@cosmicdrift/kumiko-framework 0.269.2 → 0.273.0

package/src/db/__tests__/tenant-db-no-raw.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, test } from "bun:test";
+import type { TenantDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
+import { InternalError } from "../../errors";
+import { testTenantId } from "../../stack";
+import type { DbRunner } from "../connection";
+import { createTenantDb, createUncheckedSystemDb, withUnsafeRawGrant } from "../tenant-db";
+import { tenantDbRunner } from "../tenant-db-runner";
+
+// TenantDb.raw is gone from the type; framework-internal callers resolve
+// the bound DbRunner through tenant-db-runner.ts's WeakMap instead.
+
+const tenantId = testTenantId(1);
+
+function fakeRunner(): DbRunner {
+  return {
+    unsafe: async () => [],
+    begin: async () => {
+      throw new Error("begin not used in these tests");
+    },
+  } as unknown as DbRunner;
+}
+
+describe("TenantDb has no .raw", () => {
+  test("compile-time: .raw is not a property of TenantDb", () => {
+    const tdb = createTenantDb(fakeRunner(), tenantId);
+    // @ts-expect-error TenantDb no longer exposes `raw`.
+    expect(tdb.raw).toBeUndefined();
+  });
+});
+
+describe("tenantDbRunner", () => {
+  test("returns the runner bound at createTenantDb() (identity)", () => {
+    const runner = fakeRunner();
+    const tdb = createTenantDb(runner, tenantId);
+    expect(tenantDbRunner(tdb)).toBe(runner);
+  });
+
+  test("withUnsafeRawGrant rebinds also resolve to the original runner", () => {
+    const runner = fakeRunner();
+    const tdb = createTenantDb(runner, tenantId);
+    const regranted = withUnsafeRawGrant(tdb, { reason: "test grant" });
+    expect(regranted).not.toBe(tdb);
+    expect(tenantDbRunner(regranted)).toBe(runner);
+  });
+
+  test("throws InternalError for a hand-built object not built by createTenantDb", () => {
+    const handBuilt = { tenantId, mode: "tenant" } as unknown as TenantDb;
+    expect(() => tenantDbRunner(handBuilt)).toThrow(InternalError);
+  });
+
+  test("throws InternalError for a throwing guard Proxy, without the proxy's get trap firing", () => {
+    let getTrapFired = false;
+    const guardProxy = new Proxy(
+      {},
+      {
+        get() {
+          getTrapFired = true;
+          throw new Error("systemScope guard: property access denied");
+        },
+      },
+    ) as unknown as TenantDb;
+
+    expect(() => tenantDbRunner(guardProxy)).toThrow(InternalError);
+    expect(getTrapFired).toBe(false);
+  });
+});
+
+describe("createUncheckedSystemDb(...).unsafeRaw", () => {
+  test("resolves to the runner bound at createTenantDb()", () => {
+    const runner = fakeRunner();
+    const tdb = createTenantDb(runner, tenantId, "system");
+    const systemDb = createUncheckedSystemDb(tdb);
+    expect(systemDb.unsafeRaw("test reason")).toBe(runner);
+  });
+});

package/src/db/__tests__/tenant-db.integration.test.ts

@@ -110,7 +110,9 @@ describe("scoped mode (default)", () => {
 
       await tdb.insertOne(table, { name: "ColSelect" });
 
-      const rows = await asRawClient(tdb).unsafe<Record<string, unknown>>(
+      // This probes a custom column projection, not tenant-scoping, so it goes
+      // straight at the underlying runner tdb was built from.
+      const rows = await asRawClient(testDb.db).unsafe<Record<string, unknown>>(
         `SELECT id, name FROM "tenant_db_items" WHERE name = $1 LIMIT 10`,
         ["ColSelect"],
       );

package/src/db/__tests__/unchecked-system-db.test.ts

@@ -1,9 +1,23 @@
 import { describe, expect, test } from "bun:test";
+import type { EscapeHatchReporter, EscapeHatchTarget } from "@cosmicdrift/kumiko-types/handlers";
 import { SYSTEM_TENANT_ID } from "../../engine";
 import { testTenantId } from "../../stack";
 import type { DbRunner } from "../connection";
 import { createTenantDb, createUncheckedSystemDb, SYSTEM_SCOPE_CHECK_BRAND } from "../tenant-db";
 
