@prisma-next/target-postgres 0.14.0-dev.54 → 0.14.0-dev.56

package/src/core/migrations/contract-to-postgres-database-schema-node.ts

@@ -117,6 +117,9 @@ export function contractToPostgresDatabaseSchemaNode(
         ...ifDefined('annotations', sqlTable.annotations),
         ...ifDefined('checks', sqlTable.checks),
         policies: policiesByTable.get(tableName) ?? [],
+        // Marker-driven, never derived from the policy set: the `rls` entry
+        // is the single authored source of enablement.
+        rlsEnabled: Object.hasOwn(ns.rls, tableName),
       });
     }
 
@@ -127,6 +130,12 @@ export function contractToPostgresDatabaseSchemaNode(
           `contract-to-postgres-database-schema-node: policy "${policyName}" references table "${tableName}" not present in namespace "${ddlSchema}"`,
         );
       }
+      if (!Object.hasOwn(ns.rls, tableName)) {
+        const policyPrefix = tablePolicies[0]?.prefix ?? '(unknown)';
+        throw new Error(
+          `contract-to-postgres-database-schema-node: policy "${policyPrefix}" targets table "${tableName}" in namespace "${ddlSchema}", which is not RLS-controlled. Mark the model with @@rls (entries.rls["${tableName}"]) or remove the policy.`,
+        );
+      }
     }
 
     namespaces[ddlSchema] = new PostgresNamespaceSchemaNode({

package/src/core/migrations/control-policy.ts

@@ -7,6 +7,7 @@ import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { isPostgresSchema } from '../postgres-schema';
 import type { PostgresNamespaceSchemaNode } from '../schema-ir/postgres-namespace-schema-node';
+import { PostgresTableSchemaNode } from '../schema-ir/postgres-table-schema-node';
 import type { SqlSchemaDiffNode } from '../schema-ir/schema-node-kinds';
 import { PostgresSchemaNodeKind } from '../schema-ir/schema-node-kinds';
 import { issueColumnName } from './issue-planner';
@@ -163,9 +164,37 @@ const POSTGRES_NODE_CREATION_FACTORY: Readonly<Record<string, string>> = Object.
   [PostgresSchemaNodeKind.table]: 'createTable',
 });
 
+/**
+ * A table `not-equal` issue whose `rlsEnabled` flips OFF→ON (expected on,
+ * actual off) is enablement toward `ENABLE ROW LEVEL SECURITY` —
+ * creation-class per `OBJECT_CREATION_FACTORIES` ('enableRowLevelSecurity'
+ * is a member): enabling RLS establishes the fail-closed guard the declared
+ * policy set attaches to, the same grant `tolerated` extends to creating the
+ * policies themselves. The opposite direction (`DISABLE`) is a modification
+ * and stays managed-only. Keying on the actual delta (not just the expected
+ * bit) keeps this correct if a second table attribute ever joins
+ * `isEqualTo`: a not-equal with no `rlsEnabled` delta is not enablement, so
+ * it is not admitted as creation-class here.
+ */
+function isEnablementCreationIssue(issue: SchemaDiffIssue<SqlSchemaDiffNode>): boolean {
+  if (issue.reason !== 'not-equal') return false;
+  const { expected, actual } = issue;
+  return (
+    expected !== undefined &&
+    actual !== undefined &&
+    PostgresTableSchemaNode.is(expected) &&
+    PostgresTableSchemaNode.is(actual) &&
+    expected.rlsEnabled === true &&
+    actual.rlsEnabled === false
+  );
+}
+
 export function resolvePostgresNodeIssueCreationFactoryName(
   issue: SchemaDiffIssue<SqlSchemaDiffNode>,
 ): string | undefined {
+  if (isEnablementCreationIssue(issue)) {
+    return 'enableRowLevelSecurity';
+  }
   if (issue.reason !== 'not-found') return undefined;
   const node = issue.expected ?? issue.actual;
   if (node === undefined) return undefined;
@@ -215,7 +244,8 @@ export function resolvePostgresNodeIssueControlPolicySubject(
     entityName: tableName,
   });
   const createsNewObject =
-    node.nodeKind === PostgresSchemaNodeKind.table && issue.reason === 'not-found';
+    (node.nodeKind === PostgresSchemaNodeKind.table && issue.reason === 'not-found') ||
+    isEnablementCreationIssue(issue);
 
