@cosmicdrift/kumiko-framework 0.334.0 → 0.335.0

package/dist/pipeline/dispatch-write.js

@@ -97,7 +97,7 @@ async function runLifecycle(ctx, type, data, handlerContext, user, origin, after
     if (result.kind === "save") {
         await lifecycle.runPostSave(type, result, handlerContext, HookPhases.inTransaction);
         afterCommitHooks.push(async () => {
-            const afterCommitContext = await buildHandlerContext(ctx, type, user, origin, undefined, afterCommitHooks);
+            const afterCommitContext = await buildHandlerContext(ctx, type, user, origin, undefined, undefined, undefined, true);
             await lifecycle.runPostSave(type, result, afterCommitContext, HookPhases.afterCommit);
         });
     }
@@ -105,7 +105,7 @@ async function runLifecycle(ctx, type, data, handlerContext, user, origin, after
         await lifecycle.runPreDelete(type, result, handlerContext);
         await lifecycle.runPostDelete(type, result, handlerContext, HookPhases.inTransaction);
         afterCommitHooks.push(async () => {
-            const afterCommitContext = await buildHandlerContext(ctx, type, user, origin, undefined, afterCommitHooks);
+            const afterCommitContext = await buildHandlerContext(ctx, type, user, origin, undefined, undefined, undefined, true);
             await lifecycle.runPostDelete(type, result, afterCommitContext, HookPhases.afterCommit);
         });
     }
@@ -115,8 +115,7 @@ async function runLifecycle(ctx, type, data, handlerContext, user, origin, after
 //
 // Contract:
 //   - `tx` is the active Drizzle transaction handle, or undefined for "no
-//     surrounding transaction" — either no Postgres is configured, or the
-//     transaction already committed (afterCommit phase).
+//     surrounding transaction" — no Postgres is configured.
 //   - `afterCommitHooks` collects deferred side-effects that must only fire
 //     after the transaction commits. The caller flushes them on commit, drops
 //     them on rollback. executeWrite never fires them directly.
@@ -145,6 +144,23 @@ async function isParentRowHiddenFromCaller(ctx, parentEntityName, parentId, user
         return true;
     return hasTenantColumn(table) && visibleRow["tenantId"] !== user.tenantId;
 }
+// A custom create handler may return a partial row. The ownership check only
+// inspects the keys it is given, so a row missing the ownership-bound field
+// would be denied (rule evaluated against undefined) or skipped entirely.
+// Complete it from the stored row, read through the caller's tenant filter.
+async function completeParentRow(ctx, parentEntityName, parentEntity, parentRow, user, tx) {
+    if (Object.keys(parentEntity.fields).every((fieldName) => fieldName in parentRow)) {
+        return parentRow;
+    }
+    const table = getTable(ctx, parentEntityName);
+    const source = resolveDbSource(ctx, tx);
+    if (!table || !source || typeof parentRow["id"] !== "string")
+        return parentRow;
+    const stored = await createTenantDb(source, user.tenantId, "tenant").fetchOne(table, {
+        id: parentRow["id"],
+    });
+    return stored ? { ...stored, ...parentRow } : parentRow;
+}
 // Nested-write orchestration (v1: depth=1, create-only, hasMany-only).
 //
 // When a parent `:create` handler's payload carries values under keys
@@ -233,7 +249,8 @@ export async function executeNestedWrite(ctx, type, payload, user, origin, tx, a
     if (parentEntityName) {
         const parentEntity = registry.getEntity(parentEntityName);
         if (parentEntity) {
-            const deniedField = checkWriteFieldOwnership(parentEntity, parentRow, user);
+            const ownershipRow = await completeParentRow(ctx, parentEntityName, parentEntity, parentRow, user, tx);
+            const deniedField = checkWriteFieldOwnership(parentEntity, ownershipRow, user);
             if (deniedField) {
                 return writeFailure(new AccessDeniedError({
                     message: `nested-write: parent row ownership check failed on field "${deniedField}" of "${type}" — refusing to attach children to a parent row the caller does not own`,

