@cosmicdrift/kumiko-bundled-features 0.339.0 → 0.340.0

package/dist/billing-foundation/projection.js

@@ -13,11 +13,10 @@
 // foundation production mounten müssen die Tabelle in ihre eigene
 // `drizzle/generate.ts` ergänzen (= via subscriptionsProjectionTable-
 // import). setupTestStack pusht sie automatisch via r.projection.table.
+import { insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { defineApply } from "@cosmicdrift/kumiko-framework/engine";
 import { paymentRowId } from "./aggregate-id.js";
-import { insertPaymentProjectionRow } from "./db/queries/payment-projection.js";
-import { upsertSubscriptionProjectionRow } from "./db/queries/subscription-projection.js";
 import { paymentEntity, subscriptionEntity } from "./entities.js";
 // Drizzle-table-instance aus dem entity-shape. Wird sowohl von der
 // projection-apply als auch von list-query / get-helper genutzt damit
@@ -27,6 +26,10 @@ export const subscriptionsProjectionTable = buildEntityTable("subscription", sub
 // raw drizzle-pgTable, not an r.entity — apps mounting billing-foundation in
 // production must add read_payments to their own drizzle/generate.ts too.
 export const paymentsProjectionTable = buildEntityTable("payment", paymentEntity);
+// Unbranded metas: the apply functions below ARE the executor of these
+// projections, so they may write through the typed helpers.
+const subscriptionsProjectionMeta = requireEntityTableMeta(subscriptionsProjectionTable, "subscription");
+const paymentsProjectionMeta = requireEntityTableMeta(paymentsProjectionTable, "payment");
 // =============================================================================
 // Shared helpers
 // =============================================================================
@@ -59,9 +62,7 @@ function cancelAtSetFromPayload(p) {
  *  on every apply including the initial create — a projection rebuild at a
  *  different wall-clock time must materialize the exact same row, and
  *  `getSubscriptionForTenant`'s `lastChangedAt` (staleness check for
- *  incomplete subscriptions) depends on that determinism. Raw `.unsafe()`
- *  bypasses the typed query-builder's Temporal.Instant-to-string coercion,
- *  hence the explicit `.toString()`. */
+ *  incomplete subscriptions) depends on that determinism. */
 async function upsert(tx, event, set, fullPayload) {
     // INSERT-fallback braucht ALL fields (NOT NULL constraints). Wenn
     // jemand nur teil-felder updated (z.B. invoice-payment-failed nur
@@ -69,38 +70,21 @@ async function upsert(tx, event, set, fullPayload) {
     // INSERT-Pfad und nur den teil-`set` für ON CONFLICT.
     const insertCols = {
         id: event.aggregateId,
-        tenant_id: event.tenantId,
-        provider_name: fullPayload.providerName,
-        provider_customer_id: fullPayload.providerCustomerId,
-        provider_subscription_id: fullPayload.providerSubscriptionId,
+        tenantId: event.tenantId,
+        providerName: fullPayload.providerName,
+        providerCustomerId: fullPayload.providerCustomerId,
+        providerSubscriptionId: fullPayload.providerSubscriptionId,
         status: fullPayload.status,
         tier: fullPayload.tier,
-        current_period_end: fullPayload.currentPeriodEndIso,
-        cancel_at: fullPayload.cancelAtIso ?? null,
-        modified_at: event.createdAt.toString(),
+        currentPeriodEnd: fullPayload.currentPeriodEndIso,
+        cancelAt: fullPayload.cancelAtIso ?? null,
+        modifiedAt: event.createdAt,
     };
-    // Map camelCase set-keys to snake_case DB columns.
-    const setMap = {
-        providerName: "provider_name",
-        providerCustomerId: "provider_customer_id",
-        providerSubscriptionId: "provider_subscription_id",
-        status: "status",
-        tier: "tier",
-        currentPeriodEnd: "current_period_end",
-        cancelAt: "cancel_at",
-    };
-    const insertParams = Object.values(insertCols);
-    const setEntries = Object.entries(set).filter(([, v]) => v !== undefined);
-    // modified_at is already bound as the last insertParams placeholder —
-    // reused (not re-pushed) for the ON CONFLICT SET clause below.
-    const setClauses = [`"modified_at" = $${insertParams.length}`];
-    const allParams = [...insertParams];
-    for (const [k, v] of setEntries) {
-        allParams.push(v);
-        setClauses.push(`"${setMap[k]}" = $${allParams.length}`);
-    }
-    const tableName = subscriptionsProjectionTable.tableName;
-    await upsertSubscriptionProjectionRow(tx, tableName, insertCols, setClauses, allParams);
+    const definedSet = Object.fromEntries(Object.entries(set).filter(([, v]) => v !== undefined));
+    await upsertOnConflict(tx, subscriptionsProjectionMeta, insertCols, {
+        conflictKeys: ["id"],
+        update: { modifiedAt: event.createdAt, ...definedSet },
+    });
 }
 // =============================================================================
 // Apply-functions — eine pro event-typ
@@ -164,17 +148,16 @@ export const applyInvoicePaymentFailed = defineApply(async (event, tx) => {
  *  the second tenant's row. ON CONFLICT DO NOTHING also makes a projection
  *  rebuild idempotent without mutating an existing row. */
 export const applyPaymentReceived = defineApply(async (event, tx) => {
-    const tableName = paymentsProjectionTable.tableName;
     const providerEventId = event.metadata.headers?.["providerEventId"];
     const providerName = event.metadata.headers?.["providerName"];
     if (typeof providerEventId !== "string" || typeof providerName !== "string") {
         throw new Error("applyPaymentReceived: event.metadata.headers is missing providerEventId/providerName — process-payment-event.write.ts always sets both");
     }
-    await insertPaymentProjectionRow(tx, tableName, {
+    await insertOnConflictDoNothing(tx, paymentsProjectionMeta, {
         id: paymentRowId(event.tenantId, providerName, providerEventId),
-        tenant_id: event.tenantId,
-        provider_name: event.payload.providerName,
-        provider_customer_id: event.payload.providerCustomerId,
-        price_id: event.payload.priceId,
+        tenantId: event.tenantId,
+        providerName: event.payload.providerName,
+        providerCustomerId: event.payload.providerCustomerId,
+        priceId: event.payload.priceId,
     });
 });

