@prisma-next/target-postgres 0.14.0-dev.61 → 0.14.0-dev.62

package/dist/{authoring-BLkL4fFG.mjs → authoring-CdIZ0yvD.mjs}

@@ -1,6 +1,6 @@
 import { a as PG_ENUM_CODEC_ID } from "./codec-ids-C_-Hj6bL.mjs";
 import { t as PostgresNativeEnum } from "./postgres-native-enum-xdiqmBf_.mjs";
-import { _ as PostgresRlsEnablement, d as PostgresRlsEnablementSchema, f as PostgresRlsPolicySchema, g as PostgresRlsPolicy, m as PostgresRole, p as PostgresRoleSchema, u as PostgresNativeEnumSchema } from "./postgres-schema-COEca21H.mjs";
+import { _ as PostgresRlsEnablement, d as PostgresRlsEnablementSchema, f as PostgresRlsPolicySchema, g as PostgresRlsPolicy, m as PostgresRole, p as PostgresRoleSchema, u as PostgresNativeEnumSchema } from "./postgres-schema-DWQ0-CPb.mjs";
 import { i as normalizePredicate, r as computeContentHash, t as formatRlsPolicyWireName } from "./wire-name-rHHtr1h0.mjs";
 import { temporalAuthoringPresets } from "@prisma-next/family-sql/control";
 import { ifDefined } from "@prisma-next/utils/defined";
@@ -525,4 +525,4 @@ const postgresAuthoringFieldPresets = {
 //#endregion
 export { postgresAuthoringTypes as a, postgresAuthoringPslBlockDescriptors as i, postgresAuthoringFieldPresets as n, postgresAuthoringModelAttributes as r, postgresAuthoringEntityTypes as t };
 
-//# sourceMappingURL=authoring-BLkL4fFG.mjs.map
+//# sourceMappingURL=authoring-CdIZ0yvD.mjs.map

package/dist/{authoring-BLkL4fFG.mjs.map → authoring-CdIZ0yvD.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"authoring-BLkL4fFG.mjs","names":[],"sources":["../src/core/authoring.ts"],"sourcesContent":["import { temporalAuthoringPresets } from '@prisma-next/family-sql/control';\nimport type {\n  AuthoringEntityContext,\n  AuthoringEntityTypeFactoryOutput,\n  AuthoringEntityTypeNamespace,\n  AuthoringFieldNamespace,\n  AuthoringModelAttributeContext,\n  AuthoringModelAttributeDescriptorNamespace,\n  AuthoringPslBlockDescriptorNamespace,\n  AuthoringTypeNamespace,\n  PslExtensionBlock,\n} from '@prisma-next/framework-components/authoring';\nimport { modelAttribute } from '@prisma-next/psl-parser';\nimport type { SqlValueSetDerivingEntityTypeOutput } from '@prisma-next/sql-contract/value-set-derivation-hook';\nimport { ifDefined } from '@prisma-next/utils/defined';\nimport { PG_ENUM_CODEC_ID } from './codec-ids';\nimport { PostgresNativeEnum } from './postgres-native-enum';\nimport { PostgresRlsEnablement, type PostgresRlsEnablementInput } from './postgres-rls-enablement';\nimport { PostgresRlsPolicy, type RlsPolicyOperation } from './postgres-rls-policy';\nimport { PostgresRole, type PostgresRoleInput } from './postgres-role';\nimport {\n  PostgresNativeEnumSchema,\n  PostgresRlsEnablementSchema,\n  PostgresRlsPolicySchema,\n  PostgresRoleSchema,\n} from './postgres-validators';\nimport { computeContentHash, normalizePredicate } from './rls/canonicalize';\nimport { formatRlsPolicyWireName } from './rls/wire-name';\n\n/**\n * `pg.enum(<ref>)` registers as an ordinary type constructor whose sole\n * positional argument names a `native_enum` entity instead of carrying a\n * literal value. The interpreter resolves the ref to the `native_enum`\n * entity generically (driven by `entityRefArg`); the `pg/enum@1` codec\n * descriptor's `columnFromEntity` hook (see `codecs.ts`) converts that\n * entity into the column's `typeParams` and native type.\n */\nexport const postgresAuthoringTypes = {\n  pg: {\n    enum: {\n      kind: 'typeConstructor',\n      entityRefArg: { index: 0, entityKind: 'native_enum' },\n      output: {\n        codecId: PG_ENUM_CODEC_ID,\n      },\n    },\n  },\n} as const satisfies AuthoringTypeNamespace;\n\nexport interface RlsPolicyExtensionBlock extends PslExtensionBlock {\n  readonly namespaceId: string;\n}\n\n/**\n * Maps a `policy_<op>` keyword to the RLS operation it authors. The keyword\n * IS the operation (per the project's rejection of a `policy { operation = … }`\n * conditional block).\n */\nconst POLICY_KEYWORD_OPERATION: Readonly<Record<string, RlsPolicyOperation>> = {\n  policy_select: 'select',\n  policy_insert: 'insert',\n  policy_update: 'update',\n  policy_delete: 'delete',\n  policy_all: 'all',\n};\n\n/**\n * Which predicate each RLS operation admits, mirroring Postgres: SELECT and\n * DELETE decide row visibility/eligibility with `USING` only; INSERT validates\n * the new row with `WITH CHECK` only; UPDATE and ALL take both. A predicate\n * outside this set is a load-time error (see {@link lowerRlsPolicyFromBlock}).\n */\nconst POLICY_OPERATION_PREDICATES: Readonly<\n  Record<RlsPolicyOperation, { readonly using: boolean; readonly withCheck: boolean }>\n> = {\n  select: { using: true, withCheck: false },\n  insert: { using: false, withCheck: true },\n  update: { using: true, withCheck: true },\n  delete: { using: true, withCheck: false },\n  all: { using: true, withCheck: true },\n};\n\nfunction readRefParam(block: PslExtensionBlock, key: string): string | undefined {\n  const param = block.parameters[key];\n  return param?.kind === 'ref' ? param.identifier : undefined;\n}\n\nfunction readValueParam(block: PslExtensionBlock, key: string): string | undefined {\n  const param = block.parameters[key];\n  return param?.kind === 'value' ? param.raw : undefined;\n}\n\nfunction readListRefParams(block: PslExtensionBlock, key: string): string[] {\n  const param = block.parameters[key];\n  if (param?.kind !== 'list') return [];\n  return param.items.flatMap((item) => (item.kind === 'ref' ? [item.identifier] : []));\n}\n\n/**\n * Unwraps a quoted PSL string argument, inverting the printer's\n * `escapePslString` escapes (`\\\\`, `\\\"`, `\\n`, `\\r`). An unknown escape\n * sequence is kept verbatim, matching the printer-side `unescapePslString`\n * convention.\n */\nfunction unwrapQuotedString(raw: string): string {\n  if (!(raw.startsWith('\"') && raw.endsWith('\"') && raw.length >= 2)) {\n    return raw;\n  }\n  const inner = raw.slice(1, -1);\n  let result = '';\n  for (let i = 0; i < inner.length; i++) {\n    if (inner[i] !== '\\\\' || i + 1 >= inner.length) {\n      result += inner[i];\n      continue;\n    }\n    const next = inner[i + 1];\n    if (next === '\\\\' || next === '\"') {\n      result += next;\n    } else if (next === 'n') {\n      result += '\\n';\n    } else if (next === 'r') {\n      result += '\\r';\n    } else {\n      result += '\\\\';\n      result += next;\n    }\n    i++;\n  }\n  return result;\n}\n\nfunction lowerRlsPolicyFromBlock(\n  block: RlsPolicyExtensionBlock,\n  ctx: AuthoringEntityContext,\n): PostgresRlsPolicy | undefined {\n  const prefix = block.name;\n  const operation = POLICY_KEYWORD_OPERATION[block.keyword] ?? 'select';\n  const targetModelName = readRefParam(block, 'target') ?? '';\n  const tableName = targetModelName.charAt(0).toLowerCase() + targetModelName.slice(1);\n  const roles = [...readListRefParams(block, 'roles')].sort();\n\n  const usingRaw = readValueParam(block, 'using');\n  const withCheckRaw = readValueParam(block, 'withCheck');\n\n  // Reject a predicate the operation does not take (e.g. `using` on INSERT, or\n  // `withCheck` on SELECT/DELETE). The descriptor's param set already omits it,\n  // but the generic descriptor validator is not wired into the SQL-family\n  // interpreter, so the lowering enforces the per-operation predicate matrix\n  // directly — a wrong predicate is a load-time diagnostic, not a silent drop.\n  const support = POLICY_OPERATION_PREDICATES[operation];\n  const rejectPredicate = (predicate: 'using' | 'withCheck'): undefined => {\n    ctx.diagnostics?.push({\n      code: 'PSL_RLS_PREDICATE_NOT_FOR_OPERATION',\n      message: `\\`${block.keyword}\\` policy \"${block.name}\" does not take a \\`${predicate}\\` predicate; the ${operation.toUpperCase()} operation uses ${support.using ? '`using`' : '`withCheck`'}${support.using && support.withCheck ? ' and `withCheck`' : ' only'}.`,\n      sourceId: ctx.sourceId ?? 'unknown',\n      span: block.parameters[predicate]?.span ?? block.span,\n    });\n    return undefined;\n  };\n  if (usingRaw !== undefined && !support.using) return rejectPredicate('using');\n  if (withCheckRaw !== undefined && !support.withCheck) return rejectPredicate('withCheck');\n\n  const using = usingRaw !== undefined ? unwrapQuotedString(usingRaw) : undefined;\n  const withCheck = withCheckRaw !== undefined ? unwrapQuotedString(withCheckRaw) : undefined;\n\n  const wireHash = computeContentHash({\n    ...ifDefined('using', using !== undefined ? normalizePredicate(using) : undefined),\n    ...ifDefined('withCheck', withCheck !== undefined ? normalizePredicate(withCheck) : undefined),\n    roles,\n    operation,\n    permissive: true,\n  });\n  const wireName = formatRlsPolicyWireName(prefix, wireHash);\n\n  return new PostgresRlsPolicy({\n    name: wireName,\n    prefix,\n    tableName,\n    namespaceId: block.namespaceId,\n    operation,\n    roles,\n    ...ifDefined('using', using),\n    ...ifDefined('withCheck', withCheck),\n    permissive: true,\n  });\n}\n\n/**\n * Lowers a `native_enum { memberName = \"value\" … @@map(\"type_name\") }` block\n * into a {@link PostgresNativeEnum}. Members must be authored as explicit\n * `key = \"value\"` pairs — a bare (value-less) member is a diagnostic, not\n * accepted (authoring-design.md §2.1). The parsed `memberName` is only used\n * to duplicate-check and report diagnostics; the lowered entity carries just\n * the member values (a native enum is value-only — the member \"name\" isn't\n * a separate authoring concept from the value). `typeName` comes from\n * `@@map` or defaults to the block name verbatim.