@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/db/queries/shadow-swap.js

@@ -17,19 +17,20 @@
 // Boundary: the shadow table is rebuilt from EntityTableMeta, so any index NOT
 // expressed in meta (hand-added in a migration) is not reconstructed, and a
 // partial index whose WHERE the renderer can't express is rejected up-front.
+// RLS flags and policies are copied from the live catalog at swap time.
 import { isUuid, parseTenantId } from "@cosmicdrift/kumiko-types/identifiers";
 import { configuredBlindIndexKey } from "../../crypto/index.js";
+import { extractPgError } from "../pg-error.js";
 import { asEntityTableMeta, asRawClient } from "../query.js";
 import { renderTableDdl } from "../render-ddl.js";
 import { columnNamesOf, tableExists } from "../schema-inspection.js";
 import { toPostgresArrayLiteral } from "./postgres-array-literal.js";
+import { readRowLevelSecurityState, restoreRowLevelSecurityState } from "./rls-catalog.js";
 import { quoteTableIdent } from "./table-ops.js";
 export const PROJECTION_REBUILD_SCHEMA = "kumiko_rebuild";
 const SCHEMA_IDENT = quoteTableIdent(PROJECTION_REBUILD_SCHEMA);
 function isDuplicateSchemaError(e) {
-    if (typeof e !== "object" || e === null || !("code" in e))
-        return false;
-    const { code } = e;
+    const code = extractPgError(e)?.code;
     // 42P06 duplicate_schema, 23505 unique_violation on pg_namespace — both
     // surface from the well-known CREATE SCHEMA IF NOT EXISTS race.
     return code === "42P06" || code === "23505";
@@ -93,27 +94,6 @@ export async function assertLiveColumnsMatchMeta(db, meta, projectionName) {
         "Rebuilding would swap away the difference. Likely cause: this pod runs a build whose registry is behind (or ahead of) the applied migrations — rolling deploy in progress? — or DDL was applied by hand. " +
         "Rebuild aborted; retry from a pod whose code matches the migrated schema.");
 }
-// EntityTableMeta carries no RLS/policies, so the swap would silently drop them.
-export async function assertLiveTableHasNoRowLevelSecurity(tx, tableName, projectionName) {
-    const rows = await asRawClient(tx).unsafe(`SELECT c.relrowsecurity AS rls_enabled, c.relforcerowsecurity AS rls_forced,
-       (SELECT count(*)::int FROM pg_policy p WHERE p.polrelid = c.oid) AS policy_count
-     FROM pg_class c
-     JOIN pg_namespace n ON n.oid = c.relnamespace
-     WHERE n.nspname = 'public' AND c.relname = $1`, [tableName]);
-    const row = rows[0];
-    // skip: no live table yet — nothing to have RLS on
-    if (!row)
-        return;
-    // skip: no RLS flags and no policies — nothing the swap could drop
-    if (!row.rls_enabled && !row.rls_forced && row.policy_count === 0)
-        return;
-    const context = projectionName !== undefined ? `projection-rebuild "${projectionName}"` : "shadow swap";
-    throw new Error(`${context}: live table "${tableName}" has row level security (enabled: ${row.rls_enabled}, ` +
-        `forced: ${row.rls_forced}, policies: ${row.policy_count}). The shadow swap rebuilds the table ` +
-        "from EntityTableMeta and would silently drop RLS and every policy. Kumiko does not support RLS " +
-        "on rebuildable tables: drop the RLS flags/policies on this table or exclude it from online " +
-        "rebuild. Rebuild aborted; live table untouched.");
-}
 // Runs INSIDE the rebuild tx, AFTER the state/consumer row lock is taken.
 // Points search_path at the shadow schema (SET LOCAL → auto-reset on commit or
 // rollback), drops any leftover shadow from a crashed run, then builds the
@@ -397,11 +377,14 @@ export async function countColumnDrift(tx, tableName, meta) {
 export async function swapShadowIntoLive(tx, tableName) {
     const raw = asRawClient(tx);
     const ident = quoteTableIdent(tableName);
-    // Held before the re-check so a concurrent ENABLE ROW LEVEL SECURITY either commits first
-    // (and is seen) or waits behind the DROP. Without it the catalog read takes no lock, and
-    // the unfenced paths (MSP rebuild, projection with no subscribed events) would drop RLS.
+    // Held before the catalog read so a concurrent ENABLE ROW LEVEL SECURITY / CREATE POLICY either
+    // commits first (and is carried over) or waits behind the DROP.
     await raw.unsafe(`LOCK TABLE public.${ident} IN ACCESS EXCLUSIVE MODE`);
-    await assertLiveTableHasNoRowLevelSecurity(tx, tableName);
+    const live = await readRowLevelSecurityState(tx, "public", tableName);
+    if (live === undefined) {
+        throw new Error(`shadow swap: live table public.${tableName} does not exist`);
+    }
     await raw.unsafe(`DROP TABLE public.${ident}`);
     await raw.unsafe(`ALTER TABLE ${SCHEMA_IDENT}.${ident} SET SCHEMA public`);
+    await restoreRowLevelSecurityState(tx, tableName, live);
 }

