@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/db/driver-row-coercion.js

@@ -4,13 +4,13 @@ import { parseJsonSafe } from "../utils/safe-json.js";
 import { isTemporalInstant, isTemporalPlainDate } from "./temporal-value-guards.js";
 // --- Value coercion at the driver boundary ------------------------------
 //
-// postgres-js returns timestamptz as JS Date (or ISO string depending on
+// The driver returns timestamptz as JS Date (or ISO string depending on
 // driver config). Framework contract says timestamptz surfaces as
 // Temporal.Instant — without coercion every read hands callers a Date and
 // downstream code that does .epochMilliseconds / .add(...) crashes.
 //
-// Symmetric on write: Temporal.Instant doesn't bind directly into postgres-js
-// params — convert to ISO string when the column pgType is timestamptz.
+// Symmetric on write: Temporal.Instant doesn't bind directly as a driver
+// param — convert to ISO string when the column pgType is timestamptz.
 // Postgres bigint → JS: safe integers become `number` (matches createBigIntField /
 // drizzle mode:"number"); values outside ±2^53 stay `bigint` (money cents, raw
 // unmanaged columns). Uses BigInt equality check so 9007199254740993n never
@@ -72,7 +72,7 @@ function instantFromDriver(value) {
 // the day, so say so once per column instead of returning the wrong day quietly.
 const warnedNonMidnightDateColumns = new Set();
 const MS_PER_DAY = 86_400_000;
-const dateColumnDriftLog = createFallbackLogger("postgres-js");
+const dateColumnDriftLog = createFallbackLogger("bun-sql");
 function warnIfNotDateColumn(epochMs, column) {
     // skip: midnight value is a correct date column, and an already-warned column is deduped
     if (epochMs % MS_PER_DAY === 0 || warnedNonMidnightDateColumns.has(column))

package/dist/db/driver-value-preparation.js

@@ -33,7 +33,9 @@ function prepareDateValue(value) {
 // structured values bind directly with an ::jsonb cast; JSON.stringify first
 // would produce a JSON-string scalar instead of the structured value.
 export function prepareJsonbValue(value) {
-    if (typeof value === "boolean") {
+    // Bun.SQL types JS numbers as int4/float8 params, which Postgres refuses for a jsonb column.
+    // Non-finite numbers fall through so Postgres rejects them instead of storing JSON null.
+    if (typeof value === "boolean" || (typeof value === "number" && Number.isFinite(value))) {
         return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
     }
     if (typeof value !== "object" || isTemporalInstant(value)) {
@@ -42,7 +44,7 @@ export function prepareJsonbValue(value) {
     if (!Array.isArray(value)) {
         return { kind: "param", sql: "::jsonb", bound: value };
     }
-    // All-boolean arrays are inferred as boolean[] by postgres-js; route via text::jsonb.
+    // All-boolean arrays are inferred as boolean[] by the driver; route via text::jsonb.
     if (value.length > 0 && value.every((entry) => typeof entry === "boolean")) {
         return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
     }
@@ -59,7 +61,7 @@ const INTEGER_PG_TYPES = new Set([
     "bigserial",
 ]);
 // Postgres rounds sub-millisecond params into timestamptz(3); truncating to ms here keeps the
-// stored instant identical across drivers and equal to what postgres.js sends via Date.
+// stored instant identical across drivers and equal to what a Date param would store.
 export function instantToTimestamptzParam(instant) {
     return Temporal.Instant.fromEpochMilliseconds(instant.epochMilliseconds).toString();
 }
@@ -67,7 +69,7 @@ function prepareDriverNeutralScalar(value, pgType) {
     if ((pgType === "timestamptz" || pgType === "timestamptz(3)") && isTemporalInstant(value)) {
         return { kind: "param", sql: "", bound: instantToTimestamptzParam(value) };
     }
-    // postgres.js sends text, so Postgres rejects 3.5 for an integer column instead of rounding it.
+    // Sent as text, so Postgres rejects 3.5 for an integer column instead of rounding it.
     if (typeof value === "number" && pgType !== undefined && INTEGER_PG_TYPES.has(pgType)) {
         return { kind: "param", sql: "", bound: String(value) };
     }

package/dist/db/eagerload.d.ts

@@ -1,4 +1,5 @@
-import type { EntityDefinition, SessionUser } from "../engine/types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { SessionUser } from "../engine/types/index.ts";
 import { type ParentVisibilityOption } from "./parent-ref-clause.ts";
 import type { TenantDb } from "./tenant-db.ts";
 export type EagerLoadEntityResolver = (entityName: string) => EntityDefinition | undefined;

