@cosmicdrift/kumiko-framework 0.364.0 → 0.365.0

package/dist/db/event-store-executor-write.js

@@ -2,14 +2,15 @@ import { checkWriteFieldOwnership } from "../engine/field-access.js";
 import { instructionFieldNames } from "../engine/instruction-fields.js";
 import { userCanCreateFieldRow, userCanWriteFieldRow } from "../engine/ownership.js";
 import { buildInsertSchema, buildUpdateSchema } from "../engine/schema-builder.js";
-import { findUnavailableSelectOptions, isRecordLocked, } from "../engine/screen-helpers.js";
-import { AccessDeniedError, VersionConflictError as FrameworkVersionConflict, IdempotentReplayError, InternalError, NotFoundError, PreconditionFailedError, RecordLockedError, UnprocessableError, writeFailure, } from "../errors/index.js";
+import { findUnavailableSelectOptions, isRecordLocked, isUnchangedValue, } from "../engine/screen-helpers.js";
+import { AccessDeniedError, VersionConflictError as FrameworkVersionConflict, IdempotentReplayError, InternalError, isSubjectErasedConflict, NotFoundError, PreconditionFailedError, RecordLockedError, UnprocessableError, writeFailure, } from "../errors/index.js";
 import { append, IdempotentAppendConflictError as EventStoreIdempotentAppendConflict, VersionConflictError as EventStoreVersionConflict, getStreamVersion, } from "../event-store/index.js";
 import { assertInstructionFieldWriteAllowed, assertIrreversibleOperationAllowed, isIrreversibleEntityVerb, } from "../pipeline/irreversible-operation-gate.js";
 import { hasLiveProjectionsForEvent, runProjectionsForEvent, } from "../pipeline/projections-runner.js";
 import { generateId } from "../utils/index.js";
 import { applyEntityEvent } from "./apply-entity-event.js";
 import { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
+import { WritePurposes, } from "./event-store-executor.js";
 import { buildEventMetadata, entityEventName, isForeignTenantOnGlobalEntity, ownershipSubject, tryMapUniqueViolation, } from "./event-store-executor-context.js";
 import { isFrameworkSystemUser, isLockGuardBypassed } from "./lock-guard.js";
 import { projectionRegistryOf } from "./projection-registry-binding.js";
@@ -34,19 +35,6 @@ async function projectEntityEvent(db, runner, event) {
 // behavior-preserving relocation, not a redesign: every closure below is
 // unchanged from the original, just relocated behind an explicit
 // ExecutorContext instead of capturing the factory's local scope directly.
-// updateOptions.skipUnchanged (#464) — opt-in: a resubmitted-but-identical
-// key is dropped before encryption so pii/encrypted fields don't get a fresh
-// AEAD ciphertext (new nonce) for no real change, and the event's `changes`
-// don't carry a phantom diff. Opt-in, not the executor's default, because
-// direct executor.update() callers rely on the current behavior to FORCE a
-// re-encrypt of an unchanged plaintext — KEK-rotation (auth-mfa reencrypt.job)
-// and the user-data-rights #494 backfill both resubmit the current value on
-// purpose to land a fresh event/ciphertext. Only the generic entity update
-// handler (entity-handlers.ts) sets this flag; those two call their own
-// executor directly and never see it.
-function isUnchangedValue(a, b) {
-    return JSON.stringify(a) === JSON.stringify(b);
-}
 function selectOptionNotAvailableFailure(entries) {
     const [first] = entries;
     if (!first)
@@ -125,6 +113,11 @@ export function createWriteVerbs(ctx) {
         }
         return writeFailure(new RecordLockedError({ entityName, entityId: id }));
     }
+    // Erasure writes run after the subject key is gone; they store the erased
+    // sentinel for that subject's fields instead of failing on re-encrypt.
+    function erasureSentinelOption(options) {
+        return options?.writePurpose === WritePurposes.erasure ? { onErasedSubject: "sentinel" } : {};
+    }
     const eventVersion = entity.eventVersion ?? 1;
     let insertSchema;
     let updateSchema;
@@ -149,6 +142,45 @@ export function createWriteVerbs(ctx) {
         }
         return { row: row };
     }
+    // A forgotten subject has no key any more: restore re-encrypts the stored row and reports
+    // that as a failure result like any other write conflict instead of throwing.
+    async function appendRestoredEvent(runner, user, id, previousPlain, streamTenantId, currentVersion) {
+        try {
+            const previous = await encryptForStorage(previousPlain, user, {
+                keyTenantId: streamTenantId,
+            });
+            const event = await runInSavepointIfSupported(runner, (sp) => append(sp, {
+                aggregateId: String(id),
+                aggregateType: entityName,
+                tenantId: streamTenantFor(user, streamTenantId),
+                expectedVersion: currentVersion,
+                type: entityEventName(entityName, "restored"),
+                eventVersion,
+                payload: { previous },
+                metadata: buildEventMetadata(user),
+            }));
+            return { event };
+        }
+        catch (e) {
+            if (isSubjectErasedConflict(e))
+                return { failure: writeFailure(e) };
+            if (e instanceof EventStoreVersionConflict) {
+                return {
+                    failure: writeFailure(new FrameworkVersionConflict({
+                        entityId: id,
+                        expectedVersion: currentVersion,
+                        currentVersion: -1,
+                    })),
+                };
+            }
+            if (e instanceof EventStoreIdempotentAppendConflict) {
+                return {
+                    failure: writeFailure(new IdempotentReplayError({ idempotencyKey: e.idempotencyKey })),
+                };
+            }
+            throw e;
+        }
+    }
     async function expectedStreamVersion(db, id, streamTenant, expect) {
         const snapshot = await loadExpectSnapshot(db, id, streamTenant, Object.keys(expect));
         const row = snapshot.row;
@@ -415,7 +447,12 @@ export function createWriteVerbs(ctx) {
             const lockedUpdate = recordLockedFailure(previous, payload.id, user, updateOptions);
