@cosmicdrift/kumiko-framework 0.364.0 → 0.365.0

package/dist/api/server.d.ts

@@ -1,6 +1,6 @@
 import type { CacheSyncBus } from "@cosmicdrift/kumiko-types/cache-sync-types";
 import { Hono } from "hono";
-import type { PgClient } from "../db/connection.js";
+import type { PgListenClient } from "../db/connection.js";
 import { type AppContext, type Registry, type RunIn, type WriteResult } from "../engine/types/index.js";
 import type { ErrorDocsConfig } from "../errors/docs-url.js";
 import type { Lifecycle } from "../lifecycle/index.js";
@@ -43,7 +43,7 @@ export type ServerOptions = {
             jobTrigger?: boolean;
             accessInvalidation?: boolean;
         };
-        pgClient?: PgClient;
+        pgClient?: PgListenClient;
     };
     observability?: ObservabilityProvider;
     observabilityOptions?: ObservabilityOptions;

package/dist/api/server.js

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
 import { ROLES } from "../auth/roles.js";
-import { createTenantDb } from "../db/tenant-db.js";
+import { createProjectingTenantDb } from "../db/tenant-db.js";
 import { createDerivativesContext } from "../derivatives/derivatives-context.js";
 import { buildAppSchema } from "../engine/build-app-schema.js";
 import { EXT_FILE_PROVIDER, EXT_PRINCIPAL_STATUS } from "../engine/extension-names.js";
@@ -69,6 +69,24 @@ export function withFileProviderResolver(registry, context, cacheSync) {
         }),
     };
 }
+// A payload-bucket handler without a resolver would answer every call with a
+// 500 at request time; fail at boot instead.
+function assertNoPayloadRateLimitsWithoutResolver(registry) {
+    const offenders = [];
+    for (const feature of registry.features.values()) {
+        for (const [name, handler] of Object.entries(feature.writeHandlers)) {
+            if (handler.additionalRateLimits !== undefined) {
+                offenders.push(`${feature.name}:write:${name}`);
+            }
+        }
+    }
+    // skip: every handler's payload buckets are covered by the resolver
+    if (offenders.length === 0)
+        return;
+    throw new Error(`Handlers declare additionalRateLimits but no RateLimitResolver is configured: ${offenders.join(", ")}. ` +
+        "Wire a Redis client on context.redis (or pass context.rateLimit), or drop the payload buckets " +
+        "(for the waitlist: emailRateLimits: []).");
+}
 export function buildServer(options) {
     assertSeedModeNotInProduction();
     // Single effective hop-count for every IP-derived rate-limit + requestMeta
@@ -221,6 +239,7 @@ export function buildServer(options) {
     const rateLimitResolver = options.context.rateLimit ??
         (wrappedRedis && wantsResolver ? createRateLimitResolver({ redis: wrappedRedis }) : undefined);
     if (!rateLimitResolver) {
+        assertNoPayloadRateLimitsWithoutResolver(options.registry);
         // The systemScope default limit only exists once a resolver does, and an app that
         // declared no explicit rateLimit anywhere never gets one auto-wired (wantsL3 stays
         // false) — so its cross-tenant handlers are silently unlimited.
@@ -696,9 +715,7 @@ export function buildServer(options) {
             canWriteRecord: createRecordWriteCheck({
                 registry: options.registry,
                 canReadRecord,
-                tenantDbFor: (tenantId) => createTenantDb(fileDb, tenantId, "tenant", undefined, undefined, undefined, {
-                    projectionRegistry: options.registry,
-                }),
+                tenantDbFor: (tenantId) => createProjectingTenantDb(fileDb, tenantId, options.registry),
             }),
             ...(routeOptions.accessGuard ? { accessGuard: routeOptions.accessGuard } : {}),
             ...(routeOptions.privilegedRoles ? { privilegedRoles: routeOptions.privilegedRoles } : {}),

