@cosmicdrift/kumiko-framework 0.379.0 → 0.380.0

package/dist/db/apply-entity-event.d.ts

@@ -1,6 +1,7 @@
+import type { ExecutorManagedRunner } from "@cosmicdrift/kumiko-types/executor-brand";
 import type { EntityDefinition } from "../engine/types/index.ts";
 import type { StoredEvent } from "../event-store/index.ts";
-import type { DbRow, DbRunner } from "./connection.ts";
+import type { DbRow } from "./connection.ts";
 import type { TableColumns } from "./dialect.ts";
 type Table = TableColumns<any>;
 export type AutoVerb = "created" | "updated" | "deleted" | "restored" | "forgotten";
@@ -17,5 +18,5 @@ export declare function parseAutoVerb(event: StoredEvent): AutoVerb | null;
 /** Idempotente Anwendung eines Auto-Events auf die Entity-Tabelle.
  *  Wird sowohl beim Live-Append (innerhalb der Write-TX) als auch beim
  *  Rebuild (innerhalb der Rebuild-TX) gerufen — identische Logik. */
-export declare function applyEntityEvent(event: StoredEvent, table: Table, entity: EntityDefinition, tx: DbRunner): Promise<ApplyResult>;
+export declare function applyEntityEvent(event: StoredEvent, table: Table, entity: EntityDefinition, tx: ExecutorManagedRunner): Promise<ApplyResult>;
 export {};

package/dist/db/apply-entity-event.js

@@ -14,7 +14,7 @@
 // (DEK erased → Wert unlesbar, bidx NULL). Load-bearing Test:
 // db/__tests__/implicit-projection-equivalence.integration.test.ts.
 //
-// Tenant isolation: applyEntityEvent expects a raw DbRunner (tx or pool), NOT
+// Tenant isolation: applyEntityEvent expects an ExecutorManagedRunner (tx or pool), NOT
 // a TenantDb wrapper. Two sources keep it safe:
 //   1. The live path reads the target row through the tenant-scoped TenantDb
 //      before writing — loadById() for update/delete/forget, db.fetchOne() for

package/dist/db/dialect.d.ts

@@ -1,3 +1,4 @@
+import type { WritableSchemaTable } from "@cosmicdrift/kumiko-types/executor-brand";
 import { type ColumnHandle, type SchemaTable } from "@cosmicdrift/kumiko-types/schema-table-types";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { PgType } from "./entity-table-meta.ts";
@@ -94,7 +95,7 @@ export type ColumnMap = Record<string, ColumnBuilder<unknown>>;
 type IndexOrPk = IndexBuilderWithCols | PrimaryKeyDescriptor;
 export declare function table<TCols extends ColumnMap>(tableName: string, cols: TCols, optsFn?: (t: {
     [K in keyof TCols]: ColumnHandle;
-}) => Record<string, IndexOrPk> | ReadonlyArray<IndexOrPk>): SchemaTable;
+}) => Record<string, IndexOrPk> | ReadonlyArray<IndexOrPk>): WritableSchemaTable;
 /** Reads the `kumiko:schema:Name` symbol from a table object.
  *  Throws with `context` in the message so callers don't have to duplicate the guard. */
 export declare function extractTableName(table: unknown, context?: string): string;

package/dist/db/dialect.js

@@ -18,7 +18,7 @@
 // crashed on timestamptz writes without it (#1480).
 import { KUMIKO_COLUMNS_SYMBOL, KUMIKO_META_SYMBOL, KUMIKO_NAME_SYMBOL, } from "@cosmicdrift/kumiko-types/schema-table-types";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { schemaTableName } from "./table-introspection.js";
+import { brandWritable, schemaTableName } from "./table-introspection.js";
 function isNumericPgType(t) {
     return t.startsWith("numeric(");
 }
@@ -376,7 +376,7 @@ export function table(tableName, cols, optsFn) {
         [KUMIKO_COLUMNS_SYMBOL]: handles,
         [KUMIKO_META_SYMBOL]: base,
     });
-    return out;
+    return brandWritable(out);
 }
 /** Reads the `kumiko:schema:Name` symbol from a table object.
  *  Throws with `context` in the message so callers don't have to duplicate the guard. */

package/dist/db/entity-table-from-registry.d.ts

@@ -1,5 +1,4 @@
-import type { ExecutorOnly } from "@cosmicdrift/kumiko-types/executor-brand";
 import type { Registry } from "../engine/index.ts";
 import type { SchemaTable } from "./dialect.ts";
 import { buildEntityTable } from "./table-builder.ts";
-export declare function entityTableFromRegistry(registry: Registry, entityName: string, entity: Parameters<typeof buildEntityTable>[1]): SchemaTable & ExecutorOnly;
+export declare function entityTableFromRegistry(registry: Registry, entityName: string, entity: Parameters<typeof buildEntityTable>[1]): SchemaTable;

package/dist/db/entity-table-from-registry.js

@@ -17,8 +17,6 @@ export function entityTableFromRegistry(registry, entityName, entity) {
             continue;
         if (projection.source !== entityName)
             continue;
-        // @cast-boundary projection-table — ProjectionDefinition.table is the
-        // untyped table object every projection registrar accepts.
         return projection.table;
     }
     return buildEntityTable(entityName, entity);

package/dist/db/entity-table-meta.d.ts

@@ -1,3 +1,4 @@
+import type { Writable } from "@cosmicdrift/kumiko-types/executor-brand";
 import type { EntityTenancy, TenancyBrand } from "@cosmicdrift/kumiko-types/tenancy-brand";
 import type { EntityDefinition } from "../engine/types/index.ts";
 import type { BuildEntityTableMetaOptions, EntityTableMeta, UnmanagedTableInput } from "./entity-table-meta-types.ts";
@@ -12,6 +13,9 @@ export declare function resolveTableName(entityName: string, entity: EntityDefin
  * Named `derive*` (not `build*Meta`) so it is not mistaken for the unmanaged
  * escape hatch (#1208).
  */
+export declare function deriveEntityTableMeta(entityName: string, entity: EntityDefinition, options: BuildEntityTableMetaOptions & {
+    readonly source: "unmanaged";
+}): EntityTableMeta & Writable;
 export declare function deriveEntityTableMeta(entityName: string, entity: EntityDefinition, options?: BuildEntityTableMetaOptions): EntityTableMeta;
 export declare function assertBackingTableSuperset(entityName: string, fieldMeta: EntityTableMeta, tableMeta: EntityTableMeta): void;
 /**
@@ -25,4 +29,4 @@ export declare function assertBackingTableSuperset(entityName: string, fieldMeta
  */
 export declare function defineUnmanagedTable<const T extends EntityTenancy = "tenant">(input: UnmanagedTableInput & {
     readonly tenancy?: T;
-}): EntityTableMeta & TenancyBrand<T>;
+}): EntityTableMeta & TenancyBrand<T> & Writable;

