@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/pipeline/index.ts

@@ -57,6 +57,8 @@ export {
 } from "./projection-state";
 export { runProjectionsForEvent } from "./projections-runner";
 export {
+  ACCESS_INVALIDATION_CONSUMER_NAME,
+  createAccessInvalidationEventConsumer,
   createSearchEventConsumer,
   createSseBroadcastEventConsumer,
   SEARCH_CONSUMER_NAME,

package/src/pipeline/msp-rebuild.ts

@@ -6,16 +6,22 @@ import {
   updateConsumerRebuildCursor,
 } from "../db/queries/event-consumer";
 import {
+  assertLiveColumnsMatchMeta,
   buildShadowTable,
   ensureRebuildSchema,
   rebuildMetaOrThrow,
   swapShadowIntoLive,
 } from "../db/queries/shadow-swap";
-import { selectMany } from "../db/query";
+import { runInSavepoint, selectMany } from "../db/query";
 import type { Registry, TenantId } from "../engine/types";
 import { InternalError } from "../errors";
 import { eventsTable, type StoredEvent, upcastStoredEvent } from "../event-store";
 import { loadAggregate, loadAggregateAsOf } from "../event-store/event-store";
+import {
+  createRebuildDeadLetterTable,
+  recordRebuildDeadLetters,
+  type SkippedApply,
+} from "../event-store/rebuild-dead-letter";
 import { upcastStoredEvents } from "../event-store/upcaster";
 import { emitProjectionRebuild } from "../observability/standard-metrics";
 import type { Meter } from "../observability/types/metric";
@@ -123,16 +129,26 @@ export async function rebuildMultiStreamProjection(
 
   const meta = rebuildMetaOrThrow(msp.table, mspName);
 
+  // Declared per-projection (MspErrorMode): the rebuild policy falls back to
+  // continuous when omitted — previously declared but never honored here.
+  const skipApplyErrors =
+    (msp.errorMode?.rebuild ?? msp.errorMode?.continuous)?.skipApplyErrors === true;
+
   const startedAt = Date.now();
   let eventsProcessed = 0;
   let lastProcessedEventId = 0n;
+  const skipped: SkippedApply[] = [];
 
   try {
     await ensureRebuildSchema(db);
+    // Outside the rebuild tx, like the schema: idempotent DDL colliding
+    // inside the tx would roll the whole replay back.
+    if (skipApplyErrors) await createRebuildDeadLetterTable(db);
     await db.begin(async (tx: DbTx) => {
       await resetConsumerForMspRebuild(tx, mspName, SHARED_INSTANCE_SENTINEL);
       await selectConsumerForUpdate(tx, mspName, SHARED_INSTANCE_SENTINEL);
 
+      await assertLiveColumnsMatchMeta(tx, meta, mspName);
       await buildShadowTable(tx, meta);
 
       const subscribedTypes = Object.keys(msp.apply);
@@ -178,13 +194,31 @@ export async function rebuildMultiStreamProjection(
           });
           const applyFn = msp.apply[row.type];
           if (!applyFn) continue;
-          const rebuildCtx = createRebuildCtx(registry, tx, row.tenantId);
-          await applyFn(storedEvent, tx, rebuildCtx);
+          if (skipApplyErrors) {
+            // Driver-native savepoint: a throwing SQL statement would
+            // otherwise poison the rebuild tx (25P02) AND make the driver
+            // reject the whole begin() even after a caught error. Apply +
+            // ctx run on the savepoint-scoped handle.
+            try {
+              await runInSavepoint(tx, async (sp) => {
+                const rebuildCtx = createRebuildCtx(registry, sp as DbRunner, row.tenantId);
+                await applyFn(storedEvent, sp as DbRunner, rebuildCtx);
+              });
+            } catch (e) {
+              skipped.push({ event: storedEvent, error: e });
+            }
+          } else {
+            const rebuildCtx = createRebuildCtx(registry, tx, row.tenantId);
+            await applyFn(storedEvent, tx, rebuildCtx);
+          }
           eventsProcessed++;
           lastProcessedEventId = row.id;
         }
       }
 
