@prisma-next/target-postgres 0.14.0-dev.60 → 0.14.0-dev.62

package/package.json

@@ -1,35 +1,35 @@
 {
   "name": "@prisma-next/target-postgres",
-  "version": "0.14.0-dev.60",
+  "version": "0.14.0-dev.62",
   "license": "Apache-2.0",
   "type": "module",
   "sideEffects": false,
   "description": "Postgres target pack for Prisma Next",
   "dependencies": {
-    "@prisma-next/cli": "0.14.0-dev.60",
-    "@prisma-next/contract": "0.14.0-dev.60",
-    "@prisma-next/errors": "0.14.0-dev.60",
-    "@prisma-next/family-sql": "0.14.0-dev.60",
-    "@prisma-next/framework-components": "0.14.0-dev.60",
-    "@prisma-next/migration-tools": "0.14.0-dev.60",
-    "@prisma-next/psl-parser": "0.14.0-dev.60",
-    "@prisma-next/sql-contract": "0.14.0-dev.60",
-    "@prisma-next/sql-errors": "0.14.0-dev.60",
-    "@prisma-next/sql-operations": "0.14.0-dev.60",
-    "@prisma-next/sql-relational-core": "0.14.0-dev.60",
-    "@prisma-next/sql-schema-ir": "0.14.0-dev.60",
-    "@prisma-next/ts-render": "0.14.0-dev.60",
-    "@prisma-next/utils": "0.14.0-dev.60",
+    "@prisma-next/cli": "0.14.0-dev.62",
+    "@prisma-next/contract": "0.14.0-dev.62",
+    "@prisma-next/errors": "0.14.0-dev.62",
+    "@prisma-next/family-sql": "0.14.0-dev.62",
+    "@prisma-next/framework-components": "0.14.0-dev.62",
+    "@prisma-next/migration-tools": "0.14.0-dev.62",
+    "@prisma-next/psl-parser": "0.14.0-dev.62",
+    "@prisma-next/sql-contract": "0.14.0-dev.62",
+    "@prisma-next/sql-errors": "0.14.0-dev.62",
+    "@prisma-next/sql-operations": "0.14.0-dev.62",
+    "@prisma-next/sql-relational-core": "0.14.0-dev.62",
+    "@prisma-next/sql-schema-ir": "0.14.0-dev.62",
+    "@prisma-next/ts-render": "0.14.0-dev.62",
+    "@prisma-next/utils": "0.14.0-dev.62",
     "@standard-schema/spec": "^1.1.0",
     "arktype": "^2.2.0",
     "pathe": "^2.0.3"
   },
   "devDependencies": {
-    "@prisma-next/psl-printer": "0.14.0-dev.60",
-    "@prisma-next/sql-contract-psl": "0.14.0-dev.60",
-    "@prisma-next/test-utils": "0.14.0-dev.60",
-    "@prisma-next/tsconfig": "0.14.0-dev.60",
-    "@prisma-next/tsdown": "0.14.0-dev.60",
+    "@prisma-next/psl-printer": "0.14.0-dev.62",
+    "@prisma-next/sql-contract-psl": "0.14.0-dev.62",
+    "@prisma-next/test-utils": "0.14.0-dev.62",
+    "@prisma-next/tsconfig": "0.14.0-dev.62",
+    "@prisma-next/tsdown": "0.14.0-dev.62",
     "tsdown": "0.22.1",
     "typescript": "5.9.3",
     "vitest": "4.1.8"

package/src/contract-free/ddl.ts

@@ -8,8 +8,10 @@ import {
   PostgresCreatePolicy,
   PostgresCreateSchema,
   PostgresCreateTable,
+  PostgresCreateType,
   PostgresDisableRowLevelSecurity,
   PostgresDropPolicy,
+  PostgresDropType,
   type RlsPolicyOperation,
 } from '../core/ddl/nodes';
 
@@ -48,6 +50,31 @@ export function createSchema(options: {
   return new PostgresCreateSchema(options);
 }
 
+/**
+ * Build a Postgres `CREATE TYPE … AS ENUM (…)` DDL node. The type name (and
+ * optional schema) are quoted by the renderer; the enum member `values` are
+ * emitted as single-quote-escaped string literals. An absent `schema` renders
+ * the type name unqualified so the connection's `search_path` resolves it.
+ */
+export function createType(options: {
+  readonly schema?: string;
+  readonly name: string;
+  readonly values: readonly string[];
+}): PostgresCreateType {
+  return new PostgresCreateType(options);
+}
+
+/**
+ * Build a Postgres `DROP TYPE` DDL node. See {@link createType} for the
+ * identifier-quoting and unqualified-when-schemaless behaviour.
+ */
+export function dropType(options: {
+  readonly schema?: string;
+  readonly name: string;
+}): PostgresDropType {
+  return new PostgresDropType(options);
+}
+
 /**
  * Build an `ADD COLUMN` action for use inside {@link alterTable}.
  * The column is a structured `DdlColumn` so codec-encoded defaults flow

