@cosmicdrift/kumiko-framework 0.197.1 → 0.198.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.197.1",
+  "version": "0.198.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -186,7 +186,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.197.1",
+    "@cosmicdrift/kumiko-types": "0.198.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -202,7 +202,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.197.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.198.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/batch.integration.test.ts

@@ -407,7 +407,7 @@ describe("POST /api/batch", () => {
 
   test("idempotency: corrupted cache entry is treated as miss and re-runs", async () => {
     const requestId = "batch-rid-corrupt";
-    const cacheKey = `${RedisKeys.idempotency}${requestId}`;
+    const cacheKey = `${RedisKeys.idempotency}${admin.tenantId}:${admin.id}:${requestId}`;
 
     // Prove key-coupling first: seed a well-formed cached entry under the
     // exact manually-built key and confirm the batch short-circuits on it

package/src/api/__tests__/sse-route.test.ts

@@ -46,6 +46,66 @@ async function buildSseApp(broker: SseBroker): Promise<{ app: Hono; token: strin
   return { app, token };
 }
 
+// createTrackingBroker's addClient discards the `send` callback — fine for
+// the channel-scoping tests above, but frame-naming tests need to capture
+// it and actually push an event through.
+function createSendCapturingBroker(): {
+  broker: SseBroker;
+  send: Promise<(event: SseEvent) => void>;
+} {
+  let resolveSend!: (send: (event: SseEvent) => void) => void;
+  const send = new Promise<(event: SseEvent) => void>((resolve) => {
+    resolveSend = resolve;
+  });
+
+  const broker: SseBroker = {
+    addClient(_channel, sendFn) {
+      resolveSend(sendFn);
+      return "test-client-id";
+    },
+    removeClient() {},
+    pushToChannel() {},
+    getClientCount() {
+      return 0;
+    },
+    getTotalClientCount() {
+      return 0;
+    },
+    subscribeAccessInvalidation() {
+      return () => {};
+    },
+    publishAccessInvalidation() {},
+  };
+
+  return { broker, send };
+}
+
+// The stream's first frame is always the immediate heartbeat `ping` (see
+// SSE_HEARTBEAT_INTERVAL_MS's while-loop in sse-route.ts) — skip it and
+// return the first real frame.
+async function readNextEntityFrame(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+): Promise<{ event: string; data: string }> {
+  const decoder = new TextDecoder();
+  let buffer = "";
+  while (true) {
+    const { value, done } = await reader.read();
+    if (done) throw new Error("SSE stream ended before a non-ping frame arrived");
+    buffer += decoder.decode(value, { stream: true });
+    let separatorIndex = buffer.indexOf("\n\n");
+    while (separatorIndex !== -1) {
+      const frame = buffer.slice(0, separatorIndex);
+      buffer = buffer.slice(separatorIndex + 2);
+      const eventName = frame.match(/^event: (.*)$/m)?.[1];
+      if (eventName !== undefined && eventName !== "ping") {
+        const data = frame.match(/^data: (.*)$/m)?.[1] ?? "";
+        return { event: eventName, data };
+      }
+      separatorIndex = buffer.indexOf("\n\n");
+    }
+  }
+}
+
 describe("sse-route security", () => {
   test("subscribes to authenticated tenant channel, ignores client query-param", async () => {
     const { broker, subscribedChannel } = createTrackingBroker();
@@ -114,3 +174,72 @@ describe("sse-route security", () => {
     expect(channel).toBe("tenant:00000000-0000-4000-8000-000000000001");
   });
 });
+
+describe("sse-route frame naming", () => {
+  test("entity events broadcast under the entity-name frame, not the verb", async () => {
+    const { broker, send } = createSendCapturingBroker();
+    const { app, token } = await buildSseApp(broker);
+
+    const controller = new AbortController();
+    const responsePromise = Promise.resolve(
+      app.request("/api/sse", {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: controller.signal,
+      }),
+    );
+
+    const sendEvent = await send;
+    const response = await responsePromise;
+    const reader = response.body!.getReader();
+
+    sendEvent({
+      type: "user.created",
+      data: {
+        id: "u1",
+        aggregateType: "user",
+        version: 1,
+        payload: {},
+        createdAt: "2026-01-01T00:00:00.000Z",
+      },
+    });
+
+    const frame = await readNextEntityFrame(reader);
+    controller.abort();
+
+    expect(frame.event).toBe("user");
+    expect(JSON.parse(frame.data)).toEqual({
+      id: "u1",
+      aggregateType: "user",
+      version: 1,
+      payload: {},
+      createdAt: "2026-01-01T00:00:00.000Z",
+    });
+  });
+
+  test("non-entity events (no aggregateType) keep event.type as the frame name", async () => {
+    const { broker, send } = createSendCapturingBroker();
+    const { app, token } = await buildSseApp(broker);
+
+    const controller = new AbortController();
+    const responsePromise = Promise.resolve(
+      app.request("/api/sse", {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: controller.signal,
+      }),
+    );
+
+    const sendEvent = await send;
+    const response = await responsePromise;
+    const reader = response.body!.getReader();
+
+    sendEvent({
+      type: "channel-in-app:event:delivered",
+      data: { id: "m1", userId: "u1", notificationType: "info", title: "Hi" },
+    });
+
+    const frame = await readNextEntityFrame(reader);
+    controller.abort();
+
+    expect(frame.event).toBe("channel-in-app:event:delivered");
+  });
+});