package/dist/db/entity-table-meta.js

@@ -18,6 +18,7 @@
 import { collectPiiEncryptedFields, isRecordKeyedField } from "../crypto/index.js";
 import { isSqlExpression } from "./dialect.js";
 import { READ_MODEL_PREFIX, SOFT_DELETE_LIVE_ROW_PREDICATE, toSnakeCase, toTableName, } from "./table-builder.js";
+import { brandWritable } from "./table-introspection.js";
 // Standard base columns for event-sourced read-model tables. Mirrors
 // `buildBaseColumns()` from table-builder.ts (drizzle variant).
 function fullBaseColumns(idType, softDelete) {
@@ -206,15 +207,6 @@ export function resolveTableName(entityName, entity, featureName) {
     }
     return `${featureName}_${baseName}`;
 }
-/**
- * Derive EntityTableMeta from an EntityDefinition (base columns + field DDL).
- * Defaults to `source: "managed"` (rebuildable projection). For direct-write
- * stores pass `{ source: "unmanaged" }` and use a non-`read_` table name
- * (convention: `store_*`) — or build columns by hand with `defineUnmanagedTable`.
- *
- * Named `derive*` (not `build*Meta`) so it is not mistaken for the unmanaged
- * escape hatch (#1208).
- */
 export function deriveEntityTableMeta(entityName, entity, options) {
     const tableName = resolveTableName(entityName, entity, options?.featureName);
     const source = options?.source ?? "managed";
@@ -345,7 +337,7 @@ export function deriveEntityTableMeta(entityName, entity, options) {
         }
     }
     const piiSubjectFields = collectPiiEncryptedFields(entity);
-    return {
+    const meta = {
         tableName,
         columns,
         indexes,
@@ -353,6 +345,7 @@ export function deriveEntityTableMeta(entityName, entity, options) {
         ...(piiSubjectFields.length > 0 && { piiSubjectFields }),
         ...(entity.tenancy === "global" && { tenancy: "global" }),
     };
+    return source === "unmanaged" ? brandWritable(meta) : meta;
 }
 function sqlExpressionText(where) {
     return isSqlExpression(where) ? where.text : undefined;
@@ -405,7 +398,7 @@ export function defineUnmanagedTable(input) {
             "have a tenant_id column — a global table's rows carry the system tenant, not a per-row " +
             "tenant identity.");
     }
-    return {
+    return brandWritable({
         tableName: input.tableName,
         columns: input.columns,
         indexes: input.indexes ?? [],
@@ -415,7 +408,7 @@ export function defineUnmanagedTable(input) {
         source: "unmanaged",
         ...(input.tenancy === "global" && { tenancy: "global" }),
         // @cast-boundary phantom-brand — TenancyBrand<T> is a phantom marker with no runtime representation.
-    };
+    });
 }
 function assertUnmanagedTableName(tableName, via) {
     if (tableName.startsWith("read_")) {

package/dist/db/executor-managed-tables.d.ts

@@ -1,6 +1,8 @@
+import type { ExecutorManagedWriteCapability, Writable } from "@cosmicdrift/kumiko-types/executor-brand";
 import { AccessDeniedError } from "../errors/index.ts";
 export declare function markExecutorManagedTable(table: object): void;
 export declare function isExecutorManagedTable(table: unknown): boolean;
 export declare function registerExecutorManagedWriteRunner(runner: object): void;
-export declare function hasExecutorManagedWriteCapability(runner: unknown): boolean;
+export declare function hasExecutorManagedWriteCapability(runner: unknown): runner is ExecutorManagedWriteCapability;
 export declare function executorManagedWriteDenied(runner: unknown, table: unknown, operation: string): AccessDeniedError | undefined;
+export declare function assertWritableTable<T extends object>(table: T): asserts table is T & Writable;

package/dist/db/executor-managed-tables.js

@@ -1,4 +1,4 @@
-import { AccessDeniedError } from "../errors/index.js";
+import { AccessDeniedError, InternalError } from "../errors/index.js";
 import { asEntityTableMeta, tableNameOf } from "./table-introspection.js";
 const executorManagedTables = new WeakSet();
 const executorManagedWriteRunners = new WeakSet();
@@ -38,3 +38,11 @@ export function executorManagedWriteDenied(runner, table, operation) {
             "projection apply; a direct write drifts from the event stream and a rebuild drops or resurrects the row.",
     });
 }
+// Unmanaged tables are the Writable ones; callers invoke this only after executorManagedWriteDenied passed without a capable runner.
+export function assertWritableTable(table) {
+    if (isExecutorManagedTable(table)) {
+        throw new InternalError({
+            message: `assertWritableTable: "${tableNameOf(table)}" is executor-managed and the runner holds no write capability.`,
+        });
+    }
+}

package/dist/db/index.d.ts

@@ -36,6 +36,6 @@ export { renderTableDdl, renderTablesDdl } from "./render-ddl.ts";
 export { diffReplayAgainstSnapshot, type ReplayedSchema, type ReplayedTable, type ReplayMismatch, replayMigrationsDir, } from "./replay-migration-sql.ts";
 export { findCommentedDropTables, isRetiredFrameworkTable, type RetiredFrameworkTable, retiredFrameworkTables, } from "./retired-framework-tables.ts";
 export { tableExists } from "./schema-inspection.ts";
-export { buildBaseColumns, buildEntityTable, declareGlobalTenancy, type EntityRow, type EntityTable, physicalColumnName, toSnakeCase, toTableName, } from "./table-builder.ts";
-export type { CreateTenantDbOptions, OutsideTransactionContext, TenantDb, TenantDbGrants, TenantDbMode, UncheckedSystemDb, } from "./tenant-db.ts";
+export { buildBaseColumns, buildEntityTable, declareGlobalTenancy, type EntityRow, type EntityTable, type ExecutorManagedRunner, type ExecutorManagedWriteCapability, physicalColumnName, toSnakeCase, toTableName, type Writable, type WritableSchemaTable, type WritableTable, } from "./table-builder.ts";
+export type { CreateTenantDbOptions, ExecutorManagedTenantDb, OutsideTransactionContext, TenantDb, TenantDbGrants, TenantDbMode, UncheckedSystemDb, } from "./tenant-db.ts";
 export { castTenantRows, createSystemDbView, createTenantDataDestroyDb, createTenantDb, hasOutsideTransactionDb, requireOutsideTransactionDb, runInOwnTransaction, SYSTEM_SCOPE_CHECK_BRAND, scopeTenantDbToTenant, } from "./tenant-db.ts";

