@cosmicdrift/kumiko-framework 0.389.0 → 0.390.0

package/dist/db/blind-index-cleanup.js

@@ -17,41 +17,47 @@ import { toSnakeCase } from "../utils/case.js";
 import { resolveTableName } from "./entity-table-meta.js";
 import { toPostgresArrayLiteral } from "./queries/postgres-array-literal.js";
 import { executeRawQuery, executeRawQueryRead } from "./queries/raw-sql.js";
+import { runInSystemRowLevelSecurityScope } from "./row-level-security-scope.js";
 import { columnNamesOf, tableExists } from "./schema-inspection.js";
 export async function nullBlindIndexesForSubject(db, features, subjectKey) {
-    const likePattern = subjectCiphertextLikePattern(subjectKey);
-    const candidates = [];
-    for (const feature of features.values()) {
-        for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
-            const lookupable = collectLookupableFields(entity);
-            if (lookupable.length === 0)
-                continue;
-            // No featureName prefix — the dispatcher builds entity tables without
-            // one (buildEntityTable with no featureName option), the sweep has to
-            // hit the same names.
-            candidates.push({ tableName: resolveTableName(entityName, entity, undefined), lookupable });
+    return runInSystemRowLevelSecurityScope("blind index nulling for a forgotten subject spans tenants", async () => {
+        const likePattern = subjectCiphertextLikePattern(subjectKey);
+        const candidates = [];
+        for (const feature of features.values()) {
+            for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
+                const lookupable = collectLookupableFields(entity);
+                if (lookupable.length === 0)
+                    continue;
+                // No featureName prefix — the dispatcher builds entity tables without
+                // one (buildEntityTable with no featureName option), the sweep has to
+                // hit the same names.
+                candidates.push({
+                    tableName: resolveTableName(entityName, entity, undefined),
+                    lookupable,
+                });
+            }
         }
-    }
-    // Skip entities whose projection was never migrated — same class as
-    // subjectRowExistsInTenant. A throw here runs AFTER eraseKey
-    // in forget-subject and would leave deterministic bidx columns still
-    // linkable. One batched existence query instead of one
-    // roundtrip per entity.
-    const existing = await existingTableNames(db, candidates.map((c) => c.tableName));
-    for (const { tableName, lookupable } of candidates) {
-        if (!existing.has(tableName))
-            continue;
-        // Same hazard for a migrated table that predates a later-added
-        // lookupable field: skip fields whose columns are missing instead of
-        // aborting the sweep for the remaining ones.
-        const columns = await columnNamesOf(db, tableName);
-        for (const fieldName of lookupable) {
-            const snake = toSnakeCase(fieldName);
-            if (!columns.has(snake) || !columns.has(`${snake}_bidx`))
+        // Skip entities whose projection was never migrated — same class as
+        // subjectRowExistsInTenant. A throw here runs AFTER eraseKey
+        // in forget-subject and would leave deterministic bidx columns still
+        // linkable. One batched existence query instead of one
+        // roundtrip per entity.
+        const existing = await existingTableNames(db, candidates.map((c) => c.tableName));
+        for (const { tableName, lookupable } of candidates) {
+            if (!existing.has(tableName))
                 continue;
-            await executeRawQuery(db, `UPDATE ${quoteIdent(tableName)} SET ${quoteIdent(`${snake}_bidx`)} = NULL WHERE ${quoteIdent(snake)} LIKE $1`, [likePattern]);
+            // Same hazard for a migrated table that predates a later-added
+            // lookupable field: skip fields whose columns are missing instead of
+            // aborting the sweep for the remaining ones.
+            const columns = await columnNamesOf(db, tableName);
+            for (const fieldName of lookupable) {
+                const snake = toSnakeCase(fieldName);
+                if (!columns.has(snake) || !columns.has(`${snake}_bidx`))
+                    continue;
+                await executeRawQuery(db, `UPDATE ${quoteIdent(tableName)} SET ${quoteIdent(`${snake}_bidx`)} = NULL WHERE ${quoteIdent(snake)} LIKE $1`, [likePattern]);
+            }
         }
-    }
+    });
 }
 async function existingTableNames(db, tableNames) {
     if (tableNames.length === 0)
@@ -75,37 +81,39 @@ async function existingTableNames(db, tableNames) {
 // (`aggregate_id = subjectId` under the actor tenant) when apps need
 // client-supplied ids.
 export async function subjectRowExistsInTenant(db, features, subjectId, tenantId) {
-    // Prefetch which self-PII projection tables actually exist — probing a
-    // missing relation used to throw (and get swallowed), which both hid
-    // real schema bugs and risked poisoning the driver connection for the
-    // rest of the forget TX.
-    const candidateTables = [];
-    for (const feature of features.values()) {
-        for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
-            const hasSelfPiiField = Object.values(entity.fields).some(isSelfPiiField);
-            if (!hasSelfPiiField)
-                continue;
-            // Subject ids are uuids; comparing one to a serial id column makes
-            // postgres throw (invalid input syntax for integer) mid forget-TX.
-            if (entity.idType === "serial")
+    return runInSystemRowLevelSecurityScope("subject existence check spans tenants", async () => {
+        // Prefetch which self-PII projection tables actually exist — probing a
+        // missing relation used to throw (and get swallowed), which both hid
