@cosmicdrift/kumiko-framework 0.388.0 → 0.389.0

package/dist/api/export/export-route.js

@@ -0,0 +1,74 @@
+import { Hono } from "hono";
+import * as z from "zod";
+import { toKumikoError } from "../../errors/index.js";
+import { createI18n, DEFAULT_LOCALE } from "../../i18n/index.js";
+import { isValidIanaTimeZone } from "../../time/index.js";
+import { Routes } from "../api-constants.js";
+import { getUser } from "../auth-middleware.js";
+import { requestContext } from "../request-context.js";
+import { assertPayloadDepthAllowed, queryErrorResponse } from "../routes.js";
+import { EXPORT_TOO_MANY_I18N_KEY, exportRejection } from "./export-errors.js";
+import { readExportRows } from "./export-rows.js";
+import { resolveExportPlan } from "./export-screen.js";
+import { writeExportWorkbook } from "./export-xlsx-writer.js";
+const XLSX_CONTENT_TYPE = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+const MAX_ID_LENGTH = 200;
+const exportBodySchema = z.object({
+    screen: z.string().max(MAX_ID_LENGTH),
+    payload: z.record(z.string(), z.unknown()).default({}),
+    columns: z.array(z.string().max(MAX_ID_LENGTH)).min(1).max(MAX_ID_LENGTH),
+    timeZone: z.string().max(64).optional(),
+});
+// Browser zone first (what the user saw in the list), then the profile zone, else UTC.
+function exportTimeZone(requested, profile) {
+    for (const candidate of [requested, profile]) {
+        if (candidate !== undefined && isValidIanaTimeZone(candidate))
+            return candidate;
+    }
+    return "UTC";
+}
+function downloadFileName(screenShortId, now) {
+    const safeId = screenShortId.replace(/[^A-Za-z0-9_-]/g, "_");
+    return `${safeId}-${now.toISOString().slice(0, 10)}.xlsx`;
+}
+export function createExportRoutes(dispatcher, registry) {
+    const api = new Hono();
+    const i18n = createI18n(registry, { defaultLocale: DEFAULT_LOCALE });
+    api.post(Routes.exportXlsx, async (c) => {
+        const user = getUser(c);
+        try {
+            const parsed = exportBodySchema.safeParse(await c.req.json().catch(() => undefined));
+            if (!parsed.success)
+                throw exportRejection("export_invalid_request", "body");
+            const body = parsed.data;
+            assertPayloadDepthAllowed(body.payload);
+            const plan = resolveExportPlan(registry, body.screen, body.columns, user);
+            const result = await readExportRows(dispatcher, plan, body.payload, user);
+            if (result.tooMany) {
+                return c.json({
+                    error: {
+                        code: "export_too_many_rows",
+                        httpStatus: 413,
+                        message: `export exceeds the limit of ${plan.maxRows} rows; narrow the filter`,
+                        i18nKey: EXPORT_TOO_MANY_I18N_KEY,
+                        details: { maxRows: plan.maxRows },
+                    },
+                }, 413);
+            }
+            const locale = requestContext.get()?.locale ?? DEFAULT_LOCALE;
+            const bytes = await writeExportWorkbook(plan.columns, result.rows, (key) => i18n.t(key, locale), exportTimeZone(body.timeZone, user.timezone));
+            return new Response(bytes, {
+                status: 200,
+                headers: {
+                    "Content-Type": XLSX_CONTENT_TYPE,
+                    "Cache-Control": "no-store",
+                    "Content-Disposition": `attachment; filename="${downloadFileName(plan.screenShortId, new Date())}"`,
+                },
+            });
+        }
+        catch (e) {
+            return queryErrorResponse(c, toKumikoError(e), Routes.exportXlsx);
+        }
+    });
+    return api;
+}

