@prisma-next/target-postgres 0.14.0-dev.60 → 0.14.0-dev.62

package/src/core/migrations/control-policy.ts

@@ -1,11 +1,17 @@
-import type { Contract } from '@prisma-next/contract/types';
-import type { ControlPolicySubject } from '@prisma-next/family-sql/control';
+import type { Contract, ControlPolicy } from '@prisma-next/contract/types';
+import type {
+  ControlPolicySubject,
+  SqlPlannerConflict,
+  SuppressionRecord,
+} from '@prisma-next/family-sql/control';
 import type { SchemaDiffIssue } from '@prisma-next/framework-components/control';
 import { entityAt, UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
 import type { SqlStorage, StorageTable } from '@prisma-next/sql-contract/types';
 import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
+import { type PostgresRole, ROLE_DEFAULT_CONTROL_POLICY } from '../postgres-role';
 import { isPostgresSchema } from '../postgres-schema';
+import { postgresNodeStorageCoordinate } from '../schema-ir/node-storage-coordinate';
 import type { PostgresNamespaceSchemaNode } from '../schema-ir/postgres-namespace-schema-node';
 import { PostgresTableSchemaNode } from '../schema-ir/postgres-table-schema-node';
 import type { SqlSchemaDiffNode } from '../schema-ir/schema-node-kinds';
@@ -23,13 +29,16 @@ import type { PostgresOpFactoryCall } from './op-factory-call';
  * and is fail-closed. Any call not listed here — including future or
  * extension-contributed factories — is treated as NOT object-creation, so it
  * is suppressed under `tolerated` rather than permissively emitted.
+ *
+ * Lists the creation factories that actually reach the call-side resolver
+ * (`resolvePostgresCallControlPolicySubject`) — today only RLS policy
+ * creation, from `planPostgresSchemaDiff`. Every other whole-object create
+ * (table, schema, native enum, and RLS enablement) is constructed inside
+ * `planIssues` and graded on the node side by
+ * `resolvePostgresNodeIssueCreationFactoryName`, so none of them are listed
+ * here.
  */
-const OBJECT_CREATION_FACTORIES: ReadonlySet<string> = new Set<string>([
-  'createTable',
-  'createSchema',
-  'createRlsPolicy',
-  'enableRowLevelSecurity',
-]);
+const OBJECT_CREATION_FACTORIES: ReadonlySet<string> = new Set<string>(['createRlsPolicy']);
 
 function createsNewTopLevelObject(call: PostgresOpFactoryCall): boolean {
   return OBJECT_CREATION_FACTORIES.has(call.factoryName);
@@ -40,18 +49,25 @@ function ddlSchemaNameForNamespace(contract: Contract<SqlStorage>, namespaceId:
   return isPostgresSchema(namespace) ? namespace.ddlSchemaName(contract.storage) : namespaceId;
 }
 
-function resolveNamespaceIdForTable(
+/**
+ * Resolve the namespace a declared storage entity lives in by walking every
+ * namespace for one whose `entries` map actually contains the coordinate —
+ * a table by its name, a native enum by its physical type name (see
+ * {@link postgresNodeStorageCoordinate}). When `ddlSchemaName` is given, the
+ * match must also land in that DDL schema (disambiguates same-named entities
+ * declared under different namespaces); when omitted, the first namespace
+ * that declares the entity wins. Falls back to {@link UNBOUND_NAMESPACE_ID}
+ * when no namespace declares it — e.g. an extra/dropped entity the contract
+ * doesn't claim at all.
+ */
+function resolveNamespaceIdForEntity(
   contract: Contract<SqlStorage>,
-  tableName: string,
+  coordinate: { readonly entityKind: string; readonly entityName: string },
   ddlSchemaName: string | undefined,
 ): string {
   for (const namespaceId of Object.keys(contract.storage.namespaces)) {
-    const table = entityAt<StorageTable>(contract.storage, {
-      namespaceId,
-      entityKind: 'table',
-      entityName: tableName,
-    });
-    if (!table) continue;
+    const entity = entityAt(contract.storage, { namespaceId, ...coordinate });
+    if (!entity) continue;
     if (
       ddlSchemaName === undefined ||
       ddlSchemaNameForNamespace(contract, namespaceId) === ddlSchemaName
@@ -62,6 +78,18 @@ function resolveNamespaceIdForTable(
   return UNBOUND_NAMESPACE_ID;
 }
 
