@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/api/server-routes.js

@@ -14,7 +14,8 @@ import { getUser, identifyOptionalSession } from "./auth-middleware.js";
 import { createAuthRoutes } from "./auth-routes.js";
 import { createClientErrorRoute } from "./client-error-route.js";
 import { clientIpSourceFromHonoContext } from "./client-ip.js";
-import { collectEntityReadAccess } from "./entity-read-access.js";
+import { collectEntityReadAccess, collectEntityRowReadMaps } from "./entity-read-access.js";
+import { createExportRoutes } from "./export/export-route.js";
 import { computeStrongEtag, etagMatches } from "./http-cache.js";
 import { requestContext } from "./request-context.js";
 import { buildRequestContextData } from "./request-id-middleware.js";
@@ -67,9 +68,11 @@ export function mountDispatcherRoutes(app, wiring) {
     app.route("/api", createApiRoutes(dispatcher, {
         ...(options.sseHeartbeatMs !== undefined ? { sseHeartbeatMs: options.sseHeartbeatMs } : {}),
     }));
+    app.route("/api", createExportRoutes(dispatcher, options.registry));
     app.route("/api", createSseRoute(sseBroker, {
         anonymousLiveEntities: collectAnonymousLiveEntities(options.registry),
         entityReadAccess: collectEntityReadAccess(options.registry),
+        entityRowReadMaps: collectEntityRowReadMaps(options.registry),
     }));
 }
 export function mountSchemaRoute(app, options) {
@@ -122,7 +125,9 @@ export function mountSchemaRoute(app, options) {
     });
 }
 export function mountFileRoutes(app, wiring) {
-    const { options, dispatcher, fileProviderResolver } = wiring;
+    const { options, dispatcher, fileProviderResolver, rateLimitResolver, tracedRedis } = wiring;
+    const metaBatchRateLimitResolver = rateLimitResolver ??
+        (tracedRedis ? createRateLimitResolver({ redis: tracedRedis }) : undefined);
     // Mount upload/download routes whenever a file provider is resolvable (a
     // file-provider plugin is mounted, or a resolver was injected). They resolve
     // the provider per-tenant through file-foundation — no `files` option; route
@@ -139,6 +144,7 @@ export function mountFileRoutes(app, wiring) {
             db: fileDb,
             registry: options.registry,
             resolveProvider: fileProviderResolver,
+            ...(metaBatchRateLimitResolver ? { metaBatchRateLimitResolver } : {}),
             canReadRecord,
             canWriteRecord: createRecordWriteCheck({
                 registry: options.registry,

package/dist/api/server-wiring.js

@@ -2,7 +2,9 @@ import { EXT_FILE_PROVIDER } from "../engine/extension-names.js";
 import { assertSeedModeNotInProduction } from "../event-store/seed-clock.js";
 import { makeFileProviderResolver } from "../files/provider-resolver.js";
 import { createFallbackLogger } from "../logging/index.js";
-import { createNoopProvider, registerStandardMetrics, wrapRedisClient, } from "../observability/index.js";
+import { createNoopProvider } from "../observability/index.js";
+import { wrapRedisClient } from "../observability/redis-wrapper.js";
+import { registerStandardMetrics } from "../observability/standard-metrics.js";
 import { configAccessorFactoryOf } from "../pipeline/config-accessor-factory.js";
 import { createDispatcher } from "../pipeline/dispatcher.js";
 import { createLifecycleHooks } from "../pipeline/lifecycle-pipeline.js";
@@ -23,13 +25,15 @@ export function withFileProviderResolver(registry, context, cacheSync) {
         return context;
     if (registry.getExtensionUsages(EXT_FILE_PROVIDER).length === 0)
         return context;
+    const { clock } = context;
     return {
         ...context,
         _fileProviderResolver: makeFileProviderResolver({
             registry,
-            _configAccessorFactory: configAccessorFactoryOf(context),
+            configAccessorFactory: configAccessorFactoryOf(context),
             secrets: context.secrets,
             db: context.db,
+            ...(clock ? { now: () => clock.now() } : {}),
             ...(cacheSync ? { cacheSync } : {}),
         }),
     };
@@ -52,7 +56,7 @@ export function resolveServerWiring(options) {
     // Inject tracer + meter into the AppContext so the dispatcher can propagate
     // them into every HandlerContext it builds. Build the per-tenant file-provider
     // resolver once (when a provider plugin is mounted) — the dispatcher uses it
-    // to materialise `ctx.files`, the upload routes + MSP-applies share it. The
+    // to materialise `ctx.services.files`, the upload routes + MSP-applies share it. The
     // resolver reads config + the s3.secretAccessKey secret under SYSTEM identity.
     const contextWithFiles = withFileProviderResolver(options.registry, options.context, cacheSync);
     const fileProviderResolver = contextWithFiles._fileProviderResolver;
@@ -140,7 +144,7 @@ function resolveServerSseBroker(explicitSseBroker, bootLog) {
 }
 function resolveServerObservability(explicitObservability, registry) {
     // Observability — Noop by default so no call-site needs to null-check.
-    // Every handler/middleware that reaches for ctx.tracer / ctx.metrics gets
+    // Every handler/middleware that reaches for ctx.obs.tracer / ctx.obs.metrics gets
     // a working, zero-cost fallback when no provider is configured.
     const observability = explicitObservability ?? createNoopProvider();
     // Register framework + feature metrics once on this meter. Standard

