@cosmicdrift/kumiko-framework 0.362.0 → 0.364.0

package/dist/api/sse-route.js

@@ -3,7 +3,8 @@ import { streamSSE } from "hono/streaming";
 import { tenantChannel } from "../engine/constants.js";
 import { isAnonymousSessionUser } from "../engine/system-user.js";
 import { Routes } from "./api-constants.js";
-import { getAuthTokenExpiry, getUser } from "./auth-middleware.js";
+import { getAuthTokenExpiry, getStaleCredentialCode, getUser } from "./auth-middleware.js";
+import { clearSessionCookies, getSessionCookies } from "./session-cookies.js";
 import { accessInvalidationCredentialFor } from "./sse-broker.js";
 import { scheduleTokenExpiry } from "./token-expiry-timer.js";
 /**
@@ -35,6 +36,10 @@ export const SSE_HEARTBEAT_INTERVAL_MS = 15_000;
 function isEntityEventData(data) {
     return typeof data["aggregateType"] === "string";
 }
+// First frame on a stream that was downgraded to anonymous because the browser's auth
+// cookie is stale. A downgraded stream answers 200, so EventSource never reports the
+// session end by itself.
+const SESSION_ENDED_SSE_EVENT = "session-ended";
 // Whitelist, never a spread: the wire frame is a signal without field
 // values even if a broker or pusher put a payload into event.data.
 function toEntitySignalWire(event, data) {
@@ -92,7 +97,17 @@ export function createSseRoute(broker, options) {
         // JWT expiry raises no access-invalidation event, so the stream must end
         // itself when the token it was opened with expires.
         const tokenExpiresAtSec = getAuthTokenExpiry(c);
+        const staleCredentialCode = getStaleCredentialCode(c);
+        // JS cannot remove the HttpOnly auth cookie, so the response does.
+        if (staleCredentialCode !== undefined)
+            clearSessionCookies(c, getSessionCookies(c));
         return streamSSE(c, async (stream) => {
+            if (staleCredentialCode !== undefined) {
+                await stream.writeSSE({
+                    event: SESSION_ENDED_SSE_EVENT,
+                    data: JSON.stringify({ code: staleCredentialCode }),
+                });
+            }
             let resolveEnded;
             const ended = new Promise((resolve) => {
                 resolveEnded = resolve;

package/dist/bun-db/index.d.ts

@@ -1,4 +1,4 @@
 export type { BunDbConnection, BunDbConnectionOptions, BunDbRunner, BunDbTx, PgListenClient, } from "./connection.js";
 export { bunDbConnectionOptionsFromEnv, createBunDbConnection } from "./connection.js";
 export type { InnerJoinRow, InnerJoinSpec, InsertOnConflictDoNothingOptions, JoinColumnPair, JsonTextMatch, SelectOptions, TableInfo, WhereObject, WhereOperator, WhereValue, } from "./query.js";
-export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, type DeleteManyBatchedOptions, type DeleteManyBatchedResult, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, type IncrementCounterOptions, incrementCounter, insertMany, insertOnConflictDoNothing, insertOne, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, selectInnerJoin, selectMany, transaction, type UpsertOnConflictOptions, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";
+export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, type DeleteManyBatchedOptions, type DeleteManyBatchedResult, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, type IncrementCounterOptions, incrementCounter, insertMany, insertOnConflictDoNothing, insertOne, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, runnerCanBeginTransaction, selectInnerJoin, selectMany, transaction, type UpsertOnConflictOptions, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";

package/dist/bun-db/index.js

@@ -1,4 +1,4 @@
 // bun-db: Bun.sql-basierte DB-API ohne drizzle.
 // Production-Pfad nach drizzle-removal.
 export { bunDbConnectionOptionsFromEnv, createBunDbConnection } from "./connection.js";
-export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, incrementCounter, insertMany, insertOnConflictDoNothing, insertOne, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, selectInnerJoin, selectMany, transaction, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";
+export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, incrementCounter, insertMany, insertOnConflictDoNothing, insertOne, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, runnerCanBeginTransaction, selectInnerJoin, selectMany, transaction, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";