+      if (skipped.length > 0) {
+        await recordRebuildDeadLetters(tx, mspName, skipped);
+      }
       await updateConsumerRebuildCursor(
         tx,
         mspName,
@@ -210,8 +244,13 @@ export async function rebuildMultiStreamProjection(
   const result: RebuildResult = {
     projection: mspName,
     eventsProcessed,
+    eventsSkipped: skipped.length,
     lastProcessedEventId,
     durationMs: Date.now() - startedAt,
+    // countColumnDrift is single-table (public.<t> vs kumiko_rebuild.<t>) and
+    // not wired into the multi-stream rebuild path — MSPs don't run the
+    // implicit-projection ghost-row guard either. #916 scope is single-table.
+    columnDriftCount: 0,
   };
   if (deps.meter) {
     emitProjectionRebuild(

package/src/pipeline/multi-stream-apply-context.ts

@@ -1,50 +1,12 @@
+import type { MultiStreamApplyContext } from "@cosmicdrift/kumiko-types/multi-stream-apply-context-types";
 import type { DbRunner } from "../db/connection";
-import type {
-  AppendEventArgs,
-  AppendEventFn,
-  KumikoEventTypeMap,
-  Registry,
-  TenantId,
-  UnsafeAppendEventFn,
-} from "../engine/types";
-import { loadAggregate, loadAggregateAsOf, type StoredEvent } from "../event-store/event-store";
+import type { AppendEventArgs, AppendEventFn, Registry, TenantId } from "../engine/types";
+import { loadAggregate, loadAggregateAsOf } from "../event-store/event-store";
 import { upcastStoredEvents } from "../event-store/upcaster";
 import type { FileContext } from "../files/file-handle";
 import { appendDomainEventCore } from "./append-event-core";
 
-// Minimal, read+write surface handed to a MultiStreamProjection's apply()
-// when it needs to produce follow-up events (saga / process-manager
-// pattern). Keeps the MSP feature-decoupled: applies don't reach into
-// handler-bridge (no query/write/writeAs), they just read the aggregate
-// stream and append new events — Marten's session scope for projections.
-//
-// TMap propagates the strict event-type-map (see HandlerContext). Default
-// matches the global KumikoEventTypeMap; runtime-pluggable callers route
-// through unsafeAppendEvent.
-export type MultiStreamApplyContext<TMap extends object = KumikoEventTypeMap> = {
-  // Append a domain event onto an aggregate stream in the CURRENT tx.
-  // Schema-validated, archive-guarded, stream-version derived. Metadata
-  // inherits from the triggering event (correlationId) + requestContext
-  // (causationId is already set to the triggering event.id by the
-  // dispatcher wrap). Strict against KumikoEventTypeMap — same contract
-  // as HandlerContext.appendEvent (compile-time-validated payload).
-  readonly appendEvent: AppendEventFn<TMap>;
-  // Escape hatch for runtime-pluggable events without compile-time
-  // augmentation. Same runtime semantics; type-surface is `payload: unknown`.
-  readonly unsafeAppendEvent: UnsafeAppendEventFn;
-  // Read an aggregate stream — useful when a saga needs to inspect the
-  // current state of a different aggregate before deciding what to emit.
-  readonly loadAggregate: (
-    aggregateId: string,
-    options?: { readonly asOf?: Temporal.Instant },
-  ) => Promise<readonly StoredEvent[]>;
-  // Binary storage handle factory, mirrors AppContext.files. Present when
-  // the app booted with `files.storageProvider`; undefined otherwise.
-  // Post-processing MSPs (resize, EXIF-strip, virus-scan) read bytes via
-  // `ctx.files.ref(payload.storageKey).read()` and write derivates via
-  // `.derive("thumb").write(...)` — binaries never ride through events.
-  readonly files?: FileContext;
-};
+export type { MultiStreamApplyContext } from "@cosmicdrift/kumiko-types/multi-stream-apply-context-types";
 
 export type MultiStreamApplyContextDeps = {
   readonly registry: Registry;

