@prisma-next/target-postgres 0.14.0-dev.6 → 0.14.0-dev.61

package/src/core/migrations/op-factory-call.ts

@@ -40,8 +40,10 @@ import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { columnExistsAst, tableExistsAst } from '../../contract-free/checks';
 import * as contractFreeDdl from '../../contract-free/ddl';
+import type { PostgresRlsPolicy } from '../postgres-rls-policy';
 import { escapeLiteral, quoteIdentifier } from '../sql-utils';
 import type { PostgresColumnDefault } from '../types';
+import { boundSchema } from './bound-schema';
 import {
   addNotNullColumnDirect,
   alterColumnType,
@@ -61,6 +63,13 @@ import {
 } from './operations/constraints';
 import { createExtension } from './operations/dependencies';
 import { createIndex, dropIndex } from './operations/indexes';
+import {
+  createRlsPolicy,
+  disableRowLevelSecurity,
+  dropRlsPolicy,
+  enableRowLevelSecurity,
+  renameRlsPolicy,
+} from './operations/rls';
 import type { ForeignKeySpec } from './operations/shared';
 import { step, targetDetails } from './operations/shared';
 import { dropTable } from './operations/tables';
@@ -83,10 +92,6 @@ type Op = SqlMigrationPlanOperation<PostgresPlanTargetDetails>;
 // transitive package on disk.
 const POSTGRES_MIGRATION_FACADE = '@prisma-next/postgres/migration';
 
-function boundSchema(schemaName: string): string | undefined {
-  return schemaName === UNBOUND_NAMESPACE_ID ? undefined : schemaName;
-}
-
 abstract class PostgresOpFactoryCallNode extends TsExpression implements FrameworkOpFactoryCall {
   abstract readonly factoryName: string;
   abstract readonly operationClass: MigrationOperationClass;
@@ -169,6 +174,8 @@ function renderDdlConstraintAsTsCall(constraint: DdlTableConstraint): string {
       const nameOpt = constraint.name ? `, { name: ${jsonToTsSource(constraint.name)} }` : '';
       return `unique(${jsonToTsSource(constraint.columns)}${nameOpt})`;
     }
+    case 'check-expression':
+      return `checkExpression(${jsonToTsSource(constraint.name)}, ${jsonToTsSource(constraint.expression)})`;
   }
 }
 
@@ -183,6 +190,7 @@ function constraintImportSymbols(constraints: readonly DdlTableConstraint[] | un
     if (c.kind === 'primary-key') symbols.add('primaryKey');
     else if (c.kind === 'foreign-key') symbols.add('foreignKey');
     else if (c.kind === 'unique') symbols.add('unique');
+    else if (c.kind === 'check-expression') symbols.add('checkExpression');
   }
   return [...symbols];
 }
@@ -684,10 +692,8 @@ export class DropDefaultCall extends PostgresOpFactoryCallNode {
 
 /**
  * Planner-internal call for adding a NOT NULL column (no contract default) to
- * a table that must be empty at migration time. Carries the raw ADD COLUMN SQL
- * (produced by `buildAddColumnSql` at plan time — deferred from slice-7 typed
- * DDL) plus the parameters needed to lower the typed pre/postchecks at render
- * time.
+ * a table that must be empty at migration time. Carries the typed `DdlColumn`
+ * and lowers it to an ADD COLUMN execute step via the adapter at `toOp` time.
  *
  * No authored `PostgresMigration` method: this call is only emitted by the
  * planner, never hand-written by migration authors.
@@ -698,15 +704,15 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
   readonly schemaName: string;
   readonly tableName: string;
   readonly columnName: string;
-  readonly executeStepSql: string;
+  readonly column: DdlColumn;
   readonly label: string;
 
-  constructor(schemaName: string, tableName: string, columnName: string, executeStepSql: string) {
+  constructor(schemaName: string, tableName: string, columnName: string, column: DdlColumn) {
     super();
     this.schemaName = schemaName;
     this.tableName = tableName;
     this.columnName = columnName;
-    this.executeStepSql = executeStepSql;
+    this.column = column;
     this.label = `Add column ${columnName} to ${tableName}`;
     this.freeze();
   }
@@ -717,13 +723,7 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
         `AddNotNullColumnDirectCall.toOp: a lowerer is required on the Postgres planner path (column "${this.columnName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
       );
     }
-    return addNotNullColumnDirect(
-      this.schemaName,
-      this.tableName,
-      this.columnName,
-      this.executeStepSql,
-      lowerer,
-    );
+    return addNotNullColumnDirect(this.schemaName, this.tableName, this.column, lowerer);
   }
 
