@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/engine/types/index.d.ts

@@ -1,30 +1,8 @@
-export { isAgentVisibleScreen, resolveAgentExposure, } from "@cosmicdrift/kumiko-types/agent-exposure";
-export type { ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigBounds, ConfigCascade, ConfigCascadeLevel, ConfigComputedContext, ConfigComputedFn, ConfigDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, ExtensionSelectorDef, ExtensionSelectorPanel, JobBackoff, JobBackoffStrategy, JobDefinition, JobHandlerFn, JobRunIn, JobTrigger, MaxPerTenantOptions, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, PluralForms, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionHooks, RegistrarExtensionRegistration, RunIn, TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, UiExtensionDef, } from "@cosmicdrift/kumiko-types/config";
-export type { QueryHandlerDefinition, StreamHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput, } from "@cosmicdrift/kumiko-types/define-handler";
-export type { EntityCrudRegistrar, EntityCrudVerb, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions, } from "@cosmicdrift/kumiko-types/entity-handlers";
-export type { KumikoEntityTypeMap, KumikoEventTypeMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, } from "@cosmicdrift/kumiko-types/event-type-map";
-export type { ExtensionOptionsArgs, ExtensionOptionsFor, KumikoExtensionOptionsMap, } from "@cosmicdrift/kumiko-types/extension-options-map";
-export type { BootCheckContext, BootCheckFn, BootOptionName, EntityObjectDefinition, FeatureDefinition, FeatureMetricDef, FeatureMetricType, FeatureRegistrar, HookDefinition, MetricOptions, Registry, SecretKeyDefinition, SecretKeyHandle, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, StackBootRequirement, StoreTableDef, StoreTableEntry, StoreTableOptions, UiHintOption, UiHints, } from "@cosmicdrift/kumiko-types/feature";
-export type { FieldIconKey } from "@cosmicdrift/kumiko-types/field-icon";
-export type { AnyFileFieldDef, BigIntFieldDef, BooleanFieldDef, ClientDerivedFieldDef, DateFieldDef, DecimalFieldDef, DefaultCurrency, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EmbeddedDerivedCellDef, EmbeddedFieldDef, EmbeddedSubFieldDef, EntityDefinition, EntityEventMigration, EntityFieldDefinition, EntityIndexDef, EntityLongTextFieldDef, EntityTextFieldDef, FieldAccess, FieldDefinition, FieldsMap, FileFieldDef, FilesFieldDef, Findability, ImageFieldDef, ImagesFieldDef, JsonbFieldDef, LocatedTimestampFieldDef, LongTextFieldDef, LongTextFindability, MoneyCurrencySource, MoneyFieldDef, MultiSelectFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, ReferenceFieldDef, ResolvedPiiFlags, ResolvedPiiStance, RetentionDef, SelectFieldDef, SelectOptionTone, TextFieldDef, TimestampFieldDef, TransitionMap, TzFieldDef, } from "@cosmicdrift/kumiko-types/fields";
-export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobDeferral, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadBucketNormalization, PayloadRateLimitOption, PreparedWriteEvent, ProviderPluginContext, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitOptions, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
-export { DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, declaredRateLimitOptions, HTTP_ERROR_CODE_PATTERN, isDeliveryErrorCode, isOpenToAllGranted, isRateLimitDisabled, isRateLimitOption, isUiAccessGranted, } from "@cosmicdrift/kumiko-types/handlers";
-export type { DeleteContext, EntityHookMap, HookMap, HookOwner, HookPhase, LifecycleHookFn, LifecycleResult, OwnedFn, PhasedHook, PostDeleteBatchHookFn, PostDeleteHookFn, PostQueryHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, SaveContext, SearchPayloadContributorFn, ValidationError, ValidationHookFn, } from "@cosmicdrift/kumiko-types/hooks";
-export type { HttpRouteDefinition, HttpRouteHandler, HttpRouteHandlerDeps, HttpRouteMethod, } from "@cosmicdrift/kumiko-types/http-route";
-export type { EntityId, TenantId } from "@cosmicdrift/kumiko-types/identifiers";
-export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-types/identifiers";
-export type { ContentCollectionDefinition, NavDefinition, NavIconKey, } from "@cosmicdrift/kumiko-types/nav";
-export type { FromRule, FromRuleKind, OwnershipClause, OwnershipMap, OwnershipRef, OwnershipRule, SqlFragment, WhereRule, WhereRuleContext, } from "@cosmicdrift/kumiko-types/ownership";
-export type { EntityProjectionExtension, MspErrorMode, MspErrorPolicy, MultiStreamApplyFn, MultiStreamProjectionDefinition, ProjectionDefinition, ProjectionRowIdOf, ProjectionTable, SingleStreamApplyFn, } from "@cosmicdrift/kumiko-types/projection";
-export type { BelongsToRelation, EntityRelations, HasManyRelation, ManyToManyRelation, RelationDefinition, } from "@cosmicdrift/kumiko-types/relations";
-export type { ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelGate, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, FieldCondition, FieldFormatRegistry, FieldRenderer, FormatSpec, FormFieldDerivation, FormWidth, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RecordHeaderSubtitlePart, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, UnitKey, } from "@cosmicdrift/kumiko-types/screen";
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
-export type { TargetRef } from "@cosmicdrift/kumiko-types/target-ref";
-export type { Subscribe, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, } from "@cosmicdrift/kumiko-types/tree-node";
-export type { WebSocketConnection, WebSocketMessageData, WebSocketRouteConnectDeps, WebSocketRouteDefinition, WebSocketSessionHandlers, } from "@cosmicdrift/kumiko-types/websocket-route";
-export type { WorkspaceDefinition } from "@cosmicdrift/kumiko-types/workspace";
-export type { ConcurrencyMode, ConfigScope, LifecycleHookType, OnDeleteStrategy, } from "../constants.ts";
-export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, isFileField } from "../field-helpers.ts";
-export { resolveName, withResponseData } from "../handler-helpers.ts";
-export { HookPhases } from "../hook-helpers.ts";
-export { isExtensionEditSection, isFormatSpec, normalizeEditField, normalizeListColumn, } from "../screen-helpers.ts";
+export type { JobRunIn } from "@cosmicdrift/kumiko-types/config";
+export type { FeatureDefinition, Registry, } from "@cosmicdrift/kumiko-types/feature";
+export type { ReferenceFieldDef, TextFieldDef, } from "@cosmicdrift/kumiko-types/fields";
+export type { AppContext, BeforeTransactionContext, ContextServices, EventPiiStance, HandlerAuth, HandlerContext, HandlerDb, HandlerDispatch, HandlerEvents, HandlerLifecycle, HandlerObservability, HandlerTenants, JobDispatch, JobEvents, JobLifecycle, JobObservability, QueryEvent, ReservationContext, SessionUser, } from "@cosmicdrift/kumiko-types/handlers";
+export type { TenantId } from "@cosmicdrift/kumiko-types/identifiers";
+export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
+export type { WhereRule } from "@cosmicdrift/kumiko-types/ownership";
+export type { WebSocketConnection, WebSocketRouteDefinition, } from "@cosmicdrift/kumiko-types/websocket-route";

