@prisma-next/target-postgres 0.14.0-dev.55 → 0.14.0-dev.56

package/dist/postgres-table-schema-node-9FCtCUz2.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-table-schema-node-9FCtCUz2.mjs","names":[],"sources":["../src/core/schema-ir/schema-node-kinds.ts","../src/core/schema-ir/postgres-table-schema-node.ts"],"sourcesContent":["import type {\n  DiffableNode,\n  DiffSubjectGranularity,\n} from '@prisma-next/framework-components/control';\nimport {\n  relationalNodeEntityKind,\n  relationalNodeGranularity,\n  type SqlSchemaIRNode,\n} from '@prisma-next/sql-schema-ir/types';\n\n/**\n * A Postgres schema-diff-tree node: a `SqlSchemaIRNode` that also implements\n * `DiffableNode` (the five `Postgres*SchemaNode` classes). `SqlSchemaIRNode`\n * alone is not a `DiffableNode` — its relational subclasses (`SqlColumnIR`, …)\n * carry no `id`/`isEqualTo`/`children` — so this intersection is the honest node\n * type the differ produces and the planner consumes (`SchemaDiff<SqlSchemaDiffNode>`).\n */\nexport type SqlSchemaDiffNode = SqlSchemaIRNode & DiffableNode;\n\n/**\n * The `nodeKind` discriminant for each Postgres schema-diff node. Each node\n * carries a unique value; the static `is`/`assert` guards compare against these\n * identifiers rather than spelling the string inline or using `instanceof`. The\n * field is an enumerable own property carried on every node instance.\n */\nexport const PostgresSchemaNodeKind = {\n  database: 'postgres-database',\n  namespace: 'postgres-namespace',\n  table: 'postgres-table',\n  policy: 'postgres-policy',\n  role: 'postgres-role',\n} as const;\n\nexport type PostgresSchemaNodeKind =\n  (typeof PostgresSchemaNodeKind)[keyof typeof PostgresSchemaNodeKind];\n\n/**\n * The one real map from a Postgres-specific `nodeKind` to the\n * framework-neutral {@link DiffSubjectGranularity} its diff issues carry —\n * resolution is by `nodeKind` equality against this map, never a\n * `nodeKind`-suffix string match and never anything stamped on the node.\n */\nconst POSTGRES_NODE_GRANULARITY: Readonly<Record<PostgresSchemaNodeKind, DiffSubjectGranularity>> =\n  {\n    [PostgresSchemaNodeKind.database]: 'structural',\n    [PostgresSchemaNodeKind.namespace]: 'namespace',\n    [PostgresSchemaNodeKind.table]: 'entity',\n    [PostgresSchemaNodeKind.policy]: 'structural',\n    [PostgresSchemaNodeKind.role]: 'structural',\n  };\n\nfunction isPostgresSchemaNodeKind(nodeKind: string): nodeKind is PostgresSchemaNodeKind {\n  return Object.hasOwn(POSTGRES_NODE_GRANULARITY, nodeKind);\n}\n\n/** Looks up the subject granularity for a Postgres-specific `nodeKind`. */\nexport function postgresNodeGranularity(nodeKind: PostgresSchemaNodeKind): DiffSubjectGranularity {\n  return POSTGRES_NODE_GRANULARITY[nodeKind];\n}\n\n/**\n * The subject granularity for any node kind that appears in a Postgres diff\n * tree — the tree mixes Postgres-specific kinds (database/namespace/table/\n * policy/role) with the relational leaf kinds (columns, constraints, indexes,\n * …), so this dispatches to whichever family/target map owns the kind. Called\n * on demand by consumers (the family verdict, the framework aggregate's\n * unclaimed-elements sweep, via the {@link\n * import('@prisma-next/framework-components/control').SchemaSubjectClassifierCapable}\n * capability) — never stamped onto the issue or the node.\n */\nexport function postgresDiffSubjectGranularity(nodeKind: string): DiffSubjectGranularity {\n  return isPostgresSchemaNodeKind(nodeKind)\n    ? postgresNodeGranularity(nodeKind)\n    : relationalNodeGranularity(nodeKind);\n}\n\n/**\n * The one real map from a Postgres-specific `nodeKind` to its storage\n * `entityKind` — the same vocabulary the contract storage's `entries`\n * dictionary keys use. Only the whole-table kind has an entity of its own;\n * database/namespace/policy/role nodes map to nothing here (a namespace is\n * addressed by id, not by an `entries` kind; policies and roles are\n * structural, never a sibling space's unclaimed entity).\n */\nconst POSTGRES_NODE_ENTITY_KIND: Partial<Readonly<Record<PostgresSchemaNodeKind, string>>> = {\n  [PostgresSchemaNodeKind.table]: 'table',\n};\n\n/** Looks up the storage entityKind for a Postgres-specific `nodeKind`. */\nexport function postgresNodeEntityKind(nodeKind: PostgresSchemaNodeKind): string | undefined {\n  return POSTGRES_NODE_ENTITY_KIND[nodeKind];\n}\n\n/**\n * The storage `entityKind` for any node kind that appears in a Postgres diff\n * tree — sibling of {@link postgresDiffSubjectGranularity}, dispatching the\n * same way to whichever family/target map owns the kind. Called on demand by\n * the framework aggregate's unclaimed-elements sweep via the {@link\n * import('@prisma-next/framework-components/control').SchemaSubjectClassifierCapable}\n * capability — never stamped onto the issue or the node.\n */\nexport function postgresDiffSubjectEntityKind(nodeKind: string): string | undefined {\n  return isPostgresSchemaNodeKind(nodeKind)\n    ? postgresNodeEntityKind(nodeKind)\n    : relationalNodeEntityKind(nodeKind);\n}\n","import type { DiffableNode } from '@prisma-next/framework-components/control';\nimport { freezeNode } from '@prisma-next/framework-components/ir';\nimport {\n  assertNode,\n  PrimaryKey,\n  type SqlAnnotations,\n  SqlCheckConstraintIR,\n  SqlColumnIR,\n  SqlForeignKeyIR,\n  SqlIndexIR,\n  SqlSchemaIRNode,\n  type SqlTableIRInput,\n  SqlUniqueIR,\n} from '@prisma-next/sql-schema-ir/types';\nimport { blindCast } from '@prisma-next/utils/casts';\nimport type { PostgresPolicySchemaNode } from './postgres-policy-schema-node';\nimport { PostgresSchemaNodeKind } from './schema-node-kinds';\n\nexport interface PostgresTableSchemaNodeInput extends SqlTableIRInput {\n  readonly policies?: readonly PostgresPolicySchemaNode[];\n  /**\n   * Whether row-level security is enabled on this table. Expected side:\n   * stamped from the contract's `entries.rls` marker (never from the\n   * policy set). Actual side: stamped from `pg_class.relrowsecurity` at\n   * introspection. Required with no default so every construction site\n   * supplies a deliberate value.\n   */\n  readonly rlsEnabled: boolean;\n}\n\n/**\n * Postgres-specific table schema-diff node. Carries all `SqlTableIR` fields\n * plus `policies`, and implements `DiffableNode` so the table instance is\n * directly the diff-tree node — no separate wrapper needed.