@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/api/index.js

@@ -1,26 +1,24 @@
 export { DEFAULT_GLOBAL_RATE_LIMIT } from "../rate-limit/middleware.js";
-export { deleteTenantCookie, setTenantCookie } from "./anonymous-cookie.js";
+export { setTenantCookie } from "./anonymous-cookie.js";
 export { collectAnonymousLiveEntities } from "./anonymous-live-entities.js";
 export { LOCALE_HEADER_NAME, NO_ROUTE_MATCH_HEADER_NAME } from "./api-constants.js";
-export { authMiddleware, CSRF_HEADER_NAME, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.js";
-export { createAuthRoutes, createInMemoryLoginRateLimiter, createRedisLoginRateLimiter, } from "./auth-routes.js";
-export { assertValidTrustedProxyHops, clientIpSourceFromHonoContext, createClientIpResolver, extractSocketAddress, parseTrustedProxyHopsEnv, TRUSTED_PROXY_HOPS_ENV, UNKNOWN_CLIENT_IP, } from "./client-ip.js";
-export { ExtraRouteEntries, ExtraRouteRejection, signatureRoute } from "./extra-route.js";
-export { cacheControlHeader, cachedResponse, computeRevisionEtag, computeStrongEtag, computeWeakEtag, etagMatches, parseIfNoneMatch, } from "./http-cache.js";
-export { createJwtHelper, loadJwtSecretOrKeyring } from "./jwt.js";
+export { CSRF_HEADER_NAME, PAT_TOKEN_PREFIX, } from "./auth-middleware.js";
+export { createInMemoryLoginRateLimiter, createRedisLoginRateLimiter, } from "./auth-routes.js";
+export { createClientIpResolver, parseTrustedProxyHopsEnv, TRUSTED_PROXY_HOPS_ENV, UNKNOWN_CLIENT_IP, } from "./client-ip.js";
+export { ExtraRouteRejection, signatureRoute } from "./extra-route.js";
+export { cacheControlHeader, cachedResponse, computeRevisionEtag, computeStrongEtag, computeWeakEtag, etagMatches, } from "./http-cache.js";
+export { loadJwtSecretOrKeyring } from "./jwt.js";
 export { publicOriginOf } from "./origin-middleware.js";
-export { patAllows, qnMatches } from "./pat-scope.js";
-export { isSafeLandingPath } from "./post-auth-landing.js";
 export { createDefaultSseBroker, createRedisSseBroker, isRedisSseBroker, } from "./redis-sse-broker.js";
-export { readonlyRequestContext as requestContext, } from "./request-context.js";
-export { buildRequestContextDataFromRequest, requestIdMiddleware, } from "./request-id-middleware.js";
+export { readonlyRequestContext as requestContext } from "./request-context-scopes.js";
+export { buildRequestContextDataFromRequest } from "./request-id-middleware.js";
 export { createMetricsApp, DEFAULT_MAX_REQUEST_BYTES, isPrometheusMeter, } from "./route-registrars.js";
-export { createApiRoutes } from "./routes.js";
 export { buildServer } from "./server.js";
+export { resolveBaseDbAndSearchAdapter } from "./server-event-dispatcher.js";
 export { makeDispatchSystemQuery, makeDispatchSystemWrite, makeDispatchWriteAs, } from "./server-extra-routes.js";
 export { withFileProviderResolver } from "./server-wiring.js";
-export { AUTH_COOKIE_BASE, CSRF_COOKIE_BASE, getSessionCookies, HOST_COOKIE_PREFIX, isHostPrefixedCookieName, resolveSessionCookieNames, resolveSessionCookies, sessionCookieName, sessionCookiesMiddleware, TENANT_COOKIE_BASE, } from "./session-cookies.js";
+export { AUTH_COOKIE_BASE, CSRF_COOKIE_BASE, getSessionCookies, sessionCookieName, } from "./session-cookies.js";
 export { createSseBroker } from "./sse-broker.js";
-export { createSseRoute, SSE_HEARTBEAT_INTERVAL_MS } from "./sse-route.js";
+export { SSE_HEARTBEAT_INTERVAL_MS } from "./sse-route.js";
 export { generateToken } from "./tokens.js";
-export { createKumikoWebSocketHandler, isWebSocketUpgradeRequest, kumikoWebSocketHandler, WEBSOCKET_BACKPRESSURE_LIMIT_BYTES, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_HEARTBEAT_INTERVAL_MS, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_PENDING_BUFFER_LIMIT_BYTES, WEBSOCKET_REVALIDATION_FAILURE_LIMIT, WEBSOCKET_ROUTE_PATH_PREFIX, } from "./websocket-route.js";
+export { createKumikoWebSocketHandler, isWebSocketUpgradeRequest, WEBSOCKET_BACKPRESSURE_LIMIT_BYTES, WEBSOCKET_HEARTBEAT_INTERVAL_MS, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_PENDING_BUFFER_LIMIT_BYTES, WEBSOCKET_ROUTE_PATH_PREFIX, } from "./websocket-route.js";

