@prisma-next/target-postgres 0.14.0-dev.4 → 0.14.0-dev.40

package/src/core/migrations/contract-to-postgres-database-schema-node.ts

@@ -0,0 +1,125 @@
+import type { ContractToSchemaIROptions } from '@prisma-next/family-sql/control';
+import { contractNamespaceToSchemaIR } from '@prisma-next/family-sql/control';
+import { ifDefined } from '@prisma-next/utils/defined';
+import type { PostgresRlsPolicy } from '../postgres-rls-policy';
+import type { PostgresContract } from '../postgres-schema';
+import { isPostgresSchema } from '../postgres-schema';
+import { PostgresDatabaseSchemaNode } from '../schema-ir/postgres-database-schema-node';
+import { PostgresNamespaceSchemaNode } from '../schema-ir/postgres-namespace-schema-node';
+import { PostgresPolicySchemaNode } from '../schema-ir/postgres-policy-schema-node';
+import { PostgresRoleSchemaNode } from '../schema-ir/postgres-role-schema-node';
+import { PostgresTableSchemaNode } from '../schema-ir/postgres-table-schema-node';
+import { resolveDdlSchemaForNamespaceStorage } from './resolve-ddl-schema';
+
+function toPolicyNode(policy: PostgresRlsPolicy, namespaceId: string): PostgresPolicySchemaNode {
+  return new PostgresPolicySchemaNode({
+    name: policy.name,
+    prefix: policy.prefix,
+    tableName: policy.tableName,
+    namespaceId,
+    operation: policy.operation,
+    roles: [...policy.roles],
+    ...ifDefined('using', policy.using),
+    ...ifDefined('withCheck', policy.withCheck),
+    permissive: policy.permissive,
+  });
+}
+
+/**
+ * Projects a Postgres contract into the expected schema-diff tree: a
+ * `PostgresDatabaseSchemaNode` root holding one `PostgresNamespaceSchemaNode`
+ * per Postgres namespace, each holding its `PostgresTableSchemaNode`s with
+ * their `PostgresPolicySchemaNode`s, plus the database roles on the root.
+ *
+ * Not a duplicate of the family's `contractToSchemaIR`: that builds a flat,
+ * single `{ tables }` map (and throws on cross-namespace name collisions, with
+ * no RLS/role concept) for SQLite's single-schema world. This is the
+ * Postgres-specific *tree* shape — multi-schema, RLS-policy-aware, role-aware.
+ * It reuses the family's per-namespace table conversion (`contractNamespaceToSchemaIR`)
+ * for column/FK/index building and only adds the Postgres tree/policy/role shape.
+ *
+ * Tables are grouped by their owning namespace (resolved DDL schema name) so
+ * the tree mirrors Postgres's object hierarchy. The DDL schema name is
+ * resolved once per namespace.
+ *
+ * A policy that references a table absent from its namespace is a malformed
+ * contract — the loop throws rather than fabricating a stub table.
+ */
+export function contractToPostgresDatabaseSchemaNode(
+  contract: PostgresContract | null,
+  options: ContractToSchemaIROptions,
+): PostgresDatabaseSchemaNode {
+  if (contract === null) {
+    return new PostgresDatabaseSchemaNode({
+      namespaces: {},
+      roles: [],
+      existingSchemas: [],
+      pgVersion: '',
+    });
+  }
+
+  const namespaces: Record<string, PostgresNamespaceSchemaNode> = {};
+  const roles: PostgresRoleSchemaNode[] = [];
+  const ownedSchemas: string[] = [];
+
+  for (const ns of Object.values(contract.storage.namespaces)) {
+    if (!isPostgresSchema(ns)) continue;
+    const ddlSchema = resolveDdlSchemaForNamespaceStorage(contract.storage, ns.id);
+    ownedSchemas.push(ddlSchema);
+
+    // Convert only THIS namespace's tables (passing the full storage for
+    // type/value-set/enum resolution that spans namespaces), so the same table
+    // name can exist in two schemas without colliding in a bare-keyed record.
+    const sqlTables = contractNamespaceToSchemaIR(contract.storage, ns.id, options).tables;
+
+    const policiesByTable = new Map<string, PostgresPolicySchemaNode[]>();
+    for (const policy of Object.values(ns.policy)) {
+      const list = policiesByTable.get(policy.tableName) ?? [];
+      list.push(toPolicyNode(policy, ddlSchema));
+      policiesByTable.set(policy.tableName, list);
+    }
+
+    const tables: Record<string, PostgresTableSchemaNode> = {};
+    for (const tableName of Object.keys(ns.table)) {
+      const sqlTable = sqlTables[tableName];
+      if (sqlTable === undefined) continue;
+      tables[tableName] = new PostgresTableSchemaNode({
+        name: sqlTable.name,
+        columns: sqlTable.columns,
+        foreignKeys: sqlTable.foreignKeys,
+        uniques: sqlTable.uniques,
+        indexes: sqlTable.indexes,
+        ...ifDefined('primaryKey', sqlTable.primaryKey),
+        ...ifDefined('annotations', sqlTable.annotations),
+        ...ifDefined('checks', sqlTable.checks),
+        policies: policiesByTable.get(tableName) ?? [],
+      });
+    }
+
+    for (const [tableName, tablePolicies] of policiesByTable) {
+      if (!(tableName in tables)) {
+        const policyName = tablePolicies[0]?.name ?? '(unknown)';
+        throw new Error(
+          `contract-to-postgres-database-schema-node: policy "${policyName}" references table "${tableName}" not present in namespace "${ddlSchema}"`,
+        );
+      }
+    }
+
+    namespaces[ddlSchema] = new PostgresNamespaceSchemaNode({
+      schemaName: ddlSchema,
+      tables,
+      nativeEnumTypeNames: [],
+    });
+
+    for (const role of Object.values(ns.role)) {
+      roles.push(new PostgresRoleSchemaNode({ name: role.name, namespaceId: role.namespaceId }));
+    }
+  }
+
+  return new PostgresDatabaseSchemaNode({
+    namespaces,
+    roles,
+    existingSchemas: ownedSchemas,
+    pgVersion: '',
+  });
+}