             if (lockedUpdate)
                 return lockedUpdate;
-            const unavailableOnUpdate = selectOptionNotAvailableFailure(findUnavailableSelectOptions(entity.fields, mergedNew, previous));
+            // Statutory retention/erasure writes may change a condition field (e.g. null a PII
+            // reference) and must not be blocked by the select rule — same exemption as the lock.
+            const isStatutorySystemWrite = updateOptions?.writePurpose !== undefined && isFrameworkSystemUser(user);
+            const unavailableOnUpdate = isStatutorySystemWrite
+                ? undefined
+                : selectOptionNotAvailableFailure(findUnavailableSelectOptions(entity.fields, mergedNew, previous));
             if (unavailableOnUpdate)
                 return unavailableOnUpdate;
             const streamTenant = streamTenantFor(user, streamTenantId);
@@ -454,6 +491,9 @@ export function createWriteVerbs(ctx) {
                 // Compound-Types Auto-Convert (alle in einem Pass).
                 // subjectSource: partial changes may carry a pii field without its
                 // ownerField — the merged row still names the subject.
+                // skipUnchanged (#464) is opt-in: an identical resubmitted key is dropped before
+                // encryption so pii/encrypted fields get no fresh ciphertext for no real change.
+                // Direct callers (KEK rotation, #494 backfill) rely on the default to force a re-encrypt.
                 const submittedChanges = updateOptions?.skipUnchanged
                     ? Object.fromEntries(Object.entries(changes).filter(([key, value]) => !isUnchangedValue(value, previous[key])))
                     : changes;
@@ -469,6 +509,7 @@ export function createWriteVerbs(ctx) {
                     onlyKeys: Object.keys(changesToPersist),
                     subjectSource: mergedNew,
                     keyTenantId: streamTenantId,
+                    ...erasureSentinelOption(updateOptions),
                 });
                 // The event payload carries BOTH `changes` (what the user asked for) AND
                 // `previous` (the pre-update row). Cross-aggregate projections need the
@@ -484,6 +525,7 @@ export function createWriteVerbs(ctx) {
                 const encryptedPrevious = await encryptForStorage(previous, user, {
                     keyTenantId: streamTenantId,
                     ownerFallback: submittedChanges,
+                    ...erasureSentinelOption(updateOptions),
                 });
                 // Savepoint-scoped — see the create() append() above for why:
                 // confines a losing writer's unique-violation to a nested scope
@@ -620,7 +662,10 @@ export function createWriteVerbs(ctx) {
                     type: entityEventName(entityName, "deleted"),
                     eventVersion,
                     payload: {
-                        previous: await encryptForStorage(existing, user, { keyTenantId: streamTenantId }),
+                        previous: await encryptForStorage(existing, user, {
+                            keyTenantId: streamTenantId,
+                            ...erasureSentinelOption(options),
+                        }),
                     },
                     metadata: buildEventMetadata(user),
                 }));
@@ -702,7 +747,10 @@ export function createWriteVerbs(ctx) {
                     // Re-encrypt like delete(): `existing` came decrypted from loadById —
                     // plaintext must not land in the immutable log, least of all on forget.
                     payload: {
-                        previous: await encryptForStorage(existing, user, { keyTenantId: streamTenantId }),
+                        previous: await encryptForStorage(existing, user, {
+                            keyTenantId: streamTenantId,
+                            onErasedSubject: "sentinel",
+                        }),
                     },
                     metadata: buildEventMetadata(user),
                 }));
@@ -778,35 +826,10 @@ export function createWriteVerbs(ctx) {
             // pii, and envelope encryption is not idempotent: decrypt, then
             // re-encrypt as delete does.
             const previousPlain = await decryptForRead(data);
-            const previousForStorage = await encryptForStorage(previousPlain, user, {
-                keyTenantId: streamTenantId,
-            });
-            let event;
-            try {
-                event = await runInSavepointIfSupported(runner, (sp) => append(sp, {
-                    aggregateId: String(payload.id),
-                    aggregateType: entityName,
-                    tenantId: streamTenantFor(user, streamTenantId),
-                    expectedVersion: currentVersion,
-                    type: entityEventName(entityName, "restored"),
-                    eventVersion,
-                    payload: { previous: previousForStorage },
-                    metadata: buildEventMetadata(user),
-                }));
-            }
-            catch (e) {
-                if (e instanceof EventStoreVersionConflict) {
-                    return writeFailure(new FrameworkVersionConflict({
-                        entityId: payload.id,
-                        expectedVersion: currentVersion,
-                        currentVersion: -1,
-                    }));
-                }
-                if (e instanceof EventStoreIdempotentAppendConflict) {
-                    return writeFailure(new IdempotentReplayError({ idempotencyKey: e.idempotencyKey }));
-                }
-                throw e;
-            }
+            const appended = await appendRestoredEvent(runner, user, payload.id, previousPlain, streamTenantId, currentVersion);
+            if ("failure" in appended)
+                return appended.failure;
+            const event = appended.event;
             // Live==Rebuild via applyEntityEvent. Restore only writes isDeleted=false
             // plus the version bump, so there is no sensitive-field drift and no
             // payload override is needed.

