@cosmicdrift/kumiko-framework 0.389.0 → 0.390.1

package/dist/pipeline/system-identity-switch.js

@@ -2,6 +2,7 @@ import { escapeHatchFor } from "@cosmicdrift/kumiko-types/handlers";
 import { withSystemDbUnsafeRawGrant, withUnsafeRawGrant } from "../db/tenant-db.js";
 import { SYSTEM_ROLE, SYSTEM_USER_ID } from "../engine/system-user.js";
 import { AccessDeniedError, FrameworkReasons, InternalError } from "../errors/index.js";
+import { attachOutsideTransaction } from "./attach-outside-transaction.js";
 export function isSystemIdentity(user) {
     return user.id === SYSTEM_USER_ID || user.roles.includes(SYSTEM_ROLE);
 }
@@ -49,14 +50,14 @@ export function identitySwitchDenied(callerLabel, asUser) {
 }
 export function unsafeAllTenantsDenied(callerLabel) {
     return new AccessDeniedError({
-        message: `${callerLabel} may not call ctx.queryProjection(..., { unsafeAllTenants: true }) — declare ` +
+        message: `${callerLabel} may not call ctx.dispatch.queryProjection(..., { unsafeAllTenants: true }) — declare ` +
             "r.systemScope() or escapeHatch: { reason } on it",
         details: { reason: FrameworkReasons.unsafeAllTenantsDenied },
     });
 }
 // Reverse-lookup so withHookEscapeHatchGrant can re-gate the SAME ungated pair (and caller) under a narrower grant.
 const sourceByGated = new WeakMap();
-// Same idea, for ctx.queryAsMember — a single function rather than a pair.
+// Same idea, for ctx.dispatch.queryAsMember — a single function rather than a pair.
 const ungatedMemberReaderByGated = new WeakMap();
 function reportGrantedSwitch(caller, asUser, hasGrant, audit) {
     // skip: no audit wired, switch wasn't grant-gated, or grant carries no reason to report
@@ -88,7 +89,7 @@ export function createGatedIdentitySwitch(callerLabel, caller, hasGrant, ungated
     sourceByGated.set(writeAs, source);
     return gated;
 }
-// ctx.queryAsMember's gate: the caller never names the target identity up
+// ctx.dispatch.queryAsMember's gate: the caller never names the target identity up
 // front (it's resolved internally), so this is a flat allow/deny.
 export function createGatedMemberReader(callerLabel, allowSystemIdentity, ungated, audit) {
     const gated = async (userId, qn, payload) => {
@@ -102,9 +103,9 @@ export function createGatedMemberReader(callerLabel, allowSystemIdentity, ungate
     ungatedMemberReaderByGated.set(gated, { ungated, audit });
     return gated;
 }
-// Same idea, for ctx.queryProjection — a single function rather than a pair.
+// Same idea, for ctx.dispatch.queryProjection — a single function rather than a pair.
 const ungatedProjectionReaderByGated = new WeakMap();
-// ctx.queryProjection's gate: only { unsafeAllTenants: true } on a projection with a
+// ctx.dispatch.queryProjection's gate: only { unsafeAllTenants: true } on a projection with a
 // tenant column is grant-checked — a plain call always passes through, tenant-scoped
 // by the projection's own table, and the flag is a no-op on a tenant-less one.
 export function createGatedProjectionReader(callerLabel, hasGrant, ungated, audit, projectionHasTenantColumn = () => true) {
@@ -121,19 +122,20 @@ export function createGatedProjectionReader(callerLabel, hasGrant, ungated, audi
     ungatedProjectionReaderByGated.set(gated, { ungated, report: audit?.report });
     return gated;
 }
-function readIdentitySwitchFn(context, key) {
-    if (!(key in context))
+// Reads own keys only — never touch a property of a resolved value, which may be a Proxy that throws on any get.
+function readMember(namespace, key) {
+    if (namespace === undefined || !(key in namespace))
         return undefined;
-    const value = Reflect.get(context, key);
-    return typeof value === "function" ? value : undefined; // @cast-boundary engine-bridge — checked via typeof above
+    return Reflect.get(namespace, key);
 }
-// context's own keys only — never touch a property of the resolved value, which may be a Proxy that throws on any get.
-function readDbLikeValue(context, key) {
-    if (!(key in context))
-        return undefined;
-    const value = Reflect.get(context, key);
+function readObjectMember(namespace, key) {
+    const value = readMember(namespace, key);
     return typeof value === "object" && value !== null ? value : undefined;
 }
+function readFunctionMember(namespace, key) {
+    const value = readMember(namespace, key);
+    return typeof value === "function" ? value : undefined; // @cast-boundary engine-bridge — checked via typeof above
+}
 function unavailableIdentitySwitchFn(callerLabel, kind) {
     return async () => {
         throw new InternalError({
@@ -179,8 +181,8 @@ function gatedIdentitySwitchFields(callerLabel, escapeHatch, ctxQueryAs, ctxWrit
         ...(ctxWriteAs && { writeAs: gated.writeAs }),
     };
 }
-// Unlike ctx.resolveActiveMembership (deny-only), a hook's own escapeHatch
-// can grant queryAsMember even when the enclosing handler has none.
+// Unlike ctx.auth.resolveActiveMembership (deny-only), a hook's own escapeHatch
+// can grant dispatch.queryAsMember even when the enclosing handler has none.
 function gatedMemberReaderField(callerLabel, escapeHatch, ctxQueryAsMember) {
