@mikro-orm/sql 7.1.16-dev.1 → 7.1.16-dev.11

package/dialects/sqlite/SqlitePlatform.d.ts

@@ -6,6 +6,8 @@ import { SqliteExceptionConverter } from './SqliteExceptionConverter.js';
 export declare class SqlitePlatform extends AbstractSqlPlatform {
     protected readonly schemaHelper: SqliteSchemaHelper;
     protected readonly exceptionConverter: SqliteExceptionConverter;
+    /** sqlite treats null as the lowest value when no placement is requested. */
+    sortsNullsLowest(): boolean;
     /** @internal */
     createNativeQueryBuilder(): SqliteNativeQueryBuilder;
     usesDefaultKeyword(): boolean;

package/dialects/sqlite/SqlitePlatform.js

@@ -5,6 +5,10 @@ import { SqliteExceptionConverter } from './SqliteExceptionConverter.js';
 export class SqlitePlatform extends AbstractSqlPlatform {
     schemaHelper = new SqliteSchemaHelper(this);
     exceptionConverter = new SqliteExceptionConverter();
+    /** sqlite treats null as the lowest value when no placement is requested. */
+    sortsNullsLowest() {
+        return true;
+    }
     /** @internal */
     createNativeQueryBuilder() {
         return new SqliteNativeQueryBuilder(this);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/sql",
-  "version": "7.1.16-dev.1",
+  "version": "7.1.16-dev.11",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",
@@ -53,7 +53,7 @@
     "@mikro-orm/core": "^7.1.15"
   },
   "peerDependencies": {
-    "@mikro-orm/core": "7.1.16-dev.1"
+    "@mikro-orm/core": "7.1.16-dev.11"
   },
   "engines": {
     "node": ">= 22.17.0"

package/query/ObjectCriteriaNode.d.ts

@@ -13,6 +13,7 @@ export declare class ObjectCriteriaNode<T extends object> extends CriteriaNode<T
     private inlineArrayChildPayload;
     private inlineChildPayload;
     private inlineCondition;
+    private isCollectionOperator;
     private shouldAutoJoin;
     private autoJoin;
     private isPrefixed;