package/dist/db/query.d.ts

@@ -1,9 +1,9 @@
 import type { AggregateRow, AggregateSpec } from "@cosmicdrift/kumiko-types/aggregate-types";
 import type { DbRunner, DbTx } from "@cosmicdrift/kumiko-types/db-connection";
+import type { ExecutorManagedRunner, ExecutorManagedWriteCapability, WritableTable } from "@cosmicdrift/kumiko-types/executor-brand";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { SelectOptions, WhereObject } from "@cosmicdrift/kumiko-types/where-clause-types";
 import type { EntityTableMeta } from "./entity-table-meta.ts";
-import { type NotExecutorOnly } from "./table-builder.ts";
 import { asEntityTableMeta, requireEntityTableMeta } from "./table-introspection.ts";
 export { asEntityTableMeta, requireEntityTableMeta };
 export type ReservedClient = {
@@ -23,12 +23,14 @@ export type RawClientWithBegin = RawClient & {
 export declare function hasBegin(client: RawClient): client is RawClientWithBegin;
 export declare function asRawClient(db: unknown): RawClient;
 export declare function runnerCanBeginTransaction(db: unknown): boolean;
+export declare function runInSavepoint<T>(tx: ExecutorManagedRunner, fn: (sp: ExecutorManagedRunner) => Promise<T>): Promise<T>;
 export declare function runInSavepoint<T>(tx: unknown, fn: (sp: unknown) => Promise<T>): Promise<T>;
+export declare function runInSavepointIfSupported<T>(db: ExecutorManagedRunner, fn: (sp: ExecutorManagedRunner) => Promise<T>): Promise<T>;
 export declare function runInSavepointIfSupported<T>(db: unknown, fn: (sp: DbRunner) => Promise<T>): Promise<T>;
 export type AnyDb = DbRunner | unknown;
+type AnyRow = any;
 export type { JsonTextMatch, OrderByClause, SelectOptions, WhereObject, WhereOperator, WhereValue, } from "@cosmicdrift/kumiko-types/where-clause-types";
 type TableLike = EntityTableMeta | any;
-type WritableTable = EntityTableMeta & NotExecutorOnly;
 export type TableInfo = {
     readonly name: string;
     readonly columnOf: (field: string) => string;
@@ -43,8 +45,8 @@ export declare function instantToTimestamptzParam(instant: Temporal.Instant): st
 export declare function isClosedConnectionError(err: unknown): boolean;
 export declare function describeClosedConnectionFailure(raw: unknown, err: unknown, attempts: number): Record<string, unknown> | undefined;
 export declare function unsafeReadRetrying<TRow>(db: AnyDb, sqlText: string, params: readonly unknown[]): Promise<readonly TRow[]>;
-export declare function selectMany<TRow = any>(db: AnyDb, table: TableLike, where?: WhereObject, options?: SelectOptions): Promise<readonly TRow[]>;
-export declare function fetchOne<TRow = any>(db: AnyDb, table: TableLike, where: WhereObject): Promise<TRow | undefined>;
+export declare function selectMany<TRow = AnyRow>(db: AnyDb, table: TableLike, where?: WhereObject, options?: SelectOptions): Promise<readonly TRow[]>;
+export declare function fetchOne<TRow = AnyRow>(db: AnyDb, table: TableLike, where: WhereObject): Promise<TRow | undefined>;
 export type JoinColumnPair = {
     readonly left: string;
     readonly right: string;
@@ -65,10 +67,14 @@ export type InnerJoinRow<TLeft, TRight> = {
     readonly right: TRight;
 };
 export declare function selectInnerJoin<TLeft = Record<string, unknown>, TRight = Record<string, unknown>>(db: AnyDb, spec: InnerJoinSpec): Promise<readonly InnerJoinRow<TLeft, TRight>[]>;
-export declare function insertMany<TRow = any>(db: AnyDb, table: WritableTable, rows: ReadonlyArray<Record<string, unknown>>): Promise<readonly TRow[]>;
-export declare function insertOne<TRow = any>(db: AnyDb, table: WritableTable, values: Record<string, unknown>): Promise<TRow | undefined>;
-export declare function updateMany<TRow = any>(db: AnyDb, table: WritableTable, set: Record<string, unknown>, where: WhereObject): Promise<readonly TRow[]>;
+export declare function insertMany<TRow = AnyRow>(db: AnyDb, table: WritableTable, rows: ReadonlyArray<Record<string, unknown>>): Promise<readonly TRow[]>;
+export declare function insertMany<TRow = AnyRow>(db: ExecutorManagedWriteCapability, table: EntityTableMeta, rows: ReadonlyArray<Record<string, unknown>>): Promise<readonly TRow[]>;
+export declare function insertOne<TRow = AnyRow>(db: AnyDb, table: WritableTable, values: Record<string, unknown>): Promise<TRow | undefined>;
+export declare function insertOne<TRow = AnyRow>(db: ExecutorManagedWriteCapability, table: EntityTableMeta, values: Record<string, unknown>): Promise<TRow | undefined>;
+export declare function updateMany<TRow = AnyRow>(db: AnyDb, table: WritableTable, set: Record<string, unknown>, where: WhereObject): Promise<readonly TRow[]>;
+export declare function updateMany<TRow = AnyRow>(db: ExecutorManagedWriteCapability, table: EntityTableMeta, set: Record<string, unknown>, where: WhereObject): Promise<readonly TRow[]>;
 export declare function deleteMany(db: AnyDb, table: WritableTable, where: WhereObject): Promise<number>;
+export declare function deleteMany(db: ExecutorManagedWriteCapability, table: EntityTableMeta, where: WhereObject): Promise<number>;
 export declare function resolveConflictColumns(table: TableLike, info: TableInfo, conflictKeys: readonly string[] | undefined): readonly string[];
 export type UpsertOnConflictOptions = {
     readonly conflictKeys: readonly string[];
@@ -88,18 +94,23 @@ export type DeleteManyBatchedResult = {
 export declare function countWhere(db: AnyDb, table: TableLike, where?: WhereObject): Promise<number>;
 export declare function isTimestamptzType(pgType: string | undefined): boolean;
 export declare function aggregateWhere(db: AnyDb, table: TableLike, spec: AggregateSpec, where?: WhereObject): Promise<readonly AggregateRow[]>;
-export declare function upsertOnConflict<TRow = any>(db: AnyDb, table: WritableTable, values: Record<string, unknown>, options: UpsertOnConflictOptions): Promise<TRow | undefined>;
-export declare function upsertByPk<TRow = any>(db: AnyDb, table: WritableTable, values: Record<string, unknown>, updateOnConflict?: Record<string, unknown>): Promise<TRow | undefined>;
+export declare function upsertOnConflict<TRow = AnyRow>(db: AnyDb, table: WritableTable, values: Record<string, unknown>, options: UpsertOnConflictOptions): Promise<TRow | undefined>;
+export declare function upsertOnConflict<TRow = AnyRow>(db: ExecutorManagedWriteCapability, table: EntityTableMeta, values: Record<string, unknown>, options: UpsertOnConflictOptions): Promise<TRow | undefined>;
+export declare function upsertByPk<TRow = AnyRow>(db: AnyDb, table: WritableTable, values: Record<string, unknown>, updateOnConflict?: Record<string, unknown>): Promise<TRow | undefined>;
+export declare function upsertByPk<TRow = AnyRow>(db: ExecutorManagedWriteCapability, table: EntityTableMeta, values: Record<string, unknown>, updateOnConflict?: Record<string, unknown>): Promise<TRow | undefined>;
 export type InsertOnConflictDoNothingOptions = {
     readonly conflictKeys?: readonly string[];
 };
-export declare function insertOnConflictDoNothing<TRow = any>(db: AnyDb, table: WritableTable, values: Record<string, unknown>, options?: InsertOnConflictDoNothingOptions): Promise<TRow | undefined>;
+export declare function insertOnConflictDoNothing<TRow = AnyRow>(db: AnyDb, table: WritableTable, values: Record<string, unknown>, options?: InsertOnConflictDoNothingOptions): Promise<TRow | undefined>;
+export declare function insertOnConflictDoNothing<TRow = AnyRow>(db: ExecutorManagedWriteCapability, table: EntityTableMeta, values: Record<string, unknown>, options?: InsertOnConflictDoNothingOptions): Promise<TRow | undefined>;
 export type IncrementCounterOptions = {
     readonly conflictKeys?: readonly string[];
     /** Extra SET clauses on conflict (e.g. lastUpdatedAt: sql\`NOW()\`). */
     readonly set?: Record<string, unknown>;
 };
-export declare function incrementCounter<TRow = any>(db: AnyDb, table: WritableTable, values: Record<string, unknown>, increments: Record<string, number>, options?: IncrementCounterOptions): Promise<TRow | undefined>;
+export declare function incrementCounter<TRow = AnyRow>(db: AnyDb, table: WritableTable, values: Record<string, unknown>, increments: Record<string, number>, options?: IncrementCounterOptions): Promise<TRow | undefined>;
+export declare function incrementCounter<TRow = AnyRow>(db: ExecutorManagedWriteCapability, table: EntityTableMeta, values: Record<string, unknown>, increments: Record<string, number>, options?: IncrementCounterOptions): Promise<TRow | undefined>;
 export declare function deleteManyBatched(db: AnyDb, table: WritableTable, where: WhereObject, options: DeleteManyBatchedOptions): Promise<DeleteManyBatchedResult>;
+export declare function deleteManyBatched(db: ExecutorManagedWriteCapability, table: EntityTableMeta, where: WhereObject, options: DeleteManyBatchedOptions): Promise<DeleteManyBatchedResult>;
 export declare function transaction<T>(db: AnyDb, fn: (tx: DbTx) => Promise<T>): Promise<T>;
 export declare function runInNewTransaction<T>(db: unknown, fn: (tx: DbRunner) => Promise<T>): Promise<T>;