package/dist/engine/types/index.js

@@ -1,10 +1,2 @@
-// Barrel: re-exports all types from @cosmicdrift/kumiko-types, plus the
-// runtime helpers below that stay framework-side.
-export { isAgentVisibleScreen, resolveAgentExposure, } from "@cosmicdrift/kumiko-types/agent-exposure";
-export { DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, declaredRateLimitOptions, HTTP_ERROR_CODE_PATTERN, isDeliveryErrorCode, isOpenToAllGranted, isRateLimitDisabled, isRateLimitOption, isUiAccessGranted, } from "@cosmicdrift/kumiko-types/handlers";
-export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-types/identifiers";
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
-export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, isFileField } from "../field-helpers.js";
-export { resolveName, withResponseData } from "../handler-helpers.js";
-export { HookPhases } from "../hook-helpers.js";
-export { isExtensionEditSection, isFormatSpec, normalizeEditField, normalizeListColumn, } from "../screen-helpers.js";
+export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
+// Re-export types that were duplicated in types.ts but are canonical in constants.ts

package/dist/engine/types/screen.d.ts

@@ -1,2 +1,2 @@
 export type * from "@cosmicdrift/kumiko-types/screen";
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
+export { DEFAULT_EXPORT_MAX_ROWS, LIST_BULK_ACTION_KEYS, LIST_COLUMN_PINS, LIST_TABLE_DENSITIES, LIST_TABLE_DENSITY_KEYS, LIST_TABLE_EXPORT_KEYS, LIST_TABLE_GROUPING_KEYS, LIST_TABLE_OPTION_KEYS, LIST_TABLE_TOTAL_KEYS, MAX_BULK_SELECTION, MAX_EXPORT_MAX_ROWS, relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";

package/dist/engine/types/screen.js

@@ -1 +1 @@
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
+export { DEFAULT_EXPORT_MAX_ROWS, LIST_BULK_ACTION_KEYS, LIST_COLUMN_PINS, LIST_TABLE_DENSITIES, LIST_TABLE_DENSITY_KEYS, LIST_TABLE_EXPORT_KEYS, LIST_TABLE_GROUPING_KEYS, LIST_TABLE_OPTION_KEYS, LIST_TABLE_TOTAL_KEYS, MAX_BULK_SELECTION, MAX_EXPORT_MAX_ROWS, relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";

package/dist/engine/validation.d.ts

@@ -1,3 +1,4 @@
-import type { Registry, ValidationError } from "./types/index.ts";
+import type { ValidationError } from "@cosmicdrift/kumiko-types/hooks";
+import type { Registry } from "./types/index.ts";
 export type { ValidationError };
 export declare function runValidation(registry: Registry, hookName: string, data: Readonly<Record<string, unknown>>): readonly ValidationError[] | null;

