@mikro-orm/sql 7.1.16-dev.10 → 7.1.16-dev.12

package/AbstractSqlConnection.d.ts

@@ -1,5 +1,5 @@
 import { type ControlledTransaction, type Dialect, Kysely } from 'kysely';
-import { type AnyEntity, Connection, type Dictionary, type EntityData, type IsolationLevel, type LogContext, type LoggingOptions, type MaybePromise, type QueryResult, type RawQueryFragment, type Transaction, type TransactionEventBroadcaster } from '@mikro-orm/core';
+import { type AnyEntity, Connection, type Dictionary, type EntityData, type IsolationLevel, type LogContext, type LoggingOptions, type MaybePromise, type QueryResult, type RawQueryFragment, type SessionContext, type Transaction, type TransactionEventBroadcaster } from '@mikro-orm/core';
 import type { AbstractSqlPlatform } from './AbstractSqlPlatform.js';
 import { NativeQueryBuilder } from './query/NativeQueryBuilder.js';
 /** Base class for SQL database connections, built on top of Kysely. */
@@ -36,6 +36,13 @@ export declare abstract class AbstractSqlConnection extends Connection {
     getClient<T = any>(): Kysely<T>;
     /** Ensures the Kysely client is initialized, creating it asynchronously if needed. */
     initClient(): Promise<void>;
+    /**
+     * Guards `getNativeClient()` overrides — drivers only capture their client while building their
+     * own dialect, which `driverOptions` carrying a ready-made Kysely instance or dialect skips.
+     *
+     * @internal
+     */
+    protected requireNativeClient<T>(client: T | undefined | null): T;
     /** Executes a callback within a transaction, committing on success and rolling back on error. */
     transactional<T>(cb: (trx: Transaction<ControlledTransaction<any, any>>) => Promise<T>, options?: {
         isolationLevel?: IsolationLevel;
@@ -43,6 +50,7 @@ export declare abstract class AbstractSqlConnection extends Connection {
         ctx?: ControlledTransaction<any>;
         eventBroadcaster?: TransactionEventBroadcaster;
         loggerContext?: LogContext;
+        sessionContext?: SessionContext;
     }): Promise<T>;
     /** Begins a new transaction or creates a savepoint if a transaction context already exists. */
     begin(options?: {
@@ -51,7 +59,17 @@ export declare abstract class AbstractSqlConnection extends Connection {
         ctx?: ControlledTransaction<any, any>;
         eventBroadcaster?: TransactionEventBroadcaster;
         loggerContext?: LogContext;
+        sessionContext?: SessionContext;
     }): Promise<ControlledTransaction<any, any>>;
+    /** Applies session variables (`set_config`) and role (`set local role`) for the current transaction. */
+    private applySessionContext;
+    /**
+     * Quotes a role name as a single PostgreSQL identifier. Unlike `platform.quoteIdentifier`, which treats a dot as a
+     * schema qualifier, a role like `my.role` must be quoted whole (`"my.role"`) with embedded quotes doubled.
+     */
+    protected static quoteRole(role: string): string;
+    /** Serializes a session variable for `set_config()`; `Date` values use ISO 8601 so casts like `::timestamptz` parse. */
+    protected stringifySessionVariable(value: unknown): string;
     /** Commits the transaction or releases the savepoint. */
     commit(ctx: ControlledTransaction<any, any>, eventBroadcaster?: TransactionEventBroadcaster, loggerContext?: LogContext): Promise<void>;
     /** Rolls back the transaction or rolls back to the savepoint. */
@@ -67,9 +85,9 @@ export declare abstract class AbstractSqlConnection extends Connection {
     private waitForIdleTransaction;
     private prepareQuery;
     /** Executes a SQL query and returns the result based on the method: `'all'` for rows, `'get'` for single row, `'run'` for affected count. */
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[], method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[] | Dictionary<unknown>, method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
     /** Executes a SQL query and returns an async iterable that yields results row by row. */
-    stream<T extends EntityData<AnyEntity>>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[], ctx?: Transaction<Kysely<any>>, loggerContext?: LoggingOptions, chunkSize?: number): AsyncIterableIterator<T>;
+    stream<T extends EntityData<AnyEntity>>(query: string | NativeQueryBuilder | RawQueryFragment, params?: readonly unknown[] | Dictionary<unknown>, ctx?: Transaction<Kysely<any>>, loggerContext?: LoggingOptions, chunkSize?: number): AsyncIterableIterator<T>;
     /** @inheritDoc */
     executeDump(dump: string): Promise<void>;
     protected getSql(query: string, formatted: string, context?: LogContext): string;

package/AbstractSqlConnection.js

@@ -1,5 +1,5 @@
 import { CompiledQuery, Kysely } from 'kysely';
-import { Connection, EventType, isRaw, Utils, } from '@mikro-orm/core';
+import { Connection, EventType, isRaw, raw, Utils, } from '@mikro-orm/core';
 import { NativeQueryBuilder } from './query/NativeQueryBuilder.js';
 /**
  * Pulls cancellation controls out of a `loggerContext` payload, returning the abort options
@@ -101,6 +101,18 @@ export class AbstractSqlConnection extends Connection {
             await this.createKysely();
         }
     }
+    /**
+     * Guards `getNativeClient()` overrides — drivers only capture their client while building their
+     * own dialect, which `driverOptions` carrying a ready-made Kysely instance or dialect skips.
+     *
+     * @internal
+     */
+    requireNativeClient(client) {
+        if (client == null) {
+            throw new Error('The native client is not available, as it is owned by the Kysely instance or dialect passed via `driverOptions`. Access it through the object you provided there instead.');
+        }
+        return client;
+    }
     /** Executes a callback within a transaction, committing on success and rolling back on error. */
     async transactional(cb, options = {}) {
         const trx = await this.begin(options);
@@ -149,9 +161,43 @@ export class AbstractSqlConnection extends Connection {
         for (const query of this.platform.getBeginTransactionSQL(options)) {
             this.logQuery(query, options.loggerContext);
         }
+        if (options.sessionContext) {
+            try {
+                await this.applySessionContext(trx, options.sessionContext, options.loggerContext);
+            }
+            catch (e) {
+                // roll back the freshly opened transaction so the pooled connection is released, not leaked
+                await trx.rollback().execute();
+                this.logQuery(this.platform.getRollbackTransactionSQL(), options.loggerContext);
+                throw e;
+            }
+        }
         await options.eventBroadcaster?.dispatchEvent(EventType.afterTransactionStart, trx);
         return trx;
     }
+    /** Applies session variables (`set_config`) and role (`set local role`) for the current transaction. */
+    async applySessionContext(trx, sessionContext, loggerContext) {
+        const variables = Object.entries(sessionContext.variables ?? {});
+        if (variables.length > 0) {
+            const parts = variables.map(() => 'set_config(?, ?, true)').join(', ');
+            const params = variables.flatMap(([key, value]) => [key, this.stringifySessionVariable(value)]);
+            await this.execute(`select ${parts}`, params, 'run', trx, loggerContext);
+        }
+        if (sessionContext.role) {
+            await this.execute(`set local role ${AbstractSqlConnection.quoteRole(sessionContext.role)}`, [], 'run', trx, loggerContext);
+        }
+    }
+    /**
+     * Quotes a role name as a single PostgreSQL identifier. Unlike `platform.quoteIdentifier`, which treats a dot as a
+     * schema qualifier, a role like `my.role` must be quoted whole (`"my.role"`) with embedded quotes doubled.
+     */
+    static quoteRole(role) {
+        return `"${role.replaceAll('"', '""')}"`;
+    }
+    /** Serializes a session variable for `set_config()`; `Date` values use ISO 8601 so casts like `::timestamptz` parse. */
+    stringifySessionVariable(value) {
+        return value instanceof Date ? value.toISOString() : String(value);
+    }
     /** Commits the transaction or releases the savepoint. */
     async commit(ctx, eventBroadcaster, loggerContext) {
         if (ctx.isRolledBack) {
@@ -197,13 +243,17 @@ export class AbstractSqlConnection extends Connection {
         if (query instanceof NativeQueryBuilder) {
             query = query.toRaw();
         }
+        if (typeof query === 'string' && !Array.isArray(params)) {
+            // plain object params hold named parameters, translate them via the `raw()` helper
+            query = raw(query, params);
+        }
         if (isRaw(query)) {
             params = query.params;
             query = query.sql;
         }
         query = this.config.get('onQuery')(query, params);
         const formatted = this.platform.formatQuery(query, params);
-        return { query, params, formatted };
+        return { query, params: params, formatted };
     }
     /** Executes a SQL query and returns the result based on the method: `'all'` for rows, `'get'` for single row, `'run'` for affected count. */
     async execute(query, params = [], method = 'all', ctx, loggerContext) {
@@ -237,7 +287,7 @@ export class AbstractSqlConnection extends Connection {
                 .stream(compiled, chunkSize ?? 100, abort ? { signal: abort.signal } : undefined);
             this.logQuery(sql, {
                 sql,
-                params,
+                params: q.params,
                 ...cleanCtx,
                 affected: Utils.isPlainObject(res) ? res.affectedRows : undefined,
             });
@@ -248,7 +298,7 @@ export class AbstractSqlConnection extends Connection {
             }
         }
         catch (e) {
-            this.logQuery(sql, { sql, params, ...cleanCtx, level: 'error' });
+            this.logQuery(sql, { sql, params: q.params, ...cleanCtx, level: 'error' });
             throw e;
         }
     }

