@prisma-next/target-postgres 0.14.0-dev.4 → 0.14.0-dev.41

package/dist/planner-CG2pLHk-.mjs

@@ -0,0 +1,640 @@
+import { d as PostgresRlsPolicy, r as isPostgresSchema } from "./postgres-schema-BLIHBEfX.mjs";
+import { a as PostgresDatabaseSchemaNode, i as PostgresNamespaceSchemaNode, n as PostgresRoleSchemaNode, r as PostgresPolicySchemaNode, t as PostgresTableSchemaNode } from "./postgres-table-schema-node-1nNc8XDT.mjs";
+import { t as resolveDdlSchemaForNamespaceStorage } from "./resolve-ddl-schema-CL1RR1mx.mjs";
+import { t as parsePostgresDefault } from "./default-normalizer-Dug8Fez9.mjs";
+import { t as normalizeSchemaNativeType } from "./native-type-normalizer-Bc9XJzWC.mjs";
+import { C as EnableRowLevelSecurityCall, d as CreatePostgresRlsPolicyCall, x as DropPostgresRlsPolicyCall } from "./op-factory-call-t65c4jyY.mjs";
+import { n as postgresPlannerStrategies, t as planIssues } from "./issue-planner-DbFvaAgu.mjs";
+import { t as TypeScriptRenderablePostgresMigration } from "./planner-produced-postgres-migration-BolD0Mvc.mjs";
+import { blindCast } from "@prisma-next/utils/casts";
+import { contractNamespaceToSchemaIR, extractCodecControlHooks, partitionCallsByControlPolicy, partitionIssuesByControlPolicy, planFieldEventOperations, plannerFailure } from "@prisma-next/family-sql/control";
+import { ifDefined } from "@prisma-next/utils/defined";
+import { UNBOUND_NAMESPACE_ID, entityAt } from "@prisma-next/framework-components/ir";
+import { verifySqlSchemaTree } from "@prisma-next/family-sql/diff";
+import { SchemaDiff, diffSchemas } from "@prisma-next/framework-components/control";
+//#region src/core/migrations/contract-to-postgres-database-schema-node.ts
+function toPolicyNode(policy, namespaceId) {
+	return new PostgresPolicySchemaNode({
+		name: policy.name,
+		prefix: policy.prefix,
+		tableName: policy.tableName,
+		namespaceId,
+		operation: policy.operation,
+		roles: [...policy.roles],
+		...ifDefined("using", policy.using),
+		...ifDefined("withCheck", policy.withCheck),
+		permissive: policy.permissive
+	});
+}
+/**
+* Projects a Postgres contract into the expected schema-diff tree: a
+* `PostgresDatabaseSchemaNode` root holding one `PostgresNamespaceSchemaNode`
+* per Postgres namespace, each holding its `PostgresTableSchemaNode`s with
+* their `PostgresPolicySchemaNode`s, plus the database roles on the root.
+*
+* Not a duplicate of the family's `contractToSchemaIR`: that builds a flat,
+* single `{ tables }` map (and throws on cross-namespace name collisions, with
+* no RLS/role concept) for SQLite's single-schema world. This is the
+* Postgres-specific *tree* shape — multi-schema, RLS-policy-aware, role-aware.
+* It reuses the family's per-namespace table conversion (`contractNamespaceToSchemaIR`)
+* for column/FK/index building and only adds the Postgres tree/policy/role shape.
+*
+* Tables are grouped by their owning namespace (resolved DDL schema name) so
+* the tree mirrors Postgres's object hierarchy. The DDL schema name is
+* resolved once per namespace.
+*
+* A policy that references a table absent from its namespace is a malformed
+* contract — the loop throws rather than fabricating a stub table.
