@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/pipeline/system-hooks.js

@@ -1,7 +1,9 @@
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { readNonEmptyStringArray, } from "../api/sse-broker.js";
-import { collectSearchableSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
-import { createTenantDb, entityTableFromRegistry, rehydrateCompoundTypes } from "../db/index.js";
+import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
+import { collectSearchableSubjectFields } from "../crypto/subject-resolver.js";
+import { rehydrateCompoundTypes } from "../db/compound-types.js";
+import { createTenantDb, entityTableFromRegistry } from "../db/index.js";
 import { tenantChannel } from "../engine/constants.js";
 import { InternalError } from "../errors/index.js";
 import { createFallbackLogger } from "../logging/utils.js";
@@ -422,7 +424,7 @@ export function createSseBroadcastEventConsumer(sseBroker) {
 // r.job's `trigger.on` historically only fired via the synchronous
 // write-handler dispatch path (dispatch-write.ts's afterCommitHooks calling
 // jobRunner.handleEvent). Events appended any other way — an
-// r.multiStreamProjection's ctx.unsafeAppendEvent, or a raw
+// r.multiStreamProjection's ctx.events.unsafeAppend, or a raw
 // event-store-executor write (e.g. `files`' fileRef.created) — never
 // reached it, so a job could never trigger on an r.defineEvent-registered
 // event.
@@ -431,7 +433,7 @@ export function createSseBroadcastEventConsumer(sseBroker) {
 // committed event off the shared cursor and re-check job triggers. It is
 // scoped EXACTLY to the gap — the write/query-handler-QN skip below is
 // defense-in-depth: no stored event's `type` is a handler QN today (entity
-// events are "entity.verb"; ctx.appendEvent enforces defineEvent-only
+// events are "entity.verb"; ctx.events.append enforces defineEvent-only
 // ownership), but if that ever changes, this consumer must not re-fire a
 // trigger the synchronous dispatch-write.ts path already handled.
 //
@@ -552,9 +554,58 @@ function readPatRevokedScope(payload) {
     const tokenIds = readNonEmptyStringArray(payload["tokenIds"]);
     return tokenIds ? { kind: "pat-tokens", tokenIds } : { kind: "user" };
 }
-export function createAccessInvalidationEventConsumer(sseBroker) {
+const ACCESS_INVALIDATION_BACKOFF_INITIAL_MS = 250;
+const ACCESS_INVALIDATION_BACKOFF_MAX_MS = 10_000;
+// Only the publish can fail because Redis is unreachable. The consumer must keep retrying those
+// until Redis is back (dead-lettering would silently stop every later revocation reaching open
+// streams), while any other failure keeps the dispatcher's attempt limit so one poison event
+// cannot hold back every later revocation for good.
+class AccessInvalidationTransportError extends Error {
+    constructor(cause) {
+        super(cause instanceof Error ? cause.message : String(cause), { cause });
+        this.name = "AccessInvalidationTransportError";
+    }
+}
+function isAccessInvalidationTransportError(error) {
+    return error instanceof AccessInvalidationTransportError;
+}
+// The gate rethrows without touching Redis until the backoff elapsed.
+function withTransportBackoff(handle, now) {
+    let delayMs = ACCESS_INVALIDATION_BACKOFF_INITIAL_MS;
+    let retryNotBefore = 0;
+    let transportError = null;
+    return async (event) => {
+        if (transportError !== null && now() < retryNotBefore)
+            throw transportError;
+        try {
+            await handle(event);
+            delayMs = ACCESS_INVALIDATION_BACKOFF_INITIAL_MS;
+            transportError = null;
+        }
+        catch (err) {
+            if (isAccessInvalidationTransportError(err)) {
+                transportError = err;
+                retryNotBefore = now() + delayMs;
+                delayMs = Math.min(delayMs * 2, ACCESS_INVALIDATION_BACKOFF_MAX_MS);
+            }
+            throw err;
+        }
+    };
+}
+export function createAccessInvalidationEventConsumer(sseBroker, opts = {}) {
+    const now = opts.now ?? Date.now;
+    const publish = async (userId, scope) => {
+        try {
+            await sseBroker.publishAccessInvalidation(userId, scope);
+        }
+        catch (cause) {
+            throw new AccessInvalidationTransportError(cause);
+        }
+    };
     return {
         name: ACCESS_INVALIDATION_CONSUMER_NAME,
+        // Count-based dead-lettering would end after a few seconds of Redis downtime.
+        errorPolicy: { isTransientError: isAccessInvalidationTransportError },
         // Shared delivery, same reasoning as SSE broadcast: one
         // cursor reads every event once and calls sseBroker.publishAccessInvalidation
         // below, which a Redis-backed broker republishes to every replica's
@@ -565,7 +616,7 @@ export function createAccessInvalidationEventConsumer(sseBroker) {
         // existed has nothing to invalidate — replaying it would be a no-op at
         // best and a spurious stream-close at worst.
         startFrom: "now",
-        handler: async (event) => {
+        handler: withTransportBackoff(async (event) => {
             if (event.type === SESSION_REVOKED_EVENT_TYPE) {
                 const userId = event.payload["userId"];
                 // skip: malformed session-revoked payload — fail open on this one
@@ -574,7 +625,7 @@ export function createAccessInvalidationEventConsumer(sseBroker) {
                 // every user behind one bad row).
                 if (typeof userId !== "string" || userId.length === 0)
                     return;
-                await sseBroker.publishAccessInvalidation(userId, readSessionRevokedScope(event.payload));
+                await publish(userId, readSessionRevokedScope(event.payload));
             }
             if (event.type === PAT_REVOKED_EVENT_TYPE) {
                 const userId = event.payload["userId"];
@@ -582,7 +633,7 @@ export function createAccessInvalidationEventConsumer(sseBroker) {
                 // session-revoked above.
                 if (typeof userId !== "string" || userId.length === 0)
                     return;
-                await sseBroker.publishAccessInvalidation(userId, readPatRevokedScope(event.payload));
+                await publish(userId, readPatRevokedScope(event.payload));
             }
             if (event.type === TENANT_MEMBERSHIP_UPDATED_EVENT_TYPE ||
                 event.type === TENANT_MEMBERSHIP_DELETED_EVENT_TYPE) {
@@ -591,8 +642,8 @@ export function createAccessInvalidationEventConsumer(sseBroker) {
                 // reasoning as above.
                 if (userId === undefined)
                     return;
-                await sseBroker.publishAccessInvalidation(userId);
+                await publish(userId);
             }
-        },
+        }, now),
     };
 }