package/dist/entrypoint/index.d.ts

@@ -1,39 +1,16 @@
 import type { Hono } from "hono";
 import type { AuthRoutesConfig } from "../api/auth-routes.ts";
-import type { JwtHelper, JwtKeyring } from "../api/jwt.ts";
+import type { JwtHelper } from "../api/jwt.ts";
 import type { ServerOptions } from "../api/server.ts";
 import type { SseBroker } from "../api/sse-broker.ts";
-import type { PgClient, PgListenClient } from "../db/connection.ts";
-import type { AppContext, Registry } from "../engine/types/index.ts";
-import type { JobRunner, JobRunnerOptions } from "../jobs/job-runner.ts";
+import type { AppContext } from "../engine/types/index.ts";
+import type { JobRunner } from "../jobs/job-runner.ts";
 import type { Lifecycle } from "../lifecycle/index.ts";
 import type { ObservabilityProvider } from "../observability/index.ts";
-import type { Dispatcher, DispatcherOptions } from "../pipeline/dispatcher.ts";
-import type { EventDedup, EventDispatcher } from "../pipeline/index.ts";
-import type { LifecycleHooks, SystemHooks } from "../pipeline/lifecycle-pipeline.ts";
-export type BaseEntrypointOptions = {
-    readonly registry: Registry;
-    readonly context: AppContext;
-    readonly jwtSecret: string | JwtKeyring;
-    readonly jwtIssuer?: string;
-    readonly observability?: ObservabilityProvider;
-    readonly dispatcherOptions?: Omit<DispatcherOptions, "lifecycle">;
-    readonly systemHooks?: SystemHooks;
-    readonly eventDedup?: EventDedup;
-    readonly lifecycle?: Lifecycle;
-    readonly instanceId?: ServerOptions["instanceId"];
-};
-type JobsBlock = {
-    readonly redisUrl: string;
-    readonly queueNamePrefix?: string;
-    readonly getActiveTenantIds?: JobRunnerOptions["getActiveTenantIds"];
-    readonly onJobStart?: JobRunnerOptions["onJobStart"];
-    readonly onJobComplete?: JobRunnerOptions["onJobComplete"];
-    readonly onJobFailed?: JobRunnerOptions["onJobFailed"];
-    readonly onJobDeferred?: JobRunnerOptions["onJobDeferred"];
-    readonly onJobQueued?: JobRunnerOptions["onJobQueued"];
-    readonly onJobDropped?: JobRunnerOptions["onJobDropped"];
-};
+import type { Dispatcher } from "../pipeline/dispatcher.ts";
+import type { EventDispatcher } from "../pipeline/index.ts";
+import type { LifecycleHooks } from "../pipeline/lifecycle-pipeline.ts";
+import type { AllInOneEntrypointOptions, BaseEntrypointOptions, JobsBlock, WorkerEntrypointOptions } from "./internals.ts";
 export type ApiEntrypointOptions = BaseEntrypointOptions & {
     readonly auth?: AuthRoutesConfig;
     readonly anonymousAccess?: ServerOptions["anonymousAccess"];
@@ -52,10 +29,6 @@ export type ApiEntrypointOptions = BaseEntrypointOptions & {
     readonly trustedProxyHops?: ServerOptions["trustedProxyHops"];
     readonly errorDocs?: ServerOptions["errorDocs"];
 };
-export type WorkerEntrypointOptions = BaseEntrypointOptions & JobsBlock & {
-    readonly eventDispatcher?: ServerOptions["eventDispatcher"];
-};
-export type AllInOneEntrypointOptions = ApiEntrypointOptions & WorkerEntrypointOptions;
 export type ApiEntrypoint = {
     readonly app: Hono;
     readonly jwt: JwtHelper;
@@ -63,6 +36,7 @@ export type ApiEntrypoint = {
     readonly lifecycle: Lifecycle;
     readonly observability: ObservabilityProvider;
     readonly dispatcher: Dispatcher;
+    readonly context: AppContext;
     readonly lifecycleHooks: LifecycleHooks;
     readonly eventDispatcher?: EventDispatcher;
     readonly mode: "api";
@@ -74,6 +48,7 @@ export type WorkerEntrypoint = {
     readonly eventDispatcher: EventDispatcher;
     readonly jobRunner: JobRunner;
     readonly observability: ObservabilityProvider;
+    readonly context: AppContext;
     readonly dispatcher: Dispatcher;
     readonly mode: "worker";
     start(): Promise<void>;
@@ -85,4 +60,3 @@ export type AllInOneEntrypoint = Omit<ApiEntrypoint, "mode"> & Omit<WorkerEntryp
 export declare function createApiEntrypoint(options: ApiEntrypointOptions): ApiEntrypoint;
 export declare function createWorkerEntrypoint(options: WorkerEntrypointOptions): WorkerEntrypoint;
 export declare function createAllInOneEntrypoint(options: AllInOneEntrypointOptions): AllInOneEntrypoint;
-export type { PgClient, PgListenClient };