package/dist/pipeline/dispatcher.js

@@ -2,8 +2,7 @@ import { runWithWriteOrigin } from "../api/request-context.js";
 import { DEPRECATED_CROSS_TENANT_SIGNAL, isDeprecatedCrossTenantHandler, } from "../engine/entity-handlers.js";
 import { TENANT_MEMBERSHIPS_QUERY } from "../engine/extension-names.js";
 import { InternalError, reraiseAsKumikoError } from "../errors/index.js";
-import { createEscapeHatchReportWindow } from "../observability/escape-hatch-report.js";
-import { getFallbackMeter, getFallbackTracer, registerStandardMetrics, } from "../observability/index.js";
+import { createEscapeHatchReportWindow, getFallbackMeter, getFallbackTracer, registerStandardMetrics, } from "../observability/index.js";
 import { INTERACTIVE_SIGN_IN_POLICY, resolveActiveMembershipFn } from "./active-membership.js";
 import { runBatch, unwrapSingle } from "./dispatch-batch.js";
 import { executeQuery } from "./dispatch-query.js";

package/dist/pipeline/event-dispatcher-admin.js

@@ -1,4 +1,4 @@
-import { advanceConsumerPastEventReturning, removePendingGapReturning, selectSnapshotXmax, updateConsumerStatusReturning, } from "../db/queries/event-consumer.js";
+import { advanceConsumerPastEventReturning, removePendingGapReturning, selectConsumerForUpdate, selectSnapshotXmax, updateConsumerStatusReturning, } from "../db/queries/event-consumer.js";
 import { selectNextEventIdAfter, selectSmallestVisibleIdInRanges, } from "../db/queries/event-store.js";
 import { coerceRow, extractTableInfo, selectMany } from "../db/query.js";
 import { getEventsHighWaterMark } from "../event-store/index.js";
@@ -50,6 +50,14 @@ async function requireConsumerRow(db, name, instanceId) {
     }
     return row;
 }
+async function requireConsumerRowForUpdate(tx, name, instanceId) {
+    const raw = await selectConsumerForUpdate(tx, name, instanceId);
+    if (!raw) {
+        throw new Error(`Consumer "${name}" (instance_id="${instanceId}") has no state row — it hasn't run yet, the name is misspelled, or the instance is misspelled. ` +
+            `For per-instance consumers pass the instance_id explicitly; shared consumers use the default.`);
+    }
+    return coerceRow(raw, extractTableInfo(eventConsumerStateTable));
+}
 async function applyConsumerStatusTransition(db, name, instanceId, targetStatus) {
     const raw = await updateConsumerStatusReturning(db, name, instanceId, targetStatus);
     const updated = raw && coerceRow(raw, extractTableInfo(eventConsumerStateTable));
@@ -84,8 +92,10 @@ export async function enableConsumer(db, name, instanceId = SHARED_INSTANCE_SENT
 // event after the cursor. Single TX so concurrent dispatcher passes can't
 // double-advance. Nothing to skip → idempotent no-op.
 export async function skipPoisonEvent(db, name, instanceId = SHARED_INSTANCE_SENTINEL) {
-    const before = await requireConsumerRow(db, name, instanceId);
     return db.begin(async (tx) => {
+        // Locked read: a dispatcher turn committing new gaps between an unlocked
+        // read and the pending_gaps overwrite below would have them dropped.
+        const before = await requireConsumerRowForUpdate(tx, name, instanceId);
         const pendingGaps = before.pendingGaps;
         const failedEventId = before.lastFailedEventId;
         const failedIsPending = failedEventId !== null && pendingGaps.some((gap) => rangeContainsId(gap, failedEventId));

package/dist/pipeline/event-dispatcher.d.ts

@@ -31,6 +31,7 @@ export type EventDispatcher = {
     runOnce(): Promise<DispatcherPassResult>;
     ensureRegistered(): Promise<void>;
     drain(): Promise<void>;
+    withBackgroundPassesPaused<T>(fn: () => Promise<T>): Promise<T>;
     readonly consumers: readonly EventConsumer[];
 };
 export type EventDispatcherOptions = {

