@cosmicdrift/kumiko-framework 0.389.0 → 0.390.0

package/dist/db/queries/test-stack.js

@@ -1,4 +1,6 @@
+import { extractPgError } from "../pg-error.js";
 import { asRawClient } from "../query.js";
+import { PROJECTION_REBUILD_SCHEMA } from "./shadow-swap.js";
 import { quoteTableIdent } from "./table-ops.js";
 // Re-exported for back-compat — the generic DDL helpers moved to ./ddl so
 // the prod-boot path (db/table-push.ts, pipeline/event-consumer-state.ts)
@@ -12,9 +14,88 @@ export async function databaseExists(db, dbName) {
     const rows = await asRawClient(db).unsafe(`SELECT EXISTS (SELECT 1 FROM pg_database WHERE datname = $1) AS exists`, [dbName]);
     return rows[0]?.exists === true;
 }
-export async function createDatabase(db, dbName, templateDbName) {
+export async function createDatabase(db, dbName, templateDbName, owner) {
     const template = templateDbName === undefined ? "" : ` TEMPLATE ${quoteTableIdent(templateDbName)}`;
-    await asRawClient(db).unsafe(`CREATE DATABASE ${quoteTableIdent(dbName)}${template}`);
+    const ownerClause = owner === undefined ? "" : ` OWNER ${quoteTableIdent(owner)}`;
+    await asRawClient(db).unsafe(`CREATE DATABASE ${quoteTableIdent(dbName)}${template}${ownerClause}`);
+}
+const DUPLICATE_OBJECT = "42710";
+const UNIQUE_VIOLATION = "23505";
+const INTERNAL_ERROR = "XX000";
+const MAX_CAUSE_DEPTH = 8;
+// XX000 is Postgres' generic internal error; only the concurrent catalog update counts as a lost race.
+// The driver error carrying the message may sit below a wrapper, as for the SQLSTATE.
+function messageInCauseChain(error, needle) {
+    let current = error;
+    for (let depth = 0; depth < MAX_CAUSE_DEPTH && current instanceof Error; depth++) {
+        if (current.message.includes(needle))
+            return true;
+        current = current.cause;
+    }
+    return false;
+}
+function isLostRoleRace(error) {
+    const pgError = extractPgError(error);
+    if (pgError?.code === DUPLICATE_OBJECT || pgError?.code === UNIQUE_VIOLATION)
+        return true;
+    return (pgError?.code === INTERNAL_ERROR && messageInCauseChain(error, "tuple concurrently updated"));
+}
+// Parallel workers race on CREATE ROLE and ALTER ROLE; losing either race means the role has the
+// attributes and password this call wanted, which is the goal.
+export async function createApplicationRole(admin, role, password) {
+    const raw = asRawClient(admin);
+    const existing = await raw.unsafe(`SELECT 1 FROM pg_roles WHERE rolname = $1`, [role]);
+    const attributes = `LOGIN NOSUPERUSER NOBYPASSRLS PASSWORD ${quoteLiteral(password)}`;
+    // An earlier run may have created the role with another password, so an existing role is realigned.
+    const statement = existing.length > 0
+        ? `ALTER ROLE ${quoteTableIdent(role)} ${attributes}`
+        : `CREATE ROLE ${quoteTableIdent(role)} ${attributes}`;
+    try {
+        await raw.unsafe(statement);
+    }
+    catch (error) {
+        if (!isLostRoleRace(error))
+            throw error;
+    }
+}
+function quoteLiteral(value) {
+    return `'${value.replace(/'/g, "''")}'`;
+}
+export async function transferDatabaseOwnership(admin, dbName, owner) {
+    await asRawClient(admin).unsafe(`ALTER DATABASE ${quoteTableIdent(dbName)} OWNER TO ${quoteTableIdent(owner)}`);
+}
+const OWNED_SCHEMA_PUBLIC = "public";
+const OWNED_RELATION_KINDS = {
+    r: "TABLE",
+    p: "TABLE",
+    S: "SEQUENCE",
+    v: "VIEW",
+    m: "MATERIALIZED VIEW",
+};
+// Run on a connection to the database itself. REASSIGN OWNED fails for a bootstrap superuser, so owners move per relation.
+// The rebuild schema is included: a persistent database that already rebuilt as superuser would otherwise refuse the
+// application role's next rebuild for lack of CREATE on it.
+export async function transferPublicSchemaOwnership(db, owner) {
+    const raw = asRawClient(db);
+    const ownedSchemas = [OWNED_SCHEMA_PUBLIC, PROJECTION_REBUILD_SCHEMA];
+    const rebuildSchema = await raw.unsafe(`SELECT 1 FROM pg_namespace WHERE nspname = $1`, [
+        PROJECTION_REBUILD_SCHEMA,
+    ]);
+    if (rebuildSchema.length > 0) {
+        await raw.unsafe(`ALTER SCHEMA ${quoteTableIdent(PROJECTION_REBUILD_SCHEMA)} OWNER TO ${quoteTableIdent(owner)}`);
+    }
+    const relations = await raw.unsafe(`SELECT n.nspname, c.relname, c.relkind::text AS relkind
+       FROM pg_class c
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+       JOIN pg_roles r ON r.oid = c.relowner
+      WHERE n.nspname = ANY($2::text[]) AND c.relkind IN ('r', 'p', 'S', 'v', 'm') AND r.rolname <> $1
+        AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = c.oid AND d.deptype IN ('a', 'i'))`, [owner, ownedSchemas]);
+    for (const { nspname, relname, relkind } of relations) {
+        const kind = OWNED_RELATION_KINDS[relkind];
+        if (kind === undefined)
+            continue;
+        await raw.unsafe(`ALTER ${kind} ${quoteTableIdent(nspname)}.${quoteTableIdent(relname)} OWNER TO ${quoteTableIdent(owner)}`);
+    }
 }
 export async function renameDatabase(db, fromName, toName) {
     await asRawClient(db).unsafe(`ALTER DATABASE ${quoteTableIdent(fromName)} RENAME TO ${quoteTableIdent(toName)}`);

