@prisma-next/target-postgres 0.14.0-dev.3 → 0.14.0-dev.30

package/src/core/migrations/operations/columns.ts

@@ -1,4 +1,6 @@
 import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
+import type { DdlColumn } from '@prisma-next/sql-relational-core/ast';
+import { ifDefined } from '@prisma-next/utils/defined';
 import {
   columnDefaultAst,
   columnExistsAst,
@@ -7,7 +9,9 @@ import {
   noNullValuesAst,
   tableIsEmptyAst,
 } from '../../../contract-free/checks';
+import * as contractFreeDdl from '../../../contract-free/ddl';
 import { quoteIdentifier } from '../../sql-utils';
+import { boundSchema } from '../bound-schema';
 import { qualifyTableName } from '../planner-sql-checks';
 import { type Op, step, targetDetails } from './shared';
 
@@ -242,12 +246,18 @@ export async function dropDefault(
   columnName: string,
   lowerer: ExecuteRequestLowerer,
 ): Promise<Op> {
-  const qualified = qualifyTableName(schemaName, tableName);
   const { present } = await columnExistsSteps(lowerer, {
     schema: schemaName,
     table: tableName,
     column: columnName,
   });
+  const dropDefaultExec = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schemaName)),
+      table: tableName,
+      actions: [contractFreeDdl.dropDefaultAction(columnName)],
+    }),
+  );
   const noDefault = await lowerer.lowerToExecuteRequest(
     columnDefaultAst({ schema: schemaName, table: tableName, column: columnName }).defaultAbsent(),
   );
@@ -257,12 +267,7 @@ export async function dropDefault(
     operationClass: 'destructive',
     target: targetDetails('column', columnName, schemaName, tableName),
     precheck: [step(`ensure column "${columnName}" exists`, present.sql, present.params)],
-    execute: [
-      step(
-        `drop default on "${columnName}"`,
-        `ALTER TABLE ${qualified} ALTER COLUMN ${quoteIdentifier(columnName)} DROP DEFAULT`,
-      ),
-    ],
+    execute: [step(`drop default on "${columnName}"`, dropDefaultExec.sql)],
     postcheck: [
       step(`verify column "${columnName}" has no default`, noDefault.sql, noDefault.params),
     ],
@@ -272,16 +277,23 @@ export async function dropDefault(
 /**
  * Builds the op for adding a NOT NULL column (no contract default) to a
  * non-empty table. Prechecks assert the column is absent and the table is
- * empty; the execute step is the raw ADD COLUMN SQL passed by the caller
- * (slice-7 deferred); postchecks assert the column exists and is NOT NULL.
+ * empty; the execute step lowers the typed `AddColumn` DDL node through the
+ * adapter; postchecks assert the column exists and is NOT NULL.
  */
 export async function addNotNullColumnDirect(
   schemaName: string,
   tableName: string,
-  columnName: string,
-  executeStepSql: string,
+  column: DdlColumn,
   lowerer: ExecuteRequestLowerer,
 ): Promise<Op> {
+  const columnName = column.name;
+  const addColumn = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schemaName)),
+      table: tableName,
+      actions: [contractFreeDdl.addColumnAction(column)],
+    }),
+  );
   const absent = await lowerer.lowerToExecuteRequest(
     columnExistsAst({ schema: schemaName, table: tableName, column: columnName }).columnAbsent(),
   );
@@ -311,7 +323,7 @@ export async function addNotNullColumnDirect(
         tableEmpty.params,
       ),
     ],
-    execute: [step(`add column "${columnName}"`, executeStepSql)],
+    execute: [step(`add column "${columnName}"`, addColumn.sql)],
     postcheck: [
       step(`verify column "${columnName}" exists`, present.sql, present.params),
       step(`verify column "${columnName}" is NOT NULL`, notNullable.sql, notNullable.params),

package/src/core/migrations/operations/data-transform.ts

@@ -113,6 +113,12 @@ export async function dataTransform<TContract extends Contract<SqlStorage>>(
     runClosures.map((closure) => invokeAndLower(closure, contract, adapter, name)),
   );
 