package/dist/db/index.d.ts

@@ -24,6 +24,7 @@ export { type AppliedMigration, type ApplyResult, type BaselineResult, baselineM
 export { flattenMoney, type MoneyRead, moneyPayloadToMinorUnits, rehydrateMoney } from "./money.js";
 export { constraintOf, extractPgError, isTableAlreadyExists, isUniqueViolation, type PgErrorInfo, } from "./pg-error.js";
 export { acquireNamespacedAdvisoryLock } from "./queries/advisory-lock.js";
+export { toPostgresArrayLiteral } from "./queries/postgres-array-literal.js";
 export { executeRawQuery, executeRawQueryRead } from "./queries/raw-sql.js";
 export type { SelectOptions, WhereObject, WhereValue } from "./query-api.js";
 export { aggregateWhere, asRawClient, countWhere, deleteMany, fetchOne, insertMany, insertOne, runInSavepoint, selectMany, transaction, updateMany, } from "./query-api.js";

package/dist/db/index.js

@@ -18,6 +18,7 @@ export { baselineMigrations, fetchAppliedMigrations, loadMigrationsFromDir, Migr
 export { flattenMoney, moneyPayloadToMinorUnits, rehydrateMoney } from "./money.js";
 export { constraintOf, extractPgError, isTableAlreadyExists, isUniqueViolation, } from "./pg-error.js";
 export { acquireNamespacedAdvisoryLock } from "./queries/advisory-lock.js";
+export { toPostgresArrayLiteral } from "./queries/postgres-array-literal.js";
 export { executeRawQuery, executeRawQueryRead } from "./queries/raw-sql.js";
 export { aggregateWhere, asRawClient, countWhere, deleteMany, fetchOne, insertMany, insertOne, runInSavepoint, selectMany, transaction, updateMany, } from "./query-api.js";
 export { readRebuildMarker, rebuildTablesFromDiff, writeRebuildMarker, } from "./rebuild-marker.js";

package/dist/db/migrate-runner.d.ts

@@ -12,6 +12,7 @@ export type ApplyResult = {
     readonly applied: readonly string[];
     readonly skipped: readonly string[];
 };
+export declare const MIGRATION_ADVISORY_LOCK_KEY = 1802857833;
 export declare function splitSqlStatements(sqlText: string): readonly string[];
 export declare function loadMigrationsFromDir(dir: string, preprocess?: (sql: string) => string): readonly Migration[];
 export declare function readMigrationSqlTexts(dir: string): readonly string[];

