@cosmicdrift/kumiko-framework 0.362.0 → 0.363.0

package/dist/pipeline/dispatch-shared.js

@@ -27,6 +27,7 @@ import { executeQuery } from "./dispatch-query.js";
 import { executeWrite } from "./dispatch-write.js";
 import { dispatcherSpanAttributes, isFailedWriteResult, NestedWriteRollback, } from "./dispatcher-utils.js";
 import { createMemberReaderFn } from "./member-reader.js";
+import { createDeferringNotify } from "./notify-scope.js";
 import { createGatedIdentitySwitch, createGatedMemberReader, createGatedProjectionReader, isSystemIdentity, systemIdentitySwitchDenied, } from "./system-identity-switch.js";
 import { buildPersonalDataGate, rootWriteOrigin } from "./write-origin.js";
 // Framework/pipeline stays bundled-features-free, so this can't import the
@@ -47,8 +48,10 @@ export const DEFAULT_MEMBER_READ_TIMEOUT_MS = 10_000;
 // dispatch-Pfade brauchen DbConnection (oder DbTx aus Caller-Scope) für
 // appendEvent/projection-writes; TenantDb-Branch wird hier ausgeschlossen.
 export function resolveDbSource(ctx, tx) {
-    const { appContext: context } = ctx;
-    return tx ?? context.db; // @cast-boundary db-operator
+    return tx ?? resolveAppPoolDb(ctx);
+}
+function resolveAppPoolDb(ctx) {
+    return ctx.appContext.db; // @cast-boundary db-operator
 }
 // ctx.appendEvent — append a domain event onto a specific aggregate stream
 // in the current tx, then fire matching inline projections. Core logic
@@ -248,7 +251,7 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
     // that is meant to outlive the request. Computed before `systemDb` below
     // so its guarded escape hatch (ctx.systemDb.outsideTransaction) can wrap
     // this same TenantDb instead of a second, independently-built one.
-    const outsideTxSource = ctx.outsideTransactionDb ?? resolveDbSource(ctx, undefined);
+    const outsideTxSource = ctx.outsideTransactionDb ?? resolveAppPoolDb(ctx);
     const rawDbOutsideTransaction = outsideTxSource
         ? buildTenantScopedDb(outsideTxSource, undefined)
         : undefined;
@@ -279,9 +282,40 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
         userId: user.id,
         ...(reqCtx && { requestId: reqCtx.requestId }),
     });
-    const notify = context._notifyFactory
-        ? context._notifyFactory(user, user.tenantId, isNotifyJobDispatcher(jobRunner) ? jobRunner : undefined)
+    // Cross-feature bridge: ctx.query/write share the current tx + afterCommitHooks sink.
+    // queryAs/writeAs to anyone but the caller itself needs r.systemScope() or { escapeHatch } (system-identity-switch.ts).
+    const bridgeSink = afterCommitHooks ?? [];
+    // Query bridges and post-commit contexts get a throwaway sink: hooks pushed there never run.
+    const hasLiveCommitSink = afterCommitHooks !== undefined && isPostCommit !== true;
+    const scheduleAfterCommit = (hook) => {
+        bridgeSink.push(hook);
+    };
+    const notifyFactory = context._notifyFactory;
+    const notifyJobDispatcher = isNotifyJobDispatcher(jobRunner) ? jobRunner : undefined;
+    // Inside the write tx the app pool's slots can all be held by waiting write txs, so the
+    // delivery's own DB work (broadcast lookup, attempt log, channel sends) runs on the outside-tx pool.
+    const notifyInTransactionFactory = notifyFactory && tx !== undefined
+        ? (notifyUser, notifyTenantId) => notifyFactory(notifyUser, notifyTenantId, notifyJobDispatcher, outsideTxSource, context._fileProviderResolver)
         : undefined;
+    const notify = buildNotify();
+    function buildNotify() {
+        if (!notifyFactory)
+            return undefined;
+        const notifyAfterCommit = notifyFactory(user, user.tenantId, notifyJobDispatcher, undefined, context._fileProviderResolver);
+        if (!notifyInTransactionFactory)
+            return notifyAfterCommit;
+        const notifyInTransaction = notifyInTransactionFactory(user, user.tenantId);
+        // A rolled-back write must leave no notification behind.