package/dist/api/jwt.js

@@ -1,6 +1,6 @@
+import { parseTenantId } from "@cosmicdrift/kumiko-types/identifiers";
 import * as jose from "jose";
 import { stripReservedTokenRoles } from "../engine/membership-roles.js";
-import { parseTenantId } from "../engine/types/index.js";
 import { InternalError } from "../errors/index.js";
 function normalizeKeyring(secretOrKeyring) {
     if (typeof secretOrKeyring === "string") {

package/dist/api/observability-middleware.d.ts

@@ -1,5 +1,5 @@
+import type { Meter, Tracer } from "@cosmicdrift/kumiko-types/observability";
 import type { Context, Next } from "hono";
-import { type Meter, type Tracer } from "../observability/index.ts";
 export type ObservabilityMiddlewareOptions = {
     readonly tracer: Tracer;
     readonly meter: Meter;

package/dist/api/observability-middleware.js

@@ -1,4 +1,5 @@
-import { emitHttpRequest, observabilityContext, } from "../observability/index.js";
+import { observabilityContext } from "../observability/context.js";
+import { emitHttpRequest } from "../observability/standard-metrics.js";
 import { getUser } from "./auth-middleware.js";
 import { requestContext } from "./request-context.js";
 import { resolveRouteLabel } from "./route-label.js";

package/dist/api/pii-leak-guard.d.ts

@@ -1,2 +1,5 @@
 import type { MiddlewareHandler } from "hono";
+export declare const CIPHERTEXT_RE: RegExp;
+export declare const CIPHERTEXT_REDACT_RE: RegExp;
+export declare const CIPHERTEXT_REDACTION = "[pii-redacted]";
 export declare function piiCiphertextResponseGuard(): MiddlewareHandler;

package/dist/api/pii-leak-guard.js

@@ -8,8 +8,9 @@ const isProductionEnv = () => process.env["NODE_ENV"] === "production";
 // Bound to the full ciphertext shape (prefix, "<kind>:<id>" subject key, base64
 // blob of at least IV + GCM tag = 28 bytes) so a user-typed "kumiko-pii:v" in a
 // note or name field cannot turn every read of that record into a 500.
-const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^:"\s<>\\]+:[^:"\s<>\\]+:[A-Za-z0-9+/=]{40,}/;
-const CIPHERTEXT_REDACT_RE = new RegExp(CIPHERTEXT_RE.source, "g");
+export const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^:"\s<>\\]+:[^:"\s<>\\]+:[A-Za-z0-9+/=]{40,}/;
+export const CIPHERTEXT_REDACT_RE = new RegExp(CIPHERTEXT_RE.source, "g");
+export const CIPHERTEXT_REDACTION = "[pii-redacted]";
 // A PII subject ciphertext never belongs in an API response — its presence
 // means a raw DB read (fetchOne/selectMany) leaked to the surface. Dev/test
 // fail loud (500) so a forgotten decrypt turns the first integration test

package/dist/api/request-context-internals.d.ts

@@ -0,0 +1,31 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
+import type { AgentRisk } from "@cosmicdrift/kumiko-types/handlers";
+import type { ErrorDocsConfig } from "../errors/docs-url.ts";
+export type RequestContextData = {
+    readonly requestId: string;
+    readonly correlationId: string;
+    readonly causationId?: string;
+    readonly signal?: AbortSignal;
+    readonly errorDocs?: ErrorDocsConfig;
+    readonly ip?: string;
+    readonly userAgent?: string;
+    readonly locale?: string;
+    readonly feature?: string;
+    readonly handler?: string;
+    tenantId?: string;
+    userId?: string;
+    readonly startedAt?: number;
+    readonly writeOrigin?: WriteOrigin;
+    readonly entryHandler?: {
+        readonly qn: string;
+        readonly risk: AgentRisk;
+    };
+    readonly chargedRateLimitBuckets?: Set<string>;
+    readonly agentToolCall?: true;
+};
+export declare const storage: AsyncLocalStorage<RequestContextData>;
+export declare function setRequestIdentity(identity: {
+    tenantId: string;
+    userId?: string;
+}): void;