package/dist/api/export/export-rows.d.ts

@@ -0,0 +1,13 @@
+import type { SessionUser } from "../../engine/types/index.ts";
+import type { Dispatcher } from "../../pipeline/dispatcher.ts";
+import type { ExportPlan } from "./export-screen.ts";
+export type ExportRow = Readonly<Record<string, unknown>>;
+export type ExportRowsResult = {
+    readonly tooMany: false;
+    readonly rows: readonly ExportRow[];
+} | {
+    readonly tooMany: true;
+};
+export declare function sanitizeExportPayload(clientPayload: Readonly<Record<string, unknown>>, plan: Pick<ExportPlan, "screenFilter">): Record<string, unknown>;
+/** Reads the whole filtered list page by page; gives up as soon as more than `maxRows` exist. */
+export declare function readExportRows(dispatcher: Pick<Dispatcher, "query">, plan: ExportPlan, clientPayload: Readonly<Record<string, unknown>>, user: SessionUser): Promise<ExportRowsResult>;

package/dist/api/export/export-rows.js

@@ -0,0 +1,62 @@
+import { MAX_LIST_LIMIT } from "../../engine/entity-handlers.js";
+import { InternalError } from "../../errors/index.js";
+import { isPlainObject } from "../../utils/is-plain-object.js";
+// Paging, sizing and aggregation belong to the server here; `filter` is replaced from the screen
+// below, so a client can neither widen the fixed screen filter nor smuggle another one in.
+const CLIENT_CONTROLLED_PAGING_KEYS = [
+    "limit",
+    "offset",
+    "cursor",
+    "totalCount",
+    "aggregate",
+    "includeDeleted",
+    "filter",
+];
+export function sanitizeExportPayload(clientPayload, plan) {
+    const payload = { ...clientPayload };
+    for (const key of CLIENT_CONTROLLED_PAGING_KEYS)
+        delete payload[key];
+    if (plan.screenFilter !== undefined)
+        payload["filter"] = plan.screenFilter;
+    return payload;
+}
+function parsePage(result, queryType) {
+    if (!isPlainObject(result) || !Array.isArray(result["rows"])) {
+        throw new InternalError({
+            message: `export: query ${queryType} did not return a { rows } envelope`,
+        });
+    }
+    const nextCursor = result["nextCursor"];
+    return {
+        rows: result["rows"].filter(isPlainObject),
+        nextCursor: typeof nextCursor === "string" && nextCursor !== "" ? nextCursor : undefined,
+    };
+}
+/** Reads the whole filtered list page by page; gives up as soon as more than `maxRows` exist. */
+export async function readExportRows(dispatcher, plan, clientPayload, user) {
+    const base = sanitizeExportPayload(clientPayload, plan);
+    const rows = [];
+    const seenCursors = new Set();
+    let cursor;
+    for (;;) {
+        const limit = Math.min(MAX_LIST_LIMIT, plan.maxRows + 1 - rows.length);
+        const pagingPayload = cursor !== undefined
+            ? { ...base, limit, cursor }
+            : rows.length > 0
+                ? { ...base, limit, offset: rows.length }
+                : { ...base, limit };
+        const page = parsePage(await dispatcher.query(plan.queryType, pagingPayload, user), plan.queryType);
+        rows.push(...page.rows);
+        if (rows.length > plan.maxRows)
+            return { tooMany: true };
+        // A short or empty page is the end of the list; a repeated cursor would loop forever.
+        if (page.rows.length < limit || page.rows.length === 0)
+            return { tooMany: false, rows };
+        if (page.nextCursor !== undefined) {
+            if (seenCursors.has(page.nextCursor))
+                return { tooMany: false, rows };
+            seenCursors.add(page.nextCursor);
+        }
+        cursor = page.nextCursor;
+    }
+}

package/dist/api/export/export-screen.d.ts

@@ -0,0 +1,12 @@
+import type { Registry, ScreenFilter, SessionUser } from "../../engine/types/index.ts";
+import { type ExportColumn } from "./export-columns.ts";
+export type ExportPlan = {
+    readonly screenShortId: string;
+    readonly queryType: string;
+    readonly screenFilter: ScreenFilter | undefined;
+    readonly columns: readonly ExportColumn[];
+    readonly maxRows: number;
+};
+type ExportScreenRegistry = Pick<Registry, "getScreen" | "getScreenFeature" | "getEntity">;
+export declare function resolveExportPlan(registry: ExportScreenRegistry, screenQn: string, requestedColumns: readonly string[], user: Pick<SessionUser, "roles">): ExportPlan;
+export {};

