@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/core/objects/publication/changes/publication.create.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { Publication } from "../publication.model.ts";
 import { CreatePublicationChange } from "./publication.base.ts";
 /**
@@ -13,5 +14,5 @@ export declare class CreatePublication extends CreatePublicationChange {
     });
     get creates(): `publication:${string}`[];
     get requires(): string[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/publication/changes/publication.create.js

@@ -34,7 +34,7 @@ export class CreatePublication extends CreatePublicationChange {
         }
         return Array.from(dependencies);
     }
-    serialize() {
+    serialize(_options) {
         const parts = ["CREATE PUBLICATION", this.publication.name];
         if (this.publication.all_tables) {
             parts.push("FOR ALL TABLES");

package/dist/core/objects/publication/changes/publication.drop.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { Publication } from "../publication.model.ts";
 import { DropPublicationChange } from "./publication.base.ts";
 /**
@@ -13,5 +14,5 @@ export declare class DropPublication extends DropPublicationChange {
     });
     get drops(): `publication:${string}`[];
     get requires(): `publication:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/publication/changes/publication.drop.js

@@ -17,7 +17,7 @@ export class DropPublication extends DropPublicationChange {
     get requires() {
         return [this.publication.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return `DROP PUBLICATION ${this.publication.name}`;
     }
 }

package/dist/core/objects/publication/changes/publication.security-label.d.ts

@@ -0,0 +1,28 @@
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import type { Publication } from "../publication.model.ts";
+import { CreatePublicationChange, DropPublicationChange } from "./publication.base.ts";
+export type SecurityLabelPublication = CreateSecurityLabelOnPublication | DropSecurityLabelOnPublication;
+export declare class CreateSecurityLabelOnPublication extends CreatePublicationChange {
+    readonly publication: Publication;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        publication: Publication;
+        securityLabel: SecurityLabelProps;
+    });
+    get creates(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): `publication:${string}`[];
+    serialize(): string;
+}
+export declare class DropSecurityLabelOnPublication extends DropPublicationChange {
+    readonly publication: Publication;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        publication: Publication;
+        securityLabel: SecurityLabelProps;
+    });
+    get drops(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): (`securityLabel:${string}::provider:${string}` | `publication:${string}`)[];
+    serialize(): string;
+}

package/dist/core/objects/publication/changes/publication.security-label.js

@@ -0,0 +1,61 @@
+import { quoteLiteral } from "../../base.change.js";
+import { stableId } from "../../utils.js";
+import { CreatePublicationChange, DropPublicationChange, } from "./publication.base.js";
+export class CreateSecurityLabelOnPublication extends CreatePublicationChange {
+    publication;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.publication = props.publication;
+        this.securityLabel = props.securityLabel;
+    }
+    get creates() {
+        return [
+            stableId.securityLabel(this.publication.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [this.publication.stableId];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON PUBLICATION",
+            this.publication.name,
+            "IS",
+            quoteLiteral(this.securityLabel.label),
+        ].join(" ");
+    }
+}
+export class DropSecurityLabelOnPublication extends DropPublicationChange {
+    publication;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.publication = props.publication;
+        this.securityLabel = props.securityLabel;
+    }
+    get drops() {
+        return [
+            stableId.securityLabel(this.publication.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [
+            stableId.securityLabel(this.publication.stableId, this.securityLabel.provider),
+            this.publication.stableId,
+        ];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON PUBLICATION",
+            this.publication.name,
+            "IS NULL",
+        ].join(" ");
+    }
+}

