@cosmicdrift/kumiko-dev-server 0.388.0 → 0.390.0

package/dist/build-server-bundle.js

@@ -59,7 +59,8 @@ const hasBun = typeof Bun !== "undefined";
 // reference the package at runtime (no native binding, plain HTTP client,
 // but a real runtime import). A production crash in money-horse,
 // "Cannot find package 'meilisearch'", occurred because it used to be in
-// BUILD_ONLY_EXTERNALS instead.
+// BUILD_ONLY_EXTERNALS instead. Its version comes from the framework's
+// peerDependencies range.
 const RUNTIME_EXTERNALS = [
     "@node-rs/argon2",
     "sharp",
@@ -296,7 +297,8 @@ async function resolveRuntimeDepsVersions(cwd, repoRoot, packages) {
             continue;
         const raw = await readFile(path, "utf-8");
         const parsed = parseJsonOrThrow(raw, path);
-        Object.assign(allDeps, parsed.dependencies ?? {}, parsed.optionalDependencies ?? {});
+        // Peers first: a real dependency of the same source overrides a peer range.
+        Object.assign(allDeps, parsed.peerDependencies ?? {}, parsed.dependencies ?? {}, parsed.optionalDependencies ?? {});
     }
     // App package.json fills gaps only — pins extraRuntimeExternals without
     // overriding framework-native pins the app may also list.

package/dist/create-kumiko-server-stack.js

@@ -2,7 +2,7 @@ import { resolveAnonymousAccessFromRegistry } from "@cosmicdrift/kumiko-bundled-
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { createMetricsForFactory } from "@cosmicdrift/kumiko-framework/observability";
 import { startDevJobRunners } from "@cosmicdrift/kumiko-server-runtime/boot/job-run-logger";
-import { makeDispatchSystemQuery, makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-server-runtime/extra-routes-deps";
+import { makeDispatchSystemQuery, makeDispatchSystemWrite, makeFilesForTenant, } from "@cosmicdrift/kumiko-server-runtime/extra-routes-deps";
 import { pushEntityProjectionTables, setupTestStack, } from "@cosmicdrift/kumiko-testing/stack";
 import { logInfo } from "./dev-server-runtime.js";
 import { isPersistentDevDb } from "./is-persistent-dev-db.js";
@@ -39,6 +39,7 @@ function buildDevStackOptions(options, dbMode) {
         ...(options.extraRoutes !== undefined && { extraRoutes: options.extraRoutes }),
         ...(options.trustedProxyHops !== undefined && { trustedProxyHops: options.trustedProxyHops }),
         ...(options.errorDocs && { errorDocs: options.errorDocs }),
+        ...(options.rowLevelSecurity !== undefined && { rowLevelSecurity: options.rowLevelSecurity }),
         // jobs.consumerLane unset = enqueuer-only; startDevJobRunners is the sole
         // consumer/cron-scheduler per lane, so runOnBoot/cron jobs don't
         // double-fire.
@@ -48,7 +49,7 @@ function buildDevStackOptions(options, dbMode) {
 export async function bootDevStack(options, dbMode) {
     logInfo(`[kumiko-server] booting Kumiko stack${dbMode.persistentDb ? ` — persistent DB "${dbMode.devDbName}"` : " — ephemeral test DB"}…`);
     const stack = await setupTestStack(buildDevStackOptions(options, dbMode));
-    await createEventsTable(stack.db);
+    await createEventsTable(stack.unscopedDb);
     await pushEntityProjectionTables(stack, stack.registry);
     // `extraRoutes` is already mounted by setupTestStack's buildServer();
     // `wire` is for co-running components that need the system-write
@@ -60,6 +61,7 @@ export async function bootDevStack(options, dbMode) {
             // so application code sees the same interface in development and production.
             redis: stack.redis.redis,
             registry: stack.registry,
+            filesForTenant: makeFilesForTenant(stack.context),
             metricsFor: createMetricsForFactory(stack.observability.meter),
             dispatchSystemWrite: makeDispatchSystemWrite(stack.dispatcher),
             dispatchSystemQuery: makeDispatchSystemQuery(stack.dispatcher),
@@ -85,13 +87,13 @@ export async function startDevBackgroundRunners(stack, jobQueueNamePrefix) {
         registry: stack.registry,
         db: stack.db,
         // The stack's own AppContext, not a `{ db, registry }` literal: these
-        // runners consume the lanes, and a job reaching for ctx.files /
+        // runners consume the lanes, and a job reaching for ctx.services.files /
         // ctx.notify / ctx.config would otherwise die here while the very same
         // handler works on the request path.
         context: stack.context,
         redisUrl,
         // Same dispatcher the request path writes through — without this,
-        // ctx.write/ctx.writeAs/ctx.queryAs inside a dev-run job throw on their
+        // ctx.dispatch.write/ctx.dispatch.writeAs/ctx.dispatch.queryAs inside a dev-run job throw on their
         // first call.
         dispatcher: stack.dispatcher,
         // Must match setupTestStack's jobs.queueNamePrefix so enqueuer and

