@prisma-next/target-postgres 0.14.0-dev.6 → 0.14.0-dev.61

package/dist/runtime.d.mts

@@ -1,6 +1,7 @@
+import { t as PostgresContractView } from "./postgres-contract-view-C9j5cqP0.mjs";
 import { AnyCodecDescriptor } from "@prisma-next/framework-components/codec";
-import { Namespace } from "@prisma-next/framework-components/ir";
-import { SqlNamespaceTablesInput, SqlStorage } from "@prisma-next/sql-contract/types";
+import { AnyEntityKindDescriptor, Namespace } from "@prisma-next/framework-components/ir";
+import { SqlNamespaceInput, SqlStorage } from "@prisma-next/sql-contract/types";
 import { SqlContractSerializerBase } from "@prisma-next/family-sql/ir";
 import { Contract } from "@prisma-next/contract/types";
 import { RuntimeTargetDescriptor, RuntimeTargetInstance } from "@prisma-next/framework-components/execution";
@@ -8,12 +9,9 @@ import { JsonObject } from "@prisma-next/utils/json";
 
 //#region src/core/postgres-contract-serializer.d.ts
 declare class PostgresContractSerializer extends SqlContractSerializerBase<Contract<SqlStorage>> {
-  constructor();
-  protected get defaultNamespaceId(): string;
-  protected hydrateSqlNamespaceEntry(nsId: string, raw: Namespace | Record<string, unknown>): Namespace | SqlNamespaceTablesInput;
+  constructor(extraPackEntityKinds?: readonly AnyEntityKindDescriptor[]);
+  protected hydrateSqlNamespaceEntry(nsId: string, raw: Record<string, unknown>): Namespace | SqlNamespaceInput;
   serializeContract(contract: Contract<SqlStorage>): JsonObject;
-  private serializePostgresNamespace;
-  private serializeJsonValue;
 }
 //#endregion
 //#region src/exports/runtime.d.ts
@@ -28,5 +26,5 @@ declare const postgresRuntimeTargetDescriptor: RuntimeTargetDescriptor<'sql', 'p
   readonly codecs: () => readonly AnyCodecDescriptor[];
 };
 //#endregion
-export { PostgresContractSerializer, PostgresRuntimeTargetInstance, postgresRuntimeTargetDescriptor as default };
+export { PostgresContractSerializer, PostgresContractView, PostgresRuntimeTargetInstance, postgresRuntimeTargetDescriptor as default };
 //# sourceMappingURL=runtime.d.mts.map

package/dist/runtime.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.mts","names":[],"sources":["../src/core/postgres-contract-serializer.ts","../src/exports/runtime.ts"],"mappings":";;;;;;;;;cAkEa,0BAAA,SAAmC,yBAAA,CAA0B,QAAA,CAAS,UAAA;;gBAM1D,kBAAA;EAAA,UAIJ,wBAAA,CACjB,IAAA,UACA,GAAA,EAAK,SAAA,GAAY,MAAA,oBAChB,SAAA,GAAY,uBAAA;EA0BN,iBAAA,CAAkB,QAAA,EAAU,QAAA,CAAS,UAAA,IAAc,UAAA;EAAA,QAuCpD,0BAAA;EAAA,QAyBA,kBAAA;AAAA;;;UChKO,6BAAA,SAAsC,qBAAqB;;;;;ADyD5E;;cCjDM,+BAAA,EAAiC,uBAAA,oBAGrC,6BAAA;EAAA,SAES,MAAA,iBAAuB,kBAAA;AAAA"}
+{"version":3,"file":"runtime.d.mts","names":[],"sources":["../src/core/postgres-contract-serializer.ts","../src/exports/runtime.ts"],"mappings":";;;;;;;;;;cA0Ea,0BAAA,SAAmC,yBAAA,CAA0B,QAAA,CAAS,UAAA;cACrE,oBAAA,YAA+B,uBAAA;EAAA,UAWxB,wBAAA,CACjB,IAAA,UACA,GAAA,EAAK,MAAA,oBACJ,SAAA,GAAY,iBAAA;EAyBN,iBAAA,CAAkB,QAAA,EAAU,QAAA,CAAS,UAAA,IAAc,UAAA;AAAA;;;UCxG7C,6BAAA,SAAsC,qBAAqB;;;;;ADgE5E;;cCxDM,+BAAA,EAAiC,uBAAA,oBAGrC,6BAAA;EAAA,SAES,MAAA,iBAAuB,kBAAA;AAAA"}

package/dist/runtime.mjs

@@ -1,5 +1,5 @@
-import { n as postgresTargetDescriptorMetaRuntime } from "./descriptor-meta-CpGygXpI.mjs";
-import { t as PostgresContractSerializer } from "./postgres-contract-serializer-k3TAcPMY.mjs";
+import { t as postgresTargetDescriptorMetaRuntime } from "./descriptor-meta-runtime-UwYdV8fD.mjs";
+import { n as PostgresContractSerializer, t as PostgresContractView } from "./postgres-contract-view-DWLNQbdR.mjs";
 //#region src/exports/runtime.ts
 /**
 * Target-postgres deliberately does NOT import `SqlRuntimeTargetDescriptor` from `@prisma-next/sql-runtime`. The target package is a control-plane residence and must not pull the SQL execution-plane package into its dependency closure. The runtime descriptor here is shaped to satisfy the framework's `RuntimeTargetDescriptor` plus the structural `SqlStaticContributions` (`codecs:` returning a descriptor list) that
@@ -18,6 +18,6 @@ const postgresRuntimeTargetDescriptor = {
 	}
 };
 //#endregion
-export { PostgresContractSerializer, postgresRuntimeTargetDescriptor as default };
+export { PostgresContractSerializer, PostgresContractView, postgresRuntimeTargetDescriptor as default };
 