package/dist/core/objects/publication/changes/publication.types.d.ts

@@ -1,5 +1,7 @@
-import type { AlterPublicationAddSchemas, AlterPublicationAddTables, AlterPublicationDropSchemas, AlterPublicationDropTables, AlterPublicationSetForAllTables, AlterPublicationSetList, AlterPublicationSetOptions, AlterPublicationSetOwner } from "./publication.alter.ts";
+import type { AlterPublicationAddSchemas, AlterPublicationAddTables, AlterPublicationDropSchemas, AlterPublicationDropTables, AlterPublicationSetList, AlterPublicationSetOptions, AlterPublicationSetOwner } from "./publication.alter.ts";
 import type { CommentPublication } from "./publication.comment.ts";
 import type { CreatePublication } from "./publication.create.ts";
 import type { DropPublication } from "./publication.drop.ts";
-export type PublicationChange = AlterPublicationAddSchemas | AlterPublicationAddTables | AlterPublicationDropSchemas | AlterPublicationDropTables | AlterPublicationSetForAllTables | AlterPublicationSetList | AlterPublicationSetOptions | AlterPublicationSetOwner | CommentPublication | CreatePublication | DropPublication;
+import type { SecurityLabelPublication } from "./publication.security-label.ts";
+/** Union of all publication-related change variants (`objectType: "publication"`). @category Change Types */
+export type PublicationChange = AlterPublicationAddSchemas | AlterPublicationAddTables | AlterPublicationDropSchemas | AlterPublicationDropTables | AlterPublicationSetList | AlterPublicationSetOptions | AlterPublicationSetOwner | CommentPublication | CreatePublication | DropPublication | SecurityLabelPublication;

package/dist/core/objects/publication/publication.diff.d.ts

@@ -1,5 +1,4 @@
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { PublicationChange } from "./changes/publication.types.ts";
 import type { Publication } from "./publication.model.ts";
-export declare function diffPublications(ctx: {
-    currentUser: string;
-}, main: Record<string, Publication>, branch: Record<string, Publication>): PublicationChange[];
+export declare function diffPublications(ctx: Pick<ObjectDiffContext, "currentUser">, main: Record<string, Publication>, branch: Record<string, Publication>): PublicationChange[];

package/dist/core/objects/publication/publication.diff.js

@@ -1,9 +1,11 @@
 import { diffObjects } from "../base.diff.js";
+import { diffSecurityLabels } from "../security-label.types.js";
 import { deepEqual } from "../utils.js";
-import { AlterPublicationAddSchemas, AlterPublicationAddTables, AlterPublicationDropSchemas, AlterPublicationDropTables, AlterPublicationSetForAllTables, AlterPublicationSetOptions, AlterPublicationSetOwner, } from "./changes/publication.alter.js";
+import { AlterPublicationAddSchemas, AlterPublicationAddTables, AlterPublicationDropSchemas, AlterPublicationDropTables, AlterPublicationSetOptions, AlterPublicationSetOwner, } from "./changes/publication.alter.js";
 import { CreateCommentOnPublication, DropCommentOnPublication, } from "./changes/publication.comment.js";
 import { CreatePublication } from "./changes/publication.create.js";
 import { DropPublication } from "./changes/publication.drop.js";
+import { CreateSecurityLabelOnPublication, DropSecurityLabelOnPublication, } from "./changes/publication.security-label.js";
 export function diffPublications(ctx, main, branch) {
     const { created, dropped, altered } = diffObjects(main, branch);
     const changes = [];
@@ -21,6 +23,12 @@ export function diffPublications(ctx, main, branch) {
         if (publication.comment !== null) {
             changes.push(new CreateCommentOnPublication({ publication }));
         }
+        for (const label of publication.security_labels) {
+            changes.push(new CreateSecurityLabelOnPublication({
+                publication,
+                securityLabel: label,
+            }));
+        }
     }
     for (const id of dropped) {
         changes.push(new DropPublication({ publication: main[id] }));
@@ -52,21 +60,16 @@ export function diffPublications(ctx, main, branch) {
         let handledObjectLists = false;
         if (mainPublication.all_tables !== branchPublication.all_tables) {
             handledObjectLists = true;
-            if (branchPublication.all_tables) {
-                changes.push(new AlterPublicationSetForAllTables({
+            // Changing the all_tables mode requires DROP + CREATE because
+            // ALTER PUBLICATION does not support SET ALL TABLES.
+            changes.push(new DropPublication({ publication: mainPublication }));
+            changes.push(new CreatePublication({ publication: branchPublication }));
+            if (branchPublication.comment !== null) {
+                changes.push(new CreateCommentOnPublication({
                     publication: branchPublication,
                 }));
             }
-            else {
-                changes.push(new DropPublication({ publication: mainPublication }));
-                changes.push(new CreatePublication({ publication: branchPublication }));
-                if (branchPublication.comment !== null) {
-                    changes.push(new CreateCommentOnPublication({
-                        publication: branchPublication,
-                    }));
-                }
-                continue;
-            }
+            continue;
         }
         if (!handledObjectLists && !branchPublication.all_tables) {
             const tableDiff = diffPublicationTables(mainPublication.tables, branchPublication.tables);
@@ -112,6 +115,14 @@ export function diffPublications(ctx, main, branch) {
                 changes.push(new CreateCommentOnPublication({ publication: branchPublication }));
             }
         }
+        // SECURITY LABELS
+        changes.push(...diffSecurityLabels(mainPublication.security_labels, branchPublication.security_labels, (securityLabel) => new CreateSecurityLabelOnPublication({
+            publication: branchPublication,
+            securityLabel,
+        }), (securityLabel) => new DropSecurityLabelOnPublication({
+            publication: mainPublication,
+            securityLabel,
+        })));
     }
     return changes;
 }

