@prisma-next/target-postgres 0.14.0-dev.7 → 0.14.0-dev.70

package/dist/{op-factory-call-D_p5vxwt.mjs → op-factory-call-WFZUHrbI.mjs}

@@ -1,14 +1,26 @@
-import { i as quoteIdentifier, n as escapeLiteral } from "./sql-utils-DcfMz4MQ.mjs";
-import { a as columnDefaultAst, c as columnTypeAst, d as indexExistsAst, f as noNullValuesAst, i as createTable, l as constraintExistsAst, m as tableIsEmptyAst, n as alterTable, o as columnExistsAst, p as tableExistsAst, r as createSchema, s as columnNullabilityAst, t as addColumnAction, u as extensionExistsAst } from "./ddl-QDyOSeLc.mjs";
-import { n as qualifyTableName } from "./planner-sql-checks-jqUUGyQR.mjs";
-import { t as buildAddColumnSql } from "./planner-ddl-builders-B2wOwLqI.mjs";
+import { t as DEFAULT_NAMESPACE_ID } from "./namespace-ids-xtp_ZY86.mjs";
+import { i as quoteIdentifier, n as escapeLiteral, o as validateEnumValueLength } from "./sql-utils-SU4FDvIV.mjs";
+import { C as tableIsEmptyAst, S as tableExistsAst, _ as extensionExistsAst, a as createSchema, b as rlsEnabledAst, c as disableRowLevelSecurity$1, d as dropType, f as columnDefaultAst, g as constraintExistsAst, h as columnTypeAst, i as createPolicy, l as dropDefaultAction, m as columnNullabilityAst, n as alterPolicyRename, o as createTable, p as columnExistsAst, r as alterTable, s as createType, t as addColumnAction, u as dropPolicy, v as indexExistsAst, x as rlsPolicyExistsAst, y as noNullValuesAst } from "./ddl-Dqgs-bDc.mjs";
+import { n as qualifyTableName } from "./planner-sql-checks-CxJ8W66T.mjs";
+import { n as buildColumnTypeSql } from "./planner-ddl-builders-BKlmGDJl.mjs";
 import { FunctionColumnDefault, LiteralColumnDefault } from "@prisma-next/sql-relational-core/ast";
+import { UNBOUND_NAMESPACE_ID } from "@prisma-next/framework-components/ir";
 import { blindCast } from "@prisma-next/utils/casts";
 import { ifDefined } from "@prisma-next/utils/defined";
-import { UNBOUND_NAMESPACE_ID } from "@prisma-next/framework-components/ir";
+import { col } from "@prisma-next/sql-relational-core/contract-free";
 import { errorUnfilledPlaceholder } from "@prisma-next/errors/migration";
 import { TsExpression, jsonToTsSource } from "@prisma-next/ts-render";
 import { REFERENTIAL_ACTION_SQL } from "@prisma-next/sql-contract/referential-action-sql";
+//#region src/core/migrations/bound-schema.ts
+/**
+* Maps a planner schema name to the contract-free DDL builder's optional
+* `schema` field: the unbound sentinel becomes `undefined` (the builder omits
+* the schema qualifier), every other name passes through.
