@cosmicdrift/kumiko-framework 0.357.0 → 0.359.0

package/dist/crypto/pii-field-encryption.d.ts

@@ -11,6 +11,7 @@ export interface EncryptPiiOptions {
     readonly tenantId?: TenantId;
     readonly subjectSource?: Record<string, unknown>;
     readonly entityName: string;
+    readonly ownerFallback?: Record<string, unknown>;
 }
 export declare function encryptPiiFieldValues(row: Record<string, unknown>, entity: EntityDefinition, piiFields: readonly string[], kms: LocalKeyKmsAdapter, kmsCtx: KmsContext, opts: EncryptPiiOptions): Promise<Record<string, unknown>>;
 export declare function serializeJsonbValue(field: string, value: unknown): string;

package/dist/crypto/pii-field-encryption.js

@@ -151,6 +151,7 @@ export async function encryptPiiFieldValues(row, entity, piiFields, kms, kmsCtx,
         const subject = resolveSubjectForField(entity, name, subjectSource, {
             entityName: opts.entityName,
             ...(opts.tenantId !== undefined && { tenantId: opts.tenantId }),
+            ...(opts.ownerFallback !== undefined && { ownerFallback: opts.ownerFallback }),
         });
         // skip: collectPiiSubjectFields only yields annotated fields — null is unreachable, kept as a type guard
         if (subject === null)

package/dist/crypto/subject-resolver.d.ts

@@ -9,6 +9,8 @@ export declare class SubjectResolutionError extends Error {
 export interface ResolveSubjectOptions {
     readonly tenantId?: TenantId;
     readonly entityName: string;
+    readonly ownerFallback?: Record<string, unknown>;
+    readonly ignoreWhenAbsent?: boolean;
 }
 /**
  * Maps a pii-annotated field to the subject whose key encrypts it.

package/dist/crypto/subject-resolver.js

@@ -29,12 +29,15 @@ function resolveRecordSubject(fieldName, row, opts) {
     }
     return { kind: "record", entity: entityName, id: recordId };
 }
-function resolveUserOwnedSubject(ownerField, fieldName, row) {
-    const userId = nonEmptyString(row[ownerField]);
-    if (userId === null) {
-        throw new SubjectResolutionError(fieldName, `owner field "${ownerField}" is empty on the row`);
+function resolveUserOwnedSubject(userOwned, fieldName, row, opts) {
+    const { ownerField } = userOwned;
+    const userId = nonEmptyString(row[ownerField]) ?? nonEmptyString(opts.ownerFallback?.[ownerField]);
+    if (userId !== null)
+        return { kind: "user", userId };
+    if (userOwned.whenAbsent === "tenant" && opts.ignoreWhenAbsent !== true) {
+        return resolveTenantSubject(fieldName, row, opts);
     }
-    return { kind: "user", userId };
+    throw new SubjectResolutionError(fieldName, `owner field "${ownerField}" is empty on the row and the field declares no whenAbsent — declare { personal: { of: "${ownerField}", whenAbsent: "tenant" } } (fw#3654)`);
 }
 function resolveTenantSubject(fieldName, row, opts) {
     const tenantId = nonEmptyString(row["tenantId"]) ?? opts.tenantId;
@@ -68,7 +71,7 @@ export function resolveSubjectForField(entity, fieldName, row, opts) {
         return resolveRecordSubject(fieldName, row, opts);
     }
     if ("userOwned" in field && field.userOwned !== undefined) {
-        return resolveUserOwnedSubject(field.userOwned.ownerField, fieldName, row);
+        return resolveUserOwnedSubject(field.userOwned, fieldName, row, opts);
     }
     if ("tenantOwned" in field && field.tenantOwned === true) {
         return resolveTenantSubject(fieldName, row, opts);

package/dist/db/connection.d.ts

@@ -8,3 +8,5 @@ export declare function createDbConnection(url: string, options?: import("./api.
     close: () => Promise<void>;
 };
 export declare function dbConnectionOptionsFromEnv(env?: Readonly<Record<string, string | undefined>>): import("./api.js").DbConnectionOptions;
+export declare const DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX = 3;
+export declare function outsideTransactionPoolOptionsFromEnv(env?: Readonly<Record<string, string | undefined>>): import("./api.js").DbConnectionOptions;

package/dist/db/connection.js

@@ -33,3 +33,13 @@ export function dbConnectionOptionsFromEnv(env = process.env) {
         opts.connectTimeoutSeconds = connect;
     return opts;
 }
+// Outside-tx access runs on its own pool: sharing the write pool deadlocks once
+// pool-max concurrent writes each hold a tx and then wait for a second connection.
+export const DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX = 3;
+export function outsideTransactionPoolOptionsFromEnv(env = process.env) {
+    return {
+        ...dbConnectionOptionsFromEnv(env),
+        maxConnections: readPositiveIntEnv(env, "DATABASE_OUTSIDE_TX_POOL_MAX") ??
+            DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX,
+    };
+}

package/dist/db/event-store-executor-context.d.ts

@@ -62,6 +62,7 @@ export type ExecutorContext = {
         onlyKeys?: Iterable<string>;
         subjectSource?: Record<string, unknown>;
         keyTenantId?: TenantId | undefined;
+        ownerFallback?: Record<string, unknown>;
     }) => Promise<Record<string, unknown>>;
     readonly decryptForRead: (row: Record<string, unknown>, opts?: DecryptForReadOptions) => Promise<Record<string, unknown>>;
     readonly applyDefaults: (payload: Record<string, unknown>) => Record<string, unknown>;

package/dist/db/event-store-executor-context.js

@@ -208,6 +208,7 @@ export function buildExecutorContext(table, entity, options) {
                     entityName,
                     ...(opts?.onlyKeys !== undefined && { onlyKeys: opts.onlyKeys }),
                     ...(opts?.subjectSource !== undefined && { subjectSource: opts.subjectSource }),
+                    ...(opts?.ownerFallback !== undefined && { ownerFallback: opts.ownerFallback }),
                 });
             }
             catch (e) {

package/dist/db/event-store-executor-write.js

@@ -464,8 +464,11 @@ export function createWriteVerbs(ctx) {
                 // re-encrypt it before it's persisted so plaintext of pii/encrypted
                 // fields doesn't land in the immutable log (flatChanges is already
                 // ciphertext from encryptForStorage above).
+                // Owner chain for the ownerless-then-assigned row: previous owner, then the
+                // owner this event sets, then whenAbsent (fw#3654).
                 const encryptedPrevious = await encryptForStorage(previous, user, {
                     keyTenantId: streamTenantId,
+                    ownerFallback: submittedChanges,
                 });
                 // Savepoint-scoped — see the create() append() above for why:
                 // confines a losing writer's unique-violation to a nested scope