package/dist/db/entity-field-encryption.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "../engine/types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { type Logger } from "../logging/index.ts";
 import type { EnvelopeCipher } from "../secrets/envelope-cipher.ts";
 export declare function collectEncryptedFieldNames(entity: EntityDefinition): ReadonlySet<string>;

package/dist/db/entity-table-meta.d.ts

@@ -1,6 +1,6 @@
 import type { Writable } from "@cosmicdrift/kumiko-types/executor-brand";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { EntityTenancy, TenancyBrand } from "@cosmicdrift/kumiko-types/tenancy-brand";
-import type { EntityDefinition } from "../engine/types/index.ts";
 import type { BuildEntityTableMetaOptions, EntityTableMeta, UnmanagedTableInput } from "./entity-table-meta-types.ts";
 export type { BuildEntityTableMetaOptions, ColumnMeta, CompositePrimaryKeyMeta, EntityTableMeta, IndexMeta, PgType, UnmanagedTableInput, } from "./entity-table-meta-types.ts";
 export declare function resolveTableName(entityName: string, entity: EntityDefinition, featureName: string | undefined): string;

package/dist/db/event-store-executor-context.d.ts

@@ -1,6 +1,8 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { EntityId } from "@cosmicdrift/kumiko-types/identifiers";
 import type { ErasedSubjectHandling } from "../crypto/pii-field-encryption.ts";
 import type { WhereObject } from "../db/query.ts";
-import type { EntityDefinition, EntityId, SessionUser, TenantId } from "../engine/types/index.ts";
+import type { SessionUser, TenantId } from "../engine/types/index.ts";
 import { type WriteFailure } from "../errors/index.ts";
 import { type EventMetadata } from "../event-store/index.ts";
 import type { EntityCache } from "../pipeline/entity-cache.ts";

package/dist/db/event-store-executor-context.js

@@ -5,7 +5,8 @@ import { executeRawQueryRead } from "../db/queries/raw-sql.js";
 import { shiftParams } from "../engine/ownership.js";
 import { SYSTEM_TENANT_ID } from "../engine/types/identifiers.js";
 import { AccessDeniedError, InternalError, subjectErasedConflict, UniqueViolationError, writeFailure, } from "../errors/index.js";
-import { ArchivedStreamError, isStreamArchived } from "../event-store/index.js";
+import { ArchivedStreamError } from "../event-store/errors.js";
+import { isStreamArchived } from "../event-store/index.js";
 import { assertUnreachable } from "../utils/index.js";
 import { rehydrateCompoundTypes } from "./compound-types.js";
 import { collectEncryptedFieldNames, decryptEntityFieldValues, encryptEntityFieldValues, logUndecryptableField, resolveEntityFieldEncryption, } from "./entity-field-encryption.js";
@@ -120,7 +121,7 @@ export function buildExecutorContext(table, entity, options) {
     // old hardcoded user.tenantId). Single source of truth for the stream key.
     const streamTenantFor = (user, requestedStreamTenantId) => entity.systemStream ? SYSTEM_TENANT_ID : (requestedStreamTenantId ?? user.tenantId);
     // Only a system-mode db (r.systemScope() / acknowledged cross-tenant) or a tenant-mode db bound
-    // to exactly that stream tenant (ctx.forTenant) may address another tenant's stream, and only
+    // to exactly that stream tenant (ctx.tenants.writeTarget) may address another tenant's stream, and only
     // the tenant of the row it just loaded.
     const streamTenantOverrideFailure = (db, row, requestedStreamTenantId) => {
         if (requestedStreamTenantId === undefined)
@@ -293,7 +294,7 @@ export function buildExecutorContext(table, entity, options) {
         return await decryptForRead(rehydrateCompoundTypes(row, entity));
     }
     // Archive guard for the CRUD write paths. Archived streams are read-only —
-    // ctx.appendEvent (append-event-core) already enforces this, but the
+    // ctx.events.append (append-event-core) already enforces this, but the
     // executor appends directly via append() and getStreamVersion() ignores
     // the archive flag, so without this check a PATCH/DELETE on an archived
     // entity would silently land an event and break the read-only contract

package/dist/db/event-store-executor-read-aggregate-currencies.d.ts

@@ -0,0 +1,17 @@
+import type { FieldDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { ListAggregateCurrencyAmount, ListAggregateMeasureKind } from "@cosmicdrift/kumiko-types/list-aggregate-types";
+import type { OwnershipClause } from "../engine/ownership.ts";
+import type { ExecutorContext } from "./event-store-executor-context.ts";
+import { type ListWhere } from "./event-store-executor-read-filter.ts";
+import type { TenantDb } from "./tenant-db.ts";
+export type CurrencyMeasureCandidate = {
+    readonly kind: ListAggregateMeasureKind;
+    readonly field: string;
+    readonly def: FieldDefinition;
+    readonly clause: OwnershipClause;
+};
+export type MeasureCurrencies = ReadonlyMap<string, readonly string[]>;
+export declare function currencyColumnOf(field: string): string;
+export declare function loadMeasureCurrencies(ctx: ExecutorContext, measures: readonly CurrencyMeasureCandidate[], where: ListWhere, db: TenantDb): Promise<MeasureCurrencies>;
+export declare function currencyMeasureAlias(measureIndex: number, currencyIndex: number): string;
+export declare function decodeCurrencyAmounts(row: Readonly<Record<string, unknown>>, measureIndex: number, currencies: readonly string[]): readonly ListAggregateCurrencyAmount[];

