@cosmicdrift/kumiko-framework 0.369.0 → 0.371.0

package/dist/api/request-context.d.ts

@@ -1,6 +1,6 @@
 import { type WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
 import type { AgentRisk } from "@cosmicdrift/kumiko-types/handlers";
-import type { ErrorDocsConfig } from "../errors/docs-url.js";
+import type { ErrorDocsConfig } from "../errors/docs-url.ts";
 export type RequestContextData = {
     readonly requestId: string;
     readonly correlationId: string;

package/dist/api/request-id-middleware.d.ts

@@ -1,7 +1,7 @@
 import type { Context, Next } from "hono";
-import type { ErrorDocsConfig } from "../errors/docs-url.js";
-import { type ClientIpResolver } from "./client-ip.js";
-import { type RequestContextData } from "./request-context.js";
+import type { ErrorDocsConfig } from "../errors/docs-url.ts";
+import { type ClientIpResolver } from "./client-ip.ts";
+import { type RequestContextData } from "./request-context.ts";
 /**
  * Builds the RequestContextData record for a raw Fetch Request — requestId
  * (client-supplied + sanitized, or generated), correlationId (mirrors

package/dist/api/route-registrars.d.ts

@@ -1,8 +1,8 @@
 import { Hono, type MiddlewareHandler } from "hono";
-import type { DbConnection } from "../db/connection.js";
-import type { Lifecycle } from "../lifecycle/index.js";
-import type { Meter, PrometheusMeter } from "../observability/index.js";
-import type { EventConsumer } from "../pipeline/event-dispatcher.js";
+import type { DbConnection } from "../db/connection.ts";
+import type { Lifecycle } from "../lifecycle/index.ts";
+import type { Meter, PrometheusMeter } from "../observability/index.ts";
+import type { EventConsumer } from "../pipeline/event-dispatcher.ts";
 export declare const DEFAULT_MAX_REQUEST_BYTES = 1048576;
 export declare function registerBodyLimit(app: Hono, maxBytes: number): void;
 export declare function bodyLimitForRoutePath(path: string, maxBytes: number): readonly MiddlewareHandler[];

package/dist/api/routes.d.ts

@@ -1,5 +1,5 @@
 import { type Context, Hono } from "hono";
-import type { Dispatcher } from "../pipeline/dispatcher.js";
+import type { Dispatcher } from "../pipeline/dispatcher.ts";
 export declare const StreamFrame: {
     readonly chunk: "chunk";
     readonly ping: "ping";

package/dist/api/server.d.ts

@@ -1,21 +1,21 @@
 import type { CacheSyncBus } from "@cosmicdrift/kumiko-types/cache-sync-types";
 import { Hono } from "hono";
-import type { PgListenClient } from "../db/connection.js";
-import { type AppContext, type Registry, type RunIn, type WriteResult } from "../engine/types/index.js";
-import type { ErrorDocsConfig } from "../errors/docs-url.js";
-import type { Lifecycle } from "../lifecycle/index.js";
-import { type ObservabilityOptions, type ObservabilityProvider } from "../observability/index.js";
-import type { DispatcherOptions } from "../pipeline/dispatcher.js";
-import { type Dispatcher } from "../pipeline/dispatcher.js";
-import type { EventDedup } from "../pipeline/event-dedup.js";
-import type { EventDispatcher } from "../pipeline/event-dispatcher.js";
-import { type SystemHooks } from "../pipeline/lifecycle-pipeline.js";
-import { type AuthEndpointRateLimitOptions, type GlobalIpRateLimitOptions } from "../rate-limit/index.js";
-import { type AnonymousAccessResolved } from "./auth-middleware.js";
-import { type AuthRoutesConfig } from "./auth-routes.js";
-import { type ExtraRouteDefinition, type RoleDispatchArgs, type SystemDispatchArgs } from "./extra-route.js";
-import { type JwtHelper, type JwtKeyring } from "./jwt.js";
-import type { SseBroker } from "./sse-broker.js";
+import type { PgListenClient } from "../db/connection.ts";
+import { type AppContext, type Registry, type RunIn, type WriteResult } from "../engine/types/index.ts";
+import type { ErrorDocsConfig } from "../errors/docs-url.ts";
+import type { Lifecycle } from "../lifecycle/index.ts";
+import { type ObservabilityOptions, type ObservabilityProvider } from "../observability/index.ts";
+import type { DispatcherOptions } from "../pipeline/dispatcher.ts";
+import { type Dispatcher } from "../pipeline/dispatcher.ts";
+import type { EventDedup } from "../pipeline/event-dedup.ts";
+import type { EventDispatcher } from "../pipeline/event-dispatcher.ts";
+import { type SystemHooks } from "../pipeline/lifecycle-pipeline.ts";
+import { type AuthEndpointRateLimitOptions, type GlobalIpRateLimitOptions } from "../rate-limit/index.ts";
+import { type AnonymousAccessResolved } from "./auth-middleware.ts";
+import { type AuthRoutesConfig } from "./auth-routes.ts";
+import { type ExtraRouteDefinition, type RoleDispatchArgs, type SystemDispatchArgs } from "./extra-route.ts";
+import { type JwtHelper, type JwtKeyring } from "./jwt.ts";
+import type { SseBroker } from "./sse-broker.ts";
 export type ServerOptions = {
     registry: Registry;
     context: AppContext;