 //# sourceMappingURL=runtime.mjs.map

package/dist/runtime.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.mjs","names":[],"sources":["../src/exports/runtime.ts"],"sourcesContent":["import type { AnyCodecDescriptor } from '@prisma-next/framework-components/codec';\nimport type {\n  RuntimeTargetDescriptor,\n  RuntimeTargetInstance,\n} from '@prisma-next/framework-components/execution';\nimport { postgresTargetDescriptorMetaRuntime } from '../core/descriptor-meta-runtime';\n\nexport { PostgresContractSerializer } from '../core/postgres-contract-serializer';\n\nexport interface PostgresRuntimeTargetInstance extends RuntimeTargetInstance<'sql', 'postgres'> {}\n\n/**\n * Target-postgres deliberately does NOT import `SqlRuntimeTargetDescriptor` from `@prisma-next/sql-runtime`. The target package is a control-plane residence and must not pull the SQL execution-plane package into its dependency closure. The runtime descriptor here is shaped to satisfy the framework's `RuntimeTargetDescriptor` plus the structural `SqlStaticContributions` (`codecs:` returning a descriptor list) that\n * `@prisma-next/sql-runtime` consumers narrow to at composition time.\n *\n * The target itself contributes no codecs — postgres-specific codecs ship from the postgres adapter and from extension packs (pgvector, arktype-json, etc.).\n */\nconst postgresRuntimeTargetDescriptor: RuntimeTargetDescriptor<\n  'sql',\n  'postgres',\n  PostgresRuntimeTargetInstance\n> & {\n  readonly codecs: () => readonly AnyCodecDescriptor[];\n} = {\n  ...postgresTargetDescriptorMetaRuntime,\n  codecs: () => [],\n  create(): PostgresRuntimeTargetInstance {\n    return {\n      familyId: 'sql',\n      targetId: 'postgres',\n    };\n  },\n};\n\nexport default postgresRuntimeTargetDescriptor;\n"],"mappings":";;;;;;;;;AAiBA,MAAM,kCAMF;CACF,GAAG;CACH,cAAc,CAAC;CACf,SAAwC;EACtC,OAAO;GACL,UAAU;GACV,UAAU;EACZ;CACF;AACF"}
+{"version":3,"file":"runtime.mjs","names":[],"sources":["../src/exports/runtime.ts"],"sourcesContent":["import type { AnyCodecDescriptor } from '@prisma-next/framework-components/codec';\nimport type {\n  RuntimeTargetDescriptor,\n  RuntimeTargetInstance,\n} from '@prisma-next/framework-components/execution';\nimport { postgresTargetDescriptorMetaRuntime } from '../core/descriptor-meta-runtime';\n\nexport { PostgresContractSerializer } from '../core/postgres-contract-serializer';\nexport { PostgresContractView } from '../core/postgres-contract-view';\n\nexport interface PostgresRuntimeTargetInstance extends RuntimeTargetInstance<'sql', 'postgres'> {}\n\n/**\n * Target-postgres deliberately does NOT import `SqlRuntimeTargetDescriptor` from `@prisma-next/sql-runtime`. The target package is a control-plane residence and must not pull the SQL execution-plane package into its dependency closure. The runtime descriptor here is shaped to satisfy the framework's `RuntimeTargetDescriptor` plus the structural `SqlStaticContributions` (`codecs:` returning a descriptor list) that\n * `@prisma-next/sql-runtime` consumers narrow to at composition time.\n *\n * The target itself contributes no codecs — postgres-specific codecs ship from the postgres adapter and from extension packs (pgvector, arktype-json, etc.).\n */\nconst postgresRuntimeTargetDescriptor: RuntimeTargetDescriptor<\n  'sql',\n  'postgres',\n  PostgresRuntimeTargetInstance\n> & {\n  readonly codecs: () => readonly AnyCodecDescriptor[];\n} = {\n  ...postgresTargetDescriptorMetaRuntime,\n  codecs: () => [],\n  create(): PostgresRuntimeTargetInstance {\n    return {\n      familyId: 'sql',\n      targetId: 'postgres',\n    };\n  },\n};\n\nexport default postgresRuntimeTargetDescriptor;\n"],"mappings":";;;;;;;;;AAkBA,MAAM,kCAMF;CACF,GAAG;CACH,cAAc,CAAC;CACf,SAAwC;EACtC,OAAO;GACL,UAAU;GACV,UAAU;EACZ;CACF;AACF"}

