@prisma-next/target-postgres 0.14.0-dev.49 → 0.14.0-dev.50

package/src/core/migrations/planner.ts

@@ -19,24 +19,32 @@ import type {
   MigrationPlanWithAuthoringSurface,
   MigrationScaffoldContext,
   SchemaDiffIssue,
-  SchemaIssue,
+  SchemaOwnership,
 } from '@prisma-next/framework-components/control';
 import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
+import type { SqlStorage } from '@prisma-next/sql-contract/types';
 import type { SqlSchemaIR } from '@prisma-next/sql-schema-ir/types';
 import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { PostgresRlsPolicy } from '../postgres-rls-policy';
 import { PostgresDatabaseSchemaNode } from '../schema-ir/postgres-database-schema-node';
 import { PostgresPolicySchemaNode } from '../schema-ir/postgres-policy-schema-node';
-import type { SqlSchemaDiffNode } from '../schema-ir/schema-node-kinds';
+import { PostgresSchemaNodeKind, type SqlSchemaDiffNode } from '../schema-ir/schema-node-kinds';
 import {
   formatPostgresControlPolicySubjectLabel,
+  resolveNamespaceIdForDdlSchema,
   resolvePostgresCallControlPolicySubject,
-  resolvePostgresIssueControlPolicySubject,
-  resolvePostgresIssueCreationFactoryName,
+  resolvePostgresNodeIssueControlPolicySubject,
+  resolvePostgresNodeIssueCreationFactoryName,
 } from './control-policy';
-import { diffPostgresDatabaseSchema } from './diff-database-schema';
-import { planIssues } from './issue-planner';
+import { buildPostgresPlanDiff } from './diff-database-schema';
+import {
+  coalesceSubtreeIssues,
+  issueNode,
+  issueSchemaName,
+  issueTableName,
+  planIssues,
+} from './issue-planner';
 import type { PostgresOpFactoryCall } from './op-factory-call';
 import {
   CreatePostgresRlsPolicyCall,
@@ -82,18 +90,20 @@ export type PostgresPlanResult =
 /**
  * Postgres migration planner — a thin wrapper over `planIssues`.
  *
- * `plan()` verifies the live schema against the target contract (producing
- * `SchemaIssue[]`) and delegates to `planIssues` with the unified
- * `postgresPlannerStrategies` list: enum-change, NOT-NULL backfill,
- * type-change, nullable-tightening, codec-hook storage types,
- * component-declared dependency installs, and shared-temp-default /
- * empty-table-guarded NOT-NULL add-column. The same strategy list runs for
- * `migration plan`, `db update`, and `db init`; behavior diverges purely on
- * `policy.allowedOperationClasses` (the data-safe strategies short-circuit
- * when `'data'` is excluded). The issue planner applies operation-class
- * policy gates and emits a single `PostgresOpFactoryCall[]` that drives both
- * the runtime-ops view (via `renderOps`) and the `renderTypeScript()`
- * authoring surface.
+ * `plan()` diffs the target contract against the live schema via the one
+ * differ (`buildPostgresPlanDiff`, producing node-typed `SchemaDiffIssue[]`)
+ * and delegates to `planIssues` with the unified `postgresPlannerStrategies`
+ * list: NOT-NULL backfill, type-change, nullable-tightening, codec-hook
+ * storage types, component-declared dependency installs, and
+ * shared-temp-default / empty-table-guarded NOT-NULL add-column. The same
+ * strategy list runs for `migration plan`, `db update`, and `db init`;
+ * behavior diverges purely on `policy.allowedOperationClasses` (the
+ * data-safe strategies short-circuit when `'data'` is excluded). The issue
+ * planner applies operation-class policy gates and emits a single
+ * `PostgresOpFactoryCall[]` that drives both the runtime-ops view (via
+ * `renderOps`) and the `renderTypeScript()` authoring surface. RLS policy
+ * drift (the structural half of the same one-differ tree) is handled
+ * separately via `planPostgresSchemaDiff`.
  */
 export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgres'> {
   readonly #lowerer: ExecuteRequestLowerer | undefined;
@@ -129,6 +139,11 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
      * the marker row by the right space.
      */
     readonly spaceId: string;
+    /**
+     * Ownership oracle over the contract-space composition — see
+     * {@link SqlMigrationPlannerPlanOptions.ownership}.
+     */
+    readonly ownership?: SchemaOwnership;
   }): PostgresPlanResult {
     return this.planSql(options as SqlMigrationPlannerPlanOptions);
   }
@@ -158,25 +173,60 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
       return policyResult;
     }
 