\n */\nfunction lowerNativeEnumFromBlock(\n  block: PslExtensionBlock,\n  ctx: AuthoringEntityContext,\n): PostgresNativeEnum | undefined {\n  const sourceId = ctx.sourceId ?? 'unknown';\n  const diagnostics = ctx.diagnostics;\n\n  const mapAttr = block.blockAttributes.find((a) => a.name === 'map');\n  let typeName = block.name;\n  if (mapAttr) {\n    const rawArg = mapAttr.args[0]?.value;\n    const mapped = rawArg !== undefined ? unwrapQuotedString(rawArg) : undefined;\n    if (mapped === undefined) {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_INVALID_MAP',\n        message: `native_enum \"${block.name}\" @@map attribute must have a quoted type-name argument`,\n        sourceId,\n        span: mapAttr.span,\n      });\n      return undefined;\n    }\n    typeName = mapped;\n  }\n\n  let memberError = false;\n  const seenValues = new Set<string>();\n  const members: string[] = [];\n  for (const [memberName, paramValue] of Object.entries(block.parameters)) {\n    if (paramValue.kind === 'bare') {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_BARE_MEMBER',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" has no value; members must be authored as \"${memberName} = \\\\\"value\\\\\"\"`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (paramValue.kind !== 'value') continue;\n\n    let jsonValue: unknown;\n    try {\n      jsonValue = JSON.parse(paramValue.raw);\n    } catch {\n      diagnostics?.push({\n        code: 'PSL_EXTENSION_INVALID_VALUE',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" value \"${paramValue.raw}\" is not valid JSON`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (typeof jsonValue !== 'string') {\n      diagnostics?.push({\n        code: 'PSL_EXTENSION_INVALID_VALUE',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" value must be a string`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (seenValues.has(jsonValue)) {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_DUPLICATE_MEMBER_VALUE',\n        message: `native_enum \"${block.name}\": duplicate member value \"${jsonValue}\"`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    seenValues.add(jsonValue);\n    members.push(jsonValue);\n  }\n\n  if (memberError) return undefined;\n\n  if (members.length === 0) {\n    diagnostics?.push({\n      code: 'PSL_NATIVE_ENUM_MISSING_MEMBERS',\n      message: `native_enum \"${block.name}\" must have at least one member`,\n      sourceId,\n      span: block.span,\n    });\n    return undefined;\n  }\n\n  // `control` stays unset — the effective grade is resolved at read time via `effectiveControlPolicy`, like `StorageTable`/`StorageColumn`.\n  return new PostgresNativeEnum({ typeName, members });\n}\n\n/**\n * `native_enum`'s entity-type factory output, checked separately from the assembled\n * `postgresAuthoringEntityTypes` map below: `deriveValueSet` is SQL-family surface\n * ({@link SqlValueSetDerivingEntityTypeOutput}), not part of the framework\n * `AuthoringEntityTypeFactoryOutput` shape, so folding it directly into the map's single\n * `satisfies AuthoringEntityTypeNamespace` check would trip an excess-property error. Checking it\n * here against the intersection of both shapes keeps it structurally valid against each without\n * widening the map's own check.\n */\nconst nativeEnumEntityTypeOutput = {\n  factory: lowerNativeEnumFromBlock,\n  deriveValueSet: (entity: PostgresNativeEnum) => ({\n    kind: 'valueSet' as const,\n    values: [...entity.members],\n  }),\n} satisfies AuthoringEntityTypeFactoryOutput<PslExtensionBlock, PostgresNativeEnum | undefined> &\n  SqlValueSetDerivingEntityTypeOutput;\n\nexport const postgresAuthoringEntityTypes = {\n  role: {\n    kind: 'entity',\n    discriminator: 'role',\n    validatorSchema: PostgresRoleSchema,\n    output: {\n      factory: (input: PostgresRoleInput): PostgresRole => new PostgresRole(input),\n    },\n  },\n  rls: {\n    kind: 'entity',\n    discriminator: 'rls',\n    validatorSchema: PostgresRlsEnablementSchema,\n    output: {\n      factory: (input: PostgresRlsEnablementInput): PostgresRlsEnablement =>\n        new PostgresRlsEnablement(input),\n    },\n  },\n  policy: {\n    kind: 'entity',\n    discriminator: 'policy',\n    validatorSchema: PostgresRlsPolicySchema,\n    output: {\n      factory: lowerRlsPolicyFromBlock,\n    },\n  },\n  native_enum: {\n    kind: 'entity',\n    discriminator: 'native_enum',\n    validatorSchema: PostgresNativeEnumSchema,\n    output: nativeEnumEntityTypeOutput,\n  },\n} as const satisfies AuthoringEntityTypeNamespace;\n\n/**\n * Field presets contributed by the Postgres target pack.\n *\n * These mirror the PSL scalar-to-codec mapping used by the Postgres adapter\n * (see `createPostgresPslScalarTypeDescriptors`), so that authoring a field\n * via the TS callback surface (e.g. `field.int()`) and via the PSL scalar\n * surface (e.g. `Int`) lowers to byte-identical contracts.\n *\n * The `uuidNative` / `id.uuidv4Native` / `id.uuidv7Native` presets use the\n * native Postgres `uuid` type (codecId `pg/uuid@1`). For cross-target\n * portability use `uuidString` / `id.uuidv4String` / `id.uuidv7String` from\n * the family pack instead.\n */\n/**\n * Shared parameter descriptors for the five `policy_<op>` PSL block\n * keywords. All five share the `policy` discriminator — the parser\n * dispatches by keyword (see the framework's PSL-block SPI), and every\n * keyword's factory lowers to `PostgresRlsPolicy` via `lowerRlsPolicyFromBlock`.\n *\n * The `roles` list uses `scope:'cross-space'` because same-namespace\n * role ref resolution requires PSL namespace entries keyed by `refKind`\n * (i.e. `'role'`), which in turn requires the role block discriminator to\n * equal `'role'`. Aligning discriminator with refKind is tracked for\n * slice 4 (cross-space roles). Until then cross-space passes validation\n * unconditionally and the authored role names flow through unchanged.\n */\nconst policyTargetParam = {\n  kind: 'ref',\n  refKind: 'model',\n  scope: 'same-namespace',\n  required: true,\n} as const;\nconst policyRolesParam = {\n  kind: 'list',\n  of: { kind: 'ref', refKind: 'role', scope: 'cross-space' },\n} as const;\nconst policyPredicateParam = { kind: 'value', codecId: 'pg/text@1', required: true } as const;\n// A policy may only target an RLS-controlled model: the model named by\n// `target` must declare `@@rls`, or the load fails with a diagnostic naming\n// the model and the policy prefix.\nconst policyRequiresRls = { parameter: 'target', attribute: 'rls' } as const;\n\nexport const postgresAuthoringPslBlockDescriptors = {\n  // The predicate param set per keyword mirrors Postgres: SELECT/DELETE take\n  // USING only; INSERT takes WITH CHECK only; UPDATE/ALL take both. The\n  // per-operation predicate matrix is enforced in `lowerRlsPolicyFromBlock`\n  // (a wrong predicate for the operation is a load-time diagnostic there),\n  // since the generic descriptor validator is not wired into the SQL-family\n  // interpreter.\n  policy_select: {\n    kind: 'pslBlock',\n    keyword: 'policy_select',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: { target: policyTargetParam, roles: policyRolesParam, using: policyPredicateParam },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_delete: {\n    kind: 'pslBlock',\n    keyword: 'policy_delete',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: { target: policyTargetParam, roles: policyRolesParam, using: policyPredicateParam },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_insert: {\n    kind: 'pslBlock',\n    keyword: 'policy_insert',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_update: {\n    kind: 'pslBlock',\n    keyword: 'policy_update',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      using: policyPredicateParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_all: {\n    kind: 'pslBlock',\n    keyword: 'policy_all',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      using: policyPredicateParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  /**\n   * PSL block descriptor for `native_enum`.\n   *\n   * Reuses the existing variadic-block mechanism (the same shape the SQL\n   * family's `enum` block ships): the body is an open `memberName = \"value\"`\n   * list. `variadicParameters: true` opens the block to arbitrary keys\n   * beyond the declared (empty) `parameters` set — the lowering factory\n   * (`lowerNativeEnumFromBlock`) turns the variadic entries into ordered\n   * members and rejects a bare (value-less) member.\n   */\n  native_enum: {\n    kind: 'pslBlock',\n    keyword: 'native_enum',\n    discriminator: 'native_enum',\n    name: { required: true },\n    parameters: {},\n    variadicParameters: true,\n  },\n} as const satisfies AuthoringPslBlockDescriptorNamespace;\n\n/**\n * `@@` model attributes contributed by the Postgres target pack.\n *\n * `@@rls` is argument-less: presence marks the model's table\n * RLS-controlled. It lowers to a {@link PostgresRlsEnablement} marker in\n * the namespace's `entries.rls`, keyed by the model's table name — the\n * marker (never the policy set) is what drives\n * `ENABLE`/`DISABLE ROW LEVEL SECURITY` planning.