package/dist/schema-ir-annotations.d.mts

@@ -0,0 +1,15 @@
+import { SqlStorage } from "@prisma-next/sql-contract/types";
+
+//#region src/core/migrations/resolve-ddl-schema.d.ts
+/**
+ * Given the contract's storage and a namespace id, returns the live Postgres
+ * DDL schema name that namespace maps to. A named Postgres namespace dispatches
+ * to its `ddlSchemaName(storage)`; the unbound sentinel resolves to
+ * `DEFAULT_NAMESPACE_ID` (the search-path default for offline planning); a
+ * bare object payload (used by some tests) falls back to the namespace id
+ * itself.
+ */
+declare function resolveDdlSchemaForNamespaceStorage(storage: SqlStorage, namespaceId: string): string;
+//#endregion
+export { resolveDdlSchemaForNamespaceStorage };
+//# sourceMappingURL=schema-ir-annotations.d.mts.map

package/dist/schema-ir-annotations.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-ir-annotations.d.mts","names":[],"sources":["../src/core/migrations/resolve-ddl-schema.ts"],"mappings":";;;;;AAaA;;;;;;iBAAgB,mCAAA,CACd,OAAA,EAAS,UAAU,EACnB,WAAA"}

package/dist/schema-ir-annotations.mjs

@@ -0,0 +1,2 @@
+import { t as resolveDdlSchemaForNamespaceStorage } from "./resolve-ddl-schema-ZkKxt2Fm.mjs";
+export { resolveDdlSchemaForNamespaceStorage };

