@cosmicdrift/kumiko-framework 0.389.0 → 0.390.0

package/dist/engine/boot-validator/nav.js

@@ -1,9 +1,9 @@
 // Nav validation + collectKnownRoles (role synthesis for ownership
 // validation in index.ts — thematically adjacent to ownership.ts, kept
 // here since this is a structural move, not a semantic reorg).
+import { isOpenToAllGranted } from "@cosmicdrift/kumiko-types/handlers";
 import { createFallbackLogger } from "../../logging/utils.js";
 import { qualifyEntityName } from "../qualified-name.js";
-import { isOpenToAllGranted } from "../types/index.js";
 const log = createFallbackLogger("kumiko:boot");
 export function collectWriteHandlerQns(features) {
     const set = new Set();

package/dist/engine/boot-validator/ownership.d.ts

@@ -1,5 +1,6 @@
+import type { ClaimKeyDefinition } from "@cosmicdrift/kumiko-types/handlers";
 import { type OwnershipMap, type WhereRule } from "../ownership.ts";
-import type { ClaimKeyDefinition, FeatureDefinition } from "../types/index.ts";
+import type { FeatureDefinition } from "../types/index.ts";
 export type WhereRuleProbe = {
     readonly table: unknown;
     readonly tableName: string;

package/dist/engine/boot-validator/parent-ref.d.ts

@@ -1,3 +1,4 @@
-import type { EntityDefinition, FeatureDefinition } from "../types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function findEntity(featureMap: ReadonlyMap<string, FeatureDefinition>, entityName: string): EntityDefinition | undefined;
 export declare function validateParentRefs(feature: FeatureDefinition, featureMap: ReadonlyMap<string, FeatureDefinition>): void;

package/dist/engine/boot-validator/projection-list-screens.d.ts

@@ -1,4 +1,5 @@
-import type { FeatureDefinition, QueryHandlerDef } from "../types/index.ts";
+import type { QueryHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function buildQueryHandlerMap(features: readonly FeatureDefinition[]): ReadonlyMap<string, QueryHandlerDef>;
 export declare function validateProjectionListScreens(features: readonly FeatureDefinition[]): void;
 export declare function validateRelatedListSectionQueries(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/query-refs.d.ts

@@ -1,3 +1,4 @@
-import type { FeatureDefinition, QueryHandlerDef } from "../types/index.ts";
+import type { QueryHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function checkQueryRef(queryHandlers: ReadonlyMap<string, QueryHandlerDef>, query: string, buildPrefix: () => string): void;
 export declare function validateQueryRefs(features: readonly FeatureDefinition[]): void;

package/dist/engine/boot-validator/screens-forms.d.ts

@@ -1,5 +1,6 @@
+import type { EntityDefinition, FieldDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { FieldsOrGroupsSection } from "../screen-helpers.ts";
-import type { EntityDefinition, FeatureDefinition, FieldDefinition } from "../types/index.ts";
+import type { FeatureDefinition } from "../types/index.ts";
 import type { ActionFormScreenDefinition, ConfigEditScreenDefinition, EditFieldSpec, EditLayout, SecretMintScreenDefinition } from "../types/screen.ts";
 import type { NavigateTargetLookups } from "./screens-actions.ts";
 export declare function validateEditFieldExtras(featureName: string, screenId: string, entityDef: EntityDefinition, fieldSpec: Exclude<EditFieldSpec, string>): void;

package/dist/engine/boot-validator/screens-kind-shared.d.ts

@@ -1,5 +1,7 @@
+import type { ConfigKeyDefinition } from "@cosmicdrift/kumiko-types/config";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { type normalizeListColumn } from "../screen-helpers.ts";
-import type { ConfigKeyDefinition, EntityDefinition, FeatureDefinition } from "../types/index.ts";
+import type { FeatureDefinition } from "../types/index.ts";
 import type { EditExtensionSection, EditFieldsSection, EditSectionSpec, RowAction } from "../types/screen.ts";
 import type { NavigateSourceScreenType, NavigateTargetLookups } from "./screens-actions.ts";
 import { type resolveRowActionNavigateTarget } from "./screens-actions.ts";

package/dist/engine/boot-validator/screens.d.ts

@@ -1,4 +1,5 @@
-import type { ConfigKeyDefinition, FeatureDefinition } from "../types/index.ts";
+import type { ConfigKeyDefinition } from "@cosmicdrift/kumiko-types/config";
+import type { FeatureDefinition } from "../types/index.ts";
 import type { ScreenDefinition } from "../types/screen.ts";
 export { readsNavigateParamsAsFormPrefill, resolveScreenTargetQn, rowFieldExtractorKeys, validateActionFieldRefs, validateActionHasIcon, validateDrawerPrefillKeys, validateScreenShortIdCollisions, } from "./screens-actions.ts";
 export { validateDashboardCustomPanel, validateDashboardScreenPanel } from "./screens-dashboard.ts";