package/dist/api/request-context-internals.js

@@ -0,0 +1,11 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+export const storage = new AsyncLocalStorage();
+export function setRequestIdentity(identity) {
+    const store = storage.getStore();
+    // skip: outside a request scope there is no log context to enrich
+    if (!store)
+        return;
+    store.tenantId = identity.tenantId;
+    if (identity.userId !== undefined)
+        store.userId = identity.userId;
+}

package/dist/api/request-context-scopes.d.ts

@@ -0,0 +1,14 @@
+import { type WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
+import type { AgentRisk } from "@cosmicdrift/kumiko-types/handlers";
+import { requestContext } from "./request-context.ts";
+export declare const readonlyRequestContext: Pick<typeof requestContext, "get">;
+export declare function runWithOrigin<T>(origin: {
+    readonly feature?: string;
+    readonly handler?: string;
+    readonly entryHandler?: {
+        readonly qn: string;
+        readonly risk: AgentRisk;
+    };
+}, fn: () => T): T;
+export declare function isAgentToolCallScope(): boolean;
+export declare function runWithWriteOrigin<T>(origin: WriteOrigin, fn: () => T): T;

package/dist/api/request-context-scopes.js

@@ -0,0 +1,69 @@
+import { isPersonalDataGated } from "@cosmicdrift/kumiko-types/event-store-types";
+import { requestContext } from "./request-context.js";
+// Request-scoped propagation. Populated by the HTTP middleware and by the
+// event-dispatcher when it runs an MSP-apply, so ctx.events.append downstream
+// automatically stamps the right provenance on every event it writes.
+//
+//   requestId     — unique per HTTP request (or Job run). Log correlation.
+//   correlationId — the end-to-end business operation id; propagates across
+//                   service boundaries and MSP causation chains. Comes from
+//                   the `x-correlation-id` header if set, otherwise mirrors
+//                   requestId (clients that don't set the header pay no
+//                   penalty — a single HTTP call == one correlation).
+//   causationId   — the events.id that triggered THIS execution. Null for
+//                   root HTTP commands; set when an MSP-apply is running
+//                   (event-dispatcher wraps the handler call). Together
+//                   with correlationId, forms a causal DAG across streams.
+//   signal        — AbortSignal from the underlying HTTP request. Aborts
+//                   when the client disconnects (mobile back-press, tab
+//                   close). Query/stream handlers check signal.aborted at
+//                   chunk or query boundaries; runBatch (write dispatch)
+//                   strips it before executing so a disconnect can't abort
+//                   a transaction mid-commit. Undefined for non-HTTP
+//                   entry-points (jobs, MSP-applies) and inside write batches.
+// Public view: `run` would let a caller replace the request scope (entryHandler,
+// writeOrigin), so only the read side is exposed through the /api barrel.
+export const readonlyRequestContext = {
+    get: requestContext.get,
+};
+// Enter a scope that attributes every event written inside it. Keeps the
+// surrounding request's ids so correlation survives, and mints fresh ones
+// when there is no surrounding request (job-runner, event-dispatcher) —
+// requestId/correlationId are mandatory, `get()` may be undefined.
+export function runWithOrigin(origin, fn) {
+    const current = requestContext.get();
+    const requestId = current?.requestId ?? requestContext.generateId();
+    return requestContext.run({
+        ...current,
+        requestId,
+        correlationId: current?.correlationId ?? requestId,
+        feature: origin.feature,
+        handler: origin.handler,
+        // The outermost dispatch wins — a nested ctx.dispatch.write/writeAs must not
+        // overwrite the entry handler that the irreversible-operation gate reads.
+        entryHandler: current?.entryHandler ?? origin.entryHandler,
+        chargedRateLimitBuckets: current?.entryHandler
+            ? current.chargedRateLimitBuckets
+            : new Set(),
+    }, fn);
+}
+export function isAgentToolCallScope() {
+    return requestContext.get()?.agentToolCall === true;
+}
+// An ungated origin never mints a scope: seeds and boot writes keep their missing context.
+export function runWithWriteOrigin(origin, fn) {
+    const current = requestContext.get();
+    if (!isPersonalDataGated(origin)) {
+        if (!current?.writeOrigin)
+            return fn();
+        const { writeOrigin: _writeOrigin, ...rest } = current;
+        return requestContext.run(rest, fn);
+    }
+    const requestId = current?.requestId ?? requestContext.generateId();
+    return requestContext.run({
+        ...current,
+        requestId,
+        correlationId: current?.correlationId ?? requestId,
+        writeOrigin: origin,
+    }, fn);
+}