package/dist/db/index.d.ts

@@ -4,7 +4,7 @@ export { collectTableMetas } from "./collect-table-metas.js";
 export { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
 export { seedConfigValues } from "./config-seed.js";
 export type { DbConnection, DbConnectionOptions, DbPoolHandle, DbRow, DbRunner, DbTx, } from "./connection.js";
-export { createDbConnection, dbConnectionOptionsFromEnv } from "./connection.js";
+export { createDbConnection, DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX, dbConnectionOptionsFromEnv, outsideTransactionPoolOptionsFromEnv, } from "./connection.js";
 export type { CursorQueryOptions, CursorResult, DecodedKeysetCursor } from "./cursor.js";
 export { decodeCursor, decodeKeysetCursor, encodeCursor, encodeKeysetCursor } from "./cursor.js";
 export type { SchemaTable, SelectQuery, TableColumns } from "./dialect.js";

package/dist/db/index.js

@@ -3,7 +3,7 @@ export { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recor
 export { collectTableMetas } from "./collect-table-metas.js";
 export { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
 export { seedConfigValues } from "./config-seed.js";
-export { createDbConnection, dbConnectionOptionsFromEnv } from "./connection.js";
+export { createDbConnection, DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX, dbConnectionOptionsFromEnv, outsideTransactionPoolOptionsFromEnv, } from "./connection.js";
 export { decodeCursor, decodeKeysetCursor, encodeCursor, encodeKeysetCursor } from "./cursor.js";
 export { bigint, bigserial, boolean, extractTableName, index, instant, instantToDriver, integer, jsonb, moneyAmount, numeric, primaryKey, serial, sql, table, text, timestamp, uniqueIndex, uuid, } from "./dialect.js";
 export { collectReferenceFields, enrichRowWithReferences, enrichWithReferences, } from "./eagerload.js";

package/dist/db/queries/backfill-pii.js

@@ -25,17 +25,22 @@
 // second run reports 0 updates. One failing event does not abort the run;
 // failures are collected and reported (fail-loud at the caller).
 //
-// Owner resolution for entity-lifecycle events (backfill-only — the live
-// write path in event-store-executor-write.ts / subject-resolver.ts stays
-// fail-closed and is untouched by this):
-//   1. payload — the event section itself names the owner field.
+// Owner resolution for entity-lifecycle events. The live write path
+// (event-store-executor-write.ts) resolves the same chain via
+// subject-resolver.ts: row owner, then the owner the same event sets, then
+// the field's whenAbsent (fw#3654). Backfill adds two opt-in stages and
+// delays whenAbsent behind the projection so a known owner is never shadowed:
+//   1. payload — the event section (plus the owner the same event sets) names
+//      the owner field; whenAbsent is not applied yet.
 //   2. projection ({@link PiiBackfillOptions.resolveOwnerFromProjection}) —
 //      pre-owner-field-addition events don't carry it; read it from the
 //      entity's current projection row instead.
+//   2b. whenAbsent — the payload again, now falling back to the tenant key for
+//      fields that declare it.
 //   3. erase ({@link PiiBackfillOptions.eraseUnresolvableSubjects}) — still
 //      unresolvable (hard-deleted aggregate, no projection) → PII_ERASED_SENTINEL.
-//   Both stages are opt-in and off by default; without them an unresolvable
-//   subject still fails loud into `failures`, as before.
+//   Stages 2 and 3 are opt-in and off by default; without them an
+//   unresolvable subject still fails loud into `failures`, as before.
 //
 // Snapshots of touched aggregates are dropped per batch (they may cache
 // plaintext); the next snapshotting load recreates them. AFTER a run, rebuild the
@@ -293,14 +298,7 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
         async function applyEntityLifecycleFields(target, projectionOwnerRow) {
             const sections = lifecycleSections(payload);
             for (const section of sections) {
-                // Update-changes may carry a pii field without its owner field —
-                // resolve subjects from the merged view; aggregate_id backs the
-                // self-subject when a section lacks the id column.
-                const subjectSource = {
-                    id: row.aggregate_id,
-                    ...Object.assign({}, ...sections),
-                    ...section,
-                };
+                const { subjectSource, ownerFallback } = lifecycleSubjectView(section, payload, row.aggregate_id);
                 for (const field of target.piiFields) {
                     const value = section[field];
                     if (value === null || value === undefined)
@@ -316,7 +314,7 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
                     // must stay untouched, not get erased by stage 3.
                     if (isPiiCiphertext(value) || value === PII_ERASED_SENTINEL)
                         continue;
-                    const resolution = resolveOwnerSubject(target.entity, field, subjectSource, projectionOwnerRow, 
+                    const resolution = resolveOwnerSubject(target.entity, field, subjectSource, ownerFallback, projectionOwnerRow, 
                     // @cast-boundary db-read — tenant_id column is the branded TenantId
                     row.tenant_id, row.aggregate_type);
                     if (resolution.kind === "unannotated")
@@ -401,32 +399,41 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
         return scanCache.destroyedTenants;
     }
 }
-// Stage 1 (payload) then stage 2 (projection row, when supplied) — stage 3
-// (erase) is the caller's call, made from the "unresolved" outcome.
-function resolveOwnerSubject(entity, field, subjectSource, projectionOwnerRow, tenantId, entityName) {
+function attemptResolve(entity, field, source, opts) {
     try {
-        const subject = resolveSubjectForField(entity, field, subjectSource, { tenantId, entityName });
-        return subject === null
-            ? { kind: "unannotated" }
-            : { kind: "resolved", subject, viaProjection: false };
+        return { ok: true, subject: resolveSubjectForField(entity, field, source, opts) };
     }
     catch (e) {
         if (!(e instanceof SubjectResolutionError))
             throw e;
-        if (projectionOwnerRow) {
-            try {
-                const augmented = { ...subjectSource, ...projectionOwnerRow };
-                const subject = resolveSubjectForField(entity, field, augmented, { tenantId, entityName });
-                if (subject !== null)
-                    return { kind: "resolved", subject, viaProjection: true };
-            }
-            catch (e2) {
-                if (!(e2 instanceof SubjectResolutionError))
-                    throw e2;
-            }
+        return { ok: false, error: e };
+    }
+}
+// Stage 1 (payload) and stage 2 (projection row, when supplied) resolve the
+// owner strictly, ignoring whenAbsent — an ownerless payload must not shadow
+// an owner the projection knows. Stage 2b then applies whenAbsent to the
+// payload. Stage 3 (erase) is the caller's call, made from "unresolved".
+function resolveOwnerSubject(entity, field, subjectSource, ownerFallback, projectionOwnerRow, tenantId, entityName) {
+    const baseOpts = { tenantId, entityName, ...(ownerFallback && { ownerFallback }) };
+    const strictOpts = { ...baseOpts, ignoreWhenAbsent: true };
+    const payloadAttempt = attemptResolve(entity, field, subjectSource, strictOpts);
+    if (payloadAttempt.ok) {
+        return payloadAttempt.subject === null
+            ? { kind: "unannotated" }
+            : { kind: "resolved", subject: payloadAttempt.subject, viaProjection: false };
+    }
+    if (projectionOwnerRow) {
+        const augmented = { ...subjectSource, ...projectionOwnerRow };
+        const projectionAttempt = attemptResolve(entity, field, augmented, strictOpts);
+        if (projectionAttempt.ok && projectionAttempt.subject !== null) {
+            return { kind: "resolved", subject: projectionAttempt.subject, viaProjection: true };
         }
-        return { kind: "unresolved", error: e };
     }
+    const whenAbsentAttempt = attemptResolve(entity, field, subjectSource, baseOpts);
+    if (whenAbsentAttempt.ok && whenAbsentAttempt.subject !== null) {
+        return { kind: "resolved", subject: whenAbsentAttempt.subject, viaProjection: false };
+    }
+    return { kind: "unresolved", error: payloadAttempt.error };
 }
 // Projection columns are snake_case (author_id); event-payload/subject
 // fields are camelCase (authorId) — forward-map from entity.fields like
@@ -460,6 +467,23 @@ function lifecycleSections(payload) {
         sections.push(payload);
     return sections;
 }
+// Same view the live write path resolves from: changes see the merged row,
+// previous sees the owner the same event sets as fallback. aggregate_id backs
+// the self-subject when a section lacks the id column.
+function lifecycleSubjectView(section, payload, aggregateId) {
+    const changes = isRecord(payload["changes"]) ? payload["changes"] : undefined;
+    const previous = isRecord(payload["previous"]) ? payload["previous"] : undefined;
+    if (section === changes) {
+        return {
+            subjectSource: { id: aggregateId, ...previous, ...changes },
+            ownerFallback: undefined,
+        };
+    }
+    return {
+        subjectSource: { id: aggregateId, ...section },
+        ownerFallback: section === previous ? changes : undefined,
+    };
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/dist/engine/boot-validator/pii-retention.js

