@cosmicdrift/kumiko-framework 0.388.0 → 0.389.0

package/dist/db/closed-connection.js

@@ -5,7 +5,7 @@ import { extractPgError } from "./pg-error.js";
 // A pool can briefly keep handing out connections the server just closed.
 // Each failed attempt discards one, so retries are bounded by pool size.
 const CLOSED_CONNECTION_CODES = new Set([
-    "CONNECTION_CLOSED", // postgres-js
+    "ERR_POSTGRES_CONNECTION_CLOSED", // Bun.SQL
     "57P01", // PG SQLSTATE: admin_shutdown / terminated backend
 ]);
 export function isClosedConnectionError(err) {
@@ -21,40 +21,33 @@ export function isPooledClient(raw) {
         typeof propertyOf(raw, "savepoint") !== "function" &&
         typeof propertyOf(raw, "release") !== "function");
 }
-const closedConnectionLog = createFallbackLogger("postgres-js");
-// The driver rejects in-flight queries with this AbortError (no code) when the
-// pool closes under them, so isClosedConnectionError can't see it.
-const DRIVER_CLOSED_ABORT_MESSAGE = "The connection was closed.";
-function isDriverClosedAbort(err) {
-    return (err instanceof Error && err.name === "AbortError" && err.message === DRIVER_CLOSED_ABORT_MESSAGE);
-}
+const closedConnectionLog = createFallbackLogger("bun-sql");
 function isHandleLike(raw) {
     return raw !== null && (typeof raw === "object" || typeof raw === "function");
 }
-// postgres-js pool and tx handles both carry `typed`.
+// Bun.SQL pool and tx handles both carry `flush`.
 function driverOf(raw) {
     if (!isHandleLike(raw))
         return "unknown";
-    if (typeof raw["typed"] === "function")
-        return "postgres-js";
+    if (typeof raw["flush"] === "function")
+        return "bun-sql";
     return "unknown";
 }
 function positiveNumber(v) {
     return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined;
 }
-// postgres-js configures timeouts in seconds.
+// Bun.SQL reports its timeout options in milliseconds.
 function timeoutOptionMs(options, driver, optionName) {
-    if (driver !== "postgres-js")
+    if (driver !== "bun-sql")
         return undefined;
-    const seconds = positiveNumber(options[optionName]);
-    return seconds === undefined ? undefined : seconds * 1000;
+    return positiveNumber(options[optionName]);
 }
 function errorProp(err, name) {
     return isHandleLike(err) ? err[name] : undefined;
 }
 // Deliberately excludes SQL text and parameters: app SQL can carry PII.
 export function describeClosedConnectionFailure(raw, err, attempts) {
-    if (!isClosedConnectionError(err) && !isDriverClosedAbort(err))
+    if (!isClosedConnectionError(err))
         return undefined;
     const driver = driverOf(raw);
     const rawOptions = isHandleLike(raw) ? raw["options"] : undefined;
@@ -64,9 +57,9 @@ export function describeClosedConnectionFailure(raw, err, attempts) {
         pooled: isPooledClient(raw),
         attempts,
         poolMax: positiveNumber(options["max"]),
-        idleTimeoutMs: timeoutOptionMs(options, driver, "idle_timeout"),
-        maxLifetimeMs: timeoutOptionMs(options, driver, "max_lifetime"),
-        connectionTimeoutMs: timeoutOptionMs(options, driver, "connect_timeout"),
+        idleTimeoutMs: timeoutOptionMs(options, driver, "idleTimeout"),
+        maxLifetimeMs: timeoutOptionMs(options, driver, "maxLifetime"),
+        connectionTimeoutMs: timeoutOptionMs(options, driver, "connectionTimeout"),
         errorName: errorProp(err, "name"),
         errorCode: extractPgError(err)?.code ?? errorProp(err, "code"),
         errorErrno: errorProp(err, "errno"),

