@cosmicdrift/kumiko-framework 0.270.0 → 0.274.0

package/src/db/event-store-executor-read.ts

@@ -9,19 +9,25 @@ import {
   normalizeAccessEntry,
   shiftParams,
 } from "../engine/ownership";
-import type { EntityDefinition, EntityId } from "../engine/types";
+import type { EntityDefinition, EntityId, SessionUser } from "../engine/types";
 import { SYSTEM_TENANT_ID } from "../engine/types/identifiers";
 import { UnprocessableError } from "../errors";
 import { getStreamVersion } from "../event-store";
+import type { SearchAdapter } from "../search/types";
 import { LIST_ROW_META_REFERENCES } from "../ui-types/list-row-meta";
 import { rehydrateCompoundTypes } from "./compound-types";
 import { decodeKeysetCursor, encodeCursor, encodeKeysetCursor } from "./cursor";
-import { collectEncryptedFieldNames } from "./entity-field-encryption";
+import {
+  collectEncryptedFieldNames,
+  hasSearchablePlaintext,
+  isSensitiveLabelField,
+} from "./entity-field-encryption";
 import type { EventStoreExecutor } from "./event-store-executor";
 import { buildFilterWhere, type ExecutorContext, type Table } from "./event-store-executor-context";
 import { buildParentRefClause } from "./parent-ref-clause";
 import { buildEntityTable, physicalColumnName } from "./table-builder";
 import type { TenantDb, TenantDbMode } from "./tenant-db";
+import { tenantDbRunner } from "./tenant-db-runner";
 
 // The two read verbs (list/detail) of the event-store-executor. Split out
 // of event-store-executor.ts (#1005, Welle 2) — behavior-preserving
@@ -103,26 +109,27 @@ function keysetBoundarySql(
 
 type ListFilter = {
   readonly field: string;
-  readonly op: "eq" | "ne" | "lt" | "gt" | "in";
+  readonly op: "eq" | "ne" | "lt" | "gt" | "lte" | "gte" | "in";
   readonly value: unknown;
 };
 