package/dist/create-kumiko-server-stylesheet.js

@@ -3,6 +3,7 @@ import { spawn } from "node:child_process";
 import { existsSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { resolveInstalledSync } from "@cosmicdrift/kumiko-server-runtime/resolve-installed-package";
 import { canResolveTailwindStylesheet, resolveTailwindCli, } from "@cosmicdrift/kumiko-server-runtime/resolve-tailwind-cli";
 import { hasBun, logError, logInfo } from "./dev-server-runtime.js";
 // Duplicated in packages/testing/src/e2e/constants.ts: the Playwright config
@@ -44,18 +45,15 @@ export function resolveStylesheet(options) {
         // silently rather than reporting an error.
         return undefined;
     }
-    try {
-        const resolved = Bun.resolveSync("@cosmicdrift/kumiko-renderer/web/styles.css", process.cwd());
-        if (!canResolveTailwindStylesheet(resolved, { bun: Bun, cwd: process.cwd() })) {
-            return undefined;
-        }
-        return resolved;
-    }
-    catch (err) {
+    const resolved = resolveInstalledSync("@cosmicdrift/kumiko-renderer/web/styles.css", process.cwd());
+    if (resolved === undefined) {
         logError("[kumiko-server] couldn't auto-resolve @cosmicdrift/kumiko-renderer/web/styles.css — " +
-            "pass `stylesheet: <path>` or `stylesheet: false` explicitly.", err);
+            "pass `stylesheet: <path>` or `stylesheet: false` explicitly.");
         return undefined;
     }
+    return canResolveTailwindStylesheet(resolved, { bun: Bun, cwd: process.cwd() })
+        ? resolved
+        : undefined;
 }
 // The E2E template can only reach an app's own server entry through its env,
 // so the env has to count whenever the option is left undefined.

package/dist/create-kumiko-server.d.ts

@@ -1,5 +1,6 @@
 /// <reference types="bun-types" preserve="true" />
 import type { AuthRoutesConfig, ExtraRouteDefinition } from "@cosmicdrift/kumiko-framework/api";
+import { type RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import type { ErrorDocsConfig } from "@cosmicdrift/kumiko-framework/errors";
 import type { PageHeadResolver, PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
@@ -64,6 +65,8 @@ export type DevHostDispatch = (req: Request, deps: {
     readonly cspScriptHashes: readonly string[];
 }) => DevHostDispatchResult | Promise<DevHostDispatchResult>;
 export type CreateKumikoServerOptions = {
+    /** Row level security of the dev stack, as in prod. Default "on", so tenant-isolation bugs show up in development. */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
     /** Features whose entities, handlers, and screens get wired into the
      *  dev stack. Pass every feature the app is supposed to run. */
     readonly features: readonly FeatureDefinition[];
@@ -141,7 +144,7 @@ export type CreateKumikoServerOptions = {
     readonly anonymousAccess?: TestStackOptions["anonymousAccess"];
     /** File-storage provider forwarded to `setupTestStack`. When set, the
      *  stack mounts the upload routes (POST/GET/DELETE /api/files), exposes
-     *  `ctx.files`, and creates the `file_refs` table. Example:
+     *  `ctx.services.files`, and creates the `file_refs` table. Example:
      *  `{ storageProvider: createInMemoryFileProvider() }`. */
     readonly files?: TestStackOptions["files"];
     /** Feature-toggle resolver forwarded to `setupTestStack`. When set, the

package/dist/create-kumiko-server.js

@@ -14,6 +14,7 @@
 //
 // The companion prod entry will land at `@cosmicdrift/kumiko-framework/server`
 // with a different options shape (clientDist, auth config, db url).
+import { assertNoActiveRowLevelSecurityScope, } from "@cosmicdrift/kumiko-framework/db";
 import { buildAppSchema } from "@cosmicdrift/kumiko-framework/engine";
 import { buildBunServeOptions, resolveDerivedMaxRequestBodySize, } from "@cosmicdrift/kumiko-server-runtime/bun-serve-options";
 import { stripNoRouteMatchHeader } from "@cosmicdrift/kumiko-server-runtime/try-hono-first";
@@ -33,6 +34,7 @@ import { hasBun, logInfo } from "./dev-server-runtime.js";
 function startDevHttpServer(port, handleFetch, stack) {
     if (!hasBun)
         return undefined;
+    assertNoActiveRowLevelSecurityScope("dev server");
     return Bun.serve(buildBunServeOptions(port, handleFetch, resolveDerivedMaxRequestBodySize(stack.registry), {
         upgradeFetch: async (req, env) => stripNoRouteMatchHeader(await stack.app.fetch(req, env)),
     }));

package/dist/few-shot-corpus.d.ts

@@ -1,4 +1,4 @@
-import { type FeaturePattern, type ParseError } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeaturePattern, type ParseError } from "@cosmicdrift/kumiko-feature-ast";
 export type AuthoringStyle = "canonical" | "legacy";
 export type CorpusWarning = {
     /** Repo-relative path to the file that triggered the warning. */