package/dist/core/objects/publication/publication.model.d.ts

@@ -1,6 +1,7 @@
 import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
+import { type SecurityLabelProps } from "../security-label.types.ts";
 declare const publicationTablePropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
@@ -24,6 +25,10 @@ declare const publicationPropsSchema: z.ZodObject<{
         row_filter: z.ZodNullable<z.ZodString>;
     }, z.z.core.$strip>>;
     schemas: z.ZodArray<z.ZodString>;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
 }, z.z.core.$strip>;
 export type PublicationTableProps = z.infer<typeof publicationTablePropsSchema>;
 export type PublicationProps = z.infer<typeof publicationPropsSchema>;
@@ -44,6 +49,7 @@ export declare class Publication extends BasePgModel {
     readonly publish_via_partition_root: PublicationProps["publish_via_partition_root"];
     readonly tables: PublicationTableProps[];
     readonly schemas: PublicationProps["schemas"];
+    readonly security_labels: SecurityLabelProps[];
     constructor(props: PublicationProps);
     get stableId(): `publication:${string}`;
     get identityFields(): {
@@ -65,6 +71,10 @@ export declare class Publication extends BasePgModel {
             row_filter: string | null;
         }[];
         schemas: string[];
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
     stableSnapshot(): {
         identity: {
@@ -78,6 +88,10 @@ export declare class Publication extends BasePgModel {
                 row_filter: string | null;
             }[];
             schemas: string[];
+            security_labels: {
+                provider: string;
+                label: string;
+            }[];
             owner: string;
             comment: string | null;
             all_tables: boolean;

package/dist/core/objects/publication/publication.model.js

@@ -1,6 +1,7 @@
 import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
+import { normalizeSecurityLabels, securityLabelPropsSchema, } from "../security-label.types.js";
 const publicationTablePropsSchema = z.object({
     schema: z.string(),
     name: z.string(),
@@ -19,6 +20,7 @@ const publicationPropsSchema = z.object({
     publish_via_partition_root: z.boolean(),
     tables: z.array(publicationTablePropsSchema),
     schemas: z.array(z.string()),
+    security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
 });
 /**
  * Logical replication publication definition extracted from pg_publication.
@@ -37,6 +39,7 @@ export class Publication extends BasePgModel {
     publish_via_partition_root;
     tables;
     schemas;
+    security_labels;
     constructor(props) {
         super();
         this.name = props.name;
@@ -60,6 +63,7 @@ export class Publication extends BasePgModel {
             return a.schema.localeCompare(b.schema) || a.name.localeCompare(b.name);
         });
         this.schemas = [...props.schemas].sort((a, b) => a.localeCompare(b));
+        this.security_labels = props.security_labels ?? [];
     }
     get stableId() {
         return `publication:${this.name}`;
@@ -81,6 +85,7 @@ export class Publication extends BasePgModel {
             publish_via_partition_root: this.publish_via_partition_root,
             tables: this.tables,
             schemas: this.schemas,
+            security_labels: this.security_labels,
         };
     }
     stableSnapshot() {
@@ -98,6 +103,7 @@ export class Publication extends BasePgModel {
                 ...this.dataFields,
                 tables: normalizedTables.sort((a, b) => a.schema.localeCompare(b.schema) || a.name.localeCompare(b.name)),
                 schemas: [...this.schemas].sort((a, b) => a.localeCompare(b)),
+                security_labels: normalizeSecurityLabels(this.security_labels),
             },
         };
     }
@@ -173,7 +179,20 @@ export async function extractPublications(pool) {
             where s.pnpubid = p.oid
           ),
           '[]'::json
-        ) as schemas
+        ) as schemas,
+        coalesce(
+          (
+            select json_agg(
+              json_build_object('provider', sl.provider, 'label', sl.label)
+              order by sl.provider
+            )
+            from pg_catalog.pg_seclabel sl
+            where sl.objoid = p.oid
+              and sl.classoid = 'pg_publication'::regclass
+              and sl.objsubid = 0
+          ),
+          '[]'::json
+        ) as security_labels
       from pg_publication p
       left join extension_oids e on e.objid = p.oid
       where e.objid is null

