@cosmicdrift/kumiko-framework 0.390.0 → 0.390.1

package/dist/db/driver-value-preparation.js

@@ -65,9 +65,30 @@ const INTEGER_PG_TYPES = new Set([
 export function instantToTimestamptzParam(instant) {
     return Temporal.Instant.fromEpochMilliseconds(instant.epochMilliseconds).toString();
 }
+function instantOfIsoString(value) {
+    try {
+        return Temporal.Instant.from(value);
+    }
+    catch {
+        // skip: not an ISO instant, Postgres parses (or rejects) the text itself
+        return undefined;
+    }
+}
+// Event payloads carry instants as ISO strings with microseconds; a projection rebuild binds them
+// as-is, so without the same truncation the replayed row differs from the live one.
+function timestamptzInstantOf(value) {
+    if (isTemporalInstant(value))
+        return value;
+    if (typeof value === "string")
+        return instantOfIsoString(value);
+    return undefined;
+}
 function prepareDriverNeutralScalar(value, pgType) {
-    if ((pgType === "timestamptz" || pgType === "timestamptz(3)") && isTemporalInstant(value)) {
-        return { kind: "param", sql: "", bound: instantToTimestamptzParam(value) };
+    if (pgType === "timestamptz" || pgType === "timestamptz(3)") {
+        const instant = timestamptzInstantOf(value);
+        if (instant !== undefined) {
+            return { kind: "param", sql: "", bound: instantToTimestamptzParam(instant) };
+        }
     }
     // Sent as text, so Postgres rejects 3.5 for an integer column instead of rounding it.
     if (typeof value === "number" && pgType !== undefined && INTEGER_PG_TYPES.has(pgType)) {

package/dist/db/queries/test-stack.js

@@ -1,5 +1,6 @@
 import { extractPgError } from "../pg-error.js";
 import { asRawClient } from "../query.js";
+import { toPostgresArrayLiteral } from "./postgres-array-literal.js";
 import { PROJECTION_REBUILD_SCHEMA } from "./shadow-swap.js";
 import { quoteTableIdent } from "./table-ops.js";
 // Re-exported for back-compat — the generic DDL helpers moved to ./ddl so
@@ -89,7 +90,7 @@ export async function transferPublicSchemaOwnership(db, owner) {
        JOIN pg_namespace n ON n.oid = c.relnamespace
        JOIN pg_roles r ON r.oid = c.relowner
       WHERE n.nspname = ANY($2::text[]) AND c.relkind IN ('r', 'p', 'S', 'v', 'm') AND r.rolname <> $1
-        AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = c.oid AND d.deptype IN ('a', 'i'))`, [owner, ownedSchemas]);
+        AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = c.oid AND d.deptype IN ('a', 'i'))`, [owner, toPostgresArrayLiteral(ownedSchemas)]);
     for (const { nspname, relname, relkind } of relations) {
         const kind = OWNED_RELATION_KINDS[relkind];
         if (kind === undefined)

package/dist/db/row-level-security-boot-check.d.ts

@@ -1,5 +1,6 @@
 import { type KnownTables } from "./known-table-names.ts";
 import type { AnyDb } from "./query.ts";
 import type { RowLevelSecurityMode } from "./render-rls-ddl.ts";
-export declare function assertRowLevelSecurityTableState(db: AnyDb, mode: RowLevelSecurityMode, knownTables: KnownTables): Promise<void>;
+export type RowLevelSecurityCheckScope = "database" | "declared tables";
+export declare function assertRowLevelSecurityTableState(db: AnyDb, mode: RowLevelSecurityMode, knownTables: KnownTables, scope?: RowLevelSecurityCheckScope): Promise<void>;
 export declare function assertRowLevelSecurityBootState(db: AnyDb, mode: RowLevelSecurityMode, knownTables: KnownTables): Promise<void>;

