@prisma-next/target-postgres 0.14.0-dev.2 → 0.14.0-dev.20

package/src/core/migrations/op-factory-call.ts

@@ -40,8 +40,10 @@ import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { columnExistsAst, tableExistsAst } from '../../contract-free/checks';
 import * as contractFreeDdl from '../../contract-free/ddl';
+import type { PostgresRlsPolicy } from '../postgres-rls-policy';
 import { escapeLiteral, quoteIdentifier } from '../sql-utils';
 import type { PostgresColumnDefault } from '../types';
+import { boundSchema } from './bound-schema';
 import {
   addNotNullColumnDirect,
   alterColumnType,
@@ -61,6 +63,7 @@ import {
 } from './operations/constraints';
 import { createExtension } from './operations/dependencies';
 import { createIndex, dropIndex } from './operations/indexes';
+import { createRlsPolicy, dropRlsPolicy, enableRowLevelSecurity } from './operations/rls';
 import type { ForeignKeySpec } from './operations/shared';
 import { step, targetDetails } from './operations/shared';
 import { dropTable } from './operations/tables';
@@ -83,10 +86,6 @@ type Op = SqlMigrationPlanOperation<PostgresPlanTargetDetails>;
 // transitive package on disk.
 const POSTGRES_MIGRATION_FACADE = '@prisma-next/postgres/migration';
 
-function boundSchema(schemaName: string): string | undefined {
-  return schemaName === UNBOUND_NAMESPACE_ID ? undefined : schemaName;
-}
-
 abstract class PostgresOpFactoryCallNode extends TsExpression implements FrameworkOpFactoryCall {
   abstract readonly factoryName: string;
   abstract readonly operationClass: MigrationOperationClass;
@@ -684,10 +683,8 @@ export class DropDefaultCall extends PostgresOpFactoryCallNode {
 
 /**
  * Planner-internal call for adding a NOT NULL column (no contract default) to
- * a table that must be empty at migration time. Carries the raw ADD COLUMN SQL
- * (produced by `buildAddColumnSql` at plan time — deferred from slice-7 typed
- * DDL) plus the parameters needed to lower the typed pre/postchecks at render
- * time.
+ * a table that must be empty at migration time. Carries the typed `DdlColumn`
+ * and lowers it to an ADD COLUMN execute step via the adapter at `toOp` time.
  *
  * No authored `PostgresMigration` method: this call is only emitted by the
  * planner, never hand-written by migration authors.
@@ -698,15 +695,15 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
   readonly schemaName: string;
   readonly tableName: string;
   readonly columnName: string;
-  readonly executeStepSql: string;
+  readonly column: DdlColumn;
   readonly label: string;
 
-  constructor(schemaName: string, tableName: string, columnName: string, executeStepSql: string) {
+  constructor(schemaName: string, tableName: string, columnName: string, column: DdlColumn) {
     super();
     this.schemaName = schemaName;
     this.tableName = tableName;
     this.columnName = columnName;
-    this.executeStepSql = executeStepSql;
+    this.column = column;
     this.label = `Add column ${columnName} to ${tableName}`;
     this.freeze();
   }
@@ -717,13 +714,7 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
         `AddNotNullColumnDirectCall.toOp: a lowerer is required on the Postgres planner path (column "${this.columnName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
       );
     }
-    return addNotNullColumnDirect(
-      this.schemaName,
-      this.tableName,
-      this.columnName,
-      this.executeStepSql,
-      lowerer,
-    );
+    return addNotNullColumnDirect(this.schemaName, this.tableName, this.column, lowerer);
   }
 
   renderTypeScript(): string {
@@ -738,9 +729,9 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
 /**
  * Planner-internal call for adding a NOT NULL column (no contract default)
  * using a temporary default value for non-empty tables. Carries all parameters
- * needed for `buildAddNotNullColumnWithTemporaryDefaultOperation`; the typed
- * pre/postchecks are lowered at render time via `toOp(lowerer)`. The execute
- * SQL (`buildAddColumnSql`) is still raw per slice-7 deferral.
+ * needed for `buildAddNotNullColumnWithTemporaryDefaultOperation`; both the
+ * typed ADD COLUMN execute step and the pre/postchecks are lowered via the
+ * adapter at `toOp` time.
  *
  * No authored `PostgresMigration` method: this call is only emitted by the
  * planner, never hand-written by migration authors.
@@ -1376,6 +1367,97 @@ export class DataTransformCall extends PostgresOpFactoryCallNode {
   }
 }
 