+        if (!hasLiveCommitSink)
+            return notifyInTransaction;
+        return createDeferringNotify({
+            registry,
+            tenantId: user.tenantId,
+            notifyAfterCommit,
+            notifyNow: notifyInTransaction,
+            scheduleAfterCommit,
+        });
+    }
     // Mirror notify: only built when the config feature wired its factory.
     const config = context._configAccessorFactory && db
         ? context._configAccessorFactory({
@@ -361,9 +395,6 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
     const metricsFor = meter
         ? (targetFeatureName) => createSafeMetricsHandle(meter, targetFeatureName)
         : () => createNoopMetricsHandle();
-    // Cross-feature bridge: ctx.query/write share the current tx + afterCommitHooks sink.
-    // queryAs/writeAs to anyone but the caller itself needs r.systemScope() or { escapeHatch } (system-identity-switch.ts).
-    const bridgeSink = afterCommitHooks ?? [];
     // A failed inner write has already appended its event and projections when a later
     // step (e.g. an inTransaction hook) fails, and the outer handler may swallow the
     // failure result. The savepoint makes the failure undo exactly the inner write; the
@@ -374,7 +405,7 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
         const innerAfterCommitHooks = [];
         try {
             const result = await runInSavepoint(tx, async (savepointTx) => {
-                const innerResult = await executeWrite(ctx, targetType, payload, asUser, origin, savepointTx, // @cast-boundary driver savepoint handle is a transaction handle
+                const innerResult = await executeWrite(ctx, targetType, payload, asUser, origin, savepointTx, // @cast-boundary db-runner savepoint handle is a transaction handle
                 innerAfterCommitHooks);
                 if (isFailedWriteResult(innerResult))
                     throw new NestedWriteRollback(innerResult);
@@ -396,9 +427,6 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
     const writeAsUser = async (asUser, targetType, payload) => isPostCommit
         ? unwrapSingle(await runBatch(ctx, [{ type: targetType, payload }], asUser, undefined, origin))
         : executeNestedWriteInSavepoint(asUser, targetType, payload);
-    const scheduleAfterCommit = (hook) => {
-        bridgeSink.push(hook);
-    };
     const identitySwitchAudit = { reason: identitySwitchGrantReason, report: reportEscapeHatch };
     const identitySwitch = createGatedIdentitySwitch(`handler "${type}"`, user, hasIdentitySwitchGrant, {
         // Inherits the caller's origin, so switching to SYSTEM cannot shed an anonymous root.
@@ -733,9 +761,12 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
     const locale = reqCtx?.locale ?? safeUserLocale ?? context.defaultLocale ?? DEFAULT_LOCALE;
     // The payload-bucket digest is dispatcher-internal; handlers must not be
     // able to compute bucket keys.
-    const { _rateLimitPayloadDigest: _omitPayloadDigest, ...contextForHandler } = context;
+    const { _rateLimitPayloadDigest: _omitPayloadDigest, 
+    // Bound to this call's tx: an outer context's factory must not leak into a tx-less one.
+    _notifyInTransactionFactory: _omitOuterNotifyInTransactionFactory, ...contextForHandler } = context;
     const handlerContext = {
         ...contextForHandler,
+        ...(notifyInTransactionFactory && { _notifyInTransactionFactory: notifyInTransactionFactory }),
         registry,
         db: exposedDb,
         dbOutsideTransaction,
@@ -781,7 +812,7 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
         _userId: user.id,
         _tenantId: user.tenantId,
         _handlerType: type,
-        scheduleAfterCommit,
+        ...(hasLiveCommitSink && { scheduleAfterCommit }),
         ...(includeDeleted && { includeDeleted: true }),
         ...bridge,
     }; // @cast-boundary engine-bridge

