@prisma-next/target-postgres 0.14.0-dev.2 → 0.14.0-dev.20

package/package.json

@@ -1,32 +1,34 @@
 {
   "name": "@prisma-next/target-postgres",
-  "version": "0.14.0-dev.2",
+  "version": "0.14.0-dev.20",
   "license": "Apache-2.0",
   "type": "module",
   "sideEffects": false,
   "description": "Postgres target pack for Prisma Next",
   "dependencies": {
-    "@prisma-next/cli": "0.14.0-dev.2",
-    "@prisma-next/contract": "0.14.0-dev.2",
-    "@prisma-next/errors": "0.14.0-dev.2",
-    "@prisma-next/family-sql": "0.14.0-dev.2",
-    "@prisma-next/framework-components": "0.14.0-dev.2",
-    "@prisma-next/migration-tools": "0.14.0-dev.2",
-    "@prisma-next/ts-render": "0.14.0-dev.2",
-    "@prisma-next/sql-contract": "0.14.0-dev.2",
-    "@prisma-next/sql-errors": "0.14.0-dev.2",
-    "@prisma-next/sql-operations": "0.14.0-dev.2",
-    "@prisma-next/sql-relational-core": "0.14.0-dev.2",
-    "@prisma-next/sql-schema-ir": "0.14.0-dev.2",
-    "@prisma-next/utils": "0.14.0-dev.2",
+    "@prisma-next/cli": "0.14.0-dev.20",
+    "@prisma-next/contract": "0.14.0-dev.20",
+    "@prisma-next/errors": "0.14.0-dev.20",
+    "@prisma-next/family-sql": "0.14.0-dev.20",
+    "@prisma-next/framework-components": "0.14.0-dev.20",
+    "@prisma-next/migration-tools": "0.14.0-dev.20",
+    "@prisma-next/ts-render": "0.14.0-dev.20",
+    "@prisma-next/sql-contract": "0.14.0-dev.20",
+    "@prisma-next/sql-errors": "0.14.0-dev.20",
+    "@prisma-next/sql-operations": "0.14.0-dev.20",
+    "@prisma-next/sql-relational-core": "0.14.0-dev.20",
+    "@prisma-next/sql-schema-ir": "0.14.0-dev.20",
+    "@prisma-next/utils": "0.14.0-dev.20",
     "@standard-schema/spec": "^1.1.0",
     "arktype": "^2.2.0",
     "pathe": "^2.0.3"
   },
   "devDependencies": {
-    "@prisma-next/test-utils": "0.14.0-dev.2",
-    "@prisma-next/tsconfig": "0.14.0-dev.2",
-    "@prisma-next/tsdown": "0.14.0-dev.2",
+    "@prisma-next/psl-parser": "0.14.0-dev.20",
+    "@prisma-next/sql-contract-psl": "0.14.0-dev.20",
+    "@prisma-next/test-utils": "0.14.0-dev.20",
+    "@prisma-next/tsconfig": "0.14.0-dev.20",
+    "@prisma-next/tsdown": "0.14.0-dev.20",
     "tsdown": "0.22.1",
     "typescript": "5.9.3",
     "vitest": "4.1.8"
@@ -68,7 +70,9 @@
     "./planner-target-details": "./dist/planner-target-details.mjs",
     "./render-ops": "./dist/render-ops.mjs",
     "./render-typescript": "./dist/render-typescript.mjs",
+    "./rls-canonicalize": "./dist/rls-canonicalize.mjs",
     "./runtime": "./dist/runtime.mjs",
+    "./schema-ir-annotations": "./dist/schema-ir-annotations.mjs",
     "./sql-utils": "./dist/sql-utils.mjs",
     "./types": "./dist/types.mjs",
     "./package.json": "./package.json"

package/src/contract-free/checks.ts

@@ -345,6 +345,79 @@ export function extensionExistsAst(extensionName: string): ExtensionExistsCheckB
   };
 }
 