 // multiSelect stores its options as a jsonb array — a filter value is one
 // option, not the whole array, so eq/ne/in must check array containment
 // (`@>`) instead of scalar `=`/`<>`/`IN` against the jsonb column (fw#2490).
-// lt/gt have no containment analogue; the boot-validator already blocks them
-// for screen-declared filters (screen-filter-ops.ts EQUALITY_ONLY), but a
-// client-supplied facet filter reaches here unvalidated, so treat it as
-// unsatisfiable rather than emitting SQL Postgres would reject.
+// lt/gt/lte/gte have no containment analogue; the boot-validator already
+// blocks them for screen-declared filters (screen-filter-ops.ts
+// EQUALITY_ONLY), but a client-supplied facet filter reaches here
+// unvalidated, so treat it as unsatisfiable rather than emitting SQL
+// Postgres would reject.
 function applyMultiSelectFilter(
   colSql: (field: string) => string,
   whereSql: string[],
   params: unknown[],
   f: ListFilter,
 ): void {
-  if (f.op === "lt" || f.op === "gt") {
+  if (f.op === "lt" || f.op === "gt" || f.op === "lte" || f.op === "gte") {
     whereSql.push("FALSE");
-    // skip: lt/gt is unsatisfiable on a multiSelect column
+    // skip: lt/gt/lte/gte is unsatisfiable on a multiSelect column
     return;
   }
   if (f.op === "in") {
@@ -289,11 +296,86 @@ function collectReferenceSearchDescriptors(
 // unscoped SQL, a match in a foreign tenant must never surface a row here
 // (fw#2660's hard constraint). Mirrors the main table's own tenant filter
 // (see the `table["tenantId"]` check further down in list()).
+async function resolveReferenceMatchesViaIlike(
+  descriptor: ReferenceSearchDescriptor,
+  searchTerm: string,
+  targetTable: Table,
+  targetTableName: string,
+  db: TenantDb,
+): Promise<{ readonly ownColumn: string; readonly ids: readonly string[] } | undefined> {
+  const labelCol = physicalColumnName(targetTable, descriptor.labelField);
+  const subParams: unknown[] = [`%${escapeLikePattern(searchTerm)}%`];
+  let tenantClause = "";
+  if (targetTable["tenantId"] !== undefined && db.mode === "tenant") {
+    subParams.push(db.tenantId, SYSTEM_TENANT_ID);
+    tenantClause = ` AND "${physicalColumnName(targetTable, "tenantId")}" IN ($2, $3)`;
+  }
+  // ::text cast covers a non-text labelField (e.g. a number/select column
+  // used as label) — Postgres has no ILIKE for those types otherwise.
+  const sql =
+    `SELECT "id" FROM "${targetTableName}" WHERE ("${labelCol}")::text ILIKE $1${tenantClause} ` +
+    `LIMIT ${MAX_REFERENCE_SEARCH_IDS + 1}`;
+  const rows = await executeRawQueryRead<{ id: string }>(tenantDbRunner(db), sql, subParams);
+  if (rows.length === 0 || rows.length > MAX_REFERENCE_SEARCH_IDS) {
+    // skip: no match, or over the cap — drop the clause rather than
+    // truncate to an arbitrary slice of matching targets
+    return undefined;
+  }
+  return { ownColumn: descriptor.ownColumn, ids: rows.map((r) => r.id) };
+}
+
+// Same lookup, but the target's index is tenant-wide, not per-viewer, so
+// candidate ids get re-checked against the target entity's own read access.
+async function resolveReferenceMatchesViaSearchIndex(
+  descriptor: ReferenceSearchDescriptor,
+  searchTerm: string,
+  targetEntity: EntityDefinition,
+  targetTable: Table,
+  targetTableName: string,
+  user: SessionUser,
+  db: TenantDb,
+  searchAdapter: SearchAdapter,
+): Promise<{ readonly ownColumn: string; readonly ids: readonly string[] } | undefined> {
+  const searchTenantId = targetEntity.systemStream ? SYSTEM_TENANT_ID : user.tenantId;
+  const results = await searchAdapter.search(searchTenantId, searchTerm, {
+    filterType: descriptor.targetEntityName,
+    limit: MAX_REFERENCE_SEARCH_IDS + 1,
+  });
+  if (results.length === 0 || results.length > MAX_REFERENCE_SEARCH_IDS) {
+    // skip: no match, or over the cap — same drop-the-clause policy as the ILIKE path
+    return undefined;
+  }
+
+  const ownership = buildOwnershipClause(user, targetEntity.access?.read, targetTable);
+  if (ownership.kind === "empty") return undefined;
+
+  const candidateIds = results.map((r) => String(r.entityId));
+  if (ownership.kind === "pass") {
+    return { ownColumn: descriptor.ownColumn, ids: candidateIds };
+  }
+
+  const params: unknown[] = [...candidateIds];
+  const idPlaceholders = candidateIds.map((_, i) => `$${i + 1}`);
+  const shifted = shiftParams(
+    { sqlText: ownership.sqlText, params: ownership.params },
+    params.length,
+  );
+  const sql =
+    `SELECT "id" FROM "${targetTableName}" WHERE "id" IN (${idPlaceholders.join(", ")}) ` +
+    `AND ${shifted.sqlText}`;
+  for (const p of shifted.params) params.push(p);
+  const rows = await executeRawQueryRead<{ id: string }>(tenantDbRunner(db), sql, params);
+  if (rows.length === 0) return undefined;
+  return { ownColumn: descriptor.ownColumn, ids: rows.map((r) => r.id) };
+}
+
 async function resolveReferenceMatches(
   descriptor: ReferenceSearchDescriptor,
   searchTerm: string,
   resolveEntity: (entityName: string) => EntityDefinition | undefined,
   db: TenantDb,
+  user: SessionUser,
+  searchAdapter: SearchAdapter,
 ): Promise<{ readonly ownColumn: string; readonly ids: readonly string[] } | undefined> {
   const targetEntity = resolveEntity(descriptor.targetEntityName);
   if (targetEntity === undefined) {
@@ -307,38 +389,36 @@ async function resolveReferenceMatches(
     // `name` is a declared field on the tenant entity, not an id/row-meta column
     return undefined;
   }
-  if (
-    collectEncryptedFieldNames(targetEntity).has(descriptor.labelField) ||
-    collectPiiSubjectFields(targetEntity).includes(descriptor.labelField)
-  ) {
-    // skip: encrypted/PII labelField — ILIKE can never match ciphertext,
-    // emitting the query would just be a silent, permanent non-match
-    return undefined;
-  }
 
