@cosmicdrift/kumiko-framework 0.389.0 → 0.390.1

package/src/changes.json

@@ -1,4 +1,240 @@
 [
+  {
+    "version": "0.390.1",
+    "type": "fix",
+    "title": "schema apply in the production image uses the runtime's row-level security mode",
+    "detail": "The app image ships only kumiko/migrations, not kumiko/schema.ts. Without the schema file `schema apply` ran with row-level security \"off\", so kumiko_events, kumiko_snapshots and kumiko_archived_streams were not healed and the boot of an app in \"on\" mode (the default) failed with \"framework tables without it\". Without a schema file apply now uses the same default as runProdApp. RunSchemaCliOptions takes an optional rowLevelSecurity, which wins over the schema file; the scaffolded bin/kumiko.ts passes appConfig.rowLevelSecurity, like bin/main.ts does for runProdApp. Apps that do not set rowLevelSecurity need no change. An app that sets rowLevelSecurity \"off\" and keeps a hand-written bin/kumiko.ts must pass rowLevelSecurity: \"off\" to runSchemaCli, otherwise apply enables row-level security on the framework tables and the app's \"off\" boot check fails."
+  },
+  {
+    "version": "0.390.1",
+    "type": "fix",
+    "title": "Projection rebuilds no longer report drift on timestamptz columns",
+    "detail": "Event payloads keep the microseconds of an instant, the live write stores milliseconds. A rebuild bound the payload's ISO string unchanged and wrote a different value, which the shadow diff reported as column drift. ISO instant strings bound to a timestamptz column are now truncated to milliseconds like Temporal.Instant values."
+  },
+  {
+    "version": "0.390.1",
+    "type": "improvement",
+    "title": "The live row-level security check of `kumiko check` covers only the app's own tables",
+    "detail": "`schema validate` (the boot step of `kumiko check`) checks the live database when DATABASE_URL is set. On a dev database several apps share it failed on the other apps' tables. It now checks the tables kumiko/schema.ts declares plus the framework tables; tables no feature declares any more are still reported by the boot check, which runs against the app's own database. An unreachable database still fails the check."
+  },
+  {
+    "version": "0.390.1",
+    "type": "fix",
+    "title": "kumiko-upgrade runs the codemods of its own feature-ast install",
+    "detail": "The kumiko-upgrade bins of kumiko-cli and kumiko-dev-server now look for the codemod scripts from their own package first, so a feature-ast copy hoisted above the app (for example in a workspace parent) can no longer supply codemods of another version. runUpgradeCli takes an optional codemodResolveFrom for that; without it the search still starts at the repo root."
+  },
+  {
+    "version": "0.390.1",
+    "type": "fix",
+    "title": "zod range moved to ^4.6.7",
+    "detail": "All framework packages and the scaffold template require zod ^4.6.7, which fixes GHSA-MRHX-C7XC-M3W5."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Parallel writes in one handler no longer abort the transaction",
+    "detail": "Bun.SQL does not serialize savepoints on a transaction. A handler that started several executor writes on ctx.db with Promise.all opened overlapping savepoints, the first RELEASE also released its neighbours, and the next one aborted the whole transaction with a 500. runInSavepoint and runInSavepointIfSupported now queue savepoints per transaction (proxy runners over the same transaction share one queue, savepoints opened from inside a running one still nest), and an executor verb on a handler transaction now runs in its own savepoint: when it fails, its event append, projection and hooks roll back together, also when the handler catches the failure, so no event without projection is left behind and a rebuild replays cleanly. Postgres errors 22007 and 22008 (a date or time value the column rejects, such as 2026-02-30) now map to a 400 validation_error instead of a 500, on writes and on query filters."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "HandlerContext without wiring, hooks receive the HandlerContext",
+    "detail": "HandlerContext has 19 members and no longer carries the AppContext wiring. ctx.services holds redis, cacheSync, jobRunner, searchAdapter, entityCache, secrets, kms, files, derivatives, configResolver, configEncryption, rateLimit, effectiveFeatures and masterKeyProvider; every key of an app's extraContext that the framework does not know now lives in ctx.services.extensions (it used to sit flat on the context through a spread, invisible to tsc). ctx.lifecycle holds afterCommit and afterRollback (replacing scheduleAfterCommit and scheduleAfterRollback), signal and runPreSave. ctx.tenants holds config (replacing configFor) and writeTarget (replacing forTenant). ctx.obs gains meter, and the flat log, tracer, _tenantId, systemUser and triggeredBy are gone; read ctx.user.tenantId and ctx.obs.log. JobContext no longer extends the shared wiring fields; it gets services and lifecycle.signal and keeps systemUser, triggeredBy and its job fields. All hooks (preSave, postSave, postSaveBatch, preDelete, postDelete, postDeleteBatch, preQuery, postQuery) and the system hook definitions receive the HandlerContext instead of the AppContext, and the batch hooks run on a real handler context built per flush. AppContext stays the flat boot wiring and declares services as never, so a handler or job context can no longer be passed to a function that takes an AppContext. The context of beforeTransaction no longer exposes ctx.systemDb.outsideTransaction, which was a hole next to the denied ctx.db.outsideTransaction. The member-resolution and pre-transaction contexts also drop the notify factories from ctx.services, and member resolution drops _fileProviderResolver, so neither can rebuild the denied notify or file storage. Helpers that took a structural context with an optional flat member read undefined once a handler context stopped carrying it; their shapes now make that a type error: requireSecretsContext, FileProviderContext (createFileProviderForTenant) and MailTransportContext (createTransportForTenant) take a required secrets key (handlers pass { secrets: ctx.services.secrets, user: ctx.user }), and CreateFileRefContext/UploadFileBytesContext read services.files, so a handler or job context passes straight in. bridgeStub accepts a services option.",