package/dist/inbound-mail-foundation/projection.js

@@ -16,51 +16,45 @@
 // kommen bereits als Ciphertext an — encrypted VOR dem append im
 // write-handler. Die applies kopieren nur durch; decrypted wird erst
 // in den list-queries.
+import { insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { defineApply } from "@cosmicdrift/kumiko-framework/engine";
-import { insertIgnoreProjectionRow, upsertProjectionRow, } from "./db/queries/inbound-projections.js";
 import { inboundMessageEntity, mailAccountEntity, mailThreadEntity } from "./entities.js";
 // Drizzle-table-instances aus den entity-shapes — geteilt zwischen
 // projection-applies und list-queries (ein column-namespace).
 export const mailAccountsProjectionTable = buildEntityTable("mail-account", mailAccountEntity);
 export const inboundMessagesProjectionTable = buildEntityTable("inbound-message", inboundMessageEntity);
 export const mailThreadsProjectionTable = buildEntityTable("mail-thread", mailThreadEntity);
-function tableNameOf(table) {
-    return table.tableName;
-}
+// Unbranded metas: the apply functions below ARE the executor of these
+// projections, so they may write through the typed helpers.
+const mailAccountsProjectionMeta = requireEntityTableMeta(mailAccountsProjectionTable, "mail-account");
+const inboundMessagesProjectionMeta = requireEntityTableMeta(inboundMessagesProjectionTable, "inbound-message");
+const mailThreadsProjectionMeta = requireEntityTableMeta(mailThreadsProjectionTable, "mail-thread");
 // =============================================================================
 // mail-account — connected/updated/disconnected teilen den payload-shape,
 // der event-type taggt was passiert ist. Alle drei UPSERT-full für
 // defensive consistency (rebuild-aus-dem-Nichts, out-of-order).
 // =============================================================================
-const ACCOUNT_SET_CLAUSES = [
-    `"provider" = EXCLUDED."provider"`,
-    `"auth_method" = EXCLUDED."auth_method"`,
-    `"owner_user_id" = EXCLUDED."owner_user_id"`,
-    `"display_name" = EXCLUDED."display_name"`,
-    `"address" = EXCLUDED."address"`,
-    `"status" = EXCLUDED."status"`,
-    `"watch_state" = EXCLUDED."watch_state"`,
-    // connected_at bewusst NICHT im SET: der Erst-Connect-Zeitpunkt
-    // bleibt stehen, updated/disconnected überschreiben ihn nicht.
-];
 const applyMailAccountUpsert = defineApply(async (event, tx) => {
     const p = event.payload;
-    const insertCols = {
-        id: event.aggregateId,
-        tenant_id: event.tenantId,
+    const mutable = {
         provider: p.provider,
-        auth_method: p.authMethod,
-        owner_user_id: p.ownerUserId,
-        display_name: p.displayName,
+        authMethod: p.authMethod,
+        ownerUserId: p.ownerUserId,
+        displayName: p.displayName,
         address: p.address,
         status: p.status,
-        watch_state: p.watchState,
-        // Insert-Pfad = Erst-Connect (bzw. Rebuild: createdAt des ersten
-        // events des Streams — fachlich derselbe Zeitpunkt).
-        connected_at: event.createdAt.toString(),
+        watchState: p.watchState,
     };
-    await upsertProjectionRow(tx, tableNameOf(mailAccountsProjectionTable), insertCols, ACCOUNT_SET_CLAUSES, Object.values(insertCols));
+    await upsertOnConflict(tx, mailAccountsProjectionMeta, {
+        id: event.aggregateId,
+        tenantId: event.tenantId,
+        ...mutable,
+        // Only the insert path is the first connect (on rebuild: createdAt of the
+        // stream's first event, the same moment). Left out of `update` so the
+        // first-connect time survives updated/disconnected events.
+        connectedAt: event.createdAt,
+    }, { conflictKeys: ["id"], update: mutable });
 });
 /** mail-account-connected → UPSERT full. */
 export const applyMailAccountConnected = applyMailAccountUpsert;
@@ -77,20 +71,20 @@ export const applyMailAccountDisconnected = applyMailAccountUpsert;
 /** inbound-message-received → INSERT ... ON CONFLICT DO NOTHING. */
 export const applyInboundMessageReceived = defineApply(async (event, tx) => {
     const p = event.payload;
-    await insertIgnoreProjectionRow(tx, tableNameOf(inboundMessagesProjectionTable), {
+    await insertOnConflictDoNothing(tx, inboundMessagesProjectionMeta, {
         id: event.aggregateId,
-        tenant_id: event.tenantId,
-        account_id: p.accountId,
-        owner_user_id: p.ownerUserId,
-        message_id_header: p.messageIdHeader,
-        thread_key: p.threadKey,
+        tenantId: event.tenantId,
+        accountId: p.accountId,
+        ownerUserId: p.ownerUserId,
+        messageIdHeader: p.messageIdHeader,
+        threadKey: p.threadKey,
         from: p.from,
         to: p.to,
         cc: p.cc,
         subject: p.subject,
         snippet: p.snippet,
-        received_at: p.receivedAtIso,
-        body_ref: p.bodyRef,
+        receivedAt: p.receivedAtIso,
+        bodyRef: p.bodyRef,
         scope: p.scope,
     });
 });
@@ -103,17 +97,15 @@ export const applyInboundMessageReceived = defineApply(async (event, tx) => {
 /** mail-thread-updated → UPSERT full mit dem Payload-Snapshot. */
 export const applyMailThreadUpdated = defineApply(async (event, tx) => {
     const p = event.payload;
-    const insertCols = {
-        id: event.aggregateId,
-        tenant_id: event.tenantId,
-        thread_key: p.threadKey,
+    const mutable = {
         subject: p.subject,
-        last_message_at: p.lastMessageAtIso,
-        message_count: p.messageCount,
+        lastMessageAt: p.lastMessageAtIso,
+        messageCount: p.messageCount,
     };
-    await upsertProjectionRow(tx, tableNameOf(mailThreadsProjectionTable), insertCols, [
-        `"subject" = EXCLUDED."subject"`,
-        `"last_message_at" = EXCLUDED."last_message_at"`,
-        `"message_count" = EXCLUDED."message_count"`,
-    ], Object.values(insertCols));
+    await upsertOnConflict(tx, mailThreadsProjectionMeta, {
+        id: event.aggregateId,
+        tenantId: event.tenantId,
+        threadKey: p.threadKey,
+        ...mutable,
+    }, { conflictKeys: ["id"], update: mutable });
 });