package/dist/db/migrate-runner.js

@@ -17,11 +17,11 @@ import { createHash } from "node:crypto";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { asRawClient, hasBegin } from "../bun-db/query.js";
+import { asRawClient, hasBegin, } from "../bun-db/query.js";
 // Advisory-lock key (random 32-bit int, stable). Verhindert dass zwei
 // gleichzeitig bootende Pods beide migrate apply laufen lassen (zweiter
 // blockiert bis erster fertig).
-const ADVISORY_LOCK_KEY = 0x6b756d69; // "kumi" in ASCII
+export const MIGRATION_ADVISORY_LOCK_KEY = 0x6b756d69; // "kumi" in ASCII
 const MIGRATIONS_TABLE_DDL = `
 CREATE TABLE IF NOT EXISTS "_kumiko_migrations" (
   "id" text PRIMARY KEY NOT NULL,
@@ -186,8 +186,18 @@ function migrationClient(db) {
 async function executeRaw(db, sqlText) {
     await migrationClient(db).unsafe(sqlText);
 }
+async function reserveConnection(db) {
+    const client = migrationClient(db);
+    if (typeof client.reserve !== "function") {
+        throw new Error("migrate-runner: db argument has no .reserve() (need Bun.SQL or postgres-js Sql)");
+    }
+    return client.reserve();
+}
 export async function fetchAppliedMigrations(db) {
-    const result = await migrationClient(db).unsafe(`SELECT id, checksum FROM "_kumiko_migrations" ORDER BY id`);
+    return fetchAppliedFrom(migrationClient(db));
+}
+async function fetchAppliedFrom(client) {
+    const result = await client.unsafe(`SELECT id, checksum FROM "_kumiko_migrations" ORDER BY id`);
     const rows = Array.isArray(result) ? result : [];
     const applied = [];
     for (const row of rows) {
@@ -216,40 +226,55 @@ export class MigrationChecksumMismatchError extends Error {
 // _kumiko_migrations-Lookup übersprungen. Checksum-Mismatch wirft fail-loud.
 // Advisory-Lock verhindert concurrent-apply-races.
 export async function runMigrations(db, migrations) {
-    await executeRaw(db, MIGRATIONS_TABLE_DDL);
-    await executeRaw(db, `SELECT pg_advisory_lock(${ADVISORY_LOCK_KEY})`);
+    // Session-level advisory lock and per-migration BEGIN/COMMIT must share one
+    // session. Pool calls may land on different connections (Bun.SQL round-robins),
+    // which would leave the lock held on a session nobody unlocks.
+    const conn = await reserveConnection(db);
     try {
-        const applied = new Map((await fetchAppliedMigrations(db)).map((a) => [a.id, a.checksum]));
-        const appliedIds = [];
-        const skippedIds = [];
-        for (const m of migrations) {
-            const prevChecksum = applied.get(m.id);
-            if (prevChecksum !== undefined) {
-                if (prevChecksum !== m.checksum) {
-                    throw new MigrationChecksumMismatchError(m.id, prevChecksum, m.checksum);
+        await conn.unsafe(MIGRATIONS_TABLE_DDL);
+        await conn.unsafe(`SELECT pg_advisory_lock(${MIGRATION_ADVISORY_LOCK_KEY})`);
+        try {
+            const applied = new Map((await fetchAppliedFrom(conn)).map((a) => [a.id, a.checksum]));
+            const appliedIds = [];
+            const skippedIds = [];
+            for (const m of migrations) {
+                const prevChecksum = applied.get(m.id);
+                if (prevChecksum !== undefined) {
+                    if (prevChecksum !== m.checksum) {
+                        throw new MigrationChecksumMismatchError(m.id, prevChecksum, m.checksum);
+                    }
+                    skippedIds.push(m.id);
+                    continue;
                 }
-                skippedIds.push(m.id);
-                continue;
-            }
-            // Apply file content + INSERT tracking-row in einer TX. Wenn ein
-            // Statement bricht, Rollback inkl. Tracking-Row → kein partial-apply
-            // stuck in den books.
-            const client = migrationClient(db);
-            await client.begin(async (tx) => {
-                for (const stmt of m.statements) {
-                    await tx.unsafe(stmt);
+                // Apply file content + INSERT tracking-row in einer TX. Wenn ein
+                // Statement bricht, Rollback inkl. Tracking-Row → kein partial-apply
+                // stuck in den books.
+                await conn.unsafe("BEGIN");
+                try {
+                    for (const stmt of m.statements) {
+                        await conn.unsafe(stmt);
+                    }
+                    await conn.unsafe(`INSERT INTO "_kumiko_migrations" ("id", "checksum") VALUES ($1, $2)`, [
+                        m.id,
+                        m.checksum,
+                    ]);
+                    await conn.unsafe("COMMIT");
+                }
+                catch (e) {
+                    // A failed ROLLBACK means the session is gone (its lock and tx with it); keep the migration error.
+                    await conn.unsafe("ROLLBACK").catch(() => undefined);
+                    throw e;
                 }
-                await tx.unsafe(`INSERT INTO "_kumiko_migrations" ("id", "checksum") VALUES ($1, $2)`, [
-                    m.id,
-                    m.checksum,
-                ]);
-            });
-            appliedIds.push(m.id);
+                appliedIds.push(m.id);
+            }
+            return { applied: appliedIds, skipped: skippedIds };
+        }
+        finally {
+            await conn.unsafe(`SELECT pg_advisory_unlock(${MIGRATION_ADVISORY_LOCK_KEY})`);
         }
-        return { applied: appliedIds, skipped: skippedIds };
     }
     finally {
-        await executeRaw(db, `SELECT pg_advisory_unlock(${ADVISORY_LOCK_KEY})`);
+        await conn.release();
     }
 }
 // Convenience: load + run in einem Call. Wird vom `kumiko migrate apply`

