@cosmicdrift/kumiko-framework 0.362.0 → 0.363.0

package/dist/api/auth-middleware.js

@@ -1,3 +1,4 @@
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { getCookie } from "hono/cookie";
 import { TENANT_TEARDOWN_STATUSES } from "../engine/active-membership.js";
 import { createAnonymousUser } from "../engine/system-user.js";
@@ -482,17 +483,18 @@ async function requestsCancelDestruction(c) {
         return false;
     try {
         const path = c.req.path;
-        const body = (await c.req.raw.clone().json());
+        const body = await c.req.raw.clone().json();
         if (path === "/api/write") {
-            return body.type === TENANT_LIFECYCLE_CANCEL_QN;
+            return propertyOf(body, "type") === TENANT_LIFECYCLE_CANCEL_QN;
         }
         if (path === "/api/batch") {
+            const commands = propertyOf(body, "commands");
             // every(), not some(): a batch mixing the cancel command with other
             // writes must NOT wave the whole batch through the teardown gate —
             // only a batch consisting solely of cancel-destruction is exempt.
-            return (Array.isArray(body.commands) &&
-                body.commands.length > 0 &&
-                body.commands.every((command) => command.type === TENANT_LIFECYCLE_CANCEL_QN));
+            return (Array.isArray(commands) &&
+                commands.length > 0 &&
+                commands.every((command) => propertyOf(command, "type") === TENANT_LIFECYCLE_CANCEL_QN));
         }
     }
     catch {

package/dist/api/redis-sse-broker.js

@@ -1,3 +1,4 @@
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { redisChannelPrefixFromEnv, redisClientOptionsFromEnv, } from "../redis/client.js";
 import { createRedisPubSubSignal } from "../redis/pubsub-signal.js";
 import { createSseBroker, readNonEmptyStringArray, } from "./sse-broker.js";
@@ -37,7 +38,9 @@ export function createDefaultSseBroker(env = process.env) {
 function isSseEvent(value) {
     return (typeof value === "object" &&
         value !== null &&
+        "type" in value &&
         typeof value.type === "string" &&
+        "data" in value &&
         typeof value.data === "object" &&
         value.data !== null);
 }
@@ -50,25 +53,24 @@ function isSseEvent(value) {
 // sparing something it doesn't understand: fail-closed on a mixed rolling
 // deploy. Anything malformed also falls back to userwide.
 function parseInvalidationScope(payload) {
-    if (typeof payload !== "object" || payload === null)
+    if (!isPlainObject(payload))
         return { kind: "user" };
-    const record = payload;
-    if ("scope" in record) {
-        const { scope } = record;
+    if ("scope" in payload) {
+        const { scope } = payload;
         if (scope === "sessions") {
-            const sessionIds = readNonEmptyStringArray(record["sessionIds"]);
+            const sessionIds = readNonEmptyStringArray(payload["sessionIds"]);
             if (sessionIds)
                 return { kind: "sessions", sessionIds };
         }
         if (scope === "pat-tokens") {
-            const tokenIds = readNonEmptyStringArray(record["tokenIds"]);
+            const tokenIds = readNonEmptyStringArray(payload["tokenIds"]);
             if (tokenIds)
                 return { kind: "pat-tokens", tokenIds };
         }
         return { kind: "user" };
     }
-    if ("keptSessionId" in record) {
-        const { keptSessionId } = record;
+    if ("keptSessionId" in payload) {
+        const { keptSessionId } = payload;
         if (typeof keptSessionId === "string" && keptSessionId.length > 0) {
             return { kind: "all-except-session", keptSessionId };
         }