package/dist/api/server.d.ts

@@ -1,6 +1,7 @@
+import type { RunIn } from "@cosmicdrift/kumiko-types/config";
 import { Hono } from "hono";
 import type { PgListenClient } from "../db/connection.ts";
-import type { AppContext, Registry, RunIn } from "../engine/types/index.ts";
+import type { AppContext, Registry } from "../engine/types/index.ts";
 import type { ErrorDocsConfig } from "../errors/docs-url.ts";
 import type { Lifecycle } from "../lifecycle/index.ts";
 import type { ObservabilityProvider } from "../observability/index.ts";

package/dist/api/sse-route.d.ts

@@ -1,5 +1,6 @@
+import type { AccessRule } from "@cosmicdrift/kumiko-types/handlers";
+import type { OwnershipMap } from "@cosmicdrift/kumiko-types/ownership";
 import { Hono } from "hono";
-import type { AccessRule } from "../engine/types/index.ts";
 import { type SseBroker } from "./sse-broker.ts";
 /**
  * Heartbeat cadence for SSE streams.
@@ -27,6 +28,7 @@ export declare const SSE_MAX_PENDING_WRITES_PER_CLIENT = 10000;
 export type SseRouteOptions = {
     readonly anonymousLiveEntities: ReadonlySet<string>;
     readonly entityReadAccess: ReadonlyMap<string, readonly AccessRule[]>;
+    readonly entityRowReadMaps?: ReadonlyMap<string, OwnershipMap>;
     readonly now?: () => number;
 };
 export declare function createSseRoute(broker: SseBroker, options: SseRouteOptions): Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;

package/dist/api/sse-route.js

@@ -84,7 +84,17 @@ function entitySignalDetail(user, aggregateType, options) {
     const granting = (options.entityReadAccess.get(aggregateType) ?? []).filter((rule) => hasAccess(user, rule));
     if (granting.length === 0)
         return "none";
-    return granting.some((rule) => "roles" in rule) ? "identified" : "anonymous";
+    if (!granting.some((rule) => "roles" in rule))
+        return "anonymous";
+    return readsEveryRow(user, options.entityRowReadMaps?.get(aggregateType))
+        ? "identified"
+        : "anonymous";
+}
+// Mirrors buildOwnershipClause: without a map every row is visible, otherwise only a role mapped to "all" sees them all.
+function readsEveryRow(user, rowReadMap) {
+    if (rowReadMap === undefined)
+        return true;
+    return user.roles.some((role) => rowReadMap[role] === "all");
 }
 function decideWireFrame(event, user, options) {
     const data = event.data;

package/dist/api/tenant-scoped-secrets.d.ts

@@ -0,0 +1,2 @@
+import type { SecretsContext } from "../secrets/index.ts";
+export declare function tenantScopedSecrets(secrets: SecretsContext): SecretsContext;