package/src/api/auth-routes.ts

@@ -1195,12 +1195,27 @@ export function createAuthRoutes(
         const status = result.error.httpStatus as 400 | 401 | 403 | 422 | 500; // @cast-boundary engine-payload
         return c.json({ isSuccess: false, error: result.error }, status);
       }
-      const data = result.data as {
-        kind: "auth-session";
-        session: SessionUser;
-        tenantId: TenantId;
-        role: string;
-      }; // @cast-boundary engine-payload
+      // @cast-boundary engine-payload — same three-shape union as /auth/login
+      // (see gateEnforceMfa): a straight session, an MFA challenge, or a
+      // hard mfa-setup-required block. Only the auth-session branch also
+      // carries tenantId/role (invite-specific).
+      const data = result.data as
+        | { kind: "auth-session"; session: SessionUser; tenantId: TenantId; role: string }
+        | { kind: "mfa-challenge"; challengeToken: string }
+        | { kind: "mfa-setup-required"; preauthSetupToken: string };
+
+      if (data.kind === "mfa-setup-required") {
+        return c.json({
+          isSuccess: true,
+          mfaSetupRequired: true,
+          preauthSetupToken: data.preauthSetupToken,
+        });
+      }
+
+      if (data.kind === "mfa-challenge") {
+        return c.json({ isSuccess: true, mfaRequired: true, challengeToken: data.challengeToken });
+      }
+
       const token = await mintSessionAndRespond(c, data.session);
       return c.json({
         isSuccess: true,

package/src/api/sse-route.ts

@@ -27,6 +27,15 @@ import type { SseBroker } from "./sse-broker";
  */
 export const SSE_HEARTBEAT_INTERVAL_MS = 15_000;
 
+// Entity events carry aggregateType in data (system-hooks.ts's SSE-broadcast
+// consumer) — the wire frame is named after the entity so the client can
+// wire a single listener per entity instead of one per verb. Non-entity
+// events (e.g. channel-in-app:event:delivered) have no aggregateType and
+// keep their event.type as the frame name.
+function isEntityEventData(data: Record<string, unknown>): data is { aggregateType: string } {
+  return typeof data["aggregateType"] === "string";
+}
+
 export function createSseRoute(broker: SseBroker) {
   const route = new Hono();
 