@@ -203,6 +203,13 @@ export function validatePiiAndRetention(feature) {
                 if (ownerField.type !== "reference" && ownerField.type !== "text") {
                     throw new Error(`[Feature ${feature.name}] personal.of "${ownerName}" on entity "${entityName}" must be a reference or text (userId) field, got type "${ownerField.type}"`);
                 }
+                const { whenAbsent } = annot.userOwned;
+                if (whenAbsent !== undefined && whenAbsent !== "tenant") {
+                    throw new Error(`[Feature ${feature.name}] Field "${fieldName}" on entity "${entityName}" declares personal.whenAbsent "${String(whenAbsent)}" — entity fields only support whenAbsent: "tenant" (no plaintext fallback for stored PII).`);
+                }
+                if (ownerField.required !== true && whenAbsent === undefined) {
+                    throw new Error(`[Feature ${feature.name}] Field "${fieldName}" on entity "${entityName}" is personal: { of: "${ownerName}" }, but "${ownerName}" is not required — rows without an owner would fail to encrypt (SubjectResolutionError, HTTP 500) on update, delete and forget. Declare { personal: { of: "${ownerName}", whenAbsent: "tenant" } } to encrypt those rows under the tenant key, or make "${ownerName}" required: true. Entity fields have no plaintext fallback (fw#3654).`);
+                }
                 // Soft-Warning wenn das reference-target nicht offensichtlich user
                 // ist — custom subject-entities (HR-Mitarbeiter, Patient) sind
                 // erlaubt, müssen aber bewusste Wahl sein.

package/dist/engine/boot-validator/screens.js

@@ -1874,7 +1874,7 @@ function validateDashboardChartDisplay(featureName, screenId, panel) {
         "from-today",
     ]);
     validateStackedAreaEnumProp(where, "markerLegend", panel.markerLegend, ["list", "legend"]);
-    const nonBooleanProp = ["brush", "legendTotals"].find((prop) => panel[prop] !== undefined && typeof panel[prop] !== "boolean");
+    const nonBooleanProp = ["brush", "legendTotals", "markerLabels"].find((prop) => panel[prop] !== undefined && typeof panel[prop] !== "boolean");
     if (nonBooleanProp !== undefined) {
         throw new Error(`${where} has a non-boolean ${nonBooleanProp}.`);
     }
@@ -1909,6 +1909,7 @@ function validateStackedAreaOnlyProps(where, panel) {
         "dateFormat",
         "initialWindow",
         "markerLegend",
+        "markerLabels",
     ].filter((prop) => panel[prop] !== undefined);
     if (stackedAreaOnly.length > 0) {
         throw new Error(`${where} sets ${stackedAreaOnly.join(", ")} on chart "${panel.chart}" — only "stacked-area" supports it.`);

package/dist/engine/build-app-schema.js

@@ -281,7 +281,16 @@ function projectScreens(featureName, screens, registry, urlPrefillFieldsByScreen
                 ...entityEditWriteExcludedFields(featureName, screen.entity, registry),
             };
         }
-        if (screen.type === "actionForm" || screen.type === "secretMint") {
+        if (screen.type === "actionForm") {
+            const { writeExcludedFields: _authoredExclusions, ...authoredScreen } = screen;
+            const excluded = registry.getWriteHandler(screen.handler)?.excludedFields;
+            return {
+                ...authoredScreen,
+                urlPrefillFields: sortedUrlPrefillFields(urlPrefillFieldsByScreenQn.get(qualifyEntityName(featureName, "screen", shortId))),
+                ...(excluded !== undefined && { writeExcludedFields: excluded }),
+            };
+        }
+        if (screen.type === "secretMint") {
             return {
                 ...screen,
                 urlPrefillFields: sortedUrlPrefillFields(urlPrefillFieldsByScreenQn.get(qualifyEntityName(featureName, "screen", shortId))),

