@cosmicdrift/kumiko-framework 0.389.0 → 0.390.0

package/dist/api/server-wiring.js

@@ -2,7 +2,9 @@ import { EXT_FILE_PROVIDER } from "../engine/extension-names.js";
 import { assertSeedModeNotInProduction } from "../event-store/seed-clock.js";
 import { makeFileProviderResolver } from "../files/provider-resolver.js";
 import { createFallbackLogger } from "../logging/index.js";
-import { createNoopProvider, registerStandardMetrics, wrapRedisClient, } from "../observability/index.js";
+import { createNoopProvider } from "../observability/index.js";
+import { wrapRedisClient } from "../observability/redis-wrapper.js";
+import { registerStandardMetrics } from "../observability/standard-metrics.js";
 import { configAccessorFactoryOf } from "../pipeline/config-accessor-factory.js";
 import { createDispatcher } from "../pipeline/dispatcher.js";
 import { createLifecycleHooks } from "../pipeline/lifecycle-pipeline.js";
@@ -28,7 +30,7 @@ export function withFileProviderResolver(registry, context, cacheSync) {
         ...context,
         _fileProviderResolver: makeFileProviderResolver({
             registry,
-            _configAccessorFactory: configAccessorFactoryOf(context),
+            configAccessorFactory: configAccessorFactoryOf(context),
             secrets: context.secrets,
             db: context.db,
             ...(clock ? { now: () => clock.now() } : {}),
@@ -54,7 +56,7 @@ export function resolveServerWiring(options) {
     // Inject tracer + meter into the AppContext so the dispatcher can propagate
     // them into every HandlerContext it builds. Build the per-tenant file-provider
     // resolver once (when a provider plugin is mounted) — the dispatcher uses it
-    // to materialise `ctx.files`, the upload routes + MSP-applies share it. The
+    // to materialise `ctx.services.files`, the upload routes + MSP-applies share it. The
     // resolver reads config + the s3.secretAccessKey secret under SYSTEM identity.
     const contextWithFiles = withFileProviderResolver(options.registry, options.context, cacheSync);
     const fileProviderResolver = contextWithFiles._fileProviderResolver;
@@ -142,7 +144,7 @@ function resolveServerSseBroker(explicitSseBroker, bootLog) {
 }
 function resolveServerObservability(explicitObservability, registry) {
     // Observability — Noop by default so no call-site needs to null-check.
-    // Every handler/middleware that reaches for ctx.tracer / ctx.metrics gets
+    // Every handler/middleware that reaches for ctx.obs.tracer / ctx.obs.metrics gets
     // a working, zero-cost fallback when no provider is configured.
     const observability = explicitObservability ?? createNoopProvider();
     // Register framework + feature metrics once on this meter. Standard

package/dist/api/server.d.ts

@@ -1,6 +1,7 @@
+import type { RunIn } from "@cosmicdrift/kumiko-types/config";
 import { Hono } from "hono";
 import type { PgListenClient } from "../db/connection.ts";
-import type { AppContext, Registry, RunIn } from "../engine/types/index.ts";
+import type { AppContext, Registry } from "../engine/types/index.ts";
 import type { ErrorDocsConfig } from "../errors/docs-url.ts";
 import type { Lifecycle } from "../lifecycle/index.ts";
 import type { ObservabilityProvider } from "../observability/index.ts";

package/dist/api/sse-route.d.ts

@@ -1,5 +1,6 @@
+import type { AccessRule } from "@cosmicdrift/kumiko-types/handlers";
+import type { OwnershipMap } from "@cosmicdrift/kumiko-types/ownership";
 import { Hono } from "hono";
-import type { AccessRule, OwnershipMap } from "../engine/types/index.ts";
 import { type SseBroker } from "./sse-broker.ts";
 /**
  * Heartbeat cadence for SSE streams.