package/dist/db/queries/test-stack.d.ts

@@ -2,7 +2,10 @@ import type { AnyDb } from "../query.ts";
 export { alterTableAddColumn, createIndexIfNotExists, executeDdlStatement } from "./ddl.ts";
 export declare function truncateTablesRestartIdentity(db: AnyDb, tableNames: readonly string[]): Promise<void>;
 export declare function databaseExists(db: AnyDb, dbName: string): Promise<boolean>;
-export declare function createDatabase(db: AnyDb, dbName: string, templateDbName?: string): Promise<void>;
+export declare function createDatabase(db: AnyDb, dbName: string, templateDbName?: string, owner?: string): Promise<void>;
+export declare function createApplicationRole(admin: AnyDb, role: string, password: string): Promise<void>;
+export declare function transferDatabaseOwnership(admin: AnyDb, dbName: string, owner: string): Promise<void>;
+export declare function transferPublicSchemaOwnership(db: AnyDb, owner: string): Promise<void>;
 export declare function renameDatabase(db: AnyDb, fromName: string, toName: string): Promise<void>;
 export declare function listDatabaseNamesWithPrefix(db: AnyDb, prefix: string): Promise<readonly string[]>;
 export declare function acquireSessionAdvisoryLock(db: AnyDb, key: string): Promise<void>;

