@cosmicdrift/kumiko-testing 0.389.0 → 0.390.0

package/README.md

@@ -47,8 +47,11 @@ test("member sees the note", async ({ seedTenant, page }) => {
 });
 ```
 
-- `defineAppE2eConfig({ port, env?, locale?, projects?, serverEntry?, testDir?, testMatch? })`: parallelism, retries, timeouts and
+- `defineAppE2eConfig({ port, env?, locale?, projects?, serverEntry?, testDir?, testMatch?, isolatedSpecs? })`: parallelism, retries, timeouts and
   workers (`KUMIKO_E2E_WORKERS` overrides) are fixed by the template; projects cannot set them.
+- `isolatedSpecs: ["**/composer.spec.ts"]` moves specs that change app-wide state (catalog entries, global
+  settings) into the `chromium-isolated` project, which runs after all parallel projects on one worker. It cannot
+  be combined with `--shard`; details in `docs/guides/testing-standard.md`.
 - `KUMIKO_E2E_REMOTE_BASE_URL=https://staging.example.com` runs the same specs against an already running
   instance: no web server is started and `baseURL` is that URL (http or https only). Add
   `KUMIKO_E2E_STORAGE_STATE=<file>` for a session recorded with `playwright codegen --save-storage`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-testing",
-  "version": "0.389.0",
+  "version": "0.390.0",
   "description": "Test template for Kumiko apps: per-flow seedTenant, app test stack, canonical test preloads, bunfig generator and integration runner.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -103,13 +103,13 @@
     "kumiko-testing": "./bin/kumiko-testing.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.389.0",
-    "@cosmicdrift/kumiko-guards": "0.389.0",
-    "@cosmicdrift/kumiko-types": "0.389.0",
+    "@cosmicdrift/kumiko-framework": "0.390.0",
+    "@cosmicdrift/kumiko-guards": "0.390.0",
+    "@cosmicdrift/kumiko-types": "0.390.0",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@happy-dom/global-registrator": "^20.11.2",
+    "@happy-dom/global-registrator": "^21.0.4",
     "@playwright/test": "^1.62.1",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2"
@@ -129,9 +129,9 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.389.0",
-    "@cosmicdrift/kumiko-dev-server": "0.389.0",
-    "@happy-dom/global-registrator": "^20.11.2",
+    "@cosmicdrift/kumiko-bundled-features": "0.390.0",
+    "@cosmicdrift/kumiko-dev-server": "0.390.0",
+    "@happy-dom/global-registrator": "^21.0.4",
     "@playwright/test": "^1.62.1",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",

package/src/changes.json

@@ -1,4 +1,67 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "happy-dom and undici updated for security advisories",
+    "detail": "The happy-dom range for the global registrator and the DOM test setup moves to ^21.0.4 (fixes GHSA-834V-8H66-3H79, incomplete fix for an unsanitized import alias leading to host code execution), undici is pinned to 7.30.1 (fixes GHSA-XJJ6-F33Q-929C, denial of service through an unhandled error on excessive content-encodings).",
+    "migration": "Bump @happy-dom/global-registrator (and happy-dom, if listed) to ^21.0.4 in the app's devDependencies; the kumiko-testing peer range is now ^21.0.4. happy-dom 21 is a major release: run the app's DOM test suite after the bump."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Run e2e specs that change global app state in an isolated project",
+    "detail": "defineAppE2eConfig takes an isolatedSpecs option with the same pattern form as testMatch. Matching specs are removed from chromium and from every app project and run in a separate chromium-isolated project with one worker, only after all other projects have finished. Apps use it for specs that change state shared across the app, such as creating catalog channels. With isolatedSpecs set, every app project needs a name, and a run with --shard throws because Playwright does not shard dependency projects. Without the option the generated config is unchanged."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "The e2e suites run in two parallel CI shards",
+    "detail": "The framework CI splits the Playwright e2e suites across two runners instead of running them one after another on a single runner. The required e2e check passes only when both shards succeed. Nothing changes for apps; the package is only republished."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "The puppeteer render tests, including the egress guard, run in CI",
+    "detail": "The integration job installs Chrome through the trusted puppeteer postinstall and caches it between runs, so the real render tests no longer skip in CI. Nothing changes for apps; the package is only republished."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "extraContext factories get the raw db in the test stack and dev",
+    "detail": "The test stack and dev now pass the enforcing pool to extraContext factories, as runProdApp does, so request-time services keep the ambient request scope and a tenant leak shows up in tests instead of only in production.",
+    "migration": "Services built in extraContext that read across tenants at request time, or that a test calls directly, must scope themselves: createTenantDb({ db, tenantId, mode: \"system\", reason: \"<why>\" }). Test code reads through stack.db."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Export applicationRoleUrlOf from kumiko-testing/stack",
+    "detail": "Use it to boot runProdApp in tests against the app role. It returns the URL of a database as the non-bypass application role with the password of TEST_DATABASE_URL; pair it with createTestDb({ applicationRole: true })."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "The test application role is realigned to the configured password",
+    "detail": "createApplicationRole used to return early when the role existed, so a kumiko_app role with another password made every integration test fail with 28P01. It now runs ALTER ROLE with the configured password and the NOSUPERUSER NOBYPASSRLS attributes."
+  },
+  {
+    "version": "0.390.0",
+    "type": "breaking",
+    "title": "The test stack runs with row level security on as role kumiko_app",
+    "detail": "setupTestStack creates the role kumiko_app (LOGIN NOSUPERUSER NOBYPASSRLS, password taken from TEST_DATABASE_URL) once, makes it owner of the test database and opens every pool as that role with rowLevelSecurity \"on\"; template databases are built the same way. stack.db runs in system scope and sees every tenant's rows as before. The new stack.unscopedDb is the enforced pool the services use, on which a statement without a scope sees no tenant rows. rowLevelSecurity: \"off\" in the stack options restores the superuser stack without policies. createTestDb takes applicationRole: true for the same setup.",
+    "migration": "App code that reads or writes tenant tables through a raw connection outside a request, a job or a TenantDb now sees no rows in integration tests. Test code that calls such a path directly runs it inside runInSystemRowLevelSecurityScope or runInRowLevelSecurityScope(tenantRowLevelSecurityScope(tenantId), ...) from @cosmicdrift/kumiko-testing/helpers. Production code works through a TenantDb for the tenant, a job, a system-scoped handler or a granted unsafeRaw. Tests that need superuser rights on stack.db, such as CREATE EXTENSION, CREATE ROLE or event triggers, open their own connection from TEST_DATABASE_URL or use createTestDb(). Manual migration, there is no codemod."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Test helpers for event-store writes",
+    "detail": "The testing helpers gain updateRowViaEventStore, deleteRowViaEventStore and deleteRowsViaEventStore. They update or delete rows of an event-sourced table through the event-store executor, so the event log and the projection stay in step, instead of writing the projection table directly."