+        // real schema bugs and risked poisoning the driver connection for the
+        // rest of the forget TX.
+        const candidateTables = [];
+        for (const feature of features.values()) {
+            for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
+                const hasSelfPiiField = Object.values(entity.fields).some(isSelfPiiField);
+                if (!hasSelfPiiField)
+                    continue;
+                // Subject ids are uuids; comparing one to a serial id column makes
+                // postgres throw (invalid input syntax for integer) mid forget-TX.
+                if (entity.idType === "serial")
+                    continue;
+                candidateTables.push(resolveTableName(entityName, entity, undefined));
+            }
+        }
+        const existing = new Set();
+        for (const tableName of candidateTables) {
+            const rows = await executeRawQueryRead(db, `SELECT to_regclass(quote_ident($1)) IS NOT NULL AS exists`, [tableName]);
+            if (rows[0]?.exists === true)
+                existing.add(tableName);
+        }
+        for (const tableName of candidateTables) {
+            if (!existing.has(tableName))
                 continue;
-            candidateTables.push(resolveTableName(entityName, entity, undefined));
+            const rows = await executeRawQueryRead(db, `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`, [subjectId, tenantId]);
+            if (rows.length > 0)
+                return true;
         }
-    }
-    const existing = new Set();
-    for (const tableName of candidateTables) {
-        const rows = await executeRawQueryRead(db, `SELECT to_regclass(quote_ident($1)) IS NOT NULL AS exists`, [tableName]);
-        if (rows[0]?.exists === true)
-            existing.add(tableName);
-    }
-    for (const tableName of candidateTables) {
-        if (!existing.has(tableName))
-            continue;
-        const rows = await executeRawQueryRead(db, `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`, [subjectId, tenantId]);
-        if (rows.length > 0)
-            return true;
-    }
-    return false;
+        return false;
+    });
 }
 function findEntityByExactName(features, entityName) {
     for (const feature of features.values()) {
@@ -123,14 +131,16 @@ function findEntityByExactName(features, entityName) {
 // table (globally unique, unspoofable via a client-supplied explicitId
 // at create) — a composite PK or shared table would break this.
 export async function recordRowExistsInTenant(db, features, entityName, recordId, tenantId) {
-    const entity = findEntityByExactName(features, entityName);
-    if (!entity)
-        return false;
-    const tableName = resolveTableName(entityName, entity, undefined);
-    if (!(await tableExists(db, tableName)))
-        return false;
-    const rows = await executeRawQueryRead(db, `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`, [recordId, tenantId]);
-    return rows.length > 0;
+    return runInSystemRowLevelSecurityScope("record existence check spans tenants", async () => {
+        const entity = findEntityByExactName(features, entityName);
+        if (!entity)
+            return false;
+        const tableName = resolveTableName(entityName, entity, undefined);
+        if (!(await tableExists(db, tableName)))
+            return false;
+        const rows = await executeRawQueryRead(db, `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`, [recordId, tenantId]);
+        return rows.length > 0;
+    });
 }
 // Provenance fallback for record subjects whose projection row is gone (hard
 // delete) or that have no registered entity at all (custom aggregates): the
@@ -138,20 +148,24 @@ export async function recordRowExistsInTenant(db, features, entityName, recordId
 // and the subject key is global, so another tenant could open a stream under
 // the same aggregate id; any foreign event voids the proof.
 export async function recordEventsOwnedExclusivelyByTenant(db, aggregateType, aggregateId, tenantId) {
-    const rows = await executeRawQueryRead(db, `SELECT 1 FROM "kumiko_events" WHERE aggregate_type = $1 AND aggregate_id = $2::uuid AND tenant_id = $3::uuid
+    return runInSystemRowLevelSecurityScope("record event ownership check spans tenants", async () => {
+        const rows = await executeRawQueryRead(db, `SELECT 1 FROM "kumiko_events" WHERE aggregate_type = $1 AND aggregate_id = $2::uuid AND tenant_id = $3::uuid
        AND NOT EXISTS (SELECT 1 FROM "kumiko_events" WHERE aggregate_type = $1 AND aggregate_id = $2::uuid AND tenant_id <> $3::uuid)
      LIMIT 1`, [aggregateType, aggregateId, tenantId]);
-    return rows.length > 0;
+        return rows.length > 0;
+    });
 }
 // Owning tenant of a record subject's row, for callers that must evaluate
 // tenant-scoped policy for the row's real owner (not the acting user's tenant).
 export async function recordRowOwningTenantId(db, features, entityName, recordId) {
-    const entity = findEntityByExactName(features, entityName);
-    if (!entity)
-        return undefined;
-    const tableName = resolveTableName(entityName, entity, undefined);
-    if (!(await tableExists(db, tableName)))
-        return undefined;
-    const rows = await executeRawQueryRead(db, `SELECT tenant_id FROM ${quoteIdent(tableName)} WHERE id = $1 LIMIT 1`, [recordId]);
-    return rows[0]?.tenant_id;
+    return runInSystemRowLevelSecurityScope("record owner lookup spans tenants", async () => {
+        const entity = findEntityByExactName(features, entityName);
+        if (!entity)
+            return undefined;
+        const tableName = resolveTableName(entityName, entity, undefined);
+        if (!(await tableExists(db, tableName)))
+            return undefined;
+        const rows = await executeRawQueryRead(db, `SELECT tenant_id FROM ${quoteIdent(tableName)} WHERE id = $1 LIMIT 1`, [recordId]);
+        return rows[0]?.tenant_id;
+    });
 }