package/dist/api/export/export-screen.js

@@ -0,0 +1,47 @@
+import { hasAccess } from "../../engine/access.js";
+import { toKebab } from "../../engine/qualified-name.js";
+import { DEFAULT_EXPORT_MAX_ROWS } from "../../engine/types/screen.js";
+import { AccessDeniedError } from "../../errors/index.js";
+import { resolveExportColumns } from "./export-columns.js";
+import { exportRejection } from "./export-errors.js";
+const SCREEN_QN = /^[A-Za-z0-9_-]+:screen:[A-Za-z0-9_-]+$/;
+function findExportScreen(registry, screenQn) {
+    // The client sends the feature name as authored (camelCase allowed); the registry keys are kebab.
+    const registryQn = toKebab(screenQn);
+    const screen = SCREEN_QN.test(screenQn) ? registry.getScreen(registryQn) : undefined;
+    if (screen === undefined || (screen.type !== "entityList" && screen.type !== "projectionList")) {
+        throw exportRejection("export_unknown_screen", "screen");
+    }
+    return { registryQn, screen };
+}
+export function resolveExportPlan(registry, screenQn, requestedColumns, user) {
+    const { registryQn, screen } = findExportScreen(registry, screenQn);
+    if (screen.table?.export?.xlsx !== true)
+        throw exportRejection("export_not_enabled", "screen");
+    if (screen.access !== undefined && !hasAccess(user, screen.access)) {
+        throw new AccessDeniedError({ details: { screen: screenQn } });
+    }
+    // Label keys use the feature name as authored, query types the kebab form.
+    const featureName = registry.getScreenFeature(registryQn) ?? "";
+    const screenShortId = registryQn.split(":")[2] ?? "";
+    const maxRows = screen.table.export.maxRows ?? DEFAULT_EXPORT_MAX_ROWS;
+    if (screen.type === "projectionList") {
+        return {
+            screenShortId,
+            queryType: screen.query,
+            screenFilter: screen.filter,
+            columns: resolveExportColumns({ featureName, columns: screen.columns, entity: undefined, entityName: undefined, user }, requestedColumns),
+            maxRows,
+        };
+    }
+    const entity = registry.getEntity(screen.entity);
+    if (entity === undefined)
+        throw exportRejection("export_unknown_screen", "screen");
+    return {
+        screenShortId,
+        queryType: `${toKebab(featureName)}:query:${toKebab(screen.entity)}:list`,
+        screenFilter: screen.filter,
+        columns: resolveExportColumns({ featureName, columns: screen.columns, entity, entityName: screen.entity, user }, requestedColumns),
+        maxRows,
+    };
+}

package/dist/api/export/export-xlsx-writer.d.ts

@@ -0,0 +1,4 @@
+import { type Translate } from "./export-cells.ts";
+import type { ExportColumn } from "./export-columns.ts";
+import type { ExportRow } from "./export-rows.ts";
+export declare function writeExportWorkbook(columns: readonly ExportColumn[], rows: readonly ExportRow[], translate: Translate, timeZone: string): Promise<Uint8Array<ArrayBuffer>>;

package/dist/api/export/export-xlsx-writer.js

@@ -0,0 +1,21 @@
+import writeXlsxFile, {} from "write-excel-file/node";
+import { toExportCell } from "./export-cells.js";
+import { guardSheetAgainstCiphertext } from "./export-ciphertext-guard.js";
+function headerLabel(column, translate) {
+    const translated = translate(column.headerKey);
+    return translated === column.headerKey ? column.headerFallback : translated;
+}
+export async function writeExportWorkbook(columns, rows, translate, timeZone) {
+    const header = columns.map((column) => ({
+        value: headerLabel(column, translate),
+        type: String,
+        fontWeight: "bold",
+    }));
+    const body = rows.map((row) => columns.map((column) => toExportCell(column, { row, translate, timeZone })));
+    const sheetData = guardSheetAgainstCiphertext([header, ...body]);
+    const buffer = await writeXlsxFile(sheetData, {}).toBuffer();
+    // Buffer is typed over ArrayBufferLike; a plain copy gives Response a BodyInit-compatible view.
+    const bytes = new Uint8Array(buffer.byteLength);
+    bytes.set(buffer);
+    return bytes;
+}