package/dist/api/tenant-scoped-secrets.js

@@ -0,0 +1,13 @@
+import { runInRowLevelSecurityScope, tenantRowLevelSecurityScope, } from "../db/row-level-security-scope.js";
+// Signature routes run before any tenant scope exists, and plugin code parses unauthenticated bytes,
+// so only the secret accesses themselves open a scope, and only for the tenant the call names.
+export function tenantScopedSecrets(secrets) {
+    const scoped = (tenantId, run) => runInRowLevelSecurityScope(tenantRowLevelSecurityScope(tenantId), run);
+    return {
+        withRunner: (runner) => tenantScopedSecrets(secrets.withRunner(runner)),
+        get: (tenantId, ...rest) => scoped(tenantId, () => secrets.get(tenantId, ...rest)),
+        has: (tenantId, ...rest) => scoped(tenantId, () => secrets.has(tenantId, ...rest)),
+        set: (tenantId, ...rest) => scoped(tenantId, () => secrets.set(tenantId, ...rest)),
+        delete: (tenantId, ...rest) => scoped(tenantId, () => secrets.delete(tenantId, ...rest)),
+    };
+}

package/dist/api/websocket-route.d.ts

@@ -1,7 +1,7 @@
 import { WEBSOCKET_BACKPRESSURE_LIMIT_BYTES, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_ROUTE_PATH_PREFIX, type WebSocketMessageData, type WebSocketSessionHandlers } from "@cosmicdrift/kumiko-types/websocket-route";
 import type { SessionUser } from "../engine/types/index.ts";
 import { type AuthSessionChecker, type TenantLifecycleStatusResolver } from "./auth-middleware.ts";
-import { type RequestContextData } from "./request-context.ts";
+import type { RequestContextData } from "./request-context-internals.ts";
 export { WEBSOCKET_BACKPRESSURE_LIMIT_BYTES, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_ROUTE_PATH_PREFIX, };
 export declare const WEBSOCKET_HEARTBEAT_INTERVAL_MS = 25000;
 export declare const WEBSOCKET_PENDING_BUFFER_LIMIT_BYTES: number;

package/dist/auth/index.d.ts

@@ -1,2 +1 @@
-export type { Role } from "./roles.ts";
 export { ROLES } from "./roles.ts";

package/dist/auth/roles.d.ts

@@ -9,8 +9,3 @@ export declare const ROLES: {
     readonly SystemAdmin: "SystemAdmin";
     readonly Member: "Member";
 };
-/**
- * Union of all known role names for compile-time checks of
- * handler access rules and ownership maps.
- */
-export type Role = (typeof ROLES)[keyof typeof ROLES];

package/dist/compliance/duration-spec.d.ts

@@ -3,6 +3,5 @@ import type { DurationSpec, RetentionSpec } from "./profiles.ts";
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 export declare function durationSpecToMs(spec: DurationSpec): number;
 export declare function addDurationSpec(now: Instant, spec: DurationSpec): Instant;
-export declare function describeDurationSpec(spec: DurationSpec): string;
 export declare function subtractRetentionSpec(now: Instant, spec: RetentionSpec): Instant;
 export {};

package/dist/compliance/duration-spec.js

@@ -28,11 +28,6 @@ export function addDurationSpec(now, spec) {
 }
 // Human-readable descriptions for logs and error messages. Not localized;
 // operator output is English-only.
-export function describeDurationSpec(spec) {
-    if ("days" in spec)
-        return `${spec.days} day${spec.days === 1 ? "" : "s"}`;
-    return `${spec.hours} hour${spec.hours === 1 ? "" : "s"}`;
-}
 // Calendar-aware cutoff: months/years are subtracted on a UTC calendar so
 // "24 months" is not approximated as 730 fixed days (leap years, month ends).
 export function subtractRetentionSpec(now, spec) {

package/dist/compliance/index.d.ts

@@ -1,6 +1,6 @@
-export { addDurationSpec, describeDurationSpec, durationSpecToMs, subtractRetentionSpec, } from "./duration-spec.ts";
+export { addDurationSpec, subtractRetentionSpec, } from "./duration-spec.ts";
 export { complianceProfileOverrideSchema } from "./override-schema.ts";
-export type { AuthorityNotificationDeadline, ComplianceProfile, ComplianceProfileKey, ComplianceProfileOverride, DurationSpec, EffectiveComplianceProfile, RetentionSpec, UserNotificationRequiredPolicy, } from "./profiles.ts";
-export { COMPLIANCE_PROFILES, OVERRIDABLE_PROFILE_KEYS, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.ts";
-export type { BundleTier, SubProcessor } from "./sub-processors.ts";
+export type { ComplianceProfile, ComplianceProfileKey, ComplianceProfileOverride, DurationSpec, EffectiveComplianceProfile, } from "./profiles.ts";
+export { COMPLIANCE_PROFILES, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.ts";
+export type { SubProcessor } from "./sub-processors.ts";
 export { getActiveSubProcessors, getPlannedSubProcessors, KUMIKO_SUB_PROCESSORS, } from "./sub-processors.ts";