package/dist/db/event-store-executor-read-aggregate-currencies.js

@@ -0,0 +1,40 @@
+import { isPerCurrencyMeasure } from "./aggregate-sql.js";
+import { bindShiftedClause } from "./event-store-executor-read-filter.js";
+import { executeRawQueryRead } from "./queries/raw-sql.js";
+import { schemaTableName } from "./table-introspection.js";
+import { tenantDbRunner } from "./tenant-db-runner.js";
+// Above the ~180 ISO 4217 codes, so the cap only bounds malformed data.
+const MAX_AGGREGATE_CURRENCIES = 200;
+export function currencyColumnOf(field) {
+    return `${field}Currency`;
+}
+// Runs before the measure query mutates `where`, on a copy of its params, and
+// under the money field's own read clause: an unreadable amount must not reveal
+// which currencies exist.
+export async function loadMeasureCurrencies(ctx, measures, where, db) {
+    const byField = new Map();
+    const tableName = String(schemaTableName(ctx.table));
+    for (const m of measures) {
+        if (!isPerCurrencyMeasure(m.kind, m.def.type) || byField.has(m.field))
+            continue;
+        if (!Object.hasOwn(ctx.table, currencyColumnOf(m.field)))
+            continue;
+        const params = [...where.params];
+        const conditions = [...where.whereSql, `${where.colSql(m.field)} IS NOT NULL`];
+        if (m.clause.kind === "sql")
+            conditions.push(`(${bindShiftedClause(params, m.clause)})`);
+        const currencySql = where.colSql(currencyColumnOf(m.field));
+        const rows = await executeRawQueryRead(tenantDbRunner(db), `SELECT DISTINCT ${currencySql} AS cur FROM "${tableName}" WHERE ${conditions.join(" AND ")} AND ${currencySql} IS NOT NULL ORDER BY 1 LIMIT ${MAX_AGGREGATE_CURRENCIES}`, params);
+        byField.set(m.field, rows.map((row) => String(row.cur)));
+    }
+    return byField;
+}
+export function currencyMeasureAlias(measureIndex, currencyIndex) {
+    return `m${measureIndex}_${currencyIndex}`;
+}
+export function decodeCurrencyAmounts(row, measureIndex, currencies) {
+    return currencies.flatMap((currency, j) => {
+        const raw = row[currencyMeasureAlias(measureIndex, j)];
+        return raw === null || raw === undefined ? [] : [{ currency, value: Number(raw) }];
+    });
+}

