@cosmicdrift/kumiko-framework 0.389.0 → 0.390.1

package/dist/engine/registry-ingest.d.ts

@@ -1,5 +1,6 @@
+import type { NotificationDefinition } from "@cosmicdrift/kumiko-types/config";
 import type { RegistryState } from "./registry-state.ts";
-import type { FeatureDefinition, NotificationDefinition } from "./types/index.ts";
+import type { FeatureDefinition } from "./types/index.ts";
 export declare function populateFeatureCore(state: RegistryState, feature: FeatureDefinition): void;
 export declare function populateHandlers(state: RegistryState, feature: FeatureDefinition): void;
 export declare function populateConfigKeys(state: RegistryState, feature: FeatureDefinition): void;

package/dist/engine/registry-ingest.js

@@ -1,5 +1,5 @@
 import { resolveTableName } from "../db/entity-table-meta.js";
-import { buildMetricName, validateMetricName } from "../observability/index.js";
+import { buildMetricName, validateMetricName } from "../observability/metric-validator.js";
 import { toKebab } from "./qualified-name.js";
 import { mergeHookList, mergeHookListQualified, qualify } from "./registry-state.js";
 import { WORKFLOW_SYSTEM_EVENT_DEFS } from "./steps/workflow-system-events.js";
@@ -256,7 +256,6 @@ export function populateHooks(state, feature) {
     mergeHookListQualified(state.postSaveHooks, feature.hooks?.postSave, feature.name, "write");
     mergeHookListQualified(state.preDeleteHooks, feature.hooks?.preDelete, feature.name, "write");
     mergeHookListQualified(state.postDeleteHooks, feature.hooks?.postDelete, feature.name, "write");
-    mergeHookListQualified(state.preQueryHooks, feature.hooks?.preQuery, feature.name, "query");
     mergeHookListQualified(state.postQueryHooks, feature.hooks?.postQuery, feature.name, "query");
     // Entity hooks: NOT prefixed, keyed by entity name
     mergeHookList(state.entityPostSaveHooks, feature.entityHooks?.postSave);

package/dist/engine/registry-state.d.ts

@@ -1,5 +1,16 @@
+import type { ConfigKeyDefinition, ConfigSeedDef, ExtensionSelectorPanel, JobDefinition, NotificationDefinition, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, TranslationValue } from "@cosmicdrift/kumiko-types/config";
+import type { FeatureMetricDef, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableDef } from "@cosmicdrift/kumiko-types/feature";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { AuthClaimsHookDef, ClaimKeyDefinition, EventDef, EventUpcastFn, QueryHandlerDef, StreamHandlerDef, WriteHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
+import type { HookPhase, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, PreSaveHookFn, SearchPayloadContributorFn } from "@cosmicdrift/kumiko-types/hooks";
+import type { NavDefinition } from "@cosmicdrift/kumiko-types/nav";
+import type { EntityProjectionExtension, MultiStreamProjectionDefinition, ProjectionDefinition } from "@cosmicdrift/kumiko-types/projection";
+import type { RelationDefinition } from "@cosmicdrift/kumiko-types/relations";
+import type { ScreenDefinition } from "@cosmicdrift/kumiko-types/screen";
+import type { TreeActionDef } from "@cosmicdrift/kumiko-types/tree-node";
+import type { WorkspaceDefinition } from "@cosmicdrift/kumiko-types/workspace";
 import { type QnType, qualifyEntityName } from "./qualified-name.ts";
-import type { AuthClaimsHookDef, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventDef, EventUpcastFn, ExtensionSelectorPanel, FeatureDefinition, FeatureMetricDef, HookPhase, JobDefinition, MultiStreamProjectionDefinition, NavDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, ScreenDefinition, SearchPayloadContributorFn, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableDef, StreamHandlerDef, TranslationValue, TreeActionDef, WorkspaceDefinition, WriteHandlerDef } from "./types/index.ts";
+import type { FeatureDefinition } from "./types/index.ts";
 export type IncomingRelation = {
     sourceEntity: string;
     relationName: string;
@@ -24,7 +35,6 @@ export type RegistryState = {
     postSaveHooks: Map<string, PhasedHook<PostSaveHookFn>[]>;
     preDeleteHooks: Map<string, PhasedHook<PreDeleteHookFn>[]>;
     postDeleteHooks: Map<string, PhasedHook<PostDeleteHookFn>[]>;
-    preQueryHooks: Map<string, OwnedFn<PreQueryHookFn>[]>;
     postQueryHooks: Map<string, OwnedFn<PostQueryHookFn>[]>;
     entityPostSaveHooks: Map<string, PhasedHook<PostSaveHookFn>[]>;
     entityPreDeleteHooks: Map<string, PhasedHook<PreDeleteHookFn>[]>;