package/dist/bun-db/query.d.ts

@@ -2,15 +2,22 @@ import type { AggregateRow, AggregateSpec } from "@cosmicdrift/kumiko-types/aggr
 import type { SelectOptions, WhereObject } from "@cosmicdrift/kumiko-types/where-clause-types";
 import type { EntityTableMeta } from "../db/entity-table-meta.js";
 import { type NotExecutorOnly } from "../db/table-builder.js";
+import { asEntityTableMeta, requireEntityTableMeta } from "../db/table-introspection.js";
 import type { DbRunner } from "@cosmicdrift/kumiko-types/db-connection";
 import type { BunDbRunner } from "./connection.js";
-export declare function asEntityTableMeta(table: unknown): EntityTableMeta | undefined;
-export declare function requireEntityTableMeta(table: unknown, tableName: string): EntityTableMeta;
-type RawClient = {
+export { asEntityTableMeta, requireEntityTableMeta };
+export type RawClient = {
     unsafe: <TRow = unknown>(sql: string, params?: readonly unknown[]) => Promise<readonly TRow[]>;
-    begin: <T>(fn: (tx: unknown) => Promise<T>) => Promise<T>;
+    begin?: <T>(fn: (tx: BunDbRunner) => Promise<T>) => Promise<T>;
+    savepoint?: <T>(fn: (sp: unknown) => Promise<T>) => Promise<T>;
+    release?: unknown;
 };
+export type RawClientWithBegin = RawClient & {
+    begin: NonNullable<RawClient["begin"]>;
+};
+export declare function hasBegin(client: RawClient): client is RawClientWithBegin;
 export declare function asRawClient(db: unknown): RawClient;
+export declare function runnerCanBeginTransaction(db: unknown): boolean;
 export declare function runInSavepoint<T>(tx: unknown, fn: (sp: unknown) => Promise<T>): Promise<T>;
 export declare function runInSavepointIfSupported<T>(db: unknown, fn: (sp: DbRunner) => Promise<T>): Promise<T>;
 export type AnyDb = BunDbRunner | unknown;
@@ -26,7 +33,7 @@ export type TableInfo = {
     readonly hasColumn: (fieldOrColumn: string) => boolean;
 };
 export declare function extractTableInfo(table: TableLike): TableInfo;
-export declare function coerceRow<T extends Record<string, unknown>>(row: T, info: TableInfo): T;
+export declare function coerceRow<TOut = Record<string, unknown>>(row: Record<string, unknown>, info: TableInfo): TOut;
 export declare function isClosedConnectionError(err: unknown): boolean;
 export declare function describeClosedConnectionFailure(raw: unknown, err: unknown, attempts: number): Record<string, unknown> | undefined;
 export declare function unsafeReadRetrying<TRow>(db: AnyDb, sqlText: string, params: readonly unknown[]): Promise<readonly TRow[]>;