+function recordingReporter(): {
+  readonly report: EscapeHatchReporter;
+  readonly calls: Array<{ kind: string; reason: string; target: EscapeHatchTarget | undefined }>;
+} {
+  const calls: Array<{ kind: string; reason: string; target: EscapeHatchTarget | undefined }> = [];
+  return {
+    report: (kind, reason, target) => {
+      calls.push({ kind, reason, target });
+    },
+    calls,
+  };
+}
+
 // createUncheckedSystemDb wraps a "system"-mode TenantDb (r.systemScope())
 // so a handler must explicitly clear a self-check before using it — none of
 // these checks execute a query, so a runner that always throws is enough to
@@ -44,6 +58,16 @@ describe("createUncheckedSystemDb", () => {
 
       expect(() => unchecked.assertTenantMatch(foreign)).toThrow(/tenant self-check failed/);
     });
+
+    test("does not report — it is a tenant-safe check", () => {
+      const systemDb = createTenantDb(unusedRunner(), own, "system");
+      const { report, calls } = recordingReporter();
+      const unchecked = createUncheckedSystemDb(systemDb, undefined, report);
+
+      unchecked.assertTenantMatch(own);
+      expect(() => unchecked.assertTenantMatch(foreign)).toThrow();
+      expect(calls).toEqual([]);
+    });
   });
 
   describe("assertRowsTenant", () => {
@@ -88,6 +112,16 @@ describe("createUncheckedSystemDb", () => {
 
       expect(unchecked.assertRowsTenant(rows, "tenantId")).toBe(rows);
     });
+
+    test("does not report — it is a tenant-safe check", () => {
+      const systemDb = createTenantDb(unusedRunner(), own, "system");
+      const { report, calls } = recordingReporter();
+      const unchecked = createUncheckedSystemDb(systemDb, undefined, report);
+      const rows = [{ tenantId: own, name: "a" }];
+
+      unchecked.assertRowsTenant(rows, "tenantId");
+      expect(calls).toEqual([]);
+    });
   });
 
   describe("acknowledgeCrossTenant", () => {
@@ -113,6 +147,30 @@ describe("createUncheckedSystemDb", () => {
 
       expect(() => unchecked.acknowledgeCrossTenant("   ")).toThrow(/non-empty reason/);
     });
+
+    test("reports acknowledge-cross-tenant once with the reason", () => {
+      const systemDb = createTenantDb(unusedRunner(), own, "system");
+      const { report, calls } = recordingReporter();
+      const unchecked = createUncheckedSystemDb(systemDb, undefined, report);
+
+      unchecked.acknowledgeCrossTenant("user feature is cross-tenant by design");
+      expect(calls).toEqual([
+        {
+          kind: "acknowledge-cross-tenant",
+          reason: "user feature is cross-tenant by design",
+          target: undefined,
+        },
+      ]);
+    });
+
+    test("an empty reason throws and does not report", () => {
+      const systemDb = createTenantDb(unusedRunner(), own, "system");
+      const { report, calls } = recordingReporter();
+      const unchecked = createUncheckedSystemDb(systemDb, undefined, report);
+
+      expect(() => unchecked.acknowledgeCrossTenant("")).toThrow();
+      expect(calls).toEqual([]);
+    });
   });
 
   describe("outsideTransaction", () => {
@@ -178,6 +236,24 @@ describe("createUncheckedSystemDb", () => {
           /no outside-transaction database source is configured/,
         );
       });
+
+      test("reports acknowledge-cross-tenant once with the reason", () => {
+        const systemDb = createTenantDb(unusedRunner(), own, "system");
+        const outsideTxDb = createTenantDb(unusedRunner(), own, "system");
+        const { report, calls } = recordingReporter();
+        const unchecked = createUncheckedSystemDb(systemDb, outsideTxDb, report);
+
+        unchecked.outsideTransaction.acknowledgeCrossTenant(
+          "durability write is cross-tenant by design",
+        );
+        expect(calls).toEqual([
+          {
+            kind: "acknowledge-cross-tenant",
+            reason: "durability write is cross-tenant by design",
+            target: undefined,
+          },
+        ]);
+      });
     });
   });
 });