package/dist/db/connection.d.ts

@@ -1,14 +1,12 @@
-import type { DbConnection, PgClient } from "@cosmicdrift/kumiko-types/db-connection";
-import postgres from "postgres";
+import type { DbConnection, PgClient, PgListenClient } from "@cosmicdrift/kumiko-types/db-connection";
 export type * from "@cosmicdrift/kumiko-types/db-connection";
-type PostgresDriverOptions = NonNullable<Parameters<typeof postgres>[1]>;
+type BunSqlOptions = Bun.SQL.PostgresOrMySQLOptions;
 export type DbConnectionOptions = {
     readonly maxConnections?: number;
     readonly idleTimeoutSeconds?: number;
     readonly connectTimeoutSeconds?: number;
     readonly closeTimeoutSeconds?: number;
-    readonly ssl?: PostgresDriverOptions["ssl"];
-    readonly onNotice?: (notice: postgres.Notice) => void;
+    readonly ssl?: BunSqlOptions["tls"];
     readonly statementTimeoutMs?: number;
     readonly idleInTransactionSessionTimeoutMs?: number;
     readonly lockTimeoutMs?: number;
@@ -19,6 +17,7 @@ export type CreateDbConnectionOptions = DbConnectionOptions & {
 export type DbConnectionHandle = {
     db: DbConnection;
     client: PgClient;
+    listenClient: PgListenClient;
     close: () => Promise<void>;
 };
 export declare const DEFAULT_DB_CLOSE_TIMEOUT_SECONDS = 5;

package/dist/db/connection.js

@@ -1,7 +1,6 @@
-import postgres from "postgres";
 import { readPositiveIntEnv } from "../utils/env-parse.js";
 // A DB outage can leave an in-flight query referenced on a dead connection,
-// so a plain end() (no timeout = wait for queries to finish) hangs forever —
+// so a plain close() (no timeout = wait for queries to finish) hangs forever —
 // close() must always bound how long shutdown waits.
 export const DEFAULT_DB_CLOSE_TIMEOUT_SECONDS = 5;
 // Keyed by the pool so withoutStatementTimeout can open a sibling with identical connect options.
@@ -11,20 +10,28 @@ export function openUnboundedSiblingPool(db) {
         return undefined;
     return unboundedSiblingFactories.get(db)?.();
 }
+// Bun.SQL treats `true` and a TLS object without rejectUnauthorized as sslmode=require, which
+// skips certificate checks; postgres-js verified in both cases, so keep that unless turned off.
+function verifiedTls(ssl) {
+    if (ssl === true)
+        return "verify-full";
+    if (typeof ssl === "object" && !(ssl instanceof Blob) && ssl.rejectUnauthorized === undefined) {
+        return { ...ssl, rejectUnauthorized: true };
+    }
+    return ssl;
+}
 export function createDbConnection({ url, ...options }) {
-    const pgOptions = {};
+    const sqlOptions = {};
     if (options.maxConnections !== undefined)
-        pgOptions.max = options.maxConnections;
+        sqlOptions.max = options.maxConnections;
     if (options.idleTimeoutSeconds !== undefined) {
-        pgOptions.idle_timeout = options.idleTimeoutSeconds;
+        sqlOptions.idleTimeout = options.idleTimeoutSeconds;
     }
     if (options.connectTimeoutSeconds !== undefined) {
-        pgOptions.connect_timeout = options.connectTimeoutSeconds;
+        sqlOptions.connectionTimeout = options.connectTimeoutSeconds;
     }
     if (options.ssl !== undefined)
-        pgOptions.ssl = options.ssl;
-    if (options.onNotice !== undefined)
-        pgOptions.onnotice = options.onNotice;
+        sqlOptions.tls = verifiedTls(options.ssl);
     const serverParameters = {};
     if (options.statementTimeoutMs !== undefined) {
         serverParameters["statement_timeout"] = options.statementTimeoutMs;
@@ -36,48 +43,50 @@ export function createDbConnection({ url, ...options }) {
     if (options.lockTimeoutMs !== undefined)
         serverParameters["lock_timeout"] = options.lockTimeoutMs;
     if (Object.keys(serverParameters).length > 0)
-        pgOptions.connection = serverParameters;
-    const client = postgres(url, pgOptions);
+        sqlOptions.connection = serverParameters;
+    // Bun.SQL opens all `max` connections on the first query, so a pool always costs `max` backends.
+    const client = new Bun.SQL(url, sqlOptions);
     // A run that never settles (a caller gave up on it via its own timeout) never reaches the
     // sibling's own close; close() ends it so shutdown and DROP DATABASE are not blocked by it.
     const openSiblings = new Set();
     unboundedSiblingFactories.set(client, () => {
         // Two connections are enough for lock-in-tx plus DDL; the cap keeps parallel rebuilds from exhausting max_connections.
-        const sibling = postgres(url, {
-            ...pgOptions,
+        const sibling = new Bun.SQL(url, {
+            ...sqlOptions,
             max: 4,
-            connection: { ...pgOptions.connection, statement_timeout: 0 },
+            connection: { ...sqlOptions.connection, statement_timeout: 0 },
         });
         openSiblings.add(sibling);
         return {
             client: sibling,
             close: async (timeoutSeconds) => {
                 openSiblings.delete(sibling);
-                await sibling.end({ timeout: timeoutSeconds });
+                await sibling.close({ timeout: timeoutSeconds });
             },
         };
     });
     return {
         db: client,
         client,
+        listenClient: client,
         close: async () => {
             const timeout = options.closeTimeoutSeconds ?? DEFAULT_DB_CLOSE_TIMEOUT_SECONDS;
             unboundedSiblingFactories.delete(client);
             const pools = [client, ...openSiblings];
             openSiblings.clear();
-            const results = await Promise.allSettled(pools.map((pool) => pool.end({ timeout })));
+            const results = await Promise.allSettled(pools.map((pool) => pool.close({ timeout })));
             const failure = results.find((result) => result.status === "rejected");
             if (failure !== undefined)
                 throw failure.reason;
         },
     };
 }
-// DB_PROVIDER=bun selected the removed Bun.SQL driver; ignoring it would boot
-// postgres-js under a config that still claims Bun.SQL.
+// DB_PROVIDER once selected between drivers; a config that still sets it is stale,
+// so fail loudly instead of silently ignoring it.
 function assertNoRemovedDbProvider(env) {
     const provider = env["DB_PROVIDER"];
-    if (provider !== undefined && provider !== "" && provider !== "postgres") {
-        throw new Error(`DB_PROVIDER="${provider}" is no longer supported: postgres-js is the only driver. Remove DB_PROVIDER from the environment.`);
+    if (provider !== undefined && provider !== "") {
+        throw new Error(`DB_PROVIDER="${provider}" is no longer supported: Bun.SQL is the only driver. Remove DB_PROVIDER from the environment.`);
     }
 }
 export function dbConnectionOptionsFromEnv(env = process.env) {