package/dist/bun-db/query.js

@@ -18,16 +18,17 @@
 //   - drizzle pgTable (legacy, has Symbol-based tableName) — extracted via
 //     drizzle's getTableName + getTableColumns (drizzle kept only as a type
 //     reference, never as a runtime API call)
-import { KUMIKO_META_SYMBOL } from "@cosmicdrift/kumiko-types/schema-table-types";
 // Static import (not getTemporal()): coercion works without an installed
 // global and returns the same Temporal classes as the rest of the repo (#1480).
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isOneOf, propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { requestContext } from "../api/request-context.js";
 import { computeBlindIndex, configuredBlindIndexKey } from "../crypto/blind-index.js";
 import { isPiiCiphertext } from "../crypto/pii-ciphertext-format.js";
 import { SQL_EXPR_BRAND } from "../db/dialect.js";
 import { extractPgError } from "../db/pg-error.js";
 import { toSnakeCase } from "../db/table-builder.js";
+import { asEntityTableMeta, requireEntityTableMeta } from "../db/table-introspection.js";
 import { camelCase as envCamelCase } from "../env/index.js";
 import { InternalError } from "../errors/index.js";
 import { createFallbackLogger } from "../logging/index.js";
@@ -48,43 +49,20 @@ function snakeToCamel(key) {
 // enumerable props, so an entity field named `source`/`columns`/`tableName`/…
 // would overwrite the matching meta key — reading the meta from the symbol is
 // the only collision-safe path.
-function isEntityTableMeta(v) {
-    return (v !== null &&
-        typeof v === "object" &&
-        typeof v.tableName === "string" &&
-        Array.isArray(v.columns) &&
-        Array.isArray(v.indexes) &&
-        (v.source === "managed" || v.source === "unmanaged"));
-}
-// Resolve any framework table input to its canonical EntityTableMeta:
-//  - table()/buildEntityTable outputs carry it under KUMIKO_META_SYMBOL, immune
-//    to a column-handle shadowing a meta key.
-//  - deriveEntityTableMeta / defineUnmanagedTable return a plain meta with no
-//    handle-spread, so its structural shape is itself unshadowable.
-export function asEntityTableMeta(table) {
-    if (table === null || typeof table !== "object")
-        return undefined;
-    const fromSymbol = table[KUMIKO_META_SYMBOL];
-    if (isEntityTableMeta(fromSymbol))
-        return fromSymbol;
-    return isEntityTableMeta(table) ? table : undefined;
+export { asEntityTableMeta, requireEntityTableMeta };
+export function hasBegin(client) {
+    return typeof client.begin === "function";
 }
-export function requireEntityTableMeta(table, tableName) {
-    const meta = asEntityTableMeta(table);
-    if (!meta) {
-        throw new Error(`${tableName}: table carries no EntityTableMeta — built via table()?`);
-    }
-    return meta;
+function isRawClient(value) {
+    return typeof propertyOf(value, "unsafe") === "function";
 }
 export function asRawClient(db) {
-    const dbAny = db;
     // Direct: Bun.SQL / postgres-js Sql / postgres-js TransactionSql. All three
     // expose `.unsafe`; only Sql/Bun.SQL have `.begin` — TransactionSql uses
     // `.savepoint` for nested-tx. We only require `.unsafe` here; callers that
     // need `.begin` (e.g. `transaction()`) verify it themselves.
-    if (typeof dbAny["unsafe"] === "function") {
-        return dbAny;
-    }
+    if (isRawClient(db))
+        return db;
     // TenantDb (ctx.db) has no unfiltered escape via asRawClient anymore — fail
     // closed instead of silently unwrapping a tenant-scoped handle.
     if (isTenantDbShape(db)) {
@@ -93,18 +71,18 @@ export function asRawClient(db) {
             "{ reason } on the handler/hook (r.systemScope() features: ctx.systemDb.unsafeRaw(reason)).");
     }
     // Drizzle DbConnection (legacy compat): $client = postgres-js Sql.
-    const $client = dbAny["$client"];
-    if ($client && typeof $client["unsafe"] === "function") {
+    const $client = propertyOf(db, "$client");
+    if (isRawClient($client))
         return $client;
-    }
     // Drizzle pg-transaction (legacy compat): session.client = postgres-js Sql.
-    const session = dbAny["session"];
-    const sessionClient = session?.["client"];
-    if (sessionClient && typeof sessionClient["unsafe"] === "function") {
+    const sessionClient = propertyOf(propertyOf(db, "session"), "client");
+    if (isRawClient(sessionClient))
         return sessionClient;
-    }
     throw new Error("bun-db: db argument has no .unsafe() — pass Bun.SQL, postgres-js Sql, or a transaction handle.");
 }
+export function runnerCanBeginTransaction(db) {
+    return hasBegin(asRawClient(db));
+}
 // postgres.js / Bun.SQL reject the WHOLE begin() when any statement inside
 // it errored — even if the JS error was caught (the driver tracks per-block
 // query failures). Error confinement therefore must go through the driver's
@@ -131,7 +109,7 @@ export async function runInSavepoint(tx, fn) {
 // to paper over by re-running `fn` without the savepoint's isolation.
 export async function runInSavepointIfSupported(db, fn) {
     const raw = asRawClient(db);
-    // @cast-boundary driver savepoint handle → DbRunner at the single seam
