@prisma-next/target-postgres 0.14.0-dev.8 → 0.14.0-dev.80

package/src/core/codecs.ts

@@ -4,7 +4,7 @@
  * Each codec ships as three artifacts:
  *
  * 1. A `PgXCodec` class extending {@link CodecImpl} that wraps the module-level encode/decode/encodeJson/decodeJson constants exported from `codec-helpers.ts` (the single source of truth for non-trivial runtime conversions; trivial identity passthroughs are inlined). 2. A `PgXDescriptor` class extending {@link CodecDescriptorImpl} declaring the codec id, traits, target types, params schema, meta, and (where applicable)
- * the emit-path `renderOutputType`. 3. A per-codec column helper (`pgXColumn`) that calls `descriptor.factory(...)` directly and packages the result into a {@link ColumnSpec} via the framework {@link column} packager. The helper is tied to its descriptor with `satisfies ColumnHelperFor` (and `ColumnHelperForStrict` where the resolved codec type is well-defined).
+ * the emit-path `renderOutputType`. 3. A per-codec column helper (`pgXColumn`) that calls `descriptor.factory(...)` directly and packages the result into a framework `ColumnSpec` via the framework {@link column} packager. The helper is tied to its descriptor with `satisfies ColumnHelperFor` (and `ColumnHelperForStrict` where the resolved codec type is well-defined).
  *
  * After TML-2357 this is the canonical source of Postgres codec metadata and runtime behaviour — the legacy `mkCodec` / `defineCodec` carriers (and the parallel `byScalar`/`codecDescriptorDefinitions`/ `codecDescriptorList` collection exports) retired with the deletion sweep.
  *
@@ -19,11 +19,14 @@ import {
   CodecDescriptorImpl,
   CodecImpl,
   type CodecInstanceContext,
+  type CodecMeta,
   type ColumnHelperFor,
   type ColumnHelperForStrict,
   column,
+  renderTsLiteral,
   voidParamsSchema,
 } from '@prisma-next/framework-components/codec';
+import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
 import {
   SqlCharCodec,
   SqlFloatCodec,
@@ -40,6 +43,8 @@ import { blindCast } from '@prisma-next/utils/casts';
 import type { StandardSchemaV1 } from '@standard-schema/spec';
 import { type as arktype } from 'arktype';
 import {
+  pgByteaDecodeJson,
+  pgByteaEncodeJson,
   pgIntervalDecode,
   pgJsonbDecode,
   pgJsonbEncode,
@@ -59,6 +64,7 @@ import {
   PG_BOOL_CODEC_ID,
   PG_BYTEA_CODEC_ID,
   PG_CHAR_CODEC_ID,
+  PG_ENUM_CODEC_ID,
   PG_FLOAT_CODEC_ID,
   PG_FLOAT4_CODEC_ID,
   PG_FLOAT8_CODEC_ID,
@@ -80,6 +86,8 @@ import {
   PG_VARBIT_CODEC_ID,
   PG_VARCHAR_CODEC_ID,
 } from './codec-ids';
+import { DEFAULT_NAMESPACE_ID } from './namespace-ids';
+import { PostgresNativeEnum } from './postgres-native-enum';
 
 type LengthParams = { readonly length?: number };
 type PrecisionParams = { readonly precision?: number };
@@ -148,6 +156,9 @@ export class PgTextDescriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['text'] as const;
   override readonly meta = PG_TEXT_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgTextCodec {
     return () => new PgTextCodec(this);
   }
@@ -161,6 +172,145 @@ export const pgTextColumn = () =>
 pgTextColumn satisfies ColumnHelperFor<PgTextDescriptor>;
 pgTextColumn satisfies ColumnHelperForStrict<PgTextDescriptor>;
 
