@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/db/render-rls-ddl.js

@@ -0,0 +1,127 @@
+// Pure renderer for Postgres row level security: EntityTableMeta → policy DDL.
+// Every table with a `tenant_id` column gets two policies; tables without one are untouched.
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
+import { isOneOf, isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { pgTypeToSqlType } from "./dialect.js";
+import { quoteIdent } from "./sql-identifier.js";
+export const ROW_LEVEL_SECURITY_MODES = ["off", "on"];
+export const DEFAULT_ROW_LEVEL_SECURITY_MODE = "on";
+export const TENANT_ISOLATION_POLICY = "kumiko_tenant_isolation";
+export const SYSTEM_TENANT_READ_POLICY = "kumiko_system_tenant_read";
+export const TENANT_ID_SETTING = "kumiko.tenant_id";
+export const SCOPE_SETTING = "kumiko.scope";
+export const SYSTEM_SCOPE = "system";
+const TENANT_COLUMN = "tenant_id";
+export const POLICY_COMMANDS = ["ALL", "SELECT", "INSERT", "UPDATE", "DELETE"];
+export const POLICY_KINDS = ["PERMISSIVE", "RESTRICTIVE"];
+export function tenantRowLevelSecurityFor(meta) {
+    const tenantColumn = meta.columns.find((col) => col.name === TENANT_COLUMN);
+    if (tenantColumn === undefined)
+        return undefined;
+    const sqlType = pgTypeToSqlType(tenantColumn.pgType);
+    const column = quoteIdent(TENANT_COLUMN);
+    // NULLIF: after a transaction-local set_config, current_setting returns '' instead of NULL.
+    const sessionTenant = `NULLIF(current_setting('${TENANT_ID_SETTING}', true), '')`;
+    const isolation = `${column} = ${sessionTenant}::${sqlType} OR current_setting('${SCOPE_SETTING}', true) = '${SYSTEM_SCOPE}'`;
+    return {
+        policies: [
+            {
+                name: TENANT_ISOLATION_POLICY,
+                command: "ALL",
+                kind: "PERMISSIVE",
+                rolesSql: "PUBLIC",
+                using: isolation,
+                withCheck: isolation,
+            },
+            {
+                name: SYSTEM_TENANT_READ_POLICY,
+                command: "SELECT",
+                kind: "PERMISSIVE",
+                rolesSql: "PUBLIC",
+                using: `${column} = '${SYSTEM_TENANT_ID}'::${sqlType} AND ${sessionTenant} IS NOT NULL`,
+            },
+        ],
+    };
+}
+export function rowLevelSecurityByTable(metas) {
+    const byTable = {};
+    for (const meta of metas) {
+        const spec = tenantRowLevelSecurityFor(meta);
+        if (spec !== undefined)
+            byTable[meta.tableName] = spec;
+    }
+    return byTable;
+}
+export function renderCreatePolicy(tableSql, policy) {
+    const using = policy.using !== undefined ? ` USING (${policy.using})` : "";
+    const withCheck = policy.withCheck !== undefined ? ` WITH CHECK (${policy.withCheck})` : "";
+    return `CREATE POLICY ${quoteIdent(policy.name)} ON ${tableSql} AS ${policy.kind} FOR ${policy.command} TO ${policy.rolesSql}${using}${withCheck};`;