package/src/pipeline/projection-rebuild.ts

@@ -7,13 +7,17 @@ import {
   selectEventsForProjectionRebuildBatch,
 } from "../db/queries/projection-rebuild";
 import {
+  assertLiveColumnsMatchMeta,
+  assertNoUnreachableLiveRows,
   buildShadowTable,
+  type ColumnDriftResult,
+  countColumnDrift,
   ensureRebuildSchema,
   fenceLiveTable,
   rebuildMetaOrThrow,
   swapShadowIntoLive,
 } from "../db/queries/shadow-swap";
-import { coerceRow, extractTableInfo, selectMany } from "../db/query";
+import { coerceRow, extractTableInfo, runInSavepoint, selectMany } from "../db/query";
 import type { Registry, TenantId } from "../engine/types";
 import {
   eventsTable,
@@ -22,6 +26,11 @@ import {
   upcastStoredEvent,
 } from "../event-store";
 import type { EventMetadata } from "../event-store/event-store";
+import {
+  createRebuildDeadLetterTable,
+  recordRebuildDeadLetters,
+  type SkippedApply,
+} from "../event-store/rebuild-dead-letter";
 import { emitProjectionRebuild } from "../observability/standard-metrics";
 import type { Meter } from "../observability/types/metric";
 import { projectionStateTable } from "./projection-state";
@@ -119,9 +128,19 @@ function rowToStoredEvent(row: StoredEventRow): StoredEvent {
 
 export type RebuildResult = {
   readonly projection: string;
+  // Events consumed from the log — includes quarantined ones (the cursor
+  // advanced past them).
   readonly eventsProcessed: number;
+  // Poison events quarantined into kumiko_rebuild_dead_letters this run.
+  // Always 0 unless quarantine mode was active (#760).
+  readonly eventsSkipped: number;
   readonly lastProcessedEventId: bigint;
   readonly durationMs: number;
+  // Live rows whose columns differ from the freshly-replayed shadow (bidx
+  // columns excluded — see countColumnDrift). Non-blocking: the swap
+  // proceeds regardless (#916). 0 for explicit projections (guard is
+  // implicit-only) or when no drift was found.
+  readonly columnDriftCount: number;
 };
 
 type RebuildDeps = {
@@ -145,6 +164,15 @@ type RebuildDeps = {
   // on the live table; if a long-running writer holds it past this, the rebuild
   // fails loud instead of hanging. Defaults to DEFAULT_FENCE_LOCK_TIMEOUT_MS.
   readonly fenceLockTimeoutMs?: number;
+  // Apply-error policy for THIS run. Default strict: the first throwing
+  // apply aborts the rebuild (tx rollback, status "failed") — a poison
+  // event makes the projection permanently un-rebuildable (#760).
+  // skipApplyErrors: true confines every apply to a savepoint; a throwing
+  // apply is rolled back, recorded into kumiko_rebuild_dead_letters and
+  // skipped, and the rebuild completes without its effect. Opt-in for
+  // operators unblocking a pinned rebuild — the projection then knowingly
+  // misses the quarantined events until they are repaired and replayed.
+  readonly errorPolicy?: { readonly skipApplyErrors?: boolean };
   // Test-only seam: fires once after the unlocked bulk drain and before the
   // cutover fence. Lets a concurrency test inject a committed write into the
   // replay window deterministically. The `__test_` prefix marks it test-only:
@@ -157,6 +185,27 @@ type RebuildDeps = {
   readonly __test_onBuildShadowTable?: () => void;
 };
 
+// Ops-facing log line for countColumnDrift's result. No-op when clean. #916.
+function warnOnColumnDrift(
+  projectionName: string,
+  tableName: string,
+  drift: ColumnDriftResult,
+): void {
+  // skip: no drift found — nothing to warn about
+  if (drift.rowCount === 0) return;
+  const sampledIds = new Set(drift.sample.map((s) => s.slice(0, s.lastIndexOf("."))));
+  const countLabel =
+    sampledIds.size < drift.rowCount
+      ? `${drift.rowCount} (sample truncated)`
+      : String(drift.rowCount);
+  console.warn(
+    `projection-rebuild "${projectionName}": ${countLabel} live row(s) in "${tableName}" have ` +
+      `column values that differ from the freshly-replayed shadow (sample: ${drift.sample.join(", ")}). ` +
+      "Not blocking — replay wins on swap. Likely cause: a legacy direct-write predating the row's " +
+      "event history (#494), or a sensitive custom field pending #972. Investigate if unexpected.",
+  );
+}
+
 export async function rebuildProjection(
   projectionName: string,
   deps: RebuildDeps,
@@ -174,7 +223,7 @@ export async function rebuildProjection(
   const meta = rebuildMetaOrThrow(projection.table, projectionName);
 
