@cosmicdrift/kumiko-framework 0.369.0 → 0.370.0

package/dist/engine/steps/_read-source.d.ts

@@ -1,7 +1,7 @@
-import type { DbRunner } from "../../db/connection.js";
-import type { WhereObject } from "../../db/query.js";
-import { type TenantDb } from "../../db/tenant-db.js";
-import type { PipelineCtx } from "../types/step.js";
+import type { DbRunner } from "../../db/connection.ts";
+import type { WhereObject } from "../../db/query.ts";
+import { type TenantDb } from "../../db/tenant-db.ts";
+import type { PipelineCtx } from "../types/step.ts";
 export declare function readSourceFor(ctx: PipelineCtx, unsafeAllTenants: {
     readonly reason: string;
 } | undefined): TenantDb | DbRunner;

package/dist/engine/steps/_resolver-utils.d.ts

@@ -1,4 +1,4 @@
-import type { PipelineCtx, StepResolver } from "../types/step.js";
+import type { PipelineCtx, StepResolver } from "../types/step.ts";
 /**
  * Resolve a required StepResolver — either a static value or a function.
  * Throws if `arg` is undefined; caller must guarantee presence.

package/dist/engine/steps/aggregate-append-event.d.ts

@@ -1,4 +1,4 @@
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 type AggregateAppendEventArgs = {
     readonly aggregateId: StepResolver<string>;
     readonly aggregateType: string;

package/dist/engine/steps/aggregate-create.d.ts

@@ -1,5 +1,5 @@
-import type { EventStoreExecutor } from "../../db/event-store-executor.js";
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { EventStoreExecutor } from "../../db/event-store-executor.ts";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 export declare function buildAggregateCreateStep(name: string, opts: {
     readonly executor: EventStoreExecutor;
     readonly data: StepResolver<Record<string, unknown>>;

package/dist/engine/steps/aggregate-update.d.ts

@@ -1,6 +1,6 @@
-import type { EventStoreExecutor } from "../../db/event-store-executor.js";
-import type { EntityId } from "../types/identifiers.js";
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { EventStoreExecutor } from "../../db/event-store-executor.ts";
+import type { EntityId } from "../types/identifiers.ts";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 export declare function buildAggregateUpdateStep(name: string, opts: {
     readonly executor: EventStoreExecutor;
     readonly id: StepResolver<EntityId>;

package/dist/engine/steps/branch.d.ts

@@ -1,4 +1,4 @@
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 type BranchArgs = {
     readonly if: StepResolver<boolean>;
     readonly onTrue: readonly StepInstance[];

package/dist/engine/steps/call-feature.d.ts

@@ -1,5 +1,5 @@
-import type { SessionUser } from "../types/index.js";
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { SessionUser } from "../types/index.ts";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 export declare function buildCallFeatureStep(name: string, opts: {
     readonly handler: string;
     readonly payload: StepResolver<unknown>;

package/dist/engine/steps/compute.d.ts

@@ -1,2 +1,2 @@
-import type { PipelineCtx, StepInstance } from "../types/step.js";
+import type { PipelineCtx, StepInstance } from "../types/step.ts";
 export declare function buildComputeStep<TResult>(name: string, fn: (ctx: PipelineCtx) => TResult): StepInstance;

package/dist/engine/steps/for-each.d.ts

@@ -1,4 +1,4 @@
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 type ForEachArgs<TItem = unknown> = {
     readonly over: StepResolver<readonly TItem[]>;
     readonly as: string;

package/dist/engine/steps/mail-send.d.ts

@@ -1,4 +1,4 @@
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 type MailSendArgs = {
     readonly to: StepResolver<string | readonly string[]>;
     readonly subject: StepResolver<string>;

package/dist/engine/steps/read-find-many.d.ts

@@ -1,5 +1,5 @@
-import { type WhereObject } from "../../db/query.js";
-import type { StepInstance, StepResolver } from "../types/step.js";
+import { type WhereObject } from "../../db/query.ts";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 export declare function buildReadFindManyStep(name: string, opts: {
     readonly table: unknown;
     readonly where?: StepResolver<WhereObject | undefined>;

package/dist/engine/steps/read-find-one.d.ts

@@ -1,5 +1,5 @@
-import { type WhereObject } from "../../db/query.js";
-import type { StepInstance, StepResolver } from "../types/step.js";
+import { type WhereObject } from "../../db/query.ts";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 export declare function buildReadFindOneStep(name: string, opts: {
     readonly table: unknown;
     readonly where: StepResolver<WhereObject | undefined>;

