@cosmicdrift/kumiko-framework 0.374.0 → 0.377.0

package/dist/db/tenant-db.d.ts

@@ -36,6 +36,13 @@ export declare function acknowledgeConventionCrossTenant(tenantDb: TenantDb, rea
     readonly deferReport?: boolean;
 }): TenantDb;
 export declare function reportConventionCrossTenantUse(acknowledged: TenantDb, target?: EscapeHatchTarget): void;
+export type OutsideTransactionContext = {
+    readonly dbOutsideTransaction: TenantDb | undefined;
+};
+export declare function hasOutsideTransactionDb(ctx: OutsideTransactionContext): ctx is OutsideTransactionContext & {
+    readonly dbOutsideTransaction: TenantDb;
+};
+export declare function requireOutsideTransactionDb(ctx: OutsideTransactionContext): TenantDb;
 export declare function runInOwnTransaction<T>(tenantDb: TenantDb, fn: (txDb: TenantDb) => Promise<T>): Promise<T>;
 export type CreateTenantDbOptions = {
     readonly db: DbRunner;

package/dist/db/tenant-db.js

@@ -103,7 +103,7 @@ function buildUncheckedSystemDb(db, dbOutsideTransaction, report, gate) {
     // AccessDeniedError) because this is a dispatch wiring fault, not a
     // tenant-access denial — mirrors the "no database connection configured"
     // case in dispatch-shared.ts's appendDomainEvent.
-    function requireOutsideTransactionDb() {
+    function requireSystemOutsideTransactionDb() {
         if (!dbOutsideTransaction) {
             throw new InternalError({
                 message: "systemScope() outsideTransaction check failed: no outside-transaction database " +
@@ -173,13 +173,13 @@ function buildUncheckedSystemDb(db, dbOutsideTransaction, report, gate) {
                         message: `systemScope() outsideTransaction tenant self-check failed: expected "${db.tenantId}", got "${tenantId}"`,
                     });
                 }
-                return requireOutsideTransactionDb();
+                return requireSystemOutsideTransactionDb();
             },
             acknowledgeCrossTenant(reason) {
                 if (reason.trim().length === 0) {
                     throw new Error("acknowledgeCrossTenant requires a non-empty reason");
                 }
-                const result = requireOutsideTransactionDb();
+                const result = requireSystemOutsideTransactionDb();
                 report("acknowledge-cross-tenant", reason);
                 return result;
             },
@@ -301,12 +301,24 @@ export function reportConventionCrossTenantUse(acknowledged, target) {
     reporter(target);
 }
 const ownTransactionRebinders = new WeakMap();
+export function hasOutsideTransactionDb(ctx) {
+    return ctx.dbOutsideTransaction !== undefined;
+}
+export function requireOutsideTransactionDb(ctx) {
+    if (!hasOutsideTransactionDb(ctx)) {
+        throw new InternalError({
+            message: "ctx.dbOutsideTransaction is not available in this dispatch phase (member-resolution, before-transaction denial) or metering tenant mode.",
+        });
+    }
+    return ctx.dbOutsideTransaction;
+}
 export async function runInOwnTransaction(tenantDb, fn) {
     const rebind = ownTransactionRebinders.get(tenantDb);
     if (!rebind) {
         throw new InternalError({
-            message: "runInOwnTransaction received a TenantDb not built by createTenantDb — " +
-                "no transaction rebinder bound.",
+            message: "runInOwnTransaction received a TenantDb without a transaction rebinder: either it was not " +
+                "built by createTenantDb, or it is the fail-closed ctx.db/ctx.dbOutsideTransaction of an " +
+                "r.systemScope() handler (use ctx.systemDb.outsideTransaction there).",
         });
     }
     return rebind(fn);