package/dist/db/queries/test-stack.js

@@ -1,4 +1,6 @@
+import { extractPgError } from "../pg-error.js";
 import { asRawClient } from "../query.js";
+import { PROJECTION_REBUILD_SCHEMA } from "./shadow-swap.js";
 import { quoteTableIdent } from "./table-ops.js";
 // Re-exported for back-compat — the generic DDL helpers moved to ./ddl so
 // the prod-boot path (db/table-push.ts, pipeline/event-consumer-state.ts)
@@ -12,9 +14,88 @@ export async function databaseExists(db, dbName) {
     const rows = await asRawClient(db).unsafe(`SELECT EXISTS (SELECT 1 FROM pg_database WHERE datname = $1) AS exists`, [dbName]);
     return rows[0]?.exists === true;
 }
-export async function createDatabase(db, dbName, templateDbName) {
+export async function createDatabase(db, dbName, templateDbName, owner) {
     const template = templateDbName === undefined ? "" : ` TEMPLATE ${quoteTableIdent(templateDbName)}`;
-    await asRawClient(db).unsafe(`CREATE DATABASE ${quoteTableIdent(dbName)}${template}`);
+    const ownerClause = owner === undefined ? "" : ` OWNER ${quoteTableIdent(owner)}`;
+    await asRawClient(db).unsafe(`CREATE DATABASE ${quoteTableIdent(dbName)}${template}${ownerClause}`);
+}
+const DUPLICATE_OBJECT = "42710";
+const UNIQUE_VIOLATION = "23505";
+const INTERNAL_ERROR = "XX000";
+const MAX_CAUSE_DEPTH = 8;
+// XX000 is Postgres' generic internal error; only the concurrent catalog update counts as a lost race.
+// The driver error carrying the message may sit below a wrapper, as for the SQLSTATE.
+function messageInCauseChain(error, needle) {
+    let current = error;
+    for (let depth = 0; depth < MAX_CAUSE_DEPTH && current instanceof Error; depth++) {
+        if (current.message.includes(needle))
+            return true;
+        current = current.cause;
+    }
+    return false;
+}
+function isLostRoleRace(error) {
+    const pgError = extractPgError(error);
+    if (pgError?.code === DUPLICATE_OBJECT || pgError?.code === UNIQUE_VIOLATION)
+        return true;
+    return (pgError?.code === INTERNAL_ERROR && messageInCauseChain(error, "tuple concurrently updated"));
+}
+// Parallel workers race on CREATE ROLE and ALTER ROLE; losing either race means the role has the
+// attributes and password this call wanted, which is the goal.
+export async function createApplicationRole(admin, role, password) {
+    const raw = asRawClient(admin);
+    const existing = await raw.unsafe(`SELECT 1 FROM pg_roles WHERE rolname = $1`, [role]);
+    const attributes = `LOGIN NOSUPERUSER NOBYPASSRLS PASSWORD ${quoteLiteral(password)}`;
+    // An earlier run may have created the role with another password, so an existing role is realigned.
+    const statement = existing.length > 0
+        ? `ALTER ROLE ${quoteTableIdent(role)} ${attributes}`
+        : `CREATE ROLE ${quoteTableIdent(role)} ${attributes}`;
+    try {
+        await raw.unsafe(statement);
+    }
+    catch (error) {
+        if (!isLostRoleRace(error))
+            throw error;
+    }
+}
+function quoteLiteral(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+export async function transferDatabaseOwnership(admin, dbName, owner) {
+    await asRawClient(admin).unsafe(`ALTER DATABASE ${quoteTableIdent(dbName)} OWNER TO ${quoteTableIdent(owner)}`);
+}
+const OWNED_SCHEMA_PUBLIC = "public";
+const OWNED_RELATION_KINDS = {
+    r: "TABLE",
+    p: "TABLE",
+    S: "SEQUENCE",
+    v: "VIEW",
+    m: "MATERIALIZED VIEW",
+};
+// Run on a connection to the database itself. REASSIGN OWNED fails for a bootstrap superuser, so owners move per relation.
+// The rebuild schema is included: a persistent database that already rebuilt as superuser would otherwise refuse the
+// application role's next rebuild for lack of CREATE on it.
+export async function transferPublicSchemaOwnership(db, owner) {
+    const raw = asRawClient(db);
+    const ownedSchemas = [OWNED_SCHEMA_PUBLIC, PROJECTION_REBUILD_SCHEMA];
+    const rebuildSchema = await raw.unsafe(`SELECT 1 FROM pg_namespace WHERE nspname = $1`, [
+        PROJECTION_REBUILD_SCHEMA,
+    ]);
+    if (rebuildSchema.length > 0) {
+        await raw.unsafe(`ALTER SCHEMA ${quoteTableIdent(PROJECTION_REBUILD_SCHEMA)} OWNER TO ${quoteTableIdent(owner)}`);
+    }
+    const relations = await raw.unsafe(`SELECT n.nspname, c.relname, c.relkind::text AS relkind
+       FROM pg_class c
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+       JOIN pg_roles r ON r.oid = c.relowner
+      WHERE n.nspname = ANY($2::text[]) AND c.relkind IN ('r', 'p', 'S', 'v', 'm') AND r.rolname <> $1
+        AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = c.oid AND d.deptype IN ('a', 'i'))`, [owner, ownedSchemas]);
+    for (const { nspname, relname, relkind } of relations) {
+        const kind = OWNED_RELATION_KINDS[relkind];
+        if (kind === undefined)
+            continue;
+        await raw.unsafe(`ALTER ${kind} ${quoteTableIdent(nspname)}.${quoteTableIdent(relname)} OWNER TO ${quoteTableIdent(owner)}`);
+    }
 }
 export async function renameDatabase(db, fromName, toName) {
     await asRawClient(db).unsafe(`ALTER DATABASE ${quoteTableIdent(fromName)} RENAME TO ${quoteTableIdent(toName)}`);