package/src/db/apply-entity-event.ts

@@ -89,7 +89,7 @@ export async function applyEntityEvent(
   switch (verb) {
     case "created": {
       // tenantId-Resolution explizit, nicht via Spread-Reihenfolge:
-      // Live-Pfad nutzt tx=db.raw (kein TenantDb-Wrapper-Auto-Inject),
+      // Live-Pfad nutzt tx=tenantDbRunner(db) (kein TenantDb-Wrapper-Auto-Inject),
       // beim Replay erst recht keiner. Default = event.tenantId; payload
       // gewinnt NUR wenn gültig string mit length > 0 (seedTenantMembership-
       // Pfad: Operator schreibt im Ziel-Tenant, Event im Operator-Tenant).

package/src/db/assert-exists-in.ts

@@ -5,7 +5,7 @@ import type { DbConnection } from "./connection";
 import type { TenantDb } from "./tenant-db";
 
 function isTenantDb(db: DbConnection | TenantDb): db is TenantDb {
-  return typeof (db as TenantDb).fetchOne === "function" && "raw" in db;
+  return "tenantId" in db && "fetchOne" in db && typeof db.fetchOne === "function";
 }
 
 /**

package/src/db/event-store-executor-context.ts

@@ -38,6 +38,7 @@ import type { EventStoreExecutorOptions } from "./event-store-executor";
 import { constraintOf, isUniqueViolation } from "./pg-error";
 import { toSnakeCase } from "./table-builder";
 import type { TenantDb } from "./tenant-db";
+import { tenantDbRunner } from "./tenant-db-runner";
 
 // Shared context-building for the event-store-executor CRUD verbs (create/
 // update/delete/forget/restore/list/detail — see event-store-executor-write.ts
@@ -358,7 +359,7 @@ export function buildExecutorContext(
     id: EntityId,
     tenantId: TenantId,
   ): Promise<void> {
-    if (await isStreamArchived(db.raw, tenantId, String(id))) {
+    if (await isStreamArchived(tenantDbRunner(db), tenantId, String(id))) {
       throw new ArchivedStreamError(tenantId, String(id));
     }
   }
@@ -401,7 +402,9 @@ export function buildExecutorContext(
     whereParts.push(shifted.sqlText);
     for (const p of shifted.params) params.push(p);
     const sqlText = `SELECT * FROM "${tableName}" WHERE ${whereParts.join(" AND ")} LIMIT 1`;
-    return [...(await executeRawQueryRead<Record<string, unknown>>(db.raw, sqlText, params))];
+    return [
+      ...(await executeRawQueryRead<Record<string, unknown>>(tenantDbRunner(db), sqlText, params)),
+    ];
   }
 
   return {

package/src/db/event-store-executor-read.ts

@@ -22,6 +22,7 @@ import { buildFilterWhere, type ExecutorContext, type Table } from "./event-stor
 import { buildParentRefClause } from "./parent-ref-clause";
 import { buildEntityTable, physicalColumnName } from "./table-builder";
 import type { TenantDb, TenantDbMode } from "./tenant-db";
+import { tenantDbRunner } from "./tenant-db-runner";
 
 // The two read verbs (list/detail) of the event-store-executor. Split out
 // of event-store-executor.ts (#1005, Welle 2) — behavior-preserving
@@ -332,7 +333,7 @@ async function resolveReferenceMatches(
   const sql =
     `SELECT "id" FROM "${targetTableName}" WHERE ("${labelCol}")::text ILIKE $1${tenantClause} ` +
     `LIMIT ${MAX_REFERENCE_SEARCH_IDS + 1}`;
-  const rows = await executeRawQueryRead<{ id: string }>(db.raw, sql, subParams);
+  const rows = await executeRawQueryRead<{ id: string }>(tenantDbRunner(db), sql, subParams);
   if (rows.length === 0 || rows.length > MAX_REFERENCE_SEARCH_IDS) {
     // skip: no match, or over the cap — drop the clause rather than
     // truncate to an arbitrary slice of matching targets
@@ -423,6 +424,7 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
     // list + detail are unchanged from crud-executor — projections are the
     // read-model and serve these queries directly.
     async list(payload, user, db, runtimeOptions) {
+      const runner = tenantDbRunner(db);
       const { limit, offset } = resolveListPagination(payload);
       const totalCount = payload.totalCount === true;
       const tableName = String((table as unknown as Record<symbol, unknown>)[KUMIKO_NAME_SYMBOL]);
@@ -674,7 +676,7 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
           : "*";
       const listSql = `SELECT ${selectList} FROM "${tableName}"${whereClauseSqlText}${orderByClause} LIMIT ${limit}${offsetClause}`;
 