+export interface RlsPolicyExistsCheckBuilder {
+  policyPresent(): SelectAst;
+  policyAbsent(): SelectAst;
+}
+
+/**
+ * Typed RLS-policy existence check over `pg_policies`, with schema, table,
+ * and policy names bound as text parameters (never inlined). The `schema`
+ * coordinate is the resolved live-database schema name (e.g. `'public'`),
+ * compared against `pg_policies.schemaname` as a bound parameter.
+ */
+export function rlsPolicyExistsAst(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly policyName: string;
+}): RlsPolicyExistsCheckBuilder {
+  const inner = () =>
+    exprSelect()
+      .from(cfTable('pg_policies'))
+      .project('one', cfExpr.lit(1))
+      .where(
+        cfExpr.allOf([
+          cfExpr.identifierRef('schemaname').eqParam(options.schema, PG_TEXT_CODEC_ID),
+          cfExpr.identifierRef('tablename').eqParam(options.table, PG_TEXT_CODEC_ID),
+          cfExpr.identifierRef('policyname').eqParam(options.policyName, PG_TEXT_CODEC_ID),
+        ]),
+      );
+  return {
+    policyPresent: () => exprSelect().project('result', cfExpr.exists(inner())).build(),
+    policyAbsent: () => exprSelect().project('result', cfExpr.notExists(inner())).build(),
+  };
+}
+
+export interface RlsEnabledCheckBuilder {
+  rlsEnabled(): SelectAst;
+  rlsDisabled(): SelectAst;
+}
+
+/**
+ * Typed row-level-security enabled check over `pg_class` joined to
+ * `pg_namespace`, comparing `pg_class.relrowsecurity` against the expected
+ * boolean. Schema and table names are bound as text parameters.
+ */
+export function rlsEnabledAst(schema: string, table: string): RlsEnabledCheckBuilder {
+  const inner = (enabled: boolean) =>
+    exprSelect()
+      .from(cfTable('pg_class', 'c'))
+      .join(
+        cfTable('pg_namespace', 'n'),
+        cfExpr.columnRef('n', 'oid').eqExpr(cfExpr.columnRef('c', 'relnamespace')),
+      )
+      .project('one', cfExpr.lit(1))
+      .where(
+        cfExpr.allOf([
+          cfExpr.columnRef('n', 'nspname').eqParam(schema, PG_TEXT_CODEC_ID),
+          cfExpr.columnRef('c', 'relname').eqParam(table, PG_TEXT_CODEC_ID),
+          enabled
+            ? cfExpr.columnRef('c', 'relrowsecurity')
+            : cfExpr.columnRef('c', 'relrowsecurity').not(),
+        ]),
+      );
+  return {
+    rlsEnabled: () =>
+      exprSelect()
+        .project('result', cfExpr.exists(inner(true)))
+        .build(),
+    rlsDisabled: () =>
+      exprSelect()
+        .project('result', cfExpr.exists(inner(false)))
+        .build(),
+  };
+}
+
 export interface IndexExistsCheckBuilder {
   indexPresent(): SelectAst;
   indexAbsent(): SelectAst;

package/src/contract-free/ddl.ts

@@ -2,9 +2,13 @@ import type { DdlColumn, DdlTableConstraint } from '@prisma-next/sql-relational-
 import {
   AddColumnAction,
   type AnyAlterTableAction,
+  DropDefaultAction,
   PostgresAlterTable,
+  PostgresCreatePolicy,
   PostgresCreateSchema,
   PostgresCreateTable,
+  PostgresDropPolicy,
+  type RlsPolicyOperation,
 } from '../core/ddl/nodes';
 
 /**
@@ -51,9 +55,17 @@ export function addColumnAction(column: DdlColumn): AddColumnAction {
   return new AddColumnAction(column);
 }
 