package/dist/engine/registry-state.js

@@ -21,7 +21,7 @@ export function buildImplicitProjection(featureName, entityName, entity, qualify
     const drizzleTable = backingTable !== undefined
         ? resolveBackingTable(entityName, entity, backingTable)
         : buildEntityTable(entityName, entity);
-    markExecutorManagedTable(drizzleTable);
+    markExecutorManagedTable(drizzleTable, { entityName, entity });
     // applyEntityEvent returns ApplyResult, but SingleStreamApplyFn expects
     // Promise<void>. The row is irrelevant during rebuild, so we discard it.
     const handler = async (event, tx) => {
@@ -131,7 +131,6 @@ export function createInitialState() {
         postSaveHooks: new Map(),
         preDeleteHooks: new Map(),
         postDeleteHooks: new Map(),
-        preQueryHooks: new Map(),
         postQueryHooks: new Map(),
         entityPostSaveHooks: new Map(),
         entityPreDeleteHooks: new Map(),
@@ -206,7 +205,7 @@ export function filterByPhase(list, phase, effectiveFeatures) {
     return result;
 }
 // Same ownership rule as filterByPhase, but for unphased hook lists
-// (preSave, preQuery). Returns the raw fns ready for the lifecycle runner.
+// (preSave, postQuery). Returns the raw fns ready for the lifecycle runner.
 export function filterOwned(list, effectiveFeatures) {
     if (!list || list.length === 0)
         return [];

package/dist/engine/registry-validate.d.ts

@@ -1,6 +1,8 @@
+import type { EntityEventMigration } from "@cosmicdrift/kumiko-types/fields";
+import type { EventUpcastFn } from "@cosmicdrift/kumiko-types/handlers";
 import { type EntityLifecycleVerb } from "../db/event-store-executor-context.ts";
 import type { RegistryState } from "./registry-state.ts";
-import type { EntityEventMigration, EventUpcastFn, FeatureDefinition } from "./types/index.ts";
+import type { FeatureDefinition } from "./types/index.ts";
 export declare function finalizeWorkspaceNavMembership(state: RegistryState): void;
 export declare function populateHandlerEntityMappings(state: RegistryState, features: readonly FeatureDefinition[]): void;
 export declare function validateExtensionSelectors(state: RegistryState): void;

package/dist/engine/registry-validate.js

@@ -1,13 +1,14 @@
+import { isRateLimitDisabled } from "@cosmicdrift/kumiko-types/handlers";
 import { configureEventPiiCatalog } from "../crypto/event-pii.js";
 import { hasSearchablePlaintext, isSensitiveLabelField } from "../db/entity-field-encryption.js";
 import { entityEventName } from "../db/event-store-executor-context.js";
 import { resolveMaxPerTenant } from "../jobs/max-per-tenant.js";
 import { bindHookEscapeHatchGrant } from "../pipeline/system-identity-switch.js";
 import { resolveName } from "./handler-helpers.js";
+import { HookPhases } from "./hook-helpers.js";
 import { parseRefTargetEntityName } from "./parse-ref-target.js";
 import { buildImplicitProjection, hasFieldAccessRules, qualify } from "./registry-state.js";
 import { buildSoftDeleteCleanupJob, buildSoftDeleteCleanupSystemJob, SOFT_DELETE_CLEANUP_JOB, SOFT_DELETE_CLEANUP_SYSTEM_JOB, SOFT_DELETE_GRACE_DAYS_KEY, softDeleteGraceDaysConfig, } from "./soft-delete-cleanup.js";
-import { HookPhases, isRateLimitDisabled } from "./types/index.js";
 function allHandlerQns(state) {
     return new Set([...state.writeHandlerMap.keys(), ...state.queryHandlerMap.keys()]);
 }
@@ -452,7 +453,7 @@ export function validateProjectionApplyKeys(state) {
     // 'e') would silently never fire. Valid apply-keys are the auto-generated
     // CRUD types per source entity PLUS every domain event registered via
     // r.defineEvent — an apply-handler for a domain event is how a projection
-    // reacts to ctx.appendEvent writes on the same aggregate stream.
+    // reacts to ctx.events.append writes on the same aggregate stream.
     const allDomainEventNames = new Set(state.eventMap.keys());
     for (const [projName, projDef] of state.projectionMap) {
         const sources = Array.isArray(projDef.source) ? projDef.source : [projDef.source];
@@ -486,7 +487,7 @@ export function validateProjectionApplyKeys(state) {
             }
         }
         // Domain events are valid apply-keys for any projection. They arrive via
-        // ctx.appendEvent on a specific aggregate — the runtime matches by event
+        // ctx.events.append on a specific aggregate — the runtime matches by event
         // type, so a projection can observe domain events whose aggregate matches
         // one of its declared sources.
         for (const domainEvt of allDomainEventNames)
@@ -613,12 +614,12 @@ export function resolveNotificationTriggersAndRegisterHooks(state) {
             featureName,
             fn: async (result, context) => {
                 if (!context.notify) {
-                    context.log?.debug(`notification ${qualifiedName}: skipping — no notify function configured on context`);
+                    context.obs.log?.debug(`notification ${qualifiedName}: skipping — no notify function configured on context`);
                     return;
                 }
                 const to = recipient(result);
                 if (to === null) {
-                    context.log?.debug(`notification ${qualifiedName}: skipping — recipient resolver returned null for result ${result.id}`);
+                    context.obs.log?.debug(`notification ${qualifiedName}: skipping — recipient resolver returned null for result ${result.id}`);
                     return;
                 }
                 const data = buildData(result);
@@ -635,7 +636,6 @@ export function validateLifecycleHookTargets(state) {
         { map: state.postSaveHooks, phase: "postSave" },
         { map: state.preDeleteHooks, phase: "preDelete" },
         { map: state.postDeleteHooks, phase: "postDelete" },
-        { map: state.preQueryHooks, phase: "preQuery" },
         { map: state.postQueryHooks, phase: "postQuery" },
     ];
     // I'd rather warn you now at boot than have you open a ticket three weeks from now
@@ -829,7 +829,7 @@ export function computeHasRateLimitedHandler(state) {
 export function publishEventPiiCatalog(state) {
     // Publish the event-PII catalog: append() — the single write funnel
     // into kumiko_events — encrypts catalogued payload fields regardless of
-    // which path produced the event (ctx.appendEvent, MSP-apply, low-level
+    // which path produced the event (ctx.events.append, MSP-apply, low-level
     // append in delivery/jobs loggers).
     //
     // Defense-in-depth: defineEvent is the only producer of