+/**
+ * Codec for a `pg.enum(Ref)` column bound to a native Postgres enum type.
+ * Text passthrough, identical to `pg/text@1` — encode/decode do not carry the
+ * enum's member values; membership is enforced by the native type itself, not
+ * by this codec. `renderValueLiteral` renders a member value as its TS
+ * literal, which is what drives the column's typed value-union (via
+ * `renderValueSetType` reading the column's `valueSet` ref) — the codec
+ * itself carries no params of its own; typing comes entirely from the
+ * column's value-set, not from `pg/enum@1`.
+ *
+ * A distinct codec id (rather than reusing `pg/text@1` on a plain text
+ * column) keeps native-enum columns independently identifiable — from a
+ * column's `codecId` alone, without also inspecting `nativeType` — which
+ * the managed (DDL) phase needs to target `CREATE TYPE`/`ALTER TYPE`
+ * operations at exactly the columns that use one.
+ */
+export class PgEnumCodec extends CodecImpl<
+  typeof PG_ENUM_CODEC_ID,
+  readonly ['equality', 'order', 'textual'],
+  string,
+  string
+> {
+  async encode(value: string, _ctx: CodecCallContext): Promise<string> {
+    return value;
+  }
+  async decode(wire: string, _ctx: CodecCallContext): Promise<string> {
+    return wire;
+  }
+  encodeJson(value: string): JsonValue {
+    return value;
+  }
+  decodeJson(json: JsonValue): string {
+    return blindCast<
+      string,
+      'text codec: a native-enum member value is stored as its wire string form'
+    >(json);
+  }
+}
+
+type PgEnumParams = { readonly typeName: string };
+
+const pgEnumParamsSchema = arktype({
+  typeName: 'string',
+}) satisfies StandardSchemaV1<PgEnumParams>;
+
+function isJsonObject(
+  value: JsonValue | undefined,
+): value is { readonly [key: string]: JsonValue } {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+export class PgEnumDescriptor extends CodecDescriptorImpl<PgEnumParams> {
+  override readonly codecId = PG_ENUM_CODEC_ID;
+  override readonly traits = ['equality', 'order', 'textual'] as const;
+  override readonly targetTypes = ['text'] as const;
+  override readonly meta = PG_TEXT_META;
+  override readonly paramsSchema = pgEnumParamsSchema satisfies StandardSchemaV1<PgEnumParams>;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
+  override metaFor(typeParams: JsonValue | undefined): CodecMeta | undefined {
+    if (!isJsonObject(typeParams)) return this.meta;
+    const typeName = typeParams['typeName'];
+    return typeof typeName === 'string'
+      ? { db: { sql: { postgres: { nativeType: typeName } } } }
+      : this.meta;
+  }
+  override factory(_params: PgEnumParams): (ctx: CodecInstanceContext) => PgEnumCodec {
+    return () => new PgEnumCodec(this);
+  }
+
+  /**
+   * Authoring-time hook a `pg.enum(<ref>)` type constructor calls once it has
+   * resolved its ref argument to the referenced `native_enum` entity:
+   * produces this codec's per-column `typeParams` and native type from the
+   * entity's bare type name. Schema-qualification (`auth.aal_level` for a
+   * named non-default schema) is not this hook's concern — the field's
+   * namespace isn't known at this call site for every authoring path (the TS
+   * builder resolves a column before it knows its model's namespace), so it is
+   * applied later, at contract construction, by {@link qualifyNativeType} via
+   * the target's `authoring.qualifyColumnType` hook. `nativeType` mirrors
+   * `typeParams.typeName` — the same value {@link metaFor} derives at render
+   * time — so the column's declared native type and the render-time cast
+   * agree. Returns `undefined` if `entity` is not a `PostgresNativeEnum` (a
+   * contributor bug, not a user-schema error — the caller decides how to
+   * report it).
+   */
+  columnFromEntity(
+    entity: object,
+  ): { readonly typeParams: PgEnumParams; readonly nativeType: string } | undefined {
+    if (!PostgresNativeEnum.is(entity)) return undefined;
+    return { typeParams: { typeName: entity.typeName }, nativeType: entity.typeName };
+  }
+
+  /**
+   * Schema-qualifies this native enum type's name for the namespace the
+   * consuming column lives in: `${namespaceId}.${typeName}` for a named
+   * non-default schema, bare for the target's default schema (`public`) or
