@cosmicdrift/kumiko-framework 0.187.0 → 0.189.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.187.0",
+  "version": "0.189.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -182,10 +182,10 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.187.0",
+    "@cosmicdrift/kumiko-types": "0.189.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
-    "hono": "^4.12.27",
+    "hono": "^4.13.1",
     "i18next": "^26.1.0",
     "ioredis": "^5.10.1",
     "jose": "^6.2.3",
@@ -198,7 +198,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.187.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.189.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/origin-middleware.test.ts

@@ -143,19 +143,18 @@ describe("originMiddleware", () => {
 
   // The guard runs as /api/* middleware before routing, so a disallowed-origin
   // request is rejected for every state-changing method even without a route.
-  test.each([
-    "PUT",
-    "PATCH",
-    "DELETE",
-  ])("cookie transport + %s + disallowed origin → 403 (every state-changing method)", async (method) => {
-    const { app, token } = await buildApp();
-    const res = await app.request("/api/write", {
-      method,
-      headers: { Cookie: `${AUTH_COOKIE_NAME}=${token}`, Origin: DISALLOWED },
-    });
-    expect(res.status).toBe(403);
-    expect(await readErrorCode(res)).toBe("origin_not_allowed");
-  });
+  test.each(["PUT", "PATCH", "DELETE"])(
+    "cookie transport + %s + disallowed origin → 403 (every state-changing method)",
+    async (method) => {
+      const { app, token } = await buildApp();
+      const res = await app.request("/api/write", {
+        method,
+        headers: { Cookie: `${AUTH_COOKIE_NAME}=${token}`, Origin: DISALLOWED },
+      });
+      expect(res.status).toBe(403);
+      expect(await readErrorCode(res)).toBe("origin_not_allowed");
+    },
+  );
 
   test("disallowed origin is blocked even as a simple text/plain request", async () => {
     // The real vector: a `text/plain` POST skips the CORS preflight and reaches

package/src/bun-db/__tests__/coerce-row-plain-date.test.ts

@@ -0,0 +1,70 @@
+// kumiko-framework#1924: `type:"date"` used to alias onto instant()
+// (TIMESTAMPTZ) and round-trip through Temporal.Instant, making the
+// read value depend on the process/session timezone. This test pins the
+// fixed coercion: a `date` pgType column reads back as Temporal.PlainDate,
+// and — the part that actually matters — the calendar day survives a
+// non-UTC process TZ, because Bun.SQL hands back a Date anchored at UTC
+// midnight and the coercion must read it via that anchor, not local getters.
+
+import { describe, expect, test } from "bun:test";
+import { Temporal } from "temporal-polyfill";
+import { coerceRow, type TableInfo } from "../query";
+
+function dateTableInfo(): TableInfo {
+  return {
+    name: "probe",
+    columnOf: (f) => f,
+    pgTypeOf: (c) => (c === "published_at" ? "date" : undefined),
+    bigintJsModeOf: () => undefined,
+    fieldOf: (c) => c,
+    hasColumn: () => true,
+  };
+}
+
+describe("coerceRow — date → Temporal.PlainDate", () => {
+  test("coerces a driver Date (UTC-midnight anchored) to the same calendar day", () => {
+    // Simulates the Bun.SQL wire value for `SELECT '2026-03-15'::date` —
+    // verified empirically to be a JS Date at epoch 1773532800000
+    // (2026-03-15T00:00:00.000Z) regardless of process TZ.
+    const row = { published_at: new Date(Date.UTC(2026, 2, 15)) };
+    const result = coerceRow(row, dateTableInfo());
+    expect(result.published_at).toBeInstanceOf(Temporal.PlainDate);
+    expect((result.published_at as unknown as Temporal.PlainDate).toString()).toBe("2026-03-15");
+  });
+
+  test("does not drift the day under a negative-offset process TZ", () => {
+    // Regression guard for the exact bug shape: naive `new
+    // Date(...).getDate()` reads the 14th under America/Los_Angeles for a
+    // UTC-midnight-anchored 15th. plainDateFromDriver must not do that.
+    const savedTz = process.env.TZ;
+    process.env.TZ = "America/Los_Angeles";
+    try {
+      const row = { published_at: new Date(Date.UTC(2026, 2, 15)) };
+      const result = coerceRow(row, dateTableInfo());
+      expect((result.published_at as unknown as Temporal.PlainDate).toString()).toBe("2026-03-15");
+    } finally {
+      if (savedTz === undefined) delete process.env.TZ;
+      else process.env.TZ = savedTz;
+    }
+  });
+
+  test("coerces a plain 'yyyy-mm-dd' driver string", () => {
+    const row = { published_at: "2026-12-01" };
+    const result = coerceRow(row, dateTableInfo());
+    expect(result.published_at).toBeInstanceOf(Temporal.PlainDate);
+    expect((result.published_at as unknown as Temporal.PlainDate).toString()).toBe("2026-12-01");
+  });
+
+  test("passes an already-PlainDate value through unchanged", () => {
+    const pd = Temporal.PlainDate.from("2026-01-01");
+    const row = { published_at: pd };
+    const result = coerceRow(row, dateTableInfo());
+    expect(result.published_at).toBe(pd);
+  });
+
+  test("leaves null untouched", () => {
+    const row = { published_at: null };
+    const result = coerceRow(row, dateTableInfo());
+    expect(result.published_at).toBeNull();
+  });
+});