package/dist/db/collect-table-metas.js

@@ -1,7 +1,7 @@
 // Canonical table source for both `kumiko schema generate` and setupTestStack
 // (entities, storeTables, projections, multiStreamProjections). One shared
 // source so the test-DB push and migrations cannot drift apart again.
-import { compareByCodepoint } from "../utils/index.js";
+import { compareByCodepoint } from "../utils/compare.js";
 import { assertBackingTableSuperset, deriveEntityTableMeta, } from "./entity-table-meta.js";
 import { enumerateFeatureTableSources } from "./feature-table-sources.js";
 import { asEntityTableMeta } from "./query.js";

package/dist/db/compound-types.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "../engine/types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 /**
  * API-Form (combined) → DB-Form (flat). Wird vor jedem Insert/Update aufgerufen.
  */

package/dist/db/compound-types.js

@@ -1,10 +1,3 @@
-// Compound-type pipeline for the executor.
-//
-// A compound type is a field represented by ONE API object and MULTIPLE
-// DB columns. Examples:
-//   - locatedTimestamp: { at, tz, utc } ↔ <name>Utc + <name>Tz
-//   - money: { amount, currency } ↔ <name> + <name>Currency
-//   - (upcoming) address: { street, zip, city } ↔ <name>Street + <name>Zip + <name>City
 //
 // Instead of nesting every helper in the executor at four different points,
 // this function pipelines all compound-type conversions in one pass. Adding

package/dist/db/config-seed.d.ts

@@ -1,5 +1,6 @@
+import type { ConfigSeedDef } from "@cosmicdrift/kumiko-types/config";
 import type { EntityDefinition } from "../engine/index.ts";
-import type { ConfigSeedDef, Registry } from "../engine/types/index.ts";
+import type { Registry } from "../engine/types/index.ts";
 import type { EnvelopeCipher } from "../secrets/envelope-cipher.ts";
 import type { DbConnection } from "./connection.ts";
 import type { EntityTable } from "./table-builder.ts";

package/dist/db/config-seed.js

@@ -24,7 +24,12 @@ export async function seedConfigValues(seeds, table, entity, registry, db, ciphe
         return { created, skipped };
     const systemUser = createSystemUser(SYSTEM_TENANT_ID);
     const executor = createEventStoreExecutor(table, entity, { entityName: "config-value" });
-    const tdb = createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+    const tdb = createTenantDb({
+        db,
+        tenantId: SYSTEM_TENANT_ID,
+        mode: "system",
+        reason: "config seeds are system-tenant defaults",
+    });
     for (const seed of seeds) {
         const keyDef = registry.getConfigKey(seed.key);
         if (!keyDef) {