package/dist/engine/boot-validator/screens.js

@@ -319,7 +319,7 @@ function validateWizardLayout(featureName, screenId, screenType, layout, feature
 // typed IconKey, a closed union — but that only protects call sites this
 // repo's own `tsc --build` actually covers (samples and external consumers
 // aren't in that project graph). The renderer's actionIconFor
-// (renderer-web/src/primitives/index.tsx) already falls back to "no icon"
+// (renderer/src/web/primitives/index.tsx) already falls back to "no icon"
 // for an unregistered key instead of crashing — this check makes the same
 // gap fail loudly at boot instead of silently at render.
 function isRegisteredIcon(icon) {
@@ -909,6 +909,12 @@ function validateInlineFormNavTargets(feature, screenId, screen, kind, lookups)
     if (screen.redirect !== undefined) {
         validateRedirectTarget(feature, screenId, kind, screen.redirect, lookups);
     }
+    if (screen.type === "actionForm" &&
+        screen.successFacts !== undefined &&
+        screen.redirect !== undefined) {
+        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (actionForm) sets both redirect and successFacts — ` +
+            `redirect leaves the screen, successFacts are shown on it. Use one of them.`);
+    }
     if (screen.type === "actionForm" && screen.successLinks !== undefined) {
         if (screen.redirect !== undefined) {
             throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (actionForm) sets both redirect and successLinks — ` +

package/dist/engine/index.d.ts

@@ -57,6 +57,7 @@ export { parseRefTarget, parseRefTargetEntityName } from "./parse-ref-target.ts"
 export { buildPipelineSteps, stepsPipeline } from "./pipeline.ts";
 export { projectAppSchemaForRoles } from "./project-app-schema-for-roles.ts";
 export { defineApply, defineMspApply, setFields } from "./projection-helpers.ts";
+export { providerPluginContextFromHandler, providerPluginContextFromJob, } from "./provider-plugin-context.ts";
 export type { BuiltinQnType, ParsedQn, QnType } from "./qualified-name.ts";
 export { isValidQn, parseQn, QnTypes, qn, toKebab } from "./qualified-name.ts";
 export { readClaim } from "./read-claim.ts";
@@ -84,7 +85,7 @@ export { assertNotificationVariables, templateVariable, templateVariablesToZod,
 export { type EffectiveFeaturesResolver, findTierResolverUsage, isTierResolverPlugin, requireTierResolverPlugin, TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin, type TrialGate, } from "./tier-resolver-extension.ts";
 export { findOverDeepTransferChain, resolveTransferAdjacency as resolveEntityTransferAdjacency, type TransferAdjacency, type TransferEdge, type TransferEdgeLink, } from "./transfer-adjacency.ts";
 export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID } from "./types/identifiers.ts";
-export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BootOptionName, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityObjectDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookDefinition, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StackBootRequirement, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.ts";
+export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BootOptionName, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityObjectDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookDefinition, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, ProviderPluginContext, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StackBootRequirement, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.ts";
 export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HookPhases, HTTP_ERROR_CODE_PATTERN, isAgentVisibleScreen, isDeliveryErrorCode, isOpenToAllGranted, resolveAgentExposure, } from "./types/index.ts";
 export type { AwaitedEventType, PipelineBuildCtx, PipelineCtx, PipelineDef, StepBuilder, StepDef, StepFailureStrategy, StepInstance, StepKind, StepNamespace, StepResolver, } from "./types/step.ts";
 export { runValidation } from "./validation.ts";

package/dist/engine/index.js

@@ -56,6 +56,7 @@ export { parseRefTarget, parseRefTargetEntityName } from "./parse-ref-target.js"
 export { buildPipelineSteps, stepsPipeline } from "./pipeline.js";
 export { projectAppSchemaForRoles } from "./project-app-schema-for-roles.js";
 export { defineApply, defineMspApply, setFields } from "./projection-helpers.js";
+export { providerPluginContextFromHandler, providerPluginContextFromJob, } from "./provider-plugin-context.js";
 export { isValidQn, parseQn, QnTypes, qn, toKebab } from "./qualified-name.js";
 export { readClaim } from "./read-claim.js";
 export { createRegistry } from "./registry.js";

package/dist/engine/parse-ref-target.js

@@ -5,7 +5,7 @@
 //   - "users:user"  → cross-feature ref (qualifiziert)
 //
 // Lebt im framework-Package damit Server-Validator + Renderer (über
-// Re-Export aus @cosmicdrift/kumiko-headless) denselben Parser nutzen — die
+// Re-Export aus @cosmicdrift/kumiko-renderer/headless) denselben Parser nutzen — die
 // Convention darf nicht zweimal implementiert werden.
 export function parseRefTarget(raw, currentFeature) {
     const idx = raw.indexOf(":");