+/**
+ * Build a `DROP DEFAULT` action (`ALTER COLUMN "<name>" DROP DEFAULT`) for
+ * use inside {@link alterTable}. The renderer quotes the column name.
+ */
+export function dropDefaultAction(columnName: string): DropDefaultAction {
+  return new DropDefaultAction(columnName);
+}
+
 /**
  * Build a Postgres `ALTER TABLE` query node carrying one or more actions.
- * See {@link addColumnAction} for building actions.
+ * See {@link addColumnAction} / {@link dropDefaultAction} for building actions.
  */
 export function alterTable(options: {
   readonly table: string;
@@ -62,3 +74,35 @@ export function alterTable(options: {
 }): PostgresAlterTable {
   return new PostgresAlterTable(options);
 }
+
+/**
+ * Build a Postgres `CREATE POLICY` DDL node.
+ *
+ * Identifiers (`schema`, `table`, `name`) are quoted by the renderer.
+ * `using` and `withCheck` are emitted verbatim as predicate SQL — callers
+ * must supply safe, pre-validated SQL expressions.
+ */
+export function createPolicy(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly permissive: boolean;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: readonly string[];
+  readonly using?: string;
+  readonly withCheck?: string;
+}): PostgresCreatePolicy {
+  return new PostgresCreatePolicy(options);
+}
+
+/**
+ * Build a Postgres `DROP POLICY` DDL node.
+ * Identifiers (`schema`, `table`, `name`) are quoted by the renderer.
+ */
+export function dropPolicy(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+}): PostgresDropPolicy {
+  return new PostgresDropPolicy(options);
+}

package/src/core/authoring.ts

@@ -1,13 +1,94 @@
 import { temporalAuthoringPresets } from '@prisma-next/family-sql/control';
 import type {
+  AuthoringEntityContext,
   AuthoringEntityTypeNamespace,
   AuthoringFieldNamespace,
+  AuthoringPslBlockDescriptorNamespace,
   AuthoringTypeNamespace,
+  PslExtensionBlock,
 } from '@prisma-next/framework-components/authoring';
+import { PostgresRlsPolicy } from './postgres-rls-policy';
+import { PostgresRole, type PostgresRoleInput } from './postgres-role';
+import { PostgresRlsPolicySchema, PostgresRoleSchema } from './postgres-validators';
+import { computeContentHash, normalizePredicate } from './rls/canonicalize';
 
 export const postgresAuthoringTypes = {} as const satisfies AuthoringTypeNamespace;
 
-export const postgresAuthoringEntityTypes = {} as const satisfies AuthoringEntityTypeNamespace;
+export interface RlsPolicyExtensionBlock extends PslExtensionBlock {
+  readonly namespaceId: string;
+}
+
+function readRefParam(block: PslExtensionBlock, key: string): string | undefined {
+  const param = block.parameters[key];
+  return param?.kind === 'ref' ? param.identifier : undefined;
+}
+
+function readValueParam(block: PslExtensionBlock, key: string): string | undefined {
+  const param = block.parameters[key];
+  return param?.kind === 'value' ? param.raw : undefined;
+}
+
+function readListRefParams(block: PslExtensionBlock, key: string): string[] {
+  const param = block.parameters[key];
+  if (param?.kind !== 'list') return [];
+  return param.items.flatMap((item) => (item.kind === 'ref' ? [item.identifier] : []));
+}
+
+function unwrapQuotedString(raw: string): string {
+  if (raw.startsWith('"') && raw.endsWith('"') && raw.length >= 2) {
+    return raw.slice(1, -1).replace(/\\"/g, '"');
+  }
+  return raw;
+}
+
+function lowerRlsPolicyFromBlock(
+  block: RlsPolicyExtensionBlock,
+  _ctx: AuthoringEntityContext,
+): PostgresRlsPolicy {
+  const prefix = block.name;
+  const targetModelName = readRefParam(block, 'target') ?? '';
+  const tableName = targetModelName.charAt(0).toLowerCase() + targetModelName.slice(1);
+  const roles = [...readListRefParams(block, 'roles')].sort();
+  const using = unwrapQuotedString(readValueParam(block, 'using') ?? '');
+
+  const wireHash = computeContentHash({
+    using: normalizePredicate(using),
+    roles,
+    operation: 'select',
+    permissive: true,
+  });
+  const wireName = `${prefix}_${wireHash}`;
+
+  return new PostgresRlsPolicy({
+    name: wireName,
+    prefix,
+    tableName,
+    namespaceId: block.namespaceId,
+    operation: 'select',
+    roles,
+    using,
+    permissive: true,
+  });
+}
+
+export const postgresAuthoringEntityTypes = {
+  role: {
+    kind: 'entity',
+    discriminator: 'role',
+    validatorSchema: PostgresRoleSchema,
+    output: {
+      factory: (input: PostgresRoleInput): PostgresRole => new PostgresRole(input),
+    },
+  },
+  policy: {
+    kind: 'entity',
+    discriminator: 'policy',
+    validatorSchema: PostgresRlsPolicySchema,
+    output: {
+      factory: lowerRlsPolicyFromBlock,
+    },
+  },
+} as const satisfies AuthoringEntityTypeNamespace;
 