package/dist/engine/factories.js

@@ -1,6 +1,28 @@
 // `personal: { of: "id" }` means the row itself is the subject, not a
 // referenced user — resolves to `recordOwned` instead of `userOwned`.
 const RECORD_OWNER_FIELD = "id";
+function resolvePersonalFlags(personal, reason) {
+    if (personal === "self")
+        return { pii: true };
+    if (personal === "tenant")
+        return { tenantOwned: true };
+    if (personal === "ref")
+        return { subjectRef: true };
+    if (personal === false)
+        return { allowPlaintext: reason };
+    if (!personal)
+        return {};
+    if (personal.of === RECORD_OWNER_FIELD) {
+        if (personal.whenAbsent !== undefined) {
+            throw new Error(`personal: { of: "${RECORD_OWNER_FIELD}", whenAbsent } is meaningless: a row always has an id, so there is never an absent owner (fw#3654)`);
+        }
+        return { recordOwned: true };
+    }
+    const { whenAbsent } = personal;
+    return {
+        userOwned: { ownerField: personal.of, ...(whenAbsent !== undefined && { whenAbsent }) },
+    };
+}
 // Resolves the author-facing `personal`/`find` annotations (kumiko-framework#2250)
 // into the internal ResolvedPiiFlags every factory below merges into its
 // return value. `personal`, `find`, `reason` never survive into the field def.
@@ -9,25 +31,7 @@ function expandPersonalAnnotations(overrides) {
         return {};
     }
     const { personal, find, reason, anonymize, ...rest } = overrides;
-    let personalFlags = {};
-    if (personal === "self") {
-        personalFlags = { pii: true };
-    }
-    else if (personal === "tenant") {
-        personalFlags = { tenantOwned: true };
-    }
-    else if (personal === "ref") {
-        personalFlags = { subjectRef: true };
-    }
-    else if (personal === false) {
-        personalFlags = { allowPlaintext: reason };
-    }
-    else if (personal && personal.of === RECORD_OWNER_FIELD) {
-        personalFlags = { recordOwned: true };
-    }
-    else if (personal) {
-        personalFlags = { userOwned: { ownerField: personal.of } };
-    }
+    const personalFlags = resolvePersonalFlags(personal, reason);
     // `searchable`/`sensitive` live on the individual FieldDef, not on
     // ResolvedPiiFlags — "fuzzy"/"secret" resolve into those too.
     let findFlags = {};

package/dist/engine/feature-ast/extractors/resolve-import.d.ts

@@ -1,6 +1,8 @@
 import type { SourceFile, VariableDeclaration } from "ts-morph";
 import { Node } from "ts-morph";
-export declare function resolveModuleFile(fromFile: SourceFile, specifier: string): SourceFile | undefined;
+export declare function resolveModuleFile(fromFile: SourceFile, specifier: string, { allowDeclarationFiles }?: {
+    readonly allowDeclarationFiles?: boolean;
+}): SourceFile | undefined;
 export declare function findImportBindingForLocalName(sourceFile: SourceFile, localName: string): {
     readonly moduleSpecifier: string;
     readonly importedName: string;

package/dist/engine/feature-ast/extractors/resolve-import.js

@@ -5,7 +5,8 @@ const MODULE_RESOLUTION_OPTIONS = {
     target: ts.ScriptTarget.ESNext,
 };
 const MAX_RESOLUTION_DEPTH = 24;
-export function resolveModuleFile(fromFile, specifier) {
+const DECLARATION_FILES_OK = { allowDeclarationFiles: true };
+export function resolveModuleFile(fromFile, specifier, { allowDeclarationFiles = false } = {}) {
     const project = fromFile.getProject();
     // The project's own host, not ts.sys: it honours an in-memory file system
     // (Designer) and exists outside Node.
@@ -13,10 +14,10 @@ export function resolveModuleFile(fromFile, specifier) {
     const resolvedFileName = resolved.resolvedModule?.resolvedFileName;
     if (!resolvedFileName)
         return undefined;
-    // A declaration file has no initializers to read. Installed packages that
-    // ship .ts sources (the @cosmicdrift/* packages in a consumer repo) stay
-    // resolvable, as they were via the type checker.
-    if (resolvedFileName.endsWith(".d.ts"))
+    // A declaration file has no initializers to read. Callers that only need
+    // `export declare const X: "literal"` types opt in (installed packages
+    // resolve to dist/*.d.ts through their publishConfig exports).
+    if (!allowDeclarationFiles && resolvedFileName.endsWith(".d.ts"))
         return undefined;
     return fromFile.getProject().addSourceFileAtPathIfExists(resolvedFileName);
 }
@@ -71,7 +72,7 @@ function resolveViaNamedExportSpecifier(file, exportedName, visited, depth) {
         const moduleSpecifierValue = exportDecl.getModuleSpecifierValue();
         if (!moduleSpecifierValue)
             continue;
-        const target = resolveModuleFile(file, moduleSpecifierValue);
+        const target = resolveModuleFile(file, moduleSpecifierValue, DECLARATION_FILES_OK);
         if (!target)
             continue;
         const resolved = resolveExportedVariable(target, originalName, visited, depth + 1);
@@ -87,7 +88,7 @@ function resolveLocalExportBinding(file, originalName, visited, depth) {
     const binding = findImportBindingForLocalName(file, originalName);
     if (!binding)
         return undefined;
-    const target = resolveModuleFile(file, binding.moduleSpecifier);
+    const target = resolveModuleFile(file, binding.moduleSpecifier, DECLARATION_FILES_OK);
     if (!target)
         return undefined;
     return resolveExportedVariable(target, binding.importedName, visited, depth + 1);
@@ -103,7 +104,7 @@ function resolveViaStarExport(file, exportedName, visited, depth) {
         const moduleSpecifierValue = exportDecl.getModuleSpecifierValue();
         if (!moduleSpecifierValue)
             continue;
-        const target = resolveModuleFile(file, moduleSpecifierValue);
+        const target = resolveModuleFile(file, moduleSpecifierValue, DECLARATION_FILES_OK);
         if (!target)
             continue;
         const resolved = resolveExportedVariable(target, exportedName, visited, depth + 1);