+*/
+function contractToPostgresDatabaseSchemaNode(contract, options) {
+	if (contract === null) return new PostgresDatabaseSchemaNode({
+		namespaces: {},
+		roles: [],
+		existingSchemas: [],
+		pgVersion: ""
+	});
+	const namespaces = {};
+	const roles = [];
+	const ownedSchemas = [];
+	for (const ns of Object.values(contract.storage.namespaces)) {
+		if (!isPostgresSchema(ns)) continue;
+		const ddlSchema = resolveDdlSchemaForNamespaceStorage(contract.storage, ns.id);
+		ownedSchemas.push(ddlSchema);
+		const sqlTables = contractNamespaceToSchemaIR(contract.storage, ns.id, options).tables;
+		const policiesByTable = /* @__PURE__ */ new Map();
+		for (const policy of Object.values(ns.policy)) {
+			const list = policiesByTable.get(policy.tableName) ?? [];
+			list.push(toPolicyNode(policy, ddlSchema));
+			policiesByTable.set(policy.tableName, list);
+		}
+		const tables = {};
+		for (const tableName of Object.keys(ns.table)) {
+			const sqlTable = sqlTables[tableName];
+			if (sqlTable === void 0) continue;
+			tables[tableName] = new PostgresTableSchemaNode({
+				name: sqlTable.name,
+				columns: sqlTable.columns,
+				foreignKeys: sqlTable.foreignKeys,
+				uniques: sqlTable.uniques,
+				indexes: sqlTable.indexes,
+				...ifDefined("primaryKey", sqlTable.primaryKey),
+				...ifDefined("annotations", sqlTable.annotations),
+				...ifDefined("checks", sqlTable.checks),
+				policies: policiesByTable.get(tableName) ?? []
+			});
+		}
+		for (const [tableName, tablePolicies] of policiesByTable) if (!(tableName in tables)) {
+			const policyName = tablePolicies[0]?.name ?? "(unknown)";
+			throw new Error(`contract-to-postgres-database-schema-node: policy "${policyName}" references table "${tableName}" not present in namespace "${ddlSchema}"`);
+		}
+		namespaces[ddlSchema] = new PostgresNamespaceSchemaNode({
+			schemaName: ddlSchema,
+			tables,
+			nativeEnumTypeNames: []
+		});
+		for (const role of Object.values(ns.role)) roles.push(new PostgresRoleSchemaNode({
+			name: role.name,
+			namespaceId: role.namespaceId
+		}));
+	}
+	return new PostgresDatabaseSchemaNode({
+		namespaces,
+		roles,
+		existingSchemas: ownedSchemas,
+		pgVersion: ""
+	});
+}
+//#endregion
+//#region src/core/migrations/diff-database-schema.ts
+/**
+* The single combined database-schema comparison — the one computation the
+* migration planner and the family schema verify both consume. Composes,
+* once each:
+*
+* - the per-namespace-paired relational diff (`verifySqlSchemaTree`) → table /
+*   column / constraint findings as framework `SchemaIssue`s (with the
+*   verification-tree `root` and pass/warn/fail counts);
+* - the policy diff (`diffPostgresSchema` over the two trees) → RLS policy
+*   presence as `SchemaDiffIssue`s, ownership-filtered to the contract's owned
+*   schemas.
+*
+* `diffPostgresDatabaseSchema` and `verifyPostgresDatabaseSchema` both read
+* this single result, so the relational walk runs once per caller — never
+* once for the diff and again for the verify tree.
+*/
+function computePostgresSchemaComparison(input) {
+	const postgresContract = blindCast(input.contract);
+	const relational = verifySqlSchemaTree({
+		contract: input.contract,
+		actualSchema: input.actualSchema,
+		buildExpectedSchema: (scopedContract) => contractToPostgresDatabaseSchemaNode(blindCast(scopedContract), { annotationNamespace: "pg" }),
+		strict: input.strict,
+		typeMetadataRegistry: input.typeMetadataRegistry,
+		frameworkComponents: input.frameworkComponents,
+		normalizeDefault: parsePostgresDefault,
+		normalizeNativeType: normalizeSchemaNativeType
+	});
+	PostgresDatabaseSchemaNode.assert(input.actualSchema);
+	const expected = contractToPostgresDatabaseSchemaNode(postgresContract, { annotationNamespace: "pg" });
+	return {
+		relational,
+		schemaDiffIssues: filterIssuesByOwnership(diffPostgresSchema(expected, input.actualSchema), ownedSchemaNames(expected))
+	};
+}
+/**
+* The `SchemaDiffer` for Postgres: the target's black-box comparison,
+* projected to the two issue lists. Namespace presence (`missing_schema` →
+* `CREATE SCHEMA`) is intentionally NOT composed here: it is a planner-only
+* op-generation concern (verify rejects on the relational `missing_table` a
+* missing schema already produces), so the planner stitches it in around this
+* diff. Control-policy suppression of the policy issues is likewise a
+* per-consumer post-step (verify filters the issues; the planner filters the
+* calls).