package/dist/engine/steps/retry.d.ts

@@ -1,4 +1,4 @@
-import type { StepInstance } from "../types/step.js";
+import type { StepInstance } from "../types/step.ts";
 type RetryStepArgs = {
     readonly times: number;
     readonly backoff: "exponential" | "linear";

package/dist/engine/steps/return.d.ts

@@ -1,4 +1,4 @@
-import type { WriteResult } from "../types/handlers.js";
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { WriteResult } from "../types/handlers.ts";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 export declare const RETURN_RESULT_KEY = "__return";
 export declare function buildReturnStep<TData>(resolver: StepResolver<WriteResult<TData>>): StepInstance;

package/dist/engine/steps/unsafe-projection-delete.d.ts

@@ -1,5 +1,5 @@
-import { type WhereObject } from "../../db/query.js";
-import type { StepInstance, StepResolver } from "../types/step.js";
+import { type WhereObject } from "../../db/query.ts";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 type UnsafeProjectionDeleteArgs = {
     readonly table: unknown;
     readonly where: StepResolver<WhereObject>;

package/dist/engine/steps/unsafe-projection-upsert.d.ts

@@ -1,4 +1,4 @@
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 type UnsafeProjectionUpsertArgs = {
     readonly table: unknown;
     readonly on: readonly string[];

package/dist/engine/steps/wait-for-event.d.ts

@@ -1,4 +1,4 @@
-import type { AwaitedEventType, EventMatch, StepInstance, StepResolver } from "../types/step.js";
+import type { AwaitedEventType, EventMatch, StepInstance, StepResolver } from "../types/step.ts";
 type WaitForEventArgs = {
     readonly event: AwaitedEventType;
     readonly match?: StepResolver<EventMatch>;

package/dist/engine/steps/wait.d.ts

@@ -1,4 +1,4 @@
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 type WaitStepArgs = {
     readonly for: StepResolver<string>;
 };

package/dist/engine/steps/webhook-send.d.ts

@@ -1,4 +1,4 @@
-import type { StepInstance, StepResolver } from "../types/step.js";
+import type { StepInstance, StepResolver } from "../types/step.ts";
 type WebhookHttpMethod = "POST" | "PUT" | "PATCH";
 type WebhookAuth = {
     readonly kind: "bearer";

package/dist/engine/strip-disabled-features-from-app-schema.d.ts

@@ -1,6 +1,6 @@
-import type { AppSchema } from "../ui-types/app-schema.js";
-import type { EffectiveFeaturesResolver } from "./tier-resolver-extension.js";
-import type { Registry } from "./types/feature.js";
-import type { TenantId } from "./types/identifiers.js";
+import type { AppSchema } from "../ui-types/app-schema.ts";
+import type { EffectiveFeaturesResolver } from "./tier-resolver-extension.ts";
+import type { Registry } from "./types/feature.ts";
+import type { TenantId } from "./types/identifiers.ts";
 export declare function resolveDisabledFeatureNames(registry: Registry, effectiveFeatures: EffectiveFeaturesResolver, tenantId: TenantId): Promise<readonly string[]>;
 export declare function stripDisabledFeaturesFromAppSchema(schema: AppSchema, registry: Registry, disabledFeatureNames: readonly string[]): AppSchema;

package/dist/engine/system-user.d.ts

@@ -1,5 +1,5 @@
-import { SYSTEM_USER_ID, type TenantId } from "./types/identifiers.js";
-import type { SessionUser } from "./types/index.js";
+import { SYSTEM_USER_ID, type TenantId } from "./types/identifiers.ts";
+import type { SessionUser } from "./types/index.ts";
 export { SYSTEM_USER_ID };
 export declare const SYSTEM_ROLE: "system";
 export declare function createSystemUser(tenantId: TenantId, extraRoles?: readonly string[]): SessionUser;

package/dist/engine/template-variables.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import type { Registry, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariables } from "./types/index.js";
+import type { Registry, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariables } from "./types/index.ts";
 type CommonOptions = {
     readonly label?: string;
     readonly required?: boolean;