package/src/core/migrations/control-policy.ts

@@ -21,6 +21,8 @@ import type { PostgresOpFactoryCall } from './op-factory-call';
 const OBJECT_CREATION_FACTORIES: ReadonlySet<string> = new Set<string>([
   'createTable',
   'createSchema',
+  'createRlsPolicy',
+  'enableRowLevelSecurity',
 ]);
 
 function createsNewTopLevelObject(call: PostgresOpFactoryCall): boolean {
@@ -151,6 +153,7 @@ export function resolvePostgresCallControlPolicySubject(
 const POSTGRES_ISSUE_CREATION_FACTORY: Readonly<Record<string, string>> = Object.freeze({
   missing_schema: 'createSchema',
   missing_table: 'createTable',
+  missing_rls_policy: 'createRlsPolicy',
 });
 
 export function resolvePostgresIssueCreationFactoryName(issue: SchemaIssue): string | undefined {

package/src/core/migrations/diff-database-schema.ts

@@ -0,0 +1,191 @@
+import type { Contract } from '@prisma-next/contract/types';
+import { verifySqlSchemaTree } from '@prisma-next/family-sql/diff';
+import type { TargetBoundComponentDescriptor } from '@prisma-next/framework-components/components';
+import type {
+  SchemaDiffIssue,
+  VerifyDatabaseSchemaResult,
+} from '@prisma-next/framework-components/control';
+import { diffSchemas, SchemaDiff } from '@prisma-next/framework-components/control';
+import type { SqlStorage } from '@prisma-next/sql-contract/types';
+import type { SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
+import { blindCast } from '@prisma-next/utils/casts';
+import { parsePostgresDefault } from '../default-normalizer';
+import { normalizeSchemaNativeType } from '../native-type-normalizer';
+import type { PostgresContract } from '../postgres-schema';
+import { PostgresDatabaseSchemaNode } from '../schema-ir/postgres-database-schema-node';
+import { PostgresPolicySchemaNode } from '../schema-ir/postgres-policy-schema-node';
+import type { SqlSchemaDiffNode } from '../schema-ir/schema-node-kinds';
+import { contractToPostgresDatabaseSchemaNode } from './contract-to-postgres-database-schema-node';
+
+interface PostgresDiffDatabaseSchemaInput {
+  readonly contract: Contract<SqlStorage>;
+  readonly actualSchema: SqlSchemaIRNode;
+  readonly strict: boolean;
+  readonly typeMetadataRegistry: ReadonlyMap<string, { readonly nativeType?: string }>;
+  readonly frameworkComponents: ReadonlyArray<TargetBoundComponentDescriptor<'sql', string>>;
+}
+
+/**
+ * The single combined database-schema comparison — the one computation the
+ * migration planner and the family schema verify both consume. Composes,
+ * once each:
+ *
+ * - the per-namespace-paired relational diff (`verifySqlSchemaTree`) → table /
+ *   column / constraint findings as framework `SchemaIssue`s (with the
+ *   verification-tree `root` and pass/warn/fail counts);
+ * - the policy diff (`diffPostgresSchema` over the two trees) → RLS policy
+ *   presence as `SchemaDiffIssue`s, ownership-filtered to the contract's owned
+ *   schemas.
+ *
+ * `diffPostgresDatabaseSchema` and `verifyPostgresDatabaseSchema` both read
+ * this single result, so the relational walk runs once per caller — never
+ * once for the diff and again for the verify tree.
+ */
+function computePostgresSchemaComparison(input: PostgresDiffDatabaseSchemaInput): {