package/dist/db/query.js

@@ -24,6 +24,7 @@ import { executorManagedWriteDenied } from "./executor-managed-tables.js";
 import { extractPgError } from "./pg-error.js";
 import { extractTableInfo } from "./table-info.js";
 import { asEntityTableMeta, requireEntityTableMeta } from "./table-introspection.js";
+import { openSerializedSavepoint } from "./transaction-serialization.js";
 import { buildWhereClause } from "./where-clause.js";
 // table() (dialect) stores the canonical, shadow-proof EntityTableMeta under
 // `Symbol.for("kumiko:schema:Meta")`. The column handles on the table object are
@@ -33,7 +34,10 @@ import { buildWhereClause } from "./where-clause.js";
 export { asEntityTableMeta, requireEntityTableMeta };
 export function hasBegin(client) {
     // Tx/savepoint handles can keep a begin() that throws; only savepoint() tells them apart from a pool.
-    return typeof client.begin === "function" && typeof client.savepoint !== "function";
+    return typeof client.begin === "function" && !hasSavepoint(client);
+}
+function hasSavepoint(client) {
+    return typeof client.savepoint === "function";
 }
 function isRawClient(value) {
     return typeof propertyOf(value, "unsafe") === "function";
@@ -71,10 +75,10 @@ function savepointRunnerOf(sp) {
 }
 export async function runInSavepoint(tx, fn) {
     const raw = asRawClient(tx);
-    if (typeof raw.savepoint !== "function") {
+    if (!hasSavepoint(raw)) {
         throw new Error("runInSavepoint: transaction handle has no savepoint() — pass the driver tx (Bun.SQL TransactionSQL).");
     }
-    return raw.savepoint((sp) => fn(savepointRunnerOf(sp)));
+    return openSerializedSavepoint(raw, (sp) => fn(savepointRunnerOf(sp)));
 }
 // Same error-confinement as runInSavepoint, but for call sites that don't
 // know whether `db` is a bare pool connection or an active transaction
@@ -99,12 +103,12 @@ function isSavepointOnDeadTransactionCode(code) {
 }
 export async function runInSavepointIfSupported(db, fn) {
     const raw = asRawClient(db);
-    if (typeof raw.savepoint !== "function")
+    if (!hasSavepoint(raw))
         return fn(savepointRunnerOf(db));
     // An error from inside fn must never be remapped, even if it carries a closed-connection code.
     let fnStarted = false;
     try {
-        return await raw.savepoint((sp) => {
+        return await openSerializedSavepoint(raw, (sp) => {
             fnStarted = true;
             return fn(savepointRunnerOf(sp));
         });
@@ -117,11 +121,11 @@ export async function runInSavepointIfSupported(db, fn) {
                     ? "runInSavepointIfSupported: the transaction handle's connection is gone — the transaction " +
                         "already committed (almost always database work in an afterCommit hook) or the connection dropped. " +
                         "afterCommit is the default phase of r.hook/postSave/postDelete. Use HookPhases.inTransaction " +
-                        "for writes that must roll back with the trigger, or ctx.dbOutsideTransaction for work that must survive a rollback."
+                        "for writes that must roll back with the trigger, or ctx.db.outsideTransaction for work that must survive a rollback."
                     : "runInSavepointIfSupported: savepoint on a transaction that has already committed — " +
                         "this is almost always database work in an afterCommit hook. afterCommit is the default " +
                         "phase of r.hook/postSave/postDelete. Use HookPhases.inTransaction for writes that must " +
-                        "roll back with the trigger, or ctx.dbOutsideTransaction for work that must survive a rollback.",
+                        "roll back with the trigger, or ctx.db.outsideTransaction for work that must survive a rollback.",
                 cause: e instanceof Error ? e : undefined,
             });
         }