 /**
  * Field presets contributed by the Postgres target pack.
@@ -22,6 +103,39 @@ export const postgresAuthoringEntityTypes = {} as const satisfies AuthoringEntit
  * portability use `uuidString` / `id.uuidv4String` / `id.uuidv7String` from
  * the family pack instead.
  */
+/**
+ * PSL block descriptor for `policy_select`.
+ *
+ * The parser learns the block shape from this descriptor; lowering from
+ * `PslExtensionBlock` to `PostgresRlsPolicy` is wired in the PSL
+ * interpreter (a later dispatch). The `discriminator` matches
+ * `PostgresRlsPolicy.kind` so the parsed block node carries the same
+ * discriminant as the IR class it will lower to.
+ *
+ * The `roles` list uses `scope:'cross-space'` because same-namespace
+ * role ref resolution requires PSL namespace entries keyed by `refKind`
+ * (i.e. `'role'`), which in turn requires the role block discriminator to
+ * equal `'role'`. Aligning discriminator with refKind is tracked for
+ * slice 4 (cross-space roles). Until then cross-space passes validation
+ * unconditionally and the authored role names flow through unchanged.
+ */
+export const postgresAuthoringPslBlockDescriptors = {
+  policy_select: {
+    kind: 'pslBlock',
+    keyword: 'policy_select',
+    discriminator: 'policy',
+    name: { required: true },
+    parameters: {
+      target: { kind: 'ref', refKind: 'model', scope: 'same-namespace', required: true },
+      roles: {
+        kind: 'list',
+        of: { kind: 'ref', refKind: 'role', scope: 'cross-space' },
+      },
+      using: { kind: 'value', codecId: 'pg/text@1', required: true },
+    },
+  },
+} as const satisfies AuthoringPslBlockDescriptorNamespace;
+
 export const postgresAuthoringFieldPresets = {
   text: {
     kind: 'fieldPreset',

package/src/core/codecs.ts

@@ -4,7 +4,7 @@
  * Each codec ships as three artifacts:
  *
  * 1. A `PgXCodec` class extending {@link CodecImpl} that wraps the module-level encode/decode/encodeJson/decodeJson constants exported from `codec-helpers.ts` (the single source of truth for non-trivial runtime conversions; trivial identity passthroughs are inlined). 2. A `PgXDescriptor` class extending {@link CodecDescriptorImpl} declaring the codec id, traits, target types, params schema, meta, and (where applicable)
- * the emit-path `renderOutputType`. 3. A per-codec column helper (`pgXColumn`) that calls `descriptor.factory(...)` directly and packages the result into a {@link ColumnSpec} via the framework {@link column} packager. The helper is tied to its descriptor with `satisfies ColumnHelperFor` (and `ColumnHelperForStrict` where the resolved codec type is well-defined).
+ * the emit-path `renderOutputType`. 3. A per-codec column helper (`pgXColumn`) that calls `descriptor.factory(...)` directly and packages the result into a framework `ColumnSpec` via the framework {@link column} packager. The helper is tied to its descriptor with `satisfies ColumnHelperFor` (and `ColumnHelperForStrict` where the resolved codec type is well-defined).
  *
  * After TML-2357 this is the canonical source of Postgres codec metadata and runtime behaviour — the legacy `mkCodec` / `defineCodec` carriers (and the parallel `byScalar`/`codecDescriptorDefinitions`/ `codecDescriptorList` collection exports) retired with the deletion sweep.
  *

package/src/core/ddl/nodes.ts

@@ -3,6 +3,7 @@ import {
   DdlNode,
   type DdlTableConstraint,
 } from '@prisma-next/sql-relational-core/ast';
+import type { RlsPolicyOperation } from '../rls/canonicalize';
 
