@cosmicdrift/kumiko-framework 0.366.0 → 0.368.0

package/dist/event-store/event-store.js

@@ -2,11 +2,10 @@
 import { isPersonalDataGated, UNATTRIBUTED_ORIGIN, } from "@cosmicdrift/kumiko-types/event-store-types";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { requestContext } from "../api/request-context.js";
-import { instantToTimestamptzParam } from "../bun-db/query.js";
 import { encryptEventPayloadPii } from "../crypto/event-pii.js";
 import { constraintOf, isUniqueViolation } from "../db/pg-error.js";
-import { claimXactId, insertSubsequentEventRow, notifyPgChannel, runAtomicEventWrite, selectAggregateMaxVersion, selectEventsHighWaterMark, selectStreamMaxVersion, selectStreamMaxVersions, } from "../db/queries/event-store.js";
-import { insertOne, selectMany } from "../db/query.js";
+import { claimXactId, insertFirstEventRow, insertSubsequentEventRow, notifyPgChannel, runAtomicEventWrite, selectAggregateMaxVersion, selectEventsHighWaterMark, selectStreamMaxVersion, selectStreamMaxVersions, } from "../db/queries/event-store.js";
+import { instantToTimestamptzParam, selectMany } from "../db/query.js";
 import { isStreamArchived } from "./archive.js";
 import { IdempotentAppendConflictError, SeedTimeOrderError, VersionConflictError, } from "./errors.js";
 import { eventsTable } from "./events-schema.js";
@@ -112,21 +111,21 @@ async function assertSeedTimeNotBeforePredecessor(db, event, seedCreatedAt) {
     }
 }
 async function insertFirstEvent(db, event, newVersion, eventVersion, seedCreatedAt) {
-    const row = await insertOne(db, eventsTable, {
+    const row = await insertFirstEventRow(db, {
         aggregateId: event.aggregateId,
         aggregateType: event.aggregateType,
         tenantId: event.tenantId,
-        version: newVersion,
+        newVersion,
         type: event.type,
         eventVersion,
         payload: event.payload,
         metadata: event.metadata,
         createdBy: event.metadata.userId,
-        ...(seedCreatedAt !== undefined && { createdAt: seedCreatedAt }),
+        createdAt: seedCreatedAt && instantToTimestamptzParam(seedCreatedAt),
     });
     if (!row)
-        throw new Error("insertFirstEvent: INSERT RETURNING produced no row");
-    return { id: row.id, createdAt: row.createdAt };
+        throw await versionConflictWithCurrentVersion(db, event);
+    return insertReturnOf(row);
 }
 // Subsequent event — predecessor must exist AND belong to the same tenant.
 // INSERT … SELECT … WHERE EXISTS is awkward in the typed builder, so this
@@ -147,7 +146,10 @@ async function insertSubsequentEvent(db, event, newVersion, eventVersion, seedCr
         createdAt: seedCreatedAt && instantToTimestamptzParam(seedCreatedAt),
     });
     if (!row)
-        throw new VersionConflictError(event.aggregateId, event.expectedVersion);
+        throw await versionConflictWithCurrentVersion(db, event);
+    return insertReturnOf(row);
+}
+function insertReturnOf(row) {
     const createdAt = row.created_at instanceof Date
         ? Temporal.Instant.fromEpochMilliseconds(row.created_at.getTime())
         : Temporal.Instant.from(row.created_at);
@@ -156,6 +158,12 @@ async function insertSubsequentEvent(db, event, newVersion, eventVersion, seedCr
         createdAt,
     };
 }
+// Runs in the still-healthy write transaction: ON CONFLICT DO NOTHING left it
+// unaborted, so the stream version is readable here.
+async function versionConflictWithCurrentVersion(db, event) {
+    const currentVersion = await selectStreamMaxVersion(db, event.aggregateId, event.tenantId);
+    return new VersionConflictError(event.aggregateId, event.expectedVersion, currentVersion);
+}
 function buildStoredEvent(event, newVersion, eventVersion, row) {
     return {
         id: String(row.id),

package/dist/event-store/events-schema.js

@@ -2,7 +2,7 @@
 import { bigserial, index, instant, integer, jsonb, table as pgTable, sql, text, uniqueIndex, uuid, } from "../db/dialect.js";
 import { tableExists } from "../db/index.js";
 import { ensureIdempotencyKeyIndex, ensureMembershipPayloadTenantIndex, } from "../db/queries/event-store.js";
-import { unsafePushTables } from "../stack/index.js";
+import { unsafePushTables } from "../db/table-push.js";
 import { createArchivedStreamsTable } from "./archive.js";
 import { createSnapshotsTable } from "./snapshot.js";
 // Event-store schema as a Drizzle table. The typed select/insert path handles