+  },
+  {
+    "version": "0.390.0",
+    "type": "improvement",
+    "title": "Seed event-sourced rows through the event store",
+    "detail": "The testing helpers gain seedRowViaEventStore(db, table, values). It takes the same arguments as seedRow, appends a created event through the event-store executor and projects the row, so a rebuild keeps the seeded row. The row's tenantId selects the acting tenant; global entities such as user are seeded without a tenantId, because the executor rejects one on them. It throws for tables that are not event-sourced entity tables, for a non-string id and when the executor rejects the row. To support this, buildEntityTable and r.entity now remember which entity a managed table belongs to; nothing changes for apps."
+  },
   {
     "version": "0.389.0",
     "type": "breaking",

package/src/e2e/define-app-e2e-config.ts

@@ -77,6 +77,8 @@ const TEMPLATE_OWNED_PROJECT_KEYS = [
 ] as const;
 const TEMPLATE_OWNED_USE_KEYS = ["actionTimeout", "navigationTimeout"] as const;
 const REAL_SPEC_GLOB = "**/*.real.spec.ts";
+export const ISOLATED_E2E_PROJECT_NAME = "chromium-isolated";
+export const NON_REAL_SPEC_PATTERN = /(?<!\.real)\.spec\.ts$/;
 const RESERVED_ENV_KEYS = [
   "PORT",
   SEED_ENABLE_ENV,
@@ -111,6 +113,7 @@ export type AppE2eConfigInput = {
   readonly projects?: readonly E2eProject[];
   readonly testDir?: string;
   readonly testMatch?: string | RegExp | readonly (string | RegExp)[];
+  readonly isolatedSpecs?: string | RegExp | readonly (string | RegExp)[];
   readonly permissions?: readonly string[];
   readonly launchOptions?: LaunchOptions;
 } & ServerStart;
@@ -140,6 +143,13 @@ function mutableTestMatch(
   return typeof match === "string" || match instanceof RegExp ? match : [...match];
 }
 
+function patternList(
+  patterns: NonNullable<AppE2eConfigInput["testMatch"]> | undefined,
+): (string | RegExp)[] {
+  if (patterns === undefined) return [];
+  return typeof patterns === "string" || patterns instanceof RegExp ? [patterns] : [...patterns];
+}
+
 export function resolveE2eWorkers(
   env: Readonly<Record<string, string | undefined>> = process.env,
   // cpus() reports every host core inside a CPU-limited container (1.5 CPU CI
@@ -233,6 +243,58 @@ function failureRecording(
   return { trace: "off", screenshot: "off", video: "off" };
 }
 
+// Worker processes do not carry --shard in argv, so only the runner trips this.
+function isShardedRun(argv: readonly string[] = process.argv): boolean {
+  return argv.some((arg) => arg === "--shard" || arg.startsWith("--shard="));
+}
+
+type ProjectsInput = {
+  readonly chromiumUse: Project["use"];
+  readonly appProjects: readonly E2eProject[];
+  readonly isolated: readonly (string | RegExp)[];
+  readonly baseIgnore: readonly string[];
+  readonly realRun: boolean;
+};
+
+function assertIsolatedSpecsUsable(appProjects: readonly E2eProject[]): void {
+  if (appProjects.some((project) => project.name === undefined)) {
+    throw new Error(
+      "defineAppE2eConfig: isolatedSpecs needs named projects, because the isolated project waits for them via dependencies",
+    );
+  }
+  if (isShardedRun()) {
+    throw new Error(
+      "defineAppE2eConfig: isolatedSpecs cannot be combined with --shard; Playwright does not shard dependency projects, so one shard would run every spec.",
+    );
+  }
+}
+
+function buildE2eProjects(input: ProjectsInput): Project[] {
+  const { chromiumUse, appProjects, isolated, baseIgnore, realRun } = input;
+  const baseProjects: Project[] = [{ name: "chromium", use: chromiumUse }, ...appProjects];
+  if (isolated.length === 0) return baseProjects;
+  assertIsolatedSpecsUsable(appProjects);
+  // A project-level testIgnore replaces the top-level one instead of merging with it.
