@cosmicdrift/kumiko-framework 0.373.0 → 0.377.0

package/AGENTS.md

@@ -10,7 +10,7 @@ not exist in your version:
 | File | What it holds |
 | --- | --- |
 | `agents/features.md` | Every bundled feature: name, purpose, config keys, dependencies |
-| `agents/widgets.md` | Every value export of `@cosmicdrift/kumiko-renderer-web` with its short description |
+| `agents/widgets.md` | Every value export of `@cosmicdrift/kumiko-renderer/web` with its short description |
 | `agents/examples.md` | Index of the worked examples, one per concept |
 | `agents/examples/<name>.md` | One tested sample app: README plus every source and test file |
 
@@ -238,7 +238,7 @@ produces code that compiles and then fails in production.
 - Never write your own JSX for a list, form, detail page or dashboard.
   Declare a screen. Use `type: "custom"` only when no screen type fits.
 - Inside a custom screen, never build your own card, table, badge, button or
-  chart. Use the widgets from `@cosmicdrift/kumiko-renderer-web`
+  chart. Use the widgets from `@cosmicdrift/kumiko-renderer/web`
   (`agents/widgets.md`) and the primitives from `usePrimitives()`.
 - Never fetch data with `useEffect` plus `fetch`. Use `useQuery`
   (`live: true` for server-sent updates) and `useMutation`.

package/agents/examples/apex-landing.md

@@ -238,7 +238,7 @@ import {
   type ApexPage,
   type ApexPricingTier,
   renderApexPage,
-} from "@cosmicdrift/kumiko-headless/apex";
+} from "@cosmicdrift/kumiko-renderer/headless/apex";
 import { HERO_SCREENSHOT } from "./constants";
 
 // --- Inputs: shapes the surrounding features hand you -----------------------

package/agents/examples/apex-surface-auth.md

@@ -42,7 +42,7 @@ import {
 import {
   RequestAccountDeletionScreen, ConfirmAccountDeletionScreen,
 } from "@cosmicdrift/kumiko-bundled-features/user-data-rights/web";
-import { createPublicSurface } from "@cosmicdrift/kumiko-renderer-web";
+import { createPublicSurface } from "@cosmicdrift/kumiko-renderer/web";
 
 // createLoginRoute, not a raw LoginScreen render — it owns the challenge-
 // swap for a second factor, so mounting auth-mfa later doesn't need this
@@ -252,7 +252,7 @@ describe("apex-surface-auth recipe", () => {
 //   2. Client (Kommentar unten + README): wie createPublicSurface + AuthShell
 //      die Screens in der Apex-Chrome mounten.
 //
-// CLIENT-WIRING (apex.tsx der App — renderer-web, hier nur als Referenz, da
+// CLIENT-WIRING (apex.tsx der App — renderer/web, hier nur als Referenz, da
 // Recipes keine Browser-Deps ziehen):
 //
 //   import {
@@ -263,7 +263,7 @@ describe("apex-surface-auth recipe", () => {
 //     RequestAccountDeletionScreen, ConfirmAccountDeletionScreen,
 //     defaultTranslations as deletionI18n,
 //   } from "@cosmicdrift/kumiko-bundled-features/user-data-rights/web";
-//   import { createPublicSurface } from "@cosmicdrift/kumiko-renderer-web";
+//   import { createPublicSurface } from "@cosmicdrift/kumiko-renderer/web";
 //
 //   // AuthShell: die Auth-Card rendert in der Marketing-Chrome statt
 //   // Fullscreen. Default (ohne Provider) bleibt der Fullscreen-Wrapper.

package/agents/examples/compose-stacks.md

@@ -44,22 +44,25 @@ the option.
 | `composeGdprStack` | `kmsMode` | `kms` or `allowPlaintextPii` |
 | `composeGdprStack({ selfService })`, `composeUserDataRightsStack` | `mail` | a mounted `channel-email` |
 | `composeSecurityStack` | `kmsMode`, `rateLimit` not `false` | `kms` or `allowPlaintextPii` |
-| `composeSaasStack({ billing: "stripe" })` | `billing` | a mounted subscription provider |
+| `composeSaasStack({ billing: "stripe" })` | `billing` (warning only) | a mounted subscription provider |
 
 A missing option fails the boot with:
 
 ```
 [runProdApp] stacks in `features` need boot options that are not set:
-  - composeSaasStack needs the boot option `billing`: set billing: { stripe: { priceToTier }, defaultTier }
+  - composeGdprStack needs the boot option `kmsMode`: set kmsMode: "required" (or { plaintextReason } for a demo)
 ```
 
+A stripe `composeSaasStack` without `billing` boots and logs the same line as a warning, so an
+app can go live before its prices exist.
+
 ## Flow
 
 1. `src/app.ts` lists the stacks and the boot options they need.
 2. The test boots with `KUMIKO_DRY_RUN_ENV=boot`, which runs the whole
    validation and stops before any DB or Redis connection: with the options
-   the boot passes, without `billing` or `kmsMode` it fails and names the
-   stacks.
+   the boot passes, without `kmsMode` it fails and names the stacks, and
+   without `billing` it warns.
 