+    // @cast-boundary db-runner savepoint handle → DbRunner at the single seam
     const asRunner = (sp) => sp;
     if (typeof raw.savepoint !== "function")
         return fn(asRunner(db));
@@ -156,15 +134,14 @@ export async function runInSavepointIfSupported(db, fn) {
 function isTenantDbShape(db) {
     if (typeof db !== "object" || db === null)
         return false;
-    const d = db;
-    if (typeof d["unsafe"] === "function")
+    if (typeof propertyOf(db, "unsafe") === "function")
         return false;
-    return (typeof d["selectMany"] === "function" &&
-        typeof d["fetchOne"] === "function" &&
-        typeof d["insertOne"] === "function" &&
-        typeof d["updateMany"] === "function" &&
-        typeof d["deleteMany"] === "function" &&
-        "tenantId" in d);
+    return (typeof propertyOf(db, "selectMany") === "function" &&
+        typeof propertyOf(db, "fetchOne") === "function" &&
+        typeof propertyOf(db, "insertOne") === "function" &&
+        typeof propertyOf(db, "updateMany") === "function" &&
+        typeof propertyOf(db, "deleteMany") === "function" &&
+        "tenantId" in db);
 }
 function tenantDbDelegate(db) {
     return isTenantDbShape(db) ? db : undefined;
@@ -182,6 +159,9 @@ function assertNotTenantScoped(db, fnName) {
 const WHERE_OPERATOR_KEYS = ["gt", "gte", "lt", "lte", "ne", "in", "like", "jsonText"];
 const _whereOperatorKeysExhaustive = true;
 void _whereOperatorKeysExhaustive;
+function isJsonTextMatchList(value) {
+    return Array.isArray(value);
+}
 function isWhereOperator(v) {
     if (v === null || typeof v !== "object" || Array.isArray(v))
         return false;
@@ -190,7 +170,7 @@ function isWhereOperator(v) {
     const keys = Object.keys(v);
     if (keys.length === 0)
         return false;
-    return keys.every((k) => WHERE_OPERATOR_KEYS.includes(k));
+    return keys.every((k) => isOneOf(WHERE_OPERATOR_KEYS, k));
 }
 export function extractTableInfo(table) {
     const meta = asEntityTableMeta(table);
@@ -236,10 +216,13 @@ function quoteIdent(name) {
 //
 // Symmetric on write: Temporal.Instant doesn't bind directly into postgres-js
 // params — convert to ISO string when the column pgType is timestamptz.
+function toStringTagOf(v) {
+    return typeof v === "object" && v !== null && Symbol.toStringTag in v
+        ? v[Symbol.toStringTag]
+        : undefined;
+}
 function isTemporalInstant(v) {
-    return (typeof v === "object" &&
-        v !== null &&
-        v[Symbol.toStringTag] === "Temporal.Instant");
+    return toStringTagOf(v) === "Temporal.Instant";
 }
 // Postgres bigint → JS: safe integers become `number` (matches createBigIntField /
 // drizzle mode:"number"); values outside ±2^53 stay `bigint` (money cents, raw
@@ -289,15 +272,14 @@ function instantFromDriver(value) {
     return null;
 }
 function isTemporalPlainDate(v) {
-    return (typeof v === "object" &&
-        v !== null &&
-        v[Symbol.toStringTag] === "Temporal.PlainDate");
+    return toStringTagOf(v) === "Temporal.PlainDate";
 }
 function isTemporalPlainDateTimeLike(v) {
-    return (typeof v === "object" &&
+    const tag = toStringTagOf(v);
+    return ((tag === "Temporal.PlainDateTime" || tag === "Temporal.ZonedDateTime") &&
+        typeof v === "object" &&
         v !== null &&
-        (v[Symbol.toStringTag] === "Temporal.PlainDateTime" ||
-            v[Symbol.toStringTag] === "Temporal.ZonedDateTime") &&
+        "toPlainDate" in v &&
         typeof v.toPlainDate === "function");
 }
 // Verified empirically against Bun.SQL (kumiko-framework#1924): a `date`
@@ -353,6 +335,10 @@ function plainDateFromDriver(value, column) {
 //
 // Unknown columns (computed/aliased) pass through unchanged.
 export function coerceRow(row, info) {
+    // @cast-boundary db-row — the driver row (raw column names/types) becomes the caller's entity row shape here, and only here
+    return coerceDriverRow(row, info);
+}
+function coerceDriverRow(row, info) {
     const out = {};
     let changed = false;
     for (const key of Object.keys(row)) {
@@ -422,7 +408,7 @@ export function coerceRow(row, info) {
             changed = true;
         out[fieldName] = coerced;
     }
-    return (changed ? out : row);
+    return changed ? out : row;
 }
 function coerceRows(rows, info) {
     return rows.map((r) => coerceRow(r, info));
@@ -568,9 +554,15 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                 if (pgType !== "jsonb") {
                     throw new Error(`where: jsonText requires a jsonb column, "${col}" is ${pgType}`);
                 }
-                const matches = Array.isArray(value.jsonText) ? value.jsonText : [value.jsonText];
+                const matches = isJsonTextMatchList(value.jsonText) ? value.jsonText : [value.jsonText];
+                if (matches.length === 0) {
+                    conditions.push("FALSE");
+                    continue;
+                }
                 for (const match of matches) {
-                    if (!Array.isArray(match.keys) ||
+                    if (match === null ||
+                        typeof match !== "object" ||