package/dist/db/driver-row-coercion.js

@@ -4,13 +4,13 @@ import { parseJsonSafe } from "../utils/safe-json.js";
 import { isTemporalInstant, isTemporalPlainDate } from "./temporal-value-guards.js";
 // --- Value coercion at the driver boundary ------------------------------
 //
-// postgres-js returns timestamptz as JS Date (or ISO string depending on
+// The driver returns timestamptz as JS Date (or ISO string depending on
 // driver config). Framework contract says timestamptz surfaces as
 // Temporal.Instant — without coercion every read hands callers a Date and
 // downstream code that does .epochMilliseconds / .add(...) crashes.
 //
-// Symmetric on write: Temporal.Instant doesn't bind directly into postgres-js
-// params — convert to ISO string when the column pgType is timestamptz.
+// Symmetric on write: Temporal.Instant doesn't bind directly as a driver
+// param — convert to ISO string when the column pgType is timestamptz.
 // Postgres bigint → JS: safe integers become `number` (matches createBigIntField /
 // drizzle mode:"number"); values outside ±2^53 stay `bigint` (money cents, raw
 // unmanaged columns). Uses BigInt equality check so 9007199254740993n never
@@ -72,7 +72,7 @@ function instantFromDriver(value) {
 // the day, so say so once per column instead of returning the wrong day quietly.
 const warnedNonMidnightDateColumns = new Set();
 const MS_PER_DAY = 86_400_000;
-const dateColumnDriftLog = createFallbackLogger("postgres-js");
+const dateColumnDriftLog = createFallbackLogger("bun-sql");
 function warnIfNotDateColumn(epochMs, column) {
     // skip: midnight value is a correct date column, and an already-warned column is deduped
     if (epochMs % MS_PER_DAY === 0 || warnedNonMidnightDateColumns.has(column))