package/dist/bun-db/connection.js

@@ -3,10 +3,8 @@
 // nach drizzle-removal. Erstellt parallel zum legacy `db/connection.ts`
 // — apps migrieren schritt-für-schritt, alte Datei weg sobald 0 Konsumenten.
 //
-// **postgres-js** bleibt als kleiner Peer NUR für LISTEN/NOTIFY in
-// event-dispatcher.ts. Bun.sql 1.2.20 hat kein listen() (PR oven-sh/bun#25511
-// pending). Nach Landung des Bun-LISTEN-Supports: peer raus.
-import postgres from "postgres";
+// LISTEN for the event dispatcher uses Bun.SQL's listen() on its own
+// dedicated connection, outside the pool's idleTimeout.
 import { readPositiveIntEnv } from "../utils/env-parse.js";
 export function createBunDbConnection(url, options = {}) {
     const bunOpts = {};
@@ -18,22 +16,11 @@ export function createBunDbConnection(url, options = {}) {
         bunOpts.connectionTimeout = options.connectTimeoutSeconds;
     }
     const db = new Bun.SQL(url, bunOpts);
-    // LISTEN-only peer — minimal pool (1 connection reicht), eigener idle/
-    // connect-timeout falls gesetzt. Wenn das wegfällt, läuft event-dispatcher
-    // auf polling-only ohne LISTEN-Wakeup.
-    const pgOpts = { max: 1 };
-    if (options.idleTimeoutSeconds !== undefined)
-        pgOpts.idle_timeout = options.idleTimeoutSeconds;
-    if (options.connectTimeoutSeconds !== undefined) {
-        pgOpts.connect_timeout = options.connectTimeoutSeconds;
-    }
-    const listenClient = postgres(url, pgOpts);
     return {
         db,
-        listenClient,
+        listenClient: db,
         close: async () => {
             await db.end();
-            await listenClient.end();
         },
     };
 }

package/dist/bun-db/index.d.ts

@@ -1,4 +1,4 @@
 export type { BunDbConnection, BunDbConnectionOptions, BunDbRunner, BunDbTx, PgListenClient, } from "./connection.js";
 export { bunDbConnectionOptionsFromEnv, createBunDbConnection } from "./connection.js";
 export type { InnerJoinRow, InnerJoinSpec, InsertOnConflictDoNothingOptions, JoinColumnPair, JsonTextMatch, SelectOptions, TableInfo, WhereObject, WhereOperator, WhereValue, } from "./query.js";
-export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, type DeleteManyBatchedOptions, type DeleteManyBatchedResult, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, type IncrementCounterOptions, incrementCounter, insertMany, insertOnConflictDoNothing, insertOne, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, runnerCanBeginTransaction, selectInnerJoin, selectMany, transaction, type UpsertOnConflictOptions, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";
+export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, type DeleteManyBatchedOptions, type DeleteManyBatchedResult, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, type IncrementCounterOptions, incrementCounter, insertMany, insertOnConflictDoNothing, insertOne, instantToTimestamptzParam, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, runnerCanBeginTransaction, selectInnerJoin, selectMany, transaction, type UpsertOnConflictOptions, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";

package/dist/bun-db/index.js

@@ -1,4 +1,4 @@
 // bun-db: Bun.sql-basierte DB-API ohne drizzle.
 // Production-Pfad nach drizzle-removal.
 export { bunDbConnectionOptionsFromEnv, createBunDbConnection } from "./connection.js";
-export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, incrementCounter, insertMany, insertOnConflictDoNothing, insertOne, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, runnerCanBeginTransaction, selectInnerJoin, selectMany, transaction, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";
+export { aggregateWhere, asEntityTableMeta, asRawClient, countWhere, deleteMany, deleteManyBatched, extractTableInfo, fetchOne, incrementCounter, insertMany, insertOnConflictDoNothing, insertOne, instantToTimestamptzParam, isTimestamptzType, requireEntityTableMeta, runInSavepoint, runInSavepointIfSupported, runnerCanBeginTransaction, selectInnerJoin, selectMany, transaction, unsafeReadRetrying, updateMany, upsertByPk, upsertOnConflict, } from "./query.js";

