@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/schema-cli/validate-command.js

@@ -1,6 +1,9 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { diffReplayAgainstSnapshot, generateMigration, readMigrationSqlTexts, replayMigrationsDir, } from "../db/index.js";
+import { assertRowLevelSecurityTableState, createDbConnection, generateMigration, } from "../db/index.js";
+import { knownTablesOf } from "../db/known-table-names.js";
+import { readMigrationSqlTexts } from "../db/migrate-runner.js";
+import { diffReplayAgainstSnapshot, replayMigrationsDir } from "../db/replay-migration-sql.js";
 import { validateBoot } from "../engine/boot-validator.js";
 import { describeThrown, loadPreviousSnapshot, loadSchemaModOrReport, nextSequenceNumber, SNAPSHOT_FILENAME, } from "./shared.js";
 import { featureDefinitionsOf, parseValidateBootOptions, withFileStoragePresence, } from "./validate-boot-input.js";
@@ -9,6 +12,7 @@ function checkSchemaDrift(ctx, schemaMod, prevSnapshot) {
     const { out, migrationsDir } = ctx;
     const drift = generateMigration({
         metas: schemaMod.entityMetas,
+        rowLevelSecurity: schemaMod.rowLevelSecurity,
         prevSnapshot,
         name: "validate",
         sequenceNumber: nextSequenceNumber(migrationsDir),
@@ -19,13 +23,14 @@ function checkSchemaDrift(ctx, schemaMod, prevSnapshot) {
         ...drift.diff.changedTables.map((t) => t.tableName),
         ...drift.diff.droppedTables,
         ...drift.retiredDrops.map((t) => t.tableName),
+        ...drift.rowLevelSecurityChanges.map((c) => c.tableName),
     ];
     if (pendingTables.length === 0) {
         out.log("  ✓ schema: migrations match the entity definitions");
         return true;
     }
     out.err("  ✗ schema drift: entity definitions are ahead of kumiko/migrations.");
-    out.err(`    pending — new: ${drift.diff.newTables.length}, changed: ${drift.diff.changedTables.length}, dropped: ${drift.diff.droppedTables.length}`);
+    out.err(`    pending — new: ${drift.diff.newTables.length}, changed: ${drift.diff.changedTables.length}, dropped: ${drift.diff.droppedTables.length}, row level security: ${drift.rowLevelSecurityChanges.length}`);
     out.err(`    tables: ${pendingTables.join(", ")}`);
     out.err("    Fix: `kumiko-schema generate <name>`, then commit the migration.");
     return false;
@@ -57,6 +62,46 @@ function checkBootValidity(out, schemaMod) {
         return false;
     }
 }
+// 4. Live row-level security table state — the table half of the boot check. Only with a DATABASE_URL;
+// without one the command stays database-free.
+async function checkLiveRowLevelSecurity(out, schemaMod) {
+    const dbUrl = process.env["DATABASE_URL"];
+    if (!dbUrl) {
+        out.log("  · row-level security: skipped — set DATABASE_URL to check the live database.");
+        return true;
+    }
+    let features;
+    try {
+        features = featureDefinitionsOf(schemaMod.features);
+    }
+    catch {
+        // skip: the boot check already reported the unreadable FEATURES export
+        return true;
+    }
+    const knownTables = features === undefined ? { has: () => true } : knownTablesOf(features);
+    const { db, close } = createDbConnection({
+        url: dbUrl,
+        maxConnections: 1,
+        rowLevelSecurity: schemaMod.rowLevelSecurity,
+    });
+    try {
+        await assertRowLevelSecurityTableState(db, schemaMod.rowLevelSecurity, knownTables);
+        out.log("  ✓ row-level security: live database matches the configured mode");
+        return true;
+    }
+    catch (e) {
+        out.err(`  ✗ row-level security: ${describeThrown(e)}`);
+        return false;
+    }
+    finally {
+        try {
+            await close();
+        }
+        catch {
+            // The check result is already reported; a failing close must not hide it.
+        }
+    }
+}
 function reportMigrationContentMismatches(out, mismatches) {
     out.err("  ✗ migration-content drift: committed *.sql files don't produce .snapshot.json.");
     for (const m of mismatches) {
@@ -72,7 +117,7 @@ function reportMigrationContentMismatches(out, mismatches) {
             "job-run-log store table for the pattern.");
     }
     if (mismatches.some((m) => m.kind !== "unexpected-table")) {
-        out.err("    Fix (missing-table/column-drift): a migration file's body doesn't match " +
+        out.err("    Fix (missing-table/column-drift/row-level-security-drift): a migration file's body doesn't match " +
             "what it (or the snapshot) claims — hand-fix the file, or ship a corrective " +
             "migration if it's already applied in prod.");
     }
@@ -117,6 +162,8 @@ function checkMigrationContentDrift(ctx, prevSnapshot) {
 //      Layer 1 alone misses this: it only compares ENTITY_METAS to the
 //      snapshot, never the snapshot to the SQL that's supposed to have
 //      produced it.
+//   4. live row-level security (only with DATABASE_URL): the boot's
+//      table-state check against the real database (not the role: that is a boot-time property).
 // The DB-level gate (assertKumikoSchemaCurrent) stays at boot/deploy.
 export async function runValidateCommand(ctx) {
     const schemaMod = await loadSchemaModOrReport(ctx);
@@ -126,5 +173,6 @@ export async function runValidateCommand(ctx) {
     const schemaOk = checkSchemaDrift(ctx, schemaMod, prevSnapshot);
     const bootOk = checkBootValidity(ctx.out, schemaMod);
     const migrationsOk = checkMigrationContentDrift(ctx, prevSnapshot);
-    return schemaOk && bootOk && migrationsOk ? 0 : 1;
+    const rowLevelSecurityOk = await checkLiveRowLevelSecurity(ctx.out, schemaMod);
+    return schemaOk && bootOk && migrationsOk && rowLevelSecurityOk ? 0 : 1;
 }