+function resolveNamespaceIdForTable(
+  contract: Contract<SqlStorage>,
+  tableName: string,
+  ddlSchemaName: string | undefined,
+): string {
+  return resolveNamespaceIdForEntity(
+    contract,
+    { entityKind: 'table', entityName: tableName },
+    ddlSchemaName,
+  );
+}
+
 export function resolveNamespaceIdForDdlSchema(
   contract: Contract<SqlStorage>,
   ddlSchemaName: string,
@@ -92,16 +120,60 @@ function postgresCallFields(call: PostgresOpFactoryCall): PostgresCallFields {
   };
 }
 
-export function formatPostgresControlPolicySubjectLabel(
-  factoryName: string,
+function formatSuppressionSubjectLabel(
   subject: ControlPolicySubject | undefined,
   contract: Contract<SqlStorage>,
 ): string {
-  if (subject?.table) {
-    const ddlSchema = ddlSchemaNameForNamespace(contract, subject.namespaceId);
-    return `${factoryName}(${ddlSchema}.${subject.table})`;
+  if (subject === undefined) return 'unknown';
+  const ddlSchema = ddlSchemaNameForNamespace(contract, subject.namespaceId);
+  if (subject.entityKind !== undefined && subject.entityName !== undefined) {
+    return `${subject.entityKind} "${ddlSchema}.${subject.entityName}"`;
+  }
+  return `namespace "${ddlSchema}"`;
+}
+
+function postgresSuppressionSummary(
+  subjectLabel: string,
+  subject: ControlPolicySubject | undefined,
+  policy: string,
+): string {
+  const namespace = subject?.namespaceId ?? 'unknown';
+  const declared = subject?.explicitNodeControlPolicy;
+  if (policy === 'external' && declared === 'managed') {
+    return `control policy suppressed: ${subjectLabel} — namespace '${namespace}' has effective control 'external' but declared 'managed'`;
   }
-  return factoryName;
+  const declaredSuffix = declared ? ` but declared '${declared}'` : '';
+  return `control policy suppressed: ${subjectLabel} — namespace '${namespace}' has effective control '${policy}'${declaredSuffix}`;
+}
+
+/**
+ * Render one family {@link SuppressionRecord} into a target `SqlPlannerConflict`.
+ * The family decides *that* a subject is suppressed and hands over the raw
+ * coordinate + policy; the label, message, and location are rendered here,
+ * driven entirely by the subject's own `(entityKind, entityName)` coordinate
+ * — no target-owned table-vs-enum vocabulary.
+ */
+export function renderPostgresSuppression(
+  record: SuppressionRecord,
+  contract: Contract<SqlStorage>,
+): SqlPlannerConflict {
+  const subject = record.subject;
+  const subjectLabel = formatSuppressionSubjectLabel(subject, contract);
+  return {
+    kind: 'controlPolicySuppressedCall',
+    summary: postgresSuppressionSummary(subjectLabel, subject, record.policy),
+    location: {
+      ...ifDefined('namespaceId', subject?.namespaceId),
+      ...ifDefined('entityKind', subject?.entityKind),
+      ...ifDefined('entityName', subject?.entityName),
+      ...ifDefined('column', subject?.column),
+    },
+    meta: {
+      controlPolicy: record.policy,
+      ...ifDefined('factoryName', record.factoryName),
+      ...ifDefined('declaredControlPolicy', subject?.explicitNodeControlPolicy),
+    },
+  };
 }
 
 export function resolvePostgresCallControlPolicySubject(
@@ -131,9 +203,10 @@ export function resolvePostgresCallControlPolicySubject(
     })?.control;
     return {
       namespaceId,
-      ...ifDefined('explicitNodeControlPolicy', tableControlPolicy),
-      table: callFields.tableName,
+      entityKind: 'table',
+      entityName: callFields.tableName,
       ...ifDefined('column', callFields.columnName),
+      ...ifDefined('explicitNodeControlPolicy', tableControlPolicy),
       createsNewObject,
     };
   }
@@ -149,10 +222,10 @@ export function resolvePostgresCallControlPolicySubject(
 }
 