package/dist/pipeline/system-identity-switch.d.ts

@@ -1,10 +1,12 @@
+import type { ActiveMembershipResult, EscapeHatchDeclaration, EscapeHatchReporter, MemberReader, WriteResult } from "@cosmicdrift/kumiko-types/handlers";
+import type { LifecycleHookFn } from "@cosmicdrift/kumiko-types/hooks";
 import type { TenantId } from "../engine/types/identifiers.ts";
-import type { ActiveMembershipResult, EscapeHatchDeclaration, EscapeHatchReporter, HandlerContext, LifecycleHookFn, MemberReader, SessionUser, WriteResult } from "../engine/types/index.ts";
+import type { HandlerContext, SessionUser } from "../engine/types/index.ts";
 import { AccessDeniedError } from "../errors/index.ts";
 export type QueryAsFn = (user: SessionUser, qn: string, payload: unknown) => Promise<unknown>;
 export type WriteAsFn = (user: SessionUser, qn: string, payload: unknown) => Promise<WriteResult>;
 export type ResolveActiveMembershipFn = (userId: string, tenantId: TenantId) => Promise<ActiveMembershipResult>;
-export type ProjectionReader = HandlerContext["queryProjection"];
+export type ProjectionReader = HandlerContext["dispatch"]["queryProjection"];
 export type IdentitySwitch = {
     readonly queryAs: QueryAsFn;
     readonly writeAs: WriteAsFn;