package/dist/api/sse-broker.d.ts

@@ -1,4 +1,4 @@
-import type { SessionUser } from "../engine/types/index.js";
+import type { SessionUser } from "../engine/types/index.ts";
 export type SseClient = {
     id: string;
     send: (event: SseEvent) => void;

package/dist/api/sse-route.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { type SseBroker } from "./sse-broker.js";
+import { type SseBroker } from "./sse-broker.ts";
 /**
  * Heartbeat-Cadence für SSE-Streams.
  *

package/dist/api/websocket-route.d.ts

@@ -1,7 +1,7 @@
 import { WEBSOCKET_BACKPRESSURE_LIMIT_BYTES, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_ROUTE_PATH_PREFIX, type WebSocketMessageData, type WebSocketSessionHandlers } from "@cosmicdrift/kumiko-types/websocket-route";
-import type { SessionUser } from "../engine/types/index.js";
-import { type AuthSessionChecker, type TenantLifecycleStatusResolver } from "./auth-middleware.js";
-import { type RequestContextData } from "./request-context.js";
+import type { SessionUser } from "../engine/types/index.ts";
+import { type AuthSessionChecker, type TenantLifecycleStatusResolver } from "./auth-middleware.ts";
+import { type RequestContextData } from "./request-context.ts";
 export { WEBSOCKET_BACKPRESSURE_LIMIT_BYTES, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_ROUTE_PATH_PREFIX, };
 export declare const WEBSOCKET_HEARTBEAT_INTERVAL_MS = 25000;
 export declare const WEBSOCKET_PENDING_BUFFER_LIMIT_BYTES: number;

package/dist/auth/index.d.ts

@@ -1,2 +1,2 @@
-export type { Role } from "./roles.js";
-export { ROLES } from "./roles.js";
+export type { Role } from "./roles.ts";
+export { ROLES } from "./roles.ts";

package/dist/compliance/duration-spec.d.ts

@@ -1,5 +1,5 @@
-import { getTemporal } from "../time/index.js";
-import type { DurationSpec, RetentionSpec } from "./profiles.js";
+import { getTemporal } from "../time/index.ts";
+import type { DurationSpec, RetentionSpec } from "./profiles.ts";
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 export declare function durationSpecToMs(spec: DurationSpec): number;
 export declare function addDurationSpec(now: Instant, spec: DurationSpec): Instant;

package/dist/compliance/index.d.ts

@@ -1,6 +1,6 @@
-export { addDurationSpec, describeDurationSpec, durationSpecToMs, subtractRetentionSpec, } from "./duration-spec.js";
-export { complianceProfileOverrideSchema } from "./override-schema.js";
-export type { AuthorityNotificationDeadline, ComplianceProfile, ComplianceProfileKey, ComplianceProfileOverride, DurationSpec, EffectiveComplianceProfile, RetentionSpec, UserNotificationRequiredPolicy, } from "./profiles.js";
-export { COMPLIANCE_PROFILES, OVERRIDABLE_PROFILE_KEYS, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.js";
-export type { BundleTier, SubProcessor } from "./sub-processors.js";
-export { getActiveSubProcessors, getPlannedSubProcessors, KUMIKO_SUB_PROCESSORS, } from "./sub-processors.js";
+export { addDurationSpec, describeDurationSpec, durationSpecToMs, subtractRetentionSpec, } from "./duration-spec.ts";
+export { complianceProfileOverrideSchema } from "./override-schema.ts";
+export type { AuthorityNotificationDeadline, ComplianceProfile, ComplianceProfileKey, ComplianceProfileOverride, DurationSpec, EffectiveComplianceProfile, RetentionSpec, UserNotificationRequiredPolicy, } from "./profiles.ts";
+export { COMPLIANCE_PROFILES, OVERRIDABLE_PROFILE_KEYS, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.ts";
+export type { BundleTier, SubProcessor } from "./sub-processors.ts";
+export { getActiveSubProcessors, getPlannedSubProcessors, KUMIKO_SUB_PROCESSORS, } from "./sub-processors.ts";