-    // One combined database-schema diff drives the whole plan: the relational
-    // findings (+ namespace presence) become structural DDL via `planIssues`,
-    // the policy findings become RLS ops via `planPostgresSchemaDiff`. Verify
-    // runs the same underlying comparison (via `verifyDatabaseSchema`) and
-    // rejects on non-empty. The caller-supplied `keepDiffIssue` predicate is
-    // applied blindly — any scoping (e.g. multi-space ownership) is the
-    // orchestration's, never worked out here.
+    // The one combined tree diff drives the whole plan: relational findings
+    // become structural DDL via `planIssues`, policy findings become RLS ops
+    // via `planPostgresSchemaDiff`. Verify runs its own full-tree node diff
+    // (`diffSchema`) over the same schema and rejects on a
+    // surviving failure.
     PostgresDatabaseSchemaNode.assert(options.schema);
-    const rawDiff = diffPostgresDatabaseSchema({
+    const { issues: rawIssues } = buildPostgresPlanDiff({
       contract: options.contract,
       actualSchema: options.schema,
-      strict:
-        options.policy.allowedOperationClasses.includes('widening') ||
-        options.policy.allowedOperationClasses.includes('destructive'),
-      typeMetadataRegistry: new Map(),
       frameworkComponents: options.frameworkComponents,
     });
-    const databaseDiff = options.keepDiffIssue ? rawDiff.filter(options.keepDiffIssue) : rawDiff;
-    const schemaIssues = this.collectSchemaIssues(options, databaseDiff.issues);
+    const policyDiffIssues = rawIssues.filter((issue) => isPolicyDiffIssue(issue));
+    const relationalDiffIssues = rawIssues.filter((issue) => !isPolicyDiffIssue(issue));
+
+    // The generic differ is total and un-gated: strict-mode extras filtering
+    // (dropping `not-expected` findings outside strict mode, mirroring the
+    // retired coordinate walk's `if (strict) { ...extra_* } }` guards),
+    // subtree coalescing (a missing/extra table also emits an issue for
+    // every child under it — redundant once the table-level Create/Drop call
+    // already accounts for the whole subtree), and ownership are all post-diff
+    // planner steps.
+    //
+    // Ownership: a live extra is only this plan's to drop when no contract
+    // space owns it. The differ ran against THIS space's contract, so a table
+    // a sibling space owns surfaces here as `not-expected`; the planner asks
+    // the ownership oracle (the passive aggregate) whether any space declares
+    // it and, if so, leaves it alone — it is a sibling's table, not an orphan.
+    // A table no space owns stays a genuine extra to drop under a destructive
+    // policy. Ownership lives in the aggregate; the planner only asks. Absent
+    // oracle (single-space, none handed) keeps every extra. Coalescing MUST
+    // run before this so a sibling-owned table's child issues have already
+    // collapsed into the one table-level issue that carries the table name.
+    const strict =
+      options.policy.allowedOperationClasses.includes('widening') ||
+      options.policy.allowedOperationClasses.includes('destructive');
+    const coalesced = coalesceSubtreeIssues(relationalDiffIssues);
+    const owned = retainUnownedExtras(coalesced, options.ownership, options.contract);
+    const gated = strict ? owned : owned.filter((issue) => issue.reason !== 'not-expected');
+
+    // Namespace presence (`CREATE SCHEMA`) is a planner-only op-generation
+    // concern stitched in here rather than inside the shared diff — verify
+    // never needs it (a missing schema already surfaces as a `not-found`
+    // table in the relational findings). These synthesized issues are added
+    // AFTER coalescing/scoping (never coalesced against the table diff —
+    // their path is an ancestor of every table path under that schema, so
+    // running them through the same coalesce would swallow the table-level
+    // `not-found` issues that drive `CREATE TABLE`) and are NOT subject to
+    // sibling-space scoping, matching the retired coordinate walk exactly.
+    const namespaceIssues = verifyPostgresNamespacePresence({
+      contract: options.contract,
+      schema: options.schema,
+    });
+    const schemaIssues = [...namespaceIssues, ...gated];
+
     const codecHooks = extractCodecControlHooks(options.frameworkComponents);
     const storageTypes = options.contract.storage.types ?? {};
     // The strategy layer reads the live schema by bare table name for existence
@@ -197,8 +247,8 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
       issues: schemaIssues,
       contract: options.contract,
       resolveControlPolicySubject: (issue) =>
-        resolvePostgresIssueControlPolicySubject(issue, options.contract),
-      resolveCreationFactoryName: resolvePostgresIssueCreationFactoryName,
+        resolvePostgresNodeIssueControlPolicySubject(issue, options.contract),
+      resolveCreationFactoryName: resolvePostgresNodeIssueCreationFactoryName,
       formatSubjectLabel: (factoryName, subject) =>
         formatPostgresControlPolicySubjectLabel(factoryName, subject, options.contract),
     });
@@ -210,7 +260,7 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
       // `db update` / `db init`, which means data-safety strategies needing
       // from/to comparisons (unsafe type change, nullable tightening) are
       // inapplicable there — reconciliation falls through to
-      // `mapIssueToCall`'s direct destructive handlers.
+      // `mapNodeIssueToCall`'s direct destructive handlers.
       fromContract: options.fromContract,
       schemaName,
       codecHooks,
@@ -225,7 +275,7 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
       return plannerFailure(result.failure);
     }
 