+*/
+function diffPostgresDatabaseSchema(input) {
+	const { relational, schemaDiffIssues } = computePostgresSchemaComparison(input);
+	return new SchemaDiff(relational.schema.issues, schemaDiffIssues);
+}
+/**
+* The same combined comparison as {@link diffPostgresDatabaseSchema}, wrapped
+* in the verify envelope (`ok`/`summary`/`code`/`target`/`timings`) plus the
+* pass/warn/fail tree the CLI renders — i.e. exactly the existing verify-result
+* schema shape, so nothing downstream changes.
+*/
+function verifyPostgresDatabaseSchema(input) {
+	const { relational, schemaDiffIssues } = computePostgresSchemaComparison(input);
+	return {
+		...relational,
+		schema: {
+			...relational.schema,
+			schemaDiffIssues
+		}
+	};
+}
+function ownedSchemaNames(expected) {
+	const policyNamespaces = Object.values(expected.namespaces).flatMap((ns) => Object.values(ns.tables).flatMap((t) => t.policies.map((p) => p.namespaceId)));
+	return new Set([...policyNamespaces, ...expected.existingSchemas]);
+}
+function renderPostgresPolicyReference(policy) {
+	return `policy "${policy.name}" on "${policy.namespaceId}"."${policy.tableName}"`;
+}
+/**
+* The policy node-diff — the structural half of the combined comparison above.
+* Computes RLS-policy drift between two derived schema trees:
+*
+* 1. Runs the framework total diff over the two `PostgresDatabaseSchemaNode`
+*    roots (database → namespace → table → policy).
+* 2. Filters to policy-subject issues only — this is transitional: the generic
+*    differ walks the whole tree, but the legacy relational verifier still owns
+*    table/column drift, so non-policy issues are dropped here.
+* 3. Remaps the message to a human-readable policy reference.
+*
+* Both trees are `PostgresDatabaseSchemaNode`s, so every issue node is a
+* `SqlSchemaDiffNode` — narrow the framework's `SchemaDiffIssue<DiffableNode>`
+* output once here (the single boundary cast), so every downstream consumer
+* (the ownership filter, the planner) reads the concrete node with no cast.
+*
+* Ownership filtering (dropping `extra` issues in namespaces a contract doesn't
+* own) is the caller's responsibility — use `filterIssuesByOwnership`.
+*/
+function diffPostgresSchema(expected, actual) {
+	return blindCast(diffSchemas(expected, actual)).filter((i) => {
+		const node = i.expected ?? i.actual;
+		return node !== void 0 && PostgresPolicySchemaNode.is(node);
+	}).map((i) => {
+		const node = i.expected ?? i.actual;
+		if (node === void 0 || !PostgresPolicySchemaNode.is(node)) return i;
+		return {
+			...i,
+			message: `${i.outcome}: ${renderPostgresPolicyReference(node)}`
+		};
+	});
+}
+/**
+* Filters `extra` policy issues to those in owned namespaces. Call after
+* `diffPostgresSchema` with the union of namespace ids from the expected tree's
+* policies and its `existingSchemas`.
+*/
+function filterIssuesByOwnership(issues, ownedSchemaNameSet) {
+	return issues.filter((i) => {
+		if (i.outcome !== "extra") return true;
+		if (i.actual === void 0) return false;
+		return PostgresPolicySchemaNode.is(i.actual) && ownedSchemaNameSet.has(i.actual.namespaceId);
+	});
+}
+//#endregion
+//#region src/core/migrations/control-policy.ts
+/**
+* Factory calls that create a whole, previously-absent top-level storage
+* object. Used to decide whether `tolerated` permits a call (it only allows
+* creating absent objects, never modifying existing ones).