package/query/ObjectCriteriaNode.js

@@ -1,7 +1,7 @@
 import { ALIAS_REPLACEMENT, GroupOperator, QueryFlag, raw, RawQueryFragment, ReferenceKind, Utils, } from '@mikro-orm/core';
 import { CriteriaNode } from './CriteriaNode.js';
 import { JoinType, QueryType } from './enums.js';
-const COLLECTION_OPERATORS = ['$some', '$none', '$every', '$size'];
+const COLLECTION_OPERATORS = ['$some', '$none', '$every', '$size', '$all'];
 /**
  * @internal
  */
@@ -17,7 +17,7 @@ export class ObjectCriteriaNode extends CriteriaNode {
             alias = nestedAlias;
         }
         if (this.shouldAutoJoin(qb, nestedAlias)) {
-            if (keys.some(k => COLLECTION_OPERATORS.includes(k))) {
+            if (keys.some(k => this.isCollectionOperator(k))) {
                 if (![ReferenceKind.MANY_TO_MANY, ReferenceKind.ONE_TO_MANY].includes(this.prop.kind)) {
                     // ignore collection operators when used on a non-relational property - this can happen when they get into
                     // populateWhere via `infer` on m:n properties with select-in strategy
@@ -34,11 +34,24 @@ export class ObjectCriteriaNode extends CriteriaNode {
                 const primaryKeys = parentMeta.primaryKeys.map(pk => {
                     return [QueryType.SELECT, QueryType.COUNT].includes(qb.type) ? `${knownKey ? alias : ownerAlias}.${pk}` : pk;
                 });
+                const conditions = [];
+                let matchNothing = false;
                 for (const key of keys) {
                     if (typeof key !== 'string' || !COLLECTION_OPERATORS.includes(key)) {
                         throw new Error('Mixing collection operators with other filters is not allowed.');
                     }
                     const payload = this.payload[key].unwrap();
+                    // `$all` requires every listed item to be present, which is an intersection of `$some` conditions
+                    if (key === '$all') {
+                        // an empty `$all` matches nothing, same as in mongo
+                        matchNothing ||= payload.length === 0;
+                        conditions.push(...payload.map(item => ['$some', item]));
+                    }
+                    else {
+                        conditions.push([key, payload]);
+                    }
+                }
+                for (const [key, payload] of conditions) {
                     // entities with a fixed schema must resolve the `from` table's own schema in the subquery,
                     // otherwise a nested operator inherits the root entity's schema (GH #7894); for wildcard or
                     // schema-less entities the schema is resolved dynamically and needs to be carried over
@@ -70,6 +83,9 @@ export class ObjectCriteriaNode extends CriteriaNode {
                         [Utils.getPrimaryKeyHash(primaryKeys)]: { [op]: sub.getNativeQuery().toRaw() },
                     });
                 }
+                if (matchNothing) {
+                    $and.push({ [Utils.getPrimaryKeyHash(primaryKeys)]: { $in: [] } });
+                }
                 if ($and.length === 1) {
                     return $and[0];
                 }
@@ -154,7 +170,7 @@ export class ObjectCriteriaNode extends CriteriaNode {
             alias = nestedAlias;
         }
         if (this.shouldAutoJoin(qb, nestedAlias)) {
-            return !keys.some(k => COLLECTION_OPERATORS.includes(k));
+            return !keys.some(k => this.isCollectionOperator(k));
         }
         return keys.some(field => {
             const childNode = this.payload[field];
@@ -238,6 +254,14 @@ export class ObjectCriteriaNode extends CriteriaNode {
         delete o[key];
         o.$and = $and;
     }
+    isCollectionOperator(key) {
+        if (typeof key !== 'string' || !COLLECTION_OPERATORS.includes(key)) {
+            return false;
+        }
+        // `$all` is primarily a mongo array operator, in SQL it is supported only on collections
+        return (key !== '$all' ||
+            (!!this.prop && [ReferenceKind.MANY_TO_MANY, ReferenceKind.ONE_TO_MANY].includes(this.prop.kind)));
+    }
     shouldAutoJoin(qb, nestedAlias) {
         if (!this.prop || !this.parent) {
             return false;
@@ -246,7 +270,7 @@ export class ObjectCriteriaNode extends CriteriaNode {
         if (keys.every(k => typeof k === 'string' && k.includes('.') && k.startsWith(`${qb.alias}.`))) {
             return false;
         }
-        if (keys.some(k => COLLECTION_OPERATORS.includes(k))) {
+        if (keys.some(k => this.isCollectionOperator(k))) {
             return true;
         }
         const meta = this.metadata.find(this.entityName);

package/query/QueryBuilder.js

@@ -1065,17 +1065,26 @@ export class QueryBuilder {
             this.limit(1);
         }
         const query = this.toQuery();
-        const cached = await this.em?.tryCache(this.mainAlias.entityName, this.#state.cache, [
-            'qb.execute',
-            query.sql,
-            query.params,
-            method,
-        ]);
+        const cacheKey = ['qb.execute', query.sql, query.params, method];
+        // session context (row level security) scopes cached rows per tenant/role, avoiding cross-context serves
+        const qbSessionContext = this.em?.getSessionContext();
+        if (qbSessionContext) {
+            cacheKey.push(qbSessionContext);
+        }
+        const cached = await this.em?.tryCache(this.mainAlias.entityName, this.#state.cache, cacheKey);
         if (cached?.data !== undefined) {
             return cached.data;
         }
         const loggerContext = { id: this.em?.id, ...this.loggerContext, ...this.#abortOptions };
-        const res = await this.getConnection().execute(query.sql, query.params, method, this.context, loggerContext);
+        const conn = this.getConnection();
+        // outside a transaction, wrap in a short implicit one so RLS `set local` session context applies (no-op when unset)
+        const sessionContext = this.context ? undefined : this.em?.getTransactionSessionContext();
+        const res = await (sessionContext
+            ? conn.transactional(trx => conn.execute(query.sql, query.params, method, trx, loggerContext), {
+                sessionContext,
+                loggerContext,
+            })
+            : conn.execute(query.sql, query.params, method, this.context, loggerContext));
         const meta = this.mainAlias.meta;
         if (!options.mapResults || !meta) {
             await this.em?.storeCache(this.#state.cache, cached, res);
@@ -1125,6 +1134,11 @@ export class QueryBuilder {
      * ```
      */
     async *stream(options) {
+        // mirror EntityManager.stream — a stream can't open the implicit session-context transaction, so under the
+        // 'transaction' strategy fail closed instead of silently running the cursor without the staged context
+        if (!this.context && this.em?.getTransactionSessionContext()) {
+            throw ValidationError.sessionContextStreamRequiresTransaction();
+        }
         options ??= {};
         options.mergeResults ??= true;
         options.mapResults ??= true;