package/dist/db/query.js

@@ -78,42 +78,27 @@ export function asRawClient(db) {
 export function runnerCanBeginTransaction(db) {
     return hasBegin(asRawClient(db));
 }
-// postgres.js rejects the WHOLE begin() when any statement inside
-// it errored — even if the JS error was caught (the driver tracks per-block
-// query failures). Error confinement therefore must go through the driver's
-// own savepoint(), not manual SAVEPOINT statements. The callback receives
-// the savepoint-scoped tx; run every confined statement on THAT handle.
+function savepointRunnerOf(sp) {
+    // @cast-boundary db-runner savepoint handle → TRunner at the single seam (boundRunner re-wraps savepoint handles with the caller's capability)
+    return sp;
+}
 export async function runInSavepoint(tx, fn) {
     const raw = asRawClient(tx);
     if (typeof raw.savepoint !== "function") {
         throw new Error("runInSavepoint: transaction handle has no savepoint() — pass the driver tx (postgres.js TransactionSql).");
     }
-    return raw.savepoint(fn);
+    return raw.savepoint((sp) => fn(savepointRunnerOf(sp)));
 }
-// Same error-confinement as runInSavepoint, but for call sites that don't
-// know whether `db` is a bare pool connection or an active transaction
-// (e.g. the CRUD executor, invoked both from a dispatcher tx and directly
-// against the pool by seeds/tests). A pool connection has no savepoint() —
-// and doesn't need one, since each statement there is its own auto-committed
-// unit and a failed statement can't poison anything downstream.
-//
-// `.savepoint` being present isn't proof the transaction is still open: a
-// committed TransactionSql-shaped db still exposes `.savepoint`, and calling
-// it fails with PG 25P01 ("no active sql transaction") since there's no
-// BEGIN left to nest into. That is now a programming error, not something
-// to paper over by re-running `fn` without the savepoint's isolation.
 export async function runInSavepointIfSupported(db, fn) {
     const raw = asRawClient(db);
-    // @cast-boundary db-runner savepoint handle → DbRunner at the single seam
-    const asRunner = (sp) => sp;
     if (typeof raw.savepoint !== "function")
-        return fn(asRunner(db));
+        return fn(savepointRunnerOf(db));
     // An error from inside fn must never be remapped, even if it carries a closed-connection code.
     let fnStarted = false;
     try {
         return await raw.savepoint((sp) => {
             fnStarted = true;
-            return fn(asRunner(sp));
+            return fn(savepointRunnerOf(sp));
         });
     }
     catch (e) {
@@ -870,7 +855,6 @@ function selectColumnList(info, fields) {
     })
         .join(", ");
 }
-// biome-ignore lint/suspicious/noExplicitAny: opt-in default loosens row type for unannotated test fixtures
 export async function selectMany(db, table, where, options) {
     const scoped = tenantDbDelegate(db);
     if (scoped) {
@@ -905,7 +889,6 @@ export async function selectMany(db, table, where, options) {
     const raw = await unsafeReadRetrying(db, sqlText, values);
     return coerceRows(raw, info);
 }
-// biome-ignore lint/suspicious/noExplicitAny: see selectMany default
 export async function fetchOne(db, table, where) {
     const rows = await selectMany(db, table, where, { limit: 1 });
     return rows[0];
@@ -980,10 +963,6 @@ export async function selectInnerJoin(db, spec) {
         };
     });
 }
-// Bulk INSERT — same shape as insertOne but takes an array of rows and
-// produces one multi-VALUES statement. Mirrors drizzle's
-// `db.insert(t).values(rows[])`. Empty input is a no-op.
-// biome-ignore lint/suspicious/noExplicitAny: see selectMany default
 export async function insertMany(db, table, rows) {
     if (rows.length === 0)
         return [];
@@ -1026,7 +1005,6 @@ export async function insertMany(db, table, rows) {
     });
     return coerceRows(raw, info);
 }
-// biome-ignore lint/suspicious/noExplicitAny: see selectMany default
 export async function insertOne(db, table, values) {
     const scoped = tenantDbDelegate(db);
     if (scoped) {
@@ -1065,7 +1043,6 @@ export async function insertOne(db, table, values) {
         return undefined;
     return coerceRow(first, info);
 }
-// biome-ignore lint/suspicious/noExplicitAny: see selectMany default
 export async function updateMany(db, table, set, where) {
     const scoped = tenantDbDelegate(db);
     if (scoped) {
@@ -1290,8 +1267,11 @@ export async function aggregateWhere(db, table, spec, where = {}) {
         };
     });
 }
-// biome-ignore lint/suspicious/noExplicitAny: see selectMany default
-export async function upsertOnConflict(db, table, values, options) {
+export function upsertOnConflict(db, table, values, options) {
+    return upsertOnConflictChecked(db, table, values, options);
+}
+// upsertByPk shares this body; the checks inside gate the write, so it needs no overload pair.
+async function upsertOnConflictChecked(db, table, values, options) {
     assertNotTenantScoped(db, "upsertOnConflict");
     const managedDenied = executorManagedWriteDenied(db, table, "upsertOnConflict");
     if (managedDenied)
@@ -1337,7 +1317,6 @@ export async function upsertOnConflict(db, table, values, options) {
         return undefined;
     return coerceRow(first, info);
 }
-// biome-ignore lint/suspicious/noExplicitAny: see selectMany default
 export async function upsertByPk(db, table, values, updateOnConflict) {
     const managedDenied = executorManagedWriteDenied(db, table, "upsertByPk");
     if (managedDenied)
@@ -1345,12 +1324,11 @@ export async function upsertByPk(db, table, values, updateOnConflict) {
     const info = extractTableInfo(table);
     const conflictKeys = resolveConflictColumns(table, info, undefined);
     const fieldKeys = conflictKeys.map((col) => info.fieldOf(col));
-    return upsertOnConflict(db, table, values, {
+    return upsertOnConflictChecked(db, table, values, {
         conflictKeys: fieldKeys,
         ...(updateOnConflict !== undefined ? { update: updateOnConflict } : {}),
     });
 }
-// biome-ignore lint/suspicious/noExplicitAny: see selectMany default
 export async function insertOnConflictDoNothing(db, table, values, options) {
     assertNotTenantScoped(db, "insertOnConflictDoNothing");
     const managedDenied = executorManagedWriteDenied(db, table, "insertOnConflictDoNothing");
@@ -1371,7 +1349,6 @@ export async function insertOnConflictDoNothing(db, table, values, options) {
         return undefined;
     return coerceRow(first, info);
 }
-// biome-ignore lint/suspicious/noExplicitAny: see selectMany default
 export async function incrementCounter(db, table, values, increments, options = {}) {
     assertNotTenantScoped(db, "incrementCounter");
     const managedDenied = executorManagedWriteDenied(db, table, "incrementCounter");