+  const parallelProjects = baseProjects.map((project) => ({
+    ...project,
+    testIgnore: [...baseIgnore, ...patternList(project.testIgnore), ...isolated],
+  }));
+  return [
+    ...parallelProjects,
+    {
+      name: ISOLATED_E2E_PROJECT_NAME,
+      testMatch: [...isolated],
+      testIgnore: [...baseIgnore, ...(realRun ? [NON_REAL_SPEC_PATTERN] : [])],
+      dependencies: parallelProjects.flatMap((project) =>
+        project.name === undefined ? [] : [project.name],
+      ),
+      fullyParallel: false,
+      workers: 1,
+      use: chromiumUse,
+    },
+  ];
+}
+
 export function defineAppE2eConfig(input: AppE2eConfigInput): PlaywrightTestConfig {
   const {
     port,
@@ -241,6 +303,7 @@ export function defineAppE2eConfig(input: AppE2eConfigInput): PlaywrightTestConf
     projects = [],
     testDir = "./e2e",
     testMatch,
+    isolatedSpecs,
     permissions,
     launchOptions,
   } = input;
@@ -257,13 +320,27 @@ export function defineAppE2eConfig(input: AppE2eConfigInput): PlaywrightTestConf
   const remote = remoteTargetFromEnv(process.env);
   const baseURL = remote?.baseURL ?? `http://localhost:${port}`;
   const realRun = isRealProviderRun();
+  const baseIgnore = [...screenshotSpecsIgnore(), ...(realRun ? [] : [REAL_SPEC_GLOB])];
+  const isolated = patternList(isolatedSpecs);
+  const chromiumUse = {
+    ...devices["Desktop Chrome"],
+    viewport: DESKTOP_VIEWPORT,
+    deviceScaleFactor: isScreenshotRun() ? SCREENSHOT_DEVICE_SCALE_FACTOR : 1,
+  };
+  const e2eProjects = buildE2eProjects({
+    chromiumUse,
+    appProjects: projects,
+    isolated,
+    baseIgnore,
+    realRun,
+  });
 
   return defineConfig({
     testDir,
     ...(realRun
       ? { testMatch: REAL_SPEC_GLOB }
       : testMatch !== undefined && { testMatch: mutableTestMatch(testMatch) }),
-    testIgnore: [...screenshotSpecsIgnore(), ...(realRun ? [] : [REAL_SPEC_GLOB])],
+    testIgnore: baseIgnore,
     fullyParallel: true,
     forbidOnly: !!process.env["CI"],
     retries: 0,
@@ -281,17 +358,7 @@ export function defineAppE2eConfig(input: AppE2eConfigInput): PlaywrightTestConf
       ...(permissions !== undefined && { permissions: [...permissions] }),
       ...(launchOptions !== undefined && { launchOptions }),
     },
-    projects: [
-      {
-        name: "chromium",
-        use: {
-          ...devices["Desktop Chrome"],
-          viewport: DESKTOP_VIEWPORT,
-          deviceScaleFactor: isScreenshotRun() ? SCREENSHOT_DEVICE_SCALE_FACTOR : 1,
-        },
-      },
-      ...projects,
-    ],
+    projects: e2eProjects,
     ...(remote === undefined && {
       webServer: {
         command: serverCommand,

package/src/e2e/index.ts

@@ -40,6 +40,7 @@ export {
   type AppE2eConfigInput,
   defineAppE2eConfig,
   type E2eProject,
+  ISOLATED_E2E_PROJECT_NAME,
   resolveE2eWorkers,
 } from "./define-app-e2e-config";
 export { type MailCaptureOptions, mailCapture } from "./mail-capture";

package/src/helpers/event-store-writes.ts

@@ -0,0 +1,160 @@
+// Test-side writes on event-sourced tables that go through the event store, so
+// the event log and the projection stay consistent. Unlike seed.ts these survive
+// a projection rebuild and fire the same events a handler would.
+
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type DbConnection,
+  fetchOne,
+  selectMany,
+  type WhereObject,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  SYSTEM_TENANT_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { executorManagedEntitySourceOf } from "@cosmicdrift/kumiko-framework/internal/testing";
+
+type ExecutorArgs = Parameters<typeof createEventStoreExecutor>;
+
+export type EventStoreWriteTarget = {
+  readonly table: ExecutorArgs[0];
+  readonly entity: ExecutorArgs[1];
+  readonly entityName: string;
+};
+
+export type EventStoreWriteScope = {
+  /** Tenant of the acting system user and of the tenant-bound db; defaults to the system tenant. */
+  readonly tenantId?: TenantId;
+  /** Address a stream that lives on another tenant than the actor's. */
+  readonly streamTenantId?: TenantId;
+};
+
+type EntityId = string | number;
+
+function isEntityId(value: unknown): value is EntityId {
+  return typeof value === "string" || typeof value === "number";
+}
+
+async function loadTarget(
+  db: DbConnection,
+  target: EventStoreWriteTarget,
+  where: WhereObject,
+  verb: string,
+): Promise<{ id: EntityId; version: number }> {
+  const row = await fetchOne<Record<string, unknown>>(db, target.table, where);
+  if (!row) {
+    throw new Error(`${verb} ${target.entityName}: no row matches ${JSON.stringify(where)}`);
+  }
+  const { id, version } = row;
+  if (!isEntityId(id)) throw new Error(`${verb} ${target.entityName}: row has no id`);
+  if (typeof version !== "number") {
+    throw new Error(`${verb} ${target.entityName}: row has no numeric version`);
+  }
+  return { id, version };
+}
+
+function writeContext(scope: EventStoreWriteScope | undefined, db: DbConnection) {
+  const tenantId = scope?.tenantId ?? SYSTEM_TENANT_ID;
+  return {
+    user: createSystemUser(tenantId),
+    tenantDb: createTenantDb({
+      db,
+      tenantId,
+      mode: "system",
+      reason: "test helper seeds event-store rows for any tenant",
+    }),
+    options: scope?.streamTenantId ? { streamTenantId: scope.streamTenantId } : undefined,
+  };
+}
+
+function failedWrite(
+  verb: string,
+  entityName: string,
+  error: { readonly code: string; readonly details?: unknown },
+): Error {
+  return new Error(
+    `${verb} ${entityName} failed: ${error.code} ${JSON.stringify(error.details ?? {})}`,
+  );
+}
+
+// Same arguments as seedRow, so a seed on an entity table switches over by rename. The row's
+// tenantId picks the acting tenant (and so the stream tenant); seed global entities without one,
+// the executor rejects a tenantId on them.