package/dist/api/routes.js

@@ -172,7 +172,7 @@ export function createApiRoutes(dispatcher, options = {}) {
             // in-flight .next(), so awaiting here would block the response until
             // that pending pull resolves (which may be never for an idle stream).
             void generator.return(undefined).catch(() => { });
-            return c.body(null, CLIENT_CLOSED_REQUEST_STATUS); // @cast-boundary non-standard client-closed-request status, Hono's union doesn't include it
+            return c.body(null, CLIENT_CLOSED_REQUEST_STATUS); // @cast-boundary third-party-type-gap — non-standard client-closed-request status, Hono's union doesn't include it
         }
         return streamSSE(c, async (stream) => {
             stream.onAbort(() => {
@@ -394,7 +394,7 @@ function clientAbortResponse(c, requestId, type) {
     logClientWarn("request aborted by client", requestId, type, {
         status: CLIENT_CLOSED_REQUEST_STATUS,
     });
-    return c.body(null, CLIENT_CLOSED_REQUEST_STATUS); // @cast-boundary non-standard client-closed-request status, Hono's union doesn't include it
+    return c.body(null, CLIENT_CLOSED_REQUEST_STATUS); // @cast-boundary third-party-type-gap — non-standard client-closed-request status, Hono's union doesn't include it
 }
 // For /query + /command: no isSuccess on success (just { data } / {ok}), so we
 // keep the same lean shape on failure — only the `error` key.

package/dist/bun-db/query.d.ts

@@ -2,13 +2,15 @@ import type { AggregateRow, AggregateSpec } from "@cosmicdrift/kumiko-types/aggr
 import type { SelectOptions, WhereObject } from "@cosmicdrift/kumiko-types/where-clause-types";
 import type { EntityTableMeta } from "../db/entity-table-meta.js";
 import { type NotExecutorOnly } from "../db/table-builder.js";
+import { asEntityTableMeta, requireEntityTableMeta } from "../db/table-introspection.js";
 import type { DbRunner } from "@cosmicdrift/kumiko-types/db-connection";
 import type { BunDbRunner } from "./connection.js";
-export declare function asEntityTableMeta(table: unknown): EntityTableMeta | undefined;
-export declare function requireEntityTableMeta(table: unknown, tableName: string): EntityTableMeta;
+export { asEntityTableMeta, requireEntityTableMeta };
 type RawClient = {
     unsafe: <TRow = unknown>(sql: string, params?: readonly unknown[]) => Promise<readonly TRow[]>;
-    begin: <T>(fn: (tx: unknown) => Promise<T>) => Promise<T>;
+    begin: <T>(fn: (tx: BunDbRunner) => Promise<T>) => Promise<T>;
+    savepoint?: <T>(fn: (sp: unknown) => Promise<T>) => Promise<T>;
+    release?: unknown;
 };
 export declare function asRawClient(db: unknown): RawClient;
 export declare function runInSavepoint<T>(tx: unknown, fn: (sp: unknown) => Promise<T>): Promise<T>;
@@ -26,7 +28,7 @@ export type TableInfo = {
     readonly hasColumn: (fieldOrColumn: string) => boolean;
 };
 export declare function extractTableInfo(table: TableLike): TableInfo;
-export declare function coerceRow<T extends Record<string, unknown>>(row: T, info: TableInfo): T;
+export declare function coerceRow<T>(row: T, info: TableInfo): T;
 export declare function isClosedConnectionError(err: unknown): boolean;
 export declare function describeClosedConnectionFailure(raw: unknown, err: unknown, attempts: number): Record<string, unknown> | undefined;
 export declare function unsafeReadRetrying<TRow>(db: AnyDb, sqlText: string, params: readonly unknown[]): Promise<readonly TRow[]>;

