@cosmicdrift/kumiko-dev-server 0.389.0 → 0.390.1

package/bin/kumiko-upgrade.ts

@@ -17,6 +17,8 @@ import { runUpgradeCli } from "@cosmicdrift/kumiko-framework/upgrade-cli";
 // biome-ignore lint/suspicious/noConsole: CLI output is the feature.
 const out = { log: (l: string) => console.log(l), err: (l: string) => console.error(l) };
 const appCwd = process.env["INIT_CWD"] ?? process.cwd();
-const code = await runUpgradeCli(process.argv.slice(2), appCwd, out);
+const code = await runUpgradeCli(process.argv.slice(2), appCwd, out, {
+  codemodResolveFrom: import.meta.dir,
+});
 // Let the event loop drain stdout (piped by guard-upgrade-state) before exit.
 process.exitCode = code;

package/dist/build-server-bundle.js

@@ -59,7 +59,8 @@ const hasBun = typeof Bun !== "undefined";
 // reference the package at runtime (no native binding, plain HTTP client,
 // but a real runtime import). A production crash in money-horse,
 // "Cannot find package 'meilisearch'", occurred because it used to be in
-// BUILD_ONLY_EXTERNALS instead.
+// BUILD_ONLY_EXTERNALS instead. Its version comes from the framework's
+// peerDependencies range.
 const RUNTIME_EXTERNALS = [
     "@node-rs/argon2",
     "sharp",
@@ -296,7 +297,8 @@ async function resolveRuntimeDepsVersions(cwd, repoRoot, packages) {
             continue;
         const raw = await readFile(path, "utf-8");
         const parsed = parseJsonOrThrow(raw, path);
-        Object.assign(allDeps, parsed.dependencies ?? {}, parsed.optionalDependencies ?? {});
+        // Peers first: a real dependency of the same source overrides a peer range.
+        Object.assign(allDeps, parsed.peerDependencies ?? {}, parsed.dependencies ?? {}, parsed.optionalDependencies ?? {});
     }
     // App package.json fills gaps only — pins extraRuntimeExternals without
     // overriding framework-native pins the app may also list.

package/dist/create-kumiko-server-stack.js

@@ -39,6 +39,7 @@ function buildDevStackOptions(options, dbMode) {
         ...(options.extraRoutes !== undefined && { extraRoutes: options.extraRoutes }),
         ...(options.trustedProxyHops !== undefined && { trustedProxyHops: options.trustedProxyHops }),
         ...(options.errorDocs && { errorDocs: options.errorDocs }),
+        ...(options.rowLevelSecurity !== undefined && { rowLevelSecurity: options.rowLevelSecurity }),
         // jobs.consumerLane unset = enqueuer-only; startDevJobRunners is the sole
         // consumer/cron-scheduler per lane, so runOnBoot/cron jobs don't
         // double-fire.
@@ -48,7 +49,7 @@ function buildDevStackOptions(options, dbMode) {
 export async function bootDevStack(options, dbMode) {
     logInfo(`[kumiko-server] booting Kumiko stack${dbMode.persistentDb ? ` — persistent DB "${dbMode.devDbName}"` : " — ephemeral test DB"}…`);
     const stack = await setupTestStack(buildDevStackOptions(options, dbMode));
-    await createEventsTable(stack.db);
+    await createEventsTable(stack.unscopedDb);
     await pushEntityProjectionTables(stack, stack.registry);
     // `extraRoutes` is already mounted by setupTestStack's buildServer();
     // `wire` is for co-running components that need the system-write
@@ -86,13 +87,13 @@ export async function startDevBackgroundRunners(stack, jobQueueNamePrefix) {
         registry: stack.registry,
         db: stack.db,
         // The stack's own AppContext, not a `{ db, registry }` literal: these
-        // runners consume the lanes, and a job reaching for ctx.files /
+        // runners consume the lanes, and a job reaching for ctx.services.files /
         // ctx.notify / ctx.config would otherwise die here while the very same
         // handler works on the request path.
         context: stack.context,
         redisUrl,
         // Same dispatcher the request path writes through — without this,
-        // ctx.write/ctx.writeAs/ctx.queryAs inside a dev-run job throw on their
+        // ctx.dispatch.write/ctx.dispatch.writeAs/ctx.dispatch.queryAs inside a dev-run job throw on their
         // first call.
         dispatcher: stack.dispatcher,
         // Must match setupTestStack's jobs.queueNamePrefix so enqueuer and