package/dist/pipeline/event-dispatcher.js

@@ -170,6 +170,15 @@ export function createEventDispatcher(options) {
             // skip: errors already recorded per-consumer inside the pass
         })));
     }
+    let backgroundPassPauseDepth = 0;
+    function runBackgroundPass() {
+        // skip: background passes are paused
+        if (backgroundPassPauseDepth > 0)
+            return;
+        void runOnce().catch(() => {
+            // skip: per-consumer errors already recorded in the state row
+        });
+    }
     async function runOnce() {
         if (!preRegistered) {
             throw new Error("EventDispatcher.runOnce() called before start() — consumer state rows are not registered. Call start() first (production) or ensureRegistered() (tests after truncating kumiko_event_consumers).");
@@ -445,11 +454,7 @@ export function createEventDispatcher(options) {
             // any consumer that exists, including freshly-deployed ones.
             await preRegisterConsumers(db, consumers, options.instanceId);
             preRegistered = true;
-            timer = setInterval(() => {
-                void runOnce().catch(() => {
-                    // skip: per-consumer errors already recorded in the state row
-                });
-            }, pollIntervalMs);
+            timer = setInterval(runBackgroundPass, pollIntervalMs);
             // NOTIFY-based wake-up: subscribe on the same channel that
             // event-store.append fires on commit. Fires runOnce directly, no
             // polling round-trip. The timer stays on as a belt-and-braces
@@ -464,11 +469,7 @@ export function createEventDispatcher(options) {
             emitEventDispatcherListenConnected(meter, false);
             if (options.pgClient) {
                 try {
-                    const sub = await options.pgClient.listen(EVENTS_PUBSUB_CHANNEL, () => {
-                        void runOnce().catch(() => {
-                            // skip: per-consumer errors already recorded in the state row
-                        });
-                    }, () => {
+                    const sub = await options.pgClient.listen(EVENTS_PUBSUB_CHANNEL, runBackgroundPass, () => {
                         // Fires on initial connect and again when postgres.js's own
                         // re-LISTEN lands after a drop; during an outage that re-LISTEN
                         // waits in its connection backoff (measured 10-30s after the DB
@@ -517,7 +518,21 @@ export function createEventDispatcher(options) {
             await preRegisterConsumers(db, consumers, options.instanceId);
             preRegistered = true;
         },
-        drain: drainInFlightTurns,
+        async drain() {
+            await drainInFlightPasses();
+            await drainInFlightTurns();
+        },
+        async withBackgroundPassesPaused(fn) {
+            backgroundPassPauseDepth++;
+            try {
+                await drainInFlightPasses();
+                await drainInFlightTurns();
+                return await fn();
+            }
+            finally {
+                backgroundPassPauseDepth--;
+            }
+        },
         runOnce,
     };
 }

package/dist/pipeline/index.d.ts

@@ -1,5 +1,5 @@
 export type { EscapeHatchReportWindow } from "../observability/escape-hatch-report.js";
-export { createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, reportEscapeHatchUse, } from "../observability/escape-hatch-report.js";
+export { createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, } from "../observability/escape-hatch-report.js";
 export type { ResolveAuthClaimsArgs } from "./auth-claims-resolver.js";
 export { resolveAuthClaims } from "./auth-claims-resolver.js";
 export { createCascadeDeleteHook } from "./cascade-handler.js";

package/dist/pipeline/index.js

@@ -1,4 +1,4 @@
-export { createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, reportEscapeHatchUse, } from "../observability/escape-hatch-report.js";
+export { createEscapeHatchReporter, createEscapeHatchReportWindow, ESCAPE_HATCH_USED_SIGNAL, fallbackEscapeHatchReporter, reportEscapeHatchUse, UNATTRIBUTED_ACTOR, } from "../observability/escape-hatch-report.js";
 export { resolveAuthClaims } from "./auth-claims-resolver.js";
 export { createCascadeDeleteHook } from "./cascade-handler.js";
 export { createDispatcher, dispatcherToWriteRef } from "./dispatcher.js";

package/dist/pipeline/member-read-only-transaction.js

@@ -3,21 +3,8 @@ import { asRawClient, runInSavepoint, transaction } from "../db/query.js";
 import { AccessDeniedError, InternalError, memberResolutionReadOnlyDenied, } from "../errors/index.js";
 import { resolveDbSource } from "./dispatch-shared.js";
 const PG_READ_ONLY_SQLSTATE = "25006";
-// Bun.SQL surfaces the PG SQLSTATE as `errno` (code stays "ERR_POSTGRES_SERVER_ERROR");
-// postgres.js surfaces it as `code`, possibly one `.cause` layer down (DrizzleQueryError-style wrapping).
 function isReadOnlyTransactionViolation(e) {
-    if (extractPgError(e)?.code === PG_READ_ONLY_SQLSTATE)
-        return true;
-    if (typeof e !== "object" || e === null)
-        return false;
-    // @cast-boundary error-details — Bun.SQL error shape (errno)
-    if (e.errno === PG_READ_ONLY_SQLSTATE)
-        return true;
-    // @cast-boundary error-details — Bun.SQL error shape (errno) under .cause
-    const cause = e.cause;
-    if (typeof cause !== "object" || cause === null)
-        return false;
-    return cause.errno === PG_READ_ONLY_SQLSTATE;
+    return extractPgError(e)?.code === PG_READ_ONLY_SQLSTATE;
 }
 async function runInDiscardedReadOnlySavepoint(tx, fn) {
     const discardMarker = {};