   return {
     namespaceId,

package/src/core/migrations/diff-database-schema.ts

@@ -70,6 +70,7 @@ export function normalizePostgresActualForDiff(
         ...ifDefined('annotations', actualTable.annotations),
         ...ifDefined('checks', actualTable.checks),
         policies: [...actualTable.policies],
+        rlsEnabled: actualTable.rlsEnabled,
       });
     }
     namespaces[nsId] = new PostgresNamespaceSchemaNode({

package/src/core/migrations/issue-planner.ts

@@ -63,6 +63,7 @@ import {
   CreateIndexCall,
   CreateSchemaCall,
   CreateTableCall,
+  DisableRowLevelSecurityCall,
   DropCheckConstraintCall,
   DropColumnCall,
   DropConstraintCall,
@@ -70,6 +71,7 @@ import {
   DropIndexCall,
   DropNotNullCall,
   DropTableCall,
+  EnableRowLevelSecurityCall,
   type PostgresOpFactoryCall,
   SetDefaultCall,
   SetNotNullCall,
@@ -163,6 +165,7 @@ function classifyCall(call: PostgresOpFactoryCall): CallCategory {
     case 'createTable':
       return 'table';
     case 'enableRowLevelSecurity':
+    case 'disableRowLevelSecurity':
       return 'rlsEnable';
     case 'createRlsPolicy':
       return 'rlsPolicy';
@@ -465,6 +468,7 @@ function fkSpecFromNode(fk: SqlForeignKeyIR, tableName: string): ForeignKeySpec
  */
 function buildCreateTableCallsFromNode(
   schemaName: string,
+  ddlSchemaName: string,
   table: PostgresTableSchemaNode,
   codecHooks: ReadonlyMap<string, CodecControlHooks>,
 ): PostgresOpFactoryCall[] {
@@ -509,6 +513,13 @@ function buildCreateTableCallsFromNode(
     const constraintName = unique.name ?? `${table.name}_${unique.columns.join('_')}_key`;
     calls.push(new AddUniqueCall(schemaName, table.name, constraintName, [...unique.columns]));
   }
+  // Marker-driven: a newly-created table that is RLS-controlled enables RLS
+  // as part of its creation bundle. The policy set never decides this. The
+  // resolved schema (not the emission sentinel) binds into the op's
+  // relrowsecurity checks.
+  if (table.rlsEnabled) {
+    calls.push(new EnableRowLevelSecurityCall(ddlSchemaName, table.name));
+  }
   return calls;
 }
 
