@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/event-store/__tests__/upcaster.integration.test.ts

@@ -56,21 +56,32 @@ const orderFeature = defineFeature("upcastshop", (r) => {
   const orderPriced = r.defineEvent(
     "priced",
     z.object({ totalCents: z.number().int(), currency: z.string() }),
-    { version: 3 },
+    {
+      version: 3,
+      migrations: [
+        // v1 → v2: renamed totalEuros → total (kept as string for this step)
+        {
+          fromVersion: 1,
+          toVersion: 2,
+          transform: (payload) => {
+            const p = payload as { totalEuros: string };
+            return { total: p.totalEuros, currency: "EUR" };
+          },
+        },
+        // v2 → v3: parse "total" string into integer cents
+        {
+          fromVersion: 2,
+          toVersion: 3,
+          transform: (payload) => {
+            const p = payload as { total: string; currency: string };
+            const euros = Number.parseFloat(p.total);
+            return { totalCents: Math.round(euros * 100), currency: p.currency };
+          },
+        },
+      ],
+    },
   );
 
-  // v1 → v2: renamed totalEuros → total (kept as string for this step)
-  r.eventMigration("priced", 1, 2, (payload) => {
-    const p = payload as { totalEuros: string };
-    return { total: p.totalEuros, currency: "EUR" };
-  });
-  // v2 → v3: parse "total" string into integer cents
-  r.eventMigration("priced", 2, 3, (payload) => {
-    const p = payload as { total: string; currency: string };
-    const euros = Number.parseFloat(p.total);
-    return { totalCents: Math.round(euros * 100), currency: p.currency };
-  });
-
   r.projection({
     name: "order-summary",
     source: "upcast-order",
@@ -309,18 +320,27 @@ describe("upcaster: async (Marten AsyncOnlyEventUpcaster — DB-Lookups)", () =>
       const placed = r.defineEvent(
         "placed",
         z.object({ customerId: z.string(), segment: z.string() }),
-        { version: 2 },
+        {
+          version: 2,
+          migrations: [
+            {
+              fromVersion: 1,
+              toVersion: 2,
+              transform: async (payload, ctx) => {
+                const p = payload as { customerId: string };
+                const [row] = await selectMany(ctx.db, customerSegments, {
+                  customerId: p.customerId,
+                });
+                return {
+                  customerId: p.customerId,
+                  segment: (row as { segment?: string } | undefined)?.segment ?? "UNKNOWN",
+                };
+              },
+            },
+          ],
+        },
       );
 
-      r.eventMigration("placed", 1, 2, async (payload, ctx) => {
-        const p = payload as { customerId: string };
-        const [row] = await selectMany(ctx.db, customerSegments, { customerId: p.customerId });
-        return {
-          customerId: p.customerId,
-          segment: (row as { segment?: string } | undefined)?.segment ?? "UNKNOWN",
-        };
-      });
-
       r.projection({
         name: "async-summary",
         source: "upcast-async-order",
@@ -385,26 +405,28 @@ describe("upcaster: boot-time validation", () => {
   test("defineEvent with version=N and only partial migrations fails at registry build", () => {
     const incomplete = defineFeature("holes", (r) => {
       r.entity("hole-order", orderEntity);
-      r.defineEvent("bad", z.object({ v3: z.string() }), { version: 3 });
       // Only 1→2 registered — the 2→3 gap must be rejected.
-      r.eventMigration("bad", 1, 2, (p) => p);
+      r.defineEvent("bad", z.object({ v3: z.string() }), {
+        version: 3,
+        migrations: [{ fromVersion: 1, toVersion: 2, transform: (p) => p }],
+      });
     });
     expect(() => createRegistry([incomplete])).toThrow(/v2.*v3|covers the step v2/);
   });
 
