@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/src/changes.json

@@ -1,4 +1,455 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Parallel writes in one handler no longer abort the transaction",
+    "detail": "Bun.SQL does not serialize savepoints on a transaction. A handler that started several executor writes on ctx.db with Promise.all opened overlapping savepoints, the first RELEASE also released its neighbours, and the next one aborted the whole transaction with a 500. runInSavepoint and runInSavepointIfSupported now queue savepoints per transaction (proxy runners over the same transaction share one queue, savepoints opened from inside a running one still nest), and an executor verb on a handler transaction now runs in its own savepoint: when it fails, its event append, projection and hooks roll back together, also when the handler catches the failure, so no event without projection is left behind and a rebuild replays cleanly. Postgres errors 22007 and 22008 (a date or time value the column rejects, such as 2026-02-30) now map to a 400 validation_error instead of a 500, on writes and on query filters."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "HandlerContext without wiring, hooks receive the HandlerContext",
+    "detail": "HandlerContext has 19 members and no longer carries the AppContext wiring. ctx.services holds redis, cacheSync, jobRunner, searchAdapter, entityCache, secrets, kms, files, derivatives, configResolver, configEncryption, rateLimit, effectiveFeatures and masterKeyProvider; every key of an app's extraContext that the framework does not know now lives in ctx.services.extensions (it used to sit flat on the context through a spread, invisible to tsc). ctx.lifecycle holds afterCommit and afterRollback (replacing scheduleAfterCommit and scheduleAfterRollback), signal and runPreSave. ctx.tenants holds config (replacing configFor) and writeTarget (replacing forTenant). ctx.obs gains meter, and the flat log, tracer, _tenantId, systemUser and triggeredBy are gone; read ctx.user.tenantId and ctx.obs.log. JobContext no longer extends the shared wiring fields; it gets services and lifecycle.signal and keeps systemUser, triggeredBy and its job fields. All hooks (preSave, postSave, postSaveBatch, preDelete, postDelete, postDeleteBatch, preQuery, postQuery) and the system hook definitions receive the HandlerContext instead of the AppContext, and the batch hooks run on a real handler context built per flush. AppContext stays the flat boot wiring and declares services as never, so a handler or job context can no longer be passed to a function that takes an AppContext. The context of beforeTransaction no longer exposes ctx.systemDb.outsideTransaction, which was a hole next to the denied ctx.db.outsideTransaction. The member-resolution and pre-transaction contexts also drop the notify factories from ctx.services, and member resolution drops _fileProviderResolver, so neither can rebuild the denied notify or file storage. Helpers that took a structural context with an optional flat member read undefined once a handler context stopped carrying it; their shapes now make that a type error: requireSecretsContext, FileProviderContext (createFileProviderForTenant) and MailTransportContext (createTransportForTenant) take a required secrets key (handlers pass { secrets: ctx.services.secrets, user: ctx.user }), and CreateFileRefContext/UploadFileBytesContext read services.files, so a handler or job context passes straight in. bridgeStub accepts a services option.",
+    "migration": "Run kumiko-upgrade --apply; it runs the ctx-namespaces codemod. It rewrites ctx.redis, cacheSync, jobRunner, searchAdapter, entityCache, secrets, kms, files, derivatives, configResolver, effectiveFeatures and the other service members to ctx.services.*, scheduleAfterCommit and scheduleAfterRollback to ctx.lifecycle.afterCommit and afterRollback, signal to ctx.lifecycle.signal, configFor and forTenant to ctx.tenants.config and writeTarget, and hook parameters annotated AppContext to HandlerContext, including context.log to context.obs.log in the hook body. Keys of your extraContext that you read through a cast move to ctx.services.extensions. Listed for manual review: ctx.systemUser, ctx.triggeredBy and ctx._tenantId on a HandlerContext (read ctx.user), a handler or job context passed to a function that takes an AppContext (narrow that parameter to the members it reads), spread literals next to moved members, and a handler or job context passed to a parameter whose structural type reads a moved member (it would read undefined without a type error). Hand-built test contexts take services, lifecycle and tenants from bridgeStub({ services }).",
+    "codemod": "scripts/codemod/ctx-namespaces.ts"
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "HandlerContext and JobContext use namespaces instead of flat members",
+    "detail": "The roughly 40 flat members of HandlerContext are grouped by purpose, with no deprecated aliases. ctx.db.outsideTransaction replaces ctx.dbOutsideTransaction and ctx.outsideTransaction (the property is non-enumerable and sits on the same db object, so TenantDb identity stays intact; it is undefined in the member-resolution and before-transaction phases and in platform-metering tenant mode). ctx.events holds append, unsafeAppend, tryAppend, fetchForWriting, load, archive, restore, isArchived, snapshot and loadWithSnapshot. ctx.dispatch holds query, queryAs, write, writeAs, queryAsMember and queryProjection. ctx.auth holds resolveClaims and resolveActiveMembership. ctx.obs holds log, tracer, metrics and metricsFor, and ctx.obs.log is now always a Logger. JobContext gets the subsets events.append, dispatch.write/writeAs/queryAs/queryAsMember and obs.log/metricsFor. reserveBeforeTransaction and beforeTransaction receive the new ReservationContext and BeforeTransactionContext types, so the surfaces they deny no longer exist on the type. The deprecated _configAccessorFactory alias is removed; use configAccessorFactory. The cap-counter resolvers and the template-resolver PrepareContext now take ReservationContext instead of HandlerContext (type-level break for callers passing a full HandlerContext-typed value to a narrower position, and for wrappers declaring the old type). attachOutsideTransaction(db, outsideDb) from @cosmicdrift/kumiko-framework/engine gives hand-built contexts a db.outsideTransaction; it mutates the passed db with a non-enumerable property (Object.defineProperty) and returns the same object. bridgeStub now accepts log and dispatch options. AppContext stays flat, and the context handed to postSave, preDelete, postDelete and postQuery hooks still reads context.log; a separate hook context follows in a later release.",
+    "migration": "Run kumiko-upgrade --apply; it runs the ctx-namespaces codemod. It rewrites ctx.dbOutsideTransaction and ctx.outsideTransaction to ctx.db.outsideTransaction, ctx.appendEvent/unsafeAppendEvent/tryAppendEvent/fetchForWriting/loadAggregate/archiveStream/restoreStream/isStreamArchived/snapshotAggregate/loadAggregateWithSnapshot to ctx.events.append/unsafeAppend/tryAppend/fetchForWriting/load/archive/restore/isArchived/snapshot/loadWithSnapshot, ctx.query/queryAs/write/writeAs/queryAsMember/queryProjection to ctx.dispatch.*, ctx.resolveAuthClaims/resolveActiveMembership to ctx.auth.resolveClaims/resolveActiveMembership, and ctx.log/tracer/metrics/metricsFor to ctx.obs.*. Object literals typed as HandlerContext or JobContext (test mocks) are nested the same way. Sites the codemod cannot resolve are listed for manual review: spread literals, untyped receivers, and AppContext reads such as context.log in hooks, which stay as they are. Manual pattern { db: someDb, dbOutsideTransaction: x } becomes db: attachOutsideTransaction(someDb, x). Spread calls such as ...bridgeStub() next to moved members are reworked by hand; pass log/dispatch as bridgeStub options. Rename _configAccessorFactory to configAccessorFactory where you set it on an AppContext.",