 /**
- * Node kinds that describe the absence of a whole, top-level Postgres
- * object — the same objects `createsNewTopLevelObject` recognises for calls.
- * Used by {@link resolvePostgresNodeIssueCreationFactoryName} to decide
- * whether a `tolerated` subject permits the issue to flow into the planner
+ * Node kinds whose *absence* is the creation of a whole, top-level Postgres
+ * object: a namespace, a table, or a native enum. Used by
+ * {@link resolvePostgresNodeIssueCreationFactoryName} to decide whether a
+ * `tolerated` subject permits the issue to flow into the planner
  * (create-if-absent) and to seed the suppressed-subject warning's
  * `factoryName` when the planner is skipped. RLS policy creation is not
  * listed here — policy issues never reach this issue-based partition (they
@@ -162,13 +235,15 @@ export function resolvePostgresCallControlPolicySubject(
 const POSTGRES_NODE_CREATION_FACTORY: Readonly<Record<string, string>> = Object.freeze({
   [PostgresSchemaNodeKind.namespace]: 'createSchema',
   [PostgresSchemaNodeKind.table]: 'createTable',
+  [PostgresSchemaNodeKind.nativeEnum]: 'createNativeEnumType',
 });
 
 /**
  * A table `not-equal` issue whose `rlsEnabled` flips OFF→ON (expected on,
- * actual off) is enablement toward `ENABLE ROW LEVEL SECURITY` —
- * creation-class per `OBJECT_CREATION_FACTORIES` ('enableRowLevelSecurity'
- * is a member): enabling RLS establishes the fail-closed guard the declared
+ * actual off) is enablement toward `ENABLE ROW LEVEL SECURITY`. It is
+ * creation-class on the node side because `isEnablementCreationIssue` and
+ * {@link resolvePostgresNodeIssueCreationFactoryName} treat this OFF→ON delta
+ * as a creation: enabling RLS establishes the fail-closed guard the declared
  * policy set attaches to, the same grant `tolerated` extends to creating the
  * policies themselves. The opposite direction (`DISABLE`) is a modification
  * and stays managed-only. Keying on the actual delta (not just the expected
@@ -206,15 +281,36 @@ export function resolvePostgresNodeIssueCreationFactoryName(
  * {@link SchemaDiffIssue}. Mirrors the resolution
  * `resolvePostgresCallControlPolicySubject` performs for a generated DDL
  * call, but works *off the issue* — so the planner can partition issues by
- * effective policy before the diff engine runs. `createsNewObject` is
- * derived from the node kind + reason: a `not-found` schema/table describes
- * a brand-new top-level object; everything else touches an existing object.
+ * effective policy before the diff engine runs.
  *
- * A `not-expected` table carries no contract namespace coordinate (the live
- * table isn't claimed by any contract namespace), so the subject's
- * `namespaceId` falls back to {@link UNBOUND_NAMESPACE_ID} via
- * `resolveNamespaceIdForTable`'s own fallback — the call-side resolver does
- * the same for the `DropTableCall` it produces.
+ * A whole storage entity (table or native enum) resolves generically off
+ * {@link postgresNodeStorageCoordinate} — the node self-describes its
+ * `(entityKind, entityName)`, so table and enum issues share one code path
+ * with no per-kind branch. A sub-entity issue (a column/constraint drift
+ * inside an owned table) carries no such coordinate on its own node, so it
+ * falls back to reading the enclosing table name off the issue path.
+ *
+ * `createsNewObject` is delegated to {@link resolvePostgresNodeIssueCreationFactoryName}
+ * in every branch below — that function already encodes exactly which
+ * node-kind/reason combinations describe a brand-new top-level object
+ * (a `not-found` table/enum, or an RLS-enablement `not-equal`).
+ *
+ * A `not-expected` (extra/dropped) entity carries no contract namespace
+ * coordinate — the live object isn't claimed by any contract namespace — so
+ * the subject's `namespaceId` falls back to {@link UNBOUND_NAMESPACE_ID} via
+ * `resolveNamespaceIdForEntity`'s own fallback, matching how the call-side
+ * resolver treats the `DropTableCall`/`DropNativeEnumTypeCall` it produces.
+ *
+ * A role node resolves against the `PostgresRole` contract entity at that
+ * role's name (roles are root-level diff subjects, so the name is the
+ * second path segment after the tree root). A `not-found` role is declared,
+ * so the entity is always found and its `control` read directly — which is
+ * always {@link ROLE_DEFAULT_CONTROL_POLICY} today, since no authoring
+ * surface sets it otherwise. A `not-expected` role has no contract entity
+ * (an undeclared live role, by definition), so the subject falls back to
+ * the same default — roles are referenced but never owned, so an
+ * undeclared role gets exactly the same governance as a declared one.
+ * Never creates a new object: role provisioning is a non-goal.
  */
 export function resolvePostgresNodeIssueControlPolicySubject(
   issue: SchemaDiffIssue<SqlSchemaDiffNode>,
@@ -234,6 +330,39 @@ export function resolvePostgresNodeIssueControlPolicySubject(
     };
   }
 