package/dist/pipeline/msp-rebuild.d.ts

@@ -8,5 +8,6 @@ export type MspRebuildDeps = {
     readonly meter?: Meter;
     readonly onMetrics?: (result: RebuildResult) => void;
     readonly markDeadOnFailure?: boolean;
+    readonly signal?: AbortSignal;
 };
 export declare function rebuildMultiStreamProjection(mspName: string, deps: MspRebuildDeps): Promise<RebuildResult>;

package/dist/pipeline/msp-rebuild.js

@@ -71,6 +71,7 @@ export async function rebuildMultiStreamProjection(mspName, deps) {
                 const events = await selectMany(tx, eventsTable, { type: [...subscribedTypes], id: { lte: horizon } }, { orderBy: { col: "id", direction: "asc" } });
                 const upcasters = registry.getEventUpcasters();
                 for (const row of events) {
+                    deps.signal?.throwIfAborted();
                     const raw = {
                         id: String(row.id),
                         aggregateId: row.aggregateId,

package/dist/pipeline/system-hooks.d.ts

@@ -1,4 +1,4 @@
-import type { SseBroker } from "../api/sse-broker.js";
+import { type SseBroker } from "../api/sse-broker.js";
 import type { EntityId, JobRunnerRef, Registry, TenantId } from "../engine/types/index.js";
 import type { SearchAdapter, SearchDocument } from "../search/types.js";
 import type { EventConsumer } from "./event-dispatcher.js";

package/dist/pipeline/system-hooks.js

@@ -1,6 +1,8 @@
+import { readNonEmptyStringArray, } from "../api/sse-broker.js";
 import { collectSearchableSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
 import { createTenantDb, entityTableFromRegistry, rehydrateCompoundTypes } from "../db/index.js";
 import { tenantChannel } from "../engine/constants.js";
+import { InternalError } from "../errors/index.js";
 // --- Search Index Consumer (async, via event-dispatcher) ---
 //
 // Search-Indexierung läuft seit D.4 als async EventConsumer über den event-
@@ -187,8 +189,13 @@ async function readProjectionRowForSearch(ctx, registry, entityName, entity, ten
     // DbConnection: event-dispatcher creation is gated on it being set
     // (api/server.ts), never a HandlerContext's already-tenant-scoped TenantDb.
     const baseDb = ctx.db;
-    if (!baseDb)
-        return undefined;
+    // undefined must keep meaning "no live row" (the caller removes the index
+    // entry), so a missing db fails the event for retry instead.
+    if (!baseDb) {
+        throw new InternalError({
+            message: `search consumer: no db on the consumer context — cannot read the live row of "${entityName}" ${entityId}`,
+        });
+    }
     const table = entityTableFromRegistry(registry, entityName, entity);
     const where = { id: entityId };
     if (entity.softDelete && table["isDeleted"]) {
@@ -511,11 +518,6 @@ function readUserIdFromPreviousSnapshot(payload) {
     const userId = previous["userId"];
     return typeof userId === "string" && userId.length > 0 ? userId : undefined;
 }
-function readNonEmptyStringArray(value) {
-    if (!Array.isArray(value) || value.length === 0)
-        return undefined;
-    return value.every((v) => typeof v === "string") ? value : undefined;
-}
 // session-revoked's scope resolution, in order:
 //   1. streamScope === "revoked-sessions" with a non-empty sessionIds array
 //      (only the raw sessionRevoker callback sets this) → narrow "sessions"