package/dist/db/event-store-executor-read-aggregate.js

@@ -1,6 +1,7 @@
 import { ValidationError } from "../errors/index.js";
-import { aggregateKeyOf, decodeListAggregateValue, emptyListAggregateValue, groupedKeyOrderLimitSql, isListAggregateGroupable, isListAggregateMeasureSupported, listAggregateKeySql, listAggregateMeasureSql, } from "./aggregate-sql.js";
+import { aggregateKeyOf, decodeListAggregateValue, emptyListAggregateValue, groupedKeyOrderLimitSql, isListAggregateGroupable, isListAggregateMeasureSupported, isPerCurrencyMeasure, listAggregateKeySql, listAggregateMeasureSql, listCurrencyMeasureSql, } from "./aggregate-sql.js";
 import { holdsCiphertextOrSecret } from "./entity-field-encryption.js";
+import { currencyColumnOf, currencyMeasureAlias, decodeCurrencyAmounts, loadMeasureCurrencies, } from "./event-store-executor-read-aggregate-currencies.js";
 import { appendShiftedClause, bindShiftedClause, } from "./event-store-executor-read-filter.js";
 import { buildListWhere, createFieldReadClause, } from "./event-store-executor-read-where.js";
 import { executeRawQueryRead } from "./queries/raw-sql.js";
@@ -61,9 +62,26 @@ function planAggregate(ctx, fieldReadClause, aggregate) {
     return { groupBy, measures };
 }
 function emptyMeasureValues(plan) {
-    return plan.measures.map((m) => m.gate.kind === "silent" ? null : emptyListAggregateValue(m.kind));
+    return plan.measures.map((m) => {
+        if (m.gate.kind === "silent")
+            return null;
+        return isPerCurrencyMeasure(m.kind, m.gate.def.type) ? [] : emptyListAggregateValue(m.kind);
+    });
+}
+function currencyCandidates(plan) {
+    return plan.measures.flatMap((m) => m.gate.kind === "ok"
+        ? [{ kind: m.kind, field: m.field, def: m.gate.def, clause: m.gate.clause }]
+        : []);
 }
-function renderSelectList(plan, where) {
+function currencyMeasureSelects(measureIndex, kind, field, readFilterSql, currencies, where) {
+    return currencies.map((currency, j) => {
+        where.params.push(currency);
+        const currencyMatch = `${where.colSql(currencyColumnOf(field))} = $${where.params.length}`;
+        const filterSql = readFilterSql === undefined ? currencyMatch : `${currencyMatch} AND (${readFilterSql})`;
+        return `${listCurrencyMeasureSql(kind, where.colSql(field), filterSql)} AS ${currencyMeasureAlias(measureIndex, j)}`;
+    });
+}
+function renderSelectList(plan, where, currencies) {
     const parts = [];
     if (plan.groupBy?.gate.kind === "ok") {
         const { def, clause } = plan.groupBy.gate;
@@ -77,6 +95,11 @@ function renderSelectList(plan, where) {
         if (m.gate.kind === "silent")
             continue; // skip: an unreadable measure stays out of the SELECT and decodes to null
         const filterSql = m.gate.clause.kind === "sql" ? bindShiftedClause(where.params, m.gate.clause) : undefined;
+        if (isPerCurrencyMeasure(m.kind, m.gate.def.type)) {
+            const fieldCurrencies = currencies.get(m.field) ?? [];
+            parts.push(...currencyMeasureSelects(i, m.kind, m.field, filterSql, fieldCurrencies, where));
+            continue;
+        }
         parts.push(`${listAggregateMeasureSql(m.kind, m.gate.def.type, where.colSql(m.field), filterSql)} AS m${i}`);
     }
     return parts.join(", ");
@@ -93,7 +116,8 @@ export async function aggregateList(ctx, payload, user, db, runtimeOptions) {
         };
     }
     const { where, searchTruncated } = built;
-    const selectList = renderSelectList(plan, where);
+    const currencies = await loadMeasureCurrencies(ctx, currencyCandidates(plan), where, db);
+    const selectList = renderSelectList(plan, where, currencies);
     const whereText = where.whereSql.length > 0 ? ` WHERE ${where.whereSql.join(" AND ")}` : "";
     const groupText = grouped ? groupedKeyOrderLimitSql(MAX_AGGREGATE_GROUPS + 1) : "";
     const tableName = String(schemaTableName(ctx.table));
@@ -102,7 +126,14 @@ export async function aggregateList(ctx, payload, user, db, runtimeOptions) {
     const groups = rows.slice(0, MAX_AGGREGATE_GROUPS).map((row) => ({
         key: grouped ? aggregateKeyOf(row["k0"]) : null,
         count: Number(row["c"]),
-        measures: plan.measures.map((m, i) => m.gate.kind === "silent" ? null : decodeListAggregateValue(row[`m${i}`])),
+        measures: plan.measures.map((m, i) => {
+            if (m.gate.kind === "silent")
+                return null;
+            if (isPerCurrencyMeasure(m.kind, m.gate.def.type)) {
+                return decodeCurrencyAmounts(row, i, currencies.get(m.field) ?? []);
+            }
+            return decodeListAggregateValue(row[`m${i}`]);
+        }),
     }));
     return {
         groups,

package/dist/db/event-store-executor-read-filter.d.ts

@@ -1,5 +1,5 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { type OwnershipClause } from "../engine/ownership.ts";
-import type { EntityDefinition } from "../engine/types/index.ts";
 import { type Table } from "./event-store-executor-context.ts";
 export type ListWhere = {
     readonly whereSql: string[];