package/AbstractSqlDriver.d.ts

@@ -100,7 +100,7 @@ export declare abstract class AbstractSqlDriver<Connection extends AbstractSqlCo
      */
     private convertOwnerPksForPivotQuery;
     private getPivotOrderBy;
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[], method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[] | Dictionary, method?: 'all' | 'get' | 'run', ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
     stream<T extends object>(entityName: EntityName<T>, where: FilterQuery<T>, options: StreamOptions<T, any, any, any>): AsyncIterableIterator<T>;
     /**
      * 1:1 owner side needs to be marked for population so QB auto-joins the owner id

package/AbstractSqlDriver.js

@@ -183,7 +183,9 @@ export class AbstractSqlDriver extends DatabaseDriver {
         if (typeof meta.expression === 'string') {
             return this.wrapVirtualExpressionInSubquery(meta, meta.expression, where, options, type);
         }
-        const em = this.createEntityManager();
+        // fork the caller EM so the callback inherits its filters, filter params and session context — a fork never
+        // resolves back to the ambient RequestContext EM, which would ignore the transaction/session context set below
+        const em = (options.em?.fork() ?? this.createEntityManager(false));
         em.setTransactionContext(options.ctx);
         const res = meta.expression(em, where, options);
         if (typeof res === 'string') {
@@ -209,7 +211,8 @@ export class AbstractSqlDriver extends DatabaseDriver {
             yield* this.wrapVirtualExpressionInSubqueryStream(meta, meta.expression, where, options, QueryType.SELECT);
             return;
         }
-        const em = this.createEntityManager();
+        // fork the caller EM for the same reason as in `findFromVirtual`
+        const em = (options.em?.fork() ?? this.createEntityManager(false));
         em.setTransactionContext(options.ctx);
         const res = meta.expression(em, where, options, true);
         if (typeof res === 'string') {
@@ -239,7 +242,17 @@ export class AbstractSqlDriver extends DatabaseDriver {
         const asKeyword = this.platform.usesAsKeyword() ? ' as ' : ' ';
         native.from(raw(`(${expression})${asKeyword}${this.platform.quoteIdentifier(qb.alias)}`));
         const query = native.compile();
-        const res = await this.execute(query.sql, query.params, 'all', options.ctx, withAbortContext(options.loggerContext, options));
+        const loggerContext = withAbortContext(options.loggerContext, options);
+        // virtual entities execute directly (not via QueryBuilder), so wrap in a short implicit transaction outside an
+        // existing one when a session context (row level security) needs to apply — mirrors the QueryBuilder wrap
+        const sessionContext = options.ctx ? undefined : options.em?.getTransactionSessionContext();
+        const conn = this.getConnection(this.resolveConnectionType(options));
+        const res = await (sessionContext
+            ? conn.transactional(trx => this.execute(query.sql, query.params, 'all', trx, loggerContext), {
+                sessionContext,
+                loggerContext,
+            })
+            : this.execute(query.sql, query.params, 'all', options.ctx, loggerContext));
         if (type === QueryType.COUNT) {
             return res[0].count;
         }

package/AbstractSqlPlatform.d.ts

@@ -1,4 +1,4 @@
-import { type RawQueryFragment, type Constructor, type EntityManager, type EntityRepository, type IDatabaseDriver, type IsolationLevel, type MikroORM, Platform } from '@mikro-orm/core';
+import { type RawQueryFragment, type Constructor, type EntityManager, type EntityProperty, type EntityRepository, type FormulaColumns, type IDatabaseDriver, type IsolationLevel, type MikroORM, Platform } from '@mikro-orm/core';
 import { SqlSchemaGenerator } from './schema/SqlSchemaGenerator.js';
 import { type SchemaHelper } from './schema/SchemaHelper.js';
 import type { IndexDef } from './typings.js';
@@ -17,6 +17,8 @@ export declare abstract class AbstractSqlPlatform extends Platform {
     getSchemaGenerator(driver: IDatabaseDriver, em?: EntityManager): SqlSchemaGenerator;
     /** @internal */
     createNativeQueryBuilder(): NativeQueryBuilder;
+    /** @inheritDoc */
+    getThroughRelationFormula(prop: EntityProperty, columns: FormulaColumns<any>): string;
     getBeginTransactionSQL(options?: {
         isolationLevel?: IsolationLevel;
         readOnly?: boolean;

package/AbstractSqlPlatform.js

@@ -1,4 +1,4 @@
-import { isRaw, JsonProperty, Platform, raw, Utils, } from '@mikro-orm/core';
+import { isRaw, JsonProperty, Platform, raw, Utils, ValidationError, } from '@mikro-orm/core';
 import { SqlEntityRepository } from './SqlEntityRepository.js';
 import { SqlSchemaGenerator } from './schema/SqlSchemaGenerator.js';
 import { NativeQueryBuilder } from './query/NativeQueryBuilder.js';
@@ -39,6 +39,37 @@ export class AbstractSqlPlatform extends Platform {
     createNativeQueryBuilder() {
         return new NativeQueryBuilder(this);
     }
+    /** @inheritDoc */
+    getThroughRelationFormula(prop, columns) {
+        const through = prop.through;
+        const driver = this.config.getDriver();
+        const alias = `${prop.name}_through`;
+        const qb = driver.createQueryBuilder(through.entity, undefined, 'read', true, undefined, alias);
+        const throughMeta = driver.getMetadata().get(through.entity);
+        const ownerProp = throughMeta.properties[through.ownerProperty];
+        const ownerMeta = driver.getMetadata().get(ownerProp.target);
+        ownerProp.fieldNames.forEach((fieldName, idx) => {
+            const referencedColumn = ownerProp.referencedColumnNames[idx];
+            const referencedProp = ownerProp.referencedPKs
+                .map(name => ownerMeta.properties[name])
+                .find(p => p.fieldNames.includes(referencedColumn));
+            // the column mapping resolves the right alias even for TPT owners, only the column name may differ for composite FK properties
+            const ownerAlias = columns[referencedProp.name].slice(0, columns[referencedProp.name].lastIndexOf('.'));
+            qb.andWhere(raw('?? = ??', [`${alias}.${fieldName}`, `${ownerAlias}.${referencedColumn}`]));
+        });
+        if (through.where) {
+            qb.andWhere(through.where);
+        }
+        if (through.orderBy) {
+            qb.orderBy(through.orderBy);
+        }
+        qb.select(through.targetProperty ?? throughMeta.primaryKeys[0]).limit(1);
+        const sql = qb.getFormattedQuery();
+        if (Object.keys(qb.state.joins).length > 0) {
+            throw new ValidationError(`The 'where' and 'orderBy' options of the through relation ${prop.name} can only reference own columns of ${throughMeta.className}`);
+        }
+        return `(${sql})`;
+    }
     getBeginTransactionSQL(options) {
         if (options?.isolationLevel) {
             return [`set transaction isolation level ${options.isolationLevel}`, 'begin'];