-  test("migration declared but no defineEvent → rejected", () => {
-    const orphan = defineFeature("orphans", (r) => {
-      r.entity("orph-order", orderEntity);
-      r.eventMigration("ghost", 1, 2, (p) => p);
-    });
-    expect(() => createRegistry([orphan])).toThrow(/no r\.defineEvent/i);
-  });
+  // "migration declared but no defineEvent" is now structurally impossible:
+  // migrations live in defineEvent's `migrations` option, always scoped to
+  // the event being defined in that same call — there is no longer a
+  // registrar shape that can express a dangling migration for an
+  // undefined event (formerly the "ghost" registry-validate error path).
 
   test("migration toVersion > defineEvent version → rejected", () => {
     const future = defineFeature("future", (r) => {
       r.entity("future-order", orderEntity);
-      r.defineEvent("early", z.object({ x: z.number() }), { version: 1 });
-      r.eventMigration("early", 1, 2, (p) => p);
+      r.defineEvent("early", z.object({ x: z.number() }), {
+        version: 1,
+        migrations: [{ fromVersion: 1, toVersion: 2, transform: (p) => p }],
+      });
     });
     expect(() => createRegistry([future])).toThrow(/declares only version 1/);
   });
@@ -412,34 +434,44 @@ describe("upcaster: boot-time validation", () => {
   test("non-contiguous (1→2 and 3→4 without 2→3) → rejected", () => {
     const gaps = defineFeature("gaps", (r) => {
       r.entity("gap-order", orderEntity);
-      r.defineEvent("jumpy", z.object({ v: z.number() }), { version: 4 });
-      r.eventMigration("jumpy", 1, 2, (p) => p);
-      r.eventMigration("jumpy", 3, 4, (p) => p);
+      r.defineEvent("jumpy", z.object({ v: z.number() }), {
+        version: 4,
+        migrations: [
+          { fromVersion: 1, toVersion: 2, transform: (p) => p },
+          { fromVersion: 3, toVersion: 4, transform: (p) => p },
+        ],
+      });
     });
     expect(() => createRegistry([gaps])).toThrow(/v2.*v3|covers the step v2/);
   });
 });
 
 describe("upcaster: registrar input validation", () => {
-  test("r.eventMigration rejects multi-step jumps", () => {
+  test("defineEvent migrations reject multi-step jumps", () => {
     expect(() =>
       defineFeature("bigstep", (r) => {
         r.entity("bigstep-order", orderEntity);
-        r.defineEvent("biz", z.object({ x: z.number() }), { version: 3 });
-        r.eventMigration("biz", 1, 3, (p) => p);
+        r.defineEvent("biz", z.object({ x: z.number() }), {
+          version: 3,
+          migrations: [{ fromVersion: 1, toVersion: 3, transform: (p) => p }],
+        });
       }),
     ).toThrow(/single-step/);
   });
 
-  test("r.eventMigration rejects duplicate step", () => {
+  test("defineEvent migrations reject duplicate step", () => {
     expect(() =>
       defineFeature("dupestep", (r) => {
         r.entity("dup-order", orderEntity);
-        r.defineEvent("dup", z.object({ x: z.number() }), { version: 2 });
-        r.eventMigration("dup", 1, 2, (p) => p);
-        r.eventMigration("dup", 1, 2, (p) => p);
+        r.defineEvent("dup", z.object({ x: z.number() }), {
+          version: 2,
+          migrations: [
+            { fromVersion: 1, toVersion: 2, transform: (p) => p },
+            { fromVersion: 1, toVersion: 2, transform: (p) => p },
+          ],
+        });
       }),
-    ).toThrow(/already registered/);
+    ).toThrow(/already declared/);
   });
 
   test("r.defineEvent rejects non-positive version", () => {

package/src/event-store/admin-api.ts

@@ -8,7 +8,7 @@
 // selbst, das Guard-Script selbst.
 