+export class CreatePostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'createRlsPolicy' as const;
+  readonly operationClass = 'additive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly policy: PostgresRlsPolicy;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, policy: PostgresRlsPolicy) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.policy = policy;
+    this.label = `Create RLS policy "${policy.name}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `CreatePostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policy.name}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return createRlsPolicy(this.schemaName, this.tableName, this.policy, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `createRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policy)})`;
+  }
+}
+
+export class DropPostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'dropRlsPolicy' as const;
+  readonly operationClass = 'destructive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly policyName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, policyName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.policyName = policyName;
+    this.label = `Drop RLS policy "${policyName}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `DropPostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policyName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return dropRlsPolicy(this.schemaName, this.tableName, this.policyName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `dropRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policyName)})`;
+  }
+}
+
+export class EnableRowLevelSecurityCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'enableRowLevelSecurity' as const;
+  readonly operationClass = 'additive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.label = `Enable row-level security on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `EnableRowLevelSecurityCall.toOp: a lowerer is required on the Postgres planner path (table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return enableRowLevelSecurity(this.schemaName, this.tableName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `enableRowLevelSecurity(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)})`;
+  }
+}
+
 export type PostgresOpFactoryCall =
   | CreateTableCall
   | DropTableCall
@@ -1399,4 +1481,7 @@ export type PostgresOpFactoryCall =
   | RawSqlCall
   | CreateExtensionCall
   | CreateSchemaCall
+  | CreatePostgresRlsPolicyCall
+  | DropPostgresRlsPolicyCall
+  | EnableRowLevelSecurityCall
   | DataTransformCall;

package/src/core/migrations/operations/columns.ts

@@ -1,4 +1,6 @@
 import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
+import type { DdlColumn } from '@prisma-next/sql-relational-core/ast';
+import { ifDefined } from '@prisma-next/utils/defined';
 import {
   columnDefaultAst,
   columnExistsAst,
@@ -7,7 +9,9 @@ import {
   noNullValuesAst,
   tableIsEmptyAst,
 } from '../../../contract-free/checks';
+import * as contractFreeDdl from '../../../contract-free/ddl';
 import { quoteIdentifier } from '../../sql-utils';
+import { boundSchema } from '../bound-schema';
 import { qualifyTableName } from '../planner-sql-checks';
 import { type Op, step, targetDetails } from './shared';
 
@@ -242,12 +246,18 @@ export async function dropDefault(
   columnName: string,
   lowerer: ExecuteRequestLowerer,
 ): Promise<Op> {
-  const qualified = qualifyTableName(schemaName, tableName);
   const { present } = await columnExistsSteps(lowerer, {
     schema: schemaName,
     table: tableName,
     column: columnName,
   });
+  const dropDefaultExec = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schemaName)),
+      table: tableName,
+      actions: [contractFreeDdl.dropDefaultAction(columnName)],
+    }),
+  );
   const noDefault = await lowerer.lowerToExecuteRequest(
     columnDefaultAst({ schema: schemaName, table: tableName, column: columnName }).defaultAbsent(),
   );
@@ -257,12 +267,7 @@ export async function dropDefault(
     operationClass: 'destructive',
     target: targetDetails('column', columnName, schemaName, tableName),
     precheck: [step(`ensure column "${columnName}" exists`, present.sql, present.params)],
-    execute: [
-      step(
-        `drop default on "${columnName}"`,
-        `ALTER TABLE ${qualified} ALTER COLUMN ${quoteIdentifier(columnName)} DROP DEFAULT`,
-      ),
-    ],
+    execute: [step(`drop default on "${columnName}"`, dropDefaultExec.sql)],
     postcheck: [
       step(`verify column "${columnName}" has no default`, noDefault.sql, noDefault.params),
     ],
@@ -272,16 +277,23 @@ export async function dropDefault(
 /**
  * Builds the op for adding a NOT NULL column (no contract default) to a
  * non-empty table. Prechecks assert the column is absent and the table is
- * empty; the execute step is the raw ADD COLUMN SQL passed by the caller
- * (slice-7 deferred); postchecks assert the column exists and is NOT NULL.
+ * empty; the execute step lowers the typed `AddColumn` DDL node through the
+ * adapter; postchecks assert the column exists and is NOT NULL.
  */
 export async function addNotNullColumnDirect(
   schemaName: string,
   tableName: string,
-  columnName: string,
-  executeStepSql: string,
+  column: DdlColumn,
   lowerer: ExecuteRequestLowerer,
 ): Promise<Op> {
+  const columnName = column.name;
+  const addColumn = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schemaName)),
+      table: tableName,
+      actions: [contractFreeDdl.addColumnAction(column)],
+    }),
+  );
   const absent = await lowerer.lowerToExecuteRequest(
     columnExistsAst({ schema: schemaName, table: tableName, column: columnName }).columnAbsent(),
   );
@@ -311,7 +323,7 @@ export async function addNotNullColumnDirect(
         tableEmpty.params,
       ),
     ],
-    execute: [step(`add column "${columnName}"`, executeStepSql)],
+    execute: [step(`add column "${columnName}"`, addColumn.sql)],
     postcheck: [
       step(`verify column "${columnName}" exists`, present.sql, present.params),
       step(`verify column "${columnName}" is NOT NULL`, notNullable.sql, notNullable.params),