package/dist/db/driver-value-preparation.js

@@ -33,7 +33,9 @@ function prepareDateValue(value) {
 // structured values bind directly with an ::jsonb cast; JSON.stringify first
 // would produce a JSON-string scalar instead of the structured value.
 export function prepareJsonbValue(value) {
-    if (typeof value === "boolean") {
+    // Bun.SQL types JS numbers as int4/float8 params, which Postgres refuses for a jsonb column.
+    // Non-finite numbers fall through so Postgres rejects them instead of storing JSON null.
+    if (typeof value === "boolean" || (typeof value === "number" && Number.isFinite(value))) {
         return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
     }
     if (typeof value !== "object" || isTemporalInstant(value)) {
@@ -42,7 +44,7 @@ export function prepareJsonbValue(value) {
     if (!Array.isArray(value)) {
         return { kind: "param", sql: "::jsonb", bound: value };
     }
-    // All-boolean arrays are inferred as boolean[] by postgres-js; route via text::jsonb.
+    // All-boolean arrays are inferred as boolean[] by the driver; route via text::jsonb.
     if (value.length > 0 && value.every((entry) => typeof entry === "boolean")) {
         return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
     }
@@ -59,7 +61,7 @@ const INTEGER_PG_TYPES = new Set([
     "bigserial",
 ]);
 // Postgres rounds sub-millisecond params into timestamptz(3); truncating to ms here keeps the
-// stored instant identical across drivers and equal to what postgres.js sends via Date.
+// stored instant identical across drivers and equal to what a Date param would store.
 export function instantToTimestamptzParam(instant) {
     return Temporal.Instant.fromEpochMilliseconds(instant.epochMilliseconds).toString();
 }
@@ -67,7 +69,7 @@ function prepareDriverNeutralScalar(value, pgType) {
     if ((pgType === "timestamptz" || pgType === "timestamptz(3)") && isTemporalInstant(value)) {
         return { kind: "param", sql: "", bound: instantToTimestamptzParam(value) };
     }
-    // postgres.js sends text, so Postgres rejects 3.5 for an integer column instead of rounding it.
+    // Sent as text, so Postgres rejects 3.5 for an integer column instead of rounding it.
     if (typeof value === "number" && pgType !== undefined && INTEGER_PG_TYPES.has(pgType)) {
         return { kind: "param", sql: "", bound: String(value) };
     }

package/dist/db/event-store-executor-read-aggregate-currencies.d.ts

@@ -0,0 +1,17 @@
+import type { FieldDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { ListAggregateCurrencyAmount, ListAggregateMeasureKind } from "@cosmicdrift/kumiko-types/list-aggregate-types";
+import type { OwnershipClause } from "../engine/ownership.ts";
+import type { ExecutorContext } from "./event-store-executor-context.ts";
+import { type ListWhere } from "./event-store-executor-read-filter.ts";
+import type { TenantDb } from "./tenant-db.ts";
+export type CurrencyMeasureCandidate = {
+    readonly kind: ListAggregateMeasureKind;
+    readonly field: string;
+    readonly def: FieldDefinition;
+    readonly clause: OwnershipClause;
+};
+export type MeasureCurrencies = ReadonlyMap<string, readonly string[]>;
+export declare function currencyColumnOf(field: string): string;
+export declare function loadMeasureCurrencies(ctx: ExecutorContext, measures: readonly CurrencyMeasureCandidate[], where: ListWhere, db: TenantDb): Promise<MeasureCurrencies>;
+export declare function currencyMeasureAlias(measureIndex: number, currencyIndex: number): string;
+export declare function decodeCurrencyAmounts(row: Readonly<Record<string, unknown>>, measureIndex: number, currencies: readonly string[]): readonly ListAggregateCurrencyAmount[];

package/dist/db/event-store-executor-read-aggregate-currencies.js

@@ -0,0 +1,40 @@
+import { isPerCurrencyMeasure } from "./aggregate-sql.js";
+import { bindShiftedClause } from "./event-store-executor-read-filter.js";
+import { executeRawQueryRead } from "./queries/raw-sql.js";
+import { schemaTableName } from "./table-introspection.js";
+import { tenantDbRunner } from "./tenant-db-runner.js";
+// Above the ~180 ISO 4217 codes, so the cap only bounds malformed data.
+const MAX_AGGREGATE_CURRENCIES = 200;
+export function currencyColumnOf(field) {
+    return `${field}Currency`;
+}
+// Runs before the measure query mutates `where`, on a copy of its params, and
+// under the money field's own read clause: an unreadable amount must not reveal
+// which currencies exist.
+export async function loadMeasureCurrencies(ctx, measures, where, db) {
+    const byField = new Map();
+    const tableName = String(schemaTableName(ctx.table));
+    for (const m of measures) {
+        if (!isPerCurrencyMeasure(m.kind, m.def.type) || byField.has(m.field))
+            continue;
+        if (!Object.hasOwn(ctx.table, currencyColumnOf(m.field)))
+            continue;
+        const params = [...where.params];
+        const conditions = [...where.whereSql, `${where.colSql(m.field)} IS NOT NULL`];
+        if (m.clause.kind === "sql")
+            conditions.push(`(${bindShiftedClause(params, m.clause)})`);
+        const currencySql = where.colSql(currencyColumnOf(m.field));
+        const rows = await executeRawQueryRead(tenantDbRunner(db), `SELECT DISTINCT ${currencySql} AS cur FROM "${tableName}" WHERE ${conditions.join(" AND ")} AND ${currencySql} IS NOT NULL ORDER BY 1 LIMIT ${MAX_AGGREGATE_CURRENCIES}`, params);
+        byField.set(m.field, rows.map((row) => String(row.cur)));
+    }
+    return byField;
+}
+export function currencyMeasureAlias(measureIndex, currencyIndex) {
+    return `m${measureIndex}_${currencyIndex}`;
+}
+export function decodeCurrencyAmounts(row, measureIndex, currencies) {
+    return currencies.flatMap((currency, j) => {
+        const raw = row[currencyMeasureAlias(measureIndex, j)];
+        return raw === null || raw === undefined ? [] : [{ currency, value: Number(raw) }];
+    });
+}

