@prisma-next/target-postgres 0.14.0-dev.3 → 0.14.0-dev.31

package/src/core/ddl/nodes.ts

@@ -3,6 +3,7 @@ import {
   DdlNode,
   type DdlTableConstraint,
 } from '@prisma-next/sql-relational-core/ast';
+import type { RlsPolicyOperation } from '../rls/canonicalize';
 
 // ---------------------------------------------------------------------------
 // AlterTableAction — nested polymorphic hierarchy
@@ -10,6 +11,7 @@ import {
 
 export interface AlterTableActionVisitor<R> {
   addColumn(action: AddColumnAction): R;
+  dropDefault(action: DropDefaultAction): R;
 }
 
 export abstract class AlterTableAction {
@@ -32,7 +34,31 @@ export class AddColumnAction extends AlterTableAction {
   }
 }
 
-export type AnyAlterTableAction = AddColumnAction;
+export class DropDefaultAction extends AlterTableAction {
+  readonly kind = 'drop-default' as const;
+  readonly columnName: string;
+
+  constructor(columnName: string) {
+    super();
+    this.columnName = columnName;
+    Object.freeze(this);
+  }
+
+  override accept<R>(visitor: AlterTableActionVisitor<R>): R {
+    return visitor.dropDefault(this);
+  }
+}
+
+/**
+ * The set of ALTER TABLE subactions currently expressible as typed DDL.
+ *
+ * The remaining actions — SetDefault, SetNotNull, DropNotNull,
+ * AlterColumnType — are still emitted as raw SQL by `operations/columns.ts`
+ * and join this union as they are converted to typed DDL. Until then it is
+ * intentionally partial: only the ALTER subactions used by the
+ * already-converted ops (AddColumn, DropDefault) appear here.
+ */
+export type AnyAlterTableAction = AddColumnAction | DropDefaultAction;
 
 // ---------------------------------------------------------------------------
 // Top-level DDL visitor
@@ -42,6 +68,8 @@ export interface PostgresDdlVisitor<R> {
   createTable(node: PostgresCreateTable): R;
   createSchema(node: PostgresCreateSchema): R;
   alterTable(node: PostgresAlterTable): R;
+  createPolicy(node: PostgresCreatePolicy): R;
+  dropPolicy(node: PostgresDropPolicy): R;
 }
 
 export abstract class PostgresDdlNode extends DdlNode {
@@ -127,4 +155,68 @@ export class PostgresAlterTable extends PostgresDdlNode {
   }
 }
 
-export type AnyPostgresDdlNode = PostgresCreateTable | PostgresCreateSchema | PostgresAlterTable;
+export type { RlsPolicyOperation };
+
+export class PostgresCreatePolicy extends PostgresDdlNode {
+  readonly kind = 'create-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly permissive: boolean;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: ReadonlyArray<string>;
+  readonly using: string | undefined;
+  readonly withCheck: string | undefined;
+
+  constructor(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly name: string;
+    readonly permissive: boolean;
+    readonly operation: RlsPolicyOperation;
+    readonly roles: readonly string[];
+    readonly using?: string;
+    readonly withCheck?: string;
+  }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.permissive = options.permissive;
+    this.operation = options.operation;
+    this.roles = Object.freeze([...options.roles]);
+    this.using = options.using;
+    this.withCheck = options.withCheck;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.createPolicy(this);
+  }
+}
+
+export class PostgresDropPolicy extends PostgresDdlNode {
+  readonly kind = 'drop-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+
+  constructor(options: { readonly schema: string; readonly table: string; readonly name: string }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.dropPolicy(this);
+  }
+}
+
+export type AnyPostgresDdlNode =
+  | PostgresCreateTable
+  | PostgresCreateSchema
+  | PostgresAlterTable
+  | PostgresCreatePolicy
+  | PostgresDropPolicy;

package/src/core/default-normalizer.ts

@@ -1,4 +1,4 @@
-import type { ColumnDefault } from '@prisma-next/contract/types';
+import type { ColumnDefault, JsonValue } from '@prisma-next/contract/types';
 