package/dist/bun-db/query.d.ts

@@ -1,4 +1,5 @@
 import type { AggregateRow, AggregateSpec } from "@cosmicdrift/kumiko-types/aggregate-types";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { SelectOptions, WhereObject } from "@cosmicdrift/kumiko-types/where-clause-types";
 import type { EntityTableMeta } from "../db/entity-table-meta.js";
 import { type NotExecutorOnly } from "../db/table-builder.js";
@@ -6,11 +7,16 @@ import { asEntityTableMeta, requireEntityTableMeta } from "../db/table-introspec
 import type { DbRunner } from "@cosmicdrift/kumiko-types/db-connection";
 import type { BunDbRunner } from "./connection.js";
 export { asEntityTableMeta, requireEntityTableMeta };
+export type ReservedClient = {
+    unsafe: RawClient["unsafe"];
+    release: () => unknown;
+};
 export type RawClient = {
     unsafe: <TRow = unknown>(sql: string, params?: readonly unknown[]) => Promise<readonly TRow[]>;
     begin?: <T>(fn: (tx: BunDbRunner) => Promise<T>) => Promise<T>;
     savepoint?: <T>(fn: (sp: unknown) => Promise<T>) => Promise<T>;
     release?: unknown;
+    reserve?: () => Promise<ReservedClient>;
 };
 export type RawClientWithBegin = RawClient & {
     begin: NonNullable<RawClient["begin"]>;
@@ -34,6 +40,7 @@ export type TableInfo = {
 };
 export declare function extractTableInfo(table: TableLike): TableInfo;
 export declare function coerceRow<TOut = Record<string, unknown>>(row: Record<string, unknown>, info: TableInfo): TOut;
+export declare function instantToTimestamptzParam(instant: Temporal.Instant): string;
 export declare function isClosedConnectionError(err: unknown): boolean;
 export declare function describeClosedConnectionFailure(raw: unknown, err: unknown, attempts: number): Record<string, unknown> | undefined;
 export declare function unsafeReadRetrying<TRow>(db: AnyDb, sqlText: string, params: readonly unknown[]): Promise<readonly TRow[]>;