-      const rawRows = await executeRawQueryRead<Record<string, unknown>>(db.raw, listSql, params);
+      const rawRows = await executeRawQueryRead<Record<string, unknown>>(runner, listSql, params);
       const lastSortLabel = rawRows[rawRows.length - 1]?.[SORT_LABEL_ALIAS];
       if (referenceSortExpr !== undefined) {
         // The alias is a sort artifact, not a column of this entity — strip it
@@ -735,7 +737,7 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
         } else {
           const countSql = `SELECT COUNT(*)::int AS count FROM "${tableName}"${whereClauseSqlText}`;
           const countRows = await executeRawQueryRead<{ count: number }>(
-            db.raw,
+            runner,
             countSql,
             whereParams,
           );
@@ -779,7 +781,7 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
         row: Record<string, unknown>,
       ): Promise<Record<string, unknown>> => {
         const streamVersion = await getStreamVersion(
-          db.raw,
+          tenantDbRunner(db),
           String(payload.id),
           streamTenantFor(user),
         );

package/src/db/event-store-executor-write.ts

@@ -30,6 +30,7 @@ import {
   tryMapUniqueViolation,
 } from "./event-store-executor-context";
 import { runInSavepointIfSupported } from "./query";
+import { tenantDbRunner } from "./tenant-db-runner";
 
 // Art. 17 erasure runs as the framework operator, not as a row owner; a
 // per-role ownership map can never cover it, and a silent deny means the
@@ -117,6 +118,7 @@ export function createWriteVerbs(
 
   return {
     async create(payload, user, db, options) {
+      const runner = tenantDbRunner(db);
       if (isForeignTenantOnGlobalEntity(entity, payload["tenantId"])) {
         throw new AccessDeniedError({
           message:
@@ -215,9 +217,9 @@ export function createWriteVerbs(
         // of the version_conflict this catch classifies. runInSavepointIfSupported
         // confines the failed INSERT to a nested scope that rolls back on
         // its own (same pattern as ctx.tryAppendEvent), and falls back to a
-        // plain call when db.raw is a bare pool connection with no active
+        // plain call when the runner is a bare pool connection with no active
         // transaction to poison (seeds/tests calling the executor directly).
-        event = await runInSavepointIfSupported(db.raw, async (sp) =>
+        event = await runInSavepointIfSupported(runner, async (sp) =>
           append(sp, {
             aggregateId,
             aggregateType: entityName,
@@ -232,7 +234,7 @@ export function createWriteVerbs(
         if (e instanceof EventStoreVersionConflict) {
           let currentVersion = -1;
           try {
-            currentVersion = await getStreamVersion(db.raw, aggregateId, streamTenantFor(user));
+            currentVersion = await getStreamVersion(runner, aggregateId, streamTenantFor(user));
           } catch {
             // Lookup failure — keep the sentinel.
           }
@@ -268,7 +270,7 @@ export function createWriteVerbs(
       // failed INSERT back; the error still propagates and stays catchable.
       let result: Awaited<ReturnType<typeof applyEntityEvent>>;
       try {
-        result = await runInSavepointIfSupported(db.raw, async (sp) =>
+        result = await runInSavepointIfSupported(runner, async (sp) =>
           applyEntityEvent(event, table, entity, sp),
         );
       } catch (e) {
@@ -308,6 +310,7 @@ export function createWriteVerbs(
     },
 
