@mikro-orm/sql 7.2.0-dev.2 → 7.2.0-dev.20

package/AbstractSqlPlatform.d.ts

@@ -1,4 +1,4 @@
-import { type RawQueryFragment, type Constructor, type EntityManager, type EntityRepository, type IDatabaseDriver, type IsolationLevel, type MikroORM, Platform } from '@mikro-orm/core';
+import { type RawQueryFragment, type Constructor, type EntityManager, type EntityProperty, type EntityRepository, type FormulaColumns, type IDatabaseDriver, type IsolationLevel, type MikroORM, Platform } from '@mikro-orm/core';
 import { SqlSchemaGenerator } from './schema/SqlSchemaGenerator.js';
 import { type SchemaHelper } from './schema/SchemaHelper.js';
 import type { IndexDef } from './typings.js';
@@ -17,6 +17,8 @@ export declare abstract class AbstractSqlPlatform extends Platform {
     getSchemaGenerator(driver: IDatabaseDriver, em?: EntityManager): SqlSchemaGenerator;
     /** @internal */
     createNativeQueryBuilder(): NativeQueryBuilder;
+    /** @inheritDoc */
+    getThroughRelationFormula(prop: EntityProperty, columns: FormulaColumns<any>): string;
     getBeginTransactionSQL(options?: {
         isolationLevel?: IsolationLevel;
         readOnly?: boolean;
@@ -28,7 +30,7 @@ export declare abstract class AbstractSqlPlatform extends Platform {
     getReleaseSavepointSQL(savepointName: string): string;
     quoteValue(value: any): string;
     getSearchJsonPropertySQL(path: string, type: string, aliased: boolean): string | RawQueryFragment;
-    getSearchJsonPropertyKey(path: string[], type: string, aliased: boolean, value?: unknown): string | RawQueryFragment;
+    getSearchJsonPropertyKey(path: string[], type: string, aliased: boolean | string, value?: unknown): string | RawQueryFragment;
     /**
      * Quotes a key for use inside a JSON path expression (e.g. `$.key`).
      * Simple alphanumeric keys are left unquoted; others are wrapped in double quotes

package/AbstractSqlPlatform.js

@@ -1,4 +1,4 @@
-import { isRaw, JsonProperty, Platform, raw, Utils, } from '@mikro-orm/core';
+import { isRaw, JsonProperty, Platform, raw, Utils, ValidationError, } from '@mikro-orm/core';
 import { SqlEntityRepository } from './SqlEntityRepository.js';
 import { SqlSchemaGenerator } from './schema/SqlSchemaGenerator.js';
 import { NativeQueryBuilder } from './query/NativeQueryBuilder.js';
@@ -39,6 +39,37 @@ export class AbstractSqlPlatform extends Platform {
     createNativeQueryBuilder() {
         return new NativeQueryBuilder(this);
     }
+    /** @inheritDoc */
+    getThroughRelationFormula(prop, columns) {
+        const through = prop.through;
+        const driver = this.config.getDriver();
+        const alias = `${prop.name}_through`;
+        const qb = driver.createQueryBuilder(through.entity, undefined, 'read', true, undefined, alias);
+        const throughMeta = driver.getMetadata().get(through.entity);
+        const ownerProp = throughMeta.properties[through.ownerProperty];
+        const ownerMeta = driver.getMetadata().get(ownerProp.target);
+        ownerProp.fieldNames.forEach((fieldName, idx) => {
+            const referencedColumn = ownerProp.referencedColumnNames[idx];
+            const referencedProp = ownerProp.referencedPKs
+                .map(name => ownerMeta.properties[name])
+                .find(p => p.fieldNames.includes(referencedColumn));
+            // the column mapping resolves the right alias even for TPT owners, only the column name may differ for composite FK properties
+            const ownerAlias = columns[referencedProp.name].slice(0, columns[referencedProp.name].lastIndexOf('.'));
+            qb.andWhere(raw('?? = ??', [`${alias}.${fieldName}`, `${ownerAlias}.${referencedColumn}`]));
+        });
+        if (through.where) {
+            qb.andWhere(through.where);
+        }
+        if (through.orderBy) {
+            qb.orderBy(through.orderBy);
+        }
+        qb.select(through.targetProperty ?? throughMeta.primaryKeys[0]).limit(1);
+        const sql = qb.getFormattedQuery();
+        if (Object.keys(qb.state.joins).length > 0) {
+            throw new ValidationError(`The 'where' and 'orderBy' options of the through relation ${prop.name} can only reference own columns of ${throughMeta.className}`);
+        }
+        return `(${sql})`;
+    }
     getBeginTransactionSQL(options) {
         if (options?.isolationLevel) {
             return [`set transaction isolation level ${options.isolationLevel}`, 'begin'];
@@ -75,6 +106,9 @@ export class AbstractSqlPlatform extends Platform {
     getSearchJsonPropertyKey(path, type, aliased, value) {
         const [a, ...b] = path;
         const jsonPath = this.quoteValue(`$.${b.map(this.quoteJsonKey).join('.')}`);
+        if (typeof aliased === 'string') {
+            return raw(`json_extract(${this.quoteIdentifier(`${aliased}.${a}`)}, ${jsonPath})`);
+        }
         if (aliased) {
             return raw(alias => `json_extract(${this.quoteIdentifier(`${alias}.${a}`)}, ${jsonPath})`);
         }