package/dist/bun-db/query.js

@@ -51,7 +51,8 @@ function snakeToCamel(key) {
 // the only collision-safe path.
 export { asEntityTableMeta, requireEntityTableMeta };
 export function hasBegin(client) {
-    return typeof client.begin === "function";
+    // Bun.SQL tx/savepoint handles keep a begin() that throws; only savepoint() tells them apart from a pool.
+    return typeof client.begin === "function" && typeof client.savepoint !== "function";
 }
 function isRawClient(value) {
     return typeof propertyOf(value, "unsafe") === "function";
@@ -113,16 +114,27 @@ export async function runInSavepointIfSupported(db, fn) {
     const asRunner = (sp) => sp;
     if (typeof raw.savepoint !== "function")
         return fn(asRunner(db));
+    // An error from inside fn must never be remapped, even if it carries a closed-connection code.
+    let fnStarted = false;
     try {
-        return await raw.savepoint((sp) => fn(asRunner(sp)));
+        return await raw.savepoint((sp) => {
+            fnStarted = true;
+            return fn(asRunner(sp));
+        });
     }
     catch (e) {
-        if (extractPgError(e)?.code === "25P01") {
+        const code = extractPgError(e)?.code;
+        if (!fnStarted && (code === "25P01" || code === "ERR_POSTGRES_CONNECTION_CLOSED")) {
             throw new InternalError({
-                message: "runInSavepointIfSupported: savepoint on a transaction that has already committed — " +
-                    "this is almost always database work in an afterCommit hook. afterCommit is the default " +
-                    "phase of r.hook/postSave/postDelete. Use HookPhases.inTransaction for writes that must " +
-                    "roll back with the trigger, or ctx.dbOutsideTransaction for work that must survive a rollback.",
+                message: code === "25P01"
+                    ? "runInSavepointIfSupported: savepoint on a transaction that has already committed — " +
+                        "this is almost always database work in an afterCommit hook. afterCommit is the default " +
+                        "phase of r.hook/postSave/postDelete. Use HookPhases.inTransaction for writes that must " +
+                        "roll back with the trigger, or ctx.dbOutsideTransaction for work that must survive a rollback."
+                    : "runInSavepointIfSupported: the transaction handle's connection is gone — the transaction " +
+                        "already committed (almost always database work in an afterCommit hook) or the connection dropped. " +
+                        "afterCommit is the default phase of r.hook/postSave/postDelete. Use HookPhases.inTransaction " +
+                        "for writes that must roll back with the trigger, or ctx.dbOutsideTransaction for work that must survive a rollback.",
                 cause: e instanceof Error ? e : undefined,
             });
         }
@@ -216,13 +228,8 @@ function quoteIdent(name) {
 //
 // Symmetric on write: Temporal.Instant doesn't bind directly into postgres-js
 // params — convert to ISO string when the column pgType is timestamptz.
-function toStringTagOf(v) {
-    return typeof v === "object" && v !== null && Symbol.toStringTag in v
-        ? v[Symbol.toStringTag]
-        : undefined;
-}
 function isTemporalInstant(v) {
-    return toStringTagOf(v) === "Temporal.Instant";
+    return propertyOf(v, Symbol.toStringTag) === "Temporal.Instant";
 }
 // Postgres bigint → JS: safe integers become `number` (matches createBigIntField /
 // drizzle mode:"number"); values outside ±2^53 stay `bigint` (money cents, raw
@@ -272,10 +279,10 @@ function instantFromDriver(value) {
     return null;
 }
 function isTemporalPlainDate(v) {
-    return toStringTagOf(v) === "Temporal.PlainDate";
+    return propertyOf(v, Symbol.toStringTag) === "Temporal.PlainDate";
 }
 function isTemporalPlainDateTimeLike(v) {
-    const tag = toStringTagOf(v);
+    const tag = propertyOf(v, Symbol.toStringTag);
     return ((tag === "Temporal.PlainDateTime" || tag === "Temporal.ZonedDateTime") &&
         typeof v === "object" &&
         v !== null &&
@@ -459,6 +466,31 @@ function prepareJsonbValue(value) {
     }
     return { kind: "param", sql: "::jsonb", bound: value };
 }
+const INTEGER_PG_TYPES = new Set([
+    "integer",
+    "int4",
+    "smallint",
+    "int2",
+    "bigint",
+    "int8",
+    "serial",
+    "bigserial",
+]);
+// postgres.js truncates timestamptz params to ms via Date; Bun.SQL sends µs and Postgres
+// rounds into timestamptz(3). Truncating here keeps both drivers storing the same instant.
+export function instantToTimestamptzParam(instant) {
+    return Temporal.Instant.fromEpochMilliseconds(instant.epochMilliseconds).toString();
+}
+function prepareDriverNeutralScalar(value, pgType) {
+    if ((pgType === "timestamptz" || pgType === "timestamptz(3)") && isTemporalInstant(value)) {
+        return { kind: "param", sql: "", bound: instantToTimestamptzParam(value) };
+    }
+    // Bun.SQL binds JS numbers typed, so Postgres would round 3.5 into an integer column; postgres.js sends text and rejects it.
+    if (typeof value === "number" && pgType !== undefined && INTEGER_PG_TYPES.has(pgType)) {
+        return { kind: "param", sql: "", bound: String(value) };
+    }
+    return undefined;
+}
 function prepareValue(value, pgType) {
     if (isSqlExpression(value)) {
         return { kind: "literal", literal: value.text };
@@ -473,9 +505,9 @@ function prepareValue(value, pgType) {
         if (prepared)
             return prepared;
     }
-    if ((pgType === "timestamptz" || pgType === "timestamptz(3)") && isTemporalInstant(value)) {
-        return { kind: "param", sql: "", bound: value.toString() };
-    }
+    const scalar = prepareDriverNeutralScalar(value, pgType);
+    if (scalar)
+        return scalar;
     if (pgType === "date") {
         const prepared = prepareDateValue(value);
         if (prepared)

package/dist/crypto/owner-transition-rekey.d.ts

@@ -1,2 +1,3 @@
 import type { EntityDefinition } from "../engine/types/fields.js";
+export declare function isPlainUserOwnedField(field: EntityDefinition["fields"][string]): boolean;
 export declare function personalFieldsRekeyedOnOwnerTransition(entity: EntityDefinition, previous: Record<string, unknown>, mergedNew: Record<string, unknown>, submittedChanges: Record<string, unknown>): Record<string, unknown>;

