@cosmicdrift/kumiko-framework 0.389.0 → 0.390.1

package/dist/pipeline/index.js

@@ -1,26 +1,24 @@
-export { createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, flushEscapeHatchAudits, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, withEscapeHatchAuditScope, } from "../observability/escape-hatch-report.js";
+export { createEscapeHatchReporter, ESCAPE_HATCH_USED_SIGNAL, flushEscapeHatchAudits, UNATTRIBUTED_ACTOR, } from "../observability/escape-hatch-report.js";
 export { normalizePayloadBucketValue } from "../rate-limit/bucket.js";
 export { createUnlimitedRateLimitResolver } from "../rate-limit/unlimited-resolver.js";
 export { appendDomainEventCore } from "./append-event-core.js";
 export { resolveAuthClaims } from "./auth-claims-resolver.js";
 export { createCascadeDeleteHook } from "./cascade-handler.js";
 export { createDispatcher, dispatcherToWriteRef } from "./dispatcher.js";
-export { isFailedWriteResult } from "./dispatcher-utils.js";
 export { createDistributedLock } from "./distributed-lock.js";
 export { createEntityCache } from "./entity-cache.js";
 export { ConsumerStatuses, createEventConsumerStateTable, eventConsumerStateTable, SHARED_INSTANCE_SENTINEL, } from "./event-consumer-state.js";
 export { createEventDedup } from "./event-dedup.js";
-export { ConsumerTransitionError, createEventDispatcher, disableConsumer, enableConsumer, getAllConsumerProgress, getConsumerState, listConsumersWithState, restartConsumer, skipPoisonEvent, } from "./event-dispatcher.js";
-export { selectConsumerCursorForUpdate } from "./event-dispatcher-delivery.js";
+export { ConsumerTransitionError, disableConsumer, enableConsumer, getAllConsumerProgress, getConsumerState, listConsumersWithState, restartConsumer, skipPoisonEvent, } from "./event-dispatcher.js";
 export { ConsumerLagError, pruneEvents } from "./event-retention.js";
 export { createIdempotencyGuard } from "./idempotency.js";
-export { assertInstructionFieldWriteAllowed, assertIrreversibleOperationAllowed, isIrreversibleEntityVerb, } from "./irreversible-operation-gate.js";
+export { assertIrreversibleOperationAllowed } from "./irreversible-operation-gate.js";
 export { createLifecycleHooks } from "./lifecycle-pipeline.js";
 export { rebuildMultiStreamProjection } from "./msp-rebuild.js";
 export { createMultiStreamApplyContext } from "./multi-stream-apply-context.js";
 export { assertNotifyTargetsOwnTenant, createDeferringNotify } from "./notify-scope.js";
 export { getAllProjectionProgress, getProjectionState, listProjectionsWithState, rebuildProjection, } from "./projection-rebuild.js";
-export { createProjectionStateTable, ProjectionStatuses, projectionStateTable, } from "./projection-state.js";
+export { createProjectionStateTable, projectionStateTable, } from "./projection-state.js";
 export { runProjectionsForEvent } from "./projections-runner.js";
-export { ACCESS_INVALIDATION_CONSUMER_NAME, createAccessInvalidationEventConsumer, createSearchEventConsumer, createSseBroadcastEventConsumer, SEARCH_CONSUMER_NAME, SSE_BROADCAST_CONSUMER_NAME, } from "./system-hooks.js";
+export { SEARCH_CONSUMER_NAME, SSE_BROADCAST_CONSUMER_NAME, } from "./system-hooks.js";
 export { TENANT_TIMEZONE_CONFIG_KEY } from "./tenant-timezone-config-key.js";

package/dist/pipeline/irreversible-operation-gate.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "../engine/types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 export declare function isIrreversibleEntityVerb(verb: "delete" | "forget", entity: EntityDefinition): boolean;
 export declare function assertIrreversibleOperationAllowed(operation: string): void;
 export declare function assertInstructionFieldWriteAllowed(entityName: string, verb: "create" | "update", writtenFieldNames: readonly string[], instructionFieldNames: readonly string[]): void;