   renderTypeScript(): string {
@@ -738,9 +738,9 @@ export class AddNotNullColumnDirectCall extends PostgresOpFactoryCallNode {
 /**
  * Planner-internal call for adding a NOT NULL column (no contract default)
  * using a temporary default value for non-empty tables. Carries all parameters
- * needed for `buildAddNotNullColumnWithTemporaryDefaultOperation`; the typed
- * pre/postchecks are lowered at render time via `toOp(lowerer)`. The execute
- * SQL (`buildAddColumnSql`) is still raw per slice-7 deferral.
+ * needed for `buildAddNotNullColumnWithTemporaryDefaultOperation`; both the
+ * typed ADD COLUMN execute step and the pre/postchecks are lowered via the
+ * adapter at `toOp` time.
  *
  * No authored `PostgresMigration` method: this call is only emitted by the
  * planner, never hand-written by migration authors.
@@ -1376,6 +1376,169 @@ export class DataTransformCall extends PostgresOpFactoryCallNode {
   }
 }
 
+export class CreatePostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'createRlsPolicy' as const;
+  readonly operationClass = 'additive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly policy: PostgresRlsPolicy;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, policy: PostgresRlsPolicy) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.policy = policy;
+    this.label = `Create RLS policy "${policy.name}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `CreatePostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policy.name}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return createRlsPolicy(this.schemaName, this.tableName, this.policy, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `createRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policy)})`;
+  }
+}
+
+export class DropPostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'dropRlsPolicy' as const;
+  readonly operationClass = 'destructive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly policyName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, policyName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.policyName = policyName;
+    this.label = `Drop RLS policy "${policyName}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `DropPostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policyName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return dropRlsPolicy(this.schemaName, this.tableName, this.policyName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `dropRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policyName)})`;
+  }
+}
+
+export class EnableRowLevelSecurityCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'enableRowLevelSecurity' as const;
+  readonly operationClass = 'additive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.label = `Enable row-level security on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `EnableRowLevelSecurityCall.toOp: a lowerer is required on the Postgres planner path (table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return enableRowLevelSecurity(this.schemaName, this.tableName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `enableRowLevelSecurity(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)})`;
+  }
+}
+
+export class DisableRowLevelSecurityCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'disableRowLevelSecurity' as const;
+  readonly operationClass = 'destructive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.label = `Disable row-level security on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `DisableRowLevelSecurityCall.toOp: a lowerer is required on the Postgres planner path (table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return disableRowLevelSecurity(this.schemaName, this.tableName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `disableRowLevelSecurity(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)})`;
+  }
+}
+
+export class RenamePostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'renameRlsPolicy' as const;
+  // `widening` is chosen so the rename plans under every allowance set except
+  // additive-only init — a rename is neither additive-creation nor
+  // destructive, and the class vocabulary has no neutral middle class. It is
+  // NOT that a rename widens anything; this is the accepted typology tradeoff.
+  readonly operationClass = 'widening' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly oldPolicyName: string;
+  readonly newPolicyName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, oldPolicyName: string, newPolicyName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.oldPolicyName = oldPolicyName;
+    this.newPolicyName = newPolicyName;
+    this.label = `Rename RLS policy "${oldPolicyName}" to "${newPolicyName}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `RenamePostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.oldPolicyName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return renameRlsPolicy(
+      this.schemaName,
+      this.tableName,
+      this.oldPolicyName,
+      this.newPolicyName,
+      lowerer,
+    );
+  }
+
+  renderTypeScript(): string {
+    return `renameRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.oldPolicyName)}, ${jsonToTsSource(this.newPolicyName)})`;
+  }
+}
+
 export type PostgresOpFactoryCall =
   | CreateTableCall
   | DropTableCall
@@ -1399,4 +1562,9 @@ export type PostgresOpFactoryCall =
   | RawSqlCall
   | CreateExtensionCall
   | CreateSchemaCall
+  | CreatePostgresRlsPolicyCall
+  | DropPostgresRlsPolicyCall
+  | EnableRowLevelSecurityCall
+  | DisableRowLevelSecurityCall
+  | RenamePostgresRlsPolicyCall
   | DataTransformCall;

package/src/core/migrations/operations/columns.ts

@@ -1,4 +1,6 @@
 import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
+import type { DdlColumn } from '@prisma-next/sql-relational-core/ast';
+import { ifDefined } from '@prisma-next/utils/defined';
 import {
   columnDefaultAst,
   columnExistsAst,
@@ -7,7 +9,9 @@ import {
   noNullValuesAst,
   tableIsEmptyAst,
 } from '../../../contract-free/checks';
+import * as contractFreeDdl from '../../../contract-free/ddl';
 import { quoteIdentifier } from '../../sql-utils';
+import { boundSchema } from '../bound-schema';
 import { qualifyTableName } from '../planner-sql-checks';
 import { type Op, step, targetDetails } from './shared';
 