package/dist/bun-db/query.js

@@ -18,16 +18,17 @@
 //   - drizzle pgTable (legacy, has Symbol-based tableName) — extracted via
 //     drizzle's getTableName + getTableColumns (drizzle kept only as a type
 //     reference, never as a runtime API call)
-import { KUMIKO_META_SYMBOL } from "@cosmicdrift/kumiko-types/schema-table-types";
 // Static import (not getTemporal()): coercion works without an installed
 // global and returns the same Temporal classes as the rest of the repo (#1480).
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isOneOf, isPlainObject, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { requestContext } from "../api/request-context.js";
 import { computeBlindIndex, configuredBlindIndexKey } from "../crypto/blind-index.js";
 import { isPiiCiphertext } from "../crypto/pii-ciphertext-format.js";
 import { SQL_EXPR_BRAND } from "../db/dialect.js";
 import { extractPgError } from "../db/pg-error.js";
 import { toSnakeCase } from "../db/table-builder.js";
+import { asEntityTableMeta, requireEntityTableMeta } from "../db/table-introspection.js";
 import { camelCase as envCamelCase } from "../env/index.js";
 import { InternalError } from "../errors/index.js";
 import { createFallbackLogger } from "../logging/index.js";
@@ -48,43 +49,17 @@ function snakeToCamel(key) {
 // enumerable props, so an entity field named `source`/`columns`/`tableName`/…
 // would overwrite the matching meta key — reading the meta from the symbol is
 // the only collision-safe path.
-function isEntityTableMeta(v) {
-    return (v !== null &&
-        typeof v === "object" &&
-        typeof v.tableName === "string" &&
-        Array.isArray(v.columns) &&
-        Array.isArray(v.indexes) &&
-        (v.source === "managed" || v.source === "unmanaged"));
-}
-// Resolve any framework table input to its canonical EntityTableMeta:
-//  - table()/buildEntityTable outputs carry it under KUMIKO_META_SYMBOL, immune
-//    to a column-handle shadowing a meta key.
-//  - deriveEntityTableMeta / defineUnmanagedTable return a plain meta with no
-//    handle-spread, so its structural shape is itself unshadowable.
-export function asEntityTableMeta(table) {
-    if (table === null || typeof table !== "object")
-        return undefined;
-    const fromSymbol = table[KUMIKO_META_SYMBOL];
-    if (isEntityTableMeta(fromSymbol))
-        return fromSymbol;
-    return isEntityTableMeta(table) ? table : undefined;
-}
-export function requireEntityTableMeta(table, tableName) {
-    const meta = asEntityTableMeta(table);
-    if (!meta) {
-        throw new Error(`${tableName}: table carries no EntityTableMeta — built via table()?`);
-    }
-    return meta;
+export { asEntityTableMeta, requireEntityTableMeta };
+function isRawClient(value) {
+    return typeof propertyOf(value, "unsafe") === "function";
 }
 export function asRawClient(db) {
-    const dbAny = db;
     // Direct: Bun.SQL / postgres-js Sql / postgres-js TransactionSql. All three
     // expose `.unsafe`; only Sql/Bun.SQL have `.begin` — TransactionSql uses
     // `.savepoint` for nested-tx. We only require `.unsafe` here; callers that
     // need `.begin` (e.g. `transaction()`) verify it themselves.
-    if (typeof dbAny["unsafe"] === "function") {
-        return dbAny;
-    }
+    if (isRawClient(db))
+        return db;
     // TenantDb (ctx.db) has no unfiltered escape via asRawClient anymore — fail
     // closed instead of silently unwrapping a tenant-scoped handle.
     if (isTenantDbShape(db)) {
@@ -93,16 +68,13 @@ export function asRawClient(db) {
             "{ reason } on the handler/hook (r.systemScope() features: ctx.systemDb.unsafeRaw(reason)).");
     }
     // Drizzle DbConnection (legacy compat): $client = postgres-js Sql.
-    const $client = dbAny["$client"];
-    if ($client && typeof $client["unsafe"] === "function") {