package/dist/db/event-store-executor-read-filter.js

@@ -58,7 +58,7 @@ function applyMultiSelectFilter(colSql, whereSql, params, f) {
         // skip: empty candidate list is unsatisfiable
         return;
     }
-    // Bound as text then cast: a JS array makes postgres.js infer boolean[]/int4[]
+    // Bound as text then cast: a JS array makes the driver infer boolean[]/int4[]
     // for client-supplied non-string values, and `boolean[]::jsonb` is rejected
     // (500 on client input). An array value means "contains all of these".
     params.push(JSON.stringify(candidates));
@@ -163,6 +163,9 @@ export function collectListFilters(payload) {
     const single = payload.filter !== undefined ? [payload.filter] : [];
     return payload.filters !== undefined ? [...single, ...payload.filters] : single;
 }
+function isJsonbArrayField(field) {
+    return field?.type === "multiSelect" || (field?.type === "reference" && field.multiple === true);
+}
 export function applyListFilter(where, f, table, entity, fieldReadClause) {
     if (!Object.hasOwn(table, f.field)) {
         // skip: unknown field — not a real column, drop the filter (injection guard)
@@ -194,9 +197,9 @@ export function applyListFilter(where, f, table, entity, fieldReadClause) {
     }
     if (readClause.kind === "sql")
         appendShiftedClause(where, readClause);
-    if (entity.fields[f.field]?.type === "multiSelect") {
+    if (isJsonbArrayField(entity.fields[f.field])) {
         applyMultiSelectFilter(where.colSql, where.whereSql, where.params, f);
-        // skip: multiSelect already handled — don't fall through to applyScreenFilter
+        // skip: jsonb-array field already handled — don't fall through to applyScreenFilter
         return;
     }
     applyScreenFilter(table, where.colSql, where.whereSql, where.params, f);

package/dist/db/event-store-executor-read-rows.d.ts

@@ -1,4 +1,5 @@
-import type { EntityDefinition, TenantId } from "../engine/types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { TenantId } from "../engine/types/index.ts";
 import type { TableInfo } from "./table-info.ts";
 export declare function withStreamVersion(row: Record<string, unknown>, streamVersion: number): Record<string, unknown>;
 export declare function coerceAndRehydrateRow(raw: Record<string, unknown>, tableInfo: TableInfo, entity: EntityDefinition): Record<string, unknown>;

package/dist/db/event-store-executor-read-search.d.ts

@@ -1,5 +1,6 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { type OwnershipClause } from "../engine/ownership.ts";
-import type { EntityDefinition, SessionUser, TenantId } from "../engine/types/index.ts";
+import type { SessionUser, TenantId } from "../engine/types/index.ts";
 import type { SearchAdapter } from "../search/types.ts";
 import type { EventStoreExecutor } from "./event-store-executor.ts";
 import type { Table } from "./event-store-executor-context.ts";

package/dist/db/event-store-executor-read-sort.d.ts

@@ -1,5 +1,6 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { type OwnershipClause } from "../engine/ownership.ts";
-import type { EntityDefinition, SessionUser } from "../engine/types/index.ts";
+import type { SessionUser } from "../engine/types/index.ts";
 import type { EventStoreExecutor } from "./event-store-executor.ts";
 import type { Table } from "./event-store-executor-context.ts";
 import type { ListWhere } from "./event-store-executor-read-filter.ts";

package/dist/db/event-store-executor-read.js

@@ -59,7 +59,7 @@ export function createReadVerbs(ctx) {
             const tableInfo = extractTableInfo(table);
             const encryptedRows = rawRows.map((r) => coerceAndRehydrateRow(r, tableInfo, entity));
             const decryptedRows = await Promise.all(encryptedRows.map((r) => decryptForRead(r, { degradeUndecryptable: () => { } })));
-            // Stream version is authoritative (see detail()): ctx.appendEvent bumps the
+            // Stream version is authoritative (see detail()): ctx.events.append bumps the
             // stream without touching row.version, so the raw row version would hand
             // clients a stale optimistic-lock base. Rows without events keep theirs.
             const rows = decryptedRows.map((r, i) => withStreamVersion(r, streamVersions[i] ?? 0));
@@ -101,7 +101,7 @@ export function createReadVerbs(ctx) {
                 return null;
             const idWhere = idFilter(payload.id);
             // Stream-version authoritative (same policy as update/Block 0):
-            // ctx.appendEvent (lifecycle-writes like incident:post-update) bumps
+            // ctx.events.append (lifecycle-writes like incident:post-update) bumps
             // the stream WITHOUT touching row.version — a detail-read that hands
             // out the stale row.version dooms the next CRUD update built on it
             // (entityEdit loads detail.version as its optimistic-lock base) to a

package/dist/db/event-store-executor-write-atomic.d.ts

@@ -0,0 +1,4 @@
+import type { EventStoreExecutor } from "@cosmicdrift/kumiko-types/event-store-executor-types";
+type WriteVerbs = Pick<EventStoreExecutor, "create" | "update" | "delete" | "forget" | "restore">;
+export declare function withOwnTransactionOnPool(verbs: WriteVerbs): WriteVerbs;
+export {};

