@cosmicdrift/kumiko-server-runtime 0.389.0 → 0.390.1

package/dist/boot/apply-boot-seeds.js

@@ -1,4 +1,5 @@
 import { seedAllConfigValues } from "@cosmicdrift/kumiko-bundled-features/config";
+import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 // Single boot-seed entry-point. runDevApp + runProdApp both call this
 // from their post-stack hook, so the wiring lives in exactly one place
 // — config-seed-boot.integration.ts pins this helper, which means a
@@ -7,12 +8,14 @@ import { seedAllConfigValues } from "@cosmicdrift/kumiko-bundled-features/config
 // shipping a server that never seeds.
 // @wrapper-known semantic-alias
 export async function applyBootSeeds(deps) {
-    await seedAllConfigValues(deps.registry, deps.db, deps.cipher);
-    // Loaded lazily: the seeding module pulls the document sanitizer (happy-dom),
-    // which apps without notification templates must not pay for at boot.
-    const hasNotificationTemplates = Array.from(deps.registry.getAllNotifications().values()).some((notification) => notification.template !== undefined);
-    if (hasNotificationTemplates) {
-        const { seedNotificationTemplates } = await import("@cosmicdrift/kumiko-bundled-features/template-resolver/seeding");
-        await seedNotificationTemplates(deps.db, deps.registry);
-    }
+    return runInSystemRowLevelSecurityScope("boot seeds write rows for arbitrary tenants", async () => {
+        await seedAllConfigValues(deps.registry, deps.db, deps.cipher);
+        // Loaded lazily: the seeding module pulls the document sanitizer (happy-dom),
+        // which apps without notification templates must not pay for at boot.
+        const hasNotificationTemplates = Array.from(deps.registry.getAllNotifications().values()).some((notification) => notification.template !== undefined);
+        if (hasNotificationTemplates) {
+            const { seedNotificationTemplates } = await import("@cosmicdrift/kumiko-bundled-features/template-resolver/seeding");
+            await seedNotificationTemplates(deps.db, deps.registry);
+        }
+    });
 }

package/dist/boot/job-run-logger.js

@@ -27,7 +27,7 @@ export async function startDevJobRunners(opts) {
             consumerLane: lane,
             ...logger,
         });
-        // Without this, ctx.write/ctx.queryAs inside a dev-run job throw
+        // Without this, ctx.dispatch.write/ctx.dispatch.queryAs inside a dev-run job throw
         // "dispatcher attached — call attachDispatcher() first" on their first
         // call — the prod entrypoints attach automatically, dev boot must too.
         jr.attachDispatcher(dispatcherToWriteRef(opts.dispatcher));

package/dist/boot/shared-boot-steps.d.ts

@@ -1,7 +1,7 @@
 import { type SeedAdminOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import type { AuthRoutesConfig } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { type DbConnection, type RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
 import { type BundledListsOptions, type EffectiveFeaturesResolver, type FeatureDefinition, type Registry, type ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { CacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
@@ -37,7 +37,7 @@ export type SharedAuthRouteSource = SharedAuthFlowFields & Pick<RunProdAppAuthOp
 export type SharedAuthRoutes = AuthFlowRoutes & Pick<AuthRoutesConfig, "membershipQuery" | "loginHandler" | "loginErrorStatusMap" | "cookieDomain" | "retiredCookieDomains" | "allowedOrigins" | "unsafeSkipOriginCheck" | "postAuthLanding" | "mfaVerifyHandler" | "switchTenantMfaGateHandler" | "mfaPreauthEnableStartHandler" | "mfaPreauthConfirmHandler">;
 export declare function buildSharedAuthRoutes(effectiveAuth: SharedAuthRouteSource, hasMfa: boolean): SharedAuthRoutes;
 export declare function waitForKmsHealthy(kms: KmsAdapter, processName: string, deadline: number, clock?: DatabaseWaitClock): Promise<void>;
-export declare function openDatabasePools(databaseUrl: string, envSource: Record<string, string | undefined>): {
+export declare function openDatabasePools(databaseUrl: string, envSource: Record<string, string | undefined>, rowLevelSecurity: RowLevelSecurityMode): {
     readonly db: DbConnection;
     readonly closeDb: () => Promise<void>;
     readonly outsideTransactionDb: DbConnection;

package/dist/boot/shared-boot-steps.js

@@ -52,7 +52,9 @@ export async function applyStandardBootSeeds(deps) {
     // error stays fatal. Later boot steps build on the seeds, so this cannot continue in the background.
     await waitUntilDatabaseReachable(async () => {
         if (admin) {
-            await seedAdminGuarded(db, admin);
+            // Operator-created account, not a self-registration: under emailVerificationMode "strict"
+            // an unverified seed admin could never log in. `admin.emailVerified` still overrides.
+            await seedAdminGuarded(db, { emailVerified: true, ...admin });
         }
         for (const seed of shortcutSeeds) {
             await seed(db);
@@ -145,14 +147,16 @@ export async function waitForKmsHealthy(kms, processName, deadline, clock) {
         throw new Error(`[${processName}] BOOT ABORTED — KMS health check failed (latency ${kmsHealth.latencyMs}ms)`);
     }
 }
-export function openDatabasePools(databaseUrl, envSource) {
+export function openDatabasePools(databaseUrl, envSource, rowLevelSecurity) {
     const { db, close: closeDb } = createDbConnection({
         url: databaseUrl,
+        rowLevelSecurity,
         ...dbConnectionOptionsFromEnv(envSource),
         ...serverTimeoutOptionsFromEnv(envSource),
     });
     const { db: outsideTransactionDb, close: closeOutsideTransactionDb } = createDbConnection({
         url: databaseUrl,
+        rowLevelSecurity,
         ...outsideTransactionPoolOptionsFromEnv(envSource),
         ...serverTimeoutOptionsFromEnv(envSource),
     });

package/dist/boot/stream-tenant-backfill-on-boot.d.ts

@@ -0,0 +1,27 @@
+import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { type DatabaseWaitClock } from "./wait-for-database.ts";
+export declare const STREAM_TENANT_BACKFILL_LOCK_KEY = 1937007206;
+/** Declares that the app has no search backend in any of its processes. */
+export type SearchBackendDeclaration = "none";
+export type StreamBackfillPart = "user" | "tenant";
+export declare function streamBackfillPendingId(part: StreamBackfillPart): string;
+export type StreamBackfillPartOutcome = "feature-missing" | "no-search-adapter" | "completed" | "failed";
+export type StreamTenantBackfillOutcome = {
+    readonly user: StreamBackfillPartOutcome;
+    readonly tenant: StreamBackfillPartOutcome;
+    readonly aggregatesMigrated: number;
+};
+type Log = ReturnType<typeof createFallbackLogger>;
+export declare function runStreamTenantBackfillOnBoot(opts: {
+    readonly db: DbConnection;
+    readonly registry: Registry;
+    readonly extraContext: object;
+    readonly processName: string;
+    /** `"none"`: the app has no search backend. Without it a process lacking a search adapter defers the work. */
+    readonly search?: SearchBackendDeclaration;
+    readonly databaseWait?: DatabaseWaitClock;
+    readonly log?: Log;
+}): Promise<StreamTenantBackfillOutcome>;
+export {};