\n *\n * Extends `SqlSchemaIRNode` directly rather than `SqlTableIR` because\n * `SqlTableIR` calls `freezeNode` in its own constructor, which prevents\n * subclass field initialisation.\n *\n * `id` is the table name. `isEqualTo` compares id + `rlsEnabled` — the\n * table's one own diffable attribute; all other structural drift is\n * expressed by its children. `children()` returns every column, the primary\n * key (when present), every foreign key, unique, index, and check constraint,\n * plus the policy nodes — one flat list, so a drifted column and a drifted\n * policy are both reported by the same walk. Order is deterministic (object\n * key order for columns, array order for the rest) so two structurally equal\n * tables always produce the same child list.\n */\nexport class PostgresTableSchemaNode extends SqlSchemaIRNode implements DiffableNode {\n  override readonly nodeKind = PostgresSchemaNodeKind.table;\n\n  readonly name: string;\n  readonly columns: Readonly<Record<string, SqlColumnIR>>;\n  readonly foreignKeys: ReadonlyArray<SqlForeignKeyIR>;\n  readonly uniques: ReadonlyArray<SqlUniqueIR>;\n  readonly indexes: ReadonlyArray<SqlIndexIR>;\n  declare readonly primaryKey?: PrimaryKey;\n  declare readonly annotations?: SqlAnnotations;\n  declare readonly checks?: ReadonlyArray<SqlCheckConstraintIR>;\n  readonly policies: readonly PostgresPolicySchemaNode[];\n  readonly rlsEnabled: boolean;\n\n  constructor(input: PostgresTableSchemaNodeInput) {\n    super();\n    this.name = input.name;\n    this.rlsEnabled = input.rlsEnabled;\n    this.columns = Object.freeze(\n      Object.fromEntries(\n        Object.entries(input.columns).map(([key, col]) => [\n          key,\n          col instanceof SqlColumnIR ? col : new SqlColumnIR(col),\n        ]),\n      ),\n    );\n    this.foreignKeys = Object.freeze(\n      input.foreignKeys.map((fk) => (fk instanceof SqlForeignKeyIR ? fk : new SqlForeignKeyIR(fk))),\n    );\n    this.uniques = Object.freeze(\n      input.uniques.map((u) => (u instanceof SqlUniqueIR ? u : new SqlUniqueIR(u))),\n    );\n    this.indexes = Object.freeze(\n      input.indexes.map((i) => (i instanceof SqlIndexIR ? i : new SqlIndexIR(i))),\n    );\n    if (input.primaryKey !== undefined) {\n      this.primaryKey =\n        input.primaryKey instanceof PrimaryKey\n          ? input.primaryKey\n          : new PrimaryKey(input.primaryKey);\n    }\n    if (input.annotations !== undefined) this.annotations = input.annotations;\n    if (input.checks !== undefined && input.checks.length > 0) {\n      this.checks = Object.freeze(\n        input.checks.map((c) =>\n          c instanceof SqlCheckConstraintIR ? c : new SqlCheckConstraintIR(c),\n        ),\n      );\n    }\n    this.policies = Object.freeze([...(input.policies ?? [])]);\n    freezeNode(this);\n  }\n\n  get id(): string {\n    return this.name;\n  }\n\n  /**\n   * Equal iff the ids (names) match AND `rlsEnabled` matches — the table's\n   * one own attribute in the diff; all other structural drift is expressed\n   * by children. A paired `not-equal` therefore always means enablement\n   * drift, which the planner maps to ENABLE/DISABLE ROW LEVEL SECURITY.\n   */\n  isEqualTo(other: DiffableNode): boolean {\n    const node = blindCast<\n      SqlSchemaIRNode,\n      'every diff-tree node the differ pairs is a SqlSchemaIRNode'\n    >(other);\n    PostgresTableSchemaNode.assert(node);\n    return this.id === node.id && this.rlsEnabled === node.rlsEnabled;\n  }\n\n  children(): readonly DiffableNode[] {\n    return [\n      ...Object.values(this.columns),\n      ...(this.primaryKey ? [this.primaryKey] : []),\n      ...this.foreignKeys,\n      ...this.uniques,\n      ...this.indexes,\n      ...(this.checks ?? []),\n      ...this.policies,\n    ];\n  }\n\n  static is(node: SqlSchemaIRNode): node is PostgresTableSchemaNode {\n    return node.nodeKind === PostgresSchemaNodeKind.table;\n  }\n\n  static assert(node: SqlSchemaIRNode): asserts node is PostgresTableSchemaNode {\n    assertNode(node, 'PostgresTableSchemaNode', PostgresTableSchemaNode.is);\n  }\n}\n"],"mappings":";;;;;;;;;;AAyBA,MAAa,yBAAyB;CACpC,UAAU;CACV,WAAW;CACX,OAAO;CACP,QAAQ;CACR,MAAM;AACR;;;;;;;AAWA,MAAM,4BACJ;EACG,uBAAuB,WAAW;EAClC,uBAAuB,YAAY;EACnC,uBAAuB,QAAQ;EAC/B,uBAAuB,SAAS;EAChC,uBAAuB,OAAO;AACjC;AAEF,SAAS,yBAAyB,UAAsD;CACtF,OAAO,OAAO,OAAO,2BAA2B,QAAQ;AAC1D;;AAGA,SAAgB,wBAAwB,UAA0D;CAChG,OAAO,0BAA0B;AACnC;;;;;;;;;;;AAYA,SAAgB,+BAA+B,UAA0C;CACvF,OAAO,yBAAyB,QAAQ,IACpC,wBAAwB,QAAQ,IAChC,0BAA0B,QAAQ;AACxC;;;;;;;;;AAUA,MAAM,4BAAuF,GAC1F,uBAAuB,QAAQ,QAClC;;AAGA,SAAgB,uBAAuB,UAAsD;CAC3F,OAAO,0BAA0B;AACnC;;;;;;;;;AAUA,SAAgB,8BAA8B,UAAsC;CAClF,OAAO,yBAAyB,QAAQ,IACpC,uBAAuB,QAAQ,IAC/B,yBAAyB,QAAQ;AACvC;;;;;;;;;;;;;;;;;;;;;ACzDA,IAAa,0BAAb,MAAa,gCAAgC,gBAAwC;CACnF,WAA6B,uBAAuB;CAEpD;CACA;CACA;CACA;CACA;CAIA;CACA;CAEA,YAAY,OAAqC;EAC/C,MAAM;EACN,KAAK,OAAO,MAAM;EAClB,KAAK,aAAa,MAAM;EACxB,KAAK,UAAU,OAAO,OACpB,OAAO,YACL,OAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,CAChD,KACA,eAAe,cAAc,MAAM,IAAI,YAAY,GAAG,CACxD,CAAC,CACH,CACF;EACA,KAAK,cAAc,OAAO,OACxB,MAAM,YAAY,KAAK,OAAQ,cAAc,kBAAkB,KAAK,IAAI,gBAAgB,EAAE,CAAE,CAC9F;EACA,KAAK,UAAU,OAAO,OACpB,MAAM,QAAQ,KAAK,MAAO,aAAa,cAAc,IAAI,IAAI,YAAY,CAAC,CAAE,CAC9E;EACA,KAAK,UAAU,OAAO,OACpB,MAAM,QAAQ,KAAK,MAAO,aAAa,aAAa,IAAI,IAAI,WAAW,CAAC,CAAE,CAC5E;EACA,IAAI,MAAM,eAAe,KAAA,GACvB,KAAK,aACH,MAAM,sBAAsB,aACxB,MAAM,aACN,IAAI,WAAW,MAAM,UAAU;EAEvC,IAAI,MAAM,gBAAgB,KAAA,GAAW,KAAK,cAAc,MAAM;EAC9D,IAAI,MAAM,WAAW,KAAA,KAAa,MAAM,OAAO,SAAS,GACtD,KAAK,SAAS,OAAO,OACnB,MAAM,OAAO,KAAK,MAChB,aAAa,uBAAuB,IAAI,IAAI,qBAAqB,CAAC,CACpE,CACF;EAEF,KAAK,WAAW,OAAO,OAAO,CAAC,GAAI,MAAM,YAAY,CAAC,CAAE,CAAC;EACzD,WAAW,IAAI;CACjB;CAEA,IAAI,KAAa;EACf,OAAO,KAAK;CACd;;;;;;;CAQA,UAAU,OAA8B;EACtC,MAAM,OAAO,UAGX,KAAK;EACP,wBAAwB,OAAO,IAAI;EACnC,OAAO,KAAK,OAAO,KAAK,MAAM,KAAK,eAAe,KAAK;CACzD;CAEA,WAAoC;EAClC,OAAO;GACL,GAAG,OAAO,OAAO,KAAK,OAAO;GAC7B,GAAI,KAAK,aAAa,CAAC,KAAK,UAAU,IAAI,CAAC;GAC3C,GAAG,KAAK;GACR,GAAG,KAAK;GACR,GAAG,KAAK;GACR,GAAI,KAAK,UAAU,CAAC;GACpB,GAAG,KAAK;EACV;CACF;CAEA,OAAO,GAAG,MAAwD;EAChE,OAAO,KAAK,aAAa,uBAAuB;CAClD;CAEA,OAAO,OAAO,MAAgE;EAC5E,WAAW,MAAM,2BAA2B,wBAAwB,EAAE;CACxE;AACF"}