   const targetTable = buildEntityTable(descriptor.targetEntityName, targetEntity);
   const targetTableName = String(
     (targetTable as unknown as Record<symbol, unknown>)[KUMIKO_NAME_SYMBOL],
   );
-  const labelCol = physicalColumnName(targetTable, descriptor.labelField);
-  const subParams: unknown[] = [`%${escapeLikePattern(searchTerm)}%`];
-  let tenantClause = "";
-  if (targetTable["tenantId"] !== undefined && db.mode === "tenant") {
-    subParams.push(db.tenantId, SYSTEM_TENANT_ID);
-    tenantClause = ` AND "${physicalColumnName(targetTable, "tenantId")}" IN ($2, $3)`;
+
+  if (!isSensitiveLabelField(targetEntity, descriptor.labelField)) {
+    return resolveReferenceMatchesViaIlike(
+      descriptor,
+      searchTerm,
+      targetTable,
+      targetTableName,
+      db,
+    );
   }
-  // ::text cast covers a non-text labelField (e.g. a number/select column
-  // used as label) — Postgres has no ILIKE for those types otherwise.
-  const sql =
-    `SELECT "id" FROM "${targetTableName}" WHERE ("${labelCol}")::text ILIKE $1${tenantClause} ` +
-    `LIMIT ${MAX_REFERENCE_SEARCH_IDS + 1}`;
-  const rows = await executeRawQueryRead<{ id: string }>(db.raw, sql, subParams);
-  if (rows.length === 0 || rows.length > MAX_REFERENCE_SEARCH_IDS) {
-    // skip: no match, or over the cap — drop the clause rather than
-    // truncate to an arbitrary slice of matching targets
+  if (!hasSearchablePlaintext(targetEntity, descriptor.labelField)) {
+    // skip: no plaintext anywhere to match — boot rejects this normally,
+    // this is defense-in-depth for a target entity resolved only at runtime.
     return undefined;
   }
-  return { ownColumn: descriptor.ownColumn, ids: rows.map((r) => r.id) };
+  return resolveReferenceMatchesViaSearchIndex(
+    descriptor,
+    searchTerm,
+    targetEntity,
+    targetTable,
+    targetTableName,
+    user,
+    db,
+    searchAdapter,
+  );
 }
 
 // Projected alongside the row when a reference sort is active, so the keyset
@@ -423,6 +503,7 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
     // list + detail are unchanged from crud-executor — projections are the
     // read-model and serve these queries directly.
     async list(payload, user, db, runtimeOptions) {
+      const runner = tenantDbRunner(db);
       const { limit, offset } = resolveListPagination(payload);
       const totalCount = payload.totalCount === true;
       const tableName = String((table as unknown as Record<symbol, unknown>)[KUMIKO_NAME_SYMBOL]);
@@ -515,7 +596,14 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
           ? (
               await Promise.all(
                 descriptors.map((d) =>
-                  resolveReferenceMatches(d, searchTerm, referenceSearch.resolveEntity, db),
+                  resolveReferenceMatches(
+                    d,
+                    searchTerm,
+                    referenceSearch.resolveEntity,
+                    db,
+                    user,
+                    effectiveSearchAdapter,
+                  ),
                 ),
               )
             ).filter(
@@ -674,7 +762,7 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
           : "*";
       const listSql = `SELECT ${selectList} FROM "${tableName}"${whereClauseSqlText}${orderByClause} LIMIT ${limit}${offsetClause}`;
 
