@vibeorm/sql 2.0.0-alpha.6 → 2.0.0-alpha.8

package/dist/index.js

@@ -42,64 +42,33 @@ function jsonParamCell(params) {
 function isJsonParamCell(value) {
   return typeof value === "object" && value !== null && value.__jsonParam === true;
 }
+function excludedRef(params) {
+  return { __excluded: true, column: params.column };
+}
+function isExcludedRef(value) {
+  return typeof value === "object" && value !== null && value.__excluded === true;
+}
 // packages/sql/src/capabilities.ts
-var POSTGRES_CAPABILITIES = {
-  returning: true,
-  scalarArrays: true,
-  nativeEnums: true,
-  ilike: true,
-  lateralJoin: true,
-  distinctOn: true,
-  partialIndexes: true,
-  conflictTargetConstraint: true,
-  transactionalDdl: true,
-  createManyAndReturn: true,
-  jsonColumnType: true,
-  orderByNulls: true,
-  fullTextEngines: ["bm25", "tsvector"]
-};
-var SQLITE_CAPABILITIES = {
-  returning: true,
-  scalarArrays: false,
-  nativeEnums: false,
-  ilike: false,
-  lateralJoin: false,
-  distinctOn: false,
-  partialIndexes: true,
-  conflictTargetConstraint: false,
-  transactionalDdl: true,
-  createManyAndReturn: true,
-  jsonColumnType: false,
-  orderByNulls: true,
-  fullTextEngines: ["fts5"]
-};
-var MYSQL_CAPABILITIES = {
-  returning: false,
-  scalarArrays: false,
-  nativeEnums: true,
-  ilike: false,
-  lateralJoin: false,
-  distinctOn: false,
-  partialIndexes: false,
-  conflictTargetConstraint: false,
-  transactionalDdl: false,
-  createManyAndReturn: false,
-  jsonColumnType: true,
-  orderByNulls: false,
-  fullTextEngines: ["fulltext"]
-};
-var DIALECT_CAPABILITIES = {
-  postgres: POSTGRES_CAPABILITIES,
-  sqlite: SQLITE_CAPABILITIES,
-  mysql: MYSQL_CAPABILITIES
-};
+import {
+  DIALECT_CAPABILITIES,
+  POSTGRES_CAPABILITIES,
+  SQLITE_CAPABILITIES,
+  MYSQL_CAPABILITIES
+} from "@vibeorm/schema";
 
 // packages/sql/src/dialects/postgres.ts
 var postgresDialect = {
   name: "postgres",
   capabilities: POSTGRES_CAPABILITIES,
   inArrayStrategy: "any",
+  tupleInStrategy: "rowValue",
   upsertForm: "onConflict",
+  conflictKeyEquality: {
+    foldingScalars: ["Decimal"],
+    textIsBinaryByDefault: true,
+    duplicatesInOneStatement: "reject"
+  },
+  excludedRowRef: { form: "keyword", name: "excluded" },
   doNothingForm: "onConflictDoNothing",
   insensitiveLike: "ilike",
   strictMatchStrategy: "native",
@@ -138,7 +107,14 @@ var sqliteDialect = {
   name: "sqlite",
   capabilities: SQLITE_CAPABILITIES,
   inArrayStrategy: "expand",
+  tupleInStrategy: "rowValue",
   upsertForm: "onConflict",
+  conflictKeyEquality: {
+    foldingScalars: [],
+    textIsBinaryByDefault: true,
+    duplicatesInOneStatement: "lastWriteWins"
+  },
+  excludedRowRef: { form: "keyword", name: "excluded" },
   doNothingForm: "onConflictDoNothing",
   insensitiveLike: "lower",
   strictMatchStrategy: "glob",
@@ -177,7 +153,15 @@ var mysqlDialect = {
   name: "mysql",
   capabilities: MYSQL_CAPABILITIES,
   inArrayStrategy: "expand",
+  tupleInStrategy: "rowValue",
   upsertForm: "onDuplicateKey",
+  conflictKeyEquality: {
+    foldingScalars: ["Decimal"],
+    defaultStringMaxLength: 191,
+    textIsBinaryByDefault: false,
+    duplicatesInOneStatement: "lastWriteWins"
+  },
+  excludedRowRef: { form: "rowAlias", alias: "new" },
   doNothingForm: "insertIgnore",
   insensitiveLike: "lower",
   strictMatchStrategy: "binary",
@@ -221,7 +205,27 @@ function getSqlDialect(params) {
   return SQL_DIALECTS[params.dialect];
 }
 // packages/sql/src/codecs.ts
-import { VibeError } from "@vibeorm/schema";
+import { VibeError, invalidStoredData } from "@vibeorm/schema";
+function enumMembershipCodec(params) {
+  const { model, field, enum: enumName } = params;
+  const members = new Set(params.members);
+  return {
+    encode: (value) => {
+      if (typeof value === "string" && members.has(value))
+        return value;
+      throw new VibeError({
+        code: "VIBE_VALIDATION",
+        message: `Invalid value for enum ${enumName} on ${model}.${field}`,
+        meta: { model, field, enum: enumName }
+      });
+    },
+    decode: (value) => {
+      if (typeof value === "string" && members.has(value))
+        return value;
+      throw invalidStoredData({ model, field, enum: enumName, value });
+    }
+  };
+}
 function decodeIsNoop(params) {
   const { scalarType, wire } = params;
   if (wire === undefined)
@@ -367,8 +371,435 @@ var DIALECT_CODECS = {
   sqlite: SQLITE_CODECS,
   mysql: MYSQL_CODECS
 };
+// packages/sql/src/dialects/diagnostics.ts
+import { unsupportedCapability } from "@vibeorm/schema";
+var QUERIES = Object.freeze({
+  postgresJsonWire: { dialect: "postgres", text: `SELECT '{"__vibeorm":1}'::jsonb AS "probe"` },
+  sqliteTriggers: { dialect: "sqlite", text: "SELECT name, tbl_name, sql FROM sqlite_master WHERE type = 'trigger'" }
+});
+function renderDiagnostic(params) {
+  const query = QUERIES[params.query];
+  if (params.dialect.name !== query.dialect) {
+    throw unsupportedCapability({ dialect: params.dialect.name, feature: params.query, hint: `this diagnostic requires ${query.dialect}` });
+  }
+  return { text: query.text, values: [], returning: "none" };
+}
+function isFixedDiagnostic(params) {
+  return params.query === "postgresJsonWire" || params.query === "sqliteTriggers";
+}
+
+// packages/sql/src/dialects/postgres-diagnostics.ts
+import { VibeError as VibeError2, unsupportedCapability as unsupportedCapability2 } from "@vibeorm/schema";
+
+// packages/sql/src/params.ts
+class ParamCollector {
+  dialect;
+  values;
+  constructor(dialect) {
+    this.dialect = dialect;
+    this.values = [];
+  }
+  add(value) {
+    this.values.push(value);
+    return this.dialect.placeholder({ index: this.values.length });
+  }
+  addMany(values) {
+    return values.map((value) => this.add(value));
+  }
+}
+
+// packages/sql/src/dialects/postgres-diagnostics.ts
+function renderPostgresExplain(params) {
+  const { dialect, query, options } = params;