package/dist/{resolve-ddl-schema-BOtCoeKV.mjs → resolve-ddl-schema-Ca88Tg6W.mjs}

@@ -1,5 +1,5 @@
 import { t as DEFAULT_NAMESPACE_ID } from "./namespace-ids-xtp_ZY86.mjs";
-import { r as isPostgresSchema } from "./postgres-schema-DcG72fcT.mjs";
+import { r as isPostgresSchema } from "./postgres-schema-DTLA_aRi.mjs";
 import { UNBOUND_NAMESPACE_ID } from "@prisma-next/framework-components/ir";
 //#region src/core/migrations/resolve-ddl-schema.ts
 /**
@@ -19,4 +19,4 @@ function resolveDdlSchemaForNamespaceStorage(storage, namespaceId) {
 //#endregion
 export { resolveDdlSchemaForNamespaceStorage as t };
 
-//# sourceMappingURL=resolve-ddl-schema-BOtCoeKV.mjs.map
+//# sourceMappingURL=resolve-ddl-schema-Ca88Tg6W.mjs.map

package/dist/{resolve-ddl-schema-BOtCoeKV.mjs.map → resolve-ddl-schema-Ca88Tg6W.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"resolve-ddl-schema-BOtCoeKV.mjs","names":[],"sources":["../src/core/migrations/resolve-ddl-schema.ts"],"sourcesContent":["import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';\nimport type { SqlStorage } from '@prisma-next/sql-contract/types';\nimport { DEFAULT_NAMESPACE_ID } from '../namespace-ids';\nimport { isPostgresSchema } from '../postgres-schema';\n\n/**\n * Given the contract's storage and a namespace id, returns the live Postgres\n * DDL schema name that namespace maps to. A named Postgres namespace dispatches\n * to its `ddlSchemaName(storage)`; the unbound sentinel resolves to\n * `DEFAULT_NAMESPACE_ID` (the search-path default for offline planning); a\n * bare object payload (used by some tests) falls back to the namespace id\n * itself.\n */\nexport function resolveDdlSchemaForNamespaceStorage(\n  storage: SqlStorage,\n  namespaceId: string,\n): string {\n  if (namespaceId === UNBOUND_NAMESPACE_ID) {\n    return DEFAULT_NAMESPACE_ID;\n  }\n  const namespace = storage.namespaces[namespaceId];\n  if (namespace && isPostgresSchema(namespace)) {\n    return namespace.ddlSchemaName(storage);\n  }\n  return namespaceId;\n}\n"],"mappings":";;;;;;;;;;;;AAaA,SAAgB,oCACd,SACA,aACQ;CACR,IAAI,gBAAgB,sBAClB,OAAO;CAET,MAAM,YAAY,QAAQ,WAAW;CACrC,IAAI,aAAa,iBAAiB,SAAS,GACzC,OAAO,UAAU,cAAc,OAAO;CAExC,OAAO;AACT"}
+{"version":3,"file":"resolve-ddl-schema-Ca88Tg6W.mjs","names":[],"sources":["../src/core/migrations/resolve-ddl-schema.ts"],"sourcesContent":["import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';\nimport type { SqlStorage } from '@prisma-next/sql-contract/types';\nimport { DEFAULT_NAMESPACE_ID } from '../namespace-ids';\nimport { isPostgresSchema } from '../postgres-schema';\n\n/**\n * Given the contract's storage and a namespace id, returns the live Postgres\n * DDL schema name that namespace maps to. A named Postgres namespace dispatches\n * to its `ddlSchemaName(storage)`; the unbound sentinel resolves to\n * `DEFAULT_NAMESPACE_ID` (the search-path default for offline planning); a\n * bare object payload (used by some tests) falls back to the namespace id\n * itself.\n */\nexport function resolveDdlSchemaForNamespaceStorage(\n  storage: SqlStorage,\n  namespaceId: string,\n): string {\n  if (namespaceId === UNBOUND_NAMESPACE_ID) {\n    return DEFAULT_NAMESPACE_ID;\n  }\n  const namespace = storage.namespaces[namespaceId];\n  if (namespace && isPostgresSchema(namespace)) {\n    return namespace.ddlSchemaName(storage);\n  }\n  return namespaceId;\n}\n"],"mappings":";;;;;;;;;;;;AAaA,SAAgB,oCACd,SACA,aACQ;CACR,IAAI,gBAAgB,sBAClB,OAAO;CAET,MAAM,YAAY,QAAQ,WAAW;CACrC,IAAI,aAAa,iBAAiB,SAAS,GACzC,OAAO,UAAU,cAAc,OAAO;CAExC,OAAO;AACT"}