+  readonly relational: VerifyDatabaseSchemaResult;
+  readonly schemaDiffIssues: readonly SchemaDiffIssue<SqlSchemaDiffNode>[];
+} {
+  const postgresContract = blindCast<
+    PostgresContract,
+    'diffPostgresDatabaseSchema is only called with a postgres contract'
+  >(input.contract);
+
+  // Relational diff: per-namespace-paired so a multi-schema database checks each
+  // contract namespace against its own actual node.
+  const relational = verifySqlSchemaTree({
+    contract: input.contract,
+    actualSchema: input.actualSchema,
+    buildExpectedSchema: (scopedContract) =>
+      contractToPostgresDatabaseSchemaNode(
+        blindCast<
+          PostgresContract | null,
+          'the relational pairing projects a scoped postgres contract'
+        >(scopedContract),
+        { annotationNamespace: 'pg' },
+      ),
+    strict: input.strict,
+    typeMetadataRegistry: input.typeMetadataRegistry,
+    frameworkComponents: input.frameworkComponents,
+    normalizeDefault: parsePostgresDefault,
+    normalizeNativeType: normalizeSchemaNativeType,
+  });
+
+  // Policy diff: the generic node differ over the expected/actual policy trees,
+  // ownership-filtered to the schemas the contract owns (so unowned-namespace
+  // policies are not reported as extras). The actual schema is always the
+  // Postgres database root in production — assert it, matching the prior
+  // `collectSchemaDiffIssues` / `planPostgresSchemaDiff` behaviour.
+  PostgresDatabaseSchemaNode.assert(input.actualSchema);
+  const expected = contractToPostgresDatabaseSchemaNode(postgresContract, {
+    annotationNamespace: 'pg',
+  });
+  const schemaDiffIssues = filterIssuesByOwnership(
+    diffPostgresSchema(expected, input.actualSchema),
+    ownedSchemaNames(expected),
+  );
+
+  return { relational, schemaDiffIssues };
+}
+
+/**
+ * The `SchemaDiffer` for Postgres: the target's black-box comparison,
+ * projected to the two issue lists. Namespace presence (`missing_schema` →
+ * `CREATE SCHEMA`) is intentionally NOT composed here: it is a planner-only
+ * op-generation concern (verify rejects on the relational `missing_table` a
+ * missing schema already produces), so the planner stitches it in around this
+ * diff. Control-policy suppression of the policy issues is likewise a
+ * per-consumer post-step (verify filters the issues; the planner filters the
+ * calls).
+ */
+export function diffPostgresDatabaseSchema(
+  input: PostgresDiffDatabaseSchemaInput,
+): SchemaDiff<SqlSchemaDiffNode> {
+  const { relational, schemaDiffIssues } = computePostgresSchemaComparison(input);
+  return new SchemaDiff(relational.schema.issues, schemaDiffIssues);
+}
+
+/**
+ * The same combined comparison as {@link diffPostgresDatabaseSchema}, wrapped
+ * in the verify envelope (`ok`/`summary`/`code`/`target`/`timings`) plus the
+ * pass/warn/fail tree the CLI renders — i.e. exactly the existing verify-result
+ * schema shape, so nothing downstream changes.
+ */
+export function verifyPostgresDatabaseSchema(
+  input: PostgresDiffDatabaseSchemaInput,
+): VerifyDatabaseSchemaResult {
+  const { relational, schemaDiffIssues } = computePostgresSchemaComparison(input);
+  return {
+    ...relational,
+    schema: { ...relational.schema, schemaDiffIssues },