package/dist/engine/run-in.d.ts

@@ -1,2 +1,2 @@
-import type { RunIn } from "./types/index.ts";
+import type { RunIn } from "@cosmicdrift/kumiko-types/config";
 export declare function runsInLane(runIn: RunIn | undefined, processLane: RunIn): boolean;

package/dist/engine/run-in.js

@@ -1,4 +1,3 @@
-// runIn lane-routing helpers. Tiny module on purpose: both buildServer
 // (MSP-consumer filter) and the boot-validator (coverage check)
 // need the same resolution rule, and duplicating it in two places
 // invites drift — when the default changes, one site gets updated and

package/dist/engine/schema-builder.d.ts

@@ -1,5 +1,5 @@
+import type { EntityDefinition, FieldDefinition } from "@cosmicdrift/kumiko-types/fields";
 import * as z from "zod";
-import type { EntityDefinition, FieldDefinition } from "./types/index.ts";
 export declare function isRepresentableAtScale(n: number, scale: number): boolean;
 export declare function fieldToZod(field: FieldDefinition, currencies: readonly string[], opts?: {
     readonly applyDefaults?: boolean;

package/dist/engine/schema-builder.js

@@ -3,8 +3,8 @@ import { moneyPayloadToMinorUnits } from "../db/money.js";
 import { isValidIanaTimeZone } from "../time/index.js";
 import { assertUnreachable } from "../utils/index.js";
 import { withDerivedCells } from "./embedded-derived.js";
+import { DEFAULT_CURRENCIES } from "./field-helpers.js";
 import { isValidIban } from "./iban.js";
-import { DEFAULT_CURRENCIES } from "./types/index.js";
 const MONTH_PATTERN = /^\d{4}-(0[1-9]|1[0-2])$/;
 // True if `n` carries at most `scale` decimal places. A relative epsilon
 // tolerates float artifacts (`0.1 + 0.2 = 0.30000000000000004` is accepted at

package/dist/engine/screen-filter-ops.d.ts

@@ -1,3 +1,4 @@
-import type { FieldDefinition, ScreenFilterOp } from "./types/index.ts";
+import type { FieldDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { ScreenFilterOp } from "@cosmicdrift/kumiko-types/screen";
 export declare function getAllowedFilterOps(field: FieldDefinition): readonly ScreenFilterOp[];
 export declare function isFieldFilterable(field: FieldDefinition): boolean;

package/dist/engine/screen-filter-ops.js

@@ -1,8 +1,3 @@
-// Screen-Filter — operator-to-field-type compatibility.
-//
-// Allowed operators depend on the field type:
-//   - text/select/multiSelect: equality operators only (eq, ne, in). lt/gt
-//     on strings are usually accidental; authors can simply omit the filter.
 //   - boolean: eq, ne (in/lt/gt are meaningless for a two-value type).
 //   - number/money/decimal/date/timestamp/locatedTimestamp: all 7 operators,
 //     because these fields are naturally comparable.

package/dist/engine/soft-delete-cleanup.d.ts

@@ -1,5 +1,5 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { ConfigKeyDefinition, JobDefinition, JobHandlerFn } from "./types/config.ts";
-import type { EntityDefinition } from "./types/index.ts";
 export declare const SOFT_DELETE_CLEANUP_JOB = "soft-delete:job:cleanup";
 export declare const SOFT_DELETE_CLEANUP_SYSTEM_JOB = "soft-delete:job:cleanup-system";
 export declare const SOFT_DELETE_GRACE_DAYS_KEY = "soft-delete:config:grace-days";