+  if (node.nodeKind === PostgresSchemaNodeKind.role) {
+    const roleName = issue.path[1];
+    const roleEntity =
+      roleName === undefined
+        ? undefined
+        : entityAt<PostgresRole>(contract.storage, {
+            namespaceId: UNBOUND_NAMESPACE_ID,
+            entityKind: 'role',
+            entityName: roleName,
+          });
+    return {
+      namespaceId: UNBOUND_NAMESPACE_ID,
+      explicitNodeControlPolicy: roleEntity?.control ?? ROLE_DEFAULT_CONTROL_POLICY,
+      createsNewObject: false,
+    };
+  }
+
+  const coordinate = postgresNodeStorageCoordinate(node);
+  if (coordinate !== undefined) {
+    const namespaceId = resolveNamespaceIdForEntity(contract, coordinate, issue.path[1]);
+    const entityControl = entityAt<{ readonly control?: ControlPolicy }>(contract.storage, {
+      namespaceId,
+      ...coordinate,
+    })?.control;
+    return {
+      namespaceId,
+      ...coordinate,
+      ...ifDefined('column', issueColumnName(issue)),
+      ...ifDefined('explicitNodeControlPolicy', entityControl),
+      createsNewObject: resolvePostgresNodeIssueCreationFactoryName(issue) !== undefined,
+    };
+  }
+
   const tableName = issue.path[2];
   if (tableName === undefined) return undefined;
   const ddlSchemaName = issue.path[1];
@@ -243,15 +372,13 @@ export function resolvePostgresNodeIssueControlPolicySubject(
     entityKind: 'table',
     entityName: tableName,
   });
-  const createsNewObject =
-    (node.nodeKind === PostgresSchemaNodeKind.table && issue.reason === 'not-found') ||
-    isEnablementCreationIssue(issue);
 
   return {
     namespaceId,
-    ...ifDefined('explicitNodeControlPolicy', table?.control),
-    table: tableName,
+    entityKind: 'table',
+    entityName: tableName,
     ...ifDefined('column', issueColumnName(issue)),
-    createsNewObject,
+    ...ifDefined('explicitNodeControlPolicy', table?.control),
+    createsNewObject: resolvePostgresNodeIssueCreationFactoryName(issue) !== undefined,
   };
 }

package/src/core/migrations/diff-database-schema.ts

@@ -3,8 +3,9 @@ import type { SqlSchemaDiffResult } from '@prisma-next/family-sql/control';
 import { buildNativeTypeExpander } from '@prisma-next/family-sql/control';
 import { classifyDiffSubjectGranularity } from '@prisma-next/family-sql/diff';
 import type { TargetBoundComponentDescriptor } from '@prisma-next/framework-components/components';
-import type { SchemaDiffIssue } from '@prisma-next/framework-components/control';
+import type { DiffableNode, SchemaDiffIssue } from '@prisma-next/framework-components/control';
 import { diffSchemas } from '@prisma-next/framework-components/control';
+import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
 import type { SqlStorage } from '@prisma-next/sql-contract/types';
 import type { SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
 import { blindCast } from '@prisma-next/utils/casts';
@@ -19,6 +20,31 @@ import {
 import { contractToPostgresDatabaseSchemaNode } from './contract-to-postgres-database-schema-node';
 import { resolvePostgresNodeIssueControlPolicySubject } from './control-policy';
 