+  requirePostgres({ dialect, feature: "query plan inspection (EXPLAIN)" });
+  const parts = [];
+  if (options?.analyze === true)
+    parts.push("ANALYZE");
+  parts.push("FORMAT JSON");
+  if (options?.verbose === true)
+    parts.push("VERBOSE");
+  if (options?.buffers === true)
+    parts.push("BUFFERS");
+  if (options?.settings === true)
+    parts.push("SETTINGS");
+  return { text: `EXPLAIN (${parts.join(", ")}) ${query.text}`, values: [...query.values], returning: "none" };
+}
+var POSTGRES_DIAGNOSTIC_SQL = Object.freeze({
+  planContext: `SELECT current_user::text AS "currentUser", session_user::text AS "sessionUser", r.rolsuper AS "superuser", r.rolbypassrls AS "bypassRls", pg_catalog.current_setting('server_version_num') AS "serverVersionNum", pg_catalog.current_database()::text AS "database" FROM pg_catalog.pg_roles r WHERE r.rolname = current_user`,
+  statementExtension: `SELECT (SELECT e.extversion FROM pg_catalog.pg_extension e WHERE e.extname = 'pg_stat_statements') AS "installedVersion", EXISTS (SELECT 1 FROM pg_catalog.pg_available_extensions a WHERE a.name = 'pg_stat_statements') AS "available", (SELECT n.nspname::text FROM pg_catalog.pg_extension e JOIN pg_catalog.pg_namespace n ON n.oid = e.extnamespace WHERE e.extname = 'pg_stat_statements') AS "schema", pg_catalog.current_setting('server_version_num') AS "serverVersionNum", pg_catalog.pg_has_role(current_user, 'pg_read_all_stats', 'MEMBER') AS "readAllStats", current_user::text AS "currentUser"`,
+  statementInfo: `SELECT i.stats_reset::text AS "statsReset" FROM %SCHEMA%.pg_stat_statements_info i`,
+  statementSnapshot: `SELECT s.queryid::text AS "queryId", s.query AS "query", s.calls AS "calls", s.total_exec_time AS "totalExecTimeMs", s.mean_exec_time AS "meanExecTimeMs", s.min_exec_time AS "minExecTimeMs", s.max_exec_time AS "maxExecTimeMs", s.rows AS "rows", s.shared_blks_hit AS "sharedBlocksHit", s.shared_blks_read AS "sharedBlocksRead", s.temp_blks_read AS "tempBlocksRead", s.temp_blks_written AS "tempBlocksWritten" FROM %SCHEMA%.pg_stat_statements s JOIN pg_catalog.pg_database d ON d.oid = s.dbid WHERE d.datname = pg_catalog.current_database() ORDER BY s.total_exec_time DESC LIMIT %LIMIT%`,
+  indexes: `SELECT i.relname::text AS "index", pg_catalog.pg_get_indexdef(x.indexrelid) AS "definition", x.indisunique AS "unique", x.indisprimary AS "primary", x.indisvalid AS "valid", pg_catalog.pg_relation_size(x.indexrelid) AS "indexBytes" FROM pg_catalog.pg_index x JOIN pg_catalog.pg_class c ON c.oid = x.indrelid JOIN pg_catalog.pg_class i ON i.oid = x.indexrelid JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = %SCHEMA_PARAM% AND c.relname = %TABLE_PARAM% ORDER BY i.relname`,
+  sessionBegin: "BEGIN",
+  sessionReadOnly: "SET TRANSACTION READ ONLY",
+  sessionCommit: "COMMIT",
+  sessionRollback: "ROLLBACK",
+  setContext: `SELECT pg_catalog.set_config(%KEY%, %VALUE%, true)`,
+  tableStats: `SELECT c.reltuples::float8 AS "estimatedRows", c.relpages::bigint AS "pages", pg_catalog.pg_table_size(c.oid) AS "tableBytes", c.relrowsecurity AS "rlsEnabled", c.relforcerowsecurity AS "rlsForced", (SELECT s.last_analyze::text FROM pg_catalog.pg_stat_all_tables s WHERE s.relid = c.oid) AS "lastAnalyze", (SELECT s.last_autoanalyze::text FROM pg_catalog.pg_stat_all_tables s WHERE s.relid = c.oid) AS "lastAutoAnalyze" FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = %SCHEMA_PARAM% AND c.relname = %TABLE_PARAM%`
+});
+var POSTGRES_WORKLOAD_LIMITS = Object.freeze({
+  minLimit: 1,
+  maxLimit: 1000
+});
+function requirePostgres(params) {
+  if (params.dialect.name !== "postgres") {
+    throw unsupportedCapability2({
+      dialect: params.dialect.name,
+      feature: params.feature,
+      hint: "plan inspection and workload statistics are PostgreSQL-shaped; portable operation tracing works on every dialect"
+    });
+  }
+}
+function renderPostgresWorkload(params) {
+  const { dialect, query, schema, table, limit } = params;
+  requirePostgres({ dialect, feature: `the "${query}" diagnostic read` });
+  const collector = new ParamCollector(dialect);
+  let text = POSTGRES_DIAGNOSTIC_SQL[query];
+  if (query === "statementInfo" || query === "statementSnapshot") {
+    text = text.replace("%SCHEMA%", dialect.quoteIdent({ name: requireArg({ value: schema, name: "schema", query }) }));
+  }
+  if (query === "statementSnapshot") {
+    const bounded = limit ?? 20;
+    if (!Number.isInteger(bounded) || bounded < POSTGRES_WORKLOAD_LIMITS.minLimit || bounded > POSTGRES_WORKLOAD_LIMITS.maxLimit) {
+      throw new VibeError2({
+        code: "VIBE_CONFIG",
+        message: `workload snapshot limit must be an integer between ${POSTGRES_WORKLOAD_LIMITS.minLimit} and ${POSTGRES_WORKLOAD_LIMITS.maxLimit}, got ${String(limit)}`,
+        meta: { limit }
+      });
+    }
+    text = text.replace("%LIMIT%", collector.add(bounded));
+  }
+  if (query === "setContext") {
+    text = text.replace("%KEY%", collector.add(requireArg({ value: params.key, name: "key", query }))).replace("%VALUE%", collector.add(params.value ?? ""));
+  }
+  if (query === "indexes" || query === "tableStats") {
+    text = text.replace("%SCHEMA_PARAM%", collector.add(requireArg({ value: schema, name: "schema", query }))).replace("%TABLE_PARAM%", collector.add(requireArg({ value: table, name: "table", query })));
+  }
+  return { text, values: collector.values, returning: "none" };
+}
+function requireArg(params) {
+  const { value, name, query } = params;
+  if (value === undefined || value.length === 0) {
+    throw new VibeError2({
+      code: "VIBE_CONFIG",
+      message: `the "${query}" diagnostic read requires a ${name}`,
+      meta: { query, argument: name }
+    });
+  }
+  return value;
+}
+
+// packages/sql/src/dialects/postgres-rls-readiness.ts
+import { unsupportedCapability as unsupportedCapability4 } from "@vibeorm/schema";
+
+// packages/sql/src/dialects/postgres-rls.ts
+import { RlsContextError, VibeError as VibeError3, assertValidSchemaIR, unsupportedCapability as unsupportedCapability3, validateRlsContextIR } from "@vibeorm/schema";