package/dist/db/query.d.ts

@@ -2,6 +2,8 @@ import type { AggregateRow, AggregateSpec } from "@cosmicdrift/kumiko-types/aggr
 import type { DbRunner, DbTx } from "@cosmicdrift/kumiko-types/db-connection";
 import type { ExecutorManagedRunner, ExecutorManagedWriteCapability, WritableTable } from "@cosmicdrift/kumiko-types/executor-brand";
 import type { SelectOptions, WhereObject } from "@cosmicdrift/kumiko-types/where-clause-types";
+import { type ClosedConnectionContext } from "./closed-connection.ts";
+import { type PreparedValue } from "./driver-value-preparation.ts";
 import type { EntityTableMeta } from "./entity-table-meta.ts";
 import { type TableInfo } from "./table-info.ts";
 import { asEntityTableMeta, requireEntityTableMeta } from "./table-introspection.ts";
@@ -32,6 +34,7 @@ type AnyRow = any;
 export type { JsonTextMatch, OrderByClause, SelectOptions, WhereObject, WhereOperator, WhereValue, } from "@cosmicdrift/kumiko-types/where-clause-types";
 export type TableLike = EntityTableMeta | any;
 export declare function coerceRow<TOut = Record<string, unknown>>(row: Record<string, unknown>, info: TableInfo): TOut;
+export declare function unsafeLoggingClosedConnection<TRow = unknown>(db: AnyDb, sqlText: string, params: readonly unknown[], context: ClosedConnectionContext): Promise<readonly TRow[]>;
 export declare function unsafeReadRetrying<TRow>(db: AnyDb, sqlText: string, params: readonly unknown[]): Promise<readonly TRow[]>;
 export declare function selectMany<TRow = AnyRow>(db: AnyDb, table: TableLike, where?: WhereObject, options?: SelectOptions): Promise<readonly TRow[]>;
 export declare function fetchOne<TRow = AnyRow>(db: AnyDb, table: TableLike, where: WhereObject): Promise<TRow | undefined>;
@@ -63,7 +66,18 @@ export declare function updateMany<TRow = AnyRow>(db: AnyDb, table: WritableTabl
 export declare function updateMany<TRow = AnyRow>(db: ExecutorManagedWriteCapability, table: EntityTableMeta, set: Record<string, unknown>, where: WhereObject): Promise<readonly TRow[]>;
 export declare function deleteMany(db: AnyDb, table: WritableTable, where: WhereObject): Promise<number>;
 export declare function deleteMany(db: ExecutorManagedWriteCapability, table: EntityTableMeta, where: WhereObject): Promise<number>;
+export type InsertEntry = {
+    readonly field: string;
+    readonly col: string;
+    readonly prepared: PreparedValue;
+};
+export declare function insertEntries(info: TableInfo, values: Record<string, unknown>): InsertEntry[];
 export declare function resolveConflictColumns(table: TableLike, info: TableInfo, conflictKeys: readonly string[] | undefined): readonly string[];
+export declare function conflictUpdateParts(info: TableInfo, entries: readonly InsertEntry[], update: Record<string, unknown> | undefined, skipCols: ReadonlySet<string>, params: unknown[]): string[];
+export declare function buildInsertSql(info: TableInfo, entries: readonly InsertEntry[]): {
+    sqlPrefix: string;
+    params: unknown[];
+};
 export type UpsertOnConflictOptions = {
     readonly conflictKeys: readonly string[];
     /** Columns to set on conflict. Default: EXCLUDED for every inserted non-key column. */