+  // Raw remnant: the factory lowered the user's `check` plan above before
+  // we get a chance to wrap it, so the EXISTS lifting only has text by the
+  // time it runs. The fix is to rewrite the factory to defer lowering until
+  // after wrapping — so `cfExpr.exists(checkPlan.ast)` can produce the
+  // EXISTS query, then lower once at the boundary — not to grow new AST
+  // substrate. Out of scope for the slice that introduced this comment.
   const precheck: readonly SqlMigrationPlanOperationStep[] = checkPlan
     ? [
         {

package/src/core/migrations/operations/rls.ts

@@ -0,0 +1,106 @@
+import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
+import { ifDefined } from '@prisma-next/utils/defined';
+import { rlsEnabledAst, rlsPolicyExistsAst } from '../../../contract-free/checks';
+import { createPolicy, dropPolicy } from '../../../contract-free/ddl';
+import type { PostgresRlsPolicy } from '../../schema-ir/postgres-rls-policy';
+import { qualifyTableName } from '../planner-sql-checks';
+import { type Op, step, targetDetails } from './shared';
+
+const PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+
+function validateRoleName(role: string): string {
+  if (!PLAIN_IDENTIFIER.test(role)) {
+    throw new Error(
+      `Invalid role name ${JSON.stringify(role)}: role names must be plain SQL identifiers matching ^[A-Za-z_][A-Za-z0-9_$]*$`,
+    );
+  }
+  return role;
+}
+
+export async function createRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  policy: PostgresRlsPolicy,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const validatedRoles = policy.roles.map(validateRoleName);
+  const ddlNode = createPolicy({
+    schema: schemaName,
+    table: tableName,
+    name: policy.name,
+    permissive: policy.permissive,
+    operation: policy.operation,
+    roles: validatedRoles,
+    ...ifDefined('using', policy.using),
+    ...ifDefined('withCheck', policy.withCheck),
+  });
+  const checks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: policy.name,
+  });
+  const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${policy.name}`,
+    label: `Create RLS policy "${policy.name}" on "${tableName}"`,
+    operationClass: 'additive',
+    target: targetDetails('rlsPolicy', policy.name, schemaName, tableName),
+    precheck: [
+      step(`ensure RLS policy "${policy.name}" does not exist`, absent.sql, absent.params),
+    ],
+    execute: [step(`create RLS policy "${policy.name}"`, execute.sql, execute.params)],
+    postcheck: [step(`verify RLS policy "${policy.name}" exists`, present.sql, present.params)],
+  };
+}
+
+export async function dropRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  policyName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = dropPolicy({ schema: schemaName, table: tableName, name: policyName });
+  const checks = rlsPolicyExistsAst({ schema: schemaName, table: tableName, policyName });
+  const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${policyName}.drop`,
+    label: `Drop RLS policy "${policyName}" on "${tableName}"`,
+    operationClass: 'destructive',
+    target: targetDetails('rlsPolicy', policyName, schemaName, tableName),
+    precheck: [step(`ensure RLS policy "${policyName}" exists`, present.sql, present.params)],
+    execute: [step(`drop RLS policy "${policyName}"`, execute.sql, execute.params)],
+    postcheck: [step(`verify RLS policy "${policyName}" is absent`, absent.sql, absent.params)],
+  };
+}
+
+export async function enableRowLevelSecurity(
+  schemaName: string,
+  tableName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const checks = rlsEnabledAst(schemaName, tableName);
+  const disabled = await lowerer.lowerToExecuteRequest(checks.rlsDisabled());
+  const enabled = await lowerer.lowerToExecuteRequest(checks.rlsEnabled());
+  return {
+    id: `rowLevelSecurity.${schemaName}.${tableName}`,
+    label: `Enable row-level security on "${tableName}"`,
+    operationClass: 'additive',
+    target: targetDetails('rowLevelSecurity', tableName, schemaName),
+    precheck: [
+      step(`check RLS is not already enabled on "${tableName}"`, disabled.sql, disabled.params),
+    ],
+    execute: [
+      step(
+        `enable row-level security on "${tableName}"`,
+        `ALTER TABLE ${qualifyTableName(schemaName, tableName)} ENABLE ROW LEVEL SECURITY`,
+      ),
+    ],
+    postcheck: [
+      step(`verify row-level security is enabled on "${tableName}"`, enabled.sql, enabled.params),
+    ],
+  };
+}