package/SqlEntityManager.d.ts

@@ -60,14 +60,14 @@ export declare class SqlEntityManager<Driver extends AbstractSqlDriver = Abstrac
      * `signal` / `inflightQueryAbortStrategy` (set via `em.fork({ signal })`) is applied automatically.
      * For per-call cancellation use the options-bag overload below.
      */
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[], method?: 'all' | 'get' | 'run', loggerContext?: LoggingOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params?: any[] | Dictionary, method?: 'all' | 'get' | 'run', loggerContext?: LoggingOptions): Promise<T>;
     /**
      * Executes a raw SQL query with an options bag carrying `method`, `loggerContext`, `signal`
      * and `inflightQueryAbortStrategy`. Per-call `signal` / `inflightQueryAbortStrategy` override
      * the fork-level defaults set via `em.fork({ signal })`. The current transaction context is
      * applied automatically.
      */
-    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params: any[], options: EmExecuteOptions): Promise<T>;
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(query: string | NativeQueryBuilder | RawQueryFragment, params: any[] | Dictionary, options: EmExecuteOptions): Promise<T>;
     /**
      * @inheritDoc
      */

package/SqlEntityManager.js

@@ -68,21 +68,22 @@ export class SqlEntityManager extends EntityManager {
             merged.signal = opts.signal ?? fork?.signal;
             merged.inflightQueryAbortStrategy = opts.inflightQueryAbortStrategy ?? fork?.inflightQueryAbortStrategy;
         }
-        return this.getDriver().execute(query, params, opts.method ?? 'all', context.getTransactionContext(), merged);
+        return context.withSessionContext(context.getTransactionContext(), ctx => this.getDriver().execute(query, params, opts.method ?? 'all', ctx, merged));
     }
     /**
      * @inheritDoc
      */
     async countBy(entityName, groupBy, options = {}) {
         const em = this.getContext(false);
-        options = { ...options };
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         const meta = em.getMetadata().find(entityName);
         const fields = Utils.asArray(groupBy);
         const { where: rawWhere, ...countOptions } = options;
         await em.tryFlush(entityName, options);
         const where = await em.processWhere(entityName, rawWhere ?? {}, options, 'read');
-        const qb = em.createQueryBuilder(meta.class);
+        // match `em.count()` semantics: an active transaction always wins over the requested connection type
+        const connectionType = em.getTransactionContext() ? 'write' : options.connectionType;
+        const qb = em.createQueryBuilder(meta.class, undefined, connectionType);
         qb
             .select([...fields, raw('count(*) as cnt')])
             .where(where)

package/dialects/mssql/MsSqlNativeQueryBuilder.js

@@ -168,7 +168,7 @@ export class MsSqlNativeQueryBuilder extends NativeQueryBuilder {
             const fields = this.options.groupBy.map(field => this.quote(field));
             this.parts.push(`group by ${fields.join(', ')}`);
         }
-        if (this.options.having) {
+        if (this.options.having?.sql.trim()) {
             this.parts.push(`having ${this.options.having.sql}`);
             this.params.push(...this.options.having.params);
         }

package/dialects/mysql/BaseMySqlPlatform.d.ts

@@ -14,6 +14,8 @@ export declare class BaseMySqlPlatform extends AbstractSqlPlatform {
         readonly "desc nulls first": 'is not null';
         readonly "desc nulls last": 'is null';
     };
+    /** mysql and mariadb treat null as the lowest value when no placement is requested. */
+    sortsNullsLowest(): boolean;
     supportsMultiColumnCountDistinct(): boolean;
     /** @internal */
     createNativeQueryBuilder(): MySqlNativeQueryBuilder;

package/dialects/mysql/BaseMySqlPlatform.js

@@ -18,6 +18,10 @@ export class BaseMySqlPlatform extends AbstractSqlPlatform {
         [QueryOrder.desc_nulls_first]: 'is not null',
         [QueryOrder.desc_nulls_last]: 'is null',
     };
+    /** mysql and mariadb treat null as the lowest value when no placement is requested. */
+    sortsNullsLowest() {
+        return true;
+    }
     supportsMultiColumnCountDistinct() {
         return true;
     }