package/src/bun-db/__tests__/extract-table-info.test.ts

@@ -29,17 +29,16 @@ describe("extractTableInfo — EntityTableMeta discriminator is shadow-proof", (
     expect(info.pgTypeOf("source")).toBe("text");
   });
 
-  test.each([
-    "columns",
-    "tableName",
-    "indexes",
-  ])("an entity field named `%s` (another meta key) also does not shadow it", (fieldName) => {
-    const table = buildEntityTable("thing", {
-      fields: { [fieldName]: { type: "text", required: true } },
-    });
-    const info = extractTableInfo(table);
-    expect(info.pgTypeOf("inserted_at")).toBe("timestamptz");
-  });
+  test.each(["columns", "tableName", "indexes"])(
+    "an entity field named `%s` (another meta key) also does not shadow it",
+    (fieldName) => {
+      const table = buildEntityTable("thing", {
+        fields: { [fieldName]: { type: "text", required: true } },
+      });
+      const info = extractTableInfo(table);
+      expect(info.pgTypeOf("inserted_at")).toBe("timestamptz");
+    },
+  );
 
   test("control entity without a colliding field is unaffected", () => {
     const table = buildEntityTable("note", {

package/src/bun-db/__tests__/where-patterns.integration.test.ts

@@ -10,6 +10,7 @@
 // JSONB top-level equality: wird getestet (JSON.stringify + ::jsonb cast in prepareValue).
 // Deep-path-queries (->>'key') sind out-of-scope für bun-db's WhereObject.
 import { afterAll, describe, expect, test } from "bun:test";
+import { Temporal } from "temporal-polyfill";
 import { insertMany, selectMany } from "../query";
 import { closeDb, withTable } from "./_helpers";
 
@@ -26,6 +27,8 @@ const boolCols = [{ name: "active", pgType: "boolean" as const, notNull: false }
 
 const refCols = [{ name: "ref", pgType: "uuid" as const, notNull: false }] as const;
 
+const dateCols = [{ name: "day", pgType: "date" as const, notNull: true }] as const;
+
 describe("where — primitive equality", () => {
   test("string equality", async () => {
     await withTable(strNumCols, async ({ db, meta }) => {
@@ -165,6 +168,31 @@ describe("where — WhereOperator", () => {
   });
 });
 