package/dist/pipeline/event-dispatcher-delivery.js

@@ -57,8 +57,7 @@ export async function acquireConsumerState(tx, name, instanceId, rearmCooldownMs
         const cooldownElapsed = Temporal.Instant.compare(state.updatedAt, cooldownDeadline) <= 0;
         if (cooldownElapsed && state.rearmCount < maxRearmCount) {
             const rearmed = await rearmDeadConsumer(tx, name, instanceId);
-            const rearmedState = rearmed &&
-                coerceRow(rearmed, extractTableInfo(eventConsumerStateTable));
+            const rearmedState = rearmed && coerceRow(rearmed, extractTableInfo(eventConsumerStateTable));
             if (rearmedState)
                 return { state: rearmedState, skip: null };
         }
@@ -149,7 +148,7 @@ export async function markProcessing(tx, name, instanceId) {
 export async function fetchPendingEvents(tx, cursor, batchSize, pendingRanges = []) {
     const rawRows = await selectPendingAndNewEventRows(tx, cursor, pendingRanges, batchSize);
     const info = extractTableInfo(eventsTable);
-    return rawRows.map((row) => coerceRow(row, info)); // @cast-boundary db-row
+    return rawRows.map((row) => coerceRow(row, info));
 }
 // Deliver events to the consumer's handler in events.id order, or — when
 // the consumer wires a batchHandler — through it in one call first. Halt-

package/dist/pipeline/index.d.ts

@@ -30,6 +30,7 @@ export type { LifecycleHooks, SystemHookDef, SystemHooks } from "./lifecycle-pip
 export { createLifecycleHooks } from "./lifecycle-pipeline.js";
 export type { MspRebuildDeps } from "./msp-rebuild.js";
 export { rebuildMultiStreamProjection } from "./msp-rebuild.js";
+export { assertNotifyTargetsOwnTenant, createDeferringNotify } from "./notify-scope.js";
 export type { ProjectionProgress, RebuildResult } from "./projection-rebuild.js";
 export { getAllProjectionProgress, getProjectionState, listProjectionsWithState, rebuildProjection, } from "./projection-rebuild.js";
 export type { ProjectionStatus } from "./projection-state.js";

package/dist/pipeline/index.js

@@ -15,6 +15,7 @@ export { createIdempotencyGuard } from "./idempotency.js";
 export { assertInstructionFieldWriteAllowed, assertIrreversibleOperationAllowed, isIrreversibleEntityVerb, } from "./irreversible-operation-gate.js";
 export { createLifecycleHooks } from "./lifecycle-pipeline.js";
 export { rebuildMultiStreamProjection } from "./msp-rebuild.js";
+export { assertNotifyTargetsOwnTenant, createDeferringNotify } from "./notify-scope.js";
 export { getAllProjectionProgress, getProjectionState, listProjectionsWithState, rebuildProjection, } from "./projection-rebuild.js";
 export { createProjectionStateTable, ProjectionStatuses, projectionStateTable, } from "./projection-state.js";
 export { runProjectionsForEvent } from "./projections-runner.js";

package/dist/pipeline/member-read-only-transaction.js

@@ -34,7 +34,7 @@ async function runInDiscardedReadOnlySavepoint(tx, timeoutMs, bindIdleTimeout, f
         await runInSavepoint(tx, async (sp) => {
             // kumiko-lint-ignore raw-sql transaction characteristic, no query helper
             await asRawClient(sp).unsafe(memberReadSessionSettingsSql(timeoutMs, bindIdleTimeout));
-            // @cast-boundary driver savepoint handle — structurally a DbTx, same shape runInSavepoint's caller relies on
+            // @cast-boundary db-runner savepoint handle — structurally a DbTx, same shape runInSavepoint's caller relies on
             settled.outcome = { value: await fn(sp) };
             // Always discarded: RELEASE SAVEPOINT would leave the outer tx read-only too.
             throw new SavepointDiscard();

