@intentius/chant-lexicon-sql 0.116.0 → 0.118.0

package/src/postgres/apply/statements.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "vitest";
-import { alterSteps, columnDefinition, constraintSql, createSteps, dropStatement, splitStatements, type PgStep } from "./statements";
+import { alterSteps, columnDefinition, constraintSql, createSteps, dropStatement, planPgStatements, splitStatements, type PgStep } from "./statements";
 import { declaredObjects } from "./apply";
 import { keyedByQualifiedName, pgSchemaFromLive, type PgSchemaObject } from "../plan/schema";
 import { diffPgSchemas, matchPgObjects } from "../plan/diff";
@@ -31,7 +31,10 @@ describe("columns", () => {
       "ALTER TABLE app.t ALTER COLUMN b DROP DEFAULT",
     ]);
     expect(sql(steps(T, "CREATE TABLE app.t (a text, b text NOT NULL)", "CREATE TABLE app.t (a text NOT NULL, b text)"))).toEqual([
+      "ALTER TABLE app.t ADD CONSTRAINT a__chant_nn CHECK (a IS NOT NULL) NOT VALID",
+      "ALTER TABLE app.t VALIDATE CONSTRAINT a__chant_nn",
       "ALTER TABLE app.t ALTER COLUMN a SET NOT NULL",
+      "ALTER TABLE app.t DROP CONSTRAINT a__chant_nn",
       "ALTER TABLE app.t ALTER COLUMN b DROP NOT NULL",
     ]);
   });
@@ -62,19 +65,52 @@ describe("constraints", () => {
     expect(added.steps[0]).toMatchObject({ class: "metadata", rule: "SQLPG217" });
     const validated = steps(T, "CREATE TABLE app.t (a int, CONSTRAINT a_pos CHECK (a > 0) NOT VALID)", "CREATE TABLE app.t (a int, CONSTRAINT a_pos CHECK (a > 0))");
     expect(sql(validated)).toEqual(["ALTER TABLE app.t VALIDATE CONSTRAINT a_pos"]);
-    expect(validated.steps[0]).toMatchObject({ class: "validate", rule: "SQLPG220" });
+    expect(validated.steps[0]).toMatchObject({ class: "validate", rule: "SQLPG220", precheck: { sql: "SELECT count(*) AS n FROM app.t WHERE NOT (a > 0)" } });
+    expect(added.steps[0]!.precheck).toBeUndefined();
   });
 
-  test("a column-level foreign key is added as a table constraint", () => {
+  test("a column-level foreign key is added NOT VALID as a table constraint, then validated", () => {
     const r = steps(T, "CREATE TABLE app.o (u bigint)", "CREATE TABLE app.o (u bigint REFERENCES app.users (id) ON DELETE CASCADE)");
-    expect(sql(r)).toEqual(["ALTER TABLE app.o ADD FOREIGN KEY (u) REFERENCES app.users (id) ON DELETE CASCADE"]);
-    expect(r.steps[0]).toMatchObject({ class: "validate", rule: "SQLPG219" });
+    expect(sql(r)).toEqual([expect.stringMatching(/^ALTER TABLE app\.o ADD CONSTRAINT o_[0-9a-f]{8}_fkey FOREIGN KEY \(u\) REFERENCES app\.users \(id\) ON DELETE CASCADE NOT VALID$/), expect.stringMatching(/^ALTER TABLE app\.o VALIDATE CONSTRAINT o_[0-9a-f]{8}_fkey$/)]);
+    expect(r.steps[0]).toMatchObject({
+      class: "metadata",
+      rule: "SQLPG217",
+      precheck: { sql: "SELECT count(*) AS n FROM app.o AS c WHERE c.u IS NOT NULL AND NOT EXISTS (SELECT 1 FROM app.users AS p WHERE p.id = c.u)" },
+    });
+    expect(r.steps[1]).toMatchObject({ class: "validate", rule: "SQLPG220", transactional: true });
+    expect(r.steps[1]!.precheck).toBeUndefined();
+  });
+
+  test("a CHECK on a table that exists is added NOT VALID, then validated (#3703)", () => {
+    const r = steps(T, "CREATE TABLE app.t (a int)", "CREATE TABLE app.t (a int, CONSTRAINT a_pos CHECK (a > 0))");
+    expect(r.steps.map((s) => [s.sql, s.class, s.rule])).toEqual([
+      ["ALTER TABLE app.t ADD CONSTRAINT a_pos CHECK (a > 0) NOT VALID", "metadata", "SQLPG217"],
+      ["ALTER TABLE app.t VALIDATE CONSTRAINT a_pos", "validate", "SQLPG220"],
+    ]);
+    // Interrupted after the first statement: the server holds it NOT VALID, and the next run only validates it.
+    const resumed = steps(T, "CREATE TABLE app.t (a int, CONSTRAINT a_pos CHECK (a > 0) NOT VALID)", "CREATE TABLE app.t (a int, CONSTRAINT a_pos CHECK (a > 0))");
+    expect(resumed.steps.map((s) => [s.sql, s.class, s.rule])).toEqual([["ALTER TABLE app.t VALIDATE CONSTRAINT a_pos", "validate", "SQLPG220"]]);
+    // An unnamed check is given a name for VALIDATE, and that named constraint still matches the unnamed declaration.
+    const unnamed = steps(T, "CREATE TABLE app.t (a int)", "CREATE TABLE app.t (a int CHECK (a > 0))");
+    expect(sql(unnamed)).toEqual([expect.stringMatching(/^ALTER TABLE app\.t ADD CONSTRAINT t_[0-9a-f]{8}_check CHECK \(a > 0\) NOT VALID$/), expect.stringMatching(/^ALTER TABLE app\.t VALIDATE CONSTRAINT t_[0-9a-f]{8}_check$/)]);
+    const given = /CONSTRAINT (\S+)/.exec(unnamed.steps[0]!.sql)![1];
+    expect(steps(T, `CREATE TABLE app.t (a int, CONSTRAINT ${given} CHECK (a > 0) NOT VALID)`, "CREATE TABLE app.t (a int CHECK (a > 0))").steps.map((s) => s.sql)).toEqual([`ALTER TABLE app.t VALIDATE CONSTRAINT ${given}`]);
   });
 