-    const schemaDiffCalls = this.planPostgresSchemaDiff(options, databaseDiff.schemaDiffIssues);
+    const schemaDiffCalls = this.planPostgresSchemaDiff(options, policyDiffIssues);
     const schemaDiffPartition = partitionCallsByControlPolicy({
       calls: schemaDiffCalls,
       contract: options.contract,
@@ -284,10 +334,10 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
   }
 
   /**
-   * Maps the RLS policy presence findings of the shared
-   * `diffPostgresDatabaseSchema` (already ownership-filtered) into
-   * `ENABLE RLS` / `CREATE POLICY` / `DROP POLICY` ops. It no longer re-diffs —
-   * it consumes the `schemaDiffIssues` of the one combined diff.
+   * Maps the RLS policy presence findings of the one combined tree diff
+   * (`buildPostgresPlanDiff`, already ownership-filtered) into `ENABLE RLS`
+   * / `CREATE POLICY` / `DROP POLICY` ops. It does not re-diff — it consumes
+   * exactly the policy-node subset of the shared diff's issues.
    */
   private planPostgresSchemaDiff(
     options: PlannerOptionsWithComponents,
@@ -298,10 +348,10 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
     const seenEnableTables = new Set<string>();
 
     for (const issue of filteredDiffIssues) {
-      // 'mismatch' is unreachable for content-addressed policies: the wire name
+      // 'not-equal' is unreachable for content-addressed policies: the wire name
       // encodes the body hash, so two policies sharing a local key (same name)
       // are always equal and isEqualTo never returns false.
-      if (issue.outcome === 'missing') {
+      if (issue.reason === 'not-found') {
         const expected = issue.expected;
         PostgresPolicySchemaNode.assert(expected);
         // expected.namespaceId is the DDL schema name (resolved during projection);
@@ -322,7 +372,7 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
             policyNodeToContractPolicy(expected),
           ),
         );
-      } else if (issue.outcome === 'extra' && allowsDestructive) {
+      } else if (issue.reason === 'not-expected' && allowsDestructive) {
         const actual = issue.actual;
         PostgresPolicySchemaNode.assert(actual);
         const schemaForTable = resolveDdlSchemaForNamespaceStorage(
@@ -348,50 +398,106 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
     }
     return null;
   }
+}
 