package/dist/pipeline/notify-scope.d.ts

@@ -0,0 +1,13 @@
+import type { TenantId } from "../engine/types/identifiers.js";
+import type { NotifyFn, NotifyOptions, Registry } from "../engine/types/index.js";
+import type { AfterCommitHook } from "./dispatcher-utils.js";
+export declare function assertNotifyTargetsOwnTenant(options: NotifyOptions, tenantId: TenantId): void;
+type DeferringNotifyDeps = {
+    readonly registry: Pick<Registry, "getAllNotifications"> | undefined;
+    readonly tenantId: TenantId;
+    readonly notifyAfterCommit: NotifyFn;
+    readonly notifyNow: NotifyFn;
+    readonly scheduleAfterCommit: (hook: AfterCommitHook) => void;
+};
+export declare function createDeferringNotify(deps: DeferringNotifyDeps): NotifyFn;
+export {};

package/dist/pipeline/notify-scope.js

@@ -0,0 +1,32 @@
+import { assertNotificationVariables } from "../engine/template-variables.js";
+import { AccessDeniedError, FrameworkReasons } from "../errors/index.js";
+function isTenantBroadcast(to) {
+    return typeof to === "object" && to !== null && !Array.isArray(to) && "tenant" in to;
+}
+export function assertNotifyTargetsOwnTenant(options, tenantId) {
+    const { to } = options;
+    if (isTenantBroadcast(to) && to.tenant !== tenantId) {
+        throw new AccessDeniedError({
+            message: "ctx.notify can only broadcast to the caller's own tenant",
+            details: { reason: FrameworkReasons.notifyForeignTenantBroadcast },
+        });
+    }
+}
+// Without `immediate`, a notify inside a write transaction waits for the commit so a
+// rolled-back write leaves no notification behind.
+export function createDeferringNotify(deps) {
+    const { registry, tenantId, notifyAfterCommit, notifyNow, scheduleAfterCommit } = deps;
+    async function notifyDeferringUntilCommit(notificationType, options) {
+        assertNotifyTargetsOwnTenant(options, tenantId);
+        // Fail the write now: after the commit the problem would only surface in the render job.
+        if (registry)
+            assertNotificationVariables(registry, notificationType, options.data);
+        if (options.immediate === true)
+            return notifyNow(notificationType, options);
+        scheduleAfterCommit(async () => {
+            await notifyAfterCommit(notificationType, options);
+        });
+        return { kind: "deferred" };
+    }
+    return notifyDeferringUntilCommit;
+}

package/dist/pipeline/system-hooks.js

@@ -1,3 +1,4 @@
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { readNonEmptyStringArray, } from "../api/sse-broker.js";
 import { collectSearchableSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
 import { createTenantDb, entityTableFromRegistry, rehydrateCompoundTypes } from "../db/index.js";
@@ -520,7 +521,7 @@ const TENANT_MEMBERSHIP_UPDATED_EVENT_TYPE = "tenant-membership.updated";
 const TENANT_MEMBERSHIP_DELETED_EVENT_TYPE = "tenant-membership.deleted";
 function readUserIdFromPreviousSnapshot(payload) {
     const previous = payload["previous"];
-    if (typeof previous !== "object" || previous === null)
+    if (!isPlainObject(previous))
         return undefined;
     const userId = previous["userId"];
     return typeof userId === "string" && userId.length > 0 ? userId : undefined;

package/dist/pipeline/system-identity-switch.js

@@ -124,14 +124,14 @@ export function createGatedProjectionReader(callerLabel, hasGrant, ungated, audi
 function readIdentitySwitchFn(context, key) {
     if (!(key in context))
         return undefined;
-    const value = context[key];
+    const value = Reflect.get(context, key);
     return typeof value === "function" ? value : undefined; // @cast-boundary engine-bridge — checked via typeof above
 }
 // context's own keys only — never touch a property of the resolved value, which may be a Proxy that throws on any get.
 function readDbLikeValue(context, key) {
     if (!(key in context))
         return undefined;
-    const value = context[key];
+    const value = Reflect.get(context, key);
     return typeof value === "object" && value !== null ? value : undefined;
 }
 function unavailableIdentitySwitchFn(callerLabel, kind) {