+  };
+}
+
+function ownedSchemaNames(expected: PostgresDatabaseSchemaNode): ReadonlySet<string> {
+  const policyNamespaces = Object.values(expected.namespaces).flatMap((ns) =>
+    Object.values(ns.tables).flatMap((t) => t.policies.map((p) => p.namespaceId)),
+  );
+  return new Set([...policyNamespaces, ...expected.existingSchemas]);
+}
+
+// Renders a display-only reference string for the diff message. If policy
+// rendering grows, route it through the adapter's SQL renderer so the message
+// can't diverge from the emitted policy SQL.
+function renderPostgresPolicyReference(policy: PostgresPolicySchemaNode): string {
+  return `policy "${policy.name}" on "${policy.namespaceId}"."${policy.tableName}"`;
+}
+
+/**
+ * The policy node-diff — the structural half of the combined comparison above.
+ * Computes RLS-policy drift between two derived schema trees:
+ *
+ * 1. Runs the framework total diff over the two `PostgresDatabaseSchemaNode`
+ *    roots (database → namespace → table → policy).
+ * 2. Filters to policy-subject issues only — this is transitional: the generic
+ *    differ walks the whole tree, but the legacy relational verifier still owns
+ *    table/column drift, so non-policy issues are dropped here.
+ * 3. Remaps the message to a human-readable policy reference.
+ *
+ * Both trees are `PostgresDatabaseSchemaNode`s, so every issue node is a
+ * `SqlSchemaDiffNode` — narrow the framework's `SchemaDiffIssue<DiffableNode>`
+ * output once here (the single boundary cast), so every downstream consumer
+ * (the ownership filter, the planner) reads the concrete node with no cast.
+ *
+ * Ownership filtering (dropping `extra` issues in namespaces a contract doesn't
+ * own) is the caller's responsibility — use `filterIssuesByOwnership`.
+ */
+export function diffPostgresSchema(
+  expected: PostgresDatabaseSchemaNode,
+  actual: PostgresDatabaseSchemaNode,
+): readonly SchemaDiffIssue<SqlSchemaDiffNode>[] {
+  const issues = blindCast<
+    readonly SchemaDiffIssue<SqlSchemaDiffNode>[],
+    'both trees are PostgresDatabaseSchemaNodes, so every diff-issue node is a SqlSchemaDiffNode'
+  >(diffSchemas(expected, actual));
+
+  return issues
+    .filter((i) => {
+      const node = i.expected ?? i.actual;
+      return node !== undefined && PostgresPolicySchemaNode.is(node);
+    })
+    .map((i) => {
+      const node = i.expected ?? i.actual;
+      if (node === undefined || !PostgresPolicySchemaNode.is(node)) return i;
+      return { ...i, message: `${i.outcome}: ${renderPostgresPolicyReference(node)}` };
+    });
+}
+
+/**
+ * Filters `extra` policy issues to those in owned namespaces. Call after
+ * `diffPostgresSchema` with the union of namespace ids from the expected tree's
+ * policies and its `existingSchemas`.
+ */
+export function filterIssuesByOwnership(
+  issues: readonly SchemaDiffIssue<SqlSchemaDiffNode>[],
+  ownedSchemaNameSet: ReadonlySet<string>,
+): readonly SchemaDiffIssue<SqlSchemaDiffNode>[] {
+  return issues.filter((i) => {
+    if (i.outcome !== 'extra') return true;
+    if (i.actual === undefined) return false;
+    return PostgresPolicySchemaNode.is(i.actual) && ownedSchemaNameSet.has(i.actual.namespaceId);
+  });
+}