package/dist/types.d.mts

@@ -1,141 +1,5 @@
-import { t as PostgresTableSource } from "./table-source-BvFo7gVs.mjs";
+import { n as PostgresRlsPolicyInput, r as RlsPolicyOperation, t as PostgresRlsPolicy } from "./postgres-rls-policy--CSddvMR.mjs";
+import { a as PostgresNamespaceSchemaNode, c as PostgresTableSchemaNode, d as PostgresPolicySchemaNodeInput, i as PostgresRoleSchemaNodeInput, l as PostgresTableSchemaNodeInput, n as PostgresDatabaseSchemaNodeInput, o as PostgresNamespaceSchemaNodeInput, r as PostgresRoleSchemaNode, s as PostgresNativeEnumIntrospection, t as PostgresDatabaseSchemaNode, u as PostgresPolicySchemaNode } from "./postgres-database-schema-node-BVdOffjC.mjs";
 import { t as PostgresColumnDefault } from "./types-BDKkx8MA.mjs";
-import { NamespaceBase } from "@prisma-next/framework-components/ir";
-import { CfExpr } from "@prisma-next/sql-relational-core/contract-free";
-import { SqlNamespaceEntries, SqlNamespaceTablesInput, SqlStorage, StorageTable, StorageValueSet } from "@prisma-next/sql-contract/types";
-
-//#region src/core/postgres-schema.d.ts
-interface PostgresSchemaInput {
-  readonly id: string;
-  readonly entries: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
-}
-/**
- * Postgres target `Namespace` concretion — a Postgres schema (`CREATE
- * SCHEMA …`). Each Postgres `SqlStorage` carries a
- * `namespaces: Record<NamespaceId, PostgresSchema>` map populated by
- * the Postgres PSL interpreter from `namespace { … }` AST buckets.
- *
- * `entries` holds entity-kind maps (`table`, `valueSet`). Qualifier
- * emission is the rendering seam: DDL / SQL emission asks the namespace
- * for its qualifier (`"<schema>"`) or for a qualified table name
- * (`"<schema>"."<table>"`) and consumes the result polymorphically.
- * The unbound singleton below overrides these methods to elide the
- * prefix entirely — call sites stay polymorphic and never branch on
- * `id === UNBOUND_NAMESPACE_ID`.
- */
-declare class PostgresSchema extends NamespaceBase {
-  /**
-   * Stable singleton reference for the late-bound slot. Materialised
-   * lazily below the singleton subclass declaration so the static
-   * initialiser sees the subclass before assigning. Consumers always
-   * reach for `PostgresSchema.unbound` (or `PostgresUnboundSchema.instance`
-   * — same identity).
-   */
-  static unbound: PostgresUnboundSchema;
-  readonly kind: 'schema';
-  readonly id: string;
-  readonly entries: SqlNamespaceEntries;
-  constructor(input: PostgresSchemaInput);
-  get table(): Readonly<Record<string, StorageTable>>;
-  get valueSet(): Readonly<Record<string, StorageValueSet>> | undefined;
-  /**
-   * The bare schema qualifier as it would appear in a rendered SQL
-   * fragment (already quoted). The unbound-schema singleton overrides
-   * this to return `''`.
-   */
-  qualifier(): string;
-  /**
-   * Qualify a table name with the schema prefix
-   * (`"<schema>"."<table>"`). The unbound-schema singleton overrides
-   * this to emit just `"<table>"` so the resolved DDL is unqualified
-   * and `search_path` decides where the object lands at runtime.
-   */
-  qualifyTable(tableName: string): string;
-  /**
-   * Render a SQL string-literal containing the qualified-name form
-   * suitable for `to_regclass(...)` arguments (e.g. `'"public"."user"'`).
-   * The unbound singleton overrides this to elide the schema prefix
-   * (`'"user"'`) so `search_path` resolves the object at runtime.
-   */
-  regclassLiteral(name: string): string;
-  /**
-   * Render a SQL expression that evaluates to this namespace's schema
-   * name at runtime, ready to drop into a `WHERE table_schema = …` /
-   * `WHERE n.nspname = …` clause. Named schemas emit a quoted SQL
-   * literal (`'public'`); the unbound singleton overrides this to emit
-   * `current_schema()` so catalog queries match whichever schema the
-   * connection's `search_path` resolved at runtime.
-   */
-  schemaSqlExpression(): string;
-  /**
-   * Typed-AST counterpart of {@link schemaSqlExpression}: the expression a
-   * builder-built catalog check compares `n.nspname` / `table_schema`
-   * against. Named schemas bind the schema name as a text parameter; the
-   * unbound singleton overrides this to the opaque `current_schema()`
-   * expression so the live connection's `search_path` decides at runtime.
-   */
-  schemaFilterExpression(): CfExpr;
-  /**
-   * Typed-AST counterpart of {@link qualifyTable}: the FROM source a
-   * builder-built check uses to address a user table in this namespace.
-   * Named schemas qualify (`"schema"."table"`); the unbound singleton
-   * overrides this to leave the table unqualified so `search_path`
-   * resolves it at runtime.
-   */
-  tableSource(tableName: string, alias?: string): PostgresTableSource;
-  /**
-   * The bare schema name a DDL planner should target when emitting
-   * statements that need to identify this namespace in the live
-   * database (e.g. `CREATE TABLE "<ddlSchemaName>"."<table>" …`,
-   * catalog filters, planner conflict lookups). Named schemas resolve
-   * to their own id. The `PostgresUnboundSchema` singleton inherits
-   * this and returns `UNBOUND_NAMESPACE_ID` — callers that dispatch
-   * through `qualifyTableName` route through the polymorphic
-   * `PostgresUnboundSchema` overrides and produce unqualified
-   * (search-path-resolved) output automatically.
-   */
-  ddlSchemaName(_storage: SqlStorage): string;
-}
-/**
- * Singleton subclass for the reserved sentinel namespace id
- * (`UNBOUND_NAMESPACE_ID`) — the late-bound Postgres slot whose binding
- * the connection's `search_path` resolves at runtime. Overrides
- * qualifier emission to elide the schema prefix; call sites that consume
- * `qualifier()` / `qualifyTable()` get unqualified output without
- * branching on the namespace id.
- *
- * This is the target-side materialization of "the framework provides
- * affordances; targets implement specifics": the framework names the
- * sentinel; Postgres decides what late-bound means here (the table
- * name, naked — the schema is supplied by the live connection's
- * `search_path`).
- *
- * `ddlSchemaName` is inherited from `PostgresSchema` and returns
- * `UNBOUND_NAMESPACE_ID`. Downstream helpers such as `qualifyTableName`
- * route through the polymorphic factory and produce unqualified output
- * automatically.
- */
-declare class PostgresUnboundSchema extends PostgresSchema {
-  static readonly instance: PostgresUnboundSchema;
-  constructor(input?: PostgresSchemaInput);
-  qualifier(): string;
-  qualifyTable(tableName: string): string;
-  schemaSqlExpression(): string;
-  schemaFilterExpression(): CfExpr;
-  tableSource(tableName: string, alias?: string): PostgresTableSource;
-}
-/**
- * Target-supplied `Namespace` factory the Postgres target plumbs
- * through `defineContract({ createNamespace })` and the SQL PSL
- * interpreter. Returns the unbound singleton for the framework
- * sentinel and a fresh `PostgresSchema` for any other coordinate.
- *
- * The factory has no per-call state — every named id deterministically
- * maps to a distinct schema instance — so callers can pass it through
- * by reference and trust the resulting `SqlStorage.namespaces` map to
- * be value-stable for a given input set.
- */
-declare function postgresCreateNamespace(input: SqlNamespaceTablesInput): PostgresSchema;
-//#endregion
-export { type PostgresColumnDefault, PostgresSchema, PostgresUnboundSchema, postgresCreateNamespace };
-//# sourceMappingURL=types.d.mts.map
+import { a as postgresCreateNamespace, c as PostgresRlsEnablement, d as PostgresRoleInput, i as isPostgresSchema, l as PostgresRlsEnablementInput, n as PostgresSchema, o as PostgresNativeEnum, r as PostgresUnboundSchema, s as PostgresNativeEnumInput, t as PostgresContract, u as PostgresRole } from "./postgres-schema-DsrtYp2v.mjs";
+export { type PostgresColumnDefault, type PostgresContract, PostgresDatabaseSchemaNode, type PostgresDatabaseSchemaNodeInput, PostgresNamespaceSchemaNode, type PostgresNamespaceSchemaNodeInput, PostgresNativeEnum, type PostgresNativeEnumInput, type PostgresNativeEnumIntrospection, PostgresPolicySchemaNode, type PostgresPolicySchemaNodeInput, PostgresRlsEnablement, type PostgresRlsEnablementInput, PostgresRlsPolicy, type PostgresRlsPolicyInput, PostgresRole, type PostgresRoleInput, PostgresRoleSchemaNode, type PostgresRoleSchemaNodeInput, PostgresSchema, PostgresTableSchemaNode, type PostgresTableSchemaNodeInput, PostgresUnboundSchema, type RlsPolicyOperation, isPostgresSchema, postgresCreateNamespace };