package/dist/search/meilisearch-adapter.js

@@ -1,3 +1,4 @@
+import { errorCodeOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { ErrorStatusCode, Meilisearch } from "meilisearch";
 // meilisearch's waitTask() RESOLVES (never rejects) once the server task
 // reaches a terminal state, even "failed" — a rejected doc (e.g. an id over
@@ -23,10 +24,8 @@ const INDEX_LIST_PAGE_SIZE = 100;
 // What an unconfigured Meilisearch index reports as searchableAttributes.
 const MEILI_ALL_ATTRIBUTES = "*";
 function isIndexNotFound(err) {
-    const cause = typeof err === "object" && err !== null ? err.cause : null;
-    return (typeof cause === "object" &&
-        cause !== null &&
-        cause.code === ErrorStatusCode.INDEX_NOT_FOUND);
+    const cause = typeof err === "object" && err !== null && "cause" in err ? err.cause : null;
+    return errorCodeOf(cause) === ErrorStatusCode.INDEX_NOT_FOUND;
 }
 // Exported for unit tests (index-name / primary-key shape) without a live Meili.
 export function meilisearchTenantIndex(prefix, tenantId) {

package/dist/secrets/stored-envelope.js

@@ -2,6 +2,7 @@
 // jsonb columns (secrets feature) or JSON-stringified TEXT columns
 // (EnvelopeCipher for config values / entity fields). One wire shape for
 // every envelope-encrypted store in the framework.
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 export function encodeStoredEnvelope(envelope) {
     return {
         ciphertext: envelope.ciphertext.toString("base64"),
@@ -21,12 +22,11 @@ export function decodeStoredEnvelope(stored) {
     };
 }
 export function isStoredEnvelope(value) {
-    if (!value || typeof value !== "object")
+    if (!isPlainObject(value))
         return false;
-    const v = value; // @cast-boundary parse-boundary after typeof check
-    return (typeof v["ciphertext"] === "string" &&
-        typeof v["iv"] === "string" &&
-        typeof v["authTag"] === "string" &&
-        typeof v["encryptedDek"] === "string" &&
-        typeof v["kekVersion"] === "number");
+    return (typeof value["ciphertext"] === "string" &&
+        typeof value["iv"] === "string" &&
+        typeof value["authTag"] === "string" &&
+        typeof value["encryptedDek"] === "string" &&
+        typeof value["kekVersion"] === "number");
 }

package/dist/stack/push-entity-projection-tables.js

@@ -1,5 +1,5 @@
-import { KUMIKO_NAME_SYMBOL } from "@cosmicdrift/kumiko-types/schema-table-types";
 import { columnNamesOf, tableExists } from "../db/schema-inspection.js";
+import { schemaTableName } from "../db/table-introspection.js";
 import { addMissingColumns, addMissingIndexes, tableToMeta, unsafePushTables, } from "./table-helpers.js";
 // biome-ignore lint/suspicious/noConsole: stack-internal status logging
 const logInfo = (msg) => console.log(msg);
@@ -29,8 +29,7 @@ export async function pushEntityProjectionTables(stack, registry) {
         if (seen.has(proj.table))
             continue;
         seen.add(proj.table);
-        const tableRec = proj.table;
-        const physical = tableRec[KUMIKO_NAME_SYMBOL];
+        const physical = schemaTableName(proj.table) ?? tableToMeta(proj.table).tableName;
         if (!(await tableExists(stack.db, `public.${physical}`))) {
             missing[projName] = proj.table;
             continue;