     async update(payload, user, db, updateOptions) {
+      const runner = tenantDbRunner(db);
       if (isForeignTenantOnGlobalEntity(entity, payload.changes["tenantId"])) {
         throw new AccessDeniedError({
           message:
@@ -397,7 +400,7 @@ export function createWriteVerbs(
       // trip `events_aggregate_version_uq` (tenant_id, aggregate_id, version)
       // with version_conflict.
       const currentVersion = await getStreamVersion(
-        db.raw,
+        runner,
         String(payload.id),
         streamTenantFor(user),
       );
@@ -452,7 +455,7 @@ export function createWriteVerbs(
         // Savepoint-scoped — see the create() append() above for why:
         // confines a losing writer's unique-violation to a nested scope
         // instead of poisoning the whole outer transaction.
-        const event = await runInSavepointIfSupported(db.raw, (sp) =>
+        const event = await runInSavepointIfSupported(runner, (sp) =>
           append(sp, {
             aggregateId: String(payload.id),
             aggregateType: entityName,
@@ -480,7 +483,7 @@ export function createWriteVerbs(
         // failed nested one throws 500 instead of failing cleanly.
         let result: Awaited<ReturnType<typeof applyEntityEvent>>;
         try {
-          result = await runInSavepointIfSupported(db.raw, async (sp) =>
+          result = await runInSavepointIfSupported(runner, async (sp) =>
             applyEntityEvent(event, table, entity, sp),
           );
         } catch (e) {
@@ -539,6 +542,7 @@ export function createWriteVerbs(
     },
 
     async delete(payload, user, db) {
+      const runner = tenantDbRunner(db);
       const existing = await loadById(payload.id, db);
       if (!existing) return writeFailure(new NotFoundError(entityName, payload.id));
 
@@ -565,7 +569,7 @@ export function createWriteVerbs(
 
       // Stream-version authoritative (see update() for rationale).
       const currentVersion = await getStreamVersion(
-        db.raw,
+        runner,
         String(payload.id),
         streamTenantFor(user),
       );
@@ -578,7 +582,7 @@ export function createWriteVerbs(
       // land in the immutable log.
       let event: Awaited<ReturnType<typeof append>>;
       try {
-        event = await runInSavepointIfSupported(db.raw, async (sp) =>
+        event = await runInSavepointIfSupported(runner, async (sp) =>
           append(sp, {
             aggregateId: String(payload.id),
             aggregateType: entityName,
@@ -606,7 +610,7 @@ export function createWriteVerbs(
       }
 
       // Live==Rebuild via applyEntityEvent. Savepoint like create/update.
-      const deleteResult = await runInSavepointIfSupported(db.raw, async (sp) =>
+      const deleteResult = await runInSavepointIfSupported(runner, async (sp) =>
         applyEntityEvent(event, table, entity, sp),
       );
       if (deleteResult.kind !== "applied") {
@@ -636,6 +640,7 @@ export function createWriteVerbs(
     // the erasure replays on rebuild (created → forgotten → row gone). Loads
     // without the isDeleted filter so trashed (soft-deleted) rows are erased too.
     async forget(payload, user, db) {
+      const runner = tenantDbRunner(db);
       const raw = await db.fetchOne<Record<string, unknown>>(table, { id: payload.id });
       if (!raw) return writeFailure(new NotFoundError(entityName, payload.id));
       const existing = await decryptForRead(rehydrateCompoundTypes(raw as DbRow, entity) as DbRow);
@@ -660,14 +665,14 @@ export function createWriteVerbs(
 
       await assertStreamWritable(db, payload.id, streamTenantFor(user));
       const currentVersion = await getStreamVersion(
-        db.raw,
+        runner,
         String(payload.id),
         streamTenantFor(user),
       );
 
       let event: Awaited<ReturnType<typeof append>>;
       try {
-        event = await runInSavepointIfSupported(db.raw, async (sp) =>
+        event = await runInSavepointIfSupported(runner, async (sp) =>
           append(sp, {
             aggregateId: String(payload.id),
             aggregateType: entityName,
@@ -696,7 +701,7 @@ export function createWriteVerbs(
         throw e;
       }
 
-      const forgetResult = await runInSavepointIfSupported(db.raw, async (sp) =>
+      const forgetResult = await runInSavepointIfSupported(runner, async (sp) =>
         applyEntityEvent(event, table, entity, sp),
       );
       if (forgetResult.kind !== "applied") {
@@ -722,6 +727,7 @@ export function createWriteVerbs(
     },
 
     async restore(payload, user, db) {
+      const runner = tenantDbRunner(db);
       if (!softDelete) {
         return writeFailure(
           new UnprocessableError("soft_delete_not_enabled", {
@@ -731,8 +737,8 @@ export function createWriteVerbs(
       }
 