@@ -519,6 +530,11 @@ function nodeConflict(kind: SqlPlannerConflict['kind'], message: string): SqlPla
 function mapTableNodeIssue(
   issue: SchemaDiffIssue,
   schemaName: string,
+  // The diff tree's RESOLVED physical schema. Enablement ops bind it into
+  // their `pg_class`/`pg_namespace` checks (the emission sentinel would
+  // never match a live nspname), mirroring the schema the retired
+  // policy-half enable resolved via `resolveDdlSchemaForNamespaceStorage`.
+  ddlSchemaName: string,
   codecHooks: ReadonlyMap<string, CodecControlHooks>,
 ): Result<readonly PostgresOpFactoryCall[], SqlPlannerConflict> {
   if (issue.reason === 'not-found') {
@@ -526,7 +542,7 @@ function mapTableNodeIssue(
       PostgresTableSchemaNode,
       'a not-found table issue always carries the expected PostgresTableSchemaNode'
     >(issue.expected);
-    return ok(buildCreateTableCallsFromNode(schemaName, table, codecHooks));
+    return ok(buildCreateTableCallsFromNode(schemaName, ddlSchemaName, table, codecHooks));
   }
   if (issue.reason === 'not-expected') {
     const table = blindCast<
@@ -535,8 +551,33 @@ function mapTableNodeIssue(
     >(issue.actual);
     return ok([new DropTableCall(schemaName, table.name)]);
   }
-  // Unreachable: PostgresTableSchemaNode.isEqualTo is identity.
-  return notOk(nodeConflict('unsupportedOperation', `Unexpected table drift: ${issue.message}`));
+  // A paired table `not-equal` means enablement drift TODAY, because
+  // `isEqualTo` compares only name + `rlsEnabled`. Key on the actual
+  // expected-vs-actual `rlsEnabled` delta rather than assuming it: emit ENABLE
+  // when it flipped on, DISABLE when it flipped off, and fail loud when
+  // `rlsEnabled` matches on both sides — that means a second table attribute
+  // drifted into `isEqualTo` and this mapper does not yet handle it. The
+  // expected side is authoritative (marker-driven, never the policy set).
+  const expected = blindCast<
+    PostgresTableSchemaNode,
+    'a not-equal table issue always carries the expected PostgresTableSchemaNode'
+  >(issue.expected);
+  const actual = blindCast<
+    PostgresTableSchemaNode,
+    'a not-equal table issue always carries the actual PostgresTableSchemaNode'
+  >(issue.actual);
+  if (expected.rlsEnabled && !actual.rlsEnabled) {
+    return ok([new EnableRowLevelSecurityCall(ddlSchemaName, expected.name)]);
+  }
+  if (!expected.rlsEnabled && actual.rlsEnabled) {
+    return ok([new DisableRowLevelSecurityCall(ddlSchemaName, expected.name)]);
+  }
+  return notOk(
+    nodeConflict(
+      'unsupportedOperation',
+      `unhandled table-attribute drift on "${expected.name}": table not-equal with no rlsEnabled delta (a second table attribute drifted)`,
+    ),
+  );
 }
 
 function mapColumnNodeIssue(
@@ -787,7 +828,7 @@ export function mapNodeIssueToCall(
 
   switch (node.nodeKind) {
     case PostgresSchemaNodeKind.table:
-      return mapTableNodeIssue(issue, schemaName, ctx.codecHooks);
+      return mapTableNodeIssue(issue, schemaName, ddlSchemaName, ctx.codecHooks);
     case RelationalSchemaNodeKind.column:
       return mapColumnNodeIssue(issue, schemaName, tableName, ctx.codecHooks);
     case RelationalSchemaNodeKind.columnDefault: {
@@ -952,6 +993,10 @@ export function planIssues(
     ...byCategory('unique'),
     ...byCategory('index'),
     ...byCategory('foreignKey'),
+    // Enablement changes run after all relational DDL (the table must exist)
+    // and before the policy calls the planner appends after `planIssues` —
+    // the same position the retired imperative enable-on-first-policy used.
+    ...byCategory('rlsEnable'),
   ];
 
   return ok({ calls });

package/src/core/migrations/op-factory-call.ts

@@ -63,7 +63,13 @@ import {
 } from './operations/constraints';
 import { createExtension } from './operations/dependencies';
 import { createIndex, dropIndex } from './operations/indexes';
-import { createRlsPolicy, dropRlsPolicy, enableRowLevelSecurity } from './operations/rls';
+import {
+  createRlsPolicy,
+  disableRowLevelSecurity,
+  dropRlsPolicy,
+  enableRowLevelSecurity,
+  renameRlsPolicy,
+} from './operations/rls';
 import type { ForeignKeySpec } from './operations/shared';
 import { step, targetDetails } from './operations/shared';
 import { dropTable } from './operations/tables';
@@ -1461,6 +1467,78 @@ export class EnableRowLevelSecurityCall extends PostgresOpFactoryCallNode {
   }
 }
 
+export class DisableRowLevelSecurityCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'disableRowLevelSecurity' as const;
+  readonly operationClass = 'destructive' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.label = `Disable row-level security on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `DisableRowLevelSecurityCall.toOp: a lowerer is required on the Postgres planner path (table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return disableRowLevelSecurity(this.schemaName, this.tableName, lowerer);
+  }
+
+  renderTypeScript(): string {
+    return `disableRowLevelSecurity(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)})`;
+  }
+}
+
+export class RenamePostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
+  readonly factoryName = 'renameRlsPolicy' as const;
+  // `widening` is chosen so the rename plans under every allowance set except
+  // additive-only init — a rename is neither additive-creation nor
+  // destructive, and the class vocabulary has no neutral middle class. It is
+  // NOT that a rename widens anything; this is the accepted typology tradeoff.
+  readonly operationClass = 'widening' as const;
+  readonly schemaName: string;
+  readonly tableName: string;
+  readonly oldPolicyName: string;
+  readonly newPolicyName: string;
+  readonly label: string;
+
+  constructor(schemaName: string, tableName: string, oldPolicyName: string, newPolicyName: string) {
+    super();
+    this.schemaName = schemaName;
+    this.tableName = tableName;
+    this.oldPolicyName = oldPolicyName;
+    this.newPolicyName = newPolicyName;
+    this.label = `Rename RLS policy "${oldPolicyName}" to "${newPolicyName}" on "${tableName}"`;
+    this.freeze();
+  }
+
+  async toOp(lowerer?: ExecuteRequestLowerer): Promise<Op> {
+    if (lowerer === undefined) {
+      throw new Error(
+        `RenamePostgresRlsPolicyCall.toOp: a lowerer is required on the Postgres planner path (policy "${this.oldPolicyName}" on table "${this.tableName}"). Pass the control adapter to createPostgresMigrationPlanner.`,
+      );
+    }
+    return renameRlsPolicy(
+      this.schemaName,
+      this.tableName,
+      this.oldPolicyName,
+      this.newPolicyName,
+      lowerer,
+    );
+  }
+
+  renderTypeScript(): string {
+    return `renameRlsPolicy(${jsonToTsSource(this.schemaName)}, ${jsonToTsSource(this.tableName)}, ${jsonToTsSource(this.oldPolicyName)}, ${jsonToTsSource(this.newPolicyName)})`;
+  }
+}
+
 export type PostgresOpFactoryCall =
   | CreateTableCall
   | DropTableCall
@@ -1487,4 +1565,6 @@ export type PostgresOpFactoryCall =
   | CreatePostgresRlsPolicyCall
   | DropPostgresRlsPolicyCall
   | EnableRowLevelSecurityCall
+  | DisableRowLevelSecurityCall
+  | RenamePostgresRlsPolicyCall
   | DataTransformCall;

package/src/core/migrations/operations/rls.ts

@@ -1,7 +1,12 @@
 import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { rlsEnabledAst, rlsPolicyExistsAst } from '../../../contract-free/checks';
-import { createPolicy, dropPolicy } from '../../../contract-free/ddl';
+import {
+  alterPolicyRename,
+  createPolicy,
+  disableRowLevelSecurity as disableRowLevelSecurityDdl,
+  dropPolicy,
+} from '../../../contract-free/ddl';
 import type { PostgresRlsPolicy } from '../../postgres-rls-policy';
 import { qualifyTableName } from '../planner-sql-checks';
 import { type Op, step, targetDetails } from './shared';
@@ -104,3 +109,79 @@ export async function enableRowLevelSecurity(
     ],
   };
 }
+
+export async function disableRowLevelSecurity(
+  schemaName: string,
+  tableName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = disableRowLevelSecurityDdl({ schema: schemaName, table: tableName });
+  const checks = rlsEnabledAst(schemaName, tableName);
+  const enabled = await lowerer.lowerToExecuteRequest(checks.rlsEnabled());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const disabled = await lowerer.lowerToExecuteRequest(checks.rlsDisabled());
+  return {
+    id: `rowLevelSecurity.${schemaName}.${tableName}.disable`,
+    label: `Disable row-level security on "${tableName}"`,
+    operationClass: 'destructive',
+    target: targetDetails('rowLevelSecurity', tableName, schemaName),
+    precheck: [
+      step(`check RLS is currently enabled on "${tableName}"`, enabled.sql, enabled.params),
+    ],
+    execute: [step(`disable row-level security on "${tableName}"`, execute.sql, execute.params)],
+    postcheck: [
+      step(
+        `verify row-level security is disabled on "${tableName}"`,
+        disabled.sql,
+        disabled.params,
+      ),
+    ],
+  };
+}
+
+export async function renameRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  oldPolicyName: string,
+  newPolicyName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = alterPolicyRename({
+    schema: schemaName,
+    table: tableName,
+    name: oldPolicyName,
+    newName: newPolicyName,
+  });
+  const oldChecks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: oldPolicyName,
+  });
+  const newChecks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: newPolicyName,
+  });
+  const oldPresent = await lowerer.lowerToExecuteRequest(oldChecks.policyPresent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const newPresent = await lowerer.lowerToExecuteRequest(newChecks.policyPresent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${oldPolicyName}.rename`,
+    label: `Rename RLS policy "${oldPolicyName}" to "${newPolicyName}" on "${tableName}"`,
+    operationClass: 'widening',
+    target: targetDetails('rlsPolicy', newPolicyName, schemaName, tableName),
+    precheck: [
+      step(`ensure RLS policy "${oldPolicyName}" exists`, oldPresent.sql, oldPresent.params),
+    ],
+    execute: [
+      step(
+        `rename RLS policy "${oldPolicyName}" to "${newPolicyName}"`,
+        execute.sql,
+        execute.params,
+      ),
+    ],
+    postcheck: [
+      step(`verify RLS policy "${newPolicyName}" exists`, newPresent.sql, newPresent.params),
+    ],
+  };
+}