+    "migration": "Run kumiko-upgrade --apply; it runs the ctx-namespaces codemod. It rewrites ctx.redis, cacheSync, jobRunner, searchAdapter, entityCache, secrets, kms, files, derivatives, configResolver, effectiveFeatures and the other service members to ctx.services.*, scheduleAfterCommit and scheduleAfterRollback to ctx.lifecycle.afterCommit and afterRollback, signal to ctx.lifecycle.signal, configFor and forTenant to ctx.tenants.config and writeTarget, and hook parameters annotated AppContext to HandlerContext, including context.log to context.obs.log in the hook body. Keys of your extraContext that you read through a cast move to ctx.services.extensions. Listed for manual review: ctx.systemUser, ctx.triggeredBy and ctx._tenantId on a HandlerContext (read ctx.user), a handler or job context passed to a function that takes an AppContext (narrow that parameter to the members it reads), spread literals next to moved members, and a handler or job context passed to a parameter whose structural type reads a moved member (it would read undefined without a type error). Hand-built test contexts take services, lifecycle and tenants from bridgeStub({ services }).",
+    "codemod": "scripts/codemod/ctx-namespaces.ts"
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "HandlerContext and JobContext use namespaces instead of flat members",
+    "detail": "The roughly 40 flat members of HandlerContext are grouped by purpose, with no deprecated aliases. ctx.db.outsideTransaction replaces ctx.dbOutsideTransaction and ctx.outsideTransaction (the property is non-enumerable and sits on the same db object, so TenantDb identity stays intact; it is undefined in the member-resolution and before-transaction phases and in platform-metering tenant mode). ctx.events holds append, unsafeAppend, tryAppend, fetchForWriting, load, archive, restore, isArchived, snapshot and loadWithSnapshot. ctx.dispatch holds query, queryAs, write, writeAs, queryAsMember and queryProjection. ctx.auth holds resolveClaims and resolveActiveMembership. ctx.obs holds log, tracer, metrics and metricsFor, and ctx.obs.log is now always a Logger. JobContext gets the subsets events.append, dispatch.write/writeAs/queryAs/queryAsMember and obs.log/metricsFor. reserveBeforeTransaction and beforeTransaction receive the new ReservationContext and BeforeTransactionContext types, so the surfaces they deny no longer exist on the type. The deprecated _configAccessorFactory alias is removed; use configAccessorFactory. The cap-counter resolvers and the template-resolver PrepareContext now take ReservationContext instead of HandlerContext (type-level break for callers passing a full HandlerContext-typed value to a narrower position, and for wrappers declaring the old type). attachOutsideTransaction(db, outsideDb) from @cosmicdrift/kumiko-framework/engine gives hand-built contexts a db.outsideTransaction; it mutates the passed db with a non-enumerable property (Object.defineProperty) and returns the same object. bridgeStub now accepts log and dispatch options. AppContext stays flat, and the context handed to postSave, preDelete, postDelete and postQuery hooks still reads context.log; a separate hook context follows in a later release.",
+    "migration": "Run kumiko-upgrade --apply; it runs the ctx-namespaces codemod. It rewrites ctx.dbOutsideTransaction and ctx.outsideTransaction to ctx.db.outsideTransaction, ctx.appendEvent/unsafeAppendEvent/tryAppendEvent/fetchForWriting/loadAggregate/archiveStream/restoreStream/isStreamArchived/snapshotAggregate/loadAggregateWithSnapshot to ctx.events.append/unsafeAppend/tryAppend/fetchForWriting/load/archive/restore/isArchived/snapshot/loadWithSnapshot, ctx.query/queryAs/write/writeAs/queryAsMember/queryProjection to ctx.dispatch.*, ctx.resolveAuthClaims/resolveActiveMembership to ctx.auth.resolveClaims/resolveActiveMembership, and ctx.log/tracer/metrics/metricsFor to ctx.obs.*. Object literals typed as HandlerContext or JobContext (test mocks) are nested the same way. Sites the codemod cannot resolve are listed for manual review: spread literals, untyped receivers, and AppContext reads such as context.log in hooks, which stay as they are. Manual pattern { db: someDb, dbOutsideTransaction: x } becomes db: attachOutsideTransaction(someDb, x). Spread calls such as ...bridgeStub() next to moved members are reworked by hand; pass log/dispatch as bridgeStub options. Rename _configAccessorFactory to configAccessorFactory where you set it on an AppContext.",
+    "codemod": "scripts/codemod/ctx-namespaces.ts"
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "Feature AST, pattern library and codemods moved to @cosmicdrift/kumiko-feature-ast",
+    "detail": "Feature AST, pattern library and codemods moved to the new package @cosmicdrift/kumiko-feature-ast; kumiko-upgrade heals stale open lines in CHANGELOG.md",
+    "migration": "Import these names from @cosmicdrift/kumiko-feature-ast instead of @cosmicdrift/kumiko-framework/engine: AddEntityArgs, AddHookArgs, AddRelationArgs, AddWriteHandlerArgs, FeaturePatcher, FeaturePattern, FeaturePatternKind, FormFieldLabel, FormFieldSpec, FormInputType, HandlerHeaderUpdate, ParseError, ParseResult, PatternCategory, PatternChange, PatternChangeIssue, PatternChangesParseResult, PatternFormSchema, PatternId, RenderFeatureFileInput, SourceLocation, PATTERN_LIBRARY, VERSION_HEADER, addPattern, applyChanges, createFeaturePatcher, getPatternSchema, groupByCategory, parseFeatureFile, parsePatternChanges, parseSourceFile, removePattern, renderFeatureFile, renderPattern, replacePattern, updatePattern. Import CodemodOptions, CodemodReport, CodemodResult, FileAnalysis, ParsedHandlerInfo, analyzeFile, analyzeHandlerArrow, convertFile, generatePerformBlock, runCodemod, scanForCandidates from @cosmicdrift/kumiko-feature-ast/codemod instead of @cosmicdrift/kumiko-framework/engine/codemod. Add @cosmicdrift/kumiko-feature-ast to the dependencies of the importing package; the codemod does both. @cosmicdrift/kumiko-framework no longer installs ts-morph.",
+    "codemod": "scripts/codemod/feature-ast-package.ts"
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "kumiko-upgrade --apply and --resolve heal stale open lines in CHANGELOG.md",
+    "migration": "Every manual migration the upgrade marker lists as resolved gets its status in CHANGELOG.md, including `- [open]` lines in older sections left behind by a resolve with an older CLI."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "allAppFeatures documents that its list is raw",
+    "detail": "The JSDoc of allAppFeatures says the list has no bundled foundation and that tooling such as runSchemaCli takes FEATURES from kumiko/schema. Behavior is unchanged."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "Jobs append their own events with ctx.events.append",
+    "detail": "Jobs no longer need escapeHatch or unsafeRaw plus the low-level event-store API to append their own feature's events. The same ownership and schema rules apply as in write handlers, and the append runs in its own transaction together with the inline projections.",