@@ -242,12 +246,18 @@ export async function dropDefault(
   columnName: string,
   lowerer: ExecuteRequestLowerer,
 ): Promise<Op> {
-  const qualified = qualifyTableName(schemaName, tableName);
   const { present } = await columnExistsSteps(lowerer, {
     schema: schemaName,
     table: tableName,
     column: columnName,
   });
+  const dropDefaultExec = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schemaName)),
+      table: tableName,
+      actions: [contractFreeDdl.dropDefaultAction(columnName)],
+    }),
+  );
   const noDefault = await lowerer.lowerToExecuteRequest(
     columnDefaultAst({ schema: schemaName, table: tableName, column: columnName }).defaultAbsent(),
   );
@@ -257,12 +267,7 @@ export async function dropDefault(
     operationClass: 'destructive',
     target: targetDetails('column', columnName, schemaName, tableName),
     precheck: [step(`ensure column "${columnName}" exists`, present.sql, present.params)],
-    execute: [
-      step(
-        `drop default on "${columnName}"`,
-        `ALTER TABLE ${qualified} ALTER COLUMN ${quoteIdentifier(columnName)} DROP DEFAULT`,
-      ),
-    ],
+    execute: [step(`drop default on "${columnName}"`, dropDefaultExec.sql)],
     postcheck: [
       step(`verify column "${columnName}" has no default`, noDefault.sql, noDefault.params),
     ],
@@ -272,16 +277,23 @@ export async function dropDefault(
 /**
  * Builds the op for adding a NOT NULL column (no contract default) to a
  * non-empty table. Prechecks assert the column is absent and the table is
- * empty; the execute step is the raw ADD COLUMN SQL passed by the caller
- * (slice-7 deferred); postchecks assert the column exists and is NOT NULL.
+ * empty; the execute step lowers the typed `AddColumn` DDL node through the
+ * adapter; postchecks assert the column exists and is NOT NULL.
  */
 export async function addNotNullColumnDirect(
   schemaName: string,
   tableName: string,
-  columnName: string,
-  executeStepSql: string,
+  column: DdlColumn,
   lowerer: ExecuteRequestLowerer,
 ): Promise<Op> {
+  const columnName = column.name;
+  const addColumn = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schemaName)),
+      table: tableName,
+      actions: [contractFreeDdl.addColumnAction(column)],
+    }),
+  );
   const absent = await lowerer.lowerToExecuteRequest(
     columnExistsAst({ schema: schemaName, table: tableName, column: columnName }).columnAbsent(),
   );
@@ -311,7 +323,7 @@ export async function addNotNullColumnDirect(
         tableEmpty.params,
       ),
     ],
-    execute: [step(`add column "${columnName}"`, executeStepSql)],
+    execute: [step(`add column "${columnName}"`, addColumn.sql)],
     postcheck: [
       step(`verify column "${columnName}" exists`, present.sql, present.params),
       step(`verify column "${columnName}" is NOT NULL`, notNullable.sql, notNullable.params),

package/src/core/migrations/operations/constraints.ts

@@ -196,7 +196,7 @@ export async function dropCheckConstraint(
  * `kind` feeds the operation's `target.details.objectType`. Descriptor-flow
  * does not carry kind information in its drop-constraint descriptor, so the
  * default is `'unique'`. The reconciliation planner passes the correct kind
- * (`'foreignKey'`, `'primaryKey'`, or `'unique'`) based on the `SchemaIssue`
+ * (`'foreignKey'`, `'primaryKey'`, or `'unique'`) based on the diff issue
  * that produced the drop.
  */
 export async function dropConstraint(

package/src/core/migrations/operations/data-transform.ts

@@ -113,6 +113,12 @@ export async function dataTransform<TContract extends Contract<SqlStorage>>(
     runClosures.map((closure) => invokeAndLower(closure, contract, adapter, name)),
   );
 