package/dist/pipeline/system-identity-switch.js

@@ -2,6 +2,7 @@ import { escapeHatchFor } from "@cosmicdrift/kumiko-types/handlers";
 import { withSystemDbUnsafeRawGrant, withUnsafeRawGrant } from "../db/tenant-db.js";
 import { SYSTEM_ROLE, SYSTEM_USER_ID } from "../engine/system-user.js";
 import { AccessDeniedError, FrameworkReasons, InternalError } from "../errors/index.js";
+import { attachOutsideTransaction } from "./attach-outside-transaction.js";
 export function isSystemIdentity(user) {
     return user.id === SYSTEM_USER_ID || user.roles.includes(SYSTEM_ROLE);
 }
@@ -49,14 +50,14 @@ export function identitySwitchDenied(callerLabel, asUser) {
 }
 export function unsafeAllTenantsDenied(callerLabel) {
     return new AccessDeniedError({
-        message: `${callerLabel} may not call ctx.queryProjection(..., { unsafeAllTenants: true }) — declare ` +
+        message: `${callerLabel} may not call ctx.dispatch.queryProjection(..., { unsafeAllTenants: true }) — declare ` +
             "r.systemScope() or escapeHatch: { reason } on it",
         details: { reason: FrameworkReasons.unsafeAllTenantsDenied },
     });
 }
 // Reverse-lookup so withHookEscapeHatchGrant can re-gate the SAME ungated pair (and caller) under a narrower grant.
 const sourceByGated = new WeakMap();
-// Same idea, for ctx.queryAsMember — a single function rather than a pair.
+// Same idea, for ctx.dispatch.queryAsMember — a single function rather than a pair.
 const ungatedMemberReaderByGated = new WeakMap();
 function reportGrantedSwitch(caller, asUser, hasGrant, audit) {
     // skip: no audit wired, switch wasn't grant-gated, or grant carries no reason to report
@@ -88,7 +89,7 @@ export function createGatedIdentitySwitch(callerLabel, caller, hasGrant, ungated
     sourceByGated.set(writeAs, source);
     return gated;
 }
-// ctx.queryAsMember's gate: the caller never names the target identity up
+// ctx.dispatch.queryAsMember's gate: the caller never names the target identity up
 // front (it's resolved internally), so this is a flat allow/deny.
 export function createGatedMemberReader(callerLabel, allowSystemIdentity, ungated, audit) {
     const gated = async (userId, qn, payload) => {
@@ -102,9 +103,9 @@ export function createGatedMemberReader(callerLabel, allowSystemIdentity, ungate
     ungatedMemberReaderByGated.set(gated, { ungated, audit });
     return gated;
 }
-// Same idea, for ctx.queryProjection — a single function rather than a pair.
+// Same idea, for ctx.dispatch.queryProjection — a single function rather than a pair.
 const ungatedProjectionReaderByGated = new WeakMap();
-// ctx.queryProjection's gate: only { unsafeAllTenants: true } on a projection with a
+// ctx.dispatch.queryProjection's gate: only { unsafeAllTenants: true } on a projection with a
 // tenant column is grant-checked — a plain call always passes through, tenant-scoped
 // by the projection's own table, and the flag is a no-op on a tenant-less one.
 export function createGatedProjectionReader(callerLabel, hasGrant, ungated, audit, projectionHasTenantColumn = () => true) {
@@ -121,19 +122,20 @@ export function createGatedProjectionReader(callerLabel, hasGrant, ungated, audi
     ungatedProjectionReaderByGated.set(gated, { ungated, report: audit?.report });
     return gated;
 }
-function readIdentitySwitchFn(context, key) {
-    if (!(key in context))
+// Reads own keys only — never touch a property of a resolved value, which may be a Proxy that throws on any get.
+function readMember(namespace, key) {
+    if (namespace === undefined || !(key in namespace))
         return undefined;
-    const value = Reflect.get(context, key);
-    return typeof value === "function" ? value : undefined; // @cast-boundary engine-bridge — checked via typeof above
+    return Reflect.get(namespace, key);
 }
-// context's own keys only — never touch a property of the resolved value, which may be a Proxy that throws on any get.
-function readDbLikeValue(context, key) {
-    if (!(key in context))
-        return undefined;
-    const value = Reflect.get(context, key);
+function readObjectMember(namespace, key) {
+    const value = readMember(namespace, key);
     return typeof value === "object" && value !== null ? value : undefined;
 }
+function readFunctionMember(namespace, key) {
+    const value = readMember(namespace, key);
+    return typeof value === "function" ? value : undefined; // @cast-boundary engine-bridge — checked via typeof above
+}
 function unavailableIdentitySwitchFn(callerLabel, kind) {
     return async () => {
         throw new InternalError({
@@ -179,8 +181,8 @@ function gatedIdentitySwitchFields(callerLabel, escapeHatch, ctxQueryAs, ctxWrit
         ...(ctxWriteAs && { writeAs: gated.writeAs }),
     };
 }
-// Unlike ctx.resolveActiveMembership (deny-only), a hook's own escapeHatch
-// can grant queryAsMember even when the enclosing handler has none.
+// Unlike ctx.auth.resolveActiveMembership (deny-only), a hook's own escapeHatch
+// can grant dispatch.queryAsMember even when the enclosing handler has none.
 function gatedMemberReaderField(callerLabel, escapeHatch, ctxQueryAsMember) {
     if (!ctxQueryAsMember)