package/dist/rls-canonicalize.d.mts

@@ -1,2 +1,20 @@
 import { i as normalizePredicate, n as RlsPolicyOperation, r as computeContentHash, t as ContentHashParts } from "./canonicalize-CAbXtVtB.mjs";
-export { type ContentHashParts, type RlsPolicyOperation, computeContentHash, normalizePredicate };
+
+//#region src/core/rls/wire-name.d.ts
+interface RlsPolicyWireName {
+  /** The user-supplied part before the `_<8hex>` suffix. */
+  readonly prefix: string;
+  /** The 8-lowercase-hex content-hash suffix. */
+  readonly hash: string;
+}
+/**
+ * Splits an RLS policy wire name (`<prefix>_<8hex>`) into its prefix and
+ * content-hash suffix. Returns `undefined` when the name does not follow the
+ * wire-name shape (e.g. a policy created outside the toolchain) — callers
+ * treat such names as all-prefix. Consumed by introspection (prefix
+ * extraction) and by rename pairing (same hash, different prefix).
+ */
+declare function parseRlsPolicyWireName(name: string): RlsPolicyWireName | undefined;
+//#endregion
+export { type ContentHashParts, type RlsPolicyOperation, type RlsPolicyWireName, computeContentHash, normalizePredicate, parseRlsPolicyWireName };
+//# sourceMappingURL=rls-canonicalize.d.mts.map

package/dist/rls-canonicalize.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-canonicalize.d.mts","names":[],"sources":["../src/core/rls/wire-name.ts"],"mappings":";;;UAAiB,iBAAA;;WAEN,MAAA;EAFM;EAAA,SAIN,IAAI;AAAA;;;;;;;;iBAsBC,sBAAA,CAAuB,IAAA,WAAe,iBAAiB"}

package/dist/rls-canonicalize.mjs

@@ -1,2 +1,2 @@
-import { n as normalizePredicate, t as computeContentHash } from "./canonicalize-Bn3BM1Cn.mjs";
-export { computeContentHash, normalizePredicate };
+import { i as normalizePredicate, n as parseRlsPolicyWireName, r as computeContentHash } from "./wire-name-rHHtr1h0.mjs";
+export { computeContentHash, normalizePredicate, parseRlsPolicyWireName };

package/dist/runtime.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.mts","names":[],"sources":["../src/core/postgres-contract-serializer.ts","../src/exports/runtime.ts"],"mappings":";;;;;;;;;;cAqEa,0BAAA,SAAmC,yBAAA,CAA0B,QAAA,CAAS,UAAA;cACrE,oBAAA,YAA+B,uBAAA;EAAA,UAUxB,wBAAA,CACjB,IAAA,UACA,GAAA,EAAK,MAAA,oBACJ,SAAA,GAAY,iBAAA;EAyBN,iBAAA,CAAkB,QAAA,EAAU,QAAA,CAAS,UAAA,IAAc,UAAA;AAAA;;;UClG7C,6BAAA,SAAsC,qBAAqB;;;;;AD2D5E;;cCnDM,+BAAA,EAAiC,uBAAA,oBAGrC,6BAAA;EAAA,SAES,MAAA,iBAAuB,kBAAA;AAAA"}
+{"version":3,"file":"runtime.d.mts","names":[],"sources":["../src/core/postgres-contract-serializer.ts","../src/exports/runtime.ts"],"mappings":";;;;;;;;;;cA0Ea,0BAAA,SAAmC,yBAAA,CAA0B,QAAA,CAAS,UAAA;cACrE,oBAAA,YAA+B,uBAAA;EAAA,UAWxB,wBAAA,CACjB,IAAA,UACA,GAAA,EAAK,MAAA,oBACJ,SAAA,GAAY,iBAAA;EAyBN,iBAAA,CAAkB,QAAA,EAAU,QAAA,CAAS,UAAA,IAAc,UAAA;AAAA;;;UCxG7C,6BAAA,SAAsC,qBAAqB;;;;;ADgE5E;;cCxDM,+BAAA,EAAiC,uBAAA,oBAGrC,6BAAA;EAAA,SAES,MAAA,iBAAuB,kBAAA;AAAA"}

package/dist/runtime.mjs

@@ -1,5 +1,5 @@
 import { t as postgresTargetDescriptorMetaRuntime } from "./descriptor-meta-runtime-UwYdV8fD.mjs";
-import { n as PostgresContractSerializer, t as PostgresContractView } from "./postgres-contract-view-C-By7rOB.mjs";
+import { n as PostgresContractSerializer, t as PostgresContractView } from "./postgres-contract-view-Dg-N7KA7.mjs";
 //#region src/exports/runtime.ts
 /**
 * Target-postgres deliberately does NOT import `SqlRuntimeTargetDescriptor` from `@prisma-next/sql-runtime`. The target package is a control-plane residence and must not pull the SQL execution-plane package into its dependency closure. The runtime descriptor here is shaped to satisfy the framework's `RuntimeTargetDescriptor` plus the structural `SqlStaticContributions` (`codecs:` returning a descriptor list) that

package/dist/schema-ir-annotations.mjs

@@ -1,2 +1,2 @@
-import { t as resolveDdlSchemaForNamespaceStorage } from "./resolve-ddl-schema-BOtCoeKV.mjs";
+import { t as resolveDdlSchemaForNamespaceStorage } from "./resolve-ddl-schema-Ca88Tg6W.mjs";
 export { resolveDdlSchemaForNamespaceStorage };