package/dialects/mysql/MySqlSchemaHelper.d.ts

@@ -53,6 +53,7 @@ export declare class MySqlSchemaHelper extends SchemaHelper {
     getPreAlterTable(tableDiff: TableDifference, safe: boolean): string[];
     getRenameColumnSQL(tableName: string, oldColumnName: string, to: Column): string;
     getRenameIndexSQL(tableName: string, index: IndexDef, oldIndexName: string): string[];
+    protected hasInlineColumnComment(): boolean;
     getChangeColumnCommentSQL(tableName: string, to: Column, schemaName?: string): string;
     alterTableColumn(column: Column, table: DatabaseTable, changedProperties: Set<string>): string[];
     private getColumnDeclarationSQL;

package/dialects/mysql/MySqlSchemaHelper.js

@@ -322,7 +322,7 @@ export class MySqlSchemaHelper extends SchemaHelper {
         const ret = [];
         for (const event of trigger.events) {
             const name = trigger.events.length > 1 ? `${trigger.name}_${event}` : trigger.name;
-            ret.push(`create trigger ${this.quote(name)} ${timing} ${event.toUpperCase()} on ${table.getQuotedName()} for each ROW begin ${trigger.body}; end`);
+            ret.push(`create trigger ${this.quote(name)} ${timing} ${event.toUpperCase()} on ${table.getQuotedName()} for each ROW begin ${this.normalizeTriggerBody(trigger.body)} end`);
         }
         return ret.join(';\n');
     }
@@ -540,6 +540,9 @@ export class MySqlSchemaHelper extends SchemaHelper {
         const keyName = this.quote(index.keyName);
         return [`alter table ${tableName} rename index ${oldIndexName} to ${keyName}`];
     }
+    hasInlineColumnComment() {
+        return true;
+    }
     getChangeColumnCommentSQL(tableName, to, schemaName) {
         tableName = this.quote(tableName);
         const columnName = this.quote(to.name);

package/dialects/oracledb/OracleNativeQueryBuilder.js

@@ -234,7 +234,7 @@ export class OracleNativeQueryBuilder extends NativeQueryBuilder {
             const fields = this.options.groupBy.map(field => this.quote(field));
             this.parts.push(`group by ${fields.join(', ')}`);
         }
-        if (this.options.having) {
+        if (this.options.having?.sql.trim()) {
             this.parts.push(`having ${this.options.having.sql}`);
             this.params.push(...this.options.having.params);
         }

package/dialects/postgresql/BasePostgreSqlPlatform.d.ts

@@ -16,6 +16,8 @@ export declare class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     getEnumArrayCheckConstraintExpression(column: string, items: string[]): string;
     supportsMaterializedViews(): boolean;
     supportsPartitionedTables(): boolean;
+    supportsRowLevelSecurity(): boolean;
+    getCurrentSettingCast(mappedType: Type<unknown>): string | null;
     supportsCustomPrimaryKeyNames(): boolean;
     getCurrentTimestampSQL(length: number): string;
     getDateTimeTypeDeclarationSQL(column: {
@@ -88,7 +90,7 @@ export declare class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     }): string;
     getBlobDeclarationSQL(): string;
     getJsonDeclarationSQL(): string;
-    getSearchJsonPropertyKey(path: string[], type: string | undefined | Type, aliased: boolean, value?: unknown): string | RawQueryFragment;
+    getSearchJsonPropertyKey(path: string[], type: string | undefined | Type, aliased: boolean | string, value?: unknown): string | RawQueryFragment;
     getJsonIndexDefinition(index: IndexDef): string[];
     quoteIdentifier(id: string | {
         toString: () => string;