package/query/QueryBuilderHelper.js

@@ -643,6 +643,10 @@ export class QueryBuilderHelper {
         return '?';
     }
     getOperatorReplacement(op, value) {
+        // collection properties expand `$all` into `$some` sub-queries in `ObjectCriteriaNode`, nothing else has a SQL equivalent
+        if (op === '$all') {
+            throw new Error('The `$all` operator is supported only on collection properties in SQL drivers, use `$contains` for array columns instead.');
+        }
         let replacement = QueryOperator[op];
         if (op === '$exists') {
             replacement = value[op] ? 'is not' : 'is';

package/schema/DatabaseSchema.d.ts

@@ -48,6 +48,10 @@ export declare class DatabaseSchema {
     /** Separate from `create()` so the comparator only pays for routine introspection when the user actually defined routines. SQLite/libSQL helpers return []. */
     loadRoutines(connection: AbstractSqlConnection, platform: AbstractSqlPlatform, schemas?: string[]): Promise<void>;
     static fromMetadata(metadata: EntityMetadata[], platform: AbstractSqlPlatform, config: Configuration, schemaName?: string, em?: any): DatabaseSchema;
+    /** Compiles an `rls`-flagged filter's condition into a resolved policy backed by `current_setting()` lookups. */
+    private static compileRlsFilterPolicy;
+    /** Truncates the base first so the collision suffix survives the identifier limit. */
+    private static uniquePolicyName;
     /** Separate from {@link fromMetadata} so the comparator only walks routines when the user defined any. */
     addRoutinesFromMetadata(routines: readonly Routine[], platform: AbstractSqlPlatform, em?: any): void;
     /**