@@ -40,7 +49,10 @@ export function createSseRoute(broker: SseBroker) {
       const clientId = broker.addClient(
         channel,
         (event) => {
-          stream.writeSSE({ event: event.type, data: JSON.stringify(event.data) });
+          const wireEventName = isEntityEventData(event.data)
+            ? event.data.aggregateType
+            : event.type;
+          stream.writeSSE({ event: wireEventName, data: JSON.stringify(event.data) });
         },
         () => stream.close(),
       );

package/src/bun-db/__tests__/sql-expr-brand.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, test } from "bun:test";
+import { sql } from "../../db/dialect";
+import type { EntityTableMeta } from "../../db/entity-table-meta";
+import { insertOne, updateMany } from "../query";
+
+const meta: EntityTableMeta = {
+  source: "unmanaged",
+  tableName: "sql_expr_brand_items",
+  indexes: [],
+  columns: [
+    { name: "id", pgType: "uuid", notNull: true, primaryKey: true },
+    { name: "payload", pgType: "jsonb", notNull: false },
+    { name: "created_at", pgType: "timestamptz", notNull: false },
+  ],
+};
+
+// Captures exactly what insertOne/updateMany hand to the driver, so the
+// assertions below check the actual SQL text + bound params — not just that
+// the call didn't throw.
+function makeRecordingDb() {
+  const calls: Array<{ sqlText: string; params: readonly unknown[] }> = [];
+  const db = {
+    unsafe: async (sqlText: string, params: readonly unknown[]) => {
+      calls.push({ sqlText, params });
+      return [{ id: "1" }];
+    },
+  };
+  return { db, calls };
+}
+
+describe("bun-db sql-expr brand — request-supplied objects can't fake a SQL literal", () => {
+  test("insertOne treats an unbranded {kind:'sql-expr'} jsonb value as ordinary data, never inlined SQL", async () => {
+    const { db, calls } = makeRecordingDb();
+    const forged = {
+      kind: "sql-expr",
+      text: "'; DROP TABLE sql_expr_brand_items; --",
+    };
+
+    await insertOne(db, meta, { id: "1", payload: forged });
+
+    expect(calls).toHaveLength(1);
+    const { sqlText, params } = calls[0]!;
+    expect(sqlText).not.toContain("DROP TABLE");
+    expect(sqlText).toContain("$2");
+    expect(params).toContainEqual(forged);
+  });
+
+  test("updateMany treats an unbranded {kind:'sql-expr'} jsonb value as ordinary data, never inlined SQL", async () => {
+    const { db, calls } = makeRecordingDb();
+    const forged = {
+      kind: "sql-expr",
+      text: "'; DROP TABLE sql_expr_brand_items; --",
+    };
+
+    await updateMany(db, meta, { payload: forged }, { id: "1" });
+
+    expect(calls).toHaveLength(1);
+    const { sqlText, params } = calls[0]!;
+    expect(sqlText).not.toContain("DROP TABLE");
+    expect(params).toContainEqual(forged);
+  });
+
+  test("insertOne still inlines a legitimately-built sql`...` expression as a literal", async () => {
+    const { db, calls } = makeRecordingDb();
+
+    await insertOne(db, meta, { id: "1", createdAt: sql`now()` });
+
+    expect(calls).toHaveLength(1);
+    const { sqlText, params } = calls[0]!;
+    expect(sqlText).toContain("now()");
+    expect(params).not.toContain("now()");
+  });
+
+  test("updateMany still inlines a legitimately-built sql`...` expression as a literal", async () => {
+    const { db, calls } = makeRecordingDb();
+
+    await updateMany(db, meta, { createdAt: sql`now()` }, { id: "1" });
+
+    expect(calls).toHaveLength(1);
+    const { sqlText } = calls[0]!;
+    expect(sqlText).toContain('"created_at" = now()');
+  });
+});

package/src/bun-db/query.ts

@@ -29,6 +29,7 @@ import type {
 // globalThis, so instantFromDriver crashed on timestamptz reads (#1480).
 import { Temporal } from "temporal-polyfill";
 import { computeBlindIndex, configuredBlindIndexKey } from "../crypto/blind-index";
+import { SQL_EXPR_BRAND } from "../db/dialect";
 import type { EntityTableMeta } from "../db/entity-table-meta";
 import { extractPgError } from "../db/pg-error";
 import { type NotExecutorOnly, toSnakeCase } from "../db/table-builder";
@@ -501,8 +502,11 @@ type PreparedValue =
   | { readonly kind: "param"; readonly sql: string; readonly bound: unknown }
   | { readonly kind: "literal"; readonly literal: string };
 