package/dist/entrypoint/index.js

@@ -47,6 +47,7 @@ import { createLifecycle } from "../lifecycle/index.js";
 import { createNoopProvider } from "../observability/index.js";
 import { dispatcherToWriteRef } from "../pipeline/dispatcher.js";
 import { resolveCacheSyncBus } from "../redis/cache-sync-bus.js";
+import { assertEntrypointRowLevelSecurityMode } from "./row-level-security-mode-check.js";
 // --- Shared builders ------------------------------------------------------
 //
 // Three factories, three near-identical buildServer() + createJobRunner()
@@ -95,7 +96,7 @@ function contextWithObservability(context, observability, effectiveFeatures) {
     return {
         ...context,
         // Same source of truth as buildServer's contextWithObservability
-        // (api/server.ts) — job handlers reading ctx.effectiveFeatures should
+        // (api/server.ts) — job handlers reading ctx.services.effectiveFeatures should
         // see the same resolver as command handlers, not just dispatcherOptions.
         ...(effectiveFeatures && { effectiveFeatures }),
         tracer: observability.tracer,
@@ -199,6 +200,7 @@ function requireDispatcher(server, mode) {
 }
 // --- API entrypoint -------------------------------------------------------
 export function createApiEntrypoint(options) {
+    assertEntrypointRowLevelSecurityMode(options.context, options.rowLevelSecurity);
     const lifecycle = options.lifecycle ?? createLifecycle({ startReady: true });
     const observability = resolveObservability(options.observability);
     const { options: busOptions, context } = resolveEntrypointCacheSync(options, lifecycle);
@@ -244,6 +246,7 @@ export function createApiEntrypoint(options) {
         lifecycle,
         observability: server.observability,
         dispatcher: server.dispatcher,
+        context: server.context,
         lifecycleHooks: server.lifecycleHooks,
         ...(server.eventDispatcher && { eventDispatcher: server.eventDispatcher }),
         mode: "api",
@@ -266,6 +269,7 @@ export function createApiEntrypoint(options) {
 }
 // --- Worker entrypoint ----------------------------------------------------
 export function createWorkerEntrypoint(options) {
+    assertEntrypointRowLevelSecurityMode(options.context, options.rowLevelSecurity);
     const lifecycle = options.lifecycle ?? createLifecycle({ startReady: true });
     const observability = resolveObservability(options.observability);
     const { options: busOptions, context } = resolveEntrypointCacheSync(options, lifecycle);
@@ -279,6 +283,7 @@ export function createWorkerEntrypoint(options) {
         jobRunner,
         observability: server.observability,
         dispatcher: server.dispatcher,
+        context: server.context,
         mode: "worker",
         async start() {
             await eventDispatcher.start();
@@ -291,6 +296,7 @@ export function createWorkerEntrypoint(options) {
 }
 // --- All-in-one entrypoint ------------------------------------------------
 export function createAllInOneEntrypoint(options) {
+    assertEntrypointRowLevelSecurityMode(options.context, options.rowLevelSecurity);
     const lifecycle = options.lifecycle ?? createLifecycle({ startReady: true });
     const observability = resolveObservability(options.observability);
     const { options: busOptions, context } = resolveEntrypointCacheSync(options, lifecycle);
@@ -324,6 +330,7 @@ export function createAllInOneEntrypoint(options) {
         jobRunner: workerJobRunner,
         observability: server.observability,
         dispatcher: server.dispatcher,
+        context: server.context,
         lifecycleHooks: server.lifecycleHooks,
         mode: "all-in-one",
         async start() {
@@ -336,3 +343,5 @@ export function createAllInOneEntrypoint(options) {
         },
     };
 }
+// Re-exported so callers of ServerOptions.eventDispatcher can name the
+// LISTEN client type it references.

package/dist/entrypoint/internals.d.ts

@@ -0,0 +1,40 @@
+import type { JwtKeyring } from "../api/jwt.ts";
+import type { ServerOptions } from "../api/server.ts";
+import type { RowLevelSecurityMode } from "../db/render-rls-ddl.ts";
+import type { AppContext, Registry } from "../engine/types/index.ts";
+import type { JobRunnerOptions } from "../jobs/job-runner.ts";
+import type { Lifecycle } from "../lifecycle/index.ts";
+import type { ObservabilityProvider } from "../observability/index.ts";
+import type { DispatcherOptions } from "../pipeline/dispatcher.ts";
+import type { EventDedup } from "../pipeline/event-dedup.ts";
+import type { SystemHooks } from "../pipeline/lifecycle-pipeline.ts";
+import type { ApiEntrypointOptions } from "./index.ts";
+export type BaseEntrypointOptions = {
+    readonly registry: Registry;
+    readonly context: AppContext;
+    readonly jwtSecret: string | JwtKeyring;
+    readonly jwtIssuer?: string;
+    readonly observability?: ObservabilityProvider;
+    readonly dispatcherOptions?: Omit<DispatcherOptions, "lifecycle">;
+    readonly systemHooks?: SystemHooks;
+    readonly eventDedup?: EventDedup;
+    readonly lifecycle?: Lifecycle;
+    readonly instanceId?: ServerOptions["instanceId"];
+    /** Must equal the mode of `context.db`; default "off". */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
+};
+export type JobsBlock = {
+    readonly redisUrl: string;
+    readonly queueNamePrefix?: string;
+    readonly getActiveTenantIds?: JobRunnerOptions["getActiveTenantIds"];
+    readonly onJobStart?: JobRunnerOptions["onJobStart"];
+    readonly onJobComplete?: JobRunnerOptions["onJobComplete"];
+    readonly onJobFailed?: JobRunnerOptions["onJobFailed"];
+    readonly onJobDeferred?: JobRunnerOptions["onJobDeferred"];
+    readonly onJobQueued?: JobRunnerOptions["onJobQueued"];
+    readonly onJobDropped?: JobRunnerOptions["onJobDropped"];
+};
+export type WorkerEntrypointOptions = BaseEntrypointOptions & JobsBlock & {
+    readonly eventDispatcher?: ServerOptions["eventDispatcher"];
+};
+export type AllInOneEntrypointOptions = ApiEntrypointOptions & WorkerEntrypointOptions;