 /**
  * Pre-compiled regex patterns for performance.
@@ -18,6 +18,13 @@ const FALSE_PATTERN = /^false$/i;
 const NUMERIC_PATTERN = /^-?\d+(\.\d+)?$/;
 const STRING_LITERAL_PATTERN = /^'((?:[^']|'')*)'(?:::(?:"[^"]+"|[\w\s]+)(?:\(\d+\))?)?$/;
 
+/**
+ * Matches a Postgres array literal default of the form `'{...}'::elemtype[]`.
+ * The literal body is captured in group 1; the cast (including `[]`) is optional.
+ * Examples: `'{}'::text[]`, `'{1,2}'::integer[]`, `'{}'`
+ */
+const ARRAY_LITERAL_PATTERN = /^'(\{.*\})'(?:::.+\[\])?$/;
+
 /**
  * Returns the canonical expression for a timestamp default function, or undefined
  * if the expression is not a recognized timestamp default.
@@ -51,6 +58,46 @@ function canonicalizeTimestampDefault(expr: string): string | undefined {
   return undefined;
 }
 
+/**
+ * Parses a Postgres array literal body (`{...}`) into a JS array of primitives.
+ * Returns undefined if the body cannot be reliably parsed.
+ *
+ * Handles:
+ * - `{}` → `[]`
+ * - `{elem1,elem2,...}` → `[elem1, elem2, ...]` with numeric and string element coercion
+ */
+function parseArrayLiteralBody(body: string): readonly JsonValue[] | undefined {
+  const inner = body.slice(1, -1).trim();
+  if (inner === '') return [];
+  const elements = inner.split(',');
+  const result: JsonValue[] = [];
+  for (const rawEl of elements) {
+    const el = rawEl.trim();
+    if (el.toUpperCase() === 'NULL') {
+      result.push(null);
+      continue;
+    }
+    if (el === 'true') {
+      result.push(true);
+      continue;
+    }
+    if (el === 'false') {
+      result.push(false);
+      continue;
+    }
+    if (NUMERIC_PATTERN.test(el)) {
+      result.push(Number(el));
+      continue;
+    }
+    if (el.startsWith('"') && el.endsWith('"')) {
+      result.push(el.slice(1, -1).replace(/""/g, '"'));
+      continue;
+    }
+    return undefined;
+  }
+  return result;
+}
+
 /**
  * Parses a raw Postgres column default expression into a normalized ColumnDefault.
  * This enables semantic comparison between contract defaults and introspected schema defaults.
@@ -59,7 +106,7 @@ function canonicalizeTimestampDefault(expr: string): string | undefined {
  * keeping the introspection layer focused on faithful data capture.
  *
  * @param rawDefault - Raw default expression from information_schema.columns.column_default
- * @param nativeType - Native column type, used for type-aware parsing (bigint tagging, JSON detection)
+ * @param nativeType - Native column type, used for type-aware parsing (array, bigint, JSON)
  * @returns Normalized ColumnDefault or undefined if the expression cannot be parsed
  */
 export function parsePostgresDefault(
@@ -69,11 +116,22 @@ export function parsePostgresDefault(
   const trimmed = rawDefault.trim();
   const normalizedType = nativeType?.toLowerCase();
   const isBigInt = normalizedType === 'bigint' || normalizedType === 'int8';
+  const isArrayType = normalizedType?.endsWith('[]') ?? false;
 
   if (NEXTVAL_PATTERN.test(trimmed)) {
     return { kind: 'function', expression: 'autoincrement()' };
   }
 
+  if (isArrayType) {
+    const arrayMatch = trimmed.match(ARRAY_LITERAL_PATTERN);
+    if (arrayMatch?.[1] !== undefined) {
+      const parsed = parseArrayLiteralBody(arrayMatch[1]);
+      if (parsed !== undefined) {
+        return { kind: 'literal', value: parsed };
+      }
+    }
+  }
+
   const canonicalTimestamp = canonicalizeTimestampDefault(trimmed);
   if (canonicalTimestamp) {
     return { kind: 'function', expression: canonicalTimestamp };

package/src/core/descriptor-meta.ts

@@ -2,9 +2,11 @@ import type { CodecTypes } from '../exports/codec-types';
 import {
   postgresAuthoringEntityTypes,
   postgresAuthoringFieldPresets,
+  postgresAuthoringPslBlockDescriptors,
   postgresAuthoringTypes,
 } from './authoring';
 import { postgresTargetDescriptorMetaRuntime } from './descriptor-meta-runtime';
+import { postgresCreateNamespace } from './postgres-schema';
 