       // Tenant boundary: db.fetchOne applies TenantDb's tenant predicate,
-      // selectMany(db.raw, ...) did not — any caller could un-delete a foreign
-      // tenant's row by id. "system"-mode dbs (r.systemScope() / crossTenant
+      // selectMany(runner, ...) did not — any caller could un-delete a foreign
+      // tenant's row by id. "system"-mode dbs (r.systemScope() / escapeHatch
       // handlers) still read unfiltered. No isDeleted filter here: restore
       // targets exactly the soft-deleted row.
       const row = await db.fetchOne(table, { id: payload.id });
@@ -766,7 +772,7 @@ export function createWriteVerbs(
 
       // Stream-version authoritative (see update() for rationale).
       const currentVersion = await getStreamVersion(
-        db.raw,
+        runner,
         String(payload.id),
         streamTenantFor(user),
       );
@@ -777,7 +783,7 @@ export function createWriteVerbs(
       // already ciphertext, no re-encrypt needed.
       let event: Awaited<ReturnType<typeof append>>;
       try {
-        event = await runInSavepointIfSupported(db.raw, (sp) =>
+        event = await runInSavepointIfSupported(runner, (sp) =>
           append(sp, {
             aggregateId: String(payload.id),
             aggregateType: entityName,
@@ -807,7 +813,7 @@ export function createWriteVerbs(
       // Live==Rebuild via applyEntityEvent. Restore only writes isDeleted=false
       // plus the version bump, so there is no sensitive-field drift and no
       // payload override is needed.
-      const restoreResult = await runInSavepointIfSupported(db.raw, async (sp) =>
+      const restoreResult = await runInSavepointIfSupported(runner, async (sp) =>
         applyEntityEvent(event, table, entity, sp),
       );
       if (restoreResult.kind !== "applied" || restoreResult.row === null) {

package/src/db/queries/shadow-swap.ts

@@ -105,6 +105,40 @@ export async function assertLiveColumnsMatchMeta(
   );
 }
 
+// EntityTableMeta carries no RLS/policies, so the swap would silently drop them (#2907).
+export async function assertLiveTableHasNoRowLevelSecurity(
+  tx: AnyDb,
+  tableName: string,
+  projectionName?: string,
+): Promise<void> {
+  const rows = await asRawClient(tx).unsafe<{
+    rls_enabled: boolean;
+    rls_forced: boolean;
+    policy_count: number;
+  }>(
+    `SELECT c.relrowsecurity AS rls_enabled, c.relforcerowsecurity AS rls_forced,
+       (SELECT count(*)::int FROM pg_policy p WHERE p.polrelid = c.oid) AS policy_count
+     FROM pg_class c
+     JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE n.nspname = 'public' AND c.relname = $1`,
+    [tableName],
+  );
+  const row = rows[0];
+  // skip: no live table yet — nothing to have RLS on
+  if (!row) return;
+  // skip: no RLS flags and no policies — nothing the swap could drop
+  if (!row.rls_enabled && !row.rls_forced && row.policy_count === 0) return;
+  const context =
+    projectionName !== undefined ? `projection-rebuild "${projectionName}"` : "shadow swap";
+  throw new Error(
+    `${context}: live table "${tableName}" has row level security (enabled: ${row.rls_enabled}, ` +
+      `forced: ${row.rls_forced}, policies: ${row.policy_count}). The shadow swap rebuilds the table ` +
+      "from EntityTableMeta and would silently drop RLS and every policy. Kumiko does not support RLS " +
+      "on rebuildable tables — see kumiko-platform docs/plans/rls-evaluation.md. Rebuild aborted; live " +
+      "table untouched.",
+  );
+}
+
 // Runs INSIDE the rebuild tx, AFTER the state/consumer row lock is taken.
 // Points search_path at the shadow schema (SET LOCAL → auto-reset on commit or
 // rollback), drops any leftover shadow from a crashed run, then builds the
@@ -300,6 +334,8 @@ export async function countColumnDrift(
 // object depends on the live table the swap fails loud and the whole rebuild
 // rolls back, leaving the old table untouched.
 export async function swapShadowIntoLive(tx: AnyDb, tableName: string): Promise<void> {
+  // Re-checked right before DROP: RLS could have been enabled after the early check.
+  await assertLiveTableHasNoRowLevelSecurity(tx, tableName);
   const raw = asRawClient(tx);
   const ident = quoteTableIdent(tableName);
   await raw.unsafe(`DROP TABLE public.${ident}`);