package/dist/core/objects/rls-policy/changes/rls-policy.alter.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { RlsPolicy } from "../rls-policy.model.ts";
 import { AlterRlsPolicyChange } from "./rls-policy.base.ts";
 /**
@@ -26,7 +27,7 @@ export declare class AlterRlsPolicySetRoles extends AlterRlsPolicyChange {
         roles: string[];
     });
     get requires(): `rlsPolicy:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * ALTER POLICY ... USING (...)
@@ -40,7 +41,7 @@ export declare class AlterRlsPolicySetUsingExpression extends AlterRlsPolicyChan
         usingExpression: string | null;
     });
     get requires(): `rlsPolicy:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * ALTER POLICY ... WITH CHECK (...)
@@ -54,7 +55,7 @@ export declare class AlterRlsPolicySetWithCheckExpression extends AlterRlsPolicy
         withCheckExpression: string | null;
     });
     get requires(): `rlsPolicy:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * Replace an RLS policy by dropping and recreating it.

package/dist/core/objects/rls-policy/changes/rls-policy.alter.js

@@ -14,14 +14,14 @@ export class AlterRlsPolicySetRoles extends AlterRlsPolicyChange {
     get requires() {
         return [this.policy.stableId];
     }
-    serialize() {
+    serialize(_options) {
         const targetRoles = this.roles;
         const toPublic = targetRoles.length === 0 ||
             (targetRoles.length === 1 && targetRoles[0].toLowerCase() === "public");
         const rolesSql = toPublic ? "PUBLIC" : targetRoles.join(", ");
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "TO",
@@ -44,11 +44,11 @@ export class AlterRlsPolicySetUsingExpression extends AlterRlsPolicyChange {
     get requires() {
         return [this.policy.stableId];
     }
-    serialize() {
+    serialize(_options) {
         const expr = this.usingExpression ?? "true";
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "USING",
@@ -71,11 +71,11 @@ export class AlterRlsPolicySetWithCheckExpression extends AlterRlsPolicyChange {
     get requires() {
         return [this.policy.stableId];
     }
-    serialize() {
+    serialize(_options) {
         const expr = this.withCheckExpression ?? "true";
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "WITH CHECK",

package/dist/core/objects/rls-policy/changes/rls-policy.comment.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { RlsPolicy } from "../rls-policy.model.ts";
 import { CreateRlsPolicyChange, DropRlsPolicyChange } from "./rls-policy.base.ts";
 export type CommentRlsPolicy = CreateCommentOnRlsPolicy | DropCommentOnRlsPolicy;
@@ -9,7 +10,7 @@ export declare class CreateCommentOnRlsPolicy extends CreateRlsPolicyChange {
     });
     get creates(): `comment:${string}`[];
     get requires(): `rlsPolicy:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 export declare class DropCommentOnRlsPolicy extends DropRlsPolicyChange {
     readonly policy: RlsPolicy;
@@ -19,5 +20,5 @@ export declare class DropCommentOnRlsPolicy extends DropRlsPolicyChange {
     });
     get drops(): `comment:${string}`[];
     get requires(): (`comment:${string}` | `rlsPolicy:${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/rls-policy/changes/rls-policy.comment.js