\n */\nexport const postgresAuthoringModelAttributes = {\n  rls: {\n    kind: 'modelAttribute',\n    attribute: 'rls',\n    spec: modelAttribute('rls', {}),\n    lower: (_parsed: Record<never, never>, ctx: AuthoringModelAttributeContext) => ({\n      key: ctx.storageName,\n      entity: new PostgresRlsEnablement({\n        tableName: ctx.storageName,\n        namespaceId: ctx.namespaceId,\n      }),\n    }),\n  },\n} as const satisfies AuthoringModelAttributeDescriptorNamespace;\n\nexport const postgresAuthoringFieldPresets = {\n  text: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/text@1',\n      nativeType: 'text',\n    },\n  },\n  int: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/int4@1',\n      nativeType: 'int4',\n    },\n  },\n  bigint: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/int8@1',\n      nativeType: 'int8',\n    },\n  },\n  float: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/float8@1',\n      nativeType: 'float8',\n    },\n  },\n  decimal: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/numeric@1',\n      nativeType: 'numeric',\n    },\n  },\n  boolean: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/bool@1',\n      nativeType: 'bool',\n    },\n  },\n  json: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/jsonb@1',\n      nativeType: 'jsonb',\n    },\n  },\n  bytes: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/bytea@1',\n      nativeType: 'bytea',\n    },\n  },\n  dateTime: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/timestamptz@1',\n      nativeType: 'timestamptz',\n    },\n  },\n  temporal: /* @__PURE__ */ temporalAuthoringPresets({\n    codecId: 'pg/timestamptz@1',\n    nativeType: 'timestamptz',\n  }),\n  uuidNative: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/uuid@1',\n      nativeType: 'uuid',\n    },\n  },\n  id: {\n    uuidv4Native: {\n      kind: 'fieldPreset',\n      output: {\n        codecId: 'pg/uuid@1',\n        nativeType: 'uuid',\n        executionDefaults: {\n          onCreate: {\n            kind: 'generator',\n            id: 'uuidv4',\n          },\n        },\n        id: true,\n      },\n    },\n    uuidv7Native: {\n      kind: 'fieldPreset',\n      output: {\n        codecId: 'pg/uuid@1',\n        nativeType: 'uuid',\n        executionDefaults: {\n          onCreate: {\n            kind: 'generator',\n            id: 'uuidv7',\n          },\n        },\n        id: true,\n      },\n    },\n  },\n} as const satisfies AuthoringFieldNamespace;\n"],"mappings":";;;;;;;;;;;;;;;;AAqCA,MAAa,yBAAyB,EACpC,IAAI,EACF,MAAM;CACJ,MAAM;CACN,cAAc;EAAE,OAAO;EAAG,YAAY;CAAc;CACpD,QAAQ,EACN,SAAS,iBACX;AACF,EACF,EACF;;;;;;AAWA,MAAM,2BAAyE;CAC7E,eAAe;CACf,eAAe;CACf,eAAe;CACf,eAAe;CACf,YAAY;AACd;;;;;;;AAQA,MAAM,8BAEF;CACF,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAM;CACxC,QAAQ;EAAE,OAAO;EAAO,WAAW;CAAK;CACxC,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAK;CACvC,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAM;CACxC,KAAK;EAAE,OAAO;EAAM,WAAW;CAAK;AACtC;AAEA,SAAS,aAAa,OAA0B,KAAiC;CAC/E,MAAM,QAAQ,MAAM,WAAW;CAC/B,OAAO,OAAO,SAAS,QAAQ,MAAM,aAAa,KAAA;AACpD;AAEA,SAAS,eAAe,OAA0B,KAAiC;CACjF,MAAM,QAAQ,MAAM,WAAW;CAC/B,OAAO,OAAO,SAAS,UAAU,MAAM,MAAM,KAAA;AAC/C;AAEA,SAAS,kBAAkB,OAA0B,KAAuB;CAC1E,MAAM,QAAQ,MAAM,WAAW;CAC/B,IAAI,OAAO,SAAS,QAAQ,OAAO,CAAC;CACpC,OAAO,MAAM,MAAM,SAAS,SAAU,KAAK,SAAS,QAAQ,CAAC,KAAK,UAAU,IAAI,CAAC,CAAE;AACrF;;;;;;;AAQA,SAAS,mBAAmB,KAAqB;CAC/C,IAAI,EAAE,IAAI,WAAW,IAAG,KAAK,IAAI,SAAS,IAAG,KAAK,IAAI,UAAU,IAC9D,OAAO;CAET,MAAM,QAAQ,IAAI,MAAM,GAAG,EAAE;CAC7B,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,IAAI,MAAM,OAAO,QAAQ,IAAI,KAAK,MAAM,QAAQ;GAC9C,UAAU,MAAM;GAChB;EACF;EACA,MAAM,OAAO,MAAM,IAAI;EACvB,IAAI,SAAS,QAAQ,SAAS,MAC5B,UAAU;OACL,IAAI,SAAS,KAClB,UAAU;OACL,IAAI,SAAS,KAClB,UAAU;OACL;GACL,UAAU;GACV,UAAU;EACZ;EACA;CACF;CACA,OAAO;AACT;AAEA,SAAS,wBACP,OACA,KAC+B;CAC/B,MAAM,SAAS,MAAM;CACrB,MAAM,YAAY,yBAAyB,MAAM,YAAY;CAC7D,MAAM,kBAAkB,aAAa,OAAO,QAAQ,KAAK;CACzD,MAAM,YAAY,gBAAgB,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,gBAAgB,MAAM,CAAC;CACnF,MAAM,QAAQ,CAAC,GAAG,kBAAkB,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK;CAE1D,MAAM,WAAW,eAAe,OAAO,OAAO;CAC9C,MAAM,eAAe,eAAe,OAAO,WAAW;CAOtD,MAAM,UAAU,4BAA4B;CAC5C,MAAM,mBAAmB,cAAgD;EACvE,IAAI,aAAa,KAAK;GACpB,MAAM;GACN,SAAS,KAAK,MAAM,QAAQ,aAAa,MAAM,KAAK,sBAAsB,UAAU,oBAAoB,UAAU,YAAY,EAAE,kBAAkB,QAAQ,QAAQ,YAAY,gBAAgB,QAAQ,SAAS,QAAQ,YAAY,qBAAqB,QAAQ;GAChQ,UAAU,IAAI,YAAY;GAC1B,MAAM,MAAM,WAAW,UAAU,EAAE,QAAQ,MAAM;EACnD,CAAC;CAEH;CACA,IAAI,aAAa,KAAA,KAAa,CAAC,QAAQ,OAAO,OAAO,gBAAgB,OAAO;CAC5E,IAAI,iBAAiB,KAAA,KAAa,CAAC,QAAQ,WAAW,OAAO,gBAAgB,WAAW;CAExF,MAAM,QAAQ,aAAa,KAAA,IAAY,mBAAmB,QAAQ,IAAI,KAAA;CACtE,MAAM,YAAY,iBAAiB,KAAA,IAAY,mBAAmB,YAAY,IAAI,KAAA;CAWlF,OAAO,IAAI,kBAAkB;EAC3B,MAHe,wBAAwB,QAPxB,mBAAmB;GAClC,GAAG,UAAU,SAAS,UAAU,KAAA,IAAY,mBAAmB,KAAK,IAAI,KAAA,CAAS;GACjF,GAAG,UAAU,aAAa,cAAc,KAAA,IAAY,mBAAmB,SAAS,IAAI,KAAA,CAAS;GAC7F;GACA;GACA,YAAY;EACd,CACwD,CAGzC;EACb;EACA;EACA,aAAa,MAAM;EACnB;EACA;EACA,GAAG,UAAU,SAAS,KAAK;EAC3B,GAAG,UAAU,aAAa,SAAS;EACnC,YAAY;CACd,CAAC;AACH;;;;;;;;;;;AAYA,SAAS,yBACP,OACA,KACgC;CAChC,MAAM,WAAW,IAAI,YAAY;CACjC,MAAM,cAAc,IAAI;CAExB,MAAM,UAAU,MAAM,gBAAgB,MAAM,MAAM,EAAE,SAAS,KAAK;CAClE,IAAI,WAAW,MAAM;CACrB,IAAI,SAAS;EACX,MAAM,SAAS,QAAQ,KAAK,EAAE,EAAE;EAChC,MAAM,SAAS,WAAW,KAAA,IAAY,mBAAmB,MAAM,IAAI,KAAA;EACnE,IAAI,WAAW,KAAA,GAAW;GACxB,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK;IACpC;IACA,MAAM,QAAQ;GAChB,CAAC;GACD;EACF;EACA,WAAW;CACb;CAEA,IAAI,cAAc;CAClB,MAAM,6BAAa,IAAI,IAAY;CACnC,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,CAAC,YAAY,eAAe,OAAO,QAAQ,MAAM,UAAU,GAAG;EACvE,IAAI,WAAW,SAAS,QAAQ;GAC9B,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW,+CAA+C,WAAW;IACrH;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,WAAW,SAAS,SAAS;EAEjC,IAAI;EACJ,IAAI;GACF,YAAY,KAAK,MAAM,WAAW,GAAG;EACvC,QAAQ;GACN,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW,WAAW,WAAW,IAAI;IACrF;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,OAAO,cAAc,UAAU;GACjC,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW;IAC3D;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,WAAW,IAAI,SAAS,GAAG;GAC7B,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,6BAA6B,UAAU;IAC3E;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,WAAW,IAAI,SAAS;EACxB,QAAQ,KAAK,SAAS;CACxB;CAEA,IAAI,aAAa,OAAO,KAAA;CAExB,IAAI,QAAQ,WAAW,GAAG;EACxB,aAAa,KAAK;GAChB,MAAM;GACN,SAAS,gBAAgB,MAAM,KAAK;GACpC;GACA,MAAM,MAAM;EACd,CAAC;EACD;CACF;CAGA,OAAO,IAAI,mBAAmB;EAAE;EAAU;CAAQ,CAAC;AACrD;AAoBA,MAAa,+BAA+B;CAC1C,MAAM;EACJ,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,UAAU,UAA2C,IAAI,aAAa,KAAK,EAC7E;CACF;CACA,KAAK;EACH,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,UAAU,UACR,IAAI,sBAAsB,KAAK,EACnC;CACF;CACA,QAAQ;EACN,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,SAAS,wBACX;CACF;CACA,aAAa;EACX,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ;GAtCV,SAAS;GACT,iBAAiB,YAAgC;IAC/C,MAAM;IACN,QAAQ,CAAC,GAAG,OAAO,OAAO;GAC5B;EAkCU;CACV;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,oBAAoB;CACxB,MAAM;CACN,SAAS;CACT,OAAO;CACP,UAAU;AACZ;AACA,MAAM,mBAAmB;CACvB,MAAM;CACN,IAAI;EAAE,MAAM;EAAO,SAAS;EAAQ,OAAO;CAAc;AAC3D;AACA,MAAM,uBAAuB;CAAE,MAAM;CAAS,SAAS;CAAa,UAAU;AAAK;AAInF,MAAM,oBAAoB;CAAE,WAAW;CAAU,WAAW;AAAM;AAElE,MAAa,uCAAuC;CAOlD,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GAAE,QAAQ;GAAmB,OAAO;GAAkB,OAAO;EAAqB;EAC9F,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GAAE,QAAQ;GAAmB,OAAO;GAAkB,OAAO;EAAqB;EAC9F,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;CACA,YAAY;EACV,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;;;;;;;;;;;CAWA,aAAa;EACX,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY,CAAC;EACb,oBAAoB;CACtB;AACF;;;;;;;;;;AAWA,MAAa,mCAAmC,EAC9C,KAAK;CACH,MAAM;CACN,WAAW;CACX,MAAM,eAAe,OAAO,CAAC,CAAC;CAC9B,QAAQ,SAA+B,SAAyC;EAC9E,KAAK,IAAI;EACT,QAAQ,IAAI,sBAAsB;GAChC,WAAW,IAAI;GACf,aAAa,IAAI;EACnB,CAAC;CACH;AACF,EACF;AAEA,MAAa,gCAAgC;CAC3C,MAAM;EACJ,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,KAAK;EACH,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,QAAQ;EACN,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,OAAO;EACL,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,SAAS;EACP,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,SAAS;EACP,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,MAAM;EACJ,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,OAAO;EACL,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,UAAU;EACR,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,UAA0B,yCAAyB;EACjD,SAAS;EACT,YAAY;CACd,CAAC;CACD,YAAY;EACV,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,IAAI;EACF,cAAc;GACZ,MAAM;GACN,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,mBAAmB,EACjB,UAAU;KACR,MAAM;KACN,IAAI;IACN,EACF;IACA,IAAI;GACN;EACF;EACA,cAAc;GACZ,MAAM;GACN,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,mBAAmB,EACjB,UAAU;KACR,MAAM;KACN,IAAI;IACN,EACF;IACA,IAAI;GACN;EACF;CACF;AACF"}