package/dist/stack/table-helpers.js

@@ -1,20 +1,19 @@
-import { KUMIKO_META_SYMBOL, KUMIKO_NAME_SYMBOL, } from "@cosmicdrift/kumiko-types/schema-table-types";
 import { pgTypeToSqlType } from "../db/dialect.js";
 import { alterTableAddColumn, createIndexIfNotExists, executeDdlStatement, } from "../db/queries/ddl.js";
 import { truncateTablesRestartIdentity } from "../db/queries/test-stack.js";
 import { renderTableDdl } from "../db/render-ddl.js";
 import { tableExists } from "../db/schema-inspection.js";
 import { buildEntityTable, toTableName } from "../db/table-builder.js";
+import { asEntityTableMeta, schemaTableName } from "../db/table-introspection.js";
 function tableNameOf(table) {
     if (typeof table !== "object" || table === null) {
         throw new Error("table-helpers: table is not a SchemaTable object");
     }
-    const rec = table;
-    if (typeof rec[KUMIKO_NAME_SYMBOL] === "string")
-        return rec[KUMIKO_NAME_SYMBOL];
-    if (typeof rec.tableName === "string") {
-        return rec.tableName;
-    }
+    const symbolName = schemaTableName(table);
+    if (symbolName !== undefined)
+        return symbolName;
+    if ("tableName" in table && typeof table.tableName === "string")
+        return table.tableName;
     throw new Error("table-helpers: table has no name");
 }
 /**
@@ -36,26 +35,11 @@ export async function unsafeEnsureEntityTable(db, entity, entityName) {
 // Tables produced by the native dialect already carry EntityTableMeta-shape
 // (source/columns/indexes). renderTableDdl converts that to CREATE TABLE +
 // CREATE INDEX statements executed via db/queries/test-stack.
-function isMetaShape(v) {
-    return (typeof v === "object" &&
-        v !== null &&
-        typeof v.tableName === "string" &&
-        Array.isArray(v.columns) &&
-        Array.isArray(v.indexes) &&
-        (v.source === "managed" || v.source === "unmanaged"));
-}
 export function tableToMeta(table) {
-    // table() spreads column handles as enumerable props, so a field named
-    // `columns`/`tableName`/`source`/… shadows the matching meta key — read the
-    // canonical meta from the unshadowable symbol when present.
-    if (table !== null && typeof table === "object") {
-        const fromSymbol = table[KUMIKO_META_SYMBOL];
-        if (isMetaShape(fromSymbol))
-            return fromSymbol;
-    }
-    if (isMetaShape(table))
-        return table;
-    throw new Error("unsafePushTables: argument is not a SchemaTable / EntityTableMeta");
+    const meta = asEntityTableMeta(table);
+    if (!meta)
+        throw new Error("unsafePushTables: argument is not a SchemaTable / EntityTableMeta");
+    return meta;
 }
 /** Applies ALTER TABLE ADD COLUMN for exactly the given columns. */
 export async function addMissingColumns(db, tableName, columns) {

package/dist/stack/test-stack.js

@@ -1,3 +1,4 @@
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { buildServer } from "../api/server.js";
 import { createSseBroker } from "../api/sse-broker.js";
 import { validateBoot, validateNavBootSubset } from "../engine/boot-validator/index.js";
@@ -269,11 +270,7 @@ export async function setupTestStack(options) {
         // always-real `testRedis.redis`, independent of whatever extraContext
         // did to `appContext.redis` — an explicit `context.rateLimit` from
         // extraContext still wins (same precedence buildServer documents).
-        // @cast-boundary extraContext is declared Record<string, unknown> (late,
-        // dynamic extension point) — appContext's inferred type doesn't carry a
-        // `rateLimit` key, so reading it back needs the same relaxed boundary
-        // extraContext itself is typed with.
-        const explicitRateLimit = appContext.rateLimit;
+        const explicitRateLimit = propertyOf(appContext, "rateLimit");
         const needsOwnRateLimitResolver = explicitRateLimit === undefined &&
             (appContext.redis === undefined || options.rateLimitNowMs !== undefined);
         const rateLimitFallback = needsOwnRateLimitResolver