package/src/core/migrations/operations/shared.ts

@@ -1,30 +1,10 @@
 import type { SqlMigrationPlanOperation } from '@prisma-next/family-sql/control';
 import type { ReferentialAction } from '@prisma-next/sql-contract/types';
 import { ifDefined } from '@prisma-next/utils/defined';
-import { quoteIdentifier } from '../../sql-utils';
 import type { OperationClass, PostgresPlanTargetDetails } from '../planner-target-details';
 
 export type Op = SqlMigrationPlanOperation<PostgresPlanTargetDetails>;
 
-/**
- * Literal-args shape for a column definition consumed by `addColumn` and
- * similar operations. Fully materialized: codec expansion and default
- * rendering have already happened in the wrapper.
- *
- * - `typeSql` is the column's DDL type string (e.g. `"integer"`, `"SERIAL"`,
- *   `"varchar(100)"`), already produced by `buildColumnTypeSql` in the
- *   call-factory wrapper.
- * - `defaultSql` is the full `DEFAULT …` clause (e.g. `"DEFAULT 42"`) or an
- *   empty string when the column has no default, matching
- *   `buildColumnDefaultSql`'s output.
- */
-export interface ColumnSpec {
-  readonly name: string;
-  readonly typeSql: string;
-  readonly defaultSql: string;
-  readonly nullable: boolean;
-}
-
 /**
  * Literal-args shape for a foreign key definition. `references.schema`
  * carries the target table's namespace (schema) coordinate so the rendered
@@ -57,13 +37,3 @@ export function targetDetails(
     details: { schema, objectType, name, ...ifDefined('table', table) },
   };
 }
-
-export function renderColumnDefinition(column: ColumnSpec): string {
-  const parts = [
-    quoteIdentifier(column.name),
-    column.typeSql,
-    column.defaultSql,
-    column.nullable ? '' : 'NOT NULL',
-  ].filter(Boolean);
-  return parts.join(' ');
-}

package/src/core/migrations/planner-ddl-builders.ts

@@ -1,43 +1,10 @@
 import type { CodecControlHooks } from '@prisma-next/family-sql/control';
-import type {
-  StorageColumn,
-  StorageTable,
-  StorageTypeInstance,
-} from '@prisma-next/sql-contract/types';
+import type { StorageColumn, StorageTypeInstance } from '@prisma-next/sql-contract/types';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { escapeLiteral, quoteIdentifier } from '../sql-utils';
 import type { PostgresColumnDefault } from '../types';
 import { resolveColumnTypeMetadata } from './planner-type-resolution';
 
-export function buildCreateTableSql(
-  qualifiedTableName: string,
-  table: StorageTable,
-  codecHooks: ReadonlyMap<string, CodecControlHooks>,
-  storageTypes: Record<string, StorageTypeInstance> = {},
-): string {
-  const columnDefinitions = Object.entries(table.columns).map(
-    ([columnName, column]: [string, StorageColumn]) => {
-      const parts = [
-        quoteIdentifier(columnName),
-        buildColumnTypeSql(column, codecHooks, storageTypes),
-        buildColumnDefaultSql(column.default, column),
-        column.nullable ? '' : 'NOT NULL',
-      ].filter(Boolean);
-      return parts.join(' ');
-    },
-  );
-
-  const constraintDefinitions: string[] = [];
-  if (table.primaryKey) {
-    constraintDefinitions.push(
-      `PRIMARY KEY (${table.primaryKey.columns.map(quoteIdentifier).join(', ')})`,
-    );
-  }
-
-  const allDefinitions = [...columnDefinitions, ...constraintDefinitions];
-  return `CREATE TABLE ${qualifiedTableName} (\n  ${allDefinitions.join(',\n  ')}\n)`;
-}
-
 /**
  * Pattern for safe PostgreSQL type names.
  * Allows letters, digits, underscores, spaces (for "double precision", "character varying"),
@@ -100,15 +67,16 @@ export function buildColumnTypeSql(
 