+// Checks the brand Symbol, not the `kind` string — a client-supplied jsonb
+// value can fake `kind: "sql-expr"` over JSON but can never carry a Symbol,
+// so request data can't be smuggled in as a raw SQL literal.
 function isSqlExpression(v: unknown): v is { kind: "sql-expr"; text: string } {
-  return typeof v === "object" && v !== null && (v as { kind?: unknown }).kind === "sql-expr";
+  return typeof v === "object" && v !== null && SQL_EXPR_BRAND in v;
 }
 
 // A `date` column takes a plain "yyyy-mm-dd" string (or PlainDate.toString())

package/src/db/__tests__/compound-types.test.ts

@@ -85,7 +85,12 @@ describe("rehydrateCompoundTypes — Pipeline", () => {
       label: "ACME",
       pickup: { at: "2026-04-15T10:00:00", tz: "Europe/Lisbon", utc: "2026-04-15T09:00:00Z" },
       // rehydrateMoney converts minor units (DB) → major units (API, ÷100).
-      buyingPrice: { amount: 45_000, currency: "EUR", amountMinor: 4_500_000 },
+      buyingPrice: {
+        amount: 45_000,
+        currency: "EUR",
+        amountScaled: 4_500_000,
+        amountMinor: 4_500_000,
+      },
     });
   });
 
@@ -98,7 +103,12 @@ describe("rehydrateCompoundTypes — Pipeline", () => {
     const round = rehydrateCompoundTypes(flattenCompoundTypes(original, mixedEntity), mixedEntity);
     // pickup bekommt utc dazu beim Read (war beim Insert nicht gesetzt)
     expect((round["pickup"] as { utc: string }).utc).toBe("2026-04-15T09:00:00Z");
-    expect(round["buyingPrice"]).toEqual({ amount: 100, currency: "EUR", amountMinor: 10_000 });
+    expect(round["buyingPrice"]).toEqual({
+      amount: 100,
+      currency: "EUR",
+      amountScaled: 10_000,
+      amountMinor: 10_000,
+    });
     expect(round["label"]).toBe("ACME");
   });
 

package/src/db/__tests__/event-store-executor-list.integration.test.ts

@@ -8,6 +8,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient } from "../../db/query";
 import { createEntity, createNumberField, createTextField } from "../../engine";
+import { UnprocessableError } from "../../errors";
 import { createEventsTable } from "../../event-store";
 import { TestUsers, unsafeCreateEntityTable } from "../../stack";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
@@ -362,12 +363,21 @@ describe("event-store-executor.list — runtime SearchAdapter (Tier 2.7e Audit-F
   // der executor zur Definition-Time keinen ctx-Adapter kennt.
   const exec = createEventStoreExecutor(table, entity, { entityName: "pagerItem" });
 
-  test("ohne searchAdapter: search-Param ist no-op (alle rows zurück)", async () => {
+  test("ohne searchAdapter: search-Param wirft statt still zu verpuffen (#2032)", async () => {
     for (let i = 0; i < 3; i++) {
       await exec.create({ title: `item-${i}`, rank: i }, admin, tdb);
     }
-    const res = await exec.list({ limit: 50, search: "irgendwas" }, admin, tdb);
-    expect(res.rows.length).toBe(3);
+    const call = exec.list({ limit: 50, search: "irgendwas" }, admin, tdb);
+    await expect(call).rejects.toThrow(UnprocessableError);
+    await expect(call.catch((e: unknown) => e)).resolves.toMatchObject({
+      code: "unprocessable",
+      httpStatus: 422,
+      details: {
+        reason: "search_adapter_not_wired",
+        entity: "pagerItem",
+        hint: expect.stringContaining("SearchAdapter"),
+      },
+    });
   });
 
   test("mit runtimeOptions.searchAdapter: search filtert auf returned IDs", async () => {

package/src/db/__tests__/event-store-executor-money-rehydrate.integration.test.ts