package/dist/compliance/index.js

@@ -1,6 +1,6 @@
 // `@cosmicdrift/kumiko-framework/compliance` — Data protection and compliance foundation.
 // Used by compliance-profiles, data-retention, user-data-rights, and related features.
-export { addDurationSpec, describeDurationSpec, durationSpecToMs, subtractRetentionSpec, } from "./duration-spec.js";
+export { addDurationSpec, subtractRetentionSpec, } from "./duration-spec.js";
 export { complianceProfileOverrideSchema } from "./override-schema.js";
-export { COMPLIANCE_PROFILES, OVERRIDABLE_PROFILE_KEYS, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.js";
+export { COMPLIANCE_PROFILES, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.js";
 export { getActiveSubProcessors, getPlannedSubProcessors, KUMIKO_SUB_PROCESSORS, } from "./sub-processors.js";

package/dist/compliance/profiles.d.ts

@@ -70,21 +70,6 @@ export interface ComplianceProfile {
  * tenants must select an actual profile.
  */
 export declare const SELECTABLE_PROFILE_KEYS: readonly ["eu-dsgvo", "swiss-dsg", "de-hr-dsgvo-hgb"];
-/**
- * Top-level `ComplianceProfile` properties that a tenant override may modify.
- * Identity fields (key, region, label, extends) are excluded because
- * overriding them would destroy the profile's identity.
- *
- * This is the single source of truth for:
- *   - the set-profile handler whitelist, which rejects typos
- *   - the snapshot test that guards against drift from the profile's top level
- *
- * When a new top-level property is added to `ComplianceProfile` (for example,
- * `dataSubjectRights` or `crossBorderTransferRules`), it must be added here;
- * otherwise set-profile rejects valid overrides. The snapshot test in
- * profiles.test.ts detects drift in either direction.
- */
-export declare const OVERRIDABLE_PROFILE_KEYS: ReadonlySet<string>;
 type DeepReadonly<T> = T extends object ? {
     readonly [K in keyof T]: DeepReadonly<T[K]>;
 } : T;

package/dist/compliance/profiles.js

@@ -164,29 +164,6 @@ export const SELECTABLE_PROFILE_KEYS = [
     "swiss-dsg",
     "de-hr-dsgvo-hgb",
 ];
-/**
- * Top-level `ComplianceProfile` properties that a tenant override may modify.
- * Identity fields (key, region, label, extends) are excluded because
- * overriding them would destroy the profile's identity.
- *
- * This is the single source of truth for:
- *   - the set-profile handler whitelist, which rejects typos
- *   - the snapshot test that guards against drift from the profile's top level
- *
- * When a new top-level property is added to `ComplianceProfile` (for example,
- * `dataSubjectRights` or `crossBorderTransferRules`), it must be added here;
- * otherwise set-profile rejects valid overrides. The snapshot test in
- * profiles.test.ts detects drift in either direction.
- */
-export const OVERRIDABLE_PROFILE_KEYS = new Set([
-    "userRights",
-    "notifications",
-    "breach",
-    "auditLog",
-    "subProcessor",
-    "tenantDestroyGracePeriod",
-    "forgetDiscovery",
-]);
 // These paths are replaced as atomic values rather than merged recursively.
 // This is required for discriminated unions, where a patch may provide a
 // sibling property instead of an override; for example, changing retention