package/dist/db/connection.d.ts

@@ -1,4 +1,5 @@
 import type { DbConnection, PgClient, PgListenClient } from "@cosmicdrift/kumiko-types/db-connection";
+import { type RowLevelSecurityMode } from "./render-rls-ddl.ts";
 export type * from "@cosmicdrift/kumiko-types/db-connection";
 type BunSqlOptions = Bun.SQL.PostgresOrMySQLOptions;
 export type DbConnectionOptions = {
@@ -13,6 +14,7 @@ export type DbConnectionOptions = {
 };
 export type CreateDbConnectionOptions = DbConnectionOptions & {
     readonly url: string;
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
 };
 export type DbConnectionHandle = {
     db: DbConnection;
@@ -26,7 +28,7 @@ export type UnboundedSiblingPool = {
     readonly close: (timeoutSeconds: number) => Promise<void>;
 };
 export declare function openUnboundedSiblingPool(db: unknown): UnboundedSiblingPool | undefined;
-export declare function createDbConnection({ url, ...options }: CreateDbConnectionOptions): DbConnectionHandle;
+export declare function createDbConnection({ url, rowLevelSecurity, ...options }: CreateDbConnectionOptions): DbConnectionHandle;
 export declare function dbConnectionOptionsFromEnv(env?: Readonly<Record<string, string | undefined>>): DbConnectionOptions;
 export declare const DEFAULT_SERVER_STATEMENT_TIMEOUT_MS = 60000;
 export declare const DEFAULT_SERVER_IDLE_IN_TRANSACTION_TIMEOUT_MS = 300000;

package/dist/db/connection.js

@@ -1,4 +1,6 @@
 import { readPositiveIntEnv } from "../utils/env-parse.js";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "./render-rls-ddl.js";
+import { enforceRowLevelSecurity } from "./row-level-security-connection.js";
 // A DB outage can leave an in-flight query referenced on a dead connection,
 // so a plain close() (no timeout = wait for queries to finish) hangs forever —
 // close() must always bound how long shutdown waits.
@@ -20,7 +22,7 @@ function verifiedTls(ssl) {
     }
     return ssl;
 }
-export function createDbConnection({ url, ...options }) {
+export function createDbConnection({ url, rowLevelSecurity = DEFAULT_ROW_LEVEL_SECURITY_MODE, ...options }) {
     const sqlOptions = {};
     if (options.maxConnections !== undefined)
         sqlOptions.max = options.maxConnections;
@@ -45,11 +47,18 @@ export function createDbConnection({ url, ...options }) {
     if (Object.keys(serverParameters).length > 0)
         sqlOptions.connection = serverParameters;
     // Bun.SQL opens all `max` connections on the first query, so a pool always costs `max` backends.
-    const client = new Bun.SQL(url, sqlOptions);
+    const rawClient = new Bun.SQL(url, sqlOptions);
+    const enforced = rowLevelSecurity === "on";
+    const client = enforced ? enforceRowLevelSecurity(rawClient) : rawClient;
     // A run that never settles (a caller gave up on it via its own timeout) never reaches the
     // sibling's own close; close() ends it so shutdown and DROP DATABASE are not blocked by it.
     const openSiblings = new Set();
-    unboundedSiblingFactories.set(client, () => {
+    const registerFactory = (factory) => {
+        unboundedSiblingFactories.set(rawClient, factory);
+        if (client !== rawClient)
+            unboundedSiblingFactories.set(client, factory);
+    };
+    registerFactory(() => {
         // Two connections are enough for lock-in-tx plus DDL; the cap keeps parallel rebuilds from exhausting max_connections.
         const sibling = new Bun.SQL(url, {
             ...sqlOptions,
@@ -58,7 +67,7 @@ export function createDbConnection({ url, ...options }) {
         });
         openSiblings.add(sibling);
         return {
-            client: sibling,
+            client: enforced ? enforceRowLevelSecurity(sibling) : sibling,
             close: async (timeoutSeconds) => {
                 openSiblings.delete(sibling);
                 await sibling.close({ timeout: timeoutSeconds });
@@ -71,8 +80,9 @@ export function createDbConnection({ url, ...options }) {
         listenClient: client,
         close: async () => {
             const timeout = options.closeTimeoutSeconds ?? DEFAULT_DB_CLOSE_TIMEOUT_SECONDS;
+            unboundedSiblingFactories.delete(rawClient);
             unboundedSiblingFactories.delete(client);
-            const pools = [client, ...openSiblings];
+            const pools = [rawClient, ...openSiblings];
             openSiblings.clear();
             const results = await Promise.allSettled(pools.map((pool) => pool.close({ timeout })));
             const failure = results.find((result) => result.status === "rejected");