package/dist/engine/boot-validator/workspaces.d.ts

@@ -1,4 +1,6 @@
-import type { FeatureDefinition, NavDefinition, WorkspaceDefinition } from "../types/index.ts";
+import type { NavDefinition } from "@cosmicdrift/kumiko-types/nav";
+import type { WorkspaceDefinition } from "@cosmicdrift/kumiko-types/workspace";
+import type { FeatureDefinition } from "../types/index.ts";
 export declare function collectWorkspaceQns(features: readonly FeatureDefinition[]): Map<string, WorkspaceDefinition & {
     readonly featureName: string;
 }>;

package/dist/engine/bridge-stub.d.ts

@@ -1,4 +1,7 @@
-import type { HandlerContext, SessionUser } from "./types/index.ts";
+import type { ContextServices, HandlerContext, HandlerDispatch, HandlerObservability, SessionUser } from "./types/index.ts";
 export declare function bridgeStub(opts?: {
     readonly user?: SessionUser;
-}): Pick<HandlerContext, "query" | "queryAs" | "write" | "writeAs" | "appendEvent" | "unsafeAppendEvent" | "tryAppendEvent" | "fetchForWriting" | "loadAggregate" | "archiveStream" | "restoreStream" | "isStreamArchived" | "snapshotAggregate" | "loadAggregateWithSnapshot" | "queryProjection" | "resolveAuthClaims" | "resolveActiveMembership" | "queryAsMember" | "hasFeature" | "metrics" | "metricsFor" | "tracer" | "tz" | "locale" | "user">;
+    readonly log?: HandlerObservability["log"];
+    readonly dispatch?: Partial<HandlerDispatch>;
+    readonly services?: Partial<ContextServices>;
+}): Pick<HandlerContext, "dispatch" | "events" | "auth" | "obs" | "hasFeature" | "tz" | "locale" | "user" | "services" | "lifecycle" | "tenants">;

package/dist/engine/bridge-stub.js

@@ -1,5 +1,7 @@
 import { DEFAULT_LOCALE } from "../i18n/request-locale.js";
-import { createNoopMetricsHandle, getFallbackTracer } from "../observability/index.js";
+import { createFallbackFullLogger } from "../logging/utils.js";
+import { getFallbackTracer } from "../observability/fallback.js";
+import { createNoopMetricsHandle } from "../observability/index.js";
 import { createTzContext } from "../time/index.js";
 import { createAnonymousUser } from "./system-user.js";
 // Test/service helper: cross-feature bridge methods that throw on use.
@@ -7,7 +9,7 @@ import { createAnonymousUser } from "./system-user.js";
 // Production code always receives a full HandlerContext from the Dispatcher's
 // buildHandlerContext (with real query/write closures). Some internal services
 // and tests construct a mini-context manually (typically just `{ db, registry }`)
-// to invoke a single handler. Those call sites don't use ctx.query/write —
+// to invoke a single handler. Those call sites don't use ctx.dispatch.query/write —
 // the stubs make the TypeScript shape match while still failing loudly if
 // anything downstream accidentally reaches for them.
 //
@@ -15,7 +17,7 @@ import { createAnonymousUser } from "./system-user.js";
 const notAvailable = (what) => async (..._args) => {
     throw new Error(`ctx.${what} not available in this context — use the dispatcher, not a stubbed handler context`);
 };
-// Noop observability — hand back the shared fallback tracer so ctx.tracer has
+// Noop observability — hand back the shared fallback tracer so ctx.obs.tracer has
 // a valid Tracer shape. No allocations per call.
 const noopTracer = getFallbackTracer();
 export function bridgeStub(opts) {
@@ -27,35 +29,48 @@ export function bridgeStub(opts) {
     const stubUser = opts?.user ?? createAnonymousUser("00000000-0000-0000-0000-000000000000");
     return {
         user: stubUser,
-        query: notAvailable("query"),
-        queryAs: notAvailable("queryAs"),
-        write: notAvailable("write"),
-        writeAs: notAvailable("writeAs"),
-        appendEvent: notAvailable("appendEvent"),
-        unsafeAppendEvent: notAvailable("unsafeAppendEvent"),
-        tryAppendEvent: notAvailable("tryAppendEvent"),
-        fetchForWriting: notAvailable("fetchForWriting"),
-        loadAggregate: notAvailable("loadAggregate"),
-        archiveStream: notAvailable("archiveStream"),
-        restoreStream: notAvailable("restoreStream"),
-        isStreamArchived: notAvailable("isStreamArchived"),
-        snapshotAggregate: notAvailable("snapshotAggregate"),
-        loadAggregateWithSnapshot: notAvailable("loadAggregateWithSnapshot"),
-        queryProjection: notAvailable("queryProjection"),
-        resolveAuthClaims: notAvailable("resolveAuthClaims"),
-        resolveActiveMembership: notAvailable("resolveActiveMembership"),
-        queryAsMember: notAvailable("queryAsMember"),
+        dispatch: {
+            query: notAvailable("dispatch.query"),
+            queryAs: notAvailable("dispatch.queryAs"),
+            write: notAvailable("dispatch.write"),
+            writeAs: notAvailable("dispatch.writeAs"),
+            queryAsMember: notAvailable("dispatch.queryAsMember"),
+            queryProjection: notAvailable("dispatch.queryProjection"),
+            ...opts?.dispatch,
+        },
+        events: {
+            append: notAvailable("events.append"),
+            unsafeAppend: notAvailable("events.unsafeAppend"),
+            tryAppend: notAvailable("events.tryAppend"),
+            fetchForWriting: notAvailable("events.fetchForWriting"),
+            load: notAvailable("events.load"),
+            archive: notAvailable("events.archive"),
+            restore: notAvailable("events.restore"),
+            isArchived: notAvailable("events.isArchived"),
+            snapshot: notAvailable("events.snapshot"),
+            loadWithSnapshot: notAvailable("events.loadWithSnapshot"),
+        },
+        auth: {
+            resolveClaims: notAvailable("auth.resolveClaims"),
+            resolveActiveMembership: notAvailable("auth.resolveActiveMembership"),
+        },
         // Stub defaults to always-enabled — matches the dispatcher's behaviour
         // when no effectiveFeatures resolver is wired (tests without toggles).
         hasFeature: async () => true,
-        metrics: createNoopMetricsHandle(),
-        metricsFor: () => createNoopMetricsHandle(),
-        tracer: noopTracer,
+        obs: {
+            log: opts?.log ?? createFallbackFullLogger("bridge-stub"),
+            tracer: noopTracer,
+            metrics: createNoopMetricsHandle(),
+            metricsFor: () => createNoopMetricsHandle(),
+        },
         // Real TzContext, not notAvailable — test code uses ctx.tz routinely,
         // it isn't a "bridge" concept. Defaults to UTC.
         tz: createTzContext(),
         // Same reasoning as tz above — ctx.locale is always-present, not a
         // bridge method. Defaults to DEFAULT_LOCALE.
         locale: DEFAULT_LOCALE,
+        services: { extensions: {}, ...opts?.services },
+        lifecycle: {},
+        tenants: {},
     };
 }