 ## Tests
 
@@ -122,11 +125,15 @@ describe("compose stacks recipe", () => {
     expect(lines.some((line: string) => line.includes("boot validation OK"))).toBe(true);
   });
 
-  test("a missing billing option names composeSaasStack and the option", async () => {
+  test("a missing billing option only warns and names composeSaasStack", async () => {
     const { billing: _billing, ...withoutBilling } = bootOptions();
-    await expect(bootValidate(withoutBilling)).rejects.toThrow(
-      "composeSaasStack needs the boot option `billing`",
-    );
+    await bootValidate(withoutBilling);
+    const warnings = warnSpy.mock.calls.map((call: unknown[]) => String(call[0]));
+    expect(
+      warnings.some((line: string) =>
+        line.includes("composeSaasStack needs the boot option `billing`"),
+      ),
+    ).toBe(true);
   });
 
   test("a missing KMS decision names every stack that needs it", async () => {

package/agents/examples/embedded-entity-form.md

@@ -471,7 +471,7 @@ export const prospectAcceptScreen: EntityEditScreenDefinition = {
 ```tsx
 import type { RenderEditControls } from "@cosmicdrift/kumiko-renderer";
 import { RenderEdit, useDispatcher, usePrimitives } from "@cosmicdrift/kumiko-renderer";
-import { Drawer } from "@cosmicdrift/kumiko-renderer-web";
+import { Drawer } from "@cosmicdrift/kumiko-renderer/web";
 import { type ReactNode, useMemo, useRef, useState } from "react";
 import { z } from "zod";
 import { prospectEntity } from "../entities/prospect";

package/agents/examples/notes-history-basic.md

@@ -55,7 +55,7 @@ handler as above. Register `notesHistoryClient()` once (for its component +
 i18n), then mount it either way:
 
 ```tsx illustration
-import { createKumikoApp } from "@cosmicdrift/kumiko-renderer-web";
+import { createKumikoApp } from "@cosmicdrift/kumiko-renderer/web";
 import { notesHistoryClient, NotesSection, NOTES_SECTION_EXTENSION_NAME } from "@cosmicdrift/kumiko-bundled-features/notes-history/web";
 
 // once, at app boot — required even for standalone use (registers i18n):

package/agents/examples/tags-basic.md

@@ -56,7 +56,7 @@ as above. Register `tagsClient()` once (for its component + i18n), then mount it
 either way:
 
 ```tsx illustration
-import { createKumikoApp } from "@cosmicdrift/kumiko-renderer-web";
+import { createKumikoApp } from "@cosmicdrift/kumiko-renderer/web";
 import { tagsClient, TagSection, TAGS_SECTION_EXTENSION_NAME } from "@cosmicdrift/kumiko-bundled-features/tags/web";
 
 // once, at app boot — required even for standalone use (registers i18n):

package/agents/examples/user-profile.md

@@ -54,7 +54,7 @@ itself needs no client registration):
 ```tsx illustration
 import { userProfileClient } from "@cosmicdrift/kumiko-bundled-features/user-profile/web";
 import { emailPasswordClient } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web";
-import { createKumikoApp } from "@cosmicdrift/kumiko-renderer-web";
+import { createKumikoApp } from "@cosmicdrift/kumiko-renderer/web";
 
 createKumikoApp({
   clientFeatures: [emailPasswordClient(), userProfileClient()],

package/agents/examples/wizard-form.md

@@ -338,11 +338,11 @@ export const listingsFeature = defineFeature("listings", (r) => {
 // A `kind: "extension"` section only resolves through
 // clientFeatures.extensionSectionComponents (createKumikoApp → ExtensionSectionsProvider)
 // — never imported directly from feature.ts, which keeps the server file
-// free of the renderer-web graph. Without registering this export, an app
+// free of the renderer/web graph. Without registering this export, an app
 // mounting this recipe gets RenderEdit's fallback placeholder instead of
 // the real review step.
 
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { ListingReviewSection } from "./listing-review-section";
 