package/dist/crypto/owner-transition-rekey.js

@@ -1,6 +1,12 @@
 import { PII_ERASED_SENTINEL } from "./kms-adapter.js";
 import { isPiiCiphertext } from "./pii-ciphertext-format.js";
 import { nonEmptyString } from "./subject-resolver.js";
+// userOwned and not recordOwned: the value follows the row's current owner.
+export function isPlainUserOwnedField(field) {
+    if (!("userOwned" in field) || field.userOwned === undefined)
+        return false;
+    return !("recordOwned" in field && field.recordOwned === true);
+}
 // Personal fields keep their stored value when an update moves the row to a
 // new owner, so without re-keying they would stay shreddable only by the old
 // owner. Returns the unchanged-by-the-caller values that must be written again
@@ -9,9 +15,7 @@ import { nonEmptyString } from "./subject-resolver.js";
 export function personalFieldsRekeyedOnOwnerTransition(entity, previous, mergedNew, submittedChanges) {
     const rekeyed = {};
     for (const [name, field] of Object.entries(entity.fields)) {
-        if (!("userOwned" in field) || field.userOwned === undefined)
-            continue;
-        if ("recordOwned" in field && field.recordOwned === true)
+        if (!isPlainUserOwnedField(field) || !("userOwned" in field) || !field.userOwned)
             continue;
         if (name in submittedChanges)
             continue;

package/dist/crypto/pii-field-encryption.d.ts

@@ -13,6 +13,7 @@ export interface EncryptPiiOptions {
     readonly subjectSource?: Record<string, unknown>;
     readonly entityName: string;
     readonly ownerFallback?: Record<string, unknown>;
+    readonly onErasedSubject?: "sentinel";
 }
 export type PiiEncryptedRow<TRow extends Record<string, unknown>> = {
     [K in keyof TRow]: TRow[K] extends string ? string : TRow[K] | string;

package/dist/crypto/pii-field-encryption.js

@@ -161,8 +161,15 @@ export async function encryptPiiFieldValues(row, entity, piiFields, kms, kmsCtx,
         // skip: collectPiiSubjectFields only yields annotated fields — null is unreachable, kept as a type guard
         if (subject === null)
             continue;
-        const dek = await getOrCreateDek(kms, subject, kmsCtx);
-        out[name] = encryptValue(subject, dek, plaintext, name, isJsonbField);
+        try {
+            const dek = await getOrCreateDek(kms, subject, kmsCtx);
+            out[name] = encryptValue(subject, dek, plaintext, name, isJsonbField);
+        }
+        catch (e) {
+            if (!(e instanceof KeyErasedError) || opts.onErasedSubject !== "sentinel")
+                throw e;
+            out[name] = PII_ERASED_SENTINEL;
+        }
     }
     return out;
 }

package/dist/crypto/subject-resolver.d.ts

@@ -30,5 +30,6 @@ export interface EventSubjectEnvelope {
 export declare function resolveEventSubject(fieldName: string, spec: EventPiiSubject, payload: Record<string, unknown>, envelope: EventSubjectEnvelope): SubjectId | null;
 export declare function collectPiiSubjectFields(entity: EntityDefinition): readonly string[];
 export declare function collectPiiEncryptedFields(entity: EntityDefinition): readonly string[];
+export declare function collectPiiFileReferenceFields(entity: EntityDefinition): readonly string[];
 /** Subject-annotated fields that may be plaintext in the derived search index (#1610). */
 export declare function collectSearchableSubjectFields(entity: EntityDefinition): readonly string[];

package/dist/crypto/subject-resolver.js

@@ -155,6 +155,13 @@ export function collectPiiEncryptedFields(entity) {
         .filter(([, field]) => hasSubjectAnnotation(field) && !isFileReferenceField(field))
         .map(([name]) => name);
 }
+// The annotated file-reference fields: never ciphertext today, but events from the
+// old backfill (which encrypted them) still carry it and must replay.
+export function collectPiiFileReferenceFields(entity) {
+    return Object.entries(entity.fields)
+        .filter(([, field]) => hasSubjectAnnotation(field) && isFileReferenceField(field))
+        .map(([name]) => name);
+}
 /** Subject-annotated fields that may be plaintext in the derived search index (#1610). */
 export function collectSearchableSubjectFields(entity) {
     return Object.entries(entity.fields)