         return {};
@@ -193,7 +195,7 @@ function gatedMemberReaderField(callerLabel, escapeHatch, ctxQueryAsMember) {
         queryAsMember: createGatedMemberReader(callerLabel, escapeHatch !== undefined, ungated, audit),
     };
 }
-// Re-gates ctx.queryProjection under the hook's own escapeHatch, same
+// Re-gates ctx.dispatch.queryProjection under the hook's own escapeHatch, same
 // re-gating rule as the other fields below — see withHookEscapeHatchGrant.
 function gatedProjectionReaderField(callerLabel, escapeHatch, ctxQueryProjection) {
     if (!ctxQueryProjection)
@@ -205,15 +207,26 @@ function gatedProjectionReaderField(callerLabel, escapeHatch, ctxQueryProjection
         queryProjection: createGatedProjectionReader(callerLabel, escapeHatch !== undefined, ungated, audit),
     };
 }
+// A rebound db is a new object, so the outsideTransaction property has to be carried over; an input
+// withUnsafeRawGrant passes through unchanged keeps its own.
+function regatedDb(ctxDb, ctxDbOutsideTransaction, rawHatch) {
+    const gatedDb = withUnsafeRawGrant(ctxDb, rawHatch);
+    if (gatedDb !== ctxDb && ctxDbOutsideTransaction) {
+        attachOutsideTransaction(gatedDb, withUnsafeRawGrant(ctxDbOutsideTransaction, rawHatch));
+    }
+    return gatedDb;
+}
 export function withHookEscapeHatchGrant(context, callerLabel, escapeHatch) {
-    const ctxQueryAs = readIdentitySwitchFn(context, "queryAs");
-    const ctxWriteAs = readIdentitySwitchFn(context, "writeAs");
-    const ctxResolveActiveMembership = readIdentitySwitchFn(context, "resolveActiveMembership");
-    const ctxQueryAsMember = readIdentitySwitchFn(context, "queryAsMember");
-    const ctxQueryProjection = readIdentitySwitchFn(context, "queryProjection");
-    const ctxDb = readDbLikeValue(context, "db");
-    const ctxDbOutsideTransaction = readDbLikeValue(context, "dbOutsideTransaction");
-    const ctxSystemDb = readDbLikeValue(context, "systemDb");
+    const dispatch = readObjectMember(context, "dispatch");
+    const auth = readObjectMember(context, "auth");
+    const ctxQueryAs = readFunctionMember(dispatch, "queryAs");
+    const ctxWriteAs = readFunctionMember(dispatch, "writeAs");
+    const ctxResolveActiveMembership = readFunctionMember(auth, "resolveActiveMembership");
+    const ctxQueryAsMember = readFunctionMember(dispatch, "queryAsMember");
+    const ctxQueryProjection = readFunctionMember(dispatch, "queryProjection");
+    const ctxDb = readObjectMember(context, "db");
+    const ctxDbOutsideTransaction = readObjectMember(ctxDb, "outsideTransaction");
+    const ctxSystemDb = readObjectMember(context, "systemDb");
     const identityHatch = escapeHatchFor(escapeHatch, "systemIdentity");
     const rawHatch = escapeHatchFor(escapeHatch, "unsafeRaw");
     if (!ctxQueryAs &&
@@ -222,29 +235,31 @@ export function withHookEscapeHatchGrant(context, callerLabel, escapeHatch) {
         !ctxQueryAsMember &&
         !ctxQueryProjection &&
         !ctxDb &&
-        !ctxDbOutsideTransaction &&
         !ctxSystemDb) {
         return context;
     }
     return {
         ...context,
-        ...gatedIdentitySwitchFields(callerLabel, identityHatch, ctxQueryAs, ctxWriteAs),
-        ...(ctxResolveActiveMembership &&
-            identityHatch === undefined && {
-            resolveActiveMembership: deniedResolveActiveMembership(callerLabel),
+        ...(dispatch && {
+            dispatch: {
+                ...dispatch,
+                ...gatedIdentitySwitchFields(callerLabel, identityHatch, ctxQueryAs, ctxWriteAs),
+                ...gatedMemberReaderField(callerLabel, identityHatch, ctxQueryAsMember),
+                ...gatedProjectionReaderField(callerLabel, identityHatch, ctxQueryProjection),
+            },
         }),
-        ...gatedMemberReaderField(callerLabel, identityHatch, ctxQueryAsMember),
-        ...gatedProjectionReaderField(callerLabel, identityHatch, ctxQueryProjection),
-        ...(ctxDb && { db: withUnsafeRawGrant(ctxDb, rawHatch) }),
-        ...(ctxDbOutsideTransaction && {
-            dbOutsideTransaction: withUnsafeRawGrant(ctxDbOutsideTransaction, rawHatch),
+        ...(auth &&
+            ctxResolveActiveMembership &&
+            identityHatch === undefined && {
+            auth: { ...auth, resolveActiveMembership: deniedResolveActiveMembership(callerLabel) },
         }),
+        ...(ctxDb && { db: regatedDb(ctxDb, ctxDbOutsideTransaction, rawHatch) }),
         ...(ctxSystemDb && {
             systemDb: withSystemDbUnsafeRawGrant(ctxSystemDb, rawHatch, callerLabel),
         }),
     };
 }
-// Re-gates a hook's own ctx.queryAs/ctx.writeAs/ctx.queryProjection/ctx.db/ctx.dbOutsideTransaction/ctx.systemDb instead of inheriting the handler's grant.
+// Re-gates a hook's own ctx.dispatch.*/ctx.auth.resolveActiveMembership/ctx.db (incl. db.outsideTransaction)/ctx.systemDb instead of inheriting the handler's grant.
 export function bindHookEscapeHatchGrant(fn, label, escapeHatch) {
     return ((payload, context) => fn(payload, withHookEscapeHatchGrant(context, label, escapeHatch))); // @cast-boundary engine-bridge — LifecycleHookFn union, same (payload, context) shape at runtime
 }