   test("a unique constraint is an index built CONCURRENTLY, then the constraint made from it", () => {
     const r = steps(T, "CREATE TABLE app.t (email text)", "CREATE TABLE app.t (email text UNIQUE)");
     expect(r.steps).toEqual([
-      { sql: "CREATE UNIQUE INDEX CONCURRENTLY t_email_key ON app.t (email)", class: "concurrently", rule: "SQLPG221", transactional: false, buildsIndex: "app.t_email_key" },
+      {
+        sql: "CREATE UNIQUE INDEX CONCURRENTLY t_email_key ON app.t (email)",
+        class: "concurrently",
+        rule: "SQLPG221",
+        transactional: false,
+        buildsIndex: "app.t_email_key",
+        precheck: {
+          sql: "SELECT (SELECT count(*) FROM (SELECT 1 FROM app.t WHERE email IS NOT NULL GROUP BY email HAVING count(*) > 1) AS duplicates) AS n",
+          detail: "values of (email) held by more than one row, which a unique index fails on",
+        },
+      },
       { sql: "ALTER TABLE app.t ADD CONSTRAINT t_email_key UNIQUE USING INDEX t_email_key", class: "metadata", rule: "SQLPG221", transactional: true },
     ]);
   });
@@ -153,3 +189,99 @@ describe("create and drop", () => {
     ]);
   });
 });
+
+describe("safe sequences and pre-checks (#3686)", () => {
+  test("SET NOT NULL on a table that exists is a NOT VALID check, its validation, SET NOT NULL and the check dropped, each classified", () => {
+    const r = steps(T, "CREATE TABLE app.t (a text)", "CREATE TABLE app.t (a text NOT NULL)");
+    expect(r.steps.map((s) => [s.sql, s.class, s.rule, s.transactional])).toEqual([
+      ["ALTER TABLE app.t ADD CONSTRAINT a__chant_nn CHECK (a IS NOT NULL) NOT VALID", "metadata", "SQLPG217", true],
+      ["ALTER TABLE app.t VALIDATE CONSTRAINT a__chant_nn", "validate", "SQLPG220", true],
+      ["ALTER TABLE app.t ALTER COLUMN a SET NOT NULL", "metadata", "SQLPG210", true],
+      ["ALTER TABLE app.t DROP CONSTRAINT a__chant_nn", "metadata", "SQLPG223", true],
+    ]);
+    // The NULL count goes with the first statement, so a caller checks it before anything runs.
+    expect(r.steps[0]!.precheck).toEqual({ sql: "SELECT count(*) AS n FROM app.t WHERE a IS NULL", detail: "rows where a is NULL, which SET NOT NULL fails on" });
+    expect(r.steps.slice(1).every((s) => s.precheck === undefined)).toBe(true);
+  });
+
+  test("the plan classes the change as a validation, the same on every supported major", () => {
+    for (const major of [14, 18]) {
+      expect(sql(steps(T, "CREATE TABLE app.t (a text)", "CREATE TABLE app.t (a text NOT NULL)", major))).toHaveLength(4);
+    }
+  });
+
+  test("a check left by an interrupted run is validated as found, not added again or dropped as undeclared", () => {
+    const r = steps(T, "CREATE TABLE app.t (a text, CONSTRAINT a__chant_nn CHECK (a IS NOT NULL) NOT VALID)", "CREATE TABLE app.t (a text NOT NULL)");
+    expect(sql(r)).toEqual([
+      "ALTER TABLE app.t VALIDATE CONSTRAINT a__chant_nn",
+      "ALTER TABLE app.t ALTER COLUMN a SET NOT NULL",
+      "ALTER TABLE app.t DROP CONSTRAINT a__chant_nn",
+    ]);
+    expect(r.steps[0]!.precheck?.sql).toBe("SELECT count(*) AS n FROM app.t WHERE a IS NULL");
+  });
+
+  test("a valid declared check that proves NOT NULL keeps SET NOT NULL to one statement", () => {
+    const r = steps(T, "CREATE TABLE app.t (a text, CONSTRAINT a_nn CHECK (a IS NOT NULL))", "CREATE TABLE app.t (a text NOT NULL, CONSTRAINT a_nn CHECK (a IS NOT NULL))");
+    expect(r.steps.map((s) => [s.sql, s.class])).toEqual([["ALTER TABLE app.t ALTER COLUMN a SET NOT NULL", "metadata"]]);
+  });
+
+  test("a primary key counts duplicates and NULL keys; NULLS NOT DISTINCT counts NULLs as equal", () => {
+    const pk = steps(T, "CREATE TABLE app.t (a int, b int)", "CREATE TABLE app.t (a int, b int, PRIMARY KEY (a, b))");
+    // The key's columns become NOT NULL first, each with its own sequence and NULL count.
+    expect(pk.steps.filter((s) => s.precheck).map((s) => s.rule)).toEqual(["SQLPG217", "SQLPG217", "SQLPG221"]);
+    expect(pk.steps.find((s) => s.rule === "SQLPG221")!.precheck?.sql).toBe(
+      "SELECT (SELECT count(*) FROM (SELECT 1 FROM app.t GROUP BY a, b HAVING count(*) > 1) AS duplicates) + (SELECT count(*) FROM app.t WHERE a IS NULL OR b IS NULL) AS n",
+    );
+    const nnd = steps(T, "CREATE TABLE app.t (a int)", "CREATE TABLE app.t (a int, UNIQUE NULLS NOT DISTINCT (a))");
+    expect(nnd.steps[0]!.precheck?.sql).toBe("SELECT (SELECT count(*) FROM (SELECT 1 FROM app.t GROUP BY a HAVING count(*) > 1) AS duplicates) AS n");
+  });
+
+  test("a CHECK added valid counts the rows it refuses; a NOT ENFORCED one has nothing to check", () => {
+    const r = steps(T, "CREATE TABLE app.t (a int)", "CREATE TABLE app.t (a int, CONSTRAINT a_pos CHECK (a > 0))");
+    expect(r.steps[0]).toMatchObject({ rule: "SQLPG217", precheck: { sql: "SELECT count(*) AS n FROM app.t WHERE NOT (a > 0)", detail: "rows that fail the check a_pos (a > 0)" } });
+    const unenforced = steps(T, "CREATE TABLE app.t (a int)", "CREATE TABLE app.t (a int, CONSTRAINT a_pos CHECK (a > 0) NOT ENFORCED)");
+    expect(unenforced.steps[0]!.precheck).toBeUndefined();
+  });
+
+  test("a foreign key with no referenced columns, or MATCH FULL, carries no pre-check", () => {
+    expect(steps(T, "CREATE TABLE app.o (u bigint)", "CREATE TABLE app.o (u bigint REFERENCES app.users)").steps[0]!.precheck).toBeUndefined();
+    expect(steps(T, "CREATE TABLE app.o (u bigint)", "CREATE TABLE app.o (u bigint REFERENCES app.users (id) MATCH FULL)").steps[0]!.precheck).toBeUndefined();
+  });
+});
+
+describe("a trigger or policy on a table", () => {
+  const TABLE = "CREATE TABLE app.t (id int)";
+  const declared = declaredObjects(
+    JSON.stringify({
+      dialect: "postgres",
+      objects: [
+        { export: "t", type: T, dependsOn: [], ddl: TABLE },
+        { export: "f", type: "Postgres::Function", dependsOn: [], ddl: "CREATE FUNCTION app.f() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RETURN NEW; END $$" },
+        { export: "g", type: "Postgres::Trigger", dependsOn: ["t", "f"], ddl: "CREATE TRIGGER g BEFORE INSERT ON app.t FOR EACH ROW EXECUTE FUNCTION app.f()" },
+        { export: "p", type: "Postgres::Policy", dependsOn: ["t"], ddl: "CREATE POLICY p ON app.t USING (true)" },
+      ],
+    }),
+  );
+  /** The create steps of the trigger and the policy, the table already on the server or not. */
+  function created(live: LivePgObject[]): Record<string, PgStep[]> {
+    const after: PgSchemaObject[] = declared.map((o) => ({ key: o.key, canonical: o.canonical }));
+    const current = pgSchemaFromLive(live, "public");
+    const plan = planPgStatements({ declared, changes: diffPgSchemas(current, after).changes, current, major: 18 });
+    return Object.fromEntries(plan.objects.flatMap((o) => (o.verdict === "create" ? [[o.obj.exportName, o.steps]] : [])));
+  }
+
+  test("on an existing table, the CREATE carries the lock rule and its class", () => {
+    const r = created([{ type: T, statement: TABLE, name: "t", oid: "1" } as unknown as LivePgObject]);
+    expect(r.t).toBeUndefined();
+    expect(r.g![0]).toMatchObject({ rule: "SQLPG283", class: "metadata" });
+    expect(r.g![0]!.sql).toMatch(/^CREATE TRIGGER g/);
+    expect(r.p![0]).toMatchObject({ rule: "SQLPG290", class: "metadata" });
+  });
+
+  test("on a table this plan creates, it is part of the create", () => {
+    const r = created([]);
+    expect(r.t![0]).toMatchObject({ rule: "SQLPG200", class: "create" });
+    expect(r.g![0]).toMatchObject({ rule: "SQLPG200", class: "create" });
+    expect(r.p![0]).toMatchObject({ rule: "SQLPG200", class: "create" });
+  });
+});