+/**
+ * Whether a diff issue's subject node is cluster-scoped — it carries its own
+ * `namespaceId` field (only role and policy diff nodes do) and that
+ * coordinate is the unbound sentinel, meaning the node is not owned by any
+ * schema/namespace. A role node is always cluster-scoped (roles are
+ * cluster-level objects); a policy node's `namespaceId` is always its
+ * table's resolved DDL schema, never the sentinel. Namespace-ownership
+ * scoping (which compares `issue.path[1]` against the set of DDL schemas
+ * the contract owns) makes no sense for a cluster-scoped subject — its path
+ * segment at that index is the object's own name, not a schema name — so
+ * such an issue bypasses that scoping entirely.
+ */
+function isClusterScopedIssue(issue: SchemaDiffIssue): boolean {
+  const node = issue.expected ?? issue.actual;
+  return node !== undefined && nodeNamespaceId(node) === UNBOUND_NAMESPACE_ID;
+}
+
+function nodeNamespaceId(node: DiffableNode): string | undefined {
+  if (!Object.hasOwn(node, 'namespaceId')) return undefined;
+  return blindCast<
+    { namespaceId: string },
+    'presence of an own namespaceId field was just checked via Object.hasOwn'
+  >(node).namespaceId;
+}
+
 function ownedSchemaNames(expected: PostgresDatabaseSchemaNode): ReadonlySet<string> {
   const policyNamespaces = Object.values(expected.namespaces).flatMap((ns) =>
     Object.values(ns.tables).flatMap((t) => t.policies.map((p) => p.namespaceId)),
@@ -53,10 +79,17 @@ function pruneTableLessNamespaces(
 }
 
 /**
- * Resolves a verdict-diff issue's subject table's declared control policy
- * directly from the contract, by delegating to the same node-typed resolver
+ * Resolves a verdict-diff issue's subject's declared control policy directly
+ * from the contract, by delegating to the same node-typed resolver
  * ({@link resolvePostgresNodeIssueControlPolicySubject}) the planner uses to
- * gate DDL calls. `undefined` when the issue resolves to no contract table.
+ * gate DDL calls. `undefined` when the issue resolves to no contract subject.
+ *
+ * A role issue resolves through that same resolver to `external`
+ * unconditionally (see its role branch), regardless of the contract's own
+ * default policy: a role is referenced by the contract but not owned, and
+ * `external`'s existing semantics — a missing declared subject still fails,
+ * every extra is suppressed — are exactly the wanted asymmetric grading for
+ * a cluster object the framework does not own.
  */
 function resolveControlPolicy(
   issue: SchemaDiffIssue,
@@ -75,8 +108,9 @@ function resolveControlPolicy(
  * the expected tree (resolved leaf values, expander threaded, FK schemas
  * resolved, table-less namespaces pruned), run the generic
  * differ over the trees as derived, and scope out `not-expected` findings under namespaces the
- * contract does not own. Ownership is role-aware, mirroring the legacy
- * decomposition: relational extras check the PRUNED owned set (the legacy
+ * contract does not own. Ownership scoping bypasses cluster-scoped subjects
+ * (roles today), mirroring the legacy decomposition: relational extras check
+ * the PRUNED owned set (the legacy
  * per-namespace walk never visited a table-less namespace, so its live
  * relational contents are invisible), while `structural` extras (RLS
  * policies) check the FULL owned set (the legacy policy diff governed
@@ -84,7 +118,7 @@ function resolveControlPolicy(
  * shrink because a namespace declares no tables). The codec `verifyType`
  * hooks run once per contract namespace with tables against that
  * namespace's paired actual node (the hooks read namespace-scoped state
- * such as `nativeEnumTypeNames`).
+ * such as `nativeEnums`).
  */
 export function diffPostgresSchema(input: {
   readonly contract: Contract<SqlStorage>;
@@ -107,9 +141,10 @@ export function diffPostgresSchema(input: {
   const structuralOwned = ownedSchemaNames(fullExpected);
   const issues = diffSchemas(expected, actual).filter((issue) => {
     if (issue.reason !== 'not-expected') return true;
+    if (isClusterScopedIssue(issue)) return true;
+    const granularity = classifyDiffSubjectGranularity(issue, postgresDiffSubjectGranularity);
     const namespaceSegment = issue.path[1];
     if (namespaceSegment === undefined) return true;
-    const granularity = classifyDiffSubjectGranularity(issue, postgresDiffSubjectGranularity);
     const owned = granularity === 'structural' ? structuralOwned : relationalOwned;
     return owned.has(namespaceSegment);
   });
@@ -146,7 +181,6 @@ function padActualNamespaces(
       namespaces[schemaName] = new PostgresNamespaceSchemaNode({
         schemaName,
         tables: {},
-        nativeEnumTypeNames: [],
       });
       padded = true;
     }
@@ -165,15 +199,15 @@ export interface PostgresPlanDiff {
   readonly expected: PostgresDatabaseSchemaNode;
   /** The live ("start") tree, padded with empty namespaces so a missing schema's tables pair. */
   readonly actual: PostgresDatabaseSchemaNode;
-  /** The one node diff over the two trees: relational + policy drift, role-aware ownership filtered. */
+  /** The one node diff over the two trees: relational + policy drift, cluster-scope-aware ownership filtered. */
   readonly issues: readonly SchemaDiffIssue<SqlSchemaDiffNode>[];
 }
 