package/src/core/migrations/issue-planner.ts

@@ -15,7 +15,7 @@ import type {
   SqlPlannerConflict,
   SqlPlannerConflictLocation,
 } from '@prisma-next/family-sql/control';
-import { arraysEqual } from '@prisma-next/family-sql/schema-verify';
+import { arraysEqual } from '@prisma-next/family-sql/diff';
 import type { TargetBoundComponentDescriptor } from '@prisma-next/framework-components/components';
 import type { SchemaIssue } from '@prisma-next/framework-components/control';
 import type {
@@ -31,6 +31,7 @@ import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import type { Result } from '@prisma-next/utils/result';
 import { notOk, ok } from '@prisma-next/utils/result';
+import { quoteIdentifier } from '../sql-utils';
 import {
   AddColumnCall,
   AddForeignKeyCall,
@@ -67,6 +68,26 @@ import { resolveColumnTypeMetadata } from './planner-type-resolution';
 
 export type { CallMigrationStrategy, StrategyContext };
 
+/**
+ * Deterministic name for the element-non-null CHECK constraint on a scalar-array
+ * column. Distinct `_elem_not_null` suffix avoids collision with the enum
+ * value-set `_check` constraints. Re-emitting the same schema produces the same
+ * name, so `pg_get_constraintdef`-based verify sees no drift.
+ */
+function elementNonNullCheckName(tableName: string, columnName: string): string {
+  return `${tableName}_${columnName}_elem_not_null`;
+}
+
+/**
+ * Predicate enforcing that a scalar-array column carries no NULL element. The
+ * array column itself may be NULL (container nullability is the column's NOT NULL
+ * clause); `array_position` over a NULL array yields NULL, which a CHECK treats
+ * as satisfied, so a nullable array column is unaffected.
+ */
+function elementNonNullCheckExpression(columnName: string): string {
+  return `array_position(${quoteIdentifier(columnName)}, NULL) IS NULL`;
+}
+
 // ============================================================================
 // Issue kind ordering (dependency order)
 // ============================================================================
@@ -254,16 +275,28 @@ function mapIssueToCall(
         );
       }
       const schemaForTable = tableSchema(issue);
+      const missingTableName = issue.table;
       const ddlColumns: DdlColumn[] = Object.entries(contractTable.columns).map(([name, column]) =>
         toDdlColumn(name, column, codecHooks, storageTypes),
       );
-      const ddlConstraints: DdlTableConstraint[] | undefined = contractTable.primaryKey
+      const primaryKeyConstraints: DdlTableConstraint[] = contractTable.primaryKey
         ? [
             contractFree.primaryKey(contractTable.primaryKey.columns, {
               ...(contractTable.primaryKey.name ? { name: contractTable.primaryKey.name } : {}),
             }),
           ]
-        : undefined;
+        : [];
+      const elementNonNullChecks: DdlTableConstraint[] = Object.entries(contractTable.columns)
+        .filter(([, column]) => column.many === true)
+        .map(([columnName]) =>
+          contractFree.checkExpression(
+            elementNonNullCheckName(missingTableName, columnName),
+            elementNonNullCheckExpression(columnName),
+          ),
+        );
+      const allTableConstraints = [...primaryKeyConstraints, ...elementNonNullChecks];
+      const ddlConstraints: DdlTableConstraint[] | undefined =
+        allTableConstraints.length > 0 ? allTableConstraints : undefined;
       const calls: PostgresOpFactoryCall[] = [
         new CreateTableCall(schemaForTable, issue.table, ddlColumns, ddlConstraints),
       ];
@@ -695,6 +728,8 @@ type CallCategory =
   | 'dep'
   | 'drop'
   | 'table'
+  | 'rlsEnable'
+  | 'rlsPolicy'
   | 'column'
   | 'alter'
   | 'primaryKey'
@@ -724,6 +759,12 @@ function classifyCall(call: PostgresOpFactoryCall): CallCategory {
       return 'unique'; // after uniques, before indexes
     case 'createTable':
       return 'table';
+    case 'enableRowLevelSecurity':
+      return 'rlsEnable';
+    case 'createRlsPolicy':
+      return 'rlsPolicy';
+    case 'dropRlsPolicy':
+      return 'drop';
     case 'addColumn':
       return 'column';
     case 'alterColumnType':