+   * the late-bound unbound sentinel (whose schema `search_path` resolves at
+   * runtime). Postgres's `format_type()` reports the bare name for a
+   * public-schema type, so a public column's declared native type must stay
+   * bare to match. Owned here because the codec owns its native type.
+   */
+  qualifyNativeType(typeName: string, namespaceId: string): string {
+    return namespaceId === DEFAULT_NAMESPACE_ID || namespaceId === UNBOUND_NAMESPACE_ID
+      ? typeName
+      : `${namespaceId}.${typeName}`;
+  }
+}
+
+export const pgEnumDescriptor = new PgEnumDescriptor();
+
+/**
+ * Contract-construction-time column-type qualifier the Postgres target
+ * contributes through `authoring.qualifyColumnType`.
+ * `buildSqlContractFromDefinition` calls this for every column as it is
+ * constructed, passing the column's bare type info and its owning
+ * `namespaceId`; a native-enum column (`pg/enum@1`) gets its type name
+ * schema-qualified for that namespace (via
+ * {@link PgEnumDescriptor.qualifyNativeType}), keeping `nativeType` and
+ * `typeParams.typeName` in sync. Every other codec passes through unchanged.
+ * Both the PSL `pg.enum(Ref)` path and the TS `pg.enum(handle)` path route
+ * through here — the dispatch keys off the codec id, not authoring surface.
+ */
+export function postgresQualifyColumnType(
+  input: {
+    readonly codecId: string;
+    readonly nativeType: string;
+    readonly typeParams?: Record<string, unknown>;
+  },
+  namespaceId: string,
+): { readonly nativeType: string; readonly typeParams?: Record<string, unknown> } {
+  if (input.codecId !== PG_ENUM_CODEC_ID) return input;
+  const bareTypeName = input.typeParams?.['typeName'];
+  if (typeof bareTypeName !== 'string') return input;
+  const qualified = pgEnumDescriptor.qualifyNativeType(bareTypeName, namespaceId);
+  return { nativeType: qualified, typeParams: { ...input.typeParams, typeName: qualified } };
+}
+
 /**
  * Postgres `text[]` codec. Encode is an identity pass-through: the pg wire
  * driver serialises a JS `string[]` to a Postgres array literal under the
@@ -228,6 +378,9 @@ export class PgInt4Descriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['int4'] as const;
   override readonly meta = PG_INT4_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgInt4Codec {
     return () => new PgInt4Codec(this);
   }
@@ -267,6 +420,9 @@ export class PgInt2Descriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['int2'] as const;
   override readonly meta = PG_INT2_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgInt2Codec {
     return () => new PgInt2Codec(this);
   }
@@ -306,6 +462,9 @@ export class PgInt8Descriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['int8'] as const;
   override readonly meta = PG_INT8_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgInt8Codec {
     return () => new PgInt8Codec(this);
   }
@@ -345,6 +504,9 @@ export class PgFloat4Descriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['float4'] as const;
   override readonly meta = PG_FLOAT4_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgFloat4Codec {
     return () => new PgFloat4Codec(this);
   }
@@ -384,6 +546,9 @@ export class PgFloat8Descriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['float8'] as const;
   override readonly meta = PG_FLOAT8_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgFloat8Codec {
     return () => new PgFloat8Codec(this);
   }
@@ -423,6 +588,9 @@ export class PgBoolDescriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['bool'] as const;
   override readonly meta = PG_BOOL_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgBoolCodec {
     return () => new PgBoolCodec(this);
   }
@@ -449,10 +617,17 @@ export class PgNumericCodec extends CodecImpl<
     return pgNumericDecode(wire);
   }
   encodeJson(value: string): JsonValue {
-    return value;
+    const number = Number(value);
+    if (!Number.isFinite(number)) {
+      throw new TypeError('pg/numeric@1 database JSON value must be a finite number');
+    }
+    return number;
   }
   decodeJson(json: JsonValue): string {
-    return json as string;
+    if (typeof json !== 'number') {
+      throw new TypeError('pg/numeric@1 database JSON value must be a number');
+    }
+    return pgNumericDecode(json);
   }
 }
 