package/dist/db/api.d.ts

@@ -1,3 +1,4 @@
+import type { PgListenClient } from "@cosmicdrift/kumiko-types/db-connection";
 export type DbConnectionOptions = {
     readonly maxConnections?: number;
     readonly idleTimeoutSeconds?: number;
@@ -8,10 +9,10 @@ export declare const DEFAULT_DB_CLOSE_TIMEOUT_SECONDS = 5;
 export type DbPoolHandle = {
     /** Provider Connection — Calls gehen über asRawClient() oder direkt. */
     readonly db: any;
-    /** Legacy postgres-js Client (für LISTEN peer) */
+    /** Raw driver client (postgres-js or Bun.SQL) */
     readonly client: any;
-    /** Optionaler Bun.SQL LISTEN peer */
-    readonly listenClient?: any;
+    /** LISTEN-capable client; Bun.SQL serves it from its own dedicated connection */
+    readonly listenClient?: PgListenClient;
     /** Pool schliessen */
     close: () => Promise<void>;
 };

package/dist/db/apply-entity-event.js

@@ -44,7 +44,10 @@
 //   - "skipped" → Event ist kein Auto-Verb (Domain-Event auf demselben
 //     Aggregate). Caller no-op.
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { requestContext } from "../api/request-context.js";
 import { collectLookupableFields, computeBlindIndexValues } from "../crypto/blind-index.js";
+import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/pii-field-encryption.js";
+import { collectPiiFileReferenceFields } from "../crypto/subject-resolver.js";
 import { deleteMany, insertOne, updateMany } from "../db/query.js";
 import { InternalError } from "../errors/index.js";
 const AUTO_VERBS = ["created", "updated", "deleted", "restored", "forgotten"];
@@ -57,6 +60,27 @@ export function parseAutoVerb(event) {
     const verb = event.type.slice(prefix.length);
     return isOneOf(AUTO_VERBS, verb) ? verb : null;
 }
+// Events written by the old PII backfill can hold ciphertext in file/image uuid
+// columns. Replay restores the plain fileRef id; an erased subject yields null.
+async function decryptFileReferenceCiphertext(entity, values) {
+    const ciphertextFields = collectPiiFileReferenceFields(entity).filter((name) => isPiiCiphertext(values[name]));
+    if (ciphertextFields.length === 0)
+        return values;
+    const kms = configuredPiiSubjectKms();
+    if (kms === undefined) {
+        throw new InternalError({
+            message: `applyEntityEvent: file field(s) ${ciphertextFields.join(", ")} hold PII ciphertext but no subject KMS is configured; configure the KMS before replaying.`,
+        });
+    }
+    const decrypted = await decryptPiiFieldValues(values, ciphertextFields, kms, {
+        requestId: requestContext.get()?.requestId ?? "apply-entity-event",
+    });
+    for (const name of ciphertextFields) {
+        if (decrypted[name] === PII_ERASED_SENTINEL)
+            decrypted[name] = null;
+    }
+    return decrypted;
+}
 /** Idempotente Anwendung eines Auto-Events auf die Entity-Tabelle.
  *  Wird sowohl beim Live-Append (innerhalb der Write-TX) als auch beim
  *  Rebuild (innerhalb der Rebuild-TX) gerufen — identische Logik. */
@@ -92,7 +116,7 @@ export async function applyEntityEvent(event, table, entity, tx) {
                 });
             }
             const row = await insertOne(tx, table, {
-                ...event.payload,
+                ...(await decryptFileReferenceCiphertext(entity, event.payload)),
                 // Blind-Index-Spalten aus dem Payload-Wert (ciphertext → decrypt →
                 // HMAC, plaintext → HMAC, erased → NULL). Hier statt im Executor,
                 // damit Live-Write und Rebuild denselben Wert produzieren und der
@@ -110,7 +134,7 @@ export async function applyEntityEvent(event, table, entity, tx) {
             // payload-Shape: { changes, previous } — siehe event-store-executor.ts.
             const rawChanges = (event.payload["changes"] ?? {}); // @cast-boundary engine-payload
             const changes = {};
-            for (const [key, value] of Object.entries(rawChanges)) {
+            for (const [key, value] of Object.entries(await decryptFileReferenceCiphertext(entity, rawChanges))) {
                 const field = entity.fields[key];
                 // Historical events can carry fields since removed from the entity; the
                 // tolerance lives here (not in updateMany) so a live typo still throws.