package/dist/engine/tier-resolver-extension.d.ts

@@ -1,8 +1,8 @@
 import type { CacheSyncBus } from "@cosmicdrift/kumiko-types/cache-sync-types";
-import type { DbConnection } from "../db/connection.js";
-import type { RegistrarExtensionRegistration } from "./types/config.js";
-import type { FeatureDefinition, Registry } from "./types/feature.js";
-import type { TenantId } from "./types/identifiers.js";
+import type { DbConnection } from "../db/connection.ts";
+import type { RegistrarExtensionRegistration } from "./types/config.ts";
+import type { FeatureDefinition, Registry } from "./types/feature.ts";
+import type { TenantId } from "./types/identifiers.ts";
 /**
  * Extension-name unter dem ein tier-resolver-plugin im registry registriert
  * werden muss. Konstante damit `r.useExtension(TENANT_TIER_RESOLVER_EXT, ...)`

package/dist/engine/transfer-adjacency.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "./types/index.js";
+import type { EntityDefinition } from "./types/index.ts";
 export declare const MAX_TRANSFER_DEPTH = 5;
 export type TransferEdgeLink = {
     readonly kind: "parentRef";

package/dist/engine/types/index.d.ts

@@ -4,7 +4,7 @@ export type { QueryHandlerDefinition, StreamHandlerDefinition, WriteHandlerDefin
 export type { EntityCrudRegistrar, EntityCrudVerb, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions, } from "@cosmicdrift/kumiko-types/entity-handlers";
 export type { KumikoEntityTypeMap, KumikoEventTypeMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, } from "@cosmicdrift/kumiko-types/event-type-map";
 export type { ExtensionOptionsArgs, ExtensionOptionsFor, KumikoExtensionOptionsMap, } from "@cosmicdrift/kumiko-types/extension-options-map";
-export type { BootCheckContext, BootCheckFn, EntityObjectDefinition, FeatureDefinition, FeatureMetricDef, FeatureMetricType, FeatureRegistrar, HookDefinition, MetricOptions, Registry, SecretKeyDefinition, SecretKeyHandle, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, StoreTableDef, StoreTableEntry, StoreTableOptions, UiHintOption, UiHints, } from "@cosmicdrift/kumiko-types/feature";
+export type { BootCheckContext, BootCheckFn, BootOptionName, EntityObjectDefinition, FeatureDefinition, FeatureMetricDef, FeatureMetricType, FeatureRegistrar, HookDefinition, MetricOptions, Registry, SecretKeyDefinition, SecretKeyHandle, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, StackBootRequirement, StoreTableDef, StoreTableEntry, StoreTableOptions, UiHintOption, UiHints, } from "@cosmicdrift/kumiko-types/feature";
 export type { FieldIconKey } from "@cosmicdrift/kumiko-types/field-icon";
 export type { AnyFileFieldDef, BigIntFieldDef, BooleanFieldDef, ClientDerivedFieldDef, DateFieldDef, DecimalFieldDef, DefaultCurrency, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EmbeddedDerivedCellDef, EmbeddedFieldDef, EmbeddedSubFieldDef, EntityDefinition, EntityEventMigration, EntityIndexDef, FieldAccess, FieldDefinition, FieldsMap, FileFieldDef, FilesFieldDef, Findability, ImageFieldDef, ImagesFieldDef, JsonbFieldDef, LocatedTimestampFieldDef, LongTextFieldDef, LongTextFindability, MoneyCurrencySource, MoneyFieldDef, MultiSelectFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, ReferenceFieldDef, ResolvedPiiFlags, RetentionDef, SelectFieldDef, SelectOptionTone, TextFieldDef, TimestampFieldDef, TransitionMap, TzFieldDef, } from "@cosmicdrift/kumiko-types/fields";
 export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadBucketNormalization, PayloadRateLimitOption, PreparedWriteEvent, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
@@ -23,8 +23,8 @@ export type { TargetRef } from "@cosmicdrift/kumiko-types/target-ref";
 export type { Subscribe, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, } from "@cosmicdrift/kumiko-types/tree-node";
 export type { WebSocketConnection, WebSocketMessageData, WebSocketRouteConnectDeps, WebSocketRouteDefinition, WebSocketSessionHandlers, } from "@cosmicdrift/kumiko-types/websocket-route";
 export type { WorkspaceDefinition } from "@cosmicdrift/kumiko-types/workspace";
-export type { ConcurrencyMode, ConfigScope, LifecycleHookType, OnDeleteStrategy, } from "../constants.js";
-export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, isFileField } from "../field-helpers.js";
-export { resolveName, withResponseData } from "../handler-helpers.js";
-export { HookPhases } from "../hook-helpers.js";
-export { isExtensionEditSection, isFormatSpec, normalizeEditField, normalizeListColumn, } from "../screen-helpers.js";
+export type { ConcurrencyMode, ConfigScope, LifecycleHookType, OnDeleteStrategy, } from "../constants.ts";
+export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, isFileField } from "../field-helpers.ts";
+export { resolveName, withResponseData } from "../handler-helpers.ts";
+export { HookPhases } from "../hook-helpers.ts";
+export { isExtensionEditSection, isFormatSpec, normalizeEditField, normalizeListColumn, } from "../screen-helpers.ts";