+}
+function renderDropPolicy(tableSql, policyName) {
+    return `DROP POLICY IF EXISTS ${quoteIdent(policyName)} ON ${tableSql};`;
+}
+export function renderRowLevelSecurityFlags(tableSql, flags) {
+    return [
+        `ALTER TABLE ${tableSql} ${flags.enabled ? "ENABLE" : "DISABLE"} ROW LEVEL SECURITY;`,
+        `ALTER TABLE ${tableSql} ${flags.forced ? "FORCE" : "NO FORCE"} ROW LEVEL SECURITY;`,
+    ];
+}
+export function renderEnableRowLevelSecurity(tableSql, next, previous) {
+    const nextNames = new Set(next.policies.map((policy) => policy.name));
+    const vanished = (previous?.policies ?? []).filter((policy) => !nextNames.has(policy.name));
+    return [
+        ...vanished.map((policy) => renderDropPolicy(tableSql, policy.name)),
+        ...next.policies.flatMap((policy) => [
+            renderDropPolicy(tableSql, policy.name),
+            renderCreatePolicy(tableSql, policy),
+        ]),
+        ...renderRowLevelSecurityFlags(tableSql, { enabled: true, forced: true }),
+    ];
+}
+export function renderDisableRowLevelSecurity(tableSql, previous) {
+    return [
+        ...previous.policies.map((policy) => renderDropPolicy(tableSql, policy.name)),
+        ...renderRowLevelSecurityFlags(tableSql, { enabled: false, forced: false }).reverse(),
+    ];
+}
+export function renderTableRowLevelSecurityDdl(meta) {
+    const spec = tenantRowLevelSecurityFor(meta);
+    if (spec === undefined)
+        return [];
+    return renderEnableRowLevelSecurity(quoteIdent(meta.tableName), spec);
+}
+function isSamePolicy(a, b) {
+    return (a.name === b.name &&
+        a.command === b.command &&
+        a.kind === b.kind &&
+        a.rolesSql === b.rolesSql &&
+        a.using === b.using &&
+        a.withCheck === b.withCheck);
+}
+export function isSameTableRowLevelSecurity(a, b) {
+    return (a.policies.length === b.policies.length &&
+        a.policies.every((policy, index) => {
+            const other = b.policies[index];
+            return other !== undefined && isSamePolicy(policy, other);
+        }));
+}
+function isOptionalString(value) {
+    return value === undefined || typeof value === "string";
+}
+function isRowLevelSecurityPolicy(value) {
+    return (isPlainObject(value) &&
+        typeof value["name"] === "string" &&
+        typeof value["rolesSql"] === "string" &&
+        isOneOf(POLICY_COMMANDS, value["command"]) &&
+        isOneOf(POLICY_KINDS, value["kind"]) &&
+        isOptionalString(value["using"]) &&
+        isOptionalString(value["withCheck"]));
+}
+function isTableRowLevelSecurity(value) {
+    return (isPlainObject(value) &&
+        Array.isArray(value["policies"]) &&
+        value["policies"].every(isRowLevelSecurityPolicy));
+}
+export function isTableRowLevelSecurityRecord(value) {
+    return isPlainObject(value) && Object.values(value).every(isTableRowLevelSecurity);
+}