+                        !Array.isArray(match.keys) ||
                         match.keys.length === 0 ||
                         !match.keys.every((k) => typeof k === "string") ||
                         typeof match.eq !== "string") {
@@ -599,7 +591,7 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                 like: "LIKE",
             };
             for (const [opKey, opSym] of Object.entries(opMap)) {
-                const opVal = value[opKey];
+                const opVal = Reflect.get(value, opKey);
                 if (opVal === undefined)
                     continue;
                 // Mirrors applyMultiSelectFilter: ordering/pattern ops have no meaning on a jsonb
@@ -638,7 +630,7 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                     values.push(p.bound);
                 }
             }
-            const inVal = value["in"];
+            const inVal = value.in;
             if (Array.isArray(inVal)) {
                 if (pgType === "jsonb") {
                     conditions.push(jsonbContainsAny(col, inVal));
@@ -711,11 +703,9 @@ export function isClosedConnectionError(err) {
 function isPooledClient(raw) {
     if (raw === null || (typeof raw !== "object" && typeof raw !== "function"))
         return false;
-    // @cast-boundary driver handle shape — begin/savepoint/release are optional across drivers
-    const r = raw;
-    return (typeof r.begin === "function" &&
-        typeof r.savepoint !== "function" &&
-        typeof r.release !== "function");
+    return (typeof propertyOf(raw, "begin") === "function" &&
+        typeof propertyOf(raw, "savepoint") !== "function" &&
+        typeof propertyOf(raw, "release") !== "function");
 }
 const closedConnectionLog = createFallbackLogger("bun-db");
 // The driver rejects in-flight queries with this AbortError (no code) when the
@@ -803,8 +793,7 @@ async function unsafeLoggingClosedConnection(db, sqlText, params, context) {
 }
 const DEFAULT_POOL_MAX = 10;
 function poolMaxOf(raw) {
-    // @cast-boundary driver pool options — both postgres-js and Bun.SQL expose options.max
-    const max = raw.options?.max;
+    const max = propertyOf(propertyOf(raw, "options"), "max");
     return typeof max === "number" && Number.isInteger(max) && max > 0 ? max : DEFAULT_POOL_MAX;
 }
 // Exported so raw-SQL query modules outside bun-db (e.g. bundled-features'
@@ -814,7 +803,7 @@ function poolMaxOf(raw) {
 export async function unsafeReadRetrying(db, sqlText, params) {
     const raw = asRawClient(db);
     try {
-        return (await raw.unsafe(sqlText, params));
+        return await raw.unsafe(sqlText, params);
     }
     catch (err) {
         if (!isPooledClient(raw) || !isClosedConnectionError(err)) {
@@ -826,7 +815,7 @@ export async function unsafeReadRetrying(db, sqlText, params) {
         let lastErr = err;
         for (let attempt = 0; attempt < maxRetries; attempt++) {
             try {
-                return (await raw.unsafe(sqlText, params));
+                return await raw.unsafe(sqlText, params);
             }
             catch (retryErr) {
                 lastErr = retryErr;
@@ -872,7 +861,7 @@ export async function selectMany(db, table, where, options) {
         }
         sqlText += ` LIMIT ${options.limit}`;
     }
-    const raw = (await unsafeReadRetrying(db, sqlText, values));
+    const raw = await unsafeReadRetrying(db, sqlText, values);
     return coerceRows(raw, info);
 }
 // biome-ignore lint/suspicious/noExplicitAny: see selectMany default
@@ -937,7 +926,7 @@ export async function selectInnerJoin(db, spec) {
         sqlText += ` WHERE ${conditions.join(" AND ")}`;
     if (spec.limit !== undefined)
         sqlText += ` LIMIT ${spec.limit}`;
-    const raw = (await unsafeReadRetrying(db, sqlText, values));
+    const raw = await unsafeReadRetrying(db, sqlText, values);
     return raw.map((row) => {
         const leftRow = {};
         const rightRow = {};
@@ -987,10 +976,10 @@ export async function insertMany(db, table, rows) {
         valuesClauses.push(`(${placeholders.join(", ")})`);
     }
     const sqlText = `INSERT INTO ${quoteIdent(info.name)} (${cols}) VALUES ${valuesClauses.join(", ")} RETURNING *`;
-    const raw = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+    const raw = await unsafeLoggingClosedConnection(db, sqlText, params, {
         operation: "insertMany",
         table: info.name,
-    }));
+    });
     return coerceRows(raw, info);
 }
 // biome-ignore lint/suspicious/noExplicitAny: see selectMany default
@@ -1020,10 +1009,10 @@ export async function insertOne(db, table, values) {
     })
         .join(", ");
     const sqlText = `INSERT INTO ${quoteIdent(info.name)} (${cols}) VALUES (${placeholders}) RETURNING *`;
-    const rows = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+    const rows = await unsafeLoggingClosedConnection(db, sqlText, params, {
         operation: "insertOne",
         table: info.name,
-    }));
+    });
     const first = rows[0];
     if (!first)
         return undefined;
@@ -1063,10 +1052,10 @@ export async function updateMany(db, table, set, where) {
             values.push(v);