package/dist/db/reference-data.d.ts

@@ -1,5 +1,5 @@
+import type { ReferenceDataDef } from "@cosmicdrift/kumiko-types/config";
 import type { Registry } from "../engine/index.ts";
-import type { ReferenceDataDef } from "../engine/types/index.ts";
 import type { DbConnection } from "./connection.ts";
 /**
  * Seed reference data at boot time.

package/dist/db/reference-data.js

@@ -19,7 +19,12 @@ export async function seedReferenceData(defs, registry, db) {
     let inserted = 0;
     let updated = 0;
     const by = createSystemUser(SYSTEM_TENANT_ID);
-    const tdb = createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+    const tdb = createTenantDb({
+        db,
+        tenantId: SYSTEM_TENANT_ID,
+        mode: "system",
+        reason: "reference data lives in the system tenant",
+    });
     for (const def of defs) {
         const entity = registry.getEntity(def.entityName);
         if (!entity)

package/dist/db/render-ddl.d.ts

@@ -1,4 +1,8 @@
 import type { EntityTableMeta, IndexMeta } from "./entity-table-meta.ts";
+import { type RowLevelSecurityMode } from "./render-rls-ddl.ts";
 export declare function renderIndex(tableName: string, idx: IndexMeta): string;
-export declare function renderTableDdl(meta: EntityTableMeta): readonly string[];
-export declare function renderTablesDdl(metas: readonly EntityTableMeta[]): readonly string[];
+export type RenderDdlOptions = {
+    readonly rowLevelSecurity?: RowLevelSecurityMode;
+};
+export declare function renderTableDdl(meta: EntityTableMeta, options?: RenderDdlOptions): readonly string[];
+export declare function renderTablesDdl(metas: readonly EntityTableMeta[], options?: RenderDdlOptions): readonly string[];

package/dist/db/render-ddl.js

@@ -7,9 +7,8 @@
 // NO-MAGIC-ON-DATA: this renderer never runs at app runtime, only as a build
 // step. The runner reads the checked-in SQL, not renderer output.
 import { pgTypeToSqlType } from "./dialect.js";
-function quoteIdent(name) {
-    return `"${name.replace(/"/g, '""')}"`;
-}
+import { renderTableRowLevelSecurityDdl } from "./render-rls-ddl.js";
+import { quoteIdent } from "./sql-identifier.js";
 function renderColumn(col) {
     const parts = [quoteIdent(col.name), pgTypeToSqlType(col.pgType)];
     if (col.identity)
@@ -36,7 +35,7 @@ export function renderIndex(tableName, idx) {
     const where = idx.whereSql !== undefined ? ` WHERE ${idx.whereSql}` : "";
     return `CREATE ${kind} IF NOT EXISTS ${quoteIdent(idx.name)} ON ${quoteIdent(tableName)} (${colList})${where};`;
 }
-export function renderTableDdl(meta) {
+export function renderTableDdl(meta, options = {}) {
     const colLines = meta.columns.map(renderColumn);
     const lines = [...colLines];
     if (meta.compositePrimaryKey !== undefined) {
@@ -45,11 +44,12 @@ export function renderTableDdl(meta) {
     }
     const create = `CREATE TABLE IF NOT EXISTS ${quoteIdent(meta.tableName)} (\n  ${lines.join(",\n  ")}\n);`;
     const indexes = meta.indexes.map((idx) => renderIndex(meta.tableName, idx));
-    return [create, ...indexes];
+    const policies = options.rowLevelSecurity === "on" ? renderTableRowLevelSecurityDdl(meta) : [];
+    return [create, ...indexes, ...policies];
 }
-export function renderTablesDdl(metas) {
+export function renderTablesDdl(metas, options = {}) {
     const stmts = [];
     for (const m of metas)
-        stmts.push(...renderTableDdl(m));
+        stmts.push(...renderTableDdl(m, options));
     return stmts;
 }