package/dist/create-kumiko-server.d.ts

@@ -1,5 +1,6 @@
 /// <reference types="bun-types" preserve="true" />
 import type { AuthRoutesConfig, ExtraRouteDefinition } from "@cosmicdrift/kumiko-framework/api";
+import { type RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import type { ErrorDocsConfig } from "@cosmicdrift/kumiko-framework/errors";
 import type { PageHeadResolver, PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
@@ -64,6 +65,8 @@ export type DevHostDispatch = (req: Request, deps: {
     readonly cspScriptHashes: readonly string[];
 }) => DevHostDispatchResult | Promise<DevHostDispatchResult>;
 export type CreateKumikoServerOptions = {
+    /** Row level security of the dev stack, as in prod. Default "on", so tenant-isolation bugs show up in development. */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
     /** Features whose entities, handlers, and screens get wired into the
      *  dev stack. Pass every feature the app is supposed to run. */
     readonly features: readonly FeatureDefinition[];
@@ -141,7 +144,7 @@ export type CreateKumikoServerOptions = {
     readonly anonymousAccess?: TestStackOptions["anonymousAccess"];
     /** File-storage provider forwarded to `setupTestStack`. When set, the
      *  stack mounts the upload routes (POST/GET/DELETE /api/files), exposes
-     *  `ctx.files`, and creates the `file_refs` table. Example:
+     *  `ctx.services.files`, and creates the `file_refs` table. Example:
      *  `{ storageProvider: createInMemoryFileProvider() }`. */
     readonly files?: TestStackOptions["files"];
     /** Feature-toggle resolver forwarded to `setupTestStack`. When set, the

package/dist/create-kumiko-server.js

@@ -14,6 +14,7 @@
 //
 // The companion prod entry will land at `@cosmicdrift/kumiko-framework/server`
 // with a different options shape (clientDist, auth config, db url).
+import { assertNoActiveRowLevelSecurityScope, } from "@cosmicdrift/kumiko-framework/db";
 import { buildAppSchema } from "@cosmicdrift/kumiko-framework/engine";
 import { buildBunServeOptions, resolveDerivedMaxRequestBodySize, } from "@cosmicdrift/kumiko-server-runtime/bun-serve-options";
 import { stripNoRouteMatchHeader } from "@cosmicdrift/kumiko-server-runtime/try-hono-first";
@@ -33,6 +34,7 @@ import { hasBun, logInfo } from "./dev-server-runtime.js";
 function startDevHttpServer(port, handleFetch, stack) {
     if (!hasBun)
         return undefined;
+    assertNoActiveRowLevelSecurityScope("dev server");
     return Bun.serve(buildBunServeOptions(port, handleFetch, resolveDerivedMaxRequestBodySize(stack.registry), {
         upgradeFetch: async (req, env) => stripNoRouteMatchHeader(await stack.app.fetch(req, env)),
     }));

package/dist/few-shot-corpus.d.ts

@@ -1,4 +1,4 @@
-import { type FeaturePattern, type ParseError } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeaturePattern, type ParseError } from "@cosmicdrift/kumiko-feature-ast";
 export type AuthoringStyle = "canonical" | "legacy";
 export type CorpusWarning = {
     /** Repo-relative path to the file that triggered the warning. */