+var NATIVE_RLS = Object.freeze({ policyName: "vibeorm_managed", tableSchema: "public", settingPrefix: "vibeorm.", parentAlias: "parent" });
+var COLUMN_TYPES = {
+  String: { default: "text", native: { text: "text", varchar: "varchar", charactervarying: "varchar", uuid: "uuid" } },
+  Boolean: { default: "boolean", native: { boolean: "boolean", bool: "boolean" } },
+  Int: { default: "integer", native: { integer: "integer", int: "integer", int4: "integer", smallint: "smallint", int2: "smallint" } },
+  BigInt: { default: "bigint", native: { bigint: "bigint", int8: "bigint" } },
+  Float: { default: "double precision", native: { doubleprecision: "double precision", float8: "double precision", real: "real", float4: "real" } },
+  Decimal: { default: "numeric", native: { numeric: "numeric", decimal: "numeric" } },
+  DateTime: { default: "timestamptz", native: { timestamptz: "timestamptz", timestampwithtimezone: "timestamptz", timestamp: "timestamp", timestampwithouttimezone: "timestamp", date: "date" } }
+};
+function requireRls(params) {
+  if (!params.dialect.capabilities.nativeRowLevelSecurity) {
+    throw unsupportedCapability3({ dialect: params.dialect.name, feature: "nativeRowLevelSecurity" });
+  }
+}
+function identifier(params) {
+  if (typeof params.name !== "string" || params.name.length === 0 || params.name.includes("\x00") || new TextEncoder().encode(params.name).length > 63) {
+    throw new VibeError3({ code: "VIBE_SCHEMA_INVALID", message: "Native RLS identifiers must be nonempty PostgreSQL identifiers of at most 63 bytes" });
+  }
+  return params.dialect.quoteIdent({ name: params.name });
+}
+function tableRef(params) {
+  if (params.schema !== undefined && params.schema !== "public" && params.schema !== "pg_temp") {
+    throw unsupportedCapability3({ dialect: params.dialect.name, feature: "nativeRowLevelSecurity", hint: "Only public tables and temporary policy probes are supported" });
+  }
+  return `${identifier({ dialect: params.dialect, name: params.schema ?? NATIVE_RLS.tableSchema })}.${identifier({ dialect: params.dialect, name: params.table })}`;
+}
+function query(params) {
+  return { text: params.text, values: params.values ?? [], returning: "none" };
+}
+function renderRlsEnable(params) {
+  requireRls(params);
+  return query({ text: `ALTER TABLE ${tableRef(params)} ENABLE ROW LEVEL SECURITY` });
+}
+function renderRlsForce(params) {
+  requireRls(params);
+  return query({ text: `ALTER TABLE ${tableRef(params)} FORCE ROW LEVEL SECURITY` });
+}
+function renderRlsDisable({ dialect, table }) {
+  requireRls({ dialect });
+  return query({ text: `ALTER TABLE ${tableRef({ dialect, table })} DISABLE ROW LEVEL SECURITY` });
+}
+function renderRlsNoForce({ dialect, table }) {
+  requireRls({ dialect });
+  return query({ text: `ALTER TABLE ${tableRef({ dialect, table })} NO FORCE ROW LEVEL SECURITY` });
+}
+function renderRlsDropPolicy({ dialect, table, policyName }) {
+  requireRls({ dialect });
+  const name = identifier({ dialect, name: policyName ?? NATIVE_RLS.policyName });
+  return query({ text: `DROP POLICY ${name} ON ${tableRef({ dialect, table })}` });
+}
+function renderRlsColumnType(params) {
+  requireRls(params);
+  const { field } = params;
+  const mapping = typeof field.type === "string" && Object.hasOwn(COLUMN_TYPES, field.type) ? COLUMN_TYPES[field.type] : undefined;
+  if (mapping !== undefined && !field.isList && !field.isUnsupported) {
+    if (field.nativeType === undefined)
+      return mapping.default;
+    const match = /^([a-z][a-z0-9 ]*)(?:\(\s*\d+(?:\s*,\s*\d+)?\s*\))?$/i.exec(field.nativeType.trim());
+    const base = match?.[1]?.toLowerCase().replace(/\s+/g, "");
+    const native = base !== undefined && Object.hasOwn(mapping.native, base) ? mapping.native[base] : undefined;
+    if (native !== undefined)
+      return native;
+  }
+  throw unsupportedCapability3({ dialect: params.dialect.name, feature: "nativeRowLevelSecurity", hint: `Unsupported physical ownership type on field ${field.name}` });
+}
+function protectedModel(params) {
+  requireRls(params);
+  assertValidSchemaIR({ schema: params.schema });
+  const model = params.schema.models.find((entry) => entry.name === params.model);
+  if (model === undefined || model.rls === undefined || model.rls === "unprotected") {
+    throw new VibeError3({ code: "VIBE_SCHEMA_INVALID", message: "Native RLS policy rendering requires a protected model", meta: { model: params.model } });
+  }
+  return model;
+}
+function renderRlsPredicate(params) {
+  const model = protectedModel(params);
+  return predicate({ dialect: params.dialect, schema: params.schema, model });
+}
+function predicate(params) {
+  const { dialect, schema, model } = params;
+  const rule = model.rls;
+  if (rule === "deny")
+    return "false";
+  if (typeof rule === "object" && "where" in rule) {
+    return Object.entries(rule.where).map(([name, ref]) => {
+      const field = model.fields.find((entry) => entry.name === name);
+      const column = identifier({ dialect, name: field.dbName ?? field.name });
+      const physicalType = renderRlsColumnType({ dialect, field });
+      return `(${column} = NULLIF(current_setting('${NATIVE_RLS.settingPrefix}${ref.context}', true), '')::${physicalType})`;
+    }).join(" AND ");
+  }
+  if (typeof rule === "object" && "through" in rule) {
+    const relation = model.relations.find((entry) => entry.name === rule.through);
+    const parent = schema.models.find((entry) => entry.name === relation.targetModel);
+    const alias = identifier({ dialect, name: NATIVE_RLS.parentAlias });
+    const child = identifier({ dialect, name: model.dbName ?? model.name });
+    const join = relation.fields.map((name, index) => {
+      const childField = model.fields.find((field) => field.name === name);
+      const parentField = parent.fields.find((field) => field.name === relation.references[index]);