+export async function seedRowViaEventStore(
+  db: DbConnection,
+  table: EventStoreWriteTarget["table"],
+  values: Readonly<Record<string, unknown>>,
+): Promise<void> {
+  const source = executorManagedEntitySourceOf(table);
+  if (!source) {
+    throw new Error(
+      "seedRowViaEventStore: table is not an event-sourced entity table (buildEntityTable or r.entity); use seedRow",
+    );
+  }
+  const { entity, entityName } = source;
+  const { tenantId, ...payload } = values;
+  if (payload["id"] !== undefined && typeof payload["id"] !== "string") {
+    throw new Error(
+      `seed ${entityName}: id must be a string, the event store would mint a new one`,
+    );
+  }
+  if (tenantId !== undefined && typeof tenantId !== "string") {
+    throw new Error(`seed ${entityName}: tenantId must be a string`);
+  }
+  const { user, tenantDb } = writeContext({ tenantId }, db);
+  const executor = createEventStoreExecutor(table, entity, { entityName });
+  const result = await executor.create(payload, user, tenantDb);
+  if (!result.isSuccess) throw failedWrite("seed", entityName, result.error);
+}
+
+export async function updateRowViaEventStore(
+  db: DbConnection,
+  target: EventStoreWriteTarget,
+  where: WhereObject,
+  changes: Readonly<Record<string, unknown>>,
+  scope?: EventStoreWriteScope,
+): Promise<void> {
+  const { id, version } = await loadTarget(db, target, where, "update");
+  const { user, tenantDb, options } = writeContext(scope, db);
+  const executor = createEventStoreExecutor(target.table, target.entity, {
+    entityName: target.entityName,
+  });
+  const result = await executor.update(
+    { id, version, changes: { ...changes } },
+    user,
+    tenantDb,
+    options,
+  );
+  if (!result.isSuccess) throw failedWrite("update", target.entityName, result.error);
+}
+
+export async function deleteRowViaEventStore(
+  db: DbConnection,
+  target: EventStoreWriteTarget,
+  where: WhereObject,
+  scope?: EventStoreWriteScope,
+): Promise<void> {
+  const { id } = await loadTarget(db, target, where, "delete");
+  const { user, tenantDb, options } = writeContext(scope, db);
+  const executor = createEventStoreExecutor(target.table, target.entity, {
+    entityName: target.entityName,
+  });
+  const result = await executor.delete({ id }, user, tenantDb, options);
+  if (!result.isSuccess) throw failedWrite("delete", target.entityName, result.error);
+}
+
+/** Deletes every row matching `where`, each through its own event-store delete. */
+export async function deleteRowsViaEventStore(
+  db: DbConnection,
+  target: EventStoreWriteTarget,
+  where: WhereObject,
+  scope?: EventStoreWriteScope,
+): Promise<void> {
+  const rows = await selectMany<{ id: EntityId }>(db, target.table, where);
+  for (const { id } of rows) {
+    await deleteRowViaEventStore(db, target, { id }, scope);
+  }
+}

package/src/helpers/index.ts

@@ -2,6 +2,12 @@
 // must import nothing from this subpath — the stack builders live in
 // `@cosmicdrift/kumiko-testing/stack`.
 
+// Scope setters for tests that call cross-tenant or tenant functions directly, outside dispatch.
+export {
+  runInRowLevelSecurityScope,
+  runInSystemRowLevelSecurityScope,
+  tenantRowLevelSecurityScope,
+} from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 // The four cache/injection resets stay in their own modules (they close over
 // module-private state) and are only re-exported here — they are out of /crypto
 // and /db. A production call to resetPiiSubjectKmsForTests() silently switches
@@ -36,6 +42,14 @@ export {
   generateE2ESpec,
   generateZodFixture,
 } from "./e2e-generator.ts";
+export {
+  deleteRowsViaEventStore,
+  deleteRowViaEventStore,
+  type EventStoreWriteScope,
+  type EventStoreWriteTarget,
+  seedRowViaEventStore,
+  updateRowViaEventStore,
+} from "./event-store-writes.ts";
 export { expectErrorIncludes } from "./expect-error.ts";
 export { describeFileProviderContract } from "./file-provider-contract.ts";
 export {

package/src/scaffold.ts

@@ -181,7 +181,7 @@ function renderIntegrationTest(): string {
     "});",
     "",
     "afterAll(async () => {",
-    "  await stack.cleanup();",
+    "  await stack?.cleanup();",
     "});",
     "",
     'describe("tasks", () => {',

package/src/stack/db.ts

@@ -4,12 +4,15 @@
 import { DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX } from "@cosmicdrift/kumiko-framework/db";
 import {
   acquireSessionAdvisoryLock,
+  createApplicationRole,
   createDatabase,
   createDbConnection,
   databaseExists,
   dropDatabaseIfExists,
   listDatabaseNamesWithPrefix,
   renameDatabase,
+  transferDatabaseOwnership,
+  transferPublicSchemaOwnership,
 } from "@cosmicdrift/kumiko-framework/internal/stack-support";
 import { ensureTemporalPolyfill } from "@cosmicdrift/kumiko-framework/time";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
@@ -27,6 +30,9 @@ function requireEnv(name: string): string {
 
 export const DEFAULT_TEST_DB_POOL_MAX = 10;
 
+// Non-superuser without BYPASSRLS: the only login that makes row-level-security policies bite in tests.
+export const TEST_APPLICATION_ROLE = "kumiko_app";
+
 export type TestDb = {
   db: DbConnection;
   poolMax: number;
@@ -44,6 +50,8 @@ export type CreateTestDbOptions = {
   readonly outsideTransactionPoolMax?: number;
   /** Clone this already-migrated database instead of starting empty. */
   readonly templateDbName?: string;
+  /** Own the database as the non-bypass application role and enforce row-level security on the pools. */
+  readonly applicationRole?: boolean;
 };
 
 // Set by the integration runner for one run; templates named after it are dropped when the run ends.
@@ -62,6 +70,67 @@ function databaseUrlOf(url: string, dbName: string): string {
   return url.replace(/\/[^/]+$/, `/${dbName}`);
 }
 
+/**
+ * URL of database `dbName` on the host of `url`, logged in as TEST_APPLICATION_ROLE with the password
+ * of `url` (the caller's TEST_DATABASE_URL). Pair it with `createTestDb({ applicationRole: true })` or
+ * a database owned by that role, so boots with row level security on connect without BYPASSRLS.
+ */
+// DDL takes no bind params, so the password is read from the configured URL instead of a literal.
+export function applicationRoleUrlOf(url: string, dbName: string): string {
+  const parsed = new URL(url);
+  parsed.pathname = `/${dbName}`;
+  parsed.username = TEST_APPLICATION_ROLE;
+  parsed.password = new URL(url).password;
+  return parsed.toString();
+}
+
+async function ensureApplicationRole(admin: DbConnection, url: string): Promise<void> {
+  await createApplicationRole(
+    admin,
+    TEST_APPLICATION_ROLE,
+    decodeURIComponent(new URL(url).password),
+  );
+}
+
+// Admin connections below run as superuser for CREATE/DROP DATABASE and never open a tenant scope: "off" is explicit.