package/dist/few-shot-corpus.js

@@ -31,7 +31,7 @@
 //   builder is permissive, and the Designer filters at read-time.
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
-import { PATTERN_LIBRARY, parseFeatureFile, } from "@cosmicdrift/kumiko-framework/engine";
+import { PATTERN_LIBRARY, parseFeatureFile, } from "@cosmicdrift/kumiko-feature-ast";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 // =============================================================================
 // Builder

package/dist/managed-files/registry.js

@@ -101,7 +101,7 @@ export function renderManagedTemplates(facts) {
     });
     return [
         ...deploy.files
-            // Managed apps migrate through the k3s release.yml InitContainer; migrate-step.sh is compose-only.
+            // Managed apps migrate through the migrate-db initContainer of the infra _app-deploy.yml; migrate-step.sh is compose-only.
             .filter((file) => file.output !== COMPOSE_ONLY_DEPLOY_FILE)
             .map((file) => marked(`deploy/${file.output}`, file.content, "#", file.output.endsWith(".sh"))),
         marked(".husky/pre-push", readTemplate("husky-pre-push.template"), "#", true),

package/dist/run-dev-app-server-options.js

@@ -3,6 +3,7 @@ function pickDevClientOptions(options) {
     return {
         ...(options.clientEntry !== undefined && { clientEntry: options.clientEntry }),
         ...(options.errorDocs && { errorDocs: options.errorDocs }),
+        ...(options.rowLevelSecurity !== undefined && { rowLevelSecurity: options.rowLevelSecurity }),
         ...(options.clientEntries !== undefined && { clientEntries: options.clientEntries }),
         ...(options.hostDispatch !== undefined && { hostDispatch: options.hostDispatch }),
         ...(options.resolvePageHead !== undefined && { resolvePageHead: options.resolvePageHead }),

package/dist/run-dev-app.d.ts

@@ -1,6 +1,7 @@
 import type { SeedAdminOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import type { PostAuthLandingResolver } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import type { RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
 import { type BundledListsOptions, type FeatureDefinition, type Registry, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { ComposedEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import type { ErrorDocsConfig } from "@cosmicdrift/kumiko-framework/errors";
@@ -128,7 +129,7 @@ export type RunDevAppOptions = {
     readonly extraContext?: CreateKumikoServerOptions["extraContext"];
     /** App-level config values, same semantics and merge as RunProdAppOptions["appOverrides"]. */
     readonly appOverrides?: ConfigOverridesInput;
-    /** MasterKeyProvider for the automatically wired `ctx.secrets`. Defaults to
+    /** MasterKeyProvider for the automatically wired `ctx.services.secrets`. Defaults to
      *  `createEnvMasterKeyProvider`; override it for KMS backends. Only relevant
      *  when the secrets feature is mounted. Symmetric with runProdApp. */
     readonly masterKey?: MasterKeyProvider;
@@ -153,7 +154,7 @@ export type RunDevAppOptions = {
      *  role in `access.roles`. */
     readonly anonymousAccess?: CreateKumikoServerOptions["anonymousAccess"];
     /** File-Storage-Provider — aktiviert die Upload-Routes (/api/files) +
-     *  `ctx.files`. Demos: `{ storageProvider: createInMemoryFileProvider() }`. */
+     *  `ctx.services.files`. Demos: `{ storageProvider: createInMemoryFileProvider() }`. */
     readonly files?: CreateKumikoServerOptions["files"];
     /** App-defined HTTP routes, such as /feed.xml and /sitemap.xml. They are
      *  attached to the Hono app before the static-asset path. Symmetric with the
@@ -202,6 +203,8 @@ export type RunDevAppOptions = {
     readonly trustedProxyHops?: number;
     /** Links the app's own error reasons to its own docs (`docsUrl` in error responses); framework reasons keep the framework docs link. */
     readonly errorDocs?: ErrorDocsConfig;
+    /** Row level security of the dev stack, as in prod. Default "on", so tenant-isolation bugs show up in development. */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
 };
 export declare function runDevApp(options: RunDevAppOptions): Promise<KumikoServerHandle>;
 export declare function mergeConfigResolverDefault(ctx: CreateKumikoServerOptions["extraContext"], registry: Registry, envSource: Record<string, string | undefined>, cipher?: EnvelopeCipher, appOverrides?: ConfigOverridesInput): CreateKumikoServerOptions["extraContext"];