package/dist/api/extra-route.d.ts

@@ -70,6 +70,10 @@ export type SignatureExtraRouteDeps = {
      *  caller's authenticity (signature, HMAC state, etc.). */
     readonly dispatchSystemWrite: (args: SystemDispatchArgs) => Promise<WriteResult>;
     readonly dispatchSystemQuery: (args: SystemDispatchArgs) => Promise<unknown>;
+    /** Same trust as dispatchSystemWrite, but runs as the tenant's system user
+     *  with the "system" role plus exactly `roles` (no SystemAdmin), so the write
+     *  passes app-role access checks. */
+    readonly dispatchWriteAs: (args: RoleDispatchArgs) => Promise<WriteResult>;
 };
 export type SignatureExtraRoute<TVerified> = {
     readonly method: HttpRouteMethod;

package/dist/api/pii-leak-guard.d.ts

@@ -1,2 +1,5 @@
 import type { MiddlewareHandler } from "hono";
+export declare const CIPHERTEXT_RE: RegExp;
+export declare const CIPHERTEXT_REDACT_RE: RegExp;
+export declare const CIPHERTEXT_REDACTION = "[pii-redacted]";
 export declare function piiCiphertextResponseGuard(): MiddlewareHandler;

package/dist/api/pii-leak-guard.js

@@ -8,8 +8,9 @@ const isProductionEnv = () => process.env["NODE_ENV"] === "production";
 // Bound to the full ciphertext shape (prefix, "<kind>:<id>" subject key, base64
 // blob of at least IV + GCM tag = 28 bytes) so a user-typed "kumiko-pii:v" in a
 // note or name field cannot turn every read of that record into a 500.
-const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^:"\s<>\\]+:[^:"\s<>\\]+:[A-Za-z0-9+/=]{40,}/;
-const CIPHERTEXT_REDACT_RE = new RegExp(CIPHERTEXT_RE.source, "g");
+export const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^:"\s<>\\]+:[^:"\s<>\\]+:[A-Za-z0-9+/=]{40,}/;
+export const CIPHERTEXT_REDACT_RE = new RegExp(CIPHERTEXT_RE.source, "g");
+export const CIPHERTEXT_REDACTION = "[pii-redacted]";
 // A PII subject ciphertext never belongs in an API response — its presence
 // means a raw DB read (fetchOne/selectMany) leaked to the surface. Dev/test
 // fail loud (500) so a forgotten decrypt turns the first integration test

package/dist/api/routes.d.ts

@@ -1,4 +1,5 @@
 import { type Context, Hono } from "hono";
+import { type KumikoError } from "../errors/index.ts";
 import type { Dispatcher } from "../pipeline/dispatcher.ts";
 export declare const StreamFrame: {
     readonly chunk: "chunk";
@@ -18,4 +19,19 @@ export type SseWriter = {
 };
 export declare function pumpStream(stream: SseWriter, generator: AsyncGenerator<unknown>, heartbeatMs: number, firstPull?: Promise<IteratorResult<unknown>>): Promise<void>;
 export declare const MAX_PAYLOAD_DEPTH = 20;
+export declare function assertPayloadDepthAllowed(payload: unknown): void;
+export declare function queryErrorResponse(c: Context, err: KumikoError, type?: unknown): (Response & import("hono").TypedResponse<{
+    readonly error: {
+        readonly code: string;
+        readonly i18nKey: string;
+        readonly i18nParams?: {
+            readonly [x: string]: import("hono/utils/types").JSONValue;
+        } | undefined;
+        readonly message: string;
+        readonly details?: import("hono/utils/types").JSONValue | undefined;
+        readonly docsUrl?: string;
+        readonly requestId?: string;
+        readonly timestamp: string;
+    };
+}, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">) | (Response & import("hono").TypedResponse<null, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "body">);
 export declare function handleUncaughtRouteError(err: Error, c: Context): Response | Promise<Response>;