package/dist/db/cross-tenant-reads.d.ts

@@ -1,5 +1,5 @@
+import type { EscapeHatchReporter } from "@cosmicdrift/kumiko-types/handlers";
 import type { CrossTenantReads } from "@cosmicdrift/kumiko-types/tenant-db-types";
-import type { EscapeHatchReporter } from "../engine/types/index.ts";
 import { type CreateTenantDbOptions, type TenantDb } from "./tenant-db.ts";
 export declare function createCrossTenantReads(systemModeDb: TenantDb, reason: string, report: EscapeHatchReporter): CrossTenantReads;
 export declare function createHandlerCrossTenantReads(options: Omit<CreateTenantDbOptions, "mode"> & {

package/dist/db/cross-tenant-reads.js

@@ -18,6 +18,6 @@ export function createCrossTenantReads(systemModeDb, reason, report) {
 // Own system-mode TenantDb without unsafeRaw/globalWrites: the handler gets the read surface only.
 export function createHandlerCrossTenantReads(options) {
     const { reason, report, ...dbOptions } = options;
-    const systemModeDb = createTenantDb({ ...dbOptions, mode: "system" });
+    const systemModeDb = createTenantDb({ ...dbOptions, mode: "system", reason });
     return createCrossTenantReads(systemModeDb, reason, report);
 }

package/dist/db/dialect.d.ts

@@ -4,7 +4,6 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { PgType } from "./entity-table-meta.ts";
 export type { ColumnHandle, SchemaTable } from "@cosmicdrift/kumiko-types/schema-table-types";
 export type TableColumns<_T = unknown> = SchemaTable;
-export type SelectQuery = unknown;
 export declare function pgTypeToSqlType(pgType: PgType): string;
 type ColumnFinal = {
     readonly sqlName: string;
@@ -46,10 +45,6 @@ export declare function timestamp(name: string, _opts?: {
     withTimezone?: boolean;
     mode?: "string" | "date";
 }): ColumnBuilder<Temporal.Instant | string>;
-export declare function numeric(name: string, _opts?: {
-    precision?: number;
-    scale?: number;
-}): ColumnBuilder<string>;
 export declare function instant(name: string, opts?: {
     precision?: 0 | 1 | 2 | 3 | 4 | 5 | 6;
 }): ColumnBuilder<Temporal.Instant>;

package/dist/db/dialect.js

@@ -180,9 +180,6 @@ export function timestamp(name, _opts) {
 }
 // numeric → text (we don't currently use Decimal); kept for compat with
 // legacy schema imports that won't actually instantiate at runtime.
-export function numeric(name, _opts) {
-    return buildColumn(name, "text");
-}
 export function instant(name, opts) {
     const pgType = opts?.precision === 3 ? "timestamptz(3)" : "timestamptz";
     return buildColumn(name, pgType);

package/dist/db/eagerload.d.ts

@@ -1,4 +1,5 @@
-import type { EntityDefinition, SessionUser } from "../engine/types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { SessionUser } from "../engine/types/index.ts";
 import { type ParentVisibilityOption } from "./parent-ref-clause.ts";
 import type { TenantDb } from "./tenant-db.ts";
 export type EagerLoadEntityResolver = (entityName: string) => EntityDefinition | undefined;

package/dist/db/entity-field-encryption.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "../engine/types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { type Logger } from "../logging/index.ts";
 import type { EnvelopeCipher } from "../secrets/envelope-cipher.ts";
 export declare function collectEncryptedFieldNames(entity: EntityDefinition): ReadonlySet<string>;

package/dist/db/entity-table-meta.d.ts

@@ -1,6 +1,6 @@
 import type { Writable } from "@cosmicdrift/kumiko-types/executor-brand";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { EntityTenancy, TenancyBrand } from "@cosmicdrift/kumiko-types/tenancy-brand";
-import type { EntityDefinition } from "../engine/types/index.ts";
 import type { BuildEntityTableMetaOptions, EntityTableMeta, UnmanagedTableInput } from "./entity-table-meta-types.ts";
 export type { BuildEntityTableMetaOptions, ColumnMeta, CompositePrimaryKeyMeta, EntityTableMeta, IndexMeta, PgType, UnmanagedTableInput, } from "./entity-table-meta-types.ts";
 export declare function resolveTableName(entityName: string, entity: EntityDefinition, featureName: string | undefined): string;