@@ -14,7 +14,7 @@ export class CreateCommentOnRlsPolicy extends CreateRlsPolicyChange {
     get requires() {
         return [this.policy.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return [
             "COMMENT ON POLICY",
             this.policy.name,
@@ -39,7 +39,7 @@ export class DropCommentOnRlsPolicy extends DropRlsPolicyChange {
     get requires() {
         return [stableId.comment(this.policy.stableId), this.policy.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return [
             "COMMENT ON POLICY",
             this.policy.name,

package/dist/core/objects/rls-policy/changes/rls-policy.create.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { RlsPolicy } from "../rls-policy.model.ts";
 import { CreateRlsPolicyChange } from "./rls-policy.base.ts";
 /**
@@ -23,5 +24,5 @@ export declare class CreateRlsPolicy extends CreateRlsPolicyChange {
     });
     get creates(): `rlsPolicy:${string}`[];
     get requires(): string[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/rls-policy/changes/rls-policy.create.js

@@ -33,9 +33,32 @@ export class CreateRlsPolicy extends CreateRlsPolicyChange {
         dependencies.add(stableId.table(this.policy.schema, this.policy.table_name));
         // Owner dependency
         dependencies.add(stableId.role(this.policy.owner));
+        // Relations and functions referenced inside USING / WITH CHECK
+        // expressions must exist before the policy is created. These come from
+        // pg_depend (populated by PostgreSQL's recordDependencyOnExpr at policy
+        // creation), not from re-parsing the expression text.
+        for (const ref of this.policy.referenced_relations) {
+            switch (ref.kind) {
+                case "table":
+                    dependencies.add(stableId.table(ref.schema, ref.name));
+                    break;
+                case "view":
+                    dependencies.add(stableId.view(ref.schema, ref.name));
+                    break;
+                case "materialized_view":
+                    dependencies.add(stableId.materializedView(ref.schema, ref.name));
+                    break;
+                case "foreign_table":
+                    dependencies.add(stableId.foreignTable(ref.schema, ref.name));
+                    break;
+            }
+        }
+        for (const ref of this.policy.referenced_procedures) {
+            dependencies.add(stableId.procedure(ref.schema, ref.name, ref.argument_types.join(",")));
+        }
         return Array.from(dependencies);
     }
-    serialize() {
+    serialize(_options) {
         const parts = ["CREATE POLICY"];
         // Add policy name
         parts.push(this.policy.name);

package/dist/core/objects/rls-policy/changes/rls-policy.drop.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { RlsPolicy } from "../rls-policy.model.ts";
 import { DropRlsPolicyChange } from "./rls-policy.base.ts";
 /**
@@ -18,5 +19,5 @@ export declare class DropRlsPolicy extends DropRlsPolicyChange {
     });
     get drops(): `rlsPolicy:${string}`[];
     get requires(): `rlsPolicy:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/rls-policy/changes/rls-policy.drop.js

@@ -22,7 +22,7 @@ export class DropRlsPolicy extends DropRlsPolicyChange {
     get requires() {
         return [this.policy.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return [
             "DROP POLICY",
             this.policy.name,

package/dist/core/objects/rls-policy/changes/rls-policy.types.d.ts

@@ -2,4 +2,5 @@ import type { AlterRlsPolicy } from "./rls-policy.alter.ts";
 import type { CommentRlsPolicy } from "./rls-policy.comment.ts";
 import type { CreateRlsPolicy } from "./rls-policy.create.ts";
 import type { DropRlsPolicy } from "./rls-policy.drop.ts";
+/** Union of all RLS policy-related change variants (`objectType: "rls_policy"`). @category Change Types */
 export type RlsPolicyChange = AlterRlsPolicy | CommentRlsPolicy | CreateRlsPolicy | DropRlsPolicy;

package/dist/core/objects/rls-policy/rls-policy.diff.js

@@ -35,7 +35,19 @@ export function diffRlsPolicies(main, branch) {
             "permissive",
         ];
         const nonAlterablePropsChanged = hasNonAlterableChanges(mainRlsPolicy, branchRlsPolicy, NON_ALTERABLE_FIELDS, {});
-        if (nonAlterablePropsChanged) {
+        // The set of relations and procedures that the policy's USING / WITH
+        // CHECK expressions reference is recorded by PostgreSQL in pg_depend
+        // (recordDependencyOnExpr at policy creation). When that set changes
+        // it is unsafe to ALTER POLICY in place: the old reference target may
+        // be dropped in the same plan, and the new reference target may only
+        // exist after the create phase. Drop+create lets the sort phase order
+        // the policy's drop before the referenced object's drop and the
+        // policy's recreate after the referenced object's create.
+        const referencedDependenciesChanged = hasNonAlterableChanges(mainRlsPolicy, branchRlsPolicy, ["referenced_procedures", "referenced_relations"], {
+            referenced_procedures: deepEqual,
+            referenced_relations: deepEqual,
+        });
+        if (nonAlterablePropsChanged || referencedDependenciesChanged) {
             // Replace the entire RLS policy (drop + create)
             changes.push(new DropRlsPolicy({ policy: mainRlsPolicy }), new CreateRlsPolicy({ policy: branchRlsPolicy }));
         }