package/dist/db/query.js

@@ -1,4 +1,4 @@
-// Typed query helpers over the postgres-js driver: EntityTableMeta in, rows out.
+// Typed query helpers over the Bun.SQL driver: EntityTableMeta in, rows out.
 //
 // API:
 //   selectMany<T>(db, table, where?, opts?) → readonly T[]
@@ -24,6 +24,7 @@ import { executorManagedWriteDenied } from "./executor-managed-tables.js";
 import { extractPgError } from "./pg-error.js";
 import { extractTableInfo } from "./table-info.js";
 import { asEntityTableMeta, requireEntityTableMeta } from "./table-introspection.js";
+import { openSerializedSavepoint } from "./transaction-serialization.js";
 import { buildWhereClause } from "./where-clause.js";
 // table() (dialect) stores the canonical, shadow-proof EntityTableMeta under
 // `Symbol.for("kumiko:schema:Meta")`. The column handles on the table object are
@@ -33,15 +34,18 @@ import { buildWhereClause } from "./where-clause.js";
 export { asEntityTableMeta, requireEntityTableMeta };
 export function hasBegin(client) {
     // Tx/savepoint handles can keep a begin() that throws; only savepoint() tells them apart from a pool.
-    return typeof client.begin === "function" && typeof client.savepoint !== "function";
+    return typeof client.begin === "function" && !hasSavepoint(client);
+}
+function hasSavepoint(client) {
+    return typeof client.savepoint === "function";
 }
 function isRawClient(value) {
     return typeof propertyOf(value, "unsafe") === "function";
 }
 export function asRawClient(db) {
-    // Direct: postgres-js Sql / TransactionSql. Both
-    // expose `.unsafe`; only Sql has `.begin` — TransactionSql uses
-    // `.savepoint` for nested-tx. We only require `.unsafe` here; callers that
+    // Direct: Bun.SQL pool / transaction handle. Both
+    // expose `.unsafe`; only the pool starts a transaction — a transaction handle uses
+    // `.savepoint` for nesting. We only require `.unsafe` here; callers that
     // need `.begin` (e.g. `transaction()`) verify it themselves.
     if (isRawClient(db))
         return db;
@@ -52,15 +56,15 @@ export function asRawClient(db) {
             "tenant filter — use a ctx.db.<method>, or ctx.db.unsafeRaw() with escapeHatch: " +
             "{ reason } on the handler/hook (r.systemScope() features: ctx.systemDb.unsafeRaw(reason)).");
     }
-    // Wrapper handle: $client = postgres-js Sql.
+    // Wrapper handle: $client = Bun.SQL pool.
     const $client = propertyOf(db, "$client");
     if (isRawClient($client))
         return $client;
-    // Wrapper transaction handle: session.client = postgres-js Sql.
+    // Wrapper transaction handle: session.client = Bun.SQL pool.
     const sessionClient = propertyOf(propertyOf(db, "session"), "client");
     if (isRawClient(sessionClient))
         return sessionClient;
-    throw new Error("asRawClient: db argument has no .unsafe() — pass a postgres-js Sql or a transaction handle.");
+    throw new Error("asRawClient: db argument has no .unsafe() — pass a Bun.SQL pool or a transaction handle.");
 }
 export function runnerCanBeginTransaction(db) {
     return hasBegin(asRawClient(db));
@@ -71,36 +75,57 @@ function savepointRunnerOf(sp) {
 }
 export async function runInSavepoint(tx, fn) {
     const raw = asRawClient(tx);
-    if (typeof raw.savepoint !== "function") {
-        throw new Error("runInSavepoint: transaction handle has no savepoint() — pass the driver tx (postgres.js TransactionSql).");
+    if (!hasSavepoint(raw)) {
+        throw new Error("runInSavepoint: transaction handle has no savepoint() — pass the driver tx (Bun.SQL TransactionSQL).");
     }
-    return raw.savepoint((sp) => fn(savepointRunnerOf(sp)));
+    return openSerializedSavepoint(raw, (sp) => fn(savepointRunnerOf(sp)));
+}
+// Same error-confinement as runInSavepoint, but for call sites that don't
+// know whether `db` is a bare pool connection or an active transaction
+// (e.g. the CRUD executor, invoked both from a dispatcher tx and directly
+// against the pool by seeds/tests). A pool connection has no savepoint() —
+// and doesn't need one, since each statement there is its own auto-committed
+// unit and a failed statement can't poison anything downstream.
+//
+// `.savepoint` being present isn't proof the transaction is still open: a
+// committed transaction handle still exposes `.savepoint`, and calling it
+// fails (Bun.SQL: ERR_POSTGRES_INVALID_TRANSACTION_STATE, Postgres: 25P01)
+// since there's no BEGIN left to nest into. That is now a programming error, not something
+// to paper over by re-running `fn` without the savepoint's isolation.
+const CONNECTION_CLOSED_CODE = "ERR_POSTGRES_CONNECTION_CLOSED";
+const SAVEPOINT_ON_COMMITTED_CODES = new Set([
+    "25P01",
+    "ERR_POSTGRES_INVALID_TRANSACTION_STATE",
+]);
+function isSavepointOnDeadTransactionCode(code) {
+    return (code !== undefined &&
+        (code === CONNECTION_CLOSED_CODE || SAVEPOINT_ON_COMMITTED_CODES.has(code)));
 }
 export async function runInSavepointIfSupported(db, fn) {
     const raw = asRawClient(db);
-    if (typeof raw.savepoint !== "function")
+    if (!hasSavepoint(raw))
         return fn(savepointRunnerOf(db));
     // An error from inside fn must never be remapped, even if it carries a closed-connection code.
     let fnStarted = false;
     try {
-        return await raw.savepoint((sp) => {
+        return await openSerializedSavepoint(raw, (sp) => {
             fnStarted = true;
             return fn(savepointRunnerOf(sp));
         });
     }
     catch (e) {
         const code = extractPgError(e)?.code;
-        if (!fnStarted && (code === "25P01" || code === "ERR_POSTGRES_CONNECTION_CLOSED")) {
+        if (!fnStarted && isSavepointOnDeadTransactionCode(code)) {
             throw new InternalError({
-                message: code === "25P01"
-                    ? "runInSavepointIfSupported: savepoint on a transaction that has already committed — " +
-                        "this is almost always database work in an afterCommit hook. afterCommit is the default " +