package/src/core/migrations/op-factory-call.ts

@@ -40,8 +40,10 @@ import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { columnExistsAst, tableExistsAst } from '../../contract-free/checks';
 import * as contractFreeDdl from '../../contract-free/ddl';
+import type { PostgresRlsPolicy } from '../postgres-rls-policy';
 import { escapeLiteral, quoteIdentifier } from '../sql-utils';
 import type { PostgresColumnDefault } from '../types';
+import { boundSchema } from './bound-schema';
 import {
   addNotNullColumnDirect,
   alterColumnType,
@@ -61,6 +63,7 @@ import {
 } from './operations/constraints';
 import { createExtension } from './operations/dependencies';
 import { createIndex, dropIndex } from './operations/indexes';
+import { createRlsPolicy, dropRlsPolicy, enableRowLevelSecurity } from './operations/rls';
 import type { ForeignKeySpec } from './operations/shared';
 import { step, targetDetails } from './operations/shared';
 import { dropTable } from './operations/tables';
@@ -83,10 +86,6 @@ type Op = SqlMigrationPlanOperation<PostgresPlanTargetDetails>;
 // transitive package on disk.
 const POSTGRES_MIGRATION_FACADE = '@prisma-next/postgres/migration';
 
-function boundSchema(schemaName: string): string | undefined {
-  return schemaName === UNBOUND_NAMESPACE_ID ? undefined : schemaName;
-}
-
 abstract class PostgresOpFactoryCallNode extends TsExpression implements FrameworkOpFactoryCall {
   abstract readonly factoryName: string;
   abstract readonly operationClass: MigrationOperationClass;
@@ -169,6 +168,8 @@ function renderDdlConstraintAsTsCall(constraint: DdlTableConstraint): string {
       const nameOpt = constraint.name ? `, { name: ${jsonToTsSource(constraint.name)} }` : '';
       return `unique(${jsonToTsSource(constraint.columns)}${nameOpt})`;
     }
+    case 'check-expression':
+      return `checkExpression(${jsonToTsSource(constraint.name)}, ${jsonToTsSource(constraint.expression)})`;
   }
 }
 
@@ -183,6 +184,7 @@ function constraintImportSymbols(constraints: readonly DdlTableConstraint[] | un
     if (c.kind === 'primary-key') symbols.add('primaryKey');
     else if (c.kind === 'foreign-key') symbols.add('foreignKey');
     else if (c.kind === 'unique') symbols.add('unique');
+    else if (c.kind === 'check-expression') symbols.add('checkExpression');
   }
   return [...symbols];
 }
@@ -684,10 +686,8 @@ export class DropDefaultCall extends PostgresOpFactoryCallNode {
 
