@cosmicdrift/kumiko-framework 0.388.0 → 0.389.0

package/dist/i18n/required-surface-keys.js

@@ -199,8 +199,9 @@ function pushRelatedListSectionKeys(out, section) {
     }
     for (const action of section.rowActions ?? [])
         pushRowActionKeys(out, action);
-    pushKey(out, section.groupBy?.label);
-    for (const label of Object.values(section.groupBy?.labels ?? {}))
+    const grouping = section.table?.grouping;
+    pushKey(out, grouping?.label);
+    for (const label of Object.values(grouping?.labels ?? {}))
         pushKey(out, label);
 }
 function pushListEmptyStateKeys(out, emptyState) {
@@ -237,6 +238,8 @@ function pushListChromeKeys(out, list) {
         pushRowActionKeys(out, action);
     for (const action of list.toolbarActions ?? [])
         pushToolbarActionKeys(out, action);
+    for (const bulk of list.bulkActions ?? [])
+        pushKey(out, bulk.confirm);
 }
 function collectEntityListKeys(ctx, list) {
     for (const col of list.columns) {
@@ -372,6 +375,8 @@ function collectProjectionDetailKeys(ctx, detail) {
         }
         if (section.kind === "relatedList") {
             pushRelatedListSectionKeys(ctx.out, section);
+            for (const bulk of section.bulkActions ?? [])
+                pushKey(ctx.out, bulk.confirm);
             continue;
         }
         if (isWriteFormEditSection(section)) {

package/dist/internal/testing.js

@@ -14,5 +14,5 @@ export function withExecutorManagedWritesForTests(db) {
     }
     if (isDbRunner(db))
         return withExecutorManagedWrites(db);
-    throw new Error("withExecutorManagedWritesForTests: expected a TenantDb or a postgres-js runner");
+    throw new Error("withExecutorManagedWritesForTests: expected a TenantDb or a Bun.SQL runner");
 }

package/dist/jobs/job-runner-scope.js

@@ -13,21 +13,21 @@ export function laneForJob(def) {
 // lane (jobDef.runIn is static), but walking both is cheap and avoids
 // a subtle bug if someone ever reassigns a job to a different lane
 // between deploys while old queue contents are still draining.
+// One getJobs per queue reads the requested lists in a single Lua script, so a job
+// moving from waiting to active between two separate reads can no longer vanish
+// from the count; that gap let a third dispatch pass the cap in CI.
 // `activeOnly` + `self` serve the defer check, which runs inside the job being
 // counted: it must not see waiting jobs or itself, and only counts jobs that
 // became active before it. Without that order, workers that fetch a burst of
 // jobs together all see each other as active and all defer, again and again.
 export async function isOverPerTenantLimit(scope, jobName, tenantId, max, countFilter = {}) {
     const { queues } = scope;
-    const results = await Promise.all([
-        queues.api.getActive(),
-        queues.worker.getActive(),
-        ...(countFilter.activeOnly ? [] : [queues.api.getWaiting(), queues.worker.getWaiting()]),
-    ]);
+    const types = countFilter.activeOnly ? ["active"] : ["active", "waiting"];
+    const results = await Promise.all([queues.api.getJobs(types), queues.worker.getJobs(types)]);
     let count = 0;
     for (const list of results) {
         for (const j of list) {
-            if (j.name !== jobName)
+            if (j === undefined || j.name !== jobName)
                 continue;
             if (countFilter.self && !isActiveBefore(j, countFilter.self))
                 continue;

package/dist/jobs/job-runner.js

@@ -264,6 +264,9 @@ export function createJobRunner(options) {
                 // a hanging process instead of a non-zero exit.
                 await worker?.close();
                 worker = null;
+                // A failed start() may never be followed by stop(); the abandoned gate must not keep
+                // writing to DB/Redis while the process shuts down.
+                await settleAbandonedBootGates(Math.min(bootRedisTimeoutMs, STOP_QUEUE_READY_TIMEOUT_MS));
                 throw err;
             }
             finally {