-  /**
-   * The structural issue list `planIssues` consumes: the relational findings
-   * from the shared `diffPostgresDatabaseSchema` plus namespace presence.
-   *
-   * Schema presence (`missing_schema` → `CREATE SCHEMA`) is a planner-only
-   * op-generation concern, so it is stitched in here rather than inside the
-   * shared diff — verify never needs it (a missing schema already surfaces as
-   * `missing_table` in the relational findings). It reads `existingSchemas` off
-   * the database root, so it takes the whole tree. Policy drift is handled
-   * separately via `planPostgresSchemaDiff` from the same shared diff's
-   * `schemaDiffIssues`.
-   */
-  private collectSchemaIssues(
-    options: PlannerOptionsWithComponents,
-    relationalIssues: readonly SchemaIssue[],
-  ): readonly SchemaIssue[] {
-    const namespaceIssues = verifyPostgresNamespacePresence({
-      contract: options.contract,
-      schema: options.schema,
-    });
-    if (namespaceIssues.length === 0) {
-      return relationalIssues;
-    }
-    return [...namespaceIssues, ...relationalIssues];
-  }
+/**
+ * A diff issue whose node is an RLS policy — the structural half of the one
+ * combined tree diff, routed to `planPostgresSchemaDiff` instead of
+ * `planIssues`.
+ */
+function isPolicyDiffIssue(issue: SchemaDiffIssue<SqlSchemaDiffNode>): boolean {
+  const node = issue.expected ?? issue.actual;
+  return node !== undefined && PostgresPolicySchemaNode.is(node);
 }
 
 /**
- * Returns the one namespace node whose tables the relational strategy layer
- * probes for live-table existence — the node matching the planner's resolved
- * schema name, or the first namespace when none matches. `undefined` when the
- * tree has no namespaces, so the strategy context uses its empty-schema default.
+ * Drops a `not-expected` issue when it is a whole extra TABLE that some
+ * contract space owns, asking the ownership oracle per node.
+ *
+ * The consultation applies ONLY to table-level extras — a live table this
+ * space's contract lacks — identified by asking the issue's own node
+ * (`nodeKind === table`), never by counting path segments. `declaresEntity`
+ * answers over the whole composition (self included), keyed on the schema-IR
+ * entity coordinate so a genuine orphan in one namespace is never conflated
+ * with a same-named table a sibling space declares in another, or with a
+ * same-named non-table entity (an enum, an RLS policy) a sibling declares in
+ * the SAME namespace: a positive answer means another space owns THIS table
+ * in THIS namespace (a table this space owned would be in its expected tree,
+ * never an extra) — leave it. A negative answer means no space owns it — a
+ * genuine orphan to drop. `entityKind` is the literal `'table'` here: this
+ * function only ever asks about a node already confirmed to be
+ * `PostgresSchemaNodeKind.table` (checked just above), and the diff tree's
+ * `nodeKind` vocabulary (`'postgres-table'`) is distinct from the storage
+ * `entries` vocabulary `elementCoordinates` walks (`'table'`) — the literal
+ * is that storage-entries spelling, not the node kind.
+ *
+ * The issue path carries the *resolved DDL schema* (e.g. `public`), but a
+ * contract space's own declared namespace id can be the unbound sentinel
+ * (`__unbound__`) that resolves to that schema — the two spellings would
+ * never string-match. `resolveNamespaceIdForDdlSchema` recovers the raw
+ * namespace id THIS space's own contract would use for that DDL schema, so
+ * a table this space's own unbound namespace declares (and any sibling
+ * whose own unbound namespace resolves the same way) is compared on the
+ * same coordinate the aggregate's `elementCoordinates` walk yields.
+ *
+ * A DEEPER extra (an extra column/constraint on a table this space DOES own —
+ * only the child drifted, so the table is in the expected tree) is this
+ * space's own drift and is always kept for dropping; asking the oracle there
+ * would wrongly suppress it, because the owned table answers `true`. Shallower
+ * issues (namespace/root) are never ownership-scoped here. No oracle ⇒ every
+ * extra is kept (single-space plan).
+ */
+function retainUnownedExtras(
+  issues: readonly SchemaDiffIssue<SqlSchemaDiffNode>[],
+  ownership: SchemaOwnership | undefined,
+  contract: Contract<SqlStorage>,
+): readonly SchemaDiffIssue<SqlSchemaDiffNode>[] {
+  if (ownership === undefined) return issues;
+  return issues.filter((issue) => {
+    if (issue.reason !== 'not-expected') return true;
+    const node = issueNode(issue);
+    if (node === undefined || node.nodeKind !== PostgresSchemaNodeKind.table) return true;
+    const ddlSchemaName = issueSchemaName(issue);
+    const tableName = issueTableName(issue);
+    if (ddlSchemaName === undefined || tableName === undefined) return true;
+    const namespaceId = resolveNamespaceIdForDdlSchema(contract, ddlSchemaName);
+    return !ownership.declaresEntity({ namespaceId, entityKind: 'table', entityName: tableName });
+  });
+}
+
+/**
+ * Returns the one namespace node the relational strategy layer probes for
+ * live-table existence and reads codec-hook context off — the namespace
+ * matching the planner's resolved schema name, or the first namespace when
+ * none matches. `undefined` when the tree has no namespaces, so the strategy
+ * context uses its empty-schema default.
  *
  * The relational strategies key tables by bare name, so they can only probe one
  * namespace at a time; probing across every namespace at once is future work.
+ *
+ * Returns the real `PostgresNamespaceSchemaNode` reference rather than a
+ * projection: `storageTypePlanCallStrategy` hands this same value to codec
+ * `planTypeOperations` hooks as `schema`, and hooks read the Postgres-specific
+ * `nativeEnumTypeNames` field off it (via `PostgresNamespaceSchemaNode.is`) to
+ * decide whether a native enum type already exists — a projection that only
+ * copies `tables` would silently drop that signal. `StrategyContext.schema`'s
+ * declared type (`SqlSchemaIR`, shared with SQLite's flat shape) doesn't
+ * capture this, so the return is `blindCast` the same way `namespaceSchemaNodes`
+ * in the family's relational walk already treats a namespace node as a
+ * structurally-`SqlSchemaIR`-shaped value.
  */
 function relationalNamespaceNode(
   schema: PostgresDatabaseSchemaNode,
   schemaName: string,
 ): SqlSchemaIR | undefined {
   const namespaceNodes = Object.values(schema.namespaces);
-  const byName = namespaceNodes.find((node) => node.schemaName === schemaName);
-  return byName ?? namespaceNodes[0];
+  const namespaceNode =
+    namespaceNodes.find((node) => node.schemaName === schemaName) ?? namespaceNodes[0];
+  if (namespaceNode === undefined) return undefined;
+  return blindCast<
+    SqlSchemaIR,
+    'PostgresNamespaceSchemaNode carries tables (+ nativeEnumTypeNames, read by codec hooks via PostgresNamespaceSchemaNode.is) structurally compatible with the SqlSchemaIR shape the strategy layer declares'
+  >(namespaceNode);
 }
 