package/dist/db/render-rls-ddl.d.ts

@@ -0,0 +1,35 @@
+import type { EntityTableMeta } from "./entity-table-meta.ts";
+export declare const ROW_LEVEL_SECURITY_MODES: readonly ["off", "on"];
+export type RowLevelSecurityMode = (typeof ROW_LEVEL_SECURITY_MODES)[number];
+export declare const DEFAULT_ROW_LEVEL_SECURITY_MODE: RowLevelSecurityMode;
+export declare const TENANT_ISOLATION_POLICY = "kumiko_tenant_isolation";
+export declare const SYSTEM_TENANT_READ_POLICY = "kumiko_system_tenant_read";
+export declare const TENANT_ID_SETTING = "kumiko.tenant_id";
+export declare const SCOPE_SETTING = "kumiko.scope";
+export declare const SYSTEM_SCOPE = "system";
+export declare const POLICY_COMMANDS: readonly ["ALL", "SELECT", "INSERT", "UPDATE", "DELETE"];
+export declare const POLICY_KINDS: readonly ["PERMISSIVE", "RESTRICTIVE"];
+export type RowLevelSecurityPolicy = {
+    readonly name: string;
+    readonly command: (typeof POLICY_COMMANDS)[number];
+    readonly kind: (typeof POLICY_KINDS)[number];
+    readonly rolesSql: string;
+    readonly using?: string;
+    readonly withCheck?: string;
+};
+export type TableRowLevelSecurity = {
+    readonly policies: readonly RowLevelSecurityPolicy[];
+};
+export type RowLevelSecurityFlags = {
+    readonly enabled: boolean;
+    readonly forced: boolean;
+};
+export declare function tenantRowLevelSecurityFor(meta: EntityTableMeta): TableRowLevelSecurity | undefined;
+export declare function rowLevelSecurityByTable(metas: readonly EntityTableMeta[]): Record<string, TableRowLevelSecurity>;
+export declare function renderCreatePolicy(tableSql: string, policy: RowLevelSecurityPolicy): string;
+export declare function renderRowLevelSecurityFlags(tableSql: string, flags: RowLevelSecurityFlags): string[];
+export declare function renderEnableRowLevelSecurity(tableSql: string, next: TableRowLevelSecurity, previous?: TableRowLevelSecurity): string[];
+export declare function renderDisableRowLevelSecurity(tableSql: string, previous: TableRowLevelSecurity): string[];
+export declare function renderTableRowLevelSecurityDdl(meta: EntityTableMeta): readonly string[];
+export declare function isSameTableRowLevelSecurity(a: TableRowLevelSecurity, b: TableRowLevelSecurity): boolean;
+export declare function isTableRowLevelSecurityRecord(value: unknown): value is Record<string, TableRowLevelSecurity>;