package/dist/scaffold-app.js

@@ -21,6 +21,7 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { APP_CONFIG_FILE } from "@cosmicdrift/kumiko-framework/config";
 import { collectTableMetas, generateMigration, writeSnapshotJson, } from "@cosmicdrift/kumiko-framework/db";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import { resolveFrameworkVersion } from "./framework-version.js";
@@ -161,7 +162,7 @@ function renderPackageJson(name, version, testSetup, infraRef) {
             "@cosmicdrift/kumiko-server-runtime": version,
             react: "^19.2.6",
             "react-dom": "^19.2.6",
-            zod: "^4.4.3",
+            zod: "^4.6.7",
         },
         devDependencies: sortedByName({
             "@biomejs/biome": SCAFFOLD_BIOME_VERSION,
@@ -396,6 +397,7 @@ const kmsWiring =
 await runProdApp({
   features: APP_FEATURES,
   ...(appConfig.validateBootOptions && { validateBootOptions: appConfig.validateBootOptions }),
+  ...(appConfig.rowLevelSecurity && { rowLevelSecurity: appConfig.rowLevelSecurity }),
   envSchema,
   staticDir: "./dist",
   ...kmsWiring,
@@ -412,12 +414,9 @@ function renderServer(appName) {
         { specifier: "../kumiko.config", names: [], defaultName: "appConfig" },
         { specifier: "../src/seed", names: ["seedDemoTasks"] },
     ]);
-    // Dev-only emailVerified skips the login verify gate for the seeded admin;
-    // prod's bin/main.ts leaves it unset because the verify flow must run there.
     const authBlock = renderAdminAuthBlock(appName, [
         'password: "changeme",',
         'displayName: "Admin",',
-        "emailVerified: true,",
     ]);
     return `// Dev bootstrap. \`bun --watch bin/server.ts\` (see package.json scripts.dev)
 // starts a full-featured dev server with auto-reload on code changes.
@@ -715,10 +714,10 @@ function renderBinKumiko() {
         "// consumer status|restart <name>` to recover a dead event consumer without",
         "// ad-hoc SQL. kumiko-build bundles this file to dist-server/kumiko.js.",
         "",
-        'import { allAppFeatures } from "@cosmicdrift/kumiko-framework/config";',
         'import { runConsumerCli } from "@cosmicdrift/kumiko-framework/consumer-cli";',
         'import { kmsSlotsOf } from "@cosmicdrift/kumiko-framework/env";',
         'import { runSchemaCli } from "@cosmicdrift/kumiko-framework/schema-cli";',
+        'import { FEATURES } from "../kumiko/schema";',
         'import appConfig from "../kumiko.config";',
         'import { envSchema } from "./env-schema";',
         "",
@@ -726,10 +725,13 @@ function renderBinKumiko() {
         "const out = { log: (l: string) => console.log(l), err: (l: string) => console.error(l) };",
         "",
         'if (cmd === "schema") {',
-        "  const features = allAppFeatures(appConfig);",
         "  const kmsSlots = kmsSlotsOf(envSchema.schema);",
         "  process.exit(",
-        "    await runSchemaCli(rest, process.env.INIT_CWD ?? process.cwd(), out, { features, kmsSlots }),",
+        "    await runSchemaCli(rest, process.env.INIT_CWD ?? process.cwd(), out, {",
+        "      features: FEATURES,",
+        "      kmsSlots,",
+        "      ...(appConfig.rowLevelSecurity && { rowLevelSecurity: appConfig.rowLevelSecurity }),",
+        "    }),",
         "  );",
         "}",
         "",
@@ -774,6 +776,7 @@ async function writeInitMigration(destination, features) {
     const metas = collectTableMetas(composed);
     const result = generateMigration({
         metas,
+        rowLevelSecurity: DEFAULT_ROW_LEVEL_SECURITY_MODE,
         prevSnapshot: null,
         name: "init",
         sequenceNumber: 1,

