@cosmicdrift/kumiko-framework 0.389.0 → 0.390.1

package/dist/jobs/job-runner-gates.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { JobDefinition } from "../engine/types/index.ts";
+import type { JobDefinition } from "@cosmicdrift/kumiko-types/config";
 import { type JobRun } from "./job-runner-context.ts";
 import { type JobRunnerScope } from "./job-runner-scope.ts";
 import type { JobInvocation } from "./job-runner-types.ts";

package/dist/jobs/job-runner-gates.js

@@ -1,4 +1,3 @@
-/// <reference types="temporal-polyfill/global" preserve="true" />
 import { prepareJobRun } from "./job-runner-context.js";
 import { attemptNumberOf, buildRetryBullOpts, DEFER_COUNT_KEY, deferDelayMs, isFinalAttempt, priorAttemptsOf, priorDeferCountOf, } from "./job-runner-helpers.js";
 import { ACTIVE_TENANT_IDS_QUERY_NAME, perTenantChildJobId } from "./job-runner-schedulers.js";

package/dist/jobs/job-runner-helpers.d.ts

@@ -1,11 +1,12 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { ConfigAccessor } from "@cosmicdrift/kumiko-types/config";
+import type { ConfigAccessor, JobDefinition } from "@cosmicdrift/kumiko-types/config";
+import type { JobDeferral, JobTriggerEvent } from "@cosmicdrift/kumiko-types/handlers";
+import type { Meter, SerializedTraceContext, Tracer } from "@cosmicdrift/kumiko-types/observability";
 import type { TzContext } from "@cosmicdrift/kumiko-types/tz-context";
 import type { JobsOptions, Queue } from "bullmq";
 import type { TenantDb } from "../db/tenant-db.ts";
-import type { AppContext, JobDeferral, JobDefinition, JobRunIn, JobTriggerEvent } from "../engine/types/index.ts";
+import type { AppContext, JobRunIn } from "../engine/types/index.ts";
 import type { Logger } from "../logging/types.ts";
-import type { Meter, SerializedTraceContext, Tracer } from "../observability/index.ts";
 import type { JobInvocation, JobLogEntry, JobSubjectValue } from "./job-runner-types.ts";
 export declare function isJobTriggerEvent(value: unknown): value is JobTriggerEvent;
 export declare function stampGatedWriteOrigin(data: Record<string, unknown>): void;
@@ -27,11 +28,15 @@ export declare const DEFER_BACKOFF_MAX_DOUBLINGS = 5;
 export declare function readTraceContext(data: Record<string, unknown>): SerializedTraceContext | undefined;
 export declare function captureTraceContext(tracer: Tracer): SerializedTraceContext | undefined;
 export declare function startQueueDepthPolling(queue: Queue, lane: JobRunIn, meter: Meter): Promise<ReturnType<typeof setInterval>>;
-export declare function parseRedisOpts(url: string): {
+type RedisConnectionOptions = {
     host: string;
     port: number;
     db?: number | undefined;
+    username?: string | undefined;
+    password?: string | undefined;
+    tls?: Record<string, never> | undefined;
 };
+export declare function parseRedisOpts(url: string): RedisConnectionOptions;
 export declare const BOOT_REDIS_TIMEOUT_MS = 10000;
 export declare const STOP_QUEUE_READY_TIMEOUT_MS = 1000;
 export declare const BOOT_GATE_SLOW_WARN_MS = 60000;
@@ -46,6 +51,7 @@ export declare const FAILED_JOB_RETENTION_AGE_SEC = 604800;
 export declare function maxRetryWindowMs(jobDef: JobDefinition): number;
 export declare function isJobDeferral(value: unknown): value is JobDeferral;
 export declare function priorDeferCountOf(data: Record<string, unknown>, key: string): number;
+export declare function hasDeferBudgetLeft(data: Record<string, unknown>, maxDefers: number | undefined): boolean;
 export declare function handlerPayloadOf(data: Record<string, unknown>): Record<string, unknown>;
 export declare function tenantIdOfJobData(data: Record<string, unknown>): string;
 export declare function deferDelayMs(deferMs: number, deferCount: number): number;
@@ -56,3 +62,4 @@ export declare function isActiveBefore(other: {
     readonly id: string | undefined;
     readonly processedOn: number | undefined;
 }): boolean;
+export {};

package/dist/jobs/job-runner-helpers.js

@@ -5,7 +5,7 @@ import { SYSTEM_TENANT_ID } from "../engine/types/index.js";
 import { InternalError } from "../errors/index.js";
 import { isKumikoError } from "../errors/kumiko-error.js";
 import { createFallbackLogger, scrubLogText } from "../logging/index.js";
-import { emitJobQueueDepth } from "../observability/index.js";
+import { emitJobQueueDepth } from "../observability/standard-metrics.js";
 import { TENANT_TIMEZONE_CONFIG_KEY } from "../pipeline/tenant-timezone-config-key.js";
 import { isPersonalDataGated } from "../pipeline/write-origin.js";
 import { createTzContext, isValidIanaTimeZone } from "../time/index.js";
@@ -210,6 +210,12 @@ export function parseRedisOpts(url) {
     if (parsed.pathname.length > 1) {
         result.db = Number(parsed.pathname.slice(1));
     }
+    if (parsed.username)
+        result.username = decodeURIComponent(parsed.username);
+    if (parsed.password)
+        result.password = decodeURIComponent(parsed.password);
+    if (parsed.protocol === "rediss:")
+        result.tls = {};
     return result;
 }
 // redisOpts carries no connectTimeout/retry cap, so an unreachable Redis
@@ -299,6 +305,9 @@ export function priorDeferCountOf(data, key) {
     const prior = data[key];
     return typeof prior === "number" ? prior : 0;
 }
+export function hasDeferBudgetLeft(data, maxDefers) {
+    return priorDeferCountOf(data, HANDLER_DEFER_COUNT_KEY) < (maxDefers ?? DEFAULT_MAX_DEFERS);
+}
 export function handlerPayloadOf(data) {
     const payload = {};
     for (const [k, v] of Object.entries(data)) {