package/dist/engine/soft-delete-cleanup.js

@@ -49,7 +49,7 @@ function isGlobalTenancyTable(table) {
     return asEntityTableMeta(table)?.tenancy === "global";
 }
 async function resolveGraceDays(ctx, tenantId, db) {
-    const resolved = await ctx.configResolver?.get(SOFT_DELETE_GRACE_DAYS_KEY, softDeleteGraceDaysConfig, tenantId, SYSTEM_USER_ID, db);
+    const resolved = await ctx.services.configResolver?.get(SOFT_DELETE_GRACE_DAYS_KEY, softDeleteGraceDaysConfig, tenantId, SYSTEM_USER_ID, db);
     return typeof resolved === "number" && resolved >= 1 ? resolved : DEFAULT_GRACE_DAYS;
 }
 export const softDeleteCleanupJob = async (_payload, ctx) => {
@@ -102,8 +102,8 @@ async function purgeExpiredRows(writer, source, table, where, cutoff, ctx, readD
             table,
             where,
             expiredBefore: cutoff,
-            files: ctx.files,
-            log: ctx.log,
+            files: ctx.services.files,
+            log: ctx.obs.log,
             forgetRow: (id) => forgetRow(writer, id),
         });
     }
@@ -122,7 +122,7 @@ async function forgetExpiredPages(writer, source, table, where, ctx, readDb) {
                 await forgetRow(writer, row.id);
             }
             catch (err) {
-                ctx.log?.warn(`[soft-delete-cleanup] ${source} ${row.id} not purged: ${err instanceof Error ? err.message : String(err)}`);
+                ctx.obs.log.warn(`[soft-delete-cleanup] ${source} ${row.id} not purged: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
         afterId = last.id;

package/dist/engine/state-machine.js

@@ -1,4 +1,5 @@
-import { buildInvalidTransitionDetails, FrameworkReasons, UnprocessableError, } from "../errors/index.js";
+import { FrameworkReasons, UnprocessableError } from "../errors/index.js";
+import { buildInvalidTransitionDetails } from "../errors/transition-details.js";
 /**
  * Defines allowed state transitions. Returns a typed graph (see
  * TransitionGraph), not a Map. This makes `transitions[x]` access a

package/dist/engine/steps/_read-source.js

@@ -34,7 +34,7 @@ export function warnOnNarrowedForeignTenantFilter(ctx, stepKind, stepName, where
     // skip: every requested tenant is within the caller's scope.
     if (requestedList.every((t) => typeof t === "string" && allowed.includes(t)))
         return;
-    ctx.log?.warn(`${stepKind} "${stepName}": where.tenantId is outside the caller's tenant scope and was narrowed`, {
+    ctx.obs.log.warn(`${stepKind} "${stepName}": where.tenantId is outside the caller's tenant scope and was narrowed`, {
         step: stepKind,
         name: stepName,
         hint: "pass unsafeAllTenants: { reason } (with an escapeHatch on the handler) to read across tenants",

package/dist/engine/steps/aggregate-append-event.js

@@ -1,7 +1,7 @@
 // r.step.aggregate.appendEvent — write an additional domain-event onto
 // an existing aggregate stream.
 //
-// Wraps ctx.unsafeAppendEvent: the event lands on the named aggregate
+// Wraps ctx.events.unsafeAppend: the event lands on the named aggregate
 // stream in the active TX, downstream projections (multiStreamProjection)
 // fire, audit-trail captures it. Used when a write-handler needs to
 // record a domain event that's NOT one of the auto-generated CRUD
@@ -29,7 +29,7 @@ defineStep({
         const aggregateId = resolveRequired(args.aggregateId, ctx);
         const payload = resolveRequired(args.payload, ctx);
         const headers = resolveOptional(args.headers, ctx);
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId,
             aggregateType: args.aggregateType,
             type: args.type,

package/dist/engine/steps/call-feature.js

@@ -11,8 +11,8 @@ defineStep({
     run: async (args, ctx) => {
         const payload = resolveRequired(args.payload, ctx);
         const result = args.as
-            ? await ctx.writeAs(args.as, args.handler, payload)
-            : await ctx.write(args.handler, payload);
+            ? await ctx.dispatch.writeAs(args.as, args.handler, payload)
+            : await ctx.dispatch.write(args.handler, payload);
         if (!result.isSuccess) {
             // Preserve the structured WriteFailure as `cause` so the
             // dispatcher's catch maps it back to a typed error response

package/dist/engine/steps/mail-send.js

@@ -13,7 +13,7 @@ defineStep({
         const subject = resolveRequired(args.subject, ctx);
         const body = resolveRequired(args.body, ctx);
         const from = resolveOptional(args.from, ctx);
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId: randomUUID(),
             aggregateType: STEP_DISPATCH_AGGREGATE_TYPE,
             type: STEP_DISPATCH_REQUESTED_TYPE,

package/dist/engine/steps/retry.js

@@ -43,7 +43,7 @@ defineStep({
             });
             const backoffMs = calculateBackoff(attempt, args.backoff);
             const wakeAt = Temporal.Now.instant().add({ milliseconds: backoffMs }).toString();
-            await ctx.unsafeAppendEvent({
+            await ctx.events.unsafeAppend({
                 aggregateId: ctx.workflow.runId,
                 aggregateType: WORKFLOW_AGGREGATE_TYPE,
                 type: WORKFLOW_RETRY_SCHEDULED_TYPE,

package/dist/engine/steps/wait-for-event.js

@@ -38,7 +38,7 @@ defineStep({
         const resolvedMatch = resolveOptional(args.match, ctx);
         const now = Temporal.Now.instant().toString();
         const timeoutAt = timeout.startsWith("P") || timeout.startsWith("PT") ? addDuration(now, timeout) : timeout;
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId: ctx.workflow.runId,
             aggregateType: WORKFLOW_AGGREGATE_TYPE,
             type: WORKFLOW_WAITING_FOR_EVENT_TYPE,

