@cosmicdrift/kumiko-framework 0.388.0 → 0.390.0

package/dist/db/apply-entity-event.js

@@ -1,49 +1,3 @@
-// applyEntityEvent — the ONLY write logic for r.entity tables from
-// StoredEvents. Both callers use it:
-//
-//   - createEventStoreExecutor (live, in the write TX) passes the just-appended
-//     StoredEvent directly; sensitive fields are table ciphertext in the payload
-//     (validated at boot as pii/encrypted).
-//   - rebuildProjection via ImplicitProjection (replay, in the rebuild TX)
-//     passes the same StoredEvent; apply copies ciphertext byte-for-byte,
-//     while bidx is recalculated below.
-//
-// Live==Rebuild equivalence therefore holds by construction for ALL fields —
-// changed write logic needs to be maintained in only ONE place, with no sync
-// contract. The only legitimate divergence is crypto-shredding
-// (DEK erased → value unreadable, bidx NULL). Load-bearing test:
-// db/__tests__/implicit-projection-equivalence.integration.test.ts.
-//
-// Tenant isolation: applyEntityEvent expects an ExecutorManagedRunner (tx or pool), NOT
-// a TenantDb wrapper. Two sources keep it safe:
-//   1. The live path reads the target row through the tenant-scoped TenantDb
-//      before writing — loadById() for update/delete/forget, db.fetchOne() for
-//      restore — so the aggregateId is already tenant-validated on arrival.
-//   2. create sets tenantId explicitly from event.tenantId, never derived from
-//      the TenantDb wrapper default.
-// The missing TenantDb wrapper in this function is therefore not a hole.
-//
-// Auto-verbs:
-//   <entity>.created   → INSERT
-//   <entity>.updated   → UPDATE WHERE id=aggregateId
-//   <entity>.deleted   → soft-delete-UPDATE if entity.softDelete, otherwise hard-DELETE
-//   <entity>.restored  → undelete-UPDATE (meaningful only for softDelete)
-//   <entity>.forgotten → always hard-DELETE (Art.17 purge, including softDelete);
-//                        via executor.forget(). Rebuild replays created→forgotten
-//                        → the row is gone, making this rebuild-safe (unlike a
-//                        direct deleteMany).
-//
-// Domain events (r.defineEvent) on the same aggregate are NOT handled here —
-// they never went through the Executor in the live path and must be handled by
-// explicit r.projection-apply handlers or r.multiStreamProjection.
-// ImplicitProjection registers the auto-verbs.
-//
-// Return shape: ApplyResult with `kind` and an optional `row`.
-//   - "applied" → the write completed. `row` contains the written row for
-//     create/update/soft-delete/restore. For hard-delete, `row` is null
-//     (DELETE statements do not provide a returning row).
-//   - "skipped" → the event is not an auto-verb (a domain event on the same
-//     aggregate). Caller no-op.
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { requestContext } from "../api/request-context.js";
 import { collectLookupableFields, computeBlindIndexValues } from "../crypto/blind-index.js";
@@ -51,6 +5,8 @@ import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ER
 import { collectPiiFileReferenceFields } from "../crypto/subject-resolver.js";
 import { deleteMany, insertOne, updateMany } from "../db/query.js";
 import { InternalError } from "../errors/index.js";
+import { activeRowLevelSecurityScope, runInSystemRowLevelSecurityScope, } from "./row-level-security-scope.js";
+import { asEntityTableMeta } from "./table-introspection.js";
 const AUTO_VERBS = ["created", "updated", "deleted", "restored", "forgotten"];
 /** Parses event.type into an AutoVerb when the event is an auto-verb
  *  for the given aggregate; otherwise returns null (a domain event). */
@@ -85,7 +41,19 @@ async function decryptFileReferenceCiphertext(entity, values) {
 /** Applies an auto-event idempotently to the entity table.
  *  Called both during live append (inside the write TX) and during rebuild
  *  (inside the rebuild TX), using identical logic. */
-export async function applyEntityEvent(event, table, entity, tx) {
+// An ambient tenant scope stays, so a live write cannot land a row in another tenant (row-level security
+// rejects it). Replay, rebuild and boot seeds run without a tenant scope and global tables live on the system
+// tenant, so only those write system scoped.
+export function applyEntityEvent(event, table, entity, tx) {
+    if (keepsAmbientTenantScope(table))
+        return applyEntityEventInScope(event, table, entity, tx);
+    return runInSystemRowLevelSecurityScope("replay, rebuild and global-table projection writes carry no tenant scope of their own", () => applyEntityEventInScope(event, table, entity, tx));
+}
+function keepsAmbientTenantScope(table) {
+    return (activeRowLevelSecurityScope()?.kind === "tenant" &&
+        asEntityTableMeta(table)?.tenancy !== "global");
+}
+async function applyEntityEventInScope(event, table, entity, tx) {
     const verb = parseAutoVerb(event);
     if (verb === null)
         return { kind: "skipped" };