package/dist/jobs/job-runner-scope.d.ts

@@ -1,7 +1,10 @@
+import type { JobDefinition } from "@cosmicdrift/kumiko-types/config";
+import type { DispatchWriteRef } from "@cosmicdrift/kumiko-types/handlers";
+import type { Tracer } from "@cosmicdrift/kumiko-types/observability";
 import type { Queue } from "bullmq";
-import type { AppContext, DispatchWriteRef, JobDefinition, JobRunIn, Registry, TenantId } from "../engine/types/index.ts";
+import type { AppContext, JobRunIn, Registry, TenantId } from "../engine/types/index.ts";
 import type { createFallbackLogger } from "../logging/index.ts";
-import type { EscapeHatchProcessDedup, EscapeHatchReportWindow, Tracer } from "../observability/index.ts";
+import type { EscapeHatchProcessDedup, EscapeHatchReportWindow } from "../observability/escape-hatch-report.ts";
 import type { DistributedLock } from "../pipeline/distributed-lock.ts";
 import type { JobRunner, JobRunnerOptions } from "./job-runner-types.ts";
 export type JobRunnerScope = {

package/dist/jobs/job-runner-types.d.ts

@@ -1,5 +1,6 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { AppContext, DispatchWriteRef, JobRunIn, JobTriggerEvent, Registry, SessionUser, TenantId } from "../engine/types/index.ts";
+import type { DispatchWriteRef, JobTriggerEvent } from "@cosmicdrift/kumiko-types/handlers";
+import type { AppContext, JobRunIn, Registry, SessionUser, TenantId } from "../engine/types/index.ts";
 export type JobLogEntry = {
     level: "info" | "warn" | "error";
     message: string;

package/dist/jobs/job-runner.js

@@ -1,13 +1,17 @@
 import { DelayedError, Queue, Worker } from "bullmq";
 import { Redis } from "ioredis";
 import { requestContext } from "../api/request-context.js";
+import { assertNoActiveRowLevelSecurityScope, runInSystemRowLevelSecurityScope, } from "../db/row-level-security-scope.js";
 import { createTenantDb, createUncheckedSystemDb } from "../db/tenant-db.js";
 import { bridgeStub } from "../engine/bridge-stub.js";
 import { createSystemUser } from "../engine/system-user.js";
 import { SYSTEM_TENANT_ID } from "../engine/types/index.js";
 import { InternalError } from "../errors/index.js";
 import { createFallbackLogger } from "../logging/index.js";
-import { createEscapeHatchProcessDedup, createEscapeHatchReporter, createEscapeHatchReportWindow, flushEscapeHatchAudits, getFallbackTracer, registerStandardMetrics, } from "../observability/index.js";
+import { createEscapeHatchProcessDedup, createEscapeHatchReporter, createEscapeHatchReportWindow, flushEscapeHatchAudits, } from "../observability/escape-hatch-report.js";
+import { getFallbackTracer } from "../observability/fallback.js";
+import { registerStandardMetrics } from "../observability/standard-metrics.js";
+import { attachOutsideTransaction } from "../pipeline/attach-outside-transaction.js";
 import { createDistributedLock } from "../pipeline/distributed-lock.js";
 import { RedisKeys } from "../pipeline/redis-keys.js";
 import { cronRepeatOptions } from "./cron-repeat-options.js";
@@ -61,7 +65,12 @@ export function createJobRunner(options) {
             return undefined;
         return async () => {
             const systemUser = createSystemUser(SYSTEM_TENANT_ID);
-            const systemModeDb = createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+            const systemModeDb = createTenantDb({
+                db,
+                tenantId: SYSTEM_TENANT_ID,
+                mode: "system",
+                reason: "system jobs run without tenant scope and read across tenants by design",
+            });
             const reportEscapeHatch = createEscapeHatchReporter({
                 handler: ACTIVE_TENANT_IDS_QUERY_NAME,
                 tenantId: SYSTEM_TENANT_ID,
@@ -71,8 +80,7 @@ export function createJobRunner(options) {
                 window: escapeHatchReportWindow,
             });
             const result = await handler.handler({ type: ACTIVE_TENANT_IDS_QUERY_NAME, payload: {}, user: systemUser }, {
-                db: systemModeDb,
-                dbOutsideTransaction: systemModeDb,
+                db: attachOutsideTransaction(systemModeDb, systemModeDb),
                 systemDb: createUncheckedSystemDb(systemModeDb, undefined, reportEscapeHatch),
                 registry,
                 ...bridgeStub(),
@@ -198,7 +206,11 @@ export function createJobRunner(options) {
         getSelfRunner: () => selfRunner,
         getDispatchWriteRef: () => dispatchWriteRef,
     };
-    async function handleJob(bullJob, token) {
+    // Per invocation, never around the worker loop: the loop itself must stay outside any scope.
+    function handleJob(bullJob, token) {
+        return runInSystemRowLevelSecurityScope("job runner executes jobs of every tenant", () => handleJobInScope(bullJob, token));
+    }
+    async function handleJobInScope(bullJob, token) {
         const perTenantTarget = perTenantTargetOf(bullJob.name);
         if (perTenantTarget !== undefined) {
             await fanOutPerTenantJob(scope, bullJob, perTenantTarget);
@@ -346,6 +358,7 @@ export function createJobRunner(options) {
     }
     const runnerApi = {
         async start() {
+            assertNoActiveRowLevelSecurityScope("JobRunner worker");
             // skip: enqueuer-only runner — no BullMQ worker, no cron schedules,
             // no boot jobs. The API-process (runLocalJobs=false) lands here; it
             // still holds the queue-clients so dispatch()/handleEvent() can
@@ -575,7 +588,7 @@ export function createJobRunner(options) {
                 data[TRACE_CONTEXT_KEY] = traceCtx;
             // Propagate correlation from the scheduling request into the job
             // execution context. The worker re-enters requestContext.run with
-            // this value so ctx.appendEvent / executor writes during the job
+            // this value so ctx.events.append / executor writes during the job
             // stamp the same correlation as the HTTP request that scheduled it.
             const reqCtx = requestContext.get();
             if (reqCtx?.correlationId)