package/dist/core/objects/rls-policy/rls-policy.model.d.ts

@@ -1,14 +1,31 @@
 import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
+declare const rlsPolicyReferencedRelationSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        table: "table";
+        foreign_table: "foreign_table";
+        materialized_view: "materialized_view";
+        view: "view";
+    }>;
+    schema: z.ZodString;
+    name: z.ZodString;
+}, z.z.core.$strip>;
+export type RlsPolicyReferencedRelation = z.infer<typeof rlsPolicyReferencedRelationSchema>;
+declare const rlsPolicyReferencedProcedureSchema: z.ZodObject<{
+    schema: z.ZodString;
+    name: z.ZodString;
+    argument_types: z.ZodArray<z.ZodString>;
+}, z.z.core.$strip>;
+export type RlsPolicyReferencedProcedure = z.infer<typeof rlsPolicyReferencedProcedureSchema>;
 declare const rlsPolicyPropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
     table_name: z.ZodString;
     command: z.ZodEnum<{
+        a: "a";
         r: "r";
         w: "w";
-        a: "a";
         d: "d";
         "*": "*";
     }>;
@@ -18,6 +35,21 @@ declare const rlsPolicyPropsSchema: z.ZodObject<{
     with_check_expression: z.ZodNullable<z.ZodString>;
     owner: z.ZodString;
     comment: z.ZodNullable<z.ZodString>;
+    referenced_relations: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            table: "table";
+            foreign_table: "foreign_table";
+            materialized_view: "materialized_view";
+            view: "view";
+        }>;
+        schema: z.ZodString;
+        name: z.ZodString;
+    }, z.z.core.$strip>>;
+    referenced_procedures: z.ZodArray<z.ZodObject<{
+        schema: z.ZodString;
+        name: z.ZodString;
+        argument_types: z.ZodArray<z.ZodString>;
+    }, z.z.core.$strip>>;
 }, z.z.core.$strip>;
 export type RlsPolicyProps = z.infer<typeof rlsPolicyPropsSchema>;
 export declare class RlsPolicy extends BasePgModel {
@@ -31,6 +63,23 @@ export declare class RlsPolicy extends BasePgModel {
     readonly with_check_expression: RlsPolicyProps["with_check_expression"];
     readonly owner: RlsPolicyProps["owner"];
     readonly comment: RlsPolicyProps["comment"];
+    /**
+     * Tables / views / materialized views / foreign tables that
+     * `using_expression` / `with_check_expression` reference, sourced from
+     * `pg_depend` (`recordDependencyOnExpr` at policy creation). Drives
+     * ordering dependencies in `CreateRlsPolicy.requires`. Intentionally
+     * excluded from `dataFields` — it's derived from the expression text
+     * and changes lockstep with it.
+     */
+    readonly referenced_relations: RlsPolicyProps["referenced_relations"];
+    /**
+     * Functions / procedures that `using_expression` / `with_check_expression`
+     * reference, sourced from `pg_depend` (refclassid = `pg_proc`). The
+     * argument-type signature comes straight from `pg_proc.proargtypes` via
+     * `format_type`, so it matches the signature the procedure extractor
+     * embeds in `stableId.procedure(...)`. Not part of `dataFields`.
+     */
+    readonly referenced_procedures: RlsPolicyProps["referenced_procedures"];
     constructor(props: RlsPolicyProps);
     get stableId(): `rlsPolicy:${string}`;
     get identityFields(): {
@@ -39,7 +88,7 @@ export declare class RlsPolicy extends BasePgModel {
         name: string;
     };
     get dataFields(): {
-        command: "r" | "w" | "a" | "d" | "*";
+        command: "a" | "r" | "w" | "d" | "*";
         permissive: boolean;
         roles: string[];
         using_expression: string | null;