package/dist/db/blind-index-cleanup.js

@@ -17,41 +17,47 @@ import { toSnakeCase } from "../utils/case.js";
 import { resolveTableName } from "./entity-table-meta.js";
 import { toPostgresArrayLiteral } from "./queries/postgres-array-literal.js";
 import { executeRawQuery, executeRawQueryRead } from "./queries/raw-sql.js";
+import { runInSystemRowLevelSecurityScope } from "./row-level-security-scope.js";
 import { columnNamesOf, tableExists } from "./schema-inspection.js";
 export async function nullBlindIndexesForSubject(db, features, subjectKey) {
-    const likePattern = subjectCiphertextLikePattern(subjectKey);
-    const candidates = [];
-    for (const feature of features.values()) {
-        for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
-            const lookupable = collectLookupableFields(entity);
-            if (lookupable.length === 0)
-                continue;
-            // No featureName prefix — the dispatcher builds entity tables without
-            // one (buildEntityTable with no featureName option), the sweep has to
-            // hit the same names.
-            candidates.push({ tableName: resolveTableName(entityName, entity, undefined), lookupable });
+    return runInSystemRowLevelSecurityScope("blind index nulling for a forgotten subject spans tenants", async () => {
+        const likePattern = subjectCiphertextLikePattern(subjectKey);
+        const candidates = [];
+        for (const feature of features.values()) {
+            for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
+                const lookupable = collectLookupableFields(entity);
+                if (lookupable.length === 0)
+                    continue;
+                // No featureName prefix — the dispatcher builds entity tables without
+                // one (buildEntityTable with no featureName option), the sweep has to
+                // hit the same names.
+                candidates.push({
+                    tableName: resolveTableName(entityName, entity, undefined),
+                    lookupable,
+                });
+            }
         }
-    }
-    // Skip entities whose projection was never migrated — same class as
-    // subjectRowExistsInTenant. A throw here runs AFTER eraseKey
-    // in forget-subject and would leave deterministic bidx columns still
-    // linkable. One batched existence query instead of one
-    // roundtrip per entity.
-    const existing = await existingTableNames(db, candidates.map((c) => c.tableName));
-    for (const { tableName, lookupable } of candidates) {
-        if (!existing.has(tableName))
-            continue;
-        // Same hazard for a migrated table that predates a later-added
-        // lookupable field: skip fields whose columns are missing instead of
-        // aborting the sweep for the remaining ones.
-        const columns = await columnNamesOf(db, tableName);
-        for (const fieldName of lookupable) {
-            const snake = toSnakeCase(fieldName);
-            if (!columns.has(snake) || !columns.has(`${snake}_bidx`))
+        // Skip entities whose projection was never migrated — same class as
+        // subjectRowExistsInTenant. A throw here runs AFTER eraseKey
+        // in forget-subject and would leave deterministic bidx columns still
+        // linkable. One batched existence query instead of one
+        // roundtrip per entity.
+        const existing = await existingTableNames(db, candidates.map((c) => c.tableName));
+        for (const { tableName, lookupable } of candidates) {
+            if (!existing.has(tableName))
                 continue;
-            await executeRawQuery(db, `UPDATE ${quoteIdent(tableName)} SET ${quoteIdent(`${snake}_bidx`)} = NULL WHERE ${quoteIdent(snake)} LIKE $1`, [likePattern]);
+            // Same hazard for a migrated table that predates a later-added
+            // lookupable field: skip fields whose columns are missing instead of