package/dist/user/handlers/update-roles.js

@@ -1,4 +1,4 @@
-import { asEntityTableMeta, asRawClient, fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { acquireNamespacedAdvisoryLock, createEventStoreExecutor, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, findForbiddenRoleAssignment, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, ConflictError, InternalError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
@@ -10,9 +10,6 @@ const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user"
 // Serializes last-SystemAdmin demotion checks globally inside the write TX
 // (dispatcher batch wraps handlers in transaction — xact lock holds through update).
 const LAST_SYSTEM_ADMIN_LOCK_NAMESPACE = 0x7361646d; // 'sadm'
-function quoteIdent(name) {
-    return `"${name.replace(/"/g, '""')}"`;
-}
 function isActiveUserRow(row) {
     if (row.isDeleted === true)
         return false;
@@ -22,19 +19,11 @@ function isActiveSystemAdminRow(row) {
     return isActiveUserRow(row) && parseRoles(row.roles).includes("SystemAdmin");
 }
 async function countOtherActiveSystemAdmins(db, excludeUserId) {
-    const tableName = asEntityTableMeta(userTable)?.tableName;
-    if (!tableName) {
-        throw new InternalError({ message: "user read table meta missing" });
-    }
-    // kumiko-lint-ignore raw-sql jsonb @> prefilter for SystemAdmin roster under advisory lock
-    const rows = (await asRawClient(db).unsafe(`SELECT id, roles, status, is_deleted AS "isDeleted"
-     FROM ${quoteIdent(tableName)}
-     WHERE is_deleted = false
-       AND (status = $1 OR status IS NULL)
-       AND roles @> $2::jsonb`, 
-    // Pass a JS array — JSON.stringify + $n::jsonb double-encodes to a jsonb string
-    // (postgres.js), so `@>` never matches a roles array.
-    [USER_STATUS.Active, ["SystemAdmin"]]));
+    // `roles` is a jsonb multiSelect column: a scalar filter value means `@>` containment.
+    const rows = await selectMany(db, userTable, {
+        isDeleted: false,
+        roles: "SystemAdmin",
+    });
     return rows.filter((u) => u.id !== excludeUserId && isActiveSystemAdminRow(u)).length;
 }
 export async function applyUserRolesUpdate(event, ctx, db) {
@@ -68,7 +57,7 @@ export async function applyUserRolesUpdate(event, ctx, db) {
         // Lock before count+update so two concurrent demotions cannot both
         // observe otherActiveSystemAdmins >= 1 and leave zero active SystemAdmins.
         await acquireNamespacedAdvisoryLock(lockRunner, LAST_SYSTEM_ADMIN_LOCK_NAMESPACE, "global");
-        const otherActiveSystemAdmins = await countOtherActiveSystemAdmins(ctx.systemDb.unsafeRaw("jsonb @> prefilter over the global users table to count remaining active SystemAdmins"), event.payload.id);
+        const otherActiveSystemAdmins = await countOtherActiveSystemAdmins(ctx.systemDb.unsafeRaw("count remaining active SystemAdmins across the global users table"), event.payload.id);
         if (otherActiveSystemAdmins === 0) {
             return writeFailure(new ConflictError({
                 message: "cannot demote the last active SystemAdmin",