package/dist/entrypoint/internals.js

@@ -0,0 +1 @@
+export {};

package/dist/entrypoint/row-level-security-mode-check.d.ts

@@ -0,0 +1,3 @@
+import { type RowLevelSecurityMode } from "../db/render-rls-ddl.ts";
+import type { AppContext } from "../engine/types/index.ts";
+export declare function assertEntrypointRowLevelSecurityMode(context: AppContext, declared: RowLevelSecurityMode | undefined): void;

package/dist/entrypoint/row-level-security-mode-check.js

@@ -0,0 +1,19 @@
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE, } from "../db/render-rls-ddl.js";
+import { rowLevelSecurityModeOf } from "../db/row-level-security-connection.js";
+import { InternalError } from "../errors/index.js";
+// The mode lives on the connection; the option states what the app config declared.
+// A mismatch means the pools were opened for a different mode than the one the
+// schema was applied for, which silently drops or over-applies tenant isolation.
+export function assertEntrypointRowLevelSecurityMode(context, declared) {
+    // skip: entrypoint has no db to check
+    if (context.db === undefined)
+        return;
+    const expected = declared ?? DEFAULT_ROW_LEVEL_SECURITY_MODE;
+    const actual = rowLevelSecurityModeOf(context.db);
+    if (actual !== expected) {
+        throw new InternalError({
+            message: `Entrypoint rowLevelSecurity is "${expected}" but the database connection runs in "${actual}" mode; open the pools with the same mode`,
+            details: { expected, actual },
+        });
+    }
+}

package/dist/env/dry-run-internals.d.ts

@@ -0,0 +1,10 @@
+export type DryRunOptions = {
+    /** From composeEnvSchema. Drives the per-row feature-attribution. */
+    readonly sources?: Readonly<Record<string, string>>;
+    /** Prefix for `pulumi config set <prefix>…` keys. Default "". */
+    readonly pulumiPrefix?: string;
+    /** k8s Secret name. Default "kumiko-env". */
+    readonly k8sName?: string;
+    /** k8s namespace. Default "default". */
+    readonly k8sNamespace?: string;
+};

package/dist/env/dry-run-internals.js

@@ -0,0 +1 @@
+export {};

package/dist/env/dry-run.d.ts

@@ -1,3 +1,4 @@
+import type { DryRunOptions } from "./dry-run-internals.ts";
 import { type ComposedEnvSchema, type EnvFieldInspection } from "./index.ts";
 export type DryRunMode = "human" | "json" | "pulumi" | "k8s";
 /** `boot` runs the boot validators without connecting anywhere; the other
@@ -10,16 +11,6 @@ export declare function parseDryRunEnvMode(raw: string | undefined): DryRunEnvMo
 /** True while any dry-run mode is requested, for code that runs at module
  *  load (key providers, secret derivation) and must not throw on missing env. */
 export declare function isDryRunEnvActive(env: Readonly<Record<string, string | undefined>>): boolean;
-export type DryRunOptions = {
-    /** From composeEnvSchema. Drives the per-row feature-attribution. */
-    readonly sources?: Readonly<Record<string, string>>;
-    /** Prefix for `pulumi config set <prefix>…` keys. Default "". */
-    readonly pulumiPrefix?: string;
-    /** k8s Secret name. Default "kumiko-env". */
-    readonly k8sName?: string;
-    /** k8s namespace. Default "default". */
-    readonly k8sNamespace?: string;
-};
 export declare function renderDryRun(composed: ComposedEnvSchema, mode: DryRunMode, options?: DryRunOptions): string;
 /** Table for `KUMIKO_DRY_RUN_ENV=boot`: one row per variable with its source,
  *  whether it is required, and whether it is set. Values are never printed. */