package/dist/types.mjs

@@ -1,2 +1,5 @@
-import { i as postgresCreateNamespace, n as PostgresUnboundSchema, t as PostgresSchema } from "./postgres-schema-COGZ1ark.mjs";
-export { PostgresSchema, PostgresUnboundSchema, postgresCreateNamespace };
+import { t as PostgresNativeEnum } from "./postgres-native-enum-xdiqmBf_.mjs";
+import { _ as PostgresRlsEnablement, g as PostgresRlsPolicy, i as postgresCreateNamespace, m as PostgresRole, n as PostgresUnboundSchema, r as isPostgresSchema, t as PostgresSchema } from "./postgres-schema-COEca21H.mjs";
+import { t as PostgresTableSchemaNode } from "./postgres-table-schema-node-9FCtCUz2.mjs";
+import { i as PostgresDatabaseSchemaNode, n as PostgresPolicySchemaNode, r as PostgresNamespaceSchemaNode, t as PostgresRoleSchemaNode } from "./postgres-role-schema-node-BmCboEa_.mjs";
+export { PostgresDatabaseSchemaNode, PostgresNamespaceSchemaNode, PostgresNativeEnum, PostgresPolicySchemaNode, PostgresRlsEnablement, PostgresRlsPolicy, PostgresRole, PostgresRoleSchemaNode, PostgresSchema, PostgresTableSchemaNode, PostgresUnboundSchema, isPostgresSchema, postgresCreateNamespace };

package/dist/wire-name-rHHtr1h0.mjs

@@ -0,0 +1,75 @@
+import { createHash } from "node:crypto";
+//#region src/core/rls/canonicalize.ts
+/**
+* Stabilizes an authored predicate for hashing: trim, and collapse runs of
+* internal whitespace to a single space.
+*
+* This is deliberately minimal. The content hash is the equivalence relation
+* for a policy, and the wire name (prefix + hash) is the only thing ever
+* compared — we never recompute the hash from an introspected policy body, so
+* there is no need to match Postgres's reprinted form. Minimal normalization
+* also protects the no-collision property: aggressive rewriting (lowercasing,
+* paren-stripping, cast-alias folding) risks collapsing two distinct predicates
+* onto one hash. Out-of-band alteration of a hashed policy is unsupported.
+*
+* The normalizer is a stability commitment: any change re-suffixes all wire names.
+*/
+function normalizePredicate(sql) {
+	return sql.replace(/\s+/g, " ").trim();
+}
+/**
+* Returns the first 8 lowercase hex characters of the SHA-256 digest over the
+* canonical content tuple for an RLS policy:
+*
+*   [normalize(using), normalize(withCheck), sortedRoles, operation, permissive]
+*
+* Schema and table are excluded (they are orthogonal to policy equivalence).
+* Uses `JSON.stringify` for a deterministic encoding.
+*/
+function computeContentHash(parts) {
+	const using = normalizePredicate(parts.using ?? "");
+	const withCheck = normalizePredicate(parts.withCheck ?? "");
+	const roles = [...new Set(parts.roles)].sort();
+	const permissive = parts.permissive ? "permissive" : "restrictive";
+	const tuple = JSON.stringify([
+		using,
+		withCheck,
+		roles,
+		parts.operation,
+		permissive
+	]);
+	return createHash("sha256").update(tuple).digest("hex").slice(0, 8);
+}
+//#endregion
+//#region src/core/rls/wire-name.ts
+const WIRE_NAME_PATTERN = /^(.+)_([0-9a-f]{8})$/;
+/**
+* Assembles an RLS policy wire name from its user-supplied prefix and its
+* 8-hex content-hash suffix. This module owns the `<prefix>_<hash>` format
+* on both sides — construction here and parsing in
+* {@link parseRlsPolicyWireName} — so the two never drift.
+*/
+function formatRlsPolicyWireName(prefix, hash) {
+	return `${prefix}_${hash}`;
+}
+/**
+* Splits an RLS policy wire name (`<prefix>_<8hex>`) into its prefix and
+* content-hash suffix. Returns `undefined` when the name does not follow the
+* wire-name shape (e.g. a policy created outside the toolchain) — callers
+* treat such names as all-prefix. Consumed by introspection (prefix
+* extraction) and by rename pairing (same hash, different prefix).
+*/
+function parseRlsPolicyWireName(name) {
+	const match = WIRE_NAME_PATTERN.exec(name);
+	const prefix = match?.[1];
+	const hash = match?.[2];
+	if (prefix === void 0 || hash === void 0) return void 0;
+	return {
+		prefix,
+		hash
+	};
+}
+//#endregion
+export { normalizePredicate as i, parseRlsPolicyWireName as n, computeContentHash as r, formatRlsPolicyWireName as t };
+
+//# sourceMappingURL=wire-name-rHHtr1h0.mjs.map