package/dist/event-store/rebuild-dead-letter.js

@@ -14,7 +14,7 @@
 // is a separate ops step — same stance as the upcaster dead-letter.
 import { bigint, index, jsonb, table as pgTable, text, timestamp, uuid } from "../db/dialect.js";
 import { tableExists } from "../db/schema-inspection.js";
-import { unsafePushTables } from "../stack/index.js";
+import { unsafePushTables } from "../db/table-push.js";
 export const rebuildDeadLetterTable = pgTable("kumiko_rebuild_dead_letters", {
     // Surrogate PK — the same event can land here across multiple rebuild
     // attempts before the fix ships, without unique-violation noise.
@@ -47,7 +47,7 @@ export async function createRebuildDeadLetterTable(db) {
 // tx). Unqualified insert — during the rebuild the search_path points at the
 // shadow schema, and this table exists only in public, so it falls through.
 export async function recordRebuildDeadLetters(db, projectionName, skipped) {
-    const { insertMany } = await import("../bun-db/query.js");
+    const { insertMany } = await import("../db/query.js");
     await insertMany(db, rebuildDeadLetterTable, skipped.map(({ event, error }) => ({
         projectionName,
         eventId: event.id,
@@ -61,7 +61,7 @@ export async function recordRebuildDeadLetters(db, projectionName, skipped) {
 }
 // Ops-side triage query, optionally scoped to one projection.
 export async function listRebuildDeadLetters(db, options = {}) {
-    const { selectMany } = await import("../bun-db/query.js");
+    const { selectMany } = await import("../db/query.js");
     const limit = options.limit ?? 100;
     const where = options.projectionName !== undefined ? { projectionName: options.projectionName } : undefined;
     return selectMany(db, rebuildDeadLetterTable, where, {

package/dist/event-store/snapshot.js

@@ -4,7 +4,7 @@ import { index, instant, integer, jsonb, table as pgTable, primaryKey, sql, text
 import { ensureSnapshotVersionColumn, upsertSnapshot } from "../db/queries/event-store.js";
 import { selectMany } from "../db/query.js";
 import { tableExists } from "../db/schema-inspection.js";
-import { unsafePushTables } from "../stack/index.js";
+import { unsafePushTables } from "../db/table-push.js";
 import { isStreamArchived } from "./archive.js";
 import { loadEventsAfterVersion } from "./event-store.js";
 // Marten-aligned snapshot store. A snapshot is a point-in-time materialised

package/dist/event-store/upcaster-dead-letter.js

@@ -13,7 +13,7 @@
 // separate CLI step — not implemented here, tracked as follow-up.
 import { bigint, index, integer, jsonb, table as pgTable, text, timestamp, uuid, } from "../db/dialect.js";
 import { tableExists } from "../db/schema-inspection.js";
-import { unsafePushTables } from "../stack/index.js";
+import { unsafePushTables } from "../db/table-push.js";
 export const upcasterDeadLetterTable = pgTable("kumiko_upcaster_dead_letters", {
     // Surrogate PK. We don't reuse eventId so a single event can land
     // here multiple times (retry attempts across deploys before the fix
@@ -49,7 +49,7 @@ export async function createUpcasterDeadLetterTable(db) {
 // ops tooling uses it for correlate-and-replay flows.
 export async function recordUpcasterDeadLetter(db, args) {
     const message = args.error instanceof Error ? args.error.message : String(args.error);
-    const { insertOne } = await import("../bun-db/query.js");
+    const { insertOne } = await import("../db/query.js");
     await insertOne(db, upcasterDeadLetterTable, {
         eventId: args.event.id,
         tenantId: args.event.tenantId,
@@ -65,7 +65,7 @@ export async function recordUpcasterDeadLetter(db, args) {
 // Ops-side query. Loads recent failures, optionally scoped by event-type
 // to triage a single broken migration without pulling the full table.
 export async function listDeadLetters(db, options = {}) {
-    const { selectMany } = await import("../bun-db/query.js");
+    const { selectMany } = await import("../db/query.js");
     const limit = options.limit ?? 100;
     const where = options.eventType !== undefined ? { eventType: options.eventType } : undefined;
     const rows = await selectMany(db, upcasterDeadLetterTable, where, {