 import type { DbRunner } from "../db";
-import { isUniqueViolation } from "../db/pg-error";
+import { constraintOf, isUniqueViolation } from "../db/pg-error";
 import {
   eventPredecessorExists,
   findExistingEventVersion,
@@ -17,7 +17,7 @@ import {
   insertRawSubsequentEvent,
 } from "../db/queries/event-store-admin";
 import type { TenantId } from "../engine/types";
-import { VersionConflictError } from "./errors";
+import { IdempotentAppendConflictError, VersionConflictError } from "./errors";
 import type { EventMetadata } from "./event-store";
 
 export type RawEventToAppend = {
@@ -39,6 +39,13 @@ export type RawEventToAppend = {
   readonly createdBy: string;
 };
 
+function mapEventUniqueViolation(e: unknown, event: RawEventToAppend): Error {
+  if (constraintOf(e) === "events_idempotency_uq" && event.metadata.idempotencyKey) {
+    return new IdempotentAppendConflictError(event.tenantId, event.metadata.idempotencyKey);
+  }
+  return new VersionConflictError(event.aggregateId, event.expectedVersion);
+}
+
 // Mirrors append()'s two-path structure: typed builder equivalent for v=0,
 // INSERT … SELECT … WHERE EXISTS gate for v>0. Caller-supplied createdAt +
 // createdBy skip the usual userResolver/now() paths.
@@ -54,7 +61,7 @@ export async function appendRaw(runner: DbRunner, event: RawEventToAppend): Prom
     }
   } catch (e) {
     if (isUniqueViolation(e)) {
-      throw new VersionConflictError(event.aggregateId, event.expectedVersion);
+      throw mapEventUniqueViolation(e, event);
     }
     throw e;
   }
@@ -143,7 +150,7 @@ export async function appendRawBatch(
     if (isUniqueViolation(e)) {
       // Pre-flight ran but lost a race against a concurrent writer. Rare for
       // migration (single-runner) but possible; we can't name the exact row.
-      throw new VersionConflictError(firstEvent.aggregateId, firstEvent.expectedVersion);
+      throw mapEventUniqueViolation(e, firstEvent);
     }
     throw e;
   }

package/src/event-store/errors.ts

@@ -1,35 +1,2 @@
-// Failure modes of the event-store's append() path. Surfaced as typed
-// errors so the executor layer can map them to the framework's
-// WriteResult error contract (version_conflict).
-
-export class VersionConflictError extends Error {
-  public readonly aggregateId: string;
-  public readonly expectedVersion: number;
-  constructor(aggregateId: string, expectedVersion: number) {
-    super(
-      `Version conflict on aggregate ${aggregateId}: expected predecessor version ${expectedVersion}`,
-    );
-    this.name = "VersionConflictError";
-    this.aggregateId = aggregateId;
-    this.expectedVersion = expectedVersion;
-  }
-}
-
-// Thrown when ctx.appendEvent targets an archived stream. Archived aggregates
-// are read-only — restoreStream() makes them writable again. The archive
-// state is not carried on the events themselves; it lives on the sparse
-// kumiko_archived_streams table. Handlers that need to branch on archive
-// state should call ctx.isStreamArchived(id) first.
-export class ArchivedStreamError extends Error {
-  public readonly tenantId: string;
-  public readonly aggregateId: string;
-  constructor(tenantId: string, aggregateId: string) {
-    super(
-      `Aggregate ${aggregateId} on tenant ${tenantId} is archived — appendEvent is blocked. ` +
-        `Call restoreStream() to re-open the stream before writing.`,
-    );
-    this.name = "ArchivedStreamError";
-    this.tenantId = tenantId;
-    this.aggregateId = aggregateId;
-  }
-}
+// Legacy path — re-exported for callers still importing this module directly.
+export * from "@cosmicdrift/kumiko-types/event-store-errors";