+            // aborting the sweep for the remaining ones.
+            const columns = await columnNamesOf(db, tableName);
+            for (const fieldName of lookupable) {
+                const snake = toSnakeCase(fieldName);
+                if (!columns.has(snake) || !columns.has(`${snake}_bidx`))
+                    continue;
+                await executeRawQuery(db, `UPDATE ${quoteIdent(tableName)} SET ${quoteIdent(`${snake}_bidx`)} = NULL WHERE ${quoteIdent(snake)} LIKE $1`, [likePattern]);
+            }
         }
-    }
+    });
 }
 async function existingTableNames(db, tableNames) {
     if (tableNames.length === 0)
@@ -75,37 +81,39 @@ async function existingTableNames(db, tableNames) {
 // (`aggregate_id = subjectId` under the actor tenant) when apps need
 // client-supplied ids.
 export async function subjectRowExistsInTenant(db, features, subjectId, tenantId) {
-    // Prefetch which self-PII projection tables actually exist — probing a
-    // missing relation used to throw (and get swallowed), which both hid
-    // real schema bugs and risked poisoning the driver connection for the
-    // rest of the forget TX.
-    const candidateTables = [];
-    for (const feature of features.values()) {
-        for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
-            const hasSelfPiiField = Object.values(entity.fields).some(isSelfPiiField);
-            if (!hasSelfPiiField)
-                continue;
-            // Subject ids are uuids; comparing one to a serial id column makes
-            // postgres throw (invalid input syntax for integer) mid forget-TX.
-            if (entity.idType === "serial")
+    return runInSystemRowLevelSecurityScope("subject existence check spans tenants", async () => {
+        // Prefetch which self-PII projection tables actually exist — probing a
+        // missing relation used to throw (and get swallowed), which both hid
+        // real schema bugs and risked poisoning the driver connection for the
+        // rest of the forget TX.
+        const candidateTables = [];
+        for (const feature of features.values()) {
+            for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
+                const hasSelfPiiField = Object.values(entity.fields).some(isSelfPiiField);
+                if (!hasSelfPiiField)
+                    continue;
+                // Subject ids are uuids; comparing one to a serial id column makes
+                // postgres throw (invalid input syntax for integer) mid forget-TX.
+                if (entity.idType === "serial")
+                    continue;
+                candidateTables.push(resolveTableName(entityName, entity, undefined));
+            }
+        }
+        const existing = new Set();
+        for (const tableName of candidateTables) {
+            const rows = await executeRawQueryRead(db, `SELECT to_regclass(quote_ident($1)) IS NOT NULL AS exists`, [tableName]);
+            if (rows[0]?.exists === true)
+                existing.add(tableName);
+        }
+        for (const tableName of candidateTables) {
+            if (!existing.has(tableName))
                 continue;
-            candidateTables.push(resolveTableName(entityName, entity, undefined));
+            const rows = await executeRawQueryRead(db, `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`, [subjectId, tenantId]);
+            if (rows.length > 0)
+                return true;
         }
-    }
-    const existing = new Set();
-    for (const tableName of candidateTables) {
-        const rows = await executeRawQueryRead(db, `SELECT to_regclass(quote_ident($1)) IS NOT NULL AS exists`, [tableName]);
-        if (rows[0]?.exists === true)
-            existing.add(tableName);
-    }
-    for (const tableName of candidateTables) {
-        if (!existing.has(tableName))
-            continue;
-        const rows = await executeRawQueryRead(db, `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`, [subjectId, tenantId]);