+*/
+function boundSchema(schemaName) {
+	return schemaName === UNBOUND_NAMESPACE_ID ? void 0 : schemaName;
+}
+//#endregion
 //#region src/core/migrations/operations/shared.ts
 function step(description, sql, params) {
 	return {
@@ -171,12 +183,16 @@ async function setDefault(schemaName, tableName, columnName, defaultSql, lowerer
 	};
 }
 async function dropDefault(schemaName, tableName, columnName, lowerer) {
-	const qualified = qualifyTableName(schemaName, tableName);
 	const { present } = await columnExistsSteps(lowerer, {
 		schema: schemaName,
 		table: tableName,
 		column: columnName
 	});
+	const dropDefaultExec = await lowerer.lowerToExecuteRequest(alterTable({
+		...ifDefined("schema", boundSchema(schemaName)),
+		table: tableName,
+		actions: [dropDefaultAction(columnName)]
+	}));
 	const noDefault = await lowerer.lowerToExecuteRequest(columnDefaultAst({
 		schema: schemaName,
 		table: tableName,
@@ -188,17 +204,23 @@ async function dropDefault(schemaName, tableName, columnName, lowerer) {
 		operationClass: "destructive",
 		target: targetDetails("column", columnName, schemaName, tableName),
 		precheck: [step(`ensure column "${columnName}" exists`, present.sql, present.params)],
-		execute: [step(`drop default on "${columnName}"`, `ALTER TABLE ${qualified} ALTER COLUMN ${quoteIdentifier(columnName)} DROP DEFAULT`)],
+		execute: [step(`drop default on "${columnName}"`, dropDefaultExec.sql)],
 		postcheck: [step(`verify column "${columnName}" has no default`, noDefault.sql, noDefault.params)]
 	};
 }
 /**
 * Builds the op for adding a NOT NULL column (no contract default) to a
 * non-empty table. Prechecks assert the column is absent and the table is
-* empty; the execute step is the raw ADD COLUMN SQL passed by the caller
-* (slice-7 deferred); postchecks assert the column exists and is NOT NULL.
+* empty; the execute step lowers the typed `AddColumn` DDL node through the
+* adapter; postchecks assert the column exists and is NOT NULL.
 */
-async function addNotNullColumnDirect(schemaName, tableName, columnName, executeStepSql, lowerer) {
+async function addNotNullColumnDirect(schemaName, tableName, column, lowerer) {
+	const columnName = column.name;
+	const addColumn = await lowerer.lowerToExecuteRequest(alterTable({
+		...ifDefined("schema", boundSchema(schemaName)),
+		table: tableName,
+		actions: [addColumnAction(column)]
+	}));
 	const absent = await lowerer.lowerToExecuteRequest(columnExistsAst({
 		schema: schemaName,
 		table: tableName,
@@ -223,7 +245,7 @@ async function addNotNullColumnDirect(schemaName, tableName, columnName, execute
 		operationClass: "additive",
 		target: targetDetails("column", columnName, schemaName, tableName),
 		precheck: [step(`ensure column "${columnName}" is missing`, absent.sql, absent.params), step(`ensure table "${tableName}" is empty before adding NOT NULL column without default`, tableEmpty.sql, tableEmpty.params)],
-		execute: [step(`add column "${columnName}"`, executeStepSql)],
+		execute: [step(`add column "${columnName}"`, addColumn.sql)],
 		postcheck: [step(`verify column "${columnName}" exists`, present.sql, present.params), step(`verify column "${columnName}" is NOT NULL`, notNullable.sql, notNullable.params)]
 	};
 }
@@ -344,7 +366,7 @@ async function dropCheckConstraint(schemaName, tableName, constraintName, lowere
 * `kind` feeds the operation's `target.details.objectType`. Descriptor-flow
 * does not carry kind information in its drop-constraint descriptor, so the
 * default is `'unique'`. The reconciliation planner passes the correct kind
-* (`'foreignKey'`, `'primaryKey'`, or `'unique'`) based on the `SchemaIssue`
+* (`'foreignKey'`, `'primaryKey'`, or `'unique'`) based on the diff issue
 * that produced the drop.
 */
 async function dropConstraint(schemaName, tableName, constraintName, lowerer, kind = "unique") {
@@ -405,7 +427,7 @@ async function installExtension(options, lowerer) {
 		target: {
 			id: "postgres",
 			details: {
-				schema: "public",
+				schema: DEFAULT_NAMESPACE_ID,
 				objectType: "dependency",
 				name: extensionName
 			}
@@ -463,6 +485,175 @@ async function dropIndex(schemaName, tableName, indexName, lowerer) {
 	};
 }
 //#endregion
+//#region src/core/migrations/operations/native-enum-types.ts
+/**
+* `CREATE TYPE <qualified> AS ENUM (…)` for a managed native enum, built as a
+* typed DDL node and lowered by the control adapter (the type name is quoted,
+* member values render as escaped string literals in declaration order —
+* Postgres enum sort order is semantic). `boundSchema` maps the unbound sentinel
+* to an absent schema so the type name renders unqualified and the connection's
+* `search_path` resolves the schema at runtime.