package/dist/engine/provider-plugin-context.d.ts

@@ -0,0 +1,3 @@
+import type { HandlerContext, JobContext, ProviderPluginContext } from "@cosmicdrift/kumiko-types/handlers";
+export declare function providerPluginContextFromHandler(ctx: HandlerContext): ProviderPluginContext;
+export declare function providerPluginContextFromJob(ctx: JobContext): ProviderPluginContext;

package/dist/engine/provider-plugin-context.js

@@ -0,0 +1,28 @@
+export function providerPluginContextFromHandler(ctx) {
+    return {
+        db: ctx.db,
+        dbOutsideTransaction: ctx.dbOutsideTransaction,
+        systemDb: ctx.systemDb,
+        registry: ctx.registry,
+        user: ctx.user,
+        log: ctx.log,
+        triggeredBy: ctx.triggeredBy,
+        config: ctx.config,
+        secrets: ctx.secrets,
+    };
+}
+// Jobs have no request user: the job's system user is the acting identity, and no
+// outside-transaction handle exists because jobs never run inside the handler's tx.
+export function providerPluginContextFromJob(ctx) {
+    return {
+        db: ctx.db,
+        dbOutsideTransaction: undefined,
+        systemDb: ctx.systemDb,
+        registry: ctx.registry,
+        user: ctx.systemUser,
+        log: ctx.log,
+        triggeredBy: ctx.triggeredBy,
+        config: ctx.config,
+        secrets: ctx.secrets,
+    };
+}

package/dist/engine/schema-builder.js

@@ -4,6 +4,7 @@ import { isValidIanaTimeZone } from "../time/index.js";
 import { assertUnreachable } from "../utils/index.js";
 import { withDerivedCells } from "./embedded-derived.js";
 import { DEFAULT_CURRENCIES } from "./types/index.js";
+const MONTH_PATTERN = /^\d{4}-(0[1-9]|1[0-2])$/;
 // True if `n` carries at most `scale` decimal places. A relative epsilon
 // tolerates float artifacts (`0.1 + 0.2 = 0.30000000000000004` is accepted at
 // scale 2) — the exact `toFixed`-roundtrip-equality it replaces rejected such
@@ -106,6 +107,12 @@ export function fieldToZod(field, currencies, opts = {}) {
                 schema = schema.email();
             if (field.format === "url")
                 schema = schema.url();
+            if (field.format === "month") {
+                // "" stays valid for an optional field; `required` rejects it via min(1) below.
+                schema = schema.refine((value) => value === "" || MONTH_PATTERN.test(value), {
+                    message: "expected a month as YYYY-MM",
+                });
+            }
             if (field.required)
                 schema = schema.min(1);
             return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;

package/dist/engine/types/index.d.ts

@@ -7,7 +7,7 @@ export type { ExtensionOptionsArgs, ExtensionOptionsFor, KumikoExtensionOptionsM
 export type { BootCheckContext, BootCheckFn, BootOptionName, EntityObjectDefinition, FeatureDefinition, FeatureMetricDef, FeatureMetricType, FeatureRegistrar, HookDefinition, MetricOptions, Registry, SecretKeyDefinition, SecretKeyHandle, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, StackBootRequirement, StoreTableDef, StoreTableEntry, StoreTableOptions, UiHintOption, UiHints, } from "@cosmicdrift/kumiko-types/feature";
 export type { FieldIconKey } from "@cosmicdrift/kumiko-types/field-icon";
 export type { AnyFileFieldDef, BigIntFieldDef, BooleanFieldDef, ClientDerivedFieldDef, DateFieldDef, DecimalFieldDef, DefaultCurrency, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EmbeddedDerivedCellDef, EmbeddedFieldDef, EmbeddedSubFieldDef, EntityDefinition, EntityEventMigration, EntityIndexDef, FieldAccess, FieldDefinition, FieldsMap, FileFieldDef, FilesFieldDef, Findability, ImageFieldDef, ImagesFieldDef, JsonbFieldDef, LocatedTimestampFieldDef, LongTextFieldDef, LongTextFindability, MoneyCurrencySource, MoneyFieldDef, MultiSelectFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, ReferenceFieldDef, ResolvedPiiFlags, RetentionDef, SelectFieldDef, SelectOptionTone, TextFieldDef, TimestampFieldDef, TransitionMap, TzFieldDef, } from "@cosmicdrift/kumiko-types/fields";
-export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadBucketNormalization, PayloadRateLimitOption, PreparedWriteEvent, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitOptions, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
+export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadBucketNormalization, PayloadRateLimitOption, PreparedWriteEvent, ProviderPluginContext, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitOptions, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
 export { DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, declaredRateLimitOptions, HTTP_ERROR_CODE_PATTERN, isDeliveryErrorCode, isOpenToAllGranted, isRateLimitDisabled, isRateLimitOption, isUiAccessGranted, } from "@cosmicdrift/kumiko-types/handlers";
 export type { DeleteContext, EntityHookMap, HookMap, HookOwner, HookPhase, LifecycleHookFn, LifecycleResult, OwnedFn, PhasedHook, PostDeleteBatchHookFn, PostDeleteHookFn, PostQueryHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, SaveContext, SearchPayloadContributorFn, ValidationError, ValidationHookFn, } from "@cosmicdrift/kumiko-types/hooks";
 export type { HttpRouteDefinition, HttpRouteHandler, HttpRouteHandlerDeps, HttpRouteMethod, } from "@cosmicdrift/kumiko-types/http-route";