package/dist/db/event-store-executor-context.d.ts

@@ -1,6 +1,8 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { EntityId } from "@cosmicdrift/kumiko-types/identifiers";
 import type { ErasedSubjectHandling } from "../crypto/pii-field-encryption.ts";
 import type { WhereObject } from "../db/query.ts";
-import type { EntityDefinition, EntityId, SessionUser, TenantId } from "../engine/types/index.ts";
+import type { SessionUser, TenantId } from "../engine/types/index.ts";
 import { type WriteFailure } from "../errors/index.ts";
 import { type EventMetadata } from "../event-store/index.ts";
 import type { EntityCache } from "../pipeline/entity-cache.ts";

package/dist/db/event-store-executor-context.js

@@ -5,7 +5,8 @@ import { executeRawQueryRead } from "../db/queries/raw-sql.js";
 import { shiftParams } from "../engine/ownership.js";
 import { SYSTEM_TENANT_ID } from "../engine/types/identifiers.js";
 import { AccessDeniedError, InternalError, subjectErasedConflict, UniqueViolationError, writeFailure, } from "../errors/index.js";
-import { ArchivedStreamError, isStreamArchived } from "../event-store/index.js";
+import { ArchivedStreamError } from "../event-store/errors.js";
+import { isStreamArchived } from "../event-store/index.js";
 import { assertUnreachable } from "../utils/index.js";
 import { rehydrateCompoundTypes } from "./compound-types.js";
 import { collectEncryptedFieldNames, decryptEntityFieldValues, encryptEntityFieldValues, logUndecryptableField, resolveEntityFieldEncryption, } from "./entity-field-encryption.js";
@@ -120,7 +121,7 @@ export function buildExecutorContext(table, entity, options) {
     // old hardcoded user.tenantId). Single source of truth for the stream key.
     const streamTenantFor = (user, requestedStreamTenantId) => entity.systemStream ? SYSTEM_TENANT_ID : (requestedStreamTenantId ?? user.tenantId);
     // Only a system-mode db (r.systemScope() / acknowledged cross-tenant) or a tenant-mode db bound
-    // to exactly that stream tenant (ctx.forTenant) may address another tenant's stream, and only
+    // to exactly that stream tenant (ctx.tenants.writeTarget) may address another tenant's stream, and only
     // the tenant of the row it just loaded.
     const streamTenantOverrideFailure = (db, row, requestedStreamTenantId) => {
         if (requestedStreamTenantId === undefined)
@@ -293,7 +294,7 @@ export function buildExecutorContext(table, entity, options) {
         return await decryptForRead(rehydrateCompoundTypes(row, entity));
     }
     // Archive guard for the CRUD write paths. Archived streams are read-only —
-    // ctx.appendEvent (append-event-core) already enforces this, but the
+    // ctx.events.append (append-event-core) already enforces this, but the
     // executor appends directly via append() and getStreamVersion() ignores
     // the archive flag, so without this check a PATCH/DELETE on an archived
     // entity would silently land an event and break the read-only contract

package/dist/db/event-store-executor-read-filter.d.ts

@@ -1,5 +1,5 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { type OwnershipClause } from "../engine/ownership.ts";
-import type { EntityDefinition } from "../engine/types/index.ts";
 import { type Table } from "./event-store-executor-context.ts";
 export type ListWhere = {
     readonly whereSql: string[];

package/dist/db/event-store-executor-read-rows.d.ts

@@ -1,4 +1,5 @@
-import type { EntityDefinition, TenantId } from "../engine/types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
+import type { TenantId } from "../engine/types/index.ts";
 import type { TableInfo } from "./table-info.ts";
 export declare function withStreamVersion(row: Record<string, unknown>, streamVersion: number): Record<string, unknown>;
 export declare function coerceAndRehydrateRow(raw: Record<string, unknown>, tableInfo: TableInfo, entity: EntityDefinition): Record<string, unknown>;

package/dist/db/event-store-executor-read-search.d.ts

@@ -1,5 +1,6 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { type OwnershipClause } from "../engine/ownership.ts";
-import type { EntityDefinition, SessionUser, TenantId } from "../engine/types/index.ts";
+import type { SessionUser, TenantId } from "../engine/types/index.ts";
 import type { SearchAdapter } from "../search/types.ts";
 import type { EventStoreExecutor } from "./event-store-executor.ts";
 import type { Table } from "./event-store-executor-context.ts";