-        if (rows.length > 0)
-            return true;
-    }
-    return false;
+        return false;
+    });
 }
 function findEntityByExactName(features, entityName) {
     for (const feature of features.values()) {
@@ -123,14 +131,16 @@ function findEntityByExactName(features, entityName) {
 // table (globally unique, unspoofable via a client-supplied explicitId
 // at create) — a composite PK or shared table would break this.
 export async function recordRowExistsInTenant(db, features, entityName, recordId, tenantId) {
-    const entity = findEntityByExactName(features, entityName);
-    if (!entity)
-        return false;
-    const tableName = resolveTableName(entityName, entity, undefined);
-    if (!(await tableExists(db, tableName)))
-        return false;
-    const rows = await executeRawQueryRead(db, `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`, [recordId, tenantId]);
-    return rows.length > 0;
+    return runInSystemRowLevelSecurityScope("record existence check spans tenants", async () => {
+        const entity = findEntityByExactName(features, entityName);
+        if (!entity)
+            return false;
+        const tableName = resolveTableName(entityName, entity, undefined);
+        if (!(await tableExists(db, tableName)))
+            return false;
+        const rows = await executeRawQueryRead(db, `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`, [recordId, tenantId]);
+        return rows.length > 0;
+    });
 }
 // Provenance fallback for record subjects whose projection row is gone (hard
 // delete) or that have no registered entity at all (custom aggregates): the
@@ -138,20 +148,24 @@ export async function recordRowExistsInTenant(db, features, entityName, recordId
 // and the subject key is global, so another tenant could open a stream under
 // the same aggregate id; any foreign event voids the proof.
 export async function recordEventsOwnedExclusivelyByTenant(db, aggregateType, aggregateId, tenantId) {
-    const rows = await executeRawQueryRead(db, `SELECT 1 FROM "kumiko_events" WHERE aggregate_type = $1 AND aggregate_id = $2::uuid AND tenant_id = $3::uuid
+    return runInSystemRowLevelSecurityScope("record event ownership check spans tenants", async () => {
+        const rows = await executeRawQueryRead(db, `SELECT 1 FROM "kumiko_events" WHERE aggregate_type = $1 AND aggregate_id = $2::uuid AND tenant_id = $3::uuid
        AND NOT EXISTS (SELECT 1 FROM "kumiko_events" WHERE aggregate_type = $1 AND aggregate_id = $2::uuid AND tenant_id <> $3::uuid)
      LIMIT 1`, [aggregateType, aggregateId, tenantId]);
-    return rows.length > 0;
+        return rows.length > 0;
+    });
 }
 // Owning tenant of a record subject's row, for callers that must evaluate
 // tenant-scoped policy for the row's real owner (not the acting user's tenant).
 export async function recordRowOwningTenantId(db, features, entityName, recordId) {
-    const entity = findEntityByExactName(features, entityName);
-    if (!entity)
-        return undefined;
-    const tableName = resolveTableName(entityName, entity, undefined);
-    if (!(await tableExists(db, tableName)))
-        return undefined;
-    const rows = await executeRawQueryRead(db, `SELECT tenant_id FROM ${quoteIdent(tableName)} WHERE id = $1 LIMIT 1`, [recordId]);
-    return rows[0]?.tenant_id;
+    return runInSystemRowLevelSecurityScope("record owner lookup spans tenants", async () => {
+        const entity = findEntityByExactName(features, entityName);
+        if (!entity)
+            return undefined;
+        const tableName = resolveTableName(entityName, entity, undefined);
+        if (!(await tableExists(db, tableName)))
+            return undefined;
+        const rows = await executeRawQueryRead(db, `SELECT tenant_id FROM ${quoteIdent(tableName)} WHERE id = $1 LIMIT 1`, [recordId]);
+        return rows[0]?.tenant_id;
+    });
 }