package/dist/env/index.js

@@ -277,7 +277,7 @@ function formatBootError(errors) {
         }
     }
     lines.push("");
-    lines.push("See: kumiko-platform/docs/runbooks/standard-deploy-app.md#step-1-boot-dry-run-lokal");
+    lines.push("See: https://github.com/CosmicDriftGameStudio/infra/blob/main/docs/runbooks/standard-deploy-app.md#schritt-1--env-vertrag-lokal-ausgeben");
     return lines.join("\n");
 }
 export class KumikoBootError extends Error {

package/dist/errors/zod-bridge.js

@@ -35,7 +35,7 @@ export function validationErrorFromZod(error) {
 // `code: "custom"` is zod's catch-all for every superRefine/refine check;
 // left mechanical it'd collapse onto one generic key, so a superRefine can
 // set `params.i18nKey` to override it. Keep in sync with the client mirror
-// (packages/headless/src/form/zod-bridge.ts).
+// (packages/renderer/src/headless/form/zod-bridge.ts).
 function resolveI18nKey(issue) {
     if (issue.code === "custom") {
         const override = issue.params?.["i18nKey"];

package/dist/files/file-ref-entity.d.ts

@@ -14,7 +14,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -37,7 +37,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -60,7 +60,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -95,7 +95,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -118,7 +118,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -141,7 +141,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/files/file-ref-table.d.ts

@@ -13,7 +13,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -59,7 +59,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -94,7 +94,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -117,7 +117,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -140,7 +140,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/files/index.d.ts

@@ -5,7 +5,7 @@ export { createFileRefFromBytes, createFileRefFromUploadedBytes, uploadFileBytes
 export { createFilesFeature, FILES_FEATURE } from "./feature.ts";
 export type { FileContext, FileHandle } from "./file-handle.ts";
 export { createFileContext, createTenantFileContext, deriveKey, storageKeyStemPrefix, } from "./file-handle.ts";
-export { fileRefEntity } from "./file-ref-entity.ts";
+export { FILE_REF_ENTITY_NAME, fileRefEntity } from "./file-ref-entity.ts";
 export { fileRefsTable } from "./file-ref-table.ts";
 export type { FileAccessDecision, FileAccessGuard, FileRef, FileRoutesOptions, } from "./file-routes.ts";
 export { createFileRoutes, readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.ts";

package/dist/files/index.js

@@ -4,7 +4,7 @@ export { createFilesFeature, FILES_FEATURE } from "./feature.js";
 // `createFileHandle` is an implementation detail — construct handles via
 // `createFileContext(provider).ref(key)`, which is the AppContext surface.
 export { createFileContext, createTenantFileContext, deriveKey, storageKeyStemPrefix, } from "./file-handle.js";
-export { fileRefEntity } from "./file-ref-entity.js";
+export { FILE_REF_ENTITY_NAME, fileRefEntity } from "./file-ref-entity.js";
 export { fileRefsTable } from "./file-ref-table.js";
 export { createFileRoutes, readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.js";
 export { createInMemoryFileProvider } from "./in-memory-provider.js";