 // ---------------------------------------------------------------------------
 // AlterTableAction — nested polymorphic hierarchy
@@ -10,6 +11,7 @@ import {
 
 export interface AlterTableActionVisitor<R> {
   addColumn(action: AddColumnAction): R;
+  dropDefault(action: DropDefaultAction): R;
 }
 
 export abstract class AlterTableAction {
@@ -32,7 +34,31 @@ export class AddColumnAction extends AlterTableAction {
   }
 }
 
-export type AnyAlterTableAction = AddColumnAction;
+export class DropDefaultAction extends AlterTableAction {
+  readonly kind = 'drop-default' as const;
+  readonly columnName: string;
+
+  constructor(columnName: string) {
+    super();
+    this.columnName = columnName;
+    Object.freeze(this);
+  }
+
+  override accept<R>(visitor: AlterTableActionVisitor<R>): R {
+    return visitor.dropDefault(this);
+  }
+}
+
+/**
+ * The set of ALTER TABLE subactions currently expressible as typed DDL.
+ *
+ * The remaining actions — SetDefault, SetNotNull, DropNotNull,
+ * AlterColumnType — are still emitted as raw SQL by `operations/columns.ts`
+ * and join this union as they are converted to typed DDL. Until then it is
+ * intentionally partial: only the ALTER subactions used by the
+ * already-converted ops (AddColumn, DropDefault) appear here.
+ */
+export type AnyAlterTableAction = AddColumnAction | DropDefaultAction;
 
 // ---------------------------------------------------------------------------
 // Top-level DDL visitor
@@ -42,6 +68,8 @@ export interface PostgresDdlVisitor<R> {
   createTable(node: PostgresCreateTable): R;
   createSchema(node: PostgresCreateSchema): R;
   alterTable(node: PostgresAlterTable): R;
+  createPolicy(node: PostgresCreatePolicy): R;
+  dropPolicy(node: PostgresDropPolicy): R;
 }
 
 export abstract class PostgresDdlNode extends DdlNode {
@@ -127,4 +155,68 @@ export class PostgresAlterTable extends PostgresDdlNode {
   }
 }
 
-export type AnyPostgresDdlNode = PostgresCreateTable | PostgresCreateSchema | PostgresAlterTable;
+export type { RlsPolicyOperation };
+
+export class PostgresCreatePolicy extends PostgresDdlNode {
+  readonly kind = 'create-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly permissive: boolean;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: ReadonlyArray<string>;
+  readonly using: string | undefined;
+  readonly withCheck: string | undefined;
+
+  constructor(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly name: string;
+    readonly permissive: boolean;
+    readonly operation: RlsPolicyOperation;
+    readonly roles: readonly string[];
+    readonly using?: string;
+    readonly withCheck?: string;
+  }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.permissive = options.permissive;
+    this.operation = options.operation;
+    this.roles = Object.freeze([...options.roles]);
+    this.using = options.using;
+    this.withCheck = options.withCheck;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.createPolicy(this);
+  }
+}
+
+export class PostgresDropPolicy extends PostgresDdlNode {
+  readonly kind = 'drop-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+
+  constructor(options: { readonly schema: string; readonly table: string; readonly name: string }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.dropPolicy(this);
+  }
+}
+
+export type AnyPostgresDdlNode =
+  | PostgresCreateTable
+  | PostgresCreateSchema
+  | PostgresAlterTable
+  | PostgresCreatePolicy
+  | PostgresDropPolicy;

package/src/core/default-normalizer.ts

@@ -1,4 +1,4 @@
-import type { ColumnDefault } from '@prisma-next/contract/types';
+import type { ColumnDefault, JsonValue } from '@prisma-next/contract/types';
 