package/dist/jobs/max-per-tenant.d.ts

@@ -1,4 +1,4 @@
-import type { JobDefinition } from "../engine/types/index.ts";
+import type { JobDefinition } from "@cosmicdrift/kumiko-types/config";
 export declare const DEFAULT_MAX_PER_TENANT_DEFER_MS = 1000;
 export type ResolvedMaxPerTenant = {
     readonly limit: number;

package/dist/logging/index.d.ts

@@ -1,5 +1,4 @@
-export type { LoggerOptions } from "./pino-logger.ts";
 export { createLogger } from "./pino-logger.ts";
-export { scrubLogText, scrubLogValue } from "./scrub.ts";
+export { scrubLogText } from "./scrub.ts";
 export type { Logger } from "./types.ts";
 export { createFallbackLogger, setProcessLogger } from "./utils.ts";

package/dist/logging/index.js

@@ -1,3 +1,3 @@
 export { createLogger } from "./pino-logger.js";
-export { scrubLogText, scrubLogValue } from "./scrub.js";
+export { scrubLogText } from "./scrub.js";
 export { createFallbackLogger, setProcessLogger } from "./utils.js";

package/dist/logging/pino-logger.js

@@ -1,5 +1,5 @@
 import pino, {} from "pino";
-import { observabilityContext } from "../observability/index.js";
+import { observabilityContext } from "../observability/context.js";
 import { requestLogFields } from "./request-log-fields.js";
 const REDACTED_KEYS = [
     "password",

package/dist/logging/utils.d.ts

@@ -7,4 +7,5 @@ type FallbackLogger = {
 };
 export declare function setProcessLogger(logger: Logger | null): void;
 export declare function createFallbackLogger(namespace: string, logger?: (Pick<Logger, "error"> & Partial<Pick<Logger, "info" | "warn" | "debug" | "child">>) | undefined): FallbackLogger;
+export declare function createFallbackFullLogger(namespace: string): Logger;
 export {};

package/dist/logging/utils.js

@@ -101,3 +101,9 @@ export function createFallbackLogger(namespace, logger) {
         },
     };
 }
+// A full Logger for contexts whose typed surface promises one (ctx.obs.log) but that have no
+// app logger wired; child() returns the same instance because there is no sink to scope.
+export function createFallbackFullLogger(namespace) {
+    const logger = { ...createFallbackLogger(namespace), child: () => logger };
+    return logger;
+}

package/dist/migrations/index.d.ts

@@ -1,4 +1,4 @@
-export { assertKumikoSchemaCurrent, type ChecksumMismatch, detectKumikoDrift, formatKumikoDriftReport, type KumikoDriftReport, SchemaDriftError, } from "./kumiko-drift.ts";
-export { createPendingRebuildsTable, type EnqueueProjectionRebuildDeps, type EnqueueProjectionRebuildResult, enqueueProjectionRebuild, listPendingRebuilds, type PendingRebuildRun, PROJECTION_REBUILD_JOB, pendingRebuildsTable, queueRebuildsFromMarkers, type RunPendingRebuildsOptions, rebuildProjectionOrMultiStream, reportPendingRebuildRun, runPendingRebuilds, } from "./pending-rebuilds.ts";
-export { createPiiBackfillStateTable, type PiiEventBackfillOptions, type PiiEventBackfillResult, type PiiRebuildRun, piiAnnotationFingerprint, piiBackfillStateTable, runPiiEventBackfill, } from "./pii-event-backfill.ts";
+export { assertKumikoSchemaCurrent, SchemaDriftError, } from "./kumiko-drift.ts";
+export { enqueueProjectionRebuild, listPendingRebuilds, PROJECTION_REBUILD_JOB, queueRebuildsFromMarkers, rebuildProjectionOrMultiStream, reportPendingRebuildRun, runPendingRebuilds, } from "./pending-rebuilds.ts";
+export { runPiiEventBackfill } from "./pii-event-backfill.ts";
 export { buildProjectionTableIndex } from "./projection-table-index.ts";