package/dist/db/replay-migration-sql.d.ts

@@ -1,13 +1,15 @@
 import type { Snapshot } from "./migrate-generator.ts";
+import { type ReplayedRowLevelSecurity } from "./replay-rls.ts";
 export type ReplayedTable = {
     readonly columns: ReadonlySet<string>;
     readonly columnsUnknown?: boolean;
+    readonly rowLevelSecurity?: ReplayedRowLevelSecurity;
 };
 export type ReplayedSchema = ReadonlyMap<string, ReplayedTable>;
 export declare function replayMigrationsDir(migrationsDir: string): ReplayedSchema;
 export type ReplayMismatch = {
     readonly tableName: string;
-    readonly kind: "missing-table" | "unexpected-table" | "column-drift";
+    readonly kind: "missing-table" | "unexpected-table" | "column-drift" | "row-level-security-drift";
     readonly detail: string;
 };
 export declare function diffReplayAgainstSnapshot(replayed: ReplayedSchema, snapshot: Snapshot): readonly ReplayMismatch[];

package/dist/db/replay-migration-sql.js

@@ -9,6 +9,7 @@
 // either. Reuses `loadMigrationsFromDir`'s statement-splitting so the replay
 // sees exactly what the real runner would execute.
 import { loadMigrationsFromDir } from "./migrate-runner.js";
+import { applyRowLevelSecurityStatement, IDENT, replayedOnlyRowLevelSecurityDrift, rowLevelSecurityDrift, TABLE_REF, } from "./replay-rls.js";
 // Migration files comment out destructive ops (DROP TABLE/COLUMN) as
 // `-- DESTRUCTIVE: <stmt>;  -- uncomment + ensure backup` so the real
 // migrate-runner never executes them unattended. For replay purposes the
@@ -48,10 +49,6 @@ function splitTopLevel(body) {
         parts.push(current);
     return parts;
 }
-// Identifiers in hand-written migrations aren't always quoted (the generator
-// always quotes, but the header explicitly invites hand-editing) — optional
-// quotes so `CREATE TABLE foo (...)` parses the same as `CREATE TABLE "foo" (...)`.
-const IDENT = `"?([^"\\s(;,.]+)"?`;
 function parseColumnNames(body) {
     const columns = new Set();
     for (const part of splitTopLevel(body)) {
@@ -197,7 +194,7 @@ function applyStatement(schema, statement, context) {
     // instead of matching only the first clause, in statement order so an
     // add-then-drop of the same column (unusual, but not impossible) resolves
     // correctly.
-    const alterTable = statement.match(new RegExp(`^ALTER TABLE\\s+${IDENT}\\s+([\\s\\S]*?);?\\s*$`, "i"));
+    const alterTable = statement.match(new RegExp(`^ALTER TABLE\\s+(?:IF EXISTS\\s+)?(?:ONLY\\s+)?${TABLE_REF}\\s+([\\s\\S]*?);?\\s*$`, "i"));
     const alterTableName = alterTable?.[1];
     const alterBody = alterTable?.[2];
     if (alterTableName !== undefined && alterBody !== undefined) {
@@ -276,10 +273,29 @@ export function replayMigrationsDir(migrationsDir) {
     for (const migration of migrations) {
         for (const statement of migration.statements) {
             applyStatement(schema, statement, { file: migration.id });
+            applyRowLevelSecurityStatement(schema, statement, { file: migration.id });
         }
     }
     return schema;
 }
+function rowLevelSecurityMismatches(replayed, snapshot) {
+    const mismatches = [];
+    const specs = snapshot.rowLevelSecurity ?? {};
+    for (const { tableName } of snapshot.tables) {
+        const table = replayed.get(tableName);
+        // skip: a missing table is already reported as missing-table
+        if (!table)
+            continue;
+        const spec = Object.hasOwn(specs, tableName) ? specs[tableName] : undefined;
+        const detail = spec === undefined
+            ? replayedOnlyRowLevelSecurityDrift(table.rowLevelSecurity)
+            : rowLevelSecurityDrift(table.rowLevelSecurity, tableName, spec);
+        if (detail !== undefined) {
+            mismatches.push({ tableName, kind: "row-level-security-drift", detail });
+        }
+    }
+    return mismatches;
+}
 // Compares what the migration files actually produce (`replayed`) against
 // what `.snapshot.json` claims (`snapshot`) — the check that would have
 // caught kumiko-studio's 0016 misgeneration (snapshot correct, SQL wrong).
@@ -314,6 +330,7 @@ export function diffReplayAgainstSnapshot(replayed, snapshot) {
             });
         }
     }
+    mismatches.push(...rowLevelSecurityMismatches(replayed, snapshot));
     for (const tableName of replayed.keys()) {
         if (!snapshotTableNames.has(tableName)) {
             mismatches.push({