+      return `(${alias}.${identifier({ dialect, name: parentField.dbName ?? parentField.name })} = ${child}.${identifier({ dialect, name: childField.dbName ?? childField.name })})`;
+    }).join(" AND ");
+    return `EXISTS (SELECT 1 FROM ${tableRef({ dialect, table: parent.dbName ?? parent.name })} AS ${alias} WHERE ${join})`;
+  }
+  throw new VibeError3({ code: "VIBE_SCHEMA_INVALID", message: "Native RLS requires a protected policy rule" });
+}
+function renderRlsPolicy(params) {
+  const model = protectedModel(params);
+  const expression = predicate({ dialect: params.dialect, schema: params.schema, model });
+  const name = identifier({ dialect: params.dialect, name: params.policyName ?? NATIVE_RLS.policyName });
+  const table = tableRef({ dialect: params.dialect, table: model.dbName ?? model.name, schema: params.targetSchema });
+  return query({ text: `CREATE POLICY ${name} ON ${table} AS PERMISSIVE FOR ALL TO PUBLIC USING (${expression}) WITH CHECK (${expression})` });
+}
+function renderRlsContext(params) {
+  requireRls(params);
+  if (validateRlsContextIR({ context: params.context }).length !== 0 || Object.keys(params.context).length === 0 || typeof params.values !== "object" || params.values === null || Array.isArray(params.values)) {
+    throw new RlsContextError({ reason: "invalid" });
+  }
+  const collector = new ParamCollector(params.dialect);
+  const parts = [];
+  for (const [key, slot] of Object.entries(params.context)) {
+    if (!Object.hasOwn(params.values, key))
+      throw new RlsContextError({ reason: "missing", key });
+    const value = params.values[key];
+    if (value === null && !slot.nullable || value !== null && (typeof value !== "string" || value.length === 0 || value.includes("\x00"))) {
+      throw new RlsContextError({ reason: "invalid", key });
+    }
+    parts.push(`set_config(${collector.add(`${NATIVE_RLS.settingPrefix}${key}`)}, ${collector.add(value ?? "")}, true)`);
+  }
+  for (const key of Reflect.ownKeys(params.values)) {
+    if (typeof key !== "string" || !Object.hasOwn(params.context, key))
+      throw new RlsContextError({ reason: "invalid" });
+  }
+  return query({ text: `SELECT ${parts.join(", ")}`, values: collector.values });
+}
+function renderRlsRole(params) {
+  requireRls(params);
+  if (typeof params.role !== "string" || params.role.trim().length === 0 || params.role.includes("\x00")) {
+    throw new VibeError3({ code: "VIBE_CONFIG", message: "PGlite native RLS requires a trusted nonempty runtime role name" });
+  }
+  const collector = new ParamCollector(params.dialect);
+  return query({ text: `SELECT set_config('role', ${collector.add(params.role)}, true)`, values: collector.values });
+}
+
+// packages/sql/src/dialects/postgres-rls-readiness.ts
+var NATIVE_RLS_PROBE_POLICY = "vibeorm_probe";
+var RLS_READINESS_SQL = Object.freeze({
+  identity: `SELECT current_user::text AS "currentUser",
+       session_user::text AS "sessionUser",
+       r.rolsuper AS "super",
+       r.rolbypassrls AS "bypassRls",
+       r.rolcreatedb AS "createDb",
+       r.rolcreaterole AS "createRole",
+       pg_catalog.current_setting('server_version_num') AS "serverVersionNum",
+       pg_catalog.pg_backend_pid()::text AS "backendPid",
+       pg_catalog.pg_postmaster_start_time()::text AS "instanceStart",
+       (SELECT a.backend_start::text FROM pg_catalog.pg_stat_activity a WHERE a.pid = pg_catalog.pg_backend_pid()) AS "backendStart",
+       pg_catalog.has_database_privilege(current_user, pg_catalog.current_database(), 'TEMP') AS "tempPrivilege"
+FROM pg_catalog.pg_roles r
+WHERE r.rolname = current_user`,
+  elevatedRoles: `SELECT r.rolname::text AS "role",
+       r.rolsuper AS "super",
+       r.rolbypassrls AS "bypassRls",
+       r.rolcreaterole AS "createRole",
+       r.rolcreatedb AS "createDb"
+FROM pg_catalog.pg_roles r
+WHERE r.rolname <> current_user
+  AND pg_catalog.pg_has_role(current_user, r.oid, 'MEMBER')
+  AND (r.rolsuper OR r.rolbypassrls OR r.rolcreaterole OR r.rolcreatedb OR r.rolname LIKE 'pg\\_%')
+ORDER BY r.rolname`,
+  schemaControl: `SELECT n.nspname::text AS "schema",
+       pg_catalog.pg_get_userbyid(n.nspowner)::text AS "owner",
+       pg_catalog.pg_has_role(current_user, n.nspowner, 'MEMBER') AS "ownerAccess",
+       EXISTS (
+         SELECT 1 FROM pg_catalog.pg_roles r
+         WHERE pg_catalog.pg_has_role(current_user, r.oid, 'MEMBER')
+           AND pg_catalog.has_schema_privilege(r.oid, n.oid, 'CREATE')
+       ) AS "create",
+       pg_catalog.current_database()::text AS "database",
+       pg_catalog.pg_get_userbyid(d.datdba)::text AS "databaseOwner",
+       pg_catalog.pg_has_role(current_user, d.datdba, 'MEMBER') AS "databaseOwnerAccess"
+FROM pg_catalog.pg_namespace n
+JOIN pg_catalog.pg_database d ON d.datname = pg_catalog.current_database()
+WHERE n.nspname = $1`,
+  tables: `SELECT c.relname::text AS "table",
+       c.relrowsecurity AS "rlsEnabled",
+       c.relforcerowsecurity AS "rlsForced",
+       pg_catalog.pg_get_userbyid(c.relowner)::text AS "owner",
+       pg_catalog.pg_has_role(current_user, c.relowner, 'MEMBER') AS "ownerAccess",
+       EXISTS (
+         SELECT 1 FROM pg_catalog.pg_roles r
+         WHERE pg_catalog.pg_has_role(current_user, r.oid, 'MEMBER')
+           AND pg_catalog.has_table_privilege(r.oid, c.oid, 'TRUNCATE')
+       ) AS "truncate"
+FROM pg_catalog.pg_class c
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+WHERE n.nspname = $1 AND c.relkind IN ('r', 'p')
+ORDER BY c.relname`,
+  policies: `SELECT c.relname::text AS "table",
+       p.polname::text AS "name",
+       p.polpermissive AS "permissive",
+       p.polcmd::text AS "command",
+       (p.polroles = '{0}'::oid[]) AS "toPublic",
+       (p.polqual IS NOT NULL) AS "hasUsing",
+       (p.polwithcheck IS NOT NULL) AS "hasWithCheck"
+FROM pg_catalog.pg_policy p
+JOIN pg_catalog.pg_class c ON c.oid = p.polrelid
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+WHERE n.nspname = $1
+ORDER BY c.relname, p.polname`,