+{"version":3,"file":"authoring-CdIZ0yvD.mjs","names":[],"sources":["../src/core/authoring.ts"],"sourcesContent":["import { temporalAuthoringPresets } from '@prisma-next/family-sql/control';\nimport type {\n  AuthoringEntityContext,\n  AuthoringEntityTypeFactoryOutput,\n  AuthoringEntityTypeNamespace,\n  AuthoringFieldNamespace,\n  AuthoringModelAttributeContext,\n  AuthoringModelAttributeDescriptorNamespace,\n  AuthoringPslBlockDescriptorNamespace,\n  AuthoringTypeNamespace,\n  PslExtensionBlock,\n} from '@prisma-next/framework-components/authoring';\nimport { modelAttribute } from '@prisma-next/psl-parser';\nimport type { SqlValueSetDerivingEntityTypeOutput } from '@prisma-next/sql-contract/value-set-derivation-hook';\nimport { ifDefined } from '@prisma-next/utils/defined';\nimport { PG_ENUM_CODEC_ID } from './codec-ids';\nimport { PostgresNativeEnum } from './postgres-native-enum';\nimport { PostgresRlsEnablement, type PostgresRlsEnablementInput } from './postgres-rls-enablement';\nimport { PostgresRlsPolicy, type RlsPolicyOperation } from './postgres-rls-policy';\nimport { PostgresRole, type PostgresRoleInput } from './postgres-role';\nimport {\n  PostgresNativeEnumSchema,\n  PostgresRlsEnablementSchema,\n  PostgresRlsPolicySchema,\n  PostgresRoleSchema,\n} from './postgres-validators';\nimport { computeContentHash, normalizePredicate } from './rls/canonicalize';\nimport { formatRlsPolicyWireName } from './rls/wire-name';\n\n/**\n * `pg.enum(<ref>)` registers as an ordinary type constructor whose sole\n * positional argument names a `native_enum` entity instead of carrying a\n * literal value. The interpreter resolves the ref to the `native_enum`\n * entity generically (driven by `entityRefArg`); the `pg/enum@1` codec\n * descriptor's `columnFromEntity` hook (see `codecs.ts`) converts that\n * entity into the column's `typeParams` and native type.\n */\nexport const postgresAuthoringTypes = {\n  pg: {\n    enum: {\n      kind: 'typeConstructor',\n      entityRefArg: { index: 0, entityKind: 'native_enum' },\n      output: {\n        codecId: PG_ENUM_CODEC_ID,\n      },\n    },\n  },\n} as const satisfies AuthoringTypeNamespace;\n\nexport interface RlsPolicyExtensionBlock extends PslExtensionBlock {\n  readonly namespaceId: string;\n}\n\n/**\n * Maps a `policy_<op>` keyword to the RLS operation it authors. The keyword\n * IS the operation (per the project's rejection of a `policy { operation = … }`\n * conditional block).\n */\nconst POLICY_KEYWORD_OPERATION: Readonly<Record<string, RlsPolicyOperation>> = {\n  policy_select: 'select',\n  policy_insert: 'insert',\n  policy_update: 'update',\n  policy_delete: 'delete',\n  policy_all: 'all',\n};\n\n/**\n * Which predicate each RLS operation admits, mirroring Postgres: SELECT and\n * DELETE decide row visibility/eligibility with `USING` only; INSERT validates\n * the new row with `WITH CHECK` only; UPDATE and ALL take both. A predicate\n * outside this set is a load-time error (see {@link lowerRlsPolicyFromBlock}).\n */\nconst POLICY_OPERATION_PREDICATES: Readonly<\n  Record<RlsPolicyOperation, { readonly using: boolean; readonly withCheck: boolean }>\n> = {\n  select: { using: true, withCheck: false },\n  insert: { using: false, withCheck: true },\n  update: { using: true, withCheck: true },\n  delete: { using: true, withCheck: false },\n  all: { using: true, withCheck: true },\n};\n\nfunction readRefParam(block: PslExtensionBlock, key: string): string | undefined {\n  const param = block.parameters[key];\n  return param?.kind === 'ref' ? param.identifier : undefined;\n}\n\nfunction readValueParam(block: PslExtensionBlock, key: string): string | undefined {\n  const param = block.parameters[key];\n  return param?.kind === 'value' ? param.raw : undefined;\n}\n\nfunction readListRefParams(block: PslExtensionBlock, key: string): string[] {\n  const param = block.parameters[key];\n  if (param?.kind !== 'list') return [];\n  return param.items.flatMap((item) => (item.kind === 'ref' ? [item.identifier] : []));\n}\n\n/**\n * Unwraps a quoted PSL string argument, inverting the printer's\n * `escapePslString` escapes (`\\\\`, `\\\"`, `\\n`, `\\r`). An unknown escape\n * sequence is kept verbatim, matching the printer-side `unescapePslString`\n * convention.\n */\nfunction unwrapQuotedString(raw: string): string {\n  if (!(raw.startsWith('\"') && raw.endsWith('\"') && raw.length >= 2)) {\n    return raw;\n  }\n  const inner = raw.slice(1, -1);\n  let result = '';\n  for (let i = 0; i < inner.length; i++) {\n    if (inner[i] !== '\\\\' || i + 1 >= inner.length) {\n      result += inner[i];\n      continue;\n    }\n    const next = inner[i + 1];\n    if (next === '\\\\' || next === '\"') {\n      result += next;\n    } else if (next === 'n') {\n      result += '\\n';\n    } else if (next === 'r') {\n      result += '\\r';\n    } else {\n      result += '\\\\';\n      result += next;\n    }\n    i++;\n  }\n  return result;\n}\n\nfunction lowerRlsPolicyFromBlock(\n  block: RlsPolicyExtensionBlock,\n  ctx: AuthoringEntityContext,\n): PostgresRlsPolicy | undefined {\n  const prefix = block.name;\n  const operation = POLICY_KEYWORD_OPERATION[block.keyword] ?? 'select';\n  const targetModelName = readRefParam(block, 'target') ?? '';\n  const tableName = targetModelName.charAt(0).toLowerCase() + targetModelName.slice(1);\n  const roles = [...readListRefParams(block, 'roles')].sort();\n\n  const usingRaw = readValueParam(block, 'using');\n  const withCheckRaw = readValueParam(block, 'withCheck');\n\n  // Reject a predicate the operation does not take (e.g. `using` on INSERT, or\n  // `withCheck` on SELECT/DELETE). The descriptor's param set already omits it,\n  // but the generic descriptor validator is not wired into the SQL-family\n  // interpreter, so the lowering enforces the per-operation predicate matrix\n  // directly — a wrong predicate is a load-time diagnostic, not a silent drop.\n  const support = POLICY_OPERATION_PREDICATES[operation];\n  const rejectPredicate = (predicate: 'using' | 'withCheck'): undefined => {\n    ctx.diagnostics?.push({\n      code: 'PSL_RLS_PREDICATE_NOT_FOR_OPERATION',\n      message: `\\`${block.keyword}\\` policy \"${block.name}\" does not take a \\`${predicate}\\` predicate; the ${operation.toUpperCase()} operation uses ${support.using ? '`using`' : '`withCheck`'}${support.using && support.withCheck ? ' and `withCheck`' : ' only'}.`,\n      sourceId: ctx.sourceId ?? 'unknown',\n      span: block.parameters[predicate]?.span ?? block.span,\n    });\n    return undefined;\n  };\n  if (usingRaw !== undefined && !support.using) return rejectPredicate('using');\n  if (withCheckRaw !== undefined && !support.withCheck) return rejectPredicate('withCheck');\n\n  const using = usingRaw !== undefined ? unwrapQuotedString(usingRaw) : undefined;\n  const withCheck = withCheckRaw !== undefined ? unwrapQuotedString(withCheckRaw) : undefined;\n\n  const wireHash = computeContentHash({\n    ...ifDefined('using', using !== undefined ? normalizePredicate(using) : undefined),\n    ...ifDefined('withCheck', withCheck !== undefined ? normalizePredicate(withCheck) : undefined),\n    roles,\n    operation,\n    permissive: true,\n  });\n  const wireName = formatRlsPolicyWireName(prefix, wireHash);\n\n  return new PostgresRlsPolicy({\n    name: wireName,\n    prefix,\n    tableName,\n    namespaceId: block.namespaceId,\n    operation,\n    roles,\n    ...ifDefined('using', using),\n    ...ifDefined('withCheck', withCheck),\n    permissive: true,\n  });\n}\n\n/**\n * Lowers a `native_enum { memberName = \"value\" … @@map(\"type_name\") }` block\n * into a {@link PostgresNativeEnum}. Members must be authored as explicit\n * `key = \"value\"` pairs — a bare (value-less) member is a diagnostic, not\n * accepted (authoring-design.md §2.1). The parsed `memberName` is only used\n * to duplicate-check and report diagnostics; the lowered entity carries just\n * the member values (a native enum is value-only — the member \"name\" isn't\n * a separate authoring concept from the value). `typeName` comes from\n * `@@map` or defaults to the block name verbatim.\n */\nfunction lowerNativeEnumFromBlock(\n  block: PslExtensionBlock,\n  ctx: AuthoringEntityContext,\n): PostgresNativeEnum | undefined {\n  const sourceId = ctx.sourceId ?? 'unknown';\n  const diagnostics = ctx.diagnostics;\n\n  const mapAttr = block.blockAttributes.find((a) => a.name === 'map');\n  let typeName = block.name;\n  if (mapAttr) {\n    const rawArg = mapAttr.args[0]?.value;\n    const mapped = rawArg !== undefined ? unwrapQuotedString(rawArg) : undefined;\n    if (mapped === undefined) {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_INVALID_MAP',\n        message: `native_enum \"${block.name}\" @@map attribute must have a quoted type-name argument`,\n        sourceId,\n        span: mapAttr.span,\n      });\n      return undefined;\n    }\n    typeName = mapped;\n  }\n\n  let memberError = false;\n  const seenValues = new Set<string>();\n  const members: string[] = [];\n  for (const [memberName, paramValue] of Object.entries(block.parameters)) {\n    if (paramValue.kind === 'bare') {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_BARE_MEMBER',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" has no value; members must be authored as \"${memberName} = \\\\\"value\\\\\"\"`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (paramValue.kind !== 'value') continue;\n\n    let jsonValue: unknown;\n    try {\n      jsonValue = JSON.parse(paramValue.raw);\n    } catch {\n      diagnostics?.push({\n        code: 'PSL_EXTENSION_INVALID_VALUE',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" value \"${paramValue.raw}\" is not valid JSON`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (typeof jsonValue !