package/dist/pipeline/irreversible-operation-gate.js

@@ -39,7 +39,7 @@ export function assertIrreversibleOperationAllowed(operation) {
         reason: FrameworkReasons.irreversibleOperationRequiresHighRisk,
         buildMessage: (entryHandler) => `Handler "${entryHandler.qn}" performs an irreversible ${operation} but resolves agent risk ` +
             `"${entryHandler.risk}" — ${highRiskRemedy(entryHandler)}. The ` +
-            "directly called handler must carry it; delegating via ctx.write/writeAs does not.",
+            "directly called handler must carry it; delegating via ctx.dispatch.write/writeAs does not.",
         details: { operation },
     });
 }
@@ -57,7 +57,7 @@ export function assertInstructionFieldWriteAllowed(entityName, verb, writtenFiel
         buildMessage: (entryHandler) => `Handler "${entryHandler.qn}" ${verb}s "${entityName}" field(s) ${fields.join(", ")} ` +
             `flagged readAsInstruction: true but resolves agent risk "${entryHandler.risk}" — ` +
             `${highRiskRemedy(entryHandler)}. The directly called handler must carry ` +
-            "it; delegating via ctx.write/writeAs does not.",
+            "it; delegating via ctx.dispatch.write/writeAs does not.",
         details: { entityName, verb, fields },
     });
 }

package/dist/pipeline/lifecycle-pipeline.d.ts

@@ -1,4 +1,5 @@
-import type { AppContext, DeleteContext, HookPhase, PostDeleteBatchHookFn, PostDeleteHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreSaveHookFn, Registry, SaveContext } from "../engine/types/index.ts";
+import type { DeleteContext, HookPhase, PostDeleteBatchHookFn, PostDeleteHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreSaveHookFn, SaveContext } from "@cosmicdrift/kumiko-types/hooks";
+import type { HandlerContext, Registry } from "../engine/types/index.ts";
 import type { EventDedup } from "./event-dedup.ts";
 export type SystemHookDef<TFn> = {
     readonly name: string;
@@ -15,12 +16,12 @@ export type SystemHooks = {
     readonly postDeleteBatch?: readonly SystemHookDef<PostDeleteBatchHookFn>[];
 };
 export type LifecycleHooks = {
-    runPreSave(handlerName: string, changes: Record<string, unknown>, previous: Readonly<Record<string, unknown>>, isNew: boolean, context: AppContext): Promise<Record<string, unknown>>;
-    runPostSave(handlerName: string, result: SaveContext, context: AppContext, phase?: HookPhase): Promise<void>;
-    runPreDelete(handlerName: string, payload: DeleteContext, context: AppContext): Promise<void>;
-    runPostDelete(handlerName: string, payload: DeleteContext, context: AppContext, phase?: HookPhase): Promise<void>;
-    runPostSaveBatch(results: readonly SaveContext[], context: AppContext): Promise<void>;
-    runPostDeleteBatch(payloads: readonly DeleteContext[], context: AppContext): Promise<void>;
+    runPreSave(handlerName: string, changes: Record<string, unknown>, previous: Readonly<Record<string, unknown>>, isNew: boolean, context: HandlerContext): Promise<Record<string, unknown>>;
+    runPostSave(handlerName: string, result: SaveContext, context: HandlerContext, phase?: HookPhase): Promise<void>;
+    runPreDelete(handlerName: string, payload: DeleteContext, context: HandlerContext): Promise<void>;
+    runPostDelete(handlerName: string, payload: DeleteContext, context: HandlerContext, phase?: HookPhase): Promise<void>;
+    runPostSaveBatch(results: readonly SaveContext[], context: HandlerContext): Promise<void>;
+    runPostDeleteBatch(payloads: readonly DeleteContext[], context: HandlerContext): Promise<void>;
 };
 export type LifecycleOptions = {
     eventDedup?: EventDedup;