+async function adoptPersistentDatabase(
+  admin: DbConnection,
+  url: string,
+  dbName: string,
+): Promise<void> {
+  await transferDatabaseOwnership(admin, dbName, TEST_APPLICATION_ROLE);
+  const owner = createDbConnection({
+    url: databaseUrlOf(url, dbName),
+    maxConnections: 1,
+    rowLevelSecurity: "off", // superuser ownership transfer, no tenant scope
+  });
+  try {
+    await transferPublicSchemaOwnership(owner.db, TEST_APPLICATION_ROLE);
+  } finally {
+    await owner.close();
+  }
+}
+
+type ProvisionArgs = {
+  readonly url: string;
+  readonly dbName: string;
+  readonly opts: CreateTestDbOptions;
+  readonly applicationRole: boolean;
+  readonly owner: string | undefined;
+};
+
+async function provisionDatabase(
+  admin: DbConnection,
+  { url, dbName, opts, applicationRole, owner }: ProvisionArgs,
+): Promise<void> {
+  const existing = opts.persistent === true && (await databaseExists(admin, dbName));
+  if (existing && applicationRole) await adoptPersistentDatabase(admin, url, dbName);
+  if (!existing) {
+    const template = opts.persistent === true ? undefined : opts.templateDbName;
+    await createDatabase(admin, dbName, template, owner);
+  }
+}
+
 export async function createTestDb(arg?: string | CreateTestDbOptions): Promise<TestDb> {
   await ensureTemporalPolyfill();
   const opts: CreateTestDbOptions = typeof arg === "string" ? { baseUrl: arg } : (arg ?? {});
@@ -69,24 +138,23 @@ export async function createTestDb(arg?: string | CreateTestDbOptions): Promise<
   const dbName = opts.dbName ?? `kumiko_test_${generateId().slice(-8)}`;
   const adminUrl = adminUrlOf(url);
 
-  const admin = createDbConnection({ url: adminUrl, maxConnections: 1 });
+  const applicationRole = opts.applicationRole === true;
+  const owner = applicationRole ? TEST_APPLICATION_ROLE : undefined;
+  const admin = createDbConnection({ url: adminUrl, maxConnections: 1, rowLevelSecurity: "off" });
   try {
-    if (opts.persistent) {
-      if (!(await databaseExists(admin.db, dbName))) {
-        await createDatabase(admin.db, dbName);
-      }
-    } else {
-      await createDatabase(admin.db, dbName, opts.templateDbName);
-    }
+    if (applicationRole) await ensureApplicationRole(admin.db, url);
+    await provisionDatabase(admin.db, { url, dbName, opts, applicationRole, owner });
   } finally {
     await admin.close();
   }
 
-  const testUrl = databaseUrlOf(url, dbName);
+  const testUrl = applicationRole ? applicationRoleUrlOf(url, dbName) : databaseUrlOf(url, dbName);
+  const rowLevelSecurity = applicationRole ? "on" : "off";
   const poolMax = opts.poolMax ?? DEFAULT_TEST_DB_POOL_MAX;
-  const conn = createDbConnection({ url: testUrl, maxConnections: poolMax });
+  const conn = createDbConnection({ url: testUrl, maxConnections: poolMax, rowLevelSecurity });
   const outsideConn = createDbConnection({
     url: testUrl,
+    rowLevelSecurity,
     maxConnections: opts.outsideTransactionPoolMax ?? DEFAULT_OUTSIDE_TRANSACTION_POOL_MAX,
   });
 
@@ -105,7 +173,11 @@ export async function createTestDb(arg?: string | CreateTestDbOptions): Promise<
       await conn.close();
       await outsideConn.close();
       if (!opts.persistent) {
-        const admin2 = createDbConnection({ url: adminUrl, maxConnections: 1 });
+        const admin2 = createDbConnection({
+          url: adminUrl,
+          maxConnections: 1,
+          rowLevelSecurity: "off",
+        });
         try {
           await dropDatabaseIfExists(admin2.db, dbName);
         } finally {
@@ -123,10 +195,11 @@ const testDbTemplates = new Map<string, Promise<void>>();
 export function ensureTestDbTemplate(
   templateDbName: string,
   buildSchema: (db: DbConnection) => Promise<void>,
+  options: { readonly applicationRole?: boolean } = {},
 ): Promise<void> {
   const known = testDbTemplates.get(templateDbName);
   if (known) return known;
-  const pending = buildTestDbTemplate(templateDbName, buildSchema);
+  const pending = buildTestDbTemplate(templateDbName, buildSchema, options);
   testDbTemplates.set(templateDbName, pending);
   pending.catch(() => testDbTemplates.delete(templateDbName));
   return pending;
@@ -135,10 +208,16 @@ export function ensureTestDbTemplate(
 export async function buildTestDbTemplate(
   templateDbName: string,
   buildSchema: (db: DbConnection) => Promise<void>,
+  options: { readonly applicationRole?: boolean } = {},
 ): Promise<void> {
+  const applicationRole = options.applicationRole === true;
   const url = requireEnv("TEST_DATABASE_URL");
   // One connection, so the session that takes the advisory lock is the one closed below.