package/dialects/postgresql/BasePostgreSqlPlatform.js

@@ -1,4 +1,4 @@
-import { ALIAS_REPLACEMENT, ARRAY_OPERATORS, raw, RawQueryFragment, Type, Utils, } from '@mikro-orm/core';
+import { ALIAS_REPLACEMENT, ARRAY_OPERATORS, BigIntType, BooleanType, DateTimeType, DateType, EnumType, IntegerType, raw, RawQueryFragment, SmallIntType, StringType, TextType, TimeType, TinyIntType, Type, Utils, UuidType, } from '@mikro-orm/core';
 import { AbstractSqlPlatform } from '../../AbstractSqlPlatform.js';
 import { PostgreSqlNativeQueryBuilder } from './PostgreSqlNativeQueryBuilder.js';
 import { PostgreSqlSchemaHelper } from './PostgreSqlSchemaHelper.js';
@@ -33,6 +33,38 @@ export class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     supportsPartitionedTables() {
         return true;
     }
+    supportsRowLevelSecurity() {
+        return true;
+    }
+    getCurrentSettingCast(mappedType) {
+        if (mappedType instanceof UuidType) {
+            return '::uuid';
+        }
+        if (mappedType instanceof BigIntType) {
+            return '::bigint';
+        }
+        // MediumIntType extends IntegerType, so it is covered here too
+        if (mappedType instanceof IntegerType || mappedType instanceof SmallIntType || mappedType instanceof TinyIntType) {
+            return '::int';
+        }
+        if (mappedType instanceof BooleanType) {
+            return '::boolean';
+        }
+        if (mappedType instanceof DateTimeType) {
+            return '::timestamptz';
+        }
+        if (mappedType instanceof DateType) {
+            return '::date';
+        }
+        if (mappedType instanceof TimeType) {
+            return '::time';
+        }
+        // current_setting() returns text already, so string-compatible types need no cast (CharacterType extends StringType)
+        if (mappedType instanceof StringType || mappedType instanceof TextType || mappedType instanceof EnumType) {
+            return '';
+        }
+        return null;
+    }
     supportsCustomPrimaryKeyNames() {
         return true;
     }
@@ -285,7 +317,8 @@ export class BasePostgreSqlPlatform extends AbstractSqlPlatform {
     getSearchJsonPropertyKey(path, type, aliased, value) {
         const first = path.shift();
         const last = path.pop();
-        const root = this.quoteIdentifier(aliased ? `${ALIAS_REPLACEMENT}.${first}` : first);
+        const alias = typeof aliased === 'string' ? aliased : ALIAS_REPLACEMENT;
+        const root = this.quoteIdentifier(aliased ? `${alias}.${first}` : first);
         type = typeof type === 'string' ? this.getMappedType(type).runtimeType : String(type);
         const cast = (key) => raw(type in this.#jsonTypeCasts ? `(${key})::${this.#jsonTypeCasts[type]}` : key);
         let lastOperator = '->>';

package/dialects/postgresql/PostgreSqlExceptionConverter.js

@@ -1,4 +1,4 @@
-import { DeadlockException, ExceptionConverter, ForeignKeyConstraintViolationException, InvalidFieldNameException, NonUniqueFieldNameException, NotNullConstraintViolationException, SyntaxErrorException, TableExistsException, TableNotFoundException, UniqueConstraintViolationException, CheckConstraintViolationException, } from '@mikro-orm/core';
+import { DeadlockException, ExceptionConverter, ForeignKeyConstraintViolationException, InvalidFieldNameException, NonUniqueFieldNameException, NotNullConstraintViolationException, RowLevelSecurityViolationException, SyntaxErrorException, TableExistsException, TableNotFoundException, UniqueConstraintViolationException, CheckConstraintViolationException, } from '@mikro-orm/core';
 export class PostgreSqlExceptionConverter extends ExceptionConverter {
     /**
      * @see http://www.postgresql.org/docs/9.4/static/errcodes-appendix.html
@@ -31,6 +31,13 @@ export class PostgreSqlExceptionConverter extends ExceptionConverter {
                 return new UniqueConstraintViolationException(exception);
             case '23514':
                 return new CheckConstraintViolationException(exception);
+            case '42501':
+                // 42501 is generic insufficient_privilege; only RLS write violations carry this message — the `routine`
+                // field covers servers with a non-english `lc_messages`, where the message check cannot match
+                if (exception.message.includes('row-level security policy') || exception.routine === 'ExecWithCheckOptions') {
+                    return new RowLevelSecurityViolationException(exception);
+                }
+                break;
             case '42601':
                 return new SyntaxErrorException(exception);
             case '42702':