package/dist/wire-name-rHHtr1h0.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-name-rHHtr1h0.mjs","names":[],"sources":["../src/core/rls/canonicalize.ts","../src/core/rls/wire-name.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nexport type RlsPolicyOperation = 'select' | 'insert' | 'update' | 'delete' | 'all';\n\nexport interface ContentHashParts {\n  readonly using?: string;\n  readonly withCheck?: string;\n  readonly roles: readonly string[];\n  readonly operation: RlsPolicyOperation;\n  readonly permissive: boolean;\n}\n\n/**\n * Stabilizes an authored predicate for hashing: trim, and collapse runs of\n * internal whitespace to a single space.\n *\n * This is deliberately minimal. The content hash is the equivalence relation\n * for a policy, and the wire name (prefix + hash) is the only thing ever\n * compared — we never recompute the hash from an introspected policy body, so\n * there is no need to match Postgres's reprinted form. Minimal normalization\n * also protects the no-collision property: aggressive rewriting (lowercasing,\n * paren-stripping, cast-alias folding) risks collapsing two distinct predicates\n * onto one hash. Out-of-band alteration of a hashed policy is unsupported.\n *\n * The normalizer is a stability commitment: any change re-suffixes all wire names.\n */\nexport function normalizePredicate(sql: string): string {\n  return sql.replace(/\\s+/g, ' ').trim();\n}\n\n/**\n * Returns the first 8 lowercase hex characters of the SHA-256 digest over the\n * canonical content tuple for an RLS policy:\n *\n *   [normalize(using), normalize(withCheck), sortedRoles, operation, permissive]\n *\n * Schema and table are excluded (they are orthogonal to policy equivalence).\n * Uses `JSON.stringify` for a deterministic encoding.\n */\nexport function computeContentHash(parts: ContentHashParts): string {\n  const using = normalizePredicate(parts.using ?? '');\n  const withCheck = normalizePredicate(parts.withCheck ?? '');\n  const roles = [...new Set(parts.roles)].sort();\n  const permissive = parts.permissive ? 'permissive' : 'restrictive';\n\n  const tuple = JSON.stringify([using, withCheck, roles, parts.operation, permissive]);\n  return createHash('sha256').update(tuple).digest('hex').slice(0, 8);\n}\n","export interface RlsPolicyWireName {\n  /** The user-supplied part before the `_<8hex>` suffix. */\n  readonly prefix: string;\n  /** The 8-lowercase-hex content-hash suffix. */\n  readonly hash: string;\n}\n\nconst WIRE_NAME_PATTERN = /^(.+)_([0-9a-f]{8})$/;\n\n/**\n * Assembles an RLS policy wire name from its user-supplied prefix and its\n * 8-hex content-hash suffix. This module owns the `<prefix>_<hash>` format\n * on both sides — construction here and parsing in\n * {@link parseRlsPolicyWireName} — so the two never drift.\n */\nexport function formatRlsPolicyWireName(prefix: string, hash: string): string {\n  return `${prefix}_${hash}`;\n}\n\n/**\n * Splits an RLS policy wire name (`<prefix>_<8hex>`) into its prefix and\n * content-hash suffix. Returns `undefined` when the name does not follow the\n * wire-name shape (e.g. a policy created outside the toolchain) — callers\n * treat such names as all-prefix. Consumed by introspection (prefix\n * extraction) and by rename pairing (same hash, different prefix).\n */\nexport function parseRlsPolicyWireName(name: string): RlsPolicyWireName | undefined {\n  const match = WIRE_NAME_PATTERN.exec(name);\n  const prefix = match?.[1];\n  const hash = match?.[2];\n  if (prefix === undefined || hash === undefined) return undefined;\n  return { prefix, hash };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0BA,SAAgB,mBAAmB,KAAqB;CACtD,OAAO,IAAI,QAAQ,QAAQ,GAAG,CAAC,CAAC,KAAK;AACvC;;;;;;;;;;AAWA,SAAgB,mBAAmB,OAAiC;CAClE,MAAM,QAAQ,mBAAmB,MAAM,SAAS,EAAE;CAClD,MAAM,YAAY,mBAAmB,MAAM,aAAa,EAAE;CAC1D,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CAC7C,MAAM,aAAa,MAAM,aAAa,eAAe;CAErD,MAAM,QAAQ,KAAK,UAAU;EAAC;EAAO;EAAW;EAAO,MAAM;EAAW;CAAU,CAAC;CACnF,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;AACpE;;;ACxCA,MAAM,oBAAoB;;;;;;;AAQ1B,SAAgB,wBAAwB,QAAgB,MAAsB;CAC5E,OAAO,GAAG,OAAO,GAAG;AACtB;;;;;;;;AASA,SAAgB,uBAAuB,MAA6C;CAClF,MAAM,QAAQ,kBAAkB,KAAK,IAAI;CACzC,MAAM,SAAS,QAAQ;CACvB,MAAM,OAAO,QAAQ;CACrB,IAAI,WAAW,KAAA,KAAa,SAAS,KAAA,GAAW,OAAO,KAAA;CACvD,OAAO;EAAE;EAAQ;CAAK;AACxB"}