== 'string') {\n      diagnostics?.push({\n        code: 'PSL_EXTENSION_INVALID_VALUE',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" value must be a string`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (seenValues.has(jsonValue)) {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_DUPLICATE_MEMBER_VALUE',\n        message: `native_enum \"${block.name}\": duplicate member value \"${jsonValue}\"`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    seenValues.add(jsonValue);\n    members.push(jsonValue);\n  }\n\n  if (memberError) return undefined;\n\n  if (members.length === 0) {\n    diagnostics?.push({\n      code: 'PSL_NATIVE_ENUM_MISSING_MEMBERS',\n      message: `native_enum \"${block.name}\" must have at least one member`,\n      sourceId,\n      span: block.span,\n    });\n    return undefined;\n  }\n\n  // `control` stays unset — the effective grade is resolved at read time via `effectiveControlPolicy`, like `StorageTable`/`StorageColumn`.\n  return new PostgresNativeEnum({ typeName, members });\n}\n\n/**\n * `native_enum`'s entity-type factory output, checked separately from the assembled\n * `postgresAuthoringEntityTypes` map below: `deriveValueSet` is SQL-family surface\n * ({@link SqlValueSetDerivingEntityTypeOutput}), not part of the framework\n * `AuthoringEntityTypeFactoryOutput` shape, so folding it directly into the map's single\n * `satisfies AuthoringEntityTypeNamespace` check would trip an excess-property error. Checking it\n * here against the intersection of both shapes keeps it structurally valid against each without\n * widening the map's own check.\n */\nconst nativeEnumEntityTypeOutput = {\n  factory: lowerNativeEnumFromBlock,\n  deriveValueSet: (entity: PostgresNativeEnum) => ({\n    kind: 'valueSet' as const,\n    values: [...entity.members],\n  }),\n} satisfies AuthoringEntityTypeFactoryOutput<PslExtensionBlock, PostgresNativeEnum | undefined> &\n  SqlValueSetDerivingEntityTypeOutput;\n\nexport const postgresAuthoringEntityTypes = {\n  role: {\n    kind: 'entity',\n    discriminator: 'role',\n    validatorSchema: PostgresRoleSchema,\n    output: {\n      factory: (input: PostgresRoleInput): PostgresRole => new PostgresRole(input),\n    },\n  },\n  rls: {\n    kind: 'entity',\n    discriminator: 'rls',\n    validatorSchema: PostgresRlsEnablementSchema,\n    output: {\n      factory: (input: PostgresRlsEnablementInput): PostgresRlsEnablement =>\n        new PostgresRlsEnablement(input),\n    },\n  },\n  policy: {\n    kind: 'entity',\n    discriminator: 'policy',\n    validatorSchema: PostgresRlsPolicySchema,\n    output: {\n      factory: lowerRlsPolicyFromBlock,\n    },\n  },\n  native_enum: {\n    kind: 'entity',\n    discriminator: 'native_enum',\n    validatorSchema: PostgresNativeEnumSchema,\n    output: nativeEnumEntityTypeOutput,\n  },\n} as const satisfies AuthoringEntityTypeNamespace;\n\n/**\n * Field presets contributed by the Postgres target pack.\n *\n * These mirror the PSL scalar-to-codec mapping used by the Postgres adapter\n * (see `createPostgresPslScalarTypeDescriptors`), so that authoring a field\n * via the TS callback surface (e.g. `field.int()`) and via the PSL scalar\n * surface (e.g. `Int`) lowers to byte-identical contracts.\n *\n * The `uuidNative` / `id.uuidv4Native` / `id.uuidv7Native` presets use the\n * native Postgres `uuid` type (codecId `pg/uuid@1`). For cross-target\n * portability use `uuidString` / `id.uuidv4String` / `id.uuidv7String` from\n * the family pack instead.\n */\n/**\n * Shared parameter descriptors for the five `policy_<op>` PSL block\n * keywords. All five share the `policy` discriminator — the parser\n * dispatches by keyword (see the framework's PSL-block SPI), and every\n * keyword's factory lowers to `PostgresRlsPolicy` via `lowerRlsPolicyFromBlock`.\n *\n * The `roles` list uses `scope:'cross-space'` because same-namespace\n * role ref resolution requires PSL namespace entries keyed by `refKind`\n * (i.e. `'role'`), which in turn requires the role block discriminator to\n * equal `'role'`. Aligning discriminator with refKind is tracked for\n * slice 4 (cross-space roles). Until then cross-space passes validation\n * unconditionally and the authored role names flow through unchanged.\n */\nconst policyTargetParam = {\n  kind: 'ref',\n  refKind: 'model',\n  scope: 'same-namespace',\n  required: true,\n} as const;\nconst policyRolesParam = {\n  kind: 'list',\n  of: { kind: 'ref', refKind: 'role', scope: 'cross-space' },\n} as const;\nconst policyPredicateParam = { kind: 'value', codecId: 'pg/text@1', required: true } as const;\n// A policy may only target an RLS-controlled model: the model named by\n// `target` must declare `@@rls`, or the load fails with a diagnostic naming\n// the model and the policy prefix.\nconst policyRequiresRls = { parameter: 'target', attribute: 'rls' } as const;\n\nexport const postgresAuthoringPslBlockDescriptors = {\n  // The predicate param set per keyword mirrors Postgres: SELECT/DELETE take\n  // USING only; INSERT takes WITH CHECK only; UPDATE/ALL take both. The\n  // per-operation predicate matrix is enforced in `lowerRlsPolicyFromBlock`\n  // (a wrong predicate for the operation is a load-time diagnostic there),\n  // since the generic descriptor validator is not wired into the SQL-family\n  // interpreter.\n  policy_select: {\n    kind: 'pslBlock',\n    keyword: 'policy_select',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: { target: policyTargetParam, roles: policyRolesParam, using: policyPredicateParam },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_delete: {\n    kind: 'pslBlock',\n    keyword: 'policy_delete',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: { target: policyTargetParam, roles: policyRolesParam, using: policyPredicateParam },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_insert: {\n    kind: 'pslBlock',\n    keyword: 'policy_insert',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_update: {\n    kind: 'pslBlock',\n    keyword: 'policy_update',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      using: policyPredicateParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_all: {\n    kind: 'pslBlock',\n    keyword: 'policy_all',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      using: policyPredicateParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  /**\n   * PSL block descriptor for `native_enum`.\n   *\n   * Reuses the existing variadic-block mechanism (the same shape the SQL\n   * family's `enum` block ships): the body is an open `memberName = \"value\"`\n   * list. `variadicParameters: true` opens the block to arbitrary keys\n   * beyond the declared (empty) `parameters` set — the lowering factory\n   * (`lowerNativeEnumFromBlock`) turns the variadic entries into ordered\n   * members and rejects a bare (value-less) member.\n   */\n  native_enum: {\n    kind: 'pslBlock',\n    keyword: 'native_enum',\n    discriminator: 'native_enum',\n    name: { required: true },\n    parameters: {},\n    variadicParameters: true,\n  },\n} as const satisfies AuthoringPslBlockDescriptorNamespace;\n\n/**\n * `@@` model attributes contributed by the Postgres target pack.\n *\n * `@@rls` is argument-less: presence marks the model's table\n * RLS-controlled. It lowers to a {@link PostgresRlsEnablement} marker in\n * the namespace's `entries.rls`, keyed by the model's table name — the\n * marker (never the policy set) is what drives\n * `ENABLE`/`DISABLE ROW LEVEL SECURITY` planning.\n */\nexport const postgresAuthoringModelAttributes = {\n  rls: {\n    kind: 'modelAttribute',\n    attribute: 'rls',\n    spec: modelAttribute('rls', {}),\n    lower: (_parsed: Record<never, never>, ctx: AuthoringModelAttributeContext) => ({\n      key: ctx.storageName,\n      entity: new PostgresRlsEnablement({\n        tableName: ctx.storageName,\n        namespaceId: ctx.namespaceId,\n      }),\n    }),\n  },\n} as const satisfies AuthoringModelAttributeDescriptorNamespace;\n\nexport const postgresAuthoringFieldPresets = {\n  text: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/text@1',\n      nativeType: 'text',\n    },\n  },\n  int: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/int4@1',\n      nativeType: 'int4',\n    },\n  },\n  bigint: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/int8@1',\n      nativeType: 'int8',\n    },\n  },\n  float: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/float8@1',\n      nativeType: 'float8',\n    },\n  },\n  decimal: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/numeric@1',\n      nativeType: 'numeric',\n    },\n  },\n  boolean: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/bool@1',\n      nativeType: 'bool',\n    },\n  },\n  json: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/jsonb@1',\n      nativeType: 'jsonb',\n    },\n  },\n  bytes: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/bytea@1',\n      nativeType: 'bytea',\n    },\n  },\n  dateTime: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/timestamptz@1',\n      nativeType: 'timestamptz',\n    },\n  },\n  temporal: /* @__PURE__ */ temporalAuthoringPresets({\n    codecId: 'pg/timestamptz@1',\n    nativeType: 'timestamptz',\n  }),\n  uuidNative: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/uuid@1',\n      nativeType: 'uuid',\n    },\n  },\n  id: {\n    uuidv4Native: {\n      kind: 'fieldPreset',\n      output: {\n        codecId: 'pg/uuid@1',\n        nativeType: 'uuid',\n        executionDefaults: {\n          onCreate: {\n            kind: 'generator',\n            id: 'uuidv4',\n          },\n        },\n        id: true,\n      },\n    },\n    