+    "migration": "JobContext has a new required field events.append. Code that builds a JobContext object by hand (boot seeds, test fixtures) and does not spread bridgeStub() adds an events.append that throws when the code under test never appends. Jobs that appended their own feature's events through escapeHatch or unsafeRaw switch to ctx.events.append({ type, aggregateId, aggregateType, payload })."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "Jobs see whether they can still defer (ctx.canDefer)",
+    "detail": "ctx.canDefer is false when the run is inline or the maxDefers budget is used up, so a handler can write its terminal state instead of deferring into an UnrecoverableError. Behaviour of ctx.defer and the maxDefers failure is unchanged.",
+    "migration": "JobContext has a new required field canDefer. Code that builds a JobContext object by hand (boot seeds, test fixtures) adds `canDefer: false` unless the context really supports ctx.defer. Contexts built by the job runner or cast with `as unknown as JobContext` need no change."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "meilisearch is an optional peer dependency",
+    "migration": "Apps that import @cosmicdrift/kumiko-framework/search/meilisearch add meilisearch to their own dependencies (bun add meilisearch@^0.58.0); without it that import fails at boot with a message that names the package. Apps without the Meilisearch adapter need nothing."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "Framework subpaths no longer export names without a user",
+    "detail": "A name stays exported from a subpath of @cosmicdrift/kumiko-framework only if at least one consumer outside packages/framework imports it from that subpath (other Kumiko packages, samples, the framework docs, kumiko-enterprise, kumiko-platform, kumiko-studio and the seven apps). Names added since 0.389.0 stay public. 1236 names had no user and are removed from their subpath; 30 of them are deleted together with their code and tests, the rest stay inside the framework as internal modules without a public export. The public-exports baseline keeps the new, smaller surface. Removed names per subpath:\n./compliance: AuthorityNotificationDeadline, BundleTier, OVERRIDABLE_PROFILE_KEYS, RetentionSpec, UserNotificationRequiredPolicy, describeDurationSpec, durationSpecToMs\n./config: AppClientConfig, AppPortEntry\n./es-ops: CreateSeedMigrationContextArgs, EsOperationAppliedBy, EsOperationType, RunPendingSeedMigrationsArgs, RunPendingSeedMigrationsResult, SeedMembershipRow, SeedTemplateResourceFilter, SeedTemplateResourceRow, SeedTenantRow, SeedUserRow\n./engine: ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, App, AppConfig, AppendEventArgs, AppendEventFn, AssignableFromRole, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BuildAppSchemaOptions, BuildManifestOptions, BuiltinQnType, CamelToKebab, CardMetaOverflow, ChangelogType, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClampInfo, ConcurrencyMode, ConcurrencyModes, ConfigBacking, ConfigDefinition, ConfigFeatureSchema, ConfigKeyAccess, ConfigMask, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, CreateEventDefOptions, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCurrencyFormat, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EXTENSION_SELECTOR_HINT_KEY, EditExtensionSection, EditFieldPrefill, EditFieldsSection, EditLayout, EmbeddedListEditSpec, EmitCtx, EntityCrudRegistrar, EntityEditAction, EntityEditActionPlacement, EntityListExpandableRow, EntityObjectDefinition, EntityRef, EntityRelations, EscapeHatchReporter, EscapeHatchTarget, ExpandableRowGrouping, FeatureChangelog, FieldAccess, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormDerivationScreen, FormWidth, FormatSpec, HANDLER_FIELD_REFERENCES_META_KEY, HandlerFieldPathSegment, HandlerFieldReference, HandlerFieldReferenceAtPath, HandlerFieldReferenceMeta, HasManyRelation, HookDefinition, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobTriggerEvent, KumikoEntityTypeMap, KumikoExtensionName, KumikoHandlerPayloadMap, KumikoHandlerResultMap, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MessageKind, MetricSpec, MspErrorPolicy, MultiSelectFieldDef, NameOrRef, NotificationDataFn, NotificationRecipientFn, NotificationTemplateFn, NotifyDeferred, NumberFieldDef, OnDeleteStrategies, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, OwnershipClause, OwnershipRef, OwnershipRule, PagedListRequest, PagedListRowValue, ParentRefDef, ParsedQn, ParsedRefTarget, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PipelineBuildCtx, PipelineDef, PlatformComponent, PluralForms, PreQueryHookFn, PreparedWriteEvent, ProjectionTable, QnType, QualifiedEventName, QueryHandlerFn, RecordHeaderSpec, RecordHeaderSubtitlePart, RegisterEntityCrudOptions, ResolveOptions, RowActionNavigate, RowActionNavigateBase, RowFieldExtractor, SETTINGS_HUB_WORKSPACE, SUSPEND_SENTINEL, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUserOrigin, StackBootRequirement, StepBuilder, StepDef, StepFailureStrategy, StepKind, StepListOutcome, StepNamespace, StorageProviderExtensionHooks, StreamHandlerDefinition, StreamHandlerFn, Subscribe, SystemHookName, SystemHookNames, SystemHookPriorities, TENANT_TEARDOWN_STATUSES, TemplateImagesVariableDef, TenantDataExtensionHooks, TenantResourceExtensionHooks, TextFieldDef, TranslationValue, TranslationsDef, TreeActionsHandle, TreeNodeState, UnavailableSelectOption, UnsafeAppendEventFn, UserDataExtensionHooks, UserDataExtensionOptions, WorkflowInput, WorkflowTrigger, applyFormDerivations, availableSelectOptions, buildOwnershipClause, buildTarget, checkWriteFieldOwnership, checkWriteFieldRoles, combineClauses, createApp, createEventDef, createUserSeed, findUnavailableSelectOptions, formDerivationsOfSchema, handlerFieldReferences, isExtensionEditSection, isForbiddenMembershipRole, isFormDerivationInputMode, isPagedQueryHandler, isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, isWriteFormEditSection, listStepKinds, qualifyTranslationKey, readHandlerFieldReferences, resolveConfigOrParam, resolveName, runValidation, runsInLane, sortEntries, stripForbiddenMembershipRoles, tenantOverrideDenied, userCanCreateFieldRow, userCanReadFieldRow, userCanWriteFieldRow, validateChangelog\n./engine/types: AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AnyFileFieldDef, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BootCheckContext, BootCheckFn, BootOptionName, BundledListsOptions, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ClientDerivedFieldDef, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigBounds, ConfigCascade, ConfigCascadeLevel, ConfigComputedContext, ConfigComputedFn, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DEFAULT_CURRENCIES, DEFAULT_LOCALES, DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelGate, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeclarativeEventMigration, DefaultCurrency, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, DispatchWriteRef, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedDerivedCellDef, EmbeddedFieldDef, EmbeddedListEditSpec, EmbeddedSubFieldDef, EntityCrudRegistrar, EntityCrudVerb, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityEventMigration, EntityFieldDefinition, EntityHandlerOptions, EntityHookMap, EntityId, EntityIndexDef, EntityListExpandableRow, EntityListScreenDefinition, EntityLongTextFieldDef, EntityObjectDefinition, EntityProjectionExtension, EntityQueryHandlerOptions, EntityRef, EntityRelations, EntityTextFieldDef, EntityWriteHandlerOptions, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventUpcastCtx, EventUpcastFn, ExpandableRowGrouping, ExtensionOptionsArgs, ExtensionOptionsFor, ExtensionSelectorDef, ExtensionSelectorPanel, FeatureMetricDef, FeatureMetricType, FeatureRegistrar, FetchForWritingArgs, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FieldsMap, FileFieldDef, FilesFieldDef, Findability, FormFieldDerivation, FormWidth, FormatSpec, FromRule, FromRuleKind, HTTP_ERROR_CODE_PATTERN, HandlerRef, HasManyRelation, HookDefinition, HookMap, HookOwner, HookPhase, HookPhases, HttpRouteDefinition, HttpRouteHandler, HttpRouteHandlerDeps, HttpRouteMethod, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDeferral, JobDefinition, JobHandlerFn, JobRunnerRef, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookFn, LifecycleHookType, LifecycleResult, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, ListTableOptions, LocatedTimestampFieldDef, LongTextFieldDef, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricOptions, MetricSpec, MoneyCurrencySource, MoneyFieldDef, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, OptionsQueryPayload, OptionsQueryPayloadValue, OwnedFn, OwnershipClause, OwnershipMap, OwnershipRef, OwnershipRule, ParentRefDef, PayloadBucketNormalization, PayloadRateLimitOption, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PhasedHook, PlatformComponent, PluralForms, PostDeleteBatchHookFn, PostDeleteHookFn, PostQueryHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, PreparedWriteEvent, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionRowIdOf, ProjectionTable, QualifiedEventName, QueryHandlerDef, QueryHandlerDefinition, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitOptions, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, RegisterEntityCrudOptions, RegistrarExtensionDef, RegistrarExtensionHooks, RegistrarExtensionRegistration, RelationDefinition, ResolvedPiiFlags, ResolvedPiiStance, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, RunIn, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SearchPayloadContributorFn, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SelectOptionTone, SessionUserOrigin, SingleStreamApplyFn, SqlFragment, StackBootRequirement, StoreTableDef, StoreTableEntry, StoreTableOptions, StreamHandlerDef, StreamHandlerDefinition, StreamHandlerFn, Subscribe, TargetRef, TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantWriteTarget, TimestampFieldDef, ToolbarAction, TransitionMap, TranslationEntry, TranslationKeys, TranslationValue, TranslationsDef, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, TryAppendEventFn, TryAppendEventResult, TzFieldDef, UiExtensionDef, UiHintOption, UiHints, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WebSocketMessageData, WebSocketRouteConnectDeps, WebSocketSessionHandlers, WhereRuleContext, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerDefinition, WriteHandlerFn, WriteHandlerInput, WriteResult, declaredRateLimitOptions, isAgentVisibleScreen, isDeliveryErrorCode, isExtensionEditSection, isFileField, isFormatSpec, isOpenToAllGranted, isRateLimitDisabled, isRateLimitOption, isSystemTenant, isUiAccessGranted, isUuid, normalizeEditField, normalizeListColumn, parseTenantId, relatedListGroupHeaderLabel, relatedListGroupKey, resolveAgentExposure, resolveName, withResponseData\n./env: ComposeEnvSchemaOptions, ComposedEnvShape, EnvError, EnvErrorKind, EnvFieldClass, EnvFieldStatus, KumikoEnvMeta, ParseEnvOptions, buildPulumiSuggestion, camelCase, getDefaultValue, getFieldDescription, pulumiConfigKey\n./env/dry-run: DryRunOptions\n./errors: AgentReason, AgentReasons, ErrorCtorInput, ErrorLogEntry, ErrorOpts, ErrorResponseBody, FeatureDisabledDetails, FrameworkReason, IdempotentReplayError, InvalidTransitionDetails, MemberReadTimeoutError, NotFoundDetails, PreconditionFailedDetails, PreconditionFailedError, RateLimitDetails, RateLimitUnavailableError, RecordLockedError, UnauthenticatedError, UnconfiguredDetails, UniqueViolationDetails, UnprocessableOpts, ValidationDetails, VersionConflictDetails, buildErrorLog, buildInvalidTransitionDetails, isSubjectErasedConflict, memberResolutionReadOnlyDenied, resolveErrorDocsUrl, serializeError, toKumikoError, toWriteErrorInfo\n./db: AppliedMigration, ApplyResult, BaselineResult, BuildEntityTableMetaOptions, CompositePrimaryKeyMeta, CreateDbConnectionOptions, CreateTenantDbOptions, CursorQueryOptions, CursorResult, DbConnectionHandle, DbConnectionOptions, DecodedKeysetCursor, DeleteManyBatchedOptions, DeleteManyBatchedResult, EagerLoadEntityResolver, EagerLoadViewer, EagerloadedRow, EntityLifecycleVerb, EntityRow, EventStoreExecutorOptions, ExecutorManagedWriteCapability, FeatureTableSource, GenerateMigrationInput, GenerateMigrationOutput, IncrementCounterOptions, IndexMeta, InnerJoinRow, InnerJoinSpec, InsertOnConflictDoNothingOptions, JoinColumnPair, LocatedTimestampRead, LockGuardOption, Migration, MigrationChecksumMismatchError, OutsideTransactionContext, PgErrorInfo, PgType, ReplayMismatch, ReplayedSchema, ReplayedTable, RetiredFrameworkTable, SYSTEM_SCOPE_CHECK_BRAND, SchemaDiff, SelectQuery, Snapshot, TableColumns, TenantDbGrants, TenantDbMode, UnmanagedTableInput, UpsertOnConflictOptions, WhereOperator, WhereValue, Writable, assertUniqueTableNames, assertValidMigrationName, baselineMigrations, bigint, bigserial, collectReferenceFields, constraintOf, diffReplayAgainstSnapshot, diffSnapshots, encryptEntityFieldValues, enrichRowWithReferences, enrichWithReferences, executeRawQueryRead, fetchAppliedMigrations, findCommentedDropTables, flattenCompoundTypes, flattenLocatedTimestamp, flattenMoney, hasOutsideTransactionDb, instantToDriver, isRetiredFrameworkTable, isTableAlreadyExists, labelListAggregateGroups, loadMigrationsFromDir, moneyAmount, moneyPayloadToMinorUnits, numeric, readMigrationSqlTexts, readRebuildMarker, rebuildTablesFromDiff, rehydrateCompoundTypes, rehydrateLocatedTimestamp, renderMigrationSql, renderTableDdl, replayMigrationsDir, requireOutsideTransactionDb, retiredFrameworkTables, runInSavepoint, runMigrations, snapshotFromMetas, splitSqlStatements, toSnakeCase, toTableName, withoutStatementTimeout, writeRebuildMarker\n./event-store: AppendEventInTenantDbOptions, ArchiveStreamArgs, ArchivedStreamError, DeadLetterRow, DeleteRowsWithoutReplayableStreamArgs, EVENTS_PUBSUB_CHANNEL, EventToAppend, EventUpcasters, IdempotentAppendConflictError, LoadAggregateWithSnapshotOptions, LoadAggregateWithSnapshotResult, PiiBackfillBatchOptions, PiiBackfillBatchResult, PiiBackfillFailure, PiiBackfillOptions, PiiBackfillResult, PiiBackfillScanCache, ProvenanceEventInput, RebuildDeadLetterRow, SaveSnapshotArgs, SkippedApply, Snapshot, SnapshotReducer, TransferAggregateStreamsArgs, UpcastOptions, UpcasterErrorPolicy, createRebuildDeadLetterTable, createSnapshotsTable, createUpcasterDeadLetterTable, listDeadLetters, listRebuildDeadLetters, loadAggregateAsOf, loadAggregateWithSnapshot, loadEventsAfterVersion, loadLatestSnapshot, rebuildDeadLetterTable, recordRebuildDeadLetters, recordUpcasterDeadLetter, restoreStream, saveSnapshot, toStoredEvent, upcastStoredEvents\n./event-store/admin-api: RawEventToAppend\n./pipeline: ACCESS_INVALIDATION_CONSUMER_NAME, AppendDomainEventCoreDeps, ConsumerCursor, ConsumerStatus, ConsumerTransitionRejection, DispatcherPassResult, EntityCache, EntityCacheOptions, EscapeHatchReportWindow, EventConsumer, EventConsumerBatchHandler, EventConsumerHandler, EventDispatcherOptions, FailedWriteResult, LifecycleHooks, MspRebuildDeps, MultiStreamApplyContextDeps, PendingGapEntry, ProjectionProgress, ProjectionStatus, ProjectionStatuses, PruneEventsResult, RebuildResult, ResolveAuthClaimsArgs, SystemHookDef, assertInstructionFieldWriteAllowed, createAccessInvalidationEventConsumer, createEscapeHatchReportWindow, createEventDispatcher, createSearchEventConsumer, createSseBroadcastEventConsumer, fallbackEscapeHatchReporter, isFailedWriteResult, isIrreversibleEntityVerb, reportEscapeHatchUse, selectConsumerCursorForUpdate, withEscapeHatchAuditScope\n./api: AuthMiddlewareOptions, AuthSessionChecker, AuthSessionStatus, CachedResponseInit, ClientIpHeaderSource, ExtraRouteEntries, ExtraRouteEntry, ExtraRouteRejectionOptions, ExtraRouteRejectionStatus, HOST_COOKIE_PREFIX, JwtKeyring, JwtPayload, KumikoServer, KumikoServerWebSocket, PostAuthLandingFlow, RedisSseBrokerOptions, RequestContextData, ResolvedSessionCookies, SessionCookieBase, SessionCookieNames, SetTenantCookieOptions, SignatureExtraRoute, SignatureExtraRouteVerifyDeps, SseClient, SseRouteOptions, TENANT_COOKIE_BASE, TenantExists, TenantLifecycleStatusResolver, TenantResolver, UserExtraRoute, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_REVALIDATION_FAILURE_LIMIT, WebSocketUpgradeServer, assertValidTrustedProxyHops, authMiddleware, clientIpSourceFromHonoContext, createApiRoutes, createAuthRoutes, createJwtHelper, createSseRoute, deleteTenantCookie, extractSocketAddress, getUser, isHostPrefixedCookieName, isSafeLandingPath, kumikoWebSocketHandler, parseIfNoneMatch, patAllows, qnMatches, requestIdMiddleware, resolveSessionCookieNames, resolveSessionCookies, sessionCheckStatus, sessionCookiesMiddleware\n./i18n: DEFAULT_LOCALE, I18n, I18nOptions, pickAcceptLanguage, rankAcceptLanguage, resolveHeaderLocale\n./auth: Role\n./files: BindPendingFileRefOutcome, CreateFileRefContext, DEFAULT_UPLOAD_SWEEP_GRACE_HOURS, FileAccessDecision, FileContentValidationResult, FileHandle, FileMetadata, FileProviderResolverDeps, FileRef, FileRoutesOptions, FileValidationOptions, MIN_UPLOAD_SWEEP_GRACE_HOURS, PendingFileRefBindTarget, UploadFileBytesContext, UploadMimeTypeResolution, WriteStreamOptions, createFileRoutes, createFileUploadLedger, fileRefStorageDelta, makeFileProviderResolver, parseMaxSize, resolveContentType, resolveUploadMimeType, sweepOrphanedUploads, validateFileContent\n./derivatives: DerivativesContextDeps, StoredFileStore, VARIANT_NAME_PATTERN, canonicalJson, createDerivativesContext, isDerivativeKeyOf, listDerivativeKeys, resolveRenderer, specHash\n./jobs: JobSubjectValue\n./observability: ConsoleProviderOptions, Counter, ESCAPE_HATCH_USED_SIGNAL, EscapeHatchProcessDedup, EscapeHatchReportWindow, Gauge, Histogram, Meter, MetricDefinition, MetricEventHandler, MetricLabels, MetricType, ObservabilityWiring, PrometheusMeter, PrometheusMeterSnapshot, REDACTED, RecordingTracerOptions, STANDARD_METRIC_DEFS, SamplingConfig, SensitiveFilterConfig, SerializedTraceContext, Span, SpanAttributeValue, SpanAttributes, SpanKind, SpanStatus, StartSpanOptions, Tracer, UNATTRIBUTED_ACTOR, buildMetricName, createConsoleProvider, createEscapeHatchProcessDedup, createEscapeHatchReportWindow, createEscapeHatchReporter, createUnboundMetricsHandle, emitDbQuery, emitDispatcherError, emitDispatcherHandler, emitEscapeHatchUse, emitEventConsumerLag, emitEventConsumerPassOutcome, emitEventConsumerPassSkipped, emitEventConsumerPendingGaps, emitEventConsumerRearmExhausted, emitEventDispatcherListenConnected, emitHttpRequest, emitJobLastSuccess, emitJobQueueDepth, fallbackEscapeHatchReporter, flushEscapeHatchAudits, generateSpanId, generateTraceId, getFallbackMeter, getFallbackProvider, getFallbackTracer, observabilityContext, redactAttributes, redactHeaders, redactQueryString, redactValue, registerStandardMetrics, reportEscapeHatchUse, serializeOpenMetrics, serializeSpanContext, shouldRedactAttribute, validateLabelKey, validateMetricName, withEscapeHatchAuditScope, wrapRedisClient\n./migrations: ChecksumMismatch, EnqueueProjectionRebuildDeps, EnqueueProjectionRebuildResult, KumikoDriftReport, PendingRebuildRun, PiiEventBackfillOptions, PiiEventBackfillResult, PiiRebuildRun, RunPendingRebuildsOptions, createPendingRebuildsTable, createPiiBackfillStateTable, detectKumikoDrift, formatKumikoDriftReport, pendingRebuildsTable, piiAnnotationFingerprint, piiBackfillStateTable\n./entrypoint: AllInOneEntrypointOptions, BaseEntrypointOptions, PgClient, PgListenClient, WorkerEntrypointOptions\n./random: ADJECTIVES, AdjNounNameOptions, GenerateUniqueNameOptions, NOUNS, generateAdjNounName, generateNoConfusableId\n./redis: CacheSyncBusOverSignalOptions, PubSubSignal, PubSubSignalOptions, RedisCacheSyncBusOptions, ResolvedCacheSyncBus, createCacheSyncBusOverSignal, isTenantConfigSyncMessage, resolveCacheSyncBus\n./search: ReindexEntityFailure, ReindexEntityOptions, ReindexEntityResult, SearchDocument, SearchOptions, SearchResult, collectSearchableFieldNames, configureTenantSearchIndex, deriveSearchAdapterConfig\n./search/meilisearch: MeilisearchAdapterOptions, meilisearchDocId, meilisearchTenantIndex\n./seeding: DEFAULT_SEED_IF_EXISTS, EventStoreSeedExisting, RunEventStoreSeedOptions\n./secrets: ContainsSecret, DekCacheOptions, EnvMasterKeyProviderOptions, Envelope, KeyScope, Keyring, SecretAuditContext, SecretKeyRef, assertNoSecretLeak, isSecret\n./crypto: ActiveKmsWiring, EncryptPiiOptions, EventPiiCatalog, KekSourceEnv, KekSourceOptions, KeyNotFoundError, KmsHealth, KmsWiringEnv, KmsWiringOptions, KmsWiringRelease, PII_CIPHERTEXT_PREFIX_JSON, PgKmsAdapter, PgKmsAdapterOptions, PgKmsRotationEnv, PlaintextPiiWiring, RECORD_ENTITY_PATTERN, RemoteCryptoKmsAdapter, RequestKmsCache, ResolveSubjectOptions, RewrapOptions, RewrapResult, SubjectDek, SubjectKey, blindIndexFieldName, buildPgKmsOptions, collectSearchableSubjectFields, computeBlindIndexValues, configureEventPiiCatalog, createRequestKmsCache, encryptEventPayloadPii, isLocalKeyKmsAdapter, subjectIdFromKey, subjectKeyForTenant\n./logging: LoggerOptions, scrubLogValue\n./schema-cli: RunSchemaCliOptions, SchemaCliOut\n./consumer-cli: ConsumerCliOut\n./upgrade-cli: ManualResolution, UpgradeCliOut, UpgradeMarkerManual, UpgradeMarkerResolvedManual, findCodemodScriptsRoot, findFeatureChangelogFiles, manualEntryId\n./internal/request-context: RequestContextData, isAgentToolCallScope, readonlyRequestContext, runWithOrigin, runWithWriteOrigin, setRequestIdentity\n./time: Clock, GeoAddress, GeoCoordinates, LocatedTimestampJson, TzContextOptions, createTzContextAsync\n./ui-types: BooleanFieldDef, CardColumnRoles, CardRoleColumn, CustomScreenRoute, DashboardChartKind, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardPanelGate, DashboardRecordBinding, DashboardRelativeTimeFormat, DashboardValueFormat, DateFieldDef, EditFieldPrefill, EntityEditActionPlacement, EntityListExpandableRow, EntityListFacetExtraOption, EntityWriteExcludedFields, ExpandableRowGrouping, FieldsOrGroupsSection, FileFieldDef, FilesFieldDef, ImageFieldDef, ImagesFieldDef, ListBadgeTone, ListColumnDisplay, ListRowMetaColumnType, ListRowMetaReference, ListTableDensity, MetricSpec, NumberFieldDef, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, OptionsQueryPayloadValue, PluralForms, ReferenceLookupSource, RoleAccessPersonalData, RoleAccessRule, ScreenFilter, ScreenFilterOp, SecretReveal, SecretRevealField, SecretsEditSection, SelectFieldDef, SystemReferenceLabel, TreeNode, TreeNodeState, UnavailableSelectOption, cardFileDisplayKind, explicitListScreenId, relatedListGroupHeaderLabel, relatedListGroupKey\n./utils: compareByCodepoint, readPositiveIntEnv, stringifyJson, toSnakeCase\nDeleted with their code (no internal replacement): ./auth Role; ./compliance describeDurationSpec, OVERRIDABLE_PROFILE_KEYS; ./crypto createRequestKmsCache, RequestKmsCache; ./db numeric, SelectQuery; ./engine BuiltinQnType, createUserSeed, HandlerFieldReferenceMeta, KumikoExtensionName, listStepKinds, MessageKind, resolveConfigOrParam, ResolveOptions, StorageProviderExtensionHooks, SystemHookName, UserDataExtensionHooks; ./errors AgentReason, buildErrorLog, ErrorLogEntry; ./observability createUnboundMetricsHandle, redactHeaders, redactQueryString, serializeSpanContext; ./pipeline ConsumerStatus, ProjectionStatus, ProjectionStatuses; ./search configureTenantSearchIndex; ./time createTzContextAsync.",
+    "migration": "None of the removed names had a user in any Kumiko repository, so no migration is expected. Internal names have no public replacement. The deleted names listed above are gone without a replacement; code that still imports one fails to compile and has to inline the few lines it needs. If you need one back, open an issue."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Job runner connects to a password-protected Redis",
+    "detail": "parseRedisOpts kept only host, port and db of REDIS_URL, so BullMQ queues and the sequential lock connected without the password and the app stopped at boot with \"Redis not reachable\" against a Redis that requires auth. Username, URL-encoded password and rediss:// TLS are now carried over."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "preQuery hooks removed",
+    "detail": "`r.hook({ type: \"preQuery\", … })` registered a hook that the query pipeline never called. The `preQuery` hook type, `PreQueryHookFn`, the `preQuery` slot of the hook maps and registrar extension hooks, and `registry.getPreQueryHooks` are removed. A `type: \"preQuery\"` registration is now a type error and throws at feature registration instead of being silently ignored.",
+    "migration": "No known users. Remove `r.hook({ type: \"preQuery\", … })` registrations; they never ran. To change a query payload, validate or transform it inside the query handler."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Row level security policy DDL behind a rowLevelSecurity parameter",
+    "detail": "renderTableDdl, renderTablesDdl and unsafePushTables accept rowLevelSecurity \"off\" or \"on\" (default \"off\", output unchanged). With \"on\", every table that has a tenant_id column gets ENABLE and FORCE ROW LEVEL SECURITY plus the policies kumiko_tenant_isolation and kumiko_system_tenant_read, driven by the kumiko.tenant_id and kumiko.scope settings. Tables without tenant_id are left alone."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "The migration generator writes a row level security section",
+    "detail": "With rowLevelSecurity \"on\", generateMigration adds a Row level security section for new, changed and recreated tables and a rowLevelSecurity field to the snapshot; switching back to \"off\" emits the matching DISABLE statements with a warning. Without the option the generated SQL and snapshot are byte-identical to before."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Migration replay understands CREATE, ALTER and DROP POLICY",
+    "detail": "The replay behind kumiko-schema validate tracks ENABLE and FORCE ROW LEVEL SECURITY and policy definitions per table, follows table renames, and reports row-level-security-drift when the committed SQL does not produce the policies the snapshot expects (missing, extra, altered or hand-edited) or turns on row level security for a table the snapshot has no spec for. An unparsable policy statement, or a policy or row level security change inside a DO block, fails loudly."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Projection and multi-stream rebuilds no longer abort on tables with row level security",
+    "detail": "The shadow swap used to refuse a live table with RLS flags or policies. It now reads them from the catalog under the swap lock, re-applies them to the swapped-in table and fails the rebuild transaction if the result differs. Before the first read, the rebuild checks that the table's policies let its system scope see every row, so the guards never see too few rows and the swap never drops hidden ones."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Migration replay parses ALTER TABLE ONLY, IF EXISTS and public. prefixes",
+    "detail": "kumiko-schema validate read `ALTER TABLE ONLY \"t\"` as a change to a table named ONLY and ignored IF EXISTS and a public. prefix; the statement now applies to the named table."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "createTenantDb mode system requires a reason",