package/dist/api/routes.js

@@ -312,7 +312,7 @@ async function readDispatchBody(c) {
 // jsonb serialization of custom-fields payloads) walks the same object
 // graph an attacker controls, so an uncapped depth is a stack-overflow /
 // CPU-DoS vector even under the 1MB body-byte limit.
-function assertPayloadDepthAllowed(payload) {
+export function assertPayloadDepthAllowed(payload) {
     if (payloadDepth(payload, 0) > MAX_PAYLOAD_DEPTH) {
         throw new ValidationError({
             fields: [
@@ -428,7 +428,7 @@ function clientAbortResponse(c, requestId, type) {
 }
 // For /query + /command: no isSuccess on success (just { data } / {ok}), so we
 // keep the same lean shape on failure — only the `error` key.
-function queryErrorResponse(c, err, type) {
+export function queryErrorResponse(c, err, type) {
     const requestId = requestContext.get()?.requestId;
     if (isClientAbort(err))
         return clientAbortResponse(c, requestId, type);

package/dist/api/server-extra-routes.js

@@ -34,6 +34,7 @@ export function mountExtraRoutes(app, wiring) {
         }
         const dispatchSystemWrite = makeDispatchSystemWrite(dispatcher);
         const dispatchSystemQuery = makeDispatchSystemQuery(dispatcher);
+        const dispatchWriteAs = makeDispatchWriteAs(dispatcher);
         for (const route of options.extraRoutes) {
             const honoHandler = buildExtraRouteHonoHandler(route, {
                 app,
@@ -42,6 +43,7 @@ export function mountExtraRoutes(app, wiring) {
                 secrets: context.secrets,
                 dispatchSystemWrite,
                 dispatchSystemQuery,
+                dispatchWriteAs,
                 clientIpResolver,
             });
             mountHonoRoute(app, route.method, route.path, honoHandler, bodyLimitForRoutePath(route.path, options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES));
@@ -195,6 +197,7 @@ function buildExtraRouteHonoHandler(route, shared) {
                     systemQuery: makeSystemQuery(c, shared.dispatcher, shared.clientIpResolver),
                     dispatchSystemWrite: shared.dispatchSystemWrite,
                     dispatchSystemQuery: shared.dispatchSystemQuery,
+                    dispatchWriteAs: shared.dispatchWriteAs,
                 });
             };
         default:

package/dist/api/server-routes.d.ts

@@ -10,7 +10,7 @@ export declare function mountAuthRoutes(app: Hono, wiring: Pick<ServerWiring, "o
 export declare function mountClientErrorRoute(app: Hono, wiring: Pick<ServerWiring, "rateLimitResolver" | "tracedRedis" | "clientIpResolver" | "observability" | "jwt">): void;
 export declare function mountDispatcherRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "sseBroker">): void;
 export declare function mountSchemaRoute(app: Hono, options: Pick<ServerOptions, "registry" | "dispatcherOptions" | "context">): void;
-export declare function mountFileRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "fileProviderResolver">): void;
+export declare function mountFileRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "fileProviderResolver" | "rateLimitResolver" | "tracedRedis">): void;
 export declare function mountFeatureHttpRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "clientIpResolver" | "rateLimitResolver" | "observability">, sessionOnlyHttpRouteGuards: readonly MiddlewareHandler[]): void;
 export declare function installNoRouteMatchMarker(app: Hono): void;
 export declare function mountHonoRoute(app: Hono, method: HttpRouteMethod, path: string, handler: (c: import("hono").Context<any, any>) => Response | Promise<Response>, middlewares?: readonly MiddlewareHandler[]): void;