package/dist/files/provider-resolver.d.ts

@@ -6,30 +6,30 @@ import type { ConfigAccessor, ConfigAccessorFactory, Registry } from "../engine/
 import type { SecretsContext } from "../secrets/index.ts";
 import type { FileStorageProvider } from "./types.ts";
 /**
- * Schmaler Surface-Type fuer Provider-Plugins. HandlerContext ist zu fett
- * (haelt tx, actor, signal etc.) — Provider sollen sich auf die read-Felder
- * beschraenken die fuer Tenant-Config + Secret-Lookup gebraucht werden.
+ * Narrow surface type for provider plugins. HandlerContext carries tx, actor,
+ * signal and more; providers only get the read fields needed for tenant config
+ * and secret lookup.
  *
- * **Warum nicht voller HandlerContext?** Im Worker-Pfad (r.job) gibt es keinen
- * request-bezogenen `tx`/`actor`/`signal`. Wenn ein Provider `ctx.tx` lesen
- * wuerde, wuerde der ganze Worker-Pfad zur Runtime brechen — und das wuerde NUR
- * mit S3 und nur in production auffallen. Die schmale Surface zwingt Provider
- * zur expliziten Erweiterung statt silent ctx-feld-ausnutzen.
+ * **Why not the full HandlerContext?** On the worker path (r.job) there is no
+ * request-bound `tx`/`actor`/`signal`. A provider reading `ctx.tx` would break
+ * the whole worker path at runtime, and that would only show up with S3 in
+ * production. The narrow surface forces providers to extend it explicitly
+ * instead of quietly relying on extra ctx fields.
  *
- * **Felder:**
- *   config  — fuer tenant-config-reads (bucket/region/endpoint/...)
- *   registry — fuer extension-Lookup in der Factory (nicht Plugin-intern)
- *   secrets — fuer tenant-secret-reads (s3.secretAccessKey)
- *   _userId — Audit-/Authority-Identity fuer secret-reads. Der Framework-
- *             Resolver setzt das auf SYSTEM_USER_ID — der s3-Provider liest
- *             `s3.secretAccessKey`, was Nicht-Admin-Request-User nicht duerfen;
- *             die Request-User-Autorisierung bleibt am Route-accessGuard.
+ * **Fields:**
+ *   config      — tenant config reads (bucket/region/endpoint/...)
+ *   registry    — extension lookup in the factory (not plugin-internal)
+ *   secrets     — tenant secret reads (s3.secretAccessKey)
+ *   auditUserId — audit and authority identity for secret reads. The framework
+ *                 resolver sets SYSTEM_USER_ID because the s3 provider reads
+ *                 `s3.secretAccessKey`, which non-admin request users may not;
+ *                 request-user authorization stays on the route accessGuard.
  */
 export type FileProviderContext = {
     readonly config?: ConfigAccessor;
     readonly registry?: Registry;
     readonly secrets?: SecretsContext;
-    readonly _userId?: string | undefined;
+    readonly auditUserId?: string | undefined;
 };
 /**
  * File-Storage-Plugin contract. Each provider-feature (file-provider-s3,

package/dist/files/provider-resolver.js

@@ -110,7 +110,7 @@ export function makeFileProviderResolver(deps) {
                 db: deps.db,
                 secrets: deps.secrets,
             });
-            return createFileProviderForTenant({ config, registry: deps.registry, secrets: deps.secrets, _userId: SYSTEM_USER_ID }, tenantId);
+            return createFileProviderForTenant({ config, registry: deps.registry, secrets: deps.secrets, auditUserId: SYSTEM_USER_ID }, tenantId);
         })();
         built.catch(() => {
             if (cache.get(tenantId) === built)

package/dist/http/egress.d.ts

@@ -0,0 +1,14 @@
+import { type EgressPolicy, type ResolvedHost } from "./policy.ts";
+type PinnedRequestInit = RequestInit & {
+    tls?: {
+        servername: string;
+    };
+};
+export declare function egress(policy: EgressPolicy): (raw: string, init?: RequestInit) => Promise<Response>;
+export declare function withOriginalUrl(res: Response, originalUrl: URL): Response;
+export declare function buildPinnedRequest(url: URL, resolved: ResolvedHost, init: RequestInit | undefined): {
+    url: URL;
+    init: PinnedRequestInit;
+};
+export declare function withManualRedirect(init: RequestInit | undefined): RequestInit;
+export {};