package/dist/pipeline/typed-append-event.d.ts

@@ -0,0 +1,2 @@
+import type { AppendEventFn, UnsafeAppendEventFn } from "@cosmicdrift/kumiko-types/handlers";
+export declare function asTypedAppendEventFn(append: UnsafeAppendEventFn): AppendEventFn;

package/dist/pipeline/typed-append-event.js

@@ -0,0 +1,4 @@
+// The per-event-type signature is only enforced at the call site; at runtime the payload is validated against the registered schema.
+export function asTypedAppendEventFn(append) {
+    return append; // @cast-boundary engine-bridge
+}

package/dist/pipeline/write-origin.js

@@ -1,5 +1,5 @@
 // The static check in boot-validator/access-declarations.ts only sees a handler's own
-// input schema; writes reached via ctx.write/writeAs/queryAs, hooks or foreign-feature
+// input schema; writes reached via ctx.dispatch.write/writeAs/queryAs, hooks or foreign-feature
 // tables are only visible at the actual write, so the gate runs there at runtime.
 import { isPersonalDataGated } from "@cosmicdrift/kumiko-types/event-store-types";
 import * as z from "zod";
@@ -37,7 +37,7 @@ function declaresPublicIntake(access) {
     return accessAllowsAnonymous(access) && declaredPersonalData(access) === "public-intake";
 }
 // Only the public dispatcher entry points compute a root; every nested call inherits
-// it, so switching identity via ctx.writeAs(SYSTEM, ...) cannot shed an anonymous root.
+// it, so switching identity via ctx.dispatch.writeAs(SYSTEM, ...) cannot shed an anonymous root.
 export function rootWriteOrigin(registry, type, user) {
     const rootHandler = registry.getWriteHandler(type) ?? registry.getQueryHandler(type);
     return {

package/dist/pipeline/write-result-masking.d.ts

@@ -1,4 +1,4 @@
-import type { WriteResult } from "../engine/types/index.ts";
+import type { WriteResult } from "@cosmicdrift/kumiko-types/handlers";
 import type { BatchCommand, BatchResult, DispatchContext } from "./dispatch-shared.ts";
 type EntityLookup = Pick<DispatchContext["registry"], "getHandlerEntity" | "getEntity">;
 export declare function maskWriteResultForClient(registry: EntityLookup, handlerType: string, result: WriteResult): WriteResult;

package/dist/pipeline/write-result-masking.js

@@ -1,19 +1,24 @@
 import { maskWriteOnlyFields } from "../engine/field-access.js";
 import { isLifecycleResult } from "./dispatcher-utils.js";
+// The echoed event carries plaintext entity data; only hooks and projections may read it.
 function maskLifecycleOrRow(entity, data) {
     if (typeof data !== "object" || data === null || Array.isArray(data))
         return data;
-    if (!isLifecycleResult(data))
-        return maskWriteOnlyFields(entity, data); // @cast-boundary engine-payload
-    if (data.kind === "save") {
+    if (!isLifecycleResult(data)) {
+        return entity ? maskWriteOnlyFields(entity, data) : data; // @cast-boundary engine-payload
+    }
+    const { event: _event, ...lifecycle } = data;
+    if (!entity)
+        return lifecycle;
+    if (lifecycle.kind === "save") {
         return {
-            ...data,
-            data: maskWriteOnlyFields(entity, data.data),
-            changes: maskWriteOnlyFields(entity, data.changes),
-            previous: maskWriteOnlyFields(entity, data.previous),
+            ...lifecycle,
+            data: maskWriteOnlyFields(entity, lifecycle.data),
+            changes: maskWriteOnlyFields(entity, lifecycle.changes),
+            previous: maskWriteOnlyFields(entity, lifecycle.previous),
         };
     }
-    return { ...data, data: maskWriteOnlyFields(entity, data.data) };
+    return { ...lifecycle, data: maskWriteOnlyFields(entity, lifecycle.data) };
 }
 // Copy-on-mask: the original results still feed postSaveBatch hooks, which
 // need the plaintext. Only what leaves the dispatcher is masked.
@@ -22,8 +27,6 @@ export function maskWriteResultForClient(registry, handlerType, result) {
         return result;
     const entityName = registry.getHandlerEntity(handlerType);
     const entity = entityName ? registry.getEntity(entityName) : undefined;
-    if (!entity)
-        return result;
     const data = maskLifecycleOrRow(entity, result.data);
     return data === result.data ? result : { ...result, data };
 }

package/dist/random/index.d.ts

@@ -1,2 +1 @@
-export { type AdjNounNameOptions, type GenerateUniqueNameOptions, generateAdjNounName, generateNoConfusableId, generateUniqueName, } from "./generate.ts";
-export { ADJECTIVES, NOUNS } from "./words.ts";
+export { generateUniqueName } from "./generate.ts";

package/dist/random/index.js

@@ -1,2 +1 @@
-export { generateAdjNounName, generateNoConfusableId, generateUniqueName, } from "./generate.js";
-export { ADJECTIVES, NOUNS } from "./words.js";
+export { generateUniqueName } from "./generate.js";

