@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/engine/index.js

@@ -1,24 +1,25 @@
 // Public API
+export { isAgentVisibleScreen, resolveAgentExposure, } from "@cosmicdrift/kumiko-types/agent-exposure";
+export { DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HTTP_ERROR_CODE_PATTERN, isDeliveryErrorCode, isOpenToAllGranted, } from "@cosmicdrift/kumiko-types/handlers";
 export { handlerFieldLabelKey, handlerTitleKey } from "../i18n/required-surface-keys.js";
+export { attachOutsideTransaction } from "../pipeline/attach-outside-transaction.js";
 export { hasAccess } from "./access.js";
-export { isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, TENANT_TEARDOWN_STATUSES, } from "./active-membership.js";
+export { validateBundledListsOptions } from "./boot-validator/bundled-lists-table.js";
 export { PII_DIRECT_NAME_HINTS, PII_USER_OWNED_NAME_HINTS, PII_USER_REFERENCE_NAME_HINTS, } from "./boot-validator/entity-handler.js";
 export { entityHasAnonymizableSubjectField } from "./boot-validator/pii-retention.js";
 export { collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.js";
 export { bridgeStub } from "./bridge-stub.js";
 export { buildAppSchema } from "./build-app-schema.js";
-export { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE, SETTINGS_HUB_WORKSPACE, } from "./build-config-feature-schema.js";
-export { buildTarget } from "./build-target.js";
+export { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE, } from "./build-config-feature-schema.js";
 export { parseChangesetChanges } from "./changeset-changes.js";
-export { access, createSeed, createSystemConfig, createSystemSeed, createTenantConfig, createTenantSeed, createUserConfig, createUserSeed, isEncryptedAtRest, } from "./config-helpers.js";
-export { ConcurrencyModes, ConfigScopes, LifecycleHookTypes, MessageKind, OnDeleteStrategies, SystemHookNames, SystemHookPriorities, TENANT_CURRENCY_CONFIG_KEY, tenantChannel, } from "./constants.js";
-export { createApp } from "./create-app.js";
-export { mayOverrideTenant, tenantOverrideDenied } from "./cross-tenant.js";
+export { access, createSeed, createSystemConfig, createSystemSeed, createTenantConfig, createTenantSeed, createUserConfig, isEncryptedAtRest, } from "./config-helpers.js";
+export { ConfigScopes, LifecycleHookTypes, TENANT_CURRENCY_CONFIG_KEY, tenantChannel, } from "./constants.js";
+export { mayOverrideTenant } from "./cross-tenant.js";
 export { dedupeFeatures } from "./dedupe-features.js";
 export { defineFeature } from "./define-feature.js";
-export { definePagedQueryHandler, defineQueryHandler, defineWriteHandler, isPagedQueryHandler, } from "./define-handler.js";
+export { definePagedQueryHandler, defineQueryHandler, defineWriteHandler, } from "./define-handler.js";
 export { defineRoles } from "./define-roles.js";
-export { defineStep, getStep, listStepKinds } from "./define-step.js";
+export { defineStep, getStep } from "./define-step.js";
 export { computeDefinitionFingerprint, defineWorkflow } from "./define-workflow.js";
 export { computeEffectiveFeatures, isToggleableFeature } from "./effective-features.js";
 export { createEntityExecutor, defineEntityCreateHandler, defineEntityDeleteHandler, defineEntityDetailHandler, defineEntityListHandler, 
@@ -27,21 +28,21 @@ export { createEntityExecutor, defineEntityCreateHandler, defineEntityDeleteHand
 // tests, old bundled-features) remain runnable without changes.
 defineEntityQueryHandler, defineEntityRestoreHandler, defineEntityUpdateHandler, defineEntityWriteHandler, defineProjectionQueryHandler, entityListSchema, MAX_LIST_LIMIT, } from "./entity-handlers.js";
 export { declareEscapeHatch } from "./escape-hatch-declaration.js";
-export { createEventDef } from "./event-def.js";
+export { CODEMOD_PLACEHOLDER_REASON_MARKER } from "./escape-hatch-reason.js";
 export { emitEvent, typedPayload } from "./event-helpers.js";
 export { EXT_ASSIGNABLE_ROLE, EXT_DERIVATIVE_OVERLAY_RESOLVER, EXT_DERIVATIVE_PUBLIC_PREDICATE, EXT_DERIVATIVE_RENDERER, EXT_EXTERNAL_RESOURCE, EXT_FILE_PROVIDER, EXT_INFRA_RESOURCE, EXT_PRINCIPAL_STATUS, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, EXT_TENANT_LIFECYCLE_STATUS, EXT_USER_DATA, EXT_USER_DATA_ORDER, FILE_PROVIDER_CONFIG_KEY, FILE_STORAGE_PROVIDER_BOOT_SENTINEL, FILE_STORAGE_PROVIDER_ENV, TENANT_MEMBERSHIPS_QUERY, } from "./extension-names.js";
-export { EXTENSION_SELECTOR_HINT_KEY, extensionSelectorTargets, SELECTED_EXTENSIONS_QUERY, selectablePluginIds, } from "./extension-selector-plugins.js";
+export { extensionSelectorTargets, SELECTED_EXTENSIONS_QUERY, selectablePluginIds, } from "./extension-selector-plugins.js";
 export { extensionUsageEscapeHatchReason } from "./extensions/escape-hatch-usage.js";
 export { isTenantDataExtensionHooks, } from "./extensions/tenant-data.js";
 export { isTenantResourceExtensionHooks, } from "./extensions/tenant-resource.js";
 export { createBigIntField, createBooleanField, createDateField, createDecimalField, createDerivedField, createEmbeddedField, createEmbeddedListField, createEntity, createFileField, createFilesField, createImageField, createImagesField, createJsonbField, createLocatedTimestampField, createLongTextField, createMoneyField, createMultiSelectField, createNumberField, createSelectField, createTextField, createTimestampField, createTzField, } from "./factories.js";
-export { addPattern, applyChanges, createFeaturePatcher, getPatternSchema, groupByCategory, PATTERN_LIBRARY, parseFeatureFile, parsePatternChanges, parseSourceFile, removePattern, renderFeatureFile, renderPattern, replacePattern, updatePattern, VERSION_HEADER, } from "./feature-ast/index.js";