-      const rawRows = await executeRawQueryRead<Record<string, unknown>>(db.raw, listSql, params);
+      const rawRows = await executeRawQueryRead<Record<string, unknown>>(runner, listSql, params);
       const lastSortLabel = rawRows[rawRows.length - 1]?.[SORT_LABEL_ALIAS];
       if (referenceSortExpr !== undefined) {
         // The alias is a sort artifact, not a column of this entity — strip it
@@ -735,7 +823,7 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
         } else {
           const countSql = `SELECT COUNT(*)::int AS count FROM "${tableName}"${whereClauseSqlText}`;
           const countRows = await executeRawQueryRead<{ count: number }>(
-            db.raw,
+            runner,
             countSql,
             whereParams,
           );
@@ -779,7 +867,7 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
         row: Record<string, unknown>,
       ): Promise<Record<string, unknown>> => {
         const streamVersion = await getStreamVersion(
-          db.raw,
+          tenantDbRunner(db),
           String(payload.id),
           streamTenantFor(user),
         );

package/src/db/event-store-executor-write.ts

@@ -30,6 +30,7 @@ import {
   tryMapUniqueViolation,
 } from "./event-store-executor-context";
 import { runInSavepointIfSupported } from "./query";
+import { tenantDbRunner } from "./tenant-db-runner";
 
 // Art. 17 erasure runs as the framework operator, not as a row owner; a
 // per-role ownership map can never cover it, and a silent deny means the
@@ -117,6 +118,7 @@ export function createWriteVerbs(
 
   return {
     async create(payload, user, db, options) {
+      const runner = tenantDbRunner(db);
       if (isForeignTenantOnGlobalEntity(entity, payload["tenantId"])) {
         throw new AccessDeniedError({
           message:
@@ -215,9 +217,9 @@ export function createWriteVerbs(
         // of the version_conflict this catch classifies. runInSavepointIfSupported
         // confines the failed INSERT to a nested scope that rolls back on
         // its own (same pattern as ctx.tryAppendEvent), and falls back to a
-        // plain call when db.raw is a bare pool connection with no active
+        // plain call when the runner is a bare pool connection with no active
         // transaction to poison (seeds/tests calling the executor directly).
-        event = await runInSavepointIfSupported(db.raw, async (sp) =>
+        event = await runInSavepointIfSupported(runner, async (sp) =>
           append(sp, {
             aggregateId,
             aggregateType: entityName,
@@ -232,7 +234,7 @@ export function createWriteVerbs(
         if (e instanceof EventStoreVersionConflict) {
           let currentVersion = -1;
           try {
-            currentVersion = await getStreamVersion(db.raw, aggregateId, streamTenantFor(user));
+            currentVersion = await getStreamVersion(runner, aggregateId, streamTenantFor(user));
           } catch {
             // Lookup failure — keep the sentinel.
           }
@@ -268,7 +270,7 @@ export function createWriteVerbs(
       // failed INSERT back; the error still propagates and stays catchable.
       let result: Awaited<ReturnType<typeof applyEntityEvent>>;
       try {
-        result = await runInSavepointIfSupported(db.raw, async (sp) =>
+        result = await runInSavepointIfSupported(runner, async (sp) =>
           applyEntityEvent(event, table, entity, sp),
         );
       } catch (e) {
@@ -308,6 +310,7 @@ export function createWriteVerbs(
     },
 
     async update(payload, user, db, updateOptions) {
+      const runner = tenantDbRunner(db);
       if (isForeignTenantOnGlobalEntity(entity, payload.changes["tenantId"])) {
         throw new AccessDeniedError({
           message:
@@ -397,7 +400,7 @@ export function createWriteVerbs(
       // trip `events_aggregate_version_uq` (tenant_id, aggregate_id, version)
       // with version_conflict.
       const currentVersion = await getStreamVersion(
-        db.raw,
+        runner,
         String(payload.id),
         streamTenantFor(user),
       );
@@ -452,7 +455,7 @@ export function createWriteVerbs(
         // Savepoint-scoped — see the create() append() above for why:
         // confines a losing writer's unique-violation to a nested scope
         // instead of poisoning the whole outer transaction.
-        const event = await runInSavepointIfSupported(db.raw, (sp) =>
+        const event = await runInSavepointIfSupported(runner, (sp) =>
           append(sp, {
             aggregateId: String(payload.id),
             aggregateType: entityName,
@@ -480,7 +483,7 @@ export function createWriteVerbs(
         // failed nested one throws 500 instead of failing cleanly.
         let result: Awaited<ReturnType<typeof applyEntityEvent>>;
         try {
-          result = await runInSavepointIfSupported(db.raw, async (sp) =>
+          result = await runInSavepointIfSupported(runner, async (sp) =>
             applyEntityEvent(event, table, entity, sp),
           );
         } catch (e) {
@@ -539,6 +542,7 @@ export function createWriteVerbs(
     },
 