-  const admin = createDbConnection({ url: adminUrlOf(url), maxConnections: 1 });
+  const admin = createDbConnection({
+    url: adminUrlOf(url),
+    maxConnections: 1,
+    rowLevelSecurity: "off",
+  });
   try {
     await acquireSessionAdvisoryLock(admin.db, templateDbName);
     // skip: another worker of this run already built it while we waited on the lock
@@ -146,8 +225,18 @@ export async function buildTestDbTemplate(
     // Built under a side name and renamed once complete, so a clone never sees a half-built schema.
     const buildDbName = `${templateDbName}_build`;
     await dropDatabaseIfExists(admin.db, buildDbName);
-    await createDatabase(admin.db, buildDbName);
-    const conn = createDbConnection({ url: databaseUrlOf(url, buildDbName), maxConnections: 1 });
+    if (applicationRole) await ensureApplicationRole(admin.db, url);
+    await createDatabase(
+      admin.db,
+      buildDbName,
+      undefined,
+      applicationRole ? TEST_APPLICATION_ROLE : undefined,
+    );
+    const conn = createDbConnection(
+      applicationRole
+        ? { url: applicationRoleUrlOf(url, buildDbName), maxConnections: 1, rowLevelSecurity: "on" }
+        : { url: databaseUrlOf(url, buildDbName), maxConnections: 1, rowLevelSecurity: "off" },
+    );
     try {
       await buildSchema(conn.db);
     } finally {
@@ -160,7 +249,11 @@ export async function buildTestDbTemplate(
 }
 
 export async function dropTestDbTemplates(baseUrl: string, runId: string): Promise<void> {
-  const admin = createDbConnection({ url: adminUrlOf(baseUrl), maxConnections: 1 });
+  const admin = createDbConnection({
+    url: adminUrlOf(baseUrl),
+    maxConnections: 1,
+    rowLevelSecurity: "off",
+  });
   try {
     for (const name of await listDatabaseNamesWithPrefix(admin.db, testDbTemplatePrefix(runId))) {
       await dropDatabaseIfExists(admin.db, name);

package/src/stack/index.ts

@@ -15,9 +15,11 @@ export {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/internal/stack-support";
 export {
+  applicationRoleUrlOf,
   type CreateTestDbOptions,
   createTestDb,
   DEFAULT_TEST_DB_POOL_MAX,
+  TEST_APPLICATION_ROLE,
   type TestDb,
 } from "./db.ts";
 export { drainEventConsumers } from "./drain-event-consumers.ts";

package/src/stack/push-entity-projection-tables.ts

@@ -11,7 +11,12 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/internal/stack-support";
 
-type DbHolder = { readonly db: DbConnection };
+// DDL must not run through the system-scoped `db` of a stack: each scoped statement is its own transaction, which CREATE INDEX CONCURRENTLY rejects.
+type DbHolder = { readonly db: DbConnection; readonly unscopedDb?: DbConnection };
+
+function ddlDbOf(stack: DbHolder): DbConnection {
+  return stack.unscopedDb ?? stack.db;
+}
 
 // biome-ignore lint/suspicious/noConsole: stack-internal status logging
 const logInfo = (msg: string): void => console.log(msg);
@@ -45,7 +50,7 @@ export async function pushEntityProjectionTables(
     if (seen.has(proj.table)) continue;
     seen.add(proj.table);
     const physical = schemaTableName(proj.table) ?? tableToMeta(proj.table).tableName;
-    if (!(await tableExists(stack.db, `public.${physical}`))) {
+    if (!(await tableExists(ddlDbOf(stack), `public.${physical}`))) {
       missing[projName] = proj.table;
       continue;
     }
@@ -53,7 +58,7 @@ export async function pushEntityProjectionTables(
   }
 
   if (Object.keys(missing).length > 0) {
-    await unsafePushTables(stack.db, missing);
+    await unsafePushTables(ddlDbOf(stack), missing);
   }
 }
 
@@ -70,11 +75,11 @@ async function syncExistingProjectionTable(
   table: unknown,
 ): Promise<void> {
   const meta = tableToMeta(table);
-  const liveColumns = await columnNamesOf(stack.db, physical);
+  const liveColumns = await columnNamesOf(ddlDbOf(stack), physical);
   const missingColumns = meta.columns.filter((c) => !liveColumns.has(c.name));
   if (missingColumns.length === 0) {
     logInfo(`[kumiko-stack] table ${physical} already exists — skipping create`);
-    await addMissingIndexes(stack.db, physical, meta.indexes);
+    await addMissingIndexes(ddlDbOf(stack), physical, meta.indexes);
     // skip: table is already in sync, only indexes needed backfilling
     return;
   }
@@ -97,6 +102,6 @@ async function syncExistingProjectionTable(
     `[kumiko-stack] table ${physical} is missing column(s) ` +
       `${missingColumns.map((c) => `"${c.name}"`).join(", ")} — adding`,
   );
-  await addMissingColumns(stack.db, physical, missingColumns);
-  await addMissingIndexes(stack.db, physical, meta.indexes);
+  await addMissingColumns(ddlDbOf(stack), physical, missingColumns);
+  await addMissingIndexes(ddlDbOf(stack), physical, meta.indexes);
 }

package/src/stack/test-stack-setup.ts

@@ -1,13 +1,24 @@
 // @runtime dev
 import { createHash } from "node:crypto";
 import { buildServer, createSseBroker } from "@cosmicdrift/kumiko-framework/api";
-import type { DbConnection, EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import {
+  assertRowLevelSecurityBootState,
+  type DbConnection,
+  type EntityTableMeta,
+  knownTablesOf,
+  type RowLevelSecurityMode,
+} from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine/types";
 import {
   createArchivedStreamsTable,
   createEventsTable,
 } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  appHookScopedRunner,
+  DEFAULT_ROW_LEVEL_SECURITY_MODE,
+  systemScopedRunner,
+} from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import {
   createRateLimitResolver,
   unsafePushTables,
@@ -35,6 +46,7 @@ import type { Clock } from "@cosmicdrift/kumiko-types/tz-context";
 import {
   createTestDb,
   ensureTestDbTemplate,
+  TEST_APPLICATION_ROLE,
   TEST_DB_TEMPLATE_RUN_ENV,
   testDbTemplatePrefix,
 } from "./db.ts";
@@ -95,7 +107,7 @@ async function pushStackSchema(
   // setupTestStack call is ready for writes without needing a manual
   // createEventsTable().
   await createEventsTable(db);
-  // Archive-stream metadata — needed by ctx.appendEvent's archive guard and
+  // Archive-stream metadata — needed by ctx.events.append's archive guard and
   // loadAggregate's default-skip. Idempotent, so production boot running
   // the same call is fine.