 export const listingsClient: ClientFeatureDefinition = {
@@ -355,13 +355,13 @@ export const listingsClient: ClientFeatureDefinition = {
 
 ```tsx
 import type { ExtensionSectionProps } from "@cosmicdrift/kumiko-renderer";
-import { DetailList } from "@cosmicdrift/kumiko-renderer-web";
+import { DetailList } from "@cosmicdrift/kumiko-renderer/web";
 import type { ReactNode } from "react";
 
 // Registered under the `__component` name the feature's review section
 // points at (see feature.ts) — never imported by feature.ts itself, the
 // string name is the only link so the server file stays free of the
-// renderer-web graph.
+// renderer/web graph.
 export function ListingReviewSection({ values }: ExtensionSectionProps): ReactNode {
   return (
     <DetailList

package/agents/widgets.md

@@ -1,8 +1,8 @@
-<!-- Generated by `bun run gen:agent-docs` from packages/renderer-web/src/index.ts. Do not edit. -->
+<!-- Generated by `bun run gen:agent-docs` from packages/renderer/src/web/index.ts. Do not edit. -->
 
 # Widgets
 
-Value exports of `@cosmicdrift/kumiko-renderer-web`.
+Value exports of `@cosmicdrift/kumiko-renderer/web`.
 
 ## Components
 
@@ -118,6 +118,7 @@ Value exports of `@cosmicdrift/kumiko-renderer-web`.
 | `useDraft` | Formular-State für Rechner-Screens: ein Draft-Objekt + `patch` für Teil-Updates + `field(name)` das die `{ id, name, value, onChange }`-Props fertig für die Feld-Widgets (NumberField/MoneyField/PercentField) liefert. |
 | `useForm` |  |
 | `useIsNarrowViewport` |  |
+| `useIsViewportBelow` |  |
 | `useLiveEvents` | Hook für useQuery-like Consumer. |
 | `useLocale` | Liefert den aktuellen LocaleResolver und abonniert automatisch Locale-Änderungen — der aufrufende Component re-rendert sobald die Sprache gewechselt wird. |
 | `useNav` |  |
@@ -173,7 +174,7 @@ Value exports of `@cosmicdrift/kumiko-renderer-web`.
 | --- | --- |
 | `BROWSER_LOCALE_STORAGE_KEY` |  |
 | `STATUS_TONE_TEXT` |  |
-| `cssVarTokens` | Tokens mit var-string-Werten. |
+| `cssVarTokens` | Tokens with var-string values. |
 | `defaultPrimitives` |  |
 | `defaultTokens` | Default-Tokens — identisch zu `cssVarTokens` (var-string-refs). |
 | `lightTokens` |  |

package/dist/api/index.d.ts

@@ -3,7 +3,7 @@ export { deleteTenantCookie, setTenantCookie } from "./anonymous-cookie.ts";
 export { collectAnonymousLiveEntities } from "./anonymous-live-entities.ts";
 export { LOCALE_HEADER_NAME, NO_ROUTE_MATCH_HEADER_NAME } from "./api-constants.ts";
 export type { AnonymousAccessConfig, AnonymousAccessResolved, AuthMiddlewareOptions, AuthSessionChecker, AuthSessionCheckResult, AuthSessionStatus, TenantExists, TenantLifecycleStatusResolver, TenantResolver, TokenVerifier, } from "./auth-middleware.ts";
-export { authMiddleware, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.ts";
+export { authMiddleware, CSRF_HEADER_NAME, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.ts";
 export type { AuthRoutesConfig, LoginRateLimiter, SessionChecker, SessionCreator, SessionMassRevoker, SessionMetadata, SessionRevoker, } from "./auth-routes.ts";
 export { createAuthRoutes, createInMemoryLoginRateLimiter, createRedisLoginRateLimiter, } from "./auth-routes.ts";
 export type { ClientIpHeaderSource, ClientIpResolver } from "./client-ip.ts";

package/dist/api/index.js

@@ -1,7 +1,7 @@
 export { deleteTenantCookie, setTenantCookie } from "./anonymous-cookie.js";
 export { collectAnonymousLiveEntities } from "./anonymous-live-entities.js";
 export { LOCALE_HEADER_NAME, NO_ROUTE_MATCH_HEADER_NAME } from "./api-constants.js";
-export { authMiddleware, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.js";
+export { authMiddleware, CSRF_HEADER_NAME, getUser, PAT_TOKEN_PREFIX, sessionCheckStatus, } from "./auth-middleware.js";
 export { createAuthRoutes, createInMemoryLoginRateLimiter, createRedisLoginRateLimiter, } from "./auth-routes.js";
 export { assertValidTrustedProxyHops, clientIpSourceFromHonoContext, createClientIpResolver, extractSocketAddress, parseTrustedProxyHopsEnv, TRUSTED_PROXY_HOPS_ENV, UNKNOWN_CLIENT_IP, } from "./client-ip.js";
 export { ExtraRouteEntries, ExtraRouteRejection, signatureRoute } from "./extra-route.js";

package/dist/api/routes.js

@@ -11,8 +11,8 @@ import { patAllows } from "./pat-scope.js";
 import { requestContext } from "./request-context.js";
 import { SSE_HEARTBEAT_INTERVAL_MS } from "./sse-route.js";
 // SSE frame event names for POST /api/stream. Parallel definition lives in
-// @cosmicdrift/kumiko-headless (dispatcher-live imports that one) — framework
-// cannot depend on headless for four string literals.
+// @cosmicdrift/kumiko-renderer/headless (the live dispatcher imports that one) — framework