 /**
  * The Postgres planner's diff input: the SAME tree-building
  * `diffPostgresSchema` uses (expander threaded, FK schemas resolved,
- * table-less namespaces pruned, role-aware ownership filter) plus actual
- * namespace padding (so a missing
+ * table-less namespaces pruned, cluster-scope-aware ownership filter) plus
+ * actual namespace padding (so a missing
  * schema's tables surface as `not-found` instead of a swallowed namespace
  * `not-found`). One differ drives both verify and plan; this is the
  * plan-side derivation. The single issue list covers tables / columns /
@@ -207,9 +241,10 @@ export function buildPostgresPlanDiff(input: {
     'both trees are PostgresDatabaseSchemaNodes, so every diff-issue node is a SqlSchemaDiffNode'
   >(diffSchemas(expected, paddedActual)).filter((issue) => {
     if (issue.reason !== 'not-expected') return true;
+    if (isClusterScopedIssue(issue)) return true;
+    const granularity = classifyDiffSubjectGranularity(issue, postgresDiffSubjectGranularity);
     const namespaceSegment = issue.path[1];
     if (namespaceSegment === undefined) return true;
-    const granularity = classifyDiffSubjectGranularity(issue, postgresDiffSubjectGranularity);
     const owned = granularity === 'structural' ? structuralOwned : relationalOwned;
     return owned.has(namespaceSegment);
   });

package/src/core/migrations/issue-planner.ts

@@ -45,6 +45,7 @@ import { ifDefined } from '@prisma-next/utils/defined';
 import type { Result } from '@prisma-next/utils/result';
 import { notOk, ok } from '@prisma-next/utils/result';
 import type { PostgresNamespaceSchemaNode } from '../schema-ir/postgres-namespace-schema-node';
+import type { PostgresNativeEnumSchemaNode } from '../schema-ir/postgres-native-enum-schema-node';
 import type { PostgresTableSchemaNode } from '../schema-ir/postgres-table-schema-node';
 import { PostgresSchemaNodeKind } from '../schema-ir/schema-node-kinds';
 import { quoteIdentifier } from '../sql-utils';
@@ -61,6 +62,7 @@ import {
   AddUniqueCall,
   AlterColumnTypeCall,
   CreateIndexCall,
+  CreateNativeEnumTypeCall,
   CreateSchemaCall,
   CreateTableCall,
   DisableRowLevelSecurityCall,
@@ -69,6 +71,7 @@ import {
   DropConstraintCall,
   DropDefaultCall,
   DropIndexCall,
+  DropNativeEnumTypeCall,
   DropNotNullCall,
   DropTableCall,
   EnableRowLevelSecurityCall,
@@ -152,8 +155,10 @@ function classifyCall(call: PostgresOpFactoryCall): CallCategory {
   switch (call.factoryName) {
     case 'createExtension':
     case 'createSchema':
+    case 'createNativeEnumType':
       return 'dep';
     case 'dropTable':
+    case 'dropNativeEnumType':
     case 'dropColumn':
     case 'dropConstraint':
     case 'dropCheckConstraint':
@@ -250,17 +255,22 @@ function locationForCall(call: PostgresOpFactoryCall): SqlPlannerConflict['locat
     typeName?: string;
   };
   const location: {
-    table?: string;
+    entityKind?: string;
+    entityName?: string;
     column?: string;
     index?: string;
     constraint?: string;
-    type?: string;
   } = {};
-  if (anyCall.tableName) location.table = anyCall.tableName;
+  if (anyCall.tableName) {
+    location.entityKind = 'table';
+    location.entityName = anyCall.tableName;
+  } else if (anyCall.typeName) {
+    location.entityKind = 'native_enum';
+    location.entityName = anyCall.typeName;
+  }
   if (anyCall.columnName) location.column = anyCall.columnName;
   if (anyCall.indexName) location.index = anyCall.indexName;
   if (anyCall.constraintName) location.constraint = anyCall.constraintName;
-  if (anyCall.typeName) location.type = anyCall.typeName;
   return Object.keys(location).length > 0 ? (location as SqlPlannerConflictLocation) : undefined;
 }
 