     async delete(payload, user, db) {
+      const runner = tenantDbRunner(db);
       const existing = await loadById(payload.id, db);
       if (!existing) return writeFailure(new NotFoundError(entityName, payload.id));
 
@@ -565,7 +569,7 @@ export function createWriteVerbs(
 
       // Stream-version authoritative (see update() for rationale).
       const currentVersion = await getStreamVersion(
-        db.raw,
+        runner,
         String(payload.id),
         streamTenantFor(user),
       );
@@ -578,7 +582,7 @@ export function createWriteVerbs(
       // land in the immutable log.
       let event: Awaited<ReturnType<typeof append>>;
       try {
-        event = await runInSavepointIfSupported(db.raw, async (sp) =>
+        event = await runInSavepointIfSupported(runner, async (sp) =>
           append(sp, {
             aggregateId: String(payload.id),
             aggregateType: entityName,
@@ -606,7 +610,7 @@ export function createWriteVerbs(
       }
 
       // Live==Rebuild via applyEntityEvent. Savepoint like create/update.
-      const deleteResult = await runInSavepointIfSupported(db.raw, async (sp) =>
+      const deleteResult = await runInSavepointIfSupported(runner, async (sp) =>
         applyEntityEvent(event, table, entity, sp),
       );
       if (deleteResult.kind !== "applied") {
@@ -636,6 +640,7 @@ export function createWriteVerbs(
     // the erasure replays on rebuild (created → forgotten → row gone). Loads
     // without the isDeleted filter so trashed (soft-deleted) rows are erased too.
     async forget(payload, user, db) {
+      const runner = tenantDbRunner(db);
       const raw = await db.fetchOne<Record<string, unknown>>(table, { id: payload.id });
       if (!raw) return writeFailure(new NotFoundError(entityName, payload.id));
       const existing = await decryptForRead(rehydrateCompoundTypes(raw as DbRow, entity) as DbRow);
@@ -660,14 +665,14 @@ export function createWriteVerbs(
 
       await assertStreamWritable(db, payload.id, streamTenantFor(user));
       const currentVersion = await getStreamVersion(
-        db.raw,
+        runner,
         String(payload.id),
         streamTenantFor(user),
       );
 
       let event: Awaited<ReturnType<typeof append>>;
       try {
-        event = await runInSavepointIfSupported(db.raw, async (sp) =>
+        event = await runInSavepointIfSupported(runner, async (sp) =>
           append(sp, {
             aggregateId: String(payload.id),
             aggregateType: entityName,
@@ -696,7 +701,7 @@ export function createWriteVerbs(
         throw e;
       }
 
-      const forgetResult = await runInSavepointIfSupported(db.raw, async (sp) =>
+      const forgetResult = await runInSavepointIfSupported(runner, async (sp) =>
         applyEntityEvent(event, table, entity, sp),
       );
       if (forgetResult.kind !== "applied") {
@@ -722,6 +727,7 @@ export function createWriteVerbs(
     },
 
     async restore(payload, user, db) {
+      const runner = tenantDbRunner(db);
       if (!softDelete) {
         return writeFailure(
           new UnprocessableError("soft_delete_not_enabled", {
@@ -731,8 +737,8 @@ export function createWriteVerbs(
       }
 