package/dist/types.d.mts

@@ -1,5 +1,5 @@
 import { n as PostgresRlsPolicyInput, r as RlsPolicyOperation, t as PostgresRlsPolicy } from "./postgres-rls-policy--CSddvMR.mjs";
-import { a as PostgresNamespaceSchemaNode, c as PostgresTableSchemaNode, d as PostgresPolicySchemaNodeInput, i as PostgresRoleSchemaNodeInput, l as PostgresTableSchemaNodeInput, n as PostgresDatabaseSchemaNodeInput, o as PostgresNamespaceSchemaNodeInput, r as PostgresRoleSchemaNode, s as PostgresNativeEnumIntrospection, t as PostgresDatabaseSchemaNode, u as PostgresPolicySchemaNode } from "./postgres-database-schema-node-UpzA0Ug5.mjs";
+import { a as PostgresNamespaceSchemaNode, c as PostgresTableSchemaNode, d as PostgresPolicySchemaNodeInput, i as PostgresRoleSchemaNodeInput, l as PostgresTableSchemaNodeInput, n as PostgresDatabaseSchemaNodeInput, o as PostgresNamespaceSchemaNodeInput, r as PostgresRoleSchemaNode, s as PostgresNativeEnumIntrospection, t as PostgresDatabaseSchemaNode, u as PostgresPolicySchemaNode } from "./postgres-database-schema-node-CfdTY-Qs.mjs";
 import { t as PostgresColumnDefault } from "./types-BDKkx8MA.mjs";
-import { a as postgresCreateNamespace, c as PostgresRole, i as isPostgresSchema, l as PostgresRoleInput, n as PostgresSchema, o as PostgresNativeEnum, r as PostgresUnboundSchema, s as PostgresNativeEnumInput, t as PostgresContract } from "./postgres-schema-9vFZLwGo.mjs";
-export { type PostgresColumnDefault, type PostgresContract, PostgresDatabaseSchemaNode, type PostgresDatabaseSchemaNodeInput, PostgresNamespaceSchemaNode, type PostgresNamespaceSchemaNodeInput, PostgresNativeEnum, type PostgresNativeEnumInput, type PostgresNativeEnumIntrospection, PostgresPolicySchemaNode, type PostgresPolicySchemaNodeInput, PostgresRlsPolicy, type PostgresRlsPolicyInput, PostgresRole, type PostgresRoleInput, PostgresRoleSchemaNode, type PostgresRoleSchemaNodeInput, PostgresSchema, PostgresTableSchemaNode, type PostgresTableSchemaNodeInput, PostgresUnboundSchema, type RlsPolicyOperation, isPostgresSchema, postgresCreateNamespace };
+import { a as postgresCreateNamespace, c as PostgresRlsEnablement, d as PostgresRoleInput, i as isPostgresSchema, l as PostgresRlsEnablementInput, n as PostgresSchema, o as PostgresNativeEnum, r as PostgresUnboundSchema, s as PostgresNativeEnumInput, t as PostgresContract, u as PostgresRole } from "./postgres-schema-CU4gF6QZ.mjs";
+export { type PostgresColumnDefault, type PostgresContract, PostgresDatabaseSchemaNode, type PostgresDatabaseSchemaNodeInput, PostgresNamespaceSchemaNode, type PostgresNamespaceSchemaNodeInput, PostgresNativeEnum, type PostgresNativeEnumInput, type PostgresNativeEnumIntrospection, PostgresPolicySchemaNode, type PostgresPolicySchemaNodeInput, PostgresRlsEnablement, type PostgresRlsEnablementInput, PostgresRlsPolicy, type PostgresRlsPolicyInput, PostgresRole, type PostgresRoleInput, PostgresRoleSchemaNode, type PostgresRoleSchemaNodeInput, PostgresSchema, PostgresTableSchemaNode, type PostgresTableSchemaNodeInput, PostgresUnboundSchema, type RlsPolicyOperation, isPostgresSchema, postgresCreateNamespace };

package/dist/types.mjs

@@ -1,4 +1,5 @@
 import { t as PostgresNativeEnum } from "./postgres-native-enum-xdiqmBf_.mjs";
-import { f as PostgresRole, i as postgresCreateNamespace, n as PostgresUnboundSchema, p as PostgresRlsPolicy, r as isPostgresSchema, t as PostgresSchema } from "./postgres-schema-DcG72fcT.mjs";
-import { a as PostgresDatabaseSchemaNode, i as PostgresNamespaceSchemaNode, n as PostgresRoleSchemaNode, r as PostgresPolicySchemaNode, t as PostgresTableSchemaNode } from "./postgres-table-schema-node-BZWWEo7B.mjs";
-export { PostgresDatabaseSchemaNode, PostgresNamespaceSchemaNode, PostgresNativeEnum, PostgresPolicySchemaNode, PostgresRlsPolicy, PostgresRole, PostgresRoleSchemaNode, PostgresSchema, PostgresTableSchemaNode, PostgresUnboundSchema, isPostgresSchema, postgresCreateNamespace };
+import { g as PostgresRlsEnablement, h as PostgresRlsPolicy, i as postgresCreateNamespace, m as PostgresRole, n as PostgresUnboundSchema, r as isPostgresSchema, t as PostgresSchema } from "./postgres-schema-DTLA_aRi.mjs";
+import { t as PostgresTableSchemaNode } from "./postgres-table-schema-node-9FCtCUz2.mjs";
+import { i as PostgresDatabaseSchemaNode, n as PostgresPolicySchemaNode, r as PostgresNamespaceSchemaNode, t as PostgresRoleSchemaNode } from "./postgres-role-schema-node-BiSTCTNg.mjs";
+export { PostgresDatabaseSchemaNode, PostgresNamespaceSchemaNode, PostgresNativeEnum, PostgresPolicySchemaNode, PostgresRlsEnablement, PostgresRlsPolicy, PostgresRole, PostgresRoleSchemaNode, PostgresSchema, PostgresTableSchemaNode, PostgresUnboundSchema, isPostgresSchema, postgresCreateNamespace };

package/dist/{canonicalize-Bn3BM1Cn.mjs → wire-name-rHHtr1h0.mjs}

@@ -41,6 +41,35 @@ function computeContentHash(parts) {
 	return createHash("sha256").update(tuple).digest("hex").slice(0, 8);
 }
 //#endregion
-export { normalizePredicate as n, computeContentHash as t };
+//#region src/core/rls/wire-name.ts
+const WIRE_NAME_PATTERN = /^(.+)_([0-9a-f]{8})$/;
+/**
+* Assembles an RLS policy wire name from its user-supplied prefix and its
+* 8-hex content-hash suffix. This module owns the `<prefix>_<hash>` format
+* on both sides — construction here and parsing in
+* {@link parseRlsPolicyWireName} — so the two never drift.
+*/
+function formatRlsPolicyWireName(prefix, hash) {
+	return `${prefix}_${hash}`;
+}
+/**
+* Splits an RLS policy wire name (`<prefix>_<8hex>`) into its prefix and
+* content-hash suffix. Returns `undefined` when the name does not follow the
+* wire-name shape (e.g. a policy created outside the toolchain) — callers
+* treat such names as all-prefix. Consumed by introspection (prefix
+* extraction) and by rename pairing (same hash, different prefix).
+*/
+function parseRlsPolicyWireName(name) {
+	const match = WIRE_NAME_PATTERN.exec(name);
+	const prefix = match?.[1];
+	const hash = match?.[2];
+	if (prefix === void 0 || hash === void 0) return void 0;
+	return {
+		prefix,
+		hash
+	};
+}
+//#endregion
+export { normalizePredicate as i, parseRlsPolicyWireName as n, computeContentHash as r, formatRlsPolicyWireName as t };
 
-//# sourceMappingURL=canonicalize-Bn3BM1Cn.mjs.map
+//# sourceMappingURL=wire-name-rHHtr1h0.mjs.map