package/dist/files/create-file-ref-from-bytes.d.ts

@@ -19,6 +19,7 @@ export type CreateFileRefInput = {
         readonly entityId?: string;
     };
 };
+export declare function filesUnavailableMessage(caller: string): string;
 export declare function createFileRefFromBytes(ctx: CreateFileRefContext, input: CreateFileRefInput): Promise<WriteResult<CreatedFileRef>>;
 export type UploadFileBytesContext = Pick<CreateFileRefContext, "db" | "files" | "registry" | "user">;
 export declare function uploadFileBytesBeforeTransaction(ctx: UploadFileBytesContext, input: CreateFileRefInput): Promise<BeforeTransactionResult<UploadedFileBytes>>;

package/dist/files/create-file-ref-from-bytes.js

@@ -1,9 +1,14 @@
-import { fetchOne } from "../bun-db/query.js";
+import { fetchOne } from "../db/query.js";
 import { FrameworkReasons, InternalError, UnprocessableError, writeFailure, } from "../errors/index.js";
 import { createFileRefRow, DEFAULT_MAX_UPLOAD_SIZE, storeFileAsFileRef, writeAcceptedFileBytes, } from "./create-file-ref.js";
 import { fileRefsTable } from "./file-ref-table.js";
 import { readFilesRouteOptions } from "./file-routes.js";
 import { assertSafeStorageKey } from "./types.js";
+// The handler context has no HTTP/job/seed marker to name, so the message states the actual
+// cause: the dispatcher's AppContext carries no file-provider resolver.
+export function filesUnavailableMessage(caller) {
+    return `${caller}: ctx.files is unavailable because no file-provider resolver is wired on this dispatcher context. Mount a file-provider-* feature and build the dispatcher context with withFileProviderResolver (HTTP, job and seed dispatchers each need it)`;
+}
 // Server-side counterpart of POST /files for handlers/jobs that produce bytes
 // themselves (generated PDFs, exports). Same validation, storage layout and
 // fileRef.created event as an upload; the tenant is always ctx.user.tenantId.
@@ -11,7 +16,7 @@ export async function createFileRefFromBytes(ctx, input) {
     const { files } = ctx;
     if (!files) {
         return writeFailure(new InternalError({
-            message: "createFileRefFromBytes: ctx.files is unavailable — mount a file-provider feature to store files",
+            message: filesUnavailableMessage("createFileRefFromBytes"),
         }));
     }
     const outcome = await storeFileAsFileRef({
@@ -48,7 +53,7 @@ export async function uploadFileBytesBeforeTransaction(ctx, input) {
     const { files } = ctx;
     if (!files) {
         return writeFailure(new InternalError({
-            message: "uploadFileBytesBeforeTransaction: ctx.files is unavailable — mount a file-provider feature to store files",
+            message: filesUnavailableMessage("uploadFileBytesBeforeTransaction"),
         }));
     }
     const outcome = await writeAcceptedFileBytes({

package/dist/files/file-routes.js

@@ -2,8 +2,8 @@ import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { getUser } from "../api/auth-middleware.js";
 import { requestContext } from "../api/request-context.js";
-import { selectMany } from "../bun-db/index.js";
 import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../crypto/index.js";
+import { selectMany } from "../db/query.js";
 import { createProjectingTenantDb } from "../db/tenant-db.js";
 import { createDerivativesContext, resolveFieldVariant, resolveRenderer, } from "../derivatives/index.js";
 import { SYSTEM_USER_ID } from "../engine/system-user.js";

package/dist/internal/stack-support.d.ts

@@ -0,0 +1,12 @@
+export { createDbConnection } from "../db/connection.js";
+export { createDatabase, databaseExists, dropDatabaseIfExists, truncateTablesRestartIdentity, } from "../db/queries/test-stack.js";
+export { type AnyDb, isClosedConnectionError } from "../db/query.js";
+export { columnNamesOf } from "../db/schema-inspection.js";
+export { schemaTableName } from "../db/table-introspection.js";
+export { addMissingColumns, addMissingIndexes, tableToMeta, unsafeCreateEntityTable, unsafeEnsureEntityTable, unsafePushTables, } from "../db/table-push.js";
+export { SEARCHABLE_FALSE_WHITELIST } from "../engine/boot-validator/entity-list-screens.js";
+export { validateNavBootSubset } from "../engine/boot-validator/index.js";
+export { validateOwnershipBoot } from "../engine/boot-validator/ownership.js";
+export { featureHasI18nSurface, requiredKeysFromFeature } from "../i18n/required-surface-keys.js";
+export type { Lifecycle } from "../lifecycle/index.js";
+export { createRateLimitResolver } from "../rate-limit/index.js";