package/dist/db/blind-index-cleanup.js

@@ -15,6 +15,7 @@ import { quoteIdent, subjectCiphertextLikePattern } from "../crypto/ciphertext-p
 import { isSelfPiiField } from "../crypto/is-self-pii-field.js";
 import { toSnakeCase } from "../utils/case.js";
 import { resolveTableName } from "./entity-table-meta.js";
+import { toPostgresArrayLiteral } from "./queries/postgres-array-literal.js";
 import { executeRawQuery, executeRawQueryRead } from "./queries/raw-sql.js";
 import { columnNamesOf, tableExists } from "./schema-inspection.js";
 export async function nullBlindIndexesForSubject(db, features, subjectKey) {
@@ -55,7 +56,7 @@ export async function nullBlindIndexesForSubject(db, features, subjectKey) {
 async function existingTableNames(db, tableNames) {
     if (tableNames.length === 0)
         return new Set();
-    const rows = await executeRawQueryRead(db, `SELECT t.name FROM unnest($1::text[]) AS t(name) WHERE to_regclass('public.' || quote_ident(t.name)) IS NOT NULL`, [tableNames]);
+    const rows = await executeRawQueryRead(db, `SELECT t.name FROM unnest($1::text[]) AS t(name) WHERE to_regclass('public.' || quote_ident(t.name)) IS NOT NULL`, [toPostgresArrayLiteral(tableNames)]);
     return new Set(rows.map((r) => r.name));
 }
 // Tenant-scope oracle for crypto-shredding's forget-subject (mh#349): a

package/dist/db/bun-provider.js

@@ -1,12 +1,11 @@
-// Bun.SQL Provider — experimentell.
-// Default: postgres-js. Dieser Provider nur aktiv wenn DB_PROVIDER=bun.
-// Bekannter Bug: Extended-Query-Protocol Caching verursacht
-// PostgresError "bind message has 11 result formats but query has 1 columns"
-// bei sequentiellen Queries mit unterschiedlicher Spaltenzahl innerhalb
-// derselben Connection.
+// Bun.SQL provider, opt-in via DB_PROVIDER=bun; postgres-js stays the default.
+// Known bug (Bun <= 1.4.3, oven-sh/bun#29484): a cached plan is not re-prepared
+// after DDL, so e.g. `SELECT *` after ADD COLUMN fails on that connection with
+// 0A000 "cached plan must not change result type". prepare:false is no fix,
+// it changes how jsonb params are bound.
 //
-// Bun.SQL hat kein LISTEN — postgres-js-Peer für event-dispatcher.
-import postgres from "postgres";
+// LISTEN runs on Bun.SQL's own dedicated connection, which is exempt from the
+// pool's idleTimeout and maxLifetime and re-LISTENs after a drop.
 import { DEFAULT_DB_CLOSE_TIMEOUT_SECONDS, } from "./api.js";
 export function createBunConnection(url, options = {}) {
     const bunOpts = {};
@@ -17,21 +16,13 @@ export function createBunConnection(url, options = {}) {
     if (options.connectTimeoutSeconds !== undefined)
         bunOpts.connectionTimeout = options.connectTimeoutSeconds;
     const db = new Bun.SQL(url, bunOpts);
-    // LISTEN peer — 1 connection reicht für NOTIFY-Wakeups
-    const pgOpts = { max: 1 };
-    if (options.idleTimeoutSeconds !== undefined)
-        pgOpts.idle_timeout = options.idleTimeoutSeconds;
-    if (options.connectTimeoutSeconds !== undefined)
-        pgOpts.connect_timeout = options.connectTimeoutSeconds;
-    const listenClient = postgres(url, pgOpts);
     const closeTimeout = options.closeTimeoutSeconds ?? DEFAULT_DB_CLOSE_TIMEOUT_SECONDS;
     return {
         db,
-        client: listenClient,
-        listenClient,
+        client: db,
+        listenClient: db,
         close: async () => {
             await db.end({ timeout: closeTimeout });
-            await listenClient.end({ timeout: closeTimeout });
         },
     };
 }