package/src/core/migrations/operations/data-transform.ts

@@ -113,6 +113,12 @@ export async function dataTransform<TContract extends Contract<SqlStorage>>(
     runClosures.map((closure) => invokeAndLower(closure, contract, adapter, name)),
   );
 
+  // Raw remnant: the factory lowered the user's `check` plan above before
+  // we get a chance to wrap it, so the EXISTS lifting only has text by the
+  // time it runs. The fix is to rewrite the factory to defer lowering until
+  // after wrapping — so `cfExpr.exists(checkPlan.ast)` can produce the
+  // EXISTS query, then lower once at the boundary — not to grow new AST
+  // substrate. Out of scope for the slice that introduced this comment.
   const precheck: readonly SqlMigrationPlanOperationStep[] = checkPlan
     ? [
         {

package/src/core/migrations/operations/rls.ts

@@ -0,0 +1,106 @@
+import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
+import { ifDefined } from '@prisma-next/utils/defined';
+import { rlsEnabledAst, rlsPolicyExistsAst } from '../../../contract-free/checks';
+import { createPolicy, dropPolicy } from '../../../contract-free/ddl';
+import type { PostgresRlsPolicy } from '../../postgres-rls-policy';
+import { qualifyTableName } from '../planner-sql-checks';
+import { type Op, step, targetDetails } from './shared';
+
+const PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+
+function validateRoleName(role: string): string {
+  if (!PLAIN_IDENTIFIER.test(role)) {
+    throw new Error(
+      `Invalid role name ${JSON.stringify(role)}: role names must be plain SQL identifiers matching ^[A-Za-z_][A-Za-z0-9_$]*$`,
+    );
+  }
+  return role;
+}
+
+export async function createRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  policy: PostgresRlsPolicy,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const validatedRoles = policy.roles.map(validateRoleName);
+  const ddlNode = createPolicy({
+    schema: schemaName,
+    table: tableName,
+    name: policy.name,
+    permissive: policy.permissive,
+    operation: policy.operation,
+    roles: validatedRoles,
+    ...ifDefined('using', policy.using),
+    ...ifDefined('withCheck', policy.withCheck),
+  });
+  const checks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: policy.name,
+  });
+  const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${policy.name}`,
+    label: `Create RLS policy "${policy.name}" on "${tableName}"`,
+    operationClass: 'additive',
+    target: targetDetails('rlsPolicy', policy.name, schemaName, tableName),
+    precheck: [
+      step(`ensure RLS policy "${policy.name}" does not exist`, absent.sql, absent.params),
+    ],
+    execute: [step(`create RLS policy "${policy.name}"`, execute.sql, execute.params)],
+    postcheck: [step(`verify RLS policy "${policy.name}" exists`, present.sql, present.params)],
+  };
+}
+
+export async function dropRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  policyName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = dropPolicy({ schema: schemaName, table: tableName, name: policyName });
+  const checks = rlsPolicyExistsAst({ schema: schemaName, table: tableName, policyName });
+  const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${policyName}.drop`,
+    label: `Drop RLS policy "${policyName}" on "${tableName}"`,
+    operationClass: 'destructive',
+    target: targetDetails('rlsPolicy', policyName, schemaName, tableName),
+    precheck: [step(`ensure RLS policy "${policyName}" exists`, present.sql, present.params)],
+    execute: [step(`drop RLS policy "${policyName}"`, execute.sql, execute.params)],
+    postcheck: [step(`verify RLS policy "${policyName}" is absent`, absent.sql, absent.params)],
+  };
+}
+
+export async function enableRowLevelSecurity(
+  schemaName: string,
+  tableName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const checks = rlsEnabledAst(schemaName, tableName);
+  const disabled = await lowerer.lowerToExecuteRequest(checks.rlsDisabled());
+  const enabled = await lowerer.lowerToExecuteRequest(checks.rlsEnabled());
+  return {
+    id: `rowLevelSecurity.${schemaName}.${tableName}`,
+    label: `Enable row-level security on "${tableName}"`,
+    operationClass: 'additive',
+    target: targetDetails('rowLevelSecurity', tableName, schemaName),
+    precheck: [
+      step(`check RLS is not already enabled on "${tableName}"`, disabled.sql, disabled.params),
+    ],
+    execute: [
+      step(
+        `enable row-level security on "${tableName}"`,
+        `ALTER TABLE ${qualifyTableName(schemaName, tableName)} ENABLE ROW LEVEL SECURITY`,
+      ),
+    ],
+    postcheck: [
+      step(`verify row-level security is enabled on "${tableName}"`, enabled.sql, enabled.params),
+    ],
+  };
+}