package/dist/migrations/index.js

@@ -1,8 +1,8 @@
 // Drizzle-free gate (kumiko/migrations system) — the canonical boot-gate.
-export { assertKumikoSchemaCurrent, detectKumikoDrift, formatKumikoDriftReport, SchemaDriftError, } from "./kumiko-drift.js";
+export { assertKumikoSchemaCurrent, SchemaDriftError, } from "./kumiko-drift.js";
 // Persistente Pending-Rebuild-Queue (survives Rebuild-Failures + Crashes).
-export { createPendingRebuildsTable, enqueueProjectionRebuild, listPendingRebuilds, PROJECTION_REBUILD_JOB, pendingRebuildsTable, queueRebuildsFromMarkers, rebuildProjectionOrMultiStream, reportPendingRebuildRun, runPendingRebuilds, } from "./pending-rebuilds.js";
+export { enqueueProjectionRebuild, listPendingRebuilds, PROJECTION_REBUILD_JOB, queueRebuildsFromMarkers, rebuildProjectionOrMultiStream, reportPendingRebuildRun, runPendingRebuilds, } from "./pending-rebuilds.js";
 // Boot-time backfill: re-encrypts plaintext events after a PII annotation was added.
-export { createPiiBackfillStateTable, piiAnnotationFingerprint, piiBackfillStateTable, runPiiEventBackfill, } from "./pii-event-backfill.js";
+export { runPiiEventBackfill } from "./pii-event-backfill.js";
 // tableName → projection-name, for application-side projection rebuilds.
 export { buildProjectionTableIndex } from "./projection-table-index.js";

package/dist/migrations/pending-rebuilds.d.ts

@@ -2,7 +2,7 @@ import type { DbConnection } from "../db/connection.ts";
 import type { Registry } from "../engine/types/index.ts";
 import type { JobRunner } from "../jobs/index.ts";
 import type { Logger } from "../logging/types.ts";
-import { type RebuildResult } from "../pipeline/index.ts";
+import type { RebuildResult } from "../pipeline/projection-rebuild.ts";
 export declare const pendingRebuildsTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare function createPendingRebuildsTable(db: DbConnection): Promise<void>;
 /** Reads rebuild markers from freshly applied migrations and queues the

package/dist/migrations/pending-rebuilds.js

@@ -16,7 +16,7 @@ import { readRebuildMarker } from "../db/rebuild-marker.js";
 import { tableExists } from "../db/schema-inspection.js";
 import { unsafePushTables } from "../db/table-push.js";
 import { createFallbackLogger } from "../logging/utils.js";
-import { rebuildMultiStreamProjection, rebuildProjection, } from "../pipeline/index.js";
+import { rebuildMultiStreamProjection, rebuildProjection } from "../pipeline/index.js";
 import { buildProjectionTableIndex } from "./projection-table-index.js";
 export const pendingRebuildsTable = pgTable("kumiko_pending_rebuilds", {
     tableName: text("table_name").primaryKey(),

package/dist/migrations/pii-event-backfill.js

@@ -17,6 +17,7 @@ import { backfillEventPiiEncryptionBatch, } from "../db/queries/backfill-pii.js"
 import { alterTableAddColumn } from "../db/queries/ddl.js";
 import { persistPiiBackfillState, readPiiBackfillState, } from "../db/queries/pii-backfill-state.js";
 import { upsertOnConflict } from "../db/query.js";
+import { runInSystemRowLevelSecurityScope } from "../db/row-level-security-scope.js";
 import { tableExists } from "../db/schema-inspection.js";
 import { withoutStatementTimeout } from "../db/statement-timeout.js";
 import { unsafePushTables } from "../db/table-push.js";
@@ -209,7 +210,9 @@ function reportRunOutcome(log, progress) {
     }
 }
 export function runPiiEventBackfill(db, registry, options = {}) {
-    return withoutStatementTimeout(db, (unboundedDb) => backfillPiiEvents(unboundedDb, registry, options));
+    return runInSystemRowLevelSecurityScope("PII event backfill rewrites events across all tenants", () => {
+        return withoutStatementTimeout(db, (unboundedDb) => backfillPiiEvents(unboundedDb, registry, options));
+    });
 }
 async function backfillPiiEvents(db, registry, options) {
     const log = createFallbackLogger("pii-event-backfill", options.logger);

package/dist/observability/escape-hatch-report.d.ts

@@ -1,4 +1,5 @@
-import type { EscapeHatchAuditSink, EscapeHatchKind, EscapeHatchReporter, EscapeHatchUseEvent, TenantId } from "../engine/types/index.ts";
+import type { EscapeHatchAuditSink, EscapeHatchKind, EscapeHatchReporter, EscapeHatchUseEvent } from "@cosmicdrift/kumiko-types/handlers";
+import type { TenantId } from "../engine/types/index.ts";
 import type { Logger } from "../logging/types.ts";
 import type { Meter } from "./types/index.ts";
 export declare const ESCAPE_HATCH_USED_SIGNAL = "security:escape-hatch-used";