 /**
  * Pre-compiled regex patterns for performance.
@@ -18,6 +18,13 @@ const FALSE_PATTERN = /^false$/i;
 const NUMERIC_PATTERN = /^-?\d+(\.\d+)?$/;
 const STRING_LITERAL_PATTERN = /^'((?:[^']|'')*)'(?:::(?:"[^"]+"|[\w\s]+)(?:\(\d+\))?)?$/;
 
+/**
+ * Matches a Postgres array literal default of the form `'{...}'::elemtype[]`.
+ * The literal body is captured in group 1; the cast (including `[]`) is optional.
+ * Examples: `'{}'::text[]`, `'{1,2}'::integer[]`, `'{}'`
+ */
+const ARRAY_LITERAL_PATTERN = /^'(\{.*\})'(?:::.+\[\])?$/;
+
 /**
  * Returns the canonical expression for a timestamp default function, or undefined
  * if the expression is not a recognized timestamp default.
@@ -51,6 +58,46 @@ function canonicalizeTimestampDefault(expr: string): string | undefined {
   return undefined;
 }
 
+/**
+ * Parses a Postgres array literal body (`{...}`) into a JS array of primitives.
+ * Returns undefined if the body cannot be reliably parsed.
+ *
+ * Handles:
+ * - `{}` → `[]`
+ * - `{elem1,elem2,...}` → `[elem1, elem2, ...]` with numeric and string element coercion
+ */
+function parseArrayLiteralBody(body: string): readonly JsonValue[] | undefined {
+  const inner = body.slice(1, -1).trim();
+  if (inner === '') return [];
+  const elements = inner.split(',');
+  const result: JsonValue[] = [];
+  for (const rawEl of elements) {
+    const el = rawEl.trim();
+    if (el.toUpperCase() === 'NULL') {
+      result.push(null);
+      continue;
+    }
+    if (el === 'true') {
+      result.push(true);
+      continue;
+    }
+    if (el === 'false') {
+      result.push(false);
+      continue;
+    }
+    if (NUMERIC_PATTERN.test(el)) {
+      result.push(Number(el));
+      continue;
+    }
+    if (el.startsWith('"') && el.endsWith('"')) {
+      result.push(el.slice(1, -1).replace(/""/g, '"'));
+      continue;
+    }
+    return undefined;
+  }
+  return result;
+}
+
 /**
  * Parses a raw Postgres column default expression into a normalized ColumnDefault.
  * This enables semantic comparison between contract defaults and introspected schema defaults.
@@ -59,7 +106,7 @@ function canonicalizeTimestampDefault(expr: string): string | undefined {
  * keeping the introspection layer focused on faithful data capture.
  *
  * @param rawDefault - Raw default expression from information_schema.columns.column_default
- * @param nativeType - Native column type, used for type-aware parsing (bigint tagging, JSON detection)
+ * @param nativeType - Native column type, used for type-aware parsing (array, bigint, JSON)
  * @returns Normalized ColumnDefault or undefined if the expression cannot be parsed
  */
 export function parsePostgresDefault(
@@ -69,11 +116,22 @@ export function parsePostgresDefault(
   const trimmed = rawDefault.trim();
   const normalizedType = nativeType?.toLowerCase();
   const isBigInt = normalizedType === 'bigint' || normalizedType === 'int8';
+  const isArrayType = normalizedType?.endsWith('[]') ?? false;
 
   if (NEXTVAL_PATTERN.test(trimmed)) {
     return { kind: 'function', expression: 'autoincrement()' };
   }
 
+  if (isArrayType) {
+    const arrayMatch = trimmed.match(ARRAY_LITERAL_PATTERN);
+    if (arrayMatch?.[1] !== undefined) {
+      const parsed = parseArrayLiteralBody(arrayMatch[1]);
+      if (parsed !== undefined) {
+        return { kind: 'literal', value: parsed };
+      }
+    }
+  }
+
   const canonicalTimestamp = canonicalizeTimestampDefault(trimmed);
   if (canonicalTimestamp) {
     return { kind: 'function', expression: canonicalTimestamp };