package/dist/testing/multipart-helper.d.ts

@@ -1,9 +1,3 @@
-/**
- * Serializes a FormData instance to multipart/form-data bytes.
- *
- * Returns the encoded body and the Content-Type header value (including the
- * generated boundary). Pass both directly to app.request or fetch.
- */
 export declare function buildMultipartBody(fd: FormData): Promise<{
     body: BodyInit;
     contentType: string;

package/dist/testing/multipart-helper.js

@@ -19,6 +19,7 @@
  * Returns the encoded body and the Content-Type header value (including the
  * generated boundary). Pass both directly to app.request or fetch.
  */
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 export async function buildMultipartBody(fd) {
     const boundary = `KumikoBnd${Date.now()}${Math.random().toString(36).slice(2, 8)}`;
     const enc = new TextEncoder();
@@ -64,12 +65,11 @@ export function patchFileInstanceofForBunTest() {
         return;
     Object.defineProperty(File, Symbol.hasInstance, {
         value(instance) {
-            if (typeof instance !== "object" || instance === null)
+            if (!isPlainObject(instance))
                 return false;
-            const f = instance;
-            return (typeof f["name"] === "string" &&
-                typeof f["size"] === "number" &&
-                typeof f["arrayBuffer"] === "function");
+            return (typeof instance["name"] === "string" &&
+                typeof instance["size"] === "number" &&
+                typeof instance["arrayBuffer"] === "function");
         },
         configurable: true,
     });

package/dist/testing/without-ambient-temporal.js

@@ -3,15 +3,15 @@
  * Used by ambient-independence regression tests (kumiko-framework#1525/#1550).
  */
 export async function withoutAmbientTemporal(fn) {
-    const savedGlobal = globalThis.Temporal;
-    delete globalThis.Temporal;
+    const savedGlobal = Reflect.get(globalThis, "Temporal");
+    Reflect.deleteProperty(globalThis, "Temporal");
     try {
         return await fn();
     }
     finally {
         if (savedGlobal === undefined)
-            delete globalThis.Temporal;
+            Reflect.deleteProperty(globalThis, "Temporal");
         else
-            globalThis.Temporal = savedGlobal;
+            Reflect.set(globalThis, "Temporal", savedGlobal);
     }
 }

package/dist/utils/is-plain-object.d.ts

@@ -1,2 +1 @@
-/** Non-null object that is not an array — shared guard for deep-merge and AST extractors. */
-export declare function isPlainObject(value: unknown): value is Record<string, unknown>;
+export { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";