package/dist/schema-cli.d.ts

@@ -1,5 +1,4 @@
 import type { RunSchemaCliOptions, SchemaCliOut } from "./schema-cli/shared.ts";
-export type { RunSchemaCliOptions, SchemaCliOut } from "./schema-cli/shared.ts";
 /**
  * Runs a schema-CLI subcommand. `appCwd` is the app workspace root (where
  * `kumiko/schema.ts` + `kumiko/migrations/` live). Returns a process exit code.

package/dist/search/configure-tenant-index.d.ts

@@ -1,4 +1,2 @@
-import type { Registry, TenantId } from "../engine/types/index.ts";
-import type { SearchAdapter } from "./types.ts";
+import type { Registry } from "../engine/types/index.ts";
 export declare function collectSearchableFieldNames(registry: Registry): readonly string[];
-export declare function configureTenantSearchIndex(searchAdapter: SearchAdapter, registry: Registry, tenantId: TenantId): Promise<void>;

package/dist/search/configure-tenant-index.js

@@ -2,7 +2,3 @@ import { deriveSearchAdapterConfig } from "./derive-search-adapter-config.js";
 export function collectSearchableFieldNames(registry) {
     return deriveSearchAdapterConfig(registry)?.searchableFields ?? [];
 }
-export async function configureTenantSearchIndex(searchAdapter, registry, tenantId) {
-    const fields = collectSearchableFieldNames(registry);
-    await searchAdapter.configure(tenantId, { searchableFields: fields, rankingFields: fields });
-}

package/dist/search/index.d.ts

@@ -1,7 +1,4 @@
-export { collectSearchableFieldNames, configureTenantSearchIndex, } from "./configure-tenant-index.ts";
-export { deriveSearchAdapterConfig } from "./derive-search-adapter-config.ts";
 export { createInMemorySearchAdapter } from "./in-memory-adapter.ts";
 export { purgeSearchDocumentsForSubject } from "./purge-subject.ts";
-export type { ReindexEntityFailure, ReindexEntityOptions, ReindexEntityResult, } from "./reindex-entity.ts";
 export { reindexEntity } from "./reindex-entity.ts";
-export type { SearchAdapter, SearchAdapterConfig, SearchDocument, SearchOptions, SearchResult, } from "./types.ts";
+export type { SearchAdapter, SearchAdapterConfig, } from "./types.ts";

package/dist/search/index.js

@@ -2,8 +2,6 @@
 // `@cosmicdrift/kumiko-framework/search/meilisearch`. This keeps the main barrel from loading a
 // Meilisearch client when consumers only use SearchAdapter types, so apps that do not use
 // Meilisearch do not pull in the client code.
-export { collectSearchableFieldNames, configureTenantSearchIndex, } from "./configure-tenant-index.js";
-export { deriveSearchAdapterConfig } from "./derive-search-adapter-config.js";
 export { createInMemorySearchAdapter } from "./in-memory-adapter.js";
 export { purgeSearchDocumentsForSubject } from "./purge-subject.js";
 export { reindexEntity } from "./reindex-entity.js";