package/dist/compliance/profiles.d.ts

@@ -1,4 +1,4 @@
-import type { BundleTier } from "./sub-processors.js";
+import type { BundleTier } from "./sub-processors.ts";
 export type ComplianceProfileKey = "eu-dsgvo" | "swiss-dsg" | "de-hr-dsgvo-hgb" | "minimal-no-region";
 export type DurationSpec = {
     readonly days: number;

package/dist/config/index.d.ts

@@ -0,0 +1,44 @@
+import type { FeatureDefinition } from "../engine/types/index.ts";
+export type AppInfraPorts = {
+    readonly postgres?: number;
+    readonly redis?: number;
+    readonly meilisearch?: number;
+    /** S3 mock (MinIO) used by integration and E2E runs. */
+    readonly s3?: number;
+};
+export type AppPorts = {
+    /** `bun run dev` listens here. */
+    readonly dev: number;
+    /** The E2E server (playwright.config.ts webServer) listens here. */
+    readonly e2e: number;
+    /** Local infrastructure of this app. One port per app, so parallel E2E runs
+     *  of several apps never share a Meilisearch or Postgres. */
+    readonly infra?: AppInfraPorts;
+};
+export type AppClientConfig = {
+    /** Client bundle entry files, relative to the app root (e.g. "src/client.tsx"). */
+    readonly entries: readonly string[];
+};
+export type AppConfig = {
+    /** Features mounted in every environment: dev, tests, prod. */
+    readonly features: readonly FeatureDefinition[];
+    /** Features mounted only in production on top of `features`. */
+    readonly prodFeatures?: readonly FeatureDefinition[];
+    readonly client: AppClientConfig;
+    readonly ports: AppPorts;
+};
+export declare const APP_CONFIG_FILE = "kumiko.config.ts";
+declare const INFRA_PORT_NAMES: readonly ["postgres", "redis", "meilisearch", "s3"];
+export type AppPortRole = "dev" | "e2e" | (typeof INFRA_PORT_NAMES)[number];
+export type AppPortEntry = {
+    readonly role: AppPortRole;
+    readonly port: number;
+};
+/** Every port the app claims, in a stable order. */
+export declare function listAppPorts(ports: AppPorts): readonly AppPortEntry[];
+/** Problems with the declared ports: out of range or claimed twice by this app. */
+export declare function findAppPortProblems(ports: AppPorts): readonly string[];
+export declare function defineAppConfig(config: AppConfig): AppConfig;
+/** The full feature list prod boots with: `features` plus `prodFeatures`. */
+export declare function allAppFeatures(config: Pick<AppConfig, "features" | "prodFeatures">): readonly FeatureDefinition[];
+export {};

package/dist/config/index.js

@@ -0,0 +1,61 @@
+export const APP_CONFIG_FILE = "kumiko.config.ts";
+const INFRA_PORT_NAMES = [
+    "postgres",
+    "redis",
+    "meilisearch",
+    "s3",
+];
+/** Every port the app claims, in a stable order. */
+export function listAppPorts(ports) {
+    const entries = [
+        { role: "dev", port: ports.dev },
+        { role: "e2e", port: ports.e2e },
+    ];
+    for (const role of INFRA_PORT_NAMES) {
+        const port = ports.infra?.[role];
+        if (port !== undefined)
+            entries.push({ role, port });
+    }
+    return entries;
+}
+function isValidPort(port) {
+    return Number.isInteger(port) && port >= 1 && port <= 65535;
+}
+/** Problems with the declared ports: out of range or claimed twice by this app. */
+export function findAppPortProblems(ports) {
+    const problems = [];
+    const owners = new Map();
+    for (const { role, port } of listAppPorts(ports)) {
+        if (!isValidPort(port)) {
+            problems.push(`ports.${role} must be an integer in 1..65535, got ${port}`);
+            continue;
+        }
+        const owner = owners.get(port);
+        if (owner !== undefined)
+            problems.push(`ports.${role} reuses port ${port} of ports.${owner}`);
+        else
+            owners.set(port, role);
+    }
+    return problems;
+}
+// Entries end up in the server's bundle list and in generated files, so only
+// plain relative paths inside the app are accepted.
+const CLIENT_ENTRY_RE = /^(?!\/)(?!.*\.\.)[A-Za-z0-9_./-]+\.(ts|tsx)$/;
+export function defineAppConfig(config) {
+    const problems = [...findAppPortProblems(config.ports)];
+    if (config.client.entries.length === 0)
+        problems.push("client.entries must name at least one entry");
+    for (const entry of config.client.entries) {
+        if (!CLIENT_ENTRY_RE.test(entry)) {
+            problems.push(`client.entries: "${entry}" must be a relative .ts/.tsx path inside the app`);
+        }
+    }
+    if (problems.length > 0) {
+        throw new Error(`defineAppConfig: ${problems.join("; ")}`);
+    }
+    return config;
+}
+/** The full feature list prod boots with: `features` plus `prodFeatures`. */
+export function allAppFeatures(config) {
+    return [...config.features, ...(config.prodFeatures ?? [])];
+}