package/dist/engine/config-helpers.d.ts

@@ -1,4 +1,5 @@
-import type { ConfigBacking, ConfigBounds, ConfigComputedFn, ConfigKeyDefinition, ConfigKeyType, ConfigMask, ConfigSeedDef, ConfigValidateFn, ConfigValue, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, OptionsQueryPayload } from "./types/index.ts";
+import type { ConfigBacking, ConfigBounds, ConfigComputedFn, ConfigKeyDefinition, ConfigKeyType, ConfigMask, ConfigSeedDef, ConfigValidateFn, ConfigValue, CreateSeedOptions, CreateTenantSeedOptions } from "@cosmicdrift/kumiko-types/config";
+import type { OptionsQueryPayload } from "@cosmicdrift/kumiko-types/fields";
 export declare function isEncryptedAtRest(def: Pick<ConfigKeyDefinition, "encrypted" | "backing">): boolean;
 export declare const access: {
     readonly all: readonly string[];
@@ -41,5 +42,4 @@ export declare function createUserConfig<T extends ConfigKeyType>(type: T, opts?
 export declare function createSeed(opts: CreateSeedOptions): ConfigSeedDef;
 export declare function createSystemSeed(opts: CreateSeedOptions): ConfigSeedDef;
 export declare function createTenantSeed(opts: CreateSeedOptions, options?: CreateTenantSeedOptions): ConfigSeedDef;
-export declare function createUserSeed(opts: CreateSeedOptions, options: CreateUserSeedOptions): ConfigSeedDef;
 export {};

package/dist/engine/config-helpers.js

@@ -114,12 +114,3 @@ export function createTenantSeed(opts, options) {
 // User-scope seed. Both tenantId AND userId are required — the resolver
 // matches against the user's actual tenantId, so a seed under
 // SYSTEM_TENANT_ID would never resolve.
-export function createUserSeed(opts, options) {
-    return {
-        value: opts.value,
-        scope: "user",
-        key: "",
-        tenantId: options.tenantId,
-        userId: options.userId,
-    };
-}

package/dist/engine/constants.d.ts

@@ -5,24 +5,14 @@ import type { TenantId } from "./types/identifiers.ts";
 export declare const SystemHookNames: {
     readonly cascadeDelete: "system:hook:cascade-delete";
 };
-export type SystemHookName = (typeof SystemHookNames)[keyof typeof SystemHookNames];
 export declare const SystemHookPriorities: {
     readonly cascadeDelete: 500;
 };
-export declare const MessageKind: {
-    readonly write: "write";
-    readonly query: "query";
-    readonly command: "command";
-    readonly shared: "shared";
-    readonly broadcast: "broadcast";
-};
-export type MessageKind = (typeof MessageKind)[keyof typeof MessageKind];
 export declare const LifecycleHookTypes: {
     readonly preSave: "preSave";
     readonly postSave: "postSave";
     readonly preDelete: "preDelete";
     readonly postDelete: "postDelete";
-    readonly preQuery: "preQuery";
     readonly postQuery: "postQuery";
 };
 export type LifecycleHookType = (typeof LifecycleHookTypes)[keyof typeof LifecycleHookTypes];