package/dialects/postgresql/PostgreSqlSchemaHelper.d.ts

@@ -1,7 +1,7 @@
 import { type Dictionary, type Transaction } from '@mikro-orm/core';
 import { SchemaHelper } from '../../schema/SchemaHelper.js';
 import type { AbstractSqlConnection } from '../../AbstractSqlConnection.js';
-import type { CheckDef, Column, ForeignKey, IndexDef, Table, TableDifference, TablePartitioning, SqlTriggerDef, SqlRoutineDef } from '../../typings.js';
+import type { CheckDef, Column, ForeignKey, IndexDef, Table, TableDifference, TablePartitioning, SqlPolicyDef, SqlTriggerDef, SqlRoutineDef } from '../../typings.js';
 import type { DatabaseSchema } from '../../schema/DatabaseSchema.js';
 import type { DatabaseTable } from '../../schema/DatabaseTable.js';
 export declare class PostgreSqlSchemaHelper extends SchemaHelper {
@@ -69,6 +69,19 @@ export declare class PostgreSqlSchemaHelper extends SchemaHelper {
     createTrigger(table: DatabaseTable, trigger: SqlTriggerDef): string;
     /** Generates SQL to drop a PostgreSQL trigger and its associated function. */
     dropTrigger(table: DatabaseTable, trigger: SqlTriggerDef): string;
+    /** Flattens `;\n` inside the dollar-quoted blocks of a raw DDL expression, which are not statement boundaries. */
+    private flattenDollarQuotedBodies;
+    getRlsCreateSQL(table: DatabaseTable): string[];
+    getRlsDropSQL(diff: TableDifference, safe?: boolean): string[];
+    getRlsAlterSQL(diff: TableDifference, safe?: boolean): string[];
+    /**
+     * Quotes a policy or role name as a single identifier. Unlike `quote()`/`platform.quoteIdentifier`, which treat
+     * a dot as a schema qualifier, these names are never schema-qualified, so `my.role` must render as `"my.role"`.
+     */
+    private quoteUnqualified;
+    private createPolicy;
+    private dropPolicy;
+    private formatPolicyRoles;
     createRoutine(routine: SqlRoutineDef): string;
     dropRoutine(routine: SqlRoutineDef): string;
     getAllRoutines(connection: AbstractSqlConnection, schemas?: string[]): Promise<SqlRoutineDef[]>;
@@ -85,6 +98,12 @@ export declare class PostgreSqlSchemaHelper extends SchemaHelper {
     getDatabaseCollation(connection: AbstractSqlConnection, ctx?: Transaction): Promise<string | undefined>;
     getAllTriggers(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>): Promise<Dictionary<SqlTriggerDef[]>>;
     private getTriggersSQL;
+    getAllPolicies(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>, ctx?: Transaction): Promise<Dictionary<{
+        policies: SqlPolicyDef[];
+        enabled: boolean;
+        forced: boolean;
+    }>>;
+    private parsePgRoles;
     getAllForeignKeys(connection: AbstractSqlConnection, tablesBySchemas: Map<string | undefined, Table[]>, ctx?: Transaction): Promise<Dictionary<Dictionary<ForeignKey>>>;
     getNativeEnumDefinitions(connection: AbstractSqlConnection, schemas: string[], ctx?: Transaction): Promise<Dictionary<{
         name: string;
@@ -131,6 +150,8 @@ export declare class PostgreSqlSchemaHelper extends SchemaHelper {
      * Build the column list for a PostgreSQL index.
      */
     protected getIndexColumns(index: IndexDef): string;
+    /** Non-default index access methods (gin, gist, brin, hash, ...), normalized to lower case. */
+    getIndexAccessMethod(index: IndexDef): string;
     /**
      * PostgreSQL-specific index options like fill factor.
      */