     if (!ctxQueryAsMember)
         return {};
@@ -193,7 +195,7 @@ function gatedMemberReaderField(callerLabel, escapeHatch, ctxQueryAsMember) {
         queryAsMember: createGatedMemberReader(callerLabel, escapeHatch !== undefined, ungated, audit),
     };
 }
-// Re-gates ctx.queryProjection under the hook's own escapeHatch, same
+// Re-gates ctx.dispatch.queryProjection under the hook's own escapeHatch, same
 // re-gating rule as the other fields below — see withHookEscapeHatchGrant.
 function gatedProjectionReaderField(callerLabel, escapeHatch, ctxQueryProjection) {
     if (!ctxQueryProjection)
@@ -205,15 +207,26 @@ function gatedProjectionReaderField(callerLabel, escapeHatch, ctxQueryProjection
         queryProjection: createGatedProjectionReader(callerLabel, escapeHatch !== undefined, ungated, audit),
     };
 }
+// A rebound db is a new object, so the outsideTransaction property has to be carried over; an input
+// withUnsafeRawGrant passes through unchanged keeps its own.
+function regatedDb(ctxDb, ctxDbOutsideTransaction, rawHatch) {
+    const gatedDb = withUnsafeRawGrant(ctxDb, rawHatch);
+    if (gatedDb !== ctxDb && ctxDbOutsideTransaction) {
+        attachOutsideTransaction(gatedDb, withUnsafeRawGrant(ctxDbOutsideTransaction, rawHatch));
+    }
+    return gatedDb;
+}
 export function withHookEscapeHatchGrant(context, callerLabel, escapeHatch) {
-    const ctxQueryAs = readIdentitySwitchFn(context, "queryAs");
-    const ctxWriteAs = readIdentitySwitchFn(context, "writeAs");
-    const ctxResolveActiveMembership = readIdentitySwitchFn(context, "resolveActiveMembership");
-    const ctxQueryAsMember = readIdentitySwitchFn(context, "queryAsMember");
-    const ctxQueryProjection = readIdentitySwitchFn(context, "queryProjection");
-    const ctxDb = readDbLikeValue(context, "db");
-    const ctxDbOutsideTransaction = readDbLikeValue(context, "dbOutsideTransaction");
-    const ctxSystemDb = readDbLikeValue(context, "systemDb");
+    const dispatch = readObjectMember(context, "dispatch");
+    const auth = readObjectMember(context, "auth");
+    const ctxQueryAs = readFunctionMember(dispatch, "queryAs");
+    const ctxWriteAs = readFunctionMember(dispatch, "writeAs");
+    const ctxResolveActiveMembership = readFunctionMember(auth, "resolveActiveMembership");
+    const ctxQueryAsMember = readFunctionMember(dispatch, "queryAsMember");
+    const ctxQueryProjection = readFunctionMember(dispatch, "queryProjection");
+    const ctxDb = readObjectMember(context, "db");
+    const ctxDbOutsideTransaction = readObjectMember(ctxDb, "outsideTransaction");
+    const ctxSystemDb = readObjectMember(context, "systemDb");
     const identityHatch = escapeHatchFor(escapeHatch, "systemIdentity");
     const rawHatch = escapeHatchFor(escapeHatch, "unsafeRaw");
     if (!ctxQueryAs &&
@@ -222,29 +235,31 @@ export function withHookEscapeHatchGrant(context, callerLabel, escapeHatch) {
         !ctxQueryAsMember &&
         !ctxQueryProjection &&
         !ctxDb &&
-        !ctxDbOutsideTransaction &&
         !ctxSystemDb) {
         return context;
     }
     return {
         ...context,
-        ...gatedIdentitySwitchFields(callerLabel, identityHatch, ctxQueryAs, ctxWriteAs),
-        ...(ctxResolveActiveMembership &&
-            identityHatch === undefined && {
-            resolveActiveMembership: deniedResolveActiveMembership(callerLabel),
+        ...(dispatch && {
+            dispatch: {
+                ...dispatch,
+                ...gatedIdentitySwitchFields(callerLabel, identityHatch, ctxQueryAs, ctxWriteAs),
+                ...gatedMemberReaderField(callerLabel, identityHatch, ctxQueryAsMember),
+                ...gatedProjectionReaderField(callerLabel, identityHatch, ctxQueryProjection),
+            },
         }),
-        ...gatedMemberReaderField(callerLabel, identityHatch, ctxQueryAsMember),
-        ...gatedProjectionReaderField(callerLabel, identityHatch, ctxQueryProjection),
-        ...(ctxDb && { db: withUnsafeRawGrant(ctxDb, rawHatch) }),
-        ...(ctxDbOutsideTransaction && {
-            dbOutsideTransaction: withUnsafeRawGrant(ctxDbOutsideTransaction, rawHatch),
+        ...(auth &&
+            ctxResolveActiveMembership &&
+            identityHatch === undefined && {
+            auth: { ...auth, resolveActiveMembership: deniedResolveActiveMembership(callerLabel) },
         }),
+        ...(ctxDb && { db: regatedDb(ctxDb, ctxDbOutsideTransaction, rawHatch) }),
         ...(ctxSystemDb && {
             systemDb: withSystemDbUnsafeRawGrant(ctxSystemDb, rawHatch, callerLabel),
         }),
     };
 }
-// Re-gates a hook's own ctx.queryAs/ctx.writeAs/ctx.queryProjection/ctx.db/ctx.dbOutsideTransaction/ctx.systemDb instead of inheriting the handler's grant.
+// Re-gates a hook's own ctx.dispatch.*/ctx.auth.resolveActiveMembership/ctx.db (incl. db.outsideTransaction)/ctx.systemDb instead of inheriting the handler's grant.
 export function bindHookEscapeHatchGrant(fn, label, escapeHatch) {
     return ((payload, context) => fn(payload, withHookEscapeHatchGrant(context, label, escapeHatch))); // @cast-boundary engine-bridge — LifecycleHookFn union, same (payload, context) shape at runtime
 }