package/README.md

@@ -24,6 +24,7 @@ npm install @mikro-orm/mysql        # MySQL
 npm install @mikro-orm/mariadb      # MariaDB
 npm install @mikro-orm/sqlite       # SQLite
 npm install @mikro-orm/libsql       # libSQL / Turso
+npm install @mikro-orm/sql-js       # sql.js (in-memory SQLite in WASM)
 npm install @mikro-orm/mongodb      # MongoDB
 npm install @mikro-orm/mssql        # MS SQL Server
 npm install @mikro-orm/oracledb     # Oracle

package/SqlEntityManager.d.ts

@@ -60,14 +60,14 @@ export declare class SqlEntityManager<Driver extends AbstractSqlDriver = Abstrac
      * `signal` / `inflightQueryAbortStrategy` (set via `em.fork({ signal })`) is applied automatically.
      * For per-call cancellation use the options-bag overload below.
      */
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[], method?: 'all' | 'get' | 'run', loggerContext?: LoggingOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[] | Dictionary, method?: 'all' | 'get' | 'run', loggerContext?: LoggingOptions): Promise<T>;
     /**
      * Executes a raw SQL query with an options bag carrying `method`, `loggerContext`, `signal`
      * and `inflightQueryAbortStrategy`. Per-call `signal` / `inflightQueryAbortStrategy` override
      * the fork-level defaults set via `em.fork({ signal })`. The current transaction context is
      * applied automatically.
      */
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params: any[], options: EmExecuteOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params: any[] | Dictionary, options: EmExecuteOptions): Promise<T>;
     /**
      * @inheritDoc
      */

package/SqlEntityManager.js

@@ -68,7 +68,7 @@ export class SqlEntityManager extends EntityManager {
             merged.signal = opts.signal ?? fork?.signal;
             merged.inflightQueryAbortStrategy = opts.inflightQueryAbortStrategy ?? fork?.inflightQueryAbortStrategy;
         }
-        return this.getDriver().execute(query, params, opts.method ?? 'all', context.getTransactionContext(), merged);
+        return context.withSessionContext(context.getTransactionContext(), ctx => this.getDriver().execute(query, params, opts.method ?? 'all', ctx, merged));
     }
     /**
      * @inheritDoc

package/dialects/mysql/BaseMySqlPlatform.d.ts

@@ -14,6 +14,8 @@ export declare class BaseMySqlPlatform extends AbstractSqlPlatform {
         readonly "desc nulls first": 'is not null';
         readonly "desc nulls last": 'is null';
     };
+    /** mysql and mariadb treat null as the lowest value when no placement is requested. */
+    sortsNullsLowest(): boolean;
     supportsMultiColumnCountDistinct(): boolean;
     /** @internal */
     createNativeQueryBuilder(): MySqlNativeQueryBuilder;

package/dialects/mysql/BaseMySqlPlatform.js

@@ -18,6 +18,10 @@ export class BaseMySqlPlatform extends AbstractSqlPlatform {
         [QueryOrder.desc_nulls_first]: 'is not null',
         [QueryOrder.desc_nulls_last]: 'is null',
     };
+    /** mysql and mariadb treat null as the lowest value when no placement is requested. */
+    sortsNullsLowest() {
+        return true;
+    }
     supportsMultiColumnCountDistinct() {
         return true;
     }

package/dialects/postgresql/BasePostgreSqlPlatform.d.ts

@@ -16,6 +16,8 @@ export declare class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     getEnumArrayCheckConstraintExpression(column: string, items: string[]): string;
     supportsMaterializedViews(): boolean;
     supportsPartitionedTables(): boolean;
+    supportsRowLevelSecurity(): boolean;
+    getCurrentSettingCast(mappedType: Type<unknown>): string | null;
     supportsCustomPrimaryKeyNames(): boolean;
     getCurrentTimestampSQL(length: number): string;
     getDateTimeTypeDeclarationSQL(column: {

package/dialects/postgresql/BasePostgreSqlPlatform.js

@@ -1,4 +1,4 @@
-import { ALIAS_REPLACEMENT, ARRAY_OPERATORS, raw, RawQueryFragment, Type, Utils, } from '@mikro-orm/core';
+import { ALIAS_REPLACEMENT, ARRAY_OPERATORS, BigIntType, BooleanType, DateTimeType, DateType, EnumType, IntegerType, raw, RawQueryFragment, SmallIntType, StringType, TextType, TimeType, TinyIntType, Type, Utils, UuidType, } from '@mikro-orm/core';
 import { AbstractSqlPlatform } from '../../AbstractSqlPlatform.js';
 import { PostgreSqlNativeQueryBuilder } from './PostgreSqlNativeQueryBuilder.js';
 import { PostgreSqlSchemaHelper } from './PostgreSqlSchemaHelper.js';
@@ -33,6 +33,38 @@ export class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     supportsPartitionedTables() {
         return true;
     }
+    supportsRowLevelSecurity() {
+        return true;
+    }
+    getCurrentSettingCast(mappedType) {
+        if (mappedType instanceof UuidType) {
+            return '::uuid';
+        }
+        if (mappedType instanceof BigIntType) {
+            return '::bigint';
+        }
+        // MediumIntType extends IntegerType, so it is covered here too
+        if (mappedType instanceof IntegerType || mappedType instanceof SmallIntType || mappedType instanceof TinyIntType) {
+            return '::int';
+        }
+        if (mappedType instanceof BooleanType) {
+            return '::boolean';
+        }
+        if (mappedType instanceof DateTimeType) {
+            return '::timestamptz';
+        }
+        if (mappedType instanceof DateType) {
+            return '::date';
+        }
+        if (mappedType instanceof TimeType) {
+            return '::time';
+        }
+        // current_setting() returns text already, so string-compatible types need no cast (CharacterType extends StringType)
+        if (mappedType instanceof StringType || mappedType instanceof TextType || mappedType instanceof EnumType) {
+            return '';
+        }
+        return null;
+    }
     supportsCustomPrimaryKeyNames() {
         return true;
     }

package/dialects/postgresql/PostgreSqlExceptionConverter.js

@@ -1,4 +1,4 @@
-import { DeadlockException, ExceptionConverter, ForeignKeyConstraintViolationException, InvalidFieldNameException, NonUniqueFieldNameException, NotNullConstraintViolationException, SyntaxErrorException, TableExistsException, TableNotFoundException, UniqueConstraintViolationException, CheckConstraintViolationException, } from '@mikro-orm/core';
+import { DeadlockException, ExceptionConverter, ForeignKeyConstraintViolationException, InvalidFieldNameException, NonUniqueFieldNameException, NotNullConstraintViolationException, RowLevelSecurityViolationException, SyntaxErrorException, TableExistsException, TableNotFoundException, UniqueConstraintViolationException, CheckConstraintViolationException, } from '@mikro-orm/core';
 export class PostgreSqlExceptionConverter extends ExceptionConverter {
     /**
      * @see http://www.postgresql.org/docs/9.4/static/errcodes-appendix.html
@@ -31,6 +31,13 @@ export class PostgreSqlExceptionConverter extends ExceptionConverter {
                 return new UniqueConstraintViolationException(exception);
             case '23514':
                 return new CheckConstraintViolationException(exception);
+            case '42501':
+                // 42501 is generic insufficient_privilege; only RLS write violations carry this message — the `routine`
+                // field covers servers with a non-english `lc_messages`, where the message check cannot match
+                if (exception.message.includes('row-level security policy') || exception.routine === 'ExecWithCheckOptions') {
+                    return new RowLevelSecurityViolationException(exception);
+                }
+                break;
             case '42601':
                 return new SyntaxErrorException(exception);
             case '42702':