   const sources = Array.isArray(projection.source) ? projection.source : [projection.source];
-  const sourcesList = [...sources];
+  const sourcesList = [...sources, ...(projection.extraSources ?? [])];
   const subscribedList = Object.keys(projection.apply);
   // Upcasters run at read time: older stored payloads get walked through the
   // registered r.eventMigration chain until their shape matches the current
@@ -184,7 +233,13 @@ export async function rebuildProjection(
   const fenceLockTimeoutMs = deps.fenceLockTimeoutMs ?? DEFAULT_FENCE_LOCK_TIMEOUT_MS;
   const startedAt = Date.now();
   let eventsProcessed = 0;
+  let columnDriftCount = 0;
   let lastProcessedEventId = 0n;
+  const skipApplyErrors = deps.errorPolicy?.skipApplyErrors === true;
+  // Quarantined events, collected in memory and written once after the
+  // replay settles — the #443 full-re-replay path would otherwise duplicate
+  // the dead-letter rows.
+  let skipped: SkippedApply[] = [];
 
   // One chronological batch of events after lastProcessedEventId, applied into
   // the shadow. Returns the batch size so the caller can detect the tail
@@ -208,7 +263,21 @@ export async function rebuildProjection(
       // skip: apply-key validation ensures every subscribed type has a handler;
       //       defensive check against runtime-mutated registry
       if (!applyFn) continue;
-      await applyFn(storedEvent, tx, projection.table);
+      if (skipApplyErrors) {
+        // Driver-native savepoint: a throwing SQL statement would otherwise
+        // poison the rebuild tx (25P02) AND make the driver reject the whole
+        // begin() even after a caught error. The apply runs on the
+        // savepoint-scoped handle so its statements are confined.
+        try {
+          await runInSavepoint(tx, async (sp) => {
+            await applyFn(storedEvent, sp as DbTx, projection.table);
+          });
+        } catch (e) {
+          skipped.push({ event: storedEvent, error: e });
+        }
+      } else {
+        await applyFn(storedEvent, tx, projection.table);
+      }
       eventsProcessed++;
       lastProcessedEventId = row.id;
     }
@@ -217,8 +286,12 @@ export async function rebuildProjection(
 
   try {
     await ensureRebuildSchema(db);
+    // Outside the rebuild tx, like the schema: idempotent DDL colliding
+    // inside the tx would roll the whole replay back.
+    if (skipApplyErrors) await createRebuildDeadLetterTable(db);
     await db.begin(async (tx: DbTx) => {
       await markProjectionRebuilding(tx, projectionName);
+      await assertLiveColumnsMatchMeta(tx, meta, projectionName);
       await buildShadowTable(tx, meta);
       deps.__test_onBuildShadowTable?.();
 
@@ -261,12 +334,39 @@ export async function rebuildProjection(
           deps.__test_onBuildShadowTable?.();
           lastProcessedEventId = 0n;
           eventsProcessed = 0;
+          skipped = [];
           while ((await drainBatch(tx)) === REBUILD_BATCH_SIZE) {
             // re-replay the full log into the fresh shadow
           }
+          // drainBatch increments eventsProcessed for every drained row
+          // regardless of quarantine (skipApplyErrors), so this must hold
+          // exactly under the fence — a mismatch means drainBatch silently
+          // dropped a row instead of counting it, which the rest of this
+          // function has no other way to detect.
+          if (eventsProcessed < Number(expectedEvents)) {
+            throw new Error(
+              `projection-rebuild "${projectionName}": fenced re-replay processed ` +
+                `${eventsProcessed} events but ${expectedEvents} were expected — drainBatch ` +
+                "silently dropped rows instead of counting them.",
+            );
+          }
         }
       }
 
+      if (skipped.length > 0) {
+        await recordRebuildDeadLetters(tx, projectionName, skipped);
+      }
+      // Guard the swap: abort if the live table holds a row no event can
+      // reconstruct (#498 ghost — direct-inserted without a .created event),
+      // which the swap would silently drop. Implicit projections only.
+      if (projection.isImplicit === true) {
+        await assertNoUnreachableLiveRows(tx, projectionName, meta.tableName, sourcesList);
+        // Non-blocking counterpart: reports column-level drift (bidx excluded)
+        // without aborting — see countColumnDrift for why this isn't fail-hard.
+        const drift = await countColumnDrift(tx, meta.tableName, meta);
+        columnDriftCount = drift.rowCount;
+        warnOnColumnDrift(projectionName, meta.tableName, drift);
+      }
       await finalizeProjectionRebuild(tx, projectionName, lastProcessedEventId);
       await swapShadowIntoLive(tx, meta.tableName);
     });
@@ -292,8 +392,10 @@ export async function rebuildProjection(
   const result: RebuildResult = {
     projection: projectionName,
     eventsProcessed,
+    eventsSkipped: skipped.length,
     lastProcessedEventId,
     durationMs: Date.now() - startedAt,
+    columnDriftCount,
   };
   if (deps.meter) {
     emitProjectionRebuild(