package/dist/crypto/blind-index.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "../engine/types/fields.js";
+import type { EntityDefinition } from "../engine/types/fields.ts";
 export declare function computeBlindIndex(key: Uint8Array, plaintext: string): string;
 export declare function decodeBlindIndexKey(base64Key: string): Uint8Array;
 export declare function configureBlindIndexKey(base64Key: string | undefined): void;

package/dist/crypto/event-pii.d.ts

@@ -1,5 +1,5 @@
 import type { EventPiiFields } from "@cosmicdrift/kumiko-types/handlers";
-import { type EventSubjectEnvelope } from "./subject-resolver.js";
+import { type EventSubjectEnvelope } from "./subject-resolver.ts";
 export type EventPiiCatalog = ReadonlyMap<string, EventPiiFields>;
 export declare function configureEventPiiCatalog(next: EventPiiCatalog): void;
 export declare function configuredEventPiiCatalog(): EventPiiCatalog;

package/dist/crypto/in-memory-kms-adapter.d.ts

@@ -1,4 +1,4 @@
-import { type KmsHealth, type LocalKeyKmsAdapter, type SubjectDek, type SubjectId } from "./kms-adapter.js";
+import { type KmsHealth, type LocalKeyKmsAdapter, type SubjectDek, type SubjectId } from "./kms-adapter.ts";
 export declare class InMemoryKmsAdapter implements LocalKeyKmsAdapter {
     readonly capabilities: {
         readonly mode: "local-key";

package/dist/crypto/index.d.ts

@@ -1,11 +1,11 @@
-export { blindIndexFieldName, collectLookupableFields, computeBlindIndex, computeBlindIndexValues, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.js";
-export { configuredEventPiiCatalog, configureEventPiiCatalog, type EventPiiCatalog, encryptEventPayloadPii, } from "./event-pii.js";
-export { InMemoryKmsAdapter } from "./in-memory-kms-adapter.js";
-export { isSelfPiiField } from "./is-self-pii-field.js";
-export { type KekSourceEnv, type KekSourceOptions, resolvePlatformKeks } from "./kek-source.js";
-export { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, type KmsAdapter, type KmsContext, type KmsHealth, type LocalKeyKmsAdapter, RECORD_ENTITY_PATTERN, type RemoteCryptoKmsAdapter, type SubjectDek, type SubjectId, type SubjectKey, subjectIdFromKey, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForTenant, subjectKeyForUser, } from "./kms-adapter.js";
-export { type ActiveKmsWiring, buildPgKmsOptions, type KmsWiring, type KmsWiringEnv, type KmsWiringOptions, type KmsWiringRelease, type PgKmsRotationEnv, type PlaintextPiiWiring, requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.js";
-export { createPgKmsAdapter, PgKmsAdapter, type PgKmsAdapterOptions, type RewrapOptions, type RewrapResult, rewrapSubjectKeys, } from "./pg-kms-adapter.js";
-export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, type EncryptPiiOptions, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
-export { createRequestKmsCache, type RequestKmsCache, } from "./request-kms-cache.js";
-export { collectPiiEncryptedFields, collectPiiSubjectFields, collectSearchableSubjectFields, isRecordKeyedField, type ResolveSubjectOptions, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";
+export { blindIndexFieldName, collectLookupableFields, computeBlindIndex, computeBlindIndexValues, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.ts";
+export { configuredEventPiiCatalog, configureEventPiiCatalog, type EventPiiCatalog, encryptEventPayloadPii, } from "./event-pii.ts";
+export { InMemoryKmsAdapter } from "./in-memory-kms-adapter.ts";
+export { isSelfPiiField } from "./is-self-pii-field.ts";
+export { type KekSourceEnv, type KekSourceOptions, resolvePlatformKeks } from "./kek-source.ts";
+export { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, type KmsAdapter, type KmsContext, type KmsHealth, type LocalKeyKmsAdapter, RECORD_ENTITY_PATTERN, type RemoteCryptoKmsAdapter, type SubjectDek, type SubjectId, type SubjectKey, subjectIdFromKey, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForTenant, subjectKeyForUser, } from "./kms-adapter.ts";
+export { type ActiveKmsWiring, buildPgKmsOptions, type KmsWiring, type KmsWiringEnv, type KmsWiringOptions, type KmsWiringRelease, type PgKmsRotationEnv, type PlaintextPiiWiring, requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.ts";
+export { createPgKmsAdapter, PgKmsAdapter, type PgKmsAdapterOptions, type RewrapOptions, type RewrapResult, rewrapSubjectKeys, } from "./pg-kms-adapter.ts";
+export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, type EncryptPiiOptions, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL, } from "./pii-field-encryption.ts";
+export { createRequestKmsCache, type RequestKmsCache, } from "./request-kms-cache.ts";
+export { collectPiiEncryptedFields, collectPiiSubjectFields, collectSearchableSubjectFields, isRecordKeyedField, type ResolveSubjectOptions, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.ts";