package/dist/few-shot-corpus.js

@@ -31,7 +31,7 @@
 //   builder is permissive, and the Designer filters at read-time.
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
-import { PATTERN_LIBRARY, parseFeatureFile, } from "@cosmicdrift/kumiko-framework/engine";
+import { PATTERN_LIBRARY, parseFeatureFile, } from "@cosmicdrift/kumiko-feature-ast";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 // =============================================================================
 // Builder

package/dist/framework-version.js

@@ -13,6 +13,7 @@ function isDevServerManifest(value) {
 }
 // All @cosmicdrift packages release in lockstep (changesets fixed-group), so
 // the dev-server's own version is the framework version.
+// Exact (no caret): `kumiko check managed` rejects ranges on @cosmicdrift pins.
 export function resolveFrameworkVersion(startDir = import.meta.dir) {
     let dir = startDir;
     while (true) {
@@ -21,7 +22,7 @@ export function resolveFrameworkVersion(startDir = import.meta.dir) {
             // A corrupt or foreign package.json on the way up must not abort the search.
             const manifest = parseJsonSafe(readFileSync(candidate, "utf-8"), undefined);
             if (isDevServerManifest(manifest))
-                return `^${manifest.version}`;
+                return manifest.version;
         }
         const parent = dirname(dir);
         if (parent === dir)

package/dist/managed-files/registry.js

@@ -92,6 +92,7 @@ function renderReleaseWorkflow(facts) {
         infraRef: infraRef ?? DEFAULT_INFRA_REF,
     }, { privateDeploy: visibility === "private", publicRollout: visibility === "public" });
 }
+const COMPOSE_ONLY_DEPLOY_FILE = "migrate-step.sh";
 export function renderManagedTemplates(facts) {
     const deploy = renderDeployFiles({
         appName: facts.appName,
@@ -99,7 +100,10 @@ export function renderManagedTemplates(facts) {
         ensuredRegistryConfigFiles: [BUNFIG_FILES.unit],
     });
     return [
-        ...deploy.files.map((file) => marked(`deploy/${file.output}`, file.content, "#", file.output.endsWith(".sh"))),
+        ...deploy.files
+            // Managed apps migrate through the migrate-db initContainer of the infra _app-deploy.yml; migrate-step.sh is compose-only.
+            .filter((file) => file.output !== COMPOSE_ONLY_DEPLOY_FILE)
+            .map((file) => marked(`deploy/${file.output}`, file.content, "#", file.output.endsWith(".sh"))),
         marked(".husky/pre-push", readTemplate("husky-pre-push.template"), "#", true),
         marked(".github/workflows/cache-cleanup.yml", readTemplate("cache-cleanup.yml.template"), "#"),
         marked(".github/workflows/release.yml", renderReleaseWorkflow(facts), "#"),

package/dist/run-dev-app-auth.js

@@ -148,6 +148,7 @@ export async function runDevAfterSetup(stack, ctx) {
         admin: effectiveAuth?.admin,
         shortcutSeeds: wiring.shortcutSeeds,
         cipher: bootCrypto.configCipher,
+        processName: "runDevApp",
     });
     for (const seed of config.stackSeeds) {
         await seed(stack);

package/dist/run-dev-app-config.js

@@ -86,7 +86,7 @@ export async function resolveDevBootConfig(options, bootFailure) {
         warn: (message) => createFallbackLogger("runDevApp").warn(message),
     });
     const extraRoutes = collectDevExtraRoutes(options, unsubscribeRoutes, wiring);
-    const features = composeAppFeatures(options.features, wiring.features, effectiveAuth);
+    const features = composeAppFeatures(options.features, wiring.features, effectiveAuth, options.bundledLists);
     return { stackSeeds, wiring, envSource, effectiveAuth, unsubscribeLinks, extraRoutes, features };
 }
 // An explicitly wired file provider (options.files) satisfies the

package/dist/run-dev-app-server-options.js

@@ -3,6 +3,7 @@ function pickDevClientOptions(options) {
     return {
         ...(options.clientEntry !== undefined && { clientEntry: options.clientEntry }),
         ...(options.errorDocs && { errorDocs: options.errorDocs }),
+        ...(options.rowLevelSecurity !== undefined && { rowLevelSecurity: options.rowLevelSecurity }),
         ...(options.clientEntries !== undefined && { clientEntries: options.clientEntries }),
         ...(options.hostDispatch !== undefined && { hostDispatch: options.hostDispatch }),
         ...(options.resolvePageHead !== undefined && { resolvePageHead: options.resolvePageHead }),