 /**

package/src/core/migrations/runner.ts

@@ -140,10 +140,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
         return runnerFailure('SCHEMA_VERIFY_FAILED', schemaVerifyResult.summary, {
           why: 'The resulting database schema does not satisfy the destination contract.',
           meta: {
-            issues: [
-              ...schemaVerifyResult.schema.issues,
-              ...schemaVerifyResult.schema.schemaDiffIssues,
-            ],
+            issues: schemaVerifyResult.schema.issues,
           },
         });
       }

package/src/core/migrations/verify-postgres-namespaces.ts

@@ -1,11 +1,13 @@
 import type { Contract } from '@prisma-next/contract/types';
-import type { SchemaIssue } from '@prisma-next/framework-components/control';
+import type { SchemaDiffIssue } from '@prisma-next/framework-components/control';
 import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
 import type { SqlStorage } from '@prisma-next/sql-contract/types';
 import type { SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
 import { DEFAULT_NAMESPACE_ID } from '../namespace-ids';
 import { isPostgresSchema } from '../postgres-schema';
 import { PostgresDatabaseSchemaNode } from '../schema-ir/postgres-database-schema-node';
+import { PostgresNamespaceSchemaNode } from '../schema-ir/postgres-namespace-schema-node';
+import type { SqlSchemaDiffNode } from '../schema-ir/schema-node-kinds';
 
 /**
  * Resolves the live-database schema name for a given namespace
@@ -48,12 +50,13 @@ function existingSchemasFromSchema(schema: SqlSchemaIRNode): readonly string[] {
 }
 