package/src/postgres/apply/statements.ts

@@ -20,6 +20,7 @@
  * transaction block at all (`CREATE INDEX CONCURRENTLY` may not).
  */
 
+import { createHash } from "node:crypto";
 import type { OwnershipMarker } from "@intentius/chant/ownership";
 import { stampedComment } from "../../core/ownership";
 import { isTrivia, tokenizeText, type Token } from "../tokens";
@@ -29,10 +30,13 @@ import { POSTGRES_ENTITY_TYPES, type PostgresEntityType } from "../entity-types"
 import { addConstraintRule, matchPgObjects } from "../plan/diff";
 import type { PgChange } from "../plan/diff";
 import { PG_CLASSIFIER_RULES, type PgChangeClass, type PgClassifierRuleId } from "../plan/rules";
-import { canonicalOptions, sameConstraint, type CanonicalConstraint, type CanonicalKind } from "../plan/normalize";
+import { ACCESS_KINDS, canonicalOptions, sameConstraint, type CanonicalConstraint, type CanonicalKind } from "../plan/normalize";
 import type { PgDiffObject, PgSchemaObject } from "../plan/schema";
 import { migrationTarget } from "../migrate/handoff";
-import type { CheckDef, ColumnDef, DomainProps, ExclusionDef, ForeignKeyDef, KeyDef, SequenceProps, TableProps } from "../entities";
+import { pgName } from "../migrate/names";
+import type { CheckDef, ColumnDef, DomainProps, ExclusionDef, ForeignKeyDef, IndexProps, KeyDef, PolicyProps, SequenceProps, TableProps } from "../entities";
+
+const same = (a: unknown, b: unknown) => JSON.stringify(a) === JSON.stringify(b);
 