package/dist/pipeline/lifecycle-pipeline.js

@@ -1,16 +1,12 @@
-import { HookPhases } from "../engine/types/index.js";
+import { HookPhases } from "../engine/hook-helpers.js";
 import { createFallbackLogger } from "../logging/utils.js";
-import { getFallbackTracer } from "../observability/index.js";
 function resolveTracer(context) {
-    return context.tracer ?? getFallbackTracer();
+    return context.obs.tracer;
 }
 /**
  * Resolves the effective feature set for the active context's tenant.
  *
- * `_tenantId` is copied from `user.tenantId` when the dispatcher builds the
- * HandlerContext. Legacy call sites without a user (system jobs, boot-time
- * pipeline) leave it undefined; `effectiveFeatures(undefined)` is type-unsafe,
- * so this returns undefined and treats that as "all features on" (registry
+ * Without a wired resolver this returns undefined, which means "all features on" (registry
  * filter hooks accept undefined to skip filtering).
  *
  * This is the single path used by all four lifecycle-hook call sites
@@ -18,9 +14,7 @@ function resolveTracer(context) {
  * consistent.
  */
 function currentEffectiveFeatures(context) {
-    if (context._tenantId === undefined)
-        return undefined;
-    return context.effectiveFeatures?.(context._tenantId);
+    return context.services.effectiveFeatures?.(context.user.tenantId);
 }
 export function createLifecycleHooks(registry, systemHooks = {}, options = {}) {
     const { eventDedup } = options;
@@ -46,14 +40,14 @@ export function createLifecycleHooks(registry, systemHooks = {}, options = {}) {
         // best-effort side-effects like Search Index, SSE broadcast, Audit — a
         // missed hook is preferable to a duplicate notification. Features that
         // need at-least-once semantics must not rely on this path; use
-        // ctx.appendEvent + r.multiStreamProjection instead, which the
+        // ctx.events.append + r.multiStreamProjection instead, which the
         // event-dispatcher retries until the consumer advances.
         if (eventDedup && opts.hookPhase === HookPhases.afterCommit) {
             const eventId = buildEventId(opts.handlerName, opts.payload, opts.phaseLabel);
             if (eventId) {
                 const acquired = await eventDedup.tryAcquire(eventId);
                 if (!acquired) {
-                    opts.context.log?.debug(`${opts.phaseLabel}: skipping ${opts.handlerName} — event ${eventId} already processed (dedup)`);
+                    opts.context.obs.log.debug(`${opts.phaseLabel}: skipping ${opts.handlerName} — event ${eventId} already processed (dedup)`);
                     return;
                 }
             }
@@ -62,7 +56,7 @@ export function createLifecycleHooks(registry, systemHooks = {}, options = {}) {
                 // always returns one. Log so we can spot framework/feature bugs where
                 // a handler emits a non-standard LifecycleResult and accidentally
                 // bypasses dedup.
-                opts.context.log?.warn(`${opts.phaseLabel}: ${opts.handlerName} has no dedup id (payload missing \`id\`) — hook may run multiple times on retry`);
+                opts.context.obs.log.warn(`${opts.phaseLabel}: ${opts.handlerName} has no dedup id (payload missing \`id\`) — hook may run multiple times on retry`);
             }
         }
         const errors = [];
@@ -128,7 +122,7 @@ export function createLifecycleHooks(registry, systemHooks = {}, options = {}) {
             await runHooks(applicable, (h) => ({ "kumiko.hook_source": "system", "kumiko.hook_name": h.name }), (h) => h.name, (h) => h.fn(opts.payload, opts.context));
         }
         if (errors.length > 0) {
-            const logError = createFallbackLogger("lifecycle", opts.context.log);
+            const logError = createFallbackLogger("lifecycle", opts.context.obs.log);
             const msg = `${opts.phaseLabel} errors for ${opts.handlerName}`;
             logError.error(msg, { details: errors.map((e) => `${e.name}: ${e.error}`) });
         }
@@ -235,7 +229,7 @@ export function createLifecycleHooks(registry, systemHooks = {}, options = {}) {
         // skip: all batch hooks succeeded, nothing to log
         if (failures.length === 0)
             return;
-        const logError = createFallbackLogger("lifecycle", opts.context.log);
+        const logError = createFallbackLogger("lifecycle", opts.context.obs.log);
         const msg = `${opts.phaseLabel} errors`;
         logError.error(msg, { details: failures.map((f) => `${f.name}: ${f.outcome.reason}`) });
     }

package/dist/pipeline/member-read-only-transaction.js

@@ -1,6 +1,9 @@
 import { extractPgError } from "../db/pg-error.js";
 import { asRawClient, runInSavepoint, transaction } from "../db/query.js";
-import { AccessDeniedError, InternalError, MemberReadTimeoutError, memberResolutionReadOnlyDenied, } from "../errors/index.js";
+import { activeRowLevelSecurityScope, runInCapturedRowLevelSecurityScope, runInSystemRowLevelSecurityScope, } from "../db/row-level-security-scope.js";
+import { MemberReadTimeoutError } from "../errors/classes.js";
+import { AccessDeniedError, InternalError } from "../errors/index.js";
+import { memberResolutionReadOnlyDenied } from "../errors/member-resolution.js";
 import { resolveDbSource } from "./dispatch-shared.js";
 const PG_READ_ONLY_SQLSTATE = "25006";
 const PG_QUERY_CANCELED_SQLSTATE = "57014";
@@ -51,7 +54,12 @@ async function runInDiscardedReadOnlySavepoint(tx, timeoutMs, bindIdleTimeout, f
     }
     return settled.outcome.value;
 }
-export async function runInMemberReadOnlyTransaction(ctx, tx, fn) {
+export function runInMemberReadOnlyTransaction(ctx, tx, fn) {
+    // Only the transaction plumbing (savepoint, SET) runs system-scoped; the caller's fn keeps the dispatch scope it came in with.
+    const incoming = activeRowLevelSecurityScope();
+    return runInSystemRowLevelSecurityScope("member read-only transaction opens its connection under system scope, then restores the caller scope", () => runInMemberReadOnlyTransactionScoped(ctx, tx, (readOnlyTx) => runInCapturedRowLevelSecurityScope(incoming, () => fn(readOnlyTx))));
+}
+async function runInMemberReadOnlyTransactionScoped(ctx, tx, fn) {
     const timeoutMs = ctx.memberReadTimeoutMs;
     try {
         if (tx)
@@ -59,7 +67,7 @@ export async function runInMemberReadOnlyTransaction(ctx, tx, fn) {
         const pool = resolveDbSource(ctx, undefined);
         if (!pool) {
             throw new InternalError({
-                message: "ctx.queryAsMember requires a database connection — none is configured.",
+                message: "ctx.dispatch.queryAsMember requires a database connection — none is configured.",
             });
         }
         // Savepoint even on the pool path: Postgres rejects a READ WRITE reset (SQLSTATE 25001) inside a subtransaction.