package/dist/db/queries/backfill-pii.js

@@ -43,7 +43,11 @@
 //   unresolvable subject still fails loud into `failures`, as before.
 //   4. owner re-key ({@link PiiBackfillOptions.rekeyTenantKeyedOwnerFields}) —
 //   tenant-keyed ciphertext of a userOwned field moves under the user the
-//   strict chain (stages 1+2, never whenAbsent) names.
+//   strict chain (stages 1+2, never whenAbsent) names; user-keyed ciphertext
+//   moves under the projection's current owner when that is another user (an
+//   owner change made before owner transitions re-keyed the value). An owner
+//   cleared again (owner → none) is not recoverable from the projection: such
+//   values stay tenant-keyed, unlike the live path that keeps the last owner.
 //
 // Snapshots of touched aggregates are dropped per batch (they may cache
 // plaintext); the next snapshotting load recreates them. AFTER a run, rebuild the
@@ -54,11 +58,13 @@ import { asRawClient } from "../../bun-db/index.js";
 import { quoteIdent } from "../../crypto/ciphertext-pattern.js";
 import { configuredEventPiiCatalog } from "../../crypto/event-pii.js";
 import { isLocalKeyKmsAdapter, KeyErasedError, KeyNotFoundError, } from "../../crypto/kms-adapter.js";
+import { isPlainUserOwnedField } from "../../crypto/owner-transition-rekey.js";
 import { configuredPiiSubjectKms, decryptPiiValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_ERASED_SENTINEL, piiCiphertextSubject, } from "../../crypto/pii-field-encryption.js";
-import { collectPiiEncryptedFields, resolveEventSubject, resolveSubjectForField, SubjectResolutionError, } from "../../crypto/subject-resolver.js";
+import { collectPiiEncryptedFields, nonEmptyString, resolveEventSubject, resolveSubjectForField, SubjectResolutionError, } from "../../crypto/subject-resolver.js";
 import { resolveTableName } from "../entity-table-meta.js";
 import { tableExists } from "../schema-inspection.js";
 import { toSnakeCase } from "../table-builder.js";
+import { toPostgresArrayLiteral } from "./postgres-array-literal.js";
 const LIFECYCLE_VERBS = ["created", "updated", "deleted", "restored", "forgotten"];
 function collectPiiTargets(registry) {
     const entityTargets = new Map();
@@ -154,12 +160,21 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
         ? raw.unsafe(`SELECT "id", "aggregate_id", "aggregate_type", "tenant_id", "type", "payload"
            FROM "kumiko_events"
           WHERE ("aggregate_type" = ANY($1::text[]) OR "type" = ANY($2::text[])) AND "id" = ANY($3::bigint[])
-          ORDER BY "id" ASC`, [aggregateTypes, catalogTypes, [...options.eventIds]])
+          ORDER BY "id" ASC`, [
+            toPostgresArrayLiteral(aggregateTypes),
+            toPostgresArrayLiteral(catalogTypes),
+            toPostgresArrayLiteral([...options.eventIds]),
+        ])
         : raw.unsafe(`SELECT "id", "aggregate_id", "aggregate_type", "tenant_id", "type", "payload"
            FROM "kumiko_events"
           WHERE ("aggregate_type" = ANY($1::text[]) OR "type" = ANY($2::text[])) AND "id" > $3::bigint
           ORDER BY "id" ASC
-          LIMIT $4`, [aggregateTypes, catalogTypes, String(options.afterEventId ?? 0), batchSize]));
+          LIMIT $4`, [
+            toPostgresArrayLiteral(aggregateTypes),
+            toPostgresArrayLiteral(catalogTypes),
+            String(options.afterEventId ?? 0),
+            batchSize,
+        ]));
     const last = rows[rows.length - 1];
     if (last === undefined)
         return emptyBatch();
@@ -205,7 +220,7 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
     }
     // Snapshots may cache the plaintext state of touched aggregates.
     if (!options.dryRun && touchedAggregates.size > 0) {
-        const deleted = await raw.unsafe(`DELETE FROM "kumiko_snapshots" WHERE "aggregate_id" = ANY($1::uuid[]) RETURNING "aggregate_id"`, [[...touchedAggregates]]);
+        const deleted = await raw.unsafe(`DELETE FROM "kumiko_snapshots" WHERE "aggregate_id" = ANY($1::uuid[]) RETURNING "aggregate_id"`, [toPostgresArrayLiteral([...touchedAggregates])]);
         result.deletedSnapshots = deleted.length;
     }
     return {
@@ -250,7 +265,7 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
             // aborts the surrounding transaction (25P02). Entity never mounted/rebuilt
             // → stage 3 still gets a chance; this batch just contributes no owners.
             if (await tableExists(db, `public.${tableName}`)) {
-                const projectionRows = await raw.unsafe(`SELECT * FROM ${quoteIdent(tableName)} WHERE "id" = ANY($1::uuid[])`, [[...ids]]);
+                const projectionRows = await raw.unsafe(`SELECT * FROM ${quoteIdent(tableName)} WHERE "id" = ANY($1::uuid[])`, [toPostgresArrayLiteral([...ids])]);
                 for (const projectionRow of projectionRows) {
                     const id = projectionRow["id"];
                     if (typeof id === "string") {
@@ -456,24 +471,20 @@ function projectionOwnerRowOfTenant(owner, tenantId) {
         return undefined;