package/dist/internal/stack-support.js

@@ -0,0 +1,12 @@
+// @runtime dev
+export { createDbConnection } from "../db/connection.js";
+export { createDatabase, databaseExists, dropDatabaseIfExists, truncateTablesRestartIdentity, } from "../db/queries/test-stack.js";
+export { isClosedConnectionError } from "../db/query.js";
+export { columnNamesOf } from "../db/schema-inspection.js";
+export { schemaTableName } from "../db/table-introspection.js";
+export { addMissingColumns, addMissingIndexes, tableToMeta, unsafeCreateEntityTable, unsafeEnsureEntityTable, unsafePushTables, } from "../db/table-push.js";
+export { SEARCHABLE_FALSE_WHITELIST } from "../engine/boot-validator/entity-list-screens.js";
+export { validateNavBootSubset } from "../engine/boot-validator/index.js";
+export { validateOwnershipBoot } from "../engine/boot-validator/ownership.js";
+export { featureHasI18nSurface, requiredKeysFromFeature } from "../i18n/required-surface-keys.js";
+export { createRateLimitResolver } from "../rate-limit/index.js";

package/dist/internal/testing.d.ts

@@ -0,0 +1,4 @@
+export { resetBlindIndexKeyForTests } from "../crypto/blind-index.js";
+export { resetEventPiiCatalogForTests } from "../crypto/event-pii.js";
+export { resetPiiSubjectKmsForTests } from "../crypto/pii-field-encryption.js";
+export { resetEntityFieldEncryptionCacheForTests } from "../db/entity-field-encryption.js";

package/dist/internal/testing.js

@@ -0,0 +1,5 @@
+// @runtime test
+export { resetBlindIndexKeyForTests } from "../crypto/blind-index.js";
+export { resetEventPiiCatalogForTests } from "../crypto/event-pii.js";
+export { resetPiiSubjectKmsForTests } from "../crypto/pii-field-encryption.js";
+export { resetEntityFieldEncryptionCacheForTests } from "../db/entity-field-encryption.js";

package/dist/jobs/job-runner.js

@@ -6,6 +6,7 @@ import { Redis } from "ioredis";
 import { requestContext } from "../api/request-context.js";
 import { createTenantDb, createUncheckedSystemDb } from "../db/tenant-db.js";
 import { createDerivativesContext } from "../derivatives/derivatives-context.js";
+import { bridgeStub } from "../engine/bridge-stub.js";
 import { qnScope } from "../engine/qualified-name.js";
 import { createSystemUser } from "../engine/system-user.js";
 import { SYSTEM_TENANT_ID, } from "../engine/types/index.js";
@@ -19,7 +20,6 @@ import { RedisKeys } from "../pipeline/redis-keys.js";
 import { createGatedIdentitySwitch } from "../pipeline/system-identity-switch.js";
 import { TENANT_TIMEZONE_CONFIG_KEY } from "../pipeline/tenant-timezone-config-key.js";
 import { buildPersonalDataGate, isPersonalDataGated, parseWriteOrigin, } from "../pipeline/write-origin.js";
-import { bridgeStub } from "../testing/handler-context.js";
 import { createTzContext, isValidIanaTimeZone } from "../time/index.js";
 import { cronRepeatOptions } from "./cron-repeat-options.js";
 import { resolveMaxPerTenant } from "./max-per-tenant.js";
@@ -429,7 +429,7 @@ export function createJobRunner(options) {
             return undefined;
         return async () => {
             const systemUser = createSystemUser(SYSTEM_TENANT_ID);
-            const systemModeDb = createTenantDb(db, SYSTEM_TENANT_ID, "system");
+            const systemModeDb = createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" });
             const reportEscapeHatch = createEscapeHatchReporter({
                 handler: ACTIVE_TENANT_IDS_QUERY_NAME,
                 tenantId: SYSTEM_TENANT_ID,
@@ -922,9 +922,14 @@ export function createJobRunner(options) {
         // unchecked cross-tenant escape hatch for such a job. Gated like jobDb so
         // ctx.systemDb, built from it, is gated too.
         const tenantScopedDb = configDb
-            ? createTenantDb(configDb, tenantId, "system", undefined, undefined, undefined, {
-                projectionRegistry: registry,
-                ...(jobPersonalDataGate && { personalDataGate: jobPersonalDataGate }),
+            ? createTenantDb({
+                db: configDb,
+                tenantId,
+                mode: "system",
+                grants: {
+                    projectionRegistry: registry,
+                    ...(jobPersonalDataGate && { personalDataGate: jobPersonalDataGate }),
+                },
             })
             : undefined;
         const isSystemJob = registry.isJobSystemScoped(jobName);
@@ -945,12 +950,19 @@ export function createJobRunner(options) {
             ? createUncheckedSystemDb(tenantScopedDb, undefined, reportEscapeHatch)
             : undefined;
         const jobDb = configDb
-            ? createTenantDb(configDb, tenantId, "tenant", context.tracer, context.meter, undefined, {
-                unsafeRaw: escapeHatchFor(jobDef.escapeHatch, "unsafeRaw"),
-                globalWrites: escapeHatchFor(jobDef.escapeHatch, "globalWrites"),
-                report: reportEscapeHatch,
-                projectionRegistry: registry,
-                ...(jobPersonalDataGate && { personalDataGate: jobPersonalDataGate }),
+            ? createTenantDb({
+                db: configDb,
+                tenantId,
+                mode: "tenant",
+                tracer: context.tracer,
+                meter: context.meter,
+                grants: {
+                    unsafeRaw: escapeHatchFor(jobDef.escapeHatch, "unsafeRaw"),
+                    globalWrites: escapeHatchFor(jobDef.escapeHatch, "globalWrites"),
+                    report: reportEscapeHatch,
+                    projectionRegistry: registry,
+                    ...(jobPersonalDataGate && { personalDataGate: jobPersonalDataGate }),
+                },
             })
             : undefined;
         const crossTenantReadsReason = escapeHatchFor(jobDef.escapeHatch, "unsafeRaw")?.reason;