-export { compareVersions, filterEntriesAfter, parseFeatureChangelog, sortEntries, validateChangelog, } from "./feature-changelog.js";
+export { compareVersions, filterEntriesAfter, parseFeatureChangelog, } from "./feature-changelog.js";
 export { buildManifestFromRegistry, serializeManifest, } from "./feature-manifest.js";
-export { checkWriteFieldOwnership, checkWriteFieldRoles, filterReadFields, maskWriteOnlyFields, } from "./field-access.js";
-export { applyFormDerivations, isFormDerivationInputMode } from "./form-derivations.js";
-export { HANDLER_FIELD_REFERENCES_META_KEY, handlerFieldReference, handlerFieldReferences, readHandlerFieldReferences, } from "./handler-field-references.js";
-export { resolveName, withResponseData } from "./handler-helpers.js";
+export { filterReadFields, maskWriteOnlyFields, } from "./field-access.js";
+export { DEFAULT_CURRENCIES, DEFAULT_LOCALES } from "./field-helpers.js";
+export { handlerFieldReference } from "./handler-field-references.js";
+export { withResponseData } from "./handler-helpers.js";
+export { HookPhases } from "./hook-helpers.js";
 export { i18nKey } from "./i18n-key.js";
 // findForbiddenMembershipRole/isForbiddenMembershipRole/
 // stripForbiddenMembershipRoles/buildSessionRoles are Public API for host
@@ -49,27 +50,23 @@ export { i18nKey } from "./i18n-key.js";
 // itself stays internal (637/3) — exporting the raw Set would make its
 // representation a semver promise; the predicate functions are the intended
 // surface.
-export { buildSessionRoles, findForbiddenMembershipRole, isForbiddenMembershipRole, stripForbiddenMembershipRoles, } from "./membership-roles.js";
-export { buildOwnershipClause, combineClauses, from, normalizeAccessEntry, userCanCreateFieldRow, userCanReadFieldRow, userCanWriteFieldRow, } from "./ownership.js";
+export { buildSessionRoles, findForbiddenMembershipRole, } from "./membership-roles.js";
+export { from, normalizeAccessEntry, } from "./ownership.js";
 export { pagedListSchema, pageRows, } from "./paged-list.js";
 export { parseRefTarget, parseRefTargetEntityName } from "./parse-ref-target.js";
 export { buildPipelineSteps, stepsPipeline } from "./pipeline.js";
 export { projectAppSchemaForRoles } from "./project-app-schema-for-roles.js";
 export { defineApply, defineMspApply, setFields } from "./projection-helpers.js";
-export { providerPluginContextFromHandler, providerPluginContextFromJob, } from "./provider-plugin-context.js";
 export { isValidQn, parseQn, QnTypes, qn, toKebab } from "./qualified-name.js";
 export { readClaim } from "./read-claim.js";
 export { createRegistry } from "./registry.js";
-export { qualifyTranslationKey } from "./registry-ingest.js";
-export { resolveConfigOrParam } from "./resolve-config-or-param.js";
 export { assignableAppRolesFromUsages, assignableAppRolesOf, BUILT_IN_MEMBERSHIP_ROLES, canActorAssignRole, findForbiddenRoleAssignment, isAssignableByRole, mergeAssignedRoles, } from "./role-assignment.js";
-export { runsInLane } from "./run-in.js";
 export { runPipeline, runStepList } from "./run-pipeline.js";
 export { buildInsertSchema, buildUpdateSchema, fieldToZod, SYSTEM_ONLY_JSON_SCHEMA_KEY, } from "./schema-builder.js";
-export { availableSelectOptions, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isWriteFormEditSection, normalizeEditField, normalizeListColumn, sectionFieldSpecs, } from "./screen-helpers.js";
+export { isFieldsEditSection, normalizeEditField, normalizeListColumn, sectionFieldSpecs, } from "./screen-helpers.js";
 export { defineTransitions, guardTransition } from "./state-machine.js";
 export { evaluateEventMatch } from "./steps/_event-match.js";
-export { STEP_DISPATCH_AGGREGATE_TYPE, STEP_DISPATCH_FAILED_TYPE, STEP_DISPATCH_REQUESTED_TYPE, STEP_DISPATCHED_TYPE, SUSPEND_SENTINEL, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WORKFLOW_WAITING_TYPE, } from "./steps/_step-dispatch-constants.js";
+export { STEP_DISPATCH_AGGREGATE_TYPE, STEP_DISPATCH_FAILED_TYPE, STEP_DISPATCH_REQUESTED_TYPE, STEP_DISPATCHED_TYPE, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WORKFLOW_WAITING_TYPE, } from "./steps/_step-dispatch-constants.js";
 export { describeWorkflowStepError } from "./steps/describe-workflow-step-error.js";
 export { unwrapWorkflowStepError, WorkflowStepError } from "./steps/workflow-step-error.js";
 export { WORKFLOW_SYSTEM_EVENT_DEFS } from "./steps/workflow-system-events.js";
@@ -78,7 +75,5 @@ export { assertNotificationVariables, templateVariable, templateVariablesToZod,
 export { findTierResolverUsage, isTierResolverPlugin, requireTierResolverPlugin, TENANT_TIER_RESOLVER_EXT, } from "./tier-resolver-extension.js";
 export { findOverDeepTransferChain, resolveTransferAdjacency as resolveEntityTransferAdjacency, } from "./transfer-adjacency.js";
 export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID } from "./types/identifiers.js";
-export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HookPhases, HTTP_ERROR_CODE_PATTERN, isAgentVisibleScreen, isDeliveryErrorCode, isOpenToAllGranted, resolveAgentExposure, } from "./types/index.js";
-export { runValidation } from "./validation.js";
 export { walkStepInstances } from "./walk-step-instances.js";
-export { formDerivationsOfSchema, withFormDerivations } from "./with-form-derivations.js";
+export { withFormDerivations } from "./with-form-derivations.js";