package/dist/observability/escape-hatch-report.js

@@ -40,6 +40,12 @@ const READ_WINDOW_KINDS = new Set([
 // A long-lived worker must leave an audit event inside every retention window
 // (90 days), or its crons vanish from the log once the first event is pruned.
 const PROCESS_REAUDIT_INTERVAL_MS = 24 * 60 * 60 * 1000;
+// Declared escape hatches of system crons are audited once per day and process for each
+// (handler, kind, tenant, target): the declaration, the system actor and the reason are
+// identical on every run, so repeats carry no information. The target is part of the
+// key only where it names a table (one run can write several global tables); a row target
+// would add a key and an audit event per touched foreign row.
+const TABLE_TARGET_KINDS = new Set(["global-write"]);
 // Row-level targets add a key per touched row; without a sweep a long-lived worker keeps them all.
 function sweepExpiredProcessDedup(dedup, nowMs) {
     if (nowMs - dedup.lastSweep.atMs >= PROCESS_REAUDIT_INTERVAL_MS) {
@@ -157,12 +163,13 @@ export function createEscapeHatchReporter(opts) {
             emitEscapeHatchUse(opts.meter, opts.handler, kind);
         const { processDedup } = opts;
         if (processDedup?.kinds.has(kind)) {
+            const keyTarget = TABLE_TARGET_KINDS.has(kind) ? target : undefined;
             const processKey = JSON.stringify([
                 opts.handler,
                 kind,
                 opts.tenantId,
-                target?.id ?? null,
-                target?.tenantId ?? null,
+                keyTarget?.id ?? null,
+                keyTarget?.tenantId ?? null,
             ]);
             const nowMs = now();
             const lastAuditedAt = processDedup.lastAuditedAt.get(processKey);

package/dist/pipeline/after-rollback-sink.d.ts

@@ -0,0 +1,6 @@
+import type { createFallbackLogger } from "../logging/utils.ts";
+import type { AfterCommitHook } from "./dispatcher-utils.ts";
+export type AfterRollbackHook = () => Promise<void>;
+export declare function afterRollbackHooksOf(commitSink: AfterCommitHook[]): AfterRollbackHook[];
+export declare function carrySavepointRollbackHooks(innerCommitSink: AfterCommitHook[], outerCommitSink: AfterCommitHook[], savepointRolledBack: boolean): void;
+export declare function flushAfterRollback(commitSink: AfterCommitHook[], logError: Pick<ReturnType<typeof createFallbackLogger>, "error">): Promise<void>;

package/dist/pipeline/after-rollback-sink.js

@@ -0,0 +1,32 @@
+// Side channel keyed by the afterCommit sink array, so executeWrite and friends keep their signatures.
+// Invariant: every registration runs at most once, and only if the work it compensates was discarded.
+const rollbackSinks = new WeakMap();
+export function afterRollbackHooksOf(commitSink) {
+    const existing = rollbackSinks.get(commitSink);
+    if (existing)
+        return existing;
+    const created = [];
+    rollbackSinks.set(commitSink, created);
+    return created;
+}
+// A rolled-back savepoint is not compensated immediately: the compensation could wait on locks of
+// the still-open outer transaction. It runs once after that transaction ends, via the commit sink
+// on commit or the rollback sink on rollback.
+export function carrySavepointRollbackHooks(innerCommitSink, outerCommitSink, savepointRolledBack) {
+    const innerHooks = rollbackSinks.get(innerCommitSink) ?? [];
+    if (innerHooks.length > 0) {
+        if (savepointRolledBack)
+            outerCommitSink.push(...innerHooks);
+        afterRollbackHooksOf(outerCommitSink).push(...innerHooks);
+    }
+}
+export async function flushAfterRollback(commitSink, logError) {
+    const hooks = rollbackSinks.get(commitSink) ?? [];
+    const outcomes = await Promise.allSettled(hooks.map((hook) => hook()));
+    for (const outcome of outcomes) {
+        if (outcome.status === "rejected") {
+            const detail = outcome.reason instanceof Error ? outcome.reason.message : String(outcome.reason);
+            logError.error("afterRollback hook failed", { error: detail });
+        }
+    }
+}