package/dist/engine/feature-ast/extractors/round3.js

@@ -212,6 +212,7 @@ export function extractReferenceData(call, sourceFile) {
         ...(upsertKey !== undefined && { upsertKey }),
     });
 }
+const USE_EXTENSION_READ_OPTIONS = { functionValuesAsRaw: true };
 export function extractUseExtension(call, sourceFile) {
     const args = call.getArguments();
     const first = args[0];
@@ -245,7 +246,7 @@ export function extractUseExtension(call, sourceFile) {
             ?.asKind(SyntaxKind.PropertyAssignment)
             ?.getInitializer();
         if (optionsInit) {
-            const parsed = readDataLiteralNode(optionsInit);
+            const parsed = readDataLiteralNode(optionsInit, USE_EXTENSION_READ_OPTIONS);
             if (!isPlainObject(parsed)) {
                 return fail("useExtension", sourceLocationFromNode(call, sourceFile), "options could not be read as a plain object");
             }
@@ -274,7 +275,7 @@ export function extractUseExtension(call, sourceFile) {
     const optionsArg = args[2];
     let options;
     if (optionsArg) {
-        const parsed = readDataLiteralNode(optionsArg);
+        const parsed = readDataLiteralNode(optionsArg, USE_EXTENSION_READ_OPTIONS);
         if (!isPlainObject(parsed)) {
             return fail("useExtension", sourceLocationFromNode(call, sourceFile), "options could not be read as a plain object");
         }

package/dist/engine/feature-ast/extractors/shared.d.ts

@@ -1,4 +1,5 @@
-import type { CallExpression, Node, ObjectLiteralExpression } from "ts-morph";
+import type { CallExpression, ObjectLiteralExpression } from "ts-morph";
+import { Node } from "ts-morph";
 import type { ParseError } from "../parse.js";
 export type ExtractOutput<TPattern> = {
     readonly kind: "pattern";
@@ -26,7 +27,16 @@ export type RawRefSentinel = {
 };
 export declare function isRawRefSentinel(value: unknown): value is RawRefSentinel;
 export declare function containsRawRefSentinel(value: unknown): boolean;
-export declare function readDataLiteralNode(node: Node): unknown;
+export type ReadDataLiteralOptions = {
+    /**
+     * Keep arrow/function-expression values as `__raw` sentinels instead of
+     * failing the whole read. Only for pattern options that are code by
+     * nature (useExtension); data-only definitions (entity, nav) must still
+     * reject functions.
+     */
+    readonly functionValuesAsRaw?: boolean;
+};
+export declare function readDataLiteralNode(node: Node, readOptions?: ReadDataLiteralOptions): unknown;
 /**
  * A node's literal string value, or the raw-ref sentinel when it resolves to
  * an unresolvable identifier/factory-call/member-access (see

package/dist/engine/feature-ast/extractors/shared.js

@@ -1,4 +1,4 @@
-import { SyntaxKind } from "ts-morph";
+import { Node, SyntaxKind } from "ts-morph";
 import { isPlainObject } from "../../../utils/is-plain-object.js";
 import { findImportBindingForLocalName, findScopedVariableDeclaration, resolveExportedVariable, resolveModuleFile, } from "./resolve-import.js";
 export function ok(pattern) {
@@ -55,7 +55,7 @@ export function containsRawRefSentinel(value) {
         return Object.values(value).some(containsRawRefSentinel);
     return false;
 }
-export function readDataLiteralNode(node) {
+export function readDataLiteralNode(node, readOptions = {}) {
     const kind = node.getKind();
     switch (kind) {
         case SyntaxKind.StringLiteral:
@@ -74,7 +74,7 @@ export function readDataLiteralNode(node) {
             const expr = node.asKindOrThrow(SyntaxKind.PrefixUnaryExpression);
             if (expr.getOperatorToken() !== SyntaxKind.MinusToken)
                 return undefined;
-            const inner = readDataLiteralNode(expr.getOperand());
+            const inner = readDataLiteralNode(expr.getOperand(), readOptions);
             if (typeof inner !== "number")
                 return undefined;
             return -inner;
@@ -83,7 +83,7 @@ export function readDataLiteralNode(node) {
             const arr = node.asKindOrThrow(SyntaxKind.ArrayLiteralExpression);
             const out = [];
             for (const el of arr.getElements()) {
-                const value = readDataLiteralNode(el);
+                const value = readDataLiteralNode(el, readOptions);
                 if (value === undefined)
                     return undefined;
                 out.push(value);
@@ -100,7 +100,7 @@ export function readDataLiteralNode(node) {
                 const initializer = propAssign.getInitializer();
                 if (!initializer)
                     return undefined;
-                const value = readDataLiteralNode(initializer);
+                const value = readDataLiteralNode(initializer, readOptions);
                 if (value === undefined)
                     return undefined;
                 out[readPropertyKey(propAssign)] = value;
@@ -108,11 +108,11 @@ export function readDataLiteralNode(node) {
             return out;
         }
         case SyntaxKind.AsExpression:
-            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.AsExpression).getExpression());
+            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.AsExpression).getExpression(), readOptions);
         case SyntaxKind.SatisfiesExpression:
-            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.SatisfiesExpression).getExpression());
+            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.SatisfiesExpression).getExpression(), readOptions);
         case SyntaxKind.ParenthesizedExpression:
-            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.ParenthesizedExpression).getExpression());
+            return readDataLiteralNode(node.asKindOrThrow(SyntaxKind.ParenthesizedExpression).getExpression(), readOptions);
         case SyntaxKind.Identifier:
         case SyntaxKind.CallExpression:
         case SyntaxKind.PropertyAccessExpression:
@@ -121,6 +121,11 @@ export function readDataLiteralNode(node) {
             // resolving/inlining it would silently rewrite the source on the next
             // parse->render roundtrip (see readDataLiteralNode doc above).
             return { __raw: node.getText() };
+        case SyntaxKind.ArrowFunction:
+        case SyntaxKind.FunctionExpression:
+            return readOptions.functionValuesAsRaw
+                ? { __raw: node.getText() }
+                : undefined;
         default:
             return undefined;
     }
@@ -178,6 +183,15 @@ function unwrapLiteralInitializer(node) {
         return unwrapLiteralInitializer(paren.getExpression());
     return undefined;
 }
+// `export declare const NAME: "value"` in a .d.ts has no initializer, only a
+// string-literal type.
+function readDeclaredStringLiteralType(decl) {
+    const typeNode = decl.getTypeNode();
+    if (!typeNode || !Node.isLiteralTypeNode(typeNode))
+        return undefined;
+    const literal = typeNode.getLiteral();
+    return Node.isStringLiteral(literal) ? literal.getLiteralValue() : undefined;
+}
 /**
  * Resolves a bare Identifier to the string value of its declaration's
  * initializer (`export const EXT_TENANT_DATA = "tenant-data" as const`),
@@ -200,12 +214,18 @@ function resolveIdentifierToStringLiteral(identifier) {
     const binding = findImportBindingForLocalName(id.getSourceFile(), name);
     if (!binding)
         return undefined;
-    const targetFile = resolveModuleFile(id.getSourceFile(), binding.moduleSpecifier);
+    const targetFile = resolveModuleFile(id.getSourceFile(), binding.moduleSpecifier, {
+        allowDeclarationFiles: true,
+    });
     if (!targetFile)
         return undefined;
     const decl = resolveExportedVariable(targetFile, binding.importedName);
-    const init = decl?.getInitializer();
-    return init ? unwrapLiteralInitializer(init) : undefined;
+    if (!decl)
+        return undefined;
+    const init = decl.getInitializer();
+    if (init)
+        return unwrapLiteralInitializer(init);
+    return readDeclaredStringLiteralType(decl);
 }
 /**
  * Like `readNameLiteral`, but for callers that must preserve an