package/dist/pipeline/typed-append-event.d.ts

@@ -0,0 +1,2 @@
+import type { AppendEventFn, UnsafeAppendEventFn } from "@cosmicdrift/kumiko-types/handlers";
+export declare function asTypedAppendEventFn(append: UnsafeAppendEventFn): AppendEventFn;

package/dist/pipeline/typed-append-event.js

@@ -0,0 +1,4 @@
+// The per-event-type signature is only enforced at the call site; at runtime the payload is validated against the registered schema.
+export function asTypedAppendEventFn(append) {
+    return append; // @cast-boundary engine-bridge
+}

package/dist/pipeline/write-origin.js

@@ -1,5 +1,5 @@
 // The static check in boot-validator/access-declarations.ts only sees a handler's own
-// input schema; writes reached via ctx.write/writeAs/queryAs, hooks or foreign-feature
+// input schema; writes reached via ctx.dispatch.write/writeAs/queryAs, hooks or foreign-feature
 // tables are only visible at the actual write, so the gate runs there at runtime.
 import { isPersonalDataGated } from "@cosmicdrift/kumiko-types/event-store-types";
 import * as z from "zod";
@@ -37,7 +37,7 @@ function declaresPublicIntake(access) {
     return accessAllowsAnonymous(access) && declaredPersonalData(access) === "public-intake";
 }
 // Only the public dispatcher entry points compute a root; every nested call inherits
-// it, so switching identity via ctx.writeAs(SYSTEM, ...) cannot shed an anonymous root.
+// it, so switching identity via ctx.dispatch.writeAs(SYSTEM, ...) cannot shed an anonymous root.
 export function rootWriteOrigin(registry, type, user) {
     const rootHandler = registry.getWriteHandler(type) ?? registry.getQueryHandler(type);
     return {

package/dist/pipeline/write-result-masking.d.ts

@@ -1,4 +1,4 @@
-import type { WriteResult } from "../engine/types/index.ts";
+import type { WriteResult } from "@cosmicdrift/kumiko-types/handlers";
 import type { BatchCommand, BatchResult, DispatchContext } from "./dispatch-shared.ts";
 type EntityLookup = Pick<DispatchContext["registry"], "getHandlerEntity" | "getEntity">;
 export declare function maskWriteResultForClient(registry: EntityLookup, handlerType: string, result: WriteResult): WriteResult;

package/dist/random/index.d.ts

@@ -1,2 +1 @@
-export { type AdjNounNameOptions, type GenerateUniqueNameOptions, generateAdjNounName, generateNoConfusableId, generateUniqueName, } from "./generate.ts";
-export { ADJECTIVES, NOUNS } from "./words.ts";
+export { generateUniqueName } from "./generate.ts";

package/dist/random/index.js

@@ -1,2 +1 @@
-export { generateAdjNounName, generateNoConfusableId, generateUniqueName, } from "./generate.js";
-export { ADJECTIVES, NOUNS } from "./words.js";
+export { generateUniqueName } from "./generate.js";

package/dist/rate-limit/bucket.d.ts

@@ -1,4 +1,5 @@
-import type { PayloadBucketNormalization, RateLimitOption, SessionUser } from "../engine/types/index.ts";
+import type { PayloadBucketNormalization, RateLimitOption } from "@cosmicdrift/kumiko-types/handlers";
+import type { SessionUser } from "../engine/types/index.ts";
 export type BucketContext = {
     readonly handlerName: string;
     readonly user: SessionUser;