uuidv7Native: {\n      kind: 'fieldPreset',\n      output: {\n        codecId: 'pg/uuid@1',\n        nativeType: 'uuid',\n        executionDefaults: {\n          onCreate: {\n            kind: 'generator',\n            id: 'uuidv7',\n          },\n        },\n        id: true,\n      },\n    },\n  },\n} as const satisfies AuthoringFieldNamespace;\n"],"mappings":";;;;;;;;;;;;;;;;AAqCA,MAAa,yBAAyB,EACpC,IAAI,EACF,MAAM;CACJ,MAAM;CACN,cAAc;EAAE,OAAO;EAAG,YAAY;CAAc;CACpD,QAAQ,EACN,SAAS,iBACX;AACF,EACF,EACF;;;;;;AAWA,MAAM,2BAAyE;CAC7E,eAAe;CACf,eAAe;CACf,eAAe;CACf,eAAe;CACf,YAAY;AACd;;;;;;;AAQA,MAAM,8BAEF;CACF,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAM;CACxC,QAAQ;EAAE,OAAO;EAAO,WAAW;CAAK;CACxC,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAK;CACvC,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAM;CACxC,KAAK;EAAE,OAAO;EAAM,WAAW;CAAK;AACtC;AAEA,SAAS,aAAa,OAA0B,KAAiC;CAC/E,MAAM,QAAQ,MAAM,WAAW;CAC/B,OAAO,OAAO,SAAS,QAAQ,MAAM,aAAa,KAAA;AACpD;AAEA,SAAS,eAAe,OAA0B,KAAiC;CACjF,MAAM,QAAQ,MAAM,WAAW;CAC/B,OAAO,OAAO,SAAS,UAAU,MAAM,MAAM,KAAA;AAC/C;AAEA,SAAS,kBAAkB,OAA0B,KAAuB;CAC1E,MAAM,QAAQ,MAAM,WAAW;CAC/B,IAAI,OAAO,SAAS,QAAQ,OAAO,CAAC;CACpC,OAAO,MAAM,MAAM,SAAS,SAAU,KAAK,SAAS,QAAQ,CAAC,KAAK,UAAU,IAAI,CAAC,CAAE;AACrF;;;;;;;AAQA,SAAS,mBAAmB,KAAqB;CAC/C,IAAI,EAAE,IAAI,WAAW,IAAG,KAAK,IAAI,SAAS,IAAG,KAAK,IAAI,UAAU,IAC9D,OAAO;CAET,MAAM,QAAQ,IAAI,MAAM,GAAG,EAAE;CAC7B,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,IAAI,MAAM,OAAO,QAAQ,IAAI,KAAK,MAAM,QAAQ;GAC9C,UAAU,MAAM;GAChB;EACF;EACA,MAAM,OAAO,MAAM,IAAI;EACvB,IAAI,SAAS,QAAQ,SAAS,MAC5B,UAAU;OACL,IAAI,SAAS,KAClB,UAAU;OACL,IAAI,SAAS,KAClB,UAAU;OACL;GACL,UAAU;GACV,UAAU;EACZ;EACA;CACF;CACA,OAAO;AACT;AAEA,SAAS,wBACP,OACA,KAC+B;CAC/B,MAAM,SAAS,MAAM;CACrB,MAAM,YAAY,yBAAyB,MAAM,YAAY;CAC7D,MAAM,kBAAkB,aAAa,OAAO,QAAQ,KAAK;CACzD,MAAM,YAAY,gBAAgB,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,gBAAgB,MAAM,CAAC;CACnF,MAAM,QAAQ,CAAC,GAAG,kBAAkB,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK;CAE1D,MAAM,WAAW,eAAe,OAAO,OAAO;CAC9C,MAAM,eAAe,eAAe,OAAO,WAAW;CAOtD,MAAM,UAAU,4BAA4B;CAC5C,MAAM,mBAAmB,cAAgD;EACvE,IAAI,aAAa,KAAK;GACpB,MAAM;GACN,SAAS,KAAK,MAAM,QAAQ,aAAa,MAAM,KAAK,sBAAsB,UAAU,oBAAoB,UAAU,YAAY,EAAE,kBAAkB,QAAQ,QAAQ,YAAY,gBAAgB,QAAQ,SAAS,QAAQ,YAAY,qBAAqB,QAAQ;GAChQ,UAAU,IAAI,YAAY;GAC1B,MAAM,MAAM,WAAW,UAAU,EAAE,QAAQ,MAAM;EACnD,CAAC;CAEH;CACA,IAAI,aAAa,KAAA,KAAa,CAAC,QAAQ,OAAO,OAAO,gBAAgB,OAAO;CAC5E,IAAI,iBAAiB,KAAA,KAAa,CAAC,QAAQ,WAAW,OAAO,gBAAgB,WAAW;CAExF,MAAM,QAAQ,aAAa,KAAA,IAAY,mBAAmB,QAAQ,IAAI,KAAA;CACtE,MAAM,YAAY,iBAAiB,KAAA,IAAY,mBAAmB,YAAY,IAAI,KAAA;CAWlF,OAAO,IAAI,kBAAkB;EAC3B,MAHe,wBAAwB,QAPxB,mBAAmB;GAClC,GAAG,UAAU,SAAS,UAAU,KAAA,IAAY,mBAAmB,KAAK,IAAI,KAAA,CAAS;GACjF,GAAG,UAAU,aAAa,cAAc,KAAA,IAAY,mBAAmB,SAAS,IAAI,KAAA,CAAS;GAC7F;GACA;GACA,YAAY;EACd,CACwD,CAGzC;EACb;EACA;EACA,aAAa,MAAM;EACnB;EACA;EACA,GAAG,UAAU,SAAS,KAAK;EAC3B,GAAG,UAAU,aAAa,SAAS;EACnC,YAAY;CACd,CAAC;AACH;;;;;;;;;;;AAYA,SAAS,yBACP,OACA,KACgC;CAChC,MAAM,WAAW,IAAI,YAAY;CACjC,MAAM,cAAc,IAAI;CAExB,MAAM,UAAU,MAAM,gBAAgB,MAAM,MAAM,EAAE,SAAS,KAAK;CAClE,IAAI,WAAW,MAAM;CACrB,IAAI,SAAS;EACX,MAAM,SAAS,QAAQ,KAAK,EAAE,EAAE;EAChC,MAAM,SAAS,WAAW,KAAA,IAAY,mBAAmB,MAAM,IAAI,KAAA;EACnE,IAAI,WAAW,KAAA,GAAW;GACxB,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK;IACpC;IACA,MAAM,QAAQ;GAChB,CAAC;GACD;EACF;EACA,WAAW;CACb;CAEA,IAAI,cAAc;CAClB,MAAM,6BAAa,IAAI,IAAY;CACnC,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,CAAC,YAAY,eAAe,OAAO,QAAQ,MAAM,UAAU,GAAG;EACvE,IAAI,WAAW,SAAS,QAAQ;GAC9B,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW,+CAA+C,WAAW;IACrH;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,WAAW,SAAS,SAAS;EAEjC,IAAI;EACJ,IAAI;GACF,YAAY,KAAK,MAAM,WAAW,GAAG;EACvC,QAAQ;GACN,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW,WAAW,WAAW,IAAI;IACrF;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,OAAO,cAAc,UAAU;GACjC,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW;IAC3D;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,WAAW,IAAI,SAAS,GAAG;GAC7B,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,6BAA6B,UAAU;IAC3E;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,WAAW,IAAI,SAAS;EACxB,QAAQ,KAAK,SAAS;CACxB;CAEA,IAAI,aAAa,OAAO,KAAA;CAExB,IAAI,QAAQ,WAAW,GAAG;EACxB,aAAa,KAAK;GAChB,MAAM;GACN,SAAS,gBAAgB,MAAM,KAAK;GACpC;GACA,MAAM,MAAM;EACd,CAAC;EACD;CACF;CAGA,OAAO,IAAI,mBAAmB;EAAE;EAAU;CAAQ,CAAC;AACrD;AAoBA,MAAa,+BAA+B;CAC1C,MAAM;EACJ,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,UAAU,UAA2C,IAAI,aAAa,KAAK,EAC7E;CACF;CACA,KAAK;EACH,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,UAAU,UACR,IAAI,sBAAsB,KAAK,EACnC;CACF;CACA,QAAQ;EACN,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,SAAS,wBACX;CACF;CACA,aAAa;EACX,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ;GAtCV,SAAS;GACT,iBAAiB,YAAgC;IAC/C,MAAM;IACN,QAAQ,CAAC,GAAG,OAAO,OAAO;GAC5B;EAkCU;CACV;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,oBAAoB;CACxB,MAAM;CACN,SAAS;CACT,OAAO;CACP,UAAU;AACZ;AACA,MAAM,mBAAmB;CACvB,MAAM;CACN,IAAI;EAAE,MAAM;EAAO,SAAS;EAAQ,OAAO;CAAc;AAC3D;AACA,MAAM,uBAAuB;CAAE,MAAM;CAAS,SAAS;CAAa,UAAU;AAAK;AAInF,MAAM,oBAAoB;CAAE,WAAW;CAAU,WAAW;AAAM;AAElE,MAAa,uCAAuC;CAOlD,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GAAE,QAAQ;GAAmB,OAAO;GAAkB,OAAO;EAAqB;EAC9F,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GAAE,QAAQ;GAAmB,OAAO;GAAkB,OAAO;EAAqB;EAC9F,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;CACA,YAAY;EACV,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;;;;;;;;;;;CAWA,aAAa;EACX,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY,CAAC;EACb,oBAAoB;CACtB;AACF;;;;;;;;;;AAWA,MAAa,mCAAmC,EAC9C,KAAK;CACH,MAAM;CACN,WAAW;CACX,MAAM,eAAe,OAAO,CAAC,CAAC;CAC9B,QAAQ,SAA+B,SAAyC;EAC9E,KAAK,IAAI;EACT,QAAQ,IAAI,sBAAsB;GAChC,WAAW,IAAI;GACf,aAAa,IAAI;EACnB,CAAC;CACH;AACF,EACF;AAEA,MAAa,gCAAgC;CAC3C,MAAM;EACJ,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,KAAK;EACH,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,QAAQ;EACN,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,OAAO;EACL,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,SAAS;EACP,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,SAAS;EACP,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,MAAM;EACJ,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,OAAO;EACL,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,UAAU;EACR,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,UAA0B,yCAAyB;EACjD,SAAS;EACT,YAAY;CACd,CAAC;CACD,YAAY;EACV,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,IAAI;EACF,cAAc;GACZ,MAAM;GACN,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,mBAAmB,EACjB,UAAU;KACR,MAAM;KACN,IAAI;IACN,EACF;IACA,IAAI;GACN;EACF;EACA,cAAc;GACZ,MAAM;GACN,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,mBAAmB,EACjB,UAAU;KACR,MAAM;KACN,IAAI;IACN,EACF;IACA,IAAI;GACN;EACF;CACF;AACF"}

package/dist/contract-free.d.mts

@@ -1,4 +1,4 @@
-import { a as DropDefaultAction, l as PostgresCreateSchema, r as AnyAlterTableAction, s as PostgresAlterTable, t as AddColumnAction, u as PostgresCreateTable } from "./nodes-BtQyZha6.mjs";
+import { a as DropDefaultAction, l as PostgresCreateSchema, r as AnyAlterTableAction, s as PostgresAlterTable, t as AddColumnAction, u as PostgresCreateTable } from "./nodes-Bc2N3tMy.mjs";
 import { t as PostgresTableSource } from "./table-source-BvFo7gVs.mjs";
 import { DdlColumn, DdlNode, DdlTableConstraint, SelectAst } from "@prisma-next/sql-relational-core/ast";
 import { CfExpr, ColumnDescriptor, ColumnSchema, TableHandle } from "@prisma-next/sql-relational-core/contract-free";

package/dist/contract-free.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-free.d.mts","names":[],"sources":["../src/contract-free/checks.ts","../src/contract-free/columns.ts","../src/contract-free/control-bootstrap.ts","../src/contract-free/ddl.ts"],"mappings":";;;;;;;;;;AAiBA;iBAAgB,UAAA,CAAW,aAAA,WAAwB,MAAM;AAAA,UASxC,uBAAA;EACf,WAAA,IAAe,SAAA;EACf,YAAA,IAAgB,SAAS;AAAA;;;;;;;;;AAAA;iBAYX,cAAA,CAAe,MAAA,UAAgB,KAAA,WAAgB,uBAAuB;AAAA,UAWrE,4BAAA;EACf,iBAAA,IAAqB,SAAA;EACrB,gBAAA,IAAoB,SAAS;AAAA;;;;AAbuD;AAWtF;;;;;;;;;AAE+B;iBAiBf,mBAAA,CAAoB,OAAA;EAAA,SACzB,cAAA;EAAA,SACA,MAAA;EAAA,SACA,KAAA;AAAA,IACP,4BAA4B;AAAA,UAuDf,wBAAA;EACf,aAAA,IAAiB,SAAA;EACjB,YAAA,IAAgB,SAAS;AAAA;;AAzDK;AAuDhC;;;iBAUgB,eAAA,CAAgB,OAAA;EAAA,SACrB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;AAAA,IACP,wBAAwB;;AAZD;AAQ3B;;iBAgBgB,oBAAA,CAAqB,OAAA;EAAA,SAC1B,MAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;EAAA,SACA,QAAA;AAAA,IACP,SAAS;AAAA,UAUI,yBAAA;EACf,cAAA,IAAkB,SAAA;EAClB,aAAA,IAAiB,SAAA;EACjB,SAAA,IAAa,SAAA;AAAA;;;;;;;iBASC,gBAAA,CAAiB,OAAA;EAAA,SACtB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;AAAA,IACP,yBAAyB;;;;;;iBAuBb,aAAA,CAAc,OAAA;EAAA,SACnB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;EAAA,SACA,YAAA;AAAA,IACP,SAAS;AAAA,UAiCI,2BAAA;EACf,SAAA,IAAa,SAAA;EACb,QAAA,IAAY,SAAS;AAAA;AAnEvB;;;;;AAAA,iBA2EgB,kBAAA,CAAmB,OAAA;EAAA,SACxB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,cAAA;AAAA,IACP,2BAA2B;AA3EF;AAuB7B;;;;AAvB6B,iBAoHb,eAAA,CAAgB,MAAA,UAAgB,KAAA,WAAgB,SAAS;;;;;iBAYzD,eAAA,CAAgB,OAAA;EAAA,SACrB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;AAAA,IACP,SAAS;AAAA,UAQI,2BAAA;EACf,gBAAA,IAAoB,SAAA;EACpB,eAAA,IAAmB,SAAS;AAAA;;;;AA/EP;iBAsFP,kBAAA,CAAmB,aAAA,WAAwB,2BAA2B;AAAA,UAYrE,2BAAA;EACf,aAAA,IAAiB,SAAA;EACjB,YAAA,IAAgB,SAAS;AAAA;;;;;;AAxFI;iBAiGf,kBAAA,CAAmB,OAAA;EAAA,SACxB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,UAAA;AAAA,IACP,2BAA2B;AAAA,UAkBd,sBAAA;EACf,UAAA,IAAc,SAAA;EACd,WAAA,IAAe,SAAS;AAAA;AApE1B;;;;;AAAA,iBA4EgB,aAAA,CAAc,MAAA,UAAgB,KAAA,WAAgB,sBAAsB;AAAA,UA8BnE,uBAAA;EACf,YAAA,IAAgB,SAAA;EAChB,WAAA,IAAe,SAAS;AAAA;AAxGb;AAQb;;;AARa,iBA+GG,cAAA,CAAe,MAAA,UAAgB,SAAA,WAAoB,uBAAuB;;;KC7ZrF,OAAA;EAAA,SAAqB,QAAQ;AAAA;AAAA,cAOrB,IAAA,GAAQ,IAAA,GAAO,OAAA,KAAU,gBAAgD;AAAA,cACzE,IAAA,GAAQ,IAAA,GAAO,OAAA,KAAU,gBAAgD;AAAA,cACzE,IAAA,GAAQ,IAAA,GAAO,OAAA,KAAU,gBAAgD;AAAA,cACzE,KAAA,GAAS,IAAA,GAAO,OAAA,KAAU,gBAAiD;AAAA,cAC3E,SAAA,GAAa,IAAA,GAAO,OAAA,KAAU,gBAAsD;AAAA,cACpF,WAAA,GAAe,IAAA,GAAO,OAAA,KAAU,gBACR;ADZoB;AASzD;;;;;;;;;AAE2B;AAY3B;AAvByD,iBC0BzC,OAAA,gBAAuB,YAAA,EACrC,MAAA;EAAA,SAAmB,IAAA;EAAA,SAAuB,MAAA;EAAA,SAA0B,KAAA;AAAA,GACpE,OAAA,EAAS,MAAA,GACR,WAAA,CAAY,MAAA;;;iBCEC,+BAAA,aAA4C,OAAO;AAAA,iBAInD,iCAAA,aAA8C,OAAO;;;;;;;AFnCrE;;;;AAAyD;AASzD;;;;;iBGGgB,WAAA,CAAY,OAAA;EAAA,SACjB,KAAA;EAAA,SACA,MAAA;EAAA,SACA,WAAA;EAAA,SACA,OAAA,WAAkB,SAAA;EAAA,SAClB,WAAA,YAAuB,kBAAA;AAAA,IAC9B,mBAAA;;;;;iBAQY,YAAA,CAAa,OAAA;EAAA,SAClB,MAAA;EAAA,SACA,WAAA;AAAA,IACP,oBAAoB;;;;;;iBASR,eAAA,CAAgB,MAAA,EAAQ,SAAA,GAAY,eAAe;;;AHFpC;AAiB/B;iBGPgB,iBAAA,CAAkB,UAAA,WAAqB,iBAAiB;;;;;iBAQxD,UAAA,CAAW,OAAA;EAAA,SAChB,KAAA;EAAA,SACA,MAAA;EAAA,SACA,OAAA,WAAkB,mBAAA;AAAA,IACzB,kBAAkB"}