package/dist/api/tenant-scoped-secrets.d.ts

@@ -0,0 +1,2 @@
+import type { SecretsContext } from "../secrets/index.ts";
+export declare function tenantScopedSecrets(secrets: SecretsContext): SecretsContext;

package/dist/api/tenant-scoped-secrets.js

@@ -0,0 +1,13 @@
+import { runInRowLevelSecurityScope, tenantRowLevelSecurityScope, } from "../db/row-level-security-scope.js";
+// Signature routes run before any tenant scope exists, and plugin code parses unauthenticated bytes,
+// so only the secret accesses themselves open a scope, and only for the tenant the call names.
+export function tenantScopedSecrets(secrets) {
+    const scoped = (tenantId, run) => runInRowLevelSecurityScope(tenantRowLevelSecurityScope(tenantId), run);
+    return {
+        withRunner: (runner) => tenantScopedSecrets(secrets.withRunner(runner)),
+        get: (tenantId, ...rest) => scoped(tenantId, () => secrets.get(tenantId, ...rest)),
+        has: (tenantId, ...rest) => scoped(tenantId, () => secrets.has(tenantId, ...rest)),
+        set: (tenantId, ...rest) => scoped(tenantId, () => secrets.set(tenantId, ...rest)),
+        delete: (tenantId, ...rest) => scoped(tenantId, () => secrets.delete(tenantId, ...rest)),
+    };
+}

package/dist/api/websocket-route.d.ts

@@ -1,7 +1,7 @@
 import { WEBSOCKET_BACKPRESSURE_LIMIT_BYTES, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_ROUTE_PATH_PREFIX, type WebSocketMessageData, type WebSocketSessionHandlers } from "@cosmicdrift/kumiko-types/websocket-route";
 import type { SessionUser } from "../engine/types/index.ts";
 import { type AuthSessionChecker, type TenantLifecycleStatusResolver } from "./auth-middleware.ts";
-import { type RequestContextData } from "./request-context.ts";
+import type { RequestContextData } from "./request-context-internals.ts";
 export { WEBSOCKET_BACKPRESSURE_LIMIT_BYTES, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES, WEBSOCKET_MAX_PAYLOAD_BYTES, WEBSOCKET_ROUTE_PATH_PREFIX, };
 export declare const WEBSOCKET_HEARTBEAT_INTERVAL_MS = 25000;
 export declare const WEBSOCKET_PENDING_BUFFER_LIMIT_BYTES: number;

package/dist/auth/index.d.ts

@@ -1,2 +1 @@
-export type { Role } from "./roles.ts";
 export { ROLES } from "./roles.ts";

package/dist/auth/roles.d.ts

@@ -9,8 +9,3 @@ export declare const ROLES: {
     readonly SystemAdmin: "SystemAdmin";
     readonly Member: "Member";
 };
-/**
- * Union of all known role names for compile-time checks of
- * handler access rules and ownership maps.
- */
-export type Role = (typeof ROLES)[keyof typeof ROLES];

package/dist/compliance/duration-spec.d.ts

@@ -3,6 +3,5 @@ import type { DurationSpec, RetentionSpec } from "./profiles.ts";
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 export declare function durationSpecToMs(spec: DurationSpec): number;
 export declare function addDurationSpec(now: Instant, spec: DurationSpec): Instant;
-export declare function describeDurationSpec(spec: DurationSpec): string;
 export declare function subtractRetentionSpec(now: Instant, spec: RetentionSpec): Instant;
 export {};

package/dist/compliance/duration-spec.js

@@ -28,11 +28,6 @@ export function addDurationSpec(now, spec) {
 }
 // Human-readable descriptions for logs and error messages. Not localized;
 // operator output is English-only.
-export function describeDurationSpec(spec) {
-    if ("days" in spec)
-        return `${spec.days} day${spec.days === 1 ? "" : "s"}`;
-    return `${spec.hours} hour${spec.hours === 1 ? "" : "s"}`;
-}
 // Calendar-aware cutoff: months/years are subtracted on a UTC calendar so
 // "24 months" is not approximated as 730 fixed days (leap years, month ends).
 export function subtractRetentionSpec(now, spec) {

package/dist/compliance/index.d.ts

@@ -1,6 +1,6 @@
-export { addDurationSpec, describeDurationSpec, durationSpecToMs, subtractRetentionSpec, } from "./duration-spec.ts";
+export { addDurationSpec, subtractRetentionSpec, } from "./duration-spec.ts";
 export { complianceProfileOverrideSchema } from "./override-schema.ts";
-export type { AuthorityNotificationDeadline, ComplianceProfile, ComplianceProfileKey, ComplianceProfileOverride, DurationSpec, EffectiveComplianceProfile, RetentionSpec, UserNotificationRequiredPolicy, } from "./profiles.ts";
-export { COMPLIANCE_PROFILES, OVERRIDABLE_PROFILE_KEYS, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.ts";
-export type { BundleTier, SubProcessor } from "./sub-processors.ts";
+export type { ComplianceProfile, ComplianceProfileKey, ComplianceProfileOverride, DurationSpec, EffectiveComplianceProfile, } from "./profiles.ts";
+export { COMPLIANCE_PROFILES, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.ts";
+export type { SubProcessor } from "./sub-processors.ts";
 export { getActiveSubProcessors, getPlannedSubProcessors, KUMIKO_SUB_PROCESSORS, } from "./sub-processors.ts";