package/dist/search/meilisearch-adapter-internals.d.ts

@@ -0,0 +1,8 @@
+import type { EntityId, TenantId } from "../engine/types/identifiers.ts";
+export type MeilisearchAdapterOptions = {
+    url: string;
+    apiKey: string;
+    indexPrefix?: string;
+};
+export declare function meilisearchTenantIndex(prefix: string, tenantId: TenantId): string;
+export declare function meilisearchDocId(entityType: string, entityId: EntityId): string;

package/dist/search/meilisearch-adapter-internals.js

@@ -0,0 +1,9 @@
+// Exported for unit tests (index-name / primary-key shape) without a live Meili.
+export function meilisearchTenantIndex(prefix, tenantId) {
+    return `${prefix}t${tenantId}`;
+}
+// Meilisearch primary-key-ids: alphanumerics, `-`, `_`. UUIDs contain `-` —
+// legal. Replace anything else just in case callers pass unexpected shapes.
+export function meilisearchDocId(entityType, entityId) {
+    return `${entityType}_${String(entityId).replace(/[^0-9A-Za-z_-]/g, "_")}`;
+}

package/dist/search/meilisearch-adapter.d.ts

@@ -1,10 +1,3 @@
-import type { EntityId, TenantId } from "../engine/types/identifiers.ts";
+import { type MeilisearchAdapterOptions } from "./meilisearch-adapter-internals.ts";
 import type { SearchAdapter } from "./types.ts";
-export type MeilisearchAdapterOptions = {
-    url: string;
-    apiKey: string;
-    indexPrefix?: string;
-};
-export declare function meilisearchTenantIndex(prefix: string, tenantId: TenantId): string;
-export declare function meilisearchDocId(entityType: string, entityId: EntityId): string;
 export declare function createMeilisearchAdapter(options: MeilisearchAdapterOptions): SearchAdapter;

package/dist/search/meilisearch-adapter.js

@@ -1,5 +1,10 @@
 import { errorCodeOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { ErrorStatusCode, Meilisearch } from "meilisearch";
+import { importOptionalPeer } from "../utils/import-optional-peer.js";
+import { meilisearchDocId, meilisearchTenantIndex, } from "./meilisearch-adapter-internals.js";
+import { MEILISEARCH_PEER } from "./meilisearch-peer.js";
+// meilisearch is an optional peer; a static import would fail with the runtime's bare
+// "Cannot find package" error instead of naming the peer and how to install it.
+const { ErrorStatusCode, Meilisearch } = await importOptionalPeer(MEILISEARCH_PEER, () => import("meilisearch"));
 // meilisearch's waitTask() RESOLVES (never rejects) once the server task
 // reaches a terminal state, even "failed" — a rejected doc (e.g. an id over
 // Meili's 511-byte limit) otherwise fails silently and the caller thinks
@@ -50,14 +55,8 @@ function isIndexNotFound(err) {
     return errorCodeOf(cause) === ErrorStatusCode.INDEX_NOT_FOUND;
 }
 // Exported for unit tests (index-name / primary-key shape) without a live Meili.
-export function meilisearchTenantIndex(prefix, tenantId) {
-    return `${prefix}t${tenantId}`;
-}
 // Meilisearch primary-key-ids: alphanumerics, `-`, `_`. UUIDs contain `-` —
 // legal. Replace anything else just in case callers pass unexpected shapes.
-export function meilisearchDocId(entityType, entityId) {
-    return `${entityType}_${String(entityId).replace(/[^0-9A-Za-z_-]/g, "_")}`;
-}
 export function createMeilisearchAdapter(options) {
     const client = new Meilisearch({ host: options.url, apiKey: options.apiKey });
     const prefix = options.indexPrefix ?? "kumiko_";

package/dist/search/meilisearch-peer.d.ts

@@ -0,0 +1,2 @@
+import type { OptionalPeer } from "../utils/import-optional-peer.ts";
+export declare const MEILISEARCH_PEER: OptionalPeer;

package/dist/search/meilisearch-peer.js

@@ -0,0 +1,5 @@
+export const MEILISEARCH_PEER = {
+    name: "meilisearch",
+    range: "^0.58.0",
+    requiredBy: "@cosmicdrift/kumiko-framework/search/meilisearch",
+};