+    const $client = propertyOf(db, "$client");
+    if (isRawClient($client))
         return $client;
-    }
     // Drizzle pg-transaction (legacy compat): session.client = postgres-js Sql.
-    const session = dbAny["session"];
-    const sessionClient = session?.["client"];
-    if (sessionClient && typeof sessionClient["unsafe"] === "function") {
+    const sessionClient = propertyOf(propertyOf(db, "session"), "client");
+    if (isRawClient(sessionClient))
         return sessionClient;
-    }
     throw new Error("bun-db: db argument has no .unsafe() — pass Bun.SQL, postgres-js Sql, or a transaction handle.");
 }
 // postgres.js / Bun.SQL reject the WHOLE begin() when any statement inside
@@ -131,7 +103,7 @@ export async function runInSavepoint(tx, fn) {
 // to paper over by re-running `fn` without the savepoint's isolation.
 export async function runInSavepointIfSupported(db, fn) {
     const raw = asRawClient(db);
-    // @cast-boundary driver savepoint handle → DbRunner at the single seam
+    // @cast-boundary db-runner savepoint handle → DbRunner at the single seam
     const asRunner = (sp) => sp;
     if (typeof raw.savepoint !== "function")
         return fn(asRunner(db));
@@ -156,15 +128,14 @@ export async function runInSavepointIfSupported(db, fn) {
 function isTenantDbShape(db) {
     if (typeof db !== "object" || db === null)
         return false;
-    const d = db;
-    if (typeof d["unsafe"] === "function")
+    if (typeof propertyOf(db, "unsafe") === "function")
         return false;
-    return (typeof d["selectMany"] === "function" &&
-        typeof d["fetchOne"] === "function" &&
-        typeof d["insertOne"] === "function" &&
-        typeof d["updateMany"] === "function" &&
-        typeof d["deleteMany"] === "function" &&
-        "tenantId" in d);
+    return (typeof propertyOf(db, "selectMany") === "function" &&
+        typeof propertyOf(db, "fetchOne") === "function" &&
+        typeof propertyOf(db, "insertOne") === "function" &&
+        typeof propertyOf(db, "updateMany") === "function" &&
+        typeof propertyOf(db, "deleteMany") === "function" &&
+        "tenantId" in db);
 }
 function tenantDbDelegate(db) {
     return isTenantDbShape(db) ? db : undefined;
@@ -182,6 +153,9 @@ function assertNotTenantScoped(db, fnName) {
 const WHERE_OPERATOR_KEYS = ["gt", "gte", "lt", "lte", "ne", "in", "like", "jsonText"];
 const _whereOperatorKeysExhaustive = true;
 void _whereOperatorKeysExhaustive;
+function isJsonTextMatchList(value) {
+    return Array.isArray(value);
+}
 function isWhereOperator(v) {
     if (v === null || typeof v !== "object" || Array.isArray(v))
         return false;
@@ -190,7 +164,7 @@ function isWhereOperator(v) {
     const keys = Object.keys(v);
     if (keys.length === 0)
         return false;
-    return keys.every((k) => WHERE_OPERATOR_KEYS.includes(k));
+    return keys.every((k) => isOneOf(WHERE_OPERATOR_KEYS, k));
 }
 export function extractTableInfo(table) {
     const meta = asEntityTableMeta(table);
@@ -236,10 +210,13 @@ function quoteIdent(name) {
 //
 // Symmetric on write: Temporal.Instant doesn't bind directly into postgres-js
 // params — convert to ISO string when the column pgType is timestamptz.
+function toStringTagOf(v) {
+    return typeof v === "object" && v !== null && Symbol.toStringTag in v
+        ? v[Symbol.toStringTag]
+        : undefined;
+}
 function isTemporalInstant(v) {
-    return (typeof v === "object" &&
-        v !== null &&
-        v[Symbol.toStringTag] === "Temporal.Instant");
+    return toStringTagOf(v) === "Temporal.Instant";
 }
 // Postgres bigint → JS: safe integers become `number` (matches createBigIntField /
 // drizzle mode:"number"); values outside ±2^53 stay `bigint` (money cents, raw
@@ -289,15 +266,14 @@ function instantFromDriver(value) {