+// cannot depend on the renderer for four string literals.
 export const StreamFrame = {
     chunk: "chunk",
     ping: "ping",

package/dist/api/server.js

@@ -18,6 +18,7 @@ import { createRecordWriteCheck } from "../files/record-write-check.js";
 import { createFallbackLogger } from "../logging/index.js";
 import { createNoopProvider, registerStandardMetrics, wrapRedisClient, } from "../observability/index.js";
 import { resolveTenantLifecyclePlugin } from "../pipeline/active-membership.js";
+import { configAccessorFactoryOf } from "../pipeline/config-accessor-factory.js";
 import { createDispatcher } from "../pipeline/dispatcher.js";
 import { SHARED_INSTANCE_SENTINEL } from "../pipeline/event-consumer-state.js";
 import { createEventDispatcher } from "../pipeline/event-dispatcher.js";
@@ -63,7 +64,7 @@ export function withFileProviderResolver(registry, context, cacheSync) {
         ...context,
         _fileProviderResolver: makeFileProviderResolver({
             registry,
-            _configAccessorFactory: context._configAccessorFactory,
+            _configAccessorFactory: configAccessorFactoryOf(context),
             secrets: context.secrets,
             db: context.db,
             ...(cacheSync ? { cacheSync } : {}),

package/dist/config/index.d.ts

@@ -27,6 +27,10 @@ export type AppConfig = {
     readonly features: readonly FeatureDefinition[];
     /** Features mounted only in production on top of `features`. */
     readonly prodFeatures?: readonly FeatureDefinition[];
+    /** Whether the app boots with the bundled auth features (config/user/tenant/auth-email-password)
+     *  that composeFeatures adds; the schema tooling needs their tables. Unset: derived from the
+     *  feature list. */
+    readonly includeBundled?: boolean;
     readonly client: AppClientConfig;
     readonly ports: AppPorts;
     /** Passed to validateBoot by `kumiko check` and, via the app's bin files, by the runners. */

package/dist/db/index.d.ts

@@ -35,5 +35,5 @@ export { diffReplayAgainstSnapshot, type ReplayedSchema, type ReplayedTable, typ
 export { findCommentedDropTables, isRetiredFrameworkTable, type RetiredFrameworkTable, retiredFrameworkTables, } from "./retired-framework-tables.ts";
 export { tableExists } from "./schema-inspection.ts";
 export { buildBaseColumns, buildEntityTable, declareGlobalTenancy, type EntityRow, type EntityTable, physicalColumnName, toSnakeCase, toTableName, } from "./table-builder.ts";
-export type { CreateTenantDbOptions, TenantDb, TenantDbGrants, TenantDbMode, UncheckedSystemDb, } from "./tenant-db.ts";
-export { castTenantRows, createSystemDbView, createTenantDb, runInOwnTransaction, SYSTEM_SCOPE_CHECK_BRAND, scopeTenantDbToTenant, } from "./tenant-db.ts";
+export type { CreateTenantDbOptions, OutsideTransactionContext, TenantDb, TenantDbGrants, TenantDbMode, UncheckedSystemDb, } from "./tenant-db.ts";
+export { castTenantRows, createSystemDbView, createTenantDb, hasOutsideTransactionDb, requireOutsideTransactionDb, runInOwnTransaction, SYSTEM_SCOPE_CHECK_BRAND, scopeTenantDbToTenant, } from "./tenant-db.ts";

package/dist/db/index.js

@@ -28,4 +28,4 @@ export { diffReplayAgainstSnapshot, replayMigrationsDir, } from "./replay-migrat
 export { findCommentedDropTables, isRetiredFrameworkTable, retiredFrameworkTables, } from "./retired-framework-tables.js";
 export { tableExists } from "./schema-inspection.js";
 export { buildBaseColumns, buildEntityTable, declareGlobalTenancy, physicalColumnName, toSnakeCase, toTableName, } from "./table-builder.js";
-export { castTenantRows, createSystemDbView, createTenantDb, runInOwnTransaction, SYSTEM_SCOPE_CHECK_BRAND, scopeTenantDbToTenant, } from "./tenant-db.js";
+export { castTenantRows, createSystemDbView, createTenantDb, hasOutsideTransactionDb, requireOutsideTransactionDb, runInOwnTransaction, SYSTEM_SCOPE_CHECK_BRAND, scopeTenantDbToTenant, } from "./tenant-db.js";

package/dist/db/migrate-runner.js

@@ -111,8 +111,18 @@ export function splitSqlStatements(sqlText) {
             current += ch;
             continue;
         }
-        if (ch === "$" && /^\$([A-Za-z_]\w*)?\$/.test(sqlText.slice(i))) {
-            throw new Error("splitSqlStatements: unsupported dollar-quoted body — migration SQL is malformed, refusing to split");
+        if (ch === "$") {
+            const opening = /^\$([A-Za-z_]\w*)?\$/.exec(sqlText.slice(i))?.[0];
+            if (opening !== undefined) {
+                // Body is copied verbatim: `;` and quotes inside a DO/function body belong to it.
+                const closeAt = sqlText.indexOf(opening, i + opening.length);