package/dist/boot/stream-tenant-backfill-on-boot.js

@@ -0,0 +1,161 @@
+// Moves legacy tenant, tenant-membership and user streams onto the tenant their
+// aggregate type now addresses (SYSTEM_TENANT_ID or the membership's payload tenant), then
+// repairs the derived state (stale search docs, projection rows, index).
+//
+// There is no completion marker: every boot searches for legacy streams, so streams that
+// older pods write during a rolling deploy are fixed on the next boot. The search only reads
+// events of other tenants than the target (shared/stream-tenant-backfill.ts), which is cheap
+// when nothing is left. Once the scan finds work a part writes a "derived-pending" row (a clean boot writes nothing); while it exists,
+// rebuild and reindex run even if no stream moves, so a crash after the moves cannot leave
+// stale rows behind. Failures are logged and retried on the next boot.
+// A process that has no search adapter although the entity is searchable leaves the work to
+// one that has: moving streams without cleaning the old buckets would orphan search docs.
+// An app that declares `search: "none"` has no search backend in any process, so there are no
+// docs to orphan: the step moves and rebuilds, and the reindex stays out.
+import { backfillTenantStreamTenants } from "@cosmicdrift/kumiko-bundled-features/tenant";
+import { backfillUserStreamTenantsWithDerivedState } from "@cosmicdrift/kumiko-bundled-features/user";
+import { resolveBaseDbAndSearchAdapter } from "@cosmicdrift/kumiko-framework/api";
+import { deleteMany, fetchOne, insertOne, listEventTenantIds, withSessionAdvisoryLock, } from "@cosmicdrift/kumiko-framework/db";
+import { createEsOperationsTable, esOperationsTable } from "@cosmicdrift/kumiko-framework/es-ops";
+import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { waitUntilDatabaseReachable } from "./wait-for-database.js";
+export const STREAM_TENANT_BACKFILL_LOCK_KEY = 0x73_74_62_66; // 'stbf'
+export function streamBackfillPendingId(part) {
+    return `stream-tenant-backfill:${part}:derived-pending`;
+}
+export async function runStreamTenantBackfillOnBoot(opts) {
+    const { db, registry, processName, search } = opts;
+    const log = opts.log ?? createFallbackLogger("stream-tenant-backfill");
+    const parts = ["user", "tenant"].filter((part) => registry.features.has(part));
+    const { searchAdapter } = resolveBaseDbAndSearchAdapter(opts.extraContext, registry);
+    if (search === "none" && searchAdapter) {
+        throw new Error(`${processName}: \`search: "none"\` declares an app without a search backend, but extraContext provides a searchAdapter. Remove one of the two.`);
+    }
+    if (parts.length === 0)
+        return outcomeOf(parts, {}, 0);
+    return waitUntilDatabaseReachable(() => runInSystemRowLevelSecurityScope("stream tenant backfill moves streams across tenants", async () => {
+        await createEsOperationsTable(db);
+        return withSessionAdvisoryLock(db, STREAM_TENANT_BACKFILL_LOCK_KEY, async () => {
+            const deps = {
+                db,
+                registry,
+                searchAdapter,
+                log,
+                search,
+                scanTenantIds: await listEventTenantIds(db),
+            };
+            const outcomes = {};
+            let migrated = 0;
+            for (const part of parts) {
+                const result = await runPart(part, deps);
+                outcomes[part] = result.outcome;
+                migrated += result.aggregatesMigrated;
+            }
+            return outcomeOf(parts, outcomes, migrated);
+        });
+    }), { ...opts.databaseWait, processName, target: "database (stream tenant backfill)" });
+}
+function outcomeOf(parts, outcomes, aggregatesMigrated) {
+    const of = (part) => parts.includes(part) ? (outcomes[part] ?? "completed") : "feature-missing";
+    return { user: of("user"), tenant: of("tenant"), aggregatesMigrated };
+}
+async function operationExists(db, id) {
+    return (await fetchOne(db, esOperationsTable, { id })) !== undefined;
+}
+// An app declaring `search: "none"` has no docs to orphan, so only apps that may have a backend defer.
+function isDeferredWithoutSearchAdapter(searchable, deps) {
+    return searchable && !deps.searchAdapter && deps.search !== "none";
+}
+async function runPart(part, deps) {
+    const { db, registry, log } = deps;
+    const entity = part === "user" ? "user" : "tenant";
+    const searchable = registry.getSearchableFields(entity).length > 0 ||
+        registry.getSearchPayloadExtensions(entity).length > 0;
+    const blockedWithoutAdapter = isDeferredWithoutSearchAdapter(searchable, deps);
+    const warnBlocked = () => log.warn(`stream tenant backfill (${part}) has work but "${entity}" is searchable and this process has no search adapter; a process with one runs it`);
+    const pendingId = streamBackfillPendingId(part);
+    const wasPending = await operationExists(db, pendingId);
+    if (wasPending && blockedWithoutAdapter) {
+        warnBlocked();
+        return { outcome: "no-search-adapter", aggregatesMigrated: 0 };
+    }
+    // A clean boot writes nothing: the pending row appears only once the scan found work.
+    let pendingExists = wasPending;
+    let skipped = false;
+    const onFirstCandidate = async () => {
+        if (skipped || blockedWithoutAdapter) {
+            if (!skipped)
+                warnBlocked();
+            skipped = true;
+            return "skip";
+        }
+        if (!pendingExists) {
+            await recordPending(db, pendingId);
+            pendingExists = true;
+        }
+        return "proceed";
+    };
+    // A throw (transient connection error) reaches waitUntilDatabaseReachable; the pending row stays for the retry.
+    const run = await runBackfill(part, deps, wasPending ? "always" : "if-moved", onFirstCandidate);
+    if (skipped)
+        return { outcome: "no-search-adapter", aggregatesMigrated: 0 };
+    for (const failure of run.failures) {
+        log.error(`stream tenant backfill (${part}) failed; it is retried on the next boot`, {
+            aggregateId: failure.aggregateId,
+            step: failure.step,
+            error: failure.error,
+        });
+    }
+    if (run.failures.length > 0) {
+        // Moves that keep failing (a broken aggregate) must not force rebuild and reindex on every
+        // boot: the pending row only guards the derived steps, which succeeded here.
+        if (pendingExists && !run.failures.some(isDerivedStateFailure)) {
+            await clearPending(db, pendingId);
+        }
+        return { outcome: "failed", aggregatesMigrated: run.aggregatesMigrated };
+    }
+    if (pendingExists)
+        await clearPending(db, pendingId);
+    if (run.aggregatesMigrated > 0) {
+        log.info(`stream tenant backfill (${part}) moved streams`, {
+            aggregatesMigrated: run.aggregatesMigrated,
+        });
+    }
+    return { outcome: "completed", aggregatesMigrated: run.aggregatesMigrated };
+}
+// Step names of rebuildAndReindex in bundled-features/shared/stream-tenant-derived-state.ts.
+function isDerivedStateFailure(failure) {
+    return failure.step === "rebuild" || failure.step === "reindex";
+}
+async function clearPending(db, pendingId) {
+    await deleteMany(db, esOperationsTable, { id: pendingId });
+}
+async function recordPending(db, id) {
+    await insertOne(db, esOperationsTable, {
+        id,
+        operationType: "stream-migration",
+        durationMs: 0,
+        appliedBy: "boot",
+    });
+}
+async function runBackfill(part, deps, derived, onFirstCandidate) {
+    const { db, registry, searchAdapter, scanTenantIds } = deps;
+    const common = {
+        db,
+        registry,
+        derived,
+        onFirstCandidate,
+        ...(searchAdapter && { searchAdapter }),
+        scanTenantIds,
+    };
+    if (part === "user") {
+        const result = await backfillUserStreamTenantsWithDerivedState(common);
+        return { failures: result.failures, aggregatesMigrated: result.streams.aggregatesMigrated };
+    }
+    const result = await backfillTenantStreamTenants(common);
+    return {
+        failures: result.failures,
+        aggregatesMigrated: result.tenants.aggregatesMigrated + result.memberships.aggregatesMigrated,
+    };
+}