package/dist/rate-limit/middleware.js

@@ -1,7 +1,8 @@
 import { isAuthRateLimitExempt } from "../api/api-constants.js";
 import { clientIpSourceFromHonoContext, createClientIpResolver, } from "../api/client-ip.js";
 import { requestContext } from "../api/request-context.js";
-import { RateLimitError, serializeError } from "../errors/index.js";
+import { RateLimitError } from "../errors/index.js";
+import { serializeError } from "../errors/serialize.js";
 import { createFallbackLogger, scrubLogText } from "../logging/index.js";
 import { emitRateLimitFailOpen } from "../observability/standard-metrics.js";
 import { toPublicBucketName } from "./bucket.js";

package/dist/redis/index.d.ts

@@ -1,8 +1,7 @@
-export type { CacheSyncBus, CacheSyncBusOverSignalOptions, ClosableCacheSyncBus, RedisCacheSyncBusOptions, ResolvedCacheSyncBus, } from "./cache-sync-bus.ts";
-export { createCacheSyncBusOverSignal, createDefaultCacheSyncBus, createLocalCacheSyncBus, createRedisCacheSyncBus, resolveCacheSyncBus, } from "./cache-sync-bus.ts";
+export type { CacheSyncBus, ClosableCacheSyncBus, } from "./cache-sync-bus.ts";
+export { createDefaultCacheSyncBus, createLocalCacheSyncBus, createRedisCacheSyncBus, } from "./cache-sync-bus.ts";
 export type { TenantConfigSyncMessage, TierAssignmentSyncMessage } from "./cache-sync-topics.ts";
-export { CACHE_SYNC_TOPICS, isTenantConfigSyncMessage, isTierAssignmentSyncMessage, } from "./cache-sync-topics.ts";
+export { CACHE_SYNC_TOPICS, isTierAssignmentSyncMessage, } from "./cache-sync-topics.ts";
 export type { RedisClientOptions } from "./client.ts";
 export { createRedisClient, logRedisConnectionState, redisChannelPrefixFromEnv, redisClientOptionsFromEnv, } from "./client.ts";
-export type { PubSubSignal, PubSubSignalOptions } from "./pubsub-signal.ts";
 export { createRedisPubSubSignal } from "./pubsub-signal.ts";

package/dist/redis/index.js

@@ -1,4 +1,4 @@
-export { createCacheSyncBusOverSignal, createDefaultCacheSyncBus, createLocalCacheSyncBus, createRedisCacheSyncBus, resolveCacheSyncBus, } from "./cache-sync-bus.js";
-export { CACHE_SYNC_TOPICS, isTenantConfigSyncMessage, isTierAssignmentSyncMessage, } from "./cache-sync-topics.js";
+export { createDefaultCacheSyncBus, createLocalCacheSyncBus, createRedisCacheSyncBus, } from "./cache-sync-bus.js";
+export { CACHE_SYNC_TOPICS, isTierAssignmentSyncMessage, } from "./cache-sync-topics.js";
 export { createRedisClient, logRedisConnectionState, redisChannelPrefixFromEnv, redisClientOptionsFromEnv, } from "./client.js";
 export { createRedisPubSubSignal } from "./pubsub-signal.js";

package/dist/schema-cli/apply-command.js

@@ -4,7 +4,7 @@ import { createRegistry } from "../engine/registry.js";
 import { createEventsTable } from "../event-store/index.js";
 import { queueRebuildsFromMarkers, reportPendingRebuildRun, runPendingRebuilds, } from "../migrations/index.js";
 import { createEventConsumerStateTable, createProjectionStateTable } from "../pipeline/index.js";
-import { migrationsDirExistsOrReport, readDatabaseUrlOrReport, } from "./shared.js";
+import { loadRowLevelSecurityModeOrReport, migrationsDirExistsOrReport, readDatabaseUrlOrReport, } from "./shared.js";
 async function ensureFrameworkInfrastructureTables(db) {
     // Framework infrastructure tables (event store + pipeline state) are not captured by
     // `generate`, which handles only entity read tables. Existing databases have them
@@ -52,7 +52,10 @@ export async function runApplyCommand(ctx) {
         return 1;
     if (!migrationsDirExistsOrReport(ctx))
         return 1;
-    const { db, close } = createDbConnection({ url: dbUrl });
+    const rowLevelSecurity = await loadRowLevelSecurityModeOrReport(ctx);
+    if (rowLevelSecurity === undefined)
+        return 1;
+    const { db, close } = createDbConnection({ url: dbUrl, rowLevelSecurity });
     let wiring;
     try {
         const result = await runMigrationsFromDir(db, migrationsDir);