   const expanded = expandParameterizedTypeSql(resolved, codecHooks);
   if (expanded !== null) {
-    return expanded;
+    return column.many ? `${expanded}[]` : expanded;
   }
 
   if (column.typeRef) {
-    return quoteIdentifier(resolved.nativeType);
+    const base = quoteIdentifier(resolved.nativeType);
+    return column.many ? `${base}[]` : base;
   }
 
   assertSafeNativeType(resolved.nativeType);
-  return resolved.nativeType;
+  return column.many ? `${resolved.nativeType}[]` : resolved.nativeType;
 }
 
 function expandParameterizedTypeSql(
@@ -174,6 +142,10 @@ export function buildColumnDefaultSql(
 export function renderDefaultLiteral(value: unknown, column?: StorageColumn): string {
   const isJsonColumn = column?.nativeType === 'json' || column?.nativeType === 'jsonb';
 
+  if (column?.many && Array.isArray(value)) {
+    return renderArrayLiteralDefault(value);
+  }
+
   if (value instanceof Date) {
     return `'${escapeLiteral(value.toISOString())}'`;
   }
@@ -193,23 +165,10 @@ export function renderDefaultLiteral(value: unknown, column?: StorageColumn): st
   return `'${escapeLiteral(json)}'`;
 }
 
-export function buildAddColumnSql(
-  qualifiedTableName: string,
-  columnName: string,
-  column: StorageColumn,
-  codecHooks: ReadonlyMap<string, CodecControlHooks>,
-  temporaryDefault?: string | null,
-  storageTypes: Record<string, StorageTypeInstance> = {},
-): string {
-  const typeSql = buildColumnTypeSql(column, codecHooks, storageTypes);
-  const defaultSql =
-    buildColumnDefaultSql(column.default, column) ||
-    (temporaryDefault ? `DEFAULT ${temporaryDefault}` : '');
-  const parts = [
-    `ALTER TABLE ${qualifiedTableName}`,
-    `ADD COLUMN ${quoteIdentifier(columnName)} ${typeSql}`,
-    defaultSql,
-    column.nullable ? '' : 'NOT NULL',
-  ].filter(Boolean);
-  return parts.join(' ');
+function renderArrayLiteralDefault(elements: unknown[]): string {
+  if (elements.length === 0) {
+    return "'{}'";
+  }
+  const rendered = elements.map((el) => renderDefaultLiteral(el)).join(', ');
+  return `ARRAY[${rendered}]`;
 }

package/src/core/migrations/planner-recipes.ts

@@ -1,15 +1,18 @@
 import type { CodecControlHooks, SqlMigrationPlanOperation } from '@prisma-next/family-sql/control';
 import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
 import type { StorageColumn, StorageTypeInstance } from '@prisma-next/sql-contract/types';
+import { FunctionColumnDefault } from '@prisma-next/sql-relational-core/ast';
+import { col } from '@prisma-next/sql-relational-core/contract-free';
+import { ifDefined } from '@prisma-next/utils/defined';
 import {
   columnDefaultAst,
   columnExistsAst,
   columnNullabilityAst,
 } from '../../contract-free/checks';
-import { quoteIdentifier } from '../sql-utils';
+import * as contractFreeDdl from '../../contract-free/ddl';
+import { boundSchema } from './bound-schema';
 import { step } from './operations/shared';
-import { buildAddColumnSql } from './planner-ddl-builders';
-import { qualifyTableName } from './planner-sql-checks';
+import { buildColumnTypeSql } from './planner-ddl-builders';
 import { buildTargetDetails, type PostgresPlanTargetDetails } from './planner-target-details';
 