     return null;
 }
 function isTemporalPlainDate(v) {
-    return (typeof v === "object" &&
-        v !== null &&
-        v[Symbol.toStringTag] === "Temporal.PlainDate");
+    return toStringTagOf(v) === "Temporal.PlainDate";
 }
 function isTemporalPlainDateTimeLike(v) {
-    return (typeof v === "object" &&
+    const tag = toStringTagOf(v);
+    return ((tag === "Temporal.PlainDateTime" || tag === "Temporal.ZonedDateTime") &&
+        typeof v === "object" &&
         v !== null &&
-        (v[Symbol.toStringTag] === "Temporal.PlainDateTime" ||
-            v[Symbol.toStringTag] === "Temporal.ZonedDateTime") &&
+        "toPlainDate" in v &&
         typeof v.toPlainDate === "function");
 }
 // Verified empirically against Bun.SQL (kumiko-framework#1924): a `date`
@@ -353,6 +329,8 @@ function plainDateFromDriver(value, column) {
 //
 // Unknown columns (computed/aliased) pass through unchanged.
 export function coerceRow(row, info) {
+    if (!isPlainObject(row))
+        return row;
     const out = {};
     let changed = false;
     for (const key of Object.keys(row)) {
@@ -568,7 +546,7 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                 if (pgType !== "jsonb") {
                     throw new Error(`where: jsonText requires a jsonb column, "${col}" is ${pgType}`);
                 }
-                const matches = Array.isArray(value.jsonText) ? value.jsonText : [value.jsonText];
+                const matches = isJsonTextMatchList(value.jsonText) ? value.jsonText : [value.jsonText];
                 for (const match of matches) {
                     if (!Array.isArray(match.keys) ||
                         match.keys.length === 0 ||
@@ -599,7 +577,7 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                 like: "LIKE",
             };
             for (const [opKey, opSym] of Object.entries(opMap)) {
-                const opVal = value[opKey];
+                const opVal = Reflect.get(value, opKey);
                 if (opVal === undefined)
                     continue;
                 // Mirrors applyMultiSelectFilter: ordering/pattern ops have no meaning on a jsonb
@@ -638,7 +616,7 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                     values.push(p.bound);
                 }
             }
-            const inVal = value["in"];
+            const inVal = value.in;
             if (Array.isArray(inVal)) {
                 if (pgType === "jsonb") {
                     conditions.push(jsonbContainsAny(col, inVal));
@@ -711,11 +689,9 @@ export function isClosedConnectionError(err) {
 function isPooledClient(raw) {
     if (raw === null || (typeof raw !== "object" && typeof raw !== "function"))
         return false;
-    // @cast-boundary driver handle shape — begin/savepoint/release are optional across drivers
-    const r = raw;
-    return (typeof r.begin === "function" &&
-        typeof r.savepoint !== "function" &&
-        typeof r.release !== "function");
+    return (typeof propertyOf(raw, "begin") === "function" &&
+        typeof propertyOf(raw, "savepoint") !== "function" &&
+        typeof propertyOf(raw, "release") !== "function");
 }
 const closedConnectionLog = createFallbackLogger("bun-db");
 // The driver rejects in-flight queries with this AbortError (no code) when the
@@ -803,8 +779,7 @@ async function unsafeLoggingClosedConnection(db, sqlText, params, context) {
 }
 const DEFAULT_POOL_MAX = 10;
 function poolMaxOf(raw) {
-    // @cast-boundary driver pool options — both postgres-js and Bun.SQL expose options.max
-    const max = raw.options?.max;
+    const max = propertyOf(propertyOf(raw, "options"), "max");
     return typeof max === "number" && Number.isInteger(max) && max > 0 ? max : DEFAULT_POOL_MAX;
 }
 // Exported so raw-SQL query modules outside bun-db (e.g. bundled-features'