+describe("where — date column (kumiko-framework#1924)", () => {
+  test("plain 'yyyy-mm-dd' string equality matches the seeded row", async () => {
+    await withTable(dateCols, async ({ db, meta }) => {
+      await insertMany(db, meta, [{ day: "2026-03-15" }, { day: "2026-03-16" }]);
+      const rows = await selectMany(db, meta, { day: "2026-03-15" });
+      expect(rows.length).toBe(1);
+    });
+  });
+
+  test("Temporal.Instant filter value still matches (compat cushion for pre-#1924 callers)", async () => {
+    // Before this fix, `date` was TIMESTAMPTZ and callers built where-filters
+    // with a Temporal.Instant (e.g. Temporal.Now.instant()). prepareValue
+    // anchors it at UTC before binding, so existing filter code doesn't
+    // start silently matching nothing (or throwing) after the column
+    // becomes a real `date`.
+    await withTable(dateCols, async ({ db, meta }) => {
+      await insertMany(db, meta, [{ day: "2026-03-15" }, { day: "2026-03-16" }]);
+      const rows = await selectMany(db, meta, {
+        day: Temporal.Instant.from("2026-03-15T00:00:00Z") as unknown as string,
+      });
+      expect(rows.length).toBe(1);
+    });
+  });
+});
+
 describe("where — multi-field AND", () => {
   test("zwei Felder kombiniert (UND-Semantik)", async () => {
     await withTable(strNumCols, async ({ db, meta }) => {

package/src/bun-db/query.ts

@@ -376,6 +376,42 @@ function instantFromDriver(value: unknown): Temporal.Instant | null {
   return null;
 }
 
+function isTemporalPlainDate(v: unknown): boolean {
+  return (
+    typeof v === "object" &&
+    v !== null &&
+    typeof (v as { day?: unknown }).day === "number" &&
+    typeof (v as { calendarId?: unknown }).calendarId === "string"
+  );
+}
+
+// Verified empirically against Bun.SQL (kumiko-framework#1924): a `date`
+// column comes back as a native JS Date, but ALWAYS anchored at UTC
+// midnight regardless of process TZ — epochMilliseconds is stable across
+// zones, only the local wall-clock read of that Date would drift the day
+// (e.g. America/Los_Angeles reads back the 14th for a stored 15th). Routing
+// through Instant→ZonedDateTimeISO("UTC")→PlainDate reads the calendar day
+// back deterministically without ever touching a local Date getter — the
+// same +value idiom instantFromDriver uses (guard-no-date-api: no
+// `.getTime()`), just anchored to a fixed zone instead of process-local.
+function plainDateFromDriver(value: unknown): Temporal.PlainDate | null {
+  if (value === null || value === undefined) return null;
+  if (isTemporalPlainDate(value)) return value as Temporal.PlainDate;
+  if (typeof value === "string") {
+    const isoDay = /^\d{4}-\d{2}-\d{2}/.exec(value)?.[0];
+    if (isoDay === undefined) return null;
+    try {
+      return Temporal.PlainDate.from(isoDay);
+    } catch {
+      return null;
+    }
+  }
+  if (value instanceof Date) {
+    return Temporal.Instant.fromEpochMilliseconds(+value).toZonedDateTimeISO("UTC").toPlainDate();
+  }
+  return null;
+}
+
 // Walk the driver-row, applying three boundary-conversions per known column:
 //   - rename key snake_case → camelCase JS field-name (drizzle did this
 //     invisibly via its column-mapper; native dialect rebuild lost it)
@@ -400,6 +436,9 @@ export function coerceRow<T extends Record<string, unknown>>(row: T, info: Table
     if (pgType === "timestamptz" || pgType === "timestamptz(3)") {
       const t = instantFromDriver(value);
       if (t !== null) coerced = t;
+    } else if (pgType === "date") {
+      const d = plainDateFromDriver(value);
+      if (d !== null) coerced = d;
     } else if (pgType === "jsonb" && typeof value === "string") {
       coerced = parseJsonSafe(value, value);
     } else if (
@@ -466,29 +505,60 @@ function isSqlExpression(v: unknown): v is { kind: "sql-expr"; text: string } {
   return typeof v === "object" && v !== null && (v as { kind?: unknown }).kind === "sql-expr";
 }
 