package/dist/boot/warn-row-level-security-off.d.ts

@@ -0,0 +1,3 @@
+import type { RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
+import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
+export declare function warnIfRowLevelSecurityOff(mode: RowLevelSecurityMode, log: Pick<Logger, "warn">): void;

package/dist/boot/warn-row-level-security-off.js

@@ -0,0 +1,6 @@
+export function warnIfRowLevelSecurityOff(mode, log) {
+    // skip: the default mode needs no warning
+    if (mode !== "off")
+        return;
+    log.warn("rowLevelSecurity is off: tenant isolation relies on the application layer only; Postgres row level security is not enforced");
+}

package/dist/boot/worker-boot-core.d.ts

@@ -25,8 +25,9 @@ export type BootedWorkerProcess = {
     readonly registry: Registry;
     readonly features: readonly FeatureDefinition[];
     readonly envSource: Record<string, string | undefined>;
+    readonly extraContext: Record<string, unknown>;
     readonly entrypoint: WorkerEntrypoint;
-    /** ctx.secrets as wired into the entrypoint (auto-wired when the secrets
+    /** ctx.services.secrets as wired into the entrypoint (auto-wired when the secrets
      *  feature is mounted and a master key exists, or from `extraContext`). */
     readonly secrets?: SecretsContext;
     /** Envelope cipher for `encrypted` config keys, when a master key is wired. */

package/dist/boot/worker-boot-core.js

@@ -5,9 +5,11 @@
 // share every step that decides ciphers, blind indexes and config encryption.
 import { loadJwtSecretOrKeyring } from "@cosmicdrift/kumiko-framework/api";
 import { configureBlindIndexKey, configurePiiSubjectKms, resolvePlatformKeks, } from "@cosmicdrift/kumiko-framework/crypto";
-import { configureEntityFieldEncryption, } from "@cosmicdrift/kumiko-framework/db";
+import { assertRowLevelSecurityBootState, configureEntityFieldEncryption, knownTablesOf, } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry, validateBoot, } from "@cosmicdrift/kumiko-framework/engine";
 import { createWorkerEntrypoint, } from "@cosmicdrift/kumiko-framework/entrypoint";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { assertKumikoSchemaCurrent, SchemaDriftError, } from "@cosmicdrift/kumiko-framework/migrations";
 import { createEntityCache, createEventDedup, createIdempotencyGuard, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { createRedisCacheSyncBus, redisClientOptionsFromEnv, } from "@cosmicdrift/kumiko-framework/redis";
@@ -23,6 +25,7 @@ import { jobRunLoggerCallbacks } from "./job-run-logger.js";
 import { INSTANCE_ID_ENV } from "./record-app-started-on-boot.js";
 import { buildEffectiveFeaturesResolver, openDatabasePools, waitForKmsHealthy, } from "./shared-boot-steps.js";
 import { WAIT_FOR_DATABASE_DEADLINE_MS, waitForDatabase } from "./wait-for-database.js";
+import { warnIfRowLevelSecurityOff } from "./warn-row-level-security-off.js";
 import { assertWorkerMetricsOptions } from "./worker-metrics-server.js";
 function isSecretsContext(value) {
     if (typeof value !== "object" || value === null)
@@ -62,6 +65,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
     const databaseUrl = requireEnv("DATABASE_URL", envSource, processName);
     const redisUrl = requireEnv("REDIS_URL", envSource, processName);
     const jwtSecretOrKeyring = loadJwtSecretOrKeyring(envSource);
+    const rowLevelSecurity = options.rowLevelSecurity ?? DEFAULT_ROW_LEVEL_SECURITY_MODE;
     // MUST be composed with the same `includeBundled` as the API process.
     const includeBundled = !!options.includeBundled || profile.authOptions !== undefined;
     const features = composeFeatures(options.features, {
@@ -97,7 +101,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
     if (options.kms) {
         await waitForKmsHealthy(options.kms, processName, databaseWaitDeadline, options.databaseWait);
     }
-    const { db, closeDb, outsideTransactionDb, closeOutsideTransactionDb } = openDatabasePools(databaseUrl, envSource);
+    const { db, closeDb, outsideTransactionDb, closeOutsideTransactionDb } = openDatabasePools(databaseUrl, envSource, rowLevelSecurity);
     const redis = new Redis(redisUrl, { maxRetriesPerRequest: null });
     const cacheSync = createRedisCacheSyncBus({
         redisUrl,
@@ -136,6 +140,16 @@ export async function bootWorkerProcess(options, envSource, profile) {
             throw err;
         }
     }
+    try {
+        await assertRowLevelSecurityBootState(db, rowLevelSecurity, knownTablesOf(features));
+    }
+    catch (err) {
+        await closeDb();
+        await closeOutsideTransactionDb();
+        redis.disconnect();
+        await cacheSync.close();
+        throw err;
+    }
     const idempotency = createIdempotencyGuard(redis, { ttlSeconds: 60 });
     const eventDedup = createEventDedup(redis, { ttlSeconds: 60 });
     const entityCache = createEntityCache(redis, { ttlSeconds: 60 });
@@ -149,6 +163,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
     configurePiiSubjectKms(options.kms);
     configureBlindIndexKey(options.blindIndexKey);
     const bootLogger = loggerFromExtraContext(resolvedExtraContext);
+    warnIfRowLevelSecurityOff(rowLevelSecurity, bootLogger ?? createFallbackLogger(processName));
     const autoExtraContext = buildBootExtraContext({
         db,
         features,
@@ -166,6 +181,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
     const jobLogger = jobRunLoggerCallbacks(registry, db);
     const entrypoint = createWorkerEntrypoint({
         registry,
+        rowLevelSecurity,
         context: { db, redis, entityCache, registry, ...extraContext },
         jwtSecret: jwtSecretOrKeyring,
         dispatcherOptions: {
@@ -197,6 +213,7 @@ export async function bootWorkerProcess(options, envSource, profile) {
         registry,
         features,
         envSource,
+        extraContext,
         entrypoint,
         ...(isSecretsContext(extraContext["secrets"]) && { secrets: extraContext["secrets"] }),
         ...(bootCrypto.configCipher && { configCipher: bootCrypto.configCipher }),