package/dist/migrations/pending-rebuilds.js

@@ -14,9 +14,9 @@ import { instant, table as pgTable, sql, text } from "../db/dialect.js";
 import { deleteMany, selectMany, upsertOnConflict } from "../db/query.js";
 import { readRebuildMarker } from "../db/rebuild-marker.js";
 import { tableExists } from "../db/schema-inspection.js";
+import { unsafePushTables } from "../db/table-push.js";
 import { createFallbackLogger } from "../logging/utils.js";
 import { rebuildMultiStreamProjection, rebuildProjection, } from "../pipeline/index.js";
-import { unsafePushTables } from "../stack/index.js";
 import { buildProjectionTableIndex } from "./projection-table-index.js";
 export const pendingRebuildsTable = pgTable("kumiko_pending_rebuilds", {
     tableName: text("table_name").primaryKey(),

package/dist/migrations/pii-event-backfill.js

@@ -18,8 +18,8 @@ import { alterTableAddColumn } from "../db/queries/ddl.js";
 import { persistPiiBackfillState, readPiiBackfillState, } from "../db/queries/pii-backfill-state.js";
 import { upsertOnConflict } from "../db/query.js";
 import { tableExists } from "../db/schema-inspection.js";
+import { unsafePushTables } from "../db/table-push.js";
 import { createFallbackLogger } from "../logging/utils.js";
-import { unsafePushTables } from "../stack/index.js";
 import { clearPendingRebuilds, createPendingRebuildsTable, listPendingRebuildRows, pendingRebuildsTable, rebuildProjectionOrMultiStream, } from "./pending-rebuilds.js";
 import { buildProjectionTableIndex } from "./projection-table-index.js";
 const PII_EVENT_BACKFILL_LOCK_NAMESPACE = 0x70_69_69_62; // 'piib'
@@ -71,7 +71,7 @@ export function piiAnnotationEntries(registry) {
 // Bump when the backfill gains a transform stage: completed states keyed by the
 // old fingerprint must run one more full pass. Kept out of piiAnnotationEntries,
 // whose emptiness gates no_pii.
-const PII_BACKFILL_TRANSFORM_VERSION = "owner-rekey-v1";
+const PII_BACKFILL_TRANSFORM_VERSION = "owner-rekey-v2";
 export function piiAnnotationFingerprint(registry) {
     return createHash("sha256")
         .update([...piiAnnotationEntries(registry), PII_BACKFILL_TRANSFORM_VERSION].join("\n"))