package/dist/db/table-builder.d.ts

@@ -1,5 +1,4 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { ExecutorOnly } from "@cosmicdrift/kumiko-types/executor-brand";
 import type { TenancyBrand } from "@cosmicdrift/kumiko-types/tenancy-brand";
 import type { EntityDefinition, EntityRelations, FieldDefinition, FieldsMap } from "../engine/types/index.ts";
 import type { Table } from "./event-store-executor-context.ts";
@@ -194,11 +193,11 @@ type Flatten<T> = {
 /** The row `executor.list()` / `executor.detail()` return for entity `E`. A wide
  *  `EntityDefinition` (fields without literal keys) yields `Record<string, unknown>`. */
 export type EntityRow<E extends EntityDefinition = EntityDefinition> = string extends keyof E["fields"] ? Record<string, unknown> : Flatten<RowOfColumns<BaseColumnsType<E>> & SoftDeleteRow<E> & RowForFields<E["fields"]>>;
-export type { ExecutorOnly, NotExecutorOnly } from "@cosmicdrift/kumiko-types/executor-brand";
+export type { ExecutorManagedRunner, ExecutorManagedWriteCapability, Writable, WritableSchemaTable, WritableTable, } from "@cosmicdrift/kumiko-types/executor-brand";
 export type { EntityTenancy, TenancyBrand } from "@cosmicdrift/kumiko-types/tenancy-brand";
 type EntityTableTenancy<E extends EntityDefinition> = [NonNullable<E["tenancy"]>] extends [never] ? "tenant" : [NonNullable<E["tenancy"]>] extends ["global"] ? "global" : "tenant";
 export type EntityTable<E extends EntityDefinition = EntityDefinition> = TableColumns<// biome-ignore lint/suspicious/noExplicitAny: drizzle's internal table-config stays generic; we layer typed columns on top via the intersection below.
-any> & BaseColumnsType<E> & SoftDeleteColumnsType & ColumnsForEntity<E["fields"]> & ExecutorOnly & TenancyBrand<EntityTableTenancy<E>>;
+any> & BaseColumnsType<E> & SoftDeleteColumnsType & ColumnsForEntity<E["fields"]> & TenancyBrand<EntityTableTenancy<E>>;
 export declare function buildBaseColumns(softDelete: boolean, idType?: "serial" | "uuid"): {
     id: ColumnBuilder<string> | ColumnBuilder<number>;
     tenantId: ColumnBuilder<string>;

package/dist/db/table-introspection.d.ts

@@ -1,4 +1,5 @@
 import type { EntityTableMeta } from "@cosmicdrift/kumiko-types/entity-table-meta-types";
+import type { Writable } from "@cosmicdrift/kumiko-types/executor-brand";
 export declare function isEntityTableMeta(value: unknown): value is EntityTableMeta;
 export declare function asEntityTableMeta(table: unknown): EntityTableMeta | undefined;
 export declare function requireEntityTableMeta(table: unknown, tableName: string): EntityTableMeta;
@@ -14,3 +15,4 @@ export declare function columnHandleName(table: unknown, field: string): string
 export declare function hasFieldProperty(table: unknown, field: string): boolean;
 /** SQL column name of a JS field via the column-handle map; undefined when not mapped. */
 export declare function columnSqlNameOf(table: unknown, field: string): string | undefined;
+export declare function brandWritable<T extends EntityTableMeta>(table: T): T & Writable;

package/dist/db/table-introspection.js

@@ -74,3 +74,7 @@ export function columnSqlNameOf(table, field) {
     const name = handle["name"];
     return typeof name === "string" ? name : undefined;
 }
+export function brandWritable(table) {
+    // @cast-boundary phantom-brand — Writable is a phantom marker with no runtime representation.
+    return table;
+}

package/dist/db/tenant-db.d.ts

@@ -1,7 +1,8 @@
 import type { EntityTableMeta } from "@cosmicdrift/kumiko-types/entity-table-meta-types";
+import type { ExecutorManagedRunner } from "@cosmicdrift/kumiko-types/executor-brand";
 import type { EscapeHatchDeclaration, EscapeHatchReporter, EscapeHatchTarget } from "@cosmicdrift/kumiko-types/handlers";
 import type { SchemaTable } from "@cosmicdrift/kumiko-types/schema-table-types";
-import { type TenantDb, type TenantDbMode, type UncheckedSystemDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
+import { type ExecutorManagedTenantDb, type TenantDb, type TenantDbMode, type UncheckedSystemDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
 import { asRawClient } from "../db/query.ts";
 import type { EntityDefinition } from "../engine/types/fields.ts";
 import { type TenantId } from "../engine/types/identifiers.ts";
@@ -10,8 +11,8 @@ import { type Meter, type Tracer } from "../observability/index.ts";
 import type { DbRunner } from "./connection.ts";
 import { tableNameOf } from "./table-introspection.ts";
 type Table = SchemaTable;
-export { SYSTEM_SCOPE_CHECK_BRAND, type TenantDb, type TenantDbMode, type UncheckedSystemDb, } from "@cosmicdrift/kumiko-types/tenant-db-types";
-export declare function withExecutorManagedWrites(runner: DbRunner): DbRunner;
+export { type ExecutorManagedTenantDb, SYSTEM_SCOPE_CHECK_BRAND, type TenantDb, type TenantDbMode, type UncheckedSystemDb, } from "@cosmicdrift/kumiko-types/tenant-db-types";
+export declare function withExecutorManagedWrites(runner: DbRunner): ExecutorManagedRunner;
 export declare function withoutExecutorManagedWrites(runner: DbRunner): DbRunner;
 export declare function assertPersonalDataWrite(db: TenantDb, tableName: string, keys: readonly string[], entity: EntityDefinition): void;
 export declare function unsafeRawForDeclaredStep(holder: TenantDb | UncheckedSystemDb, reason: string): DbRunner;
@@ -55,7 +56,10 @@ export type CreateTenantDbOptions = {
     readonly signal?: AbortSignal;
     readonly grants?: TenantDbGrants;
 };
+export declare function createTenantDb(options: CreateTenantDbOptions & {
+    readonly db: ExecutorManagedRunner;
+}): ExecutorManagedTenantDb;
 export declare function createTenantDb(options: CreateTenantDbOptions): TenantDb;
-export declare function createTenantDataDestroyDb(options: Omit<CreateTenantDbOptions, "mode">): TenantDb;
+export declare function createTenantDataDestroyDb(options: Omit<CreateTenantDbOptions, "mode">): ExecutorManagedTenantDb;
 export declare function createProjectingTenantDb(db: DbRunner, tenantId: TenantId, projectionRegistry: Registry | undefined): TenantDb;
 export { asRawClient };