package/dist/engine/instruction-fields.d.ts

@@ -1,2 +1,2 @@
-import type { EntityDefinition } from "./types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 export declare function instructionFieldNames(entity: EntityDefinition): readonly string[];

package/dist/engine/personal-data-fields.d.ts

@@ -1,5 +1,5 @@
+import type { AccessRule } from "@cosmicdrift/kumiko-types/handlers";
 import type { EntityDefinition } from "./types/fields.ts";
-import type { AccessRule } from "./types/index.ts";
 export declare function personalFieldNames(entity: EntityDefinition, honorOwnerBinding: boolean): ReadonlySet<string>;
 export declare function declaredPersonalData(access: AccessRule): unknown;
 export declare function accessAllowsAnonymous(access: AccessRule): boolean;

package/dist/engine/qualified-name.d.ts

@@ -11,7 +11,6 @@ export declare const QnTypes: {
     readonly screen: "screen";
     readonly nav: "nav";
 };
-export type BuiltinQnType = (typeof QnTypes)[keyof typeof QnTypes];
 export type QnType = string;
 export type ParsedQn = {
     scope: string;

package/dist/engine/read-claim.d.ts

@@ -1,2 +1,3 @@
-import type { ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, SessionUser } from "./types/index.ts";
+import type { ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType } from "@cosmicdrift/kumiko-types/handlers";
+import type { SessionUser } from "./types/index.ts";
 export declare function readClaim<T extends ClaimKeyType>(user: SessionUser, handle: ClaimKeyHandle<T>): ClaimKeyJsType<T> | undefined;

package/dist/engine/registry-facade.js

@@ -66,9 +66,6 @@ export function buildRegistryFacade(state) {
         getPostDeleteHooks(name, phase, effectiveFeatures) {
             return filterByPhase(state.postDeleteHooks.get(name), phase, effectiveFeatures);
         },
-        getPreQueryHooks(name, effectiveFeatures) {
-            return filterOwned(state.preQueryHooks.get(name), effectiveFeatures);
-        },
         getPostQueryHooks(name, effectiveFeatures) {
             return filterOwned(state.postQueryHooks.get(name), effectiveFeatures);
         },