package/dist/engine/constants.js

@@ -12,20 +12,12 @@ export const SystemHookPriorities = {
     cascadeDelete: 500,
 };
 // --- Message Kinds ---
-export const MessageKind = {
-    write: "write",
-    query: "query",
-    command: "command",
-    shared: "shared",
-    broadcast: "broadcast",
-};
 // --- Lifecycle Hook Types ---
 export const LifecycleHookTypes = {
     preSave: "preSave",
     postSave: "postSave",
     preDelete: "preDelete",
     postDelete: "postDelete",
-    preQuery: "preQuery",
     postQuery: "postQuery",
 };
 // --- Config Scopes ---

package/dist/engine/create-app.js

@@ -1,7 +1,7 @@
 import { validateBoot } from "./boot-validator.js";
 import { dedupeFeatures } from "./dedupe-features.js";
+import { DEFAULT_CURRENCIES } from "./field-helpers.js";
 import { createRegistry } from "./registry.js";
-import { DEFAULT_CURRENCIES } from "./types/index.js";
 // Every field map an entity-less inline form screen renders: actionForm's and
 // secretMint's own fields, plus a secretMint's separate `confirm` step.
 function inlineFormFieldMaps(screen) {

package/dist/engine/define-feature.d.ts

@@ -1,4 +1,5 @@
-import type { FeatureDefinition, FeatureRegistrar } from "./types/index.ts";
+import type { FeatureRegistrar } from "@cosmicdrift/kumiko-types/feature-registrar";
+import type { FeatureDefinition } from "./types/index.ts";
 export type DefineFeatureSettings = {
     readonly dedupeOptions?: Readonly<Record<string, unknown>>;
 };

package/dist/engine/define-feature.js

@@ -12,7 +12,7 @@ import { isObjectArgument, throwObjectArgumentRequired, unwrapArrayForm } from "
 // the call-site (`defineFeature("driverOrders", ...)` → TName="driverOrders").
 // The literal threads into the FeatureRegistrar so r.defineEvent's return
 // carries `name: "driver-orders:event:foo"` as a literal — strict-mode
-// for `ctx.appendEvent({ type: eventDef.name, ... })` lights up. Apps
+// for `ctx.events.append({ type: eventDef.name, ... })` lights up. Apps
 // that don't care can keep the default-string and use the wrapper-based
 // strict-mode (string-literal types per call-site) like before.
 // optionalRequires accepts either variadic strings or a single `{ features }` object; requires
@@ -116,7 +116,6 @@ export function defineFeature(name, setup, settings) {
             postSave: state.phasedLifecycleHooks.postSave,
             preDelete: state.phasedLifecycleHooks.preDelete,
             postDelete: state.phasedLifecycleHooks.postDelete,
-            preQuery: state.lifecycleHooks["preQuery"] ?? {},
             postQuery: state.lifecycleHooks["postQuery"] ?? {},
             // @cast-boundary engine-bridge — hook registration erases the per-slot
             // signatures to LifecycleHookFn (a union; see the cast in

package/dist/engine/define-handler.d.ts

@@ -1,8 +1,8 @@
 import type { CursorResult } from "@cosmicdrift/kumiko-types/cursor-types";
+import type { KumikoEventTypeMap } from "@cosmicdrift/kumiko-types/event-type-map";
 import type { ZodType } from "zod";
 import type { ContainsSecret } from "../secrets/types.ts";
 import type { QueryHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput } from "./types/define-handler.ts";
-import type { KumikoEventTypeMap } from "./types/index.ts";
 export type { QueryHandlerDefinition, StreamHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput, } from "./types/define-handler.ts";
 export declare function defineWriteHandler<const TName extends string, TSchema extends ZodType, TData = unknown, TMap extends object = KumikoEventTypeMap, TPrepared = undefined>(def: WriteHandlerInput<TName, TSchema, TData, TMap, TPrepared>, ..._noSecretInResponse: true extends ContainsSecret<TData> ? [
     secretLeak: "A handler response must not contain a Secret<> — call .reveal() and return the plaintext, or drop the field."

package/dist/engine/define-step.d.ts

@@ -1,4 +1,3 @@
 import type { StepDef, StepKind } from "./types/step.ts";
 export declare function defineStep<TArgs, TResult>(def: StepDef<TArgs, TResult>): StepDef<TArgs, TResult>;
 export declare function getStep(kind: StepKind): StepDef | undefined;
-export declare function listStepKinds(): readonly StepKind[];

package/dist/engine/define-step.js

@@ -17,6 +17,3 @@ export function defineStep(def) {
 export function getStep(kind) {
     return stepRegistry.get(kind);
 }
-export function listStepKinds() {
-    return Array.from(stepRegistry.keys());
-}

package/dist/engine/embedded-derived.d.ts

@@ -1,4 +1,4 @@
-import type { EmbeddedDerivedCellDef, EmbeddedSubFieldDef } from "./types/index.ts";
+import type { EmbeddedDerivedCellDef, EmbeddedSubFieldDef } from "@cosmicdrift/kumiko-types/fields";
 /** Computes a derived cell from its source values. Missing/non-numeric
  *  sources: "multiply"/"percent" with any missing source → undefined; "sum"/"subtract"
  *  treat missing as 0 only when at least one source is present — if every