package/dist/rate-limit/bucket.d.ts

@@ -1,4 +1,5 @@
-import type { PayloadBucketNormalization, RateLimitOption, SessionUser } from "../engine/types/index.ts";
+import type { PayloadBucketNormalization, RateLimitOption } from "@cosmicdrift/kumiko-types/handlers";
+import type { SessionUser } from "../engine/types/index.ts";
 export type BucketContext = {
     readonly handlerName: string;
     readonly user: SessionUser;

package/dist/rate-limit/middleware.js

@@ -1,7 +1,8 @@
 import { isAuthRateLimitExempt } from "../api/api-constants.js";
 import { clientIpSourceFromHonoContext, createClientIpResolver, } from "../api/client-ip.js";
 import { requestContext } from "../api/request-context.js";
-import { RateLimitError, serializeError } from "../errors/index.js";
+import { RateLimitError } from "../errors/index.js";
+import { serializeError } from "../errors/serialize.js";
 import { createFallbackLogger, scrubLogText } from "../logging/index.js";
 import { emitRateLimitFailOpen } from "../observability/standard-metrics.js";
 import { toPublicBucketName } from "./bucket.js";

package/dist/redis/index.d.ts

@@ -1,8 +1,7 @@
-export type { CacheSyncBus, CacheSyncBusOverSignalOptions, ClosableCacheSyncBus, RedisCacheSyncBusOptions, ResolvedCacheSyncBus, } from "./cache-sync-bus.ts";
-export { createCacheSyncBusOverSignal, createDefaultCacheSyncBus, createLocalCacheSyncBus, createRedisCacheSyncBus, resolveCacheSyncBus, } from "./cache-sync-bus.ts";
+export type { CacheSyncBus, ClosableCacheSyncBus, } from "./cache-sync-bus.ts";
+export { createDefaultCacheSyncBus, createLocalCacheSyncBus, createRedisCacheSyncBus, } from "./cache-sync-bus.ts";
 export type { TenantConfigSyncMessage, TierAssignmentSyncMessage } from "./cache-sync-topics.ts";
-export { CACHE_SYNC_TOPICS, isTenantConfigSyncMessage, isTierAssignmentSyncMessage, } from "./cache-sync-topics.ts";
+export { CACHE_SYNC_TOPICS, isTierAssignmentSyncMessage, } from "./cache-sync-topics.ts";
 export type { RedisClientOptions } from "./client.ts";
 export { createRedisClient, logRedisConnectionState, redisChannelPrefixFromEnv, redisClientOptionsFromEnv, } from "./client.ts";
-export type { PubSubSignal, PubSubSignalOptions } from "./pubsub-signal.ts";
 export { createRedisPubSubSignal } from "./pubsub-signal.ts";

package/dist/redis/index.js

@@ -1,4 +1,4 @@
-export { createCacheSyncBusOverSignal, createDefaultCacheSyncBus, createLocalCacheSyncBus, createRedisCacheSyncBus, resolveCacheSyncBus, } from "./cache-sync-bus.js";
-export { CACHE_SYNC_TOPICS, isTenantConfigSyncMessage, isTierAssignmentSyncMessage, } from "./cache-sync-topics.js";
+export { createDefaultCacheSyncBus, createLocalCacheSyncBus, createRedisCacheSyncBus, } from "./cache-sync-bus.js";
+export { CACHE_SYNC_TOPICS, isTierAssignmentSyncMessage, } from "./cache-sync-topics.js";
 export { createRedisClient, logRedisConnectionState, redisChannelPrefixFromEnv, redisClientOptionsFromEnv, } from "./client.js";
 export { createRedisPubSubSignal } from "./pubsub-signal.js";

package/dist/schema-cli/apply-command.js

@@ -4,7 +4,7 @@ import { createRegistry } from "../engine/registry.js";
 import { createEventsTable } from "../event-store/index.js";
 import { queueRebuildsFromMarkers, reportPendingRebuildRun, runPendingRebuilds, } from "../migrations/index.js";
 import { createEventConsumerStateTable, createProjectionStateTable } from "../pipeline/index.js";
-import { migrationsDirExistsOrReport, readDatabaseUrlOrReport, } from "./shared.js";
+import { loadRowLevelSecurityModeOrReport, migrationsDirExistsOrReport, readDatabaseUrlOrReport, } from "./shared.js";
 async function ensureFrameworkInfrastructureTables(db) {
     // Framework infrastructure tables (event store + pipeline state) are not captured by
     // `generate`, which handles only entity read tables. Existing databases have them
@@ -52,7 +52,10 @@ export async function runApplyCommand(ctx) {
         return 1;
     if (!migrationsDirExistsOrReport(ctx))
         return 1;
-    const { db, close } = createDbConnection({ url: dbUrl });
+    const rowLevelSecurity = await loadRowLevelSecurityModeOrReport(ctx);
+    if (rowLevelSecurity === undefined)
+        return 1;
+    const { db, close } = createDbConnection({ url: dbUrl, rowLevelSecurity });
     let wiring;
     try {
         const result = await runMigrationsFromDir(db, migrationsDir);