 /** One object as a build declares it, in the shape the applier works with. */
 export interface DeclaredPgObject {
@@ -64,6 +68,21 @@ export interface PgStep {
   rule?: PgClassifierRuleId;
   /** An index this statement builds CONCURRENTLY: a failed build leaves it INVALID, and the applier drops it again. */
   buildsIndex?: string;
+  /** A query to run before the statement, whose success depends on the rows already in the table (#3686). */
+  precheck?: PgPrecheck;
+}
+
+/**
+ * A data-dependent statement's pre-check (#3686): a query that returns one
+ * row with one column, `n`, the count of rows (or groups of rows) the
+ * statement would fail on. Zero means it can run. Nothing runs it on its own:
+ * a caller runs every step's pre-check before the first statement, and stops
+ * when one is not zero. It reads the table without locking it beyond `SELECT`.
+ */
+export interface PgPrecheck {
+  sql: string;
+  /** What a count above zero means, e.g. `rows where email is NULL, which SET NOT NULL fails on`. */
+  detail: string;
 }
 
 /** What {@link alterSteps} could not make in place: changes with no statement, each with why. */
@@ -86,9 +105,9 @@ export const pgQualified = (schema: string | undefined, name: string): string =>
  * trigger with its table (`touch ON app.users`).
  */
 export const objectIdent = (o: { kind: CanonicalKind; schema?: string; name: string; signature?: string }): string =>
-  o.kind === "schema" || o.kind === "extension"
+  o.kind === "schema" || o.kind === "extension" || o.kind === "role"
     ? quoteIdent(o.name)
-    : o.kind === "trigger"
+    : o.kind === "trigger" || o.kind === "policy"
       ? `${quoteIdent(o.name)}${o.signature ?? ""}`
       : `${pgQualified(o.schema, o.name)}${o.signature ?? ""}`;
 
@@ -106,6 +125,10 @@ export const KIND_WORDS: Readonly<Record<CanonicalKind, string>> = {
   function: "FUNCTION",
   procedure: "PROCEDURE",
   trigger: "TRIGGER",
+  policy: "POLICY",
+  role: "ROLE",
+  grant: "GRANT",
+  defaultPrivileges: "DEFAULT PRIVILEGES",
 };
 
 /** The canonical kind of an entity type. */
@@ -115,6 +138,56 @@ export const kindOfType = (type: string): CanonicalKind =>
 const step = (sql: string, cls: PgChangeClass, rule?: PgClassifierRuleId, transactional = true): PgStep => ({ sql, class: cls, transactional, ...(rule ? { rule } : {}) });
 const classOf = (rule: PgClassifierRuleId): PgChangeClass => PG_CLASSIFIER_RULES[rule].class;
 
+// ── Pre-checks (#3686) ─────────────────────────────────────────────────
+
+/** The rows of `table` with `column` NULL: what SET NOT NULL fails on. */
+export function nullPrecheck(table: string, column: string): PgPrecheck {
+  return { sql: `SELECT count(*) AS n FROM ${table} WHERE ${quoteIdent(column)} IS NULL`, detail: `rows where ${column} is NULL, which SET NOT NULL fails on` };
+}
+
+/**
+ * The groups of rows of `table` with the same `columns`: what a unique index
+ * or a unique or primary key constraint fails on. NULLs are distinct unless
+ * `nullsNotDistinct`; a primary key also counts the rows with a NULL key
+ * column, which its implied NOT NULL fails on. `where` is a partial index's
+ * predicate.
+ */
+export function duplicatePrecheck(table: string, columns: readonly string[], opts: { primaryKey?: boolean; nullsNotDistinct?: boolean; where?: string } = {}): PgPrecheck {
+  const cols = columns.map(quoteIdent);
+  const filter = [...(opts.primaryKey || opts.nullsNotDistinct ? [] : cols.map((c) => `${c} IS NOT NULL`)), ...(opts.where ? [`(${opts.where})`] : [])];
+  const groups = `SELECT count(*) FROM (SELECT 1 FROM ${table}${filter.length ? ` WHERE ${filter.join(" AND ")}` : ""} GROUP BY ${cols.join(", ")} HAVING count(*) > 1) AS duplicates`;
+  const what = columns.join(", ");
+  if (!opts.primaryKey) return { sql: `SELECT (${groups}) AS n`, detail: `values of (${what}) held by more than one row, which a unique index fails on` };
+  return {
+    sql: `SELECT (${groups}) + (SELECT count(*) FROM ${table} WHERE ${cols.map((c) => `${c} IS NULL`).join(" OR ")}) AS n`,
+    detail: `values of (${what}) held by more than one row, and rows with one of them NULL, which a primary key fails on`,
+  };
+}
+
+/** The rows of `table` that fail a CHECK: its expression false (a NULL result passes). */
+export function checkPrecheck(table: string, expr: string, name?: string): PgPrecheck {
+  return { sql: `SELECT count(*) AS n FROM ${table} WHERE NOT (${expr})`, detail: `rows that fail the check${name ? ` ${name}` : ""} (${expr})` };
+}
+
+/**
+ * The rows of `table` whose foreign key references no row: every key column
+ * set and no referenced row with those values (MATCH SIMPLE, the default).
+ * Undefined for a foreign key that names no referenced columns or is MATCH
+ * FULL, which the query does not cover.
+ */
+export function foreignKeyPrecheck(table: string, fk: ForeignKeyDef): PgPrecheck | undefined {
+  if (fk.refColumns.length !== fk.columns.length || (fk.match !== undefined && fk.match.toUpperCase() !== "SIMPLE")) return undefined;
+  const child = fk.columns.map((c) => `c.${quoteIdent(c)}`);
+  const join = fk.refColumns.map((r, i) => `p.${quoteIdent(r)} = ${child[i]}`).join(" AND ");
+  return {
+    sql: `SELECT count(*) AS n FROM ${table} AS c WHERE ${child.map((c) => `${c} IS NOT NULL`).join(" AND ")} AND NOT EXISTS (SELECT 1 FROM ${fk.refTable} AS p WHERE ${join})`,
+    detail: `rows whose (${fk.columns.join(", ")}) references no row of ${fk.refTable}, which the foreign key${fk.name ? ` ${fk.name}` : ""} fails on`,
+  };
+}
+
+/** The check that proves a column NOT NULL while SET NOT NULL runs (SQLPG210), named as the migration Op names its own. */
+export const notNullCheckName = (column: string): string => pgName(`${column}__chant_nn`);
+
 // ── Statements in a template ───────────────────────────────────────────
 