package/dist/config/index.d.ts

@@ -1,5 +1,8 @@
+import type { BundledListsOptions } from "@cosmicdrift/kumiko-types/screen";
+import { type RowLevelSecurityMode } from "../db/render-rls-ddl.ts";
 import type { ValidateBootOptions } from "../engine/boot-validator.ts";
 import type { FeatureDefinition } from "../engine/types/index.ts";
+import type { AppClientConfig, AppPortEntry } from "./internals.ts";
 export type AppInfraPorts = {
     readonly postgres?: number;
     readonly redis?: number;
@@ -16,10 +19,6 @@ export type AppPorts = {
      *  of several apps never share a Meilisearch or Postgres. */
     readonly infra?: AppInfraPorts;
 };
-export type AppClientConfig = {
-    /** Client bundle entry files, relative to the app root (e.g. "src/client.tsx"). */
-    readonly entries: readonly string[];
-};
 /** The boot-validator options an app owns; `env` and the cipher are injected by the runners. */
 export type AppValidateBootOptions = Pick<ValidateBootOptions, "navAllowlist" | "navAllowlistExempt" | "requiredLocales" | "warnOnUniqueAccessRoles">;
 export type AppConfig = {
@@ -35,19 +34,22 @@ export type AppConfig = {
     readonly ports: AppPorts;
     /** Passed to validateBoot by `kumiko check` and, via the app's bin files, by the runners. */
     readonly validateBootOptions?: AppValidateBootOptions;
+    /** One table block for every list of the bundled features. kumiko/schema.ts passes it to composeFeatures; the app's bin files pass it to the runners, like validateBootOptions. */
+    readonly bundledLists?: BundledListsOptions;
+    /** "on" enforces tenant isolation in Postgres via row level security; schema tooling and every runner read this one value. Default "on". */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
 };
 export declare const APP_CONFIG_FILE = "kumiko.config.ts";
 declare const INFRA_PORT_NAMES: readonly ["postgres", "redis", "meilisearch", "s3"];
 export type AppPortRole = "dev" | "e2e" | (typeof INFRA_PORT_NAMES)[number];
-export type AppPortEntry = {
-    readonly role: AppPortRole;
-    readonly port: number;
-};
 /** Every port the app claims, in a stable order. */
 export declare function listAppPorts(ports: AppPorts): readonly AppPortEntry[];
 /** Problems with the declared ports: out of range or claimed twice by this app. */
 export declare function findAppPortProblems(ports: AppPorts): readonly string[];
 export declare function defineAppConfig(config: AppConfig): AppConfig;
-/** The full feature list prod boots with: `features` plus `prodFeatures`. */
+/**
+ * Raw `features` plus `prodFeatures`, without the bundled foundation: the runners compose it,
+ * tooling such as `runSchemaCli` takes `FEATURES` from `kumiko/schema`.
+ */
 export declare function allAppFeatures(config: Pick<AppConfig, "features" | "prodFeatures">): readonly FeatureDefinition[];
 export {};

package/dist/config/index.js

@@ -1,3 +1,8 @@
+// The app's single config file (kumiko.config.ts). Type-only imports keep it
+// loadable by tooling (kumiko check, agent lint, port registry) without
+// pulling the engine runtime.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { ROW_LEVEL_SECURITY_MODES } from "../db/render-rls-ddl.js";
 export const APP_CONFIG_FILE = "kumiko.config.ts";
 const INFRA_PORT_NAMES = [
     "postgres",
@@ -50,12 +55,19 @@ export function defineAppConfig(config) {
             problems.push(`client.entries: "${entry}" must be a relative .ts/.tsx path inside the app`);
         }
     }
+    if (config.rowLevelSecurity !== undefined &&
+        !isOneOf(ROW_LEVEL_SECURITY_MODES, config.rowLevelSecurity)) {
+        problems.push(`rowLevelSecurity must be one of ${ROW_LEVEL_SECURITY_MODES.join(", ")}, got ${String(config.rowLevelSecurity)}`);
+    }
     if (problems.length > 0) {
         throw new Error(`defineAppConfig: ${problems.join("; ")}`);
     }
     return config;
 }
-/** The full feature list prod boots with: `features` plus `prodFeatures`. */
+/**
+ * Raw `features` plus `prodFeatures`, without the bundled foundation: the runners compose it,
+ * tooling such as `runSchemaCli` takes `FEATURES` from `kumiko/schema`.
+ */
 export function allAppFeatures(config) {
     return [...config.features, ...(config.prodFeatures ?? [])];
 }