package/dist/schema-cli/baseline-command.js

@@ -1,4 +1,5 @@
-import { baselineMigrations, createDbConnection, loadMigrationsFromDir } from "../db/index.js";
+import { createDbConnection } from "../db/index.js";
+import { baselineMigrations, loadMigrationsFromDir } from "../db/migrate-runner.js";
 import { describeThrown, migrationsDirExistsOrReport, readDatabaseUrlOrReport, } from "./shared.js";
 export async function runBaselineCommand(ctx) {
     const { out, migrationsDir } = ctx;
@@ -10,7 +11,11 @@ export async function runBaselineCommand(ctx) {
         return 1;
     if (!migrationsDirExistsOrReport(ctx))
         return 1;
-    const { db, close } = createDbConnection({ url: dbUrl, maxConnections: 1 });
+    const { db, close } = createDbConnection({
+        url: dbUrl,
+        maxConnections: 1,
+        rowLevelSecurity: "off", // journal-only tool: touches no tenant rows
+    });
     try {
         const result = await baselineMigrations(db, loadMigrationsFromDir(migrationsDir));
         out.log("");

package/dist/schema-cli/generate-command.js

@@ -1,6 +1,9 @@
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { assertValidMigrationName, generateMigration, readMigrationSqlTexts, rebuildTablesFromDiff, writeRebuildMarker, writeSnapshotJson, } from "../db/index.js";
+import { generateMigration, writeSnapshotJson } from "../db/index.js";
+import { assertValidMigrationName, hasNoSchemaChanges } from "../db/migrate-generator.js";
+import { readMigrationSqlTexts } from "../db/migrate-runner.js";
+import { rebuildTablesFromDiff, writeRebuildMarker } from "../db/rebuild-marker.js";
 import { describeThrown, loadPreviousSnapshot, loadSchemaModOrReport, nextSequenceNumber, SNAPSHOT_FILENAME, } from "./shared.js";
 const GENERATE_USAGE = "  Usage: schema generate <name>";
 function parseGenerateName(ctx) {
@@ -35,12 +38,6 @@ function parseGenerateName(ctx) {
     }
     return { kind: "name", name };
 }
-function isEmptyMigration(result) {
-    return (result.diff.newTables.length === 0 &&
-        result.diff.changedTables.length === 0 &&
-        result.diff.droppedTables.length === 0 &&
-        result.retiredDrops.length === 0);
-}
 function writeMigrationFiles(migrationsDir, snapshotPath, result) {
     if (!existsSync(migrationsDir))
         mkdirSync(migrationsDir, { recursive: true });
@@ -50,7 +47,7 @@ function writeMigrationFiles(migrationsDir, snapshotPath, result) {
 function reportGeneratedMigration(out, result, rebuildTables) {
     out.log("");
     out.log(`  ✓ ${result.filename}`);
-    out.log(`    new tables: ${result.diff.newTables.length}, changed: ${result.diff.changedTables.length}, dropped: ${result.diff.droppedTables.length}, retired framework tables dropped: ${result.retiredDrops.length}`);
+    out.log(`    new tables: ${result.diff.newTables.length}, changed: ${result.diff.changedTables.length}, dropped: ${result.diff.droppedTables.length}, retired framework tables dropped: ${result.retiredDrops.length}, row level security changes: ${result.rowLevelSecurityChanges.length}`);
     if (rebuildTables.length > 0) {
         out.log(`    rebuild-marker: ${result.filename.replace(/\.sql$/, ".rebuild.json")} (${rebuildTables.length} table(s))`);
     }
@@ -70,12 +67,13 @@ export async function runGenerateCommand(ctx) {
     const prevSnapshot = loadPreviousSnapshot(snapshotPath);
     const result = generateMigration({
         metas: schemaMod.entityMetas,
+        rowLevelSecurity: schemaMod.rowLevelSecurity,
         prevSnapshot,
         name: parsed.name,
         sequenceNumber: nextSequenceNumber(migrationsDir),
         priorMigrationsSql: readMigrationSqlTexts(migrationsDir),
     });
-    if (isEmptyMigration(result)) {
+    if (hasNoSchemaChanges(result)) {
         out.log("  No schema changes detected — no new migration file written.");
         return 0;
     }

package/dist/schema-cli/shared.d.ts

@@ -1,10 +1,16 @@
 import { type renderTablesDdl } from "../db/index.ts";
+import { type RowLevelSecurityMode } from "../db/render-rls-ddl.ts";
 import type { FeatureDefinition } from "../engine/types/feature.ts";
 export type SchemaCliOut = {
     readonly log: (line: string) => void;
     readonly err: (line: string) => void;
 };
-export type RunSchemaCliOptions = {
+type RunSchemaCliRowLevelSecurityOption = {
+    /** The mode the app's runtime boots with (`AppConfig.rowLevelSecurity`). Wins over the schema
+     *  file, so `apply` heals the same mode the boot check enforces. */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
+};
+export type RunSchemaCliOptions = RunSchemaCliRowLevelSecurityOption & ({
     readonly features?: undefined;
     readonly kmsSlots?: undefined;
 } | {
@@ -16,7 +22,7 @@ export type RunSchemaCliOptions = {
      *  `[]` when the app wires none. This CLI parses no env schema, so the
      *  rebuild's KMS wiring cannot derive them itself. */
     readonly kmsSlots: readonly string[];
-};
+});
 export type SchemaCliContext = {
     readonly argv: readonly string[];
     readonly out: SchemaCliOut;
@@ -30,10 +36,14 @@ export type SchemaMod = {
     readonly entityMetas: Parameters<typeof renderTablesDdl>[0];
     readonly features?: unknown;
     readonly validateBootOptions?: unknown;
+    readonly rowLevelSecurity: RowLevelSecurityMode;
 };
+export declare function parseSchemaRowLevelSecurity(value: unknown, schemaFile: string): RowLevelSecurityMode;
 export declare function describeThrown(e: unknown): string;
 export declare function nextSequenceNumber(migrationsDir: string): number;
 export declare function loadPreviousSnapshot(snapshotPath: string): import("../db/migrate-generator.ts").Snapshot | null;
 export declare function loadSchemaModOrReport(ctx: SchemaCliContext): Promise<SchemaMod | undefined>;
+export declare function loadRowLevelSecurityModeOrReport(ctx: SchemaCliContext): Promise<RowLevelSecurityMode | undefined>;
 export declare function readDatabaseUrlOrReport(out: SchemaCliOut): string | undefined;
 export declare function migrationsDirExistsOrReport(ctx: SchemaCliContext): boolean;
+export {};