package/dist/db/closed-connection.js

@@ -5,7 +5,7 @@ import { extractPgError } from "./pg-error.js";
 // A pool can briefly keep handing out connections the server just closed.
 // Each failed attempt discards one, so retries are bounded by pool size.
 const CLOSED_CONNECTION_CODES = new Set([
-    "CONNECTION_CLOSED", // postgres-js
+    "ERR_POSTGRES_CONNECTION_CLOSED", // Bun.SQL
     "57P01", // PG SQLSTATE: admin_shutdown / terminated backend
 ]);
 export function isClosedConnectionError(err) {
@@ -21,40 +21,33 @@ export function isPooledClient(raw) {
         typeof propertyOf(raw, "savepoint") !== "function" &&
         typeof propertyOf(raw, "release") !== "function");
 }
-const closedConnectionLog = createFallbackLogger("postgres-js");
-// The driver rejects in-flight queries with this AbortError (no code) when the
-// pool closes under them, so isClosedConnectionError can't see it.
-const DRIVER_CLOSED_ABORT_MESSAGE = "The connection was closed.";
-function isDriverClosedAbort(err) {
-    return (err instanceof Error && err.name === "AbortError" && err.message === DRIVER_CLOSED_ABORT_MESSAGE);
-}
+const closedConnectionLog = createFallbackLogger("bun-sql");
 function isHandleLike(raw) {
     return raw !== null && (typeof raw === "object" || typeof raw === "function");
 }
-// postgres-js pool and tx handles both carry `typed`.
+// Bun.SQL pool and tx handles both carry `flush`.
 function driverOf(raw) {
     if (!isHandleLike(raw))
         return "unknown";
-    if (typeof raw["typed"] === "function")
-        return "postgres-js";
+    if (typeof raw["flush"] === "function")
+        return "bun-sql";
     return "unknown";
 }
 function positiveNumber(v) {
     return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined;
 }
-// postgres-js configures timeouts in seconds.
+// Bun.SQL reports its timeout options in milliseconds.
 function timeoutOptionMs(options, driver, optionName) {
-    if (driver !== "postgres-js")
+    if (driver !== "bun-sql")
         return undefined;
-    const seconds = positiveNumber(options[optionName]);
-    return seconds === undefined ? undefined : seconds * 1000;
+    return positiveNumber(options[optionName]);
 }
 function errorProp(err, name) {
     return isHandleLike(err) ? err[name] : undefined;
 }
 // Deliberately excludes SQL text and parameters: app SQL can carry PII.
 export function describeClosedConnectionFailure(raw, err, attempts) {
-    if (!isClosedConnectionError(err) && !isDriverClosedAbort(err))
+    if (!isClosedConnectionError(err))
         return undefined;
     const driver = driverOf(raw);
     const rawOptions = isHandleLike(raw) ? raw["options"] : undefined;
@@ -64,9 +57,9 @@ export function describeClosedConnectionFailure(raw, err, attempts) {
         pooled: isPooledClient(raw),
         attempts,
         poolMax: positiveNumber(options["max"]),
-        idleTimeoutMs: timeoutOptionMs(options, driver, "idle_timeout"),
-        maxLifetimeMs: timeoutOptionMs(options, driver, "max_lifetime"),
-        connectionTimeoutMs: timeoutOptionMs(options, driver, "connect_timeout"),
+        idleTimeoutMs: timeoutOptionMs(options, driver, "idleTimeout"),
+        maxLifetimeMs: timeoutOptionMs(options, driver, "maxLifetime"),
+        connectionTimeoutMs: timeoutOptionMs(options, driver, "connectionTimeout"),
         errorName: errorProp(err, "name"),
         errorCode: extractPgError(err)?.code ?? errorProp(err, "code"),
         errorErrno: errorProp(err, "errno"),

package/dist/db/collect-table-metas.js

@@ -1,7 +1,7 @@
 // Canonical table source for both `kumiko schema generate` and setupTestStack
 // (entities, storeTables, projections, multiStreamProjections). One shared
 // source so the test-DB push and migrations cannot drift apart again.
-import { compareByCodepoint } from "../utils/index.js";
+import { compareByCodepoint } from "../utils/compare.js";
 import { assertBackingTableSuperset, deriveEntityTableMeta, } from "./entity-table-meta.js";
 import { enumerateFeatureTableSources } from "./feature-table-sources.js";
 import { asEntityTableMeta } from "./query.js";

package/dist/db/compound-types.d.ts

@@ -1,4 +1,4 @@
-import type { EntityDefinition } from "../engine/types/index.ts";
+import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 /**
  * API-Form (combined) → DB-Form (flat). Wird vor jedem Insert/Update aufgerufen.
  */

package/dist/db/compound-types.js

@@ -1,10 +1,3 @@
-// Compound-type pipeline for the executor.
-//
-// A compound type is a field represented by ONE API object and MULTIPLE
-// DB columns. Examples:
-//   - locatedTimestamp: { at, tz, utc } ↔ <name>Utc + <name>Tz
-//   - money: { amount, currency } ↔ <name> + <name>Currency
-//   - (upcoming) address: { street, zip, city } ↔ <name>Street + <name>Zip + <name>City
 //
 // Instead of nesting every helper in the executor at four different points,
 // this function pipelines all compound-type conversions in one pass. Adding