@@ -814,7 +789,7 @@ function poolMaxOf(raw) {
 export async function unsafeReadRetrying(db, sqlText, params) {
     const raw = asRawClient(db);
     try {
-        return (await raw.unsafe(sqlText, params));
+        return await raw.unsafe(sqlText, params);
     }
     catch (err) {
         if (!isPooledClient(raw) || !isClosedConnectionError(err)) {
@@ -826,7 +801,7 @@ export async function unsafeReadRetrying(db, sqlText, params) {
         let lastErr = err;
         for (let attempt = 0; attempt < maxRetries; attempt++) {
             try {
-                return (await raw.unsafe(sqlText, params));
+                return await raw.unsafe(sqlText, params);
             }
             catch (retryErr) {
                 lastErr = retryErr;
@@ -872,7 +847,7 @@ export async function selectMany(db, table, where, options) {
         }
         sqlText += ` LIMIT ${options.limit}`;
     }
-    const raw = (await unsafeReadRetrying(db, sqlText, values));
+    const raw = await unsafeReadRetrying(db, sqlText, values);
     return coerceRows(raw, info);
 }
 // biome-ignore lint/suspicious/noExplicitAny: see selectMany default
@@ -937,7 +912,7 @@ export async function selectInnerJoin(db, spec) {
         sqlText += ` WHERE ${conditions.join(" AND ")}`;
     if (spec.limit !== undefined)
         sqlText += ` LIMIT ${spec.limit}`;
-    const raw = (await unsafeReadRetrying(db, sqlText, values));
+    const raw = await unsafeReadRetrying(db, sqlText, values);
     return raw.map((row) => {
         const leftRow = {};
         const rightRow = {};
@@ -987,10 +962,10 @@ export async function insertMany(db, table, rows) {
         valuesClauses.push(`(${placeholders.join(", ")})`);
     }
     const sqlText = `INSERT INTO ${quoteIdent(info.name)} (${cols}) VALUES ${valuesClauses.join(", ")} RETURNING *`;
-    const raw = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+    const raw = await unsafeLoggingClosedConnection(db, sqlText, params, {
         operation: "insertMany",
         table: info.name,
-    }));
+    });
     return coerceRows(raw, info);
 }
 // biome-ignore lint/suspicious/noExplicitAny: see selectMany default
@@ -1020,10 +995,10 @@ export async function insertOne(db, table, values) {
     })
         .join(", ");
     const sqlText = `INSERT INTO ${quoteIdent(info.name)} (${cols}) VALUES (${placeholders}) RETURNING *`;
-    const rows = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+    const rows = await unsafeLoggingClosedConnection(db, sqlText, params, {
         operation: "insertOne",
         table: info.name,
-    }));
+    });
     const first = rows[0];
     if (!first)
         return undefined;
@@ -1063,10 +1038,10 @@ export async function updateMany(db, table, set, where) {
             values.push(v);
     }
     sqlText += " RETURNING *";
-    const raw = (await unsafeLoggingClosedConnection(db, sqlText, values, {
+    const raw = await unsafeLoggingClosedConnection(db, sqlText, values, {
         operation: "updateMany",
         table: info.name,
-    }));
+    });
     return coerceRows(raw, info);
 }
 export async function deleteMany(db, table, where) {
@@ -1135,7 +1110,7 @@ export async function countWhere(db, table, where = {}) {
         sqlText += ` WHERE ${w.sqlText}`;
         values = w.values;
     }
-    const rows = (await unsafeReadRetrying(db, sqlText, values));
+    const rows = await unsafeReadRetrying(db, sqlText, values);
     return rows[0]?.count ?? 0;
 }
 const AGGREGATE_BUCKET_UNITS = ["hour", "day"];
@@ -1171,7 +1146,7 @@ function aggregateMeasureSql(info, measure) {
         case "avg":
             return `AVG(${requireAggregateColumn(info, measure.field, "measure field")})`;
         default:
-            throw new Error(`aggregateWhere: unknown measure fn "${String(measure.fn)}"`);