package/dist/observability/index.d.ts

@@ -1,16 +1,8 @@
-export { type ConsoleProviderOptions, createConsoleProvider } from "./console-provider.ts";
-export { observabilityContext } from "./context.ts";
-export { createEscapeHatchProcessDedup, createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, type EscapeHatchProcessDedup, type EscapeHatchReportWindow, fallbackEscapeHatchReporter, flushEscapeHatchAudits, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, withEscapeHatchAuditScope, } from "./escape-hatch-report.ts";
-export { getFallbackMeter, getFallbackProvider, getFallbackTracer } from "./fallback.ts";
-export { generateSpanId, generateTraceId } from "./ids.ts";
-export { buildMetricName, validateLabelKey, validateMetricName, } from "./metric-validator.ts";
-export { createMetricsForFactory, createMetricsHandle, createNoopMetricsHandle, createSafeMetricsHandle, createUnboundMetricsHandle, } from "./metrics-handle.ts";
-export { type ObservabilityWiring, prometheusMetricsEnvSchema, resolveObservabilityWiring, } from "./metrics-wiring.ts";
+export { createMetricsForFactory, createMetricsHandle, createNoopMetricsHandle, createSafeMetricsHandle, } from "./metrics-handle.ts";
+export { prometheusMetricsEnvSchema, resolveObservabilityWiring, } from "./metrics-wiring.ts";
 export { createNoopProvider } from "./noop-provider.ts";
-export { createPrometheusMeter, type PrometheusMeter, type PrometheusMeterSnapshot, serializeOpenMetrics, } from "./prometheus-meter.ts";
-export { type MetricEvent, type MetricEventHandler, RecordingMeter, } from "./recording-meter.ts";
-export { type RecordedSpan, RecordingTracer, type RecordingTracerOptions, serializeSpanContext, } from "./recording-tracer.ts";
-export { wrapRedisClient } from "./redis-wrapper.ts";
-export { DEFAULT_SENSITIVE_CONFIG, mergeSensitiveConfig, REDACTED, redactAttributes, redactHeaders, redactQueryString, redactValue, shouldRedactAttribute, } from "./sensitive-filter.ts";
-export { emitDbQuery, emitDispatcherError, emitDispatcherHandler, emitEscapeHatchUse, emitEventConsumerLag, emitEventConsumerPassOutcome, emitEventConsumerPassSkipped, emitEventConsumerPendingGaps, emitEventConsumerRearmExhausted, emitEventDispatcherListenConnected, emitHttpRequest, emitJobLastSuccess, emitJobQueueDepth, registerStandardMetrics, STANDARD_METRIC_DEFS, } from "./standard-metrics.ts";
-export type { Counter, Gauge, Histogram, Meter, MetricDefinition, MetricLabels, MetricsHandle, MetricType, ObservabilityOptions, ObservabilityProvider, SamplingConfig, SensitiveFilterConfig, SerializedTraceContext, Span, SpanAttributes, SpanAttributeValue, SpanKind, SpanStatus, StartSpanOptions, Tracer, } from "./types/index.ts";
+export { createPrometheusMeter } from "./prometheus-meter.ts";
+export { type MetricEvent, RecordingMeter, } from "./recording-meter.ts";
+export { type RecordedSpan, RecordingTracer, } from "./recording-tracer.ts";
+export { DEFAULT_SENSITIVE_CONFIG, mergeSensitiveConfig, } from "./sensitive-filter.ts";
+export type { MetricsHandle, ObservabilityOptions, ObservabilityProvider, } from "./types/index.ts";

package/dist/observability/index.js

@@ -1,16 +1,8 @@
 // Public surface of the observability module.
-export { createConsoleProvider } from "./console-provider.js";
-export { observabilityContext } from "./context.js";
-export { createEscapeHatchProcessDedup, createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, flushEscapeHatchAudits, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, withEscapeHatchAuditScope, } from "./escape-hatch-report.js";
-export { getFallbackMeter, getFallbackProvider, getFallbackTracer } from "./fallback.js";
-export { generateSpanId, generateTraceId } from "./ids.js";
-export { buildMetricName, validateLabelKey, validateMetricName, } from "./metric-validator.js";
-export { createMetricsForFactory, createMetricsHandle, createNoopMetricsHandle, createSafeMetricsHandle, createUnboundMetricsHandle, } from "./metrics-handle.js";
+export { createMetricsForFactory, createMetricsHandle, createNoopMetricsHandle, createSafeMetricsHandle, } from "./metrics-handle.js";
 export { prometheusMetricsEnvSchema, resolveObservabilityWiring, } from "./metrics-wiring.js";
 export { createNoopProvider } from "./noop-provider.js";
-export { createPrometheusMeter, serializeOpenMetrics, } from "./prometheus-meter.js";
+export { createPrometheusMeter } from "./prometheus-meter.js";
 export { RecordingMeter, } from "./recording-meter.js";
-export { RecordingTracer, serializeSpanContext, } from "./recording-tracer.js";
-export { wrapRedisClient } from "./redis-wrapper.js";
-export { DEFAULT_SENSITIVE_CONFIG, mergeSensitiveConfig, REDACTED, redactAttributes, redactHeaders, redactQueryString, redactValue, shouldRedactAttribute, } from "./sensitive-filter.js";
-export { emitDbQuery, emitDispatcherError, emitDispatcherHandler, emitEscapeHatchUse, emitEventConsumerLag, emitEventConsumerPassOutcome, emitEventConsumerPassSkipped, emitEventConsumerPendingGaps, emitEventConsumerRearmExhausted, emitEventDispatcherListenConnected, emitHttpRequest, emitJobLastSuccess, emitJobQueueDepth, registerStandardMetrics, STANDARD_METRIC_DEFS, } from "./standard-metrics.js";
+export { RecordingTracer, } from "./recording-tracer.js";
+export { DEFAULT_SENSITIVE_CONFIG, mergeSensitiveConfig, } from "./sensitive-filter.js";