package/src/core/migrations/planner.ts

@@ -27,6 +27,7 @@ import type { SqlSchemaIR } from '@prisma-next/sql-schema-ir/types';
 import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { PostgresRlsPolicy } from '../postgres-rls-policy';
+import { parseRlsPolicyWireName } from '../rls/wire-name';
 import { PostgresDatabaseSchemaNode } from '../schema-ir/postgres-database-schema-node';
 import { PostgresPolicySchemaNode } from '../schema-ir/postgres-policy-schema-node';
 import { PostgresSchemaNodeKind, type SqlSchemaDiffNode } from '../schema-ir/schema-node-kinds';
@@ -49,7 +50,7 @@ import type { PostgresOpFactoryCall } from './op-factory-call';
 import {
   CreatePostgresRlsPolicyCall,
   DropPostgresRlsPolicyCall,
-  EnableRowLevelSecurityCall,
+  RenamePostgresRlsPolicyCall,
 } from './op-factory-call';
 import { TypeScriptRenderablePostgresMigration } from './planner-produced-postgres-migration';
 import { postgresPlannerStrategies } from './planner-strategies';
@@ -335,17 +336,40 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
 
   /**
    * Maps the RLS policy presence findings of the one combined tree diff
-   * (`buildPostgresPlanDiff`, already ownership-filtered) into `ENABLE RLS`
-   * / `CREATE POLICY` / `DROP POLICY` ops. It does not re-diff — it consumes
-   * exactly the policy-node subset of the shared diff's issues.
+   * (`buildPostgresPlanDiff`, already ownership-filtered) into
+   * `CREATE POLICY` / `DROP POLICY` / `ALTER POLICY … RENAME TO` ops. It
+   * does not re-diff — it consumes exactly the policy-node subset of the
+   * shared diff's issues. Enablement is NOT decided here: `ENABLE`/`DISABLE
+   * ROW LEVEL SECURITY` derive from the table's marker-driven `rlsEnabled`
+   * attribute diff on the relational side.
+   *
+   * Rename post-pass: a `not-found` and a `not-expected` policy on the SAME
+   * table whose wire-name content hashes match but prefixes differ are one
+   * prefix-only rename, collapsed into a single non-destructive
+   * `RenamePostgresRlsPolicyCall`. Multi-candidate hash groups pair
+   * deterministically by sorted wire name; leftovers proceed as
+   * create/drop. Unparseable wire names never pair.
+   *
+   * The pairing runs only when the policy allows `widening` (rename's
+   * class). Without it (db-init's additive-only set), pairing degrades
+   * deliberately to the additive half: the new name is CREATEd and the old
+   * policy survives live until a widening/destructive-allowed plan runs —
+   * emitting an ungated widening rename would only fail at the runner's
+   * class re-enforcement.
    */
   private planPostgresSchemaDiff(
     options: PlannerOptionsWithComponents,
     filteredDiffIssues: readonly SchemaDiffIssue<SqlSchemaDiffNode>[],
   ): readonly PostgresOpFactoryCall[] {
     const allowsDestructive = options.policy.allowedOperationClasses.includes('destructive');
-    const calls: PostgresOpFactoryCall[] = [];
-    const seenEnableTables = new Set<string>();
+    const allowsWidening = options.policy.allowedOperationClasses.includes('widening');
+
+    interface PolicyFinding {
+      readonly node: PostgresPolicySchemaNode;
+      readonly schemaForTable: string;
+    }
+    const missing: PolicyFinding[] = [];
+    const extra: PolicyFinding[] = [];
 