       // Tenant boundary: db.fetchOne applies TenantDb's tenant predicate,
-      // selectMany(db.raw, ...) did not — any caller could un-delete a foreign
-      // tenant's row by id. "system"-mode dbs (r.systemScope() / crossTenant
+      // selectMany(runner, ...) did not — any caller could un-delete a foreign
+      // tenant's row by id. "system"-mode dbs (r.systemScope() / escapeHatch
       // handlers) still read unfiltered. No isDeleted filter here: restore
       // targets exactly the soft-deleted row.
       const row = await db.fetchOne(table, { id: payload.id });
@@ -766,7 +772,7 @@ export function createWriteVerbs(
 
       // Stream-version authoritative (see update() for rationale).
       const currentVersion = await getStreamVersion(
-        db.raw,
+        runner,
         String(payload.id),
         streamTenantFor(user),
       );
@@ -777,7 +783,7 @@ export function createWriteVerbs(
       // already ciphertext, no re-encrypt needed.
       let event: Awaited<ReturnType<typeof append>>;
       try {
-        event = await runInSavepointIfSupported(db.raw, (sp) =>
+        event = await runInSavepointIfSupported(runner, (sp) =>
           append(sp, {
             aggregateId: String(payload.id),
             aggregateType: entityName,
@@ -807,7 +813,7 @@ export function createWriteVerbs(
       // Live==Rebuild via applyEntityEvent. Restore only writes isDeleted=false
       // plus the version bump, so there is no sensitive-field drift and no
       // payload override is needed.
-      const restoreResult = await runInSavepointIfSupported(db.raw, async (sp) =>
+      const restoreResult = await runInSavepointIfSupported(runner, async (sp) =>
         applyEntityEvent(event, table, entity, sp),
       );
       if (restoreResult.kind !== "applied" || restoreResult.row === null) {

package/src/db/queries/shadow-swap.ts

@@ -105,6 +105,40 @@ export async function assertLiveColumnsMatchMeta(
   );
 }
 
+// EntityTableMeta carries no RLS/policies, so the swap would silently drop them (#2907).
+export async function assertLiveTableHasNoRowLevelSecurity(
+  tx: AnyDb,
+  tableName: string,
+  projectionName?: string,
+): Promise<void> {
+  const rows = await asRawClient(tx).unsafe<{
+    rls_enabled: boolean;
+    rls_forced: boolean;
+    policy_count: number;
+  }>(
+    `SELECT c.relrowsecurity AS rls_enabled, c.relforcerowsecurity AS rls_forced,
+       (SELECT count(*)::int FROM pg_policy p WHERE p.polrelid = c.oid) AS policy_count
+     FROM pg_class c
+     JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE n.nspname = 'public' AND c.relname = $1`,
+    [tableName],
+  );
+  const row = rows[0];
+  // skip: no live table yet — nothing to have RLS on
+  if (!row) return;
+  // skip: no RLS flags and no policies — nothing the swap could drop
+  if (!row.rls_enabled && !row.rls_forced && row.policy_count === 0) return;
+  const context =
+    projectionName !== undefined ? `projection-rebuild "${projectionName}"` : "shadow swap";
+  throw new Error(
+    `${context}: live table "${tableName}" has row level security (enabled: ${row.rls_enabled}, ` +
+      `forced: ${row.rls_forced}, policies: ${row.policy_count}). The shadow swap rebuilds the table ` +
+      "from EntityTableMeta and would silently drop RLS and every policy. Kumiko does not support RLS " +
+      "on rebuildable tables — see kumiko-platform docs/plans/rls-evaluation.md. Rebuild aborted; live " +
+      "table untouched.",
+  );
+}
+
 // Runs INSIDE the rebuild tx, AFTER the state/consumer row lock is taken.
 // Points search_path at the shadow schema (SET LOCAL → auto-reset on commit or
 // rollback), drops any leftover shadow from a crashed run, then builds the
@@ -300,6 +334,8 @@ export async function countColumnDrift(
 // object depends on the live table the swap fails loud and the whole rebuild
 // rolls back, leaving the old table untouched.
 export async function swapShadowIntoLive(tx: AnyDb, tableName: string): Promise<void> {
+  // Re-checked right before DROP: RLS could have been enabled after the early check.
+  await assertLiveTableHasNoRowLevelSecurity(tx, tableName);
   const raw = asRawClient(tx);
   const ident = quoteTableIdent(tableName);
   await raw.unsafe(`DROP TABLE public.${ident}`);