     }
     sqlText += " RETURNING *";
-    const raw = (await unsafeLoggingClosedConnection(db, sqlText, values, {
+    const raw = await unsafeLoggingClosedConnection(db, sqlText, values, {
         operation: "updateMany",
         table: info.name,
-    }));
+    });
     return coerceRows(raw, info);
 }
 export async function deleteMany(db, table, where) {
@@ -1135,7 +1124,7 @@ export async function countWhere(db, table, where = {}) {
         sqlText += ` WHERE ${w.sqlText}`;
         values = w.values;
     }
-    const rows = (await unsafeReadRetrying(db, sqlText, values));
+    const rows = await unsafeReadRetrying(db, sqlText, values);
     return rows[0]?.count ?? 0;
 }
 const AGGREGATE_BUCKET_UNITS = ["hour", "day"];
@@ -1171,7 +1160,7 @@ function aggregateMeasureSql(info, measure) {
         case "avg":
             return `AVG(${requireAggregateColumn(info, measure.field, "measure field")})`;
         default:
-            throw new Error(`aggregateWhere: unknown measure fn "${String(measure.fn)}"`);
+            throw new Error(`aggregateWhere: unknown measure fn "${String(Reflect.get(measure, "fn"))}"`);
     }
 }
 function aggregateDimensionSql(info, dimension, index, params) {
@@ -1233,7 +1222,7 @@ export async function aggregateWhere(db, table, spec, where = {}) {
         params.push(...w.values);
     }
     sqlText += aggregateGroupOrderLimitSql(spec, dimensions.length);
-    const raw = (await unsafeReadRetrying(db, sqlText, params));
+    const raw = await unsafeReadRetrying(db, sqlText, params);
     return raw.map((row) => {
         const value = row["value"];
         return {
@@ -1277,10 +1266,10 @@ export async function upsertOnConflict(db, table, values, options) {
     }
     const conflictList = conflictCols.map((c) => quoteIdent(c)).join(", ");
     const sqlText = `${sqlPrefix} ON CONFLICT (${conflictList}) DO UPDATE SET ${updateParts.join(", ")} RETURNING *`;
-    const rows = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+    const rows = await unsafeLoggingClosedConnection(db, sqlText, params, {
         operation: "upsertOnConflict",
         table: info.name,
-    }));
+    });
     const first = rows[0];
     if (!first)
         return undefined;
@@ -1305,10 +1294,10 @@ export async function insertOnConflictDoNothing(db, table, values, options) {
     const { sqlPrefix, params } = buildInsertSql(info, entries);
     const conflictList = conflictCols.map((c) => quoteIdent(c)).join(", ");
     const sqlText = `${sqlPrefix} ON CONFLICT (${conflictList}) DO NOTHING RETURNING *`;
-    const rows = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+    const rows = await unsafeLoggingClosedConnection(db, sqlText, params, {
         operation: "insertOnConflictDoNothing",
         table: info.name,
-    }));
+    });
     const first = rows[0];
     if (!first)
         return undefined;
@@ -1357,10 +1346,10 @@ export async function incrementCounter(db, table, values, increments, options =
     }
     const conflictList = conflictCols.map((c) => quoteIdent(c)).join(", ");
     const sqlText = `${sqlPrefix} ON CONFLICT (${conflictList}) DO UPDATE SET ${updateParts.join(", ")} RETURNING *`;
-    const rows = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+    const rows = await unsafeLoggingClosedConnection(db, sqlText, params, {
         operation: "incrementCounter",
         table: info.name,
-    }));
+    });
     const first = rows[0];
     if (!first)
         return undefined;
@@ -1389,10 +1378,10 @@ export async function deleteManyBatched(db, table, where, options) {
         const sqlText = `DELETE FROM ${tableQ} WHERE ${idQ} IN (
       SELECT ${idQ} FROM ${tableQ} WHERE ${w.sqlText} LIMIT $${limitIdx}
     ) RETURNING ${idQ}`;
-        const rows = (await unsafeLoggingClosedConnection(db, sqlText, params, {
+        const rows = await unsafeLoggingClosedConnection(db, sqlText, params, {
             operation: "deleteManyBatched",
             table: info.name,
-        }));
+        });
         batches++;
         deleted += rows.length;
         if (rows.length < limit)
@@ -1401,16 +1390,21 @@ export async function deleteManyBatched(db, table, where, options) {
     return { deleted, batches };
 }
 export async function transaction(db, fn) {
-    return (await asRawClient(db).begin(async (tx) => fn(tx)));
+    const raw = asRawClient(db);
+    if (!hasBegin(raw)) {
+        throw new InternalError({
+            message: "transaction: runner has no begin() — already inside a transaction or savepoint.",
+        });
+    }
+    return raw.begin(fn);
 }
 // A tx/savepoint handle has no begin(); fail closed instead of nesting silently or TypeError-ing.
 export async function runInNewTransaction(db, fn) {
     const raw = asRawClient(db);
-    if (typeof raw.begin !== "function") {
+    if (!hasBegin(raw)) {
         throw new InternalError({
             message: "runInNewTransaction: runner has no begin() — already inside a transaction or savepoint.",
         });
     }
-    // @cast-boundary driver tx handle → DbRunner at the single seam
-    return raw.begin((tx) => fn(tx));
+    return raw.begin(fn);
 }