package/dist/api/request-context.d.ts

@@ -1,46 +1,7 @@
-import { type WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
-import type { AgentRisk } from "@cosmicdrift/kumiko-types/handlers";
-import type { ErrorDocsConfig } from "../errors/docs-url.ts";
-export type RequestContextData = {
-    readonly requestId: string;
-    readonly correlationId: string;
-    readonly causationId?: string;
-    readonly signal?: AbortSignal;
-    readonly errorDocs?: ErrorDocsConfig;
-    readonly ip?: string;
-    readonly userAgent?: string;
-    readonly locale?: string;
-    readonly feature?: string;
-    readonly handler?: string;
-    tenantId?: string;
-    userId?: string;
-    readonly startedAt?: number;
-    readonly writeOrigin?: WriteOrigin;
-    readonly entryHandler?: {
-        readonly qn: string;
-        readonly risk: AgentRisk;
-    };
-    readonly chargedRateLimitBuckets?: Set<string>;
-    readonly agentToolCall?: true;
-};
+import { type RequestContextData } from "./request-context-internals.ts";
 export declare const requestContext: {
     run<T>(data: RequestContextData, fn: () => T): T;
     get(): RequestContextData | undefined;
     generateId(): string;
 };
-export declare function setRequestIdentity(identity: {
-    tenantId: string;
-    userId?: string;
-}): void;
-export declare const readonlyRequestContext: Pick<typeof requestContext, "get">;
-export declare function runWithOrigin<T>(origin: {
-    readonly feature?: string;
-    readonly handler?: string;
-    readonly entryHandler?: {
-        readonly qn: string;
-        readonly risk: AgentRisk;
-    };
-}, fn: () => T): T;
 export declare function runAsAgentToolCallEntry<T>(fn: () => T): T;
-export declare function isAgentToolCallScope(): boolean;
-export declare function runWithWriteOrigin<T>(origin: WriteOrigin, fn: () => T): T;

package/dist/api/request-context.js

@@ -1,7 +1,26 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-import { isPersonalDataGated } from "@cosmicdrift/kumiko-types/event-store-types";
 import { generateId } from "../utils/index.js";
-const storage = new AsyncLocalStorage();
+import { storage } from "./request-context-internals.js";
+// Request-scoped propagation. Populated by the HTTP middleware and by the
+// event-dispatcher when it runs an MSP-apply, so ctx.events.append downstream
+// automatically stamps the right provenance on every event it writes.
+//
+//   requestId     — unique per HTTP request (or Job run). Log correlation.
+//   correlationId — the end-to-end business operation id; propagates across
+//                   service boundaries and MSP causation chains. Comes from
+//                   the `x-correlation-id` header if set, otherwise mirrors
+//                   requestId (clients that don't set the header pay no
+//                   penalty — a single HTTP call == one correlation).
+//   causationId   — the events.id that triggered THIS execution. Null for
+//                   root HTTP commands; set when an MSP-apply is running
+//                   (event-dispatcher wraps the handler call). Together
+//                   with correlationId, forms a causal DAG across streams.
+//   signal        — AbortSignal from the underlying HTTP request. Aborts
+//                   when the client disconnects (mobile back-press, tab
+//                   close). Query/stream handlers check signal.aborted at
+//                   chunk or query boundaries; runBatch (write dispatch)
+//                   strips it before executing so a disconnect can't abort
+//                   a transaction mid-commit. Undefined for non-HTTP
+//                   entry-points (jobs, MSP-applies) and inside write batches.
 export const requestContext = {
     run(data, fn) {
         return storage.run(data, fn);
@@ -13,41 +32,12 @@ export const requestContext = {
         return generateId();
     },
 };
-export function setRequestIdentity(identity) {
-    const store = storage.getStore();
-    // skip: outside a request scope there is no log context to enrich
-    if (!store)
-        return;
-    store.tenantId = identity.tenantId;
-    if (identity.userId !== undefined)
-        store.userId = identity.userId;
-}
 // Public view: `run` would let a caller replace the request scope (entryHandler,
 // writeOrigin), so only the read side is exposed through the /api barrel.
-export const readonlyRequestContext = {
-    get: requestContext.get,
-};
 // Enter a scope that attributes every event written inside it. Keeps the
 // surrounding request's ids so correlation survives, and mints fresh ones
 // when there is no surrounding request (job-runner, event-dispatcher) —
 // requestId/correlationId are mandatory, `get()` may be undefined.
-export function runWithOrigin(origin, fn) {
-    const current = requestContext.get();
-    const requestId = current?.requestId ?? requestContext.generateId();
-    return requestContext.run({
-        ...current,
-        requestId,
-        correlationId: current?.correlationId ?? requestId,
-        feature: origin.feature,
-        handler: origin.handler,
-        // The outermost dispatch wins — a nested ctx.write/writeAs must not
-        // overwrite the entry handler that the irreversible-operation gate reads.
-        entryHandler: current?.entryHandler ?? origin.entryHandler,
-        chargedRateLimitBuckets: current?.entryHandler
-            ? current.chargedRateLimitBuckets
-            : new Set(),
-    }, fn);
-}
 // Clears entryHandler so the next dispatch inside fn becomes the new entry, letting
 // the irreversible-operation gate see the invoked tool handler instead of the
 // surrounding turn/approve handler. Reserved for dispatchToolCall, so it also marks
@@ -64,23 +54,4 @@ export function runAsAgentToolCallEntry(fn) {
         agentToolCall: true,
     }, fn);
 }
-export function isAgentToolCallScope() {
-    return requestContext.get()?.agentToolCall === true;
-}
 // An ungated origin never mints a scope: seeds and boot writes keep their missing context.
-export function runWithWriteOrigin(origin, fn) {
-    const current = requestContext.get();
-    if (!isPersonalDataGated(origin)) {
-        if (!current?.writeOrigin)
-            return fn();
-        const { writeOrigin: _writeOrigin, ...rest } = current;
-        return requestContext.run(rest, fn);
-    }
-    const requestId = current?.requestId ?? requestContext.generateId();
-    return requestContext.run({
-        ...current,
-        requestId,
-        correlationId: current?.correlationId ?? requestId,
-        writeOrigin: origin,
-    }, fn);
-}