+{"version":3,"file":"contract-free.d.mts","names":[],"sources":["../src/contract-free/checks.ts","../src/contract-free/columns.ts","../src/contract-free/control-bootstrap.ts","../src/contract-free/ddl.ts"],"mappings":";;;;;;;;;;AAiBA;iBAAgB,UAAA,CAAW,aAAA,WAAwB,MAAM;AAAA,UASxC,uBAAA;EACf,WAAA,IAAe,SAAA;EACf,YAAA,IAAgB,SAAS;AAAA;;;;;;;;;AAAA;iBAYX,cAAA,CAAe,MAAA,UAAgB,KAAA,WAAgB,uBAAuB;AAAA,UAWrE,4BAAA;EACf,iBAAA,IAAqB,SAAA;EACrB,gBAAA,IAAoB,SAAS;AAAA;;;;AAbuD;AAWtF;;;;;;;;;AAE+B;iBAiBf,mBAAA,CAAoB,OAAA;EAAA,SACzB,cAAA;EAAA,SACA,MAAA;EAAA,SACA,KAAA;AAAA,IACP,4BAA4B;AAAA,UAuDf,wBAAA;EACf,aAAA,IAAiB,SAAA;EACjB,YAAA,IAAgB,SAAS;AAAA;;AAzDK;AAuDhC;;;iBAUgB,eAAA,CAAgB,OAAA;EAAA,SACrB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;AAAA,IACP,wBAAwB;;AAZD;AAQ3B;;iBAgBgB,oBAAA,CAAqB,OAAA;EAAA,SAC1B,MAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;EAAA,SACA,QAAA;AAAA,IACP,SAAS;AAAA,UAUI,yBAAA;EACf,cAAA,IAAkB,SAAA;EAClB,aAAA,IAAiB,SAAA;EACjB,SAAA,IAAa,SAAA;AAAA;;;;;;;iBASC,gBAAA,CAAiB,OAAA;EAAA,SACtB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;AAAA,IACP,yBAAyB;;;;;;iBAuBb,aAAA,CAAc,OAAA;EAAA,SACnB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;EAAA,SACA,YAAA;AAAA,IACP,SAAS;AAAA,UAiCI,2BAAA;EACf,SAAA,IAAa,SAAA;EACb,QAAA,IAAY,SAAS;AAAA;AAnEvB;;;;;AAAA,iBA2EgB,kBAAA,CAAmB,OAAA;EAAA,SACxB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,cAAA;AAAA,IACP,2BAA2B;AA3EF;AAuB7B;;;;AAvB6B,iBAoHb,eAAA,CAAgB,MAAA,UAAgB,KAAA,WAAgB,SAAS;;;;;iBAYzD,eAAA,CAAgB,OAAA;EAAA,SACrB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,MAAA;AAAA,IACP,SAAS;AAAA,UAQI,2BAAA;EACf,gBAAA,IAAoB,SAAA;EACpB,eAAA,IAAmB,SAAS;AAAA;;;;AA/EP;iBAsFP,kBAAA,CAAmB,aAAA,WAAwB,2BAA2B;AAAA,UAYrE,2BAAA;EACf,aAAA,IAAiB,SAAA;EACjB,YAAA,IAAgB,SAAS;AAAA;;;;;;AAxFI;iBAiGf,kBAAA,CAAmB,OAAA;EAAA,SACxB,MAAA;EAAA,SACA,KAAA;EAAA,SACA,UAAA;AAAA,IACP,2BAA2B;AAAA,UAkBd,sBAAA;EACf,UAAA,IAAc,SAAA;EACd,WAAA,IAAe,SAAS;AAAA;AApE1B;;;;;AAAA,iBA4EgB,aAAA,CAAc,MAAA,UAAgB,KAAA,WAAgB,sBAAsB;AAAA,UA8BnE,uBAAA;EACf,YAAA,IAAgB,SAAA;EAChB,WAAA,IAAe,SAAS;AAAA;AAxGb;AAQb;;;AARa,iBA+GG,cAAA,CAAe,MAAA,UAAgB,SAAA,WAAoB,uBAAuB;;;KC7ZrF,OAAA;EAAA,SAAqB,QAAQ;AAAA;AAAA,cAOrB,IAAA,GAAQ,IAAA,GAAO,OAAA,KAAU,gBAAgD;AAAA,cACzE,IAAA,GAAQ,IAAA,GAAO,OAAA,KAAU,gBAAgD;AAAA,cACzE,IAAA,GAAQ,IAAA,GAAO,OAAA,KAAU,gBAAgD;AAAA,cACzE,KAAA,GAAS,IAAA,GAAO,OAAA,KAAU,gBAAiD;AAAA,cAC3E,SAAA,GAAa,IAAA,GAAO,OAAA,KAAU,gBAAsD;AAAA,cACpF,WAAA,GAAe,IAAA,GAAO,OAAA,KAAU,gBACR;ADZoB;AASzD;;;;;;;;;AAE2B;AAY3B;AAvByD,iBC0BzC,OAAA,gBAAuB,YAAA,EACrC,MAAA;EAAA,SAAmB,IAAA;EAAA,SAAuB,MAAA;EAAA,SAA0B,KAAA;AAAA,GACpE,OAAA,EAAS,MAAA,GACR,WAAA,CAAY,MAAA;;;iBCEC,+BAAA,aAA4C,OAAO;AAAA,iBAInD,iCAAA,aAA8C,OAAO;;;;;;;AFnCrE;;;;AAAyD;AASzD;;;;;iBGKgB,WAAA,CAAY,OAAA;EAAA,SACjB,KAAA;EAAA,SACA,MAAA;EAAA,SACA,WAAA;EAAA,SACA,OAAA,WAAkB,SAAA;EAAA,SAClB,WAAA,YAAuB,kBAAA;AAAA,IAC9B,mBAAA;;;;;iBAQY,YAAA,CAAa,OAAA;EAAA,SAClB,MAAA;EAAA,SACA,WAAA;AAAA,IACP,oBAAoB;AH0BQ;AAuDhC;;;;AAvDgC,iBGQhB,eAAA,CAAgB,MAAA,EAAQ,SAAA,GAAY,eAAe;;;;;iBAQnD,iBAAA,CAAkB,UAAA,WAAqB,iBAAiB;AHiDxE;;;;AAAA,iBGzCgB,UAAA,CAAW,OAAA;EAAA,SAChB,KAAA;EAAA,SACA,MAAA;EAAA,SACA,OAAA,WAAkB,mBAAA;AAAA,IACzB,kBAAkB"}

package/dist/contract-free.mjs

@@ -1,6 +1,6 @@
 import { _ as PG_TEXT_ARRAY_CODEC_ID, d as PG_INT8_CODEC_ID, m as PG_JSONB_CODEC_ID, u as PG_INT4_CODEC_ID, v as PG_TEXT_CODEC_ID, y as PG_TIMESTAMPTZ_CODEC_ID } from "./codec-ids-C_-Hj6bL.mjs";
-import { l as PostgresTableSource } from "./postgres-schema-COEca21H.mjs";
-import { C as toRegclass, S as tablePrimaryKeyAst, _ as noNullValuesAst, a as createSchema, b as tableExistsAst, c as dropDefaultAction, d as columnExistsAst, f as columnNullabilityAst, g as indexExistsAst, h as extensionExistsAst, m as constraintExistsAst, o as createTable, p as columnTypeAst, r as alterTable, t as addColumnAction, u as columnDefaultAst, v as rlsEnabledAst, x as tableIsEmptyAst, y as rlsPolicyExistsAst } from "./ddl-BovUVFVi.mjs";
+import { l as PostgresTableSource } from "./postgres-schema-DWQ0-CPb.mjs";
+import { C as tableIsEmptyAst, S as tableExistsAst, T as toRegclass, _ as extensionExistsAst, a as createSchema, b as rlsEnabledAst, f as columnDefaultAst, g as constraintExistsAst, h as columnTypeAst, l as dropDefaultAction, m as columnNullabilityAst, o as createTable, p as columnExistsAst, r as alterTable, t as addColumnAction, v as indexExistsAst, w as tablePrimaryKeyAst, x as rlsPolicyExistsAst, y as noNullValuesAst } from "./ddl-gmxHf68z.mjs";
 import { col, fn, lit, table } from "@prisma-next/sql-relational-core/contract-free";
 import { APP_SPACE_ID } from "@prisma-next/framework-components/control";
 //#region src/contract-free/columns.ts

package/dist/{control-policy-BpmChlAK.mjs → control-policy-DKp0HKpY.mjs}

@@ -1,9 +1,9 @@
-import { r as isPostgresSchema } from "./postgres-schema-COEca21H.mjs";
-import { i as quoteIdentifier } from "./sql-utils-DcfMz4MQ.mjs";
-import { n as PostgresSchemaNodeKind, t as PostgresTableSchemaNode } from "./postgres-table-schema-node-9FCtCUz2.mjs";
-import { A as buildTargetDetails, C as DropTableCall, D as SetDefaultCall, O as SetNotNullCall, T as RawSqlCall, _ as DropColumnCall, a as AddNotNullColumnWithTempDefaultCall, b as DropIndexCall, c as AlterColumnTypeCall, f as CreateSchemaCall, g as DropCheckConstraintCall, h as DisableRowLevelSecurityCall, i as AddNotNullColumnDirectCall, k as postgresDefaultToDdlColumnDefault, m as DataTransformCall, n as AddColumnCall, o as AddPrimaryKeyCall, p as CreateTableCall, r as AddForeignKeyCall, s as AddUniqueCall, t as AddCheckConstraintCall, u as CreateIndexCall, v as DropConstraintCall, w as EnableRowLevelSecurityCall, x as DropNotNullCall, y as DropDefaultCall } from "./op-factory-call-CI00nS4z.mjs";
-import { t as buildExpectedFormatType } from "./planner-sql-checks-C1-Kk3Eu.mjs";
-import { n as buildColumnTypeSql, t as buildColumnDefaultSql } from "./planner-ddl-builders-B8Nn6nHN.mjs";
+import { r as isPostgresSchema } from "./postgres-schema-DWQ0-CPb.mjs";
+import { i as quoteIdentifier } from "./sql-utils-SU4FDvIV.mjs";
+import { n as PostgresNativeEnumSchemaNode, o as postgresNodeEntityKind, r as PostgresSchemaNodeKind, t as PostgresTableSchemaNode } from "./postgres-table-schema-node-D6LvInCe.mjs";
+import { A as SetNotNullCall, C as DropNotNullCall, D as RawSqlCall, E as EnableRowLevelSecurityCall, M as buildTargetDetails, S as DropNativeEnumTypeCall, T as DropTableCall, _ as DropCheckConstraintCall, a as AddNotNullColumnWithTempDefaultCall, b as DropDefaultCall, c as AlterColumnTypeCall, d as CreateNativeEnumTypeCall, g as DisableRowLevelSecurityCall, h as DataTransformCall, i as AddNotNullColumnDirectCall, j as postgresDefaultToDdlColumnDefault, k as SetDefaultCall, m as CreateTableCall, n as AddColumnCall, o as AddPrimaryKeyCall, p as CreateSchemaCall, r as AddForeignKeyCall, s as AddUniqueCall, t as AddCheckConstraintCall, u as CreateIndexCall, v as DropColumnCall, x as DropIndexCall, y as DropConstraintCall } from "./op-factory-call-C4flTtTG.mjs";
+import { t as buildExpectedFormatType } from "./planner-sql-checks-Br1c_QsH.mjs";
+import { n as buildColumnTypeSql, t as buildColumnDefaultSql } from "./planner-ddl-builders-BKlmGDJl.mjs";
 import { n as resolveIdentityValue } from "./planner-identity-values-CJPha2Sz.mjs";
 import { i as hasUniqueConstraint, n as hasForeignKey, t as buildSchemaLookupMap } from "./planner-schema-lookup-CiVaAQP-.mjs";
 import { UNBOUND_NAMESPACE_ID, entityAt } from "@prisma-next/framework-components/ir";
@@ -15,6 +15,31 @@ import * as contractFree from "@prisma-next/sql-relational-core/contract-free";
 import { RelationalSchemaNodeKind, SqlSchemaIR } from "@prisma-next/sql-schema-ir/types";
 import { defaultIndexName } from "@prisma-next/sql-schema-ir/naming";
 import { notOk, ok } from "@prisma-next/utils/result";
+//#region src/core/schema-ir/node-storage-coordinate.ts
+/**
+* The storage-`entries` coordinate `(entityKind, entityName)` a Postgres diff
+* node addresses — a table by its name, a native enum by its physical type
+* name. `undefined` for a node that is not a whole storage entity (a namespace,
+* a column, a policy). Lets ownership/subject resolution treat every entity kind
+* uniformly, the node self-describing its storage identity.