package/dist/pipeline/member-reader.d.ts

@@ -1,6 +1,6 @@
+import type { MemberReader } from "@cosmicdrift/kumiko-types/handlers";
 import type { DbTx } from "../db/connection.ts";
 import type { TenantId } from "../engine/types/identifiers.ts";
-import type { MemberReader } from "../engine/types/index.ts";
 import { type ActiveMembershipPolicy } from "./active-membership.ts";
 import { type DispatchContext } from "./dispatch-shared.ts";
 export declare const BACKGROUND_READ_POLICY: ActiveMembershipPolicy;

package/dist/pipeline/member-reader.js

@@ -1,4 +1,4 @@
-// ctx.queryAsMember — reads a query handler as a stored tenant member. The
+// ctx.dispatch.queryAsMember — reads a query handler as a stored tenant member. The
 // resolved SessionUser never leaves this module.
 import { buildSessionRoles } from "../engine/membership-roles.js";
 import { SYSTEM_TENANT_ID } from "../engine/types/index.js";
@@ -32,7 +32,7 @@ async function resolveMember(ctx, tenantId, userId) {
     const dbSource = resolveDbSource(ctx, undefined);
     if (!dbSource) {
         throw new InternalError({
-            message: "ctx.queryAsMember requires a database connection — none is configured.",
+            message: "ctx.dispatch.queryAsMember requires a database connection — none is configured.",
         });
     }
     // resolveDbSource(ctx, undefined) never returns a tx, only AppContext.db.

package/dist/pipeline/msp-rebuild.js

@@ -1,6 +1,8 @@
 import { markConsumerRebuildFailed, resetConsumerForMspRebuild, selectConsumerForUpdate, selectEventIdHorizonWithMissingRanges, selectSnapshotXmax, updateConsumerRebuildCursor, } from "../db/queries/event-consumer.js";
-import { assertLiveColumnsMatchMeta, assertLiveTableHasNoRowLevelSecurity, buildShadowTable, ensureRebuildSchema, rebuildMetaOrThrow, swapShadowIntoLive, } from "../db/queries/shadow-swap.js";
+import { assertRebuildableRowLevelSecurity } from "../db/queries/rebuild-rls-guard.js";
+import { assertLiveColumnsMatchMeta, buildShadowTable, ensureRebuildSchema, rebuildMetaOrThrow, swapShadowIntoLive, } from "../db/queries/shadow-swap.js";
 import { runInSavepoint, selectMany } from "../db/query.js";
+import { runInSystemRowLevelSecurityScope } from "../db/row-level-security-scope.js";
 import { withoutStatementTimeout } from "../db/statement-timeout.js";
 import { withExecutorManagedWrites } from "../db/tenant-db.js";
 import { InternalError } from "../errors/index.js";
@@ -31,7 +33,7 @@ function createRebuildCtx(registry, db, tenantId) {
     };
 }
 export function rebuildMultiStreamProjection(mspName, deps) {
-    return withoutStatementTimeout(deps.db, (db) => replayMultiStreamProjectionIntoShadow(mspName, { ...deps, db }));
+    return withoutStatementTimeout(deps.db, (db) => runInSystemRowLevelSecurityScope("multi-stream projection rebuild replays events of all tenants", () => replayMultiStreamProjectionIntoShadow(mspName, { ...deps, db })));
 }
 async function replayMultiStreamProjectionIntoShadow(mspName, deps) {
     const { db, registry } = deps;
@@ -62,11 +64,11 @@ async function replayMultiStreamProjectionIntoShadow(mspName, deps) {
             await createRebuildDeadLetterTable(db);
         const replayedIds = [];
         await db.begin(async (tx) => {
+            await assertRebuildableRowLevelSecurity(tx, meta.tableName);
             await resetConsumerForMspRebuild(tx, mspName, SHARED_INSTANCE_SENTINEL);
             await selectConsumerForUpdate(tx, mspName, SHARED_INSTANCE_SENTINEL);
             const { horizon, gaps: seededGaps } = await selectEventIdHorizonWithMissingRanges(tx);
             await assertLiveColumnsMatchMeta(tx, meta, mspName);
-            await assertLiveTableHasNoRowLevelSecurity(tx, meta.tableName, mspName);
             await buildShadowTable(tx, meta);
             const subscribedTypes = Object.keys(msp.apply);
             if (subscribedTypes.length > 0) {