package/src/core/migrations/operations/shared.ts

@@ -1,30 +1,10 @@
 import type { SqlMigrationPlanOperation } from '@prisma-next/family-sql/control';
 import type { ReferentialAction } from '@prisma-next/sql-contract/types';
 import { ifDefined } from '@prisma-next/utils/defined';
-import { quoteIdentifier } from '../../sql-utils';
 import type { OperationClass, PostgresPlanTargetDetails } from '../planner-target-details';
 
 export type Op = SqlMigrationPlanOperation<PostgresPlanTargetDetails>;
 
-/**
- * Literal-args shape for a column definition consumed by `addColumn` and
- * similar operations. Fully materialized: codec expansion and default
- * rendering have already happened in the wrapper.
- *
- * - `typeSql` is the column's DDL type string (e.g. `"integer"`, `"SERIAL"`,
- *   `"varchar(100)"`), already produced by `buildColumnTypeSql` in the
- *   call-factory wrapper.
- * - `defaultSql` is the full `DEFAULT …` clause (e.g. `"DEFAULT 42"`) or an
- *   empty string when the column has no default, matching
- *   `buildColumnDefaultSql`'s output.
- */
-export interface ColumnSpec {
-  readonly name: string;
-  readonly typeSql: string;
-  readonly defaultSql: string;
-  readonly nullable: boolean;
-}
-
 /**
  * Literal-args shape for a foreign key definition. `references.schema`
  * carries the target table's namespace (schema) coordinate so the rendered
@@ -57,13 +37,3 @@ export function targetDetails(
     details: { schema, objectType, name, ...ifDefined('table', table) },
   };
 }
-
-export function renderColumnDefinition(column: ColumnSpec): string {
-  const parts = [
-    quoteIdentifier(column.name),
-    column.typeSql,
-    column.defaultSql,
-    column.nullable ? '' : 'NOT NULL',
-  ].filter(Boolean);
-  return parts.join(' ');
-}

package/src/core/migrations/planner-ddl-builders.ts

@@ -1,43 +1,10 @@
 import type { CodecControlHooks } from '@prisma-next/family-sql/control';
-import type {
-  StorageColumn,
-  StorageTable,
-  StorageTypeInstance,
-} from '@prisma-next/sql-contract/types';
+import type { StorageColumn, StorageTypeInstance } from '@prisma-next/sql-contract/types';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { escapeLiteral, quoteIdentifier } from '../sql-utils';
 import type { PostgresColumnDefault } from '../types';
 import { resolveColumnTypeMetadata } from './planner-type-resolution';
 