package/dist/db/event-store-executor-read-aggregate.js

@@ -1,6 +1,7 @@
 import { ValidationError } from "../errors/index.js";
-import { aggregateKeyOf, decodeListAggregateValue, emptyListAggregateValue, groupedKeyOrderLimitSql, isListAggregateGroupable, isListAggregateMeasureSupported, listAggregateKeySql, listAggregateMeasureSql, } from "./aggregate-sql.js";
+import { aggregateKeyOf, decodeListAggregateValue, emptyListAggregateValue, groupedKeyOrderLimitSql, isListAggregateGroupable, isListAggregateMeasureSupported, isPerCurrencyMeasure, listAggregateKeySql, listAggregateMeasureSql, listCurrencyMeasureSql, } from "./aggregate-sql.js";
 import { holdsCiphertextOrSecret } from "./entity-field-encryption.js";
+import { currencyColumnOf, currencyMeasureAlias, decodeCurrencyAmounts, loadMeasureCurrencies, } from "./event-store-executor-read-aggregate-currencies.js";
 import { appendShiftedClause, bindShiftedClause, } from "./event-store-executor-read-filter.js";
 import { buildListWhere, createFieldReadClause, } from "./event-store-executor-read-where.js";
 import { executeRawQueryRead } from "./queries/raw-sql.js";
@@ -61,9 +62,26 @@ function planAggregate(ctx, fieldReadClause, aggregate) {
     return { groupBy, measures };
 }
 function emptyMeasureValues(plan) {
-    return plan.measures.map((m) => m.gate.kind === "silent" ? null : emptyListAggregateValue(m.kind));
+    return plan.measures.map((m) => {
+        if (m.gate.kind === "silent")
+            return null;
+        return isPerCurrencyMeasure(m.kind, m.gate.def.type) ? [] : emptyListAggregateValue(m.kind);
+    });
+}
+function currencyCandidates(plan) {
+    return plan.measures.flatMap((m) => m.gate.kind === "ok"
+        ? [{ kind: m.kind, field: m.field, def: m.gate.def, clause: m.gate.clause }]
+        : []);
 }
-function renderSelectList(plan, where) {
+function currencyMeasureSelects(measureIndex, kind, field, readFilterSql, currencies, where) {
+    return currencies.map((currency, j) => {
+        where.params.push(currency);
+        const currencyMatch = `${where.colSql(currencyColumnOf(field))} = $${where.params.length}`;
+        const filterSql = readFilterSql === undefined ? currencyMatch : `${currencyMatch} AND (${readFilterSql})`;
+        return `${listCurrencyMeasureSql(kind, where.colSql(field), filterSql)} AS ${currencyMeasureAlias(measureIndex, j)}`;
+    });
+}
+function renderSelectList(plan, where, currencies) {
     const parts = [];
     if (plan.groupBy?.gate.kind === "ok") {
         const { def, clause } = plan.groupBy.gate;
@@ -77,6 +95,11 @@ function renderSelectList(plan, where) {
         if (m.gate.kind === "silent")
             continue; // skip: an unreadable measure stays out of the SELECT and decodes to null
         const filterSql = m.gate.clause.kind === "sql" ? bindShiftedClause(where.params, m.gate.clause) : undefined;
+        if (isPerCurrencyMeasure(m.kind, m.gate.def.type)) {
+            const fieldCurrencies = currencies.get(m.field) ?? [];
+            parts.push(...currencyMeasureSelects(i, m.kind, m.field, filterSql, fieldCurrencies, where));
+            continue;
+        }
         parts.push(`${listAggregateMeasureSql(m.kind, m.gate.def.type, where.colSql(m.field), filterSql)} AS m${i}`);
     }
     return parts.join(", ");
@@ -93,7 +116,8 @@ export async function aggregateList(ctx, payload, user, db, runtimeOptions) {
         };
     }
     const { where, searchTruncated } = built;
-    const selectList = renderSelectList(plan, where);
+    const currencies = await loadMeasureCurrencies(ctx, currencyCandidates(plan), where, db);
+    const selectList = renderSelectList(plan, where, currencies);
     const whereText = where.whereSql.length > 0 ? ` WHERE ${where.whereSql.join(" AND ")}` : "";
     const groupText = grouped ? groupedKeyOrderLimitSql(MAX_AGGREGATE_GROUPS + 1) : "";
     const tableName = String(schemaTableName(ctx.table));
@@ -102,7 +126,14 @@ export async function aggregateList(ctx, payload, user, db, runtimeOptions) {
     const groups = rows.slice(0, MAX_AGGREGATE_GROUPS).map((row) => ({
         key: grouped ? aggregateKeyOf(row["k0"]) : null,
         count: Number(row["c"]),
-        measures: plan.measures.map((m, i) => m.gate.kind === "silent" ? null : decodeListAggregateValue(row[`m${i}`])),
+        measures: plan.measures.map((m, i) => {
+            if (m.gate.kind === "silent")
+                return null;
+            if (isPerCurrencyMeasure(m.kind, m.gate.def.type)) {
+                return decodeCurrencyAmounts(row, i, currencies.get(m.field) ?? []);
+            }
+            return decodeListAggregateValue(row[`m${i}`]);
+        }),
     }));
     return {
         groups,