package/dist/run-dev-app.d.ts

@@ -1,7 +1,8 @@
 import type { SeedAdminOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import type { PostAuthLandingResolver } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import { type FeatureDefinition, type Registry, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
+import type { RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
+import { type BundledListsOptions, type FeatureDefinition, type Registry, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { ComposedEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import type { ErrorDocsConfig } from "@cosmicdrift/kumiko-framework/errors";
 import type { EnvelopeCipher, MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
@@ -11,7 +12,7 @@ import type { TestStack } from "@cosmicdrift/kumiko-testing/stack";
 import { type CreateKumikoServerOptions, type KumikoServerHandle } from "./create-kumiko-server.ts";
 export type { AccountLockoutSetup, AccountUnlockSetup, AuthMailOptions, EmailVerificationSetup, InviteSetup, PasswordResetSetup, SignupSetup, } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 import type { AccountLockoutSetup, AccountUnlockSetup, AuthMailOptions, EmailVerificationSetup, InviteSetup, PasswordResetSetup, SignupSetup } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
-import { type UnsubscribeOption } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
+import { type ConfigOverridesInput, type UnsubscribeOption } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 export type RunDevAppAuthOptions = {
     /** Admin user to seed at boot. Idempotent — re-runs in persistent-DB
      *  mode reuse the existing user. */
@@ -78,6 +79,8 @@ export type RunDevAppOptions = {
     readonly features: readonly FeatureDefinition[];
     /** Opt-in boot-validator warnings — see ValidateBootOptions. */
     readonly validateBootOptions?: ValidateBootOptions;
+    /** One table block for every list of the bundled features, see ComposeFeaturesOptions.bundledLists. */
+    readonly bundledLists?: BundledListsOptions;
     /** Browser entry module, bundled to /client.js. Mutually exclusive with
      *  `clientEntries`. */
     readonly clientEntry?: string;
@@ -124,7 +127,9 @@ export type RunDevAppOptions = {
      *  no locale signal. Merged into AppContext before extraContext (app wins). */
     readonly defaultLocale?: string;
     readonly extraContext?: CreateKumikoServerOptions["extraContext"];
-    /** MasterKeyProvider for the automatically wired `ctx.secrets`. Defaults to
+    /** App-level config values, same semantics and merge as RunProdAppOptions["appOverrides"]. */
+    readonly appOverrides?: ConfigOverridesInput;
+    /** MasterKeyProvider for the automatically wired `ctx.services.secrets`. Defaults to
      *  `createEnvMasterKeyProvider`; override it for KMS backends. Only relevant
      *  when the secrets feature is mounted. Symmetric with runProdApp. */
     readonly masterKey?: MasterKeyProvider;
@@ -149,7 +154,7 @@ export type RunDevAppOptions = {
      *  role in `access.roles`. */
     readonly anonymousAccess?: CreateKumikoServerOptions["anonymousAccess"];
     /** File-Storage-Provider — aktiviert die Upload-Routes (/api/files) +
-     *  `ctx.files`. Demos: `{ storageProvider: createInMemoryFileProvider() }`. */
+     *  `ctx.services.files`. Demos: `{ storageProvider: createInMemoryFileProvider() }`. */
     readonly files?: CreateKumikoServerOptions["files"];
     /** App-defined HTTP routes, such as /feed.xml and /sitemap.xml. They are
      *  attached to the Hono app before the static-asset path. Symmetric with the
@@ -198,6 +203,8 @@ export type RunDevAppOptions = {
     readonly trustedProxyHops?: number;
     /** Links the app's own error reasons to its own docs (`docsUrl` in error responses); framework reasons keep the framework docs link. */
     readonly errorDocs?: ErrorDocsConfig;
+    /** Row level security of the dev stack, as in prod. Default "on", so tenant-isolation bugs show up in development. */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
 };
 export declare function runDevApp(options: RunDevAppOptions): Promise<KumikoServerHandle>;
-export declare function mergeConfigResolverDefault(ctx: CreateKumikoServerOptions["extraContext"], registry: Registry, envSource: Record<string, string | undefined>, cipher?: EnvelopeCipher): CreateKumikoServerOptions["extraContext"];
+export declare function mergeConfigResolverDefault(ctx: CreateKumikoServerOptions["extraContext"], registry: Registry, envSource: Record<string, string | undefined>, cipher?: EnvelopeCipher, appOverrides?: ConfigOverridesInput): CreateKumikoServerOptions["extraContext"];