package/dist/pipeline/tenant-timezone-cache.d.ts

@@ -10,6 +10,8 @@ export type TenantTimezoneCacheEntry = {
 export type TenantTimezoneCache = {
     get(tenantId: TenantId): TenantTimezoneCacheEntry | undefined;
     set(tenantId: TenantId, value: string | undefined): void;
+    generation(): number;
+    setIfFresh(tenantId: TenantId, value: string | undefined, generationAtRead: number): void;
     invalidate(tenantId: TenantId): void;
     clear(): void;
     size(): number;

package/dist/pipeline/tenant-timezone-cache.js

@@ -10,20 +10,27 @@ const DEFAULT_TTL_MS = 5 * 60 * 1000;
 const DEFAULT_MAX_ENTRIES = 1000;
 export function createTenantTimezoneCache(opts = {}) {
     const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
-    const maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    // 0 or negative would never evict (size < max is never true) and grow unbounded.
+    const maxEntries = Math.max(1, opts.maxEntries ?? DEFAULT_MAX_ENTRIES);
     const now = opts.now ?? (() => Date.now());
     // Map insertion order doubles as LRU order: touch = delete+re-insert.
     const entries = new Map();
+    let generation = 0;
     function evictOldestIfFull() {
         // skip: cache has room, nothing to evict
         if (entries.size < maxEntries)
             return;
         const oldestKey = entries.keys().next().value;
-        // skip: defensive — only reachable if maxEntries is 0 (cache disabled) and entries is empty
+        // skip: defensive — maxEntries >= 1 guarantees a non-empty map here
         if (oldestKey === undefined)
             return;
         entries.delete(oldestKey);
     }
+    function set(tenantId, value) {
+        entries.delete(tenantId);
+        evictOldestIfFull();
+        entries.set(tenantId, { value, expiresAt: now() + ttlMs });
+    }
     return {
         get(tenantId) {
             const hit = entries.get(tenantId);
@@ -37,15 +44,22 @@ export function createTenantTimezoneCache(opts = {}) {
             entries.set(tenantId, hit);
             return { value: hit.value };
         },
-        set(tenantId, value) {
-            entries.delete(tenantId);
-            evictOldestIfFull();
-            entries.set(tenantId, { value, expiresAt: now() + ttlMs });
+        set,
+        generation() {
+            return generation;
+        },
+        setIfFresh(tenantId, value, generationAtRead) {
+            // skip: an invalidation ran since the read started, the value may be pre-write
+            if (generationAtRead !== generation)
+                return;
+            set(tenantId, value);
         },
         invalidate(tenantId) {
+            generation++;
             entries.delete(tenantId);
         },
         clear() {
+            generation++;
             entries.clear();
         },
         size() {

package/dist/redis/pubsub-signal.d.ts

@@ -1,3 +1,4 @@
+import { type RedisClientOptions } from "./client.js";
 export type PubSubSignal = {
     publish(channel: string, payload: unknown): void;
     onMessage(listener: (channel: string, payload: unknown) => void): void;
@@ -7,5 +8,6 @@ export type PubSubSignalOptions = {
     readonly redisUrl: string;
     readonly channelPattern: string;
     readonly label: string;
+    readonly clientOptions?: RedisClientOptions;
 };
 export declare function createRedisPubSubSignal(opts: PubSubSignalOptions): PubSubSignal;

package/dist/redis/pubsub-signal.js

@@ -9,8 +9,8 @@ function logConnectionError(label, role) {
     };
 }
 export function createRedisPubSubSignal(opts) {
-    const publisher = createRedisClient(opts.redisUrl);
-    const subscriber = createRedisClient(opts.redisUrl);
+    const publisher = createRedisClient(opts.redisUrl, opts.clientOptions);
+    const subscriber = createRedisClient(opts.redisUrl, opts.clientOptions);
     publisher.on("error", logConnectionError(opts.label, "publisher"));
     subscriber.on("error", logConnectionError(opts.label, "subscriber"));
     const listeners = new Set();