+*
+* Deliberately an explicit, closed set rather than a `factoryName`
+* create/alter/drop classification: it answers exactly one yes/no question
+* and is fail-closed. Any call not listed here — including future or
+* extension-contributed factories — is treated as NOT object-creation, so it
+* is suppressed under `tolerated` rather than permissively emitted.
+*/
+const OBJECT_CREATION_FACTORIES = new Set([
+	"createTable",
+	"createSchema",
+	"createRlsPolicy",
+	"enableRowLevelSecurity"
+]);
+function createsNewTopLevelObject(call) {
+	return OBJECT_CREATION_FACTORIES.has(call.factoryName);
+}
+function ddlSchemaNameForNamespace(contract, namespaceId) {
+	const namespace = contract.storage.namespaces[namespaceId];
+	return isPostgresSchema(namespace) ? namespace.ddlSchemaName(contract.storage) : namespaceId;
+}
+function resolveNamespaceIdForTable(contract, tableName, ddlSchemaName) {
+	for (const namespaceId of Object.keys(contract.storage.namespaces)) {
+		if (!entityAt(contract.storage, {
+			namespaceId,
+			entityKind: "table",
+			entityName: tableName
+		})) continue;
+		if (ddlSchemaName === void 0 || ddlSchemaNameForNamespace(contract, namespaceId) === ddlSchemaName) return namespaceId;
+	}
+	return UNBOUND_NAMESPACE_ID;
+}
+function resolveNamespaceIdForDdlSchema(contract, ddlSchemaName) {
+	for (const namespaceId of Object.keys(contract.storage.namespaces)) {
+		const ns = contract.storage.namespaces[namespaceId];
+		if (isPostgresSchema(ns) && ns.ddlSchemaName(contract.storage) === ddlSchemaName) return namespaceId;
+		if (namespaceId === ddlSchemaName) return namespaceId;
+	}
+	return UNBOUND_NAMESPACE_ID;
+}
+function postgresCallFields(call) {
+	return {
+		...ifDefined("schemaName", "schemaName" in call ? call.schemaName : void 0),
+		...ifDefined("tableName", "tableName" in call ? call.tableName : void 0),
+		...ifDefined("columnName", "columnName" in call ? call.columnName : void 0)
+	};
+}
+function formatPostgresControlPolicySubjectLabel(factoryName, subject, contract) {
+	if (subject?.table) return `${factoryName}(${ddlSchemaNameForNamespace(contract, subject.namespaceId)}.${subject.table})`;
+	return factoryName;
+}
+function resolvePostgresCallControlPolicySubject(call, contract) {
+	const callFields = postgresCallFields(call);
+	const createsNewObject = createsNewTopLevelObject(call);
+	if (call.factoryName === "createSchema" && callFields.schemaName) return {
+		namespaceId: resolveNamespaceIdForDdlSchema(contract, callFields.schemaName),
+		createsNewObject
+	};
+	if (callFields.tableName) {
+		const namespaceId = resolveNamespaceIdForTable(contract, callFields.tableName, callFields.schemaName);
+		const tableControlPolicy = entityAt(contract.storage, {
+			namespaceId,
+			entityKind: "table",
+			entityName: callFields.tableName
+		})?.control;
+		return {
+			namespaceId,
+			...ifDefined("explicitNodeControlPolicy", tableControlPolicy),
+			table: callFields.tableName,
+			...ifDefined("column", callFields.columnName),
+			createsNewObject
+		};
+	}
+	if (callFields.schemaName) return {
+		namespaceId: resolveNamespaceIdForDdlSchema(contract, callFields.schemaName),
+		createsNewObject
+	};
+}
+/**
+* Issue kinds that describe the absence of a whole, top-level Postgres
+* object — the same kinds `createsNewTopLevelObject` recognises for calls.