package/dist/workflow-runner/db/queries/due-runs.d.ts

@@ -1,8 +1,7 @@
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
 export type DueRow = {
-    readonly run_id: string;
-    readonly step_index: number;
+    readonly runId: string;
+    readonly stepIndex: number;
 };
 export declare const DUE_RUNS_BATCH_SIZE = 100;
-export declare function selectDueWorkflowRunPending(db: DbConnection, tenantId: TenantId): Promise<readonly DueRow[]>;
+export declare function selectDueWorkflowRunPending(db: TenantDb): Promise<readonly DueRow[]>;

package/dist/workflow-runner/db/queries/due-runs.js

@@ -1,4 +1,5 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { sql } from "@cosmicdrift/kumiko-framework/db";
+import { workflowRunPendingTable } from "../../tables.js";
 // Oldest first and capped, so a backlog after an outage drains over several
 // ticks instead of holding one tick's `concurrency: "skip"` slot for minutes.
 export const DUE_RUNS_BATCH_SIZE = 100;
@@ -6,7 +7,7 @@ export const DUE_RUNS_BATCH_SIZE = 100;
 // (ctx.tryAppendEvent on WORKFLOW_RESUMED) — a second dispatch for the same
 // row loses that race and no-ops. No row locks: in an autocommit statement
 // they would be released right after the SELECT and guard nothing.
-export async function selectDueWorkflowRunPending(db, tenantId) {
-    // kumiko-lint-ignore raw-sql tenant-scoped due-row pickup
-    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now() ORDER BY wake_at ASC LIMIT ${DUE_RUNS_BATCH_SIZE}`, [tenantId]));
+// `now()` stays the DB clock so job-host clock skew cannot mark rows due early.
+export function selectDueWorkflowRunPending(db) {
+    return db.selectMany(workflowRunPendingTable, { wakeAt: { lt: sql `now()` } }, { orderBy: { col: "wakeAt", direction: "asc" }, limit: DUE_RUNS_BATCH_SIZE });
 }