package/dist/pipeline/dispatch-batch.js

@@ -3,6 +3,7 @@ import { transaction } from "../db/query.js";
 import { InternalError, toWriteErrorInfo, UnprocessableError, writeFailure, } from "../errors/index.js";
 import { createFallbackLogger } from "../logging/utils.js";
 import { parseJsonSafe } from "../utils/safe-json.js";
+import { flushAfterRollback } from "./after-rollback-sink.js";
 import { resolveAppPoolDb } from "./dispatch-shared.js";
 import { executeNestedWrite, executeWrite } from "./dispatch-write.js";
 import { BatchRollback, isLifecycleResult, wrapToKumiko, } from "./dispatcher-utils.js";
@@ -36,6 +37,9 @@ async function runReservedCommand(scope, cmd, index, tx) {
     rewrapHooksWithOrigin(afterCommitHooks, hookStart, origin);
     return res;
 }
+function rollbackLogger(scope) {
+    return createFallbackLogger("dispatcher", scope.ctx.appContext.log);
+}
 // Sequential fallback without an outer transaction. A failure result and a throw both end the
 // batch, so both give the reserved capacity back.
 async function runCommandsWithoutTransaction(scope, commands, results) {
@@ -50,12 +54,14 @@ async function runCommandsWithoutTransaction(scope, commands, results) {
                 // No tx means no rollback — but we still drop afterCommit hooks,
                 // matching the semantic "failure = side-effects don't fire".
                 await scope.reservations.releaseAll();
+                await flushAfterRollback(scope.afterCommitHooks, rollbackLogger(scope));
                 return { index: i, error: res.error };
             }
         }
     }
     catch (e) {
         await scope.reservations.releaseAll();
+        await flushAfterRollback(scope.afterCommitHooks, rollbackLogger(scope));
         throw e;
     }
     return undefined;
@@ -208,7 +214,7 @@ async function runBatchBody(ctx, commands, user, requestId, inheritedOrigin) {
         }, reservations.error.httpStatus >= 500);
     }
     // batch() opens its own outer transaction — needs the top-level
-    // connection's `.begin()` (TransactionSql exposes only `.savepoint()`).
+    // connection's `.begin()` (a transaction handle cannot begin another one).
     const db = resolveAppPoolDb(ctx);
     if (!db || runsWithoutTransaction) {
         // Without a DB connection (or for a perCommand handler, whose writes open their own transactions)
@@ -250,6 +256,7 @@ async function runBatchBody(ctx, commands, user, requestId, inheritedOrigin) {
         // Rollback or failed COMMIT: the transaction is over, so the reserved capacity goes back.
         // The release is outcome-safe: it only gives back a reservation row the handler tx did not delete.
         await reservations.releaseAll();
+        await flushAfterRollback(afterCommitHooks, createFallbackLogger("dispatcher", context.log));
         if (e instanceof BatchRollback) {
             // Thrown inside the callback, so the tx rolled back. A 4xx is
             // deterministic and stays cached; a 5xx may be transient.

package/dist/pipeline/dispatch-shared.js

@@ -140,6 +140,9 @@ export function applyMemberResolutionReadOnly(handlerContext) {
         scheduleAfterCommit: () => {
             throw memberResolutionReadOnlyDenied();
         },
+        scheduleAfterRollback: () => {
+            throw memberResolutionReadOnlyDenied();
+        },
         // A read as a member gets no system-scope DB, preSave pipeline or file storage.
         runPreSave: undefined,
         systemDb: undefined,
@@ -199,6 +202,7 @@ export function denyTransactionBoundSurfaces(handlerContext) {
         write: denySurface(beforeTransactionDenied, "write"),
         writeAs: denySurface(beforeTransactionDenied, "writeAs"),
         scheduleAfterCommit: denySurface(beforeTransactionDenied, "scheduleAfterCommit"),
+        scheduleAfterRollback: denySurface(beforeTransactionDenied, "scheduleAfterRollback"),
         ...(handlerContext.notify && { notify: denySurface(beforeTransactionDenied, "notify") }),
         ...(handlerContext.jobRunner && {
             jobRunner: denyingJobRunnerProxy(() => beforeTransactionDenied("jobRunner")),

package/dist/pipeline/event-dispatcher-delivery.js

@@ -212,9 +212,11 @@ export async function deliverEvents(consumer, events, context, maxAttempts, stat
                 resolve(row.id);
                 continue;
             }
-            attempts += 1;
             lastError = errMessage;
             failedEventId = row.id;
+            if (consumer.errorPolicy?.isTransientError?.(e))
+                break;
+            attempts += 1;
             if (attempts >= effectiveMaxAttempts)
                 deadLettered = true;
             break;

package/dist/pipeline/event-dispatcher.d.ts

@@ -7,6 +7,7 @@ export type EventConsumerBatchHandler = (events: readonly StoredEvent[], ctx: Ap
 export type EventConsumerErrorPolicy = {
     readonly skipApplyErrors?: boolean;
     readonly maxAttempts?: number;
+    readonly isTransientError?: (error: unknown) => boolean;
 };
 export type EventConsumer = {
     readonly name: string;