package/dist/db/replay-rls.d.ts

@@ -0,0 +1,25 @@
+import { type TableRowLevelSecurity } from "./render-rls-ddl.ts";
+export type ReplayedPolicies = ReadonlyMap<string, string | undefined>;
+export type ReplayedRowLevelSecurity = {
+    readonly enabled: boolean;
+    readonly forced: boolean;
+    readonly policies: ReplayedPolicies;
+};
+export type MutableReplayedRowLevelSecurity = {
+    enabled: boolean;
+    forced: boolean;
+    policies: Map<string, string | undefined>;
+};
+type TableWithRowLevelSecurity = {
+    rowLevelSecurity?: MutableReplayedRowLevelSecurity;
+};
+export declare const IDENT = "\"?([^\"\\s(;,.]+)\"?";
+export declare const TABLE_REF = "(?:\"?public\"?\\.)?\"?([^\"\\s(;,.]+)\"?";
+type StatementContext = {
+    readonly file: string;
+};
+type ReplayTables = ReadonlyMap<string, TableWithRowLevelSecurity>;
+export declare function applyRowLevelSecurityStatement(tables: ReplayTables, statement: string, context: StatementContext): void;
+export declare function rowLevelSecurityDrift(replayed: ReplayedRowLevelSecurity | undefined, tableName: string, expected: TableRowLevelSecurity): string | undefined;
+export declare function replayedOnlyRowLevelSecurityDrift(replayed: ReplayedRowLevelSecurity | undefined): string | undefined;
+export {};