package/dist/config/internals.d.ts

@@ -0,0 +1,9 @@
+import type { AppPortRole } from "./index.ts";
+export type AppClientConfig = {
+    /** Client bundle entry files, relative to the app root (e.g. "src/client.tsx"). */
+    readonly entries: readonly string[];
+};
+export type AppPortEntry = {
+    readonly role: AppPortRole;
+    readonly port: number;
+};

package/dist/config/internals.js

@@ -0,0 +1 @@
+export {};

package/dist/consumer-cli-internals.d.ts

@@ -0,0 +1,4 @@
+export type ConsumerCliOut = {
+    readonly log: (line: string) => void;
+    readonly err: (line: string) => void;
+};

package/dist/consumer-cli-internals.js

@@ -0,0 +1 @@
+export {};

package/dist/consumer-cli.d.ts

@@ -1,5 +1,2 @@
-export type ConsumerCliOut = {
-    readonly log: (line: string) => void;
-    readonly err: (line: string) => void;
-};
+import type { ConsumerCliOut } from "./consumer-cli-internals.ts";
 export declare function runConsumerCli(argv: readonly string[], out: ConsumerCliOut): Promise<number>;

package/dist/consumer-cli.js

@@ -79,7 +79,11 @@ export async function runConsumerCli(argv, out) {
         out.err("  DATABASE_URL not set.");
         return 1;
     }
-    const { db, close } = createDbConnection({ url: dbUrl, ...dbConnectionOptionsFromEnv() });
+    const { db, close } = createDbConnection({
+        url: dbUrl,
+        rowLevelSecurity: "off", // consumer state tables carry no tenant_id
+        ...dbConnectionOptionsFromEnv(),
+    });
     try {
         if (sub === "status") {
             const state = await getConsumerState(db, name, instanceId);

package/dist/crypto/event-pii.js

@@ -1,5 +1,5 @@
 // PII on custom-event payloads. Entity CRUD events get their PII
-// encrypted by the executor; events written via ctx.appendEvent / MSP-apply /
+// encrypted by the executor; events written via ctx.events.append / MSP-apply /
 // low-level append() (delivery attempt-log, jobs run-logger) had no encrypt
 // path at all. `r.defineEvent(name, schema, { piiFields })` declares which
 // payload fields are PII and which payload field names the owning user;

package/dist/crypto/index.d.ts

@@ -1,11 +1,10 @@
-export { blindIndexFieldName, collectLookupableFields, computeBlindIndex, computeBlindIndexValues, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.ts";
-export { configuredEventPiiCatalog, configureEventPiiCatalog, type EventPiiCatalog, encryptEventPayloadPii, } from "./event-pii.ts";
+export { collectLookupableFields, computeBlindIndex, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.ts";
+export { configuredEventPiiCatalog } from "./event-pii.ts";
 export { InMemoryKmsAdapter } from "./in-memory-kms-adapter.ts";
 export { isSelfPiiField } from "./is-self-pii-field.ts";
-export { type KekSourceEnv, type KekSourceOptions, resolvePlatformKeks } from "./kek-source.ts";
-export { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, type KmsAdapter, type KmsContext, type KmsHealth, type LocalKeyKmsAdapter, RECORD_ENTITY_PATTERN, type RemoteCryptoKmsAdapter, type SubjectDek, type SubjectId, type SubjectKey, subjectIdFromKey, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForTenant, subjectKeyForUser, } from "./kms-adapter.ts";
-export { type ActiveKmsWiring, buildPgKmsOptions, type KmsWiring, type KmsWiringEnv, type KmsWiringOptions, type KmsWiringRelease, type PgKmsRotationEnv, type PlaintextPiiWiring, requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.ts";
-export { createPgKmsAdapter, PgKmsAdapter, type PgKmsAdapterOptions, type RewrapOptions, type RewrapResult, rewrapSubjectKeys, } from "./pg-kms-adapter.ts";
-export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, type EncryptPiiOptions, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL, } from "./pii-field-encryption.ts";
-export { createRequestKmsCache, type RequestKmsCache, } from "./request-kms-cache.ts";
-export { collectPiiEncryptedFields, collectPiiSubjectFields, collectSearchableSubjectFields, isRecordKeyedField, type ResolveSubjectOptions, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.ts";
+export { resolvePlatformKeks } from "./kek-source.ts";
+export { KeyAlreadyExistsError, KeyErasedError, type KmsAdapter, type KmsContext, type LocalKeyKmsAdapter, type SubjectId, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForUser, } from "./kms-adapter.ts";
+export { type KmsWiring, requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.ts";
+export { createPgKmsAdapter, rewrapSubjectKeys, } from "./pg-kms-adapter.ts";
+export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_ERASED_SENTINEL, } from "./pii-field-encryption.ts";
+export { collectPiiEncryptedFields, collectPiiSubjectFields, isRecordKeyedField, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.ts";

