MoneyRead, moneyPayloadToMinorUnits, rehydrateMoney } from "./money.js";
 export { constraintOf, extractPgError, isTableAlreadyExists, isUniqueViolation, type PgErrorInfo, } from "./pg-error.js";

package/dist/db/index.js

@@ -10,10 +10,10 @@ export { collectReferenceFields, enrichRowWithReferences, enrichWithReferences,
 export { collectEncryptedFieldNames, configuredEntityFieldEncryption, configureEntityFieldEncryption, decryptEntityFieldValues, encryptEntityFieldValues, } from "./entity-field-encryption.js";
 export { entityTableFromRegistry } from "./entity-table-from-registry.js";
 export { buildEntityTableMeta, defineUnmanagedTable, deriveEntityTableMeta, } from "./entity-table-meta.js";
-export { createEventStoreExecutor, entityEventName } from "./event-store-executor.js";
+export { createEventStoreExecutor, entityEventName, WritePurposes, } from "./event-store-executor.js";
 export { enumerateFeatureTableSources, } from "./feature-table-sources.js";
 export { flattenLocatedTimestamp, rehydrateLocatedTimestamp } from "./located-timestamp.js";
-export { assertValidMigrationName, diffSnapshots, generateMigration, loadSnapshotJson, renderMigrationSql, snapshotFromMetas, writeSnapshotJson, } from "./migrate-generator.js";
+export { assertUniqueTableNames, assertValidMigrationName, diffSnapshots, generateMigration, loadSnapshotJson, renderMigrationSql, snapshotFromMetas, writeSnapshotJson, } from "./migrate-generator.js";
 export { baselineMigrations, fetchAppliedMigrations, loadMigrationsFromDir, MigrationChecksumMismatchError, readMigrationSqlTexts, runMigrations, runMigrationsFromDir, splitSqlStatements, } from "./migrate-runner.js";
 export { flattenMoney, moneyPayloadToMinorUnits, rehydrateMoney } from "./money.js";
 export { constraintOf, extractPgError, isTableAlreadyExists, isUniqueViolation, } from "./pg-error.js";

package/dist/db/migrate-generator.d.ts

@@ -83,5 +83,6 @@ export type GenerateMigrationOutput = {
 };
 export declare const MIGRATION_NAME_RE: RegExp;
 export declare function assertValidMigrationName(name: string): void;
+export declare function assertUniqueTableNames(metas: readonly EntityTableMeta[]): void;
 export declare function generateMigration(input: GenerateMigrationInput): GenerateMigrationOutput;
 export {};

package/dist/db/migrate-generator.js

@@ -428,8 +428,20 @@ export function assertValidMigrationName(name) {
         throw new Error(`Invalid migration name "${name}" — must start with a letter or digit, then letters/digits/"-"/"_" only (max 64 chars).`);
     }
 }
+export function assertUniqueTableNames(metas) {
+    const counts = new Map();
+    for (const { tableName } of metas)
+        counts.set(tableName, (counts.get(tableName) ?? 0) + 1);
+    const duplicates = [...counts].filter(([, count]) => count > 1);
+    if (duplicates.length > 0) {
+        throw new Error(duplicates
+            .map(([tableName, count]) => `ENTITY_METAS lists table "${tableName}" ${count} times — the migration diff would silently use only one definition. collectTableMetas(features) already includes every table a feature registers (r.storeTable, entities, projections); remove the hand-added meta for "${tableName}".`)
+            .join("\n"));
+    }
+}
 export function generateMigration(input) {
     assertValidMigrationName(input.name);
+    assertUniqueTableNames(input.metas);
     const nextSnapshot = snapshotFromMetas(input.metas);
     const diff = diffSnapshots(input.prevSnapshot, nextSnapshot);
     const retiredDrops = findRetiredTableDrops(input.priorMigrationsSql ?? [], nextSnapshot);

package/dist/db/queries/backfill-pii.d.ts

@@ -9,6 +9,7 @@ export type PiiBackfillResult = {
     readonly updatedEvents: number;
     readonly encryptedFields: number;
     readonly erasedFields: number;
+    readonly rekeyedFields: number;
     readonly ownerFromProjection: number;
     readonly erasedUnresolvable: number;
     readonly deletedSnapshots: number;
@@ -30,6 +31,7 @@ export type PiiBackfillOptions = {
     readonly dryRun?: boolean;
     readonly resolveOwnerFromProjection?: boolean;
     readonly eraseUnresolvableSubjects?: boolean;
+    readonly rekeyTenantKeyedOwnerFields?: boolean;
 };
 export type PiiBackfillBatchOptions = PiiBackfillOptions & {
     readonly afterEventId?: bigint | string;