package/dist/db/tenant-db.js

@@ -4,7 +4,7 @@ import { asEntityTableMeta, asRawClient, aggregateWhere as bunAggregateWhere, co
 import { SYSTEM_TENANT_ID } from "../engine/types/identifiers.js";
 import { AccessDeniedError, InternalError, memberResolutionReadOnlyDenied, } from "../errors/index.js";
 import { emitDbQuery, fallbackEscapeHatchReporter, registerStandardMetrics, } from "../observability/index.js";
-import { executorManagedWriteDenied, registerExecutorManagedWriteRunner, } from "./executor-managed-tables.js";
+import { assertWritableTable, executorManagedWriteDenied, hasExecutorManagedWriteCapability, registerExecutorManagedWriteRunner, } from "./executor-managed-tables.js";
 import { bindProjectionRegistry, projectionRegistryOf } from "./projection-registry-binding.js";
 import { acquireNamespacedAdvisoryLock } from "./queries/advisory-lock.js";
 import { queryDatabaseNow } from "./queries/database-now.js";
@@ -73,12 +73,17 @@ const capableRunnerByInner = new WeakMap();
 // Framework-private (not re-exported from db/index.ts): the only way to obtain a runner that may
 // write executor-managed tables. Only the framework's own event-apply paths call it.
 export function withExecutorManagedWrites(runner) {
-    if (capableRunnerInners.has(runner))
+    if (hasExecutorManagedWriteCapability(runner))
         return runner;
     const cached = capableRunnerByInner.get(runner);
     if (cached)
         return cached;
     const capable = boundRunner(runner, runnerPersonalDataGates.get(runner), projectionRegistryOf(runner), true);
+    if (!hasExecutorManagedWriteCapability(capable)) {
+        throw new InternalError({
+            message: "boundRunner did not register the executor write capability",
+        });
+    }
     capableRunnerByInner.set(runner, capable);
     return capable;
 }
@@ -353,7 +358,7 @@ export function createTenantDb(options) {
 }
 // Tenant-destroy hooks purge their own tenant's event-fed rows; the pinned tenant is the only reach and unsafeRaw stays without the write capability.
 export function createTenantDataDestroyDb(options) {
-    return buildTenantDb({ ...options, db: withExecutorManagedWrites(options.db), mode: "tenant" });
+    return createTenantDb({ ...options, db: withExecutorManagedWrites(options.db), mode: "tenant" });
 }
 // Untyped JS callers or an `as` cast can still hand in undefined; a scoped handle
 // without a tenant would bind `tenant_id = NULL` instead of failing loudly.
@@ -488,6 +493,26 @@ function buildTenantDb(options) {
                 "use db.global(table) with escapeHatch instead.",
         });
     }
+    // Callers ran executorManagedWriteDenied first: either db holds the capability or the table is
+    // unmanaged. The split only proves to the compiler which overload of the free writers applies.
+    function insertRow(table, values) {
+        if (hasExecutorManagedWriteCapability(db))
+            return bunInsertOne(db, table, values);
+        assertWritableTable(table);
+        return bunInsertOne(db, table, values);
+    }
+    function updateRows(table, set, where) {
+        if (hasExecutorManagedWriteCapability(db))
+            return bunUpdateMany(db, table, set, where);
+        assertWritableTable(table);
+        return bunUpdateMany(db, table, set, where);
+    }
+    function deleteRows(table, where) {
+        if (hasExecutorManagedWriteCapability(db))
+            return bunDeleteMany(db, table, where);
+        assertWritableTable(table);
+        return bunDeleteMany(db, table, where);
+    }
     function globalTable(table) {
         const meta = asEntityTableMeta(table);
         if (meta?.tenancy !== "global") {
@@ -511,7 +536,7 @@ function buildTenantDb(options) {
                 if (denied)
                     return Promise.reject(denied);
                 report("global-write", globalWriteReason());
-                return withDbSpan("insert", table, async () => bunInsertOne(db, table, values));
+                return withDbSpan("insert", table, async () => insertRow(table, values));
             },
             updateMany(set, where) {
                 const denied = writesDenied("ctx.db.global().updateMany") ??
@@ -525,7 +550,7 @@ function buildTenantDb(options) {
                     return Promise.reject(new Error("db.global().updateMany without where would mass-update every tenant's rows. Pass at least one where condition."));
                 }
                 report("global-write", globalWriteReason());
-                return withDbSpan("update", table, async () => bunUpdateMany(db, table, set, where));
+                return withDbSpan("update", table, async () => updateRows(table, set, where));
             },
             deleteMany(where) {
                 const denied = writesDenied("ctx.db.global().deleteMany") ??
@@ -538,10 +563,10 @@ function buildTenantDb(options) {
                 }
                 report("global-write", globalWriteReason());
                 return withDbSpan("delete", table, async () => {
-                    await bunDeleteMany(db, table, where);
+                    await deleteRows(table, where);
                 });
             },
-            // @cast-boundary phantom-brand — GlobalWrites is only present in the type when TTable is not ExecutorOnly; the object above always carries the methods.
+            // @cast-boundary phantom-brand — GlobalWrites is only present in the type when TTable carries Writable; the object above always carries the methods.
         };
     }
     function grantedUnsafeRawRunner(declaredStepReason) {
@@ -605,7 +630,7 @@ function buildTenantDb(options) {
             if (managedDenied)
                 return Promise.reject(managedDenied);
             const data = insertValues(table, values);
-            return withDbSpan("insert", table, async () => bunInsertOne(db, table, data));
+            return withDbSpan("insert", table, async () => insertRow(table, data));
         },
         updateMany(table, set, where) {
             const writeDenied = writesDenied("ctx.db.updateMany");
@@ -624,7 +649,7 @@ function buildTenantDb(options) {
             if (managedDenied)
                 return Promise.reject(managedDenied);
             const filter = writeWhere(table, where);
-            return withDbSpan("update", table, async () => bunUpdateMany(db, table, set, filter));
+            return withDbSpan("update", table, async () => updateRows(table, set, filter));
         },
         deleteMany(table, where) {
             const writeDenied = writesDenied("ctx.db.deleteMany");
@@ -640,7 +665,7 @@ function buildTenantDb(options) {
             if (managedDenied)
                 return Promise.reject(managedDenied);
             const filter = writeWhere(table, where);
-            return withDbSpan("delete", table, async () => bunDeleteMany(db, table, filter));
+            return withDbSpan("delete", table, async () => deleteRows(table, filter));
         },
     };
     declaredUnsafeRawRunners.set(tenantDb, grantedUnsafeRawRunner);