package/dist/engine/entity-handlers.d.ts

@@ -1,8 +1,9 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { AccessRule, EscapeHatchDeclaration, QueryHandlerDef, WriteHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
 import * as z from "zod";
 import { type EventStoreExecutor } from "../db/event-store-executor.ts";
 import { type EntityRow, type EntityTable } from "../db/table-builder.ts";
 import type { EntityCrudRegistrar, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions } from "./types/entity-handlers.ts";
-import type { AccessRule, EntityDefinition, EscapeHatchDeclaration, QueryHandlerDef, WriteHandlerDef } from "./types/index.ts";
 export type { EntityCrudHandlerDefaults, EntityCrudRegistrar, EntityCrudVerb, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions, } from "./types/entity-handlers.ts";
 export declare function assertEscapeHatchAccessIsSystemAdminOnly(name: string, kind: "write" | "query", access: AccessRule): void;
 export declare const MAX_LIST_LIMIT = 200;

package/dist/engine/entity-handlers.js

@@ -41,7 +41,7 @@ import { parseTenantId } from "./types/identifiers.js";
 //     r.queryHandler(defineEntityDetailHandler("note", noteEntity, { access }))
 //
 // For custom logic (default values, business rules, side effects, custom
-// executors with ctx.searchAdapter, ...) write the handler explicitly with
+// executors with ctx.services.searchAdapter, ...) write the handler explicitly with
 // r.writeHandler / r.queryHandler — these helpers cover the standard path only.
 //
 // Note on the `as` casts in the handler bodies: WriteHandlerDef.handler's
@@ -252,7 +252,7 @@ export function defineEntityWriteHandler(name, entity, options) {
         case "create":
             schema = buildInsertSchema(entity, undefined, excludedFields, { allowCallerId: true });
             handler = async (event, ctx) => {
-                const { runPreSave } = ctx;
+                const { lifecycle: { runPreSave }, } = ctx;
                 // A caller-chosen id (deterministic-id idempotent creates) is only
                 // honored for a system-identity caller (jobs/hooks via
                 // createSystemUser) — an HTTP-authenticated end user can never
@@ -273,7 +273,7 @@ export function defineEntityWriteHandler(name, entity, options) {
                 changes: buildUpdateSchema(entity, undefined, excludedFields),
             });
             handler = async (event, ctx) => {
-                const { runPreSave } = ctx;
+                const { lifecycle: { runPreSave }, } = ctx;
                 const db = dbFor(ctx);
                 const submitted = event.payload; // @cast-boundary engine-payload
                 const payload = {
@@ -509,7 +509,7 @@ export function createEntityExecutor(entityName, entity) {
 //   );
 //
 // For anything more involved (filters, joins, custom shaping), write the
-// query-handler explicitly with ctx.queryProjection or a raw select.
+// query-handler explicitly with ctx.dispatch.queryProjection or a raw select.
 export function defineProjectionQueryHandler(name, projectionQualifiedName, options) {
     if (typeof options.unsafeAllTenants === "object") {
         assertReason(`"${name}": unsafeAllTenants`, options.unsafeAllTenants.reason);
@@ -521,11 +521,11 @@ export function defineProjectionQueryHandler(name, projectionQualifiedName, opti
     return {
         name,
         schema: z.object({}),
-        // Returns the raw row array — matches ctx.queryProjection's shape so the
-        // helper is a drop-in for the inline `async (_q, ctx) => ctx.queryProjection(...)`
+        // Returns the raw row array — matches ctx.dispatch.queryProjection's shape so the
+        // helper is a drop-in for the inline `async (_q, ctx) => ctx.dispatch.queryProjection(...)`
         // handler. Wrap the result in the caller's handler when you need
         // pagination envelopes or added metadata.
-        handler: async (_query, ctx) => ctx.queryProjection(projectionQualifiedName, options.unsafeAllTenants ? { unsafeAllTenants: true } : undefined), // @wrapper-known semantic-alias
+        handler: async (_query, ctx) => ctx.dispatch.queryProjection(projectionQualifiedName, options.unsafeAllTenants ? { unsafeAllTenants: true } : undefined), // @wrapper-known semantic-alias
         access: options.access,
         ...(escapeHatch && { escapeHatch }),
     };

package/dist/engine/entity-list-runtime-options.js

@@ -6,7 +6,9 @@ export function entityListRuntime(ctx, entityName, user) {
     const resolveEntity = (name) => ctx.registry.getEntity(name);
     return {
         runtimeOptions: {
-            ...(ctx.searchAdapter !== undefined && { searchAdapter: ctx.searchAdapter }),
+            ...(ctx.services.searchAdapter !== undefined && {
+                searchAdapter: ctx.services.searchAdapter,
+            }),
             ...(ctx.includeDeleted === true && { includeDeleted: true }),
             referenceSearch: { fields: ctx.registry.getSearchableReferences(entityName), resolveEntity },
             referenceSort: { fields: ctx.registry.getSortableReferences(entityName), resolveEntity },