+    "detail": "The system scope a TenantDb opens for its statements now carries that reason, so a scope leak assertion names the call site. Tenant mode takes no reason.",
+    "migration": "Add `reason: \"<why this access spans tenants>\"` to every createTenantDb({ mode: \"system\" }) call. The reason must be a non-empty string literal: an empty reason throws InternalError at construction, and the internal-subpath-imports guard rejects a missing, empty or non-literal reason."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Signature routes read and write secrets in a system scope",
+    "detail": "With row level security on, verify() and the handler of a signature route (subscription webhooks, mail connect callbacks) read the secrets of a tenant named by the signed request before any tenant scope exists, and failed. deps.secrets now opens the system scope for each secret access only, so plugin code that parses the unauthenticated body stays unscoped."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "RLS boot check tells known tables from orphaned ones",
+    "detail": "With rowLevelSecurity on, the boot check lists tenant tables without row-level security in two groups. Tables the app schema knows point to kumiko schema generate. Tables no feature declares anymore, including retired framework tables, are named as orphaned and point to dropping them by migration. The check itself stays strict.",
+    "migration": "assertRowLevelSecurityBootState takes the known tables as a required third argument: pass knownTablesOf(features), both exported from the db subpath."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "schema apply heals row-level security on existing framework tables",
+    "detail": "Existing databases got no policies on kumiko_events, kumiko_archived_streams and kumiko_snapshots, so boot failed while schema validate stayed green."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Connections set the row level security scope in every transaction",
+    "detail": "createDbConnection takes rowLevelSecurity \"off\" or \"on\" (default \"off\", the connection is unchanged). With \"on\", every statement and transaction sets kumiko.tenant_id and kumiko.scope transaction-locally from the ambient scope. TenantDb sets its tenant, and the system scope for system-mode TenantDbs, global tables and a granted unsafeRaw. Dispatch sets the user's tenant per command, or the system scope for a system-scoped handler. Event store reads and writes use the stream's tenant. Jobs, the event dispatcher, member resolution, migrations, boot seeds, retention, reindex, blind-index cleanup, the PII backfill, projection apply, auth providers and the tenant lifecycle check run in system scope. A statement without a scope sees no tenant rows. The functions that set a scope (runInRowLevelSecurityScope, runInSystemRowLevelSecurityScope, tenantRowLevelSecurityScope, systemScopedRunner) are not part of the public db subpath; framework packages import them from @cosmicdrift/kumiko-framework/internal/row-level-security, which no guard closes to apps yet. App code reaches the system scope through a system-scoped handler, a job or a granted unsafeRaw."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "One rowLevelSecurity value in kumiko.config.ts for schema tooling and runners",
+    "detail": "AppConfig.rowLevelSecurity (\"off\" by default) is exported by the managed kumiko/schema.ts as ROW_LEVEL_SECURITY. kumiko-schema generate and validate render and check the policies from it, and apply opens its connection in that mode; the CLI has no flag of its own. The API, worker and all-in-one entrypoints take the same option and refuse a context whose connection runs in another mode. unsafePushTables with \"on\" reads the catalog first and runs no lock and no DDL for a table that already has ENABLE, FORCE and both kumiko policies."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Projection rebuilds run in system scope under row level security",
+    "detail": "The rebuild transaction no longer turns row_security off, so a rebuild works as a NOSUPERUSER NOBYPASSRLS table owner under FORCE. Before the first guard read it locks the live table in SHARE UPDATE EXCLUSIVE mode, which blocks policy DDL and a second rebuild of the same table, and reads the catalog. When row level security is enabled, kumiko_tenant_isolation must exist as a PERMISSIVE policy for ALL commands and PUBLIC and no RESTRICTIVE policy may exist; otherwise the rebuild fails with the table and its policies and leaves the live table untouched. Other permissive policies carry over to the swapped-in table. Multi-stream rebuilds follow the same rule."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "rowLevelSecurity defaults to \"on\"",
+    "detail": "Postgres row level security is on by default, system scopes carry a mandatory reason, and the event write path keeps the caller's tenant scope.",
+    "migration": "In the app repo, once with the bump: run `kumiko sync-managed --write` (the managed kumiko/schema.ts now reads `export const ROW_LEVEL_SECURITY = appConfig.rowLevelSecurity;`), then `kumiko schema generate` and commit the migration. It contains ENABLE and FORCE ROW LEVEL SECURITY plus the policies `kumiko_tenant_isolation` and `kumiko_system_tenant_read` for every tenant table. The schema apply (the migrate init container in production) creates them; there is no manual database step. Without the migration, boot at \"on\" refuses to start and names the unprotected tables.\nThe app's database role must not skip policies; boot refuses it otherwise. Check it as that role with `SELECT rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user` (both must be false). Callers of createDbConnection without a mode now get \"on\"; tools that touch no tenant rows (schema baseline/status, the KMS key store) pass \"off\" explicitly, and the operator commands backfill-pii, waitlist-migrate, project and consumer run on an enforcing connection in system scope, so they work against both modes.\nWay back: set `rowLevelSecurity: \"off\"` in kumiko.config.ts and run `kumiko schema generate`; the generated migration contains DISABLE ROW LEVEL SECURITY and drops the policies. At \"off\" runProdApp and runWorkerApp log a boot warning."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "Boot hooks with a db dependency get a system-scoped db at rowLevelSecurity \"on\"",
+    "migration": "No action unless a hook relied on the unscoped pool. The anonymousAccess factory, enrichAnonymousAccess, the runProdApp `wire` hook and runWorkerApp `wireComponents` now receive a system-scoped db, the same in prod, dev and the test stack, so tenant resolution and boot reads see rows across tenants. Anything the anonymousAccess factory builds keeps that db at request time and therefore reads across tenants for anonymous callers: filter by the resolved tenant yourself. In prod, extraContext factories keep the ambient request scope; the test stack and dev still hand them a system-scoped db, so a service that needs cross-tenant reads at request time must scope itself."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "runInSystemRowLevelSecurityScope and systemScopedRunner take a reason",