+*/
+async function createNativeEnumType(schemaName, typeName, members, lowerer) {
+	for (const member of members) validateEnumValueLength(member, typeName);
+	const ddlNode = createType({
+		...ifDefined("schema", boundSchema(schemaName)),
+		name: typeName,
+		values: members
+	});
+	const statement = await lowerer.lowerToExecuteRequest(ddlNode);
+	return {
+		id: `createNativeEnumType.${typeName}`,
+		label: `Create enum type "${typeName}"`,
+		operationClass: "additive",
+		target: targetDetails("type", typeName, schemaName),
+		precheck: [],
+		execute: [step(`create enum type "${typeName}"`, statement.sql, statement.params)],
+		postcheck: []
+	};
+}
+/** `DROP TYPE <qualified>` for an unclaimed managed native enum, via typed DDL. */
+async function dropNativeEnumType(schemaName, typeName, lowerer) {
+	const ddlNode = dropType({
+		...ifDefined("schema", boundSchema(schemaName)),
+		name: typeName
+	});
+	const statement = await lowerer.lowerToExecuteRequest(ddlNode);
+	return {
+		id: `dropNativeEnumType.${typeName}`,
+		label: `Drop enum type "${typeName}"`,
+		operationClass: "destructive",
+		target: targetDetails("type", typeName, schemaName),
+		precheck: [],
+		execute: [step(`drop enum type "${typeName}"`, statement.sql, statement.params)],
+		postcheck: []
+	};
+}
+//#endregion
+//#region src/core/migrations/operations/rls.ts
+const PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+function validateRoleName(role) {
+	if (!PLAIN_IDENTIFIER.test(role)) throw new Error(`Invalid role name ${JSON.stringify(role)}: role names must be plain SQL identifiers matching ^[A-Za-z_][A-Za-z0-9_$]*$`);
+	return role;
+}
+async function createRlsPolicy(schemaName, tableName, policy, lowerer) {
+	const validatedRoles = policy.roles.map(validateRoleName);
+	const ddlNode = createPolicy({
+		schema: schemaName,
+		table: tableName,
+		name: policy.name,
+		permissive: policy.permissive,
+		operation: policy.operation,
+		roles: validatedRoles,
+		...ifDefined("using", policy.using),
+		...ifDefined("withCheck", policy.withCheck)
+	});
+	const checks = rlsPolicyExistsAst({
+		schema: schemaName,
+		table: tableName,
+		policyName: policy.name
+	});
+	const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+	const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+	const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+	return {
+		id: `rlsPolicy.${schemaName}.${tableName}.${policy.name}`,
+		label: `Create RLS policy "${policy.name}" on "${tableName}"`,
+		operationClass: "additive",
+		target: targetDetails("rlsPolicy", policy.name, schemaName, tableName),
+		precheck: [step(`ensure RLS policy "${policy.name}" does not exist`, absent.sql, absent.params)],
+		execute: [step(`create RLS policy "${policy.name}"`, execute.sql, execute.params)],
+		postcheck: [step(`verify RLS policy "${policy.name}" exists`, present.sql, present.params)]
+	};
+}
+async function dropRlsPolicy(schemaName, tableName, policyName, lowerer) {
+	const ddlNode = dropPolicy({
+		schema: schemaName,
+		table: tableName,
+		name: policyName
+	});
+	const checks = rlsPolicyExistsAst({
+		schema: schemaName,
+		table: tableName,
+		policyName
+	});
+	const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+	const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+	const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+	return {
+		id: `rlsPolicy.${schemaName}.${tableName}.${policyName}.drop`,
+		label: `Drop RLS policy "${policyName}" on "${tableName}"`,
+		operationClass: "destructive",