package/schema/DatabaseSchema.js

@@ -1,4 +1,4 @@
-import { ReferenceKind, isRaw, } from '@mikro-orm/core';
+import { ReferenceKind, MetadataError, QueryHelper, Utils, isRaw, } from '@mikro-orm/core';
 import { DatabaseTable } from './DatabaseTable.js';
 import { normalizeViewDefinition } from './SchemaHelper.js';
 import { getTablePartitioning } from './partitioning.js';
@@ -262,9 +262,115 @@ export class DatabaseSchema {
                     expression: trigger.expression,
                 });
             }
+            // non-empty policies imply RLS; `rowLevelSecurity: 'force'` enforces it for the table owner too, but an
+            // explicit `rowLevelSecurity: false` keeps RLS disabled even when policies are staged (they stay dormant)
+            table.rlsEnabled = meta.rowLevelSecurity !== false && (meta.policies.length > 0 || !!meta.rowLevelSecurity);
+            table.rlsForced = meta.rowLevelSecurity === 'force';
+            const usedPolicyNames = new Set();
+            const resolve = (raw) => {
+                if (raw == null) {
+                    return undefined;
+                }
+                return isRaw(raw) ? platform.formatQuery(raw.sql, raw.params) : raw;
+            };
+            for (const policy of meta.policies) {
+                const command = policy.command ?? 'all';
+                // deterministic default name derived from table + command + collision index, truncated the
+                // same way check names are, so the introspected (engine-truncated) name matches metadata
+                const max = platform.getMaxIdentifierLength();
+                let name = policy.name;
+                if (!name) {
+                    name = this.uniquePolicyName(`${meta.collection}_${command}_policy`, platform, usedPolicyNames);
+                }
+                else {
+                    name = name.substring(0, max);
+                    // explicit names skip the collision suffixing, so a duplicate would otherwise die with a raw pg error
+                    // on create or be silently swallowed by the name-keyed diff dictionaries — reject it up front
+                    if (usedPolicyNames.has(name)) {
+                        throw MetadataError.duplicatePolicyName(meta, name);
+                    }
+                    usedPolicyNames.add(name);
+                }
+                table.addPolicy({
+                    name,
+                    command,
+                    type: policy.type ?? 'permissive',
+                    roles: policy.roles ?? [],
+                    using: resolve(policy.using),
+                    check: resolve(policy.check),
+                });
+            }
+            // rls-flagged filters materialize as additional permissive policies (app-level WHERE + DB-level policy);
+            // filters inherited from a TPT parent are skipped — the policy already lives on the parent table, and the
+            // child table may not even have the referenced columns
+            const rlsFilters = Object.values(meta.filters).filter(filter => filter.rls && !(meta.tptParent && Object.values(meta.tptParent.filters).includes(filter)));
+            if (rlsFilters.length > 0) {
+                // an explicit `rowLevelSecurity: false` still stages the filter's policy but keeps RLS off (dormant)
+                table.rlsEnabled = meta.rowLevelSecurity !== false;
+                for (const filter of rlsFilters) {
+                    table.addPolicy(this.compileRlsFilterPolicy(meta, filter, table, platform, usedPolicyNames));
+                }
+            }
         }
         return schema;
     }
+    /** Compiles an `rls`-flagged filter's condition into a resolved policy backed by `current_setting()` lookups. */
+    static compileRlsFilterPolicy(meta, filter, table, platform, usedPolicyNames) {
+        const accessed = new Set();
+        const cond = QueryHelper.resolveRlsFilterCond(filter, accessed, meta.className);
+        const setting = typeof filter.rls === 'object' ? filter.rls.setting : undefined;
+        if (setting && accessed.size > 1) {
+            throw MetadataError.rlsFilterMultiArgSetting(filter.name, [...accessed]);
+        }
+        // the config-bound driver is always an `AbstractSqlDriver` here, like in `DatabaseTable.processIndexWhere`
+        const driver = platform.getConfig().getDriver();
+        let sql = driver.renderPartialIndexWhere(meta.class, cond);
+        const prefix = QueryHelper.RLS_SENTINEL_PREFIX;
+        const suffix = QueryHelper.RLS_SENTINEL_SUFFIX;
+        // match `"<column>" <op> '<sentinel>'` — the LHS is always a quoted column emitted from this entity's own
+        // where; group 1 keeps the column + operator so only the sentinel literal is swapped for the session lookup
+        const re = new RegExp(`("([^"]+)"\\s*(?:!=|>=|<=|=|>|<)\\s*)'${prefix}(\\w+)${suffix}'`, 'g');
+        sql = sql.replace(re, (_whole, lhs, column, arg) => {
+            const col = table.getColumn(column);
+            // the condition can reference a property that renders a field name without a managed column
+            // (`persist: false`, `skipColumns`) — fail with a descriptive error instead of a crash
+            if (!col) {
+                throw MetadataError.rlsFilterUnmanagedColumn(filter.name, column);
+            }
+            // native enum columns compare against the enum type itself, `current_setting()` text won't coerce implicitly
+            const cast = col.nativeEnumName
+                ? `::${platform.quoteIdentifier(col.nativeEnumName)}`
+                : platform.getCurrentSettingCast(col.mappedType);
+            if (cast === null) {
+                throw MetadataError.rlsFilterUncastableType(filter.name, col.type);
+            }
+            // a sentinel implies the arg was accessed, and multi-arg custom settings were already rejected above
+            const name = setting || Utils.getRlsSettingName(filter.name, arg);
+            return `${lhs}current_setting(${platform.quoteValue(name)})${cast}`;
+        });
+        // a leftover sentinel means an argument appeared somewhere other than a direct comparison, which we can't compile
+        if (sql.includes(prefix)) {
+            throw MetadataError.rlsFilterUnsupportedCond(filter.name);
+        }
+        return {
+            name: this.uniquePolicyName(`${meta.collection}_${filter.name}_policy`, platform, usedPolicyNames),
+            command: 'all',
+            type: 'permissive',
+            roles: [],
+            using: sql,
+        };
+    }
+    /** Truncates the base first so the collision suffix survives the identifier limit. */
+    static uniquePolicyName(base, platform, used) {
+        const max = platform.getMaxIdentifierLength();
+        let name = base.substring(0, max);
+        for (let i = 2; used.has(name); i++) {
+            const suffix = `_${i}`;
+            name = base.substring(0, max - suffix.length) + suffix;
+        }
+        used.add(name);
+        return name;
+    }
     /** Separate from {@link fromMetadata} so the comparator only walks routines when the user defined any. */
     addRoutinesFromMetadata(routines, platform, em) {
         const resolveBody = (raw) => {