+    "codemod": "scripts/codemod/ctx-namespaces.ts"
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "Feature AST, pattern library and codemods moved to @cosmicdrift/kumiko-feature-ast",
+    "detail": "Feature AST, pattern library and codemods moved to the new package @cosmicdrift/kumiko-feature-ast; kumiko-upgrade heals stale open lines in CHANGELOG.md",
+    "migration": "Import these names from @cosmicdrift/kumiko-feature-ast instead of @cosmicdrift/kumiko-framework/engine: AddEntityArgs, AddHookArgs, AddRelationArgs, AddWriteHandlerArgs, FeaturePatcher, FeaturePattern, FeaturePatternKind, FormFieldLabel, FormFieldSpec, FormInputType, HandlerHeaderUpdate, ParseError, ParseResult, PatternCategory, PatternChange, PatternChangeIssue, PatternChangesParseResult, PatternFormSchema, PatternId, RenderFeatureFileInput, SourceLocation, PATTERN_LIBRARY, VERSION_HEADER, addPattern, applyChanges, createFeaturePatcher, getPatternSchema, groupByCategory, parseFeatureFile, parsePatternChanges, parseSourceFile, removePattern, renderFeatureFile, renderPattern, replacePattern, updatePattern. Import CodemodOptions, CodemodReport, CodemodResult, FileAnalysis, ParsedHandlerInfo, analyzeFile, analyzeHandlerArrow, convertFile, generatePerformBlock, runCodemod, scanForCandidates from @cosmicdrift/kumiko-feature-ast/codemod instead of @cosmicdrift/kumiko-framework/engine/codemod. Add @cosmicdrift/kumiko-feature-ast to the dependencies of the importing package; the codemod does both. @cosmicdrift/kumiko-framework no longer installs ts-morph.",
+    "codemod": "scripts/codemod/feature-ast-package.ts"
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "kumiko-upgrade --apply and --resolve heal stale open lines in CHANGELOG.md",
+    "migration": "Every manual migration the upgrade marker lists as resolved gets its status in CHANGELOG.md, including `- [open]` lines in older sections left behind by a resolve with an older CLI."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "allAppFeatures documents that its list is raw",
+    "detail": "The JSDoc of allAppFeatures says the list has no bundled foundation and that tooling such as runSchemaCli takes FEATURES from kumiko/schema. Behavior is unchanged."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "Jobs append their own events with ctx.events.append",
+    "detail": "Jobs no longer need escapeHatch or unsafeRaw plus the low-level event-store API to append their own feature's events. The same ownership and schema rules apply as in write handlers, and the append runs in its own transaction together with the inline projections.",
+    "migration": "JobContext has a new required field events.append. Code that builds a JobContext object by hand (boot seeds, test fixtures) and does not spread bridgeStub() adds an events.append that throws when the code under test never appends. Jobs that appended their own feature's events through escapeHatch or unsafeRaw switch to ctx.events.append({ type, aggregateId, aggregateType, payload })."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "Jobs see whether they can still defer (ctx.canDefer)",
+    "detail": "ctx.canDefer is false when the run is inline or the maxDefers budget is used up, so a handler can write its terminal state instead of deferring into an UnrecoverableError. Behaviour of ctx.defer and the maxDefers failure is unchanged.",
+    "migration": "JobContext has a new required field canDefer. Code that builds a JobContext object by hand (boot seeds, test fixtures) adds `canDefer: false` unless the context really supports ctx.defer. Contexts built by the job runner or cast with `as unknown as JobContext` need no change."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "meilisearch is an optional peer dependency",
+    "migration": "Apps that import @cosmicdrift/kumiko-framework/search/meilisearch add meilisearch to their own dependencies (bun add meilisearch@^0.58.0); without it that import fails at boot with a message that names the package. Apps without the Meilisearch adapter need nothing."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "Framework subpaths no longer export names without a user",
+    "detail": "A name stays exported from a subpath of @cosmicdrift/kumiko-framework only if at least one consumer outside packages/framework imports it from that subpath (other Kumiko packages, samples, the framework docs, kumiko-enterprise, kumiko-platform, kumiko-studio and the seven apps). Names added since 0.389.0 stay public. 1236 names had no user and are removed from their subpath; 30 of them are deleted together with their code and tests, the rest stay inside the framework as internal modules without a public export. The public-exports baseline keeps the new, smaller surface. Removed names per subpath:\n./compliance: AuthorityNotificationDeadline, BundleTier, OVERRIDABLE_PROFILE_KEYS, RetentionSpec, UserNotificationRequiredPolicy, describeDurationSpec, durationSpecToMs\n./config: AppClientConfig, AppPortEntry\n./es-ops: CreateSeedMigrationContextArgs, EsOperationAppliedBy, EsOperationType, RunPendingSeedMigrationsArgs, RunPendingSeedMigrationsResult, SeedMembershipRow, SeedTemplateResourceFilter, SeedTemplateResourceRow, SeedTenantRow, SeedUserRow\n./engine: ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, App, AppConfig, AppendEventArgs, AppendEventFn, AssignableFromRole, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BuildAppSchemaOptions, BuildManifestOptions, BuiltinQnType, CamelToKebab, CardMetaOverflow, ChangelogType, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClampInfo, ConcurrencyMode, ConcurrencyModes, ConfigBacking, ConfigDefinition, ConfigFeatureSchema, ConfigKeyAccess, ConfigMask, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, CreateEventDefOptions, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCurrencyFormat, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EXTENSION_SELECTOR_HINT_KEY, EditExtensionSection, EditFieldPrefill, EditFieldsSection, EditLayout, EmbeddedListEditSpec, EmitCtx, EntityCrudRegistrar, EntityEditAction, EntityEditActionPlacement, EntityListExpandableRow, EntityObjectDefinition, EntityRef, EntityRelations, EscapeHatchReporter, EscapeHatchTarget, ExpandableRowGrouping, FeatureChangelog, FieldAccess, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormDerivationScreen, FormWidth, FormatSpec, HANDLER_FIELD_REFERENCES_META_KEY, HandlerFieldPathSegment, HandlerFieldReference, HandlerFieldReferenceAtPath, HandlerFieldReferenceMeta, HasManyRelation, HookDefinition, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobTriggerEvent, KumikoEntityTypeMap, KumikoExtensionName, KumikoHandlerPayloadMap, KumikoHandlerResultMap, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MessageKind, MetricSpec, MspErrorPolicy, MultiSelectFieldDef, NameOrRef, NotificationDataFn, NotificationRecipientFn, NotificationTemplateFn, NotifyDeferred, NumberFieldDef, OnDeleteStrategies, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, OwnershipClause, OwnershipRef, OwnershipRule, PagedListRequest, PagedListRowValue, ParentRefDef, ParsedQn, ParsedRefTarget, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PipelineBuildCtx, PipelineDef, PlatformComponent, PluralForms, PreQueryHookFn, PreparedWriteEvent, ProjectionTable, QnType, QualifiedEventName, QueryHandlerFn, RecordHeaderSpec, RecordHeaderSubtitlePart, RegisterEntityCrudOptions, ResolveOptions, RowActionNavigate, RowActionNavigateBase, RowFieldExtractor, SETTINGS_HUB_WORKSPACE, SUSPEND_SENTINEL, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUserOrigin, StackBootRequirement, StepBuilder, StepDef, StepFailureStrategy, StepKind, StepListOutcome, StepNamespace, StorageProviderExtensionHooks, StreamHandlerDefinition, StreamHandlerFn, Subscribe, SystemHookName, SystemHookNames, SystemHookPriorities, TENANT_TEARDOWN_STATUSES, TemplateImagesVariableDef, TenantDataExtensionHooks, TenantResourceExtensionHooks, TextFieldDef, TranslationValue, TranslationsDef, TreeActionsHandle, TreeNodeState, UnavailableSelectOption, UnsafeAppendEventFn, UserDataExtensionHooks, UserDataExtensionOptions, WorkflowInput, WorkflowTrigger, applyFormDerivations, availableSelectOptions, buildOwnershipClause, buildTarget, checkWriteFieldOwnership, checkWriteFieldRoles, combineClauses, createApp, createEventDef, createUserSeed, findUnavailableSelectOptions, formDerivationsOfSchema, handlerFieldReferences, isExtensionEditSection, isForbiddenMembershipRole, isFormDerivationInputMode, isPagedQueryHandler, isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, isWriteFormEditSection, listStepKinds, qualifyTranslationKey, readHandlerFieldReferences, resolveConfigOrParam, resolveName, runValidation, runsInLane, sortEntries, stripForbiddenMembershipRoles, tenantOverrideDenied, userCanCreateFieldRow, userCanReadFieldRow, userCanWriteFieldRow, validateChangelog\n./engine/types: AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AnyFileFieldDef, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BootCheckContext, BootCheckFn, BootOptionName, BundledListsOptions, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ClientDerivedFieldDef, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigBounds, ConfigCascade, ConfigCascadeLevel, ConfigComputedContext, ConfigComputedFn, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DEFAULT_CURRENCIES, DEFAULT_LOCALES, DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelGate, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeclarativeEventMigration, DefaultCurrency, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, DispatchWriteRef, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedDerivedCellDef, EmbeddedFieldDef, EmbeddedListEditSpec, EmbeddedSubFieldDef, EntityCrudRegistrar, EntityCrudVerb, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityEventMigration, EntityFieldDefinition, EntityHandlerOptions, EntityHookMap, EntityId, EntityIndexDef, EntityListExpandableRow, EntityListScreenDefinition, EntityLongTextFieldDef, EntityObjectDefinition, EntityProjectionExtension, EntityQueryHandlerOptions, EntityRef, EntityRelations, EntityTextFieldDef, EntityWriteHandlerOptions, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventUpcastCtx, EventUpcastFn, ExpandableRowGrouping, ExtensionOptionsArgs, ExtensionOptionsFor, ExtensionSelectorDef, ExtensionSelectorPanel, FeatureMetricDef, FeatureMetricType, FeatureRegistrar, FetchForWritingArgs, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FieldsMap, FileFieldDef, FilesFieldDef, Findability, FormFieldDerivation, FormWidth, FormatSpec, FromRule, FromRuleKind, HTTP_ERROR_CODE_PATTERN, HandlerRef, HasManyRelation, HookDefinition, HookMap, HookOwner, HookPhase, HookPhases, HttpRouteDefinition, HttpRouteHandler, HttpRouteHandlerDeps, HttpRouteMethod, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDeferral, JobDefinition, JobHandlerFn, JobRunnerRef, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookFn, LifecycleHookType, LifecycleResult, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, ListTableOptions, LocatedTimestampFieldDef, LongTextFieldDef, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricOptions, MetricSpec, MoneyCurrencySource, MoneyFieldDef, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, OptionsQueryPayload, OptionsQueryPayloadValue, OwnedFn, OwnershipClause, OwnershipMap, OwnershipRef, OwnershipRule, ParentRefDef, PayloadBucketNormalization, PayloadRateLimitOption, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PhasedHook, PlatformComponent, PluralForms, PostDeleteBatchHookFn, PostDeleteHookFn, PostQueryHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, PreparedWriteEvent, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionRowIdOf, ProjectionTable, QualifiedEventName, QueryHandlerDef, QueryHandlerDefinition, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitOptions, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, RegisterEntityCrudOptions, RegistrarExtensionDef, RegistrarExtensionHooks, RegistrarExtensionRegistration, RelationDefinition, ResolvedPiiFlags, ResolvedPiiStance, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, RunIn, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SearchPayloadContributorFn, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SelectOptionTone, SessionUserOrigin, SingleStreamApplyFn, SqlFragment, StackBootRequirement, StoreTableDef, StoreTableEntry, StoreTableOptions, StreamHandlerDef, StreamHandlerDefinition, StreamHandlerFn, Subscribe, TargetRef, TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantWriteTarget, TimestampFieldDef, ToolbarAction, TransitionMap, TranslationEntry, TranslationKeys, TranslationValue, TranslationsDef, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, TryAppendEventFn, TryAppendEventResult, TzFieldDef, UiExtensionDef, UiHintOption, UiHints, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WebSocketMessageData, WebSocketRouteConnectDeps, WebSocketSessionHandlers, WhereRuleContext, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerDefinition, WriteHandlerFn, WriteHandlerInput, WriteResult, declaredRateLimitOptions, isAgentVisibleScreen, isDeliveryErrorCode, isExtensionEditSection, isFileField, isFormatSpec, isOpenToAllGranted, isRateLimitDisabled, isRateLimitOption, isSystemTenant, isUiAccessGranted, isUuid, normalizeEditField, normalizeListColumn, parseTenantId, relatedListGroupHeaderLabel, relatedListGroupKey, resolveAgentExposure, resolveName, withResponseData\n./env: ComposeEnvSchemaOptions, ComposedEnvShape, EnvError, EnvErrorKind, EnvFieldClass, EnvFieldStatus, KumikoEnvMeta, ParseEnvOptions, buildPulumiSuggestion, camelCase, getDefaultValue, getFieldDescription, pulumiConfigKey\n./env/dry-run: DryRunOptions\n./errors: AgentReason, AgentReasons, ErrorCtorInput, ErrorLogEntry, ErrorOpts, ErrorResponseBody, FeatureDisabledDetails, FrameworkReason, IdempotentReplayError, InvalidTransitionDetails, MemberReadTimeoutError, NotFoundDetails, PreconditionFailedDetails, PreconditionFailedError, RateLimitDetails, RateLimitUnavailableError, RecordLockedError, UnauthenticatedError, UnconfiguredDetails, UniqueViolationDetails, UnprocessableOpts, ValidationDetails, VersionConflictDetails, buildErrorLog, buildInvalidTransitionDetails, isSubjectErasedConflict, memberResolutionReadOnlyDenied, resolveErrorDocsUrl, serializeError, toKumikoError, toWriteErrorInfo\n./db: AppliedMigration, ApplyResult, BaselineResult, BuildEntityTableMetaOptions, CompositePrimaryKeyMeta, CreateDbConnectionOptions, CreateTenantDbOptions, CursorQueryOptions, CursorResult, DbConnectionHandle, DbConnectionOptions, DecodedKeysetCursor, DeleteManyBatchedOptions, DeleteManyBatchedResult, EagerLoadEntityResolver, EagerLoadViewer, EagerloadedRow, EntityLifecycleVerb, EntityRow, EventStoreExecutorOptions, ExecutorManagedWriteCapability, FeatureTableSource, GenerateMigrationInput, GenerateMigrationOutput, IncrementCounterOptions, IndexMeta, InnerJoinRow, InnerJoinSpec, InsertOnConflictDoNothingOptions, JoinColumnPair, LocatedTimestampRead, LockGuardOption, Migration, MigrationChecksumMismatchError, OutsideTransactionContext, PgErrorInfo, PgType, ReplayMismatch, ReplayedSchema, ReplayedTable, RetiredFrameworkTable, SYSTEM_SCOPE_CHECK_BRAND, SchemaDiff, SelectQuery, Snapshot, TableColumns, TenantDbGrants, TenantDbMode, UnmanagedTableInput, UpsertOnConflictOptions, WhereOperator, WhereValue, Writable, assertUniqueTableNames, assertValidMigrationName, baselineMigrations, bigint, bigserial, collectReferenceFields, constraintOf, diffReplayAgainstSnapshot, diffSnapshots, encryptEntityFieldValues, enrichRowWithReferences, enrichWithReferences, executeRawQueryRead, fetchAppliedMigrations, findCommentedDropTables, flattenCompoundTypes, flattenLocatedTimestamp, flattenMoney, hasOutsideTransactionDb, instantToDriver, isRetiredFrameworkTable, isTableAlreadyExists, labelListAggregateGroups, loadMigrationsFromDir, moneyAmount, moneyPayloadToMinorUnits, numeric, readMigrationSqlTexts, readRebuildMarker, rebuildTablesFromDiff, rehydrateCompoundTypes, rehydrateLocatedTimestamp, renderMigrationSql, renderTableDdl, replayMigrationsDir, requireOutsideTransactionDb, retiredFrameworkTables, runInSavepoint, runMigrations, snapshotFromMetas, splitSqlStatements, toSnakeCase, toTableName, withoutStatementTimeout, writeRebuildMarker\n./event-store: AppendEventInTenantDbOptions, ArchiveStreamArgs, ArchivedStreamError, DeadLetterRow, DeleteRowsWithoutReplayableStreamArgs, EVENTS_PUBSUB_CHANNEL, EventToAppend, EventUpcasters, IdempotentAppendConflictError, LoadAggregateWithSnapshotOptions, LoadAggregateWithSnapshotResult, PiiBackfillBatchOptions, PiiBackfillBatchResult, PiiBackfillFailure, PiiBackfillOptions, PiiBackfillResult, PiiBackfillScanCache, ProvenanceEventInput, RebuildDeadLetterRow, SaveSnapshotArgs, SkippedApply, Snapshot, SnapshotReducer, TransferAggregateStreamsArgs, UpcastOptions, UpcasterErrorPolicy, createRebuildDeadLetterTable, createSnapshotsTable, createUpcasterDeadLetterTable, listDeadLetters, listRebuildDeadLetters, loadAggregateAsOf, loadAggregateWithSnapshot, loadEventsAfterVersion, loadLatestSnapshot, rebuildDeadLetterTable, recordRebuildDeadLetters, recordUpcasterDeadLetter, restoreStream, saveSnapshot, toStoredEvent, upcastStoredEvents\n./event-store/admin-api: RawEventToAppend\n./pipeline: ACCESS_INVALIDATION_CONSUMER_NAME, AppendDomainEventCoreDeps, ConsumerCursor, ConsumerStatus, ConsumerTransitionRejection, DispatcherPassResult, EntityCache, EntityCacheOptions, EscapeHatchReportWindow, EventConsumer, EventConsumerBatchHandler, EventConsumerHandler, EventDispatcherOptions, FailedWriteResult, LifecycleHooks, MspRebuildDeps, MultiStreamApplyContextDeps, PendingGapEntry, ProjectionProgress, ProjectionStatus, ProjectionStatuses, PruneEventsResult, RebuildResult, ResolveAuthClaimsArgs, SystemHookDef, assertInstructionFieldWriteAllowed, createAccessInvalidationEventConsumer, createEscapeHatchReportWindow, createEventDispatcher, createSearchEventConsumer, createSseBroadcastEventConsumer, fallbackEscapeHatchReporter, isFailedWriteResult, isIrreversibleEntityVerb, reportEscapeHatchUse, selectConsumerCursorForUpdate, withEscapeHatchAuditScope\n./api: AuthMiddlewareOptions, AuthSessionChecker, AuthSessionStatus, CachedResponseInit, ClientIpHeaderSource, ExtraRouteEntries, ExtraRouteEntry, ExtraRouteRejectionOptions, ExtraRouteRejectionStatus, HOST_COOKIE_PREFIX, JwtKeyring, JwtPayload, KumikoServer, KumikoServerWebSocket, PostAuthLandingFlow, RedisSseBrokerOptions, RequestContextData, ResolvedSessionCookies, SessionCookieBase, SessionCookieNames, SetTenantCookieOptions, SignatureExtraRoute, SignatureExtraRouteVerifyDeps, SseClient, SseRouteOptions, TENANT_COOKIE_BASE, TenantExists, TenantLifecycleStatusResolver, TenantResolver, UserExtraRoute, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_REVALIDATION_FAILURE_LIMIT, WebSocketUpgradeServer, assertValidTrustedProxyHops, authMiddleware, clientIpSourceFromHonoContext, createApiRoutes, createAuthRoutes, createJwtHelper, createSseRoute, deleteTenantCookie, extractSocketAddress, getUser, isHostPrefixedCookieName, isSafeLandingPath, kumikoWebSocketHandler, parseIfNoneMatch, patAllows, qnMatches, requestIdMiddleware, resolveSessionCookieNames, resolveSessionCookies, sessionCheckStatus, sessionCookiesMiddleware\n./i18n: DEFAULT_LOCALE, I18n, I18nOptions, pickAcceptLanguage, rankAcceptLanguage, resolveHeaderLocale\n./auth: Role\n./files: BindPendingFileRefOutcome, CreateFileRefContext, DEFAULT_UPLOAD_SWEEP_GRACE_HOURS, FileAccessDecision, FileContentValidationResult, FileHandle, FileMetadata, FileProviderResolverDeps, FileRef, FileRoutesOptions, FileValidationOptions, MIN_UPLOAD_SWEEP_GRACE_HOURS, PendingFileRefBindTarget, UploadFileBytesContext, UploadMimeTypeResolution, WriteStreamOptions, createFileRoutes, createFileUploadLedger, fileRefStorageDelta, makeFileProviderResolver, parseMaxSize, resolveContentType, resolveUploadMimeType, sweepOrphanedUploads, validateFileContent\n./derivatives: DerivativesContextDeps, StoredFileStore, VARIANT_NAME_PATTERN, canonicalJson, createDerivativesContext, isDerivativeKeyOf, listDerivativeKeys, resolveRenderer, specHash\n./jobs: JobSubjectValue\n./observability: ConsoleProviderOptions, Counter, ESCAPE_HATCH_USED_SIGNAL, EscapeHatchProcessDedup, EscapeHatchReportWindow, Gauge, Histogram, Meter, MetricDefinition, MetricEventHandler, MetricLabels, MetricType, ObservabilityWiring, PrometheusMeter, PrometheusMeterSnapshot, REDACTED, RecordingTracerOptions, STANDARD_METRIC_DEFS, SamplingConfig, SensitiveFilterConfig, SerializedTraceContext, Span, SpanAttributeValue, SpanAttributes, SpanKind, SpanStatus, StartSpanOptions, Tracer, UNATTRIBUTED_ACTOR, buildMetricName, createConsoleProvider, createEscapeHatchProcessDedup, createEscapeHatchReportWindow, createEscapeHatchReporter, createUnboundMetricsHandle, emitDbQuery, emitDispatcherError, emitDispatcherHandler, emitEscapeHatchUse, emitEventConsumerLag, emitEventConsumerPassOutcome, emitEventConsumerPassSkipped, emitEventConsumerPendingGaps, emitEventConsumerRearmExhausted, emitEventDispatcherListenConnected, emitHttpRequest, emitJobLastSuccess, emitJobQueueDepth, fallbackEscapeHatchReporter, flushEscapeHatchAudits, generateSpanId, generateTraceId, getFallbackMeter, getFallbackProvider, getFallbackTracer, observabilityContext, redactAttributes, redactHeaders, redactQueryString, redactValue, registerStandardMetrics, reportEscapeHatchUse, serializeOpenMetrics, serializeSpanContext, shouldRedactAttribute, validateLabelKey, validateMetricName, withEscapeHatchAuditScope, wrapRedisClient\n./migrations: ChecksumMismatch, EnqueueProjectionRebuildDeps, EnqueueProjectionRebuildResult, KumikoDriftReport, PendingRebuildRun, PiiEventBackfillOptions, PiiEventBackfillResult, PiiRebuildRun, RunPendingRebuildsOptions, createPendingRebuildsTable, createPiiBackfillStateTable, detectKumikoDrift, formatKumikoDriftReport, pendingRebuildsTable, piiAnnotationFingerprint, piiBackfillStateTable\n./entrypoint: AllInOneEntrypointOptions, BaseEntrypointOptions, PgClient, PgListenClient, WorkerEntrypointOptions\n./random: ADJECTIVES, AdjNounNameOptions, GenerateUniqueNameOptions, NOUNS, generateAdjNounName, generateNoConfusableId\n./redis: CacheSyncBusOverSignalOptions, PubSubSignal, PubSubSignalOptions, RedisCacheSyncBusOptions, ResolvedCacheSyncBus, createCacheSyncBusOverSignal, isTenantConfigSyncMessage, resolveCacheSyncBus\n./search: ReindexEntityFailure, ReindexEntityOptions, ReindexEntityResult, SearchDocument, SearchOptions, SearchResult, collectSearchableFieldNames, configureTenantSearchIndex, deriveSearchAdapterConfig\n./search/meilisearch: MeilisearchAdapterOptions, meilisearchDocId, meilisearchTenantIndex\n./seeding: DEFAULT_SEED_IF_EXISTS, EventStoreSeedExisting, RunEventStoreSeedOptions\n./secrets: ContainsSecret, DekCacheOptions, EnvMasterKeyProviderOptions, Envelope, KeyScope, Keyring, SecretAuditContext, SecretKeyRef, assertNoSecretLeak, isSecret\n./crypto: ActiveKmsWiring, EncryptPiiOptions, EventPiiCatalog, KekSourceEnv, KekSourceOptions, KeyNotFoundError, KmsHealth, KmsWiringEnv, KmsWiringOptions, KmsWiringRelease, PII_CIPHERTEXT_PREFIX_JSON, PgKmsAdapter, PgKmsAdapterOptions, PgKmsRotationEnv, PlaintextPiiWiring, RECORD_ENTITY_PATTERN, RemoteCryptoKmsAdapter, RequestKmsCache, ResolveSubjectOptions, RewrapOptions, RewrapResult, SubjectDek, SubjectKey, blindIndexFieldName, buildPgKmsOptions, collectSearchableSubjectFields, computeBlindIndexValues, configureEventPiiCatalog, createRequestKmsCache, encryptEventPayloadPii, isLocalKeyKmsAdapter, subjectIdFromKey, subjectKeyForTenant\n./logging: LoggerOptions, scrubLogValue\n./schema-cli: RunSchemaCliOptions, SchemaCliOut\n./consumer-cli: ConsumerCliOut\n./upgrade-cli: ManualResolution, UpgradeCliOut, UpgradeMarkerManual, UpgradeMarkerResolvedManual, findCodemodScriptsRoot, findFeatureChangelogFiles, manualEntryId\n./internal/request-context: RequestContextData, isAgentToolCallScope, readonlyRequestContext, runWithOrigin, runWithWriteOrigin, setRequestIdentity\n./time: Clock, GeoAddress, GeoCoordinates, LocatedTimestampJson, TzContextOptions, createTzContextAsync\n./ui-types: BooleanFieldDef, CardColumnRoles, CardRoleColumn, CustomScreenRoute, DashboardChartKind, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardPanelGate, DashboardRecordBinding, DashboardRelativeTimeFormat, DashboardValueFormat, DateFieldDef, EditFieldPrefill, EntityEditActionPlacement, EntityListExpandableRow, EntityListFacetExtraOption, EntityWriteExcludedFields, ExpandableRowGrouping, FieldsOrGroupsSection, FileFieldDef, FilesFieldDef, ImageFieldDef, ImagesFieldDef, ListBadgeTone, ListColumnDisplay, ListRowMetaColumnType, ListRowMetaReference, ListTableDensity, MetricSpec, NumberFieldDef, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, OptionsQueryPayloadValue, PluralForms, ReferenceLookupSource, RoleAccessPersonalData, RoleAccessRule, ScreenFilter, ScreenFilterOp, SecretReveal, SecretRevealField, SecretsEditSection, SelectFieldDef, SystemReferenceLabel, TreeNode, TreeNodeState, UnavailableSelectOption, cardFileDisplayKind, explicitListScreenId, relatedListGroupHeaderLabel, relatedListGroupKey\n./utils: compareByCodepoint, readPositiveIntEnv, stringifyJson, toSnakeCase\nDeleted with their code (no internal replacement): ./auth Role; ./compliance describeDurationSpec, OVERRIDABLE_PROFILE_KEYS; ./crypto createRequestKmsCache, RequestKmsCache; ./db numeric, SelectQuery; ./engine BuiltinQnType, createUserSeed, HandlerFieldReferenceMeta, KumikoExtensionName, listStepKinds, MessageKind, resolveConfigOrParam, ResolveOptions, StorageProviderExtensionHooks, SystemHookName, UserDataExtensionHooks; ./errors AgentReason, buildErrorLog, ErrorLogEntry; ./observability createUnboundMetricsHandle, redactHeaders, redactQueryString, serializeSpanContext; ./pipeline ConsumerStatus, ProjectionStatus, ProjectionStatuses; ./search configureTenantSearchIndex; ./time createTzContextAsync.",
+    "migration": "None of the removed names had a user in any Kumiko repository, so no migration is expected. Internal names have no public replacement. The deleted names listed above are gone without a replacement; code that still imports one fails to compile and has to inline the few lines it needs. If you need one back, open an issue."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Job runner connects to a password-protected Redis",
+    "detail": "parseRedisOpts kept only host, port and db of REDIS_URL, so BullMQ queues and the sequential lock connected without the password and the app stopped at boot with \"Redis not reachable\" against a Redis that requires auth. Username, URL-encoded password and rediss:// TLS are now carried over."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "preQuery hooks removed",
+    "detail": "`r.hook({ type: \"preQuery\", … })` registered a hook that the query pipeline never called. The `preQuery` hook type, `PreQueryHookFn`, the `preQuery` slot of the hook maps and registrar extension hooks, and `registry.getPreQueryHooks` are removed. A `type: \"preQuery\"` registration is now a type error and throws at feature registration instead of being silently ignored.",
+    "migration": "No known users. Remove `r.hook({ type: \"preQuery\", … })` registrations; they never ran. To change a query payload, validate or transform it inside the query handler."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Row level security policy DDL behind a rowLevelSecurity parameter",
+    "detail": "renderTableDdl, renderTablesDdl and unsafePushTables accept rowLevelSecurity \"off\" or \"on\" (default \"off\", output unchanged). With \"on\", every table that has a tenant_id column gets ENABLE and FORCE ROW LEVEL SECURITY plus the policies kumiko_tenant_isolation and kumiko_system_tenant_read, driven by the kumiko.tenant_id and kumiko.scope settings. Tables without tenant_id are left alone."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "The migration generator writes a row level security section",
+    "detail": "With rowLevelSecurity \"on\", generateMigration adds a Row level security section for new, changed and recreated tables and a rowLevelSecurity field to the snapshot; switching back to \"off\" emits the matching DISABLE statements with a warning. Without the option the generated SQL and snapshot are byte-identical to before."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Migration replay understands CREATE, ALTER and DROP POLICY",
+    "detail": "The replay behind kumiko-schema validate tracks ENABLE and FORCE ROW LEVEL SECURITY and policy definitions per table, follows table renames, and reports row-level-security-drift when the committed SQL does not produce the policies the snapshot expects (missing, extra, altered or hand-edited) or turns on row level security for a table the snapshot has no spec for. An unparsable policy statement, or a policy or row level security change inside a DO block, fails loudly."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Projection and multi-stream rebuilds no longer abort on tables with row level security",
+    "detail": "The shadow swap used to refuse a live table with RLS flags or policies. It now reads them from the catalog under the swap lock, re-applies them to the swapped-in table and fails the rebuild transaction if the result differs. Before the first read, the rebuild checks that the table's policies let its system scope see every row, so the guards never see too few rows and the swap never drops hidden ones."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Migration replay parses ALTER TABLE ONLY, IF EXISTS and public. prefixes",
+    "detail": "kumiko-schema validate read `ALTER TABLE ONLY \"t\"` as a change to a table named ONLY and ignored IF EXISTS and a public. prefix; the statement now applies to the named table."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "createTenantDb mode system requires a reason",
+    "detail": "The system scope a TenantDb opens for its statements now carries that reason, so a scope leak assertion names the call site. Tenant mode takes no reason.",
+    "migration": "Add `reason: \"<why this access spans tenants>\"` to every createTenantDb({ mode: \"system\" }) call. The reason must be a non-empty string literal: an empty reason throws InternalError at construction, and the internal-subpath-imports guard rejects a missing, empty or non-literal reason."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Signature routes read and write secrets in a system scope",
+    "detail": "With row level security on, verify() and the handler of a signature route (subscription webhooks, mail connect callbacks) read the secrets of a tenant named by the signed request before any tenant scope exists, and failed. deps.secrets now opens the system scope for each secret access only, so plugin code that parses the unauthenticated body stays unscoped."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "RLS boot check tells known tables from orphaned ones",
+    "detail": "With rowLevelSecurity on, the boot check lists tenant tables without row-level security in two groups. Tables the app schema knows point to kumiko schema generate. Tables no feature declares anymore, including retired framework tables, are named as orphaned and point to dropping them by migration. The check itself stays strict.",
+    "migration": "assertRowLevelSecurityBootState takes the known tables as a required third argument: pass knownTablesOf(features), both exported from the db subpath."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "schema apply heals row-level security on existing framework tables",