package/dist/pipeline/event-dispatcher.js

@@ -16,12 +16,10 @@ const PENDING_GAPS_WARN_THRESHOLD = 1000;
 // Only these say the database socket itself is gone; timeouts, schema or pool errors do not
 // imply the dedicated LISTEN connection dropped.
 const CONNECTION_LOSS_CODES = new Set([
-    "CONNECTION_CLOSED",
-    "CONNECTION_DESTROYED",
-    "CONNECTION_ENDED",
-    "CONNECT_TIMEOUT",
-    "ECONNREFUSED",
-    "ECONNRESET",
+    "ERR_POSTGRES_CONNECTION_CLOSED",
+    "ERR_POSTGRES_CONNECTION_REFUSED",
+    "ERR_POSTGRES_CONNECTION_TIMEOUT",
+    "ERR_POSTGRES_CONNECTION_FAILED",
     "57P01",
 ]);
 function isConnectionLossError(e) {
@@ -111,7 +109,7 @@ export function createEventDispatcher(options) {
     let pgSubscription = null;
     // Bounds how many consumer turns hold a DB transaction at once. Each turn's
     // db.begin() checks out one pool connection, plus any writes the handler
-    // itself makes via context.db — the app db pool defaults to postgres-js's
+    // itself makes via context.db — the app db pool defaults to Bun.SQL's
     // max=10 (db/connection.ts, no DATABASE_POOL_MAX override) and is shared
     // with HTTP request handlers, so turns can't be allowed to claim it all.
     // A pool no larger than this limit can deadlock: every connection held by
@@ -493,8 +491,7 @@ export function createEventDispatcher(options) {
                     const sub = await options.pgClient.listen(EVENTS_PUBSUB_CHANNEL, runBackgroundPass, () => {
                         // Fires on initial connect and again when the driver's own
                         // re-LISTEN lands after a drop; during an outage that re-LISTEN
-                        // waits in its connection backoff (postgres-js: measured 10-30s
-                        // after the DB returns), polling covers
+                        // waits in the driver's reconnect backoff, polling covers
                         // delivery meanwhile. Never unlisten()
                         // + listen() by hand: that leaves duplicate listeners.
                         // ponytail: no own LISTEN reconnect, the backoff gap is polled;

package/dist/pipeline/handler-context-dispatch.d.ts

@@ -1,4 +1,5 @@
 import type { WriteResult } from "../engine/types/index.ts";
+import { type AfterRollbackHook } from "./after-rollback-sink.ts";
 import { type HandlerTransactionScope } from "./dispatch-shared.ts";
 import { type AfterCommitHook } from "./dispatcher-utils.ts";
 import type { HandlerContextScope } from "./handler-context-scope.ts";
@@ -17,5 +18,6 @@ export declare function buildDispatchFacet(scope: HandlerContextScope, sinks: Co
     };
     scheduleFragment: {
         scheduleAfterCommit?: ((hook: AfterCommitHook) => void) | undefined;
+        scheduleAfterRollback?: ((hook: AfterRollbackHook) => void) | undefined;
     };
 };

package/dist/pipeline/handler-context-dispatch.js

@@ -1,5 +1,7 @@
+import { runWithWriteOrigin } from "../api/request-context.js";
 import { runInSavepoint } from "../db/query.js";
 import { writeFailure } from "../errors/index.js";
+import { afterRollbackHooksOf, carrySavepointRollbackHooks, } from "./after-rollback-sink.js";
 import { runBatch, unwrapSingle } from "./dispatch-batch.js";
 import { executeQuery } from "./dispatch-query.js";
 import { perCommandNestedDenied } from "./dispatch-shared.js";
@@ -40,9 +42,11 @@ async function runNestedWriteInSavepoint(scope, sinks, asUser, targetType, paylo
             return innerResult;
         });
         bridgeSink.push(...innerAfterCommitHooks);
+        carrySavepointRollbackHooks(innerAfterCommitHooks, bridgeSink, false);
         return result;
     }
     catch (e) {
+        carrySavepointRollbackHooks(innerAfterCommitHooks, bridgeSink, true);
         if (e instanceof NestedWriteRollback)
             return e.failure;
         throw e;
@@ -64,6 +68,9 @@ export function buildDispatchFacet(scope, sinks) {
     const scheduleAfterCommit = (hook) => {
         sinks.bridgeSink.push(hook);
     };
+    const scheduleAfterRollback = (hook) => {
+        afterRollbackHooksOf(sinks.bridgeSink).push(() => runWithWriteOrigin(origin, hook));
+    };
     const executeNestedWriteInSavepoint = createSerializedNestedWriter(scope, sinks);
     // Without an open transaction (post-commit hooks, stream/query handlers, perCommand handlers) a bare
     // executeWrite would auto-commit event append, projections and inTransaction hooks separately and its
@@ -84,6 +91,11 @@ export function buildDispatchFacet(scope, sinks) {
             write: (targetType, payload) => writeAsUser(user, targetType, payload),
             writeAs: identitySwitch.writeAs,
         },
-        scheduleFragment: { ...(sinks.hasLiveCommitSink && { scheduleAfterCommit }) },
+        scheduleFragment: {
+            ...(sinks.hasLiveCommitSink && { scheduleAfterCommit }),
+            // perCommand and no-tx paths have earlier commands already committed: nothing to compensate on rollback.
+            ...(sinks.hasLiveCommitSink &&
+                transactionScope === "inTransaction" && { scheduleAfterRollback }),
+        },
     };
 }