@@ -88,7 +88,12 @@ describe("event-store-executor — money column rehydration through raw SQL (fw#
     const res = await exec.list({ limit: 50 }, admin, tdb);
     expect(res.rows).toHaveLength(1);
     const row = res.rows[0] as Record<string, unknown>;
-    expect(row["grossTotal"]).toEqual({ amount: 136.85, currency: "EUR", amountMinor: 13685 });
+    expect(row["grossTotal"]).toEqual({
+      amount: 136.85,
+      currency: "EUR",
+      amountScaled: 13685,
+      amountMinor: 13685,
+    });
     expect("grossTotalCurrency" in row).toBe(false);
   });
 
@@ -111,7 +116,12 @@ describe("event-store-executor — money column rehydration through raw SQL (fw#
     > | null;
     expect(row).not.toBeNull();
     if (!row) return;
-    expect(row["grossTotal"]).toEqual({ amount: 42.5, currency: "USD", amountMinor: 4250 });
+    expect(row["grossTotal"]).toEqual({
+      amount: 42.5,
+      currency: "USD",
+      amountScaled: 4250,
+      amountMinor: 4250,
+    });
     expect("grossTotalCurrency" in row).toBe(false);
   });
 

package/src/db/__tests__/money.test.ts

@@ -99,23 +99,42 @@ describe("flattenMoney — Insert/Update Convert (major units → minor units)",
 });
 
 describe("rehydrateMoney — Read Convert (minor units → major units)", () => {
-  test("{ <name>: minorUnits, <name>Currency: string } → { <name>: { amount: majorUnits, currency, amountMinor } }", () => {
+  test("{ <name>: scaledUnits, <name>Currency: string } → { <name>: { amount: majorUnits, currency, amountScaled, amountMinor } }", () => {
     const out = rehydrateMoney({ buyingPrice: 45000, buyingPriceCurrency: "EUR" }, orderEntity);
-    expect(out).toEqual({ buyingPrice: { amount: 450, currency: "EUR", amountMinor: 45000 } });
+    expect(out).toEqual({
+      buyingPrice: { amount: 450, currency: "EUR", amountScaled: 45000, amountMinor: 45000 },
+    });
+  });
+
+  test("amountMinor is a deprecated alias of amountScaled, same value", () => {
+    const out = rehydrateMoney({ buyingPrice: 45000, buyingPriceCurrency: "EUR" }, orderEntity)[
+      "buyingPrice"
+    ] as MoneyRead;
+    expect(out.amountMinor).toBe(out.amountScaled);
   });
 
   test("PG-BIGINT als String wird zu number gecastet", () => {
     // Postgres-driver liefert BIGINT manchmal als String (>2^53 sicher).
     const out = rehydrateMoney({ buyingPrice: "45000", buyingPriceCurrency: "EUR" }, orderEntity);
-    expect(out["buyingPrice"]).toEqual({ amount: 450, currency: "EUR", amountMinor: 45000 });
+    expect(out["buyingPrice"]).toEqual({
+      amount: 450,
+      currency: "EUR",
+      amountScaled: 45000,
+      amountMinor: 45000,
+    });
   });
 
   test("fehlende Currency-Spalte fällt auf entity.defaultCurrency", () => {
     const out = rehydrateMoney({ buyingPrice: 45000 }, orderEntity);
-    expect(out["buyingPrice"]).toEqual({ amount: 450, currency: "EUR", amountMinor: 45000 });
+    expect(out["buyingPrice"]).toEqual({
+      amount: 450,
+      currency: "EUR",
+      amountScaled: 45000,
+      amountMinor: 45000,
+    });
   });
 
-  test("amountMinor bleibt exakter Integer über mehrere Additionen (fw#1830)", () => {
+  test("amountScaled bleibt exakter Integer über mehrere Additionen (fw#1830)", () => {
     const rows = [10, 20, 30].map(
       (minor) =>
         rehydrateMoney({ buyingPrice: minor, buyingPriceCurrency: "EUR" }, orderEntity)[
@@ -124,7 +143,7 @@ describe("rehydrateMoney — Read Convert (minor units → major units)", () =>
     );
     const [a, b, c] = rows;
 