+    "detail": "Existing databases got no policies on kumiko_events, kumiko_archived_streams and kumiko_snapshots, so boot failed while schema validate stayed green."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Connections set the row level security scope in every transaction",
+    "detail": "createDbConnection takes rowLevelSecurity \"off\" or \"on\" (default \"off\", the connection is unchanged). With \"on\", every statement and transaction sets kumiko.tenant_id and kumiko.scope transaction-locally from the ambient scope. TenantDb sets its tenant, and the system scope for system-mode TenantDbs, global tables and a granted unsafeRaw. Dispatch sets the user's tenant per command, or the system scope for a system-scoped handler. Event store reads and writes use the stream's tenant. Jobs, the event dispatcher, member resolution, migrations, boot seeds, retention, reindex, blind-index cleanup, the PII backfill, projection apply, auth providers and the tenant lifecycle check run in system scope. A statement without a scope sees no tenant rows. The functions that set a scope (runInRowLevelSecurityScope, runInSystemRowLevelSecurityScope, tenantRowLevelSecurityScope, systemScopedRunner) are not part of the public db subpath; framework packages import them from @cosmicdrift/kumiko-framework/internal/row-level-security, which no guard closes to apps yet. App code reaches the system scope through a system-scoped handler, a job or a granted unsafeRaw."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "One rowLevelSecurity value in kumiko.config.ts for schema tooling and runners",
+    "detail": "AppConfig.rowLevelSecurity (\"off\" by default) is exported by the managed kumiko/schema.ts as ROW_LEVEL_SECURITY. kumiko-schema generate and validate render and check the policies from it, and apply opens its connection in that mode; the CLI has no flag of its own. The API, worker and all-in-one entrypoints take the same option and refuse a context whose connection runs in another mode. unsafePushTables with \"on\" reads the catalog first and runs no lock and no DDL for a table that already has ENABLE, FORCE and both kumiko policies."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Projection rebuilds run in system scope under row level security",
+    "detail": "The rebuild transaction no longer turns row_security off, so a rebuild works as a NOSUPERUSER NOBYPASSRLS table owner under FORCE. Before the first guard read it locks the live table in SHARE UPDATE EXCLUSIVE mode, which blocks policy DDL and a second rebuild of the same table, and reads the catalog. When row level security is enabled, kumiko_tenant_isolation must exist as a PERMISSIVE policy for ALL commands and PUBLIC and no RESTRICTIVE policy may exist; otherwise the rebuild fails with the table and its policies and leaves the live table untouched. Other permissive policies carry over to the swapped-in table. Multi-stream rebuilds follow the same rule."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "rowLevelSecurity defaults to \"on\"",
+    "detail": "Postgres row level security is on by default, system scopes carry a mandatory reason, and the event write path keeps the caller's tenant scope.",
+    "migration": "In the app repo, once with the bump: run `kumiko sync-managed --write` (the managed kumiko/schema.ts now reads `export const ROW_LEVEL_SECURITY = appConfig.rowLevelSecurity;`), then `kumiko schema generate` and commit the migration. It contains ENABLE and FORCE ROW LEVEL SECURITY plus the policies `kumiko_tenant_isolation` and `kumiko_system_tenant_read` for every tenant table. The schema apply (the migrate init container in production) creates them; there is no manual database step. Without the migration, boot at \"on\" refuses to start and names the unprotected tables.\nThe app's database role must not skip policies; boot refuses it otherwise. Check it as that role with `SELECT rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user` (both must be false). Callers of createDbConnection without a mode now get \"on\"; tools that touch no tenant rows (schema baseline/status, the KMS key store) pass \"off\" explicitly, and the operator commands backfill-pii, waitlist-migrate, project and consumer run on an enforcing connection in system scope, so they work against both modes.\nWay back: set `rowLevelSecurity: \"off\"` in kumiko.config.ts and run `kumiko schema generate`; the generated migration contains DISABLE ROW LEVEL SECURITY and drops the policies. At \"off\" runProdApp and runWorkerApp log a boot warning."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "Boot hooks with a db dependency get a system-scoped db at rowLevelSecurity \"on\"",
+    "migration": "No action unless a hook relied on the unscoped pool. The anonymousAccess factory, enrichAnonymousAccess, the runProdApp `wire` hook and runWorkerApp `wireComponents` now receive a system-scoped db, the same in prod, dev and the test stack, so tenant resolution and boot reads see rows across tenants. Anything the anonymousAccess factory builds keeps that db at request time and therefore reads across tenants for anonymous callers: filter by the resolved tenant yourself. In prod, extraContext factories keep the ambient request scope; the test stack and dev still hand them a system-scoped db, so a service that needs cross-tenant reads at request time must scope itself."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "runInSystemRowLevelSecurityScope and systemScopedRunner take a reason",
+    "migration": "Call runInSystemRowLevelSecurityScope(\"<why this access spans tenants>\", fn) and systemScopedRunner(runner, \"<reason>\"). An empty or whitespace reason throws InternalError; the scope leak assertion names the reason."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "A projection write under a tenant scope can no longer land in another tenant",
+    "detail": "applyEntityEvent keeps an ambient tenant scope instead of wrapping every write in a system scope. Writes for other tenants go through ctx.systemDb.acknowledgeCrossTenant in an r.systemScope() feature. Replays, rebuilds and global entities still write system scoped.",
+    "migration": "A command that writes an entity row for another tenant through ctx.db now fails with SQLSTATE 42501; move that write to ctx.systemDb.acknowledgeCrossTenant in an r.systemScope() feature."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "composeFeatures no longer warns about its own bundled copies",
+    "detail": "Composing the output of a first composeFeatures pass again drops the earlier bundled instances silently; only copies the app supplied itself still warn."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Scoped pool statements pipeline their transaction",
+    "detail": "A pool statement under a row level security scope sends BEGIN, the transaction-local scope, the statement and COMMIT pipelined on one reserved connection instead of waiting for each, which cuts its roundtrips roughly in half. The connection returns to the pool only after COMMIT settled."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Schema generator emits primary-key changes",
+    "detail": "A changed primary key (single to composite, reordered columns, renamed constraint) previously produced no migration. The generator now emits DROP CONSTRAINT plus ADD CONSTRAINT with a WARN comment, and managed projections are recreated and replayed."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Tests seed and reset event-sourced tables through the event store",
+    "detail": "Seeds of user, membership, tenant and other entity rows use seedRowViaEventStore instead of seedRow, so their created events exist. Setup and teardown hooks in the integration tests clear event-sourced tables through resetTestTables instead of raw DELETE statements, and clear the events table in the same call, so a test no longer starts with events whose projection rows are gone. Nothing changes for apps; the packages are only republished."