package/dist/pipeline/handler-context-events.d.ts

@@ -1,4 +1,4 @@
-import type { AggregateStreamHandle, AppendEventArgs, AppendEventFn, FetchForWritingArgs } from "../engine/types/index.ts";
+import type { AggregateStreamHandle, AppendEventArgs, AppendEventFn, FetchForWritingArgs, HandlerContext } from "../engine/types/index.ts";
 import { IdempotentAppendConflictError as EventStoreIdempotentAppendConflictError, VersionConflictError as EventStoreVersionConflictError } from "../event-store/errors.ts";
 import { type StoredEvent } from "../event-store/event-store.ts";
 import { type LoadAggregateWithSnapshotOptions, type LoadAggregateWithSnapshotResult, type SnapshotReducer } from "../event-store/snapshot.ts";
@@ -20,9 +20,7 @@ export declare function buildEventStoreFacet(scope: HandlerContextScope): {
         conflict: EventStoreIdempotentAppendConflictError;
     }>;
     fetchForWriting: (args: FetchForWritingArgs) => Promise<AggregateStreamHandle>;
-    loadAggregate: (aggregateId: string, loadOptions?: {
-        readonly asOf?: Temporal.Instant;
-    }) => Promise<readonly StoredEvent[]>;
+    loadAggregate: (aggregateId: string, loadOptions?: Parameters<HandlerContext["loadAggregate"]>[1]) => Promise<readonly StoredEvent[]>;
     archiveStream: (aggregateId: string, archiveArgs: {
         readonly aggregateType: string;
         readonly reason?: string;

package/dist/pipeline/handler-context-events.js

@@ -38,9 +38,9 @@ async function appendDomainEvent(ctx, args, user, tx, callerFeature) {
     }, args);
 }
 // Savepoint-scoped append: catches a losing writer's VersionConflictError
-// without poisoning the rest of the handler's transaction. postgres.js
-// aborts the WHOLE begin() on an uncaught statement error
-// (SQLSTATE 25P02) even if the JS error is caught — runInSavepoint
+// without poisoning the rest of the handler's transaction. Postgres
+// aborts the WHOLE transaction on a statement error
+// (SQLSTATE 25P02 until rollback) even if the JS error is caught — runInSavepoint
 // wraps the append in a real SAVEPOINT so only that nested scope rolls
 // back on conflict, and subsequent statements in the outer tx (e.g. a
 // dedup-anchor insert) still succeed. Use when a handler must react to
@@ -127,7 +127,9 @@ function buildLoadAggregate(scope) {
         const dbSource = requireDbSource(ctx, tx, `ctx.loadAggregate("${aggregateId}")`);
         const events = loadOptions?.asOf
             ? await loadAggregateAsOf(dbSource, aggregateId, user.tenantId, loadOptions.asOf)
-            : await loadAggregate(dbSource, aggregateId, user.tenantId);
+            : await loadAggregate(dbSource, aggregateId, user.tenantId, {
+                ...(loadOptions?.atVersion !== undefined && { atVersion: loadOptions.atVersion }),
+            });
         return upcastStoredEvents(events, registry.getEventUpcasters(), {
             db: dbSource,
             tenantId: user.tenantId,

package/dist/pipeline/system-hooks.d.ts

@@ -22,4 +22,6 @@ export declare function createSseBroadcastEventConsumer(sseBroker: SseBroker): E
 export declare const JOB_TRIGGER_CONSUMER_NAME = "system:consumer:job-trigger";
 export declare function createJobTriggerEventConsumer(jobRunner: JobRunnerRef, registry: Registry): EventConsumer;
 export declare const ACCESS_INVALIDATION_CONSUMER_NAME = "system:consumer:access-invalidation";
-export declare function createAccessInvalidationEventConsumer(sseBroker: SseBroker): EventConsumer;
+export declare function createAccessInvalidationEventConsumer(sseBroker: SseBroker, opts?: {
+    readonly now?: () => number;
+}): EventConsumer;