package/dist/db/row-level-security-boot-check.js

@@ -28,8 +28,9 @@ async function assertEnforcingRole(db) {
 function listingOf(entries) {
     return entries.map((entry) => `${entry.table} (${entry.missing.join(", ")})`).join("; ");
 }
-async function assertAllTenantTablesProtected(db, knownTables) {
+async function assertAllTenantTablesProtected(db, knownTables, scope) {
     const incomplete = (await readTenantTablesRowLevelSecurity(db))
+        .filter((table) => scope === "database" || knownTables.has(table.tableName))
         .map((table) => ({ table: table.tableName, missing: missingPartsOf(table) }))
         .filter((entry) => entry.missing.length > 0);
     // skip: every tenant table is protected
@@ -59,8 +60,8 @@ async function assertAllTenantTablesProtected(db, knownTables) {
         message: `rowLevelSecurity is "on" but tenant tables lack row-level security. ${sections.join(" ")}`,
     });
 }
-async function assertNoLiveRowLevelSecurity(db) {
-    const tables = await readTablesWithRowLevelSecurityEnabled(db);
+async function assertNoLiveRowLevelSecurity(db, knownTables, scope) {
+    const tables = (await readTablesWithRowLevelSecurityEnabled(db)).filter((table) => scope === "database" || knownTables.has(table));
     // skip: no live row-level security to disable
     if (tables.length === 0)
         return;
@@ -70,13 +71,13 @@ async function assertNoLiveRowLevelSecurity(db) {
 }
 // Table state only, no role check: the role is a runtime property of the boot connection, so tools
 // that connect with another role (CI, `schema validate`) use this one.
-export async function assertRowLevelSecurityTableState(db, mode, knownTables) {
+export async function assertRowLevelSecurityTableState(db, mode, knownTables, scope = "database") {
     if (mode === "off") {
-        await assertNoLiveRowLevelSecurity(db);
+        await assertNoLiveRowLevelSecurity(db, knownTables, scope);
         // skip: off-mode check done
         return;
     }
-    await assertAllTenantTablesProtected(db, knownTables);
+    await assertAllTenantTablesProtected(db, knownTables, scope);
 }
 export async function assertRowLevelSecurityBootState(db, mode, knownTables) {
     if (mode === "on")

package/dist/schema-cli/shared.d.ts

@@ -5,7 +5,12 @@ export type SchemaCliOut = {
     readonly log: (line: string) => void;
     readonly err: (line: string) => void;
 };
-export type RunSchemaCliOptions = {
+type RunSchemaCliRowLevelSecurityOption = {
+    /** The mode the app's runtime boots with (`AppConfig.rowLevelSecurity`). Wins over the schema
+     *  file, so `apply` heals the same mode the boot check enforces. */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
+};
+export type RunSchemaCliOptions = RunSchemaCliRowLevelSecurityOption & ({
     readonly features?: undefined;
     readonly kmsSlots?: undefined;
 } | {
@@ -17,7 +22,7 @@ export type RunSchemaCliOptions = {
      *  `[]` when the app wires none. This CLI parses no env schema, so the
      *  rebuild's KMS wiring cannot derive them itself. */
     readonly kmsSlots: readonly string[];
-};
+});
 export type SchemaCliContext = {
     readonly argv: readonly string[];
     readonly out: SchemaCliOut;
@@ -41,3 +46,4 @@ export declare function loadSchemaModOrReport(ctx: SchemaCliContext): Promise<Sc
 export declare function loadRowLevelSecurityModeOrReport(ctx: SchemaCliContext): Promise<RowLevelSecurityMode | undefined>;
 export declare function readDatabaseUrlOrReport(out: SchemaCliOut): string | undefined;
 export declare function migrationsDirExistsOrReport(ctx: SchemaCliContext): boolean;
+export {};