package/dialects/postgresql/PostgreSqlSchemaHelper.js

@@ -3,6 +3,8 @@ import { SchemaHelper, stripStatementNewlines } from '../../schema/SchemaHelper.
 import { normalizePartitionBound, normalizePartitionDefinition } from '../../schema/partitioning.js';
 /** PostGIS system views that should be automatically ignored */
 const POSTGIS_VIEWS = ['geography_columns', 'geometry_columns'];
+/** Dollar-quote delimiter, e.g. `$$` or `$body$`, captured so `split` keeps it. */
+const DOLLAR_QUOTE_TAG = /(\$(?:[A-Za-z_]\w*)?\$)/;
 export class PostgreSqlSchemaHelper extends SchemaHelper {
     static DEFAULT_VALUES = {
         'now()': ['now()', 'current_timestamp'],
@@ -160,6 +162,7 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
         const fks = await this.getAllForeignKeys(connection, tablesBySchema, ctx);
         const partitionings = await this.getPartitions(connection, tablesBySchema, ctx);
         const triggers = await this.getAllTriggers(connection, tablesBySchema);
+        const policies = await this.getAllPolicies(connection, tablesBySchema, ctx);
         const dbCollation = await this.getDatabaseCollation(connection, ctx);
         for (const t of tables) {
             const key = this.getTableKey(t);
@@ -173,6 +176,12 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
             if (triggers[key]) {
                 table.setTriggers(triggers[key]);
             }
+            const rls = policies[key];
+            if (rls) {
+                table.setPolicies(rls.policies);
+                table.rlsEnabled = rls.enabled;
+                table.rlsForced = rls.forced;
+            }
             table.setPartitioning(partitionings[key]);
         }
     }
@@ -492,7 +501,7 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
             // SchemaHelper.createCheck).
             const m = /^check \(\((.*)\)\)$/is.exec(check.expression);
             const single = m ? null : /^check \((.*)\)$/is.exec(check.expression);
-            const def = m ? m[1].replace(/\((.*?)\)::\w+/g, '$1') : single ? single[1] : check.expression;
+            const def = m ? m[1].replace(/\(([^()]*)\)::\w+(?:\[\])?/g, '$1') : single ? single[1] : check.expression;
             ret[key].push({
                 name: check.name,
                 columnName: check.column_name,
@@ -505,7 +514,7 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
     /** Generates SQL to create a PostgreSQL trigger and its associated function. */
     createTrigger(table, trigger) {
         if (trigger.expression) {
-            return trigger.expression;
+            return this.flattenDollarQuotedBodies(trigger.expression);
         }
         const timing = trigger.timing.toUpperCase();
         const events = trigger.events.map(e => e.toUpperCase()).join(' OR ');
@@ -513,7 +522,7 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
         const when = trigger.when ? `\n  when (${trigger.when})` : '';
         const fnName = this.getSchemaQualifiedTriggerFnName(table, trigger);
         const triggerName = this.platform.quoteIdentifier(trigger.name);
-        const fnSql = `create or replace function ${fnName}() returns trigger as $$ begin ${trigger.body}; end; $$ language plpgsql`;
+        const fnSql = `create or replace function ${fnName}() returns trigger as $$ begin ${this.normalizeTriggerBody(trigger.body)} end; $$ language plpgsql`;
         const triggerSql = `create trigger ${triggerName} ${timing} ${events} on ${table.getQuotedName()} for each ${forEach}${when} execute function ${fnName}()`;
         return `${fnSql};\n${triggerSql}`;
     }
@@ -523,9 +532,101 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
         const fnName = this.getSchemaQualifiedTriggerFnName(table, trigger);
         return `drop trigger if exists ${triggerName} on ${table.getQuotedName()};\ndrop function if exists ${fnName}()`;
     }
+    /** Flattens `;\n` inside the dollar-quoted blocks of a raw DDL expression, which are not statement boundaries. */
+    flattenDollarQuotedBodies(ddl) {
+        let openTag = '';
+        return ddl
+            .split(DOLLAR_QUOTE_TAG)
+            .map((part, i) => {
+            // the capture group puts the delimiters on the odd indexes
+            if (i % 2 === 1) {
+                openTag = openTag === part ? '' : openTag || part;
+                return part;
+            }
+            return openTag ? stripStatementNewlines(part) : part;
+        })
+            .join('');
+    }
+    getRlsCreateSQL(table) {
+        const ret = [];
+        if (table.rlsEnabled) {
+            ret.push(`alter table ${table.getQuotedName()} enable row level security`);
+        }
+        if (table.rlsForced) {
+            ret.push(`alter table ${table.getQuotedName()} force row level security`);
+        }
+        for (const policy of table.getPolicies()) {
+            ret.push(this.createPolicy(table, policy));
+        }
+        return ret;
+    }
+    getRlsDropSQL(diff, safe) {
+        // a policy expression holds a dependency on the columns it references, so removed policies (including the
+        // old version of changed ones) must be dropped before the column drops emitted later in the diff;
+        // in safe mode only recreated policies (present in both removed + added) are dropped, so a policy that is
+        // merely removed is left untouched like removed triggers/columns
+        return Object.values(diff.removedPolicies)
+            .filter(policy => !safe || policy.name in diff.addedPolicies)
+            .map(policy => this.dropPolicy(diff.toTable, policy));
+    }
+    getRlsAlterSQL(diff, safe) {
+        const ret = [];
+        const table = diff.toTable;
+        if (diff.changedRlsEnabled === true) {
+            ret.push(`alter table ${table.getQuotedName()} enable row level security`);
+        }
+        if (diff.changedRlsForced === true) {
+            ret.push(`alter table ${table.getQuotedName()} force row level security`);
+        }
+        else if (!safe && diff.changedRlsForced === false) {
+            ret.push(`alter table ${table.getQuotedName()} no force row level security`);
+        }
+        for (const policy of Object.values(diff.addedPolicies)) {
+            ret.push(this.createPolicy(table, policy));
+        }
+        // disable only after its policies are gone (removed ones were dropped via `getRlsDropSQL`); skipped in
+        // safe mode so a safe run never lifts row level security off an existing table
+        if (!safe && diff.changedRlsEnabled === false) {
+            ret.push(`alter table ${table.getQuotedName()} disable row level security`);
+        }
+        return ret;
+    }
+    /**
+     * Quotes a policy or role name as a single identifier. Unlike `quote()`/`platform.quoteIdentifier`, which treat
+     * a dot as a schema qualifier, these names are never schema-qualified, so `my.role` must render as `"my.role"`.
+     */
+    quoteUnqualified(name) {