 export function buildAddColumnOperationIdentity(
@@ -51,7 +54,29 @@ export async function buildAddNotNullColumnWithTemporaryDefaultOperation(options
     temporaryDefault,
     lowerer,
   } = options;
-  const qualified = qualifyTableName(schema, tableName);
+
+  // The recipe handles NOT NULL columns that carry no contract default, so the
+  // temporary backfill value is the only default. It is a pre-rendered SQL
+  // fragment (e.g. `''`, `0`, `'{}'::jsonb`), carried verbatim as a
+  // `FunctionColumnDefault` so the adapter emits it as a `DEFAULT (...)` clause.
+  const ddlColumn = col(columnName, buildColumnTypeSql(column, codecHooks, storageTypes), {
+    notNull: true,
+    default: new FunctionColumnDefault(temporaryDefault),
+  });
+  const addColumn = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schema)),
+      table: tableName,
+      actions: [contractFreeDdl.addColumnAction(ddlColumn)],
+    }),
+  );
+  const dropTempDefault = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schema)),
+      table: tableName,
+      actions: [contractFreeDdl.dropDefaultAction(columnName)],
+    }),
+  );
 
   const absent = await lowerer.lowerToExecuteRequest(
     columnExistsAst({ schema, table: tableName, column: columnName }).columnAbsent(),
@@ -73,18 +98,11 @@ export async function buildAddNotNullColumnWithTemporaryDefaultOperation(options
     execute: [
       {
         description: `add column "${columnName}"`,
-        sql: buildAddColumnSql(
-          qualified,
-          columnName,
-          column,
-          codecHooks,
-          temporaryDefault,
-          storageTypes,
-        ),
+        sql: addColumn.sql,
       },
       {
         description: `drop temporary default from column "${columnName}"`,
-        sql: `ALTER TABLE ${qualified} ALTER COLUMN ${quoteIdentifier(columnName)} DROP DEFAULT`,
+        sql: dropTempDefault.sql,
       },
     ],
     postcheck: [

package/src/core/migrations/planner-strategies.ts

@@ -53,10 +53,10 @@ import {
   RawSqlCall,
   SetNotNullCall,
 } from './op-factory-call';
-import { buildAddColumnSql, buildColumnTypeSql } from './planner-ddl-builders';
+import { buildColumnTypeSql } from './planner-ddl-builders';
 import { resolveIdentityValue } from './planner-identity-values';
 import { buildSchemaLookupMap, hasForeignKey, hasUniqueConstraint } from './planner-schema-lookup';
-import { buildExpectedFormatType, qualifyTableName } from './planner-sql-checks';
+import { buildExpectedFormatType } from './planner-sql-checks';
 import { buildTargetDetails, type PostgresPlanTargetDetails } from './planner-target-details';
 import { resolveColumnTypeMetadata } from './planner-type-resolution';
 
@@ -600,20 +600,12 @@ export const notNullAddColumnCallStrategy: CallMigrationStrategy = (issues, ctx)
       continue;
     }
 
-    const qualified = qualifyTableName(schemaForTable, issue.table);
     calls.push(
       new AddNotNullColumnDirectCall(
         schemaForTable,
         issue.table,
         issue.column,
-        buildAddColumnSql(
-          qualified,
-          issue.column,
-          column,
-          mutableCodecHooks,
-          undefined,
-          mutableStorageTypes,
-        ),
+        buildColumnSpec(namespaceId, issue.table, issue.column, ctx),
       ),
     );
   }

package/src/core/migrations/planner-target-details.ts

@@ -9,7 +9,9 @@ export type OperationClass =
   | 'unique'
   | 'index'
   | 'foreignKey'
-  | 'checkConstraint';
+  | 'checkConstraint'
+  | 'rlsPolicy'
+  | 'rowLevelSecurity';
 
 export interface PostgresPlanTargetDetails {
   readonly schema: string;