package/dist/engine/entity-list-searchability.d.ts

@@ -1,4 +1,5 @@
-import type { EntityDefinition, QueryHandlerDef } from "./types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { QueryHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
 export declare function resolveEntityBehindListQuery(queryQn: string, handler: QueryHandlerDef | undefined, lookupEntity: (entityName: string) => EntityDefinition | undefined): EntityDefinition | undefined;
 /** True when the list query is an entity-convention one over an entity with no
  *  searchable field — a search box would never match anything. */

package/dist/engine/event-def.d.ts

@@ -1,5 +1,6 @@
+import type { EventDef, QualifiedEventName } from "@cosmicdrift/kumiko-types/handlers";
 import { type ZodType } from "zod";
-import type { EventDef, EventPiiStance, QualifiedEventName } from "./types/index.ts";
+import type { EventPiiStance } from "./types/index.ts";
 export type CreateEventDefOptions<TFeature extends string, TInner extends string, TPayload> = {
     readonly feature: TFeature;
     readonly name: TInner;

package/dist/engine/event-helpers.d.ts

@@ -1,5 +1,7 @@
 import type { AppendEventArgs, EventDef, HandlerContext } from "./types/handlers.ts";
-export type EmitCtx = Pick<HandlerContext, "unsafeAppendEvent">;
+export type EmitCtx = {
+    readonly events: Pick<HandlerContext["events"], "unsafeAppend">;
+};
 export declare function emitEvent<TPayload>(ctx: EmitCtx, eventDef: EventDef<TPayload>, args: {
     readonly aggregateId: string;
     readonly aggregateType: string;

package/dist/engine/event-helpers.js

@@ -1,4 +1,4 @@
-// Typed wrapper around ctx.appendEvent. Two wins over the raw call:
+// Typed wrapper around ctx.events.append. Two wins over the raw call:
 //
 //   1. The payload is checked against the EventDef's inferred TPayload,
 //      so a Zod-schema mismatch becomes a compile error at the emit site
@@ -14,7 +14,7 @@
 //
 // aggregateType stays explicit on purpose — the EventDef doesn't know which
 // aggregate owns an event (cross-feature reuse is legal). Use the raw
-// ctx.appendEvent when the event name is computed at runtime.
+// ctx.events.append when the event name is computed at runtime.
 export async function emitEvent(ctx, eventDef, args) {
     const appendArgs = {
         aggregateId: args.aggregateId,
@@ -23,7 +23,7 @@ export async function emitEvent(ctx, eventDef, args) {
         payload: args.payload,
         ...(args.headers !== undefined && { headers: args.headers }),
     };
-    await ctx.unsafeAppendEvent(appendArgs);
+    await ctx.events.unsafeAppend(appendArgs);
 }
 // Read-side counterpart: narrow a StoredEvent's `payload` (declared as
 // `Record<string, unknown>` because a stream carries many event types) to

package/dist/engine/extension-names.d.ts

@@ -47,7 +47,7 @@ export declare const EXT_STORAGE_PROVIDER: "storageProvider";
  * implementation via `r.useExtension(EXT_FILE_PROVIDER, "<name>", { build })`;
  * the per-tenant config key `provider` selects one at runtime. The framework
  * resolver (`createFileProviderForTenant`) reads it so upload routes,
- * `ctx.files`, and GDPR jobs all use the same store.
+ * `ctx.services.files`, and GDPR jobs all use the same store.
  *
  * The framework owns this contract to prevent string drift — file-foundation
  * MUST register the extension point and config key under exactly these names.
@@ -63,7 +63,7 @@ export declare const FILE_STORAGE_PROVIDER_BOOT_SENTINEL: "configured";
  * Renderer-Features (a future `derivatives-*` feature) register via
  * `r.useExtension(EXT_DERIVATIVE_RENDERER, "<mimePattern>", { render })`,
  * where `<mimePattern>` is an exact MIME type (`application/pdf`) or a
- * type-wildcard (`image/*`). `ctx.derivatives.variant(...)` resolves the
+ * type-wildcard (`image/*`). `ctx.services.derivatives.variant(...)` resolves the
  * renderer for a FileRef's MIME type at call time — exact match first,
  * wildcard second.
  *
@@ -148,12 +148,6 @@ export declare const EXT_TENANT_LIFECYCLE_STATUS: "tenantLifecycleStatus";
  */
 export declare const EXT_ASSIGNABLE_ROLE: "assignableRole";
 export declare const TENANT_MEMBERSHIPS_QUERY: "tenant:query:memberships";
-/**
- * Union of standardized extension names for the privacy surface.
- * Not every extension in the system is included — other features can still
- * register their own extension names.
- */
-export type KumikoExtensionName = typeof EXT_USER_DATA | typeof EXT_TENANT_DATA | typeof EXT_STORAGE_PROVIDER | typeof EXT_SEARCH_ADAPTER | typeof EXT_EXTERNAL_RESOURCE | typeof EXT_INFRA_RESOURCE | typeof EXT_FILE_PROVIDER | typeof EXT_DERIVATIVE_RENDERER | typeof EXT_DERIVATIVE_PUBLIC_PREDICATE | typeof EXT_DERIVATIVE_OVERLAY_RESOLVER | typeof EXT_PRINCIPAL_STATUS | typeof EXT_TENANT_LIFECYCLE_STATUS | typeof EXT_ASSIGNABLE_ROLE;
 /** The four `destroyTenant(tenantId, ctx)`-only resource-cleanup extension points. */
 export type TenantResourceExtensionName = typeof EXT_STORAGE_PROVIDER | typeof EXT_SEARCH_ADAPTER | typeof EXT_EXTERNAL_RESOURCE | typeof EXT_INFRA_RESOURCE;
 declare module "@cosmicdrift/kumiko-framework/engine" {