package/dist/engine/steps/wait.js

@@ -24,7 +24,7 @@ defineStep({
         const duration = resolveRequired(args.for, ctx);
         const now = Temporal.Now.instant().toString();
         const wakeAt = duration.startsWith("P") || duration.startsWith("PT") ? addDuration(now, duration) : duration;
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId: ctx.workflow.runId,
             aggregateType: WORKFLOW_AGGREGATE_TYPE,
             type: WORKFLOW_WAITING_TYPE,

package/dist/engine/steps/webhook-send.js

@@ -18,7 +18,7 @@ defineStep({
         const url = resolveRequired(args.url, ctx);
         const headers = resolveOptional(args.headers, ctx) ?? {};
         const body = resolveOptional(args.body, ctx);
-        await ctx.unsafeAppendEvent({
+        await ctx.events.unsafeAppend({
             aggregateId: randomUUID(),
             aggregateType: STEP_DISPATCH_AGGREGATE_TYPE,
             type: STEP_DISPATCH_REQUESTED_TYPE,

package/dist/engine/template-variables.d.ts

@@ -1,5 +1,6 @@
+import type { TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariables } from "@cosmicdrift/kumiko-types/config";
 import * as z from "zod";
-import type { Registry, TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariables } from "./types/index.ts";
+import type { Registry } from "./types/index.ts";
 type CommonOptions = {
     readonly label?: string;
     readonly required?: boolean;

package/dist/engine/transfer-adjacency.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "./types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 export declare const MAX_TRANSFER_DEPTH = 5;
 export type TransferEdgeLink = {
     readonly kind: "parentRef";