 interface Statement {
@@ -172,12 +245,14 @@ export function commentStatement(obj: Pick<DeclaredPgObject, "canonical">, marke
 export function createSteps(
   obj: Pick<DeclaredPgObject, "ddl" | "canonical" | "props">,
   marker: OwnershipMarker | undefined,
-  opts: { base?: string; orReplace?: boolean; cls?: PgChangeClass; rule?: PgClassifierRuleId } = {},
+  opts: { base?: string; orReplace?: boolean; cls?: PgChangeClass; rule?: PgClassifierRuleId; access?: boolean } = {},
 ): PgStep[] {
   const cls = opts.cls ?? "create";
   const out: PgStep[] = [];
   splitStatements(obj.ddl).forEach((s, i) => {
     if (i > 0 && isOwnComment(s, obj.canonical.kind)) return;
+    // A table's row-level security is access, which only a profile that manages access applies.
+    if (i > 0 && opts.access === false && firstNode(s)?.statement === "rowSecurity") return;
     let sql = s.text;
     const replaceable = obj.canonical.kind === "view" || obj.canonical.kind === "function" || obj.canonical.kind === "procedure" || (obj.canonical.kind === "trigger" && obj.canonical.fields.constraint !== true);
     if (i === 0 && opts.orReplace && replaceable && !/^\s*CREATE\s+OR\s+REPLACE\b/i.test(sql)) sql = sql.replace(/\bCREATE\s+/i, "CREATE OR REPLACE ");
@@ -192,7 +267,7 @@ export function createSteps(
 export function dropStatement(kind: CanonicalKind, schema: string | undefined, name: string, signature?: string): PgStep {
   const what = objectIdent({ kind, ...(schema !== undefined ? { schema } : {}), name, ...(signature !== undefined ? { signature } : {}) });
   if (kind === "index") return step(`DROP INDEX CONCURRENTLY ${what}`, "concurrently", "SQLPG242", false);
-  return step(`DROP ${KIND_WORDS[kind]} ${what}`, "drop", kind === "trigger" ? "SQLPG285" : "SQLPG270");
+  return step(`DROP ${KIND_WORDS[kind]} ${what}`, "drop", kind === "trigger" ? "SQLPG285" : kind === "policy" ? "SQLPG292" : "SQLPG270");
 }
 
 // ── Columns ────────────────────────────────────────────────────────────
@@ -318,7 +393,11 @@ function keyConstraintSteps(table: { schema?: string; name: string }, kind: "PRI
     .filter(Boolean)
     .join(" ");
   return [
-    { ...step(build, "concurrently", "SQLPG221", false), buildsIndex: index },
+    {
+      ...step(build, "concurrently", "SQLPG221", false),
+      buildsIndex: index,
+      precheck: duplicatePrecheck(pgQualified(table.schema, table.name), k.columns, { primaryKey: kind === "PRIMARY KEY", ...(k.nullsNotDistinct ? { nullsNotDistinct: true } : {}) }),
+    },
     step(
       [`ALTER TABLE ${pgQualified(table.schema, table.name)} ADD CONSTRAINT ${quoteIdent(name)} ${kind} USING INDEX ${quoteIdent(name)}`, deferralSql(k)].filter(Boolean).join(" "),
       "metadata",
@@ -327,6 +406,31 @@ function keyConstraintSteps(table: { schema?: string; name: string }, kind: "PRI
   ];
 }
 