+		target: targetDetails("rlsPolicy", policyName, schemaName, tableName),
+		precheck: [step(`ensure RLS policy "${policyName}" exists`, present.sql, present.params)],
+		execute: [step(`drop RLS policy "${policyName}"`, execute.sql, execute.params)],
+		postcheck: [step(`verify RLS policy "${policyName}" is absent`, absent.sql, absent.params)]
+	};
+}
+async function enableRowLevelSecurity(schemaName, tableName, lowerer) {
+	const checks = rlsEnabledAst(schemaName, tableName);
+	const disabled = await lowerer.lowerToExecuteRequest(checks.rlsDisabled());
+	const enabled = await lowerer.lowerToExecuteRequest(checks.rlsEnabled());
+	return {
+		id: `rowLevelSecurity.${schemaName}.${tableName}`,
+		label: `Enable row-level security on "${tableName}"`,
+		operationClass: "additive",
+		target: targetDetails("rowLevelSecurity", tableName, schemaName),
+		precheck: [step(`check RLS is not already enabled on "${tableName}"`, disabled.sql, disabled.params)],
+		execute: [step(`enable row-level security on "${tableName}"`, `ALTER TABLE ${qualifyTableName(schemaName, tableName)} ENABLE ROW LEVEL SECURITY`)],
+		postcheck: [step(`verify row-level security is enabled on "${tableName}"`, enabled.sql, enabled.params)]
+	};
+}
+async function disableRowLevelSecurity(schemaName, tableName, lowerer) {
+	const ddlNode = disableRowLevelSecurity$1({
+		schema: schemaName,
+		table: tableName
+	});
+	const checks = rlsEnabledAst(schemaName, tableName);
+	const enabled = await lowerer.lowerToExecuteRequest(checks.rlsEnabled());
+	const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+	const disabled = await lowerer.lowerToExecuteRequest(checks.rlsDisabled());
+	return {
+		id: `rowLevelSecurity.${schemaName}.${tableName}.disable`,
+		label: `Disable row-level security on "${tableName}"`,
+		operationClass: "destructive",
+		target: targetDetails("rowLevelSecurity", tableName, schemaName),
+		precheck: [step(`check RLS is currently enabled on "${tableName}"`, enabled.sql, enabled.params)],
+		execute: [step(`disable row-level security on "${tableName}"`, execute.sql, execute.params)],
+		postcheck: [step(`verify row-level security is disabled on "${tableName}"`, disabled.sql, disabled.params)]
+	};
+}
+async function renameRlsPolicy(schemaName, tableName, oldPolicyName, newPolicyName, lowerer) {
+	const ddlNode = alterPolicyRename({
+		schema: schemaName,
+		table: tableName,
+		name: oldPolicyName,
+		newName: newPolicyName
+	});
+	const oldChecks = rlsPolicyExistsAst({
+		schema: schemaName,
+		table: tableName,
+		policyName: oldPolicyName
+	});
+	const newChecks = rlsPolicyExistsAst({
+		schema: schemaName,
+		table: tableName,
+		policyName: newPolicyName
+	});
+	const oldPresent = await lowerer.lowerToExecuteRequest(oldChecks.policyPresent());
+	const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+	const newPresent = await lowerer.lowerToExecuteRequest(newChecks.policyPresent());
+	return {
+		id: `rlsPolicy.${schemaName}.${tableName}.${oldPolicyName}.rename`,
+		label: `Rename RLS policy "${oldPolicyName}" to "${newPolicyName}" on "${tableName}"`,
+		operationClass: "widening",
+		target: targetDetails("rlsPolicy", newPolicyName, schemaName, tableName),
+		precheck: [step(`ensure RLS policy "${oldPolicyName}" exists`, oldPresent.sql, oldPresent.params)],
+		execute: [step(`rename RLS policy "${oldPolicyName}" to "${newPolicyName}"`, execute.sql, execute.params)],
+		postcheck: [step(`verify RLS policy "${newPolicyName}" exists`, newPresent.sql, newPresent.params)]
+	};
+}
+//#endregion