+  expressions: `SELECT c.relname::text AS "table",
+       p.polname::text AS "name",
+       (n.nspname <> $1) AS "probe",
+       pg_catalog.pg_get_expr(p.polqual, p.polrelid) AS "using",
+       pg_catalog.pg_get_expr(p.polwithcheck, p.polrelid) AS "withCheck"
+FROM pg_catalog.pg_policy p
+JOIN pg_catalog.pg_class c ON c.oid = p.polrelid
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+WHERE (n.nspname = $1 AND p.polname = $2)
+   OR (c.relnamespace = pg_catalog.pg_my_temp_schema() AND p.polname = $3)
+ORDER BY c.relname, p.polname`,
+  views: `SELECT n.nspname::text AS "schema",
+       c.relname::text AS "name",
+       pg_catalog.pg_get_userbyid(c.relowner)::text AS "owner",
+       (c.relkind = 'm') AS "materialized",
+       (COALESCE((
+          SELECT o.option_value FROM pg_catalog.pg_options_to_table(c.reloptions) AS o
+          WHERE o.option_name = 'security_invoker'
+        ), 'false') = 'true') AS "securityInvoker"
+FROM pg_catalog.pg_class c
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+  AND c.relkind IN ('v', 'm')
+  AND EXISTS (
+    SELECT 1 FROM pg_catalog.pg_roles r
+    WHERE pg_catalog.pg_has_role(current_user, r.oid, 'MEMBER')
+      AND pg_catalog.has_schema_privilege(r.oid, n.oid, 'USAGE')
+      AND (pg_catalog.has_table_privilege(r.oid, c.oid, 'SELECT')
+        OR pg_catalog.has_any_column_privilege(r.oid, c.oid, 'SELECT'))
+  )
+ORDER BY n.nspname, c.relname`,
+  routines: `SELECT n.nspname::text AS "schema",
+       p.proname::text AS "name",
+       pg_catalog.pg_get_userbyid(p.proowner)::text AS "owner"
+FROM pg_catalog.pg_proc p
+JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+  AND p.prosecdef
+  AND EXISTS (
+    SELECT 1 FROM pg_catalog.pg_roles r
+    WHERE pg_catalog.pg_has_role(current_user, r.oid, 'MEMBER')
+      AND pg_catalog.has_schema_privilege(r.oid, n.oid, 'USAGE')
+      AND pg_catalog.has_function_privilege(r.oid, p.oid, 'EXECUTE')
+  )
+ORDER BY n.nspname, p.proname`,
+  triggers: `SELECT c.relname::text AS "table",
+       t.tgname::text AS "name",
+       f.proname::text AS "function",
+       pg_catalog.pg_get_userbyid(f.proowner)::text AS "owner",
+       f.prosecdef AS "securityDefiner"
+FROM pg_catalog.pg_trigger t
+JOIN pg_catalog.pg_class c ON c.oid = t.tgrelid
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+JOIN pg_catalog.pg_proc f ON f.oid = t.tgfoid
+WHERE n.nspname = $1
+  AND NOT t.tgisinternal
+  AND f.prosecdef
+ORDER BY c.relname, t.tgname`,
+  readSearchPath: `SELECT pg_catalog.current_setting('search_path') AS "searchPath"`,
+  setSearchPath: `SELECT pg_catalog.set_config('search_path', $1, true)`
+});
+function requireRls2(params) {
+  if (!params.dialect.capabilities.nativeRowLevelSecurity) {
+    throw unsupportedCapability4({ dialect: params.dialect.name, feature: "nativeRowLevelSecurity" });
+  }
+}
+function renderRlsReadinessQuery(params) {
+  requireRls2(params);
+  const values = params.query === "setSearchPath" ? [params.searchPath ?? ""] : [NATIVE_RLS.tableSchema, NATIVE_RLS.policyName, NATIVE_RLS_PROBE_POLICY];
+  const collector = new ParamCollector(params.dialect);
+  const slots = new Map;
+  const text = RLS_READINESS_SQL[params.query].replace(/\$(\d+)/g, (slot, index) => {
+    let placeholder = slots.get(slot);
+    if (placeholder === undefined) {
+      placeholder = collector.add(values[Number(index) - 1]);
+      slots.set(slot, placeholder);
+    }
+    return placeholder;
+  });
+  return { text, values: collector.values, returning: "none" };
+}
+function renderRlsProbeTable(params) {
+  requireRls2(params);
+  const name = params.dialect.quoteIdent({ name: params.table });
+  const schema = params.dialect.quoteIdent({ name: params.action === "create" ? NATIVE_RLS.tableSchema : "pg_temp" });
+  const text = params.action === "create" ? `CREATE TEMP TABLE ${name} (LIKE ${schema}.${name}) ON COMMIT DROP` : `DROP TABLE ${schema}.${name}`;
+  return { text, values: [], returning: "none" };
+}
+function renderRlsPolicyPath(params) {
+  requireRls2(params);
+  const text = params.stage === "save" ? "SELECT pg_catalog.set_config('vibeorm.rls_saved_search_path', pg_catalog.current_setting('search_path'), true)" : params.stage === "empty" ? "SELECT pg_catalog.set_config('search_path', '', true)" : "SELECT pg_catalog.set_config('search_path', pg_catalog.current_setting('vibeorm.rls_saved_search_path'), true)";
+  return { text, values: [], returning: "none" };
+}
+
 // packages/sql/src/render.ts
-import { internalError, unsupportedCapability } from "@vibeorm/schema";
+import { internalError, unsupportedCapability as unsupportedCapability5 } from "@vibeorm/schema";
 
 // packages/sql/src/like.ts
 function escapeLikePattern(params) {
@@ -395,28 +826,23 @@ function strictMatchPattern(params) {
   return op === "contains" ? containsPattern({ raw: value }) : op === "startsWith" ? startsWithPattern({ raw: value }) : endsWithPattern({ raw: value });
 }
 
-// packages/sql/src/params.ts
-class ParamCollector {
-  dialect;
-  values;
-  constructor(dialect) {
-    this.dialect = dialect;
-    this.values = [];
-  }
-  add(value) {
-    this.values.push(value);
-    return this.dialect.placeholder({ index: this.values.length });
-  }
-  addMany(values) {
-    return values.map((value) => this.add(value));
-  }
-}
-
 // packages/sql/src/render.ts
 function renderStatement(params) {
   const { dialect, statement } = params;
   const collector = new ParamCollector(dialect);
   switch (statement.kind) {
+    case "diagnostic": {
+      if (isFixedDiagnostic(statement))
+        return renderDiagnostic({ dialect, query: statement.query });
+      if (statement.query === "postgresExplain") {
+        return renderPostgresExplain({
+          dialect,
+          query: renderStatement({ dialect, statement: statement.statement }),
+          ...statement.options === undefined ? {} : { options: statement.options }
+        });
+      }
+      return renderPostgresWorkload({ dialect, ...statement });
+    }