package/dist/engine/validate-projection-allowlist.d.ts

@@ -1,4 +1,4 @@
-import type { FeatureDefinition } from "./types/index.js";
+import type { FeatureDefinition } from "./types/index.ts";
 /**
  * Validate every feature's pipeline-form writeHandlers against:
  *   1. the owning feature's r.requires.projection allowlist

package/dist/engine/validation.d.ts

@@ -1,3 +1,3 @@
-import type { Registry, ValidationError } from "./types/index.js";
+import type { Registry, ValidationError } from "./types/index.ts";
 export type { ValidationError };
 export declare function runValidation(registry: Registry, hookName: string, data: Readonly<Record<string, unknown>>): readonly ValidationError[] | null;

package/dist/entrypoint/index.d.ts

@@ -1,16 +1,16 @@
 import type { Hono } from "hono";
-import type { AuthRoutesConfig } from "../api/auth-routes.js";
-import type { JwtHelper, JwtKeyring } from "../api/jwt.js";
-import type { ServerOptions } from "../api/server.js";
-import type { SseBroker } from "../api/sse-broker.js";
-import type { PgClient, PgListenClient } from "../db/connection.js";
-import type { AppContext, Registry } from "../engine/types/index.js";
-import type { JobRunner, JobRunnerOptions } from "../jobs/job-runner.js";
-import type { Lifecycle } from "../lifecycle/index.js";
-import type { ObservabilityOptions, ObservabilityProvider } from "../observability/index.js";
-import type { Dispatcher, DispatcherOptions } from "../pipeline/dispatcher.js";
-import type { EventDedup, EventDispatcher } from "../pipeline/index.js";
-import type { SystemHooks } from "../pipeline/lifecycle-pipeline.js";
+import type { AuthRoutesConfig } from "../api/auth-routes.ts";
+import type { JwtHelper, JwtKeyring } from "../api/jwt.ts";
+import type { ServerOptions } from "../api/server.ts";
+import type { SseBroker } from "../api/sse-broker.ts";
+import type { PgClient, PgListenClient } from "../db/connection.ts";
+import type { AppContext, Registry } from "../engine/types/index.ts";
+import type { JobRunner, JobRunnerOptions } from "../jobs/job-runner.ts";
+import type { Lifecycle } from "../lifecycle/index.ts";
+import type { ObservabilityOptions, ObservabilityProvider } from "../observability/index.ts";
+import type { Dispatcher, DispatcherOptions } from "../pipeline/dispatcher.ts";
+import type { EventDedup, EventDispatcher } from "../pipeline/index.ts";
+import type { SystemHooks } from "../pipeline/lifecycle-pipeline.ts";
 export type BaseEntrypointOptions = {
     readonly registry: Registry;
     readonly context: AppContext;

package/dist/env/dry-run.d.ts

@@ -1,5 +1,15 @@
-import { type ComposedEnvSchema } from "./index.js";
+import { type ComposedEnvSchema, type EnvFieldInspection } from "./index.ts";
 export type DryRunMode = "human" | "json" | "pulumi" | "k8s";
+/** `boot` runs the boot validators without connecting anywhere; the other
+ *  modes only render the env inventory. */
+export type DryRunEnvMode = DryRunMode | "boot";
+export declare const DRY_RUN_ENV_VAR = "KUMIKO_DRY_RUN_ENV";
+/** Reads `KUMIKO_DRY_RUN_ENV`. `1` and `true` mean `human`; an unknown value
+ *  returns undefined, so the caller decides whether to warn or boot. */
+export declare function parseDryRunEnvMode(raw: string | undefined): DryRunEnvMode | undefined;
+/** True while any dry-run mode is requested, for code that runs at module
+ *  load (key providers, secret derivation) and must not throw on missing env. */
+export declare function isDryRunEnvActive(env: Readonly<Record<string, string | undefined>>): boolean;
 export type DryRunOptions = {
     /** From composeEnvSchema. Drives the per-row feature-attribution. */
     readonly sources?: Readonly<Record<string, string>>;
@@ -11,3 +21,6 @@ export type DryRunOptions = {
     readonly k8sNamespace?: string;
 };
 export declare function renderDryRun(composed: ComposedEnvSchema, mode: DryRunMode, options?: DryRunOptions): string;
+/** Table for `KUMIKO_DRY_RUN_ENV=boot`: one row per variable with its source,
+ *  whether it is required, and whether it is set. Values are never printed. */
+export declare function renderEnvInspection(rows: readonly EnvFieldInspection[]): string;