+*/
+function postgresNodeStorageCoordinate(node) {
+	if (PostgresTableSchemaNode.is(node)) {
+		const entityKind = postgresNodeEntityKind(node.nodeKind);
+		return entityKind === void 0 ? void 0 : {
+			entityKind,
+			entityName: node.name
+		};
+	}
+	if (PostgresNativeEnumSchemaNode.is(node)) {
+		const entityKind = postgresNodeEntityKind(node.nodeKind);
+		return entityKind === void 0 ? void 0 : {
+			entityKind,
+			entityName: node.typeName
+		};
+	}
+}
+//#endregion
 //#region src/core/migrations/column-ddl-rendering.ts
 /**
 * Reconstructs the `StorageColumn`-shaped fields the DDL builder functions
@@ -542,8 +567,10 @@ function issueConflict(kind, summary, location) {
 function classifyCall(call) {
 	switch (call.factoryName) {
 		case "createExtension":
-		case "createSchema": return "dep";
+		case "createSchema":
+		case "createNativeEnumType": return "dep";
 		case "dropTable":
+		case "dropNativeEnumType":
 		case "dropColumn":
 		case "dropConstraint":
 		case "dropCheckConstraint":
@@ -594,11 +621,16 @@ function conflictKindForCall(call) {
 function locationForCall(call) {
 	const anyCall = call;
 	const location = {};
-	if (anyCall.tableName) location.table = anyCall.tableName;
+	if (anyCall.tableName) {
+		location.entityKind = "table";
+		location.entityName = anyCall.tableName;
+	} else if (anyCall.typeName) {
+		location.entityKind = "native_enum";
+		location.entityName = anyCall.typeName;
+	}
 	if (anyCall.columnName) location.column = anyCall.columnName;
 	if (anyCall.indexName) location.index = anyCall.indexName;
 	if (anyCall.constraintName) location.constraint = anyCall.constraintName;
-	if (anyCall.typeName) location.type = anyCall.typeName;
 	return Object.keys(location).length > 0 ? location : void 0;
 }
 function conflictForDisallowedCall(call, allowed) {
@@ -674,6 +706,7 @@ function nodeIssueOrder(issue) {
 	if (node === void 0) return 99;
 	switch (node.nodeKind) {
 		case PostgresSchemaNodeKind.namespace: return 1;
+		case PostgresSchemaNodeKind.nativeEnum: return issue.reason === "not-expected" ? 17 : 2;
 		case RelationalSchemaNodeKind.foreignKey: return issue.reason === "not-expected" ? 10 : 60;
 		case RelationalSchemaNodeKind.unique: return issue.reason === "not-expected" ? 11 : 51;
 		case RelationalSchemaNodeKind.primaryKey: return issue.reason === "not-expected" ? 12 : 50;
@@ -759,6 +792,27 @@ function buildCreateTableCallsFromNode(schemaName, ddlSchemaName, table, codecHo
 function nodeConflict(kind, message) {
 	return issueConflict(kind, message);
 }
+/**
+* Managed native-enum issue -> op lowering. A missing declared type creates
+* it; an unclaimed live type drops it (ownership-scoped upstream by
+* `retainUnownedExtras`, destructiveness gated by the operation-class
+* policy); a paired member-value mismatch is a NAMED unsupported diagnostic
+* — never a silent no-op and never a drop-and-recreate. Slice B replaces the
+* diagnostic with order-aware `ALTER TYPE ... ADD VALUE` / refusal semantics.
+*/
+function mapNativeEnumNodeIssue(issue, ctx) {
+	const ddlSchemaName = issueSchemaName(issue);
+	if (ddlSchemaName === void 0) return notOk(nodeConflict("unsupportedOperation", `Enum issue has no schema in its path: ${issue.path.join("/")}`));
+	const schemaName = emissionSchemaName(ctx, ddlSchemaName);
+	if (issue.reason === "not-found") {
+		const expected = blindCast(issue.expected);
+		return ok([new CreateNativeEnumTypeCall(schemaName, expected.typeName, expected.members)]);
+	}
+	if (issue.reason === "not-expected") return ok([new DropNativeEnumTypeCall(schemaName, blindCast(issue.actual).typeName)]);
+	const expected = blindCast(issue.expected);
+	const actualMembers = blindCast(issue.actual).members;
+	return notOk(nodeConflict("unsupportedOperation", `Native enum type "${ddlSchemaName}"."${expected.typeName}" member values changed (contract declares [${expected.members.join(", ")}], database has [${actualMembers.join(", ")}]); enum value changes are not auto-migrated yet. Author the change manually with \`migration new\`.`));
+}
 function mapTableNodeIssue(issue, schemaName, ddlSchemaName, codecHooks) {
 	if (issue.reason === "not-found") return ok(buildCreateTableCallsFromNode(schemaName, ddlSchemaName, blindCast(issue.expected), codecHooks));
 	if (issue.reason === "not-expected") return ok([new DropTableCall(schemaName, blindCast(issue.actual).name)]);
@@ -853,6 +907,7 @@ function mapNodeIssueToCall(issue, ctx) {
 		if (issue.reason !== "not-found") return notOk(nodeConflict("unsupportedOperation", `Unexpected namespace drift: ${issue.path.join("/")}`));
 		return ok([new CreateSchemaCall(blindCast(issue.expected).schemaName)]);
 	}
+	if (node.nodeKind === PostgresSchemaNodeKind.nativeEnum) return mapNativeEnumNodeIssue(issue, ctx);
 	const ddlSchemaName = issueSchemaName(issue);
 	const tableName = issueTableName(issue);
 	if (ddlSchemaName === void 0 || tableName === void 0) return notOk(nodeConflict("unsupportedOperation", `Issue has no schema/table in its path: ${issue.path.join("/")}`));
@@ -972,13 +1027,16 @@ function planIssues(options) {
 * and is fail-closed. Any call not listed here — including future or
 * extension-contributed factories — is treated as NOT object-creation, so it
 * is suppressed under `tolerated` rather than permissively emitted.
+*
+* Lists the creation factories that actually reach the call-side resolver
+* (`resolvePostgresCallControlPolicySubject`) — today only RLS policy
+* creation, from `planPostgresSchemaDiff`. Every other whole-object create
+* (table, schema, native enum, and RLS enablement) is constructed inside
+* `planIssues` and graded on the node side by
+* `resolvePostgresNodeIssueCreationFactoryName`, so none of them are listed
+* here.
 */
-const OBJECT_CREATION_FACTORIES = new Set([
-	"createTable",
-	"createSchema",
-	"createRlsPolicy",
-	"enableRowLevelSecurity"
-]);
+const OBJECT_CREATION_FACTORIES = new Set(["createRlsPolicy"]);
 function createsNewTopLevelObject(call) {
 	return OBJECT_CREATION_FACTORIES.has(call.factoryName);
 }
@@ -986,17 +1044,33 @@ function ddlSchemaNameForNamespace(contract, namespaceId) {
 	const namespace = contract.storage.namespaces[namespaceId];
 	return isPostgresSchema(namespace) ? namespace.ddlSchemaName(contract.storage) : namespaceId;
 }
-function resolveNamespaceIdForTable(contract, tableName, ddlSchemaName) {
+/**
+* Resolve the namespace a declared storage entity lives in by walking every
+* namespace for one whose `entries` map actually contains the coordinate —
+* a table by its name, a native enum by its physical type name (see
+* {@link postgresNodeStorageCoordinate}). When `ddlSchemaName` is given, the
+* match must also land in that DDL schema (disambiguates same-named entities
+* declared under different namespaces); when omitted, the first namespace
+* that declares the entity wins. Falls back to {@link UNBOUND_NAMESPACE_ID}
+* when no namespace declares it — e.g. an extra/dropped entity the contract
+* doesn't claim at all.
+*/
+function resolveNamespaceIdForEntity(contract, coordinate, ddlSchemaName) {
 	for (const namespaceId of Object.keys(contract.storage.namespaces)) {
 		if (!entityAt(contract.storage, {
 			namespaceId,
-			entityKind: "table",
-			entityName: tableName
+			...coordinate
 		})) continue;
 		if (ddlSchemaName === void 0 || ddlSchemaNameForNamespace(contract, namespaceId) === ddlSchemaName) return namespaceId;
 	}
 	return UNBOUND_NAMESPACE_ID;
 }
+function resolveNamespaceIdForTable(contract, tableName, ddlSchemaName) {
+	return resolveNamespaceIdForEntity(contract, {
+		entityKind: "table",
+		entityName: tableName
+	}, ddlSchemaName);
+}
 function resolveNamespaceIdForDdlSchema(contract, ddlSchemaName) {
 	for (const namespaceId of Object.keys(contract.storage.namespaces)) {
 		const ns = contract.storage.namespaces[namespaceId];
@@ -1012,9 +1086,42 @@ function postgresCallFields(call) {
 		...ifDefined("columnName", "columnName" in call ? call.columnName : void 0)
 	};
 }
-function formatPostgresControlPolicySubjectLabel(factoryName, subject, contract) {
-	if (subject?.table) return `${factoryName}(${ddlSchemaNameForNamespace(contract, subject.namespaceId)}.${subject.table})`;
-	return factoryName;
+function formatSuppressionSubjectLabel(subject, contract) {
+	if (subject === void 0) return "unknown";
+	const ddlSchema = ddlSchemaNameForNamespace(contract, subject.namespaceId);
+	if (subject.entityKind !== void 0 && subject.entityName !== void 0) return `${subject.entityKind} "${ddlSchema}.${subject.entityName}"`;
+	return `namespace "${ddlSchema}"`;
+}
+function postgresSuppressionSummary(subjectLabel, subject, policy) {
+	const namespace = subject?.namespaceId ?? "unknown";
+	const declared = subject?.explicitNodeControlPolicy;
+	if (policy === "external" && declared === "managed") return `control policy suppressed: ${subjectLabel} — namespace '${namespace}' has effective control 'external' but declared 'managed'`;
+	return `control policy suppressed: ${subjectLabel} — namespace '${namespace}' has effective control '${policy}'${declared ? ` but declared '${declared}'` : ""}`;
+}
+/**
+* Render one family {@link SuppressionRecord} into a target `SqlPlannerConflict`.
+* The family decides *that* a subject is suppressed and hands over the raw
+* coordinate + policy; the label, message, and location are rendered here,
+* driven entirely by the subject's own `(entityKind, entityName)` coordinate
+* — no target-owned table-vs-enum vocabulary.
+*/
+function renderPostgresSuppression(record, contract) {
+	const subject = record.subject;
+	return {
+		kind: "controlPolicySuppressedCall",
+		summary: postgresSuppressionSummary(formatSuppressionSubjectLabel(subject, contract), subject, record.policy),
+		location: {
+			...ifDefined("namespaceId", subject?.namespaceId),
+			...ifDefined("entityKind", subject?.entityKind),
+			...ifDefined("entityName", subject?.entityName),
+			...ifDefined("column", subject?.column)
+		},
+		meta: {
+			controlPolicy: record.policy,
+			...ifDefined("factoryName", record.factoryName),
+			...ifDefined("declaredControlPolicy", subject?.explicitNodeControlPolicy)
+		}
+	};
 }
 function resolvePostgresCallControlPolicySubject(call, contract) {
 	const callFields = postgresCallFields(call);