package/dist/crypto/is-self-pii-field.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "../engine/types/fields.js";
+import type { EntityDefinition } from "../engine/types/fields.ts";
 type AnyField = EntityDefinition["fields"][string];
 /** True when the field's own row id is the PII subject (`pii: true`). */
 export declare function isSelfPiiField(field: AnyField): boolean;

package/dist/crypto/kms-wiring.d.ts

@@ -1,5 +1,5 @@
-import { type KekSourceOptions } from "./kek-source.js";
-import { type PgKmsAdapter, type PgKmsAdapterOptions } from "./pg-kms-adapter.js";
+import { type KekSourceOptions } from "./kek-source.ts";
+import { type PgKmsAdapter, type PgKmsAdapterOptions } from "./pg-kms-adapter.ts";
 export type KmsWiringEnv = {
     readonly PLATFORM_KEK?: string | undefined;
     readonly SUBJECT_KEYS_DATABASE_URL?: string | undefined;

package/dist/crypto/owner-transition-rekey.d.ts

@@ -1,3 +1,3 @@
-import type { EntityDefinition } from "../engine/types/fields.js";
+import type { EntityDefinition } from "../engine/types/fields.ts";
 export declare function isPlainUserOwnedField(field: EntityDefinition["fields"][string]): boolean;
 export declare function personalFieldsRekeyedOnOwnerTransition(entity: EntityDefinition, previous: Record<string, unknown>, mergedNew: Record<string, unknown>, submittedChanges: Record<string, unknown>): Record<string, unknown>;

package/dist/crypto/pg-kms-adapter.d.ts

@@ -1,4 +1,4 @@
-import { type KmsContext, type KmsHealth, type LocalKeyKmsAdapter, type SubjectDek, type SubjectId } from "./kms-adapter.js";
+import { type KmsContext, type KmsHealth, type LocalKeyKmsAdapter, type SubjectDek, type SubjectId } from "./kms-adapter.ts";
 export interface PgKmsAdapterOptions {
     /** Connection string of the DEDICATED subject-keys cluster — never the app DB (its backup retention must stay shorter, see kms-adapter.md). */
     readonly databaseUrl: string;

package/dist/crypto/pii-field-encryption.d.ts

@@ -1,7 +1,7 @@
-import type { EntityDefinition } from "../engine/types/fields.js";
-import type { TenantId } from "../engine/types/identifiers.js";
-import { type KmsAdapter, type KmsContext, type LocalKeyKmsAdapter, PII_ERASED_SENTINEL, type SubjectId } from "./kms-adapter.js";
-import { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON } from "./pii-ciphertext-format.js";
+import type { EntityDefinition } from "../engine/types/fields.ts";
+import type { TenantId } from "../engine/types/identifiers.ts";
+import { type KmsAdapter, type KmsContext, type LocalKeyKmsAdapter, PII_ERASED_SENTINEL, type SubjectId } from "./kms-adapter.ts";
+import { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON } from "./pii-ciphertext-format.ts";
 export { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL };
 export declare function piiCiphertextSubject(value: string): SubjectId;
 export declare function encryptPiiValueForSubject(kms: LocalKeyKmsAdapter, subject: SubjectId, value: string, kmsCtx: KmsContext, field: string): Promise<string>;

package/dist/crypto/request-kms-cache.d.ts

@@ -1,4 +1,4 @@
-import type { KmsContext, LocalKeyKmsAdapter, SubjectDek, SubjectId } from "./kms-adapter.js";
+import type { KmsContext, LocalKeyKmsAdapter, SubjectDek, SubjectId } from "./kms-adapter.ts";
 export interface RequestKmsCache {
     getKey(subject: SubjectId, ctx: KmsContext): Promise<SubjectDek>;
     /** Drops one subject's cached DEK — called when its key is shredded mid-request. */

package/dist/crypto/subject-resolver.d.ts

@@ -1,7 +1,7 @@
 import { type EventPiiSubject } from "@cosmicdrift/kumiko-types/handlers";
-import type { EntityDefinition } from "../engine/types/fields.js";
-import type { TenantId } from "../engine/types/identifiers.js";
-import { type SubjectId } from "./kms-adapter.js";
+import type { EntityDefinition } from "../engine/types/fields.ts";
+import type { TenantId } from "../engine/types/identifiers.ts";
+import { type SubjectId } from "./kms-adapter.ts";
 export declare class SubjectResolutionError extends Error {
     readonly fieldName: string;
     constructor(fieldName: string, reason: string);