+  },
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "Bun.SQL replaces postgres-js as the only Postgres driver",
+    "detail": "createDbConnection opens a Bun.SQL pool and needs Bun 1.4.4 or newer, the first release that drops a cached statement plan after DDL on the same connection. The handle gains listenClient for LISTEN/NOTIFY. Server errors carry the code ERR_POSTGRES_SERVER_ERROR with the SQLSTATE in errno and the constraint name in constraint; connection failures carry ERR_POSTGRES_CONNECTION_CLOSED, ERR_POSTGRES_CONNECTION_REFUSED, ERR_POSTGRES_CONNECTION_TIMEOUT or ERR_POSTGRES_CONNECTION_FAILED. extractPgError, isUniqueViolation, isTableAlreadyExists, constraintOf and the newly exported isUndefinedTable read that shape. The onNotice option is removed, because Bun.SQL has no notice hook and drops server notices. The ssl option takes Bun's tls value (a boolean, \"disable\", \"prefer\", \"require\", \"verify-ca\", \"verify-full\" or a TLS options object); ssl true and a TLS object without rejectUnauthorized still verify the server certificate, as they did with postgres-js. DB_PROVIDER is refused at boot for every non-empty value, \"postgres\" included.",
+    "migration": "Read SQLSTATE and constraint only through extractPgError or the is* helpers from @cosmicdrift/kumiko-framework/db; a direct err.code === \"23505\" check or an err.constraint_name read no longer matches. Replace checks for CONNECTION_CLOSED, CONNECTION_ENDED, CONNECTION_DESTROYED or CONNECT_TIMEOUT with the ERR_POSTGRES_CONNECTION_* codes. Drop onNotice from createDbConnection calls. Remove DB_PROVIDER from every environment. Run on Bun 1.4.4 or newer in engines, CI and images. Code that imports postgres itself must declare its own dependency or move to Bun.SQL, since the framework no longer installs it. Manual migration, there is no codemod."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "schema status and baseline use one connection, bun-types is a peer dependency",
+    "detail": "kumiko schema status and baseline open a pool of one connection instead of the default size, because Bun.SQL dials every pool connection on the first query. bun-types is now a peer dependency (^1.4.4) of framework, types, server-runtime and dev-server instead of a regular dependency, so install it next to the framework."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "validateBundledListsOptions and the BundledListsOptions type",
+    "detail": "BundledListsOptions is exported from the types package and the engine barrel. validateBundledListsOptions rejects unknown keys, grouping, totals and pinFirstColumn without table.pinning with a message that names the key, and checks the remaining keys like a screen's own table block."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "r.adoptsBundledLists() marks features that take the bundledLists block",
+    "detail": "The registrar method r.adoptsBundledLists() marks a feature whose list screens take the app-wide bundledLists block; the flag appears as FeatureDefinition.adoptsBundledLists and in feature-manifest.json, and the feature-ast parser knows the call as an opaque singleton pattern."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "table block on entityList, projectionList and relatedList",
+    "detail": "The new optional table block (rememberState, resetAll, columnPicker, density with default and userChoice) is validated at boot; unknown keys, hidden columns without columnPicker and invalid density values are rejected. Columns accept hidden: true. Remembered state lives in sessionStorage per tenant and user and is cleared on logout or identity change."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "table.pinning, table.resizing and table.keyboardNavigation, column pinned, width and minWidth",
+    "detail": "The boot validator rejects pinned without table.pinning, a pinned value other than left or right, width or minWidth without table.resizing, values that are not finite numbers above 0, and a minWidth above the width."
+  },
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "Money list aggregates answer one value per currency",
+    "detail": "A sum, avg, min or max measure over a money field in a list aggregate now answers [{ currency, value }] with value in minor units, one entry per currency in the matching rows, and never adds amounts of different currencies. Before, it answered one plain number over all currencies.",
+    "migration": "code reading measures of a money field from a list aggregate answer (executor.aggregate, answerListAggregate or the list query with aggregate) reads an array of { currency, value } instead of a number; take the entry of the wanted currency, value stays in minor units"
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "table.grouping, table.totals and range facets validated at boot",
+    "detail": "The table block takes grouping ({ field, label?, labels?, collapsedWhen?, userChoice?, fields? }) and totals ([{ field, kind }]). The boot validator checks the fields against the entity or the columns, rejects measures a field type cannot carry and requires the list query to accept aggregate (entityListSchema does; hand-written queries answer it with answerListAggregate). facets.<field>.display \"range\" needs a filterable number, decimal, money or bigInt field."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "bulkActions on entityList, projectionList and relatedList",
+    "detail": "Each entry is { id, rowAction, confirm? } and points at a writeHandler entry of the same screen's rowActions. The boot validator rejects unknown keys, a non-kebab or duplicate id, an unknown rowAction and a rowAction of kind clientAction, navigate or drawer."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "XLSX export for entityList and projectionList via table.export",
+    "detail": "The new table.export block ({ xlsx: true, maxRows? }) is validated at boot and is only accepted on entityList and projectionList. POST /api/export/xlsx runs the list query again with the caller's session, pages through the whole filtered list and answers 413 above maxRows (default 10000, hard cap 100000). Encrypted, sensitive, write-only and unreadable fields and virtual columns are left out of the sheet. Reference columns export the label of the target (joined with commas for multiple references), not the id. Timestamp cells use the browser time zone sent with the request, else the profile zone, else UTC. Personal access tokens are rejected. A projectionList query must honor offset or return nextCursor. Adds the write-excel-file dependency."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Executor writes on a pool runner are atomic",
+    "detail": "executor.create/update/delete/forget/restore on a TenantDb that is not inside a transaction used to run append, projection and custom projections as separate autocommit statements, so a failing projection left an event without its row. They now run in their own transaction, and a returned failure such as version_conflict rolls it back too. Calls inside a handler transaction keep their savepoint behavior. Callers that wrapped executor writes in runInOwnTransaction as a workaround can drop it."
+  },
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "FeatureRegistrar types moved to @cosmicdrift/kumiko-types/feature-registrar",
+    "migration": "Import FeatureRegistrar, HookDefinition, EntityObjectDefinition and RequiresApi from @cosmicdrift/kumiko-types/feature-registrar or from the engine barrel of @cosmicdrift/kumiko-framework; @cosmicdrift/kumiko-types/feature no longer exports them."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "maxPerTenant counts active and waiting jobs in one snapshot",
+    "detail": "The guard read the active and the waiting list with separate Redis calls, so a job that moved from waiting to active between them was missing from both and a dispatch over the cap got through. It now reads both lists with one getJobs snapshot per queue. The integration tests hold the cap jobs on a release gate instead of sleeping."
+  },
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "relatedList groupBy replaced by table.grouping",
+    "detail": "The groupBy key on a relatedList section and an entityList expandableRow is removed together with the RelatedListGroupBy type. Both group through table.grouping ({ field, label?, labels?, collapsedWhen? }): groups, counts and header measures come from one aggregate query over all matching rows instead of the loaded page, and each open group loads its own rows. An expandableRow takes only table.grouping with a fixed field; userChoice, fields and every other table option stay boot errors there. The boot validator reports a leftover groupBy with a pointer to table.grouping. ExpandableRowGrouping is the new type of an expandableRow's grouping.",
+    "migration": "move groupBy { field, collapsedWhen, label, labels } to table: { grouping: { field, collapsedWhen, label, labels } }; the bound query must accept aggregate (entityListSchema does, a hand-written query answers it with answerListAggregate). dateField and the {lastDate} placeholder have no replacement on an expandableRow, where totals stay off; on a relatedList a max measure in table.totals shows the latest date. Every group now gets a header: a group without label or labels entry shows its value instead of rendering headerless."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "ctx.loadAggregate can read a single event by version",
+    "detail": "The new atVersion option returns the event at that version of the stream (or nothing), with upcasting and the tenant filter. It cannot be combined with asOf. Workflow resume uses it for event references."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Access invalidation survives a Redis outage",
+    "detail": "The consumer that pushes session, token and membership revocations to open streams does not count failed publishes towards the attempt limit and backs off between them, instead of dying after 10 failed deliveries and silently dropping later revocations. Other failures keep the limit. New EventConsumerErrorPolicy.isTransientError."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "file upload rechecks the record lock when inserting the row",
+    "detail": "POST /files with an entityId reads the stored row again through the inserting transaction and refuses with 409 record_locked when lockedWhen holds. The window between that read and the commit stays open, like for any other write that checks the lock before its own commit."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Meilisearch default upgrade cannot tell a narrowed configure() from an older default",
+    "detail": "A tenant that called configure() with a strict subset of the default attributes gets the full default back after the next process restart, because Meilisearch stores no marker for an explicit configure(). Configure the full attribute set, or a set that contains an attribute outside the default, to keep it."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Cross-tenant-read crons audit once per day, not once per foreign row",
+    "detail": "The process dedup key of a declared system cron hatch includes the target only for global-write (a table). Row targets of cross-tenant-read no longer grow the in-memory map or write one audit event per row."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Failed job-runner start waits for the timed-out boot gate",
+    "detail": "start() now waits a bounded time for an abandoned boot gate before throwing, instead of leaving that to stop(). The scheduler-seen timer is only started after every step that can fail, so no timer outlives a failed start."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "disabled feature no longer removes another feature's workspace with the same id",
+    "detail": "buildAppSchema records which feature owns each workspace and the feature strip removes only the workspaces of the disabled features. Two features that use the same short workspace id keep their own entries."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "upload ledger uses the injected clock",
+    "detail": "createFileUploadLedger and withUploadLedger take an optional now function, and the file provider resolver wires AppContext.clock into it. Without a clock the system time is used as before."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "anonymous save leaves foreign pending uploads unbound",
+    "detail": "Integration test through the real write route with anonymous access, covering the save pipeline path of the pending-upload ownership check."