+        return `"${name.replaceAll('"', '""')}"`;
+    }
+    createPolicy(table, policy) {
+        const parts = [`create policy ${this.quoteUnqualified(policy.name)} on ${table.getQuotedName()}`];
+        if (policy.type === 'restrictive') {
+            parts.push('as restrictive');
+        }
+        if (policy.command !== 'all') {
+            parts.push(`for ${policy.command}`);
+        }
+        if (policy.roles.length > 0) {
+            parts.push(`to ${this.formatPolicyRoles(policy.roles)}`);
+        }
+        if (policy.using) {
+            parts.push(`using (${policy.using})`);
+        }
+        if (policy.check) {
+            parts.push(`with check (${policy.check})`);
+        }
+        return parts.join(' ');
+    }
+    dropPolicy(table, policy) {
+        return `drop policy ${this.quoteUnqualified(policy.name)} on ${table.getQuotedName()}`;
+    }
+    // `public` is a keyword and must stay unquoted; other roles are quoted like any identifier
+    formatPolicyRoles(roles) {
+        return roles.map(role => (role === 'public' ? 'public' : this.quoteUnqualified(role))).join(', ');
+    }
     createRoutine(routine) {
         if (routine.expression) {
-            return routine.expression;
+            return this.flattenDollarQuotedBodies(routine.expression);
         }
         const qualifiedName = this.qualifiedRoutineName(routine);
         const params = this.formatRoutineParams(routine);
@@ -715,6 +816,56 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
     where (${conditions.join(' or ')})
     order by t.trigger_name, t.event_manipulation`;
     }
+    async getAllPolicies(connection, tablesBySchemas, ctx) {
+        const conditionsFor = (schemaColumn, tableColumn) => [...tablesBySchemas.entries()].map(([schema, tables]) => {
+            const names = tables.map(t => this.platform.quoteValue(t.table_name)).join(', ');
+            const schemaName = this.platform.quoteValue(schema ?? this.platform.getDefaultSchemaName());
+            return `(${schemaColumn} = ${schemaName} and ${tableColumn} in (${names}))`;
+        });
+        const flagConditions = conditionsFor('ns.nspname', 'cls.relname');
+        const policyConditions = conditionsFor('schemaname', 'tablename');
+        // pg_class carries the enable/force flags (a table can enable RLS with zero policies)
+        const flagRows = await connection.execute(`select cls.relname as table_name, ns.nspname as schema_name, cls.relrowsecurity as enabled, cls.relforcerowsecurity as forced
+        from pg_class cls
+        join pg_namespace ns on ns.oid = cls.relnamespace
+        where (${flagConditions.join(' or ')})`, [], 'all', ctx);
+        const policyRows = await connection.execute(`select tablename as table_name, schemaname as schema_name, policyname as name, permissive, roles, cmd, qual, with_check
+        from pg_policies
+        where (${policyConditions.join(' or ')})
+        order by policyname`, [], 'all', ctx);
+        const policiesByTable = {};
+        for (const row of policyRows) {
+            const key = this.getTableKey(row);
+            (policiesByTable[key] ??= []).push({
+                name: row.name,
+                command: row.cmd.toLowerCase(),
+                type: row.permissive === 'PERMISSIVE' ? 'permissive' : 'restrictive',
+                roles: this.parsePgRoles(row.roles),
+                using: row.qual ?? undefined,
+                check: row.with_check ?? undefined,
+            });
+        }
+        const ret = {};
+        for (const row of flagRows) {
+            const key = this.getTableKey(row);
+            ret[key] = { policies: policiesByTable[key] ?? [], enabled: row.enabled, forced: row.forced };
+        }
+        return ret;
+    }
+    // node-postgres returns `pg_policies.roles` as an unparsed array literal (`{public}`), pglite as an array
+    parsePgRoles(value) {
+        if (Array.isArray(value)) {
+            return value;
+        }
+        // tokenize the array literal instead of splitting on commas — quoted role names can contain
+        // commas, and quoted elements escape `"` and `\` with a backslash
+        const roles = [];
+        const re = /"((?:[^"\\]|\\.)*)"|[^,]+/g;
+        for (const match of value.replace(/^\{|\}$/g, '').matchAll(re)) {
+            roles.push(match[1] != null ? match[1].replace(/\\(.)/g, '$1') : match[0]);
+        }
+        return roles;
+    }
     async getAllForeignKeys(connection, tablesBySchemas, ctx) {
         const sql = `select nsp1.nspname schema_name, cls1.relname table_name, nsp2.nspname referenced_schema_name,
       cls2.relname referenced_table_name, a.attname column_name, af.attname referenced_column_name, conname constraint_name,
@@ -949,6 +1100,24 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
             for (const { table: localTable, foreignKey } of inboundForeignKeys) {
                 this.append(ret, this.createForeignKey(localTable, foreignKey));
             }
+            // re-enable row level security and recreate the policies (createTable skips them during a rebuild);
+            // emitted after the data copy so `force row level security` can't block the owner's insert
+            this.append(ret, this.getRlsCreateSQL(table));
+            // with `ignorePolicies`, hand-written policies (and the RLS flags they imply) may exist only on the
+            // introspected side — recreate them verbatim, or the rebuild would silently strip them
+            if (this.options.ignorePolicies) {
+                if (diff.fromTable.rlsEnabled && !table.rlsEnabled) {
+                    ret.push(`alter table ${table.getQuotedName()} enable row level security`);
+                }
+                if (diff.fromTable.rlsForced && !table.rlsForced) {
+                    ret.push(`alter table ${table.getQuotedName()} force row level security`);
+                }
+                for (const policy of diff.fromTable.getPolicies()) {
+                    if (!table.hasPolicy(policy.name)) {
+                        ret.push(this.createPolicy(table, policy));
+                    }
+                }
+            }
         }
         if (safe) {
             ret.push(`-- safe mode: original tables kept in schema "${tmpSchema}"; drop that schema manually once the data is verified`);
@@ -1118,6 +1287,14 @@ export class PostgreSqlSchemaHelper extends SchemaHelper {
         })
             .join(', ');
     }
+    /** Non-default index access methods (gin, gist, brin, hash, ...), normalized to lower case. */
+    getIndexAccessMethod(index) {
+        // `fulltext` is a cross-dialect alias handled via `getFullTextIndexExpression`, not a pg access method
+        if (typeof index.type !== 'string' || ['', 'btree', 'fulltext'].includes(index.type.toLowerCase())) {
+            return '';
+        }
+        return index.type.toLowerCase();
+    }
     /**
      * PostgreSQL-specific index options like fill factor.
      */