package/dist/utils/is-plain-object.js

@@ -1,4 +1 @@
-/** Non-null object that is not an array — shared guard for deep-merge and AST extractors. */
-export function isPlainObject(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
+export { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.362.0",
+  "version": "0.363.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -210,8 +210,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.362.0",
-    "@cosmicdrift/kumiko-types": "0.362.0",
+    "@cosmicdrift/kumiko-http": "0.363.0",
+    "@cosmicdrift/kumiko-types": "0.363.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -227,7 +227,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.362.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.363.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,48 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Fewer unchecked casts in bundled features, dev-server, server-runtime, testing and cli",
+    "detail": "Casts are replaced by shared type guards, typed query rows and direct Bun typings. Behavior stays the same, except that a tier-resolver registration without a build() factory now fails with a clear error at boot, the kumiko CLI prints the thrown value of non-Error failures instead of \"undefined\"."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Remove unknown cast-boundary reasons and share propertyOf",
+    "detail": "Framework internals read untyped properties through the shared propertyOf from kumiko-types instead of private copies and casts. The as-casts guard knows four more boundary reasons (phantom-brand, third-party-type-gap, dom-event-target, feature-exports) and normalizes whitespace in cast targets so re-indenting a multi-line cast no longer counts as a regression. A stored inbound-mail cursor that is not a JSON object is now treated like a missing cursor."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "ctx.notify in write handlers delivers after commit",
+    "detail": "Inside a write handler's transaction ctx.notify only records the notification and delivers it once the write has committed, so a rolled-back write sends nothing and leaves no attempt event. Delivery no longer takes a connection from the app pool while the write holds one, which deadlocked at pool max N with N parallel writes. With immediate: true the call stays synchronous and runs its DB work on the outside-transaction pool.",
+    "migration": "NotifyResult is now a union, NotifyDispatched ({ kind: \"dispatched\", deliveries }) or NotifyDeferred ({ kind: \"deferred\" }). In a write handler without immediate: true ctx.notify returns deferred and delivers after commit (a rollback means no notification). Code that reads the result (for example a \"send test message\" handler showing sent/failed) sets immediate: true, which delivers synchronously on the outside-transaction pool and returns dispatched; narrow on kind before reading deliveries. Errors such as a missing idempotency Redis, a tenant broadcast without the tenant feature or an unknown notification type no longer throw in a deferred write handler, they land in the afterCommit log. Notifications from jobs, from seeding and from handlers without a transaction stay synchronous. The boot default wires tenantUserIdsQuery for to: { tenant } when the tenant feature is mounted, so an app-side tenantUserIdsQuery wiring can go. Custom NotifyFactory implementations receive an optional 4th parameter deliveryDb, and DeliveryService.notify an optional 6th."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Shared type guards and fewer unchecked casts in framework internals",
+    "detail": "\"@cosmicdrift/kumiko-types/type-guards\" exports isPlainObject, isOneOf and errorCodeOf. The framework replaces many unchecked as-casts with narrowing, generic query rows and table-introspection helpers. encryptPiiFieldValues is generic over the row and returns PiiEncryptedRow<TRow>, so callers read encrypted fields without casts. Behavior stays the same."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "r.notification declares variables, template and meta; applyBootSeeds seeds them",
+    "detail": "r.notification accepts variables (typed with templateVariable.text, link, money, date and list), template (per locale body, document html) and meta (per locale subject and more). Boot validation requires a kebab-case name, a meta.<locale>.subject for every template locale and valid placeholder names. templateVariablesToZod turns the variables into a Zod schema. applyBootSeeds calls seedNotificationTemplates, which writes the text as system templates of kind mail and fails loudly when notifications declare a template but the template-resolver feature is not mounted."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "r.notification works without trigger and ships localized templates",
+    "detail": "trigger, recipient and data are optional and must be declared together, a notification without trigger is sent explicitly through ctx.notify. localizedTemplate groups body and meta per locale and is mutually exclusive with template and meta. The variable names link, money and date are reserved for template helpers. ctx.notify validates the data against the declared variables and fails the write on a missing required variable. New exports are listMailLocales, hasMailTranslationKey, assertNotificationVariables and NotificationLocalizedTemplate."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "ctx.notify rejects a broadcast to another tenant",
+    "detail": "A notify with to: { tenant } now throws an AccessDeniedError (reason notify_foreign_tenant_broadcast) unless the tenant is the caller's own, before any delivery work. In a write handler it fails synchronously instead of landing in the afterCommit log. Notifications fired from seed hooks during self-signup no longer use the app pool inside the signup transaction, which deadlocked at pool max N with N parallel signups; they deliver after commit. ctx.scheduleAfterCommit is now absent in query bridges and post-commit contexts, where hooks pushed to it never ran; callers that check for it (cache-sync announce, set-tenant-tier onAssigned, form-draft discard, seed hooks) now run inline there instead of being dropped.",
+    "migration": "to: { tenant } must be the tenant of the caller (user.tenantId of the handler or job context), otherwise notify throws; in a write handler the throw is synchronous. Seed-hook notifications in the signup transaction run after commit and return { kind: \"deferred\" } (immediate: true runs synchronously on the outside-transaction pool, which cannot see rows the signup transaction has not committed yet, so a tenant broadcast there finds no new member). No known consumer broadcasts to a foreign tenant."
+  },
   {
     "version": "0.362.0",
     "type": "fix",