package/schema/DatabaseTable.d.ts

@@ -1,6 +1,6 @@
 import { type Configuration, type DeferMode, type Dictionary, type EntityMetadata, type EntityProperty, type IndexCallback, type NamingStrategy } from '@mikro-orm/core';
 import type { SchemaHelper } from './SchemaHelper.js';
-import type { CheckDef, Column, ForeignKey, IndexDef, TablePartitioning, SqlTriggerDef } from '../typings.js';
+import type { CheckDef, Column, ForeignKey, IndexDef, TablePartitioning, SqlPolicyDef, SqlTriggerDef } from '../typings.js';
 import type { AbstractSqlPlatform } from '../AbstractSqlPlatform.js';
 /**
  * @internal
@@ -15,6 +15,10 @@ export declare class DatabaseTable {
         items: string[];
     }>;
     comment?: string;
+    /** Whether row level security is enabled on the table (postgres only). */
+    rlsEnabled: boolean;
+    /** Whether row level security is also enforced for the table owner (postgres `force`). */
+    rlsForced: boolean;
     partitioning?: TablePartitioning;
     /**
      * Effective collation the column defaults to when no explicit `COLLATE` is set on a column.
@@ -34,6 +38,11 @@ export declare class DatabaseTable {
     /** @internal */
     setPartitioning(partitioning?: TablePartitioning): void;
     getTriggers(): SqlTriggerDef[];
+    getPolicies(): SqlPolicyDef[];
+    /** `[]` and `['public']` both mean PUBLIC — a single predicate so metadata, introspection and codegen agree. */
+    static isDefaultPolicyRoles(roles: string[]): boolean;
+    /** @internal */
+    setPolicies(policies: SqlPolicyDef[]): void;
     /** @internal */
     setIndexes(indexes: IndexDef[]): void;
     /** @internal */
@@ -65,6 +74,8 @@ export declare class DatabaseTable {
     hasCheck(checkName: string): boolean;
     getTrigger(triggerName: string): SqlTriggerDef | undefined;
     hasTrigger(triggerName: string): boolean;
+    getPolicy(policyName: string): SqlPolicyDef | undefined;
+    hasPolicy(policyName: string): boolean;
     getPrimaryKey(): IndexDef | undefined;
     hasPrimaryKey(): boolean;
     private getForeignKeyDeclaration;
@@ -99,5 +110,6 @@ export declare class DatabaseTable {
     private processIndexWhere;
     addCheck(check: CheckDef): void;
     addTrigger(trigger: SqlTriggerDef): void;
+    addPolicy(policy: SqlPolicyDef): void;
     toJSON(): Dictionary;
 }