+                if (closeAt === -1) {
+                    throw new Error(`splitSqlStatements: unterminated dollar-quoted body ${opening} — migration SQL is malformed, refusing to split`);
+                }
+                current += sqlText.slice(i, closeAt + opening.length);
+                i = closeAt + opening.length - 1;
+                continue;
+            }
         }
         if (ch === ";") {
             statements.push(current);
@@ -122,8 +132,6 @@ export function splitSqlStatements(sqlText) {
         current += ch;
     }
     if (state === "blockComment" || state === "singleQuote" || state === "doubleQuote") {
-        // Does not track dollar-quoted (`$$...$$`) bodies — none of this repo's
-        // migrations use them; add that state if one ever does.
         throw new Error(`splitSqlStatements: unterminated ${state} — migration SQL is malformed, refusing to split`);
     }
     statements.push(current);

package/dist/db/money.js

@@ -10,7 +10,7 @@
 //                round-tripping the float amount through /100·*100.
 //                `amountMinor` stays as a @deprecated alias of the same
 //                value until #1976/4 and #1976/5 migrate their remaining
-//                consumers (renderer-web/primitives/index.tsx,
+//                consumers (renderer/web/primitives/index.tsx,
 //                renderer/components/render-field.tsx) off the old name.
 //
 // table-builder.ts's moneyAmount column has always documented BIGINT as

package/dist/db/query.js

@@ -44,7 +44,7 @@ function snakeToCamel(key) {
 // the only collision-safe path.
 export { asEntityTableMeta, requireEntityTableMeta };
 export function hasBegin(client) {
-    // Bun.SQL tx/savepoint handles keep a begin() that throws; only savepoint() tells them apart from a pool.
+    // Tx/savepoint handles can keep a begin() that throws; only savepoint() tells them apart from a pool.
     return typeof client.begin === "function" && typeof client.savepoint !== "function";
 }
 function isRawClient(value) {
@@ -77,7 +77,7 @@ export function asRawClient(db) {
 export function runnerCanBeginTransaction(db) {
     return hasBegin(asRawClient(db));
 }
-// postgres.js / Bun.SQL reject the WHOLE begin() when any statement inside
+// postgres.js rejects the WHOLE begin() when any statement inside
 // it errored — even if the JS error was caught (the driver tracks per-block
 // query failures). Error confinement therefore must go through the driver's
 // own savepoint(), not manual SAVEPOINT statements. The callback receives
@@ -85,7 +85,7 @@ export function runnerCanBeginTransaction(db) {
 export async function runInSavepoint(tx, fn) {
     const raw = asRawClient(tx);
     if (typeof raw.savepoint !== "function") {
-        throw new Error("runInSavepoint: transaction handle has no savepoint() — pass the driver tx (postgres.js TransactionSql / Bun.SQL).");
+        throw new Error("runInSavepoint: transaction handle has no savepoint() — pass the driver tx (postgres.js TransactionSql).");
     }
     return raw.savepoint(fn);
 }
@@ -180,7 +180,7 @@ function isWhereOperator(v) {
 export function extractTableInfo(table) {
     const meta = asEntityTableMeta(table);
     if (!meta) {
-        throw new Error("bun-db.extractTableInfo: table is not a kumiko EntityTableMeta — " +
+        throw new Error("extractTableInfo: table is not a kumiko EntityTableMeta — " +
             "build it via buildEntityTable / deriveEntityTableMeta / table().");
     }
     const colByField = new Map();
@@ -282,7 +282,7 @@ function isTemporalPlainDateTimeLike(v) {
         "toPlainDate" in v &&
         typeof v.toPlainDate === "function");
 }
-// Verified empirically against Bun.SQL (kumiko-framework#1924): a `date`
+// Verified empirically (kumiko-framework#1924): a `date`
 // column comes back as a native JS Date, but ALWAYS anchored at UTC
 // midnight regardless of process TZ — epochMilliseconds is stable across
 // zones, only the local wall-clock read of that Date would drift the day
@@ -296,7 +296,7 @@ function isTemporalPlainDateTimeLike(v) {
 // the day, so say so once per column instead of returning the wrong day quietly.
 const warnedNonMidnightDateColumns = new Set();
 const MS_PER_DAY = 86_400_000;
-const dateColumnDriftLog = createFallbackLogger("bun-db");
+const dateColumnDriftLog = createFallbackLogger("postgres-js");
 function warnIfNotDateColumn(epochMs, column) {
     // skip: midnight value is a correct date column, and an already-warned column is deduped
     if (epochMs % MS_PER_DAY === 0 || warnedNonMidnightDateColumns.has(column))
@@ -384,7 +384,7 @@ function coerceDriverRow(row, info) {
         }