package/dist/env/dry-run.js

@@ -8,7 +8,8 @@
 // The same schema introspection (`classifyField`, `readKumikoMeta`) used
 // by parseEnv drives the output here — single source of truth.
 import { zodShape } from "./_zod-introspect.js";
-import { classifyField, getDefaultValue, getFieldDescription, pulumiConfigKey, readKumikoMeta, } from "./index.js";
+import { classifyField, readKumikoMeta, } from "./index.js";
+import { getDefaultValue, getFieldDescription, pulumiConfigKey } from "./internals.js";
 export const DRY_RUN_ENV_VAR = "KUMIKO_DRY_RUN_ENV";
 /** Reads `KUMIKO_DRY_RUN_ENV`. `1` and `true` mean `human`; an unknown value
  *  returns undefined, so the caller decides whether to warn or boot. */

package/dist/env/index.d.ts

@@ -1,33 +1,11 @@
 import * as z from "zod";
 import type { FeatureDefinition } from "../engine/types/feature.ts";
-export type KumikoEnvMeta = {
-    readonly pulumi?: {
-        /** Override the auto-derived camelCase Pulumi-config-key name. Apps
-         *  setting `pulumiPrefix: "studio"` and authoring `STUDIO_ADMIN_EMAIL`
-         *  would otherwise get `studioStudioAdminEmail` — set
-         *  `.meta({ kumiko: { pulumi: { name: "adminEmail" } } })` to drop the
-         *  duplicated prefix. */
-        readonly name?: string;
-        /** Shell expression that generates a value, e.g. `openssl rand -base64 32`.
-         *  Without this, dry-run-pulumi emits `<set-me>` as the placeholder. */
-        readonly generator?: string;
-        /** Force the `--secret` flag in `pulumi config set`. Default false. */
-        readonly secret?: boolean;
-    };
-    /** The value may be delivered as a Scaleway Key Manager ciphertext in
-     *  `<NAME>_CIPHERTEXT`. `runProdApp` decrypts it at boot when `<NAME>` itself
-     *  is unset; a set plaintext always wins. A flag, not an object: every slot
-     *  uses the same `_CIPHERTEXT` twin and one shared key (`PLATFORM_KEK_KMS_*`). */
-    readonly kms?: true;
-};
+import { type ComposedEnvShape, type ComposeEnvSchemaOptions, type EmptyShape, type EnvError, type EnvFieldClass, type EnvFieldStatus, type KumikoEnvMeta, type ParseEnvOptions } from "./internals.ts";
 export declare function readKumikoMeta(field: z.ZodType): KumikoEnvMeta;
 /** Env names whose schema field declares `kms: true` — the slots
  *  `resolvePlatformKeks` resolves from a ciphertext. */
 export declare function kmsSlotsOf(schema: z.ZodObject<z.ZodRawShape>): readonly string[];
-export type EnvFieldClass = "required" | "optional" | "withDefault";
 export declare function classifyField(field: z.ZodType): EnvFieldClass;
-export declare function getDefaultValue(field: z.ZodType): unknown;
-export declare function getFieldDescription(field: z.ZodType): string | undefined;
 /** A feature whose registered env schema is visible in its type, so
  *  `composeEnvSchema` can type the merged schema from the feature list. */
 export type FeatureWithEnvSchema<TFeature extends FeatureDefinition, TShape extends z.ZodRawShape> = TFeature & {
@@ -37,41 +15,6 @@ export type FeatureWithEnvSchema<TFeature extends FeatureDefinition, TShape exte
  *  `r.envSchema(schema)`. Throws when the feature registered another
  *  instance, so the type never claims fields the runtime schema lacks. */
 export declare function featureWithEnvSchema<TFeature extends FeatureDefinition, TShape extends z.ZodRawShape>(feature: TFeature, schema: z.ZodObject<TShape>): FeatureWithEnvSchema<TFeature, TShape>;
-type EmptyShape = Record<never, never>;
-type DeclaredEnvShape<TFeature> = TFeature extends {
-    readonly envSchema: z.ZodObject<infer TShape extends z.ZodRawShape>;
-} ? string extends keyof TShape ? EmptyShape : TShape : EmptyShape;
-type UnionToIntersection<TUnion> = (TUnion extends unknown ? (value: TUnion) => void : never) extends (value: infer TIntersection) => void ? TIntersection : never;
-type OptionalShape<TShape extends z.ZodRawShape> = {
-    [Key in keyof TShape]: z.ZodOptional<TShape[Key]>;
-};
-type FeaturesEnvShape<TFeatures extends readonly FeatureDefinition[]> = UnionToIntersection<DeclaredEnvShape<TFeatures[number]>>;
-type FlattenShape<TShape> = {
-    [Key in keyof TShape]: TShape[Key];
-} & {};
-type KnownShape<TShape extends z.ZodRawShape> = string extends keyof TShape ? EmptyShape : TShape;
-/** The merged shape `composeEnvSchema` returns. With `optionalFeatures`
- *  every feature field is typed optional: the type cannot tell which feature
- *  a name refers to, and over-reporting `undefined` is the safe side. */
-export type ComposedEnvShape<TFeatures extends readonly FeatureDefinition[], TCore extends z.ZodRawShape, TExtend extends z.ZodRawShape, TOptionalFeatures extends readonly string[] | undefined> = Extract<FlattenShape<KnownShape<TCore> & (TOptionalFeatures extends readonly string[] ? OptionalShape<FeaturesEnvShape<TFeatures> & z.ZodRawShape> : FeaturesEnvShape<TFeatures>) & KnownShape<TExtend>>, z.ZodRawShape>;