package/dist/env/dry-run.js

@@ -9,6 +9,24 @@
 // by parseEnv drives the output here — single source of truth.
 import { zodShape } from "./_zod-introspect.js";
 import { classifyField, getDefaultValue, getFieldDescription, pulumiConfigKey, readKumikoMeta, } from "./index.js";
+export const DRY_RUN_ENV_VAR = "KUMIKO_DRY_RUN_ENV";
+/** Reads `KUMIKO_DRY_RUN_ENV`. `1` and `true` mean `human`; an unknown value
+ *  returns undefined, so the caller decides whether to warn or boot. */
+export function parseDryRunEnvMode(raw) {
+    if (!raw)
+        return undefined;
+    const value = raw.toLowerCase();
+    if (value === "1" || value === "true" || value === "human")
+        return "human";
+    if (value === "json" || value === "pulumi" || value === "k8s" || value === "boot")
+        return value;
+    return undefined;
+}
+/** True while any dry-run mode is requested, for code that runs at module
+ *  load (key providers, secret derivation) and must not throw on missing env. */
+export function isDryRunEnvActive(env) {
+    return parseDryRunEnvMode(env[DRY_RUN_ENV_VAR]) !== undefined;
+}
 function collectFields(schema, sources) {
     const out = [];
     for (const [name, field] of Object.entries(zodShape(schema))) {
@@ -163,3 +181,35 @@ function renderK8s(fields, options) {
     }
     return `${lines.join("\n")}\n`;
 }
+function inspectionStatus(row) {
+    return row.status === "invalid" ? `invalid: ${row.message ?? "invalid value"}` : row.status;
+}
+/** Table for `KUMIKO_DRY_RUN_ENV=boot`: one row per variable with its source,
+ *  whether it is required, and whether it is set. Values are never printed. */
+export function renderEnvInspection(rows) {
+    const header = { name: "VARIABLE", source: "SOURCE", klass: "KIND" };
+    const nameWidth = Math.max(header.name.length, ...rows.map((r) => r.name.length));
+    const sourceWidth = Math.max(header.source.length, ...rows.map((r) => r.source.length));
+    const klassWidth = Math.max(header.klass.length, ...rows.map((r) => r.klass.length));
+    const line = (name, source, klass, status) => `  ${name.padEnd(nameWidth)}  ${source.padEnd(sourceWidth)}  ${klass.padEnd(klassWidth)}  ${status}`;
+    const order = { required: 0, optional: 1, withDefault: 2 };
+    const sorted = [...rows].sort((a, b) => order[a.klass] - order[b.klass] ||
+        a.source.localeCompare(b.source) ||
+        a.name.localeCompare(b.name));
+    const missing = rows.filter((r) => r.status === "missing").length;
+    const invalid = rows.filter((r) => r.status === "invalid").length;
+    const lines = [
+        "Env check (values are not printed):",
+        line(header.name, header.source, header.klass, "STATUS"),
+        ...sorted.map((r) => line(r.name, r.source, r.klass, inspectionStatus(r))),
+        "",
+    ];
+    if (invalid > 0)
+        lines.push(`${invalid} variable(s) invalid.`);
+    if (missing > 0) {
+        lines.push(`${missing} required variable(s) missing. Feature wiring was NOT validated; set them and rerun to check it.`);
+    }
+    if (invalid === 0 && missing === 0)
+        lines.push("All variables present.");
+    return `${lines.join("\n")}\n`;
+}