 //#region src/core/migrations/operations/tables.ts
 async function dropTable(schemaName, tableName, lowerer) {
 	const qualified = qualifyTableName(schemaName, tableName);
@@ -504,7 +695,20 @@ function buildAddColumnOperationIdentity(schema, tableName, columnName) {
 }
 async function buildAddNotNullColumnWithTemporaryDefaultOperation(options) {
 	const { schema, tableName, columnName, column, codecHooks, storageTypes, temporaryDefault, lowerer } = options;
-	const qualified = qualifyTableName(schema, tableName);
+	const ddlColumn = col(columnName, buildColumnTypeSql(column, codecHooks, storageTypes), {
+		notNull: true,
+		default: new FunctionColumnDefault(temporaryDefault)
+	});
+	const addColumn = await lowerer.lowerToExecuteRequest(alterTable({
+		...ifDefined("schema", boundSchema(schema)),
+		table: tableName,
+		actions: [addColumnAction(ddlColumn)]
+	}));
+	const dropTempDefault = await lowerer.lowerToExecuteRequest(alterTable({
+		...ifDefined("schema", boundSchema(schema)),
+		table: tableName,
+		actions: [dropDefaultAction(columnName)]
+	}));
 	const absent = await lowerer.lowerToExecuteRequest(columnExistsAst({
 		schema,
 		table: tableName,
@@ -532,10 +736,10 @@ async function buildAddNotNullColumnWithTemporaryDefaultOperation(options) {
 		precheck: [step(`ensure column "${columnName}" is missing`, absent.sql, absent.params)],
 		execute: [{
 			description: `add column "${columnName}"`,
-			sql: buildAddColumnSql(qualified, columnName, column, codecHooks, temporaryDefault, storageTypes)
+			sql: addColumn.sql
 		}, {
 			description: `drop temporary default from column "${columnName}"`,
-			sql: `ALTER TABLE ${qualified} ALTER COLUMN ${quoteIdentifier(columnName)} DROP DEFAULT`
+			sql: dropTempDefault.sql
 		}],
 		postcheck: [
 			step(`verify column "${columnName}" exists`, present.sql, present.params),
@@ -568,9 +772,6 @@ async function buildAddNotNullColumnWithTemporaryDefaultOperation(options) {
 * `PostgresOpFactoryCall` union.
 */
 const POSTGRES_MIGRATION_FACADE = "@prisma-next/postgres/migration";
-function boundSchema(schemaName) {
-	return schemaName === UNBOUND_NAMESPACE_ID ? void 0 : schemaName;
-}
 var PostgresOpFactoryCallNode = class extends TsExpression {
 	importRequirements() {
 		return [{
@@ -625,6 +826,7 @@ function renderDdlConstraintAsTsCall(constraint) {
 			const nameOpt = constraint.name ? `, { name: ${jsonToTsSource(constraint.name)} }` : "";
 			return `unique(${jsonToTsSource(constraint.columns)}${nameOpt})`;
 		}
+		case "check-expression": return `checkExpression(${jsonToTsSource(constraint.name)}, ${jsonToTsSource(constraint.expression)})`;
 	}
 }
 function needsColOrConstraintImport(columns) {
@@ -636,6 +838,7 @@ function constraintImportSymbols(constraints) {
 	for (const c of constraints) if (c.kind === "primary-key") symbols.add("primaryKey");
 	else if (c.kind === "foreign-key") symbols.add("foreignKey");
 	else if (c.kind === "unique") symbols.add("unique");
+	else if (c.kind === "check-expression") symbols.add("checkExpression");
 	return [...symbols];
 }
 function defaultImportSymbols(columns) {
@@ -998,10 +1201,8 @@ var DropDefaultCall = class extends PostgresOpFactoryCallNode {
 };
 /**
 * Planner-internal call for adding a NOT NULL column (no contract default) to
-* a table that must be empty at migration time. Carries the raw ADD COLUMN SQL
-* (produced by `buildAddColumnSql` at plan time — deferred from slice-7 typed
-* DDL) plus the parameters needed to lower the typed pre/postchecks at render
-* time.