package/src/db/replay-migration-sql.ts

@@ -84,7 +84,7 @@ const SHAPE_NEUTRAL_ALTER_CLAUSE_RE = new RegExp(
     `ALTER COLUMN\\s+${IDENT}\\s+(SET|DROP)\\s+NOT NULL\\b`,
     `ALTER COLUMN\\s+${IDENT}\\s+(SET DEFAULT\\b|DROP DEFAULT\\b)`,
     `(ADD|DROP)\\s+CONSTRAINT\\s+${IDENT}`,
-    `\\b(ENABLE|DISABLE)\\s+ROW LEVEL SECURITY\\b`,
+    `\\b(ENABLE|DISABLE|(NO\\s+)?FORCE)\\s+ROW LEVEL SECURITY\\b`,
     `^OWNER TO\\b`,
   ].join("|"),
   "gi",
@@ -149,9 +149,9 @@ function applyStatement(
       else table.columns.delete(name);
     }
     // Shape-neutral clauses (ALTER COLUMN TYPE, SET/DROP NOT NULL, SET/DROP
-    // DEFAULT, ADD/DROP CONSTRAINT, ENABLE/DISABLE ROW LEVEL SECURITY, OWNER
-    // TO) — none add/remove/rename a column, so this replay (which only
-    // tracks column presence) correctly has nothing to do for them.
+    // DEFAULT, ADD/DROP CONSTRAINT, ENABLE/DISABLE/[NO] FORCE ROW LEVEL
+    // SECURITY, OWNER TO) — none add/remove/rename a column, so this replay
+    // (which only tracks column presence) correctly has nothing to do for them.
     if (alterBody.match(SHAPE_NEUTRAL_ALTER_CLAUSE_RE)) matchedAClause = true;
     // An ALTER TABLE that matched the outer "ALTER TABLE <name> <body>" shape
     // but whose body contains no recognized clause (e.g. RENAME TO/RENAME
@@ -177,7 +177,7 @@ function applyStatement(
         `starts with CREATE/ALTER/DROP TABLE but matched none of the replay's ` +
         `recognized patterns (CREATE TABLE, DROP TABLE, ALTER TABLE ADD/DROP ` +
         `COLUMN, ALTER COLUMN ... TYPE, SET/DROP NOT NULL, SET/DROP DEFAULT, ` +
-        `ADD/DROP CONSTRAINT, ENABLE/DISABLE ROW LEVEL SECURITY, OWNER TO — ` +
+        `ADD/DROP CONSTRAINT, ENABLE/DISABLE/[NO] FORCE ROW LEVEL SECURITY, OWNER TO — ` +
         `optionally-quoted identifiers). Likely RENAME TO/RENAME COLUMN (real ` +
         `identity change, not trackable here) or genuinely unparsed hand-written ` +
         `DDL. Statement: ${prefix}${statement.length > 200 ? "…" : ""}`,

package/src/db/tenant-db-runner.ts

@@ -0,0 +1,23 @@
+import type { TenantDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
+import { InternalError } from "../errors";
+import type { DbRunner } from "./connection";
+
+const tenantDbRunners = new WeakMap<TenantDb, DbRunner>();
+
+export function bindTenantDbRunner(tenantDb: TenantDb, runner: DbRunner): void {
+  tenantDbRunners.set(tenantDb, runner);
+}
+
+// WeakMap.get never reads a property off tenantDb — safe even when tenantDb is a
+// throwing systemScope guard Proxy that rejects every property access.
+export function tenantDbRunner(tenantDb: TenantDb): DbRunner {
+  const runner = tenantDbRunners.get(tenantDb);
+  if (!runner) {
+    throw new InternalError({
+      message:
+        "framework infrastructure received a TenantDb not built by createTenantDb (or a " +
+        "fail-closed systemScope guard) — no connection bound.",
+    });
+  }
+  return runner;
+}