+* Used by {@link resolvePostgresIssueCreationFactoryName} to decide whether
+* a `tolerated` subject permits the issue to flow into the planner
+* (create-if-absent) and to seed the suppressed-subject warning's
+* `factoryName` when the planner is skipped.
+*/
+const POSTGRES_ISSUE_CREATION_FACTORY = Object.freeze({
+	missing_schema: "createSchema",
+	missing_table: "createTable",
+	missing_rls_policy: "createRlsPolicy"
+});
+function resolvePostgresIssueCreationFactoryName(issue) {
+	return POSTGRES_ISSUE_CREATION_FACTORY[issue.kind];
+}
+/**
+* Resolve the control-policy subject coordinate for a single
+* {@link SchemaIssue}. Mirrors the resolution `resolvePostgresCallControlPolicySubject`
+* performs for a generated DDL call, but works *off the issue* — so the
+* planner can partition issues by effective policy before the diff engine
+* runs. `createsNewObject` is derived from the issue's kind: schema/table/
+* type-missing issues describe a brand-new top-level object; everything else
+* touches an existing object.
+*
+* An `extra_table` issue carries no contract namespace coordinate (the table
+* isn't in any contract namespace), so the subject's `namespaceId` falls
+* back to {@link UNBOUND_NAMESPACE_ID}; the call-side resolver does the same
+* for the `DropTableCall` it produces.
+*/
+function resolvePostgresIssueControlPolicySubject(issue, contract) {
+	const createsNewObject = POSTGRES_ISSUE_CREATION_FACTORY[issue.kind] !== void 0;
+	if (issue.kind === "missing_schema" && issue.namespaceId) return {
+		namespaceId: issue.namespaceId,
+		createsNewObject
+	};
+	if ("table" in issue && issue.table) {
+		const namespaceId = "namespaceId" in issue && issue.namespaceId ? issue.namespaceId : resolveNamespaceIdForTable(contract, issue.table, void 0);
+		return {
+			namespaceId,
+			...ifDefined("explicitNodeControlPolicy", entityAt(contract.storage, {
+				namespaceId,
+				entityKind: "table",
+				entityName: issue.table
+			})?.control),
+			table: issue.table,
+			...ifDefined("column", "column" in issue ? issue.column : void 0),
+			createsNewObject
+		};
+	}
+}
+//#endregion
+//#region src/core/migrations/verify-postgres-namespaces.ts
+/**
+* Resolves the live-database schema name for a given namespace
+* coordinate. Mirrors `resolveDdlSchemaForNamespace` in
+* `planner-strategies.ts` so the verifier's projection and the
+* planner's projection always agree — Postgres-aware namespaces (the
+* production path) dispatch to `ddlSchemaName(storage)`, and bare
+* object payloads (used by some tests) fall back to the coordinate
+* itself.
+*/
+function resolveDdlSchemaName(storage, namespaceId) {
+	const namespace = storage.namespaces[namespaceId];
+	if (isPostgresSchema(namespace)) return namespace.ddlSchemaName(storage);
+	return namespaceId;
+}
+/**
+* Reads the introspected list of schema names from the database-root schema
+* node. `existingSchemas` is database-level, so it lives on the
+* `PostgresDatabaseSchemaNode` root — not on the per-schema namespace nodes.
+*
+* Defaults to the always-present `public` schema when the node is not the
+* database root — a fresh Postgres database always carries `public` (unless an
+* operator dropped it manually), so any verifier path that runs without an
+* enriched introspection still suppresses the redundant `CREATE SCHEMA
+* "public"`.
+*
+* Production introspection (`PostgresControlAdapter.introspect`) is the
+* authoritative source: it queries `pg_namespace` and sets `existingSchemas`
+* on the returned root. Tests that want to assert against a richer initial
+* state construct a `PostgresDatabaseSchemaNode` explicitly.
+*/
+function existingSchemasFromSchema(schema) {
+	if (PostgresDatabaseSchemaNode.is(schema)) return schema.existingSchemas;
+	return ["public"];
+}
+/**
+* Emits a `missing_schema` issue for every contract-declared Postgres
+* namespace whose live container does not yet exist. The planner's
+* `collectSchemaIssues` prepends these to the relational findings so a
+* multi-schema plan emits `CREATE SCHEMA` before the tables that need it —
+* a planner-only concern (verify already rejects via the `missing_table` a
+* missing schema produces), so this is not part of the shared diff.