package/src/db/replay-migration-sql.ts

@@ -84,7 +84,7 @@ const SHAPE_NEUTRAL_ALTER_CLAUSE_RE = new RegExp(
     `ALTER COLUMN\\s+${IDENT}\\s+(SET|DROP)\\s+NOT NULL\\b`,
     `ALTER COLUMN\\s+${IDENT}\\s+(SET DEFAULT\\b|DROP DEFAULT\\b)`,
     `(ADD|DROP)\\s+CONSTRAINT\\s+${IDENT}`,
-    `\\b(ENABLE|DISABLE)\\s+ROW LEVEL SECURITY\\b`,
+    `\\b(ENABLE|DISABLE|(NO\\s+)?FORCE)\\s+ROW LEVEL SECURITY\\b`,
     `^OWNER TO\\b`,
   ].join("|"),
   "gi",
@@ -149,9 +149,9 @@ function applyStatement(
       else table.columns.delete(name);
     }
     // Shape-neutral clauses (ALTER COLUMN TYPE, SET/DROP NOT NULL, SET/DROP
-    // DEFAULT, ADD/DROP CONSTRAINT, ENABLE/DISABLE ROW LEVEL SECURITY, OWNER
-    // TO) — none add/remove/rename a column, so this replay (which only
-    // tracks column presence) correctly has nothing to do for them.
+    // DEFAULT, ADD/DROP CONSTRAINT, ENABLE/DISABLE/[NO] FORCE ROW LEVEL
+    // SECURITY, OWNER TO) — none add/remove/rename a column, so this replay
+    // (which only tracks column presence) correctly has nothing to do for them.
     if (alterBody.match(SHAPE_NEUTRAL_ALTER_CLAUSE_RE)) matchedAClause = true;
     // An ALTER TABLE that matched the outer "ALTER TABLE <name> <body>" shape
     // but whose body contains no recognized clause (e.g. RENAME TO/RENAME
@@ -177,7 +177,7 @@ function applyStatement(
         `starts with CREATE/ALTER/DROP TABLE but matched none of the replay's ` +
         `recognized patterns (CREATE TABLE, DROP TABLE, ALTER TABLE ADD/DROP ` +
         `COLUMN, ALTER COLUMN ... TYPE, SET/DROP NOT NULL, SET/DROP DEFAULT, ` +
-        `ADD/DROP CONSTRAINT, ENABLE/DISABLE ROW LEVEL SECURITY, OWNER TO — ` +
+        `ADD/DROP CONSTRAINT, ENABLE/DISABLE/[NO] FORCE ROW LEVEL SECURITY, OWNER TO — ` +
         `optionally-quoted identifiers). Likely RENAME TO/RENAME COLUMN (real ` +
         `identity change, not trackable here) or genuinely unparsed hand-written ` +
         `DDL. Statement: ${prefix}${statement.length > 200 ? "…" : ""}`,

package/src/db/tenant-db-runner.ts

@@ -0,0 +1,23 @@
+import type { TenantDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
+import { InternalError } from "../errors";
+import type { DbRunner } from "./connection";
+
+const tenantDbRunners = new WeakMap<TenantDb, DbRunner>();
+
+export function bindTenantDbRunner(tenantDb: TenantDb, runner: DbRunner): void {
+  tenantDbRunners.set(tenantDb, runner);
+}
+
+// WeakMap.get never reads a property off tenantDb — safe even when tenantDb is a
+// throwing systemScope guard Proxy that rejects every property access.
+export function tenantDbRunner(tenantDb: TenantDb): DbRunner {
+  const runner = tenantDbRunners.get(tenantDb);
+  if (!runner) {
+    throw new InternalError({
+      message:
+        "framework infrastructure received a TenantDb not built by createTenantDb (or a " +
+        "fail-closed systemScope guard) — no connection bound.",
+    });
+  }
+  return runner;
+}