package/dist/search/reindex-entity.js

@@ -6,7 +6,8 @@
 // existing row and indexes it, same as a live write would.
 import { resolveTableName } from "../db/entity-table-meta.js";
 import { executeRawQueryRead } from "../db/queries/raw-sql.js";
-import { withoutStatementTimeout } from "../db/statement-timeout.js";
+import { runInNewTransaction, runnerCanBeginTransaction } from "../db/query.js";
+import { runInSystemRowLevelSecurityScope } from "../db/row-level-security-scope.js";
 import { buildSearchDocument, decryptSearchableSubjectFields, hasErasedSearchableSubjectField, } from "../pipeline/system-hooks.js";
 import { toSnakeCase } from "../utils/case.js";
 function quoteIdent(name) {
@@ -26,111 +27,126 @@ function rowToState(row, fieldNames) {
     }
     return state;
 }
-export function reindexEntity(db, registry, searchAdapter, entityName, tenantId, options = {}) {
-    return withoutStatementTimeout(db, (unboundedDb) => scanAndIndexEntity(unboundedDb, registry, searchAdapter, entityName, tenantId, options));
-}
-async function scanAndIndexEntity(db, registry, searchAdapter, entityName, tenantId, options) {
-    const entity = registry.getEntity(entityName);
-    if (!entity) {
-        throw new Error(`reindexEntity: unknown entity "${entityName}"`);
-    }
-    const searchableFields = registry.getSearchableFields(entityName);
-    const extensions = registry.getSearchPayloadExtensions(entityName);
-    if (searchableFields.length === 0 && extensions.length === 0) {
-        throw new Error(`reindexEntity: entity "${entityName}" has no searchable fields and no search-payload ` +
-            `extensions — nothing to index.`);
+// Server pools cap statement_timeout, and a batch scan over a large table can outlast it. The caller's
+// runner (often a gated proxy around the pool) is used as is, so the cap is lifted per batch
+// with a transaction-local set_config instead of moving the scan to an ungated sibling pool. A runner already inside a
+// transaction keeps the caller's setting rather than leaking ours into its remaining statements.
+async function readBatchWithoutStatementTimeout(db, sqlText, params) {
+    if (!runnerCanBeginTransaction(db)) {
+        return executeRawQueryRead(db, sqlText, params);
     }
-    const batchSize = options.batchSize ?? 500;
-    const tableName = resolveTableName(entityName, entity, undefined);
-    const fieldNames = Object.keys(entity.fields);
-    // Soft-deleted rows already left the live index (the .deleted consumer
-    // calls searchAdapter.remove()) — resurrecting them here would make
-    // erased entities findable again.
-    const deletedFilter = entity.softDelete === true ? `AND ${quoteIdent("is_deleted")} IS NOT TRUE` : "";
-    const failures = [];
-    const result = { scannedRows: 0, indexedRows: 0, wouldIndexRows: 0, failures };
-    let lastId;
-    // Whether a searchable field lacks a matching read-table column depends
-    // only on the table's column set (rowToState/Object.hasOwn), not on any
-    // particular row's data — every row from the same SELECT * has the same
-    // columns. Check once against the first row instead of every row, so a
-    // dropped/never-migrated column fails fast with one clear error instead
-    // of one identical failures[] entry per scanned row (1M rows → 1M
-    // entries, and the real schema problem is buried in "x failed").
-    let uncheckedSchema = true;
-    for (;;) {
-        // Keyset, not OFFSET: rows deleted or changed while the loop runs must not shift the window.
-        const afterLastId = lastId === undefined ? "" : `AND ${quoteIdent("id")} > $3`;
-        const rows = await executeRawQueryRead(db, `SELECT * FROM ${quoteIdent(tableName)}
+    return runInNewTransaction(db, async (tx) => {
+        await executeRawQueryRead(tx, "SELECT set_config('statement_timeout', '0', true)", []);
+        return executeRawQueryRead(tx, sqlText, params);
+    });
+}
+export async function reindexEntity(db, registry, searchAdapter, entityName, tenantId, options = {}) {
+    return runInSystemRowLevelSecurityScope("search reindex reads entity rows of all tenants", async () => {
+        const entity = registry.getEntity(entityName);
+        if (!entity) {
+            throw new Error(`reindexEntity: unknown entity "${entityName}"`);
+        }
+        const searchableFields = registry.getSearchableFields(entityName);
+        const extensions = registry.getSearchPayloadExtensions(entityName);
+        if (searchableFields.length === 0 && extensions.length === 0) {
+            throw new Error(`reindexEntity: entity "${entityName}" has no searchable fields and no search-payload ` +
+                `extensions — nothing to index.`);
+        }
+        const batchSize = options.batchSize ?? 500;
+        const tableName = resolveTableName(entityName, entity, undefined);
+        const fieldNames = Object.keys(entity.fields);
+        // Soft-deleted rows already left the live index (the .deleted consumer
+        // calls searchAdapter.remove()) — resurrecting them here would make
+        // erased entities findable again.
+        const deletedFilter = entity.softDelete === true ? `AND ${quoteIdent("is_deleted")} IS NOT TRUE` : "";
+        const failures = [];
+        const result = { scannedRows: 0, indexedRows: 0, wouldIndexRows: 0, failures };
+        let lastId;
+        // Whether a searchable field lacks a matching read-table column depends
+        // only on the table's column set (rowToState/Object.hasOwn), not on any
+        // particular row's data — every row from the same SELECT * has the same
+        // columns. Check once against the first row instead of every row, so a
+        // dropped/never-migrated column fails fast with one clear error instead
+        // of one identical failures[] entry per scanned row (1M rows → 1M
+        // entries, and the real schema problem is buried in "x failed").
+        let uncheckedSchema = true;
+        for (;;) {
+            // Keyset, not OFFSET: rows deleted or changed while the loop runs must not shift the window.
+            const afterLastId = lastId === undefined ? "" : `AND ${quoteIdent("id")} > $3`;
+            const rows = await readBatchWithoutStatementTimeout(db, `SELECT * FROM ${quoteIdent(tableName)}
         WHERE ${quoteIdent("tenant_id")} = $1 ${deletedFilter} ${afterLastId}
         ORDER BY ${quoteIdent("id")} ASC
         LIMIT $2`, lastId === undefined ? [tenantId, batchSize] : [tenantId, batchSize, lastId]);