package/src/core/descriptor-meta.ts

@@ -2,9 +2,11 @@ import type { CodecTypes } from '../exports/codec-types';
 import {
   postgresAuthoringEntityTypes,
   postgresAuthoringFieldPresets,
+  postgresAuthoringPslBlockDescriptors,
   postgresAuthoringTypes,
 } from './authoring';
 import { postgresTargetDescriptorMetaRuntime } from './descriptor-meta-runtime';
+import { postgresCreateNamespace } from './postgres-schema';
 
 const postgresTargetDescriptorMetaBase = {
   ...postgresTargetDescriptorMetaRuntime,
@@ -13,6 +15,8 @@ const postgresTargetDescriptorMetaBase = {
     type: postgresAuthoringTypes,
     field: postgresAuthoringFieldPresets,
     entityTypes: postgresAuthoringEntityTypes,
+    pslBlockDescriptors: postgresAuthoringPslBlockDescriptors,
+    createNamespace: postgresCreateNamespace,
   },
 } as const;
 

package/src/core/entity-kinds.ts

@@ -0,0 +1,16 @@
+import type { EntityKindDescriptor } from '@prisma-next/framework-components/ir';
+import { PostgresRlsPolicy, type PostgresRlsPolicyInput } from './postgres-rls-policy';
+import { PostgresRole, type PostgresRoleInput } from './postgres-role';
+import { PostgresRlsPolicySchema, PostgresRoleSchema } from './postgres-validators';
+
+export const policyEntityKind: EntityKindDescriptor<PostgresRlsPolicyInput, PostgresRlsPolicy> = {
+  kind: 'policy',
+  schema: PostgresRlsPolicySchema,
+  construct: (input) => new PostgresRlsPolicy(input),
+};
+
+export const roleEntityKind: EntityKindDescriptor<PostgresRoleInput, PostgresRole> = {
+  kind: 'role',
+  schema: PostgresRoleSchema,
+  construct: (input) => new PostgresRole(input),
+};

package/src/core/migrations/bound-schema.ts

@@ -0,0 +1,10 @@
+import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
+
+/**
+ * Maps a planner schema name to the contract-free DDL builder's optional
+ * `schema` field: the unbound sentinel becomes `undefined` (the builder omits
+ * the schema qualifier), every other name passes through.
+ */
+export function boundSchema(schemaName: string): string | undefined {
+  return schemaName === UNBOUND_NAMESPACE_ID ? undefined : schemaName;
+}

package/src/core/migrations/control-policy.ts

@@ -21,6 +21,8 @@ import type { PostgresOpFactoryCall } from './op-factory-call';
 const OBJECT_CREATION_FACTORIES: ReadonlySet<string> = new Set<string>([
   'createTable',
   'createSchema',
+  'createRlsPolicy',
+  'enableRowLevelSecurity',
 ]);
 
 function createsNewTopLevelObject(call: PostgresOpFactoryCall): boolean {
@@ -151,6 +153,7 @@ export function resolvePostgresCallControlPolicySubject(
 const POSTGRES_ISSUE_CREATION_FACTORY: Readonly<Record<string, string>> = Object.freeze({
   missing_schema: 'createSchema',
   missing_table: 'createTable',
+  missing_rls_policy: 'createRlsPolicy',
 });
 
 export function resolvePostgresIssueCreationFactoryName(issue: SchemaIssue): string | undefined {

package/src/core/migrations/issue-planner.ts

@@ -695,6 +695,8 @@ type CallCategory =
   | 'dep'
   | 'drop'
   | 'table'
+  | 'rlsEnable'
+  | 'rlsPolicy'
   | 'column'
   | 'alter'
   | 'primaryKey'
@@ -724,6 +726,12 @@ function classifyCall(call: PostgresOpFactoryCall): CallCategory {
       return 'unique'; // after uniques, before indexes
     case 'createTable':
       return 'table';
+    case 'enableRowLevelSecurity':
+      return 'rlsEnable';
+    case 'createRlsPolicy':
+      return 'rlsPolicy';
+    case 'dropRlsPolicy':
+      return 'drop';
     case 'addColumn':
       return 'column';
     case 'alterColumnType':