package/dist/boot/worker-metrics-server.js

@@ -1,6 +1,7 @@
 // /metrics for HTTP-less worker pods: the worker entrypoint has no Hono app,
 // so scraping needs its own tiny server on a dedicated port.
 import { createMetricsApp, isPrometheusMeter, } from "@cosmicdrift/kumiko-framework/api";
+import { assertNoActiveRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/db";
 /** Fails the boot (also under KUMIKO_DRY_RUN_ENV=boot) on a metrics config
  *  that would otherwise only surface as a 503 on the first scrape. */
 export function assertWorkerMetricsOptions(metrics, observability, processName) {
@@ -16,6 +17,7 @@ export function assertWorkerMetricsOptions(metrics, observability, processName)
 }
 export function startWorkerMetricsServer(metrics, entrypoint) {
     const app = createMetricsApp(entrypoint.observability.meter, metrics);
+    assertNoActiveRowLevelSecurityScope("worker metrics server");
     const server = Bun.serve({ port: metrics.port, fetch: app.fetch });
     entrypoint.lifecycle.registerShutdownHook("metrics-server", async () => {
         await server.stop();

package/dist/boot-options/seed-shortcuts.js

@@ -28,7 +28,9 @@ function membershipOf(tenant, roles) {
 }
 function seedAccount(admin) {
     return async (db) => {
-        await seedAdminGuarded(db, admin);
+        // Operator-created account, not a self-registration: under emailVerificationMode "strict"
+        // an unverified seed account could never log in. An explicit `emailVerified` still overrides.
+        await seedAdminGuarded(db, { emailVerified: true, ...admin });
     };
 }
 function buildDemoAdminSeed(value, demoTenant, envSource) {

package/dist/compose-features.js

@@ -26,6 +26,9 @@ import { FILES_FEATURE } from "@cosmicdrift/kumiko-framework/files";
 import { createRendererMailHtmlFeature } from "@cosmicdrift/kumiko-renderer-mail-html";
 import { applyBundledListsTable } from "./bundled-lists-table.js";
 export { buildComposeAuthOptions } from "./compose-auth-options.js";
+// Output of a first composeFeatures pass comes back as app features when a caller composes twice (the app
+// config already composed, boot composes again); those copies are dropped silently, only app-supplied ones warn.
+const composedBundledInstances = new WeakSet();
 export function composeFeatures(appFeatures, options) {
     // ponytail: includeBundled:false skips the auth-mfa auto-wiring below —
     // an app composing its own foundation and mounting auth-mfa itself is
@@ -74,6 +77,8 @@ export function composeFeatures(appFeatures, options) {
         // "on unless an operator flips it off at runtime" contract.
         ...(authOptions?.signup !== undefined ? [createAuthSelfRegistrationToggleFeature()] : []),
     ];
+    for (const f of bundled)
+        composedBundledInstances.add(f);
     const bundledNames = new Set(bundled.map((f) => f.name));
     const filteredApp = [];
     for (const f of dedupedAppFeatures) {
@@ -83,6 +88,8 @@ export function composeFeatures(appFeatures, options) {
             // authOptions.signup and only get it from there.
             if (f.name === AUTH_SELF_REGISTRATION_FEATURE)
                 continue;
+            if (composedBundledInstances.has(f))
+                continue;
             // biome-ignore lint/suspicious/noConsole: boot-time UX warning
             console.warn(`[composeFeatures] "${f.name}" already auto-mounted via includeBundled — dropping the explicit copy from APP_FEATURES. Remove it from run-config.ts to silence this warning.`);
             continue;

package/dist/extra-routes-deps.d.ts

@@ -26,7 +26,7 @@ export type SystemWireDeps = {
     readonly masterKeyProvider?: MasterKeyProvider;
     /** Cipher for `encrypted: true` config keys, same instance and DEK cache as the handlers use. */
     readonly configEncryption?: EnvelopeCipher;
-    /** Same contract as `ctx.metricsFor`: unregistered metric names no-op. */
+    /** Same contract as `ctx.obs.metricsFor`: unregistered metric names no-op. */
     readonly metricsFor: (featureName: string) => MetricsHandle;
     /** Writes through the /api/*-command-dispatcher (same idempotency/job
      *  hooks) as an auto-constructed SystemAdmin of the target tenant,

package/dist/run-prod-app-boot-context.js

@@ -23,13 +23,11 @@ import { resolveBootCrypto } from "./boot/boot-crypto.js";
 export function addConfigAccessorFactory(resolved, registry) {
     if (!resolved.configResolver)
         return resolved;
-    // Both keys, always overriding an app-supplied value: the factory must derive from the
-    // effective resolver; the underscore alias stays until the next major.
+    // Always overrides an app-supplied value: the factory must derive from the effective resolver.
     const configAccessorFactory = createConfigAccessorFactory(registry, resolved.configResolver);
     return {
         ...resolved,
         configAccessorFactory,
-        _configAccessorFactory: configAccessorFactory,
     };
 }
 // Framework-default providers for AppContext, using the same mechanism as
@@ -42,7 +40,7 @@ export function addConfigAccessorFactory(resolved, registry) {
 // boot/boot-crypto.ts (envHasMasterKek, resolveBootCrypto), shared with runDevApp.
 // A production misconfiguration (secrets mounted without a KEK) is caught by
 // secretsEnvSchema during boot; without the env-schema path, requireSecretsContext
-// throws with a wiring hint on the first ctx.secrets access. configResolver is only
+// throws with a wiring hint on the first ctx.services.secrets access. configResolver is only
 // wired in auth mode. Exported and pure for unit tests; the caller merges it with
 // app values (the app wins).
 // Prod/dev parity for ctx.notify: without this `_notifyFactory` is only wired
@@ -116,7 +114,7 @@ function bootCryptoContext(crypto) {
         ...(crypto.masterKeyProvider && { masterKeyProvider: crypto.masterKeyProvider }),
         // Encrypt/decrypt partner for `encrypted: true` config keys. Wired
         // whenever a master key exists — NOT gated on the secrets feature,
-        // config encryption must work without mounting ctx.secrets.
+        // config encryption must work without mounting ctx.services.secrets.
         ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
     };
 }

package/dist/run-prod-app-config.d.ts

@@ -1,4 +1,5 @@
 import { loadJwtSecretOrKeyring } from "@cosmicdrift/kumiko-framework/api";
+import type { RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
 import { type FeatureDefinition, type Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import { resolveBootCrypto } from "./boot/boot-crypto.ts";
@@ -15,6 +16,7 @@ export type ProdBootConfig = {
     readonly envSource: Record<string, string | undefined>;
     readonly bootKms: BootOptionWiring["kms"];
     readonly databaseUrl: string;
+    readonly rowLevelSecurity: RowLevelSecurityMode;
     readonly redisUrl: string;
     readonly jwtSecret: string;
     readonly jwtSecretOrKeyring: ReturnType<typeof loadJwtSecretOrKeyring>;