+* a table that must be empty at migration time. Carries the typed `DdlColumn`
+* and lowers it to an ADD COLUMN execute step via the adapter at `toOp` time.
 *
 * No authored `PostgresMigration` method: this call is only emitted by the
 * planner, never hand-written by migration authors.
@@ -1012,20 +1213,20 @@ var AddNotNullColumnDirectCall = class extends PostgresOpFactoryCallNode {
 	schemaName;
 	tableName;
 	columnName;
-	executeStepSql;
+	column;
 	label;
-	constructor(schemaName, tableName, columnName, executeStepSql) {
+	constructor(schemaName, tableName, columnName, column) {
 		super();
 		this.schemaName = schemaName;
 		this.tableName = tableName;
 		this.columnName = columnName;
-		this.executeStepSql = executeStepSql;
+		this.column = column;
 		this.label = `Add column ${columnName} to ${tableName}`;
 		this.freeze();
 	}
 	async toOp(lowerer) {
 		if (lowerer === void 0) throw new Error(`AddNotNullColumnDirectCall.toOp: a lowerer is required on the Postgres planner path (column "${this.columnName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`);
-		return addNotNullColumnDirect(this.schemaName, this.tableName, this.columnName, this.executeStepSql, lowerer);
+		return addNotNullColumnDirect(this.schemaName, this.tableName, this.column, lowerer);
 	}
 	renderTypeScript() {
 		return `rawSql(${jsonToTsSource({
@@ -1041,9 +1242,9 @@ var AddNotNullColumnDirectCall = class extends PostgresOpFactoryCallNode {
 /**
 * Planner-internal call for adding a NOT NULL column (no contract default)
 * using a temporary default value for non-empty tables. Carries all parameters
-* needed for `buildAddNotNullColumnWithTemporaryDefaultOperation`; the typed
-* pre/postchecks are lowered at render time via `toOp(lowerer)`. The execute
-* SQL (`buildAddColumnSql`) is still raw per slice-7 deferral.
+* needed for `buildAddNotNullColumnWithTemporaryDefaultOperation`; both the
+* typed ADD COLUMN execute step and the pre/postchecks are lowered via the
+* adapter at `toOp` time.
 *
 * No authored `PostgresMigration` method: this call is only emitted by the
 * planner, never hand-written by migration authors.
@@ -1440,6 +1641,60 @@ var CreateSchemaCall = class extends PostgresOpFactoryCallNode {
 		return [];
 	}
 };
+var CreateNativeEnumTypeCall = class extends PostgresOpFactoryCallNode {
+	factoryName = "createNativeEnumType";
+	operationClass = "additive";
+	schemaName;
+	typeName;
+	members;
+	label;
+	constructor(schemaName, typeName, members) {
+		super();
+		this.schemaName = schemaName;
+		this.typeName = typeName;
+		this.members = Object.freeze([...members]);
+		this.label = `Create enum type "${typeName}"`;
+		this.freeze();
+	}
+	async toOp(lowerer) {
+		if (lowerer === void 0) throw new Error(`CreateNativeEnumTypeCall.toOp: a DDL lowerer is required on the Postgres planner path (type "${this.typeName}"). Pass the control adapter to createPostgresMigrationPlanner.`);
+		return createNativeEnumType(this.schemaName, this.typeName, this.members, lowerer);
+	}
+	renderTypeScript() {
+		return `this.createNativeEnumType({ ${[
+			`schema: ${jsonToTsSource(this.schemaName)}`,
+			`typeName: ${jsonToTsSource(this.typeName)}`,
+			`members: ${jsonToTsSource(this.members)}`
+		].join(", ")} })`;
+	}
+	importRequirements() {
+		return [];
+	}
+};
+var DropNativeEnumTypeCall = class extends PostgresOpFactoryCallNode {
+	factoryName = "dropNativeEnumType";
+	operationClass = "destructive";
+	schemaName;
+	typeName;
+	label;