package/dist/compliance/index.js

@@ -1,6 +1,6 @@
 // `@cosmicdrift/kumiko-framework/compliance` — Data protection and compliance foundation.
 // Used by compliance-profiles, data-retention, user-data-rights, and related features.
-export { addDurationSpec, describeDurationSpec, durationSpecToMs, subtractRetentionSpec, } from "./duration-spec.js";
+export { addDurationSpec, subtractRetentionSpec, } from "./duration-spec.js";
 export { complianceProfileOverrideSchema } from "./override-schema.js";
-export { COMPLIANCE_PROFILES, OVERRIDABLE_PROFILE_KEYS, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.js";
+export { COMPLIANCE_PROFILES, resolveComplianceProfile, SELECTABLE_PROFILE_KEYS, } from "./profiles.js";
 export { getActiveSubProcessors, getPlannedSubProcessors, KUMIKO_SUB_PROCESSORS, } from "./sub-processors.js";

package/dist/compliance/profiles.d.ts

@@ -70,21 +70,6 @@ export interface ComplianceProfile {
  * tenants must select an actual profile.
  */
 export declare const SELECTABLE_PROFILE_KEYS: readonly ["eu-dsgvo", "swiss-dsg", "de-hr-dsgvo-hgb"];
-/**
- * Top-level `ComplianceProfile` properties that a tenant override may modify.
- * Identity fields (key, region, label, extends) are excluded because
- * overriding them would destroy the profile's identity.
- *
- * This is the single source of truth for:
- *   - the set-profile handler whitelist, which rejects typos
- *   - the snapshot test that guards against drift from the profile's top level
- *
- * When a new top-level property is added to `ComplianceProfile` (for example,
- * `dataSubjectRights` or `crossBorderTransferRules`), it must be added here;
- * otherwise set-profile rejects valid overrides. The snapshot test in
- * profiles.test.ts detects drift in either direction.
- */
-export declare const OVERRIDABLE_PROFILE_KEYS: ReadonlySet<string>;
 type DeepReadonly<T> = T extends object ? {
     readonly [K in keyof T]: DeepReadonly<T[K]>;
 } : T;

package/dist/compliance/profiles.js

@@ -164,29 +164,6 @@ export const SELECTABLE_PROFILE_KEYS = [
     "swiss-dsg",
     "de-hr-dsgvo-hgb",
 ];
-/**
- * Top-level `ComplianceProfile` properties that a tenant override may modify.
- * Identity fields (key, region, label, extends) are excluded because
- * overriding them would destroy the profile's identity.
- *
- * This is the single source of truth for:
- *   - the set-profile handler whitelist, which rejects typos
- *   - the snapshot test that guards against drift from the profile's top level
- *
- * When a new top-level property is added to `ComplianceProfile` (for example,
- * `dataSubjectRights` or `crossBorderTransferRules`), it must be added here;
- * otherwise set-profile rejects valid overrides. The snapshot test in
- * profiles.test.ts detects drift in either direction.
- */
-export const OVERRIDABLE_PROFILE_KEYS = new Set([
-    "userRights",
-    "notifications",
-    "breach",
-    "auditLog",
-    "subProcessor",
-    "tenantDestroyGracePeriod",
-    "forgetDiscovery",
-]);
 // These paths are replaced as atomic values rather than merged recursively.
 // This is required for discriminated unions, where a patch may provide a
 // sibling property instead of an override; for example, changing retention