+/**
+ * A CHECK (SQLPG218) or a foreign key (SQLPG219) added to a table that
+ * exists, without reading its rows under a lock that blocks writes: the
+ * constraint added NOT VALID, which checks new rows only (SQLPG217), then
+ * validated (SQLPG220), which reads the rows under SHARE UPDATE EXCLUSIVE
+ * while writes go on. The applier commits between the two, since their
+ * classes differ, so the validation runs in a transaction of its own. A run
+ * interrupted after the first statement leaves the constraint NOT VALID on
+ * the server, and the next plan validates it as found. The first statement
+ * carries the pre-check (the rows the check or the foreign key refuses).
+ * VALIDATE needs a name, so a constraint declared without one is given
+ * {@link unnamedConstraintName}'s; the diff matches an unnamed declaration
+ * to the constraint by its body, whatever it is called.
+ */
+/** The name given to a CHECK or foreign key declared without one: `<table>_<hash of its body>_check` or `_fkey`. */
+export function unnamedConstraintName(table: string, c: Pick<CanonicalConstraint, "kind" | "body">): string {
+  const hash = createHash("sha256").update(c.body).digest("hex").slice(0, 8);
+  return pgName(`${table}_${hash}_${c.kind === "CHECK" ? "check" : "fkey"}`);
+}
+
+function notValidThenValidateSteps(alter: string, kind: "CHECK" | "FOREIGN KEY", def: CheckDef | ForeignKeyDef, precheck: PgPrecheck | undefined): PgStep[] {
+  const add = step(`${alter} ADD ${constraintSql(kind, { ...def, notValid: true })}`, "metadata", "SQLPG217");
+  return [precheck ? { ...add, precheck } : add, step(`${alter} VALIDATE CONSTRAINT ${quoteIdent(def.name!)}`, "validate", "SQLPG220")];
+}
+
 /**
  * The constraint changes of a table or a domain, matched the way the diff
  * matches them (`../plan/diff.ts`): a declared constraint the server lacks is
@@ -334,15 +438,20 @@ function keyConstraintSteps(table: { schema?: string; name: string }, kind: "PRI
  * validated, one the declaration lost is dropped, and a changed comment is
  * set.
  */
-function constraintSteps(obj: DeclaredPgObject, live: PgDiffObject): PgStep[] {
+function constraintSteps(obj: DeclaredPgObject, live: PgDiffObject, keep: ReadonlySet<string> = new Set()): PgStep[] {
   const domain = obj.canonical.kind === "domain";
   const target = objectIdent(obj.canonical);
   const alter = domain ? `ALTER DOMAIN ${target}` : `ALTER TABLE ${target}`;
   const defs = domain
     ? (obj.props as unknown as DomainProps).checks.map((def) => ({ kind: "CHECK" as const, def: def as CheckDef }))
     : declaredConstraintDefs(obj.props as unknown as TableProps);
-  const remaining = [...live.constraints];
+  // A NOT NULL proof left by an interrupted SET NOT NULL (SQLPG210) is that sequence's to reuse and drop.
+  const remaining = live.constraints.filter((b) => !(b.name && keep.has(b.name)));
   const out: PgStep[] = [];
+  /** What the rows must pass for a CHECK or a foreign key to be valid. */
+  const precheckOf = (kind: CanonicalConstraint["kind"], def: unknown): PgPrecheck | undefined =>
+    domain || def === undefined ? undefined : kind === "CHECK" ? checkPrecheck(target, (def as CheckDef).expr, (def as CheckDef).name) : kind === "FOREIGN KEY" ? foreignKeyPrecheck(target, def as ForeignKeyDef) : undefined;
+  const withPrecheck = (s: PgStep, p: PgPrecheck | undefined): PgStep => (p ? { ...s, precheck: p } : s);
   obj.canonical.constraints.forEach((a, i) => {
     const def = defs[i]?.def;
     const at = remaining.findIndex((b) => sameConstraint(a, b));
@@ -353,9 +462,13 @@ function constraintSteps(obj: DeclaredPgObject, live: PgDiffObject): PgStep[] {
         out.push(step(`${alter} ADD ${named(c.name)}CHECK (${c.expr})${c.notValid ? " NOT VALID" : ""}`, c.notValid ? "metadata" : "validate", c.notValid ? "SQLPG217" : "SQLPG262"));
       } else if ((a.kind === "PRIMARY KEY" || a.kind === "UNIQUE") && !a.notValid) {
         out.push(...keyConstraintSteps(obj.canonical, a.kind, def as KeyDef));
+      } else if ((a.kind === "CHECK" || a.kind === "FOREIGN KEY") && !a.notValid && !(def as { notEnforced?: boolean }).notEnforced) {
+        const d = def as CheckDef | ForeignKeyDef;
+        const withName = d.name ? d : { ...d, name: unnamedConstraintName(obj.canonical.name, a) };
+        out.push(...notValidThenValidateSteps(alter, a.kind, withName, precheckOf(a.kind, withName)));
       } else {
         const rule = addConstraintRule(a);
-        out.push(step(`${alter} ADD ${constraintSql(a.kind, def)}`, classOf(rule), rule));
+        out.push(withPrecheck(step(`${alter} ADD ${constraintSql(a.kind, def)}`, classOf(rule), rule), rule === "SQLPG217" || (def as { notEnforced?: boolean }).notEnforced ? undefined : precheckOf(a.kind, def)));
       }
       if (a.comment !== undefined) {
         const name = a.name ?? (def as { name?: string }).name;
@@ -366,7 +479,7 @@ function constraintSteps(obj: DeclaredPgObject, live: PgDiffObject): PgStep[] {
     const b = remaining.splice(at, 1)[0]!;
     const name = b.name ?? a.name;
     if (!name) return;
-    if (b.notValid && !a.notValid) out.push(step(`${alter} VALIDATE CONSTRAINT ${quoteIdent(name)}`, "validate", "SQLPG220"));
+    if (b.notValid && !a.notValid) out.push(withPrecheck(step(`${alter} VALIDATE CONSTRAINT ${quoteIdent(name)}`, "validate", "SQLPG220"), precheckOf(a.kind, def)));
     if (b.comment !== a.comment) {
       out.push(step(`COMMENT ON CONSTRAINT ${quoteIdent(name)} ON ${domain ? "DOMAIN " : ""}${target} IS ${a.comment === undefined ? "NULL" : pgString(a.comment)}`, "metadata", "SQLPG216"));
     }
@@ -417,6 +530,31 @@ export const isDestructive = (c: PgChange): boolean => c.rule === "SQLPG204";
 /** Changes that replace the object: drop it and create it again from its declaration. */
 export const isRecreate = (c: PgChange): boolean => c.rule === "SQLPG252" || c.rule === "SQLPG243" || c.rule === "SQLPG281";
 