+*
+* A namespace's live container is the schema returned by its
+* polymorphic `ddlSchemaName(storage)` method — named schemas resolve
+* to their own id; the unbound singleton returns `UNBOUND_NAMESPACE_ID`
+* and is skipped explicitly (late-bound namespaces have no fixed DDL
+* schema). Issues are emitted only when the resolved name is a real,
+* creatable schema (not the unbound sentinel) and is missing from the
+* introspected list. `public` is suppressed implicitly because the
+* introspection (or its sensible default) always carries it.
+*
+* Each emitted issue stamps `namespaceId` with the contract namespace
+* coordinate so the downstream `mapIssueToCall` re-resolves the DDL
+* schema name through the same polymorphic path — keeping the
+* coordinate, not the resolved name, as the issue's stable identity.
+*/
+function verifyPostgresNamespacePresence(input) {
+	const { contract, schema } = input;
+	const existing = new Set(existingSchemasFromSchema(schema));
+	const issues = [];
+	const namespaceIds = Object.keys(contract.storage.namespaces).sort();
+	for (const namespaceId of namespaceIds) {
+		if (namespaceId === UNBOUND_NAMESPACE_ID) continue;
+		const ddlName = resolveDdlSchemaName(contract.storage, namespaceId);
+		if (ddlName === UNBOUND_NAMESPACE_ID) continue;
+		if (existing.has(ddlName)) continue;
+		issues.push({
+			kind: "missing_schema",
+			reason: "not-found",
+			namespaceId,
+			message: `Schema "${ddlName}" is missing from database`
+		});
+	}
+	return issues;
+}
+//#endregion
+//#region src/core/migrations/planner.ts
+function createPostgresMigrationPlanner(lowerer) {
+	return new PostgresMigrationPlanner(lowerer);
+}
+/**
+* Postgres migration planner — a thin wrapper over `planIssues`.
+*
+* `plan()` verifies the live schema against the target contract (producing
+* `SchemaIssue[]`) and delegates to `planIssues` with the unified
+* `postgresPlannerStrategies` list: enum-change, NOT-NULL backfill,
+* type-change, nullable-tightening, codec-hook storage types,
+* component-declared dependency installs, and shared-temp-default /
+* empty-table-guarded NOT-NULL add-column. The same strategy list runs for
+* `migration plan`, `db update`, and `db init`; behavior diverges purely on
+* `policy.allowedOperationClasses` (the data-safe strategies short-circuit
+* when `'data'` is excluded). The issue planner applies operation-class
+* policy gates and emits a single `PostgresOpFactoryCall[]` that drives both
+* the runtime-ops view (via `renderOps`) and the `renderTypeScript()`
+* authoring surface.