package/dist/db/dialect.d.ts

@@ -54,7 +54,7 @@ export declare function instant(name: string, opts?: {
 }): ColumnBuilder<Temporal.Instant>;
 export declare function plainDate(name: string): ColumnBuilder<Temporal.PlainDate>;
 export declare const decimalColumn: (name: string, precision: number, scale: number) => ColumnBuilder<number>;
-export declare const moneyAmount: (name: string) => ColumnBuilder<number>;
+export declare const moneyAmount: (name: string) => ColumnBuilder<bigint>;
 export type IndexBuilder = {
     readonly __index: true;
     on(...cols: ColumnHandle[]): IndexBuilderWithCols;

package/dist/db/dialect.js

@@ -58,6 +58,8 @@ export function pgTypeToSqlType(pgType) {
 function _toSnakeCase(name) {
     return name.replace(/[A-Z]/g, (m) => `_${m.toLowerCase()}`).replace(/^_/, "");
 }
+// TValue is never inferred from the factory's declared return type, so a factory that forgets its
+// type argument fails to compile instead of silently typing the column from its own annotation.
 function buildColumn(sqlName, pgType, opts) {
     let notNull = false;
     let primaryKey = false;

package/dist/db/eagerload.js

@@ -26,6 +26,7 @@ import { parseRefTargetEntityName } from "../engine/parse-ref-target.js";
 import { isUuid, SYSTEM_TENANT_ID } from "../engine/types/identifiers.js";
 import { collectEncryptedFieldNames, decryptEntityFieldValues, resolveEntityFieldEncryption, } from "./entity-field-encryption.js";
 import { buildParentRefClause } from "./parent-ref-clause.js";
+import { toPostgresArrayLiteral } from "./queries/postgres-array-literal.js";
 import { executeRawQueryRead } from "./queries/raw-sql.js";
 import { buildEntityTable, physicalColumnName } from "./table-builder.js";
 import { tenantDbRunner } from "./tenant-db-runner.js";
@@ -77,7 +78,7 @@ async function resolveRefAccessScope(refEntity, refTable, refTableName, ids, db,
     // No read path exists for non-uuid ids, so nothing can be access-checked.
     if (refEntity.idType !== undefined && refEntity.idType !== "uuid")
         return { kind: "none" };
-    const params = [ids];
+    const params = [toPostgresArrayLiteral(ids)];
     let tenantClause = "";
     if (refTable["tenantId"] !== undefined && db.mode === "tenant") {
         params.push(db.tenantId, SYSTEM_TENANT_ID);

package/dist/db/event-store-executor-context.d.ts

@@ -62,6 +62,7 @@ export type ExecutorContext = {
         subjectSource?: Record<string, unknown>;
         keyTenantId?: TenantId | undefined;
         ownerFallback?: Record<string, unknown>;
+        onErasedSubject?: "sentinel";
     }) => Promise<Record<string, unknown>>;
     readonly decryptForRead: (row: Record<string, unknown>, opts?: DecryptForReadOptions) => Promise<Record<string, unknown>>;
     readonly ownerTransitionRekeys: (previous: Record<string, unknown>, mergedNew: Record<string, unknown>, submittedChanges: Record<string, unknown>) => Record<string, unknown>;

package/dist/db/event-store-executor-context.js

@@ -215,6 +215,7 @@ export function buildExecutorContext(table, entity, options) {
                     ...(opts?.onlyKeys !== undefined && { onlyKeys: opts.onlyKeys }),
                     ...(opts?.subjectSource !== undefined && { subjectSource: opts.subjectSource }),
                     ...(opts?.ownerFallback !== undefined && { ownerFallback: opts.ownerFallback }),
+                    ...(opts?.onErasedSubject !== undefined && { onErasedSubject: opts.onErasedSubject }),
                 });
             }
             catch (e) {

package/dist/db/event-store-executor-write.d.ts

@@ -1,3 +1,3 @@
-import type { EventStoreExecutor } from "./event-store-executor.js";
+import { type EventStoreExecutor } from "./event-store-executor.js";
 import { type ExecutorContext } from "./event-store-executor-context.js";
 export declare function createWriteVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor, "create" | "update" | "delete" | "forget" | "restore">;