+/**
+ * SET NOT NULL on a table that exists, without reading the table under
+ * ACCESS EXCLUSIVE (SQLPG210): a CHECK (column IS NOT NULL) added NOT VALID,
+ * which reads no rows; validated, which reads them under SHARE UPDATE
+ * EXCLUSIVE while writes go on; then SET NOT NULL, which the valid check
+ * proves without a scan (12 and later), and the check dropped. The applier
+ * commits between the catalog changes and the validation, so the brief
+ * ACCESS EXCLUSIVE locks are never held across the scan. A check left by an
+ * interrupted run is validated as found. The first statement carries the
+ * NULL count as its pre-check. 18's `NOT NULL ... NOT VALID` would save the
+ * last statement; the check is used on every major for one sequence.
+ */
+export function setNotNullSteps(table: string, column: string, live?: Pick<PgDiffObject, "constraints">): PgStep[] {
+  const check = quoteIdent(notNullCheckName(column));
+  const left = live?.constraints.some((k) => k.name === notNullCheckName(column)) ?? false;
+  const steps = [
+    ...(left ? [] : [step(`ALTER TABLE ${table} ADD CONSTRAINT ${check} CHECK (${quoteIdent(column)} IS NOT NULL) NOT VALID`, "metadata", "SQLPG217")]),
+    step(`ALTER TABLE ${table} VALIDATE CONSTRAINT ${check}`, "validate", "SQLPG220"),
+    step(`ALTER TABLE ${table} ALTER COLUMN ${quoteIdent(column)} SET NOT NULL`, "metadata", "SQLPG210"),
+    step(`ALTER TABLE ${table} DROP CONSTRAINT ${check}`, "metadata", "SQLPG223"),
+  ];
+  steps[0] = { ...steps[0]!, precheck: nullPrecheck(table, column) };
+  return steps;
+}
+
 /**
  * The statements for an object that exists on the server, change by change.
  * `live` is the server's definition, matched to the declaration (a renamed
@@ -440,6 +578,7 @@ export function alterSteps(
   const declaredColumns = new Map(d.columns.map((c) => [c.name, c]));
   let constraintsDone = false;
   let recreated = false;
+  const notNullChecks = new Set(changes.filter((c) => c.rule === "SQLPG210" && c.class !== "metadata").map((c) => notNullCheckName(COLUMN_FIELD.exec(c.field)?.[1] ?? "")));
 
   for (const c of changes) {
     const no = (why: string) => unsupported.push({ change: c, why });
@@ -452,7 +591,7 @@ export function alterSteps(
       continue;
     }
     if (c.field.startsWith("constraints.")) {
-      if (!constraintsDone) steps.push(...constraintSteps(obj, live));
+      if (!constraintsDone) steps.push(...constraintSteps(obj, live, notNullChecks));
       constraintsDone = true;
       continue;
     }
@@ -483,7 +622,9 @@ export function alterSteps(
           steps.push(step(def?.default !== undefined ? `${column} SET DEFAULT ${def.default}` : `${column} DROP DEFAULT`, c.class, c.rule));
           break;
         case "SQLPG210":
-          steps.push(step(`${column} SET NOT NULL`, c.class, c.rule));
+          // A valid check the server already holds proves it (the diff classes that metadata): SET NOT NULL alone.
+          if (c.class === "metadata") steps.push(step(`${column} SET NOT NULL`, c.class, c.rule));
+          else steps.push(...setNotNullSteps(target, name, live));
           break;
         case "SQLPG211":
           steps.push(step(`${column} DROP NOT NULL`, c.class, c.rule));
@@ -553,6 +694,36 @@ export function alterSteps(
       case "SQLPG280":
         steps.push(...createSteps(obj, opts.marker, { orReplace: true, cls: c.class, rule: c.rule }).slice(0, 1));
         break;
+      case "SQLPG291": {
+        const p = obj.props as unknown as PolicyProps;
+        const recreate =
+          ["table", "restrictive", "command"].some((k) => !same(d.fields[k], live.fields[k])) ||
+          (live.fields.using !== undefined && d.fields.using === undefined) ||
+          (live.fields.check !== undefined && d.fields.check === undefined);
+        if (recreate) {
+          steps.push(step(`DROP POLICY ${objectIdent(live)}`, c.class, c.rule));
+          steps.push(...createSteps(obj, opts.marker, { cls: c.class, rule: c.rule }));
+        } else {
+          const roles = p.roles.map((r) => (r === "public" ? "PUBLIC" : quoteIdent(r))).join(", ");
+          steps.push(step([`ALTER POLICY ${objectIdent(d)} TO ${roles}`, p.using ? `USING (${p.using})` : "", p.check ? `WITH CHECK (${p.check})` : ""].filter(Boolean).join(" "), c.class, c.rule));
+        }
+        break;
+      }
+      case "SQLPG293":
+        if (!same(d.fields.rowSecurity, live.fields.rowSecurity)) steps.push(step(`${alterKind} ${d.fields.rowSecurity ? "ENABLE" : "DISABLE"} ROW LEVEL SECURITY`, c.class, c.rule));
+        if (!same(d.fields.forceRowSecurity, live.fields.forceRowSecurity)) steps.push(step(`${alterKind} ${d.fields.forceRowSecurity ? "FORCE" : "NO FORCE"} ROW LEVEL SECURITY`, c.class, c.rule));
+        break;
+      case "SQLPG294": {
+        if (steps.some((x) => x.rule === "SQLPG294")) break;
+        const want = new Set((d.fields.attributes as string[] | undefined) ?? []);
+        const have = new Set((live.fields.attributes as string[] | undefined) ?? []);
+        const flip = (a: string) => (a.startsWith("no") ? a.slice(2) : `no${a}`);
+        // An attribute at its default is in neither set: write the side that changes.
+        const words = [...[...want].filter((a) => !have.has(a)), ...[...have].filter((a) => !want.has(a)).map(flip)];
+        const limit = d.fields.connectionLimit !== live.fields.connectionLimit ? [`CONNECTION LIMIT ${String(d.fields.connectionLimit ?? -1)}`] : [];
+        steps.push(step(`ALTER ROLE ${objectIdent(d)} WITH ${[...words.map((w) => w.toUpperCase()), ...limit].join(" ")}`, c.class, c.rule));
+        break;
+      }
       case "SQLPG284":
         if (d.fields.constraint === true || live.fields.constraint === true || d.signature !== live.signature) {
           steps.push(step(`DROP TRIGGER ${objectIdent(live)}`, c.class, c.rule));
@@ -674,6 +845,8 @@ export interface PgStatementPlanInput {
   carriesMarker?: (live: PgDiffObject, currentKey: string) => boolean;
   /** The comment an extension's control file sets, kept under the trailer when the declaration sets none. */
   extensionComment?: (name: string) => string | undefined;
+  /** Whether access is managed: off, a table is created without its row-level security statements. Default: on. */
+  access?: boolean;
 }
 