package/dist/schema-cli/baseline-command.js

@@ -1,4 +1,5 @@
-import { baselineMigrations, createDbConnection, loadMigrationsFromDir } from "../db/index.js";
+import { createDbConnection } from "../db/index.js";
+import { baselineMigrations, loadMigrationsFromDir } from "../db/migrate-runner.js";
 import { describeThrown, migrationsDirExistsOrReport, readDatabaseUrlOrReport, } from "./shared.js";
 export async function runBaselineCommand(ctx) {
     const { out, migrationsDir } = ctx;
@@ -10,7 +11,11 @@ export async function runBaselineCommand(ctx) {
         return 1;
     if (!migrationsDirExistsOrReport(ctx))
         return 1;
-    const { db, close } = createDbConnection({ url: dbUrl });
+    const { db, close } = createDbConnection({
+        url: dbUrl,
+        maxConnections: 1,
+        rowLevelSecurity: "off", // journal-only tool: touches no tenant rows
+    });
     try {
         const result = await baselineMigrations(db, loadMigrationsFromDir(migrationsDir));
         out.log("");

package/dist/schema-cli/generate-command.js

@@ -1,6 +1,9 @@
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { assertValidMigrationName, generateMigration, readMigrationSqlTexts, rebuildTablesFromDiff, writeRebuildMarker, writeSnapshotJson, } from "../db/index.js";
+import { generateMigration, writeSnapshotJson } from "../db/index.js";
+import { assertValidMigrationName, hasNoSchemaChanges } from "../db/migrate-generator.js";
+import { readMigrationSqlTexts } from "../db/migrate-runner.js";
+import { rebuildTablesFromDiff, writeRebuildMarker } from "../db/rebuild-marker.js";
 import { describeThrown, loadPreviousSnapshot, loadSchemaModOrReport, nextSequenceNumber, SNAPSHOT_FILENAME, } from "./shared.js";
 const GENERATE_USAGE = "  Usage: schema generate <name>";
 function parseGenerateName(ctx) {
@@ -35,12 +38,6 @@ function parseGenerateName(ctx) {
     }
     return { kind: "name", name };
 }
-function isEmptyMigration(result) {
-    return (result.diff.newTables.length === 0 &&
-        result.diff.changedTables.length === 0 &&
-        result.diff.droppedTables.length === 0 &&
-        result.retiredDrops.length === 0);
-}
 function writeMigrationFiles(migrationsDir, snapshotPath, result) {
     if (!existsSync(migrationsDir))
         mkdirSync(migrationsDir, { recursive: true });
@@ -50,7 +47,7 @@ function writeMigrationFiles(migrationsDir, snapshotPath, result) {
 function reportGeneratedMigration(out, result, rebuildTables) {
     out.log("");
     out.log(`  ✓ ${result.filename}`);
-    out.log(`    new tables: ${result.diff.newTables.length}, changed: ${result.diff.changedTables.length}, dropped: ${result.diff.droppedTables.length}, retired framework tables dropped: ${result.retiredDrops.length}`);
+    out.log(`    new tables: ${result.diff.newTables.length}, changed: ${result.diff.changedTables.length}, dropped: ${result.diff.droppedTables.length}, retired framework tables dropped: ${result.retiredDrops.length}, row level security changes: ${result.rowLevelSecurityChanges.length}`);
     if (rebuildTables.length > 0) {
         out.log(`    rebuild-marker: ${result.filename.replace(/\.sql$/, ".rebuild.json")} (${rebuildTables.length} table(s))`);
     }
@@ -70,12 +67,13 @@ export async function runGenerateCommand(ctx) {
     const prevSnapshot = loadPreviousSnapshot(snapshotPath);
     const result = generateMigration({
         metas: schemaMod.entityMetas,
+        rowLevelSecurity: schemaMod.rowLevelSecurity,
         prevSnapshot,
         name: parsed.name,
         sequenceNumber: nextSequenceNumber(migrationsDir),
         priorMigrationsSql: readMigrationSqlTexts(migrationsDir),
     });
-    if (isEmptyMigration(result)) {
+    if (hasNoSchemaChanges(result)) {
         out.log("  No schema changes detected — no new migration file written.");
         return 0;
     }