package/src/pipeline/system-hooks.ts

@@ -1,7 +1,7 @@
 import type { SseBroker } from "../api/sse-broker";
 import type { DbRow } from "../db/connection";
 import { tenantChannel } from "../engine/constants";
-import type { EntityId, Registry } from "../engine/types";
+import type { EntityId, JobRunnerRef, Registry, SessionUser } from "../engine/types";
 import type { SearchAdapter, SearchDocument } from "../search/types";
 import type { EventConsumer } from "./event-dispatcher";
 
@@ -41,6 +41,13 @@ export function createSearchEventConsumer(
 ): EventConsumer {
   return {
     name: SEARCH_CONSUMER_NAME,
+    // ponytail: count-based maxAttempts, not real backoff — retries hammer
+    // the search adapter every pollIntervalMs during an outage instead of
+    // spacing out. 1200 attempts * 100ms default poll ~= 2min budget for a
+    // still-provisioning Meilisearch to come up at boot (was 10 = ~1s,
+    // killing the consumer near-instantly). Upgrade path: time-based
+    // dead-lettering in event-dispatcher-delivery.ts if 2min isn't enough.
+    errorPolicy: { maxAttempts: 1200 },
     handler: async (event) => {
       const entityName = event.aggregateType;
       const verb = event.type.split(".").pop();
@@ -242,3 +249,139 @@ export function createSseBroadcastEventConsumer(sseBroker: SseBroker): EventCons
     },
   };
 }
+
+// --- Job-Trigger Consumer (async, via event-dispatcher) ---
+//
+// r.job's `trigger.on` historically only fired via the synchronous
+// write-handler dispatch path (dispatch-write.ts's afterCommitHooks calling
+// jobRunner.handleEvent). Events appended any other way — an
+// r.multiStreamProjection's ctx.unsafeAppendEvent, or a raw
+// event-store-executor write (e.g. `files`' fileRef.created) — never
+// reached it, so a job could never trigger on an r.defineEvent-registered
+// event (kumiko-framework#1505).
+//
+// This consumer closes that gap the same way search/SSE do: read every
+// committed event off the shared cursor and re-check job triggers. It is
+// scoped EXACTLY to the gap — the write/query-handler-QN skip below is
+// defense-in-depth: no stored event's `type` is a handler QN today (entity
+// events are "entity.verb"; ctx.appendEvent enforces defineEvent-only
+// ownership), but if that ever changes, this consumer must not re-fire a
+// trigger the synchronous dispatch-write.ts path already handled.
+//
+// Delivery is at-least-once (cursor semantics) where the synchronous path
+// is effectively once — job handlers reached via an r.defineEvent trigger
+// must be idempotent (same expectation r.multiStreamProjection applies
+// already carry).
+export const JOB_TRIGGER_CONSUMER_NAME = "system:consumer:job-trigger";
+
+export function createJobTriggerEventConsumer(
+  jobRunner: JobRunnerRef,
+  registry: Registry,
+): EventConsumer {
+  return {
+    name: JOB_TRIGGER_CONSUMER_NAME,
+    handler: async (event) => {
+      // skip: write/query-handler QN — already dispatched synchronously by
+      // dispatch-write.ts's afterCommitHooks. Re-firing here would
+      // double-enqueue every existing handler-triggered job.
+      if (registry.getWriteHandler(event.type) || registry.getQueryHandler(event.type)) return;
+      // skip: no r.defineEvent registered under this type — nothing this
+      // consumer is responsible for.
+      if (!registry.getEvent(event.type)) return;
+
+      const user: SessionUser = {
+        id: event.metadata.userId,
+        tenantId: event.tenantId,
+        roles: [],
+      };
+      await jobRunner.handleEvent(event.type, event.payload, user);
+    },
+  };
+}
+
+// --- Access-Invalidation Consumer (async, via event-dispatcher) ---
+//
+// #1524 (Design), #1558 (channel + stream subscribe), #1559 (session-revoke
+// emits an event). This consumer is the last leg: it watches for the two
+// event types that can make an already-issued JWT stale mid-stream and
+// pushes an invalidation through sseBroker.publishAccessInvalidation, which
+// dispatch-stream.ts's subscribeAccessInvalidation listener turns into an
+// AccessDeniedError thrown into the open stream.
+//
+// Event types are literal strings, not imports — this package (framework)
+// cannot depend on bundled-features (sessions, tenant own these events),