 /**
- * Emits a `missing_schema` issue for every contract-declared Postgres
- * namespace whose live container does not yet exist. The planner's
- * `collectSchemaIssues` prepends these to the relational findings so a
- * multi-schema plan emits `CREATE SCHEMA` before the tables that need it —
- * a planner-only concern (verify already rejects via the `missing_table` a
- * missing schema produces), so this is not part of the shared diff.
+ * Emits a `postgres-namespace` `not-found` diff issue for every
+ * contract-declared Postgres namespace whose live container does not yet
+ * exist. The planner prepends these (node-typed, synthesized) to the
+ * relational diff issues so a multi-schema plan emits `CREATE SCHEMA`
+ * before the tables that need it — a planner-only concern (verify already
+ * rejects via the `not-found` table issues a missing schema already
+ * produces), so this is not part of the shared diff.
  *
  * A namespace's live container is the schema returned by its
  * polymorphic `ddlSchemaName(storage)` method — named schemas resolve
@@ -64,29 +67,37 @@ function existingSchemasFromSchema(schema: SqlSchemaIRNode): readonly string[] {
  * introspected list. `public` is suppressed implicitly because the
  * introspection (or its sensible default) always carries it.
  *
- * Each emitted issue stamps `namespaceId` with the contract namespace
- * coordinate so the downstream `mapIssueToCall` re-resolves the DDL
- * schema name through the same polymorphic path — keeping the
- * coordinate, not the resolved name, as the issue's stable identity.
+ * Each emitted issue's path is `['database', ddlName]` — an ancestor of
+ * every table path under that schema, so it must never be run through
+ * `coalesceSubtreeIssues` alongside the table diff (it would swallow the
+ * table-level `not-found` issues that drive `CREATE TABLE`); the planner
+ * adds these AFTER coalescing the relational issues, and they are not
+ * subject to sibling-space ownership scoping (mirrors the retired
+ * coordinate walk, which prepended namespace issues after that filter).
  */
 export function verifyPostgresNamespacePresence(input: {
   readonly contract: Contract<SqlStorage>;
   readonly schema: SqlSchemaIRNode;
-}): readonly SchemaIssue[] {
+}): readonly SchemaDiffIssue<SqlSchemaDiffNode>[] {
   const { contract, schema } = input;
   const existing = new Set(existingSchemasFromSchema(schema));
-  const issues: SchemaIssue[] = [];
+  const issues: SchemaDiffIssue<SqlSchemaDiffNode>[] = [];
   const namespaceIds = Object.keys(contract.storage.namespaces).sort();
   for (const namespaceId of namespaceIds) {
     if (namespaceId === UNBOUND_NAMESPACE_ID) continue;
     const ddlName = resolveDdlSchemaName(contract.storage, namespaceId);
     if (ddlName === UNBOUND_NAMESPACE_ID) continue;
     if (existing.has(ddlName)) continue;
+    const namespace = new PostgresNamespaceSchemaNode({
+      schemaName: ddlName,
+      tables: {},
+      nativeEnumTypeNames: [],
+    });
     issues.push({
-      kind: 'missing_schema',
+      path: ['database', ddlName],
       reason: 'not-found',
-      namespaceId,
       message: `Schema "${ddlName}" is missing from database`,
+      expected: namespace,
     });
   }
   return issues;

package/src/core/postgres-schema-verifier.ts

@@ -1,16 +1,19 @@
 import type { Contract } from '@prisma-next/contract/types';
 import { SqlSchemaVerifierBase } from '@prisma-next/family-sql/ir';
-import type { SchemaIssue, SchemaVerifyOptions } from '@prisma-next/framework-components/control';
+import type {
+  SchemaDiffIssue,
+  SchemaVerifyOptions,
+} from '@prisma-next/framework-components/control';
 import type { SqlStorage } from '@prisma-next/sql-contract/types';
 import type { SqlSchemaIR } from '@prisma-next/sql-schema-ir/types';
 