package/dist/engine/extension-names.js

@@ -66,7 +66,7 @@ export const EXT_STORAGE_PROVIDER = "storageProvider";
  * implementation via `r.useExtension(EXT_FILE_PROVIDER, "<name>", { build })`;
  * the per-tenant config key `provider` selects one at runtime. The framework
  * resolver (`createFileProviderForTenant`) reads it so upload routes,
- * `ctx.files`, and GDPR jobs all use the same store.
+ * `ctx.services.files`, and GDPR jobs all use the same store.
  *
  * The framework owns this contract to prevent string drift — file-foundation
  * MUST register the extension point and config key under exactly these names.
@@ -92,7 +92,7 @@ export const FILE_STORAGE_PROVIDER_BOOT_SENTINEL = "configured";
  * Renderer-Features (a future `derivatives-*` feature) register via
  * `r.useExtension(EXT_DERIVATIVE_RENDERER, "<mimePattern>", { render })`,
  * where `<mimePattern>` is an exact MIME type (`application/pdf`) or a
- * type-wildcard (`image/*`). `ctx.derivatives.variant(...)` resolves the
+ * type-wildcard (`image/*`). `ctx.services.derivatives.variant(...)` resolves the
  * renderer for a FileRef's MIME type at call time — exact match first,
  * wildcard second.
  *

package/dist/engine/extension-selector-plugins.d.ts

@@ -1,5 +1,5 @@
+import type { RegistrarExtensionRegistration } from "@cosmicdrift/kumiko-types/config";
 import type { Registry } from "./types/feature.ts";
-import type { RegistrarExtensionRegistration } from "./types/index.ts";
 export declare const SELECTED_EXTENSIONS_QUERY = "config:query:config-value:selected-extensions";
 export declare const EXTENSION_SELECTOR_HINT_KEY = "config.settings.extensionSelectorHint";
 export declare function selectablePluginIds(registry: Pick<Registry, "getExtensionUsages">, extensionName: string): string[];

package/dist/engine/extensions/storage-provider.d.ts

@@ -1,4 +1,3 @@
-import type { TenantResourceDestroyHook, TenantResourceExtensionHooks, TenantResourceHookCtx } from "./tenant-resource.ts";
+import type { TenantResourceDestroyHook, TenantResourceHookCtx } from "./tenant-resource.ts";
 export type StorageProviderHookCtx = TenantResourceHookCtx;
 export type StorageProviderDestroyTenantHook = TenantResourceDestroyHook;
-export type StorageProviderExtensionHooks = TenantResourceExtensionHooks;

package/dist/engine/extensions/user-data.d.ts

@@ -131,14 +131,6 @@ export type UserDataDeleteHookResult = void | {
     readonly reason: string;
 };
 export type UserDataDeleteHook = (ctx: UserDataHookCtx, strategy: UserDataDeleteStrategy) => Promise<UserDataDeleteHookResult>;
-/**
- * Full hook table for EXT_USER_DATA. Export-only is a legitimate partial
- * contract, so registrations are typed by `UserDataExtensionOptions`.
- */
-export interface UserDataExtensionHooks {
-    readonly export: UserDataExportHook;
-    readonly delete: UserDataDeleteHook;
-}
 export type UserDataExtensionOptions = ({
     readonly export: UserDataExportHook;
     readonly delete?: UserDataDeleteHook;