package/dist/engine/extensions/tenant-data.d.ts

@@ -1,9 +1,9 @@
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-types/file-provider-resolver-types";
-import type { TenantDb } from "../../db/tenant-db.ts";
+import type { ExecutorManagedTenantDb } from "../../db/tenant-db.ts";
 import type { Registry, TenantId } from "../types/index.ts";
 import type { TenantDestroyHookResult } from "./tenant-resource.ts";
 export interface TenantDataHookCtx {
-    readonly db: TenantDb;
+    readonly db: ExecutorManagedTenantDb;
     readonly registry: Registry;
     readonly tenantId: TenantId;
     readonly deadlineAt?: number;

package/dist/engine/projection-helpers.d.ts

@@ -1,7 +1,7 @@
-import type { DbRunner } from "../db/connection.ts";
+import type { ExecutorManagedRunner } from "@cosmicdrift/kumiko-types/executor-brand";
 import type { StoredEvent } from "../event-store/event-store.ts";
 import type { MultiStreamApplyContext } from "../pipeline/multi-stream-apply-context.ts";
 import type { MultiStreamApplyFn, ProjectionTable, SingleStreamApplyFn } from "./types/projection.ts";
-export declare function defineApply<TPayload = Record<string, unknown>>(fn: (event: StoredEvent<TPayload>, tx: DbRunner, table: ProjectionTable) => Promise<void>): SingleStreamApplyFn;
-export declare function defineMspApply<TPayload = Record<string, unknown>>(fn: (event: StoredEvent<TPayload>, tx: DbRunner, ctx: MultiStreamApplyContext) => Promise<void>): MultiStreamApplyFn;
+export declare function defineApply<TPayload = Record<string, unknown>>(fn: (event: StoredEvent<TPayload>, tx: ExecutorManagedRunner, table: ProjectionTable) => Promise<void>): SingleStreamApplyFn;
+export declare function defineMspApply<TPayload = Record<string, unknown>>(fn: (event: StoredEvent<TPayload>, tx: ExecutorManagedRunner, ctx: MultiStreamApplyContext) => Promise<void>): MultiStreamApplyFn;
 export declare function setFields(table: ProjectionTable, fields: Record<string, unknown> | ((event: Parameters<SingleStreamApplyFn>[0]) => Record<string, unknown>)): SingleStreamApplyFn;

package/dist/engine/steps/unsafe-projection-delete.js

@@ -16,6 +16,7 @@
 // must commit in the same TX as the aggregate-mutation that triggered
 // it (stronger consistency than an async projection). Reviewer judges.
 import { deleteMany } from "../../db/query.js";
+import { requireEntityTableMeta } from "../../db/table-introspection.js";
 import { withExecutorManagedWrites } from "../../db/tenant-db.js";
 import { tenantDbWriteRunner } from "../../db/tenant-db-runner.js";
 import { defineStep } from "../define-step.js";
@@ -27,8 +28,8 @@ defineStep({
         const where = resolveRequired(args.where, ctx);
         // The `unsafe*`-step IS the sanctioned direct projection write — it exists
         // to bypass the executor deliberately (boot-validated allowlist + reviewer
-        // gate). The brand-strip cast makes that explicit at the one blessed seam.
-        await deleteMany(withExecutorManagedWrites(tenantDbWriteRunner(ctx.db, "unsafe projection delete")), args.table, where);
+        // gate).
+        await deleteMany(withExecutorManagedWrites(tenantDbWriteRunner(ctx.db, "unsafe projection delete")), requireEntityTableMeta(args.table, "unsafeProjectionDelete"), where);
     },
 });
 export function buildUnsafeProjectionDeleteStep(args) {

package/dist/es-ops/operations-schema.d.ts

@@ -1,5 +1,5 @@
 import { type DbConnection } from "../db/index.ts";
 export type EsOperationType = "seed-migration";
 export type EsOperationAppliedBy = "boot" | "cli" | "ci-pipeline";
-export declare const esOperationsTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const esOperationsTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare function createEsOperationsTable(db: DbConnection): Promise<void>;

package/dist/event-store/archive.d.ts

@@ -1,6 +1,6 @@
 import type { DbConnection, DbRunner } from "../db/connection.ts";
 import type { TenantId } from "../engine/types/index.ts";
-export declare const archivedStreamsTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const archivedStreamsTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare function createArchivedStreamsTable(db: DbConnection): Promise<void>;
 export type ArchiveStreamArgs = {
     readonly tenantId: TenantId;

package/dist/event-store/events-schema.d.ts

@@ -1,3 +1,3 @@
 import { type DbConnection } from "../db/index.ts";
-export declare const eventsTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const eventsTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare function createEventsTable(db: DbConnection): Promise<void>;

package/dist/event-store/rebuild-dead-letter.d.ts

@@ -1,6 +1,6 @@
 import type { DbConnection, DbRunner } from "../db/connection.ts";
 import type { StoredEvent } from "./event-store.ts";
-export declare const rebuildDeadLetterTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const rebuildDeadLetterTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare function createRebuildDeadLetterTable(db: DbConnection): Promise<void>;
 export type SkippedApply = {
     readonly event: StoredEvent;

package/dist/event-store/snapshot.d.ts

@@ -2,7 +2,7 @@
 import type { LoadAggregateWithSnapshotOptions, LoadAggregateWithSnapshotResult, SnapshotReducer } from "@cosmicdrift/kumiko-types/snapshot-types";
 import type { DbConnection, DbRunner } from "../db/connection.ts";
 import type { TenantId } from "../engine/types/index.ts";
-export declare const snapshotsTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const snapshotsTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare function createSnapshotsTable(db: DbConnection): Promise<void>;
 export declare function effectiveSnapshotGeneration(callerVersion: number, entityEventVersion: number | undefined): number;
 export type Snapshot<TState extends Record<string, unknown> = Record<string, unknown>> = {

package/dist/event-store/upcaster-dead-letter.d.ts

@@ -1,6 +1,6 @@
 import type { DbConnection, DbRunner } from "../db/connection.ts";
 import type { StoredEvent } from "./event-store.ts";
-export declare const upcasterDeadLetterTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const upcasterDeadLetterTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare function createUpcasterDeadLetterTable(db: DbConnection): Promise<void>;
 export declare function recordUpcasterDeadLetter(db: DbRunner, args: {
     event: StoredEvent;

package/dist/files/storage-tracking.d.ts

@@ -7,7 +7,7 @@ export declare function fileRefStorageDelta(event: {
     readonly bytes: number;
     readonly files: number;
 } | null;
-export declare const tenantStorageUsageTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const tenantStorageUsageTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare const filesStorageTrackingFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/files/upload-ledger.d.ts