+  // Raw remnant: the factory lowered the user's `check` plan above before
+  // we get a chance to wrap it, so the EXISTS lifting only has text by the
+  // time it runs. The fix is to rewrite the factory to defer lowering until
+  // after wrapping — so `cfExpr.exists(checkPlan.ast)` can produce the
+  // EXISTS query, then lower once at the boundary — not to grow new AST
+  // substrate. Out of scope for the slice that introduced this comment.
   const precheck: readonly SqlMigrationPlanOperationStep[] = checkPlan
     ? [
         {

package/src/core/migrations/operations/dependencies.ts

@@ -1,5 +1,6 @@
 import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
 import { extensionExistsAst } from '../../../contract-free/checks';
+import { DEFAULT_NAMESPACE_ID } from '../../namespace-ids';
 import { quoteIdentifier } from '../../sql-utils';
 import { type Op, step } from './shared';
 
@@ -55,7 +56,7 @@ export async function installExtension(
     invariantId,
     target: {
       id: 'postgres',
-      details: { schema: 'public', objectType: 'dependency', name: extensionName },
+      details: { schema: DEFAULT_NAMESPACE_ID, objectType: 'dependency', name: extensionName },
     },
     precheck: [
       step(`verify extension "${extensionName}" is not already enabled`, absent.sql, absent.params),

package/src/core/migrations/operations/rls.ts

@@ -0,0 +1,187 @@
+import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
+import { ifDefined } from '@prisma-next/utils/defined';
+import { rlsEnabledAst, rlsPolicyExistsAst } from '../../../contract-free/checks';
+import {
+  alterPolicyRename,
+  createPolicy,
+  disableRowLevelSecurity as disableRowLevelSecurityDdl,
+  dropPolicy,
+} from '../../../contract-free/ddl';
+import type { PostgresRlsPolicy } from '../../postgres-rls-policy';
+import { qualifyTableName } from '../planner-sql-checks';
+import { type Op, step, targetDetails } from './shared';
+
+const PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+
+function validateRoleName(role: string): string {
+  if (!PLAIN_IDENTIFIER.test(role)) {
+    throw new Error(
+      `Invalid role name ${JSON.stringify(role)}: role names must be plain SQL identifiers matching ^[A-Za-z_][A-Za-z0-9_$]*$`,
+    );
+  }
+  return role;
+}
+
+export async function createRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  policy: PostgresRlsPolicy,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const validatedRoles = policy.roles.map(validateRoleName);
+  const ddlNode = createPolicy({
+    schema: schemaName,
+    table: tableName,
+    name: policy.name,
+    permissive: policy.permissive,
+    operation: policy.operation,
+    roles: validatedRoles,
+    ...ifDefined('using', policy.using),
+    ...ifDefined('withCheck', policy.withCheck),
+  });
+  const checks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: policy.name,
+  });
+  const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${policy.name}`,
+    label: `Create RLS policy "${policy.name}" on "${tableName}"`,
+    operationClass: 'additive',
+    target: targetDetails('rlsPolicy', policy.name, schemaName, tableName),
+    precheck: [
+      step(`ensure RLS policy "${policy.name}" does not exist`, absent.sql, absent.params),
+    ],
+    execute: [step(`create RLS policy "${policy.name}"`, execute.sql, execute.params)],
+    postcheck: [step(`verify RLS policy "${policy.name}" exists`, present.sql, present.params)],
+  };
+}
+
+export async function dropRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  policyName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = dropPolicy({ schema: schemaName, table: tableName, name: policyName });
+  const checks = rlsPolicyExistsAst({ schema: schemaName, table: tableName, policyName });
+  const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${policyName}.drop`,
+    label: `Drop RLS policy "${policyName}" on "${tableName}"`,
+    operationClass: 'destructive',
+    target: targetDetails('rlsPolicy', policyName, schemaName, tableName),
+    precheck: [step(`ensure RLS policy "${policyName}" exists`, present.sql, present.params)],
+    execute: [step(`drop RLS policy "${policyName}"`, execute.sql, execute.params)],
+    postcheck: [step(`verify RLS policy "${policyName}" is absent`, absent.sql, absent.params)],
+  };
+}
+
+export async function enableRowLevelSecurity(
+  schemaName: string,
+  tableName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const checks = rlsEnabledAst(schemaName, tableName);
+  const disabled = await lowerer.lowerToExecuteRequest(checks.rlsDisabled());
+  const enabled = await lowerer.lowerToExecuteRequest(checks.rlsEnabled());
+  return {
+    id: `rowLevelSecurity.${schemaName}.${tableName}`,
+    label: `Enable row-level security on "${tableName}"`,
+    operationClass: 'additive',
+    target: targetDetails('rowLevelSecurity', tableName, schemaName),
+    precheck: [
+      step(`check RLS is not already enabled on "${tableName}"`, disabled.sql, disabled.params),
+    ],
+    execute: [
+      step(
+        `enable row-level security on "${tableName}"`,
+        `ALTER TABLE ${qualifyTableName(schemaName, tableName)} ENABLE ROW LEVEL SECURITY`,
+      ),
+    ],
+    postcheck: [
+      step(`verify row-level security is enabled on "${tableName}"`, enabled.sql, enabled.params),
+    ],
+  };
+}
+
+export async function disableRowLevelSecurity(
+  schemaName: string,
+  tableName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = disableRowLevelSecurityDdl({ schema: schemaName, table: tableName });
+  const checks = rlsEnabledAst(schemaName, tableName);
+  const enabled = await lowerer.lowerToExecuteRequest(checks.rlsEnabled());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const disabled = await lowerer.lowerToExecuteRequest(checks.rlsDisabled());
+  return {
+    id: `rowLevelSecurity.${schemaName}.${tableName}.disable`,
+    label: `Disable row-level security on "${tableName}"`,
+    operationClass: 'destructive',
+    target: targetDetails('rowLevelSecurity', tableName, schemaName),
+    precheck: [
+      step(`check RLS is currently enabled on "${tableName}"`, enabled.sql, enabled.params),
+    ],
+    execute: [step(`disable row-level security on "${tableName}"`, execute.sql, execute.params)],
+    postcheck: [
+      step(
+        `verify row-level security is disabled on "${tableName}"`,
+        disabled.sql,
+        disabled.params,
+      ),
+    ],
+  };
+}
+
+export async function renameRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  oldPolicyName: string,
+  newPolicyName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = alterPolicyRename({
+    schema: schemaName,
+    table: tableName,
+    name: oldPolicyName,
+    newName: newPolicyName,
+  });
+  const oldChecks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: oldPolicyName,
+  });
+  const newChecks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: newPolicyName,
+  });
+  const oldPresent = await lowerer.lowerToExecuteRequest(oldChecks.policyPresent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const newPresent = await lowerer.lowerToExecuteRequest(newChecks.policyPresent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${oldPolicyName}.rename`,
+    label: `Rename RLS policy "${oldPolicyName}" to "${newPolicyName}" on "${tableName}"`,
+    operationClass: 'widening',
+    target: targetDetails('rlsPolicy', newPolicyName, schemaName, tableName),
+    precheck: [
+      step(`ensure RLS policy "${oldPolicyName}" exists`, oldPresent.sql, oldPresent.params),
+    ],
+    execute: [
+      step(
+        `rename RLS policy "${oldPolicyName}" to "${newPolicyName}"`,
+        execute.sql,
+        execute.params,
+      ),
+    ],
+    postcheck: [
+      step(`verify RLS policy "${newPolicyName}" exists`, newPresent.sql, newPresent.params),
+    ],
+  };
+}