 export interface PgStatementPlan {
@@ -683,8 +856,14 @@ export interface PgStatementPlan {
   drops: PgDropStatement[];
 }
 
+/** The rules that create an object, which label its create statements. */
+const CREATE_RULES: ReadonlySet<string> = new Set(["SQLPG200", "SQLPG240", "SQLPG241", "SQLPG283", "SQLPG290"]);
+
 /** Drop order: what reads from a table before the table, types after the tables using them, a schema last. */
 const DROP_ORDER: Record<CanonicalKind, number> = {
+  grant: 0,
+  defaultPrivileges: 0,
+  policy: 0,
   trigger: 0,
   materializedView: 1,
   view: 2,
@@ -698,8 +877,16 @@ const DROP_ORDER: Record<CanonicalKind, number> = {
   enum: 8,
   extension: 9,
   schema: 10,
+  // A role is the cluster's: never dropped by a prune (`../live/catalog.ts` reads only the declared ones).
+  role: 11,
 };
 
+/** A unique index's duplicate count, when every element is a plain column; undefined otherwise. */
+function uniqueIndexPrecheck(p: IndexProps): PgPrecheck | undefined {
+  if (!p.unique || p.elements.length === 0 || p.elements.some((e) => e.column === undefined)) return undefined;
+  return duplicatePrecheck(p.tableName, p.elements.map((e) => e.column!), { ...(p.nullsNotDistinct ? { nullsNotDistinct: true } : {}), ...(p.where ? { where: p.where } : {}) });
+}
+
 /**
  * The statements that take the current schema to the declared one, from the
  * classified changes between them. Pure: nothing is read or sent. The applier
@@ -718,7 +905,8 @@ export function planPgStatements(input: PgStatementPlanInput): PgStatementPlan {
   }
 
   const recreatedRelations = new Set<string>();
-  const objects = input.declared.map((obj): PgObjectStatements => {
+  // Grants and default privileges are access, made by their own statements (`../access/acl.ts`).
+  const objects = input.declared.filter((obj) => !ACCESS_KINDS.has(obj.canonical.kind)).map((obj): PgObjectStatements => {
     const key = keyOf(obj);
     const currentKey = matched.get(key);
     const live = currentKey !== undefined ? currentByKey.get(currentKey) : undefined;
@@ -744,9 +932,13 @@ export function planPgStatements(input: PgStatementPlanInput): PgStatementPlan {
     const onRecreated = obj.canonical.kind === "index" && recreatedRelations.has(String(obj.canonical.fields.table));
     if (!live || onRecreated) {
       const base = obj.canonical.kind === "extension" && !live ? input.extensionComment?.(obj.canonical.name) : undefined;
-      // An index on a table that exists is built under the scan timeout (SQLPG240, SQLPG241); one on a new table is part of the create.
-      const how = mine.find((c) => c.rule === "SQLPG200" || c.rule === "SQLPG240" || c.rule === "SQLPG241");
-      const steps = createSteps(obj, input.marker, { ...(base !== undefined ? { base } : {}), ...(how ? { cls: how.class, rule: how.rule } : {}) });
+      // An index on a table that exists is built under the scan timeout (SQLPG240, SQLPG241), and a trigger or policy
+      // on one locks it (SQLPG283, SQLPG290); on a new table each is part of the create (SQLPG200).
+      const how = mine.find((c) => CREATE_RULES.has(c.rule));
+      const steps = createSteps(obj, input.marker, { ...(base !== undefined ? { base } : {}), ...(how ? { cls: how.class, rule: how.rule } : {}), ...(input.access === false ? { access: false } : {}) });
+      // A unique index on a table that has rows fails on duplicates: its build carries their count.
+      const unique = how && how.rule !== "SQLPG200" && obj.canonical.kind === "index" ? uniqueIndexPrecheck(obj.props as unknown as IndexProps) : undefined;
+      if (unique && steps[0]) steps[0] = { ...steps[0], precheck: unique };
       return { verdict: "create", obj, changes: mine, steps, ...withLive };
     }
 
@@ -770,7 +962,7 @@ export function planPgStatements(input: PgStatementPlanInput): PgStatementPlan {
 
   const drops: PgDropStatement[] = [];
   for (const c of input.changes) {
-    if (!((c.rule === "SQLPG270" || c.rule === "SQLPG242" || c.rule === "SQLPG285") && c.after === undefined)) continue;
+    if (!((c.rule === "SQLPG270" || c.rule === "SQLPG242" || c.rule === "SQLPG285" || c.rule === "SQLPG292") && c.after === undefined)) continue;
     const o = currentByKey.get(c.object);
     if (!o || o.foreign) continue;
     const schema = o.kind === "schema" || o.kind === "extension" ? undefined : o.schema;