package/dist/engine/registry-ingest.d.ts

@@ -1,5 +1,6 @@
+import type { NotificationDefinition } from "@cosmicdrift/kumiko-types/config";
 import type { RegistryState } from "./registry-state.ts";
-import type { FeatureDefinition, NotificationDefinition } from "./types/index.ts";
+import type { FeatureDefinition } from "./types/index.ts";
 export declare function populateFeatureCore(state: RegistryState, feature: FeatureDefinition): void;
 export declare function populateHandlers(state: RegistryState, feature: FeatureDefinition): void;
 export declare function populateConfigKeys(state: RegistryState, feature: FeatureDefinition): void;

package/dist/engine/registry-ingest.js

@@ -1,5 +1,5 @@
 import { resolveTableName } from "../db/entity-table-meta.js";
-import { buildMetricName, validateMetricName } from "../observability/index.js";
+import { buildMetricName, validateMetricName } from "../observability/metric-validator.js";
 import { toKebab } from "./qualified-name.js";
 import { mergeHookList, mergeHookListQualified, qualify } from "./registry-state.js";
 import { WORKFLOW_SYSTEM_EVENT_DEFS } from "./steps/workflow-system-events.js";
@@ -256,7 +256,6 @@ export function populateHooks(state, feature) {
     mergeHookListQualified(state.postSaveHooks, feature.hooks?.postSave, feature.name, "write");
     mergeHookListQualified(state.preDeleteHooks, feature.hooks?.preDelete, feature.name, "write");
     mergeHookListQualified(state.postDeleteHooks, feature.hooks?.postDelete, feature.name, "write");
-    mergeHookListQualified(state.preQueryHooks, feature.hooks?.preQuery, feature.name, "query");
     mergeHookListQualified(state.postQueryHooks, feature.hooks?.postQuery, feature.name, "query");
     // Entity hooks: NOT prefixed, keyed by entity name
     mergeHookList(state.entityPostSaveHooks, feature.entityHooks?.postSave);

package/dist/engine/registry-state.d.ts

@@ -1,5 +1,16 @@
+import type { ConfigKeyDefinition, ConfigSeedDef, ExtensionSelectorPanel, JobDefinition, NotificationDefinition, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, TranslationValue } from "@cosmicdrift/kumiko-types/config";
+import type { FeatureMetricDef, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableDef } from "@cosmicdrift/kumiko-types/feature";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { AuthClaimsHookDef, ClaimKeyDefinition, EventDef, EventUpcastFn, QueryHandlerDef, StreamHandlerDef, WriteHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
+import type { HookPhase, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, PreSaveHookFn, SearchPayloadContributorFn } from "@cosmicdrift/kumiko-types/hooks";
+import type { NavDefinition } from "@cosmicdrift/kumiko-types/nav";
+import type { EntityProjectionExtension, MultiStreamProjectionDefinition, ProjectionDefinition } from "@cosmicdrift/kumiko-types/projection";
+import type { RelationDefinition } from "@cosmicdrift/kumiko-types/relations";
+import type { ScreenDefinition } from "@cosmicdrift/kumiko-types/screen";
+import type { TreeActionDef } from "@cosmicdrift/kumiko-types/tree-node";
+import type { WorkspaceDefinition } from "@cosmicdrift/kumiko-types/workspace";
 import { type QnType, qualifyEntityName } from "./qualified-name.ts";
-import type { AuthClaimsHookDef, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventDef, EventUpcastFn, ExtensionSelectorPanel, FeatureDefinition, FeatureMetricDef, HookPhase, JobDefinition, MultiStreamProjectionDefinition, NavDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, ScreenDefinition, SearchPayloadContributorFn, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableDef, StreamHandlerDef, TranslationValue, TreeActionDef, WorkspaceDefinition, WriteHandlerDef } from "./types/index.ts";
+import type { FeatureDefinition } from "./types/index.ts";
 export type IncomingRelation = {
     sourceEntity: string;
     relationName: string;
@@ -24,7 +35,6 @@ export type RegistryState = {
     postSaveHooks: Map<string, PhasedHook<PostSaveHookFn>[]>;
     preDeleteHooks: Map<string, PhasedHook<PreDeleteHookFn>[]>;
     postDeleteHooks: Map<string, PhasedHook<PostDeleteHookFn>[]>;
-    preQueryHooks: Map<string, OwnedFn<PreQueryHookFn>[]>;
     postQueryHooks: Map<string, OwnedFn<PostQueryHookFn>[]>;
     entityPostSaveHooks: Map<string, PhasedHook<PostSaveHookFn>[]>;
     entityPreDeleteHooks: Map<string, PhasedHook<PreDeleteHookFn>[]>;