package/dist/schema-cli/shared.js

@@ -7,10 +7,20 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { existsSync, readdirSync } from "node:fs";
-import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import { assertUniqueTableNames, loadSnapshotJson } from "../db/index.js";
+import { isOneOf, isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { loadSnapshotJson } from "../db/index.js";
+import { assertUniqueTableNames } from "../db/migrate-generator.js";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE, ROW_LEVEL_SECURITY_MODES, } from "../db/render-rls-ddl.js";
 import { isEntityTableMeta } from "../db/table-introspection.js";
 export const SNAPSHOT_FILENAME = ".snapshot.json";
+// An absent export means the default mode; a typo must not silently switch tenant isolation off.
+export function parseSchemaRowLevelSecurity(value, schemaFile) {
+    if (value === undefined)
+        return DEFAULT_ROW_LEVEL_SECURITY_MODE;
+    if (isOneOf(ROW_LEVEL_SECURITY_MODES, value))
+        return value;
+    throw new Error(`Schema file ${schemaFile}: ROW_LEVEL_SECURITY must be one of ${ROW_LEVEL_SECURITY_MODES.join(", ")}, got ${String(value)}.`);
+}
 export function describeThrown(e) {
     return e instanceof Error ? e.message : String(e);
 }
@@ -43,6 +53,7 @@ async function loadSchemaModFromApp(schemaFile) {
         entityMetas: validMetas,
         features: mod["FEATURES"],
         validateBootOptions: mod["VALIDATE_BOOT_OPTIONS"],
+        rowLevelSecurity: parseSchemaRowLevelSecurity(mod["ROW_LEVEL_SECURITY"], schemaFile),
     };
 }
 export function nextSequenceNumber(migrationsDir) {
@@ -79,6 +90,17 @@ export async function loadSchemaModOrReport(ctx) {
         return undefined;
     }
 }
+// `apply` needs only the mode: migrations and rebuilds on a role that RLS binds see nothing unless
+// the connection runs in system scope, which only an "on" connection sets. The prod image ships no
+// kumiko/schema.ts, so without one apply falls back to the runtime's default instead of "off":
+// otherwise the framework tables stay unhealed and the boot check of an "on" app fails.
+export async function loadRowLevelSecurityModeOrReport(ctx) {
+    if (ctx.options.rowLevelSecurity !== undefined)
+        return ctx.options.rowLevelSecurity;
+    if (!existsSync(ctx.schemaFile))
+        return DEFAULT_ROW_LEVEL_SECURITY_MODE;
+    return (await loadSchemaModOrReport(ctx))?.rowLevelSecurity;
+}
 export function readDatabaseUrlOrReport(out) {
     const dbUrl = process.env["DATABASE_URL"];
     if (!dbUrl) {

package/dist/schema-cli/status-command.js

@@ -1,6 +1,8 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { createDbConnection, fetchAppliedMigrations, findCommentedDropTables, isRetiredFrameworkTable, loadMigrationsFromDir, readMigrationSqlTexts, tableExists, } from "../db/index.js";
+import { createDbConnection, tableExists } from "../db/index.js";
+import { fetchAppliedMigrations, loadMigrationsFromDir, readMigrationSqlTexts, } from "../db/migrate-runner.js";
+import { findCommentedDropTables, isRetiredFrameworkTable, } from "../db/retired-framework-tables.js";
 import { describeThrown, loadPreviousSnapshot, readDatabaseUrlOrReport, SNAPSHOT_FILENAME, } from "./shared.js";
 // A table that a migration only drops as a commented DESTRUCTIVE marker and
 // that the snapshot no longer has is gone on paper but still in the live DB.
@@ -42,7 +44,11 @@ export async function runStatusCommand(ctx) {
         return 0;
     }
     const local = loadMigrationsFromDir(migrationsDir);
-    const { db, close } = createDbConnection({ url: dbUrl, maxConnections: 1 });
+    const { db, close } = createDbConnection({
+        url: dbUrl,
+        maxConnections: 1,
+        rowLevelSecurity: "off", // journal-only tool: touches no tenant rows
+    });
     try {
         const applied = await fetchAppliedMigrationIds(db);
         out.log("");