-                        "phase of r.hook/postSave/postDelete. Use HookPhases.inTransaction for writes that must " +
-                        "roll back with the trigger, or ctx.dbOutsideTransaction for work that must survive a rollback."
-                    : "runInSavepointIfSupported: the transaction handle's connection is gone — the transaction " +
+                message: code === CONNECTION_CLOSED_CODE
+                    ? "runInSavepointIfSupported: the transaction handle's connection is gone — the transaction " +
                         "already committed (almost always database work in an afterCommit hook) or the connection dropped. " +
                         "afterCommit is the default phase of r.hook/postSave/postDelete. Use HookPhases.inTransaction " +
-                        "for writes that must roll back with the trigger, or ctx.dbOutsideTransaction for work that must survive a rollback.",
+                        "for writes that must roll back with the trigger, or ctx.db.outsideTransaction for work that must survive a rollback."
+                    : "runInSavepointIfSupported: savepoint on a transaction that has already committed — " +
+                        "this is almost always database work in an afterCommit hook. afterCommit is the default " +
+                        "phase of r.hook/postSave/postDelete. Use HookPhases.inTransaction for writes that must " +
+                        "roll back with the trigger, or ctx.db.outsideTransaction for work that must survive a rollback.",
                 cause: e instanceof Error ? e : undefined,
             });
         }
@@ -131,7 +156,8 @@ function assertNotTenantScoped(db, fnName) {
     if (tenantDbDelegate(db) !== undefined) {
         throw new Error(`${fnName}: received a tenant-scoped db but this helper does not apply the tenant filter. ` +
             "Pass ctx.db.unsafeRaw() (with escapeHatch: { reason } on the handler/hook) for an " +
-            "explicit cross-tenant op, or use a scoped TenantDb method.");
+            "explicit cross-tenant op, or use a scoped TenantDb method " +
+            "(for an upsert: ctx.db.upsert(table, values, { conflictTarget })).");
     }
 }
 export function coerceRow(row, info) {
@@ -143,7 +169,7 @@ function coerceRows(rows, info) {
 }
 // Write and other non-retried paths: log when a closed-connection error leaves
 // the db layer, rethrow unchanged.
-async function unsafeLoggingClosedConnection(db, sqlText, params, context) {
+export async function unsafeLoggingClosedConnection(db, sqlText, params, context) {
     const raw = asRawClient(db);
     try {
         return await raw.unsafe(sqlText, params);
@@ -453,14 +479,14 @@ export async function deleteMany(db, table, where) {
         operation: "deleteMany",
         table: info.name,
     });
-    // postgres-js reports the affected-row count of a DELETE on the result, no RETURNING needed.
+    // Bun.SQL reports the affected-row count of a DELETE on the result, no RETURNING needed.
     const count = propertyOf(result, "count");
     if (typeof count !== "number") {
         throw new Error(`deleteMany(${info.name}): the driver result carries no affected-row count`);
     }
     return count;
 }
-function insertEntries(info, values) {
+export function insertEntries(info, values) {
     return Object.entries(values)
         .filter(([k]) => info.hasColumn(k))
         .map(([k, v]) => {
@@ -486,7 +512,31 @@ export function resolveConflictColumns(table, info, conflictKeys) {
         return [info.columnOf("id")];
     throw new Error("upsert: cannot infer conflict keys — pass conflictKeys explicitly");
 }
-function buildInsertSql(info, entries) {
+// Appends bound values to `params`; `skipCols` only applies to the default EXCLUDED set.
+export function conflictUpdateParts(info, entries, update, skipCols, params) {
+    const parts = [];
+    if (update === undefined) {
+        for (const e of entries) {
+            if (skipCols.has(e.col))
+                continue;
+            parts.push(`${quoteIdent(e.col)} = EXCLUDED.${quoteIdent(e.col)}`);
+        }
+        return parts;
+    }
+    for (const [field, value] of Object.entries(update)) {
+        const col = info.columnOf(field);
+        const p = prepareValue(value, info.pgTypeOf(col));
+        if (p.kind === "literal") {
+            parts.push(`${quoteIdent(col)} = ${p.literal}`);
+        }
+        else {
+            params.push(p.bound);
+            parts.push(`${quoteIdent(col)} = $${params.length}${p.sql}`);
+        }
+    }
+    return parts;
+}
+export function buildInsertSql(info, entries) {
     if (entries.length === 0)
         throw new Error("insert: empty values object");
     const cols = entries.map((e) => quoteIdent(e.col)).join(", ");
@@ -556,28 +606,7 @@ async function upsertOnConflictChecked(db, table, values, options) {
     const conflictCols = resolveConflictColumns(table, info, options.conflictKeys);
     const conflictSet = new Set(conflictCols);
     const { sqlPrefix, params } = buildInsertSql(info, entries);
-    const updateParts = [];
-    let idx = params.length + 1;
-    if (options.update !== undefined) {
-        for (const [field, value] of Object.entries(options.update)) {
-            const col = info.columnOf(field);
-            const p = prepareValue(value, info.pgTypeOf(col));
-            if (p.kind === "literal") {
-                updateParts.push(`${quoteIdent(col)} = ${p.literal}`);
-            }
-            else {
-                updateParts.push(`${quoteIdent(col)} = $${idx++}${p.sql}`);
-                params.push(p.bound);
-            }
-        }
-    }
-    else {
-        for (const e of entries) {
-            if (conflictSet.has(e.col))
-                continue;
-            updateParts.push(`${quoteIdent(e.col)} = EXCLUDED.${quoteIdent(e.col)}`);
-        }
-    }
+    const updateParts = conflictUpdateParts(info, entries, options.update, conflictSet, params);
     if (updateParts.length === 0) {
         throw new Error("upsertOnConflict: nothing to update on conflict");
     }