package/dist/db/render-rls-ddl.js

@@ -0,0 +1,127 @@
+// Pure renderer for Postgres row level security: EntityTableMeta → policy DDL.
+// Every table with a `tenant_id` column gets two policies; tables without one are untouched.
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-types/identifiers";
+import { isOneOf, isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { pgTypeToSqlType } from "./dialect.js";
+import { quoteIdent } from "./sql-identifier.js";
+export const ROW_LEVEL_SECURITY_MODES = ["off", "on"];
+export const DEFAULT_ROW_LEVEL_SECURITY_MODE = "on";
+export const TENANT_ISOLATION_POLICY = "kumiko_tenant_isolation";
+export const SYSTEM_TENANT_READ_POLICY = "kumiko_system_tenant_read";
+export const TENANT_ID_SETTING = "kumiko.tenant_id";
+export const SCOPE_SETTING = "kumiko.scope";
+export const SYSTEM_SCOPE = "system";
+const TENANT_COLUMN = "tenant_id";
+export const POLICY_COMMANDS = ["ALL", "SELECT", "INSERT", "UPDATE", "DELETE"];
+export const POLICY_KINDS = ["PERMISSIVE", "RESTRICTIVE"];
+export function tenantRowLevelSecurityFor(meta) {
+    const tenantColumn = meta.columns.find((col) => col.name === TENANT_COLUMN);
+    if (tenantColumn === undefined)
+        return undefined;
+    const sqlType = pgTypeToSqlType(tenantColumn.pgType);
+    const column = quoteIdent(TENANT_COLUMN);
+    // NULLIF: after a transaction-local set_config, current_setting returns '' instead of NULL.
+    const sessionTenant = `NULLIF(current_setting('${TENANT_ID_SETTING}', true), '')`;
+    const isolation = `${column} = ${sessionTenant}::${sqlType} OR current_setting('${SCOPE_SETTING}', true) = '${SYSTEM_SCOPE}'`;
+    return {
+        policies: [
+            {
+                name: TENANT_ISOLATION_POLICY,
+                command: "ALL",
+                kind: "PERMISSIVE",
+                rolesSql: "PUBLIC",
+                using: isolation,
+                withCheck: isolation,
+            },
+            {
+                name: SYSTEM_TENANT_READ_POLICY,
+                command: "SELECT",
+                kind: "PERMISSIVE",
+                rolesSql: "PUBLIC",
+                using: `${column} = '${SYSTEM_TENANT_ID}'::${sqlType} AND ${sessionTenant} IS NOT NULL`,
+            },
+        ],
+    };
+}
+export function rowLevelSecurityByTable(metas) {
+    const byTable = {};
+    for (const meta of metas) {
+        const spec = tenantRowLevelSecurityFor(meta);
+        if (spec !== undefined)
+            byTable[meta.tableName] = spec;
+    }
+    return byTable;
+}
+export function renderCreatePolicy(tableSql, policy) {
+    const using = policy.using !== undefined ? ` USING (${policy.using})` : "";
+    const withCheck = policy.withCheck !== undefined ? ` WITH CHECK (${policy.withCheck})` : "";
+    return `CREATE POLICY ${quoteIdent(policy.name)} ON ${tableSql} AS ${policy.kind} FOR ${policy.command} TO ${policy.rolesSql}${using}${withCheck};`;
+}
+function renderDropPolicy(tableSql, policyName) {
+    return `DROP POLICY IF EXISTS ${quoteIdent(policyName)} ON ${tableSql};`;
+}
+export function renderRowLevelSecurityFlags(tableSql, flags) {
+    return [
+        `ALTER TABLE ${tableSql} ${flags.enabled ? "ENABLE" : "DISABLE"} ROW LEVEL SECURITY;`,
+        `ALTER TABLE ${tableSql} ${flags.forced ? "FORCE" : "NO FORCE"} ROW LEVEL SECURITY;`,
+    ];
+}
+export function renderEnableRowLevelSecurity(tableSql, next, previous) {
+    const nextNames = new Set(next.policies.map((policy) => policy.name));
+    const vanished = (previous?.policies ?? []).filter((policy) => !nextNames.has(policy.name));
+    return [
+        ...vanished.map((policy) => renderDropPolicy(tableSql, policy.name)),
+        ...next.policies.flatMap((policy) => [
+            renderDropPolicy(tableSql, policy.name),
+            renderCreatePolicy(tableSql, policy),
+        ]),
+        ...renderRowLevelSecurityFlags(tableSql, { enabled: true, forced: true }),
+    ];
+}
+export function renderDisableRowLevelSecurity(tableSql, previous) {
+    return [
+        ...previous.policies.map((policy) => renderDropPolicy(tableSql, policy.name)),
+        ...renderRowLevelSecurityFlags(tableSql, { enabled: false, forced: false }).reverse(),
+    ];
+}
+export function renderTableRowLevelSecurityDdl(meta) {
+    const spec = tenantRowLevelSecurityFor(meta);
+    if (spec === undefined)
+        return [];
+    return renderEnableRowLevelSecurity(quoteIdent(meta.tableName), spec);
+}
+function isSamePolicy(a, b) {
+    return (a.name === b.name &&
+        a.command === b.command &&
+        a.kind === b.kind &&
+        a.rolesSql === b.rolesSql &&
+        a.using === b.using &&
+        a.withCheck === b.withCheck);
+}
+export function isSameTableRowLevelSecurity(a, b) {
+    return (a.policies.length === b.policies.length &&
+        a.policies.every((policy, index) => {
+            const other = b.policies[index];
+            return other !== undefined && isSamePolicy(policy, other);
+        }));
+}
+function isOptionalString(value) {
+    return value === undefined || typeof value === "string";
+}
+function isRowLevelSecurityPolicy(value) {
+    return (isPlainObject(value) &&
+        typeof value["name"] === "string" &&
+        typeof value["rolesSql"] === "string" &&
+        isOneOf(POLICY_COMMANDS, value["command"]) &&
+        isOneOf(POLICY_KINDS, value["kind"]) &&
+        isOptionalString(value["using"]) &&
+        isOptionalString(value["withCheck"]));
+}
+function isTableRowLevelSecurity(value) {
+    return (isPlainObject(value) &&
+        Array.isArray(value["policies"]) &&
+        value["policies"].every(isRowLevelSecurityPolicy));
+}
+export function isTableRowLevelSecurityRecord(value) {
+    return isPlainObject(value) && Object.values(value).every(isTableRowLevelSecurity);
+}

package/dist/db/replay-migration-sql.d.ts

@@ -1,13 +1,15 @@
 import type { Snapshot } from "./migrate-generator.ts";
+import { type ReplayedRowLevelSecurity } from "./replay-rls.ts";
 export type ReplayedTable = {
     readonly columns: ReadonlySet<string>;
     readonly columnsUnknown?: boolean;
+    readonly rowLevelSecurity?: ReplayedRowLevelSecurity;
 };
 export type ReplayedSchema = ReadonlyMap<string, ReplayedTable>;
 export declare function replayMigrationsDir(migrationsDir: string): ReplayedSchema;
 export type ReplayMismatch = {
     readonly tableName: string;
-    readonly kind: "missing-table" | "unexpected-table" | "column-drift";
+    readonly kind: "missing-table" | "unexpected-table" | "column-drift" | "row-level-security-drift";
     readonly detail: string;
 };
 export declare function diffReplayAgainstSnapshot(replayed: ReplayedSchema, snapshot: Snapshot): readonly ReplayMismatch[];