package/dist/run-prod-app-config.js

@@ -2,6 +2,7 @@ import { EXT_SESSION_STORE } from "@cosmicdrift/kumiko-bundled-features/auth-fou
 import { SESSIONS_FEATURE } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { loadJwtSecretOrKeyring, TRUSTED_PROXY_HOPS_ENV } from "@cosmicdrift/kumiko-framework/api";
 import { createRegistry, } from "@cosmicdrift/kumiko-framework/engine";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { resolveBootCrypto } from "./boot/boot-crypto.js";
 import { composeAppFeatures, validateComposedFeatures, withEnvDefaults, } from "./boot/shared-boot-steps.js";
@@ -100,6 +101,7 @@ export async function resolveProdBootConfig(options, decryptedEnvSource, log, re
         envSource,
         bootKms,
         databaseUrl,
+        rowLevelSecurity: options.rowLevelSecurity ?? DEFAULT_ROW_LEVEL_SECURITY_MODE,
         redisUrl,
         jwtSecret,
         jwtSecretOrKeyring,

package/dist/run-prod-app-connections.js

@@ -8,7 +8,7 @@ import { WAIT_FOR_DATABASE_DEADLINE_MS, waitForDatabase, } from "./boot/wait-for
 // immediately. `new Redis(...)` connects eagerly, so this must stay AFTER the
 // boot-mode exit.
 export async function connectProdDependencies(config, log, registerAbortCleanup, databaseWait) {
-    const { bootKms, databaseUrl, redisUrl, envSource } = config;
+    const { bootKms, databaseUrl, redisUrl, envSource, rowLevelSecurity } = config;
     // KMS health gate: an app configured for crypto-shredding must not boot
     // against an unreachable key store — a silent start would answer every
     // PII read with 503. Runs BEFORE connections so an abort leaks nothing.
@@ -16,7 +16,7 @@ export async function connectProdDependencies(config, log, registerAbortCleanup,
     if (bootKms.kms) {
         await waitForKmsHealthy(bootKms.kms, "runProdApp", databaseWaitDeadline, databaseWait);
     }
-    const pools = openDatabasePools(databaseUrl, envSource);
+    const pools = openDatabasePools(databaseUrl, envSource, rowLevelSecurity);
     const redis = new Redis(redisUrl, { maxRetriesPerRequest: null });
     registerAbortCleanup(pools.closeDb);
     registerAbortCleanup(pools.closeOutsideTransactionDb);

package/dist/run-prod-app-entrypoint.d.ts

@@ -10,5 +10,5 @@ export declare function buildProdEntrypointOptions(options: RunProdAppOptions, c
 export type ProdEntrypointOptions = ReturnType<typeof buildProdEntrypointOptions>;
 export declare function createProdEntrypoint(options: RunProdAppOptions, config: ProdBootConfig, composed: ProdComposedFeatures, connections: ProdConnections, entrypointOptions: ProdEntrypointOptions): ProdEntrypoint;
 export declare function registerProdShutdownHooks(entrypoint: ProdEntrypoint, cacheSync: ProdConnections["cacheSync"], ownedRedisSseBroker: ProdRequestContext["ownedRedisSseBroker"]): void;
-export declare function runProdWireHook(options: RunProdAppOptions, composed: ProdComposedFeatures, connections: ProdConnections, entrypoint: ProdEntrypoint): Promise<void>;
+export declare function runProdWireHook(options: RunProdAppOptions, config: ProdBootConfig, composed: ProdComposedFeatures, connections: ProdConnections, entrypoint: ProdEntrypoint): Promise<void>;
 export declare function startProdBackgroundWork(entrypoint: ProdEntrypoint, config: ProdBootConfig, composed: ProdComposedFeatures, connections: ProdConnections): Promise<void>;

package/dist/run-prod-app-entrypoint.js

@@ -1,4 +1,5 @@
 import { createAllInOneEntrypoint, createApiEntrypoint, } from "@cosmicdrift/kumiko-framework/entrypoint";
+import { appHookScopedRunner } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { createMetricsForFactory } from "@cosmicdrift/kumiko-framework/observability";
 import { jobRunLoggerCallbacks } from "./boot/job-run-logger.js";
 import { startPiiEventBackfillOnBoot } from "./boot/pii-event-backfill-on-boot.js";
@@ -27,6 +28,7 @@ export function buildProdEntrypointOptions(options, config, composed, connection
             registry,
             ...requestContext.extraContext,
         },
+        rowLevelSecurity: config.rowLevelSecurity,
         sseBroker: requestContext.sseBroker,
         jwtSecret: config.jwtSecretOrKeyring,
         ...(jwtIssuer && { jwtIssuer }),
@@ -119,12 +121,12 @@ export function registerProdShutdownHooks(entrypoint, cacheSync, ownedRedisSseBr
 // runs. `wire` is the remaining escape-hatch for app-wired co-running
 // components that need the system-write dispatcher but don't declare a
 // route.
-export async function runProdWireHook(options, composed, connections, entrypoint) {
+export async function runProdWireHook(options, config, composed, connections, entrypoint) {
     const { wire } = options;
     if (wire) {
         const { bootCrypto } = composed;
         await wire({
-            db: connections.db,
+            db: appHookScopedRunner(connections.db, config.rowLevelSecurity),
             redis: connections.redis,
             registry: composed.registry,
             filesForTenant: makeFilesForTenant(entrypoint.context),

package/dist/run-prod-app-handle.js

@@ -1,3 +1,4 @@
+import { assertNoActiveRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/db";
 import { flushEscapeHatchAudits } from "@cosmicdrift/kumiko-framework/pipeline";
 import { installShutdownSignals } from "./boot-options/process-signals.js";
 import { buildBunServeOptions, resolveDerivedMaxRequestBodySize } from "./bun-serve-options.js";
@@ -65,6 +66,7 @@ export function createProdAppHandle(input) {
                 throw new Error("[runProdApp] listen() requires Bun runtime (Bun.serve). " +
                     "Under Node/vitest pass `autoListen: false` and call the returned `fetch()` directly.");
             }
+            assertNoActiveRowLevelSecurityScope("prod app server");
             handle.server = Bun.serve(buildBunServeOptions(listenPort, fetchHandler, options.maxRequestBodySize ?? resolveDerivedMaxRequestBodySize(composed.registry), { upgradeFetch: webSocketUpgradeFetch }));
             // SIGTERM/SIGINT — graceful shutdown. Only registered when we
             // actually own a Bun-server, otherwise the test process picks up