package/src/core/migrations/planner.ts

@@ -25,14 +25,25 @@ import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
 import { blindCast } from '@prisma-next/utils/casts';
 import { parsePostgresDefault } from '../default-normalizer';
 import { normalizeSchemaNativeType } from '../native-type-normalizer';
+import type { PostgresContract } from '../postgres-schema';
+import { assertPostgresRlsPolicy } from '../schema-ir/postgres-rls-policy';
+import { assertPostgresSchemaIR, ensurePostgresSchemaIR } from '../schema-ir/postgres-schema-ir';
+import { resolveDdlSchemaForNamespaceStorage } from '../schema-ir/postgres-schema-ir-annotations';
+import { contractToPostgresSchemaIR } from './contract-to-postgres-schema-ir';
 import {
   formatPostgresControlPolicySubjectLabel,
   resolvePostgresCallControlPolicySubject,
   resolvePostgresIssueControlPolicySubject,
   resolvePostgresIssueCreationFactoryName,
 } from './control-policy';
+import { diffPostgresSchema, filterIssuesByOwnership } from './diff-postgres-schema';
 import { planIssues } from './issue-planner';
 import type { PostgresOpFactoryCall } from './op-factory-call';
+import {
+  CreatePostgresRlsPolicyCall,
+  DropPostgresRlsPolicyCall,
+  EnableRowLevelSecurityCall,
+} from './op-factory-call';
 import { TypeScriptRenderablePostgresMigration } from './planner-produced-postgres-migration';
 import { postgresPlannerStrategies } from './planner-strategies';
 import { verifyPostgresNamespacePresence } from './verify-postgres-namespaces';
@@ -194,6 +205,17 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
       return plannerFailure(result.failure);
     }
 
+    const schemaDiffCalls = this.planPostgresSchemaDiff(options);
+    const schemaDiffPartition = partitionCallsByControlPolicy({
+      calls: schemaDiffCalls,
+      contract: options.contract,
+      resolveControlPolicySubject: (call) =>
+        resolvePostgresCallControlPolicySubject(call, options.contract),
+      resolveFactoryName: (call) => call.factoryName,
+      formatSubjectLabel: (factoryName, subject) =>
+        formatPostgresControlPolicySubjectLabel(factoryName, subject, options.contract),
+    });
+
     // Inline `onFieldEvent`-emitted ops after structural DDL. The fixed
     // ordering is `structural → added → dropped → altered`, with
     // within-group sorting by `(tableName, fieldName)` so re-emits are
@@ -219,9 +241,10 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
       formatSubjectLabel: (factoryName, subject) =>
         formatPostgresControlPolicySubjectLabel(factoryName, subject, options.contract),
     });
-    const calls = [...result.value.calls, ...fieldEventPartition.kept];
+    const calls = [...result.value.calls, ...schemaDiffPartition.kept, ...fieldEventPartition.kept];
     const warnings: SqlPlannerConflict[] = [
       ...issuePartition.warnings,
+      ...schemaDiffPartition.warnings,
       ...fieldEventPartition.warnings,
     ];
 
@@ -240,6 +263,65 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
     });
   }
 