package/dist/scaffold-feature.js

@@ -12,7 +12,7 @@
 // scaffolding).
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { renderFeatureFile, } from "@cosmicdrift/kumiko-framework/engine";
+import { renderFeatureFile, } from "@cosmicdrift/kumiko-feature-ast";
 /**
  * Generate a starter feature workspace at `destination`. Throws when
  * the destination already exists — refuses to overwrite. The caller is

package/dist/schema-apply.d.ts

@@ -1,3 +1,4 @@
+import { type RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { type ComposeFeaturesOptions } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 export type SchemaApplyOptions = ComposeFeaturesOptions & {
@@ -6,6 +7,8 @@ export type SchemaApplyOptions = ComposeFeaturesOptions & {
     readonly features: readonly FeatureDefinition[];
     /** Default INIT_CWD ?? process.cwd(); migrations live under <appCwd>/kumiko/migrations. */
     readonly appCwd?: string;
+    /** Pass appConfig.rowLevelSecurity: on a role the policies bind, migrations and rebuilds only see rows through an "on" connection. Default "on". */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
 };
 export declare function runSchemaApply(opts: SchemaApplyOptions): Promise<number>;
 export declare function runStandaloneSchemaCli(opts: SchemaApplyOptions): Promise<never>;

package/dist/schema-apply.js

@@ -7,9 +7,10 @@
 // kumiko-build discovers the app bin via findRepoRoot() and bundles it.
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { createDbConnection, runMigrationsFromDir } from "@cosmicdrift/kumiko-framework/db";
+import { createDbConnection, runMigrationsFromDir, } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { queueRebuildsFromMarkers, reportPendingRebuildRun, runPendingRebuilds, } from "@cosmicdrift/kumiko-framework/migrations";
 import { createEventConsumerStateTable, createProjectionStateTable, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { composeFeatures, } from "@cosmicdrift/kumiko-server-runtime/compose-features";
@@ -25,7 +26,10 @@ export async function runSchemaApply(opts) {
         console.error(`\n  ${migrationsDir} is missing — kumiko/migrations/ must be part of the image.\n`);
         return 1;
     }
-    const { db, close } = createDbConnection({ url: dbUrl });
+    const { db, close } = createDbConnection({
+        url: dbUrl,
+        rowLevelSecurity: opts.rowLevelSecurity ?? DEFAULT_ROW_LEVEL_SECURITY_MODE,
+    });
     try {
         // Create infrastructure tables (event store + pipeline state) first; all are
         // tableExists-gated and idempotent: on an existing DB this is a no-op, while

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.389.0",
+  "version": "0.390.1",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding. Its compose-stacks/env-schema subpaths are consumed at prod boot too — see @cosmicdrift/kumiko-server-runtime for the prod runner itself.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,16 +77,17 @@
     "kumiko-upgrade": "./bin/kumiko-upgrade.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.389.0",
-    "@cosmicdrift/kumiko-framework": "0.389.0",
-    "@cosmicdrift/kumiko-renderer": "0.389.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.389.0",
-    "@cosmicdrift/kumiko-guards": "0.389.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.389.0",
-    "@cosmicdrift/kumiko-testing": "0.389.0",
-    "@cosmicdrift/kumiko-types": "0.389.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.390.1",
+    "@cosmicdrift/kumiko-feature-ast": "0.390.1",
+    "@cosmicdrift/kumiko-framework": "0.390.1",
+    "@cosmicdrift/kumiko-renderer": "0.390.1",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.390.1",
+    "@cosmicdrift/kumiko-guards": "0.390.1",
+    "@cosmicdrift/kumiko-server-runtime": "0.390.1",
+    "@cosmicdrift/kumiko-testing": "0.390.1",
+    "@cosmicdrift/kumiko-types": "0.390.1",
     "ts-morph": "^28.0.0",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "peerDependencies": {
     "bun-types": "^1.4.4"