-    expect(a!.amountMinor + b!.amountMinor).toBe(c!.amountMinor);
+    expect(a!.amountScaled + b!.amountScaled).toBe(c!.amountScaled);
   });
 
   test("null/undefined amount → Field wird aus Output entfernt", () => {
@@ -143,12 +162,12 @@ describe("rehydrateMoney — Read Convert (minor units → major units)", () =>
       orderEntity,
     );
     expect(out).toEqual({
-      buyingPrice: { amount: 450, currency: "EUR", amountMinor: 45000 },
-      sellingPrice: { amount: 600, currency: "USD", amountMinor: 60000 },
+      buyingPrice: { amount: 450, currency: "EUR", amountScaled: 45000, amountMinor: 45000 },
+      sellingPrice: { amount: 600, currency: "USD", amountScaled: 60000, amountMinor: 60000 },
     });
   });
 
-  test("Round-Trip: flatten dann rehydrate ergibt dasselbe amount/currency, plus amountMinor", () => {
+  test("Round-Trip: flatten dann rehydrate ergibt dasselbe amount/currency, plus amountScaled", () => {
     const original = {
       buyingPrice: { amount: 450.5, currency: "EUR" },
       sellingPrice: { amount: 56799.16, currency: "USD" },
@@ -156,15 +175,25 @@ describe("rehydrateMoney — Read Convert (minor units → major units)", () =>
     const flat = flattenMoney(original, orderEntity);
     const rehydrated = rehydrateMoney(flat, orderEntity);
     expect(rehydrated).toEqual({
-      buyingPrice: { amount: 450.5, currency: "EUR", amountMinor: 45050 },
-      sellingPrice: { amount: 56799.16, currency: "USD", amountMinor: 5679916 },
+      buyingPrice: { amount: 450.5, currency: "EUR", amountScaled: 45050, amountMinor: 45050 },
+      sellingPrice: {
+        amount: 56799.16,
+        currency: "USD",
+        amountScaled: 5679916,
+        amountMinor: 5679916,
+      },
     });
   });
 
-  test("Round-Trip primitive-Insert: flatten(450) → rehydrate → { amount:450, currency:EUR, amountMinor:45000 }", () => {
+  test("Round-Trip primitive-Insert: flatten(450) → rehydrate → { amount:450, currency:EUR, amountScaled:45000 }", () => {
     const flat = flattenMoney({ buyingPrice: 450 }, orderEntity);
     const out = rehydrateMoney(flat, orderEntity);
-    expect(out["buyingPrice"]).toEqual({ amount: 450, currency: "EUR", amountMinor: 45000 });
+    expect(out["buyingPrice"]).toEqual({
+      amount: 450,
+      currency: "EUR",
+      amountScaled: 45000,
+      amountMinor: 45000,
+    });
   });
 
   test("ist pure — input wird nicht mutiert", () => {
@@ -180,7 +209,7 @@ describe("rehydrateMoney — Read Convert (minor units → major units)", () =>
     ).toThrow(/not a safe integer — DB corruption/);
   });
 
-  test("fractional string amount (fw#1833) → loud throw statt amountMinor mit Nachkommastelle", () => {
+  test("fractional string amount (fw#1833) → loud throw statt amountScaled mit Nachkommastelle", () => {
     expect(() =>
       rehydrateMoney({ buyingPrice: "45000.7", buyingPriceCurrency: "EUR" }, orderEntity),
     ).toThrow(/not a safe integer — DB corruption/);
@@ -208,7 +237,9 @@ describe("Round-Trip im Update-Pfad (Helper-Verkettung wie im Executor)", () =>
 