package/dist/env/index.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import type { FeatureDefinition } from "../engine/types/feature.js";
+import type { FeatureDefinition } from "../engine/types/feature.ts";
 export type KumikoEnvMeta = {
     readonly pulumi?: {
         /** Override the auto-derived camelCase Pulumi-config-key name. Apps
@@ -28,31 +28,54 @@ export type EnvFieldClass = "required" | "optional" | "withDefault";
 export declare function classifyField(field: z.ZodType): EnvFieldClass;
 export declare function getDefaultValue(field: z.ZodType): unknown;
 export declare function getFieldDescription(field: z.ZodType): string | undefined;
-export type ComposeEnvSchemaOptions = {
-    /** All features whose envSchemas should be merged. */
-    readonly features: readonly FeatureDefinition[];
+/** A feature whose registered env schema is visible in its type, so
+ *  `composeEnvSchema` can type the merged schema from the feature list. */
+export type FeatureWithEnvSchema<TFeature extends FeatureDefinition, TShape extends z.ZodRawShape> = TFeature & {
+    readonly envSchema: z.ZodObject<TShape>;
+};
+/** Returns `feature` typed with the env schema it registered via
+ *  `r.envSchema(schema)`. Throws when the feature registered another
+ *  instance, so the type never claims fields the runtime schema lacks. */
+export declare function featureWithEnvSchema<TFeature extends FeatureDefinition, TShape extends z.ZodRawShape>(feature: TFeature, schema: z.ZodObject<TShape>): FeatureWithEnvSchema<TFeature, TShape>;
+type EmptyShape = Record<never, never>;
+type DeclaredEnvShape<TFeature> = TFeature extends {
+    readonly envSchema: z.ZodObject<infer TShape extends z.ZodRawShape>;
+} ? string extends keyof TShape ? EmptyShape : TShape : EmptyShape;
+type UnionToIntersection<TUnion> = (TUnion extends unknown ? (value: TUnion) => void : never) extends (value: infer TIntersection) => void ? TIntersection : never;
+type OptionalShape<TShape extends z.ZodRawShape> = {
+    [Key in keyof TShape]: z.ZodOptional<TShape[Key]>;
+};
+type FeaturesEnvShape<TFeatures extends readonly FeatureDefinition[]> = UnionToIntersection<DeclaredEnvShape<TFeatures[number]>>;
+type FlattenShape<TShape> = {
+    [Key in keyof TShape]: TShape[Key];
+} & {};
+type KnownShape<TShape extends z.ZodRawShape> = string extends keyof TShape ? EmptyShape : TShape;
+/** The merged shape `composeEnvSchema` returns. With `optionalFeatures`
+ *  every feature field is typed optional: the type cannot tell which feature
+ *  a name refers to, and over-reporting `undefined` is the safe side. */
+export type ComposedEnvShape<TFeatures extends readonly FeatureDefinition[], TCore extends z.ZodRawShape, TExtend extends z.ZodRawShape, TOptionalFeatures extends readonly string[] | undefined> = Extract<FlattenShape<KnownShape<TCore> & (TOptionalFeatures extends readonly string[] ? OptionalShape<FeaturesEnvShape<TFeatures> & z.ZodRawShape> : FeaturesEnvShape<TFeatures>) & KnownShape<TExtend>>, z.ZodRawShape>;
+export type ComposeEnvSchemaOptions<TFeatures extends readonly FeatureDefinition[] = readonly FeatureDefinition[], TCore extends z.ZodRawShape = z.ZodRawShape, TExtend extends z.ZodRawShape = z.ZodRawShape, TOptionalFeatures extends readonly string[] | undefined = readonly string[] | undefined> = {
+    /** All features whose envSchemas should be merged. Bundled features type
+     *  their fragment, so passing the list inline types the merged schema. */
+    readonly features: TFeatures;
     /** App-specific env-vars (e.g. `STUDIO_ADMIN_EMAIL`). Keys here are
      *  tagged as source "app" in the resulting sources map. */
-    readonly extend?: z.ZodObject<z.ZodRawShape>;
+    readonly extend?: z.ZodObject<TExtend>;
     /** Feature-names whose env-vars should be auto-`.optional()`-wrapped.
      *  Lets an app opt out of e.g. `channel-email-smtp`'s vars without
      *  manually `.partial()`-ing each shape at the call-site. */
-    readonly optionalFeatures?: readonly string[];