package/dist/schema-cli.js

@@ -14,7 +14,7 @@ import { assertValidMigrationName, baselineMigrations, createDbConnection, diffR
 import { validateBoot } from "./engine/boot-validator.js";
 import { createRegistry } from "./engine/registry.js";
 import { createEventsTable } from "./event-store/index.js";
-import { queueRebuildsFromMarkers, runPendingRebuilds } from "./migrations/index.js";
+import { queueRebuildsFromMarkers, reportPendingRebuildRun, runPendingRebuilds, } from "./migrations/index.js";
 import { createEventConsumerStateTable, createProjectionStateTable } from "./pipeline/index.js";
 import { ensureTemporalPolyfill } from "./time/index.js";
 const SNAPSHOT_FILENAME = ".snapshot.json";
@@ -49,6 +49,7 @@ function nextSequenceNumber(migrationsDir) {
     }
     return max + 1;
 }
+const SCHEMA_SUBCOMMANDS = ["generate", "validate", "apply", "baseline", "status"];
 /**
  * Runs a schema-CLI subcommand. `appCwd` is the app workspace root (where
  * `kumiko/schema.ts` + `kumiko/migrations/` live). Returns a process exit code.
@@ -319,18 +320,7 @@ export async function runSchemaCli(argv, appCwd, out, options = {}) {
                     });
                     const registry = createRegistry(options.features);
                     const rebuildRun = await runPendingRebuilds(db, registry, { thisRunTables });
-                    if (rebuildRun.rebuilt.length > 0) {
-                        out.log(`  Rebuild ${rebuildRun.rebuilt.length} Projection(s)…`);
-                        for (const r of rebuildRun.rebuilt) {
-                            out.log(`    ↻ ${r.projection} (${r.eventsProcessed} events)`);
-                        }
-                        out.log("");
-                    }
-                    if (rebuildRun.failed.length > 0) {
-                        throw new Error(`Projection rebuild failed for: ${rebuildRun.failed
-                            .map((f) => `${f.projection} (${f.error})`)
-                            .join("; ")}. Table(s) stay queued in kumiko_pending_rebuilds — retried on the next apply.`);
-                    }
+                    reportPendingRebuildRun(rebuildRun, out.log);
                 }
                 return 0;
             }
@@ -421,7 +411,7 @@ export async function runSchemaCli(argv, appCwd, out, options = {}) {
             // move on without ever running a migration.
             if (sub !== undefined) {
                 out.err(`  Unbekanntes Subcommand: "${sub}"`);
-                out.err("  Erlaubt: generate | validate | apply | baseline | status");
+                out.err(`  Erlaubt: ${SCHEMA_SUBCOMMANDS.join(" | ")}`);
                 return 1;
             }
             out.log("");

package/dist/search/meilisearch-adapter.js

@@ -39,6 +39,12 @@ export function createMeilisearchAdapter(options) {
     // always wins and is never overwritten by the lazy default — its promise
     // sits in the map exactly like a lazily-triggered one.
     const configuredTenants = new Map();
+    // Exact inverse of meilisearchTenantIndex. A bare startsWith(prefix) would also
+    // match a longer sibling prefix (`kumiko_` vs `kumiko_staging_`) sharing the
+    // instance; tenant ids never contain `_`, which excludes that sibling.
+    function isOwnTenantIndex(uid) {
+        return uid.startsWith(prefix) && /^t[0-9A-Za-z-]+$/.test(uid.slice(prefix.length));
+    }
     async function applyConfig(tenantId, config) {
         const index = client.index(meilisearchTenantIndex(prefix, tenantId));
         const fields = config.rankingFields ?? config.searchableFields;
@@ -124,18 +130,23 @@ export function createMeilisearchAdapter(options) {
             for (let offset = 0;; offset += INDEX_LIST_PAGE_SIZE) {
                 const page = await client.getIndexes({ limit: INDEX_LIST_PAGE_SIZE, offset });
                 for (const index of page.results) {
-                    if (index.uid.startsWith(prefix))
+                    if (isOwnTenantIndex(index.uid))
                         uids.push(index.uid);
                 }
                 if (page.results.length === 0 || offset + page.results.length >= page.total)
                     break;
             }
-            for (const uid of uids) {
-                await awaitSucceededTask(client.deleteIndex(uid), REMOVE_TOLERATED_ERROR_CODES);
+            // Cleared even when a delete throws midway: otherwise ensureConfigured treats the
+            // already-dropped tenants as configured and the next index() recreates an
+            // unconfigured index ("not filterable" on filtered search).
+            try {
+                for (const uid of uids) {
+                    await awaitSucceededTask(client.deleteIndex(uid), REMOVE_TOLERATED_ERROR_CODES);
+                }
+            }
+            finally {
+                configuredTenants.clear();
             }
-            // Otherwise ensureConfigured treats the dropped tenants as configured and the
-            // next index() recreates an unconfigured index ("not filterable" on filtered search).
-            configuredTenants.clear();
             return uids.length;
         },
         async removeBatch(tenantId, items) {