     case "select":
       return renderSelect({ dialect, statement, collector });
     case "insert":
@@ -425,6 +851,28 @@ function renderStatement(params) {
       return renderUpdate({ dialect, statement, collector });
     case "delete":
       return renderDelete({ dialect, statement, collector });
+    case "rlsReadiness":
+      return renderRlsReadinessQuery({ dialect, ...statement });
+    case "rlsProbeTable":
+      return renderRlsProbeTable({ dialect, ...statement });
+    case "rlsPolicyPath":
+      return renderRlsPolicyPath({ dialect, ...statement });
+    case "rlsEnable":
+      return renderRlsEnable({ dialect, table: statement.table });
+    case "rlsForce":
+      return renderRlsForce({ dialect, table: statement.table });
+    case "rlsDisable":
+      return renderRlsDisable({ dialect, table: statement.table });
+    case "rlsNoForce":
+      return renderRlsNoForce({ dialect, table: statement.table });
+    case "rlsDropPolicy":
+      return renderRlsDropPolicy({ dialect, table: statement.table, policyName: statement.policyName });
+    case "rlsPolicy":
+      return renderRlsPolicy({ dialect, ...statement });
+    case "rlsContext":
+      return renderRlsContext({ dialect, context: statement.context, values: statement.values });
+    case "rlsRole":
+      return renderRlsRole({ dialect, role: statement.role });
   }
 }
 function quoteCol(dialect, column) {
@@ -494,7 +942,7 @@ function renderAggRef(dialect, agg) {
 function assertScalarArrays(dialect, feature) {
   if (dialect.capabilities.scalarArrays)
     return;
-  throw unsupportedCapability({
+  throw unsupportedCapability5({
     dialect: dialect.name,
     feature,
     hint: "only postgres has native array columns \u2014 model the list as a related table instead"
@@ -534,6 +982,33 @@ function renderExpr(params) {
       const placeholders = collector.addMany(expr.values);
       return `${column} ${expr.negate === true ? "NOT IN" : "IN"} (${placeholders.join(", ")})`;
     }
+    case "tupleIn": {
+      if (expr.columns.length === 0) {
+        throw internalError({ message: "tupleIn needs at least one column" });
+      }
+      for (const row of expr.rows) {
+        if (row.length !== expr.columns.length) {
+          throw internalError({
+            message: `tupleIn row has ${row.length} values for ${expr.columns.length} columns`
+          });
+        }
+      }
+      if (expr.rows.length === 0) {
+        return expr.negate === true ? "1 = 1" : "1 = 0";
+      }
+      const columns = expr.columns.map((column) => quoteCol(dialect, column));
+      if (dialect.tupleInStrategy === "rowValue") {
+        const tuples = expr.rows.map((row) => `(${collector.addMany(row).join(", ")})`);
+        const base2 = `(${columns.join(", ")}) IN (${tuples.join(", ")})`;
+        return expr.negate === true ? `NOT (${base2})` : base2;
+      }
+      const conjunctions = expr.rows.map((row) => {
+        const terms = row.map((value, index) => `${columns[index]} = ${collector.add(value)}`);
+        return terms.length === 1 ? terms[0] : `(${terms.join(" AND ")})`;
+      });
+      const base = conjunctions.length === 1 ? conjunctions[0] : `(${conjunctions.join(" OR ")})`;
+      return expr.negate === true ? `NOT ${base.startsWith("(") ? base : `(${base})`}` : base;
+    }
     case "like": {
       const column = quoteCol(dialect, expr.column);
       const placeholder = collector.add(expr.pattern);
@@ -675,7 +1150,7 @@ function renderJsonLike(params) {
 function renderJsonFilter(params) {
   const { dialect, expr, collector } = params;
   if (!dialect.supportedJsonOps.includes(expr.op)) {
-    throw unsupportedCapability({
+    throw unsupportedCapability5({
       dialect: dialect.name,
       feature: `the json filter "${expr.op}"`,
       hint: `this dialect can express: ${dialect.supportedJsonOps.join(", ")}`
@@ -730,7 +1205,7 @@ function renderJsonFilter(params) {
         const elements = Array.isArray(expr.value) ? expr.value : [expr.value];
         const tests = elements.map((element) => {
           if (element === null || typeof element === "object" && element !== null) {
-            throw unsupportedCapability({
+            throw unsupportedCapability5({
               dialect: dialect.name,
               feature: "json array_contains with object/array/null elements",
               hint: "sqlite expresses scalar-element containment only \u2014 deep structural containment needs postgres or mysql"
@@ -853,7 +1328,7 @@ function renderSelect(params) {
   let distinctPrefix = "";
   if (statement.distinctOn !== undefined && statement.distinctOn.length > 0) {
     if (!dialect.capabilities.distinctOn) {
-      throw unsupportedCapability({
+      throw unsupportedCapability5({
         dialect: dialect.name,
         feature: "SELECT DISTINCT ON",
         hint: "postgres-only \u2014 the runtime emulates distinct client-side on this dialect"
@@ -884,7 +1359,7 @@ function renderSelect(params) {
   }
   if (statement.lateralJoins !== undefined && statement.lateralJoins.length > 0) {
     if (!dialect.capabilities.lateralJoin) {
-      throw unsupportedCapability({
+      throw unsupportedCapability5({
         dialect: dialect.name,
         feature: "LATERAL JOIN relation loading",
         hint: 'use the portable "query" relation strategy on this dialect'
@@ -958,13 +1433,16 @@ function renderInsert(params) {
     return "DEFAULT";
   }).join(", ")})`).join(", ");
   let text = `${insertKeyword} ${renderTable(dialect, statement.table)} (${columnList}) VALUES ${rowsSql}`;
+  if (onConflict !== undefined && !("doNothing" in onConflict) && dialect.excludedRowRef.form === "rowAlias" && Object.values(onConflict.update).some((value) => isExcludedRef(value))) {
+    text += ` AS ${dialect.quoteIdent({ name: dialect.excludedRowRef.alias })}`;
+  }
   if (onConflict !== undefined) {
     if ("doNothing" in onConflict) {
       if (dialect.doNothingForm === "onConflictDoNothing") {
         let target = "";