package/dist/api/request-id-middleware.d.ts

@@ -1,7 +1,7 @@
 import type { Context, Next } from "hono";
 import type { ErrorDocsConfig } from "../errors/docs-url.ts";
 import { type ClientIpResolver } from "./client-ip.ts";
-import { type RequestContextData } from "./request-context.ts";
+import type { RequestContextData } from "./request-context-internals.ts";
 /**
  * Builds the RequestContextData record for a raw Fetch Request — requestId
  * (client-supplied + sanitized, or generated), correlationId (mirrors

package/dist/api/route-registrars.d.ts

@@ -1,7 +1,8 @@
+import type { Meter } from "@cosmicdrift/kumiko-types/observability";
 import { Hono, type MiddlewareHandler } from "hono";
 import type { DbConnection } from "../db/connection.ts";
 import type { Lifecycle } from "../lifecycle/index.ts";
-import type { Meter, PrometheusMeter } from "../observability/index.ts";
+import type { PrometheusMeter } from "../observability/prometheus-meter.ts";
 import type { EventConsumer } from "../pipeline/event-dispatcher.ts";
 export declare const DEFAULT_MAX_REQUEST_BYTES = 1048576;
 export declare function registerBodyLimit(app: Hono, maxBytes: number): void;

package/dist/api/route-registrars.js

@@ -5,7 +5,7 @@
 // helpers exist to make each step's dependencies visible at the call-site.
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
-import { serializeOpenMetrics } from "../observability/index.js";
+import { serializeOpenMetrics } from "../observability/prometheus-meter.js";
 import { BODY_LIMIT_OPT_OUT_PATHS, Routes } from "./api-constants.js";
 import { createReadinessProbe, dbPingCheck, dispatcherLagCheck, redisPingCheck, } from "./readiness.js";
 // --- Body size limit ------------------------------------------------------