package/dist/observability/metric-validator.js

@@ -51,7 +51,7 @@ export function validateMetricName(name, type) {
 // r.metric() is called with `feature.name` as registered at defineFeature
 // time) — normalize "-" to "_" here so a feature like "ai-foundation"
 // resolves to the same "kumiko_ai_foundation_x" on both the registration
-// path (registry-ingest.ts) and the read path (ctx.metrics / ctx.metricsFor),
+// path (registry-ingest.ts) and the read path (ctx.obs.metrics / ctx.obs.metricsFor),
 // instead of the kebab form being rejected outright.
 export function buildMetricName(featureName, shortName) {
     const normalizedFeatureName = toKebab(featureName).replace(/-/g, "_");

package/dist/observability/metrics-handle.d.ts

@@ -1,6 +1,5 @@
 import type { Meter, MetricsHandle } from "./types/index.ts";
 export declare function createMetricsHandle(meter: Meter, featureName: string): MetricsHandle;
 export declare function createSafeMetricsHandle(meter: Meter, featureName: string): MetricsHandle;
-export declare function createUnboundMetricsHandle(meter: Meter): MetricsHandle;
 export declare function createNoopMetricsHandle(): MetricsHandle;
 export declare function createMetricsForFactory(meter: Meter | undefined): (featureName: string) => MetricsHandle;

package/dist/observability/metrics-handle.js

@@ -26,7 +26,7 @@ export function createMetricsHandle(meter, featureName) {
 // Same feature-bound resolution as createMetricsHandle, but for an
 // explicit `featureName` chosen by the caller rather than the dispatching
 // handler's own feature. Meant for shared/library code
-// invoked from many features' HandlerContext (ctx.metricsFor) — the
+// invoked from many features' HandlerContext (ctx.obs.metricsFor) — the
 // library owns one stable metric name instead of splintering into
 // kumiko_<caller>_x per consumer.
 //
@@ -77,19 +77,6 @@ export function createSafeMetricsHandle(meter, featureName) {
 // Fallback for contexts where the feature is unknown (e.g. system-hooks,
 // internal pipeline code). Short names are used verbatim — useful for
 // framework-level usage, but rejected by the Meter unless pre-registered.
-export function createUnboundMetricsHandle(meter) {
-    return {
-        inc(name, labels, value) {
-            meter.counter(name).inc(value, labels);
-        },
-        observe(name, value, labels) {
-            meter.histogram(name).observe(value, labels);
-        },
-        set(name, value, labels) {
-            meter.gauge(name).set(value, labels);
-        },
-    };
-}
 // Noop fallback used when no provider is configured and for safety in
 // contexts where we can't determine the feature. Every call is a no-op —
 // tests and non-observability-aware features never crash.
@@ -100,7 +87,7 @@ export function createNoopMetricsHandle() {
         set(_name, _value, _labels) { },
     };
 }
-// Shared factory behind ctx.metricsFor for handler and job contexts, so both
+// Shared factory behind ctx.obs.metricsFor for handler and job contexts, so both
 // keep the same no-op-on-unregistered contract.
 export function createMetricsForFactory(meter) {
     return meter

package/dist/observability/recording-tracer.d.ts

@@ -1,4 +1,4 @@
-import type { SensitiveFilterConfig, SerializedTraceContext, Span, SpanAttributeValue, SpanKind, SpanStatus, StartSpanOptions, Tracer } from "./types/index.ts";
+import type { SensitiveFilterConfig, Span, SpanAttributeValue, SpanKind, SpanStatus, StartSpanOptions, Tracer } from "./types/index.ts";
 export type RecordedSpan = {
     readonly traceId: string;
     readonly spanId: string;
@@ -28,5 +28,4 @@ export declare class RecordingTracer implements Tracer {
     withSpan<T>(name: string, optionsOrFn: StartSpanOptions | ((span: Span) => Promise<T>), fn?: (span: Span) => Promise<T>): Promise<T>;
     getActiveSpan(): Span | undefined;
 }
-export declare function serializeSpanContext(span: Span): SerializedTraceContext;
 export {};

package/dist/observability/recording-tracer.js

@@ -127,9 +127,3 @@ export class RecordingTracer {
     }
 }
 // Helper to serialize an active Span into the cross-process format.
-export function serializeSpanContext(span) {
-    return {
-        traceId: span.traceId,
-        spanId: span.spanId,
-    };
-}