package/dist/db/event-store-executor-write-atomic.js

@@ -0,0 +1,42 @@
+import { runnerCanBeginTransaction } from "./query.js";
+import { isBoundTenantDb, tenantDbRunner, tenantDbWritesDeniedReason } from "./tenant-db-runner.js";
+import { runInOwnSavepoint, runInOwnTransaction } from "./tenant-db-scoped-rebind.js";
+// Aborts the surrounding transaction when a verb returns a failure instead of throwing.
+class RollbackOnFailure extends Error {
+}
+// Append, projection and hooks commit or roll back together, also when a handler swallows a failed
+// verb inside its transaction. Savepoints on one tx are serialized, so parallel verbs cannot interleave.
+async function runVerbAtomically(db, run) {
+    // Unbound and denied handles keep their original error, a fresh transaction would reword it.
+    if (!isBoundTenantDb(db) || tenantDbWritesDeniedReason(db) !== undefined) {
+        return run(db);
+    }
+    const runInOwnScope = runnerCanBeginTransaction(tenantDbRunner(db))
+        ? runInOwnTransaction
+        : runInOwnSavepoint;
+    let failure;
+    try {
+        return await runInOwnScope(db, async (txDb) => {
+            const result = await run(txDb);
+            if (!result.isSuccess) {
+                failure = result;
+                throw new RollbackOnFailure();
+            }
+            return result;
+        });
+    }
+    catch (error) {
+        if (error instanceof RollbackOnFailure && failure !== undefined)
+            return failure;
+        throw error;
+    }
+}
+export function withOwnTransactionOnPool(verbs) {
+    return {
+        create: (payload, user, db, options) => runVerbAtomically(db, (txDb) => verbs.create(payload, user, txDb, options)),
+        update: (payload, user, db, options) => runVerbAtomically(db, (txDb) => verbs.update(payload, user, txDb, options)),
+        delete: (payload, user, db, options) => runVerbAtomically(db, (txDb) => verbs.delete(payload, user, txDb, options)),
+        forget: (payload, user, db, options) => runVerbAtomically(db, (txDb) => verbs.forget(payload, user, txDb, options)),
+        restore: (payload, user, db, options) => runVerbAtomically(db, (txDb) => verbs.restore(payload, user, txDb, options)),
+    };
+}

package/dist/db/event-store-executor-write-steps.d.ts

@@ -1,13 +1,11 @@
+import type { EntityId } from "@cosmicdrift/kumiko-types/identifiers";
 import type { TenantDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
 import type { ZodType } from "zod";
 import type { UnavailableSelectOption } from "../engine/screen-helpers.ts";
-import type { EntityId } from "../engine/types/index.ts";
-import { type UnprocessableOpts, type WriteFailure, writeFailure } from "../errors/index.ts";
+import type { UnprocessableOpts } from "../errors/classes.ts";
+import { type WriteFailure, writeFailure } from "../errors/index.ts";
 import type { StoredEvent } from "../event-store/index.ts";
 import type { DbRow, DbRunner } from "./connection.ts";
-export declare function withoutEventInJson<T extends {
-    readonly event: unknown;
-}>(result: T): T;
 export declare function projectEntityEvent(db: TenantDb, runner: DbRunner, event: StoredEvent): Promise<void>;
 export declare function selectOptionNotAvailableFailure(entries: readonly UnavailableSelectOption[]): WriteFailure | undefined;
 export type PreSaveFn = (changes: Record<string, unknown>, previous: Record<string, unknown>, isNew: boolean) => Promise<Record<string, unknown>>;

package/dist/db/event-store-executor-write-steps.js

@@ -2,11 +2,6 @@ import { VersionConflictError as FrameworkVersionConflict, UnprocessableError, w
 import { hasLiveProjectionsForEvent, runProjectionsForEvent, } from "../pipeline/projections-runner.js";
 import { projectionRegistryOf } from "./projection-registry-binding.js";
 import { runInSavepointIfSupported } from "./query.js";
-// The echoed event carries entity PII and must never reach a handler's JSON response, while
-// hooks and projections still read it by property. Non-enumerable keeps it out of spread/stringify.
-export function withoutEventInJson(result) {
-    return Object.defineProperty(result, "event", { value: result.event, enumerable: false });
-}
 // Custom projections for a write that did not go through the dispatcher (hook or
 // job writing a second aggregate). Savepoint like applyEntityEvent: a throwing
 // projection fails the write and the caller's transaction rolls it back.