+// A `date` column takes a plain "yyyy-mm-dd" string (or PlainDate.toString())
+// as-is — no Instant detour. Postgres parses a DATE literal without ever
+// consulting the session timezone, so this is TZ-independent by construction
+// (verified empirically — see plainDateFromDriver above for the read side).
+// Compat cushion: pre-#1924 code (this field used to be an Instant) may still
+// hand a Temporal.Instant into a where-filter or write on a `date` column —
+// same UTC anchor as plainDateFromDriver's read side, so a filter built with
+// `Temporal.Now.instant()` keeps working instead of binding a raw Instant the
+// driver can't serialize.
+function prepareDateValue(value: unknown): PreparedValue | undefined {
+  if (isTemporalPlainDate(value)) {
+    return { kind: "param", sql: "", bound: (value as Temporal.PlainDate).toString() };
+  }
+  if (isTemporalInstant(value)) {
+    const day = (value as Temporal.Instant).toZonedDateTimeISO("UTC").toPlainDate();
+    return { kind: "param", sql: "", bound: day.toString() };
+  }
+  return undefined;
+}
+
+// structured values bind directly with an ::jsonb cast; JSON.stringify first
+// would produce a JSON-string scalar instead of the structured value.
+function prepareJsonbValue(value: unknown): PreparedValue | undefined {
+  if (typeof value === "boolean") {
+    return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
+  }
+  if (typeof value !== "object" || isTemporalInstant(value)) {
+    return undefined;
+  }
+  if (!Array.isArray(value)) {
+    return { kind: "param", sql: "::jsonb", bound: value };
+  }
+  // All-boolean arrays are inferred as boolean[] by postgres-js; route via text::jsonb.
+  if (value.length > 0 && value.every((entry) => typeof entry === "boolean")) {
+    return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
+  }
+  return { kind: "param", sql: "::jsonb", bound: value };
+}
+
 function prepareValue(value: unknown, pgType: string | undefined): PreparedValue {
   if (isSqlExpression(value)) {
     return { kind: "literal", literal: value.text };
   }
   if (pgType === "jsonb" && value !== null) {
-    if (typeof value === "boolean") {
-      return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
-    }
-    if (typeof value === "object" && !isTemporalInstant(value)) {
-      // Plain objects: bind directly — JSON.stringify + ::jsonb stores a JSON string scalar.
-      if (!Array.isArray(value)) {
-        return { kind: "param", sql: "::jsonb", bound: value };
-      }
-      // All-boolean arrays are inferred as boolean[] by postgres-js; route via text::jsonb.
-      if (value.length > 0 && value.every((entry) => typeof entry === "boolean")) {
-        return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
-      }
-      return { kind: "param", sql: "::jsonb", bound: value };
-    }
+    const prepared = prepareJsonbValue(value);
+    if (prepared) return prepared;
   }
   if ((pgType === "timestamptz" || pgType === "timestamptz(3)") && isTemporalInstant(value)) {
     return { kind: "param", sql: "", bound: (value as Temporal.Instant).toString() };
   }
+  if (pgType === "date") {
+    const prepared = prepareDateValue(value);
+    if (prepared) return prepared;
+  }
   return { kind: "param", sql: "", bound: value };
 }
 

package/src/db/__tests__/column-ddl.integration.test.ts

@@ -7,6 +7,7 @@ import {
   jsonb,
   boolean as pgBoolean,
   table as pgTable,
+  plainDate,
   serial,
   text,
   timestamp,
@@ -85,6 +86,14 @@ describe("renderTableDdl — column types", () => {
     expect(ddl[0]).toContain('"created" timestamp with time zone DEFAULT now() NOT NULL');
   });
 
+  test("date notNull — real PG date, not timestamptz (kumiko-framework#1924)", () => {
+    const t = pgTable("t_date", { publishedAt: plainDate("published_at").notNull() });
+    // biome-ignore lint/suspicious/noExplicitAny: DDL test uses cast for mock tables
+    const ddl = renderTableDdl(t as any);
+    expect(ddl[0]).toContain('"published_at" date NOT NULL');
+    expect(ddl[0]).not.toContain("timestamp");
+  });
+
   test("bigint generatedAlwaysAsIdentity primaryKey", () => {
     const t = pgTable("t_ident", { id: bigint("id").primaryKey().generatedAlwaysAsIdentity() });
     // biome-ignore lint/suspicious/noExplicitAny: DDL test uses cast for mock tables

package/src/db/__tests__/migrate-generator.test.ts

@@ -142,6 +142,29 @@ describe("renderMigrationSql — managed recreate vs unmanaged in-place", () =>
     expect(sql).not.toContain("WARN: destructive change");
   });
 