package/dist/db/reference-data.d.ts

@@ -1,5 +1,5 @@
+import type { ReferenceDataDef } from "@cosmicdrift/kumiko-types/config";
 import type { Registry } from "../engine/index.ts";
-import type { ReferenceDataDef } from "../engine/types/index.ts";
 import type { DbConnection } from "./connection.ts";
 /**
  * Seed reference data at boot time.

package/dist/db/reference-data.js

@@ -2,8 +2,10 @@ import { fetchOne } from "../db/query.js";
 import { createSystemUser } from "../engine/system-user.js";
 import { SYSTEM_TENANT_ID } from "../engine/types/index.js";
 import { reraiseAsKumikoError } from "../errors/index.js";
+import { getStreamVersion } from "../event-store/event-store.js";
 import { entityTableFromRegistry } from "./entity-table-from-registry.js";
 import { createEventStoreExecutor } from "./event-store-executor.js";
+import { deleteRowsWithoutReplayableStream } from "./queries/event-store-orphan-rows.js";
 import { createTenantDb } from "./tenant-db.js";
 /**
  * Seed reference data at boot time.
@@ -17,7 +19,12 @@ export async function seedReferenceData(defs, registry, db) {
     let inserted = 0;
     let updated = 0;
     const by = createSystemUser(SYSTEM_TENANT_ID);
-    const tdb = createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+    const tdb = createTenantDb({
+        db,
+        tenantId: SYSTEM_TENANT_ID,
+        mode: "system",
+        reason: "reference data lives in the system tenant",
+    });
     for (const def of defs) {
         const entity = registry.getEntity(def.entityName);
         if (!entity)
@@ -38,11 +45,21 @@ export async function seedReferenceData(defs, registry, db) {
             if (keyValue === undefined)
                 continue;
             // Soft-deleted rows are invisible to executor.update, so treat them as missing and re-create.
-            const existing = await fetchOne(db, table, {
+            const existingRow = await fetchOne(db, table, {
                 [upsertKey]: keyValue,
                 tenantId: SYSTEM_TENANT_ID,
                 ...(entity.softDelete && { isDeleted: false }),
             });
+            // Rows seeded before reference data went through the executor have no events: update would
+            // hit a stream-version conflict and a rebuild would drop them. Drop the row and re-create
+            // it under the same id so its stream starts now.
+            let existing = existingRow;
+            let recreateId;
+            if (existingRow && (await getStreamVersion(db, existingRow.id, SYSTEM_TENANT_ID)) === 0) {
+                await deleteRowsWithoutReplayableStream(tdb, { table, ids: [existingRow.id] });
+                existing = undefined;
+                recreateId = existingRow.id;
+            }
             if (existing) {
                 const changes = {};
                 for (const [field, value] of Object.entries(row)) {
@@ -60,7 +77,7 @@ export async function seedReferenceData(defs, registry, db) {
                 }
             }
             else {
-                const result = await executor.create({ ...row, tenantId: SYSTEM_TENANT_ID }, by, tdb);
+                const result = await executor.create({ ...row, ...(recreateId && { id: recreateId }), tenantId: SYSTEM_TENANT_ID }, by, tdb);
                 if (!result.isSuccess)
                     throw reraiseAsKumikoError(result.error);
                 inserted++;

package/dist/db/render-ddl.d.ts

@@ -1,4 +1,8 @@
 import type { EntityTableMeta, IndexMeta } from "./entity-table-meta.ts";
+import { type RowLevelSecurityMode } from "./render-rls-ddl.ts";
 export declare function renderIndex(tableName: string, idx: IndexMeta): string;
-export declare function renderTableDdl(meta: EntityTableMeta): readonly string[];
-export declare function renderTablesDdl(metas: readonly EntityTableMeta[]): readonly string[];
+export type RenderDdlOptions = {
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
+};
+export declare function renderTableDdl(meta: EntityTableMeta, options?: RenderDdlOptions): readonly string[];
+export declare function renderTablesDdl(metas: readonly EntityTableMeta[], options?: RenderDdlOptions): readonly string[];