package/dist/crypto/index.js

@@ -1,11 +1,10 @@
-export { blindIndexFieldName, collectLookupableFields, computeBlindIndex, computeBlindIndexValues, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.js";
-export { configuredEventPiiCatalog, configureEventPiiCatalog, encryptEventPayloadPii, } from "./event-pii.js";
+export { collectLookupableFields, computeBlindIndex, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.js";
+export { configuredEventPiiCatalog } from "./event-pii.js";
 export { InMemoryKmsAdapter } from "./in-memory-kms-adapter.js";
 export { isSelfPiiField } from "./is-self-pii-field.js";
 export { resolvePlatformKeks } from "./kek-source.js";
-export { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, RECORD_ENTITY_PATTERN, subjectIdFromKey, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForTenant, subjectKeyForUser, } from "./kms-adapter.js";
-export { buildPgKmsOptions, requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.js";
-export { createPgKmsAdapter, PgKmsAdapter, rewrapSubjectKeys, } from "./pg-kms-adapter.js";
-export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
-export { createRequestKmsCache, } from "./request-kms-cache.js";
-export { collectPiiEncryptedFields, collectPiiSubjectFields, collectSearchableSubjectFields, isRecordKeyedField, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";
+export { KeyAlreadyExistsError, KeyErasedError, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForUser, } from "./kms-adapter.js";
+export { requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.js";
+export { createPgKmsAdapter, rewrapSubjectKeys, } from "./pg-kms-adapter.js";
+export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
+export { collectPiiEncryptedFields, collectPiiSubjectFields, isRecordKeyedField, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";

package/dist/crypto/pg-kms-adapter.d.ts

@@ -17,6 +17,7 @@ export declare class PgKmsAdapter implements LocalKeyKmsAdapter {
     readonly capabilities: {
         readonly mode: "local-key";
     };
+    private readonly connection;
     private readonly sql;
     private readonly kek;
     private readonly kekVersion;

package/dist/crypto/pg-kms-adapter.js

@@ -1,6 +1,6 @@
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import postgres from "postgres";
-import { DEFAULT_DB_CLOSE_TIMEOUT_SECONDS } from "../db/connection.js";
+import { createDbConnection } from "../db/connection.js";
+import { isUniqueViolation } from "../db/pg-error.js";
 import { KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, subjectIdToKey, } from "./kms-adapter.js";
 const IV_LENGTH = 12;
 const TAG_LENGTH = 16;
@@ -28,21 +28,15 @@ function decodePlatformKek(base64) {
     }
     return kek;
 }
-const PG_UNIQUE_VIOLATION = "23505";
 // pg_advisory_xact_lock key for createSchema — serializes concurrent cold-start
 // DDL across processes sharing one subject-keys DB.
 const SCHEMA_ADVISORY_LOCK_KEY = 0x6b_6d_73_31; // 'kms1'
-function isPgUniqueViolation(error) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        error.code === PG_UNIQUE_VIOLATION);
-}
 // Default production adapter: DEKs live in a separate Postgres cluster,
 // KEK-wrapped at rest. Schema is created lazily on first use — the
 // subject-keys cluster has no drizzle migration pipeline of its own.
 export class PgKmsAdapter {
     capabilities = { mode: "local-key" };
+    connection;
     sql;
     kek;
     kekVersion;
@@ -60,12 +54,12 @@ export class PgKmsAdapter {
             previous.set(v, decodePlatformKek(kek));
         }
         this.previousKeks = previous;
-        this.sql = postgres(options.databaseUrl, {
-            max: options.maxConnections ?? 4,
-            // The connection is exclusive to this adapter and its only DDL is
-            // idempotent IF NOT EXISTS — notices are pure boot-log noise.
-            onnotice: () => { },
+        this.connection = createDbConnection({
+            url: options.databaseUrl,
+            maxConnections: options.maxConnections ?? 4,
+            rowLevelSecurity: "off", // key tables carry no tenant_id
         });
+        this.sql = this.connection.client;
     }
     async createKey(subject, ctx) {
         await this.ensureSchema();
@@ -76,7 +70,7 @@ export class PgKmsAdapter {
         VALUES (${subjectIdToKey(subject)}, ${wrapped}, ${this.kekVersion}, ${ctx.userId ?? null})`;
         }
         catch (error) {
-            if (isPgUniqueViolation(error))
+            if (isUniqueViolation(error))
                 throw new KeyAlreadyExistsError(subject);
             throw error;
         }
@@ -128,7 +122,7 @@ export class PgKmsAdapter {
         return { ok: true, latencyMs: Date.now() - start };
     }
     async close() {
-        await this.sql.end({ timeout: DEFAULT_DB_CLOSE_TIMEOUT_SECONDS });
+        await this.connection.close();
     }
     ensureSchema() {
         // A failed attempt resets the memo so a transient DB outage does not
@@ -178,7 +172,12 @@ export async function rewrapSubjectKeys(options) {
         fromKeks.set(Number(version), decodePlatformKek(kek));
     }
     const batchSize = options.batchSize ?? 200;
-    const sql = postgres(options.databaseUrl, { max: 2, onnotice: () => { } });
+    const connection = createDbConnection({
+        url: options.databaseUrl,
+        maxConnections: 2,
+        rowLevelSecurity: "off", // key tables carry no tenant_id
+    });
+    const sql = connection.client;
     const failures = [];
     const result = { scanned: 0, rewrapped: 0, skippedErased: 0, failures };
     try {
@@ -226,7 +225,7 @@ export async function rewrapSubjectKeys(options) {
         }
     }
     finally {
-        await sql.end();
+        await connection.close();
     }
     return result;
 }