package/dist/http/egress.js

@@ -0,0 +1,144 @@
+import { assertAllowedTarget, assertHttpScheme, assertValidInternalPolicy, resolvePublicHost, } from "./policy.js";
+const MAX_INTERNAL_REDIRECTS = 5;
+// Single exported way to speak outward. The policy is named once, at bind
+// time, and cannot drift from the request that follows it.
+export function egress(policy) {
+    if (policy.kind === "internal")
+        assertValidInternalPolicy(policy);
+    return (raw, init) => runEgress(policy, raw, init);
+}
+async function runEgress(policy, raw, init) {
+    const url = new URL(raw);
+    assertHttpScheme(url);
+    if (policy.kind === "internal") {
+        assertAllowedTarget(url, policy);
+        return fetchWithAllowlistedRedirects(url, policy, init);
+    }
+    // external + tenant-supplied: deny private/reserved/link-local ranges,
+    // pin the connect to the exact address that passed that check (closes the
+    // DNS-rebinding TOCTOU, see buildPinnedRequest), and never follow a
+    // redirect — a 3xx could point anywhere, including back into the denied
+    // ranges above. The caller sees the 3xx response itself and, to follow it,
+    // is expected to call `egress()` again with the Location header — which
+    // re-runs this same resolve-and-pin check against the new host.
+    const resolved = await resolvePublicHost(url);
+    const pinned = buildPinnedRequest(url, resolved, init);
+    const res = await fetch(pinned.url, withManualRedirect(pinned.init));
+    return withOriginalUrl(res, url);
+}
+// fetch() reports `res.url` as the address it actually connected to — the
+// pinned IP literal, not the hostname the caller asked for. Left alone, a
+// caller resolving a relative Location header the normal way
+// (`new URL(location, res.url)`) would resolve it against the IP instead of
+// the original host, and the re-invoked egress() call would then pin and
+// SNI-validate against that IP, breaking virtual hosting and TLS for
+// essentially every real server. Overwriting `.url` back to the original
+// request URL keeps that caller pattern working exactly as it would without
+// IP pinning.
+export function withOriginalUrl(res, originalUrl) {
+    Object.defineProperty(res, "url", { value: originalUrl.toString(), configurable: true });
+    return res;
+}
+// Rewrites the request to connect directly to `resolved.address` — the
+// exact address `resolvePublicHost` just validated — instead of handing
+// `fetch()` the original hostname and letting it resolve again. That second
+// resolution is the DNS-rebinding window: fetch-by-IP removes it entirely,
+// since there is no hostname left for fetch to look up. The original
+// hostname is preserved in the Host header (virtual hosting) and in
+// `tls.servername` (TLS SNI, and certificate validation still checks the
+// real hostname — not the IP we dial).
+export function buildPinnedRequest(url, resolved, init) {
+    const pinnedHost = resolved.family === 6 ? `[${resolved.address}]` : resolved.address;
+    const pinnedUrl = new URL(url.toString());
+    pinnedUrl.hostname = pinnedHost;
+    if (pinnedUrl.hostname !== pinnedHost) {
+        // The WHATWG URL hostname setter silently no-ops on invalid input
+        // instead of throwing. If that ever happened here, the request would
+        // silently fall back to the original (unpinned) hostname — reopening
+        // the rebinding window this function exists to close. Fail loudly.
+        throw new Error(`egress: failed to pin connection to resolved address ${resolved.address}`);
+    }
+    const headers = new Headers(init?.headers);
+    headers.set("host", url.host);
+    const pinnedInit = { ...init, headers };
+    if (url.protocol === "https:") {
+        pinnedInit.tls = { servername: url.hostname };
+    }
+    return { url: pinnedUrl, init: pinnedInit };
+}
+// Applied last, after spreading the caller's `init` — a caller cannot
+// override the policy's redirect handling by passing its own `redirect`
+// option. Used by both the external/tenant-supplied fetch above and the
+// internal redirect loop below, so it is not part of the package's public
+// barrel (not re-exported from index.ts) but is a plain named export for