package/dist/db/replay-migration-sql.js

@@ -9,6 +9,7 @@
 // either. Reuses `loadMigrationsFromDir`'s statement-splitting so the replay
 // sees exactly what the real runner would execute.
 import { loadMigrationsFromDir } from "./migrate-runner.js";
+import { applyRowLevelSecurityStatement, IDENT, replayedOnlyRowLevelSecurityDrift, rowLevelSecurityDrift, TABLE_REF, } from "./replay-rls.js";
 // Migration files comment out destructive ops (DROP TABLE/COLUMN) as
 // `-- DESTRUCTIVE: <stmt>;  -- uncomment + ensure backup` so the real
 // migrate-runner never executes them unattended. For replay purposes the
@@ -48,10 +49,6 @@ function splitTopLevel(body) {
         parts.push(current);
     return parts;
 }
-// Identifiers in hand-written migrations aren't always quoted (the generator
-// always quotes, but the header explicitly invites hand-editing) — optional
-// quotes so `CREATE TABLE foo (...)` parses the same as `CREATE TABLE "foo" (...)`.
-const IDENT = `"?([^"\\s(;,.]+)"?`;
 function parseColumnNames(body) {
     const columns = new Set();
     for (const part of splitTopLevel(body)) {
@@ -197,7 +194,7 @@ function applyStatement(schema, statement, context) {
     // instead of matching only the first clause, in statement order so an
     // add-then-drop of the same column (unusual, but not impossible) resolves
     // correctly.
-    const alterTable = statement.match(new RegExp(`^ALTER TABLE\\s+${IDENT}\\s+([\\s\\S]*?);?\\s*$`, "i"));
+    const alterTable = statement.match(new RegExp(`^ALTER TABLE\\s+(?:IF EXISTS\\s+)?(?:ONLY\\s+)?${TABLE_REF}\\s+([\\s\\S]*?);?\\s*$`, "i"));
     const alterTableName = alterTable?.[1];
     const alterBody = alterTable?.[2];
     if (alterTableName !== undefined && alterBody !== undefined) {
@@ -276,10 +273,29 @@ export function replayMigrationsDir(migrationsDir) {
     for (const migration of migrations) {
         for (const statement of migration.statements) {
             applyStatement(schema, statement, { file: migration.id });
+            applyRowLevelSecurityStatement(schema, statement, { file: migration.id });
         }
     }
     return schema;
 }
+function rowLevelSecurityMismatches(replayed, snapshot) {
+    const mismatches = [];
+    const specs = snapshot.rowLevelSecurity ?? {};
+    for (const { tableName } of snapshot.tables) {
+        const table = replayed.get(tableName);
+        // skip: a missing table is already reported as missing-table
+        if (!table)
+            continue;
+        const spec = Object.hasOwn(specs, tableName) ? specs[tableName] : undefined;
+        const detail = spec === undefined
+            ? replayedOnlyRowLevelSecurityDrift(table.rowLevelSecurity)
+            : rowLevelSecurityDrift(table.rowLevelSecurity, tableName, spec);
+        if (detail !== undefined) {
+            mismatches.push({ tableName, kind: "row-level-security-drift", detail });
+        }
+    }
+    return mismatches;
+}
 // Compares what the migration files actually produce (`replayed`) against
 // what `.snapshot.json` claims (`snapshot`) — the check that would have
 // caught kumiko-studio's 0016 misgeneration (snapshot correct, SQL wrong).
@@ -314,6 +330,7 @@ export function diffReplayAgainstSnapshot(replayed, snapshot) {
             });
         }
     }
+    mismatches.push(...rowLevelSecurityMismatches(replayed, snapshot));
     for (const tableName of replayed.keys()) {
         if (!snapshotTableNames.has(tableName)) {
             mismatches.push({