+  },
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "Unused ProviderPluginContext helpers removed",
+    "detail": "ProviderPluginContext, providerPluginContextFromHandler and providerPluginContextFromJob are gone. No plugin type or resolver used them, and the type exposed db handles without an audit user. Provider contexts stay the narrow FileProviderContext, MailTransportContext and InboundMailContext.",
+    "migration": "no known callers; use FileProviderContext, MailTransportContext or InboundMailContext"
+  },
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "provider selector option labels are unique per owner",
+    "detail": "The selector field id of a provider form is qualified with its owner feature, so the translation keys of its option labels change.",
+    "migration": "move app translation overrides from config:entity:__config-edit__:field:provider:option:<value> to the owner-qualified field id, field:mail-foundation-provider:option:<value> or field:file-foundation-provider:option:<value>"
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "live signals hide row ids from row-filtered roles",
+    "detail": "createSseRoute takes an optional entityRowReadMaps option, built from entity access.read by the server routes. A signed-in connection receives id and version only if the entity has no read ownership map or one of its roles is mapped to all; otherwise the signal carries just the entity and event type so the client refetches."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "write handlers that spread the executor result keep projections and postSave hooks",
+    "detail": "The event is stripped from lifecycle results when the dispatcher masks the response, no longer made non-enumerable on the result, so copying the result does not lose it. Responses still carry no event."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "event-free write results proven for non-HTTP entry points",
+    "detail": "Integration tests assert that dispatcher.write, dispatcher.batch and the agent tool dispatch return no event. No runtime change: all of them already pass through the dispatcher masking."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "reference-data seed adopts rows that have no event stream",
+    "detail": "Rows from installs that seeded reference data by direct insert are re-created under the same id through the executor on the next boot, so updates apply and the rows survive a rebuild. No action is needed; the row id is unchanged, only its version restarts at 1."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "client-errors route keeps an in-memory floor limit",
+    "detail": "The in-memory per-IP limiter now runs in front of the Redis-backed limiter instead of only when no resolver is wired, so a failing resolver can no longer lift the limit on the public client-errors endpoint."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "reindex job batches are no longer cut off by the server statement timeout",
+    "detail": "reindexEntity reads each batch in its own transaction with statement_timeout lifted for that transaction, on the caller's own runner, so the job path through ctx.systemDb.unsafeRaw() keeps its gates."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "files meta batch route is rate limited by id count",
+    "detail": "createFileRoutes takes an optional metaBatchRateLimitResolver, wired by the server from the rate-limit resolver or Redis. A user over 1000 requested ids per minute gets 429 rate_limited; a failing limiter fails open and is reported like the other limiters."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "kumiko-upgrade explains that --apply writes the CHANGELOG",
+    "detail": "The preview run never wrote the upgrade CHANGELOG or the marker, and consumers running it without --apply got no entry and no explanation. It now prints a hint; the exit code is unchanged."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Codemod imports no longer land inside header comments",
+    "detail": "ensureNamedImport appends the new import after the last existing import, so a file with a header comment block keeps the comment intact."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Database now is rounded to milliseconds",
+    "detail": "The Postgres clock read behind readDatabaseNow is cast to timestamptz(3), the precision of events.created_at, so a comparison with a stored event time is exact."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "E2E seeders and signature routes can write with explicit roles",
+    "detail": "dispatchWriteAs on signature route deps and writeAs on the E2E seeder context run a write as the tenant's system user with the \"system\" role plus the given roles, without SystemAdmin. write() keeps running as SystemAdmin."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "List filter on multiple references matches array contents",
+    "detail": "eq, ne and in on a multi-reference field now check jsonb containment instead of scalar equality, and screen filters on such fields allow the equality operators. Consumers no longer need a full scan."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "kumiko-upgrade --resolve updates CHANGELOG.md",
+    "detail": "The Manual migrations lines of every CHANGELOG.md section change from [open] to the chosen resolution for the resolved ids; other entries and files without a CHANGELOG.md are left alone."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "ctx.scheduleAfterRollback for outside-transaction compensation",
+    "detail": "ctx.scheduleAfterRollback(fn) runs fn when the handler transaction does not commit, or when the enclosing savepoint of a nested ctx.write rolls back (after the outer transaction ends). It never runs on commit, errors are logged and do not change the write result, and it is absent outside a transaction scope (perCommand, post-commit, beforeTransaction, member resolution). A failed COMMIT also triggers it, so callbacks must be idempotent and outcome-safe, for example releasing a reservation row that may already be gone."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Tenant-safe upsert on ctx.db",
+    "detail": "ctx.db.upsert(table, values, { conflictTarget, update? }) requires tenantId in conflictTarget and the target to match a declared unique index or primary key. The update only touches the row of the inserted tenant, update may not set tenantId, and the default update leaves conflict, primary-key and tenant columns alone. Event-fed tables are rejected. Replaces unsafeRaw plus upsertOnConflict for tenant-scoped upserts."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/dist/crypto/request-kms-cache.d.ts

@@ -1,8 +0,0 @@
-import type { KmsContext, LocalKeyKmsAdapter, SubjectDek, SubjectId } from "./kms-adapter.ts";
-export interface RequestKmsCache {
-    getKey(subject: SubjectId, ctx: KmsContext): Promise<SubjectDek>;
-    /** Drops one subject's cached DEK — called when its key is shredded mid-request. */
-    invalidate(subject: SubjectId): void;
-    clear(): void;
-}
-export declare function createRequestKmsCache(adapter: LocalKeyKmsAdapter): RequestKmsCache;

package/dist/crypto/request-kms-cache.js

@@ -1,21 +0,0 @@
-import { subjectIdToKey } from "./kms-adapter.js";
-export function createRequestKmsCache(adapter) {
-    const cache = new Map();
-    return {
-        async getKey(subject, ctx) {
-            const subjectKey = subjectIdToKey(subject);
-            const hit = cache.get(subjectKey);
-            if (hit !== undefined)
-                return hit;
-            const dek = await adapter.getKey(subject, ctx);
-            cache.set(subjectKey, dek);
-            return dek;
-        },
-        invalidate(subject) {
-            cache.delete(subjectIdToKey(subject));
-        },
-        clear() {
-            cache.clear();
-        },
-    };
-}

package/dist/engine/codemod/index.d.ts

@@ -1,2 +0,0 @@
-export type { CodemodOptions, CodemodReport, CodemodResult, FileAnalysis, ParsedHandlerInfo, } from "./pipeline-codemod.ts";
-export { analyzeFile, analyzeHandlerArrow, convertFile, generatePerformBlock, runCodemod, scanForCandidates, } from "./pipeline-codemod.ts";

package/dist/engine/codemod/index.js

@@ -1 +0,0 @@
-export { analyzeFile, analyzeHandlerArrow, convertFile, generatePerformBlock, runCodemod, scanForCandidates, } from "./pipeline-codemod.js";