-        const [firstRow] = rows;
-        if (firstRow === undefined)
-            break;
-        if (uncheckedSchema) {
-            uncheckedSchema = false;
-            const sampleState = rowToState(firstRow, fieldNames);
-            const unmappedField = searchableFields.find((fieldName) => !(fieldName in sampleState));
-            if (unmappedField !== undefined) {
-                throw new Error(`reindexEntity: searchable field "${unmappedField}" is not mappable from read-table ` +
-                    `column ${quoteIdent(tableName)} — likely a dropped/never-migrated column.`);
-            }
-        }
-        const docs = [];
-        for (const row of rows) {
-            result.scannedRows++;
-            const entityId = String(row["id"]);
-            try {
-                const rawState = rowToState(row, fieldNames);
-                // `pii + searchable` fields hold ciphertext on the read-table row —
-                // decrypt the same way the live write-path consumer does. An
-                // erased subject key doesn't throw, it swaps the value for
-                // PII_ERASED_SENTINEL (see decryptSearchableSubjectFields) — check
-                // for that AFTER decrypting, mirroring the softDelete filter above:
-                // resurrecting a crypto-shredded row here would undo
-                // purgeSearchDocumentsForSubject and make it findable again.
-                const state = await decryptSearchableSubjectFields(entityName, rawState, registry);
-                if (hasErasedSearchableSubjectField(entityName, state, registry))
-                    continue;
-                const doc = await buildSearchDocument(entityName, entityId, state, registry);
-                if (doc)
-                    docs.push({ entityId, doc });
-            }
-            catch (e) {
-                result.failures.push({ entityId, reason: e instanceof Error ? e.message : String(e) });
+            const [firstRow] = rows;
+            if (firstRow === undefined)
+                break;
+            if (uncheckedSchema) {
+                uncheckedSchema = false;
+                const sampleState = rowToState(firstRow, fieldNames);
+                const unmappedField = searchableFields.find((fieldName) => !(fieldName in sampleState));
+                if (unmappedField !== undefined) {
+                    throw new Error(`reindexEntity: searchable field "${unmappedField}" is not mappable from read-table ` +
+                        `column ${quoteIdent(tableName)} — likely a dropped/never-migrated column.`);
+                }
             }
-        }
-        if (!options.dryRun && docs.length > 0) {
-            if (searchAdapter.indexBatch) {
+            const docs = [];
+            for (const row of rows) {
+                result.scannedRows++;
+                const entityId = String(row["id"]);
                 try {
-                    await searchAdapter.indexBatch(tenantId, docs.map((d) => d.doc));
-                    result.indexedRows += docs.length;
+                    const rawState = rowToState(row, fieldNames);
+                    // `pii + searchable` fields hold ciphertext on the read-table row —
+                    // decrypt the same way the live write-path consumer does. An
+                    // erased subject key doesn't throw, it swaps the value for
+                    // PII_ERASED_SENTINEL (see decryptSearchableSubjectFields) — check
+                    // for that AFTER decrypting, mirroring the softDelete filter above:
+                    // resurrecting a crypto-shredded row here would undo
+                    // purgeSearchDocumentsForSubject and make it findable again.
+                    const state = await decryptSearchableSubjectFields(entityName, rawState, registry);
+                    if (hasErasedSearchableSubjectField(entityName, state, registry))
+                        continue;
+                    const doc = await buildSearchDocument(entityName, entityId, state, registry);
+                    if (doc)
+                        docs.push({ entityId, doc });
                 }
                 catch (e) {
-                    const reason = e instanceof Error ? e.message : String(e);
-                    for (const { entityId } of docs)
-                        result.failures.push({ entityId, reason });
+                    result.failures.push({ entityId, reason: e instanceof Error ? e.message : String(e) });
                 }
             }
-            else {
-                for (const { entityId, doc } of docs) {
+            if (!options.dryRun && docs.length > 0) {
+                if (searchAdapter.indexBatch) {
                     try {
-                        await searchAdapter.index(tenantId, doc);
-                        result.indexedRows++;
+                        await searchAdapter.indexBatch(tenantId, docs.map((d) => d.doc));
+                        result.indexedRows += docs.length;
                     }
                     catch (e) {
-                        result.failures.push({ entityId, reason: e instanceof Error ? e.message : String(e) });
+                        const reason = e instanceof Error ? e.message : String(e);
+                        for (const { entityId } of docs)
+                            result.failures.push({ entityId, reason });
+                    }
+                }
+                else {
+                    for (const { entityId, doc } of docs) {
+                        try {
+                            await searchAdapter.index(tenantId, doc);
+                            result.indexedRows++;
+                        }
+                        catch (e) {
+                            result.failures.push({
+                                entityId,
+                                reason: e instanceof Error ? e.message : String(e),
+                            });
+                        }
                     }
                 }
             }
+            else if (options.dryRun) {
+                result.wouldIndexRows += docs.length;
+            }
+            lastId = rows[rows.length - 1]?.["id"];
+            if (rows.length < batchSize)
+                break;
         }
-        else if (options.dryRun) {
-            result.wouldIndexRows += docs.length;
-        }
-        lastId = rows[rows.length - 1]?.["id"];
-        if (rows.length < batchSize)
-            break;
-    }
-    return result;
+        return result;
+    });
 }