package/dist/db/replay-rls.d.ts

@@ -0,0 +1,25 @@
+import { type TableRowLevelSecurity } from "./render-rls-ddl.ts";
+export type ReplayedPolicies = ReadonlyMap<string, string | undefined>;
+export type ReplayedRowLevelSecurity = {
+    readonly enabled: boolean;
+    readonly forced: boolean;
+    readonly policies: ReplayedPolicies;
+};
+export type MutableReplayedRowLevelSecurity = {
+    enabled: boolean;
+    forced: boolean;
+    policies: Map<string, string | undefined>;
+};
+type TableWithRowLevelSecurity = {
+    rowLevelSecurity?: MutableReplayedRowLevelSecurity;
+};
+export declare const IDENT = "\"?([^\"\\s(;,.]+)\"?";
+export declare const TABLE_REF = "(?:\"?public\"?\\.)?\"?([^\"\\s(;,.]+)\"?";
+type StatementContext = {
+    readonly file: string;
+};
+type ReplayTables = ReadonlyMap<string, TableWithRowLevelSecurity>;
+export declare function applyRowLevelSecurityStatement(tables: ReplayTables, statement: string, context: StatementContext): void;
+export declare function rowLevelSecurityDrift(replayed: ReplayedRowLevelSecurity | undefined, tableName: string, expected: TableRowLevelSecurity): string | undefined;
+export declare function replayedOnlyRowLevelSecurityDrift(replayed: ReplayedRowLevelSecurity | undefined): string | undefined;
+export {};