+	constructor(schemaName, typeName) {
+		super();
+		this.schemaName = schemaName;
+		this.typeName = typeName;
+		this.label = `Drop enum type "${typeName}"`;
+		this.freeze();
+	}
+	async toOp(lowerer) {
+		if (lowerer === void 0) throw new Error(`DropNativeEnumTypeCall.toOp: a DDL lowerer is required on the Postgres planner path (type "${this.typeName}"). Pass the control adapter to createPostgresMigrationPlanner.`);
+		return dropNativeEnumType(this.schemaName, this.typeName, lowerer);
+	}
+	renderTypeScript() {
+		return `this.dropNativeEnumType({ ${[`schema: ${jsonToTsSource(this.schemaName)}`, `typeName: ${jsonToTsSource(this.typeName)}`].join(", ")} })`;
+	}
+	importRequirements() {
+		return [];
+	}
+};
 /**
 * A planner-generated data-transform stub. `checkSlot` and `runSlot` name
 * the unfilled authoring slots that the rendered `migration.ts` will expose
@@ -1484,7 +1739,120 @@ var DataTransformCall = class extends PostgresOpFactoryCallNode {
 		}];
 	}
 };
+var CreatePostgresRlsPolicyCall = class extends PostgresOpFactoryCallNode {
+	factoryName = "createRlsPolicy";
+	operationClass = "additive";
+	schemaName;
+	tableName;
+	policy;
+	label;
+	constructor(schemaName, tableName, policy) {
+		super();
+		this.schemaName = schemaName;
+		this.tableName = tableName;
+		this.policy = policy;
+		this.label = `Create RLS policy "${policy.name}" on "${tableName}"`;
+		this.freeze();
+	}
+	async toOp(lowerer) {
+		if (lowerer === void 0) throw new Error(`CreatePostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policy.name}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`);
+		return createRlsPolicy(this.schemaName, this.tableName, this.policy, lowerer);
+	}
+	renderTypeScript() {
+		return `createRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policy)})`;
+	}
+};
+var DropPostgresRlsPolicyCall = class extends PostgresOpFactoryCallNode {
+	factoryName = "dropRlsPolicy";
+	operationClass = "destructive";
+	schemaName;
+	tableName;
+	policyName;
+	label;
+	constructor(schemaName, tableName, policyName) {
+		super();
+		this.schemaName = schemaName;
+		this.tableName = tableName;
+		this.policyName = policyName;
+		this.label = `Drop RLS policy "${policyName}" on "${tableName}"`;
+		this.freeze();
+	}
+	async toOp(lowerer) {
+		if (lowerer === void 0) throw new Error(`DropPostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.policyName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`);
+		return dropRlsPolicy(this.schemaName, this.tableName, this.policyName, lowerer);
+	}
+	renderTypeScript() {
+		return `dropRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.policyName)})`;
+	}
+};
+var EnableRowLevelSecurityCall = class extends PostgresOpFactoryCallNode {
+	factoryName = "enableRowLevelSecurity";
+	operationClass = "additive";
+	schemaName;
+	tableName;
+	label;
+	constructor(schemaName, tableName) {
+		super();
+		this.schemaName = schemaName;
+		this.tableName = tableName;
+		this.label = `Enable row-level security on "${tableName}"`;
+		this.freeze();
+	}
+	async toOp(lowerer) {
+		if (lowerer === void 0) throw new Error(`EnableRowLevelSecurityCall.toOp: a lowerer is required on the Postgres planner path (table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`);
+		return enableRowLevelSecurity(this.schemaName, this.tableName, lowerer);
+	}
+	renderTypeScript() {
+		return `enableRowLevelSecurity(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)})`;
+	}
+};
+var DisableRowLevelSecurityCall = class extends PostgresOpFactoryCallNode {