 const postgresTargetDescriptorMetaBase = {
   ...postgresTargetDescriptorMetaRuntime,
@@ -13,6 +15,8 @@ const postgresTargetDescriptorMetaBase = {
     type: postgresAuthoringTypes,
     field: postgresAuthoringFieldPresets,
     entityTypes: postgresAuthoringEntityTypes,
+    pslBlockDescriptors: postgresAuthoringPslBlockDescriptors,
+    createNamespace: postgresCreateNamespace,
   },
 } as const;
 

package/src/core/entity-kinds.ts

@@ -0,0 +1,16 @@
+import type { EntityKindDescriptor } from '@prisma-next/framework-components/ir';
+import { PostgresRlsPolicySchema, PostgresRoleSchema } from './postgres-validators';
+import { PostgresRlsPolicy, type PostgresRlsPolicyInput } from './schema-ir/postgres-rls-policy';
+import { PostgresRole, type PostgresRoleInput } from './schema-ir/postgres-role';
+
+export const policyEntityKind: EntityKindDescriptor<PostgresRlsPolicyInput, PostgresRlsPolicy> = {
+  kind: 'policy',
+  schema: PostgresRlsPolicySchema,
+  construct: (input) => new PostgresRlsPolicy(input),
+};
+
+export const roleEntityKind: EntityKindDescriptor<PostgresRoleInput, PostgresRole> = {
+  kind: 'role',
+  schema: PostgresRoleSchema,
+  construct: (input) => new PostgresRole(input),
+};

package/src/core/migrations/bound-schema.ts

@@ -0,0 +1,10 @@
+import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
+
+/**
+ * Maps a planner schema name to the contract-free DDL builder's optional
+ * `schema` field: the unbound sentinel becomes `undefined` (the builder omits
+ * the schema qualifier), every other name passes through.
+ */
+export function boundSchema(schemaName: string): string | undefined {
+  return schemaName === UNBOUND_NAMESPACE_ID ? undefined : schemaName;
+}