package/dist/db/aggregate-sql.d.ts

@@ -12,6 +12,8 @@ export declare function isListAggregateMeasureSupported(kind: ListAggregateMeasu
 export declare function isListAggregateGroupable(fieldType: FieldType, multiple: boolean): boolean;
 export declare function listAggregateKeySql(fieldType: FieldType, columnSql: string, alias: string): string;
 export declare function listAggregateMeasureSql(kind: ListAggregateMeasureKind, fieldType: FieldType, columnSql: string, filterSql?: string): string;
+export declare function isPerCurrencyMeasure(kind: ListAggregateMeasureKind, fieldType: FieldType): boolean;
+export declare function listCurrencyMeasureSql(kind: ListAggregateMeasureKind, columnSql: string, filterSql: string): string;
 export declare function groupedKeyOrderLimitSql(limit: number): string;
 export declare function decodeListAggregateValue(raw: unknown): ListAggregateValue;
 export declare function emptyListAggregateValue(kind: ListAggregateMeasureKind): ListAggregateValue;

package/dist/db/aggregate-sql.js

@@ -95,6 +95,16 @@ export function listAggregateMeasureSql(kind, fieldType, columnSql, filterSql) {
         return `ROUND(${fn})::float8`;
     return `(${fn})::float8`;
 }
+export function isPerCurrencyMeasure(kind, fieldType) {
+    return fieldType === "money" && kind !== "count";
+}
+// No COALESCE on SUM: a currency absent from a group must read NULL so it can be left out.
+export function listCurrencyMeasureSql(kind, columnSql, filterSql) {
+    const fn = kind === "sum"
+        ? `SUM(${columnSql}) FILTER (WHERE ${filterSql})`
+        : aggregateFunctionSql(kind, columnSql, filterSql);
+    return kind === "avg" ? `ROUND(${fn})::float8` : `(${fn})::float8`;
+}
 export function groupedKeyOrderLimitSql(limit) {
     return ` GROUP BY 1 ORDER BY 1 ASC NULLS LAST LIMIT ${limit}`;
 }

package/dist/db/apply-entity-event.d.ts

@@ -1,5 +1,5 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { ExecutorManagedRunner } from "@cosmicdrift/kumiko-types/executor-brand";
-import type { EntityDefinition } from "../engine/types/index.ts";
 import type { StoredEvent } from "../event-store/index.ts";
 import type { DbRow } from "./connection.ts";
 import type { TableColumns } from "./dialect.ts";