package/dist/secrets/index.d.ts

@@ -1,9 +1,8 @@
-export { createDekCache, type DekCache, type DekCacheOptions, withDekCache } from "./dek-cache.ts";
+export { createDekCache, type DekCache, withDekCache } from "./dek-cache.ts";
 export { derivePurposeSecret } from "./derive-purpose-secret.ts";
-export { createEnvMasterKeyProvider, type EnvMasterKeyProviderOptions, type Keyring, } from "./env-master-key-provider.ts";
+export { createEnvMasterKeyProvider } from "./env-master-key-provider.ts";
 export { decryptValue, encryptValue } from "./envelope.ts";
 export { createEnvelopeCipher, type EnvelopeCipher, type EnvelopeCipherOptions, } from "./envelope-cipher.ts";
-export { assertNoSecretLeak } from "./leak-guard.ts";
 export { rewrapDek } from "./rotation.ts";
 export { decodeStoredEnvelope, encodeStoredEnvelope, isStoredEnvelope, type StoredEnvelope, } from "./stored-envelope.ts";
-export { type ContainsSecret, createSecret, type Envelope, isSecret, type KeyScope, type MasterKeyProvider, type Secret, type SecretAuditContext, type SecretKeyRef, type SecretsContext, } from "./types.ts";
+export { createSecret, type MasterKeyProvider, type Secret, type SecretsContext, } from "./types.ts";

package/dist/secrets/index.js

@@ -1,9 +1,8 @@
 export { createDekCache, withDekCache } from "./dek-cache.js";
 export { derivePurposeSecret } from "./derive-purpose-secret.js";
-export { createEnvMasterKeyProvider, } from "./env-master-key-provider.js";
+export { createEnvMasterKeyProvider } from "./env-master-key-provider.js";
 export { decryptValue, encryptValue } from "./envelope.js";
 export { createEnvelopeCipher, } from "./envelope-cipher.js";
-export { assertNoSecretLeak } from "./leak-guard.js";
 export { rewrapDek } from "./rotation.js";
 export { decodeStoredEnvelope, encodeStoredEnvelope, isStoredEnvelope, } from "./stored-envelope.js";
-export { createSecret, isSecret, } from "./types.js";
+export { createSecret, } from "./types.js";