package/dist/schema-cli/validate-command.js

@@ -1,6 +1,9 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { diffReplayAgainstSnapshot, generateMigration, readMigrationSqlTexts, replayMigrationsDir, } from "../db/index.js";
+import { assertRowLevelSecurityTableState, createDbConnection, generateMigration, } from "../db/index.js";
+import { isLiveFrameworkTable } from "../db/known-table-names.js";
+import { readMigrationSqlTexts } from "../db/migrate-runner.js";
+import { diffReplayAgainstSnapshot, replayMigrationsDir } from "../db/replay-migration-sql.js";
 import { validateBoot } from "../engine/boot-validator.js";
 import { describeThrown, loadPreviousSnapshot, loadSchemaModOrReport, nextSequenceNumber, SNAPSHOT_FILENAME, } from "./shared.js";
 import { featureDefinitionsOf, parseValidateBootOptions, withFileStoragePresence, } from "./validate-boot-input.js";
@@ -9,6 +12,7 @@ function checkSchemaDrift(ctx, schemaMod, prevSnapshot) {
     const { out, migrationsDir } = ctx;
     const drift = generateMigration({
         metas: schemaMod.entityMetas,
+        rowLevelSecurity: schemaMod.rowLevelSecurity,
         prevSnapshot,
         name: "validate",
         sequenceNumber: nextSequenceNumber(migrationsDir),
@@ -19,13 +23,14 @@ function checkSchemaDrift(ctx, schemaMod, prevSnapshot) {
         ...drift.diff.changedTables.map((t) => t.tableName),
         ...drift.diff.droppedTables,
         ...drift.retiredDrops.map((t) => t.tableName),
+        ...drift.rowLevelSecurityChanges.map((c) => c.tableName),
     ];
     if (pendingTables.length === 0) {
         out.log("  ✓ schema: migrations match the entity definitions");
         return true;
     }
     out.err("  ✗ schema drift: entity definitions are ahead of kumiko/migrations.");
-    out.err(`    pending — new: ${drift.diff.newTables.length}, changed: ${drift.diff.changedTables.length}, dropped: ${drift.diff.droppedTables.length}`);
+    out.err(`    pending — new: ${drift.diff.newTables.length}, changed: ${drift.diff.changedTables.length}, dropped: ${drift.diff.droppedTables.length}, row level security: ${drift.rowLevelSecurityChanges.length}`);
     out.err(`    tables: ${pendingTables.join(", ")}`);
     out.err("    Fix: `kumiko-schema generate <name>`, then commit the migration.");
     return false;
@@ -57,6 +62,42 @@ function checkBootValidity(out, schemaMod) {
         return false;
     }
 }
+function declaredTablesOf(schemaMod) {
+    const names = new Set(schemaMod.entityMetas.map((meta) => meta.tableName));
+    return { has: (tableName) => names.has(tableName) || isLiveFrameworkTable(tableName) };
+}
+// 4. Live row-level security table state — the table half of the boot check. Only with a DATABASE_URL;
+// without one the command stays database-free. Scoped to the tables kumiko/schema.ts declares plus the
+// framework tables, because a local DATABASE_URL may point at a dev database several apps share.
+async function checkLiveRowLevelSecurity(out, schemaMod) {
+    const dbUrl = process.env["DATABASE_URL"];
+    if (!dbUrl) {
+        out.log("  · row-level security: skipped — set DATABASE_URL to check the live database.");
+        return true;
+    }
+    const { db, close } = createDbConnection({
+        url: dbUrl,
+        maxConnections: 1,
+        rowLevelSecurity: schemaMod.rowLevelSecurity,
+    });
+    try {
+        await assertRowLevelSecurityTableState(db, schemaMod.rowLevelSecurity, declaredTablesOf(schemaMod), "declared tables");
+        out.log("  ✓ row-level security: live database matches the configured mode for this app's tables and the framework tables (tables of other apps sharing the database are not checked)");
+        return true;
+    }
+    catch (e) {
+        out.err(`  ✗ row-level security: ${describeThrown(e)}`);
+        return false;
+    }
+    finally {
+        try {
+            await close();
+        }
+        catch {
+            // The check result is already reported; a failing close must not hide it.
+        }
+    }
+}
 function reportMigrationContentMismatches(out, mismatches) {
     out.err("  ✗ migration-content drift: committed *.sql files don't produce .snapshot.json.");
     for (const m of mismatches) {
@@ -72,7 +113,7 @@ function reportMigrationContentMismatches(out, mismatches) {
             "job-run-log store table for the pattern.");
     }
     if (mismatches.some((m) => m.kind !== "unexpected-table")) {
-        out.err("    Fix (missing-table/column-drift): a migration file's body doesn't match " +
+        out.err("    Fix (missing-table/column-drift/row-level-security-drift): a migration file's body doesn't match " +
             "what it (or the snapshot) claims — hand-fix the file, or ship a corrective " +
             "migration if it's already applied in prod.");
     }
@@ -117,6 +158,8 @@ function checkMigrationContentDrift(ctx, prevSnapshot) {
 //      Layer 1 alone misses this: it only compares ENTITY_METAS to the
 //      snapshot, never the snapshot to the SQL that's supposed to have
 //      produced it.
+//   4. live row-level security (only with DATABASE_URL): the boot's
+//      table-state check against the real database (not the role: that is a boot-time property).
 // The DB-level gate (assertKumikoSchemaCurrent) stays at boot/deploy.
 export async function runValidateCommand(ctx) {
     const schemaMod = await loadSchemaModOrReport(ctx);
@@ -126,5 +169,6 @@ export async function runValidateCommand(ctx) {
     const schemaOk = checkSchemaDrift(ctx, schemaMod, prevSnapshot);
     const bootOk = checkBootValidity(ctx.out, schemaMod);
     const migrationsOk = checkMigrationContentDrift(ctx, prevSnapshot);
-    return schemaOk && bootOk && migrationsOk ? 0 : 1;
+    const rowLevelSecurityOk = await checkLiveRowLevelSecurity(ctx.out, schemaMod);
+    return schemaOk && bootOk && migrationsOk && rowLevelSecurityOk ? 0 : 1;
 }