 /**
  * Postgres target `SchemaVerifier` concretion. Plugs into the
  * SQL-shared verification surface; production verification today still
- * routes through the legacy `verifySqlSchema` entry point, which
- * carries options (codec hooks, normalizers, framework components)
- * that the framework-level `SchemaVerifyOptions` shape does not yet
- * surface.
+ * routes through the family verify verdict (`verifySqlSchemaByDiff` over
+ * `diffPostgresSchema`), which carries options (codec hooks,
+ * normalizers, framework components) that the framework-level
+ * `SchemaVerifyOptions` shape does not yet surface.
  *
  * The hooks return the empty list pending the call-site migration that
  * routes the existing verifier behaviour through the SPI — at that
@@ -25,13 +28,13 @@ export class PostgresSchemaVerifier extends SqlSchemaVerifierBase<
 > {
   protected verifyCommonSqlSchema(
     _options: SchemaVerifyOptions<Contract<SqlStorage>, SqlSchemaIR>,
-  ): readonly SchemaIssue[] {
+  ): readonly SchemaDiffIssue[] {
     return [];
   }
 
   protected verifyTargetExtensions(
     _options: SchemaVerifyOptions<Contract<SqlStorage>, SqlSchemaIR>,
-  ): readonly SchemaIssue[] {
+  ): readonly SchemaDiffIssue[] {
     return [];
   }
 }

package/src/core/psl-infer/infer-psl-contract.ts

@@ -36,12 +36,8 @@ import {
   UNSPECIFIED_PSL_NAMESPACE_ID,
 } from '@prisma-next/framework-components/psl-ast';
 import type { SqlModelStorage } from '@prisma-next/sql-contract/types';
-import type {
-  SqlColumnIR,
-  SqlForeignKeyIR,
-  SqlSchemaIR,
-  SqlTableIR,
-} from '@prisma-next/sql-schema-ir/types';
+import type { SqlColumnIR, SqlForeignKeyIR } from '@prisma-next/sql-schema-ir/types';
+import { SqlSchemaIR, SqlTableIR } from '@prisma-next/sql-schema-ir/types';
 import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import type { PostgresDatabaseSchemaNode } from '../schema-ir/postgres-database-schema-node';
@@ -255,7 +251,7 @@ function resolveForeignKeys(
     resultTables[tableName] =
       keptForeignKeys.length === table.foreignKeys.length
         ? table
-        : { ...table, foreignKeys: keptForeignKeys };
+        : new SqlTableIR({ ...table, foreignKeys: keptForeignKeys });
   }
 
   return { tables: resultTables, extraRelationsByTable, crossSpaceFieldNamesByTable };
@@ -335,16 +331,15 @@ export function inferPostgresPslContract(
             'output is a later slice).',
         );
       }
-      tables[tableName] = table;
+      tables[tableName] = new SqlTableIR(table);
     }
   }
-
   const {
     tables: resolvedTables,
     extraRelationsByTable,
     crossSpaceFieldNamesByTable,
   } = resolveForeignKeys(tables, owners);
-  const schemaIR: SqlSchemaIR = { tables: resolvedTables };
+  const schemaIR = new SqlSchemaIR({ tables: resolvedTables });
 
   const options: PslPrinterOptions = {
     typeMap: createPostgresTypeMap(new Set()),

package/src/core/schema-ir/postgres-database-schema-node.ts

@@ -1,6 +1,6 @@
 import type { DiffableNode } from '@prisma-next/framework-components/control';
 import { freezeNode } from '@prisma-next/framework-components/ir';
-import { SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
+import { assertNode, SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
 import type { PostgresNamespaceSchemaNode } from './postgres-namespace-schema-node';
 import type { PostgresRoleSchemaNode } from './postgres-role-schema-node';
 import { PostgresSchemaNodeKind } from './schema-node-kinds';
@@ -23,6 +23,7 @@ export interface PostgresDatabaseSchemaNodeInput {
  */
 export class PostgresDatabaseSchemaNode extends SqlSchemaIRNode implements DiffableNode {
   override readonly nodeKind = PostgresSchemaNodeKind.database;
+
   readonly namespaces: Readonly<Record<string, PostgresNamespaceSchemaNode>>;
   readonly roles: readonly PostgresRoleSchemaNode[];
   readonly existingSchemas: readonly string[];
@@ -54,10 +55,6 @@ export class PostgresDatabaseSchemaNode extends SqlSchemaIRNode implements Diffa
   }
 