package/dist/pipeline/multi-stream-apply-context.js

@@ -1,6 +1,7 @@
 import { loadAggregate, loadAggregateAsOf } from "../event-store/event-store.js";
 import { upcastStoredEvents } from "../event-store/upcaster.js";
 import { appendDomainEventCore } from "./append-event-core.js";
+import { asTypedAppendEventFn } from "./typed-append-event.js";
 export function createMultiStreamApplyContext(deps) {
     return {
         registry: deps.registry,
@@ -8,7 +9,7 @@ export function createMultiStreamApplyContext(deps) {
         ...(deps.derivatives ? { derivatives: deps.derivatives } : {}),
         ...(deps.secrets ? { secrets: deps.secrets } : {}),
         ...(deps.jobs ? { jobs: deps.jobs } : {}),
-        appendEvent: (async (args) => {
+        appendEvent: asTypedAppendEventFn(async (args) => {
             await appendDomainEventCore({
                 registry: deps.registry,
                 db: deps.db,
@@ -17,7 +18,7 @@ export function createMultiStreamApplyContext(deps) {
                 callSiteLabel: "MSP-apply ctx.appendEvent",
                 ...(deps.callerFeature && { callerFeature: deps.callerFeature }),
             }, args);
-        }), // @cast-boundary engine-bridge
+        }),
         unsafeAppendEvent: async (args) => {
             await appendDomainEventCore({
                 registry: deps.registry,

package/dist/pipeline/notify-scope.d.ts

@@ -1,5 +1,6 @@
+import type { NotifyFn, NotifyOptions } from "@cosmicdrift/kumiko-types/handlers";
 import type { TenantId } from "../engine/types/identifiers.ts";
-import type { NotifyFn, NotifyOptions, Registry } from "../engine/types/index.ts";
+import type { Registry } from "../engine/types/index.ts";
 import type { AfterCommitHook } from "./dispatcher-utils.ts";
 export declare function assertNotifyTargetsOwnTenant(options: NotifyOptions, tenantId: TenantId): void;
 type DeferringNotifyDeps = {

package/dist/pipeline/pre-handler-gates.d.ts

@@ -1,4 +1,5 @@
-import type { SessionUser, WriteHandlerDef } from "../engine/types/index.ts";
+import type { WriteHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
+import type { SessionUser } from "../engine/types/index.ts";
 import { type WriteFailure } from "../errors/index.ts";
 import type { DispatchContext } from "./dispatch-shared.ts";
 export type PreHandlerGateMode = "charge" | "recheck";

package/dist/pipeline/pre-transaction-reservations.d.ts

@@ -1,6 +1,6 @@
-import type { ReservationHandle } from "@cosmicdrift/kumiko-types/handlers";
-import type { SessionUser, WriteHandlerDef } from "../engine/types/index.ts";
-import { type WriteErrorInfo } from "../errors/index.ts";
+import type { ReservationHandle, WriteHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
+import type { SessionUser } from "../engine/types/index.ts";
+import type { WriteErrorInfo } from "../errors/index.ts";
 import type { BatchCommand, DispatchContext } from "./dispatch-shared.ts";
 import type { WriteOrigin } from "./write-origin.ts";
 type ReservationConfirm = ReservationHandle["confirmInTransaction"];