+    "migration": "Call runInSystemRowLevelSecurityScope(\"<why this access spans tenants>\", fn) and systemScopedRunner(runner, \"<reason>\"). An empty or whitespace reason throws InternalError; the scope leak assertion names the reason."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "A projection write under a tenant scope can no longer land in another tenant",
+    "detail": "applyEntityEvent keeps an ambient tenant scope instead of wrapping every write in a system scope. Writes for other tenants go through ctx.systemDb.acknowledgeCrossTenant in an r.systemScope() feature. Replays, rebuilds and global entities still write system scoped.",
+    "migration": "A command that writes an entity row for another tenant through ctx.db now fails with SQLSTATE 42501; move that write to ctx.systemDb.acknowledgeCrossTenant in an r.systemScope() feature."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "composeFeatures no longer warns about its own bundled copies",
+    "detail": "Composing the output of a first composeFeatures pass again drops the earlier bundled instances silently; only copies the app supplied itself still warn."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Scoped pool statements pipeline their transaction",
+    "detail": "A pool statement under a row level security scope sends BEGIN, the transaction-local scope, the statement and COMMIT pipelined on one reserved connection instead of waiting for each, which cuts its roundtrips roughly in half. The connection returns to the pool only after COMMIT settled."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Schema generator emits primary-key changes",
+    "detail": "A changed primary key (single to composite, reordered columns, renamed constraint) previously produced no migration. The generator now emits DROP CONSTRAINT plus ADD CONSTRAINT with a WARN comment, and managed projections are recreated and replayed."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Tests seed and reset event-sourced tables through the event store",
+    "detail": "Seeds of user, membership, tenant and other entity rows use seedRowViaEventStore instead of seedRow, so their created events exist. Setup and teardown hooks in the integration tests clear event-sourced tables through resetTestTables instead of raw DELETE statements, and clear the events table in the same call, so a test no longer starts with events whose projection rows are gone. Nothing changes for apps; the packages are only republished."
+  },
   {
     "version": "0.389.0",
     "type": "breaking",

package/dist/crypto/request-kms-cache.d.ts

@@ -1,8 +0,0 @@
-import type { KmsContext, LocalKeyKmsAdapter, SubjectDek, SubjectId } from "./kms-adapter.ts";
-export interface RequestKmsCache {
-    getKey(subject: SubjectId, ctx: KmsContext): Promise<SubjectDek>;
-    /** Drops one subject's cached DEK — called when its key is shredded mid-request. */
-    invalidate(subject: SubjectId): void;
-    clear(): void;
-}
-export declare function createRequestKmsCache(adapter: LocalKeyKmsAdapter): RequestKmsCache;

package/dist/crypto/request-kms-cache.js

@@ -1,21 +0,0 @@
-import { subjectIdToKey } from "./kms-adapter.js";
-export function createRequestKmsCache(adapter) {
-    const cache = new Map();
-    return {
-        async getKey(subject, ctx) {
-            const subjectKey = subjectIdToKey(subject);
-            const hit = cache.get(subjectKey);
-            if (hit !== undefined)
-                return hit;
-            const dek = await adapter.getKey(subject, ctx);
-            cache.set(subjectKey, dek);
-            return dek;
-        },
-        invalidate(subject) {
-            cache.delete(subjectIdToKey(subject));
-        },
-        clear() {
-            cache.clear();
-        },
-    };
-}

package/dist/engine/codemod/index.d.ts

@@ -1,2 +0,0 @@
-export type { CodemodOptions, CodemodReport, CodemodResult, FileAnalysis, ParsedHandlerInfo, } from "./pipeline-codemod.ts";
-export { analyzeFile, analyzeHandlerArrow, convertFile, generatePerformBlock, runCodemod, scanForCandidates, } from "./pipeline-codemod.ts";

package/dist/engine/codemod/index.js

@@ -1 +0,0 @@
-export { analyzeFile, analyzeHandlerArrow, convertFile, generatePerformBlock, runCodemod, scanForCandidates, } from "./pipeline-codemod.js";

package/dist/engine/codemod/pipeline-codemod.d.ts

@@ -1,50 +0,0 @@
-import { Project } from "ts-morph";
-export type CodemodResult = {
-    readonly filePath: string;
-    readonly status: "converted" | "skipped" | "error";
-    readonly reason?: string;
-};
-export type CodemodReport = {
-    readonly results: readonly CodemodResult[];
-    readonly converted: number;
-    readonly skipped: number;
-    readonly errors: number;
-};
-export type CodemodOptions = {
-    readonly dryRun?: boolean;
-    readonly verbose?: boolean;
-};
-export type GuardConfig = {
-    readonly condition: string;
-    readonly failureReturn: string;
-    readonly successReturn: string;
-};
-export type ParsedHandlerInfo = {
-    readonly handlerBodyText: string;
-    readonly isStaticReturn: boolean;
-    readonly isSimpleExecutorCreate: boolean;
-    readonly isSimpleExecutorUpdate: boolean;
-    readonly hasConditionalLogic: boolean;
-    readonly executorName?: string;
-    readonly executorCreateVar?: string;
-    readonly executorCreateArgs?: string[];
-    readonly executorUpdateVar?: string;
-    readonly isExpressionBodyCreate: boolean;
-    readonly isExpressionBodyUpdate: boolean;
-    readonly expressionBodyArgs: string[] | undefined;
-    readonly isGuardedCreate: boolean;
-    readonly guardConfig: GuardConfig | undefined;
-};
-export declare function analyzeHandlerArrow(arrowText: string): ParsedHandlerInfo;
-export declare function generatePerformBlock(analysis: ParsedHandlerInfo, schemaType: string, indent: string): string | null;
-export declare function scanForCandidates(rootDir: string): FileAnalysis[];
-export type FileAnalysis = {
-    readonly filePath: string;
-    readonly pattern: "free-form-write" | "pipeline-write" | "query-handler" | "other";
-    readonly convertible: boolean;
-    readonly reason: string;
-    readonly handlerLine?: number;
-};
-export declare function analyzeFile(filePath: string): FileAnalysis | null;
-export declare function runCodemod(rootDir: string, options?: CodemodOptions): Promise<CodemodReport>;
-export declare function convertFile(filePath: string, project?: Project, options?: CodemodOptions): Promise<CodemodResult>;