package/dist/pipeline/dispatch-shared.js

@@ -289,16 +289,24 @@ readOnlyForTenant = false) {
     });
     const identitySwitchGrantReason = identitySwitchEscapeHatch?.reason ??
         (isSystem ? `r.systemScope() feature "${featureName ?? "unknown"}"` : undefined);
-    const buildTenantScopedDb = (source, signal, foreignTenantId, denyWrites = false) => createTenantDb(source, foreignTenantId ?? user.tenantId, isSystem && foreignTenantId === undefined ? "system" : "tenant", context.tracer, context.meter, signal, {
-        ...(foreignTenantId === undefined && {
-            globalWrites: escapeHatchFor(writeEscapeHatch, "globalWrites"),
-            unsafeRaw: escapeHatchFor(handlerEscapeHatch, "unsafeRaw"),
-        }),
-        report: reportEscapeHatch,
-        memberReadOnly: isMemberResolutionPrincipal(user),
-        personalDataGate: buildPersonalDataGate(registry, origin),
-        projectionRegistry: registry,
-        ...(denyWrites && { writesDeniedReason: "without an open transaction" }),
+    const buildTenantScopedDb = (source, signal, foreignTenantId, denyWrites = false) => createTenantDb({
+        db: source,
+        tenantId: foreignTenantId ?? user.tenantId,
+        mode: isSystem && foreignTenantId === undefined ? "system" : "tenant",
+        tracer: context.tracer,
+        meter: context.meter,
+        signal,
+        grants: {
+            ...(foreignTenantId === undefined && {
+                globalWrites: escapeHatchFor(writeEscapeHatch, "globalWrites"),
+                unsafeRaw: escapeHatchFor(handlerEscapeHatch, "unsafeRaw"),
+            }),
+            report: reportEscapeHatch,
+            memberReadOnly: isMemberResolutionPrincipal(user),
+            personalDataGate: buildPersonalDataGate(registry, origin),
+            projectionRegistry: registry,
+            ...(denyWrites && { writesDeniedReason: "without an open transaction" }),
+        },
     });
     // Propagate the request's AbortSignal so every TenantDb query throws when
     // the client has disconnected — handlers with many sequential queries skip
@@ -410,7 +418,14 @@ readOnlyForTenant = false) {
             const targetSystemUser = createSystemUser(targetTenantId);
             return configFactory({
                 user: { id: targetSystemUser.id, tenantId: targetTenantId },
-                db: createTenantDb(dbSource, targetTenantId, "tenant", context.tracer, context.meter, undefined, { projectionRegistry: registry }),
+                db: createTenantDb({
+                    db: dbSource,
+                    tenantId: targetTenantId,
+                    mode: "tenant",
+                    tracer: context.tracer,
+                    meter: context.meter,
+                    grants: { projectionRegistry: registry },
+                }),
                 secrets: context.secrets,
             });
         }
@@ -886,9 +901,7 @@ readOnlyForTenant = false) {
         // Finger an typo-resistenten ctx.user-Patterns. Identisch zum
         // event.user-Wert; Identity-Switches nutzen weiterhin queryAs/writeAs.
         user,
-        _userId: user.id,
         _tenantId: user.tenantId,
-        _handlerType: type,
         ...(hasLiveCommitSink && { scheduleAfterCommit }),
         ...(includeDeleted && { includeDeleted: true }),
         ...bridge,
@@ -1219,16 +1232,23 @@ function buildAuthClaimsContext(ctx, user) {
             message: "dispatcher.resolveAuthClaims requires a database connection — none is configured.",
         });
     }
-    const db = createTenantDb(dbSource, user.tenantId, "tenant", context.tracer, context.meter, undefined, {
-        report: createEscapeHatchReporter({
-            handler: "r.authClaims hook",
-            tenantId: user.tenantId,
-            actor: user.id,
-            sink: context._escapeHatchAuditSink,
-            log: context.log ?? createFallbackLogger("dispatcher"),
-            window: ctx.escapeHatchReportWindow,
-        }),
-        projectionRegistry: ctx.registry,
+    const db = createTenantDb({
+        db: dbSource,
+        tenantId: user.tenantId,
+        mode: "tenant",
+        tracer: context.tracer,
+        meter: context.meter,
+        grants: {
+            report: createEscapeHatchReporter({
+                handler: "r.authClaims hook",
+                tenantId: user.tenantId,
+                actor: user.id,
+                sink: context._escapeHatchAuditSink,
+                log: context.log ?? createFallbackLogger("dispatcher"),
+                window: ctx.escapeHatchReportWindow,
+            }),
+            projectionRegistry: ctx.registry,
+        },
     });
     const configAccessor = context._configAccessorFactory
         ? context._configAccessorFactory({

package/dist/pipeline/dispatch-write.js

@@ -163,7 +163,7 @@ async function isParentRowHiddenFromCaller(ctx, parentEntityName, parentId, user
     const source = resolveDbSource(ctx, tx);
     if (!table || !source)
         return true;
-    const callerDb = createTenantDb(source, user.tenantId, "tenant");
+    const callerDb = createTenantDb({ db: source, tenantId: user.tenantId, mode: "tenant" });
     const visibleRow = await callerDb.fetchOne(table, { id: parentId });
     if (visibleRow === undefined)
         return true;
@@ -181,7 +181,11 @@ async function completeParentRow(ctx, parentEntityName, parentEntity, parentRow,
     const source = resolveDbSource(ctx, tx);
     if (!table || !source || typeof parentRow["id"] !== "string")
         return parentRow;
-    const stored = await createTenantDb(source, user.tenantId, "tenant").fetchOne(table, {
+    const stored = await createTenantDb({
+        db: source,
+        tenantId: user.tenantId,
+        mode: "tenant",
+    }).fetchOne(table, {
         id: parentRow["id"],
     });
     return stored ? { ...stored, ...parentRow } : parentRow;