package/dist/wire-name-rHHtr1h0.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-name-rHHtr1h0.mjs","names":[],"sources":["../src/core/rls/canonicalize.ts","../src/core/rls/wire-name.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nexport type RlsPolicyOperation = 'select' | 'insert' | 'update' | 'delete' | 'all';\n\nexport interface ContentHashParts {\n  readonly using?: string;\n  readonly withCheck?: string;\n  readonly roles: readonly string[];\n  readonly operation: RlsPolicyOperation;\n  readonly permissive: boolean;\n}\n\n/**\n * Stabilizes an authored predicate for hashing: trim, and collapse runs of\n * internal whitespace to a single space.\n *\n * This is deliberately minimal. The content hash is the equivalence relation\n * for a policy, and the wire name (prefix + hash) is the only thing ever\n * compared — we never recompute the hash from an introspected policy body, so\n * there is no need to match Postgres's reprinted form. Minimal normalization\n * also protects the no-collision property: aggressive rewriting (lowercasing,\n * paren-stripping, cast-alias folding) risks collapsing two distinct predicates\n * onto one hash. Out-of-band alteration of a hashed policy is unsupported.\n *\n * The normalizer is a stability commitment: any change re-suffixes all wire names.\n */\nexport function normalizePredicate(sql: string): string {\n  return sql.replace(/\\s+/g, ' ').trim();\n}\n\n/**\n * Returns the first 8 lowercase hex characters of the SHA-256 digest over the\n * canonical content tuple for an RLS policy:\n *\n *   [normalize(using), normalize(withCheck), sortedRoles, operation, permissive]\n *\n * Schema and table are excluded (they are orthogonal to policy equivalence).\n * Uses `JSON.stringify` for a deterministic encoding.\n */\nexport function computeContentHash(parts: ContentHashParts): string {\n  const using = normalizePredicate(parts.using ?? '');\n  const withCheck = normalizePredicate(parts.withCheck ?? '');\n  const roles = [...new Set(parts.roles)].sort();\n  const permissive = parts.permissive ? 'permissive' : 'restrictive';\n\n  const tuple = JSON.stringify([using, withCheck, roles, parts.operation, permissive]);\n  return createHash('sha256').update(tuple).digest('hex').slice(0, 8);\n}\n","export interface RlsPolicyWireName {\n  /** The user-supplied part before the `_<8hex>` suffix. */\n  readonly prefix: string;\n  /** The 8-lowercase-hex content-hash suffix. */\n  readonly hash: string;\n}\n\nconst WIRE_NAME_PATTERN = /^(.+)_([0-9a-f]{8})$/;\n\n/**\n * Assembles an RLS policy wire name from its user-supplied prefix and its\n * 8-hex content-hash suffix. This module owns the `<prefix>_<hash>` format\n * on both sides — construction here and parsing in\n * {@link parseRlsPolicyWireName} — so the two never drift.\n */\nexport function formatRlsPolicyWireName(prefix: string, hash: string): string {\n  return `${prefix}_${hash}`;\n}\n\n/**\n * Splits an RLS policy wire name (`<prefix>_<8hex>`) into its prefix and\n * content-hash suffix. Returns `undefined` when the name does not follow the\n * wire-name shape (e.g. a policy created outside the toolchain) — callers\n * treat such names as all-prefix. Consumed by introspection (prefix\n * extraction) and by rename pairing (same hash, different prefix).\n */\nexport function parseRlsPolicyWireName(name: string): RlsPolicyWireName | undefined {\n  const match = WIRE_NAME_PATTERN.exec(name);\n  const prefix = match?.[1];\n  const hash = match?.[2];\n  if (prefix === undefined || hash === undefined) return undefined;\n  return { prefix, hash };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0BA,SAAgB,mBAAmB,KAAqB;CACtD,OAAO,IAAI,QAAQ,QAAQ,GAAG,CAAC,CAAC,KAAK;AACvC;;;;;;;;;;AAWA,SAAgB,mBAAmB,OAAiC;CAClE,MAAM,QAAQ,mBAAmB,MAAM,SAAS,EAAE;CAClD,MAAM,YAAY,mBAAmB,MAAM,aAAa,EAAE;CAC1D,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CAC7C,MAAM,aAAa,MAAM,aAAa,eAAe;CAErD,MAAM,QAAQ,KAAK,UAAU;EAAC;EAAO;EAAW;EAAO,MAAM;EAAW;CAAU,CAAC;CACnF,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;AACpE;;;ACxCA,MAAM,oBAAoB;;;;;;;AAQ1B,SAAgB,wBAAwB,QAAgB,MAAsB;CAC5E,OAAO,GAAG,OAAO,GAAG;AACtB;;;;;;;;AASA,SAAgB,uBAAuB,MAA6C;CAClF,MAAM,QAAQ,kBAAkB,KAAK,IAAI;CACzC,MAAM,SAAS,QAAQ;CACvB,MAAM,OAAO,QAAQ;CACrB,IAAI,WAAW,KAAA,KAAa,SAAS,KAAA,GAAW,OAAO,KAAA;CACvD,OAAO;EAAE;EAAQ;CAAK;AACxB"}

package/package.json

@@ -1,35 +1,35 @@
 {
   "name": "@prisma-next/target-postgres",
-  "version": "0.14.0-dev.55",
+  "version": "0.14.0-dev.56",
   "license": "Apache-2.0",
   "type": "module",
   "sideEffects": false,
   "description": "Postgres target pack for Prisma Next",
   "dependencies": {
-    "@prisma-next/cli": "0.14.0-dev.55",
-    "@prisma-next/contract": "0.14.0-dev.55",
-    "@prisma-next/errors": "0.14.0-dev.55",
-    "@prisma-next/family-sql": "0.14.0-dev.55",
-    "@prisma-next/framework-components": "0.14.0-dev.55",
-    "@prisma-next/migration-tools": "0.14.0-dev.55",
-    "@prisma-next/sql-contract": "0.14.0-dev.55",
-    "@prisma-next/sql-errors": "0.14.0-dev.55",
-    "@prisma-next/sql-operations": "0.14.0-dev.55",
-    "@prisma-next/sql-relational-core": "0.14.0-dev.55",
-    "@prisma-next/sql-schema-ir": "0.14.0-dev.55",
-    "@prisma-next/ts-render": "0.14.0-dev.55",
-    "@prisma-next/utils": "0.14.0-dev.55",
+    "@prisma-next/cli": "0.14.0-dev.56",
+    "@prisma-next/contract": "0.14.0-dev.56",
+    "@prisma-next/errors": "0.14.0-dev.56",
+    "@prisma-next/family-sql": "0.14.0-dev.56",
+    "@prisma-next/framework-components": "0.14.0-dev.56",
+    "@prisma-next/migration-tools": "0.14.0-dev.56",
+    "@prisma-next/psl-parser": "0.14.0-dev.56",
+    "@prisma-next/sql-contract": "0.14.0-dev.56",
+    "@prisma-next/sql-errors": "0.14.0-dev.56",
+    "@prisma-next/sql-operations": "0.14.0-dev.56",
+    "@prisma-next/sql-relational-core": "0.14.0-dev.56",
+    "@prisma-next/sql-schema-ir": "0.14.0-dev.56",
+    "@prisma-next/ts-render": "0.14.0-dev.56",
+    "@prisma-next/utils": "0.14.0-dev.56",
     "@standard-schema/spec": "^1.1.0",
     "arktype": "^2.2.0",
     "pathe": "^2.0.3"
   },
   "devDependencies": {
-    "@prisma-next/psl-parser": "0.14.0-dev.55",
-    "@prisma-next/psl-printer": "0.14.0-dev.55",
-    "@prisma-next/sql-contract-psl": "0.14.0-dev.55",
-    "@prisma-next/test-utils": "0.14.0-dev.55",
-    "@prisma-next/tsconfig": "0.14.0-dev.55",
-    "@prisma-next/tsdown": "0.14.0-dev.55",
+    "@prisma-next/psl-printer": "0.14.0-dev.56",
+    "@prisma-next/sql-contract-psl": "0.14.0-dev.56",
+    "@prisma-next/test-utils": "0.14.0-dev.56",
+    "@prisma-next/tsconfig": "0.14.0-dev.56",
+    "@prisma-next/tsdown": "0.14.0-dev.56",
     "tsdown": "0.22.1",
     "typescript": "5.9.3",
     "vitest": "4.1.8"