package/dist/crypto/kek-source.js

@@ -3,6 +3,7 @@
 // A slot's plaintext always wins over its ciphertext sibling, with no request
 // made at all. Any `*_CIPHERTEXT` in the env that names no requested slot is
 // ignored — a foreign ciphertext must never fail boot.
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 const SCALEWAY_KEY_MANAGER_API_VERSION = "v1alpha1";
 const DEFAULT_REGION = "fr-par";
 const DECRYPT_TIMEOUT_MS = 5_000;
@@ -48,15 +49,16 @@ async function decryptCiphertext(ciphertext, keyId, token, region, fetchImpl, lo
         }
         let body;
         try {
-            body = (await response.json());
+            body = await response.json();
         }
         catch {
             throw new Error(`${prefix}Key Manager decrypt for key ${keyId} returned an unparseable response`);
         }
-        if (typeof body.plaintext !== "string") {
+        const plaintext = propertyOf(body, "plaintext");
+        if (typeof plaintext !== "string") {
             throw new Error(`${prefix}Key Manager decrypt for key ${keyId} returned no plaintext field`);
         }
-        return body.plaintext;
+        return plaintext;
     }
     throw new Error(`${prefix}Key Manager decrypt failed for key ${keyId}: retries exhausted`);
 }

package/dist/crypto/pii-field-encryption.d.ts

@@ -14,7 +14,10 @@ export interface EncryptPiiOptions {
     readonly entityName: string;
     readonly ownerFallback?: Record<string, unknown>;
 }
-export declare function encryptPiiFieldValues(row: Record<string, unknown>, entity: EntityDefinition, piiFields: readonly string[], kms: LocalKeyKmsAdapter, kmsCtx: KmsContext, opts: EncryptPiiOptions): Promise<Record<string, unknown>>;
+export type PiiEncryptedRow<TRow extends Record<string, unknown>> = {
+    [K in keyof TRow]: TRow[K] extends string ? string : TRow[K] | string;
+};
+export declare function encryptPiiFieldValues<TRow extends Record<string, unknown>>(row: TRow, entity: EntityDefinition, piiFields: readonly string[], kms: LocalKeyKmsAdapter, kmsCtx: KmsContext, opts: EncryptPiiOptions): Promise<PiiEncryptedRow<TRow>>;
 export declare function serializeJsonbValue(field: string, value: unknown): string;
 export declare function decryptPiiFieldValues(row: Record<string, unknown>, piiFields: readonly string[], kms: LocalKeyKmsAdapter, kmsCtx: KmsContext): Promise<Record<string, unknown>>;
 export declare function configurePiiSubjectKms(adapter: KmsAdapter | undefined): void;