package/dist/search/purge-subject.js

@@ -12,7 +12,7 @@ import { isSelfPiiField } from "../crypto/is-self-pii-field.js";
 import { collectSearchableSubjectFields } from "../crypto/subject-resolver.js";
 import { resolveTableName } from "../db/entity-table-meta.js";
 import { executeRawQueryRead } from "../db/queries/raw-sql.js";
-import { tableExists } from "../db/schema-inspection.js";
+import { columnNamesOf, tableExists } from "../db/schema-inspection.js";
 import { toSnakeCase } from "../utils/case.js";
 function finalizePredicateParts(parts, params) {
     if (parts.length === 0)
@@ -140,8 +140,8 @@ subject) {
     const seen = new Set();
     for (const feature of features.values()) {
         for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
-            const fields = collectSearchableSubjectFields(entity);
-            if (fields.length === 0)
+            const declaredFields = collectSearchableSubjectFields(entity);
+            if (declaredFields.length === 0)
                 continue;
             const tableName = resolveTableName(entityName, entity, undefined);
             // Same post-eraseKey hazard as nullBlindIndexesForSubject (fw#2550):
@@ -149,6 +149,11 @@ subject) {
             // (and the audit event after it).
             if (!(await tableExists(db, tableName)))
                 continue;
+            // A migrated table can still lack a later-added searchable column.
+            const columns = await columnNamesOf(db, tableName);
+            const fields = declaredFields.filter((f) => columns.has(toSnakeCase(f)));
+            if (fields.length === 0)
+                continue;
             const predicate = buildSubjectPredicate(entity, fields, likePattern, entityName, subject);
             const rows = await collectMatchingRowsForEntity(db, tableName, predicate.sql, predicate.params);
             for (const row of rows) {

package/dist/stack/drain-jobs.js

@@ -76,24 +76,36 @@ export async function drainJobs(stack, tracker) {
         .filter((consumer) => (consumer.delivery ?? "shared") === "shared")
         .map((consumer) => consumer.name);
     try {
-        let consecutiveIdlePasses = 0;
-        while (consecutiveIdlePasses < REQUIRED_IDLE_PASSES) {
-            await eventDispatcher?.runOnce();
-            const pending = await jobRunner.countPendingJobs();
-            const caughtUp = await sharedConsumersCaughtUp(db, sharedConsumerNames);
-            consecutiveIdlePasses = pending === 0 && caughtUp ? consecutiveIdlePasses + 1 : 0;
-            if (consecutiveIdlePasses < REQUIRED_IDLE_PASSES) {
-                await Promise.race([tracker.waitForActivity(), sleep(DRAIN_IDLE_POLL_MS)]);
+        try {
+            let consecutiveIdlePasses = 0;
+            while (consecutiveIdlePasses < REQUIRED_IDLE_PASSES) {
+                await eventDispatcher?.runOnce();
+                const pending = await jobRunner.countPendingJobs();
+                const caughtUp = await sharedConsumersCaughtUp(db, sharedConsumerNames);
+                consecutiveIdlePasses = pending === 0 && caughtUp ? consecutiveIdlePasses + 1 : 0;
+                if (consecutiveIdlePasses < REQUIRED_IDLE_PASSES) {
+                    await Promise.race([tracker.waitForActivity(), sleep(DRAIN_IDLE_POLL_MS)]);
+                }
             }
         }
+        catch (err) {
+            // A failed job often kills its consumer, so the drain error is only the follow-up symptom.
+            if (tracker.failures.size === 0)
+                throw err;
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`${message}; ${describeJobFailures(tracker)}`, { cause: err });
+        }
         if (tracker.failures.size > 0) {
-            const details = [...tracker.failures.values()]
-                .map((failure) => `${failure.jobName}: ${failure.error}`)
-                .join("; ");
-            throw new Error(`drainJobs: job(s) failed: ${details}`);
+            throw new Error(`drainJobs: ${describeJobFailures(tracker)}`);
         }
     }
     finally {
         tracker.clear();
     }
 }
+function describeJobFailures(tracker) {
+    const details = [...tracker.failures.values()]
+        .map((failure) => `${failure.jobName}: ${failure.error}`)
+        .join("; ");
+    return `job(s) failed: ${details}`;
+}