         if (onConflict.constraint !== undefined) {
           if (dialect.name !== "postgres") {
-            throw unsupportedCapability({
+            throw unsupportedCapability5({
               dialect: dialect.name,
               feature: "a named-constraint conflict target (ON CONFLICT ON CONSTRAINT)",
               hint: "only postgres names constraints in conflict targets \u2014 use a column-list target"
@@ -979,7 +1457,7 @@ function renderInsert(params) {
         }
         text += ` ON CONFLICT${target} DO NOTHING`;
       } else if (onConflict.constraint !== undefined || onConflict.conflictWhere !== undefined) {
-        throw unsupportedCapability({
+        throw unsupportedCapability5({
           dialect: dialect.name,
           feature: "a refined conflict target (constraint / partial-index predicate) on INSERT IGNORE",
           hint: "mysql skips on any duplicate key \u2014 drop the refinement or gate the call per dialect"
@@ -991,28 +1469,41 @@ function renderInsert(params) {
         throw internalError({ message: "upsert update must set at least one column" });
       }
       const selfRef = dialect.quoteIdent({ name: statement.table.name });
-      const assignments = renderAssignments({ dialect, entries: updates, collector, selfRef });
+      const assignments = renderAssignments({ dialect, entries: updates, collector, selfRef, allowExcluded: true });
       if (dialect.upsertForm === "onConflict") {
         if (onConflict.lastInsertIdColumn !== undefined) {
           throw internalError({ message: "lastInsertIdColumn is a mysql (onDuplicateKey) construct" });
         }
         if (onConflict.constraint !== undefined && dialect.name !== "postgres") {
-          throw unsupportedCapability({
+          throw unsupportedCapability5({
             dialect: dialect.name,
             feature: "a named-constraint conflict target (ON CONFLICT ON CONSTRAINT)",
             hint: "sqlite conflict targets are column lists \u2014 name the indexed columns instead"
           });
         }
-        const target = onConflict.constraint !== undefined ? ` ON CONSTRAINT ${dialect.quoteIdent({ name: onConflict.constraint })}` : ` (${onConflict.columns.map((name) => dialect.quoteIdent({ name })).join(", ")})`;
+        if (onConflict.constraint !== undefined && onConflict.conflictWhere !== undefined) {
+          throw internalError({
+            message: "a named-constraint conflict target already identifies the index \u2014 it cannot carry a partial predicate too"
+          });
+        }
+        const partial = onConflict.conflictWhere === undefined ? "" : ` WHERE ${onConflict.conflictWhere}`;
+        const target = onConflict.constraint !== undefined ? ` ON CONSTRAINT ${dialect.quoteIdent({ name: onConflict.constraint })}` : ` (${onConflict.columns.map((name) => dialect.quoteIdent({ name })).join(", ")})${partial}`;
         text += ` ON CONFLICT${target} DO UPDATE SET ${assignments}`;
       } else {
         if (onConflict.constraint !== undefined) {
-          throw unsupportedCapability({
+          throw unsupportedCapability5({
             dialect: dialect.name,
             feature: "a named-constraint conflict target on ON DUPLICATE KEY UPDATE",
             hint: "mysql's ODKU fires on any duplicate key \u2014 no target can be named"
           });
         }
+        if (onConflict.conflictWhere !== undefined) {
+          throw unsupportedCapability5({
+            dialect: dialect.name,
+            feature: "a partial-index conflict target on ON DUPLICATE KEY UPDATE",
+            hint: "mysql's ODKU fires on any duplicate key \u2014 a partial arbiter cannot be selected; gate the call per dialect"
+          });
+        }
         const trick = onConflict.lastInsertIdColumn === undefined ? "" : `, ${dialect.quoteIdent({ name: onConflict.lastInsertIdColumn })} = LAST_INSERT_ID(${dialect.quoteIdent({ name: onConflict.lastInsertIdColumn })})`;
         text += ` ON DUPLICATE KEY UPDATE ${assignments}${trick}`;
       }
@@ -1035,11 +1526,25 @@ function renderUpdate(params) {
   const returning = applyReturning({ dialect, requested: statement.returning });
   return { text: text + returning.suffix, values: collector.values, returning: returning.status };
 }
+function renderIncomingRowColumn(params) {
+  const { dialect, column } = params;
+  const ref = dialect.excludedRowRef;
+  const qualifier = ref.form === "keyword" ? ref.name : dialect.quoteIdent({ name: ref.alias });
+  return `${qualifier}.${dialect.quoteIdent({ name: column })}`;
+}
 function renderAssignments(params) {
   const { dialect, entries, collector, selfRef } = params;
   return entries.map(([name, value]) => {
     const column = dialect.quoteIdent({ name });
     const read = selfRef === undefined ? column : `${selfRef}.${column}`;
+    if (isExcludedRef(value)) {
+      if (params.allowExcluded !== true) {
+        throw internalError({
+          message: `an incoming-row reference (${value.column}) is only meaningful inside an upsert's update arm`
+        });
+      }
+      return `${column} = ${renderIncomingRowColumn({ dialect, column: value.column })}`;
+    }
     if (isJsonParamCell(value)) {
       return `${column} = ${collector.add(value.text)}${dialect.jsonParamCast}`;
     }
@@ -1068,13 +1573,143 @@ function renderDelete(params) {
   const returning = applyReturning({ dialect, requested: statement.returning });
   return { text: text + returning.suffix, values: collector.values, returning: returning.status };
 }
+// packages/sql/src/dialects/postgres-migration.ts
+import { VibeError as VibeError4, unsupportedCapability as unsupportedCapability6 } from "@vibeorm/schema";
+var SETTING_VALUE = /^[0-9]+(?:\.[0-9]+)?\s*(?:us|ms|s|min|h|d)?$/;
+function requirePostgres2(params) {
+  if (params.dialect.name !== "postgres") {
+    throw unsupportedCapability6({ dialect: params.dialect.name, feature: params.feature });
+  }
+}
+function renderMigrationSessionRead(params) {