     return owner.tenantId === undefined || owner.tenantId === tenantId ? owner.fields : undefined;
 }
-function isPlainUserOwnedField(entity, field) {
-    const fieldDef = entity.fields[field];
-    if (fieldDef === undefined || !("userOwned" in fieldDef) || fieldDef.userOwned === undefined) {
-        return false;
-    }
-    return !("recordOwned" in fieldDef && fieldDef.recordOwned === true);
-}
 // Stage 4. In dryRun the "rekeyed" value is the untouched ciphertext (nothing is written).
 async function rekeyTenantKeyedValue(deps, target) {
     const { entity, field, ciphertext } = target;
-    if (!isPlainUserOwnedField(entity, field) || !isTenantKeyedUnder(ciphertext, target.tenantId)) {
+    const fieldDef = entity.fields[field];
+    if (fieldDef === undefined || !isPlainUserOwnedField(fieldDef))
         return { kind: "unchanged" };
-    }
-    const resolution = resolveOwnerSubject(entity, field, target.subjectSource, target.ownerFallback, target.projectionOwnerRow, target.tenantId, target.aggregateType);
-    if (resolution.kind !== "resolved" || resolution.subject.kind !== "user") {
+    const keyedUnder = ciphertextSubjectOrNull(ciphertext);
+    const userSubject = keyedUnder?.kind === "tenant" && keyedUnder.tenantId === target.tenantId
+        ? ownerOfTenantKeyedValue(target)
+        : keyedUnder?.kind === "user"
+            ? currentProjectionOwnerIfOther(target, keyedUnder.userId)
+            : null;
+    if (userSubject === null)
         return { kind: "unchanged" };
-    }
-    const userSubject = resolution.subject;
     if (await deps.isForgottenSubject(userSubject))
         return { kind: "erased" };
     if (deps.dryRun) {
@@ -494,16 +505,32 @@ async function rekeyTenantKeyedValue(deps, target) {
         throw e;
     }
 }
-// Only the row's own tenant key counts: another tenant's or a user's key is
+// Strict chain (payload, then projection), never whenAbsent.
+function ownerOfTenantKeyedValue(target) {
+    const resolution = resolveOwnerSubject(target.entity, target.field, target.subjectSource, target.ownerFallback, target.projectionOwnerRow, target.tenantId, target.aggregateType);
+    return resolution.kind === "resolved" && resolution.subject.kind === "user"
+        ? resolution.subject
+        : null;
+}
+// A value keyed under a previous owner moves to the owner the row has now. The
+// projection of the event's own tenant is authoritative here: the payload of
+// an old created event still names the owner the row had back then.
+function currentProjectionOwnerIfOther(target, keyedUserId) {
+    const fieldDef = target.entity.fields[target.field];
+    if (fieldDef === undefined || !("userOwned" in fieldDef) || !fieldDef.userOwned)
+        return null;
+    const owner = nonEmptyString(target.projectionOwnerRow?.[fieldDef.userOwned.ownerField]);
+    return owner === null || owner === keyedUserId ? null : { kind: "user", userId: owner };
+}
+// Only the row's own tenant key or a user key counts: another tenant's key is
 // never decrypted here.
-function isTenantKeyedUnder(ciphertext, tenantId) {
+function ciphertextSubjectOrNull(ciphertext) {
     try {
-        const subject = piiCiphertextSubject(ciphertext);
-        return subject.kind === "tenant" && subject.tenantId === tenantId;
+        return piiCiphertextSubject(ciphertext);
     }
     catch {
         // skip: a malformed ciphertext prefix is not ours to re-key
-        return false;
+        return null;
     }
 }
 function attemptResolve(entity, field, source, opts) {
@@ -516,6 +543,17 @@ function attemptResolve(entity, field, source, opts) {
         return { ok: false, error: e };
     }
 }
+// An explicit owner key (even null) means the event itself knows the row had no
+// owner then; only a missing key predates the owner field and may use the
+// projection's current owner.
+function payloadNamesOwnerKey(entity, field, subjectSource, ownerFallback) {
+    const fieldDef = entity.fields[field];
+    if (fieldDef === undefined || !("userOwned" in fieldDef) || !fieldDef.userOwned)
+        return false;
+    const { ownerField } = fieldDef.userOwned;
+    return (Object.hasOwn(subjectSource, ownerField) ||
+        (ownerFallback !== undefined && Object.hasOwn(ownerFallback, ownerField)));
+}
 // Stage 1 (payload) and stage 2 (projection row, when supplied) resolve the
 // owner strictly, ignoring whenAbsent — an ownerless payload must not shadow
 // an owner the projection knows. Stage 2b then applies whenAbsent to the
@@ -529,7 +567,7 @@ function resolveOwnerSubject(entity, field, subjectSource, ownerFallback, projec
             ? { kind: "unannotated" }
             : { kind: "resolved", subject: payloadAttempt.subject, viaProjection: false };
     }
-    if (projectionOwnerRow) {
+    if (projectionOwnerRow && !payloadNamesOwnerKey(entity, field, subjectSource, ownerFallback)) {
         const augmented = { ...subjectSource, ...projectionOwnerRow };
         const projectionAttempt = attemptResolve(entity, field, augmented, strictOpts);
         if (projectionAttempt.ok && projectionAttempt.subject !== null) {