package/src/core/migrations/contract-to-postgres-schema-ir.ts

@@ -0,0 +1,91 @@
+import type { ContractToSchemaIROptions } from '@prisma-next/family-sql/control';
+import { contractToSchemaIR } from '@prisma-next/family-sql/control';
+import { ifDefined } from '@prisma-next/utils/defined';
+import type { PostgresContract } from '../postgres-schema';
+import { isPostgresSchema } from '../postgres-schema';
+import { PostgresRlsPolicy } from '../schema-ir/postgres-rls-policy';
+import { PostgresSchemaIR } from '../schema-ir/postgres-schema-ir';
+import { resolveDdlSchemaForNamespaceStorage } from '../schema-ir/postgres-schema-ir-annotations';
+import { PostgresTableIR } from '../schema-ir/postgres-table-ir';
+
+export function contractToPostgresSchemaIR(
+  contract: PostgresContract | null,
+  options: ContractToSchemaIROptions,
+): PostgresSchemaIR {
+  const sqlIr = contractToSchemaIR(contract, options);
+  const ownedSchemas =
+    contract === null
+      ? []
+      : Object.values(contract.storage.namespaces)
+          .filter((ns) => isPostgresSchema(ns))
+          .map((ns) => resolveDdlSchemaForNamespaceStorage(contract.storage, ns.id));
+
+  // Build a map of tableName → PostgresRlsPolicy[], resolving the DDL schema
+  // name once per namespace (not per policy).
+  const policiesByTable = new Map<string, PostgresRlsPolicy[]>();
+  if (contract !== null) {
+    for (const ns of Object.values(contract.storage.namespaces)) {
+      if (!isPostgresSchema(ns)) continue;
+      const resolvedSchema = resolveDdlSchemaForNamespaceStorage(contract.storage, ns.id);
+      for (const policy of Object.values(ns.policy)) {
+        const resolved =
+          resolvedSchema === policy.namespaceId
+            ? policy
+            : new PostgresRlsPolicy({
+                name: policy.name,
+                prefix: policy.prefix,
+                tableName: policy.tableName,
+                namespaceId: resolvedSchema,
+                operation: policy.operation,
+                roles: [...policy.roles],
+                ...ifDefined('using', policy.using),
+                ...ifDefined('withCheck', policy.withCheck),
+                permissive: policy.permissive,
+              });
+        const list = policiesByTable.get(policy.tableName) ?? [];
+        list.push(resolved);
+        policiesByTable.set(policy.tableName, list);
+      }
+    }
+  }
+
+  // Attach policies to each table from the relational projection. A policy that
+  // references a table absent from the schema IR is a malformed contract — the
+  // loop below throws rather than fabricating a stub table.
+  const tables: Record<string, PostgresTableIR> = {};
+  for (const [tableName, sqlTable] of Object.entries(sqlIr.tables)) {
+    tables[tableName] = new PostgresTableIR({
+      name: sqlTable.name,
+      columns: sqlTable.columns,
+      foreignKeys: sqlTable.foreignKeys,
+      uniques: sqlTable.uniques,
+      indexes: sqlTable.indexes,
+      ...(sqlTable.primaryKey !== undefined ? { primaryKey: sqlTable.primaryKey } : {}),
+      ...(sqlTable.annotations !== undefined ? { annotations: sqlTable.annotations } : {}),
+      ...(sqlTable.checks !== undefined ? { checks: sqlTable.checks } : {}),
+      rlsPolicies: policiesByTable.get(tableName) ?? [],
+    });
+  }
+  for (const [tableName, policies] of policiesByTable) {
+    if (!(tableName in tables)) {
+      const policyName = policies[0]?.name ?? '(unknown)';
+      throw new Error(
+        `contract-to-postgres-schema-ir: policy "${policyName}" references table "${tableName}" not present in the schema`,
+      );
+    }
+  }
+
+  return new PostgresSchemaIR({
+    tables,
+    roles:
+      contract === null
+        ? []
+        : Object.values(contract.storage.namespaces).flatMap((ns) =>
+            isPostgresSchema(ns) ? Object.values(ns.role) : [],
+          ),
+    pgSchemaName: 'public',
+    pgVersion: '',
+    existingSchemas: ownedSchemas,
+    nativeEnumTypeNames: [],
+  });
+}

package/src/core/migrations/control-policy.ts

@@ -21,6 +21,8 @@ import type { PostgresOpFactoryCall } from './op-factory-call';
 const OBJECT_CREATION_FACTORIES: ReadonlySet<string> = new Set<string>([
   'createTable',
   'createSchema',
+  'createRlsPolicy',
+  'enableRowLevelSecurity',
 ]);
 
 function createsNewTopLevelObject(call: PostgresOpFactoryCall): boolean {
@@ -151,6 +153,7 @@ export function resolvePostgresCallControlPolicySubject(
 const POSTGRES_ISSUE_CREATION_FACTORY: Readonly<Record<string, string>> = Object.freeze({
   missing_schema: 'createSchema',
   missing_table: 'createTable',
+  missing_rls_policy: 'createRlsPolicy',
 });
 
 export function resolvePostgresIssueCreationFactoryName(issue: SchemaIssue): string | undefined {