package/src/core/authoring.ts

@@ -12,10 +12,11 @@ import type {
 } from '@prisma-next/framework-components/authoring';
 import { modelAttribute } from '@prisma-next/psl-parser';
 import type { SqlValueSetDerivingEntityTypeOutput } from '@prisma-next/sql-contract/value-set-derivation-hook';
+import { ifDefined } from '@prisma-next/utils/defined';
 import { PG_ENUM_CODEC_ID } from './codec-ids';
 import { PostgresNativeEnum } from './postgres-native-enum';
 import { PostgresRlsEnablement, type PostgresRlsEnablementInput } from './postgres-rls-enablement';
-import { PostgresRlsPolicy } from './postgres-rls-policy';
+import { PostgresRlsPolicy, type RlsPolicyOperation } from './postgres-rls-policy';
 import { PostgresRole, type PostgresRoleInput } from './postgres-role';
 import {
   PostgresNativeEnumSchema,
@@ -50,6 +51,35 @@ export interface RlsPolicyExtensionBlock extends PslExtensionBlock {
   readonly namespaceId: string;
 }
 
+/**
+ * Maps a `policy_<op>` keyword to the RLS operation it authors. The keyword
+ * IS the operation (per the project's rejection of a `policy { operation = … }`
+ * conditional block).
+ */
+const POLICY_KEYWORD_OPERATION: Readonly<Record<string, RlsPolicyOperation>> = {
+  policy_select: 'select',
+  policy_insert: 'insert',
+  policy_update: 'update',
+  policy_delete: 'delete',
+  policy_all: 'all',
+};
+
+/**
+ * Which predicate each RLS operation admits, mirroring Postgres: SELECT and
+ * DELETE decide row visibility/eligibility with `USING` only; INSERT validates
+ * the new row with `WITH CHECK` only; UPDATE and ALL take both. A predicate
+ * outside this set is a load-time error (see {@link lowerRlsPolicyFromBlock}).
+ */
+const POLICY_OPERATION_PREDICATES: Readonly<
+  Record<RlsPolicyOperation, { readonly using: boolean; readonly withCheck: boolean }>
+> = {
+  select: { using: true, withCheck: false },
+  insert: { using: false, withCheck: true },
+  update: { using: true, withCheck: true },
+  delete: { using: true, withCheck: false },
+  all: { using: true, withCheck: true },
+};
+
 function readRefParam(block: PslExtensionBlock, key: string): string | undefined {
   const param = block.parameters[key];
   return param?.kind === 'ref' ? param.identifier : undefined;
@@ -101,18 +131,43 @@ function unwrapQuotedString(raw: string): string {
 
 function lowerRlsPolicyFromBlock(
   block: RlsPolicyExtensionBlock,
-  _ctx: AuthoringEntityContext,
-): PostgresRlsPolicy {
+  ctx: AuthoringEntityContext,
+): PostgresRlsPolicy | undefined {
   const prefix = block.name;
+  const operation = POLICY_KEYWORD_OPERATION[block.keyword] ?? 'select';
   const targetModelName = readRefParam(block, 'target') ?? '';
   const tableName = targetModelName.charAt(0).toLowerCase() + targetModelName.slice(1);
   const roles = [...readListRefParams(block, 'roles')].sort();
-  const using = unwrapQuotedString(readValueParam(block, 'using') ?? '');
+
+  const usingRaw = readValueParam(block, 'using');
+  const withCheckRaw = readValueParam(block, 'withCheck');
+
+  // Reject a predicate the operation does not take (e.g. `using` on INSERT, or
+  // `withCheck` on SELECT/DELETE). The descriptor's param set already omits it,
+  // but the generic descriptor validator is not wired into the SQL-family
+  // interpreter, so the lowering enforces the per-operation predicate matrix
+  // directly — a wrong predicate is a load-time diagnostic, not a silent drop.
+  const support = POLICY_OPERATION_PREDICATES[operation];
+  const rejectPredicate = (predicate: 'using' | 'withCheck'): undefined => {
+    ctx.diagnostics?.push({
+      code: 'PSL_RLS_PREDICATE_NOT_FOR_OPERATION',
+      message: `\`${block.keyword}\` policy "${block.name}" does not take a \`${predicate}\` predicate; the ${operation.toUpperCase()} operation uses ${support.using ? '`using`' : '`withCheck`'}${support.using && support.withCheck ? ' and `withCheck`' : ' only'}.`,
+      sourceId: ctx.sourceId ?? 'unknown',
+      span: block.parameters[predicate]?.span ?? block.span,
+    });
+    return undefined;
+  };
+  if (usingRaw !== undefined && !support.using) return rejectPredicate('using');
+  if (withCheckRaw !== undefined && !support.withCheck) return rejectPredicate('withCheck');
+
+  const using = usingRaw !== undefined ? unwrapQuotedString(usingRaw) : undefined;
+  const withCheck = withCheckRaw !== undefined ? unwrapQuotedString(withCheckRaw) : undefined;
 