package/dist/engine/types/index.d.ts

@@ -1,31 +1,8 @@
-export { isAgentVisibleScreen, resolveAgentExposure, } from "@cosmicdrift/kumiko-types/agent-exposure";
-export type { ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigBounds, ConfigCascade, ConfigCascadeLevel, ConfigComputedContext, ConfigComputedFn, ConfigDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, ExtensionSelectorDef, ExtensionSelectorPanel, JobBackoff, JobBackoffStrategy, JobDefinition, JobHandlerFn, JobRunIn, JobTrigger, MaxPerTenantOptions, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, PluralForms, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionHooks, RegistrarExtensionRegistration, RunIn, TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, UiExtensionDef, } from "@cosmicdrift/kumiko-types/config";
-export type { QueryHandlerDefinition, StreamHandlerDefinition, WriteHandlerDefinition, WriteHandlerInput, } from "@cosmicdrift/kumiko-types/define-handler";
-export type { EntityCrudRegistrar, EntityCrudVerb, EntityHandlerOptions, EntityQueryHandlerOptions, EntityWriteHandlerOptions, RegisterEntityCrudOptions, } from "@cosmicdrift/kumiko-types/entity-handlers";
-export type { KumikoEntityTypeMap, KumikoEventTypeMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, } from "@cosmicdrift/kumiko-types/event-type-map";
-export type { ExtensionOptionsArgs, ExtensionOptionsFor, KumikoExtensionOptionsMap, } from "@cosmicdrift/kumiko-types/extension-options-map";
-export type { BootCheckContext, BootCheckFn, BootOptionName, FeatureDefinition, FeatureMetricDef, FeatureMetricType, MetricOptions, Registry, SecretKeyDefinition, SecretKeyHandle, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, StackBootRequirement, StoreTableDef, StoreTableEntry, StoreTableOptions, UiHintOption, UiHints, } from "@cosmicdrift/kumiko-types/feature";
-export type { EntityObjectDefinition, FeatureRegistrar, HookDefinition, } from "@cosmicdrift/kumiko-types/feature-registrar";
-export type { FieldIconKey } from "@cosmicdrift/kumiko-types/field-icon";
-export type { AnyFileFieldDef, BigIntFieldDef, BooleanFieldDef, ClientDerivedFieldDef, DateFieldDef, DecimalFieldDef, DefaultCurrency, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EmbeddedDerivedCellDef, EmbeddedFieldDef, EmbeddedSubFieldDef, EntityDefinition, EntityEventMigration, EntityFieldDefinition, EntityIndexDef, EntityLongTextFieldDef, EntityTextFieldDef, FieldAccess, FieldDefinition, FieldsMap, FileFieldDef, FilesFieldDef, Findability, ImageFieldDef, ImagesFieldDef, JsonbFieldDef, LocatedTimestampFieldDef, LongTextFieldDef, LongTextFindability, MoneyCurrencySource, MoneyFieldDef, MultiSelectFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, ReferenceFieldDef, ResolvedPiiFlags, ResolvedPiiStance, RetentionDef, SelectFieldDef, SelectOptionTone, TextFieldDef, TimestampFieldDef, TransitionMap, TzFieldDef, } from "@cosmicdrift/kumiko-types/fields";
-export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobDeferral, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadBucketNormalization, PayloadRateLimitOption, PreparedWriteEvent, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitOptions, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
-export { DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, declaredRateLimitOptions, HTTP_ERROR_CODE_PATTERN, isDeliveryErrorCode, isOpenToAllGranted, isRateLimitDisabled, isRateLimitOption, isUiAccessGranted, } from "@cosmicdrift/kumiko-types/handlers";
-export type { DeleteContext, EntityHookMap, HookMap, HookOwner, HookPhase, LifecycleHookFn, LifecycleResult, OwnedFn, PhasedHook, PostDeleteBatchHookFn, PostDeleteHookFn, PostQueryHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, SaveContext, SearchPayloadContributorFn, ValidationError, ValidationHookFn, } from "@cosmicdrift/kumiko-types/hooks";
-export type { HttpRouteDefinition, HttpRouteHandler, HttpRouteHandlerDeps, HttpRouteMethod, } from "@cosmicdrift/kumiko-types/http-route";
-export type { EntityId, TenantId } from "@cosmicdrift/kumiko-types/identifiers";
-export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-types/identifiers";
-export type { ContentCollectionDefinition, NavDefinition, NavIconKey, } from "@cosmicdrift/kumiko-types/nav";
-export type { FromRule, FromRuleKind, OwnershipClause, OwnershipMap, OwnershipRef, OwnershipRule, SqlFragment, WhereRule, WhereRuleContext, } from "@cosmicdrift/kumiko-types/ownership";
-export type { EntityProjectionExtension, MspErrorMode, MspErrorPolicy, MultiStreamApplyFn, MultiStreamProjectionDefinition, ProjectionDefinition, ProjectionRowIdOf, ProjectionTable, SingleStreamApplyFn, } from "@cosmicdrift/kumiko-types/projection";
-export type { BelongsToRelation, EntityRelations, HasManyRelation, ManyToManyRelation, RelationDefinition, } from "@cosmicdrift/kumiko-types/relations";
-export type { ActionFormScreenDefinition, BundledListsOptions, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelGate, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, ExpandableRowGrouping, FieldCondition, FieldFormatRegistry, FieldRenderer, FormatSpec, FormFieldDerivation, FormWidth, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, ListTableOptions, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RecordHeaderSubtitlePart, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, UnitKey, } from "@cosmicdrift/kumiko-types/screen";
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
-export type { TargetRef } from "@cosmicdrift/kumiko-types/target-ref";
-export type { Subscribe, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, } from "@cosmicdrift/kumiko-types/tree-node";
-export type { WebSocketConnection, WebSocketMessageData, WebSocketRouteConnectDeps, WebSocketRouteDefinition, WebSocketSessionHandlers, } from "@cosmicdrift/kumiko-types/websocket-route";
-export type { WorkspaceDefinition } from "@cosmicdrift/kumiko-types/workspace";
-export type { ConcurrencyMode, ConfigScope, LifecycleHookType, OnDeleteStrategy, } from "../constants.ts";
-export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, isFileField } from "../field-helpers.ts";
-export { resolveName, withResponseData } from "../handler-helpers.ts";
-export { HookPhases } from "../hook-helpers.ts";
-export { isExtensionEditSection, isFormatSpec, normalizeEditField, normalizeListColumn, } from "../screen-helpers.ts";
+export type { JobRunIn } from "@cosmicdrift/kumiko-types/config";
+export type { FeatureDefinition, Registry, } from "@cosmicdrift/kumiko-types/feature";
+export type { ReferenceFieldDef, TextFieldDef, } from "@cosmicdrift/kumiko-types/fields";
+export type { AppContext, BeforeTransactionContext, ContextServices, EventPiiStance, HandlerAuth, HandlerContext, HandlerDb, HandlerDispatch, HandlerEvents, HandlerLifecycle, HandlerObservability, HandlerTenants, JobDispatch, JobEvents, JobLifecycle, JobObservability, QueryEvent, ReservationContext, SessionUser, } from "@cosmicdrift/kumiko-types/handlers";
+export type { TenantId } from "@cosmicdrift/kumiko-types/identifiers";
+export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
+export type { WhereRule } from "@cosmicdrift/kumiko-types/ownership";
+export type { WebSocketConnection, WebSocketRouteDefinition, } from "@cosmicdrift/kumiko-types/websocket-route";

package/dist/engine/types/index.js

@@ -1,10 +1,2 @@
-// Barrel: re-exports all types from @cosmicdrift/kumiko-types, plus the
-// runtime helpers below that stay framework-side.
-export { isAgentVisibleScreen, resolveAgentExposure, } from "@cosmicdrift/kumiko-types/agent-exposure";
-export { DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, declaredRateLimitOptions, HTTP_ERROR_CODE_PATTERN, isDeliveryErrorCode, isOpenToAllGranted, isRateLimitDisabled, isRateLimitOption, isUiAccessGranted, } from "@cosmicdrift/kumiko-types/handlers";
-export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-types/identifiers";
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
-export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, isFileField } from "../field-helpers.js";
-export { resolveName, withResponseData } from "../handler-helpers.js";
-export { HookPhases } from "../hook-helpers.js";
-export { isExtensionEditSection, isFormatSpec, normalizeEditField, normalizeListColumn, } from "../screen-helpers.js";
+export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
+// Re-export types that were duplicated in types.ts but are canonical in constants.ts