package/dist/schema-cli/shared.js

@@ -91,11 +91,14 @@ export async function loadSchemaModOrReport(ctx) {
     }
 }
 // `apply` needs only the mode: migrations and rebuilds on a role that RLS binds see nothing unless
-// the connection runs in system scope, which only an "on" connection sets. Without a schema file
-// (dev CLI against a bare checkout) there is nothing to enforce.
+// the connection runs in system scope, which only an "on" connection sets. The prod image ships no
+// kumiko/schema.ts, so without one apply falls back to the runtime's default instead of "off":
+// otherwise the framework tables stay unhealed and the boot check of an "on" app fails.
 export async function loadRowLevelSecurityModeOrReport(ctx) {
+    if (ctx.options.rowLevelSecurity !== undefined)
+        return ctx.options.rowLevelSecurity;
     if (!existsSync(ctx.schemaFile))
-        return "off";
+        return DEFAULT_ROW_LEVEL_SECURITY_MODE;
     return (await loadSchemaModOrReport(ctx))?.rowLevelSecurity;
 }
 export function readDatabaseUrlOrReport(out) {

package/dist/schema-cli/validate-command.js

@@ -1,7 +1,7 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { assertRowLevelSecurityTableState, createDbConnection, generateMigration, } from "../db/index.js";
-import { knownTablesOf } from "../db/known-table-names.js";
+import { isLiveFrameworkTable } from "../db/known-table-names.js";
 import { readMigrationSqlTexts } from "../db/migrate-runner.js";
 import { diffReplayAgainstSnapshot, replayMigrationsDir } from "../db/replay-migration-sql.js";
 import { validateBoot } from "../engine/boot-validator.js";
@@ -62,31 +62,27 @@ function checkBootValidity(out, schemaMod) {
         return false;
     }
 }
+function declaredTablesOf(schemaMod) {
+    const names = new Set(schemaMod.entityMetas.map((meta) => meta.tableName));
+    return { has: (tableName) => names.has(tableName) || isLiveFrameworkTable(tableName) };
+}
 // 4. Live row-level security table state — the table half of the boot check. Only with a DATABASE_URL;
-// without one the command stays database-free.
+// without one the command stays database-free. Scoped to the tables kumiko/schema.ts declares plus the
+// framework tables, because a local DATABASE_URL may point at a dev database several apps share.
 async function checkLiveRowLevelSecurity(out, schemaMod) {
     const dbUrl = process.env["DATABASE_URL"];
     if (!dbUrl) {
         out.log("  · row-level security: skipped — set DATABASE_URL to check the live database.");
         return true;
     }
-    let features;
-    try {
-        features = featureDefinitionsOf(schemaMod.features);
-    }
-    catch {
-        // skip: the boot check already reported the unreadable FEATURES export
-        return true;
-    }
-    const knownTables = features === undefined ? { has: () => true } : knownTablesOf(features);
     const { db, close } = createDbConnection({
         url: dbUrl,
         maxConnections: 1,
         rowLevelSecurity: schemaMod.rowLevelSecurity,
     });
     try {
-        await assertRowLevelSecurityTableState(db, schemaMod.rowLevelSecurity, knownTables);
-        out.log("  ✓ row-level security: live database matches the configured mode");
+        await assertRowLevelSecurityTableState(db, schemaMod.rowLevelSecurity, declaredTablesOf(schemaMod), "declared tables");
+        out.log("  ✓ row-level security: live database matches the configured mode for this app's tables and the framework tables (tables of other apps sharing the database are not checked)");
         return true;
     }
     catch (e) {

package/dist/upgrade-cli.d.ts

@@ -4,4 +4,5 @@ export declare function findFeaturesDirs(cwd: string): string[];
 export declare function resolveCodemodScript(repoRoot: string, codemodField: string | undefined): string | null;
 export declare function runUpgradeCli(argv: readonly string[], cwd: string, out: UpgradeCliOut, options?: {
     readonly repoRoot?: string;
+    readonly codemodResolveFrom?: string;
 }): Promise<number>;