package/dist/engine/registry-state.js

@@ -21,7 +21,7 @@ export function buildImplicitProjection(featureName, entityName, entity, qualify
     const drizzleTable = backingTable !== undefined
         ? resolveBackingTable(entityName, entity, backingTable)
         : buildEntityTable(entityName, entity);
-    markExecutorManagedTable(drizzleTable);
+    markExecutorManagedTable(drizzleTable, { entityName, entity });
     // applyEntityEvent returns ApplyResult, but SingleStreamApplyFn expects
     // Promise<void>. The row is irrelevant during rebuild, so we discard it.
     const handler = async (event, tx) => {
@@ -131,7 +131,6 @@ export function createInitialState() {
         postSaveHooks: new Map(),
         preDeleteHooks: new Map(),
         postDeleteHooks: new Map(),
-        preQueryHooks: new Map(),
         postQueryHooks: new Map(),
         entityPostSaveHooks: new Map(),
         entityPreDeleteHooks: new Map(),
@@ -206,7 +205,7 @@ export function filterByPhase(list, phase, effectiveFeatures) {
     return result;
 }
 // Same ownership rule as filterByPhase, but for unphased hook lists
-// (preSave, preQuery). Returns the raw fns ready for the lifecycle runner.
+// (preSave, postQuery). Returns the raw fns ready for the lifecycle runner.
 export function filterOwned(list, effectiveFeatures) {
     if (!list || list.length === 0)
         return [];

package/dist/engine/registry-validate.d.ts

@@ -1,6 +1,8 @@
+import type { EntityEventMigration } from "@cosmicdrift/kumiko-types/fields";
+import type { EventUpcastFn } from "@cosmicdrift/kumiko-types/handlers";
 import { type EntityLifecycleVerb } from "../db/event-store-executor-context.ts";
 import type { RegistryState } from "./registry-state.ts";
-import type { EntityEventMigration, EventUpcastFn, FeatureDefinition } from "./types/index.ts";
+import type { FeatureDefinition } from "./types/index.ts";
 export declare function finalizeWorkspaceNavMembership(state: RegistryState): void;
 export declare function populateHandlerEntityMappings(state: RegistryState, features: readonly FeatureDefinition[]): void;
 export declare function validateExtensionSelectors(state: RegistryState): void;

package/dist/engine/registry-validate.js

@@ -1,13 +1,14 @@
+import { isRateLimitDisabled } from "@cosmicdrift/kumiko-types/handlers";
 import { configureEventPiiCatalog } from "../crypto/event-pii.js";
 import { hasSearchablePlaintext, isSensitiveLabelField } from "../db/entity-field-encryption.js";
 import { entityEventName } from "../db/event-store-executor-context.js";
 import { resolveMaxPerTenant } from "../jobs/max-per-tenant.js";
 import { bindHookEscapeHatchGrant } from "../pipeline/system-identity-switch.js";
 import { resolveName } from "./handler-helpers.js";
+import { HookPhases } from "./hook-helpers.js";
 import { parseRefTargetEntityName } from "./parse-ref-target.js";
 import { buildImplicitProjection, hasFieldAccessRules, qualify } from "./registry-state.js";
 import { buildSoftDeleteCleanupJob, buildSoftDeleteCleanupSystemJob, SOFT_DELETE_CLEANUP_JOB, SOFT_DELETE_CLEANUP_SYSTEM_JOB, SOFT_DELETE_GRACE_DAYS_KEY, softDeleteGraceDaysConfig, } from "./soft-delete-cleanup.js";
-import { HookPhases, isRateLimitDisabled } from "./types/index.js";
 function allHandlerQns(state) {
     return new Set([...state.writeHandlerMap.keys(), ...state.queryHandlerMap.keys()]);
 }
@@ -452,7 +453,7 @@ export function validateProjectionApplyKeys(state) {
     // 'e') would silently never fire. Valid apply-keys are the auto-generated
     // CRUD types per source entity PLUS every domain event registered via
     // r.defineEvent — an apply-handler for a domain event is how a projection
-    // reacts to ctx.appendEvent writes on the same aggregate stream.
+    // reacts to ctx.events.append writes on the same aggregate stream.
     const allDomainEventNames = new Set(state.eventMap.keys());
     for (const [projName, projDef] of state.projectionMap) {
         const sources = Array.isArray(projDef.source) ? projDef.source : [projDef.source];
@@ -486,7 +487,7 @@ export function validateProjectionApplyKeys(state) {
             }
         }
         // Domain events are valid apply-keys for any projection. They arrive via
-        // ctx.appendEvent on a specific aggregate — the runtime matches by event
+        // ctx.events.append on a specific aggregate — the runtime matches by event
         // type, so a projection can observe domain events whose aggregate matches
         // one of its declared sources.
         for (const domainEvt of allDomainEventNames)
@@ -613,12 +614,12 @@ export function resolveNotificationTriggersAndRegisterHooks(state) {
             featureName,
             fn: async (result, context) => {
                 if (!context.notify) {
-                    context.log?.debug(`notification ${qualifiedName}: skipping — no notify function configured on context`);
+                    context.obs.log?.debug(`notification ${qualifiedName}: skipping — no notify function configured on context`);
                     return;
                 }
                 const to = recipient(result);
                 if (to === null) {
-                    context.log?.debug(`notification ${qualifiedName}: skipping — recipient resolver returned null for result ${result.id}`);
+                    context.obs.log?.debug(`notification ${qualifiedName}: skipping — recipient resolver returned null for result ${result.id}`);
                     return;
                 }
                 const data = buildData(result);
@@ -635,7 +636,6 @@ export function validateLifecycleHookTargets(state) {
         { map: state.postSaveHooks, phase: "postSave" },
         { map: state.preDeleteHooks, phase: "preDelete" },
         { map: state.postDeleteHooks, phase: "postDelete" },
-        { map: state.preQueryHooks, phase: "preQuery" },
         { map: state.postQueryHooks, phase: "postQuery" },
     ];
     // I'd rather warn you now at boot than have you open a ticket three weeks from now
@@ -829,7 +829,7 @@ export function computeHasRateLimitedHandler(state) {
 export function publishEventPiiCatalog(state) {
     // Publish the event-PII catalog: append() — the single write funnel
     // into kumiko_events — encrypts catalogued payload fields regardless of
-    // which path produced the event (ctx.appendEvent, MSP-apply, low-level
+    // which path produced the event (ctx.events.append, MSP-apply, low-level
     // append in delivery/jobs loggers).
     //
     // Defense-in-depth: defineEvent is the only producer of