package/schema/DatabaseTable.js

@@ -10,10 +10,15 @@ export class DatabaseTable {
     #indexes = [];
     #checks = [];
     #triggers = [];
+    #policies = [];
     #foreignKeys = {};
     #platform;
     nativeEnums = {}; // for postgres
     comment;
+    /** Whether row level security is enabled on the table (postgres only). */
+    rlsEnabled = false;
+    /** Whether row level security is also enforced for the table owner (postgres `force`). */
+    rlsForced = false;
     partitioning;
     /**
      * Effective collation the column defaults to when no explicit `COLLATE` is set on a column.
@@ -55,6 +60,17 @@ export class DatabaseTable {
     getTriggers() {
         return this.#triggers;
     }
+    getPolicies() {
+        return this.#policies;
+    }
+    /** `[]` and `['public']` both mean PUBLIC — a single predicate so metadata, introspection and codegen agree. */
+    static isDefaultPolicyRoles(roles) {
+        return roles.length === 0 || (roles.length === 1 && roles[0] === 'public');
+    }
+    /** @internal */
+    setPolicies(policies) {
+        this.#policies = policies;
+    }
     /** @internal */
     setIndexes(indexes) {
         this.#indexes = indexes;
@@ -670,6 +686,12 @@ export class DatabaseTable {
     hasTrigger(triggerName) {
         return !!this.getTrigger(triggerName);
     }
+    getPolicy(policyName) {
+        return this.#policies.find(p => p.name === policyName);
+    }
+    hasPolicy(policyName) {
+        return !!this.getPolicy(policyName);
+    }
     getPrimaryKey() {
         return this.#indexes.find(i => i.primary);
     }
@@ -990,6 +1012,9 @@ export class DatabaseTable {
     addTrigger(trigger) {
         this.#triggers.push(trigger);
     }
+    addPolicy(policy) {
+        this.#policies.push(policy);
+    }
     toJSON() {
         const columns = this.#columns;
         // locale-independent comparison so the snapshot is stable across machines
@@ -1123,13 +1148,26 @@ export class DatabaseTable {
             }
             return out;
         };
+        const normalizePolicy = (policy) => {
+            const out = { name: policy.name, command: policy.command, type: policy.type };
+            if (!DatabaseTable.isDefaultPolicyRoles(policy.roles)) {
+                out.roles = [...policy.roles].sort(byString);
+            }
+            for (const field of ['using', 'check']) {
+                if (policy[field]) {
+                    out[field] = policy[field];
+                }
+            }
+            return out;
+        };
         const sortedIndexes = [...this.#indexes].sort((a, b) => byString(a.keyName, b.keyName)).map(normalizeIndex);
         const sortedChecks = [...this.#checks].sort((a, b) => byString(a.name, b.name)).map(normalizeCheck);
         const sortedTriggers = [...this.#triggers].sort((a, b) => byString(a.name, b.name));
+        const sortedPolicies = [...this.#policies].sort((a, b) => byString(a.name, b.name)).map(normalizePolicy);
         const sortedForeignKeys = Object.fromEntries(Object.entries(this.#foreignKeys)
             .sort(([a], [b]) => byString(a, b))
             .map(([k, v]) => [k, normalizeFk(v)]));
-        return {
+        const ret = {
             name: this.name,
             schema: this.schema,
             columns: columnsMapped,
@@ -1142,5 +1180,16 @@ export class DatabaseTable {
             // platforms that can't read comments back (sqlite), where keeping it would flip the snapshot
             comment: supportsComments ? this.comment || null : null,
         };
+        // emit RLS state only when set, so snapshots of non-RLS tables stay byte-for-byte unchanged
+        if (sortedPolicies.length > 0) {
+            ret.policies = sortedPolicies;
+        }
+        if (this.rlsEnabled) {
+            ret.rlsEnabled = true;
+        }
+        if (this.rlsForced) {
+            ret.rlsForced = true;
+        }
+        return ret;
     }
 }

package/schema/SchemaComparator.d.ts

@@ -88,6 +88,8 @@ export declare class SchemaComparator {
      */
     private diffViewExpression;
     private diffTrigger;
+    private diffPolicies;
+    private diffPolicy;
     parseJsonDefault(defaultValue?: string | null): Dictionary | string | null;
     private parseDecimalDefault;
     hasSameDefaultValue(from: Column, to: Column): boolean;