package/dist/db/config-seed.d.ts

@@ -1,5 +1,6 @@
+import type { ConfigSeedDef } from "@cosmicdrift/kumiko-types/config";
 import type { EntityDefinition } from "../engine/index.ts";
-import type { ConfigSeedDef, Registry } from "../engine/types/index.ts";
+import type { Registry } from "../engine/types/index.ts";
 import type { EnvelopeCipher } from "../secrets/envelope-cipher.ts";
 import type { DbConnection } from "./connection.ts";
 import type { EntityTable } from "./table-builder.ts";

package/dist/db/config-seed.js

@@ -24,7 +24,12 @@ export async function seedConfigValues(seeds, table, entity, registry, db, ciphe
         return { created, skipped };
     const systemUser = createSystemUser(SYSTEM_TENANT_ID);
     const executor = createEventStoreExecutor(table, entity, { entityName: "config-value" });
-    const tdb = createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+    const tdb = createTenantDb({
+        db,
+        tenantId: SYSTEM_TENANT_ID,
+        mode: "system",
+        reason: "config seeds are system-tenant defaults",
+    });
     for (const seed of seeds) {
         const keyDef = registry.getConfigKey(seed.key);
         if (!keyDef) {

package/dist/db/connection.d.ts

@@ -1,24 +1,25 @@
-import type { DbConnection, PgClient } from "@cosmicdrift/kumiko-types/db-connection";
-import postgres from "postgres";
+import type { DbConnection, PgClient, PgListenClient } from "@cosmicdrift/kumiko-types/db-connection";
+import { type RowLevelSecurityMode } from "./render-rls-ddl.ts";
 export type * from "@cosmicdrift/kumiko-types/db-connection";
-type PostgresDriverOptions = NonNullable<Parameters<typeof postgres>[1]>;
+type BunSqlOptions = Bun.SQL.PostgresOrMySQLOptions;
 export type DbConnectionOptions = {
     readonly maxConnections?: number;
     readonly idleTimeoutSeconds?: number;
     readonly connectTimeoutSeconds?: number;
     readonly closeTimeoutSeconds?: number;
-    readonly ssl?: PostgresDriverOptions["ssl"];
-    readonly onNotice?: (notice: postgres.Notice) => void;
+    readonly ssl?: BunSqlOptions["tls"];
     readonly statementTimeoutMs?: number;
     readonly idleInTransactionSessionTimeoutMs?: number;
     readonly lockTimeoutMs?: number;
 };
 export type CreateDbConnectionOptions = DbConnectionOptions & {
     readonly url: string;
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
 };
 export type DbConnectionHandle = {
     db: DbConnection;
     client: PgClient;
+    listenClient: PgListenClient;
     close: () => Promise<void>;
 };
 export declare const DEFAULT_DB_CLOSE_TIMEOUT_SECONDS = 5;
@@ -27,7 +28,7 @@ export type UnboundedSiblingPool = {
     readonly close: (timeoutSeconds: number) => Promise<void>;
 };
 export declare function openUnboundedSiblingPool(db: unknown): UnboundedSiblingPool | undefined;
-export declare function createDbConnection({ url, ...options }: CreateDbConnectionOptions): DbConnectionHandle;
+export declare function createDbConnection({ url, rowLevelSecurity, ...options }: CreateDbConnectionOptions): DbConnectionHandle;
 export declare function dbConnectionOptionsFromEnv(env?: Readonly<Record<string, string | undefined>>): DbConnectionOptions;
 export declare const DEFAULT_SERVER_STATEMENT_TIMEOUT_MS = 60000;
 export declare const DEFAULT_SERVER_IDLE_IN_TRANSACTION_TIMEOUT_MS = 300000;