package/dist/config/index.d.ts

@@ -1,5 +1,8 @@
+import type { BundledListsOptions } from "@cosmicdrift/kumiko-types/screen";
+import { type RowLevelSecurityMode } from "../db/render-rls-ddl.ts";
 import type { ValidateBootOptions } from "../engine/boot-validator.ts";
-import type { BundledListsOptions, FeatureDefinition } from "../engine/types/index.ts";
+import type { FeatureDefinition } from "../engine/types/index.ts";
+import type { AppClientConfig, AppPortEntry } from "./internals.ts";
 export type AppInfraPorts = {
     readonly postgres?: number;
     readonly redis?: number;
@@ -16,10 +19,6 @@ export type AppPorts = {
      *  of several apps never share a Meilisearch or Postgres. */
     readonly infra?: AppInfraPorts;
 };
-export type AppClientConfig = {
-    /** Client bundle entry files, relative to the app root (e.g. "src/client.tsx"). */
-    readonly entries: readonly string[];
-};
 /** The boot-validator options an app owns; `env` and the cipher are injected by the runners. */
 export type AppValidateBootOptions = Pick<ValidateBootOptions, "navAllowlist" | "navAllowlistExempt" | "requiredLocales" | "warnOnUniqueAccessRoles">;
 export type AppConfig = {
@@ -37,19 +36,20 @@ export type AppConfig = {
     readonly validateBootOptions?: AppValidateBootOptions;
     /** One table block for every list of the bundled features. kumiko/schema.ts passes it to composeFeatures; the app's bin files pass it to the runners, like validateBootOptions. */
     readonly bundledLists?: BundledListsOptions;
+    /** "on" enforces tenant isolation in Postgres via row level security; schema tooling and every runner read this one value. Default "on". */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
 };
 export declare const APP_CONFIG_FILE = "kumiko.config.ts";
 declare const INFRA_PORT_NAMES: readonly ["postgres", "redis", "meilisearch", "s3"];
 export type AppPortRole = "dev" | "e2e" | (typeof INFRA_PORT_NAMES)[number];
-export type AppPortEntry = {
-    readonly role: AppPortRole;
-    readonly port: number;
-};
 /** Every port the app claims, in a stable order. */
 export declare function listAppPorts(ports: AppPorts): readonly AppPortEntry[];
 /** Problems with the declared ports: out of range or claimed twice by this app. */
 export declare function findAppPortProblems(ports: AppPorts): readonly string[];
 export declare function defineAppConfig(config: AppConfig): AppConfig;
-/** The full feature list prod boots with: `features` plus `prodFeatures`. */
+/**
+ * Raw `features` plus `prodFeatures`, without the bundled foundation: the runners compose it,
+ * tooling such as `runSchemaCli` takes `FEATURES` from `kumiko/schema`.
+ */
 export declare function allAppFeatures(config: Pick<AppConfig, "features" | "prodFeatures">): readonly FeatureDefinition[];
 export {};

package/dist/config/index.js

@@ -1,3 +1,8 @@
+// The app's single config file (kumiko.config.ts). Type-only imports keep it
+// loadable by tooling (kumiko check, agent lint, port registry) without
+// pulling the engine runtime.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { ROW_LEVEL_SECURITY_MODES } from "../db/render-rls-ddl.js";
 export const APP_CONFIG_FILE = "kumiko.config.ts";
 const INFRA_PORT_NAMES = [
     "postgres",
@@ -50,12 +55,19 @@ export function defineAppConfig(config) {
             problems.push(`client.entries: "${entry}" must be a relative .ts/.tsx path inside the app`);
         }
     }
+    if (config.rowLevelSecurity !== undefined &&
+        !isOneOf(ROW_LEVEL_SECURITY_MODES, config.rowLevelSecurity)) {
+        problems.push(`rowLevelSecurity must be one of ${ROW_LEVEL_SECURITY_MODES.join(", ")}, got ${String(config.rowLevelSecurity)}`);
+    }
     if (problems.length > 0) {
         throw new Error(`defineAppConfig: ${problems.join("; ")}`);
     }
     return config;
 }
-/** The full feature list prod boots with: `features` plus `prodFeatures`. */
+/**
+ * Raw `features` plus `prodFeatures`, without the bundled foundation: the runners compose it,
+ * tooling such as `runSchemaCli` takes `FEATURES` from `kumiko/schema`.
+ */
 export function allAppFeatures(config) {
     return [...config.features, ...(config.prodFeatures ?? [])];
 }

package/dist/config/internals.d.ts

@@ -0,0 +1,9 @@
+import type { AppPortRole } from "./index.ts";
+export type AppClientConfig = {
+    /** Client bundle entry files, relative to the app root (e.g. "src/client.tsx"). */
+    readonly entries: readonly string[];
+};
+export type AppPortEntry = {
+    readonly role: AppPortRole;
+    readonly port: number;
+};