package/dist/api/server-routes.js

@@ -14,7 +14,8 @@ import { getUser, identifyOptionalSession } from "./auth-middleware.js";
 import { createAuthRoutes } from "./auth-routes.js";
 import { createClientErrorRoute } from "./client-error-route.js";
 import { clientIpSourceFromHonoContext } from "./client-ip.js";
-import { collectEntityReadAccess } from "./entity-read-access.js";
+import { collectEntityReadAccess, collectEntityRowReadMaps } from "./entity-read-access.js";
+import { createExportRoutes } from "./export/export-route.js";
 import { computeStrongEtag, etagMatches } from "./http-cache.js";
 import { requestContext } from "./request-context.js";
 import { buildRequestContextData } from "./request-id-middleware.js";
@@ -67,9 +68,11 @@ export function mountDispatcherRoutes(app, wiring) {
     app.route("/api", createApiRoutes(dispatcher, {
         ...(options.sseHeartbeatMs !== undefined ? { sseHeartbeatMs: options.sseHeartbeatMs } : {}),
     }));
+    app.route("/api", createExportRoutes(dispatcher, options.registry));
     app.route("/api", createSseRoute(sseBroker, {
         anonymousLiveEntities: collectAnonymousLiveEntities(options.registry),
         entityReadAccess: collectEntityReadAccess(options.registry),
+        entityRowReadMaps: collectEntityRowReadMaps(options.registry),
     }));
 }
 export function mountSchemaRoute(app, options) {
@@ -122,7 +125,9 @@ export function mountSchemaRoute(app, options) {
     });
 }
 export function mountFileRoutes(app, wiring) {
-    const { options, dispatcher, fileProviderResolver } = wiring;
+    const { options, dispatcher, fileProviderResolver, rateLimitResolver, tracedRedis } = wiring;
+    const metaBatchRateLimitResolver = rateLimitResolver ??
+        (tracedRedis ? createRateLimitResolver({ redis: tracedRedis }) : undefined);
     // Mount upload/download routes whenever a file provider is resolvable (a
     // file-provider plugin is mounted, or a resolver was injected). They resolve
     // the provider per-tenant through file-foundation — no `files` option; route
@@ -139,6 +144,7 @@ export function mountFileRoutes(app, wiring) {
             db: fileDb,
             registry: options.registry,
             resolveProvider: fileProviderResolver,
+            ...(metaBatchRateLimitResolver ? { metaBatchRateLimitResolver } : {}),
             canReadRecord,
             canWriteRecord: createRecordWriteCheck({
                 registry: options.registry,

package/dist/api/server-wiring.js

@@ -23,6 +23,7 @@ export function withFileProviderResolver(registry, context, cacheSync) {
         return context;
     if (registry.getExtensionUsages(EXT_FILE_PROVIDER).length === 0)
         return context;
+    const { clock } = context;
     return {
         ...context,
         _fileProviderResolver: makeFileProviderResolver({
@@ -30,6 +31,7 @@ export function withFileProviderResolver(registry, context, cacheSync) {
             _configAccessorFactory: configAccessorFactoryOf(context),
             secrets: context.secrets,
             db: context.db,
+            ...(clock ? { now: () => clock.now() } : {}),
             ...(cacheSync ? { cacheSync } : {}),
         }),
     };

package/dist/api/sse-route.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import type { AccessRule } from "../engine/types/index.ts";
+import type { AccessRule, OwnershipMap } from "../engine/types/index.ts";
 import { type SseBroker } from "./sse-broker.ts";
 /**
  * Heartbeat cadence for SSE streams.
@@ -27,6 +27,7 @@ export declare const SSE_MAX_PENDING_WRITES_PER_CLIENT = 10000;
 export type SseRouteOptions = {
     readonly anonymousLiveEntities: ReadonlySet<string>;
     readonly entityReadAccess: ReadonlyMap<string, readonly AccessRule[]>;
+    readonly entityRowReadMaps?: ReadonlyMap<string, OwnershipMap>;
     readonly now?: () => number;
 };
 export declare function createSseRoute(broker: SseBroker, options: SseRouteOptions): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;