+*/
+var PostgresMigrationPlanner = class {
+	#lowerer;
+	constructor(lowerer) {
+		this.#lowerer = lowerer;
+	}
+	plan(options) {
+		return this.planSql(options);
+	}
+	emptyMigration(context, spaceId) {
+		return new TypeScriptRenderablePostgresMigration([], {
+			from: context.fromHash,
+			to: context.toHash
+		}, spaceId, this.#lowerer);
+	}
+	planSql(options) {
+		const schemaName = options.schemaName ?? Object.keys(options.contract.storage.namespaces).find((id) => id !== UNBOUND_NAMESPACE_ID) ?? UNBOUND_NAMESPACE_ID;
+		const policyResult = this.ensureAdditivePolicy(options.policy);
+		if (policyResult) return policyResult;
+		PostgresDatabaseSchemaNode.assert(options.schema);
+		const rawDiff = diffPostgresDatabaseSchema({
+			contract: options.contract,
+			actualSchema: options.schema,
+			strict: options.policy.allowedOperationClasses.includes("widening") || options.policy.allowedOperationClasses.includes("destructive"),
+			typeMetadataRegistry: /* @__PURE__ */ new Map(),
+			frameworkComponents: options.frameworkComponents
+		});
+		const databaseDiff = options.keepDiffIssue ? rawDiff.filter(options.keepDiffIssue) : rawDiff;
+		const schemaIssues = this.collectSchemaIssues(options, databaseDiff.issues);
+		const codecHooks = extractCodecControlHooks(options.frameworkComponents);
+		const storageTypes = options.contract.storage.types ?? {};
+		const relationalSchema = relationalNamespaceNode(options.schema, schemaName);
+		const issuePartition = partitionIssuesByControlPolicy({
+			issues: schemaIssues,
+			contract: options.contract,
+			resolveControlPolicySubject: (issue) => resolvePostgresIssueControlPolicySubject(issue, options.contract),
+			resolveCreationFactoryName: resolvePostgresIssueCreationFactoryName,
+			formatSubjectLabel: (factoryName, subject) => formatPostgresControlPolicySubjectLabel(factoryName, subject, options.contract)
+		});
+		const result = planIssues({
+			issues: issuePartition.plannable,
+			toContract: options.contract,
+			fromContract: options.fromContract,
+			schemaName,
+			codecHooks,
+			storageTypes,
+			...ifDefined("schema", relationalSchema),
+			policy: options.policy,
+			frameworkComponents: options.frameworkComponents,
+			strategies: postgresPlannerStrategies
+		});
+		if (!result.ok) return plannerFailure(result.failure);
+		const schemaDiffPartition = partitionCallsByControlPolicy({
+			calls: this.planPostgresSchemaDiff(options, databaseDiff.schemaDiffIssues),
+			contract: options.contract,
+			resolveControlPolicySubject: (call) => resolvePostgresCallControlPolicySubject(call, options.contract),
+			resolveFactoryName: (call) => call.factoryName,
+			formatSubjectLabel: (factoryName, subject) => formatPostgresControlPolicySubjectLabel(factoryName, subject, options.contract)
+		});
+		const fieldEventPartition = partitionCallsByControlPolicy({
+			calls: blindCast(planFieldEventOperations({
+				priorContract: options.fromContract,
+				newContract: options.contract,
+				codecHooks
+			})),
+			contract: options.contract,
+			resolveControlPolicySubject: (call) => resolvePostgresCallControlPolicySubject(call, options.contract),
+			resolveFactoryName: (call) => call.factoryName,
+			formatSubjectLabel: (factoryName, subject) => formatPostgresControlPolicySubjectLabel(factoryName, subject, options.contract)
+		});
+		const calls = [
+			...result.value.calls,
+			...schemaDiffPartition.kept,
+			...fieldEventPartition.kept
+		];
+		const warnings = [
+			...issuePartition.warnings,
+			...schemaDiffPartition.warnings,
+			...fieldEventPartition.warnings
+		];
+		return Object.freeze({
+			kind: "success",
+			plan: new TypeScriptRenderablePostgresMigration(calls, {
+				from: options.fromContract?.storage.storageHash ?? null,
+				to: options.contract.storage.storageHash
+			}, options.spaceId, this.#lowerer),
+			...warnings.length > 0 ? { warnings: Object.freeze(warnings) } : {}
+		});
+	}
+	/**
+	* Maps the RLS policy presence findings of the shared
+	* `diffPostgresDatabaseSchema` (already ownership-filtered) into
+	* `ENABLE RLS` / `CREATE POLICY` / `DROP POLICY` ops. It no longer re-diffs —
+	* it consumes the `schemaDiffIssues` of the one combined diff.