package/dist/db/apply-entity-event.d.ts

@@ -1,7 +1,7 @@
-import type { EntityDefinition } from "../engine/types/index.js";
-import type { StoredEvent } from "../event-store/index.js";
-import type { DbRow, DbRunner } from "./connection.js";
-import type { TableColumns } from "./dialect.js";
+import type { EntityDefinition } from "../engine/types/index.ts";
+import type { StoredEvent } from "../event-store/index.ts";
+import type { DbRow, DbRunner } from "./connection.ts";
+import type { TableColumns } from "./dialect.ts";
 type Table = TableColumns<any>;
 export type AutoVerb = "created" | "updated" | "deleted" | "restored" | "forgotten";
 export type ApplyResult = {

package/dist/db/assert-exists-in.d.ts

@@ -1,7 +1,7 @@
-import type { TenantId } from "../engine/types/identifiers.js";
-import { NotFoundError } from "../errors/index.js";
-import type { DbConnection } from "./connection.js";
-import type { TenantDb } from "./tenant-db.js";
+import type { TenantId } from "../engine/types/identifiers.ts";
+import { NotFoundError } from "../errors/index.ts";
+import type { DbConnection } from "./connection.ts";
+import type { TenantDb } from "./tenant-db.ts";
 /**
  * Generic constraint helper: asserts a value exists in a table.
  * Returns a ready-to-return NotFoundError when the row is missing, or null

package/dist/db/blind-index-cleanup.d.ts

@@ -1,5 +1,5 @@
-import type { FeatureDefinition } from "../engine/types/index.js";
-import type { DbRunner } from "./connection.js";
+import type { FeatureDefinition } from "../engine/types/index.ts";
+import type { DbRunner } from "./connection.ts";
 export declare function nullBlindIndexesForSubject(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, subjectKey: string): Promise<void>;
 export declare function subjectRowExistsInTenant(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, subjectId: string, tenantId: string): Promise<boolean>;
 export declare function recordRowExistsInTenant(db: DbRunner, features: ReadonlyMap<string, FeatureDefinition>, entityName: string, recordId: string, tenantId: string): Promise<boolean>;

package/dist/db/collect-table-metas.d.ts

@@ -1,3 +1,3 @@
-import type { FeatureDefinition } from "../engine/types/index.js";
-import { type EntityTableMeta } from "./entity-table-meta.js";
+import type { FeatureDefinition } from "../engine/types/index.ts";
+import { type EntityTableMeta } from "./entity-table-meta.ts";
 export declare function collectTableMetas(features: readonly FeatureDefinition[]): readonly EntityTableMeta[];

package/dist/db/compound-types.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "../engine/types/index.js";
+import type { EntityDefinition } from "../engine/types/index.ts";
 /**
  * API-Form (combined) → DB-Form (flat). Wird vor jedem Insert/Update aufgerufen.
  */

package/dist/db/config-seed.d.ts

@@ -1,8 +1,8 @@
-import type { EntityDefinition } from "../engine/index.js";
-import type { ConfigSeedDef, Registry } from "../engine/types/index.js";
-import type { EnvelopeCipher } from "../secrets/envelope-cipher.js";
-import type { DbConnection } from "./connection.js";
-import type { EntityTable } from "./table-builder.js";
+import type { EntityDefinition } from "../engine/index.ts";
+import type { ConfigSeedDef, Registry } from "../engine/types/index.ts";
+import type { EnvelopeCipher } from "../secrets/envelope-cipher.ts";
+import type { DbConnection } from "./connection.ts";
+import type { EntityTable } from "./table-builder.ts";
 /**
  * Seed config values at boot time via the event-store executor.
  *

package/dist/db/connection.d.ts

@@ -19,12 +19,7 @@ export type DbConnectionHandle = {
     close: () => Promise<void>;
 };
 export declare const DEFAULT_DB_CLOSE_TIMEOUT_SECONDS = 5;
-export declare function createDbConnection(options: CreateDbConnectionOptions): DbConnectionHandle;
-/**
- * @deprecated Positional form, use `createDbConnection({ url, ... })`. Run
- * `bun kumiko-upgrade --apply` to rewrite call sites. Removed in the first release after 2026-10-29.
- */
-export declare function createDbConnection(url: string, options?: DbConnectionOptions): DbConnectionHandle;
+export declare function createDbConnection({ url, ...options }: CreateDbConnectionOptions): DbConnectionHandle;
 export declare function dbConnectionOptionsFromEnv(env?: Readonly<Record<string, string | undefined>>): DbConnectionOptions;
 export declare const DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX = 3;
 export declare function outsideTransactionPoolOptionsFromEnv(env?: Readonly<Record<string, string | undefined>>): DbConnectionOptions;