+	factoryName = "disableRowLevelSecurity";
+	operationClass = "destructive";
+	schemaName;
+	tableName;
+	label;
+	constructor(schemaName, tableName) {
+		super();
+		this.schemaName = schemaName;
+		this.tableName = tableName;
+		this.label = `Disable row-level security on "${tableName}"`;
+		this.freeze();
+	}
+	async toOp(lowerer) {
+		if (lowerer === void 0) throw new Error(`DisableRowLevelSecurityCall.toOp: a lowerer is required on the Postgres planner path (table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`);
+		return disableRowLevelSecurity(this.schemaName, this.tableName, lowerer);
+	}
+	renderTypeScript() {
+		return `disableRowLevelSecurity(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)})`;
+	}
+};
+var RenamePostgresRlsPolicyCall = class extends PostgresOpFactoryCallNode {
+	factoryName = "renameRlsPolicy";
+	operationClass = "widening";
+	schemaName;
+	tableName;
+	oldPolicyName;
+	newPolicyName;
+	label;
+	constructor(schemaName, tableName, oldPolicyName, newPolicyName) {
+		super();
+		this.schemaName = schemaName;
+		this.tableName = tableName;
+		this.oldPolicyName = oldPolicyName;
+		this.newPolicyName = newPolicyName;
+		this.label = `Rename RLS policy "${oldPolicyName}" to "${newPolicyName}" on "${tableName}"`;
+		this.freeze();
+	}
+	async toOp(lowerer) {
+		if (lowerer === void 0) throw new Error(`RenamePostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.oldPolicyName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`);
+		return renameRlsPolicy(this.schemaName, this.tableName, this.oldPolicyName, this.newPolicyName, lowerer);
+	}
+	renderTypeScript() {
+		return `renameRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.oldPolicyName)}, ${jsonToTsSource(this.newPolicyName)})`;
+	}
+};
 //#endregion
-export { SetNotNullCall as C, installExtension as D, createExtension as E, SetDefaultCall as S, buildTargetDetails as T, DropDefaultCall as _, AddNotNullColumnWithTempDefaultCall as a, DropTableCall as b, AlterColumnTypeCall as c, CreateSchemaCall as d, CreateTableCall as f, DropConstraintCall as g, DropColumnCall as h, AddNotNullColumnDirectCall as i, CreateExtensionCall as l, DropCheckConstraintCall as m, AddColumnCall as n, AddPrimaryKeyCall as o, DataTransformCall as p, AddForeignKeyCall as r, AddUniqueCall as s, AddCheckConstraintCall as t, CreateIndexCall as u, DropIndexCall as v, postgresDefaultToDdlColumnDefault as w, RawSqlCall as x, DropNotNullCall as y };
+export { SetNotNullCall as A, DropNotNullCall as C, RawSqlCall as D, EnableRowLevelSecurityCall as E, buildTargetDetails as M, createExtension as N, RenamePostgresRlsPolicyCall as O, installExtension as P, DropNativeEnumTypeCall as S, DropTableCall as T, DropCheckConstraintCall as _, AddNotNullColumnWithTempDefaultCall as a, DropDefaultCall as b, AlterColumnTypeCall as c, CreateNativeEnumTypeCall as d, CreatePostgresRlsPolicyCall as f, DisableRowLevelSecurityCall as g, DataTransformCall as h, AddNotNullColumnDirectCall as i, postgresDefaultToDdlColumnDefault as j, SetDefaultCall as k, CreateExtensionCall as l, CreateTableCall as m, AddColumnCall as n, AddPrimaryKeyCall as o, CreateSchemaCall as p, AddForeignKeyCall as r, AddUniqueCall as s, AddCheckConstraintCall as t, CreateIndexCall as u, DropColumnCall as v, DropPostgresRlsPolicyCall as w, DropIndexCall as x, DropConstraintCall as y };
 
-//# sourceMappingURL=op-factory-call-D_p5vxwt.mjs.map
+//# sourceMappingURL=op-factory-call-WFZUHrbI.mjs.map