package/dist/upgrade-cli.js

@@ -213,6 +213,10 @@ function resolveCodemodScriptAt(codemodScriptsRoot, codemodField) {
     }
     return resolved;
 }
+function findCodemodScriptsRootPreferring(resolveFrom, repoRoot) {
+    const own = resolveFrom === undefined ? null : findCodemodScriptsRoot(resolveFrom);
+    return own ?? findCodemodScriptsRoot(repoRoot);
+}
 export function resolveCodemodScript(repoRoot, codemodField) {
     const scriptsRoot = findCodemodScriptsRoot(repoRoot);
     if (!scriptsRoot)
@@ -388,7 +392,7 @@ function writePartialMarker(out, targetDir, pending, manualEntries, failedVersio
 // even with zero pending entries, so an already-current app still gets a
 // bootstrap marker recording its installed version.
 // kumiko-lint-ignore complexity-budget sequential codemod runner with zero-pending bootstrap marker
-async function applyCodemods(out, pending, repoRoot, targetDir, dryRun, 
+async function applyCodemods(out, pending, codemodLocation, targetDir, dryRun, 
 // Installed version for the zero-pending bootstrap marker — never a
 // `--from` filter override (that would permanently skip real pending
 // codemods once the CI guard compares against the fake marker).
@@ -443,14 +447,16 @@ markerVersion, previous, fromVersion, manualDetails) {
         }
         return 0;
     }
-    const codemodScriptsRoot = findCodemodScriptsRoot(repoRoot);
+    const { repoRoot, resolveFrom: codemodResolveFrom } = codemodLocation;
+    const codemodScriptsRoot = findCodemodScriptsRootPreferring(codemodResolveFrom, repoRoot);
     if (codemodScriptsRoot === null) {
-        out.err(`  ✗ could not locate @cosmicdrift/kumiko-feature-ast/src/scripts/codemod — is @cosmicdrift/kumiko-cli or @cosmicdrift/kumiko-dev-server installed? searched from ${repoRoot} upward`);
+        const searched = codemodResolveFrom === undefined ? repoRoot : `${codemodResolveFrom} and ${repoRoot}`;
+        out.err(`  ✗ could not locate @cosmicdrift/kumiko-feature-ast/src/scripts/codemod — is @cosmicdrift/kumiko-cli or @cosmicdrift/kumiko-dev-server installed? searched from ${searched} upward`);
         return 1;
     }
     const ran = [];
     for (const e of codemodEntries) {
-        const scriptPath = resolveCodemodScript(repoRoot, e.codemod);
+        const scriptPath = resolveCodemodScriptAt(codemodScriptsRoot, e.codemod);
         if (!scriptPath) {
             out.err(`  ✗ ${e.version} · ${e.title} — invalid codemod path "${e.codemod}"`);
             if (!dryRun)
@@ -681,7 +687,7 @@ function planUpgrade(args, cwd, targetDir) {
         value: { ...baseline.value, targetInstalledVersion, allEntries, pending },
     };
 }
-async function applyPlannedUpgrade(out, args, plan, repoRoot, targetDir) {
+async function applyPlannedUpgrade(out, args, plan, codemodLocation, targetDir) {
     // Marker must reflect what is actually installed under the target (or
     // cwd), not the filter baseline above — otherwise CI stays green forever.
     const markerVersion = plan.targetInstalledVersion;
@@ -690,7 +696,7 @@ async function applyPlannedUpgrade(out, args, plan, repoRoot, targetDir) {
         return failUpgrade(out, `Could not detect the installed Kumiko version under ${targetDir}.`, "Refusing to write an upgrade marker without it (--from is only a filter).");
     }
     out.log("");
-    const code = await applyCodemods(out, plan.pending, repoRoot, targetDir, dryRun, markerVersion ?? plan.currentVersion, carryOf(plan.markerRead), plan.currentVersion, getFlag(args, "verbose") ? manualDetailsOf(plan.allEntries) : undefined);
+    const code = await applyCodemods(out, plan.pending, codemodLocation, targetDir, dryRun, markerVersion ?? plan.currentVersion, carryOf(plan.markerRead), plan.currentVersion, getFlag(args, "verbose") ? manualDetailsOf(plan.allEntries) : undefined);
     out.log("");
     return code;
 }
@@ -802,7 +808,13 @@ export async function runUpgradeCli(argv, cwd, out, options) {
     if (planned.kind === "error")
         return failUpgrade(out, ...planned.lines);
     if (getFlag(args, "apply")) {
-        return applyPlannedUpgrade(out, args, planned.value, options?.repoRoot ?? cwd, targetDir);
+        const codemodLocation = {
+            repoRoot: options?.repoRoot ?? cwd,
+            ...(options?.codemodResolveFrom !== undefined && {
+                resolveFrom: options.codemodResolveFrom,
+            }),
+        };
+        return applyPlannedUpgrade(out, args, planned.value, codemodLocation, targetDir);
     }
     if (getFlag(args, "json"))
         return reportUpgradeJson(out, planned.value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.390.0",
+  "version": "0.390.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -199,7 +199,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.390.0",
+    "@cosmicdrift/kumiko-types": "0.390.1",
     "bullmq": "^5.76.7",
     "hono": "^4.13.1",
     "i18next": "^26.1.0",
@@ -209,7 +209,7 @@
     "temporal-polyfill": "^0.3.2",
     "uuid": "^14.0.0",
     "write-excel-file": "^4.1.1",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "peerDependencies": {
     "bun-types": "^1.4.4",
@@ -221,7 +221,7 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.390.0",
+    "@cosmicdrift/kumiko-testing": "0.390.1",
     "bun-types": "^1.4.4",
     "fflate": "^0.8.2",
     "meilisearch": "^0.58.0",