package/dist/db/connection.js

@@ -4,13 +4,13 @@ import { readPositiveIntEnv } from "../utils/env-parse.js";
 // so a plain end() (no timeout = wait for queries to finish) hangs forever —
 // close() must always bound how long shutdown waits.
 export const DEFAULT_DB_CLOSE_TIMEOUT_SECONDS = 5;
-export function createDbConnection(urlOrOptions, legacyOptions = {}) {
-    const { url, ...options } = typeof urlOrOptions === "string" ? { ...legacyOptions, url: urlOrOptions } : urlOrOptions;
+export function createDbConnection({ url, ...options }) {
     const pgOptions = {};
     if (options.maxConnections !== undefined)
         pgOptions.max = options.maxConnections;
-    if (options.idleTimeoutSeconds !== undefined)
+    if (options.idleTimeoutSeconds !== undefined) {
         pgOptions.idle_timeout = options.idleTimeoutSeconds;
+    }
     if (options.connectTimeoutSeconds !== undefined) {
         pgOptions.connect_timeout = options.connectTimeoutSeconds;
     }
@@ -22,10 +22,21 @@ export function createDbConnection(urlOrOptions, legacyOptions = {}) {
     return {
         db: client,
         client,
-        close: () => client.end({ timeout: options.closeTimeoutSeconds ?? DEFAULT_DB_CLOSE_TIMEOUT_SECONDS }),
+        close: () => client.end({
+            timeout: options.closeTimeoutSeconds ?? DEFAULT_DB_CLOSE_TIMEOUT_SECONDS,
+        }),
     };
 }
+// DB_PROVIDER=bun selected the removed Bun.SQL driver; ignoring it would boot
+// postgres-js under a config that still claims Bun.SQL.
+function assertNoRemovedDbProvider(env) {
+    const provider = env["DB_PROVIDER"];
+    if (provider !== undefined && provider !== "" && provider !== "postgres") {
+        throw new Error(`DB_PROVIDER="${provider}" is no longer supported: postgres-js is the only driver. Remove DB_PROVIDER from the environment.`);
+    }
+}
 export function dbConnectionOptionsFromEnv(env = process.env) {
+    assertNoRemovedDbProvider(env);
     const opts = {};
     const max = readPositiveIntEnv(env, "DATABASE_POOL_MAX");
     const idle = readPositiveIntEnv(env, "DATABASE_POOL_IDLE_TIMEOUT");

package/dist/db/dialect.d.ts

@@ -1,6 +1,6 @@
 import { type ColumnHandle, type SchemaTable } from "@cosmicdrift/kumiko-types/schema-table-types";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import type { PgType } from "./entity-table-meta.js";
+import type { PgType } from "./entity-table-meta.ts";
 export type { ColumnHandle, SchemaTable } from "@cosmicdrift/kumiko-types/schema-table-types";
 export type TableColumns<_T = any> = SchemaTable;
 export type SelectQuery = any;

package/dist/db/eagerload.d.ts

@@ -1,6 +1,6 @@
-import type { EntityDefinition, SessionUser } from "../engine/types/index.js";
-import { type ParentVisibilityOption } from "./parent-ref-clause.js";
-import type { TenantDb } from "./tenant-db.js";
+import type { EntityDefinition, SessionUser } from "../engine/types/index.ts";
+import { type ParentVisibilityOption } from "./parent-ref-clause.ts";
+import type { TenantDb } from "./tenant-db.ts";
 export type EagerLoadEntityResolver = (entityName: string) => EntityDefinition | undefined;
 export type EagerloadedRow<T extends Record<string, unknown> = Record<string, unknown>> = T & {
     readonly _refs?: Readonly<Record<string, Record<string, unknown> | ReadonlyArray<Record<string, unknown>> | undefined>>;

package/dist/db/entity-field-encryption.d.ts

@@ -1,6 +1,6 @@
-import type { EntityDefinition } from "../engine/types/index.js";
-import { type Logger } from "../logging/index.js";
-import type { EnvelopeCipher } from "../secrets/envelope-cipher.js";
+import type { EntityDefinition } from "../engine/types/index.ts";
+import { type Logger } from "../logging/index.ts";
+import type { EnvelopeCipher } from "../secrets/envelope-cipher.ts";
 export declare function collectEncryptedFieldNames(entity: EntityDefinition): ReadonlySet<string>;
 export declare function isSensitiveLabelField(entity: EntityDefinition, field: string): boolean;
 export declare function isListFilterAllowed(entity: EntityDefinition, field: string, filter: {