+	*/
+	planPostgresSchemaDiff(options, filteredDiffIssues) {
+		const allowsDestructive = options.policy.allowedOperationClasses.includes("destructive");
+		const calls = [];
+		const seenEnableTables = /* @__PURE__ */ new Set();
+		for (const issue of filteredDiffIssues) if (issue.outcome === "missing") {
+			const expected = issue.expected;
+			PostgresPolicySchemaNode.assert(expected);
+			const schemaForTable = resolveDdlSchemaForNamespaceStorage(options.contract.storage, expected.namespaceId);
+			const tableKey = `${schemaForTable}.${expected.tableName}`;
+			if (!seenEnableTables.has(tableKey)) {
+				seenEnableTables.add(tableKey);
+				calls.push(new EnableRowLevelSecurityCall(schemaForTable, expected.tableName));
+			}
+			calls.push(new CreatePostgresRlsPolicyCall(schemaForTable, expected.tableName, policyNodeToContractPolicy(expected)));
+		} else if (issue.outcome === "extra" && allowsDestructive) {
+			const actual = issue.actual;
+			PostgresPolicySchemaNode.assert(actual);
+			const schemaForTable = resolveDdlSchemaForNamespaceStorage(options.contract.storage, actual.namespaceId);
+			calls.push(new DropPostgresRlsPolicyCall(schemaForTable, actual.tableName, actual.name));
+		}
+		return calls;
+	}
+	ensureAdditivePolicy(policy) {
+		if (!policy.allowedOperationClasses.includes("additive")) return plannerFailure([{
+			kind: "unsupportedOperation",
+			summary: "Migration planner requires additive operations be allowed",
+			why: "The planner requires the \"additive\" operation class to be allowed in the policy."
+		}]);
+		return null;
+	}
+	/**
+	* The structural issue list `planIssues` consumes: the relational findings
+	* from the shared `diffPostgresDatabaseSchema` plus namespace presence.
+	*
+	* Schema presence (`missing_schema` → `CREATE SCHEMA`) is a planner-only
+	* op-generation concern, so it is stitched in here rather than inside the
+	* shared diff — verify never needs it (a missing schema already surfaces as
+	* `missing_table` in the relational findings). It reads `existingSchemas` off
+	* the database root, so it takes the whole tree. Policy drift is handled
+	* separately via `planPostgresSchemaDiff` from the same shared diff's
+	* `schemaDiffIssues`.
+	*/
+	collectSchemaIssues(options, relationalIssues) {
+		const namespaceIssues = verifyPostgresNamespacePresence({
+			contract: options.contract,
+			schema: options.schema
+		});
+		if (namespaceIssues.length === 0) return relationalIssues;
+		return [...namespaceIssues, ...relationalIssues];
+	}
+};
+/**
+* Returns the one namespace node whose tables the relational strategy layer
+* probes for live-table existence — the node matching the planner's resolved
+* schema name, or the first namespace when none matches. `undefined` when the
+* tree has no namespaces, so the strategy context uses its empty-schema default.
+*
+* The relational strategies key tables by bare name, so they can only probe one
+* namespace at a time; probing across every namespace at once is future work.
+*/
+function relationalNamespaceNode(schema, schemaName) {
+	const namespaceNodes = Object.values(schema.namespaces);
+	return namespaceNodes.find((node) => node.schemaName === schemaName) ?? namespaceNodes[0];
+}
+/**
+* Rebuilds the `PostgresRlsPolicy` contract entity `CreatePostgresRlsPolicyCall`
+* carries (its `renderTypeScript`/`createRlsPolicy` paths serialize the whole
+* entity, `namespaceId` included). This reconstructs rather than looking the
+* original up in the contract on purpose: the diff node's `namespaceId` is the
+* *resolved DDL schema* (set when the expected tree was built), which is the
+* value the emitted op must carry; the contract-stored entity holds the raw,
+* pre-resolution coordinate, so a lookup would change the migration output.
+*/
+function policyNodeToContractPolicy(node) {
+	return new PostgresRlsPolicy({
+		name: node.name,
+		prefix: node.prefix,
+		tableName: node.tableName,
+		namespaceId: node.namespaceId,
+		operation: node.operation,
+		roles: [...node.roles],
+		...ifDefined("using", node.using),
+		...ifDefined("withCheck", node.withCheck),
+		permissive: node.permissive
+	});
+}
+//#endregion
+export { contractToPostgresDatabaseSchemaNode as i, diffPostgresDatabaseSchema as n, verifyPostgresDatabaseSchema as r, createPostgresMigrationPlanner as t };
+
+//# sourceMappingURL=planner-CG2pLHk-.mjs.map