package/dist/config/internals.js

@@ -0,0 +1 @@
+export {};

package/dist/consumer-cli-internals.d.ts

@@ -0,0 +1,4 @@
+export type ConsumerCliOut = {
+    readonly log: (line: string) => void;
+    readonly err: (line: string) => void;
+};

package/dist/consumer-cli-internals.js

@@ -0,0 +1 @@
+export {};

package/dist/consumer-cli.d.ts

@@ -1,5 +1,2 @@
-export type ConsumerCliOut = {
-    readonly log: (line: string) => void;
-    readonly err: (line: string) => void;
-};
+import type { ConsumerCliOut } from "./consumer-cli-internals.ts";
 export declare function runConsumerCli(argv: readonly string[], out: ConsumerCliOut): Promise<number>;

package/dist/consumer-cli.js

@@ -79,7 +79,11 @@ export async function runConsumerCli(argv, out) {
         out.err("  DATABASE_URL not set.");
         return 1;
     }
-    const { db, close } = createDbConnection({ url: dbUrl, ...dbConnectionOptionsFromEnv() });
+    const { db, close } = createDbConnection({
+        url: dbUrl,
+        rowLevelSecurity: "off", // consumer state tables carry no tenant_id
+        ...dbConnectionOptionsFromEnv(),
+    });
     try {
         if (sub === "status") {
             const state = await getConsumerState(db, name, instanceId);

package/dist/crypto/event-pii.js

@@ -1,5 +1,5 @@
 // PII on custom-event payloads. Entity CRUD events get their PII
-// encrypted by the executor; events written via ctx.appendEvent / MSP-apply /
+// encrypted by the executor; events written via ctx.events.append / MSP-apply /
 // low-level append() (delivery attempt-log, jobs run-logger) had no encrypt
 // path at all. `r.defineEvent(name, schema, { piiFields })` declares which
 // payload fields are PII and which payload field names the owning user;

package/dist/crypto/index.d.ts

@@ -1,11 +1,10 @@
-export { blindIndexFieldName, collectLookupableFields, computeBlindIndex, computeBlindIndexValues, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.ts";
-export { configuredEventPiiCatalog, configureEventPiiCatalog, type EventPiiCatalog, encryptEventPayloadPii, } from "./event-pii.ts";
+export { collectLookupableFields, computeBlindIndex, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.ts";
+export { configuredEventPiiCatalog } from "./event-pii.ts";
 export { InMemoryKmsAdapter } from "./in-memory-kms-adapter.ts";
 export { isSelfPiiField } from "./is-self-pii-field.ts";
-export { type KekSourceEnv, type KekSourceOptions, resolvePlatformKeks } from "./kek-source.ts";
-export { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, type KmsAdapter, type KmsContext, type KmsHealth, type LocalKeyKmsAdapter, RECORD_ENTITY_PATTERN, type RemoteCryptoKmsAdapter, type SubjectDek, type SubjectId, type SubjectKey, subjectIdFromKey, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForTenant, subjectKeyForUser, } from "./kms-adapter.ts";
-export { type ActiveKmsWiring, buildPgKmsOptions, type KmsWiring, type KmsWiringEnv, type KmsWiringOptions, type KmsWiringRelease, type PgKmsRotationEnv, type PlaintextPiiWiring, requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.ts";
-export { createPgKmsAdapter, PgKmsAdapter, type PgKmsAdapterOptions, type RewrapOptions, type RewrapResult, rewrapSubjectKeys, } from "./pg-kms-adapter.ts";
-export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, type EncryptPiiOptions, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL, } from "./pii-field-encryption.ts";
-export { createRequestKmsCache, type RequestKmsCache, } from "./request-kms-cache.ts";
-export { collectPiiEncryptedFields, collectPiiSubjectFields, collectSearchableSubjectFields, isRecordKeyedField, type ResolveSubjectOptions, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.ts";
+export { resolvePlatformKeks } from "./kek-source.ts";
+export { KeyAlreadyExistsError, KeyErasedError, type KmsAdapter, type KmsContext, type LocalKeyKmsAdapter, type SubjectId, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForUser, } from "./kms-adapter.ts";
+export { type KmsWiring, requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.ts";
+export { createPgKmsAdapter, rewrapSubjectKeys, } from "./pg-kms-adapter.ts";
+export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_ERASED_SENTINEL, } from "./pii-field-encryption.ts";
+export { collectPiiEncryptedFields, collectPiiSubjectFields, isRecordKeyedField, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.ts";