package/dist/seeding/index.d.ts

@@ -1,3 +1,3 @@
-export { type EventStoreSeedExisting, type RunEventStoreSeedOptions, runEventStoreSeed, } from "./entity-seed.ts";
+export { runEventStoreSeed } from "./entity-seed.ts";
 export { createTestUser, TestUsers, testTenantId, testUserId } from "./seed-users.ts";
-export { DEFAULT_SEED_IF_EXISTS, type SeedIfExists } from "./types.ts";
+export type { SeedIfExists } from "./types.ts";

package/dist/seeding/index.js

@@ -1,3 +1,2 @@
-export { runEventStoreSeed, } from "./entity-seed.js";
+export { runEventStoreSeed } from "./entity-seed.js";
 export { createTestUser, TestUsers, testTenantId, testUserId } from "./seed-users.js";
-export { DEFAULT_SEED_IF_EXISTS } from "./types.js";

package/dist/time/index.d.ts

@@ -1,6 +1,6 @@
 export { warnIfNonUtcServerTimeZone } from "./boot-tz-warning.ts";
-export type { GeoAddress, GeoCoordinates, GeoTzProvider } from "./geo-tz.ts";
+export type { GeoTzProvider } from "./geo-tz.ts";
 export { isValidIanaTimeZone } from "./iana.ts";
 export { instantToLegacyDate, legacyDateToInstant } from "./legacy-date.ts";
 export { ensureTemporalPolyfill, getTemporal } from "./polyfill.ts";
-export { type Clock, createTzContext, createTzContextAsync, type LocatedTimestampJson, type TzContext, type TzContextOptions, } from "./tz-context.ts";
+export { createTzContext, type TzContext, } from "./tz-context.ts";

package/dist/time/index.js

@@ -12,4 +12,4 @@ export { warnIfNonUtcServerTimeZone } from "./boot-tz-warning.js";
 export { isValidIanaTimeZone } from "./iana.js";
 export { instantToLegacyDate, legacyDateToInstant } from "./legacy-date.js";
 export { ensureTemporalPolyfill, getTemporal } from "./polyfill.js";
-export { createTzContext, createTzContextAsync, } from "./tz-context.js";
+export { createTzContext, } from "./tz-context.js";

package/dist/time/tz-context.d.ts

@@ -6,8 +6,3 @@ export type { Clock, LocatedTimestampJson, TzContext, TzContextOptions, } from "
  * buildHandlerContext stays ambient-free.
  */
 export declare function createTzContext(options?: TzContextOptions): TzContext;
-/**
- * Convenience: ensures the polyfill is loaded AND creates the TzContext in
- * one await. Prefer this in boot code.
- */
-export declare function createTzContextAsync(options?: TzContextOptions): Promise<TzContext>;

package/dist/time/tz-context.js

@@ -18,7 +18,6 @@
 // The pure type contracts (TzContext, TzContextOptions, LocatedTimestampJson)
 // live in @cosmicdrift/kumiko-types/tz-context — only the factories are here.
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { ensureTemporalPolyfill } from "./polyfill.js";
 const SYSTEM_CLOCK = {
     now: () => Temporal.Now.instant(), // @wrapper-known semantic-alias
 };
@@ -72,11 +71,3 @@ export function createTzContext(options = {}) {
         },
     };
 }
-/**
- * Convenience: ensures the polyfill is loaded AND creates the TzContext in
- * one await. Prefer this in boot code.
- */
-export async function createTzContextAsync(options) {
-    await ensureTemporalPolyfill();
-    return createTzContext(options);
-}