package/src/core/migrations/diff-postgres-schema.ts

@@ -0,0 +1,55 @@
+import type { SchemaDiffIssue } from '@prisma-next/framework-components/control';
+import { diffSchemas } from '@prisma-next/framework-components/control';
+import { isPostgresRlsPolicy, type PostgresRlsPolicy } from '../schema-ir/postgres-rls-policy';
+import { ensurePostgresSchemaIR, type PostgresSchemaIR } from '../schema-ir/postgres-schema-ir';
+
+// Renders a display-only reference string for the diff message. If policy
+// rendering grows, route it through the adapter's SQL renderer so the message
+// can't diverge from the emitted policy SQL.
+function renderPostgresPolicyReference(policy: PostgresRlsPolicy): string {
+  return `policy "${policy.name}" on "${policy.namespaceId}"."${policy.tableName}"`;
+}
+
+/**
+ * Computes schema drift between two derived schema IRs.
+ *
+ * 1. Runs the framework total diff.
+ * 2. Filters to policy-subject issues only — this is transitional: the generic
+ *    differ walks the whole tree, but the legacy relational verifier still owns
+ *    table/column drift, so non-policy issues are dropped here.
+ * 3. Remaps the message to a human-readable policy reference.
+ *
+ * Ownership filtering (dropping `extra` issues in namespaces a contract doesn't
+ * own) is the caller's responsibility — use `filterIssuesByOwnership`.
+ */
+export function diffPostgresSchema(
+  expected: PostgresSchemaIR,
+  actual: PostgresSchemaIR,
+): readonly SchemaDiffIssue[] {
+  const safeActual = ensurePostgresSchemaIR(actual);
+  const issues = diffSchemas(expected, safeActual);
+
+  return issues
+    .filter((i) => isPostgresRlsPolicy(i.expected ?? i.actual))
+    .map((i) => {
+      const policy = i.expected ?? i.actual;
+      if (!isPostgresRlsPolicy(policy)) return i;
+      return { ...i, message: `${i.outcome}: ${renderPostgresPolicyReference(policy)}` };
+    });
+}
+
+/**
+ * Filters `extra` policy issues to those in owned namespaces. Call after
+ * `diffPostgresSchema` with the union of namespace ids from the expected IR's
+ * policies and its `existingSchemas`.
+ */
+export function filterIssuesByOwnership(
+  issues: readonly SchemaDiffIssue[],
+  ownedSchemaNames: ReadonlySet<string>,
+): readonly SchemaDiffIssue[] {
+  return issues.filter(
+    (i) =>
+      i.outcome !== 'extra' ||
+      (isPostgresRlsPolicy(i.actual) && ownedSchemaNames.has(i.actual.namespaceId)),
+  );
+}

package/src/core/migrations/issue-planner.ts

@@ -695,6 +695,8 @@ type CallCategory =
   | 'dep'
   | 'drop'
   | 'table'
+  | 'rlsEnable'
+  | 'rlsPolicy'
   | 'column'
   | 'alter'
   | 'primaryKey'
@@ -724,6 +726,12 @@ function classifyCall(call: PostgresOpFactoryCall): CallCategory {
       return 'unique'; // after uniques, before indexes
     case 'createTable':
       return 'table';
+    case 'enableRowLevelSecurity':
+      return 'rlsEnable';
+    case 'createRlsPolicy':
+      return 'rlsPolicy';
+    case 'dropRlsPolicy':
+      return 'drop';
     case 'addColumn':
       return 'column';
     case 'alterColumnType':

package/src/core/migrations/op-factory-call.ts

@@ -40,8 +40,10 @@ import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { columnExistsAst, tableExistsAst } from '../../contract-free/checks';
 import * as contractFreeDdl from '../../contract-free/ddl';
+import type { PostgresRlsPolicy } from '../schema-ir/postgres-rls-policy';
 import { escapeLiteral, quoteIdentifier } from '../sql-utils';
 import type { PostgresColumnDefault } from '../types';
+import { boundSchema } from './bound-schema';
 import {
   addNotNullColumnDirect,
   alterColumnType,
@@ -61,6 +63,7 @@ import {
 } from './operations/constraints';
 import { createExtension } from './operations/dependencies';
 import { createIndex, dropIndex } from './operations/indexes';
+import { createRlsPolicy, dropRlsPolicy, enableRowLevelSecurity } from './operations/rls';
 import type { ForeignKeySpec } from './operations/shared';
 import { step, targetDetails } from './operations/shared';
 import { dropTable } from './operations/tables';
@@ -83,10 +86,6 @@ type Op = SqlMigrationPlanOperation<PostgresPlanTargetDetails>;
 // transitive package on disk.
 const POSTGRES_MIGRATION_FACADE = '@prisma-next/postgres/migration';
 
-function boundSchema(schemaName: string): string | undefined {
-  return schemaName === UNBOUND_NAMESPACE_ID ? undefined : schemaName;
-}
-
 abstract class PostgresOpFactoryCallNode extends TsExpression implements FrameworkOpFactoryCall {
   abstract readonly factoryName: string;
   abstract readonly operationClass: MigrationOperationClass;
@@ -684,10 +683,8 @@ export class DropDefaultCall extends PostgresOpFactoryCallNode {
 