-export function buildCreateTableSql(
-  qualifiedTableName: string,
-  table: StorageTable,
-  codecHooks: ReadonlyMap<string, CodecControlHooks>,
-  storageTypes: Record<string, StorageTypeInstance> = {},
-): string {
-  const columnDefinitions = Object.entries(table.columns).map(
-    ([columnName, column]: [string, StorageColumn]) => {
-      const parts = [
-        quoteIdentifier(columnName),
-        buildColumnTypeSql(column, codecHooks, storageTypes),
-        buildColumnDefaultSql(column.default, column),
-        column.nullable ? '' : 'NOT NULL',
-      ].filter(Boolean);
-      return parts.join(' ');
-    },
-  );
-
-  const constraintDefinitions: string[] = [];
-  if (table.primaryKey) {
-    constraintDefinitions.push(
-      `PRIMARY KEY (${table.primaryKey.columns.map(quoteIdentifier).join(', ')})`,
-    );
-  }
-
-  const allDefinitions = [...columnDefinitions, ...constraintDefinitions];
-  return `CREATE TABLE ${qualifiedTableName} (\n  ${allDefinitions.join(',\n  ')}\n)`;
-}
-
 /**
  * Pattern for safe PostgreSQL type names.
  * Allows letters, digits, underscores, spaces (for "double precision", "character varying"),
@@ -100,15 +67,16 @@ export function buildColumnTypeSql(
 
   const expanded = expandParameterizedTypeSql(resolved, codecHooks);
   if (expanded !== null) {
-    return expanded;
+    return column.many ? `${expanded}[]` : expanded;
   }
 
   if (column.typeRef) {
-    return quoteIdentifier(resolved.nativeType);
+    const base = quoteIdentifier(resolved.nativeType);
+    return column.many ? `${base}[]` : base;
   }
 
   assertSafeNativeType(resolved.nativeType);
-  return resolved.nativeType;
+  return column.many ? `${resolved.nativeType}[]` : resolved.nativeType;
 }
 
 function expandParameterizedTypeSql(
@@ -174,6 +142,10 @@ export function buildColumnDefaultSql(
 export function renderDefaultLiteral(value: unknown, column?: StorageColumn): string {
   const isJsonColumn = column?.nativeType === 'json' || column?.nativeType === 'jsonb';
 
+  if (column?.many && Array.isArray(value)) {
+    return renderArrayLiteralDefault(value);
+  }
+
   if (value instanceof Date) {
     return `'${escapeLiteral(value.toISOString())}'`;
   }
@@ -193,23 +165,10 @@ export function renderDefaultLiteral(value: unknown, column?: StorageColumn): st
   return `'${escapeLiteral(json)}'`;
 }
 
-export function buildAddColumnSql(
-  qualifiedTableName: string,
-  columnName: string,
-  column: StorageColumn,
-  codecHooks: ReadonlyMap<string, CodecControlHooks>,
-  temporaryDefault?: string | null,
-  storageTypes: Record<string, StorageTypeInstance> = {},
-): string {
-  const typeSql = buildColumnTypeSql(column, codecHooks, storageTypes);
-  const defaultSql =
-    buildColumnDefaultSql(column.default, column) ||
-    (temporaryDefault ? `DEFAULT ${temporaryDefault}` : '');
-  const parts = [
-    `ALTER TABLE ${qualifiedTableName}`,
-    `ADD COLUMN ${quoteIdentifier(columnName)} ${typeSql}`,
-    defaultSql,
-    column.nullable ? '' : 'NOT NULL',
-  ].filter(Boolean);
-  return parts.join(' ');
+function renderArrayLiteralDefault(elements: unknown[]): string {
+  if (elements.length === 0) {
+    return "'{}'";
+  }
+  const rendered = elements.map((el) => renderDefaultLiteral(el)).join(', ');
+  return `ARRAY[${rendered}]`;
 }

package/src/core/migrations/planner-recipes.ts

@@ -1,15 +1,18 @@
 import type { CodecControlHooks, SqlMigrationPlanOperation } from '@prisma-next/family-sql/control';
 import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
 import type { StorageColumn, StorageTypeInstance } from '@prisma-next/sql-contract/types';
+import { FunctionColumnDefault } from '@prisma-next/sql-relational-core/ast';
+import { col } from '@prisma-next/sql-relational-core/contract-free';
+import { ifDefined } from '@prisma-next/utils/defined';
 import {
   columnDefaultAst,
   columnExistsAst,
   columnNullabilityAst,
 } from '../../contract-free/checks';
-import { quoteIdentifier } from '../sql-utils';
+import * as contractFreeDdl from '../../contract-free/ddl';
+import { boundSchema } from './bound-schema';
 import { step } from './operations/shared';
-import { buildAddColumnSql } from './planner-ddl-builders';
-import { qualifyTableName } from './planner-sql-checks';
+import { buildColumnTypeSql } from './planner-ddl-builders';
 import { buildTargetDetails, type PostgresPlanTargetDetails } from './planner-target-details';
 