package/dist/db/event-store-executor-read-sort.d.ts

@@ -1,5 +1,6 @@
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { type OwnershipClause } from "../engine/ownership.ts";
-import type { EntityDefinition, SessionUser } from "../engine/types/index.ts";
+import type { SessionUser } from "../engine/types/index.ts";
 import type { EventStoreExecutor } from "./event-store-executor.ts";
 import type { Table } from "./event-store-executor-context.ts";
 import type { ListWhere } from "./event-store-executor-read-filter.ts";

package/dist/db/event-store-executor-read.js

@@ -59,7 +59,7 @@ export function createReadVerbs(ctx) {
             const tableInfo = extractTableInfo(table);
             const encryptedRows = rawRows.map((r) => coerceAndRehydrateRow(r, tableInfo, entity));
             const decryptedRows = await Promise.all(encryptedRows.map((r) => decryptForRead(r, { degradeUndecryptable: () => { } })));
-            // Stream version is authoritative (see detail()): ctx.appendEvent bumps the
+            // Stream version is authoritative (see detail()): ctx.events.append bumps the
             // stream without touching row.version, so the raw row version would hand
             // clients a stale optimistic-lock base. Rows without events keep theirs.
             const rows = decryptedRows.map((r, i) => withStreamVersion(r, streamVersions[i] ?? 0));
@@ -101,7 +101,7 @@ export function createReadVerbs(ctx) {
                 return null;
             const idWhere = idFilter(payload.id);
             // Stream-version authoritative (same policy as update/Block 0):
-            // ctx.appendEvent (lifecycle-writes like incident:post-update) bumps
+            // ctx.events.append (lifecycle-writes like incident:post-update) bumps
             // the stream WITHOUT touching row.version — a detail-read that hands
             // out the stale row.version dooms the next CRUD update built on it
             // (entityEdit loads detail.version as its optimistic-lock base) to a

package/dist/db/event-store-executor-write-atomic.js

@@ -1,21 +1,22 @@
 import { runnerCanBeginTransaction } from "./query.js";
-import { runInOwnTransaction } from "./tenant-db.js";
 import { isBoundTenantDb, tenantDbRunner, tenantDbWritesDeniedReason } from "./tenant-db-runner.js";
+import { runInOwnSavepoint, runInOwnTransaction } from "./tenant-db-scoped-rebind.js";
 // Aborts the surrounding transaction when a verb returns a failure instead of throwing.
 class RollbackOnFailure extends Error {
 }
-// Pool runners have no savepoint, so append, projection and hooks would otherwise commit as
-// separate autocommit statements. Tx and savepoint runners already provide atomicity.
+// Append, projection and hooks commit or roll back together, also when a handler swallows a failed
+// verb inside its transaction. Savepoints on one tx are serialized, so parallel verbs cannot interleave.
 async function runVerbAtomically(db, run) {
     // Unbound and denied handles keep their original error, a fresh transaction would reword it.
-    if (!isBoundTenantDb(db) ||
-        tenantDbWritesDeniedReason(db) !== undefined ||
-        !runnerCanBeginTransaction(tenantDbRunner(db))) {
+    if (!isBoundTenantDb(db) || tenantDbWritesDeniedReason(db) !== undefined) {
         return run(db);
     }
+    const runInOwnScope = runnerCanBeginTransaction(tenantDbRunner(db))
+        ? runInOwnTransaction
+        : runInOwnSavepoint;
     let failure;
     try {
-        return await runInOwnTransaction(db, async (txDb) => {
+        return await runInOwnScope(db, async (txDb) => {
             const result = await run(txDb);
             if (!result.isSuccess) {
                 failure = result;

package/dist/db/event-store-executor-write-steps.d.ts

@@ -1,8 +1,9 @@
+import type { EntityId } from "@cosmicdrift/kumiko-types/identifiers";
 import type { TenantDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
 import type { ZodType } from "zod";
 import type { UnavailableSelectOption } from "../engine/screen-helpers.ts";
-import type { EntityId } from "../engine/types/index.ts";
-import { type UnprocessableOpts, type WriteFailure, writeFailure } from "../errors/index.ts";
+import type { UnprocessableOpts } from "../errors/classes.ts";
+import { type WriteFailure, writeFailure } from "../errors/index.ts";
 import type { StoredEvent } from "../event-store/index.ts";
 import type { DbRow, DbRunner } from "./connection.ts";
 export declare function projectEntityEvent(db: TenantDb, runner: DbRunner, event: StoredEvent): Promise<void>;