     // DB liefert dieselben Spalten zurück
     const out = rehydrateMoney(flat, orderEntity);
-    expect(out).toEqual({ buyingPrice: { amount: 990, currency: "USD", amountMinor: 99_000 } });
+    expect(out).toEqual({
+      buyingPrice: { amount: 990, currency: "USD", amountScaled: 99_000, amountMinor: 99_000 },
+    });
   });
 
   test("List-Pfad: mehrere Rows hintereinander rehydraten", () => {
@@ -219,9 +250,9 @@ describe("Round-Trip im Update-Pfad (Helper-Verkettung wie im Executor)", () =>
     ];
     const apiRows = dbRows.map((r) => rehydrateMoney(r, orderEntity));
     expect(apiRows).toEqual([
-      { buyingPrice: { amount: 1, currency: "EUR", amountMinor: 100 } },
-      { buyingPrice: { amount: 2, currency: "USD", amountMinor: 200 } },
-      { buyingPrice: { amount: 3, currency: "GBP", amountMinor: 300 } },
+      { buyingPrice: { amount: 1, currency: "EUR", amountScaled: 100, amountMinor: 100 } },
+      { buyingPrice: { amount: 2, currency: "USD", amountScaled: 200, amountMinor: 200 } },
+      { buyingPrice: { amount: 3, currency: "GBP", amountScaled: 300, amountMinor: 300 } },
     ]);
   });
 });

package/src/db/dialect.ts

@@ -377,10 +377,16 @@ export function primaryKey(opts: {
 // Limits: no nested SqlExpression composition (drizzle's recursive
 // `sql\`${other}\``) — schema-files use single-level expressions only.
 
+// Unforgeable via JSON — a client-supplied jsonb value can fake `kind:
+// "sql-expr"` but can never carry a Symbol, so isSqlExpression() (bun-db/query.ts)
+// can't be tricked into treating request data as a raw SQL literal.
+export const SQL_EXPR_BRAND: unique symbol = Symbol("sql-expr");
+
 export type SqlExpression = {
   readonly kind: "sql-expr";
   readonly text: string;
   readonly params: readonly unknown[];
+  readonly [SQL_EXPR_BRAND]: true;
 };
 
 export function sql(strings: TemplateStringsArray, ...values: readonly unknown[]): SqlExpression {
@@ -397,10 +403,15 @@ export function sql(strings: TemplateStringsArray, ...values: readonly unknown[]
       }
     }
   }
-  return { kind: "sql-expr", text: parts.join(""), params };
+  return { kind: "sql-expr", text: parts.join(""), params, [SQL_EXPR_BRAND]: true };
 }
 
-sql.raw = (text: string): SqlExpression => ({ kind: "sql-expr", text, params: [] });
+sql.raw = (text: string): SqlExpression => ({
+  kind: "sql-expr",
+  text,
+  params: [],
+  [SQL_EXPR_BRAND]: true,
+});
 
 // ---- table() — the schema-table factory ----
 //

package/src/db/event-store-executor-read.ts

@@ -5,6 +5,7 @@ import { coerceRow, extractTableInfo } from "../db/query";
 import { buildOwnershipClause, shiftParams } from "../engine/ownership";
 import type { EntityId } from "../engine/types";
 import { SYSTEM_TENANT_ID } from "../engine/types/identifiers";
+import { UnprocessableError } from "../errors";
 import { getStreamVersion } from "../event-store";
 import { rehydrateCompoundTypes } from "./compound-types";
 import { decodeCursor, encodeCursor } from "./cursor";
@@ -54,7 +55,17 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
       // ctx.searchAdapter erst zur Laufzeit weil createEventStoreExecutor
       // beim Definition-Time noch keinen Server-Context hat).
       const effectiveSearchAdapter = searchAdapter ?? runtimeOptions?.searchAdapter;
-      if (payload.search && effectiveSearchAdapter && entityName) {
+      if (payload.search) {
+        // #2032 — a search term with no adapter wired must fail loud, not
+        // silently return the unfiltered list dressed up as a search result.
+        if (!effectiveSearchAdapter) {
+          throw new UnprocessableError("search_adapter_not_wired", {
+            details: {
+              entity: entityName,
+              hint: "Wire a SearchAdapter for this entity, or remove `searchable` from the field/screen.",
+            },
+          });
+        }
         const results = await effectiveSearchAdapter.search(user.tenantId, payload.search, {
           filterType: entityName,
         });