   await createArchivedStreamsTable(db);
@@ -135,6 +147,7 @@ async function resolveTestDbTemplateName(
   options: TestStackOptions,
   metas: readonly EntityTableMeta[],
   withFileTables: boolean,
+  rowLevelSecurity: RowLevelSecurityMode,
 ): Promise<string | undefined> {
   const runId = process.env[TEST_DB_TEMPLATE_RUN_ENV];
   if (runId === undefined || options.persistentDb === true || options.dbName !== undefined) {
@@ -142,7 +155,14 @@ async function resolveTestDbTemplateName(
   }
   const { renderTablesDdl } = await import("@cosmicdrift/kumiko-framework/db");
   const fingerprint = createHash("sha256")
-    .update(JSON.stringify({ withFileTables, ddl: renderTablesDdl(metas) }))
+    .update(
+      JSON.stringify({
+        withFileTables,
+        rowLevelSecurity,
+        role: rowLevelSecurity === "on" ? TEST_APPLICATION_ROLE : "superuser",
+        ddl: renderTablesDdl(metas, { rowLevelSecurity }),
+      }),
+    )
     .digest("hex")
     .slice(0, 16);
   return `${testDbTemplatePrefix(runId)}${fingerprint}`;
@@ -193,8 +213,17 @@ export async function provisionStackStorage(options: TestStackOptions): Promise<
   const withFileTables = options.files !== undefined;
   const buildStackSchema = (db: DbConnection): Promise<void> =>
     pushStackSchema(db, stackTableMetas, withFileTables);
-  const templateDbName = await resolveTestDbTemplateName(options, stackTableMetas, withFileTables);
-  if (templateDbName !== undefined) await ensureTestDbTemplate(templateDbName, buildStackSchema);
+  const rowLevelSecurity = options.rowLevelSecurity ?? "on";
+  const applicationRole = rowLevelSecurity === "on";
+  const templateDbName = await resolveTestDbTemplateName(
+    options,
+    stackTableMetas,
+    withFileTables,
+    rowLevelSecurity,
+  );
+  if (templateDbName !== undefined) {
+    await ensureTestDbTemplate(templateDbName, buildStackSchema, { applicationRole });
+  }
 
   // Forward db-name/persistent-flag through to createTestDb. The
   // defaults (undefined dbName, persistent:false) keep the legacy
@@ -209,6 +238,7 @@ export async function provisionStackStorage(options: TestStackOptions): Promise<
         outsideTransactionPoolMax: options.outsideTransactionPoolMax,
       }),
       ...(templateDbName !== undefined && { templateDbName }),
+      applicationRole,
     }),
     createTestRedis(
       options.sharedRedisWith && { borrowKeyPrefix: options.sharedRedisWith.redis.keyPrefix },
@@ -219,13 +249,16 @@ export async function provisionStackStorage(options: TestStackOptions): Promise<
   // DB/Redis — the caller never gets the stack object back to call
   // cleanup() itself (same "leaked ephemeral DB" failure class as the later
   // try/catch in setupTestStack, but for setup that runs before that try starts).
-  if (templateDbName === undefined) {
-    try {
-      await buildStackSchema(testDb.db);
-    } catch (error) {
-      await runCleanupsIgnoringErrors([() => testDb.cleanup(), () => testRedis.cleanup()]);
-      throw error;
-    }
+  try {
+    if (templateDbName === undefined) await buildStackSchema(testDb.db);
+    await assertRowLevelSecurityBootState(
+      testDb.db,
+      rowLevelSecurity,
+      knownTablesOf(options.features),
+    );
+  } catch (error) {
+    await runCleanupsIgnoringErrors([() => testDb.cleanup(), () => testRedis.cleanup()]);
+    throw error;
   }
   return { testDb, testRedis };
 }
@@ -308,11 +341,17 @@ export async function buildStackServices(
   // it there either (only dispatcherOptions.effectiveFeatures, consumed by
   // the command-dispatcher — see buildJobRunnerWithHook in entrypoint/
   // index.ts). Putting it here would reintroduce the exact test-vs-prod
-  // drift fixed: a job/handler reading `ctx.effectiveFeatures` would pass in
+  // drift fixed: a job/handler reading `ctx.services.effectiveFeatures` would pass in
   // tests and break in prod.
   const extraContext =
     typeof options.extraContext === "function"
-      ? options.extraContext({ registry, db: testDb.db, sseBroker, redis: testRedis.redis })
+      ? options.extraContext({
+          registry,
+          // The raw pool, as in prod: request-time services keep the ambient request scope, so a tenant leak shows in tests.
+          db: testDb.db,
+          sseBroker,
+          redis: testRedis.redis,
+        })
       : options.extraContext;
   const appContext = {
     db: testDb.db,
@@ -334,7 +373,7 @@ export type StackServices = Awaited<ReturnType<typeof buildStackServices>>;
 type JobFailureTracker = ReturnType<typeof createJobFailureTracker>;
 
 // Built before buildServer() so it can be merged into dispatcherOptions
-// (write handlers' `ctx.jobRunner.dispatch(...)` and the afterCommit
+// (write handlers' `ctx.services.jobRunner.dispatch(...)` and the afterCommit
 // event-trigger hook both need it present at dispatcher-construction
 // time, same as the prod entrypoint's buildJobRunnerWithHook). Uses the
 // test-stack's own ephemeral redis — no separate `redisUrl` seam needed.
@@ -430,7 +469,7 @@ async function configureStackSearch(
 
 // buildServer only auto-wires an L3 RateLimitResolver from
 // `context.redis` — a degradation test that nulls `redis` via
-// extraContext (to exercise a handler's own ctx.redis-down guard) also
+// extraContext (to exercise a handler's own ctx.services.redis-down guard) also
 // silently strips rate-limiting, even though every handler with a
 // `rateLimit` declaration still requires a resolver at dispatch time.