package/dist/pipeline/system-hooks.js

@@ -552,9 +552,58 @@ function readPatRevokedScope(payload) {
     const tokenIds = readNonEmptyStringArray(payload["tokenIds"]);
     return tokenIds ? { kind: "pat-tokens", tokenIds } : { kind: "user" };
 }
-export function createAccessInvalidationEventConsumer(sseBroker) {
+const ACCESS_INVALIDATION_BACKOFF_INITIAL_MS = 250;
+const ACCESS_INVALIDATION_BACKOFF_MAX_MS = 10_000;
+// Only the publish can fail because Redis is unreachable. The consumer must keep retrying those
+// until Redis is back (dead-lettering would silently stop every later revocation reaching open
+// streams), while any other failure keeps the dispatcher's attempt limit so one poison event
+// cannot hold back every later revocation for good.
+class AccessInvalidationTransportError extends Error {
+    constructor(cause) {
+        super(cause instanceof Error ? cause.message : String(cause), { cause });
+        this.name = "AccessInvalidationTransportError";
+    }
+}
+function isAccessInvalidationTransportError(error) {
+    return error instanceof AccessInvalidationTransportError;
+}
+// The gate rethrows without touching Redis until the backoff elapsed.
+function withTransportBackoff(handle, now) {
+    let delayMs = ACCESS_INVALIDATION_BACKOFF_INITIAL_MS;
+    let retryNotBefore = 0;
+    let transportError = null;
+    return async (event) => {
+        if (transportError !== null && now() < retryNotBefore)
+            throw transportError;
+        try {
+            await handle(event);
+            delayMs = ACCESS_INVALIDATION_BACKOFF_INITIAL_MS;
+            transportError = null;
+        }
+        catch (err) {
+            if (isAccessInvalidationTransportError(err)) {
+                transportError = err;
+                retryNotBefore = now() + delayMs;
+                delayMs = Math.min(delayMs * 2, ACCESS_INVALIDATION_BACKOFF_MAX_MS);
+            }
+            throw err;
+        }
+    };
+}
+export function createAccessInvalidationEventConsumer(sseBroker, opts = {}) {
+    const now = opts.now ?? Date.now;
+    const publish = async (userId, scope) => {
+        try {
+            await sseBroker.publishAccessInvalidation(userId, scope);
+        }
+        catch (cause) {
+            throw new AccessInvalidationTransportError(cause);
+        }
+    };
     return {
         name: ACCESS_INVALIDATION_CONSUMER_NAME,
+        // Count-based dead-lettering would end after a few seconds of Redis downtime.
+        errorPolicy: { isTransientError: isAccessInvalidationTransportError },
         // Shared delivery, same reasoning as SSE broadcast: one
         // cursor reads every event once and calls sseBroker.publishAccessInvalidation
         // below, which a Redis-backed broker republishes to every replica's
@@ -565,7 +614,7 @@ export function createAccessInvalidationEventConsumer(sseBroker) {
         // existed has nothing to invalidate — replaying it would be a no-op at
         // best and a spurious stream-close at worst.
         startFrom: "now",
-        handler: async (event) => {
+        handler: withTransportBackoff(async (event) => {
             if (event.type === SESSION_REVOKED_EVENT_TYPE) {
                 const userId = event.payload["userId"];
                 // skip: malformed session-revoked payload — fail open on this one
@@ -574,7 +623,7 @@ export function createAccessInvalidationEventConsumer(sseBroker) {
                 // every user behind one bad row).
                 if (typeof userId !== "string" || userId.length === 0)
                     return;
-                await sseBroker.publishAccessInvalidation(userId, readSessionRevokedScope(event.payload));
+                await publish(userId, readSessionRevokedScope(event.payload));
             }
             if (event.type === PAT_REVOKED_EVENT_TYPE) {
                 const userId = event.payload["userId"];
@@ -582,7 +631,7 @@ export function createAccessInvalidationEventConsumer(sseBroker) {
                 // session-revoked above.
                 if (typeof userId !== "string" || userId.length === 0)
                     return;
-                await sseBroker.publishAccessInvalidation(userId, readPatRevokedScope(event.payload));
+                await publish(userId, readPatRevokedScope(event.payload));
             }
             if (event.type === TENANT_MEMBERSHIP_UPDATED_EVENT_TYPE ||
                 event.type === TENANT_MEMBERSHIP_DELETED_EVENT_TYPE) {
@@ -591,8 +640,8 @@ export function createAccessInvalidationEventConsumer(sseBroker) {
                 // reasoning as above.
                 if (userId === undefined)
                     return;
-                await sseBroker.publishAccessInvalidation(userId);
+                await publish(userId);
             }
-        },
+        }, now),
     };
 }