package/dist/workflow-runner/feature.js

@@ -57,21 +57,19 @@ export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {
             // skip: cron fired without a perTenant fan-out tenant — nothing scoped
             return;
         }
-        ctx.systemDb.assertTenantMatch(tenantId);
-        const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.unsafeRaw("due-row pickup needs FOR UPDATE SKIP LOCKED raw SQL; the query filters by this job's tenantId"), // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
-        tenantId);
+        const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.assertTenantMatch(tenantId));
         for (const row of dueRows) {
             try {
                 await ctx.write("workflow-runner:write:resume-run", {
-                    runId: row.run_id,
-                    stepIndex: row.step_index,
+                    runId: row.runId,
+                    stepIndex: row.stepIndex,
                 });
             }
             catch (error) {
                 // skip: one row's dispatch failing (infra hiccup, not a business
                 // outcome — resume-run itself never throws for expected cases)
                 // must not stop the rest of this tenant's due rows from resuming.
-                ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.run_id} stepIndex=${row.step_index} dispatch failed: ${String(error)}`);
+                ctx.log.warn(`[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`);
             }
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.339.0",
+  "version": "0.340.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -499,12 +499,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.339.0",
-    "@cosmicdrift/kumiko-framework": "0.339.0",
-    "@cosmicdrift/kumiko-headless": "0.339.0",
-    "@cosmicdrift/kumiko-renderer": "0.339.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.339.0",
-    "@cosmicdrift/kumiko-types": "0.339.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.340.0",
+    "@cosmicdrift/kumiko-framework": "0.340.0",
+    "@cosmicdrift/kumiko-headless": "0.340.0",
+    "@cosmicdrift/kumiko-renderer": "0.340.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.340.0",
+    "@cosmicdrift/kumiko-types": "0.340.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1017,8 +1017,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.339.0",
-    "@cosmicdrift/kumiko-locale-es": "0.339.0",
+    "@cosmicdrift/kumiko-locale-de": "0.340.0",
+    "@cosmicdrift/kumiko-locale-es": "0.340.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/billing-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "Payment and subscription projections use typed bun-db helpers",
+    "detail": "`payment-received` inserts through `insertOnConflictDoNothing`, subscription events upsert through `upsertOnConflict`. The raw `db/queries/payment-projection.ts` and `subscription-projection.ts` modules are gone.",
+    "migration": "keine"
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "Inbound mail projections use typed bun-db helpers",
+    "detail": "Mail-account and mail-thread events upsert through `upsertOnConflict` (`connectedAt` is only written on insert), inbound messages insert through `insertOnConflictDoNothing`. The raw `db/queries/inbound-projections.ts` module is gone.",
+    "migration": "keine"
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/src/user/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "The last-SystemAdmin check uses jsonb containment through selectMany",
+    "detail": "Removing the SystemAdmin role still refuses to drop the last active SystemAdmin; the count now comes from `selectMany` with a roles containment filter instead of raw SQL.",
+    "migration": "keine"
+  },
   {
     "version": "0.271.0",
     "type": "improvement",
@@ -8,7 +15,7 @@
   {
     "version": "0.218.1",
     "type": "improvement",
-    "title": "user.email searchable \u2014 reindex required after upgrade",
+    "title": "user.email searchable — reindex required after upgrade",
     "detail": "email gained searchable for roster lookup. buildSearchDocument only runs on write; existing rows need reindexEntity(\"user\") (or the reindex job) plus Meili configure for the new attribute.",
     "migration": "After deploying, run reindexEntity(\"user\") (or the existing reindex job) so pre-upgrade user rows appear in roster search."
   },
@@ -16,28 +23,28 @@
     "version": "0.218.0",
     "type": "fix",
     "title": "user-list: system-scope search; membership roles on tenants; emailVerified sort",
-    "detail": "systemScope entityList search uses SYSTEM_TENANT_ID (was session tenant \u2192 Meili miss/500). Tenants column shows membership roles (Offlot Demo (TenantAdmin)). emailVerified sortable; email also searchable for roster lookup. Global roles stay SystemAdmin-only \u2014 TenantAdmin/Admin live on membership (Team \u2192 Members)."
+    "detail": "systemScope entityList search uses SYSTEM_TENANT_ID (was session tenant → Meili miss/500). Tenants column shows membership roles (Offlot Demo (TenantAdmin)). emailVerified sortable; email also searchable for roster lookup. Global roles stay SystemAdmin-only — TenantAdmin/Admin live on membership (Team → Members)."