+// mirrors the es-ops-seed precedent (literal QNs, no subpath import).
+//
+//   "sessions:event:session-revoked" — payload.userId direct (own aggregate,
+//     see bundled-features/sessions/session-revoked-event.ts). Fired for
+//     both self-service revoke and the privileged cross-tenant
+//     revoke-all-for-user (SYSTEM_TENANT_ID-anchored DSGVO Art.18 freeze).
+//     fetchPendingEvents has no tenant predicate, so the SYSTEM_TENANT_ID-
+//     anchored event reaches this consumer the same as any other — routing
+//     is purely on payload.userId, never on event.tenantId.
+//   "tenant-membership.updated" / "tenant-membership.deleted" — role change
+//     or member removal. userId isn't in payload.changes (update only
+//     carries the changed fields, e.g. { roles }) so it's read from
+//     payload.previous, the full pre-write entity snapshot written by
+//     createEventStoreExecutor. tenantMembershipEntity declares no
+//     encrypted/PII fields, so previous.userId is plaintext — no KMS
+//     decrypt step (see kumiko-framework#1560 PR discussion; the issue's
+//     original handoff assumed encryption that doesn't apply here).
+//
+// Over-invalidation (e.g. tenant-membership.updated fired by something
+// other than a role change) is fail-safe: the stream closes, the client
+// reconnects and re-authorizes. No opt-out/allowlist — #1524 chose
+// global-by-default specifically so this can't be silently disabled per
+// handler.
+//
+// Scope note: entityEventName also emits "tenant-membership.forgotten" (DSGVO
+// erasure) and ".restored" — .restored re-grants access so ignoring it is
+// correct, .forgotten is not currently produced by any user-data-rights
+// pipeline for memberships but would be revocation-relevant if it ever is.
+// Out of #1560's stated scope (session-revoke + role/membership change),
+// tracked rather than handled speculatively here.
+export const ACCESS_INVALIDATION_CONSUMER_NAME = "system:consumer:access-invalidation";
+
+const SESSION_REVOKED_EVENT_TYPE = "sessions:event:session-revoked";
+const TENANT_MEMBERSHIP_UPDATED_EVENT_TYPE = "tenant-membership.updated";
+const TENANT_MEMBERSHIP_DELETED_EVENT_TYPE = "tenant-membership.deleted";
+
+function readUserIdFromPreviousSnapshot(payload: Record<string, unknown>): string | undefined {
+  const previous = payload["previous"];
+  if (typeof previous !== "object" || previous === null) return undefined;
+  const userId = (previous as Record<string, unknown>)["userId"];
+  return typeof userId === "string" && userId.length > 0 ? userId : undefined;
+}
+
+export function createAccessInvalidationEventConsumer(sseBroker: SseBroker): EventConsumer {
+  return {
+    name: ACCESS_INVALIDATION_CONSUMER_NAME,
+    // Per-instance, same reasoning as SSE broadcast: subscribeAccessInvalidation
+    // listeners live in this process's in-memory sseBroker only. A shared
+    // cursor would deliver the event to exactly one instance and leave
+    // every other instance's open streams for that user un-invalidated.
+    delivery: "per-instance",
+    handler: async (event) => {
+      if (event.type === SESSION_REVOKED_EVENT_TYPE) {
+        const userId = event.payload["userId"];
+        // skip: malformed session-revoked payload — fail open on this one
+        // event rather than dead-lettering the whole consumer (halt-on-
+        // poison would otherwise permanently stop access-invalidation for
+        // every user behind one bad row).
+        if (typeof userId !== "string" || userId.length === 0) return;
+        sseBroker.publishAccessInvalidation(userId);
+      }
+
+      if (
+        event.type === TENANT_MEMBERSHIP_UPDATED_EVENT_TYPE ||
+        event.type === TENANT_MEMBERSHIP_DELETED_EVENT_TYPE
+      ) {
+        const userId = readUserIdFromPreviousSnapshot(event.payload);
+        // skip: previous snapshot missing/malformed userId — same fail-open
+        // reasoning as above.
+        if (userId === undefined) return;
+        sseBroker.publishAccessInvalidation(userId);
+      }
+    },
+  };
+}

package/src/rate-limit/__tests__/resolver.integration.test.ts

@@ -169,6 +169,24 @@ describe("createRateLimitResolver — peek", () => {
   });
 });
 