package/dist/schema-cli/shared.d.ts

@@ -1,4 +1,5 @@
 import { type renderTablesDdl } from "../db/index.ts";
+import { type RowLevelSecurityMode } from "../db/render-rls-ddl.ts";
 import type { FeatureDefinition } from "../engine/types/feature.ts";
 export type SchemaCliOut = {
     readonly log: (line: string) => void;
@@ -30,10 +31,13 @@ export type SchemaMod = {
     readonly entityMetas: Parameters<typeof renderTablesDdl>[0];
     readonly features?: unknown;
     readonly validateBootOptions?: unknown;
+    readonly rowLevelSecurity: RowLevelSecurityMode;
 };
+export declare function parseSchemaRowLevelSecurity(value: unknown, schemaFile: string): RowLevelSecurityMode;
 export declare function describeThrown(e: unknown): string;
 export declare function nextSequenceNumber(migrationsDir: string): number;
 export declare function loadPreviousSnapshot(snapshotPath: string): import("../db/migrate-generator.ts").Snapshot | null;
 export declare function loadSchemaModOrReport(ctx: SchemaCliContext): Promise<SchemaMod | undefined>;
+export declare function loadRowLevelSecurityModeOrReport(ctx: SchemaCliContext): Promise<RowLevelSecurityMode | undefined>;
 export declare function readDatabaseUrlOrReport(out: SchemaCliOut): string | undefined;
 export declare function migrationsDirExistsOrReport(ctx: SchemaCliContext): boolean;

package/dist/schema-cli/shared.js

@@ -7,10 +7,20 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { existsSync, readdirSync } from "node:fs";
-import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import { assertUniqueTableNames, loadSnapshotJson } from "../db/index.js";
+import { isOneOf, isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { loadSnapshotJson } from "../db/index.js";
+import { assertUniqueTableNames } from "../db/migrate-generator.js";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE, ROW_LEVEL_SECURITY_MODES, } from "../db/render-rls-ddl.js";
 import { isEntityTableMeta } from "../db/table-introspection.js";
 export const SNAPSHOT_FILENAME = ".snapshot.json";
+// An absent export means the default mode; a typo must not silently switch tenant isolation off.
+export function parseSchemaRowLevelSecurity(value, schemaFile) {
+    if (value === undefined)
+        return DEFAULT_ROW_LEVEL_SECURITY_MODE;
+    if (isOneOf(ROW_LEVEL_SECURITY_MODES, value))
+        return value;
+    throw new Error(`Schema file ${schemaFile}: ROW_LEVEL_SECURITY must be one of ${ROW_LEVEL_SECURITY_MODES.join(", ")}, got ${String(value)}.`);
+}
 export function describeThrown(e) {
     return e instanceof Error ? e.message : String(e);
 }
@@ -43,6 +53,7 @@ async function loadSchemaModFromApp(schemaFile) {
         entityMetas: validMetas,
         features: mod["FEATURES"],
         validateBootOptions: mod["VALIDATE_BOOT_OPTIONS"],
+        rowLevelSecurity: parseSchemaRowLevelSecurity(mod["ROW_LEVEL_SECURITY"], schemaFile),
     };
 }
 export function nextSequenceNumber(migrationsDir) {
@@ -79,6 +90,14 @@ export async function loadSchemaModOrReport(ctx) {
         return undefined;
     }
 }
+// `apply` needs only the mode: migrations and rebuilds on a role that RLS binds see nothing unless
+// the connection runs in system scope, which only an "on" connection sets. Without a schema file
+// (dev CLI against a bare checkout) there is nothing to enforce.
+export async function loadRowLevelSecurityModeOrReport(ctx) {
+    if (!existsSync(ctx.schemaFile))
+        return "off";
+    return (await loadSchemaModOrReport(ctx))?.rowLevelSecurity;
+}
 export function readDatabaseUrlOrReport(out) {
     const dbUrl = process.env["DATABASE_URL"];
     if (!dbUrl) {

package/dist/schema-cli/status-command.js

@@ -1,6 +1,8 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { createDbConnection, fetchAppliedMigrations, findCommentedDropTables, isRetiredFrameworkTable, loadMigrationsFromDir, readMigrationSqlTexts, tableExists, } from "../db/index.js";
+import { createDbConnection, tableExists } from "../db/index.js";
+import { fetchAppliedMigrations, loadMigrationsFromDir, readMigrationSqlTexts, } from "../db/migrate-runner.js";
+import { findCommentedDropTables, isRetiredFrameworkTable, } from "../db/retired-framework-tables.js";
 import { describeThrown, loadPreviousSnapshot, readDatabaseUrlOrReport, SNAPSHOT_FILENAME, } from "./shared.js";
 // A table that a migration only drops as a commented DESTRUCTIVE marker and
 // that the snapshot no longer has is gone on paper but still in the live DB.
@@ -42,7 +44,11 @@ export async function runStatusCommand(ctx) {
         return 0;
     }
     const local = loadMigrationsFromDir(migrationsDir);
-    const { db, close } = createDbConnection({ url: dbUrl });
+    const { db, close } = createDbConnection({
+        url: dbUrl,
+        maxConnections: 1,
+        rowLevelSecurity: "off", // journal-only tool: touches no tenant rows
+    });
     try {
         const applied = await fetchAppliedMigrationIds(db);
         out.log("");