package/dialects/sqlite/BaseSqliteConnection.d.ts

@@ -7,4 +7,7 @@ export declare class BaseSqliteConnection extends AbstractSqlConnection {
         skipOnConnect?: boolean;
     }): Promise<void>;
     protected attachDatabases(): Promise<void>;
+    /** Per-connection state, lost whenever the underlying connection is recreated, so it has to be replayed. */
+    protected getConnectionSetupSql(): Promise<string[]>;
+    private getAttachDatabasesSql;
 }

package/dialects/sqlite/BaseSqliteConnection.js

@@ -1,5 +1,6 @@
 import { CompiledQuery } from 'kysely';
 import { AbstractSqlConnection } from '../../AbstractSqlConnection.js';
+const FOREIGN_KEYS_PRAGMA = 'pragma foreign_keys = on';
 export class BaseSqliteConnection extends AbstractSqlConnection {
     createKyselyDialect(options) {
         throw new Error('No SQLite dialect configured. Pass a Kysely dialect via the `driverOptions` config option, ' +
@@ -7,19 +8,28 @@ export class BaseSqliteConnection extends AbstractSqlConnection {
     }
     async connect(options) {
         await super.connect(options);
-        await this.getClient().executeQuery(CompiledQuery.raw('pragma foreign_keys = on'));
+        await this.getClient().executeQuery(CompiledQuery.raw(FOREIGN_KEYS_PRAGMA));
         await this.attachDatabases();
     }
     async attachDatabases() {
+        for (const sql of await this.getAttachDatabasesSql()) {
+            await this.execute(sql);
+        }
+    }
+    /** Per-connection state, lost whenever the underlying connection is recreated, so it has to be replayed. */
+    async getConnectionSetupSql() {
+        return [FOREIGN_KEYS_PRAGMA, ...(await this.getAttachDatabasesSql())];
+    }
+    async getAttachDatabasesSql() {
         const attachDatabases = this.config.get('attachDatabases');
         if (!attachDatabases?.length) {
-            return;
+            return [];
         }
         const { fs } = await import('@mikro-orm/core/fs-utils');
         const baseDir = this.config.get('baseDir');
-        for (const db of attachDatabases) {
+        return attachDatabases.map(db => {
             const path = fs.absolutePath(db.path, baseDir);
-            await this.execute(`attach database '${path}' as ${this.platform.quoteIdentifier(db.name)}`);
-        }
+            return `attach database '${path}' as ${this.platform.quoteIdentifier(db.name)}`;
+        });
     }
 }