package/src/event-store/event-store.ts

@@ -1,42 +1,29 @@
+import type { EventMetadata, StoredEvent } from "@cosmicdrift/kumiko-types/event-store-types";
+// Value-only import, aliased to avoid shadowing the ambient global
+// `Temporal` TYPE this file's other Temporal.Instant annotations resolve
+// against (StoredEvent.createdAt et al. — importing the bare name here
+// conflicts with that ambient type, see #1438). Bun doesn't expose Temporal
+// as a runtime value on globalThis, so the un-aliased call below crashed
+// with "Temporal is not defined" outside boot paths that install it (#1480).
+import { Temporal as TemporalPolyfill } from "temporal-polyfill";
+import { encryptEventPayloadPii } from "../crypto/event-pii";
 import type { DbRunner } from "../db";
-import { isUniqueViolation } from "../db/pg-error";
+import { constraintOf, isUniqueViolation } from "../db/pg-error";
 import {
   insertSubsequentEventRow,
   notifyPgChannel,
   selectAggregateMaxVersion,
-  selectAggregateStreamTenant,
   selectEventsHighWaterMark,
   selectStreamMaxVersion,
 } from "../db/queries/event-store";
 import { insertOne, selectMany } from "../db/query";
 import type { TenantId } from "../engine/types";
 import { isStreamArchived } from "./archive";
-import { VersionConflictError } from "./errors";
+import { IdempotentAppendConflictError, VersionConflictError } from "./errors";
 import { eventsTable } from "./events-schema";
 import { toStoredEvent } from "./row-to-stored-event";
 
-export type EventMetadata = {
-  readonly userId: string;
-  readonly requestId?: string;
-  // End-to-end business-operation id. Root HTTP requests get it from the
-  // x-correlation-id header (default: requestId). MSP-applies inherit it
-  // from the triggering event. Lets you trace "which user click caused
-  // this email 3 streams later?".
-  readonly correlationId?: string;
-  // Stored event id that triggered this write. Null for root commands;
-  // set to event.id when an MSP-apply runs ctx.appendEvent. Together with
-  // correlationId forms a causation DAG across aggregate streams.
-  readonly causationId?: string;
-  // Marten-conform free key/value space for app-specific metadata that
-  // doesn't deserve its own EventMetadata field. Examples: A/B-test bucket,
-  // feature-flag snapshot, geo-region, client SDK version. Persisted into
-  // events.metadata jsonb (no schema change — it's already a free-form
-  // jsonb column), survives upcasters untouched, available on every
-  // StoredEvent.metadata.headers. Framework does not interpret values; the
-  // app reads them when filtering/auditing. Keep values JSON-primitive
-  // (string|number|boolean) so JSON serialization stays bulletproof.
-  readonly headers?: Readonly<Record<string, string | number | boolean>>;
-};
+export type { EventMetadata, StoredEvent } from "@cosmicdrift/kumiko-types/event-store-types";
 
 export type EventToAppend = {
   readonly aggregateId: string;
@@ -50,25 +37,6 @@ export type EventToAppend = {
   readonly metadata: EventMetadata;
 };
 
-// Generic über payload-shape. Default = Record<string, unknown> macht
-// alle existierenden Konsumenten backwards-compatible. Konkrete Apply-
-// Handler / Tests können `StoredEvent<MyEventPayload>` annotieren um
-// payload typed zu lesen. Type-Propagation kommt durch r.defineEvent +
-// SingleStreamApplyFn<T> in apply-Maps.
-export type StoredEvent<TPayload = Record<string, unknown>> = {
-  readonly id: string;
-  readonly aggregateId: string;
-  readonly aggregateType: string;
-  readonly tenantId: TenantId;
-  readonly version: number;
-  readonly type: string;
-  readonly eventVersion: number;
-  readonly payload: TPayload;
-  readonly metadata: EventMetadata;
-  readonly createdAt: Temporal.Instant;
-  readonly createdBy: string;
-};
-
 type SelectedEvent = {
   readonly id: bigint;
   readonly aggregateId: string;
@@ -108,27 +76,36 @@ type SelectedEvent = {
 export const EVENTS_PUBSUB_CHANNEL = "kumiko_events_new";
 