+    readonly optionalFeatures?: TOptionalFeatures;
     /** Framework-core env-vars (PORT, DATABASE_URL, REDIS_URL, …) from
      *  `@cosmicdrift/kumiko-dev-server`. Keys here are tagged as source
      *  "framework-core" in error output. Conflict-detection runs across
      *  core/features/extend as one merged pool — same key declared in two
      *  layers throws KumikoBootError at compose-time. */
-    readonly core?: z.ZodObject<z.ZodRawShape>;
+    readonly core?: z.ZodObject<TCore>;
 };
-export type ComposedEnvSchema = {
-    /** The merged Zod schema. Type-erased to `ZodObject<ZodRawShape>` — TS
-     *  can't variadic-merge N generic feature schemas without tuple gymnastics
-     *  that hurt readability. For type-safe `z.infer` in app code, build a
-     *  parallel typed schema manually (see Plan-Doc
-     *  `kumiko-studio/docs/plans/sprint-9-env-schemas.md` → API-Design)
-     *  and only pass `composed.schema` to `runProdApp` for validation. */
-    readonly schema: z.ZodObject<z.ZodRawShape>;
+export type ComposedEnvSchema<TShape extends z.ZodRawShape = z.ZodRawShape> = {
+    /** The merged Zod schema, typed from core, the typed feature fragments and
+     *  extend; `parseEnv(composed.schema, env)` returns the typed env. */
+    readonly schema: z.ZodObject<TShape>;
     /** env-var-name → declaring source-name: feature-name from `r.envSchema()`,
      *  "app" from `extend`, or "framework-core" from `core`. */
     readonly sources: Readonly<Record<string, string>>;
@@ -60,7 +83,7 @@ export type ComposedEnvSchema = {
 /** Makes the named env keys optional while keeping their `kms` meta. Keys
  *  missing from the schema shape are ignored. */
 export declare function withOptionalEnvKeys(schema: z.ZodObject<z.ZodRawShape>, keys: readonly string[]): z.ZodObject<z.ZodRawShape>;
-export declare function composeEnvSchema(options: ComposeEnvSchemaOptions): ComposedEnvSchema;
+export declare function composeEnvSchema<const TFeatures extends readonly FeatureDefinition[], TCore extends z.ZodRawShape = EmptyShape, TExtend extends z.ZodRawShape = EmptyShape, const TOptionalFeatures extends readonly string[] | undefined = undefined>(options: ComposeEnvSchemaOptions<TFeatures, TCore, TExtend, TOptionalFeatures>): ComposedEnvSchema<ComposedEnvShape<TFeatures, TCore, TExtend, TOptionalFeatures>>;
 export type EnvErrorKind = "missing" | "invalid";
 export type EnvError = {
     readonly name: string;
@@ -100,6 +123,21 @@ export declare function parseEnv<S extends z.ZodObject<z.ZodRawShape>>(schema: S
  *  scheitern. Ersetzt das `({} as Shape)`-Muster, bei dem JEDER Zugriff
  *  silent undefined war und das Compile-Level nichts davon wusste. */
 export declare function parseEnvDryRun<S extends z.ZodObject<z.ZodRawShape>>(schema: S, env: Record<string, string | undefined>): Partial<z.infer<S>>;
+export type EnvFieldStatus = "set" | "unset" | "missing" | "invalid";
+export type EnvFieldInspection = {
+    readonly name: string;
+    readonly klass: EnvFieldClass;
+    readonly source: string;
+    readonly status: EnvFieldStatus;
+    /** Zod's issue text for an invalid value; never the value itself. */
+    readonly message?: string;
+};
+/** Checks every field of `schema` on its own against `env`, for the boot dry
+ *  run: a missing required value is reported, not thrown, so the inventory
+ *  renders on an empty env. Object-level refinements do not run here; once
+ *  nothing is missing or invalid, parseEnv validates the whole object. */
+export declare function inspectEnv(schema: z.ZodObject<z.ZodRawShape>, env: Readonly<Record<string, string | undefined>>, options?: Pick<ParseEnvOptions, "sources">): readonly EnvFieldInspection[];
 export declare function camelCase(snakeShout: string): string;
 export declare function pulumiConfigKey(envName: string, field: z.ZodType | undefined, prefix: string | undefined): string;
 export declare function buildPulumiSuggestion(envName: string, field: z.ZodType, prefix: string | undefined): string | undefined;
+export {};