package/dist/run-dev-app.js

@@ -11,7 +11,7 @@
 // For maximum control, such as custom auth wiring, a different membership
 // query, or a custom LoginRateLimiter, use `createKumikoServer` directly from
 // @cosmicdrift/kumiko-dev-server.
-import { buildEnvConfigOverrides, createConfigResolver, } from "@cosmicdrift/kumiko-bundled-features/config";
+import { createConfigResolver } from "@cosmicdrift/kumiko-bundled-features/config";
 import { parseTrustedProxyHopsEnv, TRUSTED_PROXY_HOPS_ENV, } from "@cosmicdrift/kumiko-framework/api";
 import { findTierResolverUsage, } from "@cosmicdrift/kumiko-framework/engine";
 import { createKumikoServer, } from "./create-kumiko-server.js";
@@ -19,7 +19,7 @@ import { createDevLateBindings, createLateBoundEffectiveFeatures, runDevAfterSet
 import { configureDevBootCrypto, resolveDevAuthRegistry, resolveDevBootConfig, validateDevBoot, } from "./run-dev-app-config.js";
 import { buildDevServerOptions } from "./run-dev-app-server-options.js";
 import { renderWelcomeBanner } from "./welcome-banner.js";
-import { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
+import { addConfigAccessorFactory, buildBootExtraContext, buildConfigOverrides, loggerFromExtraContext, } from "@cosmicdrift/kumiko-server-runtime/run-prod-app";
 export async function runDevApp(options) {
     const bootFailure = { release: undefined };
     try {
@@ -105,7 +105,7 @@ function renderDevWelcomeBanner(options, config, handle) {
 function buildDevExtraContext(options, config, registry, bootCrypto) {
     const { features, envSource, unsubscribeLinks } = config;
     const cfgExtra = registry
-        ? mergeConfigResolverDefault(options.extraContext, registry, envSource, bootCrypto.configCipher)
+        ? mergeConfigResolverDefault(options.extraContext, registry, envSource, bootCrypto.configCipher, options.appOverrides)
         : options.extraContext;
     return (deps) => {
         const base = typeof cfgExtra === "function" ? cfgExtra(deps) : (cfgExtra ?? {});
@@ -133,10 +133,10 @@ function buildDevExtraContext(options, config, registry, bootCrypto) {
 // pins that the dev configResolver-default carries the ENV→app-override bridge
 // and that a caller-supplied configResolver still overrides it. Not re-exported
 // from the package barrel (index.ts lists only runDevApp).
-export function mergeConfigResolverDefault(ctx, registry, envSource, cipher) {
+export function mergeConfigResolverDefault(ctx, registry, envSource, cipher, appOverrides) {
     const defaults = {
         configResolver: createConfigResolver({
-            appOverrides: buildEnvConfigOverrides(registry, envSource),
+            appOverrides: buildConfigOverrides(registry, envSource, appOverrides),
             ...(cipher && { cipher }),
         }),
     };

package/dist/scaffold-app.d.ts

@@ -27,7 +27,8 @@ export type ScaffoldAppOptions = {
      *  (the CLI's ctx.cwd) MUST pass it so the scaffold lands where the
      *  command's output claims it does. */
     readonly cwd?: string;
-    /** npm-version-pin for @cosmicdrift/* deps. Default "*" for latest. */
+    /** Exact version pin for @cosmicdrift/* deps. Default: the running framework version
+     *  (resolveFrameworkVersion); scaffoldApp throws when that cannot be resolved. */
     readonly frameworkVersion?: string;
     /** Bundled-features to mount in run-config.ts. Default: secrets + auth-foundation + sessions
      *  (the historical foundation). create-kumiko-app passes the picker output