package/schema/SchemaComparator.js

@@ -328,6 +328,7 @@ export class SchemaComparator {
             addedIndexes: {},
             addedChecks: {},
             addedTriggers: {},
+            addedPolicies: {},
             changedColumns: {},
             changedForeignKeys: {},
             changedIndexes: {},
@@ -338,6 +339,7 @@ export class SchemaComparator {
             removedIndexes: {},
             removedChecks: {},
             removedTriggers: {},
+            removedPolicies: {},
             renamedColumns: {},
             renamedIndexes: {},
             fromTable,
@@ -517,6 +519,9 @@ export class SchemaComparator {
                 }
             }
         }
+        if (this.#platform.supportsRowLevelSecurity()) {
+            changes += this.diffPolicies(fromTable, toTable, tableDifferences);
+        }
         const fromForeignKeys = { ...fromTable.getForeignKeys() };
         const toForeignKeys = { ...toTable.getForeignKeys() };
         for (const fromConstraint of Object.values(fromForeignKeys)) {
@@ -908,6 +913,10 @@ export class SchemaComparator {
                 // multi word type names in casts, the generic `::\w+` below only covers single word ones
                 // the precision is kept, so `timestamptz(3)` and `timestamp(3) with time zone` leave the same residue
                 .replace(/::\s*(?:character\s+varying|bit\s+varying|double\s+precision|(?:timestamp|time)\b(\s*\(\d+\))?(?:\s+with(?:out)?\s+time\s+zone)?)/gi, '$1')
+                // Protect dots inside string literals before the quote strip below, or the alias-prefix normalization
+                // would mangle literal contents — `current_setting('app.tenant')` and `current_setting('req.tenant')`
+                // must not both collapse to `current_settingtenant`
+                .replace(/'([^']*)'/g, (_, inner) => `'${inner.replaceAll('.', '\u0000')}'`)
                 // Remove quotes first so we can process identifiers
                 .replace(/['"`]/g, '')
                 // MySQL adds table/alias prefixes to columns (e.g., a.name or table_name.column vs just column)
@@ -985,6 +994,87 @@ export class SchemaComparator {
         }
         return this.diffExpression(from.body, to.body);
     }
+    diffPolicies(fromTable, toTable, diff) {
+        let changes = 0;
+        // `ignorePolicies` makes RLS create-only: declared policies are still added and RLS is still enabled/forced,
+        // but existing policies are never diffed for drop/alter and RLS is never disabled or unforced — this protects
+        // hand-written policies on databases that adopted RLS before the ORM managed it
+        const ignorePolicies = this.#platform.getConfig().get('schemaGenerator').ignorePolicies;
+        // postgres rejects `alter column ... type` on a column referenced by any policy, so a type change forces us to
+        // drop every still-present policy around the alter (dropped before via `getRlsDropSQL`, recreated after via
+        // `getRlsAlterSQL`) even when the policy itself is otherwise unchanged; a `generated`-only change is emitted
+        // as a drop + re-add of the same column, which a policy's column dependency blocks the same way
+        const hasColumnTypeChange = Object.values(diff.changedColumns).some(c => c.changedProperties.has('type')) ||
+            Object.keys(diff.removedColumns).some(name => name in diff.addedColumns);
+        for (const policy of toTable.getPolicies()) {
+            if (!fromTable.hasPolicy(policy.name)) {
+                diff.addedPolicies[policy.name] = policy;
+                this.log(`policy ${policy.name} added to table ${diff.name}`, { policy });
+                changes++;
+            }
+        }
+        if (fromTable.rlsEnabled !== toTable.rlsEnabled && (!ignorePolicies || toTable.rlsEnabled)) {
+            diff.changedRlsEnabled = toTable.rlsEnabled;
+            changes++;
+        }
+        if (fromTable.rlsForced !== toTable.rlsForced && (!ignorePolicies || toTable.rlsForced)) {
+            diff.changedRlsForced = toTable.rlsForced;
+            changes++;
+        }
+        if (ignorePolicies) {
+            // existing policies are unmanaged here, but a type change still needs them dropped and recreated for the
+            // alter to succeed — recreate each verbatim from introspection so the hand-written definition is preserved
+            if (hasColumnTypeChange) {
+                for (const policy of fromTable.getPolicies()) {
+                    diff.removedPolicies[policy.name] = policy;
+                    diff.addedPolicies[policy.name] = policy;
+                    changes += 2;
+                }
+            }
+            return changes;
+        }
+        for (const policy of fromTable.getPolicies()) {
+            const toPolicy = toTable.getPolicy(policy.name);
+            if (!toPolicy) {
+                diff.removedPolicies[policy.name] = policy;
+                this.log(`policy ${policy.name} removed from table ${diff.name}`);
+                changes++;
+                continue;
+            }
+            // changed policies are always dropped (before column drops, which the old expression can block via its
+            // column dependencies) and recreated (after column adds) — postgres could alter some of the changes in
+            // place, but not a policy's command or type, nor unset an expression
+            if (this.diffPolicy(policy, toPolicy)) {
+                diff.removedPolicies[policy.name] = policy;
+                diff.addedPolicies[policy.name] = toPolicy;
+                this.log(`policy ${policy.name} recreated in table ${diff.name}`, { from: policy, to: toPolicy });
+                changes += 2;
+                continue;
+            }
+            // an unchanged policy still blocks a type change on any column, so drop + recreate it around the alter
+            if (hasColumnTypeChange) {
+                diff.removedPolicies[policy.name] = policy;
+                diff.addedPolicies[policy.name] = toPolicy;
+                this.log(`policy ${policy.name} recreated around a column type change in table ${diff.name}`);
+                changes += 2;
+            }
+        }
+        return changes;
+    }
+    diffPolicy(from, to) {
+        // normalize so an omitted `roles` matches introspected `{public}`
+        const normalizeRoles = (roles) => DatabaseTable.isDefaultPolicyRoles(roles) ? '' : [...roles].sort().join(',');
+        if (from.command !== to.command || from.type !== to.type) {
+            return true;
+        }
+        if (normalizeRoles(from.roles) !== normalizeRoles(to.roles)) {
+            return true;
+        }
+        if (this.diffExpression(from.using ?? '', to.using ?? '')) {
+            return true;
+        }
+        return this.diffExpression(from.check ?? '', to.check ?? '');
+    }
     parseJsonDefault(defaultValue) {
         /* v8 ignore next */
         if (!defaultValue) {