package/dist/crypto/pii-field-encryption.js

@@ -187,8 +187,8 @@ export async function decryptPiiFieldValues(row, piiFields, kms, kmsCtx) {
         try {
             const key = await kms.getKey(subject, kmsCtx);
             const plain = decryptValue(key, blob, subject, name, hasAad, isJson);
-            // @cast-boundary crypto-decrypt — AEAD-authenticated plaintext that this module serialized
-            out[name] = isJson ? JSON.parse(plain) : plain;
+            const decoded = isJson ? JSON.parse(plain) : plain;
+            out[name] = decoded;
         }
         catch (e) {
             // KeyNotFound deliberately propagates: ciphertext without a key row

package/dist/db/apply-entity-event.js

@@ -43,6 +43,7 @@
 //     `row` null (DELETE-Statements geben keine returning-Row her).
 //   - "skipped" → Event ist kein Auto-Verb (Domain-Event auf demselben
 //     Aggregate). Caller no-op.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { collectLookupableFields, computeBlindIndexValues } from "../crypto/blind-index.js";
 import { deleteMany, insertOne, updateMany } from "../db/query.js";
 import { InternalError } from "../errors/index.js";
@@ -54,8 +55,7 @@ export function parseAutoVerb(event) {
     if (!event.type.startsWith(prefix))
         return null;
     const verb = event.type.slice(prefix.length);
-    // @cast-boundary: verb is validated against the AutoVerb list before the cast.
-    return AUTO_VERBS.includes(verb) ? verb : null;
+    return isOneOf(AUTO_VERBS, verb) ? verb : null;
 }
 /** Idempotente Anwendung eines Auto-Events auf die Entity-Tabelle.
  *  Wird sowohl beim Live-Append (innerhalb der Write-TX) als auch beim

package/dist/db/collect-table-metas.js

@@ -15,6 +15,15 @@ function canonicalColumnsKey(meta) {
         .map((c) => `${c.name}|${c.pgType}|${c.notNull}|${c.defaultSql ?? ""}|${c.primaryKey ?? false}|${c.identity ?? false}|${c.bigintJsMode ?? ""}`)
         .join("\n");
 }
+function registerPass1Meta(metas, byName, meta, origin) {
+    const existing = byName.get(meta.tableName);
+    if (existing) {
+        throw new Error(`collectTableMetas: table "${meta.tableName}" is registered by ${origin} and ${existing.origin}. ` +
+            "Give one of them a different table name.");
+    }
+    metas.push(meta);
+    byName.set(meta.tableName, { meta, origin });
+}
 export function collectTableMetas(features) {
     const metas = [];
     const byName = new Map();
@@ -37,15 +46,10 @@ export function collectTableMetas(features) {
                 assertBackingTableSuperset(name, fieldMeta, tableMeta);
                 meta = tableMeta;
             }
-            metas.push(meta);
-            byName.set(meta.tableName, { meta, origin: `entity "${name}" (${feature.name})` });
+            registerPass1Meta(metas, byName, meta, `entity "${name}" (${feature.name})`);
         }
         for (const entry of Object.values(feature.storeTables)) {
-            metas.push(entry.meta);
-            byName.set(entry.meta.tableName, {
-                meta: entry.meta,
-                origin: `storeTable "${entry.name}" (${feature.name})`,
-            });
+            registerPass1Meta(metas, byName, entry.meta, `storeTable "${entry.name}" (${feature.name})`);
         }
     }
     // Pass 2: table-tragende Registrierungen. Zwei Pässe, damit eine Entity-

package/dist/db/cursor.js

@@ -1,3 +1,4 @@
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 // String-basiert damit UUIDs (Default seit Sprint F) + Integer-Auto-Increment
 // durch denselben Cursor-Pfad laufen. UUIDv7 erfüllt die lex-Monotonie
 // (time-ordered Prefix); UUIDv4 nicht — wer den nutzt, kriegt inkorrekte
@@ -28,7 +29,7 @@ function parseKeysetPayload(decoded) {
     catch {
         return null;
     }
-    if (typeof raw !== "object" || raw === null)
+    if (!isPlainObject(raw))
         return null;
     const { v, i } = raw;
     if (typeof i !== "string" || i === "")