package/dist/db/queries/event-consumer.js

@@ -1,4 +1,5 @@
 import { asRawClient } from "../query.js";
+import { toPostgresArrayLiteral } from "./postgres-array-literal.js";
 // Per-turn snapshot bounds for pending-gap finality (event-dispatcher.ts's
 // processConsumer). pg_current_snapshot() is this transaction's MVCC view;
 // xmin is the oldest still-in-progress xact id in it, xmax the next
@@ -123,7 +124,7 @@ export async function selectProvablyIdleConsumerPairs(db, names, instanceIds, de
        AND "pending_gaps" = '[]'::jsonb
        AND NOT EXISTS (
          SELECT 1 FROM "kumiko_events" e WHERE e."id" > c."last_processed_event_id"
-       )`, [names, instanceIds, deadStatus]);
+       )`, [toPostgresArrayLiteral(names), toPostgresArrayLiteral(instanceIds), deadStatus]);
     return rows.map((r) => ({ name: r.name, instanceId: r.instance_id }));
 }
 export async function selectConsumerForUpdateSkipLocked(db, name, instanceId) {

package/dist/db/queries/event-store-transfer.js

@@ -4,12 +4,18 @@
 // backfill-pii.ts): the one place in the repo allowed to write tenant_id
 // directly onto kumiko_events / kumiko_snapshots / kumiko_archived_streams.
 import { asRawClient } from "../query.js";
+import { toPostgresArrayLiteral } from "./postgres-array-literal.js";
 // Postgres' RETURNING clause has no DISTINCT keyword — dedupe the
 // per-event-row hits in-process instead of relying on invalid SQL.
 export async function transferEventRows(db, params) {
     const rows = await asRawClient(db).unsafe(`UPDATE "kumiko_events" SET "tenant_id" = $1 ` +
-        `WHERE "tenant_id" = $2 AND "aggregate_type" = $3 AND "aggregate_id" = ANY($4) ` +
-        `RETURNING "aggregate_id" AS id`, [params.destinationTenantId, params.sourceTenantId, params.aggregateType, params.aggregateIds]);
+        `WHERE "tenant_id" = $2 AND "aggregate_type" = $3 AND "aggregate_id" = ANY($4::uuid[]) ` +
+        `RETURNING "aggregate_id" AS id`, [
+        params.destinationTenantId,
+        params.sourceTenantId,
+        params.aggregateType,
+        toPostgresArrayLiteral(params.aggregateIds),
+    ]);
     return [...new Set(rows.map((row) => row.id))];
 }
 // Snapshots are a pure read-performance cache (event-store/snapshot.ts) —
@@ -17,7 +23,7 @@ export async function transferEventRows(db, params) {
 // events on next read instead of carrying the snapshot's own generation
 // bookkeeping across the tenant boundary.
 export async function deleteSnapshotsForAggregates(db, params) {
-    await asRawClient(db).unsafe(`DELETE FROM "kumiko_snapshots" WHERE "tenant_id" = $1 AND "aggregate_id" = ANY($2)`, [params.tenantId, params.aggregateIds]);
+    await asRawClient(db).unsafe(`DELETE FROM "kumiko_snapshots" WHERE "tenant_id" = $1 AND "aggregate_id" = ANY($2::uuid[])`, [params.tenantId, toPostgresArrayLiteral(params.aggregateIds)]);
 }
 // An archived stream's marker must move with it — leaving it behind would
 // make the stream writable again the instant it lands in the destination
@@ -27,5 +33,10 @@ export async function deleteSnapshotsForAggregates(db, params) {
 // moved aggregate's id must stay in the source tenant.
 export async function transferArchivedStreamRows(db, params) {
     await asRawClient(db).unsafe(`UPDATE "kumiko_archived_streams" SET "tenant_id" = $1 ` +
-        `WHERE "tenant_id" = $2 AND "aggregate_type" = $3 AND "aggregate_id" = ANY($4)`, [params.destinationTenantId, params.sourceTenantId, params.aggregateType, params.aggregateIds]);
+        `WHERE "tenant_id" = $2 AND "aggregate_type" = $3 AND "aggregate_id" = ANY($4::uuid[])`, [
+        params.destinationTenantId,
+        params.sourceTenantId,
+        params.aggregateType,
+        toPostgresArrayLiteral(params.aggregateIds),
+    ]);
 }