package/dist/api/routes.d.ts

@@ -1,4 +1,5 @@
 import { type Context, Hono } from "hono";
+import { type KumikoError } from "../errors/index.ts";
 import type { Dispatcher } from "../pipeline/dispatcher.ts";
 export declare const StreamFrame: {
     readonly chunk: "chunk";
@@ -18,4 +19,19 @@ export type SseWriter = {
 };
 export declare function pumpStream(stream: SseWriter, generator: AsyncGenerator<unknown>, heartbeatMs: number, firstPull?: Promise<IteratorResult<unknown>>): Promise<void>;
 export declare const MAX_PAYLOAD_DEPTH = 20;
+export declare function assertPayloadDepthAllowed(payload: unknown): void;
+export declare function queryErrorResponse(c: Context, err: KumikoError, type?: unknown): (Response & import("hono").TypedResponse<{
+    readonly error: {
+        readonly code: string;
+        readonly i18nKey: string;
+        readonly i18nParams?: {
+            readonly [x: string]: import("hono/utils/types").JSONValue;
+        } | undefined;
+        readonly message: string;
+        readonly details?: import("hono/utils/types").JSONValue | undefined;
+        readonly docsUrl?: string;
+        readonly requestId?: string;
+        readonly timestamp: string;
+    };
+}, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">) | (Response & import("hono").TypedResponse<null, -1 | 100 | 102 | 103 | 200 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "body">);
 export declare function handleUncaughtRouteError(err: Error, c: Context): Response | Promise<Response>;

package/dist/api/routes.js

@@ -1,8 +1,11 @@
 import { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { streamSSE } from "hono/streaming";
-import { AccessDeniedError, reraiseAsKumikoError, serializeError, toKumikoError, ValidationError, } from "../errors/index.js";
-import { createFallbackLogger, scrubLogText, scrubLogValue } from "../logging/index.js";
+import { AccessDeniedError, reraiseAsKumikoError, ValidationError, } from "../errors/index.js";
+import { serializeError } from "../errors/serialize.js";
+import { createFallbackLogger, scrubLogText } from "../logging/index.js";
+import { scrubLogValue } from "../logging/scrub.js";
+import { wrapToKumiko } from "../pipeline/dispatcher-utils.js";
 import { isPlainObject } from "../utils/is-plain-object.js";
 import { stringifyJson } from "../utils/safe-json.js";
 import { Routes } from "./api-constants.js";
@@ -241,7 +244,8 @@ firstPull) {
 function jsonResponse(c, body, status = 200) {
     return c.body(stringifyJson(body), status, { "Content-Type": "application/json" });
 }
-const toKumiko = toKumikoError;
+// Query filters with an impossible date fail in Postgres (22007/22008); same 400 as on writes.
+const toKumiko = wrapToKumiko;
 // Nesting cap for request payloads — an object-walk, not a string/byte
 // check, since an attacker fully controls whitespace/formatting and a
 // minified deeply-nested payload can stay well under the byte limit while
@@ -312,7 +316,7 @@ async function readDispatchBody(c) {
 // jsonb serialization of custom-fields payloads) walks the same object
 // graph an attacker controls, so an uncapped depth is a stack-overflow /
 // CPU-DoS vector even under the 1MB body-byte limit.
-function assertPayloadDepthAllowed(payload) {
+export function assertPayloadDepthAllowed(payload) {
     if (payloadDepth(payload, 0) > MAX_PAYLOAD_DEPTH) {
         throw new ValidationError({
             fields: [
@@ -428,7 +432,7 @@ function clientAbortResponse(c, requestId, type) {
 }
 // For /query + /command: no isSuccess on success (just { data } / {ok}), so we
 // keep the same lean shape on failure — only the `error` key.
-function queryErrorResponse(c, err, type) {
+export function queryErrorResponse(c, err, type) {
     const requestId = requestContext.get()?.requestId;
     if (isClientAbort(err))
         return clientAbortResponse(c, requestId, type);

package/dist/api/server-boot-checks.d.ts

@@ -1,4 +1,4 @@
-import { type AppContext, type Registry } from "../engine/types/index.ts";
+import type { AppContext, Registry } from "../engine/types/index.ts";
 import type { createFallbackLogger } from "../logging/index.ts";
 import type { AuthRoutesConfig } from "./auth-routes.ts";
 export type BootLogger = ReturnType<typeof createFallbackLogger>;

package/dist/api/server-boot-checks.js

@@ -1,5 +1,5 @@
 import { EXT_FILE_PROVIDER, EXT_PRINCIPAL_STATUS } from "../engine/extension-names.js";
-import { isFileField } from "../engine/types/index.js";
+import { isFileField } from "../engine/field-helpers.js";
 import { SHARED_INSTANCE_SENTINEL } from "../pipeline/event-consumer-state.js";
 import { generateId } from "../utils/index.js";
 // A payload-bucket handler without a resolver would answer every call with a
@@ -23,7 +23,7 @@ export function assertNoPayloadRateLimitsWithoutResolver(registry) {
 export function assertFileStorageProviderForFileFields(registry, context) {
     // File-storage is resolved per-tenant through file-foundation: a mounted
     // `file-provider-*` plugin (inmemory/s3/s3-env) is the single source for
-    // uploads, ctx.files and the GDPR jobs.
+    // uploads, ctx.services.files and the GDPR jobs.
     const hasFileProvider = registry.getExtensionUsages(EXT_FILE_PROVIDER).length > 0;
     // A test/advanced caller may inject the resolver directly on the context
     // (e.g. a static in-memory provider) instead of mounting a provider plugin.