package/dist/observability/sensitive-filter.d.ts

@@ -2,8 +2,6 @@ import type { SensitiveFilterConfig, SpanAttributeValue } from "./types/index.ts
 export declare const REDACTED = "[REDACTED]";
 export declare const DEFAULT_SENSITIVE_CONFIG: SensitiveFilterConfig;
 export declare function mergeSensitiveConfig(override: Partial<SensitiveFilterConfig> | undefined): SensitiveFilterConfig;
-export declare function redactHeaders(headers: Readonly<Record<string, string>>, config: SensitiveFilterConfig): Record<string, string>;
-export declare function redactQueryString(input: string, config: SensitiveFilterConfig): string;
 export declare function shouldRedactAttribute(key: string, config: SensitiveFilterConfig): boolean;
 export declare function redactValue(value: SpanAttributeValue): SpanAttributeValue;
 export declare function redactAttributes(attrs: Readonly<Record<string, SpanAttributeValue>>, config: SensitiveFilterConfig): Record<string, SpanAttributeValue>;

package/dist/observability/sensitive-filter.js

@@ -32,35 +32,6 @@ export function mergeSensitiveConfig(override) {
             DEFAULT_SENSITIVE_CONFIG.redactedAttributeKeyPatterns,
     };
 }
-function lowercaseSet(names) {
-    return new Set(names.map((n) => n.toLowerCase()));
-}
-export function redactHeaders(headers, config) {
-    const redacted = lowercaseSet(config.redactedHeaders);
-    const out = {};
-    for (const [key, value] of Object.entries(headers)) {
-        out[key] = redacted.has(key.toLowerCase()) ? REDACTED : value;
-    }
-    return out;
-}
-// Redact sensitive query params in a URL or query string. Returns a new URL
-// string with the same shape — path, fragment, and ordering preserved.
-export function redactQueryString(input, config) {
-    const redacted = lowercaseSet(config.redactedQueryParams);
-    // URL wants absolute; handle both absolute and path-only forms.
-    const hasScheme = /^[a-z][a-z0-9+\-.]*:/i.test(input);
-    const base = hasScheme ? undefined : "http://_internal";
-    const url = base ? new URL(input, base) : new URL(input);
-    for (const key of Array.from(url.searchParams.keys())) {
-        if (redacted.has(key.toLowerCase())) {
-            url.searchParams.set(key, REDACTED);
-        }
-    }
-    if (!hasScheme) {
-        return `${url.pathname}${url.search}${url.hash}`;
-    }
-    return url.toString();
-}
 // Check a single attribute key against the redaction patterns.
 // Used by the Span implementation when setAttribute is called.
 export function shouldRedactAttribute(key, config) {

package/dist/pipeline/active-membership.d.ts

@@ -1,6 +1,7 @@
+import type { ActiveMembershipResult } from "@cosmicdrift/kumiko-types/handlers";
 import { type PrincipalStatusPlugin, type TenantLifecycleStatusPlugin } from "../engine/active-membership.ts";
 import type { TenantId } from "../engine/types/identifiers.ts";
-import type { ActiveMembershipResult, Registry } from "../engine/types/index.ts";
+import type { Registry } from "../engine/types/index.ts";
 import { type DispatchContext } from "./dispatch-shared.ts";
 export type ActiveMembershipPolicy = {
     readonly allowPendingDestruction: boolean;

package/dist/pipeline/active-membership.js

@@ -1,5 +1,6 @@
 // One framework-owned composition of membership / principal-status /
 // tenant-lifecycle checks so login, switch-tenant and MFA completion can't independently drift.
+import { runInSystemRowLevelSecurityScope } from "../db/row-level-security-scope.js";
 import { isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, TENANT_TEARDOWN_STATUSES, } from "../engine/active-membership.js";
 import { EXT_PRINCIPAL_STATUS, EXT_TENANT_LIFECYCLE_STATUS } from "../engine/extension-names.js";
 import { createSystemUser } from "../engine/system-user.js";
@@ -41,7 +42,7 @@ async function findMembership(ctx, userId, tenantId) {
     }
     return rawMemberships.find((m) => m.tenantId === tenantId);
 }
-// Exported so member-reader.ts (ctx.queryAsMember) can reach the registered
+// Exported so member-reader.ts (ctx.dispatch.queryAsMember) can reach the registered
 // PrincipalStatusPlugin's resolveProfile without duplicating this lookup.
 export function resolvePrincipalPlugin(registry) {
     const usages = registry.getExtensionUsages(EXT_PRINCIPAL_STATUS);
@@ -84,7 +85,10 @@ function isTeardownRejected(status, policy) {
 }
 // Order is load-bearing: a non-member must never learn a foreign tenant's
 // lifecycle/blocked state, so membership is resolved and checked FIRST.
-export async function resolveActiveMembershipFn(ctx, userId, tenantId, policy) {
+export function resolveActiveMembershipFn(ctx, userId, tenantId, policy) {
+    return runInSystemRowLevelSecurityScope("active membership lookup runs before the request tenant is established", () => resolveActiveMembershipInScope(ctx, userId, tenantId, policy));
+}
+async function resolveActiveMembershipInScope(ctx, userId, tenantId, policy) {
     const { registry } = ctx;
     const membership = await findMembership(ctx, userId, tenantId);
     if (!membership) {