+  private planPostgresSchemaDiff(
+    options: PlannerOptionsWithComponents,
+  ): readonly PostgresOpFactoryCall[] {
+    assertPostgresSchemaIR(options.schema);
+    const expected = contractToPostgresSchemaIR(
+      blindCast<PostgresContract, 'planPostgresSchemaDiff is only called with a postgres contract'>(
+        options.contract,
+      ),
+      { annotationNamespace: 'pg' },
+    );
+    const actual = ensurePostgresSchemaIR(options.schema);
+    const rawIssues = diffPostgresSchema(expected, actual);
+    const ownedSchemaNames = new Set([
+      ...expected.rlsPolicies.map((p) => p.namespaceId),
+      ...expected.existingSchemas,
+    ]);
+    const filteredDiffIssues = filterIssuesByOwnership(rawIssues, ownedSchemaNames);
+
+    const allowsDestructive = options.policy.allowedOperationClasses.includes('destructive');
+    const calls: PostgresOpFactoryCall[] = [];
+    const seenEnableTables = new Set<string>();
+
+    for (const issue of filteredDiffIssues) {
+      // 'mismatch' is unreachable for content-addressed policies: the wire name
+      // encodes the body hash, so two policies sharing a local key (same name)
+      // are always equal and isEqualTo never returns false.
+      if (issue.outcome === 'missing') {
+        assertPostgresRlsPolicy(issue.expected);
+        // issue.expected.namespaceId is the DDL schema name (resolved during projection);
+        // this re-resolution is a no-op as long as PostgresSchema.ddlSchemaName() returns this.id.
+        const schemaForTable = resolveDdlSchemaForNamespaceStorage(
+          options.contract.storage,
+          issue.expected.namespaceId,
+          options.schema,
+        );
+        const tableKey = `${schemaForTable}.${issue.expected.tableName}`;
+        if (!seenEnableTables.has(tableKey)) {
+          seenEnableTables.add(tableKey);
+          calls.push(new EnableRowLevelSecurityCall(schemaForTable, issue.expected.tableName));
+        }
+        calls.push(
+          new CreatePostgresRlsPolicyCall(schemaForTable, issue.expected.tableName, issue.expected),
+        );
+      } else if (issue.outcome === 'extra' && allowsDestructive) {
+        assertPostgresRlsPolicy(issue.actual);
+        const schemaForTable = resolveDdlSchemaForNamespaceStorage(
+          options.contract.storage,
+          issue.actual.namespaceId,
+          options.schema,
+        );
+        calls.push(
+          new DropPostgresRlsPolicyCall(schemaForTable, issue.actual.tableName, issue.actual.name),
+        );
+      }
+    }
+
+    return calls;
+  }
+
   private ensureAdditivePolicy(policy: MigrationOperationPolicy) {
     if (!policy.allowedOperationClasses.includes('additive')) {
       return plannerFailure([
@@ -274,6 +356,7 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
     // rather than in the family verifier. Stitch it in here so a single
     // `SchemaIssue[]` flows through `planIssues` and the planner emits
     // CREATE SCHEMA in the dep bucket before any CreateTableCall.
+    // Schema drift is handled separately via diffPostgresSchema → planPostgresSchemaDiff.
     const namespaceIssues = verifyPostgresNamespacePresence({
       contract: options.contract,
       schema: options.schema,

package/src/core/migrations/verify-postgres-namespaces.ts

@@ -4,6 +4,7 @@ import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
 import type { SqlStorage } from '@prisma-next/sql-contract/types';
 import type { SqlSchemaIR } from '@prisma-next/sql-schema-ir/types';
 import { isPostgresSchema } from '../postgres-schema';
+import { isPostgresSchemaIR } from '../schema-ir/postgres-schema-ir';
 
 /**
  * Resolves the live-database schema name for a given namespace
@@ -23,25 +24,21 @@ function resolveDdlSchemaName(storage: SqlStorage, namespaceId: string): string
 }
 
 /**
- * Reads the introspected list of schema names from the Postgres-flavoured
- * annotations slot on the schema IR. Defaults to the always-present
- * `public` schema when introspection did not populate the slot — a fresh
- * Postgres database always carries `public` (unless an operator dropped
- * it manually), so any verifier path that runs without an enriched
- * introspection still suppresses the redundant `CREATE SCHEMA "public"`.
+ * Reads the introspected list of schema names from a `PostgresSchemaIR`.
+ * Defaults to the always-present `public` schema when the schema IR is not a
+ * `PostgresSchemaIR` — a fresh Postgres database always carries `public`
+ * (unless an operator dropped it manually), so any verifier path that runs
+ * without an enriched introspection still suppresses the redundant
+ * `CREATE SCHEMA "public"`.
  *
  * Production introspection (`PostgresControlAdapter.introspect`) is the
- * authoritative source: it queries `pg_namespace` and writes every
- * non-system schema into `annotations.pg.existingSchemas`. Tests that
- * want to assert against a richer initial state pass the slot
- * explicitly via the schema IR.
+ * authoritative source: it queries `pg_namespace` and sets `existingSchemas`
+ * on the returned `PostgresSchemaIR`. Tests that want to assert against a
+ * richer initial state construct a `PostgresSchemaIR` explicitly.
  */
 function existingSchemasFromSchema(schema: SqlSchemaIR): readonly string[] {
-  const annotations = (schema as { annotations?: { pg?: { existingSchemas?: unknown } } })
-    .annotations;
-  const slot = annotations?.pg?.existingSchemas;
-  if (Array.isArray(slot)) {
-    return slot.filter((s): s is string => typeof s === 'string');
+  if (isPostgresSchemaIR(schema)) {
+    return schema.existingSchemas;
   }
   return ['public'];
 }