package/dist/db/event-store-executor-read-filter.js

@@ -58,7 +58,7 @@ function applyMultiSelectFilter(colSql, whereSql, params, f) {
         // skip: empty candidate list is unsatisfiable
         return;
     }
-    // Bound as text then cast: a JS array makes postgres.js infer boolean[]/int4[]
+    // Bound as text then cast: a JS array makes the driver infer boolean[]/int4[]
     // for client-supplied non-string values, and `boolean[]::jsonb` is rejected
     // (500 on client input). An array value means "contains all of these".
     params.push(JSON.stringify(candidates));
@@ -163,6 +163,9 @@ export function collectListFilters(payload) {
     const single = payload.filter !== undefined ? [payload.filter] : [];
     return payload.filters !== undefined ? [...single, ...payload.filters] : single;
 }
+function isJsonbArrayField(field) {
+    return field?.type === "multiSelect" || (field?.type === "reference" && field.multiple === true);
+}
 export function applyListFilter(where, f, table, entity, fieldReadClause) {
     if (!Object.hasOwn(table, f.field)) {
         // skip: unknown field — not a real column, drop the filter (injection guard)
@@ -194,9 +197,9 @@ export function applyListFilter(where, f, table, entity, fieldReadClause) {
     }
     if (readClause.kind === "sql")
         appendShiftedClause(where, readClause);
-    if (entity.fields[f.field]?.type === "multiSelect") {
+    if (isJsonbArrayField(entity.fields[f.field])) {
         applyMultiSelectFilter(where.colSql, where.whereSql, where.params, f);
-        // skip: multiSelect already handled — don't fall through to applyScreenFilter
+        // skip: jsonb-array field already handled — don't fall through to applyScreenFilter
         return;
     }
     applyScreenFilter(table, where.colSql, where.whereSql, where.params, f);

package/dist/db/event-store-executor-write-atomic.d.ts

@@ -0,0 +1,4 @@
+import type { EventStoreExecutor } from "@cosmicdrift/kumiko-types/event-store-executor-types";
+type WriteVerbs = Pick<EventStoreExecutor, "create" | "update" | "delete" | "forget" | "restore">;
+export declare function withOwnTransactionOnPool(verbs: WriteVerbs): WriteVerbs;
+export {};