package/dist/db/event-store-executor-write.js

@@ -4,15 +4,18 @@ import { instructionFieldNames } from "../engine/instruction-fields.js";
 import { userCanCreateFieldRow, userCanWriteFieldRow } from "../engine/ownership.js";
 import { buildInsertSchema, buildUpdateSchema } from "../engine/schema-builder.js";
 import { findUnavailableSelectOptions, isRecordLocked, isUnchangedValue, } from "../engine/screen-helpers.js";
-import { AccessDeniedError, VersionConflictError as FrameworkVersionConflict, IdempotentReplayError, InternalError, isSubjectErasedConflict, NotFoundError, PreconditionFailedError, RecordLockedError, UnprocessableError, writeFailure, } from "../errors/index.js";
-import { append, IdempotentAppendConflictError as EventStoreIdempotentAppendConflict, VersionConflictError as EventStoreVersionConflict, getStreamVersion, } from "../event-store/index.js";
+import { IdempotentReplayError, PreconditionFailedError, RecordLockedError, } from "../errors/classes.js";
+import { AccessDeniedError, VersionConflictError as FrameworkVersionConflict, InternalError, NotFoundError, UnprocessableError, writeFailure, } from "../errors/index.js";
+import { isSubjectErasedConflict } from "../errors/subject-erased.js";
+import { IdempotentAppendConflictError as EventStoreIdempotentAppendConflict } from "../event-store/errors.js";
+import { append, VersionConflictError as EventStoreVersionConflict, getStreamVersion, } from "../event-store/index.js";
 import { assertInstructionFieldWriteAllowed, assertIrreversibleOperationAllowed, isIrreversibleEntityVerb, } from "../pipeline/irreversible-operation-gate.js";
 import { generateId } from "../utils/index.js";
 import { applyEntityEvent } from "./apply-entity-event.js";
 import { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types.js";
 import { WritePurposes, } from "./event-store-executor.js";
 import { buildEventMetadata, entityEventName, isForeignTenantOnGlobalEntity, ownershipSubject, tryMapUniqueViolation, } from "./event-store-executor-context.js";
-import { optimisticLockFailure, ownershipDeniedFailure, projectEntityEvent, runPreSave, selectOptionNotAvailableFailure, withoutEventInJson, } from "./event-store-executor-write-steps.js";
+import { optimisticLockFailure, ownershipDeniedFailure, projectEntityEvent, runPreSave, selectOptionNotAvailableFailure, } from "./event-store-executor-write-steps.js";
 import { isFrameworkSystemUser, isLockGuardBypassed } from "./lock-guard.js";
 import { runInSavepointIfSupported } from "./query.js";
 import { assertPersonalDataWrite, tableNameOf, withExecutorManagedWrites } from "./tenant-db.js";
@@ -131,7 +134,7 @@ export function createWriteVerbs(ctx) {
         }
         throw error;
     }
-    // Stream-version is authoritative, not row.version. `ctx.appendEvent`
+    // Stream-version is authoritative, not row.version. `ctx.events.append`
     // can bump the stream between CRUD writes (domain event on the same
     // aggregate); a stale row.version here would make the next CRUD write
     // trip `events_aggregate_version_uq` (tenant_id, aggregate_id, version)
@@ -244,14 +247,14 @@ export function createWriteVerbs(ctx) {
         //    legitimately collide — the same ID has an existing stream — so return
         //    version_conflict instead of internal_error. Update uses the same catch.
         try {
-            // Savepoint-scoped: postgres.js poisons the WHOLE surrounding
-            // begin() once any statement inside it errors, even if the JS error
+            // Savepoint-scoped: Postgres aborts the WHOLE surrounding
+            // transaction once any statement inside it errors, even if the JS error
             // is caught — a losing concurrent create's unique-violation
             // would otherwise abort the caller's outer transaction and surface as
             // internal_error at commit time instead of the version_conflict this
             // catch classifies. runInSavepointIfSupported confines the failed
             // INSERT to a nested scope that rolls back on its own (same pattern as
-            // ctx.tryAppendEvent), and falls back to a plain call when the runner
+            // ctx.events.tryAppend), and falls back to a plain call when the runner
             // is a bare pool connection with no active transaction to poison
             // (seeds/tests calling the executor directly).
             const event = await runInSavepointIfSupported(runner, async (sp) => append(sp, {
@@ -287,8 +290,8 @@ export function createWriteVerbs(ctx) {
     //    designer/frontend can show a clear "duplicate" message instead of a cryptic
     //    "internal server error".
     // Savepoint like the append: an unclassified DB error from the projection
-    // write would otherwise poison the enclosing transaction (postgres-js rejects the
-    // whole begin() once any statement in it fails). The savepoint rolls back the failed
+    // write would otherwise poison the enclosing transaction (Postgres aborts the
+    // whole transaction once any statement in it fails). The savepoint rolls back the failed
     // write while allowing the error to propagate and remain catchable.
     async function applyProjection(runner, event, noRowMessage) {
         let result;
@@ -462,7 +465,7 @@ export function createWriteVerbs(ctx) {
             await projectEntityEvent(db, runner, echoEvent);
             return {
                 isSuccess: true,
-                data: withoutEventInJson({
+                data: {
                     kind: "save",
                     id: aggregateId,
                     data: projection,
@@ -473,7 +476,7 @@ export function createWriteVerbs(ctx) {
                     // Persisted event carries ciphertext by design — the caller-facing
                     // echo must be plaintext like every other response field.
                     event: echoEvent,
-                }),
+                },
             };
         },
         async update(payload, user, db, updateOptions) {
@@ -526,7 +529,7 @@ export function createWriteVerbs(ctx) {
                 const { data, echoEvent } = persisted;
                 return {
                     isSuccess: true,
-                    data: withoutEventInJson({
+                    data: {
                         kind: "save",
                         id: data["id"], // @cast-boundary engine-payload
                         data,
@@ -535,7 +538,7 @@ export function createWriteVerbs(ctx) {
                         isNew: false,
                         entityName,
                         event: echoEvent,
-                    }),
+                    },
                 };
             }
             catch (e) {
@@ -622,14 +625,14 @@ export function createWriteVerbs(ctx) {
             await projectEntityEvent(db, runner, echoEvent);
             return {
                 isSuccess: true,
-                data: withoutEventInJson({
+                data: {
                     kind: "delete",
                     id: payload.id,
                     data: existing,
                     entityName,
                     event: echoEvent,
                     ...(isLockGuardBypassed(user, options) && { lockGuardBypassed: true }),
-                }),
+                },
             };
         },
         // Hard-purge (Art. 17). Same shape as delete(), but emits `forgotten` which
@@ -695,14 +698,14 @@ export function createWriteVerbs(ctx) {
             await projectEntityEvent(db, runner, echoEvent);
             return {
                 isSuccess: true,
-                data: withoutEventInJson({
+                data: {
                     kind: "delete",
                     id: payload.id,
                     data: existing,
                     entityName,
                     event: echoEvent,
                     lockGuardBypassed: true,
-                }),
+                },
             };
         },
         async restore(payload, user, db, options) {
@@ -761,7 +764,7 @@ export function createWriteVerbs(ctx) {
             await projectEntityEvent(db, runner, echoEvent);
             return {
                 isSuccess: true,
-                data: withoutEventInJson({
+                data: {
                     kind: "save",
                     id: payload.id,
                     data: restoredHydrated,
@@ -770,7 +773,7 @@ export function createWriteVerbs(ctx) {
                     isNew: false,
                     entityName,
                     event: echoEvent,
-                }),
+                },
             };
         },
     };