package/src/core/migrations/operations/shared.ts

@@ -1,30 +1,10 @@
 import type { SqlMigrationPlanOperation } from '@prisma-next/family-sql/control';
 import type { ReferentialAction } from '@prisma-next/sql-contract/types';
 import { ifDefined } from '@prisma-next/utils/defined';
-import { quoteIdentifier } from '../../sql-utils';
 import type { OperationClass, PostgresPlanTargetDetails } from '../planner-target-details';
 
 export type Op = SqlMigrationPlanOperation<PostgresPlanTargetDetails>;
 
-/**
- * Literal-args shape for a column definition consumed by `addColumn` and
- * similar operations. Fully materialized: codec expansion and default
- * rendering have already happened in the wrapper.
- *
- * - `typeSql` is the column's DDL type string (e.g. `"integer"`, `"SERIAL"`,
- *   `"varchar(100)"`), already produced by `buildColumnTypeSql` in the
- *   call-factory wrapper.
- * - `defaultSql` is the full `DEFAULT …` clause (e.g. `"DEFAULT 42"`) or an
- *   empty string when the column has no default, matching
- *   `buildColumnDefaultSql`'s output.
- */
-export interface ColumnSpec {
-  readonly name: string;
-  readonly typeSql: string;
-  readonly defaultSql: string;
-  readonly nullable: boolean;
-}
-
 /**
  * Literal-args shape for a foreign key definition. `references.schema`
  * carries the target table's namespace (schema) coordinate so the rendered
@@ -57,13 +37,3 @@ export function targetDetails(
     details: { schema, objectType, name, ...ifDefined('table', table) },
   };
 }
-
-export function renderColumnDefinition(column: ColumnSpec): string {
-  const parts = [
-    quoteIdentifier(column.name),
-    column.typeSql,
-    column.defaultSql,
-    column.nullable ? '' : 'NOT NULL',
-  ].filter(Boolean);
-  return parts.join(' ');
-}