   },
   {
     "version": "0.217.0",
     "type": "improvement",
     "title": "user-list: roles multiSelect + tenants column; roles editable as SystemAdmin (fw#2384 follow-up)",
-    "detail": "user.roles is now createMultiSelectField (jsonb string[], options=[SystemAdmin]) so entityEdit shows a real multi-select instead of a raw JSON text box \u2014 SystemAdmins can promote another SystemAdmin from the UI. user-list columns gain roles + tenants; tenants is a derived field filled by the list handler from memberships (platform roster was unusable without tenant context). switch-tenant + auth-client parseRoles accept jsonb arrays (string-only deserialize dropped SystemAdmin on tenant switch). Soft-deleted users stay hidden by default.",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 migrates read_users.roles from text to jsonb USING roles::jsonb. Existing JSON array strings (`[]`, `[\"SystemAdmin\"]`) convert cleanly. Consumers that wrote roles as a JSON-encoded string via user:create/update should pass string[] instead (parseRoles still accepts both on read)."
+    "detail": "user.roles is now createMultiSelectField (jsonb string[], options=[SystemAdmin]) so entityEdit shows a real multi-select instead of a raw JSON text box — SystemAdmins can promote another SystemAdmin from the UI. user-list columns gain roles + tenants; tenants is a derived field filled by the list handler from memberships (platform roster was unusable without tenant context). switch-tenant + auth-client parseRoles accept jsonb arrays (string-only deserialize dropped SystemAdmin on tenant switch). Soft-deleted users stay hidden by default.",
+    "migration": "Run `kumiko-schema generate` and apply — migrates read_users.roles from text to jsonb USING roles::jsonb. Existing JSON array strings (`[]`, `[\"SystemAdmin\"]`) convert cleanly. Consumers that wrote roles as a JSON-encoded string via user:create/update should pass string[] instead (parseRoles still accepts both on read)."
   },
   {
     "version": "0.167.1",
     "type": "breaking",
     "title": "user.locale no longer defaults to \"de\" (fw#1637).",
     "detail": "The entity-level default contradicted tenant-settings' own \"en\" default and silently overrode any app or tenant locale configuration for every new user. locale now stays unset until the client or a resolution chain provides one. Consumers that already fall back with `user.locale ?? \"en\"` are unaffected in shape but now see null instead of \"de\".",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 the migration emits `ALTER TABLE read_users ALTER COLUMN locale DROP DEFAULT`. Note that DROP DEFAULT only affects future inserts: existing rows keep the \"de\" the old default wrote, which no user ever chose. Your app therefore splits into pre-bump users on \"de\" and post-bump users on null, and each group resolves to a different language. Decide deliberately: either keep the old values (and state that pre-bump users stay German), or run `UPDATE read_users SET locale = NULL WHERE locale = 'de'` once so every user follows the same chain \u2014 the latter only if no UI ever let users edit the field, otherwise it erases real choices. If your app relied on the implicit German default, set an explicit fallback instead (fw#1653)."
+    "migration": "Run `kumiko-schema generate` and apply — the migration emits `ALTER TABLE read_users ALTER COLUMN locale DROP DEFAULT`. Note that DROP DEFAULT only affects future inserts: existing rows keep the \"de\" the old default wrote, which no user ever chose. Your app therefore splits into pre-bump users on \"de\" and post-bump users on null, and each group resolves to a different language. Decide deliberately: either keep the old values (and state that pre-bump users stay German), or run `UPDATE read_users SET locale = NULL WHERE locale = 'de'` once so every user follows the same chain — the latter only if no UI ever let users edit the field, otherwise it erases real choices. If your app relied on the implicit German default, set an explicit fallback instead (fw#1653)."
   },
   {
     "version": "0.167.1",
     "type": "improvement",
     "title": "user.timezone field, wired into ctx.tz (fw#1636).",
     "detail": "The user entity gains a `timezone` field (createTzField, no default). buildHandlerContext passes it to ctx.tz.user; the fallback chain stays tenant.timezone, then \"UTC\". Before this, ctx.tz.tenant and ctx.tz.user both hardcoded \"UTC\" while the plumbing already accepted per-request values.",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 the migration adds `read_users.timezone`. No backfill: an unset timezone falls through to the tenant's, exactly as before the field existed."
+    "migration": "Run `kumiko-schema generate` and apply — the migration adds `read_users.timezone`. No backfill: an unset timezone falls through to the tenant's, exactly as before the field existed."
   },
   {
     "version": "0.165.3",