package/dist/jobs/job-runner.d.ts

@@ -9,6 +9,7 @@ import { type AppContext, type DispatchWriteRef, type JobRunIn, type JobTriggerE
  */
 export declare function schedulerIdForJobName(jobName: string): string;
 export declare function bootJobIdForJobName(jobName: string): string;
+export declare const ORPHAN_SCHEDULER_GRACE_MS: number;
 export type JobLogEntry = {
     level: "info" | "warn" | "error";
     message: string;

package/dist/jobs/job-runner.js

@@ -73,9 +73,48 @@ export function schedulerIdForJobName(jobName) {
 export function bootJobIdForJobName(jobName) {
     return `boot-${jobName.replace(/[.:]/g, "-")}`;
 }
-// ponytail: migration shim, remove after fw#1603 deploy is everywhere.
-function legacySchedulerIdForJobName(jobName) {
-    return `scheduler-${jobName.replace(/\./g, "-")}`;
+const SCHEDULER_PAGE_SIZE = 100;
+// Rolling deploys run old and new pods against the same Redis for a while; an
+// old runner restarting in that window must not delete the scheduler of a
+// cron job the new version just added.
+export const ORPHAN_SCHEDULER_GRACE_MS = 60 * 60 * 1000;
+function schedulerSeenKey(queue) {
+    return queue.toKey("kumiko-scheduler-seen");
+}
+// A cron job dropped from the app (or an older scheduler-id format) leaves its
+// scheduler in Redis, where it keeps firing jobs the worker no longer knows
+// ("Unknown job"). Best-effort: a Redis hiccup here must not stop the start.
+async function removeOrphanJobSchedulers(queue, expectedSchedulerIds, lane, log) {
+    try {
+        // Collect first: removing while paging would shift the indices.
+        const existingKeys = [];
+        for (let start = 0;; start += SCHEDULER_PAGE_SIZE) {
+            const page = await queue.getJobSchedulers(start, start + SCHEDULER_PAGE_SIZE - 1);
+            for (const scheduler of page)
+                existingKeys.push(scheduler.key);
+            if (page.length < SCHEDULER_PAGE_SIZE)
+                break;
+        }
+        const client = await queue.client;
+        const seenAt = await client.hgetall(schedulerSeenKey(queue));
+        const now = Date.now();
+        for (const key of existingKeys) {
+            if (expectedSchedulerIds.has(key))
+                continue;
+            const lastSeen = Number(seenAt[key]);
+            if (key in seenAt && now - lastSeen < ORPHAN_SCHEDULER_GRACE_MS)
+                continue;
+            await queue.removeJobScheduler(key);
+            await client.hdel(schedulerSeenKey(queue), key);
+            log.info("removed orphan job scheduler", { schedulerId: key, lane });
+        }
+    }
+    catch (err) {
+        log.warn("orphan job scheduler cleanup failed", {
+            lane,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
 }
 // Deterministic per-tenant child job id, derived from the perTenant
 // wrapper's own BullMQ job id. A cron tick's wrapper id is
@@ -1108,21 +1147,13 @@ export function createJobRunner(options) {
             // Only schedule cron + boot for jobs that belong to this lane. Jobs
             // assigned to the other lane get their cron/boot wiring from the
             // runner running on that lane. Running both here would double-fire.
+            const expectedSchedulerIds = new Set();
             for (const [name, jobDef] of allJobs) {
                 if (laneForJob(jobDef) !== consumerLane)
                     continue;
                 if ("cron" in jobDef.trigger) {
                     const schedulerId = schedulerIdForJobName(name);
-                    const legacyId = legacySchedulerIdForJobName(name);
-                    // Drop pre-sanitize scheduler ids so colon-form ghosts stop firing.
-                    if (legacyId !== schedulerId) {
-                        try {
-                            await consumerQueue.removeJobScheduler(legacyId);
-                        }
-                        catch {
-                            // skip: legacy scheduler absent (fresh install / already purged)
-                        }
-                    }
+                    expectedSchedulerIds.add(schedulerId);
                     await consumerQueue.upsertJobScheduler(schedulerId, { pattern: jobDef.trigger.cron }, {
                         name: jobDef.perTenant ? `_perTenant:${name}` : name,
                         data: {},
@@ -1133,8 +1164,15 @@ export function createJobRunner(options) {
                             ...buildRetryBullOpts(jobDef),
                         },
                     });
+                    await (await consumerQueue.client).hset(schedulerSeenKey(consumerQueue), {
+                        [schedulerId]: String(Date.now()),
+                    });
                 }
             }
+            await removeOrphanJobSchedulers(consumerQueue, expectedSchedulerIds, consumerLane, {
+                info: (msg, data) => context.log ? context.log.info(msg, data) : errorLogger.debug(msg, data),
+                warn: errorLogger.warn,
+            });
             // Persistent marker outside the swept completed/failed sets: a plain
             // Redis hash at one key per consumer queue, fields = boot job ids
             // already enqueued (BullMQ's IRedisClient has no set commands, only