package/dialects/postgresql/PostgreSqlSchemaHelper.d.ts

@@ -1,7 +1,7 @@
 import { type Dictionary, type Transaction } from '@mikro-orm/core';
 import { SchemaHelper } from '../../schema/SchemaHelper.js';
 import type { AbstractSqlConnection } from '../../AbstractSqlConnection.js';
-import type { CheckDef, Column, ForeignKey, IndexDef, Table, TableDifference, TablePartitioning, SqlTriggerDef, SqlRoutineDef } from '../../typings.js';
+import type { CheckDef, Column, ForeignKey, IndexDef, Table, TableDifference, TablePartitioning, SqlPolicyDef, SqlTriggerDef, SqlRoutineDef } from '../../typings.js';
 import type { DatabaseSchema } from '../../schema/DatabaseSchema.js';
 import type { DatabaseTable } from '../../schema/DatabaseTable.js';
 export declare class PostgreSqlSchemaHelper extends SchemaHelper {
@@ -71,6 +71,17 @@ export declare class PostgreSqlSchemaHelper extends SchemaHelper {
     dropTrigger(table: DatabaseTable, trigger: SqlTriggerDef): string;
     /** Flattens `;\n` inside the dollar-quoted blocks of a raw DDL expression, which are not statement boundaries. */
     private flattenDollarQuotedBodies;
+    getRlsCreateSQL(table: DatabaseTable): string[];
+    getRlsDropSQL(diff: TableDifference, safe?: boolean): string[];
+    getRlsAlterSQL(diff: TableDifference, safe?: boolean): string[];
+    /**
+     * Quotes a policy or role name as a single identifier. Unlike `quote()`/`platform.quoteIdentifier`, which treat
+     * a dot as a schema qualifier, these names are never schema-qualified, so `my.role` must render as `"my.role"`.
+     */
+    private quoteUnqualified;
+    private createPolicy;
+    private dropPolicy;
+    private formatPolicyRoles;
     createRoutine(routine: SqlRoutineDef): string;
     dropRoutine(routine: SqlRoutineDef): string;
     getAllRoutines(connection: AbstractSqlConnection, schemas?: string[]): Promise<SqlRoutineDef[]>;
@@ -87,6 +98,12 @@ export declare class PostgreSqlSchemaHelper extends SchemaHelper {
     getDatabaseCollation(connection: AbstractSqlConnection, ctx?: Transaction): Promise<string | undefined>;
     getAllTriggers(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>): Promise<Dictionary<SqlTriggerDef[]>>;
     private getTriggersSQL;
+    getAllPolicies(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>, ctx?: Transaction): Promise<Dictionary<{
+        policies: SqlPolicyDef[];
+        enabled: boolean;
+        forced: boolean;
+    }>>;
+    private parsePgRoles;
     getAllForeignKeys(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>, ctx?: Transaction): Promise<Dictionary<Dictionary<ForeignKey>>>;
     getNativeEnumDefinitions(connection: AbstractSqlConnection, schemas: string[], ctx?: Transaction): Promise<Dictionary<{
         name: string;

package/dialects/postgresql/PostgreSqlSchemaHelper.js

@@ -162,6 +162,7 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
         const fks = await this.getAllForeignKeys(connection, tablesBySchema, ctx);
         const partitionings = await this.getPartitions(connection, tablesBySchema, ctx);
         const triggers = await this.getAllTriggers(connection, tablesBySchema);
+        const policies = await this.getAllPolicies(connection, tablesBySchema, ctx);
         const dbCollation = await this.getDatabaseCollation(connection, ctx);
         for (const t of tables) {
             const key = this.getTableKey(t);
@@ -175,6 +176,12 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
             if (triggers[key]) {
                 table.setTriggers(triggers[key]);
             }
+            const rls = policies[key];
+            if (rls) {
+                table.setPolicies(rls.policies);
+                table.rlsEnabled = rls.enabled;
+                table.rlsForced = rls.forced;
+            }
             table.setPartitioning(partitionings[key]);
         }
     }
@@ -540,6 +547,83 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
         })
             .join('');
     }
+    getRlsCreateSQL(table) {
+        const ret = [];
+        if (table.rlsEnabled) {
+            ret.push(`alter table ${table.getQuotedName()} enable row level security`);
+        }
+        if (table.rlsForced) {
+            ret.push(`alter table ${table.getQuotedName()} force row level security`);
+        }
+        for (const policy of table.getPolicies()) {
+            ret.push(this.createPolicy(table, policy));
+        }
+        return ret;
+    }
+    getRlsDropSQL(diff, safe) {
+        // a policy expression holds a dependency on the columns it references, so removed policies (including the
+        // old version of changed ones) must be dropped before the column drops emitted later in the diff;
+        // in safe mode only recreated policies (present in both removed + added) are dropped, so a policy that is
+        // merely removed is left untouched like removed triggers/columns
+        return Object.values(diff.removedPolicies)
+            .filter(policy => !safe || policy.name in diff.addedPolicies)
+            .map(policy => this.dropPolicy(diff.toTable, policy));
+    }
+    getRlsAlterSQL(diff, safe) {
+        const ret = [];
+        const table = diff.toTable;
+        if (diff.changedRlsEnabled === true) {
+            ret.push(`alter table ${table.getQuotedName()} enable row level security`);
+        }
+        if (diff.changedRlsForced === true) {
+            ret.push(`alter table ${table.getQuotedName()} force row level security`);
+        }
+        else if (!safe && diff.changedRlsForced === false) {
+            ret.push(`alter table ${table.getQuotedName()} no force row level security`);
+        }
+        for (const policy of Object.values(diff.addedPolicies)) {
+            ret.push(this.createPolicy(table, policy));
+        }
+        // disable only after its policies are gone (removed ones were dropped via `getRlsDropSQL`); skipped in
+        // safe mode so a safe run never lifts row level security off an existing table
+        if (!safe && diff.changedRlsEnabled === false) {
+            ret.push(`alter table ${table.getQuotedName()} disable row level security`);
+        }
+        return ret;
+    }
+    /**
+     * Quotes a policy or role name as a single identifier. Unlike `quote()`/`platform.quoteIdentifier`, which treat
+     * a dot as a schema qualifier, these names are never schema-qualified, so `my.role` must render as `"my.role"`.
+     */
+    quoteUnqualified(name) {
+        return `"${name.replaceAll('"', '""')}"`;
+    }
+    createPolicy(table, policy) {
+        const parts = [`create policy ${this.quoteUnqualified(policy.name)} on ${table.getQuotedName()}`];
+        if (policy.type === 'restrictive') {
+            parts.push('as restrictive');
+        }
+        if (policy.command !== 'all') {
+            parts.push(`for ${policy.command}`);
+        }
+        if (policy.roles.length > 0) {
+            parts.push(`to ${this.formatPolicyRoles(policy.roles)}`);
+        }
+        if (policy.using) {
+            parts.push(`using (${policy.using})`);
+        }
+        if (policy.check) {
+            parts.push(`with check (${policy.check})`);
+        }
+        return parts.join(' ');
+    }
+    dropPolicy(table, policy) {
+        return `drop policy ${this.quoteUnqualified(policy.name)} on ${table.getQuotedName()}`;
+    }
+    // `public` is a keyword and must stay unquoted; other roles are quoted like any identifier
+    formatPolicyRoles(roles) {
+        return roles.map(role => (role === 'public' ? 'public' : this.quoteUnqualified(role))).join(', ');
+    }
     createRoutine(routine) {
         if (routine.expression) {
             return this.flattenDollarQuotedBodies(routine.expression);
@@ -732,6 +816,56 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
     where (${conditions.join(' or ')})
     order by t.trigger_name, t.event_manipulation`;
     }
+    async getAllPolicies(connection, tablesBySchemas, ctx) {
+        const conditionsFor = (schemaColumn, tableColumn) => [...tablesBySchemas.entries()].map(([schema, tables]) => {
+            const names = tables.map(t => this.platform.quoteValue(t.table_name)).join(', ');
+            const schemaName = this.platform.quoteValue(schema ?? this.platform.getDefaultSchemaName());
+            return `(${schemaColumn} = ${schemaName} and ${tableColumn} in (${names}))`;
+        });
+        const flagConditions = conditionsFor('ns.nspname', 'cls.relname');
+        const policyConditions = conditionsFor('schemaname', 'tablename');
+        // pg_class carries the enable/force flags (a table can enable RLS with zero policies)
+        const flagRows = await connection.execute(`select cls.relname as table_name, ns.nspname as schema_name, cls.relrowsecurity as enabled, cls.relforcerowsecurity as forced
+        from pg_class cls
+        join pg_namespace ns on ns.oid = cls.relnamespace
+        where (${flagConditions.join(' or ')})`, [], 'all', ctx);
+        const policyRows = await connection.execute(`select tablename as table_name, schemaname as schema_name, policyname as name, permissive, roles, cmd, qual, with_check
+        from pg_policies
+        where (${policyConditions.join(' or ')})
+        order by policyname`, [], 'all', ctx);
+        const policiesByTable = {};
+        for (const row of policyRows) {
+            const key = this.getTableKey(row);
+            (policiesByTable[key] ??= []).push({
+                name: row.name,
+                command: row.cmd.toLowerCase(),
+                type: row.permissive === 'PERMISSIVE' ? 'permissive' : 'restrictive',
+                roles: this.parsePgRoles(row.roles),
+                using: row.qual ?? undefined,
+                check: row.with_check ?? undefined,
+            });
+        }
+        const ret = {};
+        for (const row of flagRows) {
+            const key = this.getTableKey(row);
+            ret[key] = { policies: policiesByTable[key] ?? [], enabled: row.enabled, forced: row.forced };
+        }
+        return ret;
+    }
+    // node-postgres returns `pg_policies.roles` as an unparsed array literal (`{public}`), pglite as an array
+    parsePgRoles(value) {
+        if (Array.isArray(value)) {
+            return value;
+        }
+        // tokenize the array literal instead of splitting on commas — quoted role names can contain
+        // commas, and quoted elements escape `"` and `\` with a backslash
+        const roles = [];
+        const re = /"((?:[^"\\]|\\.)*)"|[^,]+/g;
+        for (const match of value.replace(/^\{|\}$/g, '').matchAll(re)) {
+            roles.push(match[1] != null ? match[1].replace(/\\(.)/g, '$1') : match[0]);
+        }
+        return roles;
+    }
     async getAllForeignKeys(connection, tablesBySchemas, ctx) {
         const sql = `select nsp1.nspname schema_name, cls1.relname table_name, nsp2.nspname referenced_schema_name,
       cls2.relname referenced_table_name, a.attname column_name, af.attname referenced_column_name, conname constraint_name,
@@ -966,6 +1100,24 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
             for (const { table: localTable, foreignKey } of inboundForeignKeys) {
                 this.append(ret, this.createForeignKey(localTable, foreignKey));
             }
+            // re-enable row level security and recreate the policies (createTable skips them during a rebuild);
+            // emitted after the data copy so `force row level security` can't block the owner's insert
+            this.append(ret, this.getRlsCreateSQL(table));
+            // with `ignorePolicies`, hand-written policies (and the RLS flags they imply) may exist only on the
+            // introspected side — recreate them verbatim, or the rebuild would silently strip them
+            if (this.options.ignorePolicies) {
+                if (diff.fromTable.rlsEnabled && !table.rlsEnabled) {
+                    ret.push(`alter table ${table.getQuotedName()} enable row level security`);
+                }
+                if (diff.fromTable.rlsForced && !table.rlsForced) {
+                    ret.push(`alter table ${table.getQuotedName()} force row level security`);
+                }
+                for (const policy of diff.fromTable.getPolicies()) {
+                    if (!table.hasPolicy(policy.name)) {
+                        ret.push(this.createPolicy(table, policy));
+                    }
+                }
+            }
         }
         if (safe) {
             ret.push(`-- safe mode: original tables kept in schema "${tmpSchema}"; drop that schema manually once the data is verified`);