package/src/workflow-runner/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "The resume job reads due runs through the job's TenantDb",
+    "detail": "`selectDueWorkflowRunPending` takes a `TenantDb` and returns `{ runId, stepIndex }` rows, so the tenant filter comes from the TenantDb instead of a hand-written `WHERE tenant_id`.",
+    "migration": "keine"
+  },
   {
     "version": "0.339.0",
     "type": "breaking",

package/dist/billing-foundation/db/queries/payment-projection.d.ts

@@ -1,2 +0,0 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-export declare function insertPaymentProjectionRow(tx: DbRunner, tableName: string, insertCols: Record<string, unknown>): Promise<void>;

package/dist/billing-foundation/db/queries/payment-projection.js

@@ -1,13 +0,0 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-// INSERT-once, not UPSERT: unlike subscriptionsProjectionTable (one row per
-// tenant, state overwritten on every event), a payment row is an immutable
-// fact keyed by paymentRowId(tenantId, providerName, providerEventId) — ON
-// CONFLICT DO NOTHING makes a projection rebuild/replay idempotent without
-// ever mutating an existing row.
-export async function insertPaymentProjectionRow(tx, tableName, insertCols) {
-    const insertKeys = Object.keys(insertCols);
-    const insertPlaceholders = insertKeys.map((_, i) => `$${i + 1}`);
-    const sqlText = `INSERT INTO "${tableName}" (${insertKeys.map((k) => `"${k}"`).join(", ")}) VALUES (${insertPlaceholders.join(", ")}) ON CONFLICT ("id") DO NOTHING`;
-    // kumiko-lint-ignore raw-sql tableName + column keys are code-controlled, not user input: tableName is buildEntityTable()'s static table name and insertKeys come from applyPaymentReceived's hardcoded object-literal columns in projection.ts — only values flow through $1..$n
-    await asRawClient(tx).unsafe(sqlText, Object.values(insertCols));
-}