package/dist/db/connection.js

@@ -1,7 +1,8 @@
-import postgres from "postgres";
 import { readPositiveIntEnv } from "../utils/env-parse.js";
+import { DEFAULT_ROW_LEVEL_SECURITY_MODE } from "./render-rls-ddl.js";
+import { enforceRowLevelSecurity } from "./row-level-security-connection.js";
 // A DB outage can leave an in-flight query referenced on a dead connection,
-// so a plain end() (no timeout = wait for queries to finish) hangs forever —
+// so a plain close() (no timeout = wait for queries to finish) hangs forever —
 // close() must always bound how long shutdown waits.
 export const DEFAULT_DB_CLOSE_TIMEOUT_SECONDS = 5;
 // Keyed by the pool so withoutStatementTimeout can open a sibling with identical connect options.
@@ -11,20 +12,28 @@ export function openUnboundedSiblingPool(db) {
         return undefined;
     return unboundedSiblingFactories.get(db)?.();
 }
-export function createDbConnection({ url, ...options }) {
-    const pgOptions = {};
+// Bun.SQL treats `true` and a TLS object without rejectUnauthorized as sslmode=require, which
+// skips certificate checks; postgres-js verified in both cases, so keep that unless turned off.
+function verifiedTls(ssl) {
+    if (ssl === true)
+        return "verify-full";
+    if (typeof ssl === "object" && !(ssl instanceof Blob) && ssl.rejectUnauthorized === undefined) {
+        return { ...ssl, rejectUnauthorized: true };
+    }
+    return ssl;
+}
+export function createDbConnection({ url, rowLevelSecurity = DEFAULT_ROW_LEVEL_SECURITY_MODE, ...options }) {
+    const sqlOptions = {};
     if (options.maxConnections !== undefined)
-        pgOptions.max = options.maxConnections;
+        sqlOptions.max = options.maxConnections;
     if (options.idleTimeoutSeconds !== undefined) {
-        pgOptions.idle_timeout = options.idleTimeoutSeconds;
+        sqlOptions.idleTimeout = options.idleTimeoutSeconds;
     }
     if (options.connectTimeoutSeconds !== undefined) {
-        pgOptions.connect_timeout = options.connectTimeoutSeconds;
+        sqlOptions.connectionTimeout = options.connectTimeoutSeconds;
     }
     if (options.ssl !== undefined)
-        pgOptions.ssl = options.ssl;
-    if (options.onNotice !== undefined)
-        pgOptions.onnotice = options.onNotice;
+        sqlOptions.tls = verifiedTls(options.ssl);
     const serverParameters = {};
     if (options.statementTimeoutMs !== undefined) {
         serverParameters["statement_timeout"] = options.statementTimeoutMs;
@@ -36,48 +45,58 @@ export function createDbConnection({ url, ...options }) {
     if (options.lockTimeoutMs !== undefined)
         serverParameters["lock_timeout"] = options.lockTimeoutMs;
     if (Object.keys(serverParameters).length > 0)
-        pgOptions.connection = serverParameters;
-    const client = postgres(url, pgOptions);
+        sqlOptions.connection = serverParameters;
+    // Bun.SQL opens all `max` connections on the first query, so a pool always costs `max` backends.
+    const rawClient = new Bun.SQL(url, sqlOptions);
+    const enforced = rowLevelSecurity === "on";
+    const client = enforced ? enforceRowLevelSecurity(rawClient) : rawClient;
     // A run that never settles (a caller gave up on it via its own timeout) never reaches the
     // sibling's own close; close() ends it so shutdown and DROP DATABASE are not blocked by it.
     const openSiblings = new Set();
-    unboundedSiblingFactories.set(client, () => {
+    const registerFactory = (factory) => {
+        unboundedSiblingFactories.set(rawClient, factory);
+        if (client !== rawClient)
+            unboundedSiblingFactories.set(client, factory);
+    };
+    registerFactory(() => {
         // Two connections are enough for lock-in-tx plus DDL; the cap keeps parallel rebuilds from exhausting max_connections.
-        const sibling = postgres(url, {
-            ...pgOptions,
+        const sibling = new Bun.SQL(url, {
+            ...sqlOptions,
             max: 4,
-            connection: { ...pgOptions.connection, statement_timeout: 0 },
+            connection: { ...sqlOptions.connection, statement_timeout: 0 },
         });
         openSiblings.add(sibling);
         return {
-            client: sibling,
+            client: enforced ? enforceRowLevelSecurity(sibling) : sibling,
             close: async (timeoutSeconds) => {
                 openSiblings.delete(sibling);
-                await sibling.end({ timeout: timeoutSeconds });
+                await sibling.close({ timeout: timeoutSeconds });
             },
         };
     });
     return {
         db: client,
         client,
+        listenClient: client,
         close: async () => {
             const timeout = options.closeTimeoutSeconds ?? DEFAULT_DB_CLOSE_TIMEOUT_SECONDS;
+            unboundedSiblingFactories.delete(rawClient);
             unboundedSiblingFactories.delete(client);
-            const pools = [client, ...openSiblings];
+            const pools = [rawClient, ...openSiblings];
             openSiblings.clear();
-            const results = await Promise.allSettled(pools.map((pool) => pool.end({ timeout })));
+            const results = await Promise.allSettled(pools.map((pool) => pool.close({ timeout })));
             const failure = results.find((result) => result.status === "rejected");
             if (failure !== undefined)
                 throw failure.reason;
         },
     };
 }
-// DB_PROVIDER=bun selected the removed Bun.SQL driver; ignoring it would boot
-// postgres-js under a config that still claims Bun.SQL.
+// DB_PROVIDER once selected between drivers; a config that still sets it is stale,
+// so fail loudly instead of silently ignoring it.
 function assertNoRemovedDbProvider(env) {
     const provider = env["DB_PROVIDER"];
-    if (provider !== undefined && provider !== "" && provider !== "postgres") {
-        throw new Error(`DB_PROVIDER="${provider}" is no longer supported: postgres-js is the only driver. Remove DB_PROVIDER from the environment.`);
+    if (provider !== undefined && provider !== "") {
+        throw new Error(`DB_PROVIDER="${provider}" is no longer supported: Bun.SQL is the only driver. Remove DB_PROVIDER from the environment.`);
     }
 }
 export function dbConnectionOptionsFromEnv(env = process.env) {