 /**
  * Planner-internal call for adding a NOT NULL column (no contract default) to
- * a table that must be empty at migration time. Carries the raw ADD COLUMN SQL
- * (produced by `buildAddColumnSql` at plan time — deferred from slice-7 typed
- * DDL) plus the parameters needed to lower the typed pre/postchecks at render
- * time.
+ * a table that must be empty at migration time. Carries the typed `DdlColumn`
+ * and lowers it to an ADD COLUMN execute step via the adapter at `toOp` time.
  *
  * No authored `PostgresMigration` method: this call is only emitted by the
  * planner, never hand-written by migration authors.
@@ -698,15 +695,15 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
   readonly schemaName: string;
   readonly tableName: string;
   readonly columnName: string;
-  readonly executeStepSql: string;
+  readonly column: DdlColumn;
   readonly label: string;
 
-  constructor(schemaName: string, tableName: string, columnName: string, executeStepSql: string) {
+  constructor(schemaName: string, tableName: string, columnName: string, column: DdlColumn) {
     super();
     this.schemaName = schemaName;
     this.tableName = tableName;
     this.columnName = columnName;
-    this.executeStepSql = executeStepSql;
+    this.column = column;
     this.label = `Add column ${columnName} to ${tableName}`;
     this.freeze();
   }
@@ -717,13 +714,7 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
         `AddNotNullColumnDirectCall.toOp: a lowerer is required on the Postgres planner path (column "${this.columnName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
       );
     }
-    return addNotNullColumnDirect(
-      this.schemaName,
-      this.tableName,
-      this.columnName,
-      this.executeStepSql,
-      lowerer,
-    );
+    return addNotNullColumnDirect(this.schemaName, this.tableName, this.column, lowerer);
   }
 
   renderTypeScript(): string {
@@ -738,9 +729,9 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
 /**
  * Planner-internal call for adding a NOT NULL column (no contract default)
  * using a temporary default value for non-empty tables. Carries all parameters
- * needed for `buildAddNotNullColumnWithTemporaryDefaultOperation`; the typed
- * pre/postchecks are lowered at render time via `toOp(lowerer)`. The execute
- * SQL (`buildAddColumnSql`) is still raw per slice-7 deferral.
+ * needed for `buildAddNotNullColumnWithTemporaryDefaultOperation`; both the
+ * typed ADD COLUMN execute step and the pre/postchecks are lowered via the
+ * adapter at `toOp` time.
  *
  * No authored `PostgresMigration` method: this call is only emitted by the
  * planner, never hand-written by migration authors.
@@ -1376,6 +1367,97 @@ export class DataTransformCall extends PostgresOpFactoryCallNode {
   }
 }
 
+export class CreatePostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'createRlsPolicy' as const;
+  readonly operationClass = 'additive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly policy: PostgresRlsPolicy;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, policy: PostgresRlsPolicy) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.policy = policy;
+    this.label = `Create RLS policy "${policy.name}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `CreatePostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policy.name}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return createRlsPolicy(this.schemaName, this.tableName, this.policy, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `createRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policy)})`;
+  }
+}
+
+export class DropPostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'dropRlsPolicy' as const;
+  readonly operationClass = 'destructive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly policyName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, policyName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.policyName = policyName;
+    this.label = `Drop RLS policy "${policyName}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `DropPostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policyName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return dropRlsPolicy(this.schemaName, this.tableName, this.policyName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `dropRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policyName)})`;
+  }
+}
+
+export class EnableRowLevelSecurityCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'enableRowLevelSecurity' as const;
+  readonly operationClass = 'additive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.label = `Enable row-level security on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `EnableRowLevelSecurityCall.toOp: a lowerer is required on the Postgres planner path (table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return enableRowLevelSecurity(this.schemaName, this.tableName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `enableRowLevelSecurity(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)})`;
+  }
+}
+
 export type PostgresOpFactoryCall =
   | CreateTableCall
   | DropTableCall
@@ -1399,4 +1481,7 @@ export type PostgresOpFactoryCall =
   | RawSqlCall
   | CreateExtensionCall
   | CreateSchemaCall
+  | CreatePostgresRlsPolicyCall
+  | DropPostgresRlsPolicyCall
+  | EnableRowLevelSecurityCall
   | DataTransformCall;