+  test("unmanaged: timestamptz → date type change emits an explicit UTC-anchored USING clause (kumiko-framework#1924)", () => {
+    // A bare `ALTER COLUMN ... TYPE date` (no USING) falls back to PG's
+    // implicit ::date cast, which reads the session TimeZone — the exact
+    // non-determinism this issue fixes. Managed tables never hit this path
+    // (they DROP+CREATE + replay from events instead); unmanaged/store_*
+    // tables carry real data through an in-place ALTER, so the generator
+    // must anchor at UTC explicitly rather than emit the generic naive cast.
+    const prev = snapshotFromMetas([
+      meta("store_invoices", { name: "period_from", pgType: "timestamptz", notNull: true }),
+    ]);
+    const next = snapshotFromMetas([
+      meta("store_invoices", { name: "period_from", pgType: "date", notNull: true }),
+    ]);
+    const sql = renderMigrationSql(diffSnapshots(prev, next), {
+      name: "invoice-date",
+      sequenceNumber: 7,
+    });
+    expect(sql).toContain(
+      'ALTER TABLE "store_invoices" ALTER COLUMN "period_from" TYPE date USING ("period_from" AT TIME ZONE \'UTC\')::date;',
+    );
+    expect(sql).not.toContain("WARN: column-type-change");
+  });
+
   test("managed: multiple recreate reasons at once → all named in the warning", () => {
     const prev = snapshotFromMetas([
       meta("read_b", { name: "old_col", pgType: "text", notNull: false }, "managed"),

package/src/db/__tests__/schema-migration.integration.test.ts

@@ -1,5 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { Temporal } from "temporal-polyfill";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient, selectMany } from "../../db/query";
 import {
@@ -106,7 +107,7 @@ describe("schema migration workflows", () => {
     expect(columns.get("title")?.dataType).toBe("text");
     expect(columns.get("body")?.dataType).toBe("text");
     expect(columns.get("view_count")?.dataType).toBe("double precision");
-    expect(columns.get("published_at")?.dataType).toContain("timestamp");
+    expect(columns.get("published_at")?.dataType).toBe("date");
     expect(columns.get("is_draft")?.dataType).toBe("boolean");
     expect(columns.get("is_draft")?.isNullable).toBe(false); // has default → NOT NULL
 
@@ -276,3 +277,62 @@ describe("schema migration workflows", () => {
     expect(productColumns.has("price")).toBe(true);
   });
 });
+
+// kumiko-framework#1924: `type:"date"` used to be a TIMESTAMPTZ alias — read
+// gave back an ISO Instant, write took a bare "yyyy-mm-dd" that bound
+// straight to a timestamptz column via the session TZ. Both sides are now a
+// real PG `date` column round-tripping Temporal.PlainDate. This test proves
+// the full path (write → column DDL → read) and — since it lives under
+// `packages/framework/src/db/__tests__/`, the same glob the CI `tz-matrix`
+// job (.github/workflows/ci.yml) runs under America/Los_Angeles, Europe/
+// Berlin, Asia/Tokyo and Pacific/Apia — proves it independent of process TZ.
+describe("date field — real DATE column, no TZ dependence (kumiko-framework#1924)", () => {
+  test("column is a genuine `date`, not timestamptz", async () => {
+    const entity = createEntity({
+      table: "df1_invoices",
+      fields: { periodFrom: createDateField({ required: true }) },
+    });
+    await unsafePushTables(testDb.db, { invoice: buildEntityTable("invoice", entity) });
+
+    const columns = await getTableColumns("df1_invoices");
+    expect(columns.get("period_from")?.dataType).toBe("date");
+  });
+
+  test("a written calendar day round-trips exactly, as Temporal.PlainDate", async () => {
+    const entity = createEntity({
+      table: "df2_invoices",
+      fields: { periodFrom: createDateField({ required: true }) },
+    });
+    const table = buildEntityTable("invoice", entity);
+    await unsafePushTables(testDb.db, { invoice: table });
+
+    await seedRow(testDb.db, table, {
+      tenantId: "00000000-0000-4000-8000-000000000001",
+      periodFrom: "2026-03-15",
+    });
+
+    const rows = await selectMany(testDb.db, table);
+    expect(rows).toHaveLength(1);
+    const periodFrom = (rows[0] as { periodFrom: unknown }).periodFrom;
+    expect(periodFrom).toBeInstanceOf(Temporal.PlainDate);
+    expect((periodFrom as Temporal.PlainDate).toString()).toBe("2026-03-15");
+  });
+
+  test("a Temporal.PlainDate value on write also round-trips exactly", async () => {
+    const entity = createEntity({
+      table: "df3_invoices",
+      fields: { periodFrom: createDateField({ required: true }) },
+    });
+    const table = buildEntityTable("invoice", entity);
+    await unsafePushTables(testDb.db, { invoice: table });
+
+    await seedRow(testDb.db, table, {
+      tenantId: "00000000-0000-4000-8000-000000000001",
+      periodFrom: Temporal.PlainDate.from("2026-12-31"),
+    });
+
+    const rows = await selectMany(testDb.db, table);
+    const periodFrom = (rows[0] as { periodFrom: unknown }).periodFrom;
+    expect((periodFrom as Temporal.PlainDate).toString()).toBe("2026-12-31");
+  });
+});