package/dialects/sqlite/SqlitePlatform.d.ts

@@ -6,6 +6,8 @@ import { SqliteExceptionConverter } from './SqliteExceptionConverter.js';
 export declare class SqlitePlatform extends AbstractSqlPlatform {
     protected readonly schemaHelper: SqliteSchemaHelper;
     protected readonly exceptionConverter: SqliteExceptionConverter;
+    /** sqlite treats null as the lowest value when no placement is requested. */
+    sortsNullsLowest(): boolean;
     /** @internal */
     createNativeQueryBuilder(): SqliteNativeQueryBuilder;
     usesDefaultKeyword(): boolean;

package/dialects/sqlite/SqlitePlatform.js

@@ -5,6 +5,10 @@ import { SqliteExceptionConverter } from './SqliteExceptionConverter.js';
 export class SqlitePlatform extends AbstractSqlPlatform {
     schemaHelper = new SqliteSchemaHelper(this);
     exceptionConverter = new SqliteExceptionConverter();
+    /** sqlite treats null as the lowest value when no placement is requested. */
+    sortsNullsLowest() {
+        return true;
+    }
     /** @internal */
     createNativeQueryBuilder() {
         return new SqliteNativeQueryBuilder(this);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/sql",
-  "version": "7.1.16-dev.10",
+  "version": "7.1.16-dev.12",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",
@@ -53,7 +53,7 @@
     "@mikro-orm/core": "^7.1.15"
   },
   "peerDependencies": {
-    "@mikro-orm/core": "7.1.16-dev.10"
+    "@mikro-orm/core": "7.1.16-dev.12"
   },
   "engines": {
     "node": ">= 22.17.0"

package/query/QueryBuilder.js

@@ -1065,17 +1065,26 @@ export class QueryBuilder {
             this.limit(1);
         }
         const query = this.toQuery();
-        const cached = await this.em?.tryCache(this.mainAlias.entityName, this.#state.cache, [
-            'qb.execute',
-            query.sql,
-            query.params,
-            method,
-        ]);
+        const cacheKey = ['qb.execute', query.sql, query.params, method];
+        // session context (row level security) scopes cached rows per tenant/role, avoiding cross-context serves
+        const qbSessionContext = this.em?.getSessionContext();
+        if (qbSessionContext) {
+            cacheKey.push(qbSessionContext);
+        }
+        const cached = await this.em?.tryCache(this.mainAlias.entityName, this.#state.cache, cacheKey);
         if (cached?.data !== undefined) {
             return cached.data;
         }
         const loggerContext = { id: this.em?.id, ...this.loggerContext, ...this.#abortOptions };
-        const res = await this.getConnection().execute(query.sql, query.params, method, this.context, loggerContext);
+        const conn = this.getConnection();
+        // outside a transaction, wrap in a short implicit one so RLS `set local` session context applies (no-op when unset)
+        const sessionContext = this.context ? undefined : this.em?.getTransactionSessionContext();
+        const res = await (sessionContext
+            ? conn.transactional(trx => conn.execute(query.sql, query.params, method, trx, loggerContext), {
+                sessionContext,
+                loggerContext,
+            })
+            : conn.execute(query.sql, query.params, method, this.context, loggerContext));
         const meta = this.mainAlias.meta;
         if (!options.mapResults || !meta) {
             await this.em?.storeCache(this.#state.cache, cached, res);
@@ -1125,6 +1134,11 @@ export class QueryBuilder {
      * ```
      */
     async *stream(options) {
+        // mirror EntityManager.stream — a stream can't open the implicit session-context transaction, so under the
+        // 'transaction' strategy fail closed instead of silently running the cursor without the staged context
+        if (!this.context && this.em?.getTransactionSessionContext()) {
+            throw ValidationError.sessionContextStreamRequiresTransaction();
+        }
         options ??= {};
         options.mergeResults ??= true;
         options.mapResults ??= true;

package/schema/DatabaseSchema.d.ts

@@ -48,6 +48,10 @@ export declare class DatabaseSchema {
     /** Separate from `create()` so the comparator only pays for routine introspection when the user actually defined routines. SQLite/libSQL helpers return []. */
     loadRoutines(connection: AbstractSqlConnection, platform: AbstractSqlPlatform, schemas?: string[]): Promise<void>;
     static fromMetadata(metadata: EntityMetadata[], platform: AbstractSqlPlatform, config: Configuration, schemaName?: string, em?: any): DatabaseSchema;
+    /** Compiles an `rls`-flagged filter's condition into a resolved policy backed by `current_setting()` lookups. */
+    private static compileRlsFilterPolicy;
+    /** Truncates the base first so the collision suffix survives the identifier limit. */
+    private static uniquePolicyName;
     /** Separate from {@link fromMetadata} so the comparator only walks routines when the user defined any. */
     addRoutinesFromMetadata(routines: readonly Routine[], platform: AbstractSqlPlatform, em?: any): void;
     /**