+describe("createRateLimitResolver — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("check() and peek() compute resetAt without relying on globalThis.Temporal", async () => {
+    const config = { limit: 5, windowSeconds: 60 };
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const checked = await resolver.check("no-ambient:user", config);
+      expect(checked.resetAt).toBeDefined();
+
+      const peeked = await resolver.peek("no-ambient:user", config);
+      expect(peeked.resetAt).toBeDefined();
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
 describe("createRateLimitResolver — enforce", () => {
   test("enforce throws RateLimitError with the bucket details when blocked", async () => {
     const config = { limit: 1, windowSeconds: 60 };

package/src/rate-limit/resolver.ts

@@ -1,4 +1,13 @@
+import type {
+  RateLimitConfig,
+  RateLimitDecision,
+  RateLimitResolver,
+} from "@cosmicdrift/kumiko-types/rate-limit-types";
 import type Redis from "ioredis";
+// Value-only import, aliased to avoid shadowing the ambient global
+// `Temporal` TYPE that RateLimitDecision.resetAt resolves against (see
+// event-store.ts for the same #1438 dual-package-hazard pattern).
+import { Temporal as TemporalPolyfill } from "temporal-polyfill";
 import { RateLimitError } from "../errors";
 import { RedisKeys } from "../pipeline/redis-keys";
 
@@ -108,36 +117,11 @@ end
 return { math.floor(tokens), retryAfterMs }
 `;
 
-export type RateLimitDecision = {
-  readonly allowed: boolean;
-  readonly limit: number;
-  readonly remaining: number;
-  readonly retryAfterSeconds: number;
-  readonly windowSeconds: number;
-  readonly resetAt: Temporal.Instant;
-};
-
-export type RateLimitConfig = {
-  readonly limit: number;
-  readonly windowSeconds: number;
-  readonly cost?: number;
-};
-
-export type RateLimitResolver = {
-  // Atomic check + deduct. Returns the decision and current bucket state
-  // — caller decides whether to throw RateLimitError or proceed.
-  check(bucket: string, config: RateLimitConfig): Promise<RateLimitDecision>;
-
-  // Convenience: throws RateLimitError when blocked. Useful inside the
-  // dispatcher / middleware code-paths where the failure shape is fixed.
-  enforce(bucket: string, config: RateLimitConfig): Promise<RateLimitDecision>;
-
-  // Read-only inspection: returns the same shape as check() but never
-  // mutates the bucket — no token deduction, no refill-timestamp update.
-  // Use for ops/status queries (e.g. "kumiko rl status user:42") that
-  // must observe the bucket without disturbing it.
-  peek(bucket: string, config: Omit<RateLimitConfig, "cost">): Promise<RateLimitDecision>;
-};
+export type {
+  RateLimitConfig,
+  RateLimitDecision,
+  RateLimitResolver,
+} from "@cosmicdrift/kumiko-types/rate-limit-types";
 
 export type RateLimitResolverOptions = {
   readonly redis: Redis;
@@ -209,7 +193,7 @@ export function createRateLimitResolver(opts: RateLimitResolverOptions): RateLim
     );
 
     const retryAfterSeconds = Math.ceil(retryAfterMs / 1000);
-    const resetAt = Temporal.Instant.fromEpochMilliseconds(nowMs + retryAfterMs);
+    const resetAt = TemporalPolyfill.Instant.fromEpochMilliseconds(nowMs + retryAfterMs);
 
     return {
       allowed: allowedFlag === 1,
@@ -249,7 +233,7 @@ export function createRateLimitResolver(opts: RateLimitResolverOptions): RateLim
     );
 
     const retryAfterSeconds = Math.ceil(retryAfterMs / 1000);
-    const resetAt = Temporal.Instant.fromEpochMilliseconds(nowMs + retryAfterMs);
+    const resetAt = TemporalPolyfill.Instant.fromEpochMilliseconds(nowMs + retryAfterMs);
 
     return {
       // peek doesn't deduct, so a "would-be" allowed flag is meaningful: