@cosmicdrift/kumiko-framework 0.356.0 → 0.358.0

package/dist/engine/feature-ast/extractors/resolve-import.js

@@ -5,7 +5,8 @@ const MODULE_RESOLUTION_OPTIONS = {
     target: ts.ScriptTarget.ESNext,
 };
 const MAX_RESOLUTION_DEPTH = 24;
-export function resolveModuleFile(fromFile, specifier) {
+const DECLARATION_FILES_OK = { allowDeclarationFiles: true };
+export function resolveModuleFile(fromFile, specifier, { allowDeclarationFiles = false } = {}) {
     const project = fromFile.getProject();
     // The project's own host, not ts.sys: it honours an in-memory file system
     // (Designer) and exists outside Node.
@@ -13,10 +14,10 @@ export function resolveModuleFile(fromFile, specifier) {
     const resolvedFileName = resolved.resolvedModule?.resolvedFileName;
     if (!resolvedFileName)
         return undefined;
-    // A declaration file has no initializers to read. Installed packages that
-    // ship .ts sources (the @cosmicdrift/* packages in a consumer repo) stay
-    // resolvable, as they were via the type checker.
-    if (resolvedFileName.endsWith(".d.ts"))
+    // A declaration file has no initializers to read. Callers that only need
+    // `export declare const X: "literal"` types opt in (installed packages
+    // resolve to dist/*.d.ts through their publishConfig exports).
+    if (!allowDeclarationFiles && resolvedFileName.endsWith(".d.ts"))
         return undefined;
     return fromFile.getProject().addSourceFileAtPathIfExists(resolvedFileName);
 }
@@ -71,7 +72,7 @@ function resolveViaNamedExportSpecifier(file, exportedName, visited, depth) {
         const moduleSpecifierValue = exportDecl.getModuleSpecifierValue();
         if (!moduleSpecifierValue)
             continue;
-        const target = resolveModuleFile(file, moduleSpecifierValue);
+        const target = resolveModuleFile(file, moduleSpecifierValue, DECLARATION_FILES_OK);
         if (!target)
             continue;
         const resolved = resolveExportedVariable(target, originalName, visited, depth + 1);
@@ -87,7 +88,7 @@ function resolveLocalExportBinding(file, originalName, visited, depth) {
     const binding = findImportBindingForLocalName(file, originalName);
     if (!binding)
         return undefined;
-    const target = resolveModuleFile(file, binding.moduleSpecifier);
+    const target = resolveModuleFile(file, binding.moduleSpecifier, DECLARATION_FILES_OK);
     if (!target)
         return undefined;
     return resolveExportedVariable(target, binding.importedName, visited, depth + 1);
@@ -103,7 +104,7 @@ function resolveViaStarExport(file, exportedName, visited, depth) {
         const moduleSpecifierValue = exportDecl.getModuleSpecifierValue();
         if (!moduleSpecifierValue)
             continue;
-        const target = resolveModuleFile(file, moduleSpecifierValue);
+        const target = resolveModuleFile(file, moduleSpecifierValue, DECLARATION_FILES_OK);
         if (!target)
             continue;
         const resolved = resolveExportedVariable(target, exportedName, visited, depth + 1);

package/dist/engine/feature-ast/extractors/round3.js

@@ -212,6 +212,7 @@ export function extractReferenceData(call, sourceFile) {
         ...(upsertKey !== undefined && { upsertKey }),
     });
 }
+const USE_EXTENSION_READ_OPTIONS = { functionValuesAsRaw: true };
 export function extractUseExtension(call, sourceFile) {
     const args = call.getArguments();
     const first = args[0];
@@ -245,7 +246,7 @@ export function extractUseExtension(call, sourceFile) {
             ?.asKind(SyntaxKind.PropertyAssignment)
             ?.getInitializer();
         if (optionsInit) {
-            const parsed = readDataLiteralNode(optionsInit);
+            const parsed = readDataLiteralNode(optionsInit, USE_EXTENSION_READ_OPTIONS);
             if (!isPlainObject(parsed)) {
                 return fail("useExtension", sourceLocationFromNode(call, sourceFile), "options could not be read as a plain object");
             }
@@ -274,7 +275,7 @@ export function extractUseExtension(call, sourceFile) {
     const optionsArg = args[2];
     let options;
     if (optionsArg) {
-        const parsed = readDataLiteralNode(optionsArg);
+        const parsed = readDataLiteralNode(optionsArg, USE_EXTENSION_READ_OPTIONS);
         if (!isPlainObject(parsed)) {
             return fail("useExtension", sourceLocationFromNode(call, sourceFile), "options could not be read as a plain object");
         }

package/dist/engine/feature-ast/extractors/shared.d.ts

@@ -1,4 +1,5 @@
-import type { CallExpression, Node, ObjectLiteralExpression } from "ts-morph";
+import type { CallExpression, ObjectLiteralExpression } from "ts-morph";
+import { Node } from "ts-morph";
 import type { ParseError } from "../parse.js";
 export type ExtractOutput<TPattern> = {
     readonly kind: "pattern";
@@ -26,7 +27,16 @@ export type RawRefSentinel = {
 };
 export declare function isRawRefSentinel(value: unknown): value is RawRefSentinel;
 export declare function containsRawRefSentinel(value: unknown): boolean;
-export declare function readDataLiteralNode(node: Node): unknown;
+export type ReadDataLiteralOptions = {
+    /**
+     * Keep arrow/function-expression values as `__raw` sentinels instead of
+     * failing the whole read. Only for pattern options that are code by
+     * nature (useExtension); data-only definitions (entity, nav) must still
+     * reject functions.
+     */
+    readonly functionValuesAsRaw?: boolean;
+};
+export declare function readDataLiteralNode(node: Node, readOptions?: ReadDataLiteralOptions): unknown;
 /**
  * A node's literal string value, or the raw-ref sentinel when it resolves to
  * an unresolvable identifier/factory-call/member-access (see

package/dist/engine/feature-ast/extractors/shared.js

@@ -1,4 +1,4 @@
-import { SyntaxKind } from "ts-morph";
+import { Node, SyntaxKind } from "ts-morph";
 import { isPlainObject } from "../../../utils/is-plain-object.js";
 import { findImportBindingForLocalName, findScopedVariableDeclaration, resolveExportedVariable, resolveModuleFile, } from "./resolve-import.js";
 export function ok(pattern) {
@@ -55,7 +55,7 @@ export function containsRawRefSentinel(value) {
         return Object.values(value).some(containsRawRefSentinel);
     return false;
 }
-export function readDataLiteralNode(node) {
+export function readDataLiteralNode(node, readOptions = {}) {
     const kind = node.getKind();
     switch (kind) {
         case SyntaxKind.StringLiteral:
@@ -74,7 +74,7 @@ export function readDataLiteralNode(node) {
             const expr = node.asKindOrThrow(SyntaxKind.PrefixUnaryExpression);
             if (expr.getOperatorToken() !== SyntaxKind.MinusToken)
                 return undefined;
-            const inner = readDataLiteralNode(expr.getOperand());
+            const inner = readDataLiteralNode(expr.getOperand(), readOptions);
             if (typeof inner !== "number")
                 return undefined;
             return -inner;
@@ -83,7 +83,7 @@ export function readDataLiteralNode(node) {
             const arr = node.asKindOrThrow(SyntaxKind.ArrayLiteralExpression);
             const out = [];
             for (const el of arr.getElements()) {
-                const value = readDataLiteralNode(el);
+                const value = readDataLiteralNode(el, readOptions);
                 if (value === undefined)
                     return undefined;
                 out.push(value);
@@ -100,7 +100,7 @@ export function readDataLiteralNode(node) {
                 const initializer = propAssign.getInitializer();
                 if (!initializer)
                     return undefined;
-                const value = readDataLiteralNode(initializer);
+                const value = readDataLiteralNode(initializer, readOptions);
                 if (value === undefined)
                     return undefined;
                 out[readPropertyKey(propAssign)] = value;
@@ -108,11 +108,11 @@ export function readDataLiteralNode(node) {
             return out;
         }
         case SyntaxKind.AsExpression:
-            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.AsExpression).getExpression());
+            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.AsExpression).getExpression(), readOptions);
         case SyntaxKind.SatisfiesExpression:
-            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.SatisfiesExpression).getExpression());
+            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.SatisfiesExpression).getExpression(), readOptions);
         case SyntaxKind.ParenthesizedExpression:
-            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.ParenthesizedExpression).getExpression());
+            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.ParenthesizedExpression).getExpression(), readOptions);
         case SyntaxKind.Identifier:
         case SyntaxKind.CallExpression:
         case SyntaxKind.PropertyAccessExpression:
@@ -121,6 +121,11 @@ export function readDataLiteralNode(node) {
             // resolving/inlining it would silently rewrite the source on the next
             // parse->render roundtrip (see readDataLiteralNode doc above).
             return { __raw: node.getText() };
+        case SyntaxKind.ArrowFunction:
+        case SyntaxKind.FunctionExpression:
+            return readOptions.functionValuesAsRaw
+                ? { __raw: node.getText() }
+                : undefined;
         default:
             return undefined;
     }
@@ -178,6 +183,15 @@ function unwrapLiteralInitializer(node) {
         return unwrapLiteralInitializer(paren.getExpression());
     return undefined;
 }
+// `export declare const NAME: "value"` in a .d.ts has no initializer, only a
+// string-literal type.
+function readDeclaredStringLiteralType(decl) {
+    const typeNode = decl.getTypeNode();
+    if (!typeNode || !Node.isLiteralTypeNode(typeNode))
+        return undefined;
+    const literal = typeNode.getLiteral();
+    return Node.isStringLiteral(literal) ? literal.getLiteralValue() : undefined;
+}
 /**
  * Resolves a bare Identifier to the string value of its declaration's
  * initializer (`export const EXT_TENANT_DATA = "tenant-data" as const`),
@@ -200,12 +214,18 @@ function resolveIdentifierToStringLiteral(identifier) {
     const binding = findImportBindingForLocalName(id.getSourceFile(), name);
     if (!binding)
         return undefined;
-    const targetFile = resolveModuleFile(id.getSourceFile(), binding.moduleSpecifier);
+    const targetFile = resolveModuleFile(id.getSourceFile(), binding.moduleSpecifier, {
+        allowDeclarationFiles: true,
+    });
     if (!targetFile)
         return undefined;
     const decl = resolveExportedVariable(targetFile, binding.importedName);
-    const init = decl?.getInitializer();
-    return init ? unwrapLiteralInitializer(init) : undefined;
+    if (!decl)
+        return undefined;
+    const init = decl.getInitializer();
+    if (init)
+        return unwrapLiteralInitializer(init);
+    return readDeclaredStringLiteralType(decl);
 }
 /**
  * Like `readNameLiteral`, but for callers that must preserve an

package/dist/engine/index.d.ts

@@ -3,7 +3,7 @@ export { hasAccess } from "./access.js";
 export { isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, type PrincipalProfile, type PrincipalStatus, type PrincipalStatusPlugin, TENANT_TEARDOWN_STATUSES, type TenantLifecycleStatusPlugin, } from "./active-membership.js";
 export { PII_DIRECT_NAME_HINTS, PII_USER_OWNED_NAME_HINTS, PII_USER_REFERENCE_NAME_HINTS, } from "./boot-validator/entity-handler.js";
 export { entityHasAnonymizableSubjectField } from "./boot-validator/pii-retention.js";
-export { collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.js";
+export { type CardMetaOverflow, collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.js";
 export { type BuildAppSchemaOptions, buildAppSchema } from "./build-app-schema.js";
 export type { ConfigFeatureSchema } from "./build-config-feature-schema.js";
 export { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE, SETTINGS_HUB_WORKSPACE, } from "./build-config-feature-schema.js";

package/dist/engine/index.js

@@ -4,7 +4,7 @@ export { hasAccess } from "./access.js";
 export { isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, TENANT_TEARDOWN_STATUSES, } from "./active-membership.js";
 export { PII_DIRECT_NAME_HINTS, PII_USER_OWNED_NAME_HINTS, PII_USER_REFERENCE_NAME_HINTS, } from "./boot-validator/entity-handler.js";
 export { entityHasAnonymizableSubjectField } from "./boot-validator/pii-retention.js";
-export { collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.js";
+export { collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.js";
 export { buildAppSchema } from "./build-app-schema.js";
 export { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE, SETTINGS_HUB_WORKSPACE, } from "./build-config-feature-schema.js";
 export { buildTarget } from "./build-target.js";

package/dist/files/file-ref-entity.d.ts

@@ -4,6 +4,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -82,6 +85,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -104,6 +108,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -126,6 +131,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/files/file-ref-table.d.ts

@@ -4,6 +4,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -82,6 +85,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -104,6 +108,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -126,6 +131,7 @@ export declare const fileRefsTable: import("../db/table-builder.js").EntityTable
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/i18n/required-surface-keys.js

@@ -283,6 +283,7 @@ export function requiredKeysFromScreen(featureName, screen, options = {}) {
             pushKey(out, mint.reveal.title);
             pushKey(out, mint.reveal.warning);
             pushKey(out, mint.reveal.confirmLabel);
+            pushKey(out, mint.reveal.acknowledge);
             for (const revealField of mint.reveal.fields) {
                 pushKey(out, revealField.label);
             }

package/dist/jobs/job-runner.d.ts

@@ -9,6 +9,7 @@ import { type AppContext, type DispatchWriteRef, type JobRunIn, type JobTriggerE
  */
 export declare function schedulerIdForJobName(jobName: string): string;
 export declare function bootJobIdForJobName(jobName: string): string;
+export declare const ORPHAN_SCHEDULER_GRACE_MS: number;
 export type JobLogEntry = {
     level: "info" | "warn" | "error";
     message: string;

package/dist/jobs/job-runner.js

@@ -73,9 +73,48 @@ export function schedulerIdForJobName(jobName) {
 export function bootJobIdForJobName(jobName) {
     return `boot-${jobName.replace(/[.:]/g, "-")}`;
 }
-// ponytail: migration shim, remove after fw#1603 deploy is everywhere.
-function legacySchedulerIdForJobName(jobName) {
-    return `scheduler-${jobName.replace(/\./g, "-")}`;
+const SCHEDULER_PAGE_SIZE = 100;
+// Rolling deploys run old and new pods against the same Redis for a while; an
+// old runner restarting in that window must not delete the scheduler of a
+// cron job the new version just added.
+export const ORPHAN_SCHEDULER_GRACE_MS = 60 * 60 * 1000;
+function schedulerSeenKey(queue) {
+    return queue.toKey("kumiko-scheduler-seen");
+}
+// A cron job dropped from the app (or an older scheduler-id format) leaves its
+// scheduler in Redis, where it keeps firing jobs the worker no longer knows
+// ("Unknown job"). Best-effort: a Redis hiccup here must not stop the start.
+async function removeOrphanJobSchedulers(queue, expectedSchedulerIds, lane, log) {
+    try {
+        // Collect first: removing while paging would shift the indices.
+        const existingKeys = [];
+        for (let start = 0;; start += SCHEDULER_PAGE_SIZE) {
+            const page = await queue.getJobSchedulers(start, start + SCHEDULER_PAGE_SIZE - 1);
+            for (const scheduler of page)
+                existingKeys.push(scheduler.key);
+            if (page.length < SCHEDULER_PAGE_SIZE)
+                break;
+        }
+        const client = await queue.client;
+        const seenAt = await client.hgetall(schedulerSeenKey(queue));
+        const now = Date.now();
+        for (const key of existingKeys) {
+            if (expectedSchedulerIds.has(key))
+                continue;
+            const lastSeen = Number(seenAt[key]);
+            if (key in seenAt && now - lastSeen < ORPHAN_SCHEDULER_GRACE_MS)
+                continue;
+            await queue.removeJobScheduler(key);
+            await client.hdel(schedulerSeenKey(queue), key);
+            log.info("removed orphan job scheduler", { schedulerId: key, lane });
+        }
+    }
+    catch (err) {
+        log.warn("orphan job scheduler cleanup failed", {
+            lane,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
 }
 // Deterministic per-tenant child job id, derived from the perTenant
 // wrapper's own BullMQ job id. A cron tick's wrapper id is
@@ -1108,21 +1147,13 @@ export function createJobRunner(options) {
             // Only schedule cron + boot for jobs that belong to this lane. Jobs
             // assigned to the other lane get their cron/boot wiring from the
             // runner running on that lane. Running both here would double-fire.
+            const expectedSchedulerIds = new Set();
             for (const [name, jobDef] of allJobs) {
                 if (laneForJob(jobDef) !== consumerLane)
                     continue;
                 if ("cron" in jobDef.trigger) {
                     const schedulerId = schedulerIdForJobName(name);
-                    const legacyId = legacySchedulerIdForJobName(name);
-                    // Drop pre-sanitize scheduler ids so colon-form ghosts stop firing.
-                    if (legacyId !== schedulerId) {
-                        try {
-                            await consumerQueue.removeJobScheduler(legacyId);
-                        }
-                        catch {
-                            // skip: legacy scheduler absent (fresh install / already purged)
-                        }
-                    }
+                    expectedSchedulerIds.add(schedulerId);
                     await consumerQueue.upsertJobScheduler(schedulerId, { pattern: jobDef.trigger.cron }, {
                         name: jobDef.perTenant ? `_perTenant:${name}` : name,
                         data: {},
@@ -1133,8 +1164,15 @@ export function createJobRunner(options) {
                             ...buildRetryBullOpts(jobDef),
                         },
                     });
+                    await (await consumerQueue.client).hset(schedulerSeenKey(consumerQueue), {
+                        [schedulerId]: String(Date.now()),
+                    });
                 }
             }
+            await removeOrphanJobSchedulers(consumerQueue, expectedSchedulerIds, consumerLane, {
+                info: (msg, data) => context.log ? context.log.info(msg, data) : errorLogger.debug(msg, data),
+                warn: errorLogger.warn,
+            });
             // Persistent marker outside the swept completed/failed sets: a plain
             // Redis hash at one key per consumer queue, fields = boot job ids
             // already enqueued (BullMQ's IRedisClient has no set commands, only

package/dist/pipeline/dispatch-shared.d.ts

@@ -47,6 +47,7 @@ export type DispatchContext = {
     meter: ReturnType<typeof getFallbackMeter>;
     membershipQuery: string;
     memberReadTimeoutMs: number;
+    outsideTransactionDb: DbConnection | undefined;
 };
 export declare const DEFAULT_MEMBER_READ_TIMEOUT_MS = 10000;
 export declare function resolveDbSource(ctx: DispatchContext, tx: DbTx | undefined): DbConnection | DbTx | undefined;

package/dist/pipeline/dispatch-shared.js

@@ -248,7 +248,7 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
     // that is meant to outlive the request. Computed before `systemDb` below
     // so its guarded escape hatch (ctx.systemDb.outsideTransaction) can wrap
     // this same TenantDb instead of a second, independently-built one.
-    const outsideTxSource = resolveDbSource(ctx, undefined);
+    const outsideTxSource = ctx.outsideTransactionDb ?? resolveDbSource(ctx, undefined);
     const rawDbOutsideTransaction = outsideTxSource
         ? buildTenantScopedDb(outsideTxSource, undefined)
         : undefined;

package/dist/pipeline/dispatcher.d.ts

@@ -1,5 +1,6 @@
 import type { CacheSyncBus } from "@cosmicdrift/kumiko-types/cache-sync-types";
 import type { SseBroker } from "../api/sse-broker.js";
+import type { DbConnection } from "../db/connection.js";
 import type { EffectiveFeaturesResolver } from "../engine/tier-resolver-extension.js";
 import type { TenantId } from "../engine/types/identifiers.js";
 import type { ActiveMembershipResult, AppContext, DispatchWriteRef, JobRunnerRef, MemberReader, Registry, SessionUser, WriteResult } from "../engine/types/index.js";
@@ -16,6 +17,7 @@ export type DispatcherOptions = {
     jobRunner?: JobRunnerRef;
     membershipQuery?: string;
     memberReadTimeoutMs?: number;
+    outsideTransactionDb?: DbConnection;
     effectiveFeatures?: EffectiveFeaturesResolver;
     sseBroker?: SseBroker;
     cacheSync?: CacheSyncBus | null;

package/dist/pipeline/dispatcher.js

@@ -97,6 +97,7 @@ export function createDispatcher(registry, context, options = {}) {
         meter: dispatcherMeter,
         membershipQuery,
         memberReadTimeoutMs,
+        outsideTransactionDb: options.outsideTransactionDb,
     };
     const dispatcher = {
         async write(typeOrRef, payload, user, requestId) {

package/dist/pipeline/system-hooks.js

@@ -37,15 +37,19 @@ import { InternalError } from "../errors/index.js";
 // call per tenant instead of one round-trip per event; handler stays the
 // per-event fallback the dispatcher falls back to when a batch throws.
 export const SEARCH_CONSUMER_NAME = "system:consumer:search";
+// An executor update with includeDeleted leaves the row deleted; indexing it would make it findable again.
+function isUpdateOfSoftDeletedRow(event, verb) {
+    return (verb === "updated" && reconstructStateForSearch(event.payload, "updated")["isDeleted"] === true);
+}
 // Resolves what one event implies for the search index, without touching
 // the adapter — same decision tree the old per-event handler ran inline.
 async function resolveSearchOperation(event, ctx, registry) {
     const entityName = event.aggregateType;
     const verb = event.type.split(".").pop();
     const tenantId = event.tenantId;
-    // skip: delete/forgotten remove the index entry — reconstruct only
-    // makes sense for created/updated/restored (field data in payload).
-    if (verb === "deleted" || verb === "forgotten") {
+    // skip: delete/forgotten (and an update on a still soft-deleted row) remove the
+    // index entry — reconstruct only makes sense for live created/updated/restored.
+    if (verb === "deleted" || verb === "forgotten" || isUpdateOfSoftDeletedRow(event, verb)) {
         return { kind: "remove", tenantId, entityType: entityName, entityId: event.aggregateId };
     }
     let state;