package/dist/db/queries/event-store.js

@@ -1,5 +1,6 @@
 import { constraintOf, isLockNotAvailable, isTableAlreadyExists, isUniqueViolation, } from "../pg-error.js";
-import { asRawClient, runInNewTransaction, unsafeReadRetrying } from "../query.js";
+import { asRawClient, runInNewTransaction, runnerCanBeginTransaction, unsafeReadRetrying, } from "../query.js";
+import { toPostgresArrayLiteral } from "./postgres-array-literal.js";
 // Gap-finality (event-dispatcher pending_gaps) needs every holder of an
 // event id to already have a *real* xact id by the time it inserts — Postgres
 // assigns those lazily on first write, so a bare INSERT alone doesn't
@@ -12,12 +13,9 @@ export async function claimXactId(db) {
 // notify would be three commits and the claimed xact id would be released before
 // the insert's. A pool runner (has begin()) therefore gets one transaction around
 // the whole write; inside a caller's tx or savepoint the caller's tx already is
-// that unit. Bun.SQL's TransactionSQL extends SQL and still exposes begin(), so
-// only a runner without savepoint() counts as a pool.
+// that unit.
 export async function runAtomicEventWrite(db, write) {
-    const raw = asRawClient(db);
-    const isPool = typeof raw.begin === "function" && typeof raw.savepoint !== "function";
-    if (!isPool)
+    if (!runnerCanBeginTransaction(db))
         return write(db);
     return runInNewTransaction(db, (tx) => write(tx));
 }
@@ -175,7 +173,7 @@ export async function selectStreamMaxVersions(db, aggregateIds, tenantId) {
     const versions = new Map();
     if (aggregateIds.length === 0)
         return versions;
-    const rows = await unsafeReadRetrying(db, `SELECT "aggregate_id" AS id, MAX("version") AS v FROM "kumiko_events" WHERE "tenant_id" = $1 AND "aggregate_id" = ANY($2::uuid[]) GROUP BY "aggregate_id"`, [tenantId, [...aggregateIds]]);
+    const rows = await unsafeReadRetrying(db, `SELECT "aggregate_id" AS id, MAX("version") AS v FROM "kumiko_events" WHERE "tenant_id" = $1 AND "aggregate_id" = ANY($2::uuid[]) GROUP BY "aggregate_id"`, [tenantId, toPostgresArrayLiteral(aggregateIds)]);
     for (const row of rows) {
         if (row.v !== null)
             versions.set(row.id, row.v);
@@ -260,8 +258,8 @@ export async function selectPendingAndNewEventRows(db, cursor, pendingRanges, ba
      (SELECT * FROM "kumiko_events" WHERE "id" > $1 ORDER BY "id" ASC LIMIT $4)
      ORDER BY "id" ASC LIMIT $4`, [
         cursor,
-        pendingRanges.map((r) => r.from.toString()),
-        pendingRanges.map((r) => r.to.toString()),
+        toPostgresArrayLiteral(pendingRanges.map((r) => r.from)),
+        toPostgresArrayLiteral(pendingRanges.map((r) => r.to)),
         batchSize,
     ]);
 }
@@ -274,7 +272,10 @@ export async function selectSmallestVisibleIdInRanges(db, pendingRanges) {
     const rows = await unsafeReadRetrying(db, `SELECT MIN("id")::text AS id FROM "kumiko_events"
      WHERE EXISTS (
        SELECT 1 FROM unnest($1::bigint[], $2::bigint[]) AS g(f, t) WHERE "id" BETWEEN g.f AND g.t
-     )`, [pendingRanges.map((r) => r.from.toString()), pendingRanges.map((r) => r.to.toString())]);
+     )`, [
+        toPostgresArrayLiteral(pendingRanges.map((r) => r.from)),
+        toPostgresArrayLiteral(pendingRanges.map((r) => r.to)),
+    ]);
     const id = rows[0]?.id;
     return id === null || id === undefined ? null : BigInt(id);
 }

package/dist/db/queries/pii-backfill-state.js

@@ -1,4 +1,5 @@
 import { asRawClient } from "../query.js";
+import { toPostgresArrayLiteral } from "./postgres-array-literal.js";
 export async function readPiiBackfillState(db, fingerprint) {
     const rows = await asRawClient(db).unsafe(`SELECT "cursor_event_id"::text AS "cursor", "completed_at" IS NOT NULL AS "completed",
             "failed_event_ids"::text[] AS "failedEventIds"
@@ -19,7 +20,7 @@ export async function persistPiiBackfillState(db, fingerprint, update) {
         fingerprint,
         update.cursor.toString(),
         update.markCompleted,
-        [...update.addFailedEventIds],
-        [...update.removeFailedEventIds],
+        toPostgresArrayLiteral(update.addFailedEventIds),
+        toPostgresArrayLiteral(update.removeFailedEventIds),
     ]);
 }