package/src/db/dialect.ts

@@ -74,6 +74,8 @@ export function pgTypeToSqlType(pgType: PgType): string {
       return "timestamp with time zone";
     case "timestamptz(3)":
       return "timestamp(3) with time zone";
+    case "date":
+      return "date";
   }
 }
 
@@ -273,6 +275,14 @@ export function instant(
   return buildColumn(name, pgType) as ColumnBuilder<Temporal.Instant>;
 }
 
+// PG `date` — no time-of-day, no timezone. Calendar-day fields (invoice
+// date, lease term) round-trip as Temporal.PlainDate, never through an
+// Instant — that detour is exactly what made `type:"date"` TZ-dependent on
+// both read and write (kumiko-framework#1924).
+export function plainDate(name: string): ColumnBuilder<Temporal.PlainDate> {
+  return buildColumn(name, "date") as ColumnBuilder<Temporal.PlainDate>;
+}
+
 // Real numeric(precision, scale) column — exact decimal storage (interest
 // rates, percentages, ratios). pg returns numeric as a STRING; coerceRow
 // parses it back to JS number on read (safe ≤ 2^53). Precision/scale live in

package/src/db/entity-table-meta.ts

@@ -200,6 +200,9 @@ function fieldToColumnMeta(
     case "jsonb":
       return [{ name: snake, pgType: "jsonb", notNull: true, defaultSql: "'{}'::jsonb" }];
     case "date":
+      // Real PG `date` — Temporal.PlainDate, no time-of-day/timezone
+      // component. See plainDate() in dialect.ts (kumiko-framework#1924).
+      return [{ name: snake, pgType: "date", notNull: field.required === true }];
     case "timestamp":
       return [{ name: snake, pgType: "timestamptz", notNull: field.required === true }];
     case "tz":

package/src/db/migrate-generator.ts

@@ -271,13 +271,26 @@ function renderColumnChange(tableName: string, change: ColumnChange): readonly s
     }
   }
   if (change.typeChanged) {
-    // pg ALTER TYPE braucht oft USING-clause für nicht-implicit-castable
-    // type-changes. Wir emittieren das als Reviewer-Kommentar + raw cast —
-    // App-Author muss prüfen ob das gewünscht ist.
-    out.push(
-      `-- WARN: column-type-change ${change.typeChanged.from} → ${change.typeChanged.to}. Review USING-clause if needed.`,
-    );
-    out.push(`ALTER TABLE ${tbl} ALTER COLUMN ${col} TYPE ${change.typeChanged.to};`);
+    const { from, to } = change.typeChanged;
+    // timestamptz → date: PG's implicit ::date cast (what a bare ALTER ...
+    // TYPE without USING falls back to) reads the session TimeZone, so the
+    // same row migrates to a different calendar day depending on who/where
+    // runs it — exactly the non-determinism kumiko-framework#1924 fixes.
+    // Anchor explicitly at UTC instead of trusting the session.
+    if ((from === "timestamptz" || from === "timestamptz(3)") && to === "date") {
+      out.push(
+        `-- ${from} → date: explicit UTC anchor — a bare cast would use the session TimeZone (non-deterministic).`,
+      );
+      out.push(
+        `ALTER TABLE ${tbl} ALTER COLUMN ${col} TYPE date USING (${col} AT TIME ZONE 'UTC')::date;`,
+      );
+    } else {
+      // pg ALTER TYPE braucht oft USING-clause für nicht-implicit-castable
+      // type-changes. Wir emittieren das als Reviewer-Kommentar + raw cast —
+      // App-Author muss prüfen ob das gewünscht ist.
+      out.push(`-- WARN: column-type-change ${from} → ${to}. Review USING-clause if needed.`);
+      out.push(`ALTER TABLE ${tbl} ALTER COLUMN ${col} TYPE ${to};`);
+    }
   }
   return out;
 }