package/dist/run-prod-app-request-context.js

@@ -2,6 +2,7 @@ import { resolveAnonymousAccessFromRegistry } from "@cosmicdrift/kumiko-bundled-
 import { createDefaultSseBroker } from "@cosmicdrift/kumiko-framework/api";
 import { configureBlindIndexKey, configurePiiSubjectKms, } from "@cosmicdrift/kumiko-framework/crypto";
 import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import { appHookScopedRunner } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { createFallbackLogger, setProcessLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { createEntityCache, createEventDedup, createIdempotencyGuard, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { addConfigAccessorFactory, buildBootExtraContext, loggerFromExtraContext, } from "./run-prod-app-boot-context.js";
@@ -47,7 +48,13 @@ function buildProdExtraContext(options, config, composed, connections, deps) {
         ...(options.defaultLocale !== undefined && { defaultLocale: options.defaultLocale }),
     };
 }
-async function resolveProdAnonymousAccess(options, deps) {
+async function resolveProdAnonymousAccess(options, requestDeps, config) {
+    // extraContext services run inside requests and keep the ambient tenant scope; only this
+    // boot-time factory and the registry resolvers get the system scope.
+    const deps = {
+        ...requestDeps,
+        db: appHookScopedRunner(requestDeps.db, config.rowLevelSecurity),
+    };
     const baseAnonymousAccess = typeof options.anonymousAccess === "function"
         ? options.anonymousAccess(deps)
         : options.anonymousAccess;
@@ -90,7 +97,7 @@ export async function buildProdRequestContext(options, config, composed, connect
         ...(bootCrypto.configCipher && { configEncryption: bootCrypto.configCipher }),
     };
     const extraContext = buildProdExtraContext(options, config, composed, connections, deps);
-    const resolvedAnonymousAccess = await resolveProdAnonymousAccess(options, deps);
+    const resolvedAnonymousAccess = await resolveProdAnonymousAccess(options, deps, config);
     return {
         idempotency,
         eventDedup,

package/dist/run-prod-app-seeds.js

@@ -1,7 +1,9 @@
 import { withFileProviderResolver } from "@cosmicdrift/kumiko-framework/api";
 import { createEsOperationsTable, createSeedMigrationContext, runPendingSeedMigrations, } from "@cosmicdrift/kumiko-framework/es-ops";
+import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { createDispatcher, createUnlimitedRateLimitResolver, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { applyStandardBootSeeds } from "./boot/shared-boot-steps.js";
+import { runStreamTenantBackfillOnBoot } from "./boot/stream-tenant-backfill-on-boot.js";
 import { makeSeedCreateFileRef, withSeedErrorContext, } from "./seed-dispatcher.js";
 // Seeds are bootstrap writes, not tenant traffic: they always get the unlimited resolver,
 // even when the app has a real one, so a handler's rateLimit can neither fail nor drain them.
@@ -58,31 +60,42 @@ async function runSeedMigrations(run, seedsDir, seedDispatcher) {
 // preconditions. Config-seeds rely on a deterministic
 // aggregate-id so re-boot becomes a version_conflict skip.
 export async function runProdBootSeeds(run, entrypoint, dispatcherOptions) {
-    const { options, config, composed, connections } = run;
-    await applyStandardBootSeeds({
-        db: connections.db,
-        registry: composed.registry,
-        admin: composed.effectiveAuth?.admin,
-        shortcutSeeds: config.bootOptionWiring.shortcutSeeds,
-        cipher: composed.bootCrypto.configCipher,
-        processName: "runProdApp",
-        ...(options.databaseWait && { databaseWait: options.databaseWait }),
+    return runInSystemRowLevelSecurityScope("boot seeds write rows for arbitrary tenants", async () => {
+        const { options, config, composed, connections } = run;
+        // First: custom seeds update tenants by version and would crash against unmigrated streams.
+        await runStreamTenantBackfillOnBoot({
+            db: connections.db,
+            registry: composed.registry,
+            extraContext: run.requestContext.extraContext,
+            processName: "runProdApp",
+            ...(options.search && { search: options.search }),
+            ...(options.databaseWait && { databaseWait: options.databaseWait }),
+        });
+        await applyStandardBootSeeds({
+            db: connections.db,
+            registry: composed.registry,
+            admin: composed.effectiveAuth?.admin,
+            shortcutSeeds: config.bootOptionWiring.shortcutSeeds,
+            cipher: composed.bootCrypto.configCipher,
+            processName: "runProdApp",
+            ...(options.databaseWait && { databaseWait: options.databaseWait }),
+        });
+        const hasSeeds = config.bootOptionWiring.customSeeds.length > 0 || options.seedsDir !== undefined;
+        const seedContext = hasSeeds ? buildSeedContext(run) : undefined;
+        const seedDispatcher = seedContext
+            ? withSeedErrorContext(createDispatcher(composed.registry, seedContext, {
+                ...dispatcherOptions,
+                lifecycle: entrypoint.lifecycleHooks,
+                ...(entrypoint.mode === "all-in-one" && { jobRunner: entrypoint.jobRunner }),
+            }))
+            : undefined;
+        if (seedDispatcher && seedContext) {
+            await runCustomSeeds(run, seedContext, seedDispatcher);
+        }
+        if (seedDispatcher &&
+            options.seedsDir !== undefined &&
+            config.envSource["KUMIKO_SKIP_ES_OPS"] !== "1") {
+            await runSeedMigrations(run, options.seedsDir, seedDispatcher);
+        }
     });
-    const hasSeeds = config.bootOptionWiring.customSeeds.length > 0 || options.seedsDir !== undefined;
-    const seedContext = hasSeeds ? buildSeedContext(run) : undefined;
-    const seedDispatcher = seedContext
-        ? withSeedErrorContext(createDispatcher(composed.registry, seedContext, {
-            ...dispatcherOptions,
-            lifecycle: entrypoint.lifecycleHooks,
-            ...(entrypoint.mode === "all-in-one" && { jobRunner: entrypoint.jobRunner }),
-        }))
-        : undefined;
-    if (seedDispatcher && seedContext) {
-        await runCustomSeeds(run, seedContext, seedDispatcher);
-    }
-    if (seedDispatcher &&
-        options.seedsDir !== undefined &&
-        config.envSource["KUMIKO_SKIP_ES_OPS"] !== "1") {
-        await runSeedMigrations(run, options.seedsDir, seedDispatcher);
-    }
 }