package/schema/SchemaHelper.d.ts

@@ -154,6 +154,12 @@ export declare abstract class SchemaHelper {
     getChangeColumnCommentSQL(tableName: string, to: Column, schemaName?: string): string;
     /** Whether the column comment is part of the column declaration, as opposed to a separate statement. */
     protected hasInlineColumnComment(): boolean;
+    /** Row level security DDL for a freshly created table (enable/force + create policies). Postgres only. */
+    getRlsCreateSQL(table: DatabaseTable): string[];
+    /** Drops removed/changed row level security policies; emitted in the pre-alter phase, before any column drop or type alter a policy expression can block. Postgres only. */
+    getRlsDropSQL(diff: TableDifference, safe?: boolean): string[];
+    /** Row level security DDL for a table difference (enable/disable/force transitions + policy creation). Postgres only. */
+    getRlsAlterSQL(diff: TableDifference, safe?: boolean): string[];
     getNamespaces(connection: AbstractSqlConnection, ctx?: Transaction): Promise<string[]>;
     protected mapIndexes(indexes: IndexDef[]): Promise<IndexDef[]>;
     mapForeignKeys(fks: any[], tableName: string, schemaName?: string): Dictionary;

package/schema/SchemaHelper.js

@@ -504,6 +504,7 @@ export class SchemaHelper {
         if ('changedComment' in diff) {
             ret.push(this.alterTableComment(diff.toTable, diff.changedComment));
         }
+        this.append(ret, this.getRlsAlterSQL(diff, safe));
         return ret;
     }
     /** Returns SQL to add columns to an existing table. */
@@ -646,6 +647,18 @@ export class SchemaHelper {
     hasInlineColumnComment() {
         return false;
     }
+    /** Row level security DDL for a freshly created table (enable/force + create policies). Postgres only. */
+    getRlsCreateSQL(table) {
+        return [];
+    }
+    /** Drops removed/changed row level security policies; emitted in the pre-alter phase, before any column drop or type alter a policy expression can block. Postgres only. */
+    getRlsDropSQL(diff, safe) {
+        return [];
+    }
+    /** Row level security DDL for a table difference (enable/disable/force transitions + policy creation). Postgres only. */
+    getRlsAlterSQL(diff, safe) {
+        return [];
+    }
     async getNamespaces(connection, ctx) {
         return [];
     }
@@ -801,6 +814,8 @@ export class SchemaHelper {
             for (const trigger of table.getTriggers()) {
                 this.append(ret, this.createTrigger(table, trigger));
             }
+            // RLS policies can reference other tables, so they are deferred until every table exists (see the
+            // callers of getRlsCreateSQL in SqlSchemaGenerator) rather than emitted inline here
         }
         return ret;
     }