+  requirePostgres2({ dialect: params.dialect, feature: "migrationSessionSettings" });
+  return {
+    text: `SELECT pg_catalog.current_setting('lock_timeout') AS "lockTimeout", pg_catalog.current_setting('statement_timeout') AS "statementTimeout"`,
+    values: [],
+    returning: "none"
+  };
+}
+function renderMigrationSessionSet(params) {
+  requirePostgres2({ dialect: params.dialect, feature: "migrationSessionSettings" });
+  const { milliseconds, setting } = params;
+  if (!Number.isSafeInteger(milliseconds) || milliseconds < 0) {
+    throw new VibeError4({
+      code: "VIBE_MIGRATION",
+      message: `${setting} must be a non-negative integer number of milliseconds (got ${String(milliseconds)})`,
+      meta: { reason: "execution-metadata-invalid", setting, value: milliseconds }
+    });
+  }
+  return { text: `SET ${params.local === true ? "LOCAL " : ""}${setting} = '${milliseconds}ms'`, values: [], returning: "none" };
+}
+function renderMigrationSessionRestore(params) {
+  requirePostgres2({ dialect: params.dialect, feature: "migrationSessionSettings" });
+  const trimmed = params.value.trim();
+  const text = SETTING_VALUE.test(trimmed) ? `SET ${params.setting} = '${trimmed}'` : `RESET ${params.setting}`;
+  return { text, values: [], returning: "none" };
+}
+function renderIndexStateQuery(params) {
+  requirePostgres2({ dialect: params.dialect, feature: "concurrentIndexRecovery" });
+  const collector = new ParamCollector(params.dialect);
+  const name = collector.add(params.index);
+  return {
+    text: `SELECT c.relname::text AS "index",
+       t.relname::text AS "table",
+       am.amname::text AS "method",
+       i.indisunique AS "unique",
+       i.indisvalid AS "valid",
+       i.indisready AS "ready",
+       pg_catalog.pg_get_expr(i.indpred, i.indrelid) AS "predicate",
+       pg_catalog.pg_get_indexdef(i.indexrelid) AS "definition",
+       (SELECT string_agg(pg_catalog.pg_get_indexdef(i.indexrelid, k.k, true), E'\\n' ORDER BY k.k)
+          FROM pg_catalog.generate_series(1, i.indnkeyatts) AS k(k)) AS "columns"
+FROM pg_catalog.pg_class c
+JOIN pg_catalog.pg_index i ON i.indexrelid = c.oid
+JOIN pg_catalog.pg_class t ON t.oid = i.indrelid
+JOIN pg_catalog.pg_am am ON am.oid = c.relam
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+WHERE n.nspname = pg_catalog.current_schema() AND c.relname = ${name}`,
+    values: collector.values,
+    returning: "none"
+  };
+}
+function renderConstraintStateQuery(params) {
+  requirePostgres2({ dialect: params.dialect, feature: "stagedConstraints" });
+  const collector = new ParamCollector(params.dialect);
+  const table = collector.add(params.table);
+  const constraint = collector.add(params.constraint);
+  return {
+    text: `SELECT con.conname::text AS "constraint",
+       rel.relname::text AS "table",
+       con.contype::text AS "type",
+       con.convalidated AS "validated",
+       pg_catalog.pg_get_constraintdef(con.oid) AS "definition"
+FROM pg_catalog.pg_constraint con
+JOIN pg_catalog.pg_class rel ON rel.oid = con.conrelid
+JOIN pg_catalog.pg_namespace n ON n.oid = rel.relnamespace
+WHERE n.nspname = pg_catalog.current_schema() AND rel.relname = ${table} AND con.conname = ${constraint}`,
+    values: collector.values,
+    returning: "none"
+  };
+}
+function renderRelationStateQuery(params) {
+  requirePostgres2({ dialect: params.dialect, feature: "renameRecovery" });
+  const collector = new ParamCollector(params.dialect);
+  const table = collector.add(params.table);
+  return {
+    text: `SELECT c.relname::text AS "table", c.relkind::text AS "kind"
+FROM pg_catalog.pg_class c
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+WHERE n.nspname = pg_catalog.current_schema() AND c.relname = ${table}`,
+    values: collector.values,
+    returning: "none"
+  };
+}
+function renderColumnStateQuery(params) {
+  requirePostgres2({ dialect: params.dialect, feature: "renameRecovery" });
+  const collector = new ParamCollector(params.dialect);
+  const table = collector.add(params.table);
+  const column = collector.add(params.column);
+  return {
+    text: `SELECT a.attname::text AS "column"
+FROM pg_catalog.pg_attribute a
+JOIN pg_catalog.pg_class c ON c.oid = a.attrelid
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+WHERE n.nspname = pg_catalog.current_schema() AND c.relname = ${table} AND a.attname = ${column}
+  AND a.attnum > 0 AND NOT a.attisdropped`,
+    values: collector.values,
+    returning: "none"
+  };
+}
 export {
   strictMatchPattern,
   startsWithPattern,
   sqliteDialect,
   renderStatement,
+  renderRlsRole,
+  renderRlsReadinessQuery,
+  renderRlsProbeTable,
+  renderRlsPredicate,
+  renderRlsPolicyPath,
+  renderRlsPolicy,
+  renderRlsNoForce,
+  renderRlsForce,
+  renderRlsEnable,
+  renderRlsDropPolicy,
+  renderRlsDisable,
+  renderRlsContext,
+  renderRlsColumnType,
+  renderRelationStateQuery,
+  renderPostgresWorkload,
+  renderPostgresExplain,
+  renderMigrationSessionSet,
+  renderMigrationSessionRestore,
+  renderMigrationSessionRead,
+  renderIndexStateQuery,
   renderFragment,
   renderExpr,
+  renderDiagnostic,
+  renderConstraintStateQuery,
+  renderColumnStateQuery,
   postgresDialect,
   mysqlDialect,
   jsonParamCell,
@@ -1082,10 +1717,14 @@ export {
   isSetOperation,
   isListSetOperation,
   isJsonParamCell,
+  isFixedDiagnostic,
+  isExcludedRef,
   isDbNowMarker,
   getSqlDialect,
+  excludedRef,
   escapeLikePattern,
   escapeGlobPattern,
+  enumMembershipCodec,
   endsWithPattern,
   decodeIsNoop,
   dbNowMarker,
@@ -1094,13 +1733,18 @@ export {
   SQL_DEFAULT_CELL,
   SQLITE_CODECS,
   SQLITE_CAPABILITIES,
+  RLS_READINESS_SQL,
   ParamCollector,
+  POSTGRES_WORKLOAD_LIMITS,
+  POSTGRES_DIAGNOSTIC_SQL,
   POSTGRES_CODECS,
   POSTGRES_CAPABILITIES,
+  NATIVE_RLS_PROBE_POLICY,
+  NATIVE_RLS,
   MYSQL_CODECS,
   MYSQL_CAPABILITIES,
   DIALECT_CODECS,
   DIALECT_CAPABILITIES
 };
 
-//# debugId=758C970CC76B2F4F64756E2164756E21
+//# debugId=BFF5BB4016D0E8C364756E2164756E21