package/dist/pipeline/dispatch-shared.d.ts

@@ -47,6 +47,7 @@ export type DispatchContext = {
     meter: ReturnType<typeof getFallbackMeter>;
     membershipQuery: string;
     memberReadTimeoutMs: number;
+    outsideTransactionDb: DbConnection | undefined;
 };
 export declare const DEFAULT_MEMBER_READ_TIMEOUT_MS = 10000;
 export declare function resolveDbSource(ctx: DispatchContext, tx: DbTx | undefined): DbConnection | DbTx | undefined;

package/dist/pipeline/dispatch-shared.js

@@ -248,7 +248,7 @@ export async function buildHandlerContext(ctx, type, user, origin, tx, afterComm
     // that is meant to outlive the request. Computed before `systemDb` below
     // so its guarded escape hatch (ctx.systemDb.outsideTransaction) can wrap
     // this same TenantDb instead of a second, independently-built one.
-    const outsideTxSource = resolveDbSource(ctx, undefined);
+    const outsideTxSource = ctx.outsideTransactionDb ?? resolveDbSource(ctx, undefined);
     const rawDbOutsideTransaction = outsideTxSource
         ? buildTenantScopedDb(outsideTxSource, undefined)
         : undefined;

package/dist/pipeline/dispatcher.d.ts

@@ -1,5 +1,6 @@
 import type { CacheSyncBus } from "@cosmicdrift/kumiko-types/cache-sync-types";
 import type { SseBroker } from "../api/sse-broker.js";
+import type { DbConnection } from "../db/connection.js";
 import type { EffectiveFeaturesResolver } from "../engine/tier-resolver-extension.js";
 import type { TenantId } from "../engine/types/identifiers.js";
 import type { ActiveMembershipResult, AppContext, DispatchWriteRef, JobRunnerRef, MemberReader, Registry, SessionUser, WriteResult } from "../engine/types/index.js";
@@ -16,6 +17,7 @@ export type DispatcherOptions = {
     jobRunner?: JobRunnerRef;
     membershipQuery?: string;
     memberReadTimeoutMs?: number;
+    outsideTransactionDb?: DbConnection;
     effectiveFeatures?: EffectiveFeaturesResolver;
     sseBroker?: SseBroker;
     cacheSync?: CacheSyncBus | null;

package/dist/pipeline/dispatcher.js

@@ -97,6 +97,7 @@ export function createDispatcher(registry, context, options = {}) {
         meter: dispatcherMeter,
         membershipQuery,
         memberReadTimeoutMs,
+        outsideTransactionDb: options.outsideTransactionDb,
     };
     const dispatcher = {
         async write(typeOrRef, payload, user, requestId) {

package/dist/stack/db.d.ts

@@ -2,6 +2,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-types/db-connection";
 declare function requireEnv(name: string): string;
 export type TestDb = {
     db: DbConnection;
+    outsideTransactionDb: DbConnection;
     client: unknown;
     dbName: string;
     cleanup: () => Promise<void>;
@@ -10,6 +11,8 @@ export type CreateTestDbOptions = {
     readonly baseUrl?: string;
     readonly dbName?: string;
     readonly persistent?: boolean;
+    readonly poolMax?: number;
+    readonly outsideTransactionPoolMax?: number;
 };
 /**
  * Provider-agnostische Test-DB. createConnection liest DB_PROVIDER.

package/dist/stack/db.js

@@ -2,6 +2,7 @@
 // Provider-agnostic via createConnection (DB_PROVIDER env).
 // postgres-js = default. DB_PROVIDER=bun = Bun.SQL (experimentell).
 import { createConnection } from "../db/api.js";
+import { DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX } from "../db/connection.js";
 import { createDatabase, databaseExists, dropDatabaseIfExists } from "../db/queries/test-stack.js";
 import { ensureTemporalPolyfill } from "../time/polyfill.js";
 import { generateId } from "../utils/index.js";
@@ -37,15 +38,20 @@ export async function createTestDb(arg) {
         await admin.close();
     }
     const testUrl = url.replace(/\/[^/]+$/, `/${dbName}`);
-    const conn = await createConnection(testUrl);
+    const conn = await createConnection(testUrl, opts.poolMax !== undefined ? { maxConnections: opts.poolMax } : {});
+    const outsideConn = await createConnection(testUrl, {
+        maxConnections: opts.outsideTransactionPoolMax ?? DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX,
+    });
     const { createEventsTable } = await import("../event-store/index.js");
     await createEventsTable(conn.db);
     return {
         db: conn.db,
+        outsideTransactionDb: outsideConn.db,
         client: conn.client,
         dbName,
         cleanup: async () => {
             await conn.close();
+            await outsideConn.close();
             if (!opts.persistent) {
                 const admin2 = await createConnection(adminUrl, { maxConnections: 1 });
                 try {

package/dist/stack/test-stack.d.ts

@@ -101,6 +101,10 @@ export type TestStackOptions = {
      *  owns its lifecycle. Default false (test contract). Used by
      *  dev-server wiring to survive hot-reloads. */
     persistentDb?: boolean;
+    /** Cap on the main app pool (default: driver default). Lets tests saturate it deliberately. */
+    dbPoolMax?: number;
+    /** Size of the dedicated pool behind ctx.dbOutsideTransaction / ctx.outsideTransaction. */
+    outsideTransactionPoolMax?: number;
     /** Forwarded to buildServer — when set, requests without a JWT pass
      *  through as anonymous instead of 401. See AnonymousAccessConfig.
      *  Akzeptiert entweder einen statischen Config-Object ODER eine Factory