package/dist/scaffold-app.js

@@ -21,7 +21,10 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { APP_CONFIG_FILE } from "@cosmicdrift/kumiko-framework/config";
 import { collectTableMetas, generateMigration, writeSnapshotJson, } from "@cosmicdrift/kumiko-framework/db";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
+import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
+import { resolveFrameworkVersion } from "./framework-version.js";
 import { isKebabSegment } from "./kebab.js";
 import { CURRENT_INFRA_REF, PREPARE_SCRIPT, resolveManagedAppFacts, syncManagedFiles, } from "./managed-files/index.js";
 import { renderAgentsMd, renderClaudeMd, renderMountedFeatureList } from "./scaffold-agent-docs.js";
@@ -45,7 +48,10 @@ export async function scaffoldApp(options) {
     if (existsSync(destination)) {
         throw new Error(`scaffoldApp: ${destination} already exists — refusing to overwrite`);
     }
-    const version = options.frameworkVersion ?? "*";
+    const version = options.frameworkVersion ?? resolveFrameworkVersion();
+    if (version === undefined) {
+        throw new Error("scaffoldApp: cannot resolve the framework version; pass frameworkVersion explicitly");
+    }
     const testSetup = options.testSetup?.({ appName: options.name, frameworkVersion: version });
     mkdirSync(join(destination, "bin"), { recursive: true });
     mkdirSync(join(destination, "src"), { recursive: true });
@@ -84,6 +90,9 @@ export async function scaffoldApp(options) {
     files.push("src/client.tsx");
     write(join(destination, "src", "styles.css"), renderStylesCss());
     files.push("src/styles.css");
+    mkdirSync(join(destination, "public"), { recursive: true });
+    write(join(destination, "public", "index.html"), renderIndexHtml(options.name));
+    files.push("public/index.html");
     write(join(destination, ".env.example"), renderEnvExample(options.name));
     files.push(".env.example");
     write(join(destination, "docker-compose.yml"), renderDockerCompose());
@@ -161,7 +170,7 @@ function renderPackageJson(name, version, testSetup, infraRef) {
             "@tailwindcss/cli": "^4.3.0",
             "@types/react": "^19.2.0",
             "@types/react-dom": "^19.2.0",
-            "bun-types": "^1.4.0",
+            "bun-types": "^1.4.4",
             tailwindcss: "^4.3.0",
             typescript: "^6.0.3",
             ...testSetup?.devDependencies,
@@ -388,6 +397,7 @@ const kmsWiring =
 await runProdApp({
   features: APP_FEATURES,
   ...(appConfig.validateBootOptions && { validateBootOptions: appConfig.validateBootOptions }),
+  ...(appConfig.rowLevelSecurity && { rowLevelSecurity: appConfig.rowLevelSecurity }),
   envSchema,
   staticDir: "./dist",
   ...kmsWiring,
@@ -404,12 +414,9 @@ function renderServer(appName) {
         { specifier: "../kumiko.config", names: [], defaultName: "appConfig" },
         { specifier: "../src/seed", names: ["seedDemoTasks"] },
     ]);
-    // Dev-only emailVerified skips the login verify gate for the seeded admin;
-    // prod's bin/main.ts leaves it unset because the verify flow must run there.
     const authBlock = renderAdminAuthBlock(appName, [
         'password: "changeme",',
         'displayName: "Admin",',
-        "emailVerified: true,",
     ]);
     return `// Dev bootstrap. \`bun --watch bin/server.ts\` (see package.json scripts.dev)
 // starts a full-featured dev server with auto-reload on code changes.
@@ -552,6 +559,8 @@ services:
     # Pinned to the project's own compose-file tag (663/1) — Alpine variant
     # (~90MB vs ~400MB) and a reproducible patch version, bump on PG18 minors.
     image: postgres:18.3-alpine
+    # Bun.SQL dials its whole pool eagerly; the default of 100 is too tight for app + tests.
+    command: postgres -c max_connections=300
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
@@ -660,6 +669,23 @@ Files whose first line reads \`kumiko-managed\` (deploy/, .github/workflows/,
 For full docs see https://docs.kumiko.rocks.
 `;
 }
+// No inline script: CSP is script-src 'self'.
+function renderIndexHtml(appName) {
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width,initial-scale=1,interactive-widget=resizes-content" />
+    <title>${escapeHtml(appName)}</title>
+    <link rel="stylesheet" href="/styles.css" />
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/client.js"></script>
+  </body>
+</html>
+`;
+}
 function renderStylesCss() {
     return [
         '@import "@cosmicdrift/kumiko-renderer/web/styles.css";',
@@ -688,21 +714,22 @@ function renderBinKumiko() {
         "// consumer status|restart <name>` to recover a dead event consumer without",
         "// ad-hoc SQL. kumiko-build bundles this file to dist-server/kumiko.js.",
         "",
-        'import { allAppFeatures } from "@cosmicdrift/kumiko-framework/config";',
         'import { runConsumerCli } from "@cosmicdrift/kumiko-framework/consumer-cli";',
         'import { kmsSlotsOf } from "@cosmicdrift/kumiko-framework/env";',
         'import { runSchemaCli } from "@cosmicdrift/kumiko-framework/schema-cli";',
-        'import appConfig from "../kumiko.config";',
+        'import { FEATURES } from "../kumiko/schema";',
         'import { envSchema } from "./env-schema";',
         "",
         "const [, , cmd, ...rest] = Bun.argv;",
         "const out = { log: (l: string) => console.log(l), err: (l: string) => console.error(l) };",
         "",
         'if (cmd === "schema") {',
-        "  const features = allAppFeatures(appConfig);",
         "  const kmsSlots = kmsSlotsOf(envSchema.schema);",
         "  process.exit(",
-        "    await runSchemaCli(rest, process.env.INIT_CWD ?? process.cwd(), out, { features, kmsSlots }),",
+        "    await runSchemaCli(rest, process.env.INIT_CWD ?? process.cwd(), out, {",
+        "      features: FEATURES,",
+        "      kmsSlots,",
+        "    }),",
         "  );",
         "}",
         "",
@@ -747,6 +774,7 @@ async function writeInitMigration(destination, features) {
     const metas = collectTableMetas(composed);
     const result = generateMigration({
         metas,
+        rowLevelSecurity: DEFAULT_ROW_LEVEL_SECURITY_MODE,
         prevSnapshot: null,
         name: "init",
         sequenceNumber: 1,

package/dist/scaffold-feature.js

@@ -12,7 +12,7 @@
 // scaffolding).
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { renderFeatureFile, } from "@cosmicdrift/kumiko-framework/engine";
+import { renderFeatureFile, } from "@cosmicdrift/kumiko-feature-ast";
 /**
  * Generate a starter feature workspace at `destination`. Throws when
  * the destination already exists — refuses to overwrite. The caller is

package/dist/schema-apply.d.ts

@@ -1,3 +1,4 @@
+import { type RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { type ComposeFeaturesOptions } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 export type SchemaApplyOptions = ComposeFeaturesOptions & {
@@ -6,6 +7,8 @@ export type SchemaApplyOptions = ComposeFeaturesOptions & {
     readonly features: readonly FeatureDefinition[];
     /** Default INIT_CWD ?? process.cwd(); migrations live under <appCwd>/kumiko/migrations. */
     readonly appCwd?: string;
+    /** Pass appConfig.rowLevelSecurity: on a role the policies bind, migrations and rebuilds only see rows through an "on" connection. Default "on". */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
 };
 export declare function runSchemaApply(opts: SchemaApplyOptions): Promise<number>;
 export declare function runStandaloneSchemaCli(opts: SchemaApplyOptions): Promise<never>;