 // Since e7bf543ad, an IP-keyed bucket key is built unconditionally
@@ -457,6 +496,12 @@ function resolveStackRateLimitFallback(
   });
 }
 
+function testCodeDb<T extends object>(options: TestStackOptions, db: T): T {
+  return (options.rowLevelSecurity ?? DEFAULT_ROW_LEVEL_SECURITY_MODE) === "on"
+    ? systemScopedRunner(db, "test stack seeds and reads rows across tenants")
+    : db;
+}
+
 async function resolveStackAnonymousAccess(
   options: TestStackOptions,
   testDb: StackStorage["testDb"],
@@ -464,12 +509,16 @@ async function resolveStackAnonymousAccess(
   services: StackServices,
 ): Promise<Pick<ServerBuildOptions, "anonymousAccess">> {
   const { registry, sseBroker } = services;
+  const hookDb = appHookScopedRunner(
+    testDb.db,
+    options.rowLevelSecurity ?? DEFAULT_ROW_LEVEL_SECURITY_MODE,
+  );
   const baseAnon =
     typeof options.anonymousAccess === "function"
-      ? options.anonymousAccess({ registry, db: testDb.db, sseBroker, redis: testRedis.redis })
+      ? options.anonymousAccess({ registry, db: hookDb, sseBroker, redis: testRedis.redis })
       : options.anonymousAccess;
   const resolvedAnon = options.enrichAnonymousAccess
-    ? await options.enrichAnonymousAccess(baseAnon, { registry, db: testDb.db })
+    ? await options.enrichAnonymousAccess(baseAnon, { registry, db: hookDb })
     : baseAnon;
   return resolvedAnon ? { anonymousAccess: resolvedAnon } : {};
 }
@@ -578,7 +627,9 @@ function assembleTestStack(
     app: server.app,
     jwt: server.jwt,
     registry: services.registry,
-    db: testDb.db,
+    // Test code sees every tenant's rows; the services keep the enforced pool.
+    db: testCodeDb(options, testDb.db),
+    unscopedDb: testDb.db,
     dbPoolMax: testDb.poolMax,
     redis: testRedis,
     cacheSync,

package/src/stack/test-stack.ts

@@ -37,7 +37,10 @@ export type TestStack = {
   app: Hono;
   jwt: JwtHelper;
   registry: Registry;
+  /** Sees every tenant's rows (system scope) at rowLevelSecurity "on". */
   db: import("@cosmicdrift/kumiko-framework/db").DbConnection;
+  /** The enforced pool the services use: a statement without a scope sees no tenant row. Same as `db` at "off". */
+  unscopedDb: import("@cosmicdrift/kumiko-framework/db").DbConnection;
   /** Resolved connection pool size of `db`. */
   readonly dbPoolMax: number;
   redis: TestRedis;
@@ -61,7 +64,7 @@ export type TestStack = {
   // wires itself (_fileProviderResolver). A dev-server that starts its own
   // lane job-runners beside this stack must hand them THIS, not a
   // `{ db, registry }` literal — that's the drift, and it makes an
-  // event-triggered job reaching for ctx.files die where the request path works.
+  // event-triggered job reaching for ctx.services.files die where the request path works.
   context: AppContext;
   // Present whenever a system consumer (SSE, Search) or
   // r.multiStreamProjection is wired. Tests drain it via runOnce() (or the
@@ -73,7 +76,7 @@ export type TestStack = {
   lifecycle?: Lifecycle;
   // Only set when `options.jobs` is truthy AND ≥1 `r.job(...)` is
   // registered in the mounted features. Lets integration tests call
-  // `stack.jobRunner.dispatch(...)` directly, mirroring `ctx.jobRunner`.
+  // `stack.jobRunner.dispatch(...)` directly, mirroring `ctx.services.jobRunner`.
   jobRunner?: JobRunner;
   // Waits for every in-flight job and its follow-up event-consumer /
   // job-trigger cascade to settle — instead of `waitFor` polling on a
@@ -116,7 +119,7 @@ export type TestStackOptions = {
   /** Wire up auth routes (login, tenant-switch). Leave undefined to skip. */
   authConfig?: AuthRoutesConfig;
   /** Register a file storage provider so uploads via POST /api/files work and
-   *  `ctx.files.ref(key)` is available to hooks/MSPs. Omit to skip — tests
+   *  `ctx.services.files.ref(key)` is available to hooks/MSPs. Omit to skip — tests
    *  without file handling don't need it. */
   files?: { storageProvider: import("@cosmicdrift/kumiko-framework/files").FileStorageProvider };
   /** Observability provider — omit for NoopProvider (no spans/metrics).
@@ -160,7 +163,7 @@ export type TestStackOptions = {
   persistentDb?: boolean;
   /** Cap on the main app pool (default: driver default). Lets tests saturate it deliberately. */
   dbPoolMax?: number;
-  /** Size of the dedicated pool behind ctx.dbOutsideTransaction / ctx.outsideTransaction. */
+  /** Size of the dedicated pool behind ctx.db.outsideTransaction / ctx.outsideTransaction. */
   outsideTransactionPoolMax?: number;
   /** Forwarded to buildServer — when set, requests without a JWT pass
    *  through as anonymous instead of 401. See AnonymousAccessConfig.
@@ -187,7 +190,7 @@ export type TestStackOptions = {
   ) => Promise<
     import("@cosmicdrift/kumiko-framework/api").ServerOptions["anonymousAccess"] | undefined
   >;
-  /** Opt-in JobRunner wired into ctx.jobRunner and merged into
+  /** Opt-in JobRunner wired into ctx.services.jobRunner and merged into
    *  dispatcherOptions so event-triggered jobs enqueue on commit — mirrors
    *  the prod entrypoint's `buildJobRunnerWithHook`. Unlike prod (which
    *  always builds one), this only builds a runner when `registry.getAllJobs()`
@@ -254,6 +257,8 @@ export type TestStackOptions = {
    *  entities across features included). Use it with the app's complete feature
    *  composition; the default only checks what is safe on a feature subset. */
   validateBoot?: "full";
+  /** Postgres tenant isolation, as in prod. "on" (default) runs the stack as the non-bypass role kumiko_app against policies; "off" uses the superuser without policies. */
+  rowLevelSecurity?: import("@cosmicdrift/kumiko-framework/db").RowLevelSecurityMode;
 };
 
 const DEFAULT_JWT_SECRET = "test-stack-secret-minimum-32-characters!!";