package/dist/db/entity-field-encryption.js

@@ -170,12 +170,14 @@ export function validateEntityFieldEncryptionAvailable(env = process.env, bootCi
     if (bootCipher ?? injectedCipher)
         return;
     try {
+        // currentVersion() forces the keyring check: under KUMIKO_DRY_RUN_ENV the
+        // provider defers it past construction.
         createEnvMasterKeyProvider({
             env: {
                 ...env,
                 KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: env["KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION"] ?? "1",
             },
-        });
+        }).currentVersion();
     }
     catch (err) {
         const reason = err instanceof Error ? err.message : String(err);

package/dist/db/entity-table-from-registry.d.ts

@@ -1,4 +1,4 @@
-import type { Registry } from "../engine/index.js";
-import type { SchemaTable } from "./dialect.js";
-import { buildEntityTable } from "./table-builder.js";
+import type { Registry } from "../engine/index.ts";
+import type { SchemaTable } from "./dialect.ts";
+import { buildEntityTable } from "./table-builder.ts";
 export declare function entityTableFromRegistry(registry: Registry, entityName: string, entity: Parameters<typeof buildEntityTable>[1]): SchemaTable;

package/dist/db/entity-table-meta.d.ts

@@ -1,7 +1,7 @@
 import type { EntityTenancy, TenancyBrand } from "@cosmicdrift/kumiko-types/tenancy-brand";
-import type { EntityDefinition } from "../engine/types/index.js";
-import type { BuildEntityTableMetaOptions, EntityTableMeta, UnmanagedTableInput } from "./entity-table-meta-types.js";
-export type { BuildEntityTableMetaOptions, ColumnMeta, CompositePrimaryKeyMeta, EntityTableMeta, IndexMeta, PgType, UnmanagedTableInput, } from "./entity-table-meta-types.js";
+import type { EntityDefinition } from "../engine/types/index.ts";
+import type { BuildEntityTableMetaOptions, EntityTableMeta, UnmanagedTableInput } from "./entity-table-meta-types.ts";
+export type { BuildEntityTableMetaOptions, ColumnMeta, CompositePrimaryKeyMeta, EntityTableMeta, IndexMeta, PgType, UnmanagedTableInput, } from "./entity-table-meta-types.ts";
 export declare function resolveTableName(entityName: string, entity: EntityDefinition, featureName: string | undefined): string;
 /**
  * Derive EntityTableMeta from an EntityDefinition (base columns + field DDL).

package/dist/db/event-store-executor-context.d.ts

@@ -1,12 +1,12 @@
-import type { WhereObject } from "../db/query.js";
-import type { EntityDefinition, EntityId, SessionUser, TenantId } from "../engine/types/index.js";
-import { type WriteFailure } from "../errors/index.js";
-import { type EventMetadata } from "../event-store/index.js";
-import type { EntityCache } from "../pipeline/entity-cache.js";
-import type { SearchAdapter } from "../search/types.js";
-import type { TableColumns } from "./dialect.js";
-import type { EventStoreExecutorOptions } from "./event-store-executor.js";
-import type { TenantDb } from "./tenant-db.js";
+import type { WhereObject } from "../db/query.ts";
+import type { EntityDefinition, EntityId, SessionUser, TenantId } from "../engine/types/index.ts";
+import { type WriteFailure } from "../errors/index.ts";
+import { type EventMetadata } from "../event-store/index.ts";
+import type { EntityCache } from "../pipeline/entity-cache.ts";
+import type { SearchAdapter } from "../search/types.ts";
+import type { TableColumns } from "./dialect.ts";
+import type { EventStoreExecutorOptions } from "./event-store-executor.ts";
+import type { TenantDb } from "./tenant-db.ts";
 export type Table = TableColumns<any>;
 export declare function buildFilterWhere(field: string, op: "eq" | "ne" | "lt" | "gt" | "lte" | "gte" | "in", value: unknown): WhereObject | null;
 export declare function ownershipSubject(user: SessionUser, streamTenantId: TenantId | undefined): SessionUser;

package/dist/db/event-store-executor-read.d.ts

@@ -1,5 +1,5 @@
-import type { EventStoreExecutor } from "./event-store-executor.js";
-import { type ExecutorContext } from "./event-store-executor-context.js";
+import type { EventStoreExecutor } from "./event-store-executor.ts";
+import { type ExecutorContext } from "./event-store-executor-context.ts";
 export declare function resolveListPagination(payload: {
     readonly limit?: unknown;
     readonly offset?: unknown;

package/dist/db/event-store-executor-write.d.ts

@@ -1,3 +1,3 @@
-import { type EventStoreExecutor } from "./event-store-executor.js";
-import { type ExecutorContext } from "./event-store-executor-context.js";
+import { type EventStoreExecutor } from "./event-store-executor.ts";
+import { type ExecutorContext } from "./event-store-executor-context.ts";
 export declare function createWriteVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor, "create" | "update" | "delete" | "forget" | "restore">;