@@ -755,17 +930,10 @@ export class PgByteaCodec extends CodecImpl<
       : new Uint8Array(wire.buffer, wire.byteOffset, wire.byteLength);
   }
   encodeJson(value: Uint8Array): JsonValue {
-    return Buffer.from(value).toString('base64');
+    return pgByteaEncodeJson(value);
   }
   decodeJson(json: JsonValue): Uint8Array {
-    if (typeof json !== 'string') {
-      throw new Error(`Expected base64 string for pg/bytea@1, got ${typeof json}`);
-    }
-    const decoded = Buffer.from(json, 'base64');
-    if (decoded.toString('base64') !== json) {
-      throw new Error(`Invalid base64 string for pg/bytea@1 (length: ${json.length})`);
-    }
-    return new Uint8Array(decoded);
+    return pgByteaDecodeJson(json);
   }
 }
 
@@ -968,6 +1136,9 @@ export class PgCharDescriptor extends CodecDescriptorImpl<LengthParams> {
   override renderOutputType(params: LengthParams): string | undefined {
     return sqlCharDescriptor.renderOutputType(params);
   }
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(_params: LengthParams): (ctx: CodecInstanceContext) => SqlCharCodec {
     return () => new SqlCharCodec(this);
   }
@@ -989,6 +1160,9 @@ export class PgVarcharDescriptor extends CodecDescriptorImpl<LengthParams> {
   override renderOutputType(params: LengthParams): string | undefined {
     return sqlVarcharDescriptor.renderOutputType(params);
   }
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(_params: LengthParams): (ctx: CodecInstanceContext) => SqlVarcharCodec {
     return () => new SqlVarcharCodec(this);
   }
@@ -1012,6 +1186,9 @@ export class PgIntDescriptor extends CodecDescriptorImpl<void> {
   override readonly meta = PG_INT_META;
   override readonly traits = sqlIntDescriptor.traits;
   override readonly paramsSchema = sqlIntDescriptor.paramsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => SqlIntCodec {
     return () => new SqlIntCodec(this);
   }
@@ -1030,6 +1207,9 @@ export class PgFloatDescriptor extends CodecDescriptorImpl<void> {
   override readonly meta = PG_FLOAT_META;
   override readonly traits = sqlFloatDescriptor.traits;
   override readonly paramsSchema = sqlFloatDescriptor.paramsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => SqlFloatCodec {
     return () => new SqlFloatCodec(this);
   }
@@ -1052,6 +1232,7 @@ export const codecDescriptors: readonly AnyCodecDescriptor[] = [
   sqlTextDescriptor,
   sqlTimestampDescriptor,
   pgTextDescriptor,
+  pgEnumDescriptor,
   pgCharDescriptor,
   pgVarcharDescriptor,
   pgIntDescriptor,

package/src/core/ddl/nodes.ts

@@ -3,6 +3,7 @@ import {
   DdlNode,
   type DdlTableConstraint,
 } from '@prisma-next/sql-relational-core/ast';
+import type { RlsPolicyOperation } from '../rls/canonicalize';
 
 // ---------------------------------------------------------------------------
 // AlterTableAction — nested polymorphic hierarchy
@@ -10,6 +11,7 @@ import {
 
 export interface AlterTableActionVisitor<R> {
   addColumn(action: AddColumnAction): R;
+  dropDefault(action: DropDefaultAction): R;
 }
 
 export abstract class AlterTableAction {
@@ -32,7 +34,31 @@ export class AddColumnAction extends AlterTableAction {
   }
 }
 
-export type AnyAlterTableAction = AddColumnAction;
+export class DropDefaultAction extends AlterTableAction {
+  readonly kind = 'drop-default' as const;
+  readonly columnName: string;
+
+  constructor(columnName: string) {
+    super();
+    this.columnName = columnName;
+    Object.freeze(this);
+  }
+
+  override accept<R>(visitor: AlterTableActionVisitor<R>): R {
+    return visitor.dropDefault(this);
+  }
+}
+
+/**
+ * The set of ALTER TABLE subactions currently expressible as typed DDL.
+ *
+ * The remaining actions — SetDefault, SetNotNull, DropNotNull,
+ * AlterColumnType — are still emitted as raw SQL by `operations/columns.ts`
+ * and join this union as they are converted to typed DDL. Until then it is
+ * intentionally partial: only the ALTER subactions used by the
+ * already-converted ops (AddColumn, DropDefault) appear here.
+ */
+export type AnyAlterTableAction = AddColumnAction | DropDefaultAction;
 