     for (const issue of filteredDiffIssues) {
       // 'not-equal' is unreachable for content-addressed policies: the wire name
@@ -356,30 +380,90 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
         PostgresPolicySchemaNode.assert(expected);
         // expected.namespaceId is the DDL schema name (resolved during projection);
         // this re-resolution is a no-op as long as PostgresSchema.ddlSchemaName() returns this.id.
-        const schemaForTable = resolveDdlSchemaForNamespaceStorage(
-          options.contract.storage,
-          expected.namespaceId,
-        );
-        const tableKey = `${schemaForTable}.${expected.tableName}`;
-        if (!seenEnableTables.has(tableKey)) {
-          seenEnableTables.add(tableKey);
-          calls.push(new EnableRowLevelSecurityCall(schemaForTable, expected.tableName));
-        }
-        calls.push(
-          new CreatePostgresRlsPolicyCall(
-            schemaForTable,
-            expected.tableName,
-            policyNodeToContractPolicy(expected),
+        missing.push({
+          node: expected,
+          schemaForTable: resolveDdlSchemaForNamespaceStorage(
+            options.contract.storage,
+            expected.namespaceId,
           ),
-        );
-      } else if (issue.reason === 'not-expected' && allowsDestructive) {
+        });
+      } else if (issue.reason === 'not-expected') {
         const actual = issue.actual;
         PostgresPolicySchemaNode.assert(actual);
-        const schemaForTable = resolveDdlSchemaForNamespaceStorage(
-          options.contract.storage,
-          actual.namespaceId,
+        extra.push({
+          node: actual,
+          schemaForTable: resolveDdlSchemaForNamespaceStorage(
+            options.contract.storage,
+            actual.namespaceId,
+          ),
+        });
+      }
+    }
+
+    const calls: PostgresOpFactoryCall[] = [];
+    const renamedExtras = new Set<PolicyFinding>();
+    const renamedMissing = new Set<PolicyFinding>();
+    const pairingKey = (finding: PolicyFinding, hash: string): string =>
+      JSON.stringify([finding.schemaForTable, finding.node.tableName, hash]);
+
+    if (allowsWidening) {
+      const extrasByGroup = new Map<string, PolicyFinding[]>();
+      for (const finding of extra) {
+        const parsed = parseRlsPolicyWireName(finding.node.name);
+        if (parsed === undefined) continue;
+        const key = pairingKey(finding, parsed.hash);
+        const group = extrasByGroup.get(key) ?? [];
+        group.push(finding);
+        extrasByGroup.set(key, group);
+      }
+      for (const group of extrasByGroup.values()) {
+        group.sort((a, b) => (a.node.name < b.node.name ? -1 : a.node.name > b.node.name ? 1 : 0));
+      }
+
+      const sortedMissing = [...missing].sort((a, b) =>
+        a.node.name < b.node.name ? -1 : a.node.name > b.node.name ? 1 : 0,
+      );
+      for (const missingFinding of sortedMissing) {
+        const parsed = parseRlsPolicyWireName(missingFinding.node.name);
+        if (parsed === undefined) continue;
+        const candidates = extrasByGroup.get(pairingKey(missingFinding, parsed.hash));
+        const candidate = candidates?.shift();
+        if (candidate === undefined) continue;
+        // Same name would never surface as missing+extra (the differ pairs by
+        // name), so a matched candidate always differs in prefix only.
+        renamedExtras.add(candidate);
+        renamedMissing.add(missingFinding);
+        calls.push(
+          new RenamePostgresRlsPolicyCall(
+            missingFinding.schemaForTable,
+            missingFinding.node.tableName,
+            candidate.node.name,
+            missingFinding.node.name,
+          ),
+        );
+      }
+    }
+
+    for (const finding of missing) {
+      if (renamedMissing.has(finding)) continue;
+      calls.push(
+        new CreatePostgresRlsPolicyCall(
+          finding.schemaForTable,
+          finding.node.tableName,
+          policyNodeToContractPolicy(finding.node),
+        ),
+      );
+    }
+    if (allowsDestructive) {
+      for (const finding of extra) {
+        if (renamedExtras.has(finding)) continue;
+        calls.push(
+          new DropPostgresRlsPolicyCall(
+            finding.schemaForTable,
+            finding.node.tableName,
+            finding.node.name,
+          ),
         );
-        calls.push(new DropPostgresRlsPolicyCall(schemaForTable, actual.tableName, actual.name));
       }
     }
 