         else if ((pgType === "integer" || pgType === "int4" || pgType === "smallint" || pgType === "int2") &&
             (typeof value === "bigint" || typeof value === "string")) {
-            // Bun.SQL / some drivers return int4 as bigint or numeric string.
+            // Drivers may return int4 as bigint or numeric string.
             // Drizzle coerced to number for numberField columns — match that.
             const n = Number(value);
             if (!Number.isNaN(n))
@@ -469,8 +469,8 @@ const INTEGER_PG_TYPES = new Set([
     "serial",
     "bigserial",
 ]);
-// postgres.js truncates timestamptz params to ms via Date; Bun.SQL sends µs and Postgres
-// rounds into timestamptz(3). Truncating here keeps both drivers storing the same instant.
+// Postgres rounds sub-millisecond params into timestamptz(3); truncating to ms here keeps the
+// stored instant identical across drivers and equal to what postgres.js sends via Date.
 export function instantToTimestamptzParam(instant) {
     return Temporal.Instant.fromEpochMilliseconds(instant.epochMilliseconds).toString();
 }
@@ -478,7 +478,7 @@ function prepareDriverNeutralScalar(value, pgType) {
     if ((pgType === "timestamptz" || pgType === "timestamptz(3)") && isTemporalInstant(value)) {
         return { kind: "param", sql: "", bound: instantToTimestamptzParam(value) };
     }
-    // Bun.SQL binds JS numbers typed, so Postgres would round 3.5 into an integer column; postgres.js sends text and rejects it.
+    // postgres.js sends text, so Postgres rejects 3.5 for an integer column instead of rounding it.
     if (typeof value === "number" && pgType !== undefined && INTEGER_PG_TYPES.has(pgType)) {
         return { kind: "param", sql: "", bound: String(value) };
     }
@@ -489,7 +489,7 @@ function prepareValue(value, pgType) {
         return { kind: "literal", literal: value.text };
     }
     // A PII-encrypted jsonb field is a JSON string scalar; a raw string bound to
-    // ::jsonb would be parsed as JSON text (or double-encoded under Bun.SQL).
+    // ::jsonb would be parsed as JSON text (or double-encoded).
     if (pgType === "jsonb" && isPiiCiphertext(value)) {
         return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
     }
@@ -732,7 +732,7 @@ function isPooledClient(raw) {
         typeof propertyOf(raw, "savepoint") !== "function" &&
         typeof propertyOf(raw, "release") !== "function");
 }
-const closedConnectionLog = createFallbackLogger("bun-db");
+const closedConnectionLog = createFallbackLogger("postgres-js");
 // The driver rejects in-flight queries with this AbortError (no code) when the
 // pool closes under them, so isClosedConnectionError can't see it.
 const DRIVER_CLOSED_ABORT_MESSAGE = "The connection was closed.";
@@ -805,7 +805,7 @@ function logClosedConnection(raw, err, attempts, context) {
     });
 }
 // Write and other non-retried paths: log when a closed-connection error leaves
-// bun-db, rethrow unchanged.
+// the db layer, rethrow unchanged.
 async function unsafeLoggingClosedConnection(db, sqlText, params, context) {
     const raw = asRawClient(db);
     try {
@@ -821,7 +821,7 @@ function poolMaxOf(raw) {
     const max = propertyOf(propertyOf(raw, "options"), "max");
     return typeof max === "number" && Number.isInteger(max) && max > 0 ? max : DEFAULT_POOL_MAX;
 }
-// Exported so raw-SQL query modules outside bun-db (e.g. bundled-features'
+// Exported so raw-SQL query modules outside the db layer (e.g. bundled-features'
 // db/queries/*.ts) can opt into the same closed-connection retry instead of
 // calling asRawClient(db).unsafe(...) directly and losing it.
 // READS ONLY — retry re-executes the statement; never pass INSERT/UPDATE/DELETE.

package/dist/db/replay-migration-sql.d.ts

@@ -1,6 +1,7 @@
 import type { Snapshot } from "./migrate-generator.ts";
 export type ReplayedTable = {
     readonly columns: ReadonlySet<string>;
+    readonly columnsUnknown?: boolean;
 };
 export type ReplayedSchema = ReadonlyMap<string, ReplayedTable>;
 export declare function replayMigrationsDir(migrationsDir: string): ReplayedSchema;

package/dist/db/replay-migration-sql.js

@@ -67,18 +67,106 @@ function parseColumnNames(body) {
 // Clauses that can appear inside an ALTER TABLE body which do NOT change the
 // table/column shape this replay tracks (presence only, not types/
 // constraints/RLS/ownership) — recognized explicitly so they don't fall
-// through to the fail-loud check as "unparsed". Deliberately does NOT
-// include RENAME TO / RENAME COLUMN: those DO change identity in a way this
-// replay can't track, so they must keep failing loud.