package/dist/stack/table-helpers.js

@@ -117,12 +117,6 @@ function renderColumnType(col) {
  * rebuilding it.
  */
 export async function resetEventStore(stack, extraTables = []) {
-    // A pass the dispatcher's own timer/LISTEN already started (from a
-    // preceding test) may still be writing into the tables truncated below —
-    // drain it first so the TRUNCATE never races a write it didn't cause.
-    if (stack.eventDispatcher) {
-        await stack.eventDispatcher.drain();
-    }
     const frameworkTables = [
         "kumiko_events",
         "kumiko_event_consumers",
@@ -131,8 +125,16 @@ export async function resetEventStore(stack, extraTables = []) {
         "kumiko_projections",
     ];
     const extraNames = extraTables.map((t) => (typeof t === "string" ? t : tableNameOf(t)));
-    await truncateTablesRestartIdentity(stack.db, [...frameworkTables, ...extraNames]);
+    const truncateAndReregister = async () => {
+        await truncateTablesRestartIdentity(stack.db, [...frameworkTables, ...extraNames]);
+        await stack.eventDispatcher?.ensureRegistered();
+    };
+    // The dispatcher's own timer/LISTEN must not start a pass between the
+    // TRUNCATE and the consumer re-registration, so they are paused for the whole reset.
     if (stack.eventDispatcher) {
-        await stack.eventDispatcher.ensureRegistered();
+        await stack.eventDispatcher.withBackgroundPassesPaused(truncateAndReregister);
+    }
+    else {
+        await truncateAndReregister();
     }
 }

package/dist/testing/closed-connection-error.js

@@ -2,10 +2,9 @@
 // the production matcher checks driver-specific codes a fake can't reproduce.
 import postgres from "postgres";
 import { isClosedConnectionError } from "../bun-db/query.js";
+import { requireEnv } from "../stack/db.js";
 export function testDatabaseUrl() {
-    return (process.env["TEST_DATABASE_URL"] ??
-        process.env["DATABASE_URL"] ??
-        "postgresql://kumiko:kumiko@localhost:15432/kumiko_test");
+    return requireEnv("TEST_DATABASE_URL");
 }
 const MAX_WARMUP_ROUNDS = 10;
 const READS_PER_ROUND = 5;

package/dist/testing/wait-for.js

@@ -30,6 +30,7 @@ fn, options) {
                 // skip: condition already true — no further polling
                 return;
             }
+            lastError = undefined;
         }
         catch (err) {
             lastError = err;

package/dist/ui-types/index.d.ts

@@ -14,7 +14,7 @@ export { metricField } from "../engine/types/screen.js";
 export type { TargetRef } from "../engine/types/target-ref.js";
 export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.js";
 export type { WorkspaceDefinition } from "../engine/types/workspace.js";
-export { PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
+export { ACTION_FORM_ENTITY, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
 export type { AppSchema, FeatureSchema, QualifiedContentCollection, WorkspaceSchema, } from "./app-schema.js";
 export { type Formality, formalLocaleTag } from "./formality.js";
 export type { ListRowMetaColumnType, ListRowMetaReference, ReferenceLookupSource, SystemReferenceLabel, } from "./list-row-meta.js";

package/dist/ui-types/index.js

@@ -25,7 +25,7 @@ export { parseRefTarget } from "../engine/parse-ref-target.js";
 export { evalFieldCondition, explicitListScreenId, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
 export { metricField } from "../engine/types/screen.js";
-export { PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
+export { ACTION_FORM_ENTITY, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
 export { formalLocaleTag } from "./formality.js";
 export { LIST_ROW_META_COLUMNS, LIST_ROW_META_REFERENCES, REFERENCE_LOOKUP_SOURCES, SYSTEM_REFERENCE_LABELS, } from "./list-row-meta.js";
 export { resolveTranslationValue, translationValueOtherText, } from "./plural.js";

package/dist/upgrade-cli.d.ts

@@ -2,6 +2,7 @@ export type UpgradeCliOut = {
     readonly log: (line: string) => void;
     readonly err: (line: string) => void;
 };
+export declare function findFeatureChangelogFiles(featuresDir: string): string[];
 export declare function findPackageChangelogFiles(cwd: string): string[];
 export declare function findFeaturesDirs(cwd: string): string[];
 export declare function findCodemodScriptsRoot(repoRoot: string): string | null;