package/dist/db/replay-rls.js

@@ -0,0 +1,156 @@
+// Row level security part of the migration replay: tracks ENABLE/FORCE flags and
+// policy definitions per table so they can be compared against the snapshot.
+import { renderCreatePolicy } from "./render-rls-ddl.js";
+import { quoteIdent } from "./sql-identifier.js";
+// Identifiers in hand-written migrations aren't always quoted (the generator
+// always quotes, but the header explicitly invites hand-editing) — optional
+// quotes so `CREATE TABLE foo (...)` parses the same as `CREATE TABLE "foo" (...)`.
+export const IDENT = `"?([^"\\s(;,.]+)"?`;
+export const TABLE_REF = `(?:"?public"?\\.)?${IDENT}`;
+const ALTER_TABLE_RE = new RegExp(`^ALTER\\s+TABLE\\s+(?:IF\\s+EXISTS\\s+)?(?:ONLY\\s+)?${TABLE_REF}\\s+([\\s\\S]*?);?\\s*$`, "i");
+const FLAG_CLAUSE_RE = /\b(ENABLE|DISABLE|NO\s+FORCE|FORCE)\s+ROW\s+LEVEL\s+SECURITY\b/gi;
+const CREATE_POLICY_RE = new RegExp(`^CREATE\\s+POLICY\\s+${IDENT}\\s+ON\\s+${TABLE_REF}(?=[\\s;]|$)([\\s\\S]*)$`, "i");
+const DROP_POLICY_RE = new RegExp(`^DROP\\s+POLICY\\s+(IF\\s+EXISTS\\s+)?${IDENT}\\s+ON\\s+${TABLE_REF}(?=[\\s;]|$)`, "i");
+const ALTER_POLICY_RE = new RegExp(`^ALTER\\s+POLICY\\s+${IDENT}\\s+ON\\s+${TABLE_REF}(?=[\\s;]|$)([\\s\\S]*)$`, "i");
+const RENAME_POLICY_RE = new RegExp(`^\\s*RENAME\\s+TO\\s+${IDENT}\\s*;?\\s*$`, "i");
+const POLICY_OR_RLS_RE = /\bPOLICY\b|ROW\s+LEVEL\s+SECURITY/i;
+const ANY_POLICY_STATEMENT_RE = /^(CREATE|ALTER|DROP)\s+POLICY\b/i;
+function stateOf(table) {
+    table.rowLevelSecurity ??= {
+        enabled: false,
+        forced: false,
+        policies: new Map(),
+    };
+    return table.rowLevelSecurity;
+}
+function applyFlagClauses(table, alterBody) {
+    for (const [, clause] of alterBody.matchAll(FLAG_CLAUSE_RE)) {
+        const state = stateOf(table);
+        switch (clause?.toUpperCase().replace(/\s+/g, " ")) {
+            case "ENABLE":
+                state.enabled = true;
+                break;
+            case "DISABLE":
+                state.enabled = false;
+                break;
+            case "FORCE":
+                state.forced = true;
+                break;
+            case "NO FORCE":
+                state.forced = false;
+                break;
+        }
+    }
+}
+function normalizePolicyDefinition(text) {
+    return text.replace(/\s+/g, " ").replace(/;\s*$/, "").trim();
+}
+function applyAlterPolicy(table, policyName, alterBody) {
+    const { policies } = stateOf(table);
+    const newName = alterBody.match(RENAME_POLICY_RE)?.[1];
+    if (newName === undefined) {
+        if (policies.has(policyName))
+            policies.set(policyName, undefined);
+        // skip: body is not a rename, the altered-flag above is all that is tracked
+        return;
+    }
+    // skip: policy not tracked, nothing to rename
+    if (!policies.has(policyName))
+        return;
+    policies.set(newName, policies.get(policyName));
+    policies.delete(policyName);
+}
+function failUnparsedPolicy(statement, file) {
+    const prefix = statement.slice(0, 200).replace(/\s+/g, " ").trim();
+    throw new Error(`replayMigrationsDir: unparsed policy statement in ${file} — expected CREATE POLICY <name> ON <table>, ` +
+        `DROP POLICY [IF EXISTS] <name> ON <table> or ALTER POLICY <name> ON <table>. Statement: ${prefix}${statement.length > 200 ? "…" : ""}`);
+}
+function tryApplyAlterTable(tables, statement) {
+    const alter = statement.match(ALTER_TABLE_RE);
+    if (alter?.[1] === undefined || alter[2] === undefined)
+        return false;
+    const table = tables.get(alter[1]);
+    if (table)
+        applyFlagClauses(table, alter[2]);
+    return true;
+}
+function tryApplyCreatePolicy(tables, statement) {
+    const created = statement.match(CREATE_POLICY_RE);