package/src/db/table-builder.ts

@@ -24,6 +24,7 @@ import {
   jsonb,
   moneyAmount,
   table as pgTable,
+  plainDate,
   type SqlExpression,
   serial,
   sql,
@@ -166,9 +167,10 @@ function fieldToColumns(
       // `customFields`-Spalte (tenant-definierte dynamische keys).
       return { [name]: jsonb(snakeName).default({}).notNull() };
     case "date": {
-      // `type:"date"` aliased auf instant() = TIMESTAMPTZ. Echte
-      // PlainDate-Migration (PG `date` Spalte, kein TZ) kommt später.
-      const col = instant(snakeName);
+      // Real PG `date` — no time-of-day, no timezone. Temporal.PlainDate
+      // end-to-end (see plainDate() in dialect.ts). Was aliased on instant()
+      // = TIMESTAMPTZ until kumiko-framework#1924 (TZ-dependent round-trip).
+      const col = plainDate(snakeName);
       return { [name]: field.required ? col.notNull() : col };
     }
     case "timestamp": {
@@ -337,25 +339,29 @@ type ColumnsForField<K extends string, F extends FieldDefinition> = F extends {
                     : F extends { type: "embedded" }
                       ? // jsonb default `{}`, immer notNull
                         { readonly [P in K]: Col<Readonly<Record<string, unknown>>> }
-                      : F extends { type: "date" | "timestamp" }
+                      : F extends { type: "date" }
                         ? F extends { required: true }
-                          ? { readonly [P in K]: Col<Temporal.Instant> }
-                          : { readonly [P in K]: NullCol<Temporal.Instant> }
-                        : F extends { type: "locatedTimestamp" }
+                          ? { readonly [P in K]: Col<Temporal.PlainDate> }
+                          : { readonly [P in K]: NullCol<Temporal.PlainDate> }
+                        : F extends { type: "timestamp" }
                           ? F extends { required: true }
-                            ? { readonly [P in `${K}Utc`]: Col<Temporal.Instant> } & {
-                                readonly [P in `${K}Tz`]: Col<string>;
-                              }
-                            : { readonly [P in `${K}Utc`]: NullCol<Temporal.Instant> } & {
-                                readonly [P in `${K}Tz`]: NullCol<string>;
-                              }
-                          : F extends { type: "file" | "image" }
+                            ? { readonly [P in K]: Col<Temporal.Instant> }
+                            : { readonly [P in K]: NullCol<Temporal.Instant> }
+                          : F extends { type: "locatedTimestamp" }
                             ? F extends { required: true }
-                              ? { readonly [P in K]: Col<string> }
-                              : { readonly [P in K]: NullCol<string> }
-                            : F extends { type: "files" | "images" }
-                              ? Record<never, never>
-                              : never;
+                              ? { readonly [P in `${K}Utc`]: Col<Temporal.Instant> } & {
+                                  readonly [P in `${K}Tz`]: Col<string>;
+                                }
+                              : { readonly [P in `${K}Utc`]: NullCol<Temporal.Instant> } & {
+                                  readonly [P in `${K}Tz`]: NullCol<string>;
+                                }
+                            : F extends { type: "file" | "image" }
+                              ? F extends { required: true }
+                                ? { readonly [P in K]: Col<string> }
+                                : { readonly [P in K]: NullCol<string> }
+                              : F extends { type: "files" | "images" }
+                                ? Record<never, never>
+                                : never;
 
 type UnionToIntersection<U> = (U extends unknown ? (k: U) => void : never) extends (
   k: infer I,