   const wireHash = computeContentHash({
-    using: normalizePredicate(using),
+    ...ifDefined('using', using !== undefined ? normalizePredicate(using) : undefined),
+    ...ifDefined('withCheck', withCheck !== undefined ? normalizePredicate(withCheck) : undefined),
     roles,
-    operation: 'select',
+    operation,
     permissive: true,
   });
   const wireName = formatRlsPolicyWireName(prefix, wireHash);
@@ -122,9 +177,10 @@ function lowerRlsPolicyFromBlock(
     prefix,
     tableName,
     namespaceId: block.namespaceId,
-    operation: 'select',
+    operation,
     roles,
-    using,
+    ...ifDefined('using', using),
+    ...ifDefined('withCheck', withCheck),
     permissive: true,
   });
 }
@@ -298,13 +354,10 @@ export const postgresAuthoringEntityTypes = {
  * the family pack instead.
  */
 /**
- * PSL block descriptor for `policy_select`.
- *
- * The parser learns the block shape from this descriptor; lowering from
- * `PslExtensionBlock` to `PostgresRlsPolicy` is wired in the PSL
- * interpreter (a later dispatch). The `discriminator` matches
- * `PostgresRlsPolicy.kind` so the parsed block node carries the same
- * discriminant as the IR class it will lower to.
+ * Shared parameter descriptors for the five `policy_<op>` PSL block
+ * keywords. All five share the `policy` discriminator — the parser
+ * dispatches by keyword (see the framework's PSL-block SPI), and every
+ * keyword's factory lowers to `PostgresRlsPolicy` via `lowerRlsPolicyFromBlock`.
  *
  * The `roles` list uses `scope:'cross-space'` because same-namespace
  * role ref resolution requires PSL namespace entries keyed by `refKind`
@@ -313,24 +366,82 @@ export const postgresAuthoringEntityTypes = {
  * slice 4 (cross-space roles). Until then cross-space passes validation
  * unconditionally and the authored role names flow through unchanged.
  */
+const policyTargetParam = {
+  kind: 'ref',
+  refKind: 'model',
+  scope: 'same-namespace',
+  required: true,
+} as const;
+const policyRolesParam = {
+  kind: 'list',
+  of: { kind: 'ref', refKind: 'role', scope: 'cross-space' },
+} as const;
+const policyPredicateParam = { kind: 'value', codecId: 'pg/text@1', required: true } as const;
+// A policy may only target an RLS-controlled model: the model named by
+// `target` must declare `@@rls`, or the load fails with a diagnostic naming
+// the model and the policy prefix.
+const policyRequiresRls = { parameter: 'target', attribute: 'rls' } as const;
+
 export const postgresAuthoringPslBlockDescriptors = {
+  // The predicate param set per keyword mirrors Postgres: SELECT/DELETE take
+  // USING only; INSERT takes WITH CHECK only; UPDATE/ALL take both. The
+  // per-operation predicate matrix is enforced in `lowerRlsPolicyFromBlock`
+  // (a wrong predicate for the operation is a load-time diagnostic there),
+  // since the generic descriptor validator is not wired into the SQL-family
+  // interpreter.
   policy_select: {
     kind: 'pslBlock',
     keyword: 'policy_select',
     discriminator: 'policy',
     name: { required: true },
+    parameters: { target: policyTargetParam, roles: policyRolesParam, using: policyPredicateParam },
+    requiresModelAttribute: policyRequiresRls,
+  },
+  policy_delete: {
+    kind: 'pslBlock',
+    keyword: 'policy_delete',
+    discriminator: 'policy',
+    name: { required: true },
+    parameters: { target: policyTargetParam, roles: policyRolesParam, using: policyPredicateParam },
+    requiresModelAttribute: policyRequiresRls,
+  },
+  policy_insert: {
+    kind: 'pslBlock',
+    keyword: 'policy_insert',
+    discriminator: 'policy',
+    name: { required: true },
     parameters: {
-      target: { kind: 'ref', refKind: 'model', scope: 'same-namespace', required: true },
-      roles: {
-        kind: 'list',
-        of: { kind: 'ref', refKind: 'role', scope: 'cross-space' },
-      },
-      using: { kind: 'value', codecId: 'pg/text@1', required: true },
+      target: policyTargetParam,
+      roles: policyRolesParam,
+      withCheck: policyPredicateParam,
+    },
+    requiresModelAttribute: policyRequiresRls,
+  },
+  policy_update: {
+    kind: 'pslBlock',
+    keyword: 'policy_update',
+    discriminator: 'policy',
+    name: { required: true },
+    parameters: {
+      target: policyTargetParam,
+      roles: policyRolesParam,
+      using: policyPredicateParam,
+      withCheck: policyPredicateParam,
+    },
+    requiresModelAttribute: policyRequiresRls,
+  },
+  policy_all: {
+    kind: 'pslBlock',
+    keyword: 'policy_all',
+    discriminator: 'policy',
+    name: { required: true },
+    parameters: {
+      target: policyTargetParam,
+      roles: policyRolesParam,
+      using: policyPredicateParam,
+      withCheck: policyPredicateParam,
     },
-    // A policy may only target an RLS-controlled model: the model named by
-    // `target` must declare `@@rls`, or the load fails with a diagnostic
-    // naming the model and the policy prefix.
-    requiresModelAttribute: { parameter: 'target', attribute: 'rls' },
+    requiresModelAttribute: policyRequiresRls,
   },
   /**
    * PSL block descriptor for `native_enum`.