package/dist/run-prod-app.d.ts

@@ -3,6 +3,7 @@ import type { AccountLockoutOptions, AccountUnlockOptions, AuthMailLocale, AuthP
 import type { SeedAdminOptions } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import type { ExtraRouteDefinition, KumikoServeEnv, PostAuthLandingResolver, SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import { type RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
 import type { BundledListsOptions, FeatureDefinition, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { AllInOneEntrypoint, ApiEntrypoint } from "@cosmicdrift/kumiko-framework/entrypoint";
 import type { ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
@@ -12,6 +13,7 @@ import type { ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observ
 import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { PageHeadMeta, PageHeadResolver, PageHeadSystemQuery } from "@cosmicdrift/kumiko-renderer/headless/apex";
 import type { Redis } from "ioredis";
+import type { SearchBackendDeclaration } from "./boot/stream-tenant-backfill-on-boot.ts";
 import type { DatabaseWaitClock } from "./boot/wait-for-database.ts";
 import type { BillingBootOption } from "./boot-options/billing-option.ts";
 import type { DemoModeOption } from "./boot-options/demo-mode.ts";
@@ -266,6 +268,13 @@ export type RunProdAppOptions = {
     readonly validateBootOptions?: ValidateBootOptions;
     /** One table block for every list of the bundled features, see ComposeFeaturesOptions.bundledLists. */
     readonly bundledLists?: BundledListsOptions;
+    /** Row level security mode of every connection; pass `appConfig.rowLevelSecurity`. Default "on". */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
+    /** `"none"`: the app has no search backend in any process (no `searchAdapter` in `extraContext`),
+     *  so no search docs can be orphaned and the stream-tenant backfill runs without a reindex. Unset:
+     *  a process without a search adapter defers the backfill of searchable entities to one that has
+     *  it. Combining `"none"` with a `searchAdapter` fails the boot. Must match the worker process. */
+    readonly search?: SearchBackendDeclaration;
     /** Listen-Port. Default 3000 (or $PORT). */
     readonly port?: number;
     /** Ceiling Bun.serve buffers a request body to before any app-level
@@ -342,13 +351,13 @@ export type RunProdAppOptions = {
     readonly defaultLocale?: string;
     readonly extraContext?: ExtraContextOption;
     /** MasterKeyProvider replacing the env KEK (`KUMIKO_SECRETS_MASTER_KEY_V<n>`)
-     *  for `ctx.secrets`, encrypted config keys and `encrypted: true` entity
+     *  for `ctx.services.secrets`, encrypted config keys and `encrypted: true` entity
      *  fields. Default: `createEnvMasterKeyProvider`. Use it for KMS backends
      *  (AWS/GCP/Azure); with it set, `KUMIKO_SECRETS_MASTER_KEY_V1` is not
      *  required in the env. */
     readonly masterKey?: MasterKeyProvider;
     /** Subject-key adapter for crypto-shredding (GDPR Art. 17). When set, it is
-     *  exposed to feature code as `ctx.kms`, and boot checks its health so the app
+     *  exposed to feature code as `ctx.services.kms`, and boot checks its health so the app
      *  cannot start against an unreachable KMS. Without an adapter,
      *  crypto-shredding remains disabled. */
     readonly kms?: KmsAdapter;

package/dist/run-prod-app.js

@@ -39,9 +39,11 @@
 //   same JWT_SECRET.
 //   PORT=3000
 //   KUMIKO_INSTANCE_ID=<stable per replica>
+import { assertRowLevelSecurityBootState, knownTablesOf, } from "@cosmicdrift/kumiko-framework/db";
 import { assertSeedModeNotInProduction } from "@cosmicdrift/kumiko-framework/event-store";
 import { runEnvGate } from "./boot/env-gate.js";
 import { buildEffectiveFeaturesResolver } from "./boot/shared-boot-steps.js";
+import { warnIfRowLevelSecurityOff } from "./boot/warn-row-level-security-off.js";
 import { installProcessLogger, uninstallProcessLogger } from "./process-logger.js";
 import { wireProdAuth } from "./run-prod-app-auth.js";
 import { composeProdFeatures, resolveProdBootConfig, runWithBootAbortCleanups, } from "./run-prod-app-config.js";
@@ -131,12 +133,14 @@ async function bootProdApp(options, registerAbortCleanup) {
         cacheSync: connections.cacheSync,
     });
     await assertProdSchemaCurrent(connections.db, options.migrations, log);
+    await assertRowLevelSecurityBootState(connections.db, config.rowLevelSecurity, knownTablesOf(features));
+    warnIfRowLevelSecurityOff(config.rowLevelSecurity, log);
     const requestContext = await buildProdRequestContext(options, config, composed, connections);
     const authWiring = await wireProdAuth(config, composed, connections);
     const entrypointOptions = buildProdEntrypointOptions(options, config, composed, connections, requestContext, authWiring, effectiveFeatures);
     const entrypoint = createProdEntrypoint(options, config, composed, connections, entrypointOptions);
     registerProdShutdownHooks(entrypoint, connections.cacheSync, requestContext.ownedRedisSseBroker);
-    await runProdWireHook(options, composed, connections, entrypoint);
+    await runProdWireHook(options, config, composed, connections, entrypoint);
     await runProdBootSeeds({ options, config, composed, connections, requestContext }, entrypoint, entrypointOptions.dispatcherOptions);
     await startProdBackgroundWork(entrypoint, config, composed, connections);
     const fetch = await buildProdFetchHandler(options, config, entrypoint);

package/dist/run-worker-app.d.ts

@@ -1,6 +1,6 @@
 import type { ServerOptions } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection, RowLevelSecurityMode } from "@cosmicdrift/kumiko-framework/db";
 import type { BundledListsOptions, FeatureDefinition, Registry, ValidateBootOptions } from "@cosmicdrift/kumiko-framework/engine";
 import type { WorkerEntrypoint } from "@cosmicdrift/kumiko-framework/entrypoint";
 import type { ComposedEnvSchema, KumikoBootError } from "@cosmicdrift/kumiko-framework/env";
@@ -8,6 +8,7 @@ import type { JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
 import { type ObservabilityProvider } from "@cosmicdrift/kumiko-framework/observability";
 import type { MasterKeyProvider, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
+import { type SearchBackendDeclaration } from "./boot/stream-tenant-backfill-on-boot.ts";
 import type { DatabaseWaitClock } from "./boot/wait-for-database.ts";
 import { type WorkerMetricsOptions, type WorkerMetricsServer } from "./boot/worker-metrics-server.ts";
 import type { BillingBootOption } from "./boot-options/billing-option.ts";
@@ -29,13 +30,20 @@ export type WorkerDeps = {
  *  `lifecycle` for `registerShutdownHook`. */
 export type WorkerWireDeps = SystemWireDeps & {
     readonly lifecycle: WorkerEntrypoint["lifecycle"];
-    /** The worker's ctx.secrets — what `createInboundMailSupervisor` needs as
+    /** The worker's ctx.services.secrets — what `createInboundMailSupervisor` needs as
      *  `providerCtx.secrets` (the IMAP provider reads credentials through it,
      *  with `auditUserId` set to a system identity for the audit trail). Undefined
      *  when the secrets feature is not mounted or no master key is available. */
     readonly secrets?: SecretsContext;
 };
 export type RunWorkerAppOptions = {
+    /** Row level security mode of every connection; pass appConfig.rowLevelSecurity. Default "on". */
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
+    /** `"none"`: the app has no search backend in any process (no `searchAdapter` in `extraContext`),
+     *  so no search docs can be orphaned and the stream-tenant backfill runs without a reindex. Unset:
+     *  a process without a search adapter defers the backfill of searchable entities to one that has
+     *  it. Combining `"none"` with a `searchAdapter` fails the boot. Must match the API process. */
+    readonly search?: SearchBackendDeclaration;
     /** App-specific features — same array as in the API/all-in-one process,
      *  so the registry + schema stay identical across processes. */
     readonly features: readonly FeatureDefinition[];
@@ -58,7 +66,7 @@ export type RunWorkerAppOptions = {
      *  RunProdAppOptions["extraContext"], without sseBroker (the worker
      *  has none — see entrypoint/index.ts's documented SSE limitation). */
     readonly extraContext?: WorkerContextOption;
-    /** MasterKeyProvider replacing the env KEK for ctx.secrets, encrypted
+    /** MasterKeyProvider replacing the env KEK for ctx.services.secrets, encrypted
      *  config keys and `encrypted: true` entity fields; with it set,
      *  `KUMIKO_SECRETS_MASTER_KEY_V1` is not required (see
      *  RunProdAppOptions["masterKey"]). */