package/dist/engine/factories.d.ts

@@ -1,5 +1,6 @@
+import type { BigIntFieldDef, BooleanFieldDef, DateFieldDef, DecimalFieldDef, DerivedFieldDef, EmbeddedFieldDef, EntityDefinition, EntityIndexDef, EntityLongTextFieldDef, EntityTextFieldDef, FieldsMap, FileFieldDef, FilesFieldDef, ImageFieldDef, ImagesFieldDef, JsonbFieldDef, LocatedTimestampFieldDef, LongTextFieldDef, MoneyFieldDef, MultiSelectFieldDef, NumberFieldDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, ResolvedPiiFlags, RetentionDef, SelectFieldDef, TimestampFieldDef, TzFieldDef } from "@cosmicdrift/kumiko-types/fields";
 import type { EntityTenancy } from "@cosmicdrift/kumiko-types/tenancy-brand";
-import type { BigIntFieldDef, BooleanFieldDef, DateFieldDef, DecimalFieldDef, DerivedFieldDef, EmbeddedFieldDef, EntityDefinition, EntityIndexDef, EntityLongTextFieldDef, EntityTextFieldDef, FieldsMap, FileFieldDef, FilesFieldDef, ImageFieldDef, ImagesFieldDef, JsonbFieldDef, LocatedTimestampFieldDef, LongTextFieldDef, MoneyFieldDef, MultiSelectFieldDef, NumberFieldDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, ResolvedPiiFlags, RetentionDef, SelectFieldDef, TextFieldDef, TimestampFieldDef, TzFieldDef } from "./types/index.ts";
+import type { TextFieldDef } from "./types/index.ts";
 export declare function createTextField<R extends true | false = false>(overrides: Partial<Omit<TextFieldDef, "type" | "required" | keyof ResolvedPiiFlags>> & PersonalAnnotations & {
     required?: R;
 }): EntityTextFieldDef & {

package/dist/engine/feature-builder-state.d.ts

@@ -1,7 +1,14 @@
+import type { ConfigKeyDefinition, ConfigSeedDef, ExtensionSelectorDef, JobDefinition, NotificationDefinition, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, TranslationKeys } from "@cosmicdrift/kumiko-types/config";
+import type { BootCheckFn, FeatureMetricDef, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableEntry, UiHints } from "@cosmicdrift/kumiko-types/feature";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { AuthClaimsFn, ClaimKeyDefinition, EventDef, EventMigrationDef, QueryHandlerDef, StreamHandlerDef, WriteHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
+import type { LifecycleHookFn, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, SearchPayloadContributorFn, ValidationHookFn } from "@cosmicdrift/kumiko-types/hooks";
+import type { EntityProjectionExtension, MultiStreamProjectionDefinition, ProjectionDefinition } from "@cosmicdrift/kumiko-types/projection";
+import type { RelationDefinition } from "@cosmicdrift/kumiko-types/relations";
+import type { TreeActionDef } from "@cosmicdrift/kumiko-types/tree-node";
 import type { WebSocketRouteDefinition } from "@cosmicdrift/kumiko-types/websocket-route";
 import type * as z from "zod";
 import type { HttpRouteDefinition } from "./types/http-route.ts";
-import type { AuthClaimsFn, BootCheckFn, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventDef, EventMigrationDef, ExtensionSelectorDef, FeatureMetricDef, JobDefinition, LifecycleHookFn, MultiStreamProjectionDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, SearchPayloadContributorFn, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableEntry, StreamHandlerDef, TranslationKeys, TreeActionDef, UiHints, ValidationHookFn, WriteHandlerDef } from "./types/index.ts";
 import type { ContentCollectionDefinition, NavDefinition } from "./types/nav.ts";
 import type { ScreenDefinition } from "./types/screen.ts";
 import type { WorkspaceDefinition } from "./types/workspace.ts";

package/dist/engine/feature-changelog.d.ts

@@ -7,7 +7,7 @@ export type ChangelogEntry = {
     readonly detail?: string;
     /** Required when type=breaking. Shown in `kumiko upgrade` output. */
     readonly migration?: string;
-    /** Path (relative to packages/framework/src/, under scripts/codemod/) run by `kumiko upgrade --apply`. */
+    /** Path (relative to packages/feature-ast/src/, under scripts/codemod/) run by `kumiko upgrade --apply`. */
     readonly codemod?: string;
     /** The codemod only covers part of the migration: the entry is also recorded as pending manual work after it ran. */
     readonly manualAfterCodemod?: boolean;

package/dist/engine/feature-config-events-jobs.d.ts

@@ -1,7 +1,10 @@
+import type { ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigSeedDef, JobDefinition, JobHandlerFn, NotificationDataFn, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, TemplateVariables, TranslationsDef } from "@cosmicdrift/kumiko-types/config";
+import type { MetricOptions, SecretKeyHandle, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions } from "@cosmicdrift/kumiko-types/feature";
+import type { AuthClaimsFn, ClaimKeyHandle, ClaimKeyType, DeclarativeEventMigration, EventDef, EventUpcastFn, NameOrRef, QualifiedEventName } from "@cosmicdrift/kumiko-types/handlers";
 import type * as z from "zod";
 import type { ZodType } from "zod";
 import type { FeatureBuilderState } from "./feature-builder-state.ts";
-import type { AuthClaimsFn, ClaimKeyHandle, ClaimKeyType, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigSeedDef, DeclarativeEventMigration, EventDef, EventPiiStance, EventUpcastFn, JobDefinition, JobHandlerFn, MetricOptions, NameOrRef, NotificationDataFn, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, QualifiedEventName, SecretKeyHandle, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, TemplateVariables, TranslationsDef } from "./types/index.ts";
+import type { EventPiiStance } from "./types/index.ts";
 export declare function buildConfigEventsJobsMethods<TName extends string>(state: FeatureBuilderState, name: TName): {
     config: {
         <T extends ConfigKeyType>(keyName: string, def: ConfigKeyDefinition<T>): ConfigKeyHandle<T>;