package/dist/db/event-store-executor-write.js

@@ -4,8 +4,11 @@ import { instructionFieldNames } from "../engine/instruction-fields.js";
 import { userCanCreateFieldRow, userCanWriteFieldRow } from "../engine/ownership.js";
 import { buildInsertSchema, buildUpdateSchema } from "../engine/schema-builder.js";
 import { findUnavailableSelectOptions, isRecordLocked, isUnchangedValue, } from "../engine/screen-helpers.js";
-import { AccessDeniedError, VersionConflictError as FrameworkVersionConflict, IdempotentReplayError, InternalError, isSubjectErasedConflict, NotFoundError, PreconditionFailedError, RecordLockedError, UnprocessableError, writeFailure, } from "../errors/index.js";
-import { append, IdempotentAppendConflictError as EventStoreIdempotentAppendConflict, VersionConflictError as EventStoreVersionConflict, getStreamVersion, } from "../event-store/index.js";
+import { IdempotentReplayError, PreconditionFailedError, RecordLockedError, } from "../errors/classes.js";
+import { AccessDeniedError, VersionConflictError as FrameworkVersionConflict, InternalError, NotFoundError, UnprocessableError, writeFailure, } from "../errors/index.js";
+import { isSubjectErasedConflict } from "../errors/subject-erased.js";
+import { IdempotentAppendConflictError as EventStoreIdempotentAppendConflict } from "../event-store/errors.js";
+import { append, VersionConflictError as EventStoreVersionConflict, getStreamVersion, } from "../event-store/index.js";
 import { assertInstructionFieldWriteAllowed, assertIrreversibleOperationAllowed, isIrreversibleEntityVerb, } from "../pipeline/irreversible-operation-gate.js";
 import { generateId } from "../utils/index.js";
 import { applyEntityEvent } from "./apply-entity-event.js";
@@ -131,7 +134,7 @@ export function createWriteVerbs(ctx) {
         }
         throw error;
     }
-    // Stream-version is authoritative, not row.version. `ctx.appendEvent`
+    // Stream-version is authoritative, not row.version. `ctx.events.append`
     // can bump the stream between CRUD writes (domain event on the same
     // aggregate); a stale row.version here would make the next CRUD write
     // trip `events_aggregate_version_uq` (tenant_id, aggregate_id, version)
@@ -251,7 +254,7 @@ export function createWriteVerbs(ctx) {
             // internal_error at commit time instead of the version_conflict this
             // catch classifies. runInSavepointIfSupported confines the failed
             // INSERT to a nested scope that rolls back on its own (same pattern as
-            // ctx.tryAppendEvent), and falls back to a plain call when the runner
+            // ctx.events.tryAppend), and falls back to a plain call when the runner
             // is a bare pool connection with no active transaction to poison
             // (seeds/tests calling the executor directly).
             const event = await runInSavepointIfSupported(runner, async (sp) => append(sp, {

package/dist/db/event-store-executor.d.ts

@@ -1,6 +1,6 @@
 import type { EventStoreExecutor } from "@cosmicdrift/kumiko-types/event-store-executor-types";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { LocalKeyKmsAdapter } from "../crypto/index.ts";
-import type { EntityDefinition } from "../engine/types/index.ts";
 import type { EntityCache } from "../pipeline/entity-cache.ts";
 import type { SearchAdapter } from "../search/types.ts";
 import type { EnvelopeCipher } from "../secrets/envelope-cipher.ts";

package/dist/db/executor-managed-tables.d.ts

@@ -1,6 +1,12 @@
 import type { ExecutorManagedWriteCapability, Writable } from "@cosmicdrift/kumiko-types/executor-brand";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import { AccessDeniedError } from "../errors/index.ts";
-export declare function markExecutorManagedTable(table: object): void;
+export type ExecutorManagedEntitySource = {
+    readonly entityName: string;
+    readonly entity: EntityDefinition;
+};
+export declare function markExecutorManagedTable(table: object, entitySource?: ExecutorManagedEntitySource): void;
+export declare function executorManagedEntitySourceOf(table: unknown): ExecutorManagedEntitySource | undefined;
 export declare function isExecutorManagedTable(table: unknown): boolean;
 export declare function registerExecutorManagedWriteRunner(runner: object): void;
 export declare function hasExecutorManagedWriteCapability(runner: unknown): runner is ExecutorManagedWriteCapability;