package/dist/pipeline/write-result-masking.js

@@ -1,19 +1,24 @@
 import { maskWriteOnlyFields } from "../engine/field-access.js";
 import { isLifecycleResult } from "./dispatcher-utils.js";
+// The echoed event carries plaintext entity data; only hooks and projections may read it.
 function maskLifecycleOrRow(entity, data) {
     if (typeof data !== "object" || data === null || Array.isArray(data))
         return data;
-    if (!isLifecycleResult(data))
-        return maskWriteOnlyFields(entity, data); // @cast-boundary engine-payload
-    if (data.kind === "save") {
+    if (!isLifecycleResult(data)) {
+        return entity ? maskWriteOnlyFields(entity, data) : data; // @cast-boundary engine-payload
+    }
+    const { event: _event, ...lifecycle } = data;
+    if (!entity)
+        return lifecycle;
+    if (lifecycle.kind === "save") {
         return {
-            ...data,
-            data: maskWriteOnlyFields(entity, data.data),
-            changes: maskWriteOnlyFields(entity, data.changes),
-            previous: maskWriteOnlyFields(entity, data.previous),
+            ...lifecycle,
+            data: maskWriteOnlyFields(entity, lifecycle.data),
+            changes: maskWriteOnlyFields(entity, lifecycle.changes),
+            previous: maskWriteOnlyFields(entity, lifecycle.previous),
         };
     }
-    return { ...data, data: maskWriteOnlyFields(entity, data.data) };
+    return { ...lifecycle, data: maskWriteOnlyFields(entity, lifecycle.data) };
 }
 // Copy-on-mask: the original results still feed postSaveBatch hooks, which
 // need the plaintext. Only what leaves the dispatcher is masked.
@@ -22,8 +27,6 @@ export function maskWriteResultForClient(registry, handlerType, result) {
         return result;
     const entityName = registry.getHandlerEntity(handlerType);
     const entity = entityName ? registry.getEntity(entityName) : undefined;
-    if (!entity)
-        return result;
     const data = maskLifecycleOrRow(entity, result.data);
     return data === result.data ? result : { ...result, data };
 }

package/dist/schema-cli/baseline-command.js

@@ -10,7 +10,7 @@ export async function runBaselineCommand(ctx) {
         return 1;
     if (!migrationsDirExistsOrReport(ctx))
         return 1;
-    const { db, close } = createDbConnection({ url: dbUrl });
+    const { db, close } = createDbConnection({ url: dbUrl, maxConnections: 1 });
     try {
         const result = await baselineMigrations(db, loadMigrationsFromDir(migrationsDir));
         out.log("");

package/dist/schema-cli/status-command.js

@@ -42,7 +42,7 @@ export async function runStatusCommand(ctx) {
         return 0;
     }
     const local = loadMigrationsFromDir(migrationsDir);
-    const { db, close } = createDbConnection({ url: dbUrl });
+    const { db, close } = createDbConnection({ url: dbUrl, maxConnections: 1 });
     try {
         const applied = await fetchAppliedMigrationIds(db);
         out.log("");

package/dist/search/reindex-entity.js

@@ -6,7 +6,7 @@
 // existing row and indexes it, same as a live write would.
 import { resolveTableName } from "../db/entity-table-meta.js";
 import { executeRawQueryRead } from "../db/queries/raw-sql.js";
-import { withoutStatementTimeout } from "../db/statement-timeout.js";
+import { runInNewTransaction, runnerCanBeginTransaction } from "../db/query.js";
 import { buildSearchDocument, decryptSearchableSubjectFields, hasErasedSearchableSubjectField, } from "../pipeline/system-hooks.js";
 import { toSnakeCase } from "../utils/case.js";
 function quoteIdent(name) {
@@ -26,10 +26,20 @@ function rowToState(row, fieldNames) {
     }
     return state;
 }
-export function reindexEntity(db, registry, searchAdapter, entityName, tenantId, options = {}) {
-    return withoutStatementTimeout(db, (unboundedDb) => scanAndIndexEntity(unboundedDb, registry, searchAdapter, entityName, tenantId, options));
+// Server pools cap statement_timeout, and a batch scan over a large table can outlast it. The caller's
+// runner (often a gated proxy around the pool) is used as is, so the cap is lifted per batch
+// with a transaction-local set_config instead of moving the scan to an ungated sibling pool. A runner already inside a
+// transaction keeps the caller's setting rather than leaking ours into its remaining statements.
+async function readBatchWithoutStatementTimeout(db, sqlText, params) {
+    if (!runnerCanBeginTransaction(db)) {
+        return executeRawQueryRead(db, sqlText, params);
+    }
+    return runInNewTransaction(db, async (tx) => {
+        await executeRawQueryRead(tx, "SELECT set_config('statement_timeout', '0', true)", []);
+        return executeRawQueryRead(tx, sqlText, params);
+    });
 }
-async function scanAndIndexEntity(db, registry, searchAdapter, entityName, tenantId, options) {
+export async function reindexEntity(db, registry, searchAdapter, entityName, tenantId, options = {}) {
     const entity = registry.getEntity(entityName);
     if (!entity) {
         throw new Error(`reindexEntity: unknown entity "${entityName}"`);
@@ -61,7 +71,7 @@ async function scanAndIndexEntity(db, registry, searchAdapter, entityName, tenan
     for (;;) {
         // Keyset, not OFFSET: rows deleted or changed while the loop runs must not shift the window.
         const afterLastId = lastId === undefined ? "" : `AND ${quoteIdent("id")} > $3`;
-        const rows = await executeRawQueryRead(db, `SELECT * FROM ${quoteIdent(tableName)}
+        const rows = await readBatchWithoutStatementTimeout(db, `SELECT * FROM ${quoteIdent(tableName)}
         WHERE ${quoteIdent("tenant_id")} = $1 ${deletedFilter} ${afterLastId}
         ORDER BY ${quoteIdent("id")} ASC
         LIMIT $2`, lastId === undefined ? [tenantId, batchSize] : [tenantId, batchSize, lastId]);