package/src/changes.json

@@ -1,4 +1,34 @@
 [
+  {
+    "version": "0.390.1",
+    "type": "fix",
+    "title": "schema apply in the production image uses the runtime's row-level security mode",
+    "detail": "The app image ships only kumiko/migrations, not kumiko/schema.ts. Without the schema file `schema apply` ran with row-level security \"off\", so kumiko_events, kumiko_snapshots and kumiko_archived_streams were not healed and the boot of an app in \"on\" mode (the default) failed with \"framework tables without it\". Without a schema file apply now uses the same default as runProdApp. RunSchemaCliOptions takes an optional rowLevelSecurity, which wins over the schema file; the scaffolded bin/kumiko.ts passes appConfig.rowLevelSecurity, like bin/main.ts does for runProdApp. Apps that do not set rowLevelSecurity need no change. An app that sets rowLevelSecurity \"off\" and keeps a hand-written bin/kumiko.ts must pass rowLevelSecurity: \"off\" to runSchemaCli, otherwise apply enables row-level security on the framework tables and the app's \"off\" boot check fails."
+  },
+  {
+    "version": "0.390.1",
+    "type": "fix",
+    "title": "Projection rebuilds no longer report drift on timestamptz columns",
+    "detail": "Event payloads keep the microseconds of an instant, the live write stores milliseconds. A rebuild bound the payload's ISO string unchanged and wrote a different value, which the shadow diff reported as column drift. ISO instant strings bound to a timestamptz column are now truncated to milliseconds like Temporal.Instant values."
+  },
+  {
+    "version": "0.390.1",
+    "type": "improvement",
+    "title": "The live row-level security check of `kumiko check` covers only the app's own tables",
+    "detail": "`schema validate` (the boot step of `kumiko check`) checks the live database when DATABASE_URL is set. On a dev database several apps share it failed on the other apps' tables. It now checks the tables kumiko/schema.ts declares plus the framework tables; tables no feature declares any more are still reported by the boot check, which runs against the app's own database. An unreachable database still fails the check."
+  },
+  {
+    "version": "0.390.1",
+    "type": "fix",
+    "title": "kumiko-upgrade runs the codemods of its own feature-ast install",
+    "detail": "The kumiko-upgrade bins of kumiko-cli and kumiko-dev-server now look for the codemod scripts from their own package first, so a feature-ast copy hoisted above the app (for example in a workspace parent) can no longer supply codemods of another version. runUpgradeCli takes an optional codemodResolveFrom for that; without it the search still starts at the repo root."
+  },
+  {
+    "version": "0.390.1",
+    "type": "fix",
+    "title": "zod range moved to ^4.6.7",
+    "detail": "All framework packages and the scaffold template require zod ^4.6.7, which fixes GHSA-MRHX-C7XC-M3W5."
+  },
   {
     "version": "0.390.0",
     "type": "fix",