package/src/core/postgres-contract-serializer.ts

@@ -19,7 +19,12 @@ import { blindCast } from '@prisma-next/utils/casts';
 import type { JsonObject } from '@prisma-next/utils/json';
 import { postgresAuthoringEntityTypes } from './authoring';
 import { PG_INT_CODEC_ID, PG_TEXT_CODEC_ID } from './codec-ids';
-import { nativeEnumEntityKind, policyEntityKind, roleEntityKind } from './entity-kinds';
+import {
+  nativeEnumEntityKind,
+  policyEntityKind,
+  rlsEnablementEntityKind,
+  roleEntityKind,
+} from './entity-kinds';
 import { PostgresSchema } from './postgres-schema';
 
 const POSTGRES_AUTHORING_CTX: AuthoringEntityContext = {
@@ -73,6 +78,7 @@ export class PostgresContractSerializer extends SqlContractSerializerBase<Contra
     super(storageTypesHydrators, [
       policyEntityKind,
       roleEntityKind,
+      rlsEnablementEntityKind,
       nativeEnumEntityKind,
       ...extraPackEntityKinds,
     ]);
@@ -110,9 +116,8 @@ export class PostgresContractSerializer extends SqlContractSerializerBase<Contra
     const { storage, ...rest } = contract;
     const namespacesJson: Record<string, JsonObject> = {};
     // Each namespace serializes to its id, its schema-kind tag, and the
-    // base's generic entries walk. Native enums are excluded upstream —
-    // carried non-enumerable on `PostgresSchema.entries`, so the walk
-    // never sees them.
+    // base's generic entries walk — every enumerable kind on
+    // `PostgresSchema.entries`, including `native_enum`.
     for (const [nsId, ns] of Object.entries(storage.namespaces)) {
       const isUnboundSlot = ns.id === UNBOUND_NAMESPACE_ID;
       namespacesJson[nsId] = {

package/src/core/postgres-rls-enablement.ts

@@ -0,0 +1,34 @@
+import { freezeNode } from '@prisma-next/framework-components/ir';
+import { SqlNode } from '@prisma-next/sql-contract/types';
+
+export interface PostgresRlsEnablementInput {
+  /** Name of the table this marker declares RLS-controlled. */
+  readonly tableName: string;
+  /** Namespace coordinate (schema name). Markers are schema-scoped like policies. */
+  readonly namespaceId: string;
+}
+
+/**
+ * Postgres contract-IR marker for `@@rls` on a model: the table named here is
+ * RLS-controlled (`ENABLE ROW LEVEL SECURITY` is driven by this marker, never
+ * by the policy set).
+ *
+ * This is an authored, serialized Contract-IR entity — it is registered as an
+ * entity kind, extends `SqlNode`, and is stored in `contract.json` under
+ * `entries.rls[tableName]`. Target-only concept — no SQL-family abstract.
+ * Frozen at construction via `freezeNode(this)`. The `kind: 'rls'`
+ * discriminant is enumerable so it survives JSON serialization; the literal
+ * matches the entries key (one-string rule).
+ */
+export class PostgresRlsEnablement extends SqlNode {
+  override readonly kind = 'rls' as const;
+  readonly tableName: string;
+  readonly namespaceId: string;
+
+  constructor(input: PostgresRlsEnablementInput) {
+    super();
+    this.tableName = input.tableName;
+    this.namespaceId = input.namespaceId;
+    freezeNode(this);
+  }
+}