 export function buildAddColumnOperationIdentity(
@@ -51,7 +54,29 @@ export async function buildAddNotNullColumnWithTemporaryDefaultOperation(options
     temporaryDefault,
     lowerer,
   } = options;
-  const qualified = qualifyTableName(schema, tableName);
+
+  // The recipe handles NOT NULL columns that carry no contract default, so the
+  // temporary backfill value is the only default. It is a pre-rendered SQL
+  // fragment (e.g. `''`, `0`, `'{}'::jsonb`), carried verbatim as a
+  // `FunctionColumnDefault` so the adapter emits it as a `DEFAULT (...)` clause.
+  const ddlColumn = col(columnName, buildColumnTypeSql(column, codecHooks, storageTypes), {
+    notNull: true,
+    default: new FunctionColumnDefault(temporaryDefault),
+  });
+  const addColumn = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schema)),
+      table: tableName,
+      actions: [contractFreeDdl.addColumnAction(ddlColumn)],
+    }),
+  );
+  const dropTempDefault = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schema)),
+      table: tableName,
+      actions: [contractFreeDdl.dropDefaultAction(columnName)],
+    }),
+  );
 
   const absent = await lowerer.lowerToExecuteRequest(
     columnExistsAst({ schema, table: tableName, column: columnName }).columnAbsent(),
@@ -73,18 +98,11 @@ export async function buildAddNotNullColumnWithTemporaryDefaultOperation(options
     execute: [
       {
         description: `add column "${columnName}"`,
-        sql: buildAddColumnSql(
-          qualified,
-          columnName,
-          column,
-          codecHooks,
-          temporaryDefault,
-          storageTypes,
-        ),
+        sql: addColumn.sql,
       },
       {
         description: `drop temporary default from column "${columnName}"`,
-        sql: `ALTER TABLE ${qualified} ALTER COLUMN ${quoteIdentifier(columnName)} DROP DEFAULT`,
+        sql: dropTempDefault.sql,
       },
     ],
     postcheck: [

package/src/core/migrations/planner-strategies.ts

@@ -53,10 +53,10 @@ import {
   RawSqlCall,
   SetNotNullCall,
 } from './op-factory-call';
-import { buildAddColumnSql, buildColumnTypeSql } from './planner-ddl-builders';
+import { buildColumnTypeSql } from './planner-ddl-builders';
 import { resolveIdentityValue } from './planner-identity-values';
 import { buildSchemaLookupMap, hasForeignKey, hasUniqueConstraint } from './planner-schema-lookup';
-import { buildExpectedFormatType, qualifyTableName } from './planner-sql-checks';
+import { buildExpectedFormatType } from './planner-sql-checks';
 import { buildTargetDetails, type PostgresPlanTargetDetails } from './planner-target-details';
 import { resolveColumnTypeMetadata } from './planner-type-resolution';
 
@@ -600,20 +600,12 @@ export const notNullAddColumnCallStrategy: CallMigrationStrategy = (issues, ctx)
       continue;
     }
 
-    const qualified = qualifyTableName(schemaForTable, issue.table);
     calls.push(
       new AddNotNullColumnDirectCall(
         schemaForTable,
         issue.table,
         issue.column,
-        buildAddColumnSql(
-          qualified,
-          issue.column,
-          column,
-          mutableCodecHooks,
-          undefined,
-          mutableStorageTypes,
-        ),
+        buildColumnSpec(namespaceId, issue.table, issue.column, ctx),
       ),
     );
   }

package/src/core/migrations/planner-target-details.ts

@@ -9,7 +9,9 @@ export type OperationClass =
   | 'unique'
   | 'index'
   | 'foreignKey'
-  | 'checkConstraint';
+  | 'checkConstraint'
+  | 'rlsPolicy'
+  | 'rowLevelSecurity';
 
 export interface PostgresPlanTargetDetails {
   readonly schema: string;