package/schema/DatabaseSchema.js

@@ -1,4 +1,4 @@
-import { ReferenceKind, isRaw, } from '@mikro-orm/core';
+import { ReferenceKind, MetadataError, QueryHelper, Utils, isRaw, } from '@mikro-orm/core';
 import { DatabaseTable } from './DatabaseTable.js';
 import { normalizeViewDefinition } from './SchemaHelper.js';
 import { getTablePartitioning } from './partitioning.js';
@@ -262,9 +262,115 @@ export class DatabaseSchema {
                     expression: trigger.expression,
                 });
             }
+            // non-empty policies imply RLS; `rowLevelSecurity: 'force'` enforces it for the table owner too, but an
+            // explicit `rowLevelSecurity: false` keeps RLS disabled even when policies are staged (they stay dormant)
+            table.rlsEnabled = meta.rowLevelSecurity !== false && (meta.policies.length > 0 || !!meta.rowLevelSecurity);
+            table.rlsForced = meta.rowLevelSecurity === 'force';
+            const usedPolicyNames = new Set();
+            const resolve = (raw) => {
+                if (raw == null) {
+                    return undefined;
+                }
+                return isRaw(raw) ? platform.formatQuery(raw.sql, raw.params) : raw;
+            };
+            for (const policy of meta.policies) {
+                const command = policy.command ?? 'all';
+                // deterministic default name derived from table + command + collision index, truncated the
+                // same way check names are, so the introspected (engine-truncated) name matches metadata
+                const max = platform.getMaxIdentifierLength();
+                let name = policy.name;
+                if (!name) {
+                    name = this.uniquePolicyName(`${meta.collection}_${command}_policy`, platform, usedPolicyNames);
+                }
+                else {
+                    name = name.substring(0, max);
+                    // explicit names skip the collision suffixing, so a duplicate would otherwise die with a raw pg error
+                    // on create or be silently swallowed by the name-keyed diff dictionaries — reject it up front
+                    if (usedPolicyNames.has(name)) {
+                        throw MetadataError.duplicatePolicyName(meta, name);
+                    }
+                    usedPolicyNames.add(name);
+                }
+                table.addPolicy({
+                    name,
+                    command,
+                    type: policy.type ?? 'permissive',
+                    roles: policy.roles ?? [],
+                    using: resolve(policy.using),
+                    check: resolve(policy.check),
+                });
+            }
+            // rls-flagged filters materialize as additional permissive policies (app-level WHERE + DB-level policy);
+            // filters inherited from a TPT parent are skipped — the policy already lives on the parent table, and the
+            // child table may not even have the referenced columns
+            const rlsFilters = Object.values(meta.filters).filter(filter => filter.rls && !(meta.tptParent && Object.values(meta.tptParent.filters).includes(filter)));
+            if (rlsFilters.length > 0) {
+                // an explicit `rowLevelSecurity: false` still stages the filter's policy but keeps RLS off (dormant)
+                table.rlsEnabled = meta.rowLevelSecurity !== false;
+                for (const filter of rlsFilters) {
+                    table.addPolicy(this.compileRlsFilterPolicy(meta, filter, table, platform, usedPolicyNames));
+                }
+            }
         }
         return schema;
     }
+    /** Compiles an `rls`-flagged filter's condition into a resolved policy backed by `current_setting()` lookups. */
+    static compileRlsFilterPolicy(meta, filter, table, platform, usedPolicyNames) {
+        const accessed = new Set();
+        const cond = QueryHelper.resolveRlsFilterCond(filter, accessed, meta.className);
+        const setting = typeof filter.rls === 'object' ? filter.rls.setting : undefined;
+        if (setting && accessed.size > 1) {
+            throw MetadataError.rlsFilterMultiArgSetting(filter.name, [...accessed]);
+        }
+        // the config-bound driver is always an `AbstractSqlDriver` here, like in `DatabaseTable.processIndexWhere`
+        const driver = platform.getConfig().getDriver();
+        let sql = driver.renderPartialIndexWhere(meta.class, cond);
+        const prefix = QueryHelper.RLS_SENTINEL_PREFIX;
+        const suffix = QueryHelper.RLS_SENTINEL_SUFFIX;
+        // match `"<column>" <op> '<sentinel>'` — the LHS is always a quoted column emitted from this entity's own
+        // where; group 1 keeps the column + operator so only the sentinel literal is swapped for the session lookup
+        const re = new RegExp(`("([^"]+)"\\s*(?:!=|>=|<=|=|>|<)\\s*)'${prefix}(\\w+)${suffix}'`, 'g');
+        sql = sql.replace(re, (_whole, lhs, column, arg) => {
+            const col = table.getColumn(column);
+            // the condition can reference a property that renders a field name without a managed column
+            // (`persist: false`, `skipColumns`) — fail with a descriptive error instead of a crash
+            if (!col) {
+                throw MetadataError.rlsFilterUnmanagedColumn(filter.name, column);
+            }
+            // native enum columns compare against the enum type itself, `current_setting()` text won't coerce implicitly
+            const cast = col.nativeEnumName
+                ? `::${platform.quoteIdentifier(col.nativeEnumName)}`
+                : platform.getCurrentSettingCast(col.mappedType);
+            if (cast === null) {
+                throw MetadataError.rlsFilterUncastableType(filter.name, col.type);
+            }
+            // a sentinel implies the arg was accessed, and multi-arg custom settings were already rejected above
+            const name = setting || Utils.getRlsSettingName(filter.name, arg);
+            return `${lhs}current_setting(${platform.quoteValue(name)})${cast}`;
+        });
+        // a leftover sentinel means an argument appeared somewhere other than a direct comparison, which we can't compile
+        if (sql.includes(prefix)) {
+            throw MetadataError.rlsFilterUnsupportedCond(filter.name);
+        }
+        return {
+            name: this.uniquePolicyName(`${meta.collection}_${filter.name}_policy`, platform, usedPolicyNames),
+            command: 'all',
+            type: 'permissive',
+            roles: [],
+            using: sql,
+        };
+    }
+    /** Truncates the base first so the collision suffix survives the identifier limit. */
+    static uniquePolicyName(base, platform, used) {
+        const max = platform.getMaxIdentifierLength();
+        let name = base.substring(0, max);
+        for (let i = 2; used.has(name); i++) {
+            const suffix = `_${i}`;
+            name = base.substring(0, max - suffix.length) + suffix;
+        }
+        used.add(name);
+        return name;
+    }
     /** Separate from {@link fromMetadata} so the comparator only walks routines when the user defined any. */
     addRoutinesFromMetadata(routines, platform, em) {
         const resolveBody = (raw) => {

package/schema/DatabaseTable.d.ts

@@ -1,6 +1,6 @@
 import { type Configuration, type DeferMode, type Dictionary, type EntityMetadata, type EntityProperty, type IndexCallback, type NamingStrategy } from '@mikro-orm/core';
 import type { SchemaHelper } from './SchemaHelper.js';
-import type { CheckDef, Column, ForeignKey, IndexDef, TablePartitioning, SqlTriggerDef } from '../typings.js';
+import type { CheckDef, Column, ForeignKey, IndexDef, TablePartitioning, SqlPolicyDef, SqlTriggerDef } from '../typings.js';
 import type { AbstractSqlPlatform } from '../AbstractSqlPlatform.js';
 /**
  * @internal
@@ -15,6 +15,10 @@ export declare class DatabaseTable {
         items: string[];
     }>;
     comment?: string;
+    /** Whether row level security is enabled on the table (postgres only). */
+    rlsEnabled: boolean;
+    /** Whether row level security is also enforced for the table owner (postgres `force`). */
+    rlsForced: boolean;
     partitioning?: TablePartitioning;
     /**
      * Effective collation the column defaults to when no explicit `COLLATE` is set on a column.
@@ -34,6 +38,11 @@ export declare class DatabaseTable {
     /** @internal */
     setPartitioning(partitioning?: TablePartitioning): void;
     getTriggers(): SqlTriggerDef[];
+    getPolicies(): SqlPolicyDef[];
+    /** `[]` and `['public']` both mean PUBLIC — a single predicate so metadata, introspection and codegen agree. */
+    static isDefaultPolicyRoles(roles: string[]): boolean;
+    /** @internal */
+    setPolicies(policies: SqlPolicyDef[]): void;
     /** @internal */
     setIndexes(indexes: IndexDef[]): void;
     /** @internal */
@@ -65,6 +74,8 @@ export declare class DatabaseTable {
     hasCheck(checkName: string): boolean;
     getTrigger(triggerName: string): SqlTriggerDef | undefined;
     hasTrigger(triggerName: string): boolean;
+    getPolicy(policyName: string): SqlPolicyDef | undefined;
+    hasPolicy(policyName: string): boolean;
     getPrimaryKey(): IndexDef | undefined;
     hasPrimaryKey(): boolean;
     private getForeignKeyDeclaration;
@@ -99,5 +110,6 @@ export declare class DatabaseTable {
     private processIndexWhere;
     addCheck(check: CheckDef): void;
     addTrigger(trigger: SqlTriggerDef): void;
+    addPolicy(policy: SqlPolicyDef): void;
     toJSON(): Dictionary;
 }