package/dist/pipeline/pre-transaction-reservations.js

@@ -1,7 +1,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-import { toWriteErrorInfo } from "../errors/index.js";
+import { toWriteErrorInfo } from "../errors/write-error-info.js";
 import { createFallbackLogger } from "../logging/utils.js";
-import { applyBeforeTransactionReadOnly, buildHandlerContext, denyTransactionBoundSurfaces, isMemberResolutionPrincipal, } from "./dispatch-shared.js";
+import { buildHandlerContext, isMemberResolutionPrincipal } from "./dispatch-shared.js";
 import { wrapToKumiko } from "./dispatcher-utils.js";
 import { runPreHandlerGates } from "./pre-handler-gates.js";
 import { effectiveWriteOrigin, rootWriteOrigin } from "./write-origin.js";
@@ -9,7 +9,7 @@ export function hasPreTransactionPhase(handler) {
     return handler.reserveBeforeTransaction !== undefined || handler.beforeTransaction !== undefined;
 }
 // One-shot permission per top-level command: the handler that reserved before the transaction
-// consumes it on entry. A capped handler reached any other way (nested ctx.write, writeAs, a
+// consumes it on entry. A capped handler reached any other way (nested ctx.dispatch.write, writeAs, a
 // second execution of the same type) finds it spent and is rejected instead of running unreserved.
 const reservedForCommand = new AsyncLocalStorage();
 export function runAsCommand(reserved, fn) {
@@ -65,8 +65,10 @@ export async function reserveBeforeTransaction(ctx, commands, user, inheritedOri
             const event = { type: command.type, payload: gates.payload, user };
             let confirmInTransaction;
             if (handler.reserveBeforeTransaction) {
-                const handlerContext = await buildHandlerContext(ctx, command.type, user, origin);
-                const handle = toReservationHandle(await handler.reserveBeforeTransaction(event, denyTransactionBoundSurfaces(handlerContext)));
+                const reservationContext = await buildHandlerContext(ctx, command.type, user, origin, {
+                    phase: "reservation",
+                });
+                const handle = toReservationHandle(await handler.reserveBeforeTransaction(event, reservationContext));
                 if (handle)
                     releases.push(handle.release);
                 confirmInTransaction = handle?.confirmInTransaction;
@@ -74,9 +76,9 @@ export async function reserveBeforeTransaction(ctx, commands, user, inheritedOri
             let prepared;
             if (handler.beforeTransaction) {
                 const phaseContext = await buildHandlerContext(ctx, command.type, user, origin, {
-                    readOnlyForTenant: true,
+                    phase: "beforeTransaction",
                 });
-                const phase = await handler.beforeTransaction(event, applyBeforeTransactionReadOnly(phaseContext));
+                const phase = await handler.beforeTransaction(event, phaseContext);
                 if (!phase.isSuccess) {
                     await releaseAll(ctx, releases);
                     return { isSuccess: false, error: phase.error, failedIndex: index };

package/dist/pipeline/projection-rebuild.js

@@ -1,6 +1,8 @@
 import { countSubscribedEvents, finalizeProjectionRebuild, markProjectionRebuildFailed, markProjectionRebuilding, selectEventsForProjectionRebuildBatch, } from "../db/queries/projection-rebuild.js";
-import { assertLiveColumnsMatchMeta, assertLiveTableHasNoRowLevelSecurity, assertNoBlindIndexLoss, assertNoUnreachableLiveRows, buildShadowTable, countColumnDrift, ensureRebuildSchema, fenceLiveTable, rebuildMetaOrThrow, swapShadowIntoLive, } from "../db/queries/shadow-swap.js";
+import { assertRebuildableRowLevelSecurity } from "../db/queries/rebuild-rls-guard.js";
+import { assertLiveColumnsMatchMeta, assertNoBlindIndexLoss, assertNoUnreachableLiveRows, buildShadowTable, countColumnDrift, ensureRebuildSchema, fenceLiveTable, rebuildMetaOrThrow, swapShadowIntoLive, } from "../db/queries/shadow-swap.js";
 import { coerceRow, runInSavepoint, selectMany } from "../db/query.js";
+import { runInSystemRowLevelSecurityScope } from "../db/row-level-security-scope.js";
 import { withoutStatementTimeout } from "../db/statement-timeout.js";
 import { extractTableInfo } from "../db/table-info.js";
 import { withExecutorManagedWrites } from "../db/tenant-db.js";
@@ -35,6 +37,7 @@ function rowToStoredEvent(row) {
         createdBy: row.createdBy,
     };
 }
+const TENANT_COLUMN_SUFFIX = ".tenant_id";
 // Ops-facing log line for countColumnDrift's result. No-op when clean.
 function warnOnColumnDrift(projectionName, tableName, drift) {
     // skip: no drift found — nothing to warn about
@@ -44,13 +47,17 @@ function warnOnColumnDrift(projectionName, tableName, drift) {
     const countLabel = sampledIds.size < drift.rowCount
         ? `${drift.rowCount} (sample truncated)`
         : String(drift.rowCount);
+    // A stream-tenant move (boot backfill) changes the stream's tenant, so the replayed row differs only in tenant_id.
+    const onlyTenantColumn = drift.sample.every((s) => s.endsWith(TENANT_COLUMN_SUFFIX));
+    const likelyCause = onlyTenantColumn
+        ? "Expected cause: a stream-tenant move by the boot backfill (the replay carries the new stream tenant)."
+        : "Likely cause: a legacy direct-write predating the row's event history (#494), or a sensitive custom field pending #972. Investigate if unexpected.";
     log.warn(`projection "${projectionName}": ${countLabel} live row(s) in "${tableName}" have ` +
         `column values that differ from the freshly-replayed shadow (sample: ${drift.sample.join(", ")}). ` +
-        "Not blocking — replay wins on swap. Likely cause: a legacy direct-write predating the row's " +
-        "event history (#494), or a sensitive custom field pending #972. Investigate if unexpected.");
+        `Not blocking — replay wins on swap. ${likelyCause}`);
 }
 export function rebuildProjection(projectionName, deps) {
-    return withoutStatementTimeout(deps.db, (db) => replayProjectionIntoShadow(projectionName, { ...deps, db }));
+    return withoutStatementTimeout(deps.db, (db) => runInSystemRowLevelSecurityScope("projection rebuild scans events of all tenants", () => replayProjectionIntoShadow(projectionName, { ...deps, db })));
 }
 async function replayProjectionIntoShadow(projectionName, deps) {
     const { db, registry } = deps;
@@ -124,9 +131,9 @@ async function replayProjectionIntoShadow(projectionName, deps) {
         if (skipApplyErrors)
             await createRebuildDeadLetterTable(db);
         await db.begin(async (tx) => {
+            await assertRebuildableRowLevelSecurity(tx, meta.tableName);
             await markProjectionRebuilding(tx, projectionName);
             await assertLiveColumnsMatchMeta(tx, meta, projectionName);
-            await assertLiveTableHasNoRowLevelSecurity(tx, meta.tableName, projectionName);
             await buildShadowTable(tx, meta);
             deps.__test_onBuildShadowTable?.();
             // A projection that subscribes to nothing has no events to replay and no