package/dist/schema-apply.js

@@ -7,9 +7,10 @@
 // kumiko-build discovers the app bin via findRepoRoot() and bundles it.
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { createDbConnection, runMigrationsFromDir } from "@cosmicdrift/kumiko-framework/db";
+import { createDbConnection, runMigrationsFromDir, } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { queueRebuildsFromMarkers, reportPendingRebuildRun, runPendingRebuilds, } from "@cosmicdrift/kumiko-framework/migrations";
 import { createEventConsumerStateTable, createProjectionStateTable, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { composeFeatures, } from "@cosmicdrift/kumiko-server-runtime/compose-features";
@@ -25,7 +26,10 @@ export async function runSchemaApply(opts) {
         console.error(`\n  ${migrationsDir} is missing — kumiko/migrations/ must be part of the image.\n`);
         return 1;
     }
-    const { db, close } = createDbConnection({ url: dbUrl });
+    const { db, close } = createDbConnection({
+        url: dbUrl,
+        rowLevelSecurity: opts.rowLevelSecurity ?? DEFAULT_ROW_LEVEL_SECURITY_MODE,
+    });
     try {
         // Create infrastructure tables (event store + pipeline state) first; all are
         // tableExists-gated and idempotent: on an existing DB this is a no-op, while

package/dist/setup-test-stack-from-features.d.ts

@@ -5,6 +5,7 @@ export type TestStackPreset = "config" | "template-resolver";
 export type SetupTestStackFromFeaturesOptions = Omit<TestStackOptions, "features"> & {
     readonly includeBundled?: boolean;
     readonly authOptions?: ComposeFeaturesOptions["authOptions"];
+    readonly bundledLists?: ComposeFeaturesOptions["bundledLists"];
     readonly presets?: readonly TestStackPreset[];
 };
 export declare function mergeExtraContext(base: TestStackOptions["extraContext"], presets: readonly TestStackPreset[]): TestStackOptions["extraContext"];

package/dist/setup-test-stack-from-features.js

@@ -36,8 +36,12 @@ export function mergeExtraContext(base, presets) {
     };
 }
 export async function setupTestStackFromFeatures(appFeatures, options = {}) {
-    const { includeBundled = false, authOptions, presets = [], ...stackOptions } = options;
-    const features = composeFeatures(appFeatures, { includeBundled, authOptions });
+    const { includeBundled = false, authOptions, bundledLists, presets = [], ...stackOptions } = options;
+    const features = composeFeatures(appFeatures, {
+        includeBundled,
+        authOptions,
+        ...(bundledLists && { bundledLists }),
+    });
     const extraContext = mergeExtraContext(stackOptions.extraContext, presets);
     // Same run-logger wiring as prod, so jobs that declare tenantVisibleFailure
     // write their failure rows in tests too.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.388.0",
+  "version": "0.390.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,18 +77,24 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.388.0",
-    "@cosmicdrift/kumiko-framework": "0.388.0",
-    "@cosmicdrift/kumiko-renderer": "0.388.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
-    "@cosmicdrift/kumiko-guards": "0.388.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.388.0",
-    "@cosmicdrift/kumiko-testing": "0.388.0",
-    "@cosmicdrift/kumiko-types": "0.388.0",
-    "bun-types": "^1.3.13",
+    "@cosmicdrift/kumiko-bundled-features": "0.390.0",
+    "@cosmicdrift/kumiko-feature-ast": "0.390.0",
+    "@cosmicdrift/kumiko-framework": "0.390.0",
+    "@cosmicdrift/kumiko-renderer": "0.390.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.390.0",
+    "@cosmicdrift/kumiko-guards": "0.390.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.390.0",
+    "@cosmicdrift/kumiko-testing": "0.390.0",
+    "@cosmicdrift/kumiko-types": "0.390.0",
     "ts-morph": "^28.0.0",
     "zod": "^4.4.3"
   },
+  "peerDependencies": {
+    "bun-types": "^1.4.4"
+  },
+  "devDependencies": {
+    "bun-types": "^1.4.4"
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public",