package/src/core/ddl/nodes.ts

@@ -67,6 +67,8 @@ export type AnyAlterTableAction = AddColumnAction | DropDefaultAction;
 export interface PostgresDdlVisitor<R> {
   createTable(node: PostgresCreateTable): R;
   createSchema(node: PostgresCreateSchema): R;
+  createType(node: PostgresCreateType): R;
+  dropType(node: PostgresDropType): R;
   alterTable(node: PostgresAlterTable): R;
   createPolicy(node: PostgresCreatePolicy): R;
   dropPolicy(node: PostgresDropPolicy): R;
@@ -134,6 +136,46 @@ export class PostgresCreateSchema extends PostgresDdlNode {
   }
 }
 
+export class PostgresCreateType extends PostgresDdlNode {
+  readonly kind = 'create-type' as const;
+  readonly schema: string | undefined;
+  readonly name: string;
+  readonly values: ReadonlyArray<string>;
+
+  constructor(options: {
+    readonly schema?: string;
+    readonly name: string;
+    readonly values: readonly string[];
+  }) {
+    super();
+    this.schema = options.schema;
+    this.name = options.name;
+    this.values = Object.freeze([...options.values]);
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.createType(this);
+  }
+}
+
+export class PostgresDropType extends PostgresDdlNode {
+  readonly kind = 'drop-type' as const;
+  readonly schema: string | undefined;
+  readonly name: string;
+
+  constructor(options: { readonly schema?: string; readonly name: string }) {
+    super();
+    this.schema = options.schema;
+    this.name = options.name;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.dropType(this);
+  }
+}
+
 export class PostgresAlterTable extends PostgresDdlNode {
   readonly kind = 'alter-table' as const;
   readonly table: string;
@@ -262,6 +304,8 @@ export class PostgresDisableRowLevelSecurity extends PostgresDdlNode {
 export type AnyPostgresDdlNode =
   | PostgresCreateTable
   | PostgresCreateSchema
+  | PostgresCreateType
+  | PostgresDropType
   | PostgresAlterTable
   | PostgresCreatePolicy
   | PostgresDropPolicy

package/src/core/migrations/contract-to-postgres-database-schema-node.ts

@@ -8,6 +8,7 @@ import type { PostgresContract } from '../postgres-schema';
 import { isPostgresSchema } from '../postgres-schema';
 import { PostgresDatabaseSchemaNode } from '../schema-ir/postgres-database-schema-node';
 import { PostgresNamespaceSchemaNode } from '../schema-ir/postgres-namespace-schema-node';
+import { PostgresNativeEnumSchemaNode } from '../schema-ir/postgres-native-enum-schema-node';
 import { PostgresPolicySchemaNode } from '../schema-ir/postgres-policy-schema-node';
 import { PostgresRoleSchemaNode } from '../schema-ir/postgres-role-schema-node';
 import { PostgresTableSchemaNode } from '../schema-ir/postgres-table-schema-node';
@@ -140,10 +141,20 @@ export function contractToPostgresDatabaseSchemaNode(
       }
     }
 
+    const nativeEnums = Object.values(ns.entries.native_enum ?? {}).map(
+      (entity) =>
+        new PostgresNativeEnumSchemaNode({
+          typeName: entity.typeName,
+          namespaceId: ddlSchema,
+          members: entity.members,
+          ...ifDefined('control', entity.control),
+        }),
+    );
+
     namespaces[ddlSchema] = new PostgresNamespaceSchemaNode({
       schemaName: ddlSchema,
       tables,
-      nativeEnumTypeNames: [],
+      nativeEnums,
     });
 
     for (const role of Object.values(ns.role)) {