package/src/contract-free/ddl.ts

@@ -3,10 +3,12 @@ import {
   AddColumnAction,
   type AnyAlterTableAction,
   DropDefaultAction,
+  PostgresAlterPolicyRename,
   PostgresAlterTable,
   PostgresCreatePolicy,
   PostgresCreateSchema,
   PostgresCreateTable,
+  PostgresDisableRowLevelSecurity,
   PostgresDropPolicy,
   type RlsPolicyOperation,
 } from '../core/ddl/nodes';
@@ -106,3 +108,27 @@ export function dropPolicy(options: {
 }): PostgresDropPolicy {
   return new PostgresDropPolicy(options);
 }
+
+/**
+ * Build a Postgres `ALTER POLICY … RENAME TO` DDL node.
+ * Identifiers (`schema`, `table`, `name`, `newName`) are quoted by the renderer.
+ */
+export function alterPolicyRename(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly newName: string;
+}): PostgresAlterPolicyRename {
+  return new PostgresAlterPolicyRename(options);
+}
+
+/**
+ * Build a Postgres `ALTER TABLE … DISABLE ROW LEVEL SECURITY` DDL node.
+ * Identifiers (`schema`, `table`) are quoted by the renderer.
+ */
+export function disableRowLevelSecurity(options: {
+  readonly schema: string;
+  readonly table: string;
+}): PostgresDisableRowLevelSecurity {
+  return new PostgresDisableRowLevelSecurity(options);
+}

package/src/core/authoring.ts

@@ -4,21 +4,27 @@ import type {
   AuthoringEntityTypeFactoryOutput,
   AuthoringEntityTypeNamespace,
   AuthoringFieldNamespace,
+  AuthoringModelAttributeContext,
+  AuthoringModelAttributeDescriptorNamespace,
   AuthoringPslBlockDescriptorNamespace,
   AuthoringTypeNamespace,
   PslExtensionBlock,
 } from '@prisma-next/framework-components/authoring';
+import { modelAttribute } from '@prisma-next/psl-parser';
 import type { SqlValueSetDerivingEntityTypeOutput } from '@prisma-next/sql-contract/value-set-derivation-hook';
 import { PG_ENUM_CODEC_ID } from './codec-ids';
 import { PostgresNativeEnum } from './postgres-native-enum';
+import { PostgresRlsEnablement, type PostgresRlsEnablementInput } from './postgres-rls-enablement';
 import { PostgresRlsPolicy } from './postgres-rls-policy';
 import { PostgresRole, type PostgresRoleInput } from './postgres-role';
 import {
   PostgresNativeEnumSchema,
+  PostgresRlsEnablementSchema,
   PostgresRlsPolicySchema,
   PostgresRoleSchema,
 } from './postgres-validators';
 import { computeContentHash, normalizePredicate } from './rls/canonicalize';
+import { formatRlsPolicyWireName } from './rls/wire-name';
 
 /**
  * `pg.enum(<ref>)` registers as an ordinary type constructor whose sole
@@ -109,7 +115,7 @@ function lowerRlsPolicyFromBlock(
     operation: 'select',
     permissive: true,
   });
-  const wireName = `${prefix}_${wireHash}`;
+  const wireName = formatRlsPolicyWireName(prefix, wireHash);
 
   return new PostgresRlsPolicy({
     name: wireName,
@@ -253,6 +259,15 @@ export const postgresAuthoringEntityTypes = {
       factory: (input: PostgresRoleInput): PostgresRole => new PostgresRole(input),
     },
   },
+  rls: {
+    kind: 'entity',
+    discriminator: 'rls',
+    validatorSchema: PostgresRlsEnablementSchema,
+    output: {
+      factory: (input: PostgresRlsEnablementInput): PostgresRlsEnablement =>
+        new PostgresRlsEnablement(input),
+    },
+  },
   policy: {
     kind: 'entity',
     discriminator: 'policy',
@@ -312,6 +327,10 @@ export const postgresAuthoringPslBlockDescriptors = {
       },
       using: { kind: 'value', codecId: 'pg/text@1', required: true },
     },
+    // A policy may only target an RLS-controlled model: the model named by
+    // `target` must declare `@@rls`, or the load fails with a diagnostic
+    // naming the model and the policy prefix.
+    requiresModelAttribute: { parameter: 'target', attribute: 'rls' },
   },
   /**
    * PSL block descriptor for `native_enum`.
@@ -333,6 +352,30 @@ export const postgresAuthoringPslBlockDescriptors = {
   },
 } as const satisfies AuthoringPslBlockDescriptorNamespace;
 
+/**
+ * `@@` model attributes contributed by the Postgres target pack.
+ *
+ * `@@rls` is argument-less: presence marks the model's table
+ * RLS-controlled. It lowers to a {@link PostgresRlsEnablement} marker in
+ * the namespace's `entries.rls`, keyed by the model's table name — the
+ * marker (never the policy set) is what drives
+ * `ENABLE`/`DISABLE ROW LEVEL SECURITY` planning.
+ */
+export const postgresAuthoringModelAttributes = {
+  rls: {
+    kind: 'modelAttribute',
+    attribute: 'rls',
+    spec: modelAttribute('rls', {}),
+    lower: (_parsed: Record<never, never>, ctx: AuthoringModelAttributeContext) => ({
+      key: ctx.storageName,
+      entity: new PostgresRlsEnablement({
+        tableName: ctx.storageName,
+        namespaceId: ctx.namespaceId,
+      }),
+    }),
+  },
+} as const satisfies AuthoringModelAttributeDescriptorNamespace;
+
 export const postgresAuthoringFieldPresets = {
   text: {
     kind: 'fieldPreset',

package/src/core/ddl/nodes.ts

@@ -70,6 +70,8 @@ export interface PostgresDdlVisitor<R> {
   alterTable(node: PostgresAlterTable): R;
   createPolicy(node: PostgresCreatePolicy): R;
   dropPolicy(node: PostgresDropPolicy): R;
+  alterPolicyRename(node: PostgresAlterPolicyRename): R;
+  disableRowLevelSecurity(node: PostgresDisableRowLevelSecurity): R;
 }
 
 export abstract class PostgresDdlNode extends DdlNode {
@@ -214,9 +216,54 @@ export class PostgresDropPolicy extends PostgresDdlNode {
   }
 }
 