 /**
  * Planner-internal call for adding a NOT NULL column (no contract default) to
- * a table that must be empty at migration time. Carries the raw ADD COLUMN SQL
- * (produced by `buildAddColumnSql` at plan time — deferred from slice-7 typed
- * DDL) plus the parameters needed to lower the typed pre/postchecks at render
- * time.
+ * a table that must be empty at migration time. Carries the typed `DdlColumn`
+ * and lowers it to an ADD COLUMN execute step via the adapter at `toOp` time.
  *
  * No authored `PostgresMigration` method: this call is only emitted by the
  * planner, never hand-written by migration authors.
@@ -698,15 +698,15 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
   readonly schemaName: string;
   readonly tableName: string;
   readonly columnName: string;
-  readonly executeStepSql: string;
+  readonly column: DdlColumn;
   readonly label: string;
 
-  constructor(schemaName: string, tableName: string, columnName: string, executeStepSql: string) {
+  constructor(schemaName: string, tableName: string, columnName: string, column: DdlColumn) {
     super();
     this.schemaName = schemaName;
     this.tableName = tableName;
     this.columnName = columnName;
-    this.executeStepSql = executeStepSql;
+    this.column = column;
     this.label = `Add column ${columnName} to ${tableName}`;
     this.freeze();
   }
@@ -717,13 +717,7 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
         `AddNotNullColumnDirectCall.toOp: a lowerer is required on the Postgres planner path (column "${this.columnName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
       );
     }
-    return addNotNullColumnDirect(
-      this.schemaName,
-      this.tableName,
-      this.columnName,
-      this.executeStepSql,
-      lowerer,
-    );
+    return addNotNullColumnDirect(this.schemaName, this.tableName, this.column, lowerer);
   }
 
   renderTypeScript(): string {
@@ -738,9 +732,9 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
 /**
  * Planner-internal call for adding a NOT NULL column (no contract default)
  * using a temporary default value for non-empty tables. Carries all parameters
- * needed for `buildAddNotNullColumnWithTemporaryDefaultOperation`; the typed
- * pre/postchecks are lowered at render time via `toOp(lowerer)`. The execute
- * SQL (`buildAddColumnSql`) is still raw per slice-7 deferral.
+ * needed for `buildAddNotNullColumnWithTemporaryDefaultOperation`; both the
+ * typed ADD COLUMN execute step and the pre/postchecks are lowered via the
+ * adapter at `toOp` time.
  *
  * No authored `PostgresMigration` method: this call is only emitted by the
  * planner, never hand-written by migration authors.
@@ -1376,6 +1370,97 @@ export class DataTransformCall extends PostgresOpFactoryCallNode {
   }
 }
 
+export class CreatePostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'createRlsPolicy' as const;
+  readonly operationClass = 'additive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly policy: PostgresRlsPolicy;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, policy: PostgresRlsPolicy) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.policy = policy;
+    this.label = `Create RLS policy "${policy.name}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `CreatePostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policy.name}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return createRlsPolicy(this.schemaName, this.tableName, this.policy, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `createRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policy)})`;
+  }
+}
+
+export class DropPostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'dropRlsPolicy' as const;
+  readonly operationClass = 'destructive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly policyName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, policyName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.policyName = policyName;
+    this.label = `Drop RLS policy "${policyName}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `DropPostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policyName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return dropRlsPolicy(this.schemaName, this.tableName, this.policyName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `dropRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policyName)})`;
+  }
+}
+
+export class EnableRowLevelSecurityCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'enableRowLevelSecurity' as const;
+  readonly operationClass = 'additive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.label = `Enable row-level security on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `EnableRowLevelSecurityCall.toOp: a lowerer is required on the Postgres planner path (table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return enableRowLevelSecurity(this.schemaName, this.tableName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `enableRowLevelSecurity(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)})`;
+  }
+}
+
 export type PostgresOpFactoryCall =
   | CreateTableCall
   | DropTableCall
@@ -1399,4 +1484,7 @@ export type PostgresOpFactoryCall =
   | RawSqlCall
   | CreateExtensionCall
   | CreateSchemaCall
+  | CreatePostgresRlsPolicyCall
+  | DropPostgresRlsPolicyCall
+  | EnableRowLevelSecurityCall
   | DataTransformCall;