package/dist/schema-cli.d.ts

@@ -1,5 +1,4 @@
 import type { RunSchemaCliOptions, SchemaCliOut } from "./schema-cli/shared.ts";
-export type { RunSchemaCliOptions, SchemaCliOut } from "./schema-cli/shared.ts";
 /**
  * Runs a schema-CLI subcommand. `appCwd` is the app workspace root (where
  * `kumiko/schema.ts` + `kumiko/migrations/` live). Returns a process exit code.

package/dist/search/configure-tenant-index.d.ts

@@ -1,4 +1,2 @@
-import type { Registry, TenantId } from "../engine/types/index.ts";
-import type { SearchAdapter } from "./types.ts";
+import type { Registry } from "../engine/types/index.ts";
 export declare function collectSearchableFieldNames(registry: Registry): readonly string[];
-export declare function configureTenantSearchIndex(searchAdapter: SearchAdapter, registry: Registry, tenantId: TenantId): Promise<void>;

package/dist/search/configure-tenant-index.js

@@ -2,7 +2,3 @@ import { deriveSearchAdapterConfig } from "./derive-search-adapter-config.js";
 export function collectSearchableFieldNames(registry) {
     return deriveSearchAdapterConfig(registry)?.searchableFields ?? [];
 }
-export async function configureTenantSearchIndex(searchAdapter, registry, tenantId) {
-    const fields = collectSearchableFieldNames(registry);
-    await searchAdapter.configure(tenantId, { searchableFields: fields, rankingFields: fields });
-}

package/dist/search/index.d.ts

@@ -1,7 +1,4 @@
-export { collectSearchableFieldNames, configureTenantSearchIndex, } from "./configure-tenant-index.ts";
-export { deriveSearchAdapterConfig } from "./derive-search-adapter-config.ts";
 export { createInMemorySearchAdapter } from "./in-memory-adapter.ts";
 export { purgeSearchDocumentsForSubject } from "./purge-subject.ts";
-export type { ReindexEntityFailure, ReindexEntityOptions, ReindexEntityResult, } from "./reindex-entity.ts";
 export { reindexEntity } from "./reindex-entity.ts";
-export type { SearchAdapter, SearchAdapterConfig, SearchDocument, SearchOptions, SearchResult, } from "./types.ts";
+export type { SearchAdapter, SearchAdapterConfig, } from "./types.ts";

package/dist/search/index.js

@@ -2,8 +2,6 @@
 // `@cosmicdrift/kumiko-framework/search/meilisearch`. This keeps the main barrel from loading a
 // Meilisearch client when consumers only use SearchAdapter types, so apps that do not use
 // Meilisearch do not pull in the client code.
-export { collectSearchableFieldNames, configureTenantSearchIndex, } from "./configure-tenant-index.js";
-export { deriveSearchAdapterConfig } from "./derive-search-adapter-config.js";
 export { createInMemorySearchAdapter } from "./in-memory-adapter.js";
 export { purgeSearchDocumentsForSubject } from "./purge-subject.js";
 export { reindexEntity } from "./reindex-entity.js";

package/dist/search/meilisearch-adapter-internals.d.ts

@@ -0,0 +1,8 @@
+import type { EntityId, TenantId } from "../engine/types/identifiers.ts";
+export type MeilisearchAdapterOptions = {
+    url: string;
+    apiKey: string;
+    indexPrefix?: string;
+};
+export declare function meilisearchTenantIndex(prefix: string, tenantId: TenantId): string;
+export declare function meilisearchDocId(entityType: string, entityId: EntityId): string;