+    if (created?.[1] === undefined || created[2] === undefined)
+        return false;
+    const table = tables.get(created[2]);
+    if (table) {
+        stateOf(table).policies.set(created[1], normalizePolicyDefinition(created[3] ?? ""));
+    }
+    return true;
+}
+function tryApplyDropPolicy(tables, statement, context) {
+    const dropped = statement.match(DROP_POLICY_RE);
+    if (dropped?.[2] === undefined || dropped[3] === undefined)
+        return false;
+    const table = tables.get(dropped[3]);
+    if (!table)
+        return true;
+    const removed = stateOf(table).policies.delete(dropped[2]);
+    if (!removed && dropped[1] === undefined) {
+        throw new Error(`replayMigrationsDir: ${context.file} drops policy "${dropped[2]}" on "${dropped[3]}" which no earlier migration created`);
+    }
+    return true;
+}
+function tryApplyAlterPolicy(tables, statement) {
+    const altered = statement.match(ALTER_POLICY_RE);
+    if (altered?.[1] === undefined || altered[2] === undefined || altered[3] === undefined) {
+        return false;
+    }
+    const table = tables.get(altered[2]);
+    if (table)
+        applyAlterPolicy(table, altered[1], altered[3]);
+    return true;
+}
+export function applyRowLevelSecurityStatement(tables, statement, context) {
+    if (/^DO\b/i.test(statement) && POLICY_OR_RLS_RE.test(statement)) {
+        throw new Error(`replayMigrationsDir: ${context.file} changes policies or row level security inside a DO block, which the replay cannot evaluate — write the statements at top level`);
+    }
+    const handled = tryApplyAlterTable(tables, statement) ||
+        tryApplyCreatePolicy(tables, statement) ||
+        tryApplyDropPolicy(tables, statement, context) ||
+        tryApplyAlterPolicy(tables, statement);
+    if (!handled && ANY_POLICY_STATEMENT_RE.test(statement)) {
+        failUnparsedPolicy(statement, context.file);
+    }
+}
+function expectedPolicyDefinition(tableName, policy) {
+    const rendered = renderCreatePolicy(quoteIdent(tableName), policy);
+    const definition = rendered.match(CREATE_POLICY_RE)?.[3];
+    if (definition === undefined) {
+        throw new Error(`rendered policy "${policy.name}" is not a CREATE POLICY statement`);
+    }
+    return normalizePolicyDefinition(definition);
+}
+export function rowLevelSecurityDrift(replayed, tableName, expected) {
+    const parts = [];
+    if (replayed?.enabled !== true)
+        parts.push("ROW LEVEL SECURITY is not enabled");
+    if (replayed?.forced !== true)
+        parts.push("ROW LEVEL SECURITY is not forced");
+    const actual = replayed?.policies ?? new Map();
+    const expectedNames = new Set(expected.policies.map((policy) => policy.name));
+    for (const policy of expected.policies) {
+        if (!actual.has(policy.name)) {
+            parts.push(`missing policy: ${policy.name}`);
+        }
+        else if (actual.get(policy.name) !== expectedPolicyDefinition(tableName, policy)) {
+            parts.push(`policy ${policy.name} deviates from the generated definition (hand-edited or altered)`);
+        }
+    }
+    const unexpected = [...actual.keys()].filter((name) => !expectedNames.has(name));
+    if (unexpected.length > 0)
+        parts.push(`unexpected policies: ${unexpected.join(", ")}`);
+    return parts.length > 0 ? parts.join("; ") : undefined;
+}
+export function replayedOnlyRowLevelSecurityDrift(replayed) {
+    const hasRowLevelSecurity = replayed !== undefined && (replayed.enabled || replayed.forced || replayed.policies.size > 0);
+    return hasRowLevelSecurity
+        ? "migrations enable row level security or create policies but .snapshot.json has no row level security spec for this table"
+        : undefined;
+}