package/dist/pipeline/dispatcher-utils.js

@@ -143,10 +143,14 @@ export function resolveType(type) {
 // A custom write losing an append race (ctx.appendEvent, stream.append) is a
 // retryable 409 like the CRUD executor's, not an internal error. Mapped here
 // because errors/ is client code and must not import the event store.
-// currentVersion -1 is the executor's "not looked up" sentinel.
+// currentVersion -1 is the "not looked up" sentinel for a bare 23505 fallback.
 export function wrapToKumiko(e) {
     if (e instanceof EventStoreVersionConflictError) {
-        return new VersionConflictError({ entityId: e.aggregateId, expectedVersion: e.expectedVersion, currentVersion: -1 }, { cause: e });
+        return new VersionConflictError({
+            entityId: e.aggregateId,
+            expectedVersion: e.expectedVersion,
+            currentVersion: e.currentVersion ?? -1,
+        }, { cause: e });
     }
     return toKumikoError(e);
 }

package/dist/pipeline/event-consumer-state.js

@@ -1,7 +1,7 @@
 import { bigint, index, instant, integer, jsonb, table as pgTable, primaryKey, sql, text, } from "../db/dialect.js";
 import { alterTableAddColumn } from "../db/queries/ddl.js";
 import { tableExists } from "../db/schema-inspection.js";
-import { unsafePushTables } from "../stack/index.js";
+import { unsafePushTables } from "../db/table-push.js";
 // Reserved sentinel used in the instance_id column for consumers whose
 // delivery is "shared" — i.e. one cursor across all dispatcher instances
 // (the default, pre-Welle-2.7 behaviour). Per-instance consumers store

package/dist/pipeline/projection-rebuild.d.ts

@@ -2,6 +2,7 @@
 import type { DbConnection } from "../db/connection.js";
 import type { Registry } from "../engine/types/index.js";
 import type { Meter } from "../observability/types/metric.js";
+export declare const REBUILD_BATCH_SIZE = 1000;
 export type RebuildResult = {
     readonly projection: string;
     readonly eventsProcessed: number;

package/dist/pipeline/projection-rebuild.js

@@ -8,7 +8,7 @@ import { projectionStateTable } from "./projection-state.js";
 // Events replayed per catch-up batch. Each batch is a fresh READ COMMITTED
 // SELECT, so a batch shorter than this means the currently-committed tail is
 // drained.
-const REBUILD_BATCH_SIZE = 1000;
+export const REBUILD_BATCH_SIZE = 1000;
 // Cap on UNLOCKED catch-up batches before forcing the cutover fence. Bounds the
 // lock-free phase under sustained writes that never momentarily quiesce; the
 // fenced final drain then always terminates (no new event can commit once the

package/dist/pipeline/projection-state.js

@@ -1,6 +1,6 @@
 import { bigint, index, instant, table as pgTable, sql, text } from "../db/dialect.js";
 import { tableExists } from "../db/schema-inspection.js";
-import { unsafePushTables } from "../stack/index.js";
+import { unsafePushTables } from "../db/table-push.js";
 // Framework-level state for every registered projection. One row per qualified
 // projection name. Written by the rebuild machinery; read by the CLI + any
 // status dashboard. Lives alongside the events table as framework infra —

package/dist/pipeline/system-hooks.js

@@ -206,7 +206,7 @@ async function readProjectionRowForSearch(ctx, registry, entityName, entity, ten
     if (entity.softDelete && table["isDeleted"]) {
         where["isDeleted"] = false;
     }
-    const row = await createTenantDb(baseDb, tenantId).fetchOne(table, where);
+    const row = await createTenantDb({ db: baseDb, tenantId }).fetchOne(table, where);
     if (!row)
         return undefined;
     const state = rehydrateCompoundTypes(row, entity);