package/schema/DatabaseTable.js

@@ -10,10 +10,15 @@ export class DatabaseTable {
     #indexes = [];
     #checks = [];
     #triggers = [];
+    #policies = [];
     #foreignKeys = {};
     #platform;
     nativeEnums = {}; // for postgres
     comment;
+    /** Whether row level security is enabled on the table (postgres only). */
+    rlsEnabled = false;
+    /** Whether row level security is also enforced for the table owner (postgres `force`). */
+    rlsForced = false;
     partitioning;
     /**
      * Effective collation the column defaults to when no explicit `COLLATE` is set on a column.
@@ -55,6 +60,17 @@ export class DatabaseTable {
     getTriggers() {
         return this.#triggers;
     }
+    getPolicies() {
+        return this.#policies;
+    }
+    /** `[]` and `['public']` both mean PUBLIC — a single predicate so metadata, introspection and codegen agree. */
+    static isDefaultPolicyRoles(roles) {
+        return roles.length === 0 || (roles.length === 1 && roles[0] === 'public');
+    }
+    /** @internal */
+    setPolicies(policies) {
+        this.#policies = policies;
+    }
     /** @internal */
     setIndexes(indexes) {
         this.#indexes = indexes;
@@ -670,6 +686,12 @@ export class DatabaseTable {
     hasTrigger(triggerName) {
         return !!this.getTrigger(triggerName);
     }
+    getPolicy(policyName) {
+        return this.#policies.find(p => p.name === policyName);
+    }
+    hasPolicy(policyName) {
+        return !!this.getPolicy(policyName);
+    }
     getPrimaryKey() {
         return this.#indexes.find(i => i.primary);
     }
@@ -990,6 +1012,9 @@ export class DatabaseTable {
     addTrigger(trigger) {
         this.#triggers.push(trigger);
     }
+    addPolicy(policy) {
+        this.#policies.push(policy);
+    }
     toJSON() {
         const columns = this.#columns;
         // locale-independent comparison so the snapshot is stable across machines
@@ -1123,13 +1148,26 @@ export class DatabaseTable {
             }
             return out;
         };
+        const normalizePolicy = (policy) => {
+            const out = { name: policy.name, command: policy.command, type: policy.type };
+            if (!DatabaseTable.isDefaultPolicyRoles(policy.roles)) {
+                out.roles = [...policy.roles].sort(byString);
+            }
+            for (const field of ['using', 'check']) {
+                if (policy[field]) {
+                    out[field] = policy[field];
+                }
+            }
+            return out;
+        };
         const sortedIndexes = [...this.#indexes].sort((a, b) => byString(a.keyName, b.keyName)).map(normalizeIndex);
         const sortedChecks = [...this.#checks].sort((a, b) => byString(a.name, b.name)).map(normalizeCheck);
         const sortedTriggers = [...this.#triggers].sort((a, b) => byString(a.name, b.name));
+        const sortedPolicies = [...this.#policies].sort((a, b) => byString(a.name, b.name)).map(normalizePolicy);
         const sortedForeignKeys = Object.fromEntries(Object.entries(this.#foreignKeys)
             .sort(([a], [b]) => byString(a, b))
             .map(([k, v]) => [k, normalizeFk(v)]));
-        return {
+        const ret = {
             name: this.name,
             schema: this.schema,
             columns: columnsMapped,
@@ -1142,5 +1180,16 @@ export class DatabaseTable {
             // platforms that can't read comments back (sqlite), where keeping it would flip the snapshot
             comment: supportsComments ? this.comment || null : null,
         };
+        // emit RLS state only when set, so snapshots of non-RLS tables stay byte-for-byte unchanged
+        if (sortedPolicies.length > 0) {
+            ret.policies = sortedPolicies;
+        }
+        if (this.rlsEnabled) {
+            ret.rlsEnabled = true;
+        }
+        if (this.rlsForced) {
+            ret.rlsForced = true;
+        }
+        return ret;
     }
 }

package/schema/SchemaComparator.d.ts

@@ -88,6 +88,8 @@ export declare class SchemaComparator {
      */
     private diffViewExpression;
     private diffTrigger;
+    private diffPolicies;
+    private diffPolicy;
     parseJsonDefault(defaultValue?: string | null): Dictionary | string | null;
     private parseDecimalDefault;
     hasSameDefaultValue(from: Column, to: Column): boolean;

package/schema/SchemaComparator.js

@@ -328,6 +328,7 @@ export class SchemaComparator {
             addedIndexes: {},
             addedChecks: {},
             addedTriggers: {},
+            addedPolicies: {},
             changedColumns: {},
             changedForeignKeys: {},
             changedIndexes: {},
@@ -338,6 +339,7 @@ export class SchemaComparator {
             removedIndexes: {},
             removedChecks: {},
             removedTriggers: {},
+            removedPolicies: {},
             renamedColumns: {},
             renamedIndexes: {},
             fromTable,
@@ -517,6 +519,9 @@ export class SchemaComparator {
                 }
             }
         }
+        if (this.#platform.supportsRowLevelSecurity()) {
+            changes += this.diffPolicies(fromTable, toTable, tableDifferences);
+        }
         const fromForeignKeys = { ...fromTable.getForeignKeys() };
         const toForeignKeys = { ...toTable.getForeignKeys() };
         for (const fromConstraint of Object.values(fromForeignKeys)) {
@@ -908,6 +913,10 @@ export class SchemaComparator {
                 // multi word type names in casts, the generic `::\w+` below only covers single word ones
                 // the precision is kept, so `timestamptz(3)` and `timestamp(3) with time zone` leave the same residue
                 .replace(/::\s*(?:character\s+varying|bit\s+varying|double\s+precision|(?:timestamp|time)\b(\s*\(\d+\))?(?:\s+with(?:out)?\s+time\s+zone)?)/gi, '$1')
+                // Protect dots inside string literals before the quote strip below, or the alias-prefix normalization
+                // would mangle literal contents — `current_setting('app.tenant')` and `current_setting('req.tenant')`
+                // must not both collapse to `current_settingtenant`
+                .replace(/'([^']*)'/g, (_, inner) => `'${inner.replaceAll('.', '\u0000')}'`)
                 // Remove quotes first so we can process identifiers
                 .replace(/['"`]/g, '')
                 // MySQL adds table/alias prefixes to columns (e.g., a.name or table_name.column vs just column)
@@ -985,6 +994,87 @@ export class SchemaComparator {
         }
         return this.diffExpression(from.body, to.body);
     }
+    diffPolicies(fromTable, toTable, diff) {
+        let changes = 0;
+        // `ignorePolicies` makes RLS create-only: declared policies are still added and RLS is still enabled/forced,
+        // but existing policies are never diffed for drop/alter and RLS is never disabled or unforced — this protects
+        // hand-written policies on databases that adopted RLS before the ORM managed it
+        const ignorePolicies = this.#platform.getConfig().get('schemaGenerator').ignorePolicies;
+        // postgres rejects `alter column ... type` on a column referenced by any policy, so a type change forces us to
+        // drop every still-present policy around the alter (dropped before via `getRlsDropSQL`, recreated after via
+        // `getRlsAlterSQL`) even when the policy itself is otherwise unchanged; a `generated`-only change is emitted
+        // as a drop + re-add of the same column, which a policy's column dependency blocks the same way
+        const hasColumnTypeChange = Object.values(diff.changedColumns).some(c => c.changedProperties.has('type')) ||
+            Object.keys(diff.removedColumns).some(name => name in diff.addedColumns);
+        for (const policy of toTable.getPolicies()) {
+            if (!fromTable.hasPolicy(policy.name)) {
+                diff.addedPolicies[policy.name] = policy;
+                this.log(`policy ${policy.name} added to table ${diff.name}`, { policy });
+                changes++;
+            }
+        }
+        if (fromTable.rlsEnabled !== toTable.rlsEnabled && (!ignorePolicies || toTable.rlsEnabled)) {
+            diff.changedRlsEnabled = toTable.rlsEnabled;
+            changes++;
+        }
+        if (fromTable.rlsForced !== toTable.rlsForced && (!ignorePolicies || toTable.rlsForced)) {
+            diff.changedRlsForced = toTable.rlsForced;
+            changes++;
+        }
+        if (ignorePolicies) {
+            // existing policies are unmanaged here, but a type change still needs them dropped and recreated for the
+            // alter to succeed — recreate each verbatim from introspection so the hand-written definition is preserved
+            if (hasColumnTypeChange) {
+                for (const policy of fromTable.getPolicies()) {
+                    diff.removedPolicies[policy.name] = policy;
+                    diff.addedPolicies[policy.name] = policy;
+                    changes += 2;
+                }
+            }
+            return changes;
+        }
+        for (const policy of fromTable.getPolicies()) {
+            const toPolicy = toTable.getPolicy(policy.name);
+            if (!toPolicy) {
+                diff.removedPolicies[policy.name] = policy;
+                this.log(`policy ${policy.name} removed from table ${diff.name}`);
+                changes++;
+                continue;
+            }
+            // changed policies are always dropped (before column drops, which the old expression can block via its
+            // column dependencies) and recreated (after column adds) — postgres could alter some of the changes in
+            // place, but not a policy's command or type, nor unset an expression
+            if (this.diffPolicy(policy, toPolicy)) {
+                diff.removedPolicies[policy.name] = policy;
+                diff.addedPolicies[policy.name] = toPolicy;
+                this.log(`policy ${policy.name} recreated in table ${diff.name}`, { from: policy, to: toPolicy });
+                changes += 2;
+                continue;
+            }
+            // an unchanged policy still blocks a type change on any column, so drop + recreate it around the alter
+            if (hasColumnTypeChange) {
+                diff.removedPolicies[policy.name] = policy;
+                diff.addedPolicies[policy.name] = toPolicy;
+                this.log(`policy ${policy.name} recreated around a column type change in table ${diff.name}`);
+                changes += 2;
+            }
+        }
+        return changes;
+    }
+    diffPolicy(from, to) {
+        // normalize so an omitted `roles` matches introspected `{public}`
+        const normalizeRoles = (roles) => DatabaseTable.isDefaultPolicyRoles(roles) ? '' : [...roles].sort().join(',');
+        if (from.command !== to.command || from.type !== to.type) {
+            return true;
+        }
+        if (normalizeRoles(from.roles) !== normalizeRoles(to.roles)) {
+            return true;
+        }
+        if (this.diffExpression(from.using ?? '', to.using ?? '')) {
+            return true;
+        }
+        return this.diffExpression(from.check ?? '', to.check ?? '');
+    }
     parseJsonDefault(defaultValue) {
         /* v8 ignore next */
         if (!defaultValue) {