package/src/changes.json

@@ -1,4 +1,30 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "The managed Dockerfile names the real k3s migration step",
+    "detail": "The comment above the migrations COPY in the managed Dockerfile pointed at a release.yml InitContainer that does not exist. It now names the migrate-db initContainer of the infra _app-deploy.yml, and migrate-step.sh for compose hosts. Only the comment changes; the next kumiko-upgrade shows it as a managed-file diff."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Scaffolded bin/kumiko.ts passes FEATURES from kumiko/schema",
+    "detail": "The scaffolded standalone CLI handed allAppFeatures(appConfig) to runSchemaCli, a raw list without the bundled foundation. It now imports FEATURES from kumiko/schema, which the Schema CLI Features guard requires. Existing apps are not touched."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "The dev server runs with row level security on",
+    "detail": "runDevApp and createKumikoServer default to rowLevelSecurity \"on\" and run the dev stack as kumiko_app. On boot against a persistent dev database, the stack creates the role and transfers ownership of the database and of the public schema's tables, views and sequences to kumiko_app. The database user in DATABASE_URL needs the right to create roles, which the superuser of a local Postgres has. Code that reads tenant tables through a raw connection without a scope sees no rows in development; the boot does not detect this. runSchemaApply takes rowLevelSecurity, and the managed kumiko/schema.ts exports ROW_LEVEL_SECURITY from appConfig; the managed file updates on the next sync.",
+    "migration": "Pass rowLevelSecurity: \"off\" to runDevApp while fixing code paths without tenant context; the dev database keeps kumiko_app as owner. A server entry written by an older scaffold passes appConfig.rowLevelSecurity to runProdApp by hand once the app turns row level security on. Manual migration, there is no codemod."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Scaffolded dev admin leaves emailVerified to the boot seed",
+    "detail": "The boot seed marks the operator-created admin and the seed shortcut accounts as email-verified, so the scaffolded `bin/server.ts` no longer sets `emailVerified: true` on its own. Self-registered users still go through the verify flow.",
+    "migration": "Optional. Existing apps can drop `emailVerified: true` from `auth.admin` in `bin/server.ts` and `bin/main.ts`; an explicit value still wins over the default."
+  },
   {
     "version": "0.389.0",
     "type": "improvement",

package/templates/deploy/Dockerfile.template

@@ -70,7 +70,7 @@ RUN bun install --production --frozen-lockfile
 COPY --from=build --chown=app:app /app/dist ./dist
 
 # Checked-in SQL migrations for the pre-deploy `kumiko schema apply` step
-# (k3s InitContainer from release.yml, or migrate-step.sh on compose hosts).
+# (migrate-db initContainer of the infra _app-deploy.yml on k3s, or migrate-step.sh on compose hosts).
 # The shipped `kumiko-schema` bin reads `${INIT_CWD}/kumiko/migrations/*.sql`
 # (see ENV INIT_CWD=/app below). kumiko/schema.ts is NOT needed at runtime
 # (only generate reads it; apply is checksum-tracked SQL only).

package/templates/managed/kumiko-schema.ts.template

@@ -28,4 +28,7 @@ export const FEATURES: readonly FeatureDefinition[] = composeFeatures([...CONFIG
 // `kumiko check` validates the boot with the options kumiko.config.ts declares.
 export const VALIDATE_BOOT_OPTIONS = appConfig.validateBootOptions;
 
+// Decides whether `generate` emits row-level-security policies and `apply` runs as a policy-enforced connection.
+export const ROW_LEVEL_SECURITY = appConfig.rowLevelSecurity;
+
 export const ENTITY_METAS: readonly EntityTableMeta[] = collectTableMetas(FEATURES);