package/dist/api/sse-route.js

@@ -84,7 +84,17 @@ function entitySignalDetail(user, aggregateType, options) {
     const granting = (options.entityReadAccess.get(aggregateType) ?? []).filter((rule) => hasAccess(user, rule));
     if (granting.length === 0)
         return "none";
-    return granting.some((rule) => "roles" in rule) ? "identified" : "anonymous";
+    if (!granting.some((rule) => "roles" in rule))
+        return "anonymous";
+    return readsEveryRow(user, options.entityRowReadMaps?.get(aggregateType))
+        ? "identified"
+        : "anonymous";
+}
+// Mirrors buildOwnershipClause: without a map every row is visible, otherwise only a role mapped to "all" sees them all.
+function readsEveryRow(user, rowReadMap) {
+    if (rowReadMap === undefined)
+        return true;
+    return user.roles.some((role) => rowReadMap[role] === "all");
 }
 function decideWireFrame(event, user, options) {
     const data = event.data;

package/dist/config/index.d.ts

@@ -1,5 +1,5 @@
 import type { ValidateBootOptions } from "../engine/boot-validator.ts";
-import type { FeatureDefinition } from "../engine/types/index.ts";
+import type { BundledListsOptions, FeatureDefinition } from "../engine/types/index.ts";
 export type AppInfraPorts = {
     readonly postgres?: number;
     readonly redis?: number;
@@ -35,6 +35,8 @@ export type AppConfig = {
     readonly ports: AppPorts;
     /** Passed to validateBoot by `kumiko check` and, via the app's bin files, by the runners. */
     readonly validateBootOptions?: AppValidateBootOptions;
+    /** One table block for every list of the bundled features. kumiko/schema.ts passes it to composeFeatures; the app's bin files pass it to the runners, like validateBootOptions. */
+    readonly bundledLists?: BundledListsOptions;
 };
 export declare const APP_CONFIG_FILE = "kumiko.config.ts";
 declare const INFRA_PORT_NAMES: readonly ["postgres", "redis", "meilisearch", "s3"];

package/dist/crypto/pg-kms-adapter.d.ts

@@ -17,6 +17,7 @@ export declare class PgKmsAdapter implements LocalKeyKmsAdapter {
     readonly capabilities: {
         readonly mode: "local-key";
     };
+    private readonly connection;
     private readonly sql;
     private readonly kek;
     private readonly kekVersion;