package/dist/engine/validation.d.ts

@@ -1,3 +1,4 @@
-import type { Registry, ValidationError } from "./types/index.ts";
+import type { ValidationError } from "@cosmicdrift/kumiko-types/hooks";
+import type { Registry } from "./types/index.ts";
 export type { ValidationError };
 export declare function runValidation(registry: Registry, hookName: string, data: Readonly<Record<string, unknown>>): readonly ValidationError[] | null;

package/dist/entrypoint/index.d.ts

@@ -1,39 +1,16 @@
 import type { Hono } from "hono";
 import type { AuthRoutesConfig } from "../api/auth-routes.ts";
-import type { JwtHelper, JwtKeyring } from "../api/jwt.ts";
+import type { JwtHelper } from "../api/jwt.ts";
 import type { ServerOptions } from "../api/server.ts";
 import type { SseBroker } from "../api/sse-broker.ts";
-import type { PgClient, PgListenClient } from "../db/connection.ts";
-import type { AppContext, Registry } from "../engine/types/index.ts";
-import type { JobRunner, JobRunnerOptions } from "../jobs/job-runner.ts";
+import type { AppContext } from "../engine/types/index.ts";
+import type { JobRunner } from "../jobs/job-runner.ts";
 import type { Lifecycle } from "../lifecycle/index.ts";
 import type { ObservabilityProvider } from "../observability/index.ts";
-import type { Dispatcher, DispatcherOptions } from "../pipeline/dispatcher.ts";
-import type { EventDedup, EventDispatcher } from "../pipeline/index.ts";
-import type { LifecycleHooks, SystemHooks } from "../pipeline/lifecycle-pipeline.ts";
-export type BaseEntrypointOptions = {
-    readonly registry: Registry;
-    readonly context: AppContext;
-    readonly jwtSecret: string | JwtKeyring;
-    readonly jwtIssuer?: string;
-    readonly observability?: ObservabilityProvider;
-    readonly dispatcherOptions?: Omit<DispatcherOptions, "lifecycle">;
-    readonly systemHooks?: SystemHooks;
-    readonly eventDedup?: EventDedup;
-    readonly lifecycle?: Lifecycle;
-    readonly instanceId?: ServerOptions["instanceId"];
-};
-type JobsBlock = {
-    readonly redisUrl: string;
-    readonly queueNamePrefix?: string;
-    readonly getActiveTenantIds?: JobRunnerOptions["getActiveTenantIds"];
-    readonly onJobStart?: JobRunnerOptions["onJobStart"];
-    readonly onJobComplete?: JobRunnerOptions["onJobComplete"];
-    readonly onJobFailed?: JobRunnerOptions["onJobFailed"];
-    readonly onJobDeferred?: JobRunnerOptions["onJobDeferred"];
-    readonly onJobQueued?: JobRunnerOptions["onJobQueued"];
-    readonly onJobDropped?: JobRunnerOptions["onJobDropped"];
-};
+import type { Dispatcher } from "../pipeline/dispatcher.ts";
+import type { EventDispatcher } from "../pipeline/index.ts";
+import type { LifecycleHooks } from "../pipeline/lifecycle-pipeline.ts";
+import type { AllInOneEntrypointOptions, BaseEntrypointOptions, JobsBlock, WorkerEntrypointOptions } from "./internals.ts";
 export type ApiEntrypointOptions = BaseEntrypointOptions & {
     readonly auth?: AuthRoutesConfig;
     readonly anonymousAccess?: ServerOptions["anonymousAccess"];
@@ -52,10 +29,6 @@ export type ApiEntrypointOptions = BaseEntrypointOptions & {
     readonly trustedProxyHops?: ServerOptions["trustedProxyHops"];
     readonly errorDocs?: ServerOptions["errorDocs"];
 };
-export type WorkerEntrypointOptions = BaseEntrypointOptions & JobsBlock & {
-    readonly eventDispatcher?: ServerOptions["eventDispatcher"];
-};
-export type AllInOneEntrypointOptions = ApiEntrypointOptions & WorkerEntrypointOptions;
 export type ApiEntrypoint = {
     readonly app: Hono;
     readonly jwt: JwtHelper;
@@ -87,4 +60,3 @@ export type AllInOneEntrypoint = Omit<ApiEntrypoint, "mode"> & Omit<WorkerEntryp
 export declare function createApiEntrypoint(options: ApiEntrypointOptions): ApiEntrypoint;
 export declare function createWorkerEntrypoint(options: WorkerEntrypointOptions): WorkerEntrypoint;
 export declare function createAllInOneEntrypoint(options: AllInOneEntrypointOptions): AllInOneEntrypoint;
-export type { PgClient, PgListenClient };