 export async function append(db: DbRunner, event: EventToAppend): Promise<StoredEvent> {
-  const newVersion = event.expectedVersion + 1;
-  const eventVersion = event.eventVersion ?? 1;
+  // Event-PII (#799): stored payload AND returned echo carry ciphertext, so
+  // inline projections and rebuilds materialize identical rows.
+  const payload = await encryptEventPayloadPii(event.type, event.payload);
+  const toStore = payload === event.payload ? event : { ...event, payload };
+  const newVersion = toStore.expectedVersion + 1;
+  const eventVersion = toStore.eventVersion ?? 1;
 
   try {
     const row =
-      event.expectedVersion === 0
-        ? await insertFirstEvent(db, event, newVersion, eventVersion)
-        : await insertSubsequentEvent(db, event, newVersion, eventVersion);
+      toStore.expectedVersion === 0
+        ? await insertFirstEvent(db, toStore, newVersion, eventVersion)
+        : await insertSubsequentEvent(db, toStore, newVersion, eventVersion);
 
     // NOTIFY fires on commit (PG buffers NOTIFY per TX), so subscribers never
     // see a wake-up for an event that later rolled back. Harmless no-op when
     // no LISTENer is attached.
     await notifyPgChannel(db, EVENTS_PUBSUB_CHANNEL);
 
-    return buildStoredEvent(event, newVersion, eventVersion, row);
+    return buildStoredEvent(toStore, newVersion, eventVersion, row);
   } catch (e) {
     if (isUniqueViolation(e)) {
-      // Only constraint left on the events table: events_aggregate_version_uq
-      // on (tenant_id, aggregate_id, version). A unique violation here always
-      // means a concurrent writer in the same tenant won the race to the
-      // next version — retry-able conflict.
+      // Two unique constraints on this table: events_aggregate_version_uq
+      // (tenant_id, aggregate_id, version) — a concurrent writer won the
+      // race to the next version — and events_idempotency_uq (tenant_id,
+      // metadata->>'idempotencyKey') — the caller reused an idempotency key.
+      // constraintOf() tells them apart; unknown/renamed constraint falls
+      // back to VersionConflictError, the pre-existing behaviour.
+      if (constraintOf(e) === "events_idempotency_uq" && event.metadata.idempotencyKey) {
+        throw new IdempotentAppendConflictError(event.tenantId, event.metadata.idempotencyKey);
+      }
       throw new VersionConflictError(event.aggregateId, event.expectedVersion);
     }
     throw e;
@@ -181,12 +158,20 @@ async function insertSubsequentEvent(
     expectedVersion: event.expectedVersion,
   });
   if (!row) throw new VersionConflictError(event.aggregateId, event.expectedVersion);
+  const createdAt =
+    row.created_at instanceof Date
+      ? TemporalPolyfill.Instant.fromEpochMilliseconds(row.created_at.getTime())
+      : TemporalPolyfill.Instant.from(row.created_at);
   return {
     id: typeof row.id === "bigint" ? row.id : BigInt(row.id),
-    createdAt:
-      row.created_at instanceof Date
-        ? Temporal.Instant.fromEpochMilliseconds(row.created_at.getTime())
-        : Temporal.Instant.from(row.created_at),
+    // @cast-boundary temporal-polyfill-vs-ambient: same TC39 Temporal.Instant
+    // at runtime, two separate .d.ts sources (temporal-polyfill's bundled
+    // types vs the ambient temporal-spec global) disagree on a couple of
+    // method-overload signatures (until/equals argument types), so TS treats
+    // them as nominally distinct. Safe: this value is only ever consumed as
+    // a Temporal.Instant (comparisons, .toString(), arithmetic), never
+    // narrowed on the specific overload shape that differs.
+    createdAt: createdAt as unknown as Temporal.Instant,
   };
 }
 