package/package.json

@@ -1,32 +1,35 @@
 {
   "name": "@prisma-next/target-postgres",
-  "version": "0.14.0-dev.6",
+  "version": "0.14.0-dev.61",
   "license": "Apache-2.0",
   "type": "module",
   "sideEffects": false,
   "description": "Postgres target pack for Prisma Next",
   "dependencies": {
-    "@prisma-next/cli": "0.14.0-dev.6",
-    "@prisma-next/contract": "0.14.0-dev.6",
-    "@prisma-next/errors": "0.14.0-dev.6",
-    "@prisma-next/family-sql": "0.14.0-dev.6",
-    "@prisma-next/framework-components": "0.14.0-dev.6",
-    "@prisma-next/migration-tools": "0.14.0-dev.6",
-    "@prisma-next/ts-render": "0.14.0-dev.6",
-    "@prisma-next/sql-contract": "0.14.0-dev.6",
-    "@prisma-next/sql-errors": "0.14.0-dev.6",
-    "@prisma-next/sql-operations": "0.14.0-dev.6",
-    "@prisma-next/sql-relational-core": "0.14.0-dev.6",
-    "@prisma-next/sql-schema-ir": "0.14.0-dev.6",
-    "@prisma-next/utils": "0.14.0-dev.6",
+    "@prisma-next/cli": "0.14.0-dev.61",
+    "@prisma-next/contract": "0.14.0-dev.61",
+    "@prisma-next/errors": "0.14.0-dev.61",
+    "@prisma-next/family-sql": "0.14.0-dev.61",
+    "@prisma-next/framework-components": "0.14.0-dev.61",
+    "@prisma-next/migration-tools": "0.14.0-dev.61",
+    "@prisma-next/psl-parser": "0.14.0-dev.61",
+    "@prisma-next/sql-contract": "0.14.0-dev.61",
+    "@prisma-next/sql-errors": "0.14.0-dev.61",
+    "@prisma-next/sql-operations": "0.14.0-dev.61",
+    "@prisma-next/sql-relational-core": "0.14.0-dev.61",
+    "@prisma-next/sql-schema-ir": "0.14.0-dev.61",
+    "@prisma-next/ts-render": "0.14.0-dev.61",
+    "@prisma-next/utils": "0.14.0-dev.61",
     "@standard-schema/spec": "^1.1.0",
     "arktype": "^2.2.0",
     "pathe": "^2.0.3"
   },
   "devDependencies": {
-    "@prisma-next/test-utils": "0.14.0-dev.6",
-    "@prisma-next/tsconfig": "0.14.0-dev.6",
-    "@prisma-next/tsdown": "0.14.0-dev.6",
+    "@prisma-next/psl-printer": "0.14.0-dev.61",
+    "@prisma-next/sql-contract-psl": "0.14.0-dev.61",
+    "@prisma-next/test-utils": "0.14.0-dev.61",
+    "@prisma-next/tsconfig": "0.14.0-dev.61",
+    "@prisma-next/tsdown": "0.14.0-dev.61",
     "tsdown": "0.22.1",
     "typescript": "5.9.3",
     "vitest": "4.1.8"
@@ -53,6 +56,7 @@
     "./data-transform": "./dist/data-transform.mjs",
     "./ddl": "./dist/ddl.mjs",
     "./default-normalizer": "./dist/default-normalizer.mjs",
+    "./diff-database-schema": "./dist/diff-database-schema.mjs",
     "./errors": "./dist/errors.mjs",
     "./issue-planner": "./dist/issue-planner.mjs",
     "./migration": "./dist/migration.mjs",
@@ -68,7 +72,9 @@
     "./planner-target-details": "./dist/planner-target-details.mjs",
     "./render-ops": "./dist/render-ops.mjs",
     "./render-typescript": "./dist/render-typescript.mjs",
+    "./rls-canonicalize": "./dist/rls-canonicalize.mjs",
     "./runtime": "./dist/runtime.mjs",
+    "./schema-ir-annotations": "./dist/schema-ir-annotations.mjs",
     "./sql-utils": "./dist/sql-utils.mjs",
     "./types": "./dist/types.mjs",
     "./package.json": "./package.json"

package/src/contract-free/checks.ts

@@ -345,6 +345,79 @@ export function extensionExistsAst(extensionName: string): ExtensionExistsCheckB
   };
 }
 