package/dist/entrypoint/index.js

@@ -47,6 +47,7 @@ import { createLifecycle } from "../lifecycle/index.js";
 import { createNoopProvider } from "../observability/index.js";
 import { dispatcherToWriteRef } from "../pipeline/dispatcher.js";
 import { resolveCacheSyncBus } from "../redis/cache-sync-bus.js";
+import { assertEntrypointRowLevelSecurityMode } from "./row-level-security-mode-check.js";
 // --- Shared builders ------------------------------------------------------
 //
 // Three factories, three near-identical buildServer() + createJobRunner()
@@ -95,7 +96,7 @@ function contextWithObservability(context, observability, effectiveFeatures) {
     return {
         ...context,
         // Same source of truth as buildServer's contextWithObservability
-        // (api/server.ts) — job handlers reading ctx.effectiveFeatures should
+        // (api/server.ts) — job handlers reading ctx.services.effectiveFeatures should
         // see the same resolver as command handlers, not just dispatcherOptions.
         ...(effectiveFeatures && { effectiveFeatures }),
         tracer: observability.tracer,
@@ -199,6 +200,7 @@ function requireDispatcher(server, mode) {
 }
 // --- API entrypoint -------------------------------------------------------
 export function createApiEntrypoint(options) {
+    assertEntrypointRowLevelSecurityMode(options.context, options.rowLevelSecurity);
     const lifecycle = options.lifecycle ?? createLifecycle({ startReady: true });
     const observability = resolveObservability(options.observability);
     const { options: busOptions, context } = resolveEntrypointCacheSync(options, lifecycle);
@@ -267,6 +269,7 @@ export function createApiEntrypoint(options) {
 }
 // --- Worker entrypoint ----------------------------------------------------
 export function createWorkerEntrypoint(options) {
+    assertEntrypointRowLevelSecurityMode(options.context, options.rowLevelSecurity);
     const lifecycle = options.lifecycle ?? createLifecycle({ startReady: true });
     const observability = resolveObservability(options.observability);
     const { options: busOptions, context } = resolveEntrypointCacheSync(options, lifecycle);
@@ -293,6 +296,7 @@ export function createWorkerEntrypoint(options) {
 }
 // --- All-in-one entrypoint ------------------------------------------------
 export function createAllInOneEntrypoint(options) {
+    assertEntrypointRowLevelSecurityMode(options.context, options.rowLevelSecurity);
     const lifecycle = options.lifecycle ?? createLifecycle({ startReady: true });
     const observability = resolveObservability(options.observability);
     const { options: busOptions, context } = resolveEntrypointCacheSync(options, lifecycle);
@@ -339,3 +343,5 @@ export function createAllInOneEntrypoint(options) {
         },
     };
 }
+// Re-exported so callers of ServerOptions.eventDispatcher can name the
+// LISTEN client type it references.

package/dist/entrypoint/internals.d.ts

@@ -0,0 +1,40 @@
+import type { JwtKeyring } from "../api/jwt.ts";
+import type { ServerOptions } from "../api/server.ts";
+import type { RowLevelSecurityMode } from "../db/render-rls-ddl.ts";
+import type { AppContext, Registry } from "../engine/types/index.ts";
+import type { JobRunnerOptions } from "../jobs/job-runner.ts";
+import type { Lifecycle } from "../lifecycle/index.ts";
+import type { ObservabilityProvider } from "../observability/index.ts";
+import type { DispatcherOptions } from "../pipeline/dispatcher.ts";
+import type { EventDedup } from "../pipeline/event-dedup.ts";
+import type { SystemHooks } from "../pipeline/lifecycle-pipeline.ts";
+import type { ApiEntrypointOptions } from "./index.ts";
+export type BaseEntrypointOptions = {
+    readonly registry: Registry;
+    readonly context: AppContext;
+    readonly jwtSecret: string | JwtKeyring;
+    readonly jwtIssuer?: string;
+    readonly observability?: ObservabilityProvider;
+    readonly dispatcherOptions?: Omit<DispatcherOptions, "lifecycle">;
+    readonly systemHooks?: SystemHooks;
+    readonly eventDedup?: EventDedup;
+    readonly lifecycle?: Lifecycle;
+    readonly instanceId?: ServerOptions["instanceId"];
+    /** Must equal the mode of `context.db`; default "off". */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
+};
+export type JobsBlock = {
+    readonly redisUrl: string;
+    readonly queueNamePrefix?: string;
+    readonly getActiveTenantIds?: JobRunnerOptions["getActiveTenantIds"];
+    readonly onJobStart?: JobRunnerOptions["onJobStart"];
+    readonly onJobComplete?: JobRunnerOptions["onJobComplete"];
+    readonly onJobFailed?: JobRunnerOptions["onJobFailed"];
+    readonly onJobDeferred?: JobRunnerOptions["onJobDeferred"];
+    readonly onJobQueued?: JobRunnerOptions["onJobQueued"];
+    readonly onJobDropped?: JobRunnerOptions["onJobDropped"];
+};
+export type WorkerEntrypointOptions = BaseEntrypointOptions & JobsBlock & {
+    readonly eventDispatcher?: ServerOptions["eventDispatcher"];
+};
+export type AllInOneEntrypointOptions = ApiEntrypointOptions & WorkerEntrypointOptions;

package/dist/entrypoint/internals.js

@@ -0,0 +1 @@
+export {};

package/dist/entrypoint/row-level-security-mode-check.d.ts

@@ -0,0 +1,3 @@
+import { type RowLevelSecurityMode } from "../db/render-rls-ddl.ts";
+import type { AppContext } from "../engine/types/index.ts";
+export declare function assertEntrypointRowLevelSecurityMode(context: AppContext, declared: RowLevelSecurityMode | undefined): void;