package/dist/crypto/index.js

@@ -1,11 +1,10 @@
-export { blindIndexFieldName, collectLookupableFields, computeBlindIndex, computeBlindIndexValues, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.js";
-export { configuredEventPiiCatalog, configureEventPiiCatalog, encryptEventPayloadPii, } from "./event-pii.js";
+export { collectLookupableFields, computeBlindIndex, configureBlindIndexKey, configuredBlindIndexKey, decodeBlindIndexKey, } from "./blind-index.js";
+export { configuredEventPiiCatalog } from "./event-pii.js";
 export { InMemoryKmsAdapter } from "./in-memory-kms-adapter.js";
 export { isSelfPiiField } from "./is-self-pii-field.js";
 export { resolvePlatformKeks } from "./kek-source.js";
-export { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, RECORD_ENTITY_PATTERN, subjectIdFromKey, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForTenant, subjectKeyForUser, } from "./kms-adapter.js";
-export { buildPgKmsOptions, requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.js";
-export { createPgKmsAdapter, PgKmsAdapter, rewrapSubjectKeys, } from "./pg-kms-adapter.js";
-export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
-export { createRequestKmsCache, } from "./request-kms-cache.js";
-export { collectPiiEncryptedFields, collectPiiSubjectFields, collectSearchableSubjectFields, isRecordKeyedField, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";
+export { KeyAlreadyExistsError, KeyErasedError, subjectIdSchema, subjectIdToKey, subjectKeyForRecord, subjectKeyForUser, } from "./kms-adapter.js";
+export { requireKmsWiring, requireKmsWiringAsync, resolveKmsWiring, resolveKmsWiringAsync, } from "./kms-wiring.js";
+export { createPgKmsAdapter, rewrapSubjectKeys, } from "./pg-kms-adapter.js";
+export { configuredPiiSubjectKms, configurePiiSubjectKms, decryptPiiFieldValues, decryptPiiValueForSubject, encryptPiiFieldValues, encryptPiiJsonValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_ERASED_SENTINEL, } from "./pii-field-encryption.js";
+export { collectPiiEncryptedFields, collectPiiSubjectFields, isRecordKeyedField, resolveSubjectForField, SubjectResolutionError, } from "./subject-resolver.js";

package/dist/crypto/pg-kms-adapter.js

@@ -57,6 +57,7 @@ export class PgKmsAdapter {
         this.connection = createDbConnection({
             url: options.databaseUrl,
             maxConnections: options.maxConnections ?? 4,
+            rowLevelSecurity: "off", // key tables carry no tenant_id
         });
         this.sql = this.connection.client;
     }
@@ -171,7 +172,11 @@ export async function rewrapSubjectKeys(options) {
         fromKeks.set(Number(version), decodePlatformKek(kek));
     }
     const batchSize = options.batchSize ?? 200;
-    const connection = createDbConnection({ url: options.databaseUrl, maxConnections: 2 });
+    const connection = createDbConnection({
+        url: options.databaseUrl,
+        maxConnections: 2,
+        rowLevelSecurity: "off", // key tables carry no tenant_id
+    });
     const sql = connection.client;
     const failures = [];
     const result = { scanned: 0, rewrapped: 0, skippedErased: 0, failures };

package/dist/db/apply-entity-event.d.ts

@@ -1,5 +1,5 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { ExecutorManagedRunner } from "@cosmicdrift/kumiko-types/executor-brand";
-import type { EntityDefinition } from "../engine/types/index.ts";
 import type { StoredEvent } from "../event-store/index.ts";
 import type { DbRow } from "./connection.ts";
 import type { TableColumns } from "./dialect.ts";