+export interface RlsPolicyExistsCheckBuilder {
+  policyPresent(): SelectAst;
+  policyAbsent(): SelectAst;
+}
+
+/**
+ * Typed RLS-policy existence check over `pg_policies`, with schema, table,
+ * and policy names bound as text parameters (never inlined). The `schema`
+ * coordinate is the resolved live-database schema name (e.g. `'public'`),
+ * compared against `pg_policies.schemaname` as a bound parameter.
+ */
+export function rlsPolicyExistsAst(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly policyName: string;
+}): RlsPolicyExistsCheckBuilder {
+  const inner = () =>
+    exprSelect()
+      .from(cfTable('pg_policies'))
+      .project('one', cfExpr.lit(1))
+      .where(
+        cfExpr.allOf([
+          cfExpr.identifierRef('schemaname').eqParam(options.schema, PG_TEXT_CODEC_ID),
+          cfExpr.identifierRef('tablename').eqParam(options.table, PG_TEXT_CODEC_ID),
+          cfExpr.identifierRef('policyname').eqParam(options.policyName, PG_TEXT_CODEC_ID),
+        ]),
+      );
+  return {
+    policyPresent: () => exprSelect().project('result', cfExpr.exists(inner())).build(),
+    policyAbsent: () => exprSelect().project('result', cfExpr.notExists(inner())).build(),
+  };
+}
+
+export interface RlsEnabledCheckBuilder {
+  rlsEnabled(): SelectAst;
+  rlsDisabled(): SelectAst;
+}
+
+/**
+ * Typed row-level-security enabled check over `pg_class` joined to
+ * `pg_namespace`, comparing `pg_class.relrowsecurity` against the expected
+ * boolean. Schema and table names are bound as text parameters.
+ */
+export function rlsEnabledAst(schema: string, table: string): RlsEnabledCheckBuilder {
+  const inner = (enabled: boolean) =>
+    exprSelect()
+      .from(cfTable('pg_class', 'c'))
+      .join(
+        cfTable('pg_namespace', 'n'),
+        cfExpr.columnRef('n', 'oid').eqExpr(cfExpr.columnRef('c', 'relnamespace')),
+      )
+      .project('one', cfExpr.lit(1))
+      .where(
+        cfExpr.allOf([
+          cfExpr.columnRef('n', 'nspname').eqParam(schema, PG_TEXT_CODEC_ID),
+          cfExpr.columnRef('c', 'relname').eqParam(table, PG_TEXT_CODEC_ID),
+          enabled
+            ? cfExpr.columnRef('c', 'relrowsecurity')
+            : cfExpr.columnRef('c', 'relrowsecurity').not(),
+        ]),
+      );
+  return {
+    rlsEnabled: () =>
+      exprSelect()
+        .project('result', cfExpr.exists(inner(true)))
+        .build(),
+    rlsDisabled: () =>
+      exprSelect()
+        .project('result', cfExpr.exists(inner(false)))
+        .build(),
+  };
+}
+
 export interface IndexExistsCheckBuilder {
   indexPresent(): SelectAst;
   indexAbsent(): SelectAst;

package/src/contract-free/ddl.ts

@@ -2,9 +2,15 @@ import type { DdlColumn, DdlTableConstraint } from '@prisma-next/sql-relational-
 import {
   AddColumnAction,
   type AnyAlterTableAction,
+  DropDefaultAction,
+  PostgresAlterPolicyRename,
   PostgresAlterTable,
+  PostgresCreatePolicy,
   PostgresCreateSchema,
   PostgresCreateTable,
+  PostgresDisableRowLevelSecurity,
+  PostgresDropPolicy,
+  type RlsPolicyOperation,
 } from '../core/ddl/nodes';
 
 /**
@@ -51,9 +57,17 @@ export function addColumnAction(column: DdlColumn): AddColumnAction {
   return new AddColumnAction(column);
 }
 
+/**
+ * Build a `DROP DEFAULT` action (`ALTER COLUMN "<name>" DROP DEFAULT`) for
+ * use inside {@link alterTable}. The renderer quotes the column name.
+ */
+export function dropDefaultAction(columnName: string): DropDefaultAction {
+  return new DropDefaultAction(columnName);
+}
+
 /**
  * Build a Postgres `ALTER TABLE` query node carrying one or more actions.
- * See {@link addColumnAction} for building actions.
+ * See {@link addColumnAction} / {@link dropDefaultAction} for building actions.
  */
 export function alterTable(options: {
   readonly table: string;
@@ -62,3 +76,59 @@ export function alterTable(options: {
 }): PostgresAlterTable {
   return new PostgresAlterTable(options);
 }
+
+/**
+ * Build a Postgres `CREATE POLICY` DDL node.
+ *
+ * Identifiers (`schema`, `table`, `name`) are quoted by the renderer.
+ * `using` and `withCheck` are emitted verbatim as predicate SQL — callers
+ * must supply safe, pre-validated SQL expressions.
+ */
+export function createPolicy(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly permissive: boolean;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: readonly string[];
+  readonly using?: string;
+  readonly withCheck?: string;
+}): PostgresCreatePolicy {
+  return new PostgresCreatePolicy(options);
+}
+
+/**
+ * Build a Postgres `DROP POLICY` DDL node.
+ * Identifiers (`schema`, `table`, `name`) are quoted by the renderer.
+ */
+export function dropPolicy(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+}): PostgresDropPolicy {
+  return new PostgresDropPolicy(options);
+}
+
+/**
+ * Build a Postgres `ALTER POLICY … RENAME TO` DDL node.
+ * Identifiers (`schema`, `table`, `name`, `newName`) are quoted by the renderer.
+ */
+export function alterPolicyRename(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly newName: string;
+}): PostgresAlterPolicyRename {
+  return new PostgresAlterPolicyRename(options);
+}
+
+/**
+ * Build a Postgres `ALTER TABLE … DISABLE ROW LEVEL SECURITY` DDL node.
+ * Identifiers (`schema`, `table`) are quoted by the renderer.
+ */
+export function disableRowLevelSecurity(options: {
+  readonly schema: string;
+  readonly table: string;
+}): PostgresDisableRowLevelSecurity {
+  return new PostgresDisableRowLevelSecurity(options);
+}