+// through to the fail-loud check as "unparsed". RENAME TO / RENAME COLUMN
+// are not listed here: they change identity and are applied explicitly.
 const SHAPE_NEUTRAL_ALTER_CLAUSE_RE = new RegExp([
     `ALTER COLUMN\\s+${IDENT}\\s+TYPE\\b`, // #1085 int/bigint-catchup fixes
     `ALTER COLUMN\\s+${IDENT}\\s+(SET|DROP)\\s+NOT NULL\\b`,
     `ALTER COLUMN\\s+${IDENT}\\s+(SET DEFAULT\\b|DROP DEFAULT\\b)`,
     `(ADD|DROP)\\s+CONSTRAINT\\s+${IDENT}`,
+    `RENAME\\s+CONSTRAINT\\s+${IDENT}\\s+TO\\s+${IDENT}`,
     `\\b(ENABLE|DISABLE|(NO\\s+)?FORCE)\\s+ROW LEVEL SECURITY\\b`,
     `^OWNER TO\\b`,
 ].join("|"), "gi");
+function lastIdentifierSegment(expression) {
+    const match = expression.trim().match(new RegExp(`(?:^|\\.)${IDENT}$`));
+    return match?.[1];
+}
+// Column names of a `SELECT <list> FROM <table>` as CREATE TABLE AS materializes them: the
+// alias, else the last segment of a plain column reference. `*` copies the single FROM table
+// when the replay knows it; anything else makes the column set unknown.
+function selectListColumns(schema, query) {
+    const columns = new Set();
+    let columnsUnknown = false;
+    const select = query.match(/^\s*SELECT\s+(?:DISTINCT\s+)?([\s\S]*)$/i);
+    if (!select?.[1])
+        return { columns, columnsUnknown: true };
+    let list = select[1];
+    const fromAt = topLevelKeywordIndex(list, "FROM");
+    const fromClause = fromAt === -1 ? "" : list.slice(fromAt + 4);
+    if (fromAt !== -1)
+        list = list.slice(0, fromAt);
+    for (const item of splitTopLevel(list)) {
+        const trimmed = item.trim();
+        if (/(^|\.)\*$/.test(trimmed)) {
+            const source = fromClause.match(new RegExp(`^\\s*${IDENT}\\s*(?:;|$)`))?.[1];
+            const sourceTable = source === undefined ? undefined : schema.get(source);
+            if (sourceTable && !sourceTable.columnsUnknown) {
+                for (const column of sourceTable.columns)
+                    columns.add(column);
+            }
+            else {
+                columnsUnknown = true;
+            }
+            continue;
+        }
+        const alias = trimmed.match(new RegExp(`\\bAS\\s+${IDENT}\\s*$`, "i"))?.[1];
+        const name = alias ?? lastIdentifierSegment(trimmed);
+        if (name === undefined)
+            columnsUnknown = true;
+        else
+            columns.add(name);
+    }
+    return { columns, columnsUnknown };
+}
+function topLevelKeywordIndex(text, keyword) {
+    let depth = 0;
+    const keywordRe = new RegExp(`^${keyword}\\b`, "i");
+    for (let i = 0; i < text.length; i++) {
+        const ch = text.charAt(i);
+        if (ch === "(")
+            depth++;
+        else if (ch === ")")
+            depth--;
+        else if (depth === 0 && /\s/.test(text.charAt(i - 1) || " ") && keywordRe.test(text.slice(i))) {
+            return i;
+        }
+    }
+    return -1;
+}
+// A DO block's conditions can't be evaluated here; its table DDL is applied as written, since
+// guarded blocks (IF NOT EXISTS ... THEN ALTER TABLE ...) express the intended end state.
+function doBlockTableStatements(statement, file) {
+    const body = statement.match(/^DO\s+(?:LANGUAGE\s+\w+\s+)?(\$(?:[A-Za-z_]\w*)?\$)([\s\S]*)\1/i)?.[2];
+    if (body === undefined) {
+        throw new Error(`${file}: DO block without a recognizable dollar-quoted body — refusing to guess its table DDL`);
+    }
+    return body
+        .split(";")
+        .map((chunk) => chunk.match(/\b(?:CREATE|ALTER|DROP)\s+TABLE\b[\s\S]*$/i)?.[0])
+        .filter((ddl) => ddl !== undefined)
+        .map((ddl) => `${ddl.trim()};`);
+}
 function applyStatement(schema, statement, context) {
+    if (/^DO\b/i.test(statement)) {
+        for (const nested of doBlockTableStatements(statement, context.file))
+            applyStatement(schema, nested, context);
+        // skip: DO block fully handled above
+        return;
+    }
+    const createAs = statement.match(new RegExp(`^CREATE\\s+(?:UNLOGGED\\s+)?TABLE\\s+(IF NOT EXISTS\\s+)?${IDENT}\\s*(?:\\(([^)]*)\\)\\s*)?AS\\b([\\s\\S]*)$`, "i"));
+    if (createAs?.[2] !== undefined && createAs[4] !== undefined) {
+        if (!(createAs[1] !== undefined && schema.has(createAs[2]))) {
+            const explicitColumns = createAs[3] === undefined ? undefined : parseColumnNames(createAs[3]);
+            const selected = selectListColumns(schema, createAs[4]);
+            schema.set(createAs[2], {
+                columns: explicitColumns ?? selected.columns,
+                ...(explicitColumns === undefined && selected.columnsUnknown && { columnsUnknown: true }),
+            });
+        }
+        // skip: CREATE TABLE AS fully handled above