-export type ComposeEnvSchemaOptions<TFeatures extends readonly FeatureDefinition[] = readonly FeatureDefinition[], TCore extends z.ZodRawShape = z.ZodRawShape, TExtend extends z.ZodRawShape = z.ZodRawShape, TOptionalFeatures extends readonly string[] | undefined = readonly string[] | undefined> = {
-    /** All features whose envSchemas should be merged. Bundled features type
-     *  their fragment, so passing the list inline types the merged schema. */
-    readonly features: TFeatures;
-    /** App-specific env-vars (e.g. `STUDIO_ADMIN_EMAIL`). Keys here are
-     *  tagged as source "app" in the resulting sources map. */
-    readonly extend?: z.ZodObject<TExtend>;
-    /** Feature-names whose env-vars should be auto-`.optional()`-wrapped.
-     *  Lets an app opt out of e.g. `channel-email-smtp`'s vars without
-     *  manually `.partial()`-ing each shape at the call-site. */
-    readonly optionalFeatures?: TOptionalFeatures;
-    /** Framework-core env-vars (PORT, DATABASE_URL, REDIS_URL, …) from
-     *  `@cosmicdrift/kumiko-dev-server`. Keys here are tagged as source
-     *  "framework-core" in error output. Conflict-detection runs across
-     *  core/features/extend as one merged pool — same key declared in two
-     *  layers throws KumikoBootError at compose-time. */
-    readonly core?: z.ZodObject<TCore>;
-};
 export type ComposedEnvSchema<TShape extends z.ZodRawShape = z.ZodRawShape> = {
     /** The merged Zod schema, typed from core, the typed feature fragments and
      *  extend; `parseEnv(composed.schema, env)` returns the typed env. */
@@ -84,33 +27,11 @@ export type ComposedEnvSchema<TShape extends z.ZodRawShape = z.ZodRawShape> = {
  *  missing from the schema shape are ignored. */
 export declare function withOptionalEnvKeys(schema: z.ZodObject<z.ZodRawShape>, keys: readonly string[]): z.ZodObject<z.ZodRawShape>;
 export declare function composeEnvSchema<const TFeatures extends readonly FeatureDefinition[], TCore extends z.ZodRawShape = EmptyShape, TExtend extends z.ZodRawShape = EmptyShape, const TOptionalFeatures extends readonly string[] | undefined = undefined>(options: ComposeEnvSchemaOptions<TFeatures, TCore, TExtend, TOptionalFeatures>): ComposedEnvSchema<ComposedEnvShape<TFeatures, TCore, TExtend, TOptionalFeatures>>;
-export type EnvErrorKind = "missing" | "invalid";
-export type EnvError = {
-    readonly name: string;
-    readonly kind: EnvErrorKind;
-    readonly message: string;
-    /** Declaring source-name from `composeEnvSchema`'s sources map:
-     *  feature-name, "app" from `extend`, or "framework-core" from `core`.
-     *  Populated when parseEnv received `options.sources`. Surfaced by
-     *  `KumikoBootError.format()` so operators see WHICH source wants the
-     *  missing var, not just the var name. */
-    readonly source?: string;
-    /** "Set via: pulumi config set ..." line. Computed when pulumiPrefix is
-     *  passed to parseEnv. */
-    readonly suggestion?: string;
-};
 export declare class KumikoBootError extends Error {
     readonly errors: readonly EnvError[];
     constructor(errors: readonly EnvError[]);
     format(): string;
 }
-export type ParseEnvOptions = {
-    /** From composeEnvSchema's return — enables per-var feature-source
-     *  attribution in suggestions. */
-    readonly sources?: Readonly<Record<string, string>>;
-    /** When set, error suggestions include `pulumi config set <prefix>...`. */
-    readonly pulumiPrefix?: string;
-};
 /** Validates `env` against `schema` and throws KumikoBootError on any issue.
  *  A `kms: true` field delivered only as `<NAME>_CIPHERTEXT` passes validation but
  *  is `undefined` in the result despite its `string` type — it is only set once
@@ -124,7 +45,6 @@ export declare function parseEnv<S extends z.ZodObject<z.ZodRawShape>>(schema: S
  *  every access silently returned undefined and the compiler could not detect
  *  it. */
 export declare function parseEnvDryRun<S extends z.ZodObject<z.ZodRawShape>>(schema: S, env: Record<string, string | undefined>): Partial<z.infer<S>>;
-export type EnvFieldStatus = "set" | "unset" | "missing" | "invalid";
 export type EnvFieldInspection = {
     readonly name: string;
     readonly klass: EnvFieldClass;
@@ -138,7 +58,3 @@ export type EnvFieldInspection = {
  *  renders on an empty env. Object-level refinements do not run here; once
  *  nothing is missing or invalid, parseEnv validates the whole object. */
 export declare function inspectEnv(schema: z.ZodObject<z.ZodRawShape>, env: Readonly<Record<string, string | undefined>>, options?: Pick<ParseEnvOptions, "sources">): readonly EnvFieldInspection[];
-export declare function camelCase(snakeShout: string): string;
-export declare function pulumiConfigKey(envName: string, field: z.ZodType | undefined, prefix: string | undefined): string;
-export declare function buildPulumiSuggestion(envName: string, field: z.ZodType, prefix: string | undefined): string | undefined;
-export {};