+// that shared use and for pinning the invariant directly in
+// ./__tests__/egress.test.ts.
+export function withManualRedirect(init) {
+    return { ...init, redirect: "manual" };
+}
+const ORIGIN_CHANGE_SAFE_HEADERS = new Set([
+    "content-type",
+    "accept",
+    "accept-encoding",
+    "accept-language",
+    "user-agent",
+]);
+// Allowlist, not denylist: any credential-bearing header we have not thought
+// of (x-api-key, custom tokens) must not follow a redirect to another origin.
+function stripToSafeHeaders(init) {
+    const kept = new Headers();
+    for (const [name, value] of new Headers(init?.headers)) {
+        if (ORIGIN_CHANGE_SAFE_HEADERS.has(name))
+            kept.set(name, value);
+    }
+    return { ...init, headers: kept };
+}
+// `internal` is the only kind that permits redirects (it is the only kind
+// with an allowlist to re-validate them against). Each hop's Location is
+// resolved, restricted to the current hop's host and checked against the
+// policy before it is followed, capped at MAX_INTERNAL_REDIRECTS.
+// `init` (method, body) is replayed verbatim on every hop — unlike a browser,
+// this does not downgrade POST to GET on a 301/302/303. Headers are replayed
+// only while the origin is unchanged; once a hop leaves the original origin
+// (scheme or port differs), credential headers are dropped for the rest of the
+// chain. The body is still replayed to the new origin (as fetch does on
+// 307/308); use allowOrigins to forbid such hops entirely.
+async function fetchWithAllowlistedRedirects(url, policy, init) {
+    let current = url;
+    let hopInit = init;
+    let strippedInit;
+    for (let hop = 0; hop <= MAX_INTERNAL_REDIRECTS; hop++) {
+        const res = await fetch(current, withManualRedirect(hopInit));
+        if (res.status < 300 || res.status >= 400)
+            return res;
+        const location = res.headers.get("location");
+        if (!location)
+            return res; // 3xx without Location — nothing to follow
+        let next;
+        try {
+            next = new URL(location, current);
+        }
+        catch {
+            throw new Error(`egress(internal): redirect Location header is not a resolvable URL: ${location}`);
+        }
+        assertHttpScheme(next);
+        // Hosts may differ in the allowlist; credentials must still not hop
+        // between them.
+        if (next.hostname.toLowerCase() !== current.hostname.toLowerCase()) {
+            throw new Error(`egress(internal): redirect crosses host (${current.hostname} -> ${next.hostname}), not followed`);
+        }
+        try {
+            assertAllowedTarget(next, policy);
+        }
+        catch {
+            // Prefix is the contract consumers match on (chat-webhook-sender); origins only, no path/query.
+            throw new Error(`egress(internal): redirect target not in allowlist (${current.origin} -> ${next.origin}), not followed`);
+        }
+        if (next.origin !== url.origin) {
+            strippedInit ??= stripToSafeHeaders(init);
+            hopInit = strippedInit;
+        }
+        current = next;
+    }
+    throw new Error(`egress(internal): exceeded ${MAX_INTERNAL_REDIRECTS} redirects`);
+}

package/dist/http/index.d.ts

@@ -1,2 +1,3 @@
-export type { EgressPolicy, ResolvedHost } from "@cosmicdrift/kumiko-http";
-export { BlockedHostError, buildPinnedRequest, egress, HostResolutionError, isPublicHost, resolvePublicHost, resolvePublicHostname, } from "@cosmicdrift/kumiko-http";
+export { buildPinnedRequest, egress } from "./egress.ts";
+export type { EgressPolicy, ResolvedHost } from "./policy.ts";
+export { BlockedHostError, HostResolutionError, isPublicHost, resolvePublicHost, resolvePublicHostname, } from "./policy.ts";

package/dist/http/index.js

@@ -1 +1,2 @@
-export { BlockedHostError, buildPinnedRequest, egress, HostResolutionError, isPublicHost, resolvePublicHost, resolvePublicHostname, } from "@cosmicdrift/kumiko-http";
+export { buildPinnedRequest, egress } from "./egress.js";
+export { BlockedHostError, HostResolutionError, isPublicHost, resolvePublicHost, resolvePublicHostname, } from "./policy.js";