package/src/changes.json

@@ -1,4 +1,61 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "The managed Dockerfile names the real k3s migration step",
+    "detail": "The comment above the migrations COPY in the managed Dockerfile pointed at a release.yml InitContainer that does not exist. It now names the migrate-db initContainer of the infra _app-deploy.yml, and migrate-step.sh for compose hosts. Only the comment changes; the next kumiko-upgrade shows it as a managed-file diff."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Scaffolded bin/kumiko.ts passes FEATURES from kumiko/schema",
+    "detail": "The scaffolded standalone CLI handed allAppFeatures(appConfig) to runSchemaCli, a raw list without the bundled foundation. It now imports FEATURES from kumiko/schema, which the Schema CLI Features guard requires. Existing apps are not touched."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "The dev server runs with row level security on",
+    "detail": "runDevApp and createKumikoServer default to rowLevelSecurity \"on\" and run the dev stack as kumiko_app. On boot against a persistent dev database, the stack creates the role and transfers ownership of the database and of the public schema's tables, views and sequences to kumiko_app. The database user in DATABASE_URL needs the right to create roles, which the superuser of a local Postgres has. Code that reads tenant tables through a raw connection without a scope sees no rows in development; the boot does not detect this. runSchemaApply takes rowLevelSecurity, and the managed kumiko/schema.ts exports ROW_LEVEL_SECURITY from appConfig; the managed file updates on the next sync.",
+    "migration": "Pass rowLevelSecurity: \"off\" to runDevApp while fixing code paths without tenant context; the dev database keeps kumiko_app as owner. A server entry written by an older scaffold passes appConfig.rowLevelSecurity to runProdApp by hand once the app turns row level security on. Manual migration, there is no codemod."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Scaffolded dev admin leaves emailVerified to the boot seed",
+    "detail": "The boot seed marks the operator-created admin and the seed shortcut accounts as email-verified, so the scaffolded `bin/server.ts` no longer sets `emailVerified: true` on its own. Self-registered users still go through the verify flow.",
+    "migration": "Optional. Existing apps can drop `emailVerified: true` from `auth.admin` in `bin/server.ts` and `bin/main.ts`; an explicit value still wins over the default."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Scaffolded apps pin Bun 1.4.4",
+    "detail": "The deploy Dockerfile template, the managed public CI workflow and the scaffolded bun-types range move from Bun 1.4.0 to 1.4.4, the minimum the Bun.SQL driver needs. The managed CI workflow updates on the next sync; the deploy Dockerfile is only written at scaffold time.",
+    "migration": "Raise BUN_VERSION in an existing deploy Dockerfile to 1.4.4 and bun-types to ^1.4.4 by hand."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Scaffolded docker-compose raises Postgres max_connections to 300",
+    "detail": "Bun.SQL dials its whole pool eagerly, so the default limit of 100 is too tight for an app plus its tests. Existing apps can add command postgres -c max_connections=300 to the postgres service."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Fresh scaffolds build with bun run build",
+    "detail": "create-kumiko-app now writes public/index.html with the /styles.css and /client.js placeholders. Without it kumiko-build stopped with a missing-template error, so the scaffolded Dockerfile could not build either."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Scaffolded apps get exact framework pins",
+    "detail": "resolveFrameworkVersion no longer prefixes ^ and scaffoldApp no longer falls back to \"*\", so a new app is green in kumiko check managed. Without a resolvable version and without an explicit frameworkVersion, scaffoldApp throws."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "migrate-step.sh leaves the managed file set",
+    "detail": "Managed apps run migrations as the k3s InitContainer from release.yml, so deploy/migrate-step.sh is neither scaffolded nor synced for them. Delete it if present. kumiko-init-deploy keeps generating it for compose self-hosting."
+  },
   {
     "version": "0.388.0",
     "type": "improvement",

package/templates/deploy/Dockerfile.template

@@ -11,7 +11,7 @@
 #
 # Build context: repository root (the full source tree is only used in the build stage).
 
-ARG BUN_VERSION=1.4.0
+ARG BUN_VERSION=1.4.4
 {{#hasPrivateGhPackages}}
 # Registry auth for @cosmicdriftgamestudio: CI passes the token as
 # NPM_AUTH_TOKEN via --build-arg. Multi-stage ARG scoping needs the
@@ -69,7 +69,8 @@ RUN bun install --production --frozen-lockfile
 # Client build (static assets) — served by runProdApp.staticDir.
 COPY --from=build --chown=app:app /app/dist ./dist
 
-# Checked-in SQL migrations for the pre-deploy `kumiko schema apply` step.
+# Checked-in SQL migrations for the pre-deploy `kumiko schema apply` step
+# (migrate-db initContainer of the infra _app-deploy.yml on k3s, or migrate-step.sh on compose hosts).
 # The shipped `kumiko-schema` bin reads `${INIT_CWD}/kumiko/migrations/*.sql`
 # (see ENV INIT_CWD=/app below). kumiko/schema.ts is NOT needed at runtime
 # (only generate reads it; apply is checksum-tracked SQL only).

package/templates/managed/ci-public.yml.template

@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.4.0"
+          bun-version: "1.4.4"
       - run: bun install --frozen-lockfile
       - run: bun run typecheck
       - run: bun run lint
@@ -81,7 +81,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.4.0"
+          bun-version: "1.4.4"
       - run: bun install --frozen-lockfile
       - name: Create test database
         env:

package/templates/managed/kumiko-schema.ts.template

@@ -22,9 +22,13 @@ const HAS_AUTH =
 
 export const FEATURES: readonly FeatureDefinition[] = composeFeatures([...CONFIGURED_FEATURES], {
   includeBundled: HAS_AUTH,
+  ...(appConfig.bundledLists && { bundledLists: appConfig.bundledLists }),
 });
 
 // `kumiko check` validates the boot with the options kumiko.config.ts declares.
 export const VALIDATE_BOOT_OPTIONS = appConfig.validateBootOptions;
 
+// Decides whether `generate` emits row-level-security policies and `apply` runs as a policy-enforced connection.
+export const ROW_LEVEL_SECURITY = appConfig.rowLevelSecurity;
+
 export const ENTITY_METAS: readonly EntityTableMeta[] = collectTableMetas(FEATURES);