package/dist/api/server-event-dispatcher.d.ts

@@ -1,9 +1,10 @@
 import type { DbConnection } from "../db/connection.ts";
-import type { AppContext } from "../engine/types/index.ts";
+import type { AppContext, Registry } from "../engine/types/index.ts";
 import type { Lifecycle } from "../lifecycle/index.ts";
 import type { ObservabilityProvider } from "../observability/index.ts";
 import { type EventConsumer, type EventDispatcher } from "../pipeline/event-dispatcher.ts";
 import type { ResolvedCacheSyncBus } from "../redis/cache-sync-bus.ts";
+import type { SearchAdapter } from "../search/types.ts";
 import type { RedisSseBroker } from "./redis-sse-broker.ts";
 import type { ServerOptions } from "./server.ts";
 import type { SseBroker } from "./sse-broker.ts";
@@ -19,6 +20,10 @@ export declare function createServerEventDispatcher(deps: {
     readonly consumers: readonly EventConsumer[];
     readonly eventDispatcher: EventDispatcher | undefined;
 };
+export declare function resolveBaseDbAndSearchAdapter(context: AppContext, registry: Registry): {
+    readonly baseDb: DbConnection | undefined;
+    readonly searchAdapter: SearchAdapter | undefined;
+};
 export declare function registerOwnedShutdownHooks(lifecycle: Lifecycle | undefined, owned: {
     readonly eventDispatcher: EventDispatcher | undefined;
     readonly ownedRedisSseBroker: RedisSseBroker | undefined;

package/dist/api/server-event-dispatcher.js

@@ -43,10 +43,9 @@ export function createServerEventDispatcher(deps) {
     }
     return { baseDb, consumers, eventDispatcher };
 }
-function resolveBaseDbAndSearchAdapter(context, registry) {
+export function resolveBaseDbAndSearchAdapter(context, registry) {
     // @cast-boundary engine-bridge — context.db union narrows to DbConnection here
     const baseDb = context.db;
-    // @cast-boundary engine-bridge — searchAdapter is an optional context-extension
     const searchAdapter = context.searchAdapter;
     // Adapter is built before the registry exists (app boot order) — hand it
     // the registry-derived default config here so it can lazily configure
@@ -145,12 +144,12 @@ function buildMultiStreamProjectionConsumer(msp, deps) {
                 // production. Defensive return for the type-narrowing path.
                 return;
             }
-            // Saga/process-manager ctx: apply can call ctx.appendEvent to cascade
+            // Saga/process-manager ctx: apply can call ctx.events.append to cascade
             // a follow-up event onto another aggregate. Uses the triggering event's
             // tenantId + userId so the causal chain stays tenant-consistent.
             // MSP qualified names are "<feature>:projection:<short>" — the
             // prefix before the first ":" owns the MSP. Used to reject
-            // cross-feature ctx.appendEvent calls at emit-site.
+            // cross-feature ctx.events.append calls at emit-site.
             const mspOwner = msp.name.split(":")[0];
             const mspFiles = fileProviderResolver
                 ? createTenantFileContext(fileProviderResolver, event.tenantId)

package/dist/api/server-extra-routes.d.ts

@@ -1,5 +1,5 @@
+import type { WriteResult } from "@cosmicdrift/kumiko-types/handlers";
 import type { Context, Hono } from "hono";
-import type { WriteResult } from "../engine/types/index.ts";
 import type { Dispatcher } from "../pipeline/dispatcher.ts";
 import { type ExtraRouteDefinition, type RoleDispatchArgs, type SystemDispatchArgs } from "./extra-route.ts";
 import type { ServerWiring } from "./server-wiring.ts";