   static assert(node: SqlSchemaIRNode): asserts node is PostgresDatabaseSchemaNode {
-    if (!PostgresDatabaseSchemaNode.is(node)) {
-      throw new Error(
-        `Expected a PostgresDatabaseSchemaNode but got nodeKind=${node.nodeKind ?? 'undefined'}`,
-      );
-    }
+    assertNode(node, 'PostgresDatabaseSchemaNode', PostgresDatabaseSchemaNode.is);
   }
 }

package/src/core/schema-ir/postgres-namespace-schema-node.ts

@@ -1,6 +1,6 @@
 import type { DiffableNode } from '@prisma-next/framework-components/control';
 import { freezeNode } from '@prisma-next/framework-components/ir';
-import { SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
+import { assertNode, SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
 import type { PostgresTableSchemaNode } from './postgres-table-schema-node';
 import { PostgresSchemaNodeKind } from './schema-node-kinds';
 
@@ -12,9 +12,11 @@ export interface PostgresNamespaceSchemaNodeInput {
 
 /**
  * One-per-Postgres-schema diff-tree node. Groups the tables belonging to a
- * single namespace and satisfies the `SqlSchemaIR` shape so legacy per-schema
- * consumers (verifySqlSchema, the relational planner, toSchemaView) can
- * accept it unchanged in Unit 6.
+ * single namespace. Per-schema consumers (the relational planner,
+ * toSchemaView) read this node's `tables` field structurally via
+ * `blindCast`/`SqlSchemaIRNode` — not through a static `SqlSchemaIR`
+ * assignment — because `nodeKind` now carries this node's own literal
+ * (`postgres-namespace`), distinct from `SqlSchemaIR`'s own (`sql-schema`).
  *
  * `id` is the schema name. `isEqualTo` is identity — two namespace nodes are
  * equal iff their ids (schema names) match. `children()` returns the table
@@ -23,6 +25,7 @@ export interface PostgresNamespaceSchemaNodeInput {
  */
 export class PostgresNamespaceSchemaNode extends SqlSchemaIRNode implements DiffableNode {
   override readonly nodeKind = PostgresSchemaNodeKind.namespace;
+
   readonly schemaName: string;
   readonly tables: Readonly<Record<string, PostgresTableSchemaNode>>;
   readonly nativeEnumTypeNames: readonly string[];
@@ -52,10 +55,6 @@ export class PostgresNamespaceSchemaNode extends SqlSchemaIRNode implements Diff
   }
 
   static assert(node: SqlSchemaIRNode): asserts node is PostgresNamespaceSchemaNode {
-    if (!PostgresNamespaceSchemaNode.is(node)) {
-      throw new Error(
-        `Expected a PostgresNamespaceSchemaNode but got nodeKind=${node.nodeKind ?? 'undefined'}`,
-      );
-    }
+    assertNode(node, 'PostgresNamespaceSchemaNode', PostgresNamespaceSchemaNode.is);
   }
 }

package/src/core/schema-ir/postgres-policy-schema-node.ts

@@ -1,6 +1,6 @@
 import type { DiffableNode } from '@prisma-next/framework-components/control';
 import { freezeNode } from '@prisma-next/framework-components/ir';
-import { SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
+import { assertNode, SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
 import { blindCast } from '@prisma-next/utils/casts';
 import type { RlsPolicyOperation } from '../postgres-rls-policy';
 import { PostgresSchemaNodeKind } from './schema-node-kinds';
@@ -38,6 +38,7 @@ export interface PostgresPolicySchemaNodeInput {
  */
 export class PostgresPolicySchemaNode extends SqlSchemaIRNode implements DiffableNode {
   override readonly nodeKind = PostgresSchemaNodeKind.policy;
+
   readonly name: string;
   readonly prefix: string;
   readonly tableName: string;
@@ -84,10 +85,6 @@ export class PostgresPolicySchemaNode extends SqlSchemaIRNode implements Diffabl
   }
 
   static assert(node: SqlSchemaIRNode | undefined): asserts node is PostgresPolicySchemaNode {
-    if (node === undefined || !PostgresPolicySchemaNode.is(node)) {
-      throw new Error(
-        `Expected a PostgresPolicySchemaNode but got nodeKind=${node?.nodeKind ?? 'undefined'}`,
-      );
-    }
+    assertNode(node, 'PostgresPolicySchemaNode', PostgresPolicySchemaNode.is);
   }
 }