@@ -1,10 +1,10 @@
+import type { WritableTable } from "@cosmicdrift/kumiko-types/executor-brand";
 import type { FileProviderResolver, FileUploadLedger } from "@cosmicdrift/kumiko-types/file-provider-resolver-types";
 import type { FileStorageProvider } from "@cosmicdrift/kumiko-types/file-storage-provider-types";
 import type { TenantId } from "@cosmicdrift/kumiko-types/identifiers";
 import type { DbConnection } from "../db/connection.ts";
-import { type EntityTableMeta } from "../db/entity-table-meta.ts";
 import { type TenantDb } from "../db/tenant-db.ts";
-export declare const fileUploadLedgerTable: EntityTableMeta;
+export declare const fileUploadLedgerTable: WritableTable;
 export declare function createFileUploadLedger(db: DbConnection | TenantDb, tenantId: TenantId): FileUploadLedger;
 export declare function withUploadLedger(resolver: (tenantId: TenantId) => Promise<FileStorageProvider>, db: DbConnection | TenantDb): FileProviderResolver;
 export declare function takeUploadLedgerEntry(txDb: TenantDb, storageKey: string): Promise<boolean>;

package/dist/internal/testing.d.ts

@@ -1,6 +1,11 @@
+import type { DbRunner } from "@cosmicdrift/kumiko-types/db-connection";
+import type { ExecutorManagedRunner } from "@cosmicdrift/kumiko-types/executor-brand";
 import type { AnyDb } from "../db/query.ts";
+import { type ExecutorManagedTenantDb, type TenantDb } from "../db/tenant-db.ts";
 export { resetBlindIndexKeyForTests } from "../crypto/blind-index.ts";
 export { resetEventPiiCatalogForTests } from "../crypto/event-pii.ts";
 export { resetPiiSubjectKmsForTests } from "../crypto/pii-field-encryption.ts";
 export { resetEntityFieldEncryptionCacheForTests } from "../db/entity-field-encryption.ts";
-export declare function withExecutorManagedWritesForTests(db: AnyDb): AnyDb;
+export declare function withExecutorManagedWritesForTests(db: TenantDb): ExecutorManagedTenantDb;
+export declare function withExecutorManagedWritesForTests(db: DbRunner): ExecutorManagedRunner;
+export declare function withExecutorManagedWritesForTests(db: AnyDb): ExecutorManagedTenantDb | ExecutorManagedRunner;

package/dist/internal/testing.js

@@ -1,10 +1,9 @@
-import { createTenantDb, withExecutorManagedWrites } from "../db/tenant-db.js";
+import { createTenantDb, withExecutorManagedWrites, } from "../db/tenant-db.js";
 import { isBoundTenantDb, isDbRunner, tenantDbRunner } from "../db/tenant-db-runner.js";
 export { resetBlindIndexKeyForTests } from "../crypto/blind-index.js";
 export { resetEventPiiCatalogForTests } from "../crypto/event-pii.js";
 export { resetPiiSubjectKmsForTests } from "../crypto/pii-field-encryption.js";
 export { resetEntityFieldEncryptionCacheForTests } from "../db/entity-field-encryption.js";
-// Seeds and teardown write read-model rows without events; the capability is the sanctioned test seam.
 export function withExecutorManagedWritesForTests(db) {
     if (isBoundTenantDb(db)) {
         return createTenantDb({

package/dist/migrations/pending-rebuilds.d.ts

@@ -3,7 +3,7 @@ import type { Registry } from "../engine/types/index.ts";
 import type { JobRunner } from "../jobs/index.ts";
 import type { Logger } from "../logging/types.ts";
 import { type RebuildResult } from "../pipeline/index.ts";
-export declare const pendingRebuildsTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const pendingRebuildsTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare function createPendingRebuildsTable(db: DbConnection): Promise<void>;
 /** Liest die rebuild-Marker der frisch applizierten Migrations und queued
  *  die betroffenen Tabellen. Upsert: ein bereits pending-er Tisch behält

package/dist/migrations/pii-event-backfill.d.ts

@@ -2,7 +2,7 @@ import type { DbConnection } from "../db/connection.ts";
 import { type PiiBackfillFailure } from "../db/queries/backfill-pii.ts";
 import type { Registry } from "../engine/types/index.ts";
 import type { Logger } from "../logging/types.ts";
-export declare const piiBackfillStateTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const piiBackfillStateTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare function createPiiBackfillStateTable(db: DbConnection): Promise<void>;
 export declare function piiAnnotationEntries(registry: Registry): readonly string[];
 export declare function piiAnnotationFingerprint(registry: Registry): string;

package/dist/pipeline/event-consumer-state.d.ts

@@ -5,7 +5,7 @@ export type PendingGapEntry = {
     readonly to: string;
     readonly xmax: string;
 };
-export declare const eventConsumerStateTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const eventConsumerStateTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare const ConsumerStatuses: {
     readonly idle: "idle";
     readonly processing: "processing";

package/dist/pipeline/projection-state.d.ts

@@ -1,5 +1,5 @@
 import type { DbConnection } from "../db/connection.ts";
-export declare const projectionStateTable: import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare const projectionStateTable: import("@cosmicdrift/kumiko-types/executor-brand").WritableSchemaTable;
 export declare const ProjectionStatuses: {
     readonly idle: "idle";
     readonly rebuilding: "rebuilding";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.379.0",
+  "version": "0.380.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -199,7 +199,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.379.0",
+    "@cosmicdrift/kumiko-types": "0.380.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -215,7 +215,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.379.0",
+    "@cosmicdrift/kumiko-testing": "0.380.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.380.0",
+    "type": "breaking",
+    "title": "Writes compile only for Writable tables or capable runners",
+    "detail": "The negative ExecutorOnly brand is replaced by positive brands. table(), defineUnmanagedTable and deriveEntityTableMeta with source \"unmanaged\" return Writable tables; buildEntityTable and r.projection tables do not. insertOne, updateMany, deleteMany, the upsert and counter helpers and the TenantDb and db.global() write methods accept a Writable table, or any table when the runner is an ExecutorManagedRunner or ExecutorManagedTenantDb. Widening a table to SchemaTable or EntityTableMeta drops the brand, so erased tables no longer compile. Projection apply functions receive tx as ExecutorManagedRunner. The runtime lock is unchanged.",
+    "migration": "Apply functions that annotate `tx` as `DbRunner`, inline or standalone, type it as `ExecutorManagedRunner` (or drop the annotation / annotate the function with SingleStreamApplyFn/MultiStreamApplyFn). Own write helpers take `WritableTable` for direct-write tables, or `ExecutorManagedRunner` / `ExecutorManagedTenantDb` when they write event-fed tables from an apply, rebuild or tenant-destroy context, instead of `SchemaTable`/`EntityTableMeta`. Tables annotated as `SchemaTable` lose the `Writable` brand; drop the annotation or add `& Writable`. Tenant-destroy hooks keep using the db they receive. Affects kumiko-enterprise, solon, money-horse, kumiko-studio, publicstatus."
+  },
   {
     "version": "0.379.0",
     "type": "improvement",