package/dist/api/server-extra-routes.js

@@ -8,6 +8,7 @@ import { clientIpSourceFromHonoContext } from "./client-ip.js";
 import { ExtraRouteEntries, ExtraRouteRejection, } from "./extra-route.js";
 import { bodyLimitForRoutePath, DEFAULT_MAX_REQUEST_BYTES } from "./route-registrars.js";
 import { isMissingOrAnonymousUser, makeSystemQuery, mountHonoRoute, unauthenticatedResponse, } from "./server-routes.js";
+import { tenantScopedSecrets } from "./tenant-scoped-secrets.js";
 // Only entry:"signature" bypasses jwtGuard (verify() authenticates
 // itself); entry:"anonymous" still needs the anonymousAccess fallthrough
 // (tenant-by-host), entry:"user" needs c.get("user") populated.
@@ -34,14 +35,16 @@ export function mountExtraRoutes(app, wiring) {
         }
         const dispatchSystemWrite = makeDispatchSystemWrite(dispatcher);
         const dispatchSystemQuery = makeDispatchSystemQuery(dispatcher);
+        const dispatchWriteAs = makeDispatchWriteAs(dispatcher);
         for (const route of options.extraRoutes) {
             const honoHandler = buildExtraRouteHonoHandler(route, {
                 app,
                 dispatcher,
                 registry: options.registry,
-                secrets: context.secrets,
+                secrets: context.secrets && tenantScopedSecrets(context.secrets),
                 dispatchSystemWrite,
                 dispatchSystemQuery,
+                dispatchWriteAs,
                 clientIpResolver,
             });
             mountHonoRoute(app, route.method, route.path, honoHandler, bodyLimitForRoutePath(route.path, options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES));
@@ -195,6 +198,7 @@ function buildExtraRouteHonoHandler(route, shared) {
                     systemQuery: makeSystemQuery(c, shared.dispatcher, shared.clientIpResolver),
                     dispatchSystemWrite: shared.dispatchSystemWrite,
                     dispatchSystemQuery: shared.dispatchSystemQuery,
+                    dispatchWriteAs: shared.dispatchWriteAs,
                 });
             };
         default:

package/dist/api/server-middleware.js

@@ -1,3 +1,4 @@
+import { runInSystemRowLevelSecurityScope } from "../db/row-level-security-scope.js";
 import { resolveTenantLifecyclePlugin } from "../pipeline/active-membership.js";
 import { authEndpointRateLimit, globalIpRateLimit } from "../rate-limit/index.js";
 import { authMiddleware, getUser } from "./auth-middleware.js";
@@ -207,5 +208,6 @@ function deriveTenantLifecycleResolver(registry, db) {
             "missing — the request-level teardown gate needs a DbConnection. Pass context.db, or wire " +
             "auth.resolveTenantLifecycleStatus explicitly.");
     }
-    return (tenantId) => plugin.resolveStatus(tenantId, { db });
+    // Runs before any tenant context exists and reads the tenant row itself, so it needs system scope.
+    return (tenantId) => runInSystemRowLevelSecurityScope("tenant lifecycle status is resolved before a tenant scope exists", () => plugin.resolveStatus(tenantId, { db }));
 }

package/dist/api/server-routes.d.ts

@@ -1,5 +1,6 @@
+import type { HttpRouteMethod } from "@cosmicdrift/kumiko-types/http-route";
 import type { Hono, MiddlewareHandler } from "hono";
-import type { HttpRouteMethod, SessionUser, TenantId } from "../engine/types/index.ts";
+import type { SessionUser, TenantId } from "../engine/types/index.ts";
 import type { Dispatcher } from "../pipeline/dispatcher.ts";
 import { type ClientIpResolver } from "./client-ip.ts";
 import type { ServerOptions } from "./server.ts";
@@ -10,7 +11,7 @@ export declare function mountAuthRoutes(app: Hono, wiring: Pick<ServerWiring, "o
 export declare function mountClientErrorRoute(app: Hono, wiring: Pick<ServerWiring, "rateLimitResolver" | "tracedRedis" | "clientIpResolver" | "observability" | "jwt">): void;
 export declare function mountDispatcherRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "sseBroker">): void;
 export declare function mountSchemaRoute(app: Hono, options: Pick<ServerOptions, "registry" | "dispatcherOptions" | "context">): void;
-export declare function mountFileRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "fileProviderResolver">): void;
+export declare function mountFileRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "fileProviderResolver" | "rateLimitResolver" | "tracedRedis">): void;
 export declare function mountFeatureHttpRoutes(app: Hono, wiring: Pick<ServerWiring, "options" | "dispatcher" | "clientIpResolver" | "rateLimitResolver" | "observability">, sessionOnlyHttpRouteGuards: readonly MiddlewareHandler[]): void;
 export declare function installNoRouteMatchMarker(app: Hono): void;
 export declare function mountHonoRoute(app: Hono, method: HttpRouteMethod, path: string, handler: (c: import("hono").Context<any, any>) => Response | Promise<Response>, middlewares?: readonly MiddlewareHandler[]): void;