+        return;
+    }
     const create = statement.match(new RegExp(`^CREATE TABLE\\s+(IF NOT EXISTS\\s+)?${IDENT}\\s*\\(([\\s\\S]*)\\);?\\s*$`, "i"));
     if (create?.[2] !== undefined && create[3] !== undefined) {
         const hasIfNotExists = create[1] !== undefined;
@@ -113,6 +201,23 @@ function applyStatement(schema, statement, context) {
     const alterTableName = alterTable?.[1];
     const alterBody = alterTable?.[2];
     if (alterTableName !== undefined && alterBody !== undefined) {
+        const renameTable = alterBody.match(new RegExp(`^RENAME\\s+TO\\s+${IDENT}\\s*;?$`, "i"));
+        if (renameTable?.[1] !== undefined) {
+            const renamed = schema.get(alterTableName) ?? { columns: new Set() };
+            schema.delete(alterTableName);
+            schema.set(renameTable[1], renamed);
+            // skip: ALTER TABLE RENAME TO fully handled above
+            return;
+        }
+        const renameColumn = alterBody.match(new RegExp(`^RENAME\\s+(?:COLUMN\\s+)?${IDENT}\\s+TO\\s+${IDENT}\\s*;?$`, "i"));
+        if (renameColumn?.[1] !== undefined && renameColumn[2] !== undefined) {
+            const renamedIn = schema.get(alterTableName) ?? { columns: new Set() };
+            schema.set(alterTableName, renamedIn);
+            renamedIn.columns.delete(renameColumn[1]);
+            renamedIn.columns.add(renameColumn[2]);
+            // skip: ALTER TABLE RENAME COLUMN fully handled above
+            return;
+        }
         const table = schema.get(alterTableName) ?? { columns: new Set() };
         schema.set(alterTableName, table);
         const clauseRe = new RegExp(`(ADD|DROP)\\s+COLUMN\\s+(?:IF (?:NOT )?EXISTS\\s+)?${IDENT}`, "gi");
@@ -133,8 +238,8 @@ function applyStatement(schema, statement, context) {
         if (alterBody.match(SHAPE_NEUTRAL_ALTER_CLAUSE_RE))
             matchedAClause = true;
         // An ALTER TABLE that matched the outer "ALTER TABLE <name> <body>" shape
-        // but whose body contains no recognized clause (e.g. RENAME TO/RENAME
-        // COLUMN, which DO change identity) would otherwise silently no-op here
+        // but whose body contains no recognized clause (e.g. SET SCHEMA)
+        // would otherwise silently no-op here
         // — fall through to the fail-loud check below instead of returning, so
         // it's reported rather than vanishing.
         // skip: at least one recognized clause matched — this ALTER TABLE is
@@ -146,19 +251,16 @@ function applyStatement(schema, statement, context) {
     // shape this replay tracks — but a statement that clearly INTENDED to
     // touch a table's shape (starts with CREATE/ALTER/DROP TABLE) and matched
     // none of the recognized patterns above must fail loud, not vanish
-    // silently. Concretely this is RENAME TO / RENAME COLUMN (identity change
-    // this replay can't track) or genuinely unparsed hand-written DDL — either
-    // way a misleading missing-table/column-drift report is worse than
+    // silently. Concretely this is genuinely unparsed hand-written DDL — a misleading missing-table/column-drift report is worse than
     // pointing at the actual unparsed statement.
     if (/^(CREATE|ALTER|DROP)\s+TABLE\b/i.test(statement)) {
         const prefix = statement.slice(0, 200).replace(/\s+/g, " ").trim();
         throw new Error(`replayMigrationsDir: unparsed table-DDL statement in ${context.file} — ` +
             `starts with CREATE/ALTER/DROP TABLE but matched none of the replay's ` +
             `recognized patterns (CREATE TABLE, DROP TABLE, ALTER TABLE ADD/DROP ` +
-            `COLUMN, ALTER COLUMN ... TYPE, SET/DROP NOT NULL, SET/DROP DEFAULT, ` +
+            `COLUMN, RENAME TO/COLUMN, CREATE TABLE AS, DO blocks, ALTER COLUMN ... TYPE, SET/DROP NOT NULL, SET/DROP DEFAULT, ` +
             `ADD/DROP CONSTRAINT, ENABLE/DISABLE/[NO] FORCE ROW LEVEL SECURITY, OWNER TO — ` +
-            `optionally-quoted identifiers). Likely RENAME TO/RENAME COLUMN (real ` +
-            `identity change, not trackable here) or genuinely unparsed hand-written ` +
+            `optionally-quoted identifiers). Likely genuinely unparsed hand-written ` +
             `DDL. Statement: ${prefix}${statement.length > 200 ? "…" : ""}`);
     }
 }
@@ -194,6 +296,8 @@ export function diffReplayAgainstSnapshot(replayed, snapshot) {
             });
             continue;
         }
+        if (table.columnsUnknown)
+            continue;
         const expected = new Set(meta.columns.map((c) => c.name));
         const missing = [...expected].filter((c) => !table.columns.has(c));
         const extra = [...table.columns].filter((c) => !expected.has(c));