package/dist/db/event-store-executor.d.ts

@@ -1,6 +1,6 @@
 import type { EventStoreExecutor } from "@cosmicdrift/kumiko-types/event-store-executor-types";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { LocalKeyKmsAdapter } from "../crypto/index.ts";
-import type { EntityDefinition } from "../engine/types/index.ts";
 import type { EntityCache } from "../pipeline/entity-cache.ts";
 import type { SearchAdapter } from "../search/types.ts";
 import type { EnvelopeCipher } from "../secrets/envelope-cipher.ts";

package/dist/db/event-store-executor.js

@@ -1,12 +1,13 @@
 import { buildExecutorContext } from "./event-store-executor-context.js";
 import { createReadVerbs } from "./event-store-executor-read.js";
 import { createWriteVerbs } from "./event-store-executor-write.js";
+import { withOwnTransactionOnPool } from "./event-store-executor-write-atomic.js";
 export { WritePurposes } from "@cosmicdrift/kumiko-types/event-store-executor-types";
 export { entityEventName } from "./event-store-executor-context.js";
 export function createEventStoreExecutor(table, entity, options) {
     const ctx = buildExecutorContext(table, entity, options);
     return {
-        ...createWriteVerbs(ctx),
+        ...withOwnTransactionOnPool(createWriteVerbs(ctx)),
         ...createReadVerbs(ctx),
     };
 }

package/dist/db/executor-managed-tables.d.ts

@@ -1,6 +1,12 @@
 import type { ExecutorManagedWriteCapability, Writable } from "@cosmicdrift/kumiko-types/executor-brand";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { AccessDeniedError } from "../errors/index.ts";
-export declare function markExecutorManagedTable(table: object): void;
+export type ExecutorManagedEntitySource = {
+    readonly entityName: string;
+    readonly entity: EntityDefinition;
+};
+export declare function markExecutorManagedTable(table: object, entitySource?: ExecutorManagedEntitySource): void;
+export declare function executorManagedEntitySourceOf(table: unknown): ExecutorManagedEntitySource | undefined;
 export declare function isExecutorManagedTable(table: unknown): boolean;
 export declare function registerExecutorManagedWriteRunner(runner: object): void;
 export declare function hasExecutorManagedWriteCapability(runner: unknown): runner is ExecutorManagedWriteCapability;