package/dist/db/render-ddl.js

@@ -7,9 +7,8 @@
 // NO-MAGIC-ON-DATA: this renderer never runs at app runtime, only as a build
 // step. The runner reads the checked-in SQL, not renderer output.
 import { pgTypeToSqlType } from "./dialect.js";
-function quoteIdent(name) {
-    return `"${name.replace(/"/g, '""')}"`;
-}
+import { renderTableRowLevelSecurityDdl } from "./render-rls-ddl.js";
+import { quoteIdent } from "./sql-identifier.js";
 function renderColumn(col) {
     const parts = [quoteIdent(col.name), pgTypeToSqlType(col.pgType)];
     if (col.identity)
@@ -36,7 +35,7 @@ export function renderIndex(tableName, idx) {
     const where = idx.whereSql !== undefined ? ` WHERE ${idx.whereSql}` : "";
     return `CREATE ${kind} IF NOT EXISTS ${quoteIdent(idx.name)} ON ${quoteIdent(tableName)} (${colList})${where};`;
 }
-export function renderTableDdl(meta) {
+export function renderTableDdl(meta, options = {}) {
     const colLines = meta.columns.map(renderColumn);
     const lines = [...colLines];
     if (meta.compositePrimaryKey !== undefined) {
@@ -45,11 +44,12 @@ export function renderTableDdl(meta) {
     }
     const create = `CREATE TABLE IF NOT EXISTS ${quoteIdent(meta.tableName)} (\n  ${lines.join(",\n  ")}\n);`;
     const indexes = meta.indexes.map((idx) => renderIndex(meta.tableName, idx));
-    return [create, ...indexes];
+    const policies = options.rowLevelSecurity === "on" ? renderTableRowLevelSecurityDdl(meta) : [];
+    return [create, ...indexes, ...policies];
 }
-export function renderTablesDdl(metas) {
+export function renderTablesDdl(metas, options = {}) {
     const stmts = [];
     for (const m of metas)
-        stmts.push(...renderTableDdl(m));
+        stmts.push(...renderTableDdl(m, options));
     return stmts;
 }

package/dist/db/render-rls-ddl.d.ts

@@ -0,0 +1,35 @@
+import type { EntityTableMeta } from "./entity-table-meta.ts";
+export declare const ROW_LEVEL_SECURITY_MODES: readonly ["off", "on"];
+export type RowLevelSecurityMode = (typeof ROW_LEVEL_SECURITY_MODES)[number];
+export declare const DEFAULT_ROW_LEVEL_SECURITY_MODE: RowLevelSecurityMode;
+export declare const TENANT_ISOLATION_POLICY = "kumiko_tenant_isolation";
+export declare const SYSTEM_TENANT_READ_POLICY = "kumiko_system_tenant_read";
+export declare const TENANT_ID_SETTING = "kumiko.tenant_id";
+export declare const SCOPE_SETTING = "kumiko.scope";
+export declare const SYSTEM_SCOPE = "system";
+export declare const POLICY_COMMANDS: readonly ["ALL", "SELECT", "INSERT", "UPDATE", "DELETE"];
+export declare const POLICY_KINDS: readonly ["PERMISSIVE", "RESTRICTIVE"];
+export type RowLevelSecurityPolicy = {
+    readonly name: string;
+    readonly command: (typeof POLICY_COMMANDS)[number];
+    readonly kind: (typeof POLICY_KINDS)[number];
+    readonly rolesSql: string;
+    readonly using?: string;
+    readonly withCheck?: string;
+};
+export type TableRowLevelSecurity = {
+    readonly policies: readonly RowLevelSecurityPolicy[];
+};
+export type RowLevelSecurityFlags = {
+    readonly enabled: boolean;
+    readonly forced: boolean;
+};
+export declare function tenantRowLevelSecurityFor(meta: EntityTableMeta): TableRowLevelSecurity | undefined;
+export declare function rowLevelSecurityByTable(metas: readonly EntityTableMeta[]): Record<string, TableRowLevelSecurity>;
+export declare function renderCreatePolicy(tableSql: string, policy: RowLevelSecurityPolicy): string;
+export declare function renderRowLevelSecurityFlags(tableSql: string, flags: RowLevelSecurityFlags): string[];
+export declare function renderEnableRowLevelSecurity(tableSql: string, next: TableRowLevelSecurity, previous?: TableRowLevelSecurity): string[];
+export declare function renderDisableRowLevelSecurity(tableSql: string, previous: TableRowLevelSecurity): string[];
+export declare function renderTableRowLevelSecurityDdl(meta: EntityTableMeta): readonly string[];
+export declare function isSameTableRowLevelSecurity(a: TableRowLevelSecurity, b: TableRowLevelSecurity): boolean;
+export declare function isTableRowLevelSecurityRecord(value: unknown): value is Record<string, TableRowLevelSecurity>;