package/dist/db/cross-tenant-reads.d.ts

@@ -1,5 +1,5 @@
+import type { EscapeHatchReporter } from "@cosmicdrift/kumiko-types/handlers";
 import type { CrossTenantReads } from "@cosmicdrift/kumiko-types/tenant-db-types";
-import type { EscapeHatchReporter } from "../engine/types/index.ts";
 import { type CreateTenantDbOptions, type TenantDb } from "./tenant-db.ts";
 export declare function createCrossTenantReads(systemModeDb: TenantDb, reason: string, report: EscapeHatchReporter): CrossTenantReads;
 export declare function createHandlerCrossTenantReads(options: Omit<CreateTenantDbOptions, "mode"> & {

package/dist/db/cross-tenant-reads.js

@@ -18,6 +18,6 @@ export function createCrossTenantReads(systemModeDb, reason, report) {
 // Own system-mode TenantDb without unsafeRaw/globalWrites: the handler gets the read surface only.
 export function createHandlerCrossTenantReads(options) {
     const { reason, report, ...dbOptions } = options;
-    const systemModeDb = createTenantDb({ ...dbOptions, mode: "system" });
+    const systemModeDb = createTenantDb({ ...dbOptions, mode: "system", reason });
     return createCrossTenantReads(systemModeDb, reason, report);
 }

package/dist/db/dialect.d.ts

@@ -4,7 +4,6 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { PgType } from "./entity-table-meta.ts";
 export type { ColumnHandle, SchemaTable } from "@cosmicdrift/kumiko-types/schema-table-types";
 export type TableColumns<_T = unknown> = SchemaTable;
-export type SelectQuery = unknown;
 export declare function pgTypeToSqlType(pgType: PgType): string;
 type ColumnFinal = {
     readonly sqlName: string;
@@ -46,10 +45,6 @@ export declare function timestamp(name: string, _opts?: {
     withTimezone?: boolean;
     mode?: "string" | "date";
 }): ColumnBuilder<Temporal.Instant | string>;
-export declare function numeric(name: string, _opts?: {
-    precision?: number;
-    scale?: number;
-}): ColumnBuilder<string>;
 export declare function instant(name: string, opts?: {
     precision?: 0 | 1 | 2 | 3 | 4 | 5 | 6;
 }): ColumnBuilder<Temporal.Instant>;

package/dist/db/dialect.js

@@ -180,9 +180,6 @@ export function timestamp(name, _opts) {
 }
 // numeric → text (we don't currently use Decimal); kept for compat with
 // legacy schema imports that won't actually instantiate at runtime.
-export function numeric(name, _opts) {
-    return buildColumn(name, "text");
-}
 export function instant(name, opts) {
     const pgType = opts?.precision === 3 ? "timestamptz(3)" : "timestamptz";
     return buildColumn(name, pgType);