package/dist/pipeline/append-event-core.d.ts

@@ -1,5 +1,6 @@
+import type { AppendEventArgs } from "@cosmicdrift/kumiko-types/handlers";
 import type { DbRunner } from "../db/connection.ts";
-import type { AppendEventArgs, Registry, TenantId } from "../engine/types/index.ts";
+import type { Registry, TenantId } from "../engine/types/index.ts";
 import { type StoredEvent } from "../event-store/event-store.ts";
 export type AppendDomainEventCoreDeps = {
     readonly registry: Registry;

package/dist/pipeline/append-event-core.js

@@ -63,7 +63,7 @@ export async function appendDomainEventCore(deps, args) {
         throw new ArchivedStreamError(deps.tenantId, args.aggregateId);
     }
     // Stream-version authoritative. See Block 0 / getStreamVersion doc for
-    // why row.version isn't sufficient once ctx.appendEvent enters the picture.
+    // why row.version isn't sufficient once ctx.events.append enters the picture.
     // A caller-pinned version (fetchForWriting handles) must reach append() so a
     // write landing between fetch and append conflicts instead of being re-read.
     const expectedVersion = args.expectedVersion ?? (await getStreamVersion(deps.db, args.aggregateId, deps.tenantId));
@@ -91,7 +91,7 @@ export async function appendDomainEventCore(deps, args) {
     });
     // Inline projections fire in the same tx — a throw rolls everything back
     // together. Same semantics regardless of which call-site triggered the
-    // append (write-handler ctx.appendEvent vs. MSP-apply ctx.appendEvent).
+    // append (write-handler ctx.events.append vs. MSP-apply ctx.appendEvent).
     await runProjectionsForEvent(stored, deps.registry, deps.db);
     return stored;
 }

package/dist/pipeline/attach-outside-transaction.d.ts

@@ -0,0 +1,3 @@
+export declare function attachOutsideTransaction<T extends object, O extends object | undefined>(db: T, outsideTransaction: O): T & {
+    readonly outsideTransaction: O;
+};

package/dist/pipeline/attach-outside-transaction.js

@@ -0,0 +1,13 @@
+// TenantDb identity keys WeakMaps (rebinders, personal-data gates), so the exposed db is never
+// wrapped or spread; the non-enumerable property keeps spreads and logging of the db unchanged.
+function defineOutsideTransaction(db, outsideTransaction) {
+    Object.defineProperty(db, "outsideTransaction", {
+        value: outsideTransaction,
+        enumerable: false,
+        configurable: true,
+    });
+}
+export function attachOutsideTransaction(db, outsideTransaction) {
+    defineOutsideTransaction(db, outsideTransaction);
+    return db;
+}

package/dist/pipeline/auth-claims-resolver.d.ts

@@ -1,4 +1,5 @@
-import type { AuthClaimsContext, AuthClaimsHookDef, SessionUser } from "../engine/types/index.ts";
+import type { AuthClaimsContext, AuthClaimsHookDef } from "@cosmicdrift/kumiko-types/handlers";
+import type { SessionUser } from "../engine/types/index.ts";
 import type { Logger } from "../logging/types.ts";
 export type ResolveAuthClaimsArgs = {
     readonly user: SessionUser;

package/dist/pipeline/cascade-handler.d.ts

@@ -1,5 +1,6 @@
+import type { PreDeleteHookFn } from "@cosmicdrift/kumiko-types/hooks";
 import type { TableColumns } from "../db/dialect.ts";
-import type { PreDeleteHookFn, Registry } from "../engine/types/index.ts";
+import type { Registry } from "../engine/types/index.ts";
 import type { SystemHookDef } from "./lifecycle-pipeline.ts";
 type TableMap = ReadonlyMap<string, TableColumns>;
 export declare function createCascadeDeleteHook(registry: Registry, tables: TableMap): SystemHookDef<PreDeleteHookFn>;

package/dist/pipeline/cascade-handler.js

@@ -4,7 +4,8 @@ import { isBoundTenantDb } from "../db/tenant-db-runner.js";
 import { OnDeleteStrategies, SystemHookNames, SystemHookPriorities } from "../engine/constants.js";
 import { isRecordLocked } from "../engine/screen-helpers.js";
 import { createSystemUser } from "../engine/system-user.js";
-import { ConflictError, FrameworkReasons, InternalError, RecordLockedError, reraiseAsKumikoError, } from "../errors/index.js";
+import { RecordLockedError } from "../errors/classes.js";
+import { ConflictError, FrameworkReasons, InternalError, reraiseAsKumikoError, } from "../errors/index.js";
 // The cascade is a consequence of the parent delete the caller was already authorized for, so the
 // children are written as the framework system user and the lock decision is taken once, up front.
 const CASCADE_CHILD_WRITE_OPTIONS = { unsafeSkipLockGuard: true };
@@ -18,7 +19,7 @@ export function createCascadeDeleteHook(registry, tables) {
                 ? ctx.systemDb.acknowledgeCrossTenant(`cascade delete for r.systemScope() write handler (${entityName ?? "unknown"})`)
                 : ctx.db;
             if (!entityName || !db) {
-                ctx.log?.debug(`cascadeDelete: skipping — ${!entityName ? "no entityName" : "no db"} on payload ${payload.id}`);
+                ctx.obs.log?.debug(`cascadeDelete: skipping — ${!entityName ? "no entityName" : "no db"} on payload ${payload.id}`);
                 return;
             }
             const writeDb = isBoundTenantDb(db) ? db : undefined;