package/dist/db/replay-rls.js

@@ -0,0 +1,156 @@
+// Row level security part of the migration replay: tracks ENABLE/FORCE flags and
+// policy definitions per table so they can be compared against the snapshot.
+import { renderCreatePolicy } from "./render-rls-ddl.js";
+import { quoteIdent } from "./sql-identifier.js";
+// Identifiers in hand-written migrations aren't always quoted (the generator
+// always quotes, but the header explicitly invites hand-editing) — optional
+// quotes so `CREATE TABLE foo (...)` parses the same as `CREATE TABLE "foo" (...)`.
+export const IDENT = `"?([^"\\s(;,.]+)"?`;
+export const TABLE_REF = `(?:"?public"?\\.)?${IDENT}`;
+const ALTER_TABLE_RE = new RegExp(`^ALTER\\s+TABLE\\s+(?:IF\\s+EXISTS\\s+)?(?:ONLY\\s+)?${TABLE_REF}\\s+([\\s\\S]*?);?\\s*$`, "i");
+const FLAG_CLAUSE_RE = /\b(ENABLE|DISABLE|NO\s+FORCE|FORCE)\s+ROW\s+LEVEL\s+SECURITY\b/gi;
+const CREATE_POLICY_RE = new RegExp(`^CREATE\\s+POLICY\\s+${IDENT}\\s+ON\\s+${TABLE_REF}(?=[\\s;]|$)([\\s\\S]*)$`, "i");
+const DROP_POLICY_RE = new RegExp(`^DROP\\s+POLICY\\s+(IF\\s+EXISTS\\s+)?${IDENT}\\s+ON\\s+${TABLE_REF}(?=[\\s;]|$)`, "i");
+const ALTER_POLICY_RE = new RegExp(`^ALTER\\s+POLICY\\s+${IDENT}\\s+ON\\s+${TABLE_REF}(?=[\\s;]|$)([\\s\\S]*)$`, "i");
+const RENAME_POLICY_RE = new RegExp(`^\\s*RENAME\\s+TO\\s+${IDENT}\\s*;?\\s*$`, "i");
+const POLICY_OR_RLS_RE = /\bPOLICY\b|ROW\s+LEVEL\s+SECURITY/i;
+const ANY_POLICY_STATEMENT_RE = /^(CREATE|ALTER|DROP)\s+POLICY\b/i;
+function stateOf(table) {
+    table.rowLevelSecurity ??= {
+        enabled: false,
+        forced: false,
+        policies: new Map(),
+    };
+    return table.rowLevelSecurity;
+}
+function applyFlagClauses(table, alterBody) {
+    for (const [, clause] of alterBody.matchAll(FLAG_CLAUSE_RE)) {
+        const state = stateOf(table);
+        switch (clause?.toUpperCase().replace(/\s+/g, " ")) {
+            case "ENABLE":
+                state.enabled = true;
+                break;
+            case "DISABLE":
+                state.enabled = false;
+                break;
+            case "FORCE":
+                state.forced = true;
+                break;
+            case "NO FORCE":
+                state.forced = false;
+                break;
+        }
+    }
+}
+function normalizePolicyDefinition(text) {
+    return text.replace(/\s+/g, " ").replace(/;\s*$/, "").trim();
+}
+function applyAlterPolicy(table, policyName, alterBody) {
+    const { policies } = stateOf(table);
+    const newName = alterBody.match(RENAME_POLICY_RE)?.[1];
+    if (newName === undefined) {
+        if (policies.has(policyName))
+            policies.set(policyName, undefined);
+        // skip: body is not a rename, the altered-flag above is all that is tracked
+        return;
+    }
+    // skip: policy not tracked, nothing to rename
+    if (!policies.has(policyName))
+        return;
+    policies.set(newName, policies.get(policyName));
+    policies.delete(policyName);
+}
+function failUnparsedPolicy(statement, file) {
+    const prefix = statement.slice(0, 200).replace(/\s+/g, " ").trim();
+    throw new Error(`replayMigrationsDir: unparsed policy statement in ${file} — expected CREATE POLICY <name> ON <table>, ` +
+        `DROP POLICY [IF EXISTS] <name> ON <table> or ALTER POLICY <name> ON <table>. Statement: ${prefix}${statement.length > 200 ? "…" : ""}`);
+}
+function tryApplyAlterTable(tables, statement) {
+    const alter = statement.match(ALTER_TABLE_RE);
+    if (alter?.[1] === undefined || alter[2] === undefined)
+        return false;
+    const table = tables.get(alter[1]);
+    if (table)
+        applyFlagClauses(table, alter[2]);
+    return true;
+}
+function tryApplyCreatePolicy(tables, statement) {
+    const created = statement.match(CREATE_POLICY_RE);
+    if (created?.[1] === undefined || created[2] === undefined)
+        return false;
+    const table = tables.get(created[2]);
+    if (table) {
+        stateOf(table).policies.set(created[1], normalizePolicyDefinition(created[3] ?? ""));
+    }
+    return true;
+}
+function tryApplyDropPolicy(tables, statement, context) {
+    const dropped = statement.match(DROP_POLICY_RE);
+    if (dropped?.[2] === undefined || dropped[3] === undefined)
+        return false;
+    const table = tables.get(dropped[3]);
+    if (!table)
+        return true;
+    const removed = stateOf(table).policies.delete(dropped[2]);
+    if (!removed && dropped[1] === undefined) {
+        throw new Error(`replayMigrationsDir: ${context.file} drops policy "${dropped[2]}" on "${dropped[3]}" which no earlier migration created`);
+    }
+    return true;
+}
+function tryApplyAlterPolicy(tables, statement) {
+    const altered = statement.match(ALTER_POLICY_RE);
+    if (altered?.[1] === undefined || altered[2] === undefined || altered[3] === undefined) {
+        return false;
+    }
+    const table = tables.get(altered[2]);
+    if (table)
+        applyAlterPolicy(table, altered[1], altered[3]);
+    return true;
+}
+export function applyRowLevelSecurityStatement(tables, statement, context) {
+    if (/^DO\b/i.test(statement) && POLICY_OR_RLS_RE.test(statement)) {
+        throw new Error(`replayMigrationsDir: ${context.file} changes policies or row level security inside a DO block, which the replay cannot evaluate — write the statements at top level`);
+    }
+    const handled = tryApplyAlterTable(tables, statement) ||
+        tryApplyCreatePolicy(tables, statement) ||
+        tryApplyDropPolicy(tables, statement, context) ||
+        tryApplyAlterPolicy(tables, statement);
+    if (!handled && ANY_POLICY_STATEMENT_RE.test(statement)) {
+        failUnparsedPolicy(statement, context.file);
+    }
+}
+function expectedPolicyDefinition(tableName, policy) {
+    const rendered = renderCreatePolicy(quoteIdent(tableName), policy);
+    const definition = rendered.match(CREATE_POLICY_RE)?.[3];
+    if (definition === undefined) {
+        throw new Error(`rendered policy "${policy.name}" is not a CREATE POLICY statement`);
+    }
+    return normalizePolicyDefinition(definition);
+}
+export function rowLevelSecurityDrift(replayed, tableName, expected) {
+    const parts = [];
+    if (replayed?.enabled !== true)
+        parts.push("ROW LEVEL SECURITY is not enabled");
+    if (replayed?.forced !== true)
+        parts.push("ROW LEVEL SECURITY is not forced");
+    const actual = replayed?.policies ?? new Map();
+    const expectedNames = new Set(expected.policies.map((policy) => policy.name));
+    for (const policy of expected.policies) {
+        if (!actual.has(policy.name)) {
+            parts.push(`missing policy: ${policy.name}`);
+        }
+        else if (actual.get(policy.name) !== expectedPolicyDefinition(tableName, policy)) {
+            parts.push(`policy ${policy.name} deviates from the generated definition (hand-edited or altered)`);
+        }
+    }
+    const unexpected = [...actual.keys()].filter((name) => !expectedNames.has(name));
+    if (unexpected.length > 0)
+        parts.push(`unexpected policies: ${unexpected.join(", ")}`);
+    return parts.length > 0 ? parts.join("; ") : undefined;
+}
+export function replayedOnlyRowLevelSecurityDrift(replayed) {
+    const hasRowLevelSecurity = replayed !== undefined && (replayed.enabled || replayed.forced || replayed.policies.size > 0);
+    return hasRowLevelSecurity
+        ? "migrations enable row level security or create policies but .snapshot.json has no row level security spec for this table"
+        : undefined;
+}