+export class PostgresAlterPolicyRename extends PostgresDdlNode {
+  readonly kind = 'alter-policy-rename' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly newName: string;
+
+  constructor(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly name: string;
+    readonly newName: string;
+  }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.newName = options.newName;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.alterPolicyRename(this);
+  }
+}
+
+export class PostgresDisableRowLevelSecurity extends PostgresDdlNode {
+  readonly kind = 'disable-row-level-security' as const;
+  readonly schema: string;
+  readonly table: string;
+
+  constructor(options: { readonly schema: string; readonly table: string }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.disableRowLevelSecurity(this);
+  }
+}
+
 export type AnyPostgresDdlNode =
   | PostgresCreateTable
   | PostgresCreateSchema
   | PostgresAlterTable
   | PostgresCreatePolicy
-  | PostgresDropPolicy;
+  | PostgresDropPolicy
+  | PostgresAlterPolicyRename
+  | PostgresDisableRowLevelSecurity;

package/src/core/descriptor-meta.ts

@@ -2,6 +2,7 @@ import type { CodecTypes } from '../exports/codec-types';
 import {
   postgresAuthoringEntityTypes,
   postgresAuthoringFieldPresets,
+  postgresAuthoringModelAttributes,
   postgresAuthoringPslBlockDescriptors,
   postgresAuthoringTypes,
 } from './authoring';
@@ -18,6 +19,7 @@ const postgresTargetDescriptorMetaBase = {
     field: postgresAuthoringFieldPresets,
     entityTypes: postgresAuthoringEntityTypes,
     pslBlockDescriptors: postgresAuthoringPslBlockDescriptors,
+    modelAttributes: postgresAuthoringModelAttributes,
     createNamespace: postgresCreateNamespace,
     qualifyColumnType: postgresQualifyColumnType,
   },

package/src/core/entity-kinds.ts

@@ -1,9 +1,11 @@
 import type { EntityKindDescriptor } from '@prisma-next/framework-components/ir';
 import { PostgresNativeEnum, type PostgresNativeEnumInput } from './postgres-native-enum';
+import { PostgresRlsEnablement, type PostgresRlsEnablementInput } from './postgres-rls-enablement';
 import { PostgresRlsPolicy, type PostgresRlsPolicyInput } from './postgres-rls-policy';
 import { PostgresRole, type PostgresRoleInput } from './postgres-role';
 import {
   PostgresNativeEnumSchema,
+  PostgresRlsEnablementSchema,
   PostgresRlsPolicySchema,
   PostgresRoleSchema,
 } from './postgres-validators';
@@ -20,6 +22,15 @@ export const roleEntityKind: EntityKindDescriptor<PostgresRoleInput, PostgresRol
   construct: (input) => new PostgresRole(input),
 };
 
+export const rlsEnablementEntityKind: EntityKindDescriptor<
+  PostgresRlsEnablementInput,
+  PostgresRlsEnablement
+> = {
+  kind: 'rls',
+  schema: PostgresRlsEnablementSchema,
+  construct: (input) => new PostgresRlsEnablement(input),
+};
+
 export const nativeEnumEntityKind: EntityKindDescriptor<
   PostgresNativeEnumInput,
   PostgresNativeEnum

package/src/core/migrations/contract-to-postgres-database-schema-node.ts

@@ -117,6 +117,9 @@ export function contractToPostgresDatabaseSchemaNode(
         ...ifDefined('annotations', sqlTable.annotations),
         ...ifDefined('checks', sqlTable.checks),
         policies: policiesByTable.get(tableName) ?? [],
+        // Marker-driven, never derived from the policy set: the `rls` entry
+        // is the single authored source of enablement.
+        rlsEnabled: Object.hasOwn(ns.rls, tableName),
       });
     }
 
@@ -127,6 +130,12 @@ export function contractToPostgresDatabaseSchemaNode(
           `contract-to-postgres-database-schema-node: policy "${policyName}" references table "${tableName}" not present in namespace "${ddlSchema}"`,
         );
       }
+      if (!Object.hasOwn(ns.rls, tableName)) {
+        const policyPrefix = tablePolicies[0]?.prefix ?? '(unknown)';
+        throw new Error(
+          `contract-to-postgres-database-schema-node: policy "${policyPrefix}" targets table "${tableName}" in namespace "${ddlSchema}", which is not RLS-controlled. Mark the model with @@rls (entries.rls["${tableName}"]) or remove the policy.`,
+        );
+      }
     }
 
     namespaces[ddlSchema] = new PostgresNamespaceSchemaNode({

package/src/core/migrations/control-policy.ts

@@ -7,6 +7,7 @@ import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { isPostgresSchema } from '../postgres-schema';
 import type { PostgresNamespaceSchemaNode } from '../schema-ir/postgres-namespace-schema-node';
+import { PostgresTableSchemaNode } from '../schema-ir/postgres-table-schema-node';
 import type { SqlSchemaDiffNode } from '../schema-ir/schema-node-kinds';
 import { PostgresSchemaNodeKind } from '../schema-ir/schema-node-kinds';
 import { issueColumnName } from './issue-planner';
@@ -163,9 +164,37 @@ const POSTGRES_NODE_CREATION_FACTORY: Readonly<Record<string, string>> = Object.
   [PostgresSchemaNodeKind.table]: 'createTable',
 });
 
+/**
+ * A table `not-equal` issue whose `rlsEnabled` flips OFF→ON (expected on,
+ * actual off) is enablement toward `ENABLE ROW LEVEL SECURITY` —
+ * creation-class per `OBJECT_CREATION_FACTORIES` ('enableRowLevelSecurity'
+ * is a member): enabling RLS establishes the fail-closed guard the declared
+ * policy set attaches to, the same grant `tolerated` extends to creating the
+ * policies themselves. The opposite direction (`DISABLE`) is a modification
+ * and stays managed-only. Keying on the actual delta (not just the expected
+ * bit) keeps this correct if a second table attribute ever joins
+ * `isEqualTo`: a not-equal with no `rlsEnabled` delta is not enablement, so
+ * it is not admitted as creation-class here.
+ */
+function isEnablementCreationIssue(issue: SchemaDiffIssue<SqlSchemaDiffNode>): boolean {
+  if (issue.reason !== 'not-equal') return false;
+  const { expected, actual } = issue;
+  return (
+    expected !== undefined &&
+    actual !== undefined &&
+    PostgresTableSchemaNode.is(expected) &&
+    PostgresTableSchemaNode.is(actual) &&
+    expected.rlsEnabled === true &&
+    actual.rlsEnabled === false
+  );
+}
+
 export function resolvePostgresNodeIssueCreationFactoryName(
   issue: SchemaDiffIssue<SqlSchemaDiffNode>,
 ): string | undefined {
+  if (isEnablementCreationIssue(issue)) {
+    return 'enableRowLevelSecurity';
+  }
   if (issue.reason !== 'not-found') return undefined;
   const node = issue.expected ?? issue.actual;
   if (node === undefined) return undefined;
@@ -215,7 +244,8 @@ export function resolvePostgresNodeIssueControlPolicySubject(
     entityName: tableName,
   });
   const createsNewObject =
-    node.nodeKind === PostgresSchemaNodeKind.table && issue.reason === 'not-found';
+    (node.nodeKind === PostgresSchemaNodeKind.table && issue.reason === 'not-found') ||
+    isEnablementCreationIssue(issue);
 
   return {
     namespaceId,

package/src/core/migrations/diff-database-schema.ts

@@ -70,6 +70,7 @@ export function normalizePostgresActualForDiff(
         ...ifDefined('annotations', actualTable.annotations),
         ...ifDefined('checks', actualTable.checks),
         policies: [...actualTable.policies],
+        rlsEnabled: actualTable.rlsEnabled,
       });
     }
     namespaces[nsId] = new PostgresNamespaceSchemaNode({