package/dist/schema-cli.js

@@ -303,7 +303,7 @@ export async function runSchemaCli(argv, appCwd, out, options = {}) {
                 out.err(`  ${migrationsDir} fehlt — erst schema generate <name>.`);
                 return 1;
             }
-            const { db, close } = createDbConnection(dbUrl);
+            const { db, close } = createDbConnection({ url: dbUrl });
             let wiring;
             try {
                 const result = await runMigrationsFromDir(db, migrationsDir);
@@ -386,7 +386,7 @@ export async function runSchemaCli(argv, appCwd, out, options = {}) {
                 out.err(`  ${migrationsDir} fehlt — erst schema generate <name>.`);
                 return 1;
             }
-            const { db, close } = createDbConnection(dbUrl);
+            const { db, close } = createDbConnection({ url: dbUrl });
             try {
                 const result = await baselineMigrations(db, loadMigrationsFromDir(migrationsDir));
                 out.log("");
@@ -418,7 +418,7 @@ export async function runSchemaCli(argv, appCwd, out, options = {}) {
                 return 0;
             }
             const local = loadMigrationsFromDir(migrationsDir);
-            const { db, close } = createDbConnection(dbUrl);
+            const { db, close } = createDbConnection({ url: dbUrl });
             try {
                 // Frische DB ohne je gelaufenes `kumiko schema apply` → tracking-table
                 // fehlt = "nichts applied". Connection-/Permission-Fehler dagegen

package/dist/search/purge-subject.js

@@ -9,7 +9,7 @@
 //      that still carry the subject key in encrypted columns.
 import { quoteIdent, subjectCiphertextLikePattern } from "../crypto/ciphertext-pattern.js";
 import { isSelfPiiField } from "../crypto/is-self-pii-field.js";
-import { collectSearchableSubjectFields } from "../crypto/subject-resolver.js";
+import { collectSearchableSubjectFields, isRecordKeyedField } from "../crypto/subject-resolver.js";
 import { resolveTableName } from "../db/entity-table-meta.js";
 import { executeRawQueryRead } from "../db/queries/raw-sql.js";
 import { columnNamesOf, tableExists } from "../db/schema-inspection.js";
@@ -63,20 +63,30 @@ function tenantOwnershipPredicates(entity, searchableFields, tenantId, nextParam
     return finalizePredicateParts(parts, params);
 }
 function recordOwnershipPredicates(entity, searchableFields, entityName, subjectEntity, subjectId, nextParam) {
-    const parts = [];
-    const params = [];
-    let recordIdN;
+    const ownerlessColumns = new Set();
+    let hasRecordOwnedField = false;
     for (const fieldName of searchableFields) {
         const field = entity.fields[fieldName];
-        if (!field)
+        if (!field || entityName !== subjectEntity || !isRecordKeyedField(field))
             continue;
-        const isMatchingRecordField = entityName === subjectEntity && "recordOwned" in field && field.recordOwned === true;
-        if (isMatchingRecordField && recordIdN === undefined) {
-            recordIdN = nextParam();
-            params.push(subjectId);
-            parts.push(`${quoteIdent("id")} = $${recordIdN}`);
+        if ("recordOwned" in field && field.recordOwned === true) {
+            hasRecordOwnedField = true;
+        }
+        else if ("userOwned" in field && field.userOwned !== undefined) {
+            ownerlessColumns.add(toSnakeCase(field.userOwned.ownerField));
         }
     }
+    if (!hasRecordOwnedField && ownerlessColumns.size === 0)
+        return null;
+    const idN = nextParam();
+    const parts = [];
+    if (hasRecordOwnedField)
+        parts.push(`${quoteIdent("id")} = $${idN}`);
+    // whenAbsent: "self" keys a row on itself only while its owner is empty
+    for (const col of ownerlessColumns) {
+        parts.push(`(${quoteIdent("id")} = $${idN} AND (${quoteIdent(col)} IS NULL OR ${quoteIdent(col)}::text = ''))`);
+    }
+    const params = [subjectId];
     return finalizePredicateParts(parts, params);
 }
 /** Build OR predicates for rows owned by `subject` (id / ownerField / tenant_id). */

package/dist/seeding/index.d.ts

@@ -1,2 +1,3 @@
 export { type EventStoreSeedExisting, type RunEventStoreSeedOptions, runEventStoreSeed, } from "./entity-seed.js";
+export { createTestUser, TestUsers, testTenantId, testUserId } from "./seed-users.js";
 export { DEFAULT_SEED_IF_EXISTS, type SeedIfExists } from "./types.js";

package/dist/seeding/index.js

@@ -1,2 +1,3 @@
 export { runEventStoreSeed, } from "./entity-seed.js";
+export { createTestUser, TestUsers, testTenantId, testUserId } from "./seed-users.js";
 export { DEFAULT_SEED_IF_EXISTS } from "./types.js";