package/dist/pipeline/projection-state.d.ts

@@ -1,9 +1,3 @@
 import type { DbConnection } from "../db/connection.ts";
 export declare const projectionStateTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
-export declare const ProjectionStatuses: {
-    readonly idle: "idle";
-    readonly rebuilding: "rebuilding";
-    readonly failed: "failed";
-};
-export type ProjectionStatus = (typeof ProjectionStatuses)[keyof typeof ProjectionStatuses];
 export declare function createProjectionStateTable(db: DbConnection): Promise<void>;

package/dist/pipeline/projection-state.js

@@ -34,11 +34,6 @@ export const projectionStateTable = pgTable("kumiko_projections", {
 }, (t) => ({
     statusIdx: index("kumiko_projections_status_idx").on(t.status),
 }));
-export const ProjectionStatuses = {
-    idle: "idle",
-    rebuilding: "rebuilding",
-    failed: "failed",
-};
 // Idempotent table bootstrap. Called by setupTestStack (and createApp once
 // that wires it up) — same pattern as createEventsTable. If the table is
 // already there (second stack in same test DB, production boot after

package/dist/pipeline/projections-runner.d.ts

@@ -1,5 +1,6 @@
+import type { LifecycleResult } from "@cosmicdrift/kumiko-types/hooks";
 import type { DbRunner } from "../db/index.ts";
-import type { LifecycleResult, Registry } from "../engine/types/index.ts";
+import type { Registry } from "../engine/types/index.ts";
 import type { StoredEvent } from "../event-store/index.ts";
 export declare function runProjections(result: LifecycleResult, registry: Registry, runner: DbRunner | undefined): Promise<void>;
 export declare function hasLiveProjectionsForEvent(event: StoredEvent, registry: Registry): boolean;

package/dist/pipeline/projections-runner.js

@@ -1,5 +1,6 @@
 import { withExecutorManagedWrites } from "../db/tenant-db.js";
 import { InternalError } from "../errors/index.js";
+import { inEventStreamScope } from "../event-store/stream-scope.js";
 // Run custom projections for a save or delete result. Lives INSIDE the
 // transaction that appended the event — a throw from apply() rolls the event
 // back along with any auto-projection write.
@@ -33,7 +34,7 @@ export async function runProjections(result, registry, runner) {
 }
 // Fire every projection whose source matches the event's aggregate type AND
 // that declares an apply-handler for the event's type. Used by both the
-// CRUD path (via runProjections) and the ctx.appendEvent path (domain events
+// CRUD path (via runProjections) and the ctx.events.append path (domain events
 // emitted inside a write handler). Keeping one function means an auto-event
 // and a r.defineEvent-event land in the same inline-projection pipeline.
 // Events whose projections already ran. The EventStoreExecutor projects right
@@ -57,10 +58,13 @@ export async function runProjectionsForEvent(event, registry, tx) {
     // skip: this event object was already projected in this write
     if (projectedEvents.has(event))
         return;
-    for (const proj of liveProjectionsForEvent(event, registry)) {
-        const applyFn = proj.apply[event.type];
-        if (applyFn)
-            await applyFn(event, withExecutorManagedWrites(tx), proj.table);
-    }
+    // Inline projections write the event's own tenant, which differs from the caller's scope for system-actor events.
+    await inEventStreamScope(event.tenantId, async () => {
+        for (const proj of liveProjectionsForEvent(event, registry)) {
+            const applyFn = proj.apply[event.type];
+            if (applyFn)
+                await applyFn(event, withExecutorManagedWrites(tx), proj.table);
+        }
+    });
     projectedEvents.add(event);
 }