package/dist/db/apply-entity-event.js

@@ -1,49 +1,3 @@
-// applyEntityEvent — the ONLY write logic for r.entity tables from
-// StoredEvents. Both callers use it:
-//
-//   - createEventStoreExecutor (live, in the write TX) passes the just-appended
-//     StoredEvent directly; sensitive fields are table ciphertext in the payload
-//     (validated at boot as pii/encrypted).
-//   - rebuildProjection via ImplicitProjection (replay, in the rebuild TX)
-//     passes the same StoredEvent; apply copies ciphertext byte-for-byte,
-//     while bidx is recalculated below.
-//
-// Live==Rebuild equivalence therefore holds by construction for ALL fields —
-// changed write logic needs to be maintained in only ONE place, with no sync
-// contract. The only legitimate divergence is crypto-shredding
-// (DEK erased → value unreadable, bidx NULL). Load-bearing test:
-// db/__tests__/implicit-projection-equivalence.integration.test.ts.
-//
-// Tenant isolation: applyEntityEvent expects an ExecutorManagedRunner (tx or pool), NOT
-// a TenantDb wrapper. Two sources keep it safe:
-//   1. The live path reads the target row through the tenant-scoped TenantDb
-//      before writing — loadById() for update/delete/forget, db.fetchOne() for
-//      restore — so the aggregateId is already tenant-validated on arrival.
-//   2. create sets tenantId explicitly from event.tenantId, never derived from
-//      the TenantDb wrapper default.
-// The missing TenantDb wrapper in this function is therefore not a hole.
-//
-// Auto-verbs:
-//   <entity>.created   → INSERT
-//   <entity>.updated   → UPDATE WHERE id=aggregateId
-//   <entity>.deleted   → soft-delete-UPDATE if entity.softDelete, otherwise hard-DELETE
-//   <entity>.restored  → undelete-UPDATE (meaningful only for softDelete)
-//   <entity>.forgotten → always hard-DELETE (Art.17 purge, including softDelete);
-//                        via executor.forget(). Rebuild replays created→forgotten
-//                        → the row is gone, making this rebuild-safe (unlike a
-//                        direct deleteMany).
-//
-// Domain events (r.defineEvent) on the same aggregate are NOT handled here —
-// they never went through the Executor in the live path and must be handled by
-// explicit r.projection-apply handlers or r.multiStreamProjection.
-// ImplicitProjection registers the auto-verbs.
-//
-// Return shape: ApplyResult with `kind` and an optional `row`.
-//   - "applied" → the write completed. `row` contains the written row for
-//     create/update/soft-delete/restore. For hard-delete, `row` is null
-//     (DELETE statements do not provide a returning row).
-//   - "skipped" → the event is not an auto-verb (a domain event on the same
-//     aggregate). Caller no-op.
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { requestContext } from "../api/request-context.js";
 import { collectLookupableFields, computeBlindIndexValues } from "../crypto/blind-index.js";
@@ -51,6 +5,8 @@ import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ER
 import { collectPiiFileReferenceFields } from "../crypto/subject-resolver.js";
 import { deleteMany, insertOne, updateMany } from "../db/query.js";
 import { InternalError } from "../errors/index.js";
+import { activeRowLevelSecurityScope, runInSystemRowLevelSecurityScope, } from "./row-level-security-scope.js";
+import { asEntityTableMeta } from "./table-introspection.js";
 const AUTO_VERBS = ["created", "updated", "deleted", "restored", "forgotten"];
 /** Parses event.type into an AutoVerb when the event is an auto-verb
  *  for the given aggregate; otherwise returns null (a domain event). */
@@ -85,7 +41,19 @@ async function decryptFileReferenceCiphertext(entity, values) {
 /** Applies an auto-event idempotently to the entity table.
  *  Called both during live append (inside the write TX) and during rebuild
  *  (inside the rebuild TX), using identical logic. */
-export async function applyEntityEvent(event, table, entity, tx) {
+// An ambient tenant scope stays, so a live write cannot land a row in another tenant (row-level security
+// rejects it). Replay, rebuild and boot seeds run without a tenant scope and global tables live on the system
+// tenant, so only those write system scoped.
+export function applyEntityEvent(event, table, entity, tx) {
+    if (keepsAmbientTenantScope(table))
+        return applyEntityEventInScope(event, table, entity, tx);
+    return runInSystemRowLevelSecurityScope("replay, rebuild and global-table projection writes carry no tenant scope of their own", () => applyEntityEventInScope(event, table, entity, tx));
+}
+function keepsAmbientTenantScope(table) {
+    return (activeRowLevelSecurityScope()?.kind === "tenant" &&
+        asEntityTableMeta(table)?.tenancy !== "global");
+}
+async function applyEntityEventInScope(event, table, entity, tx) {
     const verb = parseAutoVerb(event);
     if (verb === null)
         return { kind: "skipped" };