package/schema/SchemaHelper.d.ts

@@ -154,6 +154,12 @@ export declare abstract class SchemaHelper {
     getChangeColumnCommentSQL(tableName: string, to: Column, schemaName?: string): string;
     /** Whether the column comment is part of the column declaration, as opposed to a separate statement. */
     protected hasInlineColumnComment(): boolean;
+    /** Row level security DDL for a freshly created table (enable/force + create policies). Postgres only. */
+    getRlsCreateSQL(table: DatabaseTable): string[];
+    /** Drops removed/changed row level security policies; emitted in the pre-alter phase, before any column drop or type alter a policy expression can block. Postgres only. */
+    getRlsDropSQL(diff: TableDifference, safe?: boolean): string[];
+    /** Row level security DDL for a table difference (enable/disable/force transitions + policy creation). Postgres only. */
+    getRlsAlterSQL(diff: TableDifference, safe?: boolean): string[];
     getNamespaces(connection: AbstractSqlConnection, ctx?: Transaction): Promise<string[]>;
     protected mapIndexes(indexes: IndexDef[]): Promise<IndexDef[]>;
     mapForeignKeys(fks: any[], tableName: string, schemaName?: string): Dictionary;

package/schema/SchemaHelper.js

@@ -504,6 +504,7 @@ export class SchemaHelper {
         if ('changedComment' in diff) {
             ret.push(this.alterTableComment(diff.toTable, diff.changedComment));
         }
+        this.append(ret, this.getRlsAlterSQL(diff, safe));
         return ret;
     }
     /** Returns SQL to add columns to an existing table. */
@@ -646,6 +647,18 @@ export class SchemaHelper {
     hasInlineColumnComment() {
         return false;
     }
+    /** Row level security DDL for a freshly created table (enable/force + create policies). Postgres only. */
+    getRlsCreateSQL(table) {
+        return [];
+    }
+    /** Drops removed/changed row level security policies; emitted in the pre-alter phase, before any column drop or type alter a policy expression can block. Postgres only. */
+    getRlsDropSQL(diff, safe) {
+        return [];
+    }
+    /** Row level security DDL for a table difference (enable/disable/force transitions + policy creation). Postgres only. */
+    getRlsAlterSQL(diff, safe) {
+        return [];
+    }
     async getNamespaces(connection, ctx) {
         return [];
     }
@@ -801,6 +814,8 @@ export class SchemaHelper {
             for (const trigger of table.getTriggers()) {
                 this.append(ret, this.createTrigger(table, trigger));
             }
+            // RLS policies can reference other tables, so they are deferred until every table exists (see the
+            // callers of getRlsCreateSQL in SqlSchemaGenerator) rather than emitted inline here
         }
         return ret;
     }

package/schema/SqlSchemaGenerator.js

@@ -94,6 +94,10 @@ export class SqlSchemaGenerator extends AbstractSchemaGenerator {
                 this.append(ret, fks, true);
             }
         }
+        // RLS policies are deferred until every table exists, so a policy expression can reference another table
+        for (const table of toSchema.getTables()) {
+            this.append(ret, this.helper.getRlsCreateSQL(table));
+        }
         const sortedViews = this.sortViewsByDependencies(toSchema.getViews());
         for (const view of sortedViews) {
             this.appendViewCreation(ret, view);
@@ -351,6 +355,7 @@ export class SqlSchemaGenerator extends AbstractSchemaGenerator {
                 for (const trigger of newTable.getTriggers()) {
                     this.append(sql, this.helper.createTrigger(newTable, trigger));
                 }
+                this.append(sql, this.helper.getRlsCreateSQL(newTable));
                 this.append(ret, sql, true);
             }
         }
@@ -410,6 +415,9 @@ export class SqlSchemaGenerator extends AbstractSchemaGenerator {
     }
     preAlterTable(diff, safe) {
         const ret = [];
+        // removed/changed policies must be dropped before any column type alter, including the pre-alter
+        // uuid-to-text cast on postgres — a policy expression blocks type changes on the columns it references
+        this.append(ret, this.helper.getRlsDropSQL(diff, safe));
         this.append(ret, this.helper.getPreAlterTable(diff, safe));
         for (const foreignKey of Object.values(diff.removedForeignKeys)) {
             ret.push(this.helper.dropForeignKey(diff.toTable.getShortestName(), foreignKey.constraintName));

package/typings.d.ts

@@ -114,6 +114,15 @@ export interface CheckDef<T = unknown> {
     definition?: string;
     columnName?: string;
 }
+/** Resolved row level security policy for schema operations (all callbacks resolved to strings). */
+export interface SqlPolicyDef {
+    name: string;
+    command: 'select' | 'insert' | 'update' | 'delete' | 'all';
+    type: 'permissive' | 'restrictive';
+    roles: string[];
+    using?: string;
+    check?: string;
+}
 /** Resolved trigger definition for schema operations (all callbacks resolved to strings). */
 export interface SqlTriggerDef {
     name: string;
@@ -191,6 +200,13 @@ export interface TableDifference {
     addedTriggers: Dictionary<SqlTriggerDef>;
     changedTriggers: Dictionary<SqlTriggerDef>;
     removedTriggers: Dictionary<SqlTriggerDef>;
+    addedPolicies: Dictionary<SqlPolicyDef>;
+    /** Changed policies surface as `removedPolicies` + `addedPolicies` pairs (drop + recreate). */
+    removedPolicies: Dictionary<SqlPolicyDef>;
+    /** New RLS enable state, present only when it changed. */
+    changedRlsEnabled?: boolean;
+    /** New RLS force state, present only when it changed. */
+    changedRlsForced?: boolean;
     addedForeignKeys: Dictionary<ForeignKey>;
     changedForeignKeys: Dictionary<ForeignKey>;
     removedForeignKeys: Dictionary<ForeignKey>;