package/dist/db/event-store-executor-write-atomic.js

@@ -0,0 +1,41 @@
+import { runnerCanBeginTransaction } from "./query.js";
+import { runInOwnTransaction } from "./tenant-db.js";
+import { isBoundTenantDb, tenantDbRunner, tenantDbWritesDeniedReason } from "./tenant-db-runner.js";
+// Aborts the surrounding transaction when a verb returns a failure instead of throwing.
+class RollbackOnFailure extends Error {
+}
+// Pool runners have no savepoint, so append, projection and hooks would otherwise commit as
+// separate autocommit statements. Tx and savepoint runners already provide atomicity.
+async function runVerbAtomically(db, run) {
+    // Unbound and denied handles keep their original error, a fresh transaction would reword it.
+    if (!isBoundTenantDb(db) ||
+        tenantDbWritesDeniedReason(db) !== undefined ||
+        !runnerCanBeginTransaction(tenantDbRunner(db))) {
+        return run(db);
+    }
+    let failure;
+    try {
+        return await runInOwnTransaction(db, async (txDb) => {
+            const result = await run(txDb);
+            if (!result.isSuccess) {
+                failure = result;
+                throw new RollbackOnFailure();
+            }
+            return result;
+        });
+    }
+    catch (error) {
+        if (error instanceof RollbackOnFailure && failure !== undefined)
+            return failure;
+        throw error;
+    }
+}
+export function withOwnTransactionOnPool(verbs) {
+    return {
+        create: (payload, user, db, options) => runVerbAtomically(db, (txDb) => verbs.create(payload, user, txDb, options)),
+        update: (payload, user, db, options) => runVerbAtomically(db, (txDb) => verbs.update(payload, user, txDb, options)),
+        delete: (payload, user, db, options) => runVerbAtomically(db, (txDb) => verbs.delete(payload, user, txDb, options)),
+        forget: (payload, user, db, options) => runVerbAtomically(db, (txDb) => verbs.forget(payload, user, txDb, options)),
+        restore: (payload, user, db, options) => runVerbAtomically(db, (txDb) => verbs.restore(payload, user, txDb, options)),
+    };
+}

package/dist/db/event-store-executor-write-steps.d.ts

@@ -5,9 +5,6 @@ import type { EntityId } from "../engine/types/index.ts";
 import { type UnprocessableOpts, type WriteFailure, writeFailure } from "../errors/index.ts";
 import type { StoredEvent } from "../event-store/index.ts";
 import type { DbRow, DbRunner } from "./connection.ts";
-export declare function withoutEventInJson<T extends {
-    readonly event: unknown;
-}>(result: T): T;
 export declare function projectEntityEvent(db: TenantDb, runner: DbRunner, event: StoredEvent): Promise<void>;
 export declare function selectOptionNotAvailableFailure(entries: readonly UnavailableSelectOption[]): WriteFailure | undefined;
 export type PreSaveFn = (changes: Record<string, unknown>, previous: Record<string, unknown>, isNew: boolean) => Promise<Record<string, unknown>>;

package/dist/db/event-store-executor-write-steps.js

@@ -2,11 +2,6 @@ import { VersionConflictError as FrameworkVersionConflict, UnprocessableError, w
 import { hasLiveProjectionsForEvent, runProjectionsForEvent, } from "../pipeline/projections-runner.js";
 import { projectionRegistryOf } from "./projection-registry-binding.js";
 import { runInSavepointIfSupported } from "./query.js";
-// The echoed event carries entity PII and must never reach a handler's JSON response, while
-// hooks and projections still read it by property. Non-enumerable keeps it out of spread/stringify.
-export function withoutEventInJson(result) {
-    return Object.defineProperty(result, "event", { value: result.event, enumerable: false });
-}
 // Custom projections for a write that did not go through the dispatcher (hook or
 // job writing a second aggregate). Savepoint like applyEntityEvent: a throwing
 // projection fails the write and the caller's transaction rolls it back.