package/dist/ui-types/index.d.ts

@@ -5,22 +5,19 @@ export type { FormDerivationScreen } from "../engine/form-derivations.ts";
 export { applyFormDerivations, isFormDerivationInputMode, isUnusedFallbackOperand, } from "../engine/form-derivations.ts";
 export type { ParsedRefTarget } from "../engine/parse-ref-target.ts";
 export { parseRefTarget } from "../engine/parse-ref-target.ts";
-export type { FieldsOrGroupsSection, UnavailableSelectOption } from "../engine/screen-helpers.ts";
-export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.ts";
-export type { BooleanFieldDef, DateFieldDef, EmbeddedDerivedCellDef, EntityDefinition, FieldDefinition, FileFieldDef, FilesFieldDef, ImageFieldDef, ImagesFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, SelectFieldDef, SelectOptionTone, TextFieldDef, } from "../engine/types/fields.ts";
-export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, RoleAccessPersonalData, RoleAccessRule, } from "../engine/types/handlers.ts";
+export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.ts";
+export type { EmbeddedDerivedCellDef, EntityDefinition, FieldDefinition, OptionsQueryPayload, SelectOptionTone, TextFieldDef, } from "../engine/types/fields.ts";
+export type { AccessRule } from "../engine/types/handlers.ts";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.ts";
 export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav.ts";
-export type { ActionFormFooterAction, ActionFormLoad, ActionFormRedirect, ActionFormScreenDefinition, ActionFormSuccessFact, ActionFormSuccessLink, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, FieldAffix, FieldCondition, FieldFillAction, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionClientAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.ts";
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.ts";
+export type { ActionFormFooterAction, ActionFormLoad, ActionFormRedirect, ActionFormScreenDefinition, ActionFormSuccessFact, ActionFormSuccessLink, ConfigEditScreenDefinition, CustomScreenDefinition, DashboardChartMarkerKind, DashboardChartPanel, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRefresh, DashboardRelativeTimeParam, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardTimeRangeDefinition, EditExtensionSection, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditScreenDefinition, EntityListFacetConfig, EntityListScreenDefinition, FieldAffix, FieldCondition, FieldFillAction, FieldIconKey, FieldRenderer, FormWidth, ListBulkAction, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListSortSpec, ListTableOptions, MetricNavigate, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionClientAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretsEditScreenDefinition, ToolbarAction, } from "../engine/types/screen.ts";
+export { MAX_BULK_SELECTION } from "../engine/types/screen.ts";
 export type { TargetRef } from "../engine/types/target-ref.ts";
-export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.ts";
+export type { TreeAction } from "../engine/types/tree-node.ts";
 export type { WorkspaceDefinition } from "../engine/types/workspace.ts";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.ts";
 export type { AppSchema, FeatureSchema, QualifiedContentCollection, WorkspaceSchema, } from "./app-schema.ts";
-export type { CardColumnRoles, CardRoleColumn } from "./card-column-roles.ts";
-export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.ts";
+export { CARD_META_MAX, cardColumnRoles } from "./card-column-roles.ts";
 export { type Formality, formalLocaleTag } from "./formality.ts";
-export type { ListRowMetaColumnType, ListRowMetaReference, ReferenceLookupSource, SystemReferenceLabel, } from "./list-row-meta.ts";
 export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, UNRESOLVED_REFERENCE_LABEL_KEYS, } from "./list-row-meta.ts";
-export { type PluralForms, resolveTranslationValue, type TranslationValue, translationValueOtherText, } from "./plural.ts";
+export { resolveTranslationValue, type TranslationValue, translationValueOtherText, } from "./plural.ts";

package/dist/ui-types/index.js

@@ -23,11 +23,11 @@ export { NO_WIDGET_FIELD_TYPES } from "@cosmicdrift/kumiko-types/fields";
 export { computeDerivedCellValue, roundDerivedCellValue } from "../engine/embedded-derived.js";
 export { applyFormDerivations, isFormDerivationInputMode, isUnusedFallbackOperand, } from "../engine/form-derivations.js";
 export { parseRefTarget } from "../engine/parse-ref-target.js";
-export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
+export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
+export { MAX_BULK_SELECTION } from "../engine/types/screen.js";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
-export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.js";
+export { CARD_META_MAX, cardColumnRoles } from "./card-column-roles.js";
 export { formalLocaleTag } from "./formality.js";
 export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, UNRESOLVED_REFERENCE_LABEL_KEYS, } from "./list-row-meta.js";
 export { resolveTranslationValue, translationValueOtherText, } from "./plural.js";

package/dist/upgrade-changelog.d.ts

@@ -1,3 +1,4 @@
+import type { UpgradeMarkerResolvedManual } from "./upgrade-marker-parse.ts";
 export type UpgradeChangelogManual = {
     readonly id: string;
     readonly version: string;
@@ -23,3 +24,5 @@ export type UpgradeChangelogSection = {
 export declare function renderUpgradeSection(section: UpgradeChangelogSection): string;
 /** Puts the section on top; a section for the same target version is replaced, so a re-run stays idempotent. */
 export declare function mergeUpgradeSection(existing: string | undefined, section: UpgradeChangelogSection): string;
+/** Pure string match on the rendered `- [open] <id> · ` prefix, in every section; each id gets its own resolution. */
+export declare function syncResolvedManualStatuses(content: string, resolved: readonly Pick<UpgradeMarkerResolvedManual, "id" | "resolution">[]): string;