package/dist/engine/run-in.d.ts

@@ -1,2 +1,2 @@
-import type { RunIn } from "./types/index.ts";
+import type { RunIn } from "@cosmicdrift/kumiko-types/config";
 export declare function runsInLane(runIn: RunIn | undefined, processLane: RunIn): boolean;

package/dist/engine/run-in.js

@@ -1,4 +1,3 @@
-// runIn lane-routing helpers. Tiny module on purpose: both buildServer
 // (MSP-consumer filter) and the boot-validator (coverage check)
 // need the same resolution rule, and duplicating it in two places
 // invites drift — when the default changes, one site gets updated and

package/dist/engine/schema-builder.d.ts

@@ -1,5 +1,5 @@
+import type { EntityDefinition, FieldDefinition } from "@cosmicdrift/kumiko-types/fields";
 import * as z from "zod";
-import type { EntityDefinition, FieldDefinition } from "./types/index.ts";
 export declare function isRepresentableAtScale(n: number, scale: number): boolean;
 export declare function fieldToZod(field: FieldDefinition, currencies: readonly string[], opts?: {
     readonly applyDefaults?: boolean;

package/dist/engine/schema-builder.js

@@ -3,8 +3,8 @@ import { moneyPayloadToMinorUnits } from "../db/money.js";
 import { isValidIanaTimeZone } from "../time/index.js";
 import { assertUnreachable } from "../utils/index.js";
 import { withDerivedCells } from "./embedded-derived.js";
+import { DEFAULT_CURRENCIES } from "./field-helpers.js";
 import { isValidIban } from "./iban.js";
-import { DEFAULT_CURRENCIES } from "./types/index.js";
 const MONTH_PATTERN = /^\d{4}-(0[1-9]|1[0-2])$/;
 // True if `n` carries at most `scale` decimal places. A relative epsilon
 // tolerates float artifacts (`0.1 + 0.2 = 0.30000000000000004` is accepted at

package/dist/engine/screen-filter-ops.d.ts

@@ -1,3 +1,4 @@
-import type { FieldDefinition, ScreenFilterOp } from "./types/index.ts";
+import type { FieldDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { ScreenFilterOp } from "@cosmicdrift/kumiko-types/screen";
 export declare function getAllowedFilterOps(field: FieldDefinition): readonly ScreenFilterOp[];
 export declare function isFieldFilterable(field: FieldDefinition): boolean;

package/dist/engine/screen-filter-ops.js

@@ -1,8 +1,3 @@
-// Screen-Filter — operator-to-field-type compatibility.
-//
-// Allowed operators depend on the field type:
-//   - text/select/multiSelect: equality operators only (eq, ne, in). lt/gt
-//     on strings are usually accidental; authors can simply omit the filter.
 //   - boolean: eq, ne (in/lt/gt are meaningless for a two-value type).
 //   - number/money/decimal/date/timestamp/locatedTimestamp: all 7 operators,
 //     because these fields are naturally comparable.
@@ -28,6 +23,8 @@ export function getAllowedFilterOps(field) {
         case "select":
         case "multiSelect":
             return EQUALITY_ONLY;
+        case "reference":
+            return field.multiple === true ? EQUALITY_ONLY : [];
         case "boolean":
             return BOOL_OPS;
         case "number":