+            throw new Error(`aggregateWhere: unknown measure fn "${String(Reflect.get(measure, "fn"))}"`);
     }
 }
 function aggregateDimensionSql(info, dimension, index, params) {
@@ -1233,7 +1208,7 @@ export async function aggregateWhere(db, table, spec, where = {}) {
         params.push(...w.values);
     }
     sqlText += aggregateGroupOrderLimitSql(spec, dimensions.length);
-    const raw = (await unsafeReadRetrying(db, sqlText, params));
+    const raw = await unsafeReadRetrying(db, sqlText, params);
     return raw.map((row) => {
         const value = row["value"];
         return {
@@ -1277,10 +1252,10 @@ export async function upsertOnConflict(db, table, values, options) {
     }
     const conflictList = conflictCols.map((c) => quoteIdent(c)).join(", ");
     const sqlText = `${sqlPrefix} ON CONFLICT (${conflictList}) DO UPDATE SET ${updateParts.join(", ")} RETURNING *`;
-    const rows = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+    const rows = await unsafeLoggingClosedConnection(db, sqlText, params, {
         operation: "upsertOnConflict",
         table: info.name,
-    }));
+    });
     const first = rows[0];
     if (!first)
         return undefined;
@@ -1305,10 +1280,10 @@ export async function insertOnConflictDoNothing(db, table, values, options) {
     const { sqlPrefix, params } = buildInsertSql(info, entries);
     const conflictList = conflictCols.map((c) => quoteIdent(c)).join(", ");
     const sqlText = `${sqlPrefix} ON CONFLICT (${conflictList}) DO NOTHING RETURNING *`;
-    const rows = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+    const rows = await unsafeLoggingClosedConnection(db, sqlText, params, {
         operation: "insertOnConflictDoNothing",
         table: info.name,
-    }));
+    });
     const first = rows[0];
     if (!first)
         return undefined;
@@ -1357,10 +1332,10 @@ export async function incrementCounter(db, table, values, increments, options =
     }
     const conflictList = conflictCols.map((c) => quoteIdent(c)).join(", ");
     const sqlText = `${sqlPrefix} ON CONFLICT (${conflictList}) DO UPDATE SET ${updateParts.join(", ")} RETURNING *`;
-    const rows = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+    const rows = await unsafeLoggingClosedConnection(db, sqlText, params, {
         operation: "incrementCounter",
         table: info.name,
-    }));
+    });
     const first = rows[0];
     if (!first)
         return undefined;
@@ -1389,10 +1364,10 @@ export async function deleteManyBatched(db, table, where, options) {
         const sqlText = `DELETE FROM ${tableQ} WHERE ${idQ} IN (
       SELECT ${idQ} FROM ${tableQ} WHERE ${w.sqlText} LIMIT $${limitIdx}
     ) RETURNING ${idQ}`;
-        const rows = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+        const rows = await unsafeLoggingClosedConnection(db, sqlText, params, {
             operation: "deleteManyBatched",
             table: info.name,
-        }));
+        });
         batches++;
         deleted += rows.length;
         if (rows.length < limit)
@@ -1401,7 +1376,7 @@ export async function deleteManyBatched(db, table, where, options) {
     return { deleted, batches };
 }
 export async function transaction(db, fn) {
-    return (await asRawClient(db).begin(async (tx) => fn(tx)));
+    return asRawClient(db).begin(fn);
 }
 // A tx/savepoint handle has no begin(); fail closed instead of nesting silently or TypeError-ing.
 export async function runInNewTransaction(db, fn) {
@@ -1411,6 +1386,5 @@ export async function runInNewTransaction(db, fn) {
             message: "runInNewTransaction: runner has no begin() — already inside a transaction or savepoint.",
         });
     }
-    // @cast-boundary driver tx handle → DbRunner at the single seam
-    return raw.begin((tx) => fn(tx));
+    return raw.begin(fn);
 }