package/dist/env/index.js

@@ -115,6 +115,18 @@ export function getDefaultValue(field) {
 export function getFieldDescription(field) {
     return zodDescription(field);
 }
+function registersEnvSchema(feature, schema) {
+    return feature.envSchema === schema;
+}
+/** Returns `feature` typed with the env schema it registered via
+ *  `r.envSchema(schema)`. Throws when the feature registered another
+ *  instance, so the type never claims fields the runtime schema lacks. */
+export function featureWithEnvSchema(feature, schema) {
+    if (!registersEnvSchema(feature, schema)) {
+        throw new Error(`[Feature ${feature.name}] featureWithEnvSchema: the feature did not register this schema instance via r.envSchema().`);
+    }
+    return feature;
+}
 // `.optional()` returns a new Zod instance that drops `.meta()`, which would
 // hide the slot from `kmsSlotsOf` on the composed schema.
 function optionalKeepingKmsMeta(field) {
@@ -214,13 +226,17 @@ export function composeEnvSchema(options) {
     }
     if (options.extend) {
         for (const [key, field] of Object.entries(zodShape(options.extend))) {
+            // An app spreading a feature's own fragment into extend re-declares the
+            // same instance; that is the feature's variable, not a second owner.
+            if (featureFields.get(key) === field)
+                continue;
             if (merged[key] !== undefined) {
                 throw new KumikoBootError([
                     {
                         name: key,
                         kind: "invalid",
-                        message: `env-var conflict: "${key}" declared by both "${sources[key]}" ` +
-                            `and the app's extend block — rename one.`,
+                        message: `env-var conflict: "${key}" is declared by "${sources[key]}" and again in the app's extend block — ` +
+                            `drop it from extend, the declaring source already owns it.`,
                     },
                 ]);
             }
@@ -230,10 +246,9 @@ export function composeEnvSchema(options) {
         }
     }
     declareKmsCiphertextTwins(merged, sources, kmsFields);
-    return {
-        schema: z.object(merged),
-        sources,
-    };
+    // @cast-boundary schema-walk — the loops above merge exactly the core, feature and extend shapes the type names; a key clash throws instead of overwriting.
+    const schema = z.object(merged);
+    return { schema, sources };
 }
 function formatBootError(errors) {
     const lines = [
@@ -346,6 +361,45 @@ export function parseEnvDryRun(schema, env) {
     // per-Feld-safeParse; jeder enthaltene Wert hat seinen Feld-Parse bestanden.
     return out;
 }
+/** Checks every field of `schema` on its own against `env`, for the boot dry
+ *  run: a missing required value is reported, not thrown, so the inventory
+ *  renders on an empty env. Object-level refinements do not run here; once
+ *  nothing is missing or invalid, parseEnv validates the whole object. */
+export function inspectEnv(schema, env, options = {}) {
+    const cleaned = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (v !== undefined)
+            cleaned[k] = v;
+    }
+    const relaxed = relaxCiphertextOnlySlots(schema, cleaned);
+    return Object.entries(zodShape(relaxed)).map(([name, field]) => {
+        const klass = classifyField(field);
+        const source = options.sources?.[name] ?? "unknown";
+        const raw = cleaned[name];
+        if (raw === undefined) {
+            return { name, klass, source, status: klass === "required" ? "missing" : "unset" };
+        }
+        const issue = firstFieldIssue(field, raw);
+        return issue === undefined
+            ? { name, klass, source, status: "set" }
+            : { name, klass, source, status: "invalid", message: issue };
+    });
+}
+function firstFieldIssue(field, raw) {
+    try {
+        const result = field.safeParse(raw);
+        if (result.success)
+            return undefined;
+        const message = result.error.issues[0]?.message ?? "invalid value";
+        // A custom refine message may interpolate the input; the table must not
+        // carry it, so such a message is replaced as a whole.
+        return raw.length > 0 && message.includes(raw) ? "invalid value" : message;
+    }
+    catch {
+        // The thrown message may quote the value, so it is not passed on.
+        return "a field refinement threw while checking the value";
+    }
+}
 export function camelCase(snakeShout) {
     const parts = snakeShout.toLowerCase().split("_").filter(Boolean);
     if (parts.length === 0)

package/dist/errors/classes.d.ts

@@ -1,6 +1,6 @@
-import type { FieldIssue } from "./field-issue.js";
-import { type ErrorOpts, KumikoError } from "./kumiko-error.js";
-export type { FieldIssue } from "./field-issue.js";
+import type { FieldIssue } from "./field-issue.ts";
+import { type ErrorOpts, KumikoError } from "./kumiko-error.ts";
+export type { FieldIssue } from "./field-issue.ts";
 export type ValidationDetails = {
     readonly fields: readonly FieldIssue[];
 };

package/dist/errors/docs-url.d.ts

@@ -1,4 +1,4 @@
-import type { KumikoError } from "./kumiko-error.js";
+import type { KumikoError } from "./kumiko-error.ts";
 /** Links an app's own error reasons to its own docs; without it only framework reasons carry a docsUrl. */
 export type ErrorDocsConfig = {
     readonly baseUrl: string;