@@ -276,29 +261,19 @@ export async function getStreamVersion(
   return selectStreamMaxVersion(db, aggregateId, tenantId);
 }
 
-/** MAX(version) for one aggregate — no tenant filter. Used by seed idempotency. */
+/** MAX(version) for one aggregate — no tenant filter. SECURITY: existence-oracle,
+ *  a caller can probe whether an aggregateId has any events regardless of tenant
+ *  membership. Only call from seed/system-internal paths (idempotency checks
+ *  against a known aggregateId) — never from a handler reachable with
+ *  caller-controlled input. */
 // @wrapper-known semantic-alias
-export async function getAggregateStreamMaxVersion(
+export async function getUnscopedAggregateStreamMaxVersion(
   db: DbRunner,
   aggregateId: string,
 ): Promise<number> {
   return selectAggregateMaxVersion(db, aggregateId);
 }
 
-/** Stream tenant of an aggregate (the tenant_id its events live under), with no
- *  membership/tenant filter. Recovers the write target for a systemScope
- *  aggregate whose stream tenant isn't one of the subject's memberships.
- *  Returns null for unknown streams. */
-export async function getAggregateStreamTenant(
-  db: DbRunner,
-  aggregateId: string,
-  aggregateType: string,
-): Promise<TenantId | null> {
-  const tenantId = await selectAggregateStreamTenant(db, aggregateId, aggregateType);
-  // DB-boundary: kumiko_events.tenant_id is a TenantId-shaped uuid column.
-  return tenantId as TenantId | null;
-}
-
 // Global high-water-mark = MAX(events.id). Marten/Wolverine standard for
 // projection/consumer lag math: lag = HWM - cursor. Single-row aggregate over
 // the bigserial PK index — sub-millisecond cost. Returns 0n on an empty log
@@ -328,15 +303,19 @@ export async function loadEventsAfterVersion(
 
 // Load every event for an aggregate_type across all tenants. Ordered by
 // (created_at, id) — chronological replay order for projection rebuilds.
-//
-// CAUTION — buffers ALL matching events in memory. Safe for smaller
-// aggregate-types (≤ 100k events), a memory cliff for large stores.
-// For >100k events use `streamAllEventsByType` (yields batchwise).
 // Mostly called from tests today — production rebuild goes through
 // projection-rebuild's own streaming path.
+//
+// Fails loud past LOAD_ALL_EVENTS_ROW_LIMIT rather than silently buffering
+// an unbounded result set — that's the memory cliff this guard exists to
+// prevent.
+export const LOAD_ALL_EVENTS_ROW_LIMIT = 100_000;
+
+/** Buffers ALL matching events in memory — a memory cliff for large stores. Use `streamAllEventsByType` (yields batchwise) for production reads; this is test-only in practice. */
 export async function loadAllEventsByType(
   db: DbRunner,
   aggregateType: string,
+  rowLimit: number = LOAD_ALL_EVENTS_ROW_LIMIT,
 ): Promise<readonly StoredEvent[]> {
   const rows = await selectMany<SelectedEvent>(
     db,
@@ -347,8 +326,15 @@ export async function loadAllEventsByType(
         { col: "createdAt", direction: "asc" },
         { col: "id", direction: "asc" },
       ],
+      limit: rowLimit + 1,
     },
   );
+  if (rows.length > rowLimit) {
+    throw new Error(
+      `loadAllEventsByType("${aggregateType}") exceeds ${rowLimit} rows — ` +
+        "use streamAllEventsByType instead of buffering the full result set in memory.",
+    );
+  }
   return rows.map(toStoredEvent);
 }
 

package/src/event-store/events-schema.ts

@@ -12,28 +12,22 @@ import {
   uniqueIndex,
   uuid,
 } from "../db/dialect";
+import { ensureIdempotencyKeyIndex } from "../db/queries/event-store";
 import { unsafePushTables } from "../stack";
 import { createArchivedStreamsTable } from "./archive";
 import { createSnapshotsTable } from "./snapshot";
+import type { EventMetadata } from "./types";
 