package/dist/stack/test-stack.js

@@ -44,6 +44,10 @@ export async function setupTestStack(options) {
         createTestDb({
             ...(options.dbName !== undefined && { dbName: options.dbName }),
             ...(options.persistentDb !== undefined && { persistent: options.persistentDb }),
+            ...(options.dbPoolMax !== undefined && { poolMax: options.dbPoolMax }),
+            ...(options.outsideTransactionPoolMax !== undefined && {
+                outsideTransactionPoolMax: options.outsideTransactionPoolMax,
+            }),
         }),
         createTestRedis(options.sharedRedisWith && { borrowKeyPrefix: options.sharedRedisWith.redis.keyPrefix }),
     ]);
@@ -286,6 +290,7 @@ export async function setupTestStack(options) {
             dispatcherOptions: {
                 idempotency,
                 cacheSync,
+                outsideTransactionDb: testDb.outsideTransactionDb,
                 ...(options.effectiveFeatures && { effectiveFeatures: options.effectiveFeatures }),
                 ...(jobRunner && { jobRunner }),
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.357.0",
+  "version": "0.359.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -210,8 +210,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.357.0",
-    "@cosmicdrift/kumiko-types": "0.357.0",
+    "@cosmicdrift/kumiko-http": "0.359.0",
+    "@cosmicdrift/kumiko-types": "0.359.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -227,7 +227,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.357.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.359.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,38 @@
 [
+  {
+    "version": "0.359.0",
+    "type": "improvement",
+    "title": "actionForm screens honour the called handler's excludedFields",
+    "detail": "buildAppSchema projects the handler's excludedFields onto actionForm screens as writeExcludedFields (a flat list, unlike entityEdit's per-verb object). The form shows these fields read-only, not required and never in the payload.",
+    "migration": "Drop a hand-written readOnly lock on an actionForm field once the handler it calls declares excludedFields for it."
+  },
+  {
+    "version": "0.358.0",
+    "type": "fix",
+    "title": "useExtension options with function values and package-imported extension names no longer fail to parse",
+    "detail": "r.useExtension(...) options that contain arrow or function expressions (for example isPublic: ({ entityId }) => ...) were reported as \"options could not be read as a plain object\", which turned the whole feature into a legacy corpus entry. The functions are now kept verbatim as raw references, option keys stay visible and parse to render round-trips unchanged. An extension name imported from a package whose types resolve to dist/*.d.ts (an installed @cosmicdrift/* package in a consumer repo) is now read from its `export declare const NAME: \"value\"` type instead of failing. Function values elsewhere (entity, nav, metric, job) are still rejected on purpose.",
+    "migration": "Consumers that ship a checked-in few-shot corpus (Enterprise) should regenerate it on the next framework bump; its drift test enforces that. The new ratchet test in dev-server pins the framework's own canonical count and parse-error ceiling."
+  },
+  {
+    "version": "0.358.0",
+    "type": "fix",
+    "title": "Job runner removes job schedulers of cron jobs that no longer exist",
+    "detail": "When an app drops a cron job, its BullMQ job scheduler stayed in Redis and kept firing, so the worker logged `Unknown job` on every tick. On start, each lane now removes every scheduler in its own queue that does not belong to a registered cron job of that lane (logged per removal). Each runner records when it last upserted a scheduler; a scheduler outside the runner's own set is only removed if it was not upserted within the last hour, so an old pod restarting during a rolling deploy does not delete the scheduler of a cron job the new version just added. Schedulers with no record, such as the old colon-form ids, are removed right away. A failing cleanup is logged as a warning and does not stop the start. This replaces the dedicated removal of the old colon-form scheduler ids."
+  },
+  {
+    "version": "0.358.0",
+    "type": "fix",
+    "title": "Outside-transaction access no longer deadlocks against the write pool",
+    "detail": "ctx.dbOutsideTransaction, ctx.systemDb.outsideTransaction and ctx.outsideTransaction used the same pool as the handler's own transaction. With as many concurrent writes as pool slots, each write held a connection and waited for a second one, so every request hung forever. They now use a dedicated pool (DispatcherOptions.outsideTransactionDb) sized by the new DATABASE_OUTSIDE_TX_POOL_MAX (default 3). runProdApp and the worker boot also read DATABASE_POOL_MAX, DATABASE_POOL_IDLE_TIMEOUT and DATABASE_POOL_CONNECT_TIMEOUT now; before, production ignored them and used the postgres.js default of 10.",
+    "migration": "Each pod now opens up to DATABASE_POOL_MAX + DATABASE_OUTSIDE_TX_POOL_MAX connections (defaults 10 + 3) plus the LISTEN connection; check the total against Postgres max_connections, including rolling-update surge. A set but invalid DATABASE_POOL_MAX, DATABASE_POOL_IDLE_TIMEOUT, DATABASE_POOL_CONNECT_TIMEOUT or DATABASE_OUTSIDE_TX_POOL_MAX now aborts the boot. Hand-built dispatchers can pass outsideTransactionDb in DispatcherOptions; without it the app pool is shared as before."
+  },
+  {
+    "version": "0.358.0",
+    "type": "breaking",
+    "title": "Entity PII fields need whenAbsent: \"tenant\" when the owner field is nullable",
+    "detail": "personal: { of: \"<owner>\", whenAbsent: \"tenant\" } makes rows without an owner editable, deletable and forgettable with an active KMS, without plaintext PII. The subject is resolved in this order: the owner on the previous row, the owner the same event sets, then the tenant key (tenant:<tenantId>). Before, an update, delete or forget of an ownerless row failed with SubjectResolutionError (HTTP 500) once a KMS was configured. backfill-pii follows the same chain and checks the projection row for the owner before it falls back to the tenant key; an updated event whose previous.owner is null but whose changes.owner is set no longer loses the owner. Entity fields have no plaintext fallback, so \"tenant\" is the only value. bundled jobs: cron and system runs (triggeredById null) now store payload, error and log messages as ciphertext under the system tenant key instead of plaintext.",
+    "migration": "Boot now aborts for a personal: { of: \"<owner>\" } field whose owner field is not required and that declares no whenAbsent: [Feature X] Field \"f\" on entity \"e\" is personal: { of: \"ownerId\" }, but \"ownerId\" is not required — rows without an owner would fail to encrypt (SubjectResolutionError, HTTP 500) on update, delete and forget. Declare { personal: { of: \"ownerId\", whenAbsent: \"tenant\" } } to encrypt those rows under the tenant key, or make \"ownerId\" required: true. Entity fields have no plaintext fallback (fw#3654). Fix: add whenAbsent: \"tenant\", or make the owner field required: true if every row has one. whenAbsent on personal: { of: \"id\" } throws at declaration. Known consumer sites: kumiko-enterprise kumiko-credit entity.ts and bauspar-entity.ts (ownerUserId), ai-agent entity.ts (authorId, ownerId) and attachment-store.ts (authorId), ai-conversation entity.ts (authorId), pattern-storage entity.ts (authorId), offlot-app src/features/lead/schema/entity.ts (enquiryId). Existing plaintext job-run rows of cron runs stay readable; new ones are ciphertext."
+  },
   {
     "version": "0.357.0",
     "type": "improvement",