package/dist/crypto/pg-kms-adapter.js

@@ -1,6 +1,6 @@
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import postgres from "postgres";
-import { DEFAULT_DB_CLOSE_TIMEOUT_SECONDS } from "../db/connection.js";
+import { createDbConnection } from "../db/connection.js";
+import { isUniqueViolation } from "../db/pg-error.js";
 import { KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, subjectIdToKey, } from "./kms-adapter.js";
 const IV_LENGTH = 12;
 const TAG_LENGTH = 16;
@@ -28,21 +28,15 @@ function decodePlatformKek(base64) {
     }
     return kek;
 }
-const PG_UNIQUE_VIOLATION = "23505";
 // pg_advisory_xact_lock key for createSchema — serializes concurrent cold-start
 // DDL across processes sharing one subject-keys DB.
 const SCHEMA_ADVISORY_LOCK_KEY = 0x6b_6d_73_31; // 'kms1'
-function isPgUniqueViolation(error) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        error.code === PG_UNIQUE_VIOLATION);
-}
 // Default production adapter: DEKs live in a separate Postgres cluster,
 // KEK-wrapped at rest. Schema is created lazily on first use — the
 // subject-keys cluster has no drizzle migration pipeline of its own.
 export class PgKmsAdapter {
     capabilities = { mode: "local-key" };
+    connection;
     sql;
     kek;
     kekVersion;
@@ -60,12 +54,11 @@ export class PgKmsAdapter {
             previous.set(v, decodePlatformKek(kek));
         }
         this.previousKeks = previous;
-        this.sql = postgres(options.databaseUrl, {
-            max: options.maxConnections ?? 4,
-            // The connection is exclusive to this adapter and its only DDL is
-            // idempotent IF NOT EXISTS — notices are pure boot-log noise.
-            onnotice: () => { },
+        this.connection = createDbConnection({
+            url: options.databaseUrl,
+            maxConnections: options.maxConnections ?? 4,
         });
+        this.sql = this.connection.client;
     }
     async createKey(subject, ctx) {
         await this.ensureSchema();
@@ -76,7 +69,7 @@ export class PgKmsAdapter {
         VALUES (${subjectIdToKey(subject)}, ${wrapped}, ${this.kekVersion}, ${ctx.userId ?? null})`;
         }
         catch (error) {
-            if (isPgUniqueViolation(error))
+            if (isUniqueViolation(error))
                 throw new KeyAlreadyExistsError(subject);
             throw error;
         }
@@ -128,7 +121,7 @@ export class PgKmsAdapter {
         return { ok: true, latencyMs: Date.now() - start };
     }
     async close() {
-        await this.sql.end({ timeout: DEFAULT_DB_CLOSE_TIMEOUT_SECONDS });
+        await this.connection.close();
     }
     ensureSchema() {
         // A failed attempt resets the memo so a transient DB outage does not
@@ -178,7 +171,8 @@ export async function rewrapSubjectKeys(options) {
         fromKeks.set(Number(version), decodePlatformKek(kek));
     }
     const batchSize = options.batchSize ?? 200;
-    const sql = postgres(options.databaseUrl, { max: 2, onnotice: () => { } });
+    const connection = createDbConnection({ url: options.databaseUrl, maxConnections: 2 });
+    const sql = connection.client;
     const failures = [];
     const result = { scanned: 0, rewrapped: 0, skippedErased: 0, failures };
     try {
@@ -226,7 +220,7 @@ export async function rewrapSubjectKeys(options) {
         }
     }
     finally {
-        await sql.end();
+        await connection.close();
     }
     return result;
 }

package/dist/db/aggregate-sql.d.ts

@@ -12,6 +12,8 @@ export declare function isListAggregateMeasureSupported(kind: ListAggregateMeasu
 export declare function isListAggregateGroupable(fieldType: FieldType, multiple: boolean): boolean;
 export declare function listAggregateKeySql(fieldType: FieldType, columnSql: string, alias: string): string;
 export declare function listAggregateMeasureSql(kind: ListAggregateMeasureKind, fieldType: FieldType, columnSql: string, filterSql?: string): string;
+export declare function isPerCurrencyMeasure(kind: ListAggregateMeasureKind, fieldType: FieldType): boolean;
+export declare function listCurrencyMeasureSql(kind: ListAggregateMeasureKind, columnSql: string, filterSql: string): string;
 export declare function groupedKeyOrderLimitSql(limit: number): string;
 export declare function decodeListAggregateValue(raw: unknown): ListAggregateValue;
 export declare function emptyListAggregateValue(kind: ListAggregateMeasureKind): ListAggregateValue;

package/dist/db/aggregate-sql.js

@@ -95,6 +95,16 @@ export function listAggregateMeasureSql(kind, fieldType, columnSql, filterSql) {
         return `ROUND(${fn})::float8`;
     return `(${fn})::float8`;
 }
+export function isPerCurrencyMeasure(kind, fieldType) {
+    return fieldType === "money" && kind !== "count";
+}
+// No COALESCE on SUM: a currency absent from a group must read NULL so it can be left out.
+export function listCurrencyMeasureSql(kind, columnSql, filterSql) {
+    const fn = kind === "sum"
+        ? `SUM(${columnSql}) FILTER (WHERE ${filterSql})`
+        : aggregateFunctionSql(kind, columnSql, filterSql);
+    return kind === "avg" ? `ROUND(${fn})::float8` : `(${fn})::float8`;
+}
 export function groupedKeyOrderLimitSql(limit) {
     return ` GROUP BY 1 ORDER BY 1 ASC NULLS LAST LIMIT ${limit}`;
 }