package/dist/crypto/kek-source.js

@@ -3,6 +3,7 @@
 // A slot's plaintext always wins over its ciphertext sibling, with no request
 // made at all. Any `*_CIPHERTEXT` in the env that names no requested slot is
 // ignored — a foreign ciphertext must never fail boot.
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 const SCALEWAY_KEY_MANAGER_API_VERSION = "v1alpha1";
 const DEFAULT_REGION = "fr-par";
 const DECRYPT_TIMEOUT_MS = 5_000;
@@ -48,15 +49,16 @@ async function decryptCiphertext(ciphertext, keyId, token, region, fetchImpl, lo
         }
         let body;
         try {
-            body = (await response.json());
+            body = await response.json();
         }
         catch {
             throw new Error(`${prefix}Key Manager decrypt for key ${keyId} returned an unparseable response`);
         }
-        if (typeof body.plaintext !== "string") {
+        const plaintext = propertyOf(body, "plaintext");
+        if (typeof plaintext !== "string") {
             throw new Error(`${prefix}Key Manager decrypt for key ${keyId} returned no plaintext field`);
         }
-        return body.plaintext;
+        return plaintext;
     }
     throw new Error(`${prefix}Key Manager decrypt failed for key ${keyId}: retries exhausted`);
 }

package/dist/crypto/pii-field-encryption.d.ts

@@ -14,7 +14,10 @@ export interface EncryptPiiOptions {
     readonly entityName: string;
     readonly ownerFallback?: Record<string, unknown>;
 }
-export declare function encryptPiiFieldValues(row: Record<string, unknown>, entity: EntityDefinition, piiFields: readonly string[], kms: LocalKeyKmsAdapter, kmsCtx: KmsContext, opts: EncryptPiiOptions): Promise<Record<string, unknown>>;
+export type PiiEncryptedRow<TRow extends Record<string, unknown>> = {
+    [K in keyof TRow]: TRow[K] extends string ? string : TRow[K] | string;
+};
+export declare function encryptPiiFieldValues<TRow extends Record<string, unknown>>(row: TRow, entity: EntityDefinition, piiFields: readonly string[], kms: LocalKeyKmsAdapter, kmsCtx: KmsContext, opts: EncryptPiiOptions): Promise<PiiEncryptedRow<TRow>>;
 export declare function serializeJsonbValue(field: string, value: unknown): string;
 export declare function decryptPiiFieldValues(row: Record<string, unknown>, piiFields: readonly string[], kms: LocalKeyKmsAdapter, kmsCtx: KmsContext): Promise<Record<string, unknown>>;
 export declare function configurePiiSubjectKms(adapter: KmsAdapter | undefined): void;

package/dist/crypto/pii-field-encryption.js

@@ -187,8 +187,8 @@ export async function decryptPiiFieldValues(row, piiFields, kms, kmsCtx) {
         try {
             const key = await kms.getKey(subject, kmsCtx);
             const plain = decryptValue(key, blob, subject, name, hasAad, isJson);
-            // @cast-boundary crypto-decrypt — AEAD-authenticated plaintext that this module serialized
-            out[name] = isJson ? JSON.parse(plain) : plain;
+            const decoded = isJson ? JSON.parse(plain) : plain;
+            out[name] = decoded;
         }
         catch (e) {
             // KeyNotFound deliberately propagates: ciphertext without a key row

package/dist/db/apply-entity-event.js

@@ -43,6 +43,7 @@
 //     `row` null (DELETE-Statements geben keine returning-Row her).
 //   - "skipped" → Event ist kein Auto-Verb (Domain-Event auf demselben
 //     Aggregate). Caller no-op.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { collectLookupableFields, computeBlindIndexValues } from "../crypto/blind-index.js";
 import { deleteMany, insertOne, updateMany } from "../db/query.js";
 import { InternalError } from "../errors/index.js";
@@ -54,8 +55,7 @@ export function parseAutoVerb(event) {
     if (!event.type.startsWith(prefix))
         return null;
     const verb = event.type.slice(prefix.length);
-    // @cast-boundary: verb is validated against the AutoVerb list before the cast.
-    return AUTO_VERBS.includes(verb) ? verb : null;
+    return isOneOf(AUTO_VERBS, verb) ? verb : null;
 }
 /** Idempotente Anwendung eines Auto-Events auf die Entity-Tabelle.
  *  Wird sowohl beim Live-Append (innerhalb der Write-TX) als auch beim

package/dist/db/cursor.js

@@ -1,3 +1,4 @@
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 // String-basiert damit UUIDs (Default seit Sprint F) + Integer-Auto-Increment
 // durch denselben Cursor-Pfad laufen. UUIDv7 erfüllt die lex-Monotonie
 // (time-ordered Prefix); UUIDv4 nicht — wer den nutzt, kriegt inkorrekte
@@ -28,7 +29,7 @@ function parseKeysetPayload(decoded) {
     catch {
         return null;
     }
-    if (typeof raw !== "object" || raw === null)
+    if (!isPlainObject(raw))
         return null;
     const { v, i } = raw;
     if (typeof i !== "string" || i === "")

package/dist/db/dialect.d.ts

@@ -85,6 +85,7 @@ export type SqlExpression = {
     readonly params: readonly unknown[];
     readonly [SQL_EXPR_BRAND]: true;
 };
+export declare function isSqlExpression(value: unknown): value is SqlExpression;
 export declare function sql(strings: TemplateStringsArray, ...values: readonly unknown[]): SqlExpression;
 export declare namespace sql {
     var raw: (text: string) => SqlExpression;