package/dist/db/event-store-executor-write.js

@@ -12,7 +12,7 @@ import { applyEntityEvent } from "./apply-entity-event.js";
 import { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
 import { WritePurposes, } from "./event-store-executor.js";
 import { buildEventMetadata, entityEventName, isForeignTenantOnGlobalEntity, ownershipSubject, tryMapUniqueViolation, } from "./event-store-executor-context.js";
-import { optimisticLockFailure, ownershipDeniedFailure, projectEntityEvent, runPreSave, selectOptionNotAvailableFailure, withoutEventInJson, } from "./event-store-executor-write-steps.js";
+import { optimisticLockFailure, ownershipDeniedFailure, projectEntityEvent, runPreSave, selectOptionNotAvailableFailure, } from "./event-store-executor-write-steps.js";
 import { isFrameworkSystemUser, isLockGuardBypassed } from "./lock-guard.js";
 import { runInSavepointIfSupported } from "./query.js";
 import { assertPersonalDataWrite, tableNameOf, withExecutorManagedWrites } from "./tenant-db.js";
@@ -244,8 +244,8 @@ export function createWriteVerbs(ctx) {
         //    legitimately collide — the same ID has an existing stream — so return
         //    version_conflict instead of internal_error. Update uses the same catch.
         try {
-            // Savepoint-scoped: postgres.js poisons the WHOLE surrounding
-            // begin() once any statement inside it errors, even if the JS error
+            // Savepoint-scoped: Postgres aborts the WHOLE surrounding
+            // transaction once any statement inside it errors, even if the JS error
             // is caught — a losing concurrent create's unique-violation
             // would otherwise abort the caller's outer transaction and surface as
             // internal_error at commit time instead of the version_conflict this
@@ -287,8 +287,8 @@ export function createWriteVerbs(ctx) {
     //    designer/frontend can show a clear "duplicate" message instead of a cryptic
     //    "internal server error".
     // Savepoint like the append: an unclassified DB error from the projection
-    // write would otherwise poison the enclosing transaction (postgres-js rejects the
-    // whole begin() once any statement in it fails). The savepoint rolls back the failed
+    // write would otherwise poison the enclosing transaction (Postgres aborts the
+    // whole transaction once any statement in it fails). The savepoint rolls back the failed
     // write while allowing the error to propagate and remain catchable.
     async function applyProjection(runner, event, noRowMessage) {
         let result;
@@ -462,7 +462,7 @@ export function createWriteVerbs(ctx) {
             await projectEntityEvent(db, runner, echoEvent);
             return {
                 isSuccess: true,
-                data: withoutEventInJson({
+                data: {
                     kind: "save",
                     id: aggregateId,
                     data: projection,
@@ -473,7 +473,7 @@ export function createWriteVerbs(ctx) {
                     // Persisted event carries ciphertext by design — the caller-facing
                     // echo must be plaintext like every other response field.
                     event: echoEvent,
-                }),
+                },
             };
         },
         async update(payload, user, db, updateOptions) {
@@ -526,7 +526,7 @@ export function createWriteVerbs(ctx) {
                 const { data, echoEvent } = persisted;
                 return {
                     isSuccess: true,
-                    data: withoutEventInJson({
+                    data: {
                         kind: "save",
                         id: data["id"], // @cast-boundary engine-payload
                         data,
@@ -535,7 +535,7 @@ export function createWriteVerbs(ctx) {
                         isNew: false,
                         entityName,
                         event: echoEvent,
-                    }),
+                    },
                 };
             }
             catch (e) {
@@ -622,14 +622,14 @@ export function createWriteVerbs(ctx) {
             await projectEntityEvent(db, runner, echoEvent);
             return {
                 isSuccess: true,
-                data: withoutEventInJson({
+                data: {
                     kind: "delete",
                     id: payload.id,
                     data: existing,
                     entityName,
                     event: echoEvent,
                     ...(isLockGuardBypassed(user, options) && { lockGuardBypassed: true }),
-                }),
+                },
             };
         },
         // Hard-purge (Art. 17). Same shape as delete(), but emits `forgotten` which
@@ -695,14 +695,14 @@ export function createWriteVerbs(ctx) {
             await projectEntityEvent(db, runner, echoEvent);
             return {
                 isSuccess: true,
-                data: withoutEventInJson({
+                data: {
                     kind: "delete",
                     id: payload.id,
                     data: existing,
                     entityName,
                     event: echoEvent,
                     lockGuardBypassed: true,
-                }),
+                },
             };
         },
         async restore(payload, user, db, options) {
@@ -761,7 +761,7 @@ export function createWriteVerbs(ctx) {
             await projectEntityEvent(db, runner, echoEvent);
             return {
                 isSuccess: true,
-                data: withoutEventInJson({
+                data: {
                     kind: "save",
                     id: payload.id,
                     data: restoredHydrated,
@@ -770,7 +770,7 @@ export function createWriteVerbs(ctx) {
                     isNew: false,
                     entityName,
                     event: echoEvent,
-                }),
+                },
             };
         },
     };

package/dist/db/event-store-executor.js

@@ -1,12 +1,13 @@
 import { buildExecutorContext } from "./event-store-executor-context.js";
 import { createReadVerbs } from "./event-store-executor-read.js";
 import { createWriteVerbs } from "./event-store-executor-write.js";
+import { withOwnTransactionOnPool } from "./event-store-executor-write-atomic.js";
 export { WritePurposes } from "@cosmicdrift/kumiko-types/event-store-executor-types";
 export { entityEventName } from "./event-store-executor-context.js";
 export function createEventStoreExecutor(table, entity, options) {
     const ctx = buildExecutorContext(table, entity, options);
     return {
-        ...createWriteVerbs(ctx),
+        ...withOwnTransactionOnPool(createWriteVerbs(ctx)),
         ...createReadVerbs(ctx),
     };
 }