package/dist/run-worker-app.js

@@ -15,12 +15,14 @@
 // Container/Coolify sets the same env vars as runProdApp:
 //   DATABASE_URL, REDIS_URL, JWT_SECRET — PORT is not needed.
 import { assertSeedModeNotInProduction } from "@cosmicdrift/kumiko-framework/event-store";
+import { appHookScopedRunner, DEFAULT_ROW_LEVEL_SECURITY_MODE, } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { scrubLogText } from "@cosmicdrift/kumiko-framework/logging";
 import { createMetricsForFactory, } from "@cosmicdrift/kumiko-framework/observability";
 import { logRedisConnectionState } from "@cosmicdrift/kumiko-framework/redis";
 import { runEnvGate } from "./boot/env-gate.js";
 import { startPiiEventBackfillOnBoot } from "./boot/pii-event-backfill-on-boot.js";
 import { recordAppStartedOnBoot } from "./boot/record-app-started-on-boot.js";
+import { runStreamTenantBackfillOnBoot, } from "./boot/stream-tenant-backfill-on-boot.js";
 import { bootWorkerProcess, resolveWorkerEnvSource, } from "./boot/worker-boot-core.js";
 import { startWorkerMetricsServer, } from "./boot/worker-metrics-server.js";
 import { resolveBootOptionWiring } from "./boot-options/resolve-boot-options.js";
@@ -49,6 +51,22 @@ async function resolveGatedEnvSource(options) {
 function assertWorkerStackRequirements(options) {
     assertStackBootRequirements({ features: options.features, ...(options.featureToggles && { featureToggles: true }) }, ["featureToggles"]);
 }
+function wireHookDb(db, options) {
+    return appHookScopedRunner(db, options.rowLevelSecurity ?? DEFAULT_ROW_LEVEL_SECURITY_MODE);
+}
+// Runs before the metrics port opens and before start() consumes jobs: a worker must not process
+// events of a feature whose streams still sit on the wrong tenant.
+async function backfillThenStartMetrics(boot, options) {
+    await runStreamTenantBackfillOnBoot({
+        db: boot.db,
+        registry: boot.registry,
+        extraContext: boot.extraContext,
+        processName: "runWorkerApp",
+        ...(options.search && { search: options.search }),
+        ...(options.databaseWait && { databaseWait: options.databaseWait }),
+    });
+    return options.metrics ? startWorkerMetricsServer(options.metrics, boot.entrypoint) : undefined;
+}
 export async function runWorkerApp(options) {
     assertSeedModeNotInProduction();
     const resolvedEnvSource = await resolveGatedEnvSource(options);
@@ -92,9 +110,7 @@ export async function runWorkerApp(options) {
     // hook, so a failing start() does not leak the listener.
     let metricsServer;
     try {
-        metricsServer = options.metrics
-            ? startWorkerMetricsServer(options.metrics, entrypoint)
-            : undefined;
+        metricsServer = await backfillThenStartMetrics(boot, options);
         await entrypoint.start();
     }
     catch (error) {
@@ -125,7 +141,7 @@ export async function runWorkerApp(options) {
     });
     if (options.wireComponents) {
         await options.wireComponents({
-            db,
+            db: wireHookDb(db, options),
             redis,
             registry,
             filesForTenant: makeFilesForTenant(entrypoint.context),

package/dist/seed-dispatcher.js

@@ -7,7 +7,9 @@ export function makeSeedCreateFileRef(deps) {
     const fileResolver = context._fileProviderResolver;
     return (tenantId, input) => createFileRefFromBytes({
         db: createTenantDb({ db, tenantId }),
-        files: fileResolver ? createTenantFileContext(fileResolver, tenantId) : context.files,
+        services: {
+            files: fileResolver ? createTenantFileContext(fileResolver, tenantId) : context.files,
+        },
         registry,
         user: createSystemUser(tenantId),
     }, input);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.389.0",
+  "version": "0.390.1",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold tooling.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -96,20 +96,20 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.389.0",
-    "@cosmicdrift/kumiko-framework": "0.389.0",
-    "@cosmicdrift/kumiko-renderer": "0.389.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.389.0",
-    "@cosmicdrift/kumiko-types": "0.389.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.390.1",
+    "@cosmicdrift/kumiko-framework": "0.390.1",
+    "@cosmicdrift/kumiko-renderer": "0.390.1",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.390.1",
+    "@cosmicdrift/kumiko-types": "0.390.1",
     "ioredis": "^5.10.1",
     "temporal-polyfill": "^0.3.2",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "peerDependencies": {
     "bun-types": "^1.4.4"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.389.0",
+    "@cosmicdrift/kumiko-testing": "0.390.1",
     "bun-types": "^1.4.4"
   },
   "publishConfig": {

package/src/changes.json

@@ -1,4 +1,35 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "auth.admin seed admin is email-verified",
+    "detail": "Under emailVerificationMode strict the seeded admin failed login with email_not_verified."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "runProdApp checks the row level security state at boot",
+    "detail": "RunProdAppOptions.rowLevelSecurity (\"off\" by default) sets the mode of every connection; the scaffolded server entry passes appConfig.rowLevelSecurity. With \"on\", boot fails when the database role has SUPERUSER or BYPASSRLS, because Postgres then skips every policy, and when a table with tenant_id lacks ENABLE, FORCE or one of the two kumiko policies; the message lists the tables. With \"off\", boot fails while any table still has row level security enabled and points to the DISABLE migration that kumiko-schema generate writes."
+  },
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "demoAdminFromEnv seed account is email-verified",
+    "detail": "Under emailVerificationMode strict the seeded demo admin failed login with email_not_verified."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Wiring tests reset event-sourced tables through resetTestTables",
+    "detail": "The compose-features integration tests clear users, memberships and the event log with resetTestTables instead of deleting projection rows. Nothing changes for apps."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "search \"none\" lets apps without a search backend run the stream-tenant backfill",
+    "detail": "The backfill deferred itself in every process without a search adapter, so apps with a searchable tenant entity but no search backend (for example publicstatus) never moved their legacy tenant streams.",
+    "migration": "Apps without a search backend set `search: \"none\"` on runProdApp and runWorkerApp, otherwise the stream-tenant backfill stays deferred."
+  },
   {
     "version": "0.389.0",
     "type": "fix",