 // ---------------------------------------------------------------------------
 // Top-level DDL visitor
@@ -41,7 +67,13 @@ export type AnyAlterTableAction = AddColumnAction;
 export interface PostgresDdlVisitor<R> {
   createTable(node: PostgresCreateTable): R;
   createSchema(node: PostgresCreateSchema): R;
+  createType(node: PostgresCreateType): R;
+  dropType(node: PostgresDropType): R;
   alterTable(node: PostgresAlterTable): R;
+  createPolicy(node: PostgresCreatePolicy): R;
+  dropPolicy(node: PostgresDropPolicy): R;
+  alterPolicyRename(node: PostgresAlterPolicyRename): R;
+  disableRowLevelSecurity(node: PostgresDisableRowLevelSecurity): R;
 }
 
 export abstract class PostgresDdlNode extends DdlNode {
@@ -104,6 +136,46 @@ export class PostgresCreateSchema extends PostgresDdlNode {
   }
 }
 
+export class PostgresCreateType extends PostgresDdlNode {
+  readonly kind = 'create-type' as const;
+  readonly schema: string | undefined;
+  readonly name: string;
+  readonly values: ReadonlyArray<string>;
+
+  constructor(options: {
+    readonly schema?: string;
+    readonly name: string;
+    readonly values: readonly string[];
+  }) {
+    super();
+    this.schema = options.schema;
+    this.name = options.name;
+    this.values = Object.freeze([...options.values]);
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.createType(this);
+  }
+}
+
+export class PostgresDropType extends PostgresDdlNode {
+  readonly kind = 'drop-type' as const;
+  readonly schema: string | undefined;
+  readonly name: string;
+
+  constructor(options: { readonly schema?: string; readonly name: string }) {
+    super();
+    this.schema = options.schema;
+    this.name = options.name;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.dropType(this);
+  }
+}
+
 export class PostgresAlterTable extends PostgresDdlNode {
   readonly kind = 'alter-table' as const;
   readonly table: string;
@@ -127,4 +199,115 @@ export class PostgresAlterTable extends PostgresDdlNode {
   }
 }
 
-export type AnyPostgresDdlNode = PostgresCreateTable | PostgresCreateSchema | PostgresAlterTable;
+export type { RlsPolicyOperation };
+
+export class PostgresCreatePolicy extends PostgresDdlNode {
+  readonly kind = 'create-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly permissive: boolean;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: ReadonlyArray<string>;
+  readonly using: string | undefined;
+  readonly withCheck: string | undefined;
+
+  constructor(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly name: string;
+    readonly permissive: boolean;
+    readonly operation: RlsPolicyOperation;
+    readonly roles: readonly string[];
+    readonly using?: string;
+    readonly withCheck?: string;
+  }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.permissive = options.permissive;
+    this.operation = options.operation;
+    this.roles = Object.freeze([...options.roles]);
+    this.using = options.using;
+    this.withCheck = options.withCheck;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.createPolicy(this);
+  }
+}
+
+export class PostgresDropPolicy extends PostgresDdlNode {
+  readonly kind = 'drop-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+
+  constructor(options: { readonly schema: string; readonly table: string; readonly name: string }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.dropPolicy(this);
+  }
+}
+
+export class PostgresAlterPolicyRename extends PostgresDdlNode {
+  readonly kind = 'alter-policy-rename' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly newName: string;
+
+  constructor(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly name: string;
+    readonly newName: string;
+  }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.newName = options.newName;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.alterPolicyRename(this);
+  }
+}
+
+export class PostgresDisableRowLevelSecurity extends PostgresDdlNode {
+  readonly kind = 'disable-row-level-security' as const;
+  readonly schema: string;
+  readonly table: string;
+
+  constructor(options: { readonly schema: string; readonly table: string }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.disableRowLevelSecurity(this);
+  }
+}
+
+export type AnyPostgresDdlNode =
+  | PostgresCreateTable
+  | PostgresCreateSchema
+  | PostgresCreateType
+  | PostgresDropType
+  | PostgresAlterTable
+  | PostgresCreatePolicy
+  | PostgresDropPolicy
+  | PostgresAlterPolicyRename
+  | PostgresDisableRowLevelSecurity;