@@ -374,6 +384,11 @@ export function nodeIssueOrder(issue: SchemaDiffIssue): number {
   switch (node.nodeKind) {
     case PostgresSchemaNodeKind.namespace:
       return 1;
+    case PostgresSchemaNodeKind.nativeEnum:
+      // Creates order right after namespace creates within the 'dep' bucket
+      // (CREATE SCHEMA before CREATE TYPE); drops order after table drops
+      // within the 'drop' bucket (DROP TYPE only after its dependents left).
+      return issue.reason === 'not-expected' ? 17 : 2;
     case RelationalSchemaNodeKind.foreignKey:
       return issue.reason === 'not-expected' ? 10 : 60;
     case RelationalSchemaNodeKind.unique:
@@ -527,6 +542,60 @@ function nodeConflict(kind: SqlPlannerConflict['kind'], message: string): SqlPla
   return issueConflict(kind, message);
 }
 
+/**
+ * Managed native-enum issue -> op lowering. A missing declared type creates
+ * it; an unclaimed live type drops it (ownership-scoped upstream by
+ * `retainUnownedExtras`, destructiveness gated by the operation-class
+ * policy); a paired member-value mismatch is a NAMED unsupported diagnostic
+ * — never a silent no-op and never a drop-and-recreate. Slice B replaces the
+ * diagnostic with order-aware `ALTER TYPE ... ADD VALUE` / refusal semantics.
+ */
+function mapNativeEnumNodeIssue(
+  issue: SchemaDiffIssue,
+  ctx: StrategyContext,
+): Result<readonly PostgresOpFactoryCall[], SqlPlannerConflict> {
+  const ddlSchemaName = issueSchemaName(issue);
+  if (ddlSchemaName === undefined) {
+    return notOk(
+      nodeConflict(
+        'unsupportedOperation',
+        `Enum issue has no schema in its path: ${issue.path.join('/')}`,
+      ),
+    );
+  }
+  const schemaName = emissionSchemaName(ctx, ddlSchemaName);
+  if (issue.reason === 'not-found') {
+    const expected = blindCast<
+      PostgresNativeEnumSchemaNode,
+      'a not-found native-enum issue always carries the expected PostgresNativeEnumSchemaNode'
+    >(issue.expected);
+    return ok([new CreateNativeEnumTypeCall(schemaName, expected.typeName, expected.members)]);
+  }
+  if (issue.reason === 'not-expected') {
+    const actual = blindCast<
+      PostgresNativeEnumSchemaNode,
+      'a not-expected native-enum issue always carries the actual PostgresNativeEnumSchemaNode'
+    >(issue.actual);
+    return ok([new DropNativeEnumTypeCall(schemaName, actual.typeName)]);
+  }
+  const expected = blindCast<
+    PostgresNativeEnumSchemaNode,
+    'a not-equal native-enum issue carries both sides; the expected node names the type'
+  >(issue.expected);
+  const actualMembers = blindCast<
+    PostgresNativeEnumSchemaNode,
+    'a not-equal native-enum issue carries both sides'
+  >(issue.actual).members;
+  return notOk(
+    nodeConflict(
+      'unsupportedOperation',
+      `Native enum type "${ddlSchemaName}"."${expected.typeName}" member values changed ` +
+        `(contract declares [${expected.members.join(', ')}], database has [${actualMembers.join(', ')}]); ` +
+        'enum value changes are not auto-migrated yet. Author the change manually with `migration new`.',
+    ),
+  );
+}
+
 function mapTableNodeIssue(
   issue: SchemaDiffIssue,
   schemaName: string,
@@ -814,6 +883,10 @@ export function mapNodeIssueToCall(
     return ok([new CreateSchemaCall(namespace.schemaName)]);
   }
 
+  if (node.nodeKind === PostgresSchemaNodeKind.nativeEnum) {
+    return mapNativeEnumNodeIssue(issue, ctx);
+  }
+
   const ddlSchemaName = issueSchemaName(issue);
   const tableName = issueTableName(issue);
   if (ddlSchemaName === undefined || tableName === undefined) {