package/dist/billing-foundation/db/queries/subscription-projection.d.ts

@@ -1,2 +0,0 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-export declare function upsertSubscriptionProjectionRow(tx: DbRunner, tableName: string, insertCols: Record<string, unknown>, setClauses: readonly string[], params: readonly unknown[]): Promise<void>;

package/dist/billing-foundation/db/queries/subscription-projection.js

@@ -1,7 +0,0 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-export async function upsertSubscriptionProjectionRow(tx, tableName, insertCols, setClauses, params) {
-    const insertKeys = Object.keys(insertCols);
-    const insertPlaceholders = insertKeys.map((_, i) => `$${i + 1}`);
-    const sqlText = `INSERT INTO "${tableName}" (${insertKeys.map((k) => `"${k}"`).join(", ")}) VALUES (${insertPlaceholders.join(", ")}) ON CONFLICT ("id") DO UPDATE SET ${setClauses.join(", ")}`;
-    await asRawClient(tx).unsafe(sqlText, params);
-}

package/dist/inbound-mail-foundation/db/queries/inbound-projections.d.ts

@@ -1,7 +0,0 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-/** INSERT ... ON CONFLICT ("id") DO UPDATE SET <setClauses>. */
-export declare function upsertProjectionRow(tx: DbRunner, tableName: string, insertCols: Record<string, unknown>, setClauses: readonly string[], params: readonly unknown[]): Promise<void>;
-/** INSERT ... ON CONFLICT ("id") DO NOTHING — für append-only-Rows
- *  (inbound-message: genau EIN received-event pro Stream, Replays
- *  no-op'en auf der PK). */
-export declare function insertIgnoreProjectionRow(tx: DbRunner, tableName: string, insertCols: Record<string, unknown>): Promise<void>;

package/dist/inbound-mail-foundation/db/queries/inbound-projections.js

@@ -1,24 +0,0 @@
-// Raw-SQL-Helper für die inline projections — Muster
-// billing-foundation/db/queries/subscription-projection.ts.
-//
-// Warum raw statt drizzle-insert: die apply-fns laufen in der event-TX
-// mit einem DbRunner, und die ON-CONFLICT-Semantik (UPSERT vs.
-// DO NOTHING) ist der fachliche Kern — explizit hingeschrieben statt
-// hinter einem ORM-Builder versteckt.
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-/** INSERT ... ON CONFLICT ("id") DO UPDATE SET <setClauses>. */
-export async function upsertProjectionRow(tx, tableName, insertCols, setClauses, params) {
-    const insertKeys = Object.keys(insertCols);
-    const insertPlaceholders = insertKeys.map((_, i) => `$${i + 1}`);
-    const sqlText = `INSERT INTO "${tableName}" (${insertKeys.map((k) => `"${k}"`).join(", ")}) VALUES (${insertPlaceholders.join(", ")}) ON CONFLICT ("id") DO UPDATE SET ${setClauses.join(", ")}`;
-    await asRawClient(tx).unsafe(sqlText, params);
-}
-/** INSERT ... ON CONFLICT ("id") DO NOTHING — für append-only-Rows
- *  (inbound-message: genau EIN received-event pro Stream, Replays
- *  no-op'en auf der PK). */
-export async function insertIgnoreProjectionRow(tx, tableName, insertCols) {
-    const insertKeys = Object.keys(insertCols);
-    const insertPlaceholders = insertKeys.map((_, i) => `$${i + 1}`);
-    const sqlText = `INSERT INTO "${tableName}" (${insertKeys.map((k) => `"${k}"`).join(", ")}) VALUES (${insertPlaceholders.join(", ")}) ON CONFLICT ("id") DO NOTHING`;
-    await asRawClient(tx).unsafe(sqlText, Object.values(insertCols));
-}