package/dist/db/row-level-security-boot-check.d.ts

@@ -0,0 +1,5 @@
+import { type KnownTables } from "./known-table-names.ts";
+import type { AnyDb } from "./query.ts";
+import type { RowLevelSecurityMode } from "./render-rls-ddl.ts";
+export declare function assertRowLevelSecurityTableState(db: AnyDb, mode: RowLevelSecurityMode, knownTables: KnownTables): Promise<void>;
+export declare function assertRowLevelSecurityBootState(db: AnyDb, mode: RowLevelSecurityMode, knownTables: KnownTables): Promise<void>;

package/dist/db/row-level-security-boot-check.js

@@ -0,0 +1,85 @@
+import { InternalError } from "../errors/index.js";
+import { isLiveFrameworkTable } from "./known-table-names.js";
+import { readConnectedRoleAttributes, readTablesWithRowLevelSecurityEnabled, readTenantTablesRowLevelSecurity, } from "./queries/rls-boot-catalog.js";
+function missingPartsOf(table) {
+    return [
+        ...(table.enabled ? [] : ["ENABLE ROW LEVEL SECURITY"]),
+        ...(table.forced ? [] : ["FORCE ROW LEVEL SECURITY"]),
+        ...(table.hasIsolationPolicy ? [] : ["policy kumiko_tenant_isolation"]),
+        ...(table.hasSystemReadPolicy ? [] : ["policy kumiko_system_tenant_read"]),
+    ];
+}
+async function assertEnforcingRole(db) {
+    const role = await readConnectedRoleAttributes(db);
+    if (role === undefined) {
+        throw new InternalError({ message: "row-level security boot check: current role not found." });
+    }
+    const bypassing = [
+        ...(role.superuser ? ["SUPERUSER"] : []),
+        ...(role.bypassRowLevelSecurity ? ["BYPASSRLS"] : []),
+    ];
+    // skip: every role enforces row-level security
+    if (bypassing.length === 0)
+        return;
+    throw new InternalError({
+        message: `rowLevelSecurity is "on" but the database role "${role.roleName}" has ${bypassing.join(" and ")}, which makes Postgres skip every policy. Connect as a role with NOSUPERUSER NOBYPASSRLS.`,
+    });
+}
+function listingOf(entries) {
+    return entries.map((entry) => `${entry.table} (${entry.missing.join(", ")})`).join("; ");
+}
+async function assertAllTenantTablesProtected(db, knownTables) {
+    const incomplete = (await readTenantTablesRowLevelSecurity(db))
+        .map((table) => ({ table: table.tableName, missing: missingPartsOf(table) }))
+        .filter((entry) => entry.missing.length > 0);
+    // skip: every tenant table is protected
+    if (incomplete.length === 0)
+        return;
+    const frameworkTables = incomplete.filter((entry) => isLiveFrameworkTable(entry.table));
+    const known = incomplete.filter((entry) => !isLiveFrameworkTable(entry.table) && knownTables.has(entry.table));
+    const orphaned = incomplete.filter((entry) => !knownTables.has(entry.table));
+    const sections = [
+        ...(frameworkTables.length > 0
+            ? [
+                `framework tables without it: ${listingOf(frameworkTables)}. Run \`kumiko schema apply\`: it adds the missing policies to the framework tables (\`kumiko schema generate\` reports no changes for them).`,
+            ]
+            : []),
+        ...(known.length > 0
+            ? [
+                `tables of this app without it: ${listingOf(known)}. Run \`kumiko schema generate\` and apply the migration.`,
+            ]
+            : []),
+        ...(orphaned.length > 0
+            ? [
+                `tables no feature declares anymore: ${listingOf(orphaned)}. No feature declares them: add a migration with DROP TABLE (enable the commented \`-- DESTRUCTIVE\` DROP that \`kumiko schema generate\` emitted; see \`kumiko schema status\`).`,
+            ]
+            : []),
+    ];
+    throw new InternalError({
+        message: `rowLevelSecurity is "on" but tenant tables lack row-level security. ${sections.join(" ")}`,
+    });
+}
+async function assertNoLiveRowLevelSecurity(db) {
+    const tables = await readTablesWithRowLevelSecurityEnabled(db);
+    // skip: no live row-level security to disable
+    if (tables.length === 0)
+        return;
+    throw new InternalError({
+        message: `rowLevelSecurity is "off" but row-level security is still enabled on: ${tables.join(", ")}. Without a tenant scope every statement would see zero rows. Run \`kumiko schema generate\` with rowLevelSecurity off to produce the DISABLE ROW LEVEL SECURITY migration and apply it.`,
+    });
+}
+// Table state only, no role check: the role is a runtime property of the boot connection, so tools
+// that connect with another role (CI, `schema validate`) use this one.
+export async function assertRowLevelSecurityTableState(db, mode, knownTables) {
+    if (mode === "off") {
+        await assertNoLiveRowLevelSecurity(db);
+        // skip: off-mode check done
+        return;
+    }
+    await assertAllTenantTablesProtected(db, knownTables);
+}
+export async function assertRowLevelSecurityBootState(db, mode, knownTables) {
+    if (mode === "on")
+        await assertEnforcingRole(db);
+    await assertRowLevelSecurityTableState(db, mode, knownTables);
+}

package/dist/db/row-level-security-connection.d.ts

@@ -0,0 +1,3 @@
+import type { RowLevelSecurityMode } from "./render-rls-ddl.ts";
+export declare function rowLevelSecurityModeOf(db: unknown): RowLevelSecurityMode;
+export declare function enforceRowLevelSecurity<T extends object>(pool: T): T;