package/dist/stack/db.d.ts

@@ -2,6 +2,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-types/db-connection";
 declare function requireEnv(name: string): string;
 export type TestDb = {
     db: DbConnection;
+    outsideTransactionDb: DbConnection;
     client: unknown;
     dbName: string;
     cleanup: () => Promise<void>;
@@ -10,6 +11,8 @@ export type CreateTestDbOptions = {
     readonly baseUrl?: string;
     readonly dbName?: string;
     readonly persistent?: boolean;
+    readonly poolMax?: number;
+    readonly outsideTransactionPoolMax?: number;
 };
 /**
  * Provider-agnostische Test-DB. createConnection liest DB_PROVIDER.

package/dist/stack/db.js

@@ -2,6 +2,7 @@
 // Provider-agnostic via createConnection (DB_PROVIDER env).
 // postgres-js = default. DB_PROVIDER=bun = Bun.SQL (experimentell).
 import { createConnection } from "../db/api.js";
+import { DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX } from "../db/connection.js";
 import { createDatabase, databaseExists, dropDatabaseIfExists } from "../db/queries/test-stack.js";
 import { ensureTemporalPolyfill } from "../time/polyfill.js";
 import { generateId } from "../utils/index.js";
@@ -37,15 +38,20 @@ export async function createTestDb(arg) {
         await admin.close();
     }
     const testUrl = url.replace(/\/[^/]+$/, `/${dbName}`);
-    const conn = await createConnection(testUrl);
+    const conn = await createConnection(testUrl, opts.poolMax !== undefined ? { maxConnections: opts.poolMax } : {});
+    const outsideConn = await createConnection(testUrl, {
+        maxConnections: opts.outsideTransactionPoolMax ?? DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX,
+    });
     const { createEventsTable } = await import("../event-store/index.js");
     await createEventsTable(conn.db);
     return {
         db: conn.db,
+        outsideTransactionDb: outsideConn.db,
         client: conn.client,
         dbName,
         cleanup: async () => {
             await conn.close();
+            await outsideConn.close();
             if (!opts.persistent) {
                 const admin2 = await createConnection(adminUrl, { maxConnections: 1 });
                 try {

package/dist/stack/test-stack.d.ts

@@ -101,6 +101,10 @@ export type TestStackOptions = {
      *  owns its lifecycle. Default false (test contract). Used by
      *  dev-server wiring to survive hot-reloads. */
     persistentDb?: boolean;
+    /** Cap on the main app pool (default: driver default). Lets tests saturate it deliberately. */
+    dbPoolMax?: number;
+    /** Size of the dedicated pool behind ctx.dbOutsideTransaction / ctx.outsideTransaction. */
+    outsideTransactionPoolMax?: number;
     /** Forwarded to buildServer — when set, requests without a JWT pass
      *  through as anonymous instead of 401. See AnonymousAccessConfig.
      *  Akzeptiert entweder einen statischen Config-Object ODER eine Factory

package/dist/stack/test-stack.js

@@ -44,6 +44,10 @@ export async function setupTestStack(options) {
         createTestDb({
             ...(options.dbName !== undefined && { dbName: options.dbName }),
             ...(options.persistentDb !== undefined && { persistent: options.persistentDb }),
+            ...(options.dbPoolMax !== undefined && { poolMax: options.dbPoolMax }),
+            ...(options.outsideTransactionPoolMax !== undefined && {
+                outsideTransactionPoolMax: options.outsideTransactionPoolMax,
+            }),
         }),
         createTestRedis(options.sharedRedisWith && { borrowKeyPrefix: options.sharedRedisWith.redis.keyPrefix }),
     ]);
@@ -286,6 +290,7 @@ export async function setupTestStack(options) {
             dispatcherOptions: {
                 idempotency,
                 cacheSync,
+                outsideTransactionDb: testDb.outsideTransactionDb,
                 ...(options.effectiveFeatures && { effectiveFeatures: options.effectiveFeatures }),
                 ...(jobRunner && { jobRunner }),
             },