package/dist/env/index.js

@@ -14,7 +14,9 @@
 // Without meta, defaults: `camelCase(envVarName)` for the Pulumi key,
 // `<set-me>` placeholder for the value, no `--secret` flag.
 import * as z from "zod";
-import { zodDef, zodDescription, zodMeta, zodShape, zodShapeField } from "./_zod-introspect.js";
+import { zodDef, zodMeta, zodShape, zodShapeField } from "./_zod-introspect.js";
+import { buildPulumiSuggestion, getFieldDescription, } from "./internals.js";
+// --- Per-env-var metadata (attach via Zod's `.meta()`) ---
 function isKumikoMeta(value) {
     if (value === null || typeof value !== "object")
         return false;
@@ -70,6 +72,7 @@ function relaxCiphertextOnlySlots(schema, env) {
     }
     return Object.keys(relaxed).length === 0 ? schema : schema.safeExtend(relaxed);
 }
+// --- Field-classification helpers (Zod v4 introspection) ---
 export function classifyField(field) {
     // Drill through ZodEffects/ZodPipe wrappers to find the inner kind.
     let current = field;
@@ -104,29 +107,6 @@ export function classifyField(field) {
     }
     return "required";
 }
-export function getDefaultValue(field) {
-    let current = field;
-    for (let i = 0; i < 8; i++) {
-        if (current instanceof z.ZodDefault) {
-            // Zod v4: defaultValue is the raw value (v3 was a factory function).
-            // Support both shapes for forward/backward safety.
-            const raw = zodDef(current)?.defaultValue;
-            // @cast-boundary schema-walk — Zod v3 stored a thunk, v4 a raw value
-            return typeof raw === "function" ? raw() : raw;
-        }
-        const inner = zodDef(current);
-        if (inner?.innerType) {
-            current = inner.innerType;
-            continue;
-        }
-        break;
-    }
-    return undefined;
-}
-// @wrapper-known semantic-alias
-export function getFieldDescription(field) {
-    return zodDescription(field);
-}
 function registersEnvSchema(feature, schema) {
     return feature.envSchema === schema;
 }
@@ -262,6 +242,7 @@ export function composeEnvSchema(options) {
     const schema = z.object(merged);
     return { schema, sources };
 }
+// --- Errors ---
 function formatBootError(errors) {
     const lines = [
         `Boot failed: ${errors.length} env-var problem${errors.length === 1 ? "" : "s"}`,
@@ -291,6 +272,7 @@ export class KumikoBootError extends Error {
         return formatBootError(this.errors);
     }
 }
+// --- Parse ---
 // safeParse does not catch exceptions thrown inside refinements; a refinement
 // reading a ciphertext-only slot (undefined here) would otherwise escape as a raw
 // TypeError past the KumikoBootError mapping.
@@ -353,9 +335,6 @@ export function parseEnv(schema, env, options = {}) {
     throw new KumikoBootError(errors);
 }
 // --- Pulumi-suggestion ---
-function ucfirst(s) {
-    return s.length === 0 ? s : s.charAt(0).toUpperCase() + s.slice(1);
-}
 /** Dry-run counterpart to parseEnv (KUMIKO_DRY_RUN_ENV path): parses each
  *  field individually and returns an honest Partial — present values pass
  *  through with their types (coerced), while missing or invalid values are
@@ -416,26 +395,3 @@ function firstFieldIssue(field, raw) {
         return "a field refinement threw while checking the value";
     }
 }
-export function camelCase(snakeShout) {
-    const parts = snakeShout.toLowerCase().split("_").filter(Boolean);
-    if (parts.length === 0)
-        return snakeShout.toLowerCase();
-    return parts[0] + parts.slice(1).map(ucfirst).join("");
-}
-export function pulumiConfigKey(envName, field, prefix) {
-    const meta = field ? readKumikoMeta(field) : {};
-    if (meta.pulumi?.name) {
-        return prefix ? prefix + ucfirst(meta.pulumi.name) : meta.pulumi.name;
-    }
-    const camel = camelCase(envName);
-    return prefix ? prefix + ucfirst(camel) : camel;
-}
-export function buildPulumiSuggestion(envName, field, prefix) {
-    if (!prefix)
-        return undefined;
-    const meta = readKumikoMeta(field);
-    const key = pulumiConfigKey(envName, field, prefix);
-    const secretFlag = meta.pulumi?.secret ? " --secret" : "";
-    const value = meta.pulumi?.generator ? `"$(${meta.pulumi.generator})"` : `"<set-me>"`;
-    return `Set via: pulumi config set${secretFlag} ${key} ${value}`;
-}