 // Event-store schema as a Drizzle table. The typed select/insert path handles
 // most operations; append() for subsequent versions uses raw SQL because
 // INSERT ... SELECT ... WHERE EXISTS isn't ergonomic in the typed builder.
 //
 // HTTP-level retry idempotency is handled by pipeline/idempotency.ts
-// (Redis-backed check + cached-response replay). The event-store itself
-// imposes no idempotency index — a single HTTP request may write N events
-// freely, metadata.requestId is purely a trace marker.
-export type EventMetadata = {
-  readonly userId: string;
-  readonly requestId?: string;
-  readonly correlationId?: string;
-  readonly causationId?: string;
-  // App-specific free key/value (Marten "headers"). Mirror of the canonical
-  // type in event-store.ts — kept duplicate because events-schema must stay
-  // import-cycle-free vs the event-store module.
-  readonly headers?: Readonly<Record<string, string | number | boolean>>;
-};
+// (Redis-backed check + cached-response replay); metadata.requestId is
+// purely a trace marker (no uniqueness constraint — one request may write
+// N events). Callers that need a hard per-event guarantee as a second line
+// of defense set metadata.idempotencyKey, enforced by the tenant-scoped
+// partial unique index ensureIdempotencyKeyIndex() creates below.
 
 export const eventsTable = pgTable(
   "kumiko_events",
@@ -86,6 +80,10 @@ export async function createEventsTable(db: DbConnection): Promise<void> {
   if (!(await tableExists(db, "public.kumiko_events"))) {
     await unsafePushTables(db, { kumikoEvents: eventsTable });
   }
+  // Runs unconditionally (both fresh + already-existing table) so installs
+  // that predate the idempotency-key index get healed the same way
+  // ensureSnapshotVersionColumn heals kumiko_snapshots.
+  await ensureIdempotencyKeyIndex(db);
   await createArchivedStreamsTable(db);
   await createSnapshotsTable(db);
 }

package/src/event-store/index.ts

@@ -1,3 +1,9 @@
+export {
+  backfillEventPiiEncryption,
+  type PiiBackfillFailure,
+  type PiiBackfillOptions,
+  type PiiBackfillResult,
+} from "../db/queries/backfill-pii";
 export {
   type ArchiveStreamArgs,
   archivedStreamsTable,
@@ -6,16 +12,16 @@ export {
   isStreamArchived,
   restoreStream,
 } from "./archive";
-export { ArchivedStreamError, VersionConflictError } from "./errors";
+export { ArchivedStreamError, IdempotentAppendConflictError, VersionConflictError } from "./errors";
 export {
   append,
   EVENTS_PUBSUB_CHANNEL,
   type EventMetadata,
   type EventToAppend,
-  getAggregateStreamMaxVersion,
-  getAggregateStreamTenant,
   getEventsHighWaterMark,
   getStreamVersion,
+  getUnscopedAggregateStreamMaxVersion,
+  LOAD_ALL_EVENTS_ROW_LIMIT,
   loadAggregate,
   loadAggregateAsOf,
   loadAllEventsByType,
@@ -24,9 +30,18 @@ export {
   streamAllEventsByType,
 } from "./event-store";
 export { createEventsTable, eventsTable } from "./events-schema";
+export {
+  createRebuildDeadLetterTable,
+  listRebuildDeadLetters,
+  type RebuildDeadLetterRow,
+  rebuildDeadLetterTable,
+  recordRebuildDeadLetters,
+  type SkippedApply,
+} from "./rebuild-dead-letter";
 export { toStoredEvent } from "./row-to-stored-event";
 export {
   createSnapshotsTable,
+  type LoadAggregateWithSnapshotOptions,
   type LoadAggregateWithSnapshotResult,
   loadAggregateWithSnapshot,
   loadLatestSnapshot,