package/dist/pipeline/system-hooks.d.ts

@@ -1,5 +1,7 @@
+import type { JobRunnerRef } from "@cosmicdrift/kumiko-types/handlers";
+import type { EntityId } from "@cosmicdrift/kumiko-types/identifiers";
 import { type SseBroker } from "../api/sse-broker.ts";
-import type { EntityId, JobRunnerRef, Registry, TenantId } from "../engine/types/index.ts";
+import type { Registry, TenantId } from "../engine/types/index.ts";
 import type { SearchAdapter, SearchDocument } from "../search/types.ts";
 import type { EventConsumer } from "./event-dispatcher.ts";
 export declare const SEARCH_CONSUMER_NAME = "system:consumer:search";

package/dist/pipeline/system-hooks.js

@@ -1,7 +1,9 @@
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { readNonEmptyStringArray, } from "../api/sse-broker.js";
-import { collectSearchableSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
-import { createTenantDb, entityTableFromRegistry, rehydrateCompoundTypes } from "../db/index.js";
+import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
+import { collectSearchableSubjectFields } from "../crypto/subject-resolver.js";
+import { rehydrateCompoundTypes } from "../db/compound-types.js";
+import { createTenantDb, entityTableFromRegistry } from "../db/index.js";
 import { tenantChannel } from "../engine/constants.js";
 import { InternalError } from "../errors/index.js";
 import { createFallbackLogger } from "../logging/utils.js";
@@ -422,7 +424,7 @@ export function createSseBroadcastEventConsumer(sseBroker) {
 // r.job's `trigger.on` historically only fired via the synchronous
 // write-handler dispatch path (dispatch-write.ts's afterCommitHooks calling
 // jobRunner.handleEvent). Events appended any other way — an
-// r.multiStreamProjection's ctx.unsafeAppendEvent, or a raw
+// r.multiStreamProjection's ctx.events.unsafeAppend, or a raw
 // event-store-executor write (e.g. `files`' fileRef.created) — never
 // reached it, so a job could never trigger on an r.defineEvent-registered
 // event.
@@ -431,7 +433,7 @@ export function createSseBroadcastEventConsumer(sseBroker) {
 // committed event off the shared cursor and re-check job triggers. It is
 // scoped EXACTLY to the gap — the write/query-handler-QN skip below is
 // defense-in-depth: no stored event's `type` is a handler QN today (entity
-// events are "entity.verb"; ctx.appendEvent enforces defineEvent-only
+// events are "entity.verb"; ctx.events.append enforces defineEvent-only
 // ownership), but if that ever changes, this consumer must not re-fire a
 // trigger the synchronous dispatch-write.ts path already handled.
 //

package/dist/pipeline/system-identity-switch.d.ts

@@ -1,10 +1,12 @@
+import type { ActiveMembershipResult, EscapeHatchDeclaration, EscapeHatchReporter, MemberReader, WriteResult } from "@cosmicdrift/kumiko-types/handlers";
+import type { LifecycleHookFn } from "@cosmicdrift/kumiko-types/hooks";
 import type { TenantId } from "../engine/types/identifiers.ts";
-import type { ActiveMembershipResult, EscapeHatchDeclaration, EscapeHatchReporter, HandlerContext, LifecycleHookFn, MemberReader, SessionUser, WriteResult } from "../engine/types/index.ts";
+import type { HandlerContext, SessionUser } from "../engine/types/index.ts";
 import { AccessDeniedError } from "../errors/index.ts";
 export type QueryAsFn = (user: SessionUser, qn: string, payload: unknown) => Promise<unknown>;
 export type WriteAsFn = (user: SessionUser, qn: string, payload: unknown) => Promise<WriteResult>;
 export type ResolveActiveMembershipFn = (userId: string, tenantId: TenantId) => Promise<ActiveMembershipResult>;
-export type ProjectionReader = HandlerContext["queryProjection"];
+export type ProjectionReader = HandlerContext["dispatch"]["queryProjection"];
 export type IdentitySwitch = {
     readonly queryAs: QueryAsFn;
     readonly writeAs: WriteAsFn;