package/dist/ui-types/index.d.ts

@@ -11,8 +11,8 @@ export type { BooleanFieldDef, DateFieldDef, EmbeddedDerivedCellDef, EntityDefin
 export type { AccessRule, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, RoleAccessPersonalData, RoleAccessRule, } from "../engine/types/handlers.ts";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.ts";
 export type { IconKey, NavDefinition, NavIconKey } from "../engine/types/nav.ts";
-export type { ActionFormFooterAction, ActionFormLoad, ActionFormRedirect, ActionFormScreenDefinition, ActionFormSuccessFact, ActionFormSuccessLink, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, FieldAffix, FieldCondition, FieldFillAction, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListGroupBy, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionClientAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.ts";
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.ts";
+export type { ActionFormFooterAction, ActionFormLoad, ActionFormRedirect, ActionFormScreenDefinition, ActionFormSuccessFact, ActionFormSuccessLink, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, EntityWriteExcludedFields, ExpandableRowGrouping, FieldAffix, FieldCondition, FieldFillAction, FieldIconKey, FieldRenderer, FormWidth, ListBadgeTone, ListBulkAction, ListColumnDisplay, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListSortSpec, ListTableDensity, ListTableOptions, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSubtitlePart, RelatedListRowTone, RelatedListToolbarAction, RowAction, RowActionClientAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, } from "../engine/types/screen.ts";
+export { MAX_BULK_SELECTION, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.ts";
 export type { TargetRef } from "../engine/types/target-ref.ts";
 export type { TreeAction, TreeNode, TreeNodeState } from "../engine/types/tree-node.ts";
 export type { WorkspaceDefinition } from "../engine/types/workspace.ts";

package/dist/ui-types/index.js

@@ -25,7 +25,7 @@ export { applyFormDerivations, isFormDerivationInputMode, isUnusedFallbackOperan
 export { parseRefTarget } from "../engine/parse-ref-target.js";
 export { ACTION_FORM_PSEUDO_ENTITY, availableSelectOptions, evalFieldCondition, explicitListScreenId, findUnavailableSelectOptions, isExtensionEditSection, isFieldsEditSection, isFormatSpec, isRecordLocked, isUnchangedValue, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../engine/screen-helpers.js";
 export { isOpenToAllGranted, isUiAccessGranted } from "../engine/types/handlers.js";
-export { relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
+export { MAX_BULK_SELECTION, relatedListGroupHeaderLabel, relatedListGroupKey, } from "../engine/types/screen.js";
 export { ACTION_FORM_ENTITY, handlerFieldLabelKey, handlerTitleKey, PROJECTION_DETAIL_ENTITY, WRITE_FORM_SECTION_ENTITY, } from "../i18n/required-surface-keys.js";
 export { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind } from "./card-column-roles.js";
 export { formalLocaleTag } from "./formality.js";

package/dist/upgrade-changelog.d.ts

@@ -23,3 +23,5 @@ export type UpgradeChangelogSection = {
 export declare function renderUpgradeSection(section: UpgradeChangelogSection): string;
 /** Puts the section on top; a section for the same target version is replaced, so a re-run stays idempotent. */
 export declare function mergeUpgradeSection(existing: string | undefined, section: UpgradeChangelogSection): string;
+/** Pure string match on the rendered `- [open] <id> · ` prefix, in every section. */
+export declare function setManualStatusInChangelog(content: string, ids: ReadonlySet<string>, resolution: "migrated" | "not-applicable"): string;