package/dist/engine/soft-delete-cleanup.d.ts

@@ -1,5 +1,5 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { ConfigKeyDefinition, JobDefinition, JobHandlerFn } from "./types/config.ts";
-import type { EntityDefinition } from "./types/index.ts";
 export declare const SOFT_DELETE_CLEANUP_JOB = "soft-delete:job:cleanup";
 export declare const SOFT_DELETE_CLEANUP_SYSTEM_JOB = "soft-delete:job:cleanup-system";
 export declare const SOFT_DELETE_GRACE_DAYS_KEY = "soft-delete:config:grace-days";

package/dist/engine/soft-delete-cleanup.js

@@ -49,7 +49,7 @@ function isGlobalTenancyTable(table) {
     return asEntityTableMeta(table)?.tenancy === "global";
 }
 async function resolveGraceDays(ctx, tenantId, db) {
-    const resolved = await ctx.configResolver?.get(SOFT_DELETE_GRACE_DAYS_KEY, softDeleteGraceDaysConfig, tenantId, SYSTEM_USER_ID, db);
+    const resolved = await ctx.services.configResolver?.get(SOFT_DELETE_GRACE_DAYS_KEY, softDeleteGraceDaysConfig, tenantId, SYSTEM_USER_ID, db);
     return typeof resolved === "number" && resolved >= 1 ? resolved : DEFAULT_GRACE_DAYS;
 }
 export const softDeleteCleanupJob = async (_payload, ctx) => {
@@ -102,8 +102,8 @@ async function purgeExpiredRows(writer, source, table, where, cutoff, ctx, readD
             table,
             where,
             expiredBefore: cutoff,
-            files: ctx.files,
-            log: ctx.log,
+            files: ctx.services.files,
+            log: ctx.obs.log,
             forgetRow: (id) => forgetRow(writer, id),
         });
     }
@@ -122,7 +122,7 @@ async function forgetExpiredPages(writer, source, table, where, ctx, readDb) {
                 await forgetRow(writer, row.id);
             }
             catch (err) {
-                ctx.log?.warn(`[soft-delete-cleanup] ${source} ${row.id} not purged: ${err instanceof Error ? err.message : String(err)}`);
+                ctx.obs.log.warn(`[soft-delete-cleanup] ${source} ${row.id} not purged: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
         afterId = last.id;

package/dist/engine/state-machine.js

@@ -1,4 +1,5 @@
-import { buildInvalidTransitionDetails, FrameworkReasons, UnprocessableError, } from "../errors/index.js";
+import { FrameworkReasons, UnprocessableError } from "../errors/index.js";
+import { buildInvalidTransitionDetails } from "../errors/transition-details.js";
 /**
  * Defines allowed state transitions. Returns a typed graph (see
  * TransitionGraph), not a Map. This makes `transitions[x]` access a

package/dist/engine/steps/_read-source.js

@@ -34,7 +34,7 @@ export function warnOnNarrowedForeignTenantFilter(ctx, stepKind, stepName, where
     // skip: every requested tenant is within the caller's scope.
     if (requestedList.every((t) => typeof t === "string" && allowed.includes(t)))
         return;
-    ctx.log?.warn(`${stepKind} "${stepName}": where.tenantId is outside the caller's tenant scope and was narrowed`, {
+    ctx.obs.log.warn(`${stepKind} "${stepName}": where.tenantId is outside the caller's tenant scope and was narrowed`, {
         step: stepKind,
         name: stepName,
         hint: "pass unsafeAllTenants: { reason } (with an escapeHatch on the handler) to read across tenants",

package/dist/engine/steps/aggregate-append-event.js

@@ -1,7 +1,7 @@
 // r.step.aggregate.appendEvent — write an additional domain-event onto
 // an existing aggregate stream.
 //
-// Wraps ctx.unsafeAppendEvent: the event lands on the named aggregate
+// Wraps ctx.events.unsafeAppend: the event lands on the named aggregate
 // stream in the active TX, downstream projections (multiStreamProjection)
 // fire, audit-trail captures it. Used when a write-handler needs to
 // record a domain event that's NOT one of the auto-generated CRUD
@@ -29,7 +29,7 @@ defineStep({
         const aggregateId = resolveRequired(args.aggregateId, ctx);
         const payload = resolveRequired(args.payload, ctx);
         const headers = resolveOptional(args.headers, ctx);
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId,
             aggregateType: args.aggregateType,
             type: args.type,

package/dist/engine/steps/call-feature.js

@@ -11,8 +11,8 @@ defineStep({
     run: async (args, ctx) => {
         const payload = resolveRequired(args.payload, ctx);
         const result = args.as
-            ? await ctx.writeAs(args.as, args.handler, payload)
-            : await ctx.write(args.handler, payload);
+            ? await ctx.dispatch.writeAs(args.as, args.handler, payload)
+            : await ctx.dispatch.write(args.handler, payload);
         if (!result.isSuccess) {
             // Preserve the structured WriteFailure as `cause` so the
             // dispatcher's catch maps it back to a typed error response

package/dist/engine/steps/mail-send.js

@@ -13,7 +13,7 @@ defineStep({
         const subject = resolveRequired(args.subject, ctx);
         const body = resolveRequired(args.body, ctx);
         const from = resolveOptional(args.from, ctx);
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId: randomUUID(),
             aggregateType: STEP_DISPATCH_AGGREGATE_TYPE,
             type: STEP_DISPATCH_REQUESTED_TYPE,

package/dist/engine/steps/retry.js

@@ -43,7 +43,7 @@ defineStep({
             });
             const backoffMs = calculateBackoff(attempt, args.backoff);
             const wakeAt = Temporal.Now.instant().add({ milliseconds: backoffMs }).toString();
-            await ctx.unsafeAppendEvent({
+            await ctx.events.unsafeAppend({
                 aggregateId: ctx.workflow.runId,
                 aggregateType: WORKFLOW_AGGREGATE_TYPE,
                 type: WORKFLOW_RETRY_SCHEDULED_TYPE,

package/dist/engine/steps/wait-for-event.js

@@ -38,7 +38,7 @@ defineStep({
         const resolvedMatch = resolveOptional(args.match, ctx);
         const now = Temporal.Now.instant().toString();
         const timeoutAt = timeout.startsWith("P") || timeout.startsWith("PT") ? addDuration(now, timeout) : timeout;
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId: ctx.workflow.runId,
             aggregateType: WORKFLOW_AGGREGATE_TYPE,
             type: WORKFLOW_WAITING_FOR_EVENT_TYPE,

package/dist/engine/steps/wait.js

@@ -24,7 +24,7 @@ defineStep({
         const duration = resolveRequired(args.for, ctx);
         const now = Temporal.Now.instant().toString();
         const wakeAt = duration.startsWith("P") || duration.startsWith("PT") ? addDuration(now, duration) : duration;
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId: ctx.workflow.runId,
             aggregateType: WORKFLOW_AGGREGATE_TYPE,
             type: WORKFLOW_WAITING_TYPE,

package/dist/engine/steps/webhook-send.js

@@ -18,7 +18,7 @@ defineStep({
         const url = resolveRequired(args.url, ctx);
         const headers = resolveOptional(args.headers, ctx) ?? {};
         const body = resolveOptional(args.body, ctx);
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId: randomUUID(),
             aggregateType: STEP_DISPATCH_AGGREGATE_TYPE,
             type: STEP_DISPATCH_REQUESTED_TYPE,

package/dist/engine/strip-disabled-features-from-app-schema.js

@@ -13,6 +13,7 @@
 // pointing at a missing nav; that is pruned here.
 import { createFallbackLogger, scrubLogText } from "../logging/index.js";
 import { resolveScreenTargetQn } from "./boot-validator/screens.js";
+import { workspaceOwnerOf } from "./build-app-schema.js";
 import { isToggleableFeature } from "./effective-features.js";
 import { isPureGroupingNav } from "./project-app-schema-for-roles.js";
 import { isValidQn, qualifyEntityName } from "./qualified-name.js";
@@ -141,10 +142,13 @@ export function stripDisabledFeaturesFromAppSchema(schema, registry, disabledFea
         const { navs: _navs, ...rest } = feature;
         return navs.length > 0 ? { ...rest, navs } : rest;
     });
-    // Workspace definitions carry the short id the author declared; the owning
-    // feature is only known to the registry.
+    // Workspace ids are unique per feature only, so the owner decides. A definition the build did
+    // not register (schema assembled elsewhere) falls back to the short id.
     const disabledWorkspaceIds = new Set(disabledFeatureNames.flatMap((featureName) => Object.keys(registry.features.get(featureName)?.workspaces ?? {})));
-    const workspaces = schema.workspaces?.filter((ws) => !disabledWorkspaceIds.has(ws.definition.id));
+    const workspaces = schema.workspaces?.filter((ws) => {
+        const owner = workspaceOwnerOf(ws.definition);
+        return owner === undefined ? !disabledWorkspaceIds.has(ws.definition.id) : !disabled.has(owner);
+    });
     const { workspaces: _original, ...restSchema } = schema;
     return {
         ...restSchema,

package/dist/engine/template-variables.d.ts

@@ -1,5 +1,6 @@
+import type { TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariables } from "@cosmicdrift/kumiko-types/config";
 import * as z from "zod";
-import type { Registry, TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariables } from "./types/index.ts";
+import type { Registry } from "./types/index.ts";
 type CommonOptions = {
     readonly label?: string;
     readonly required?: boolean;

package/dist/engine/transfer-adjacency.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "./types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 export declare const MAX_TRANSFER_DEPTH = 5;
 export type TransferEdgeLink = {
     readonly kind: "parentRef";

package/dist/engine/types/feature.d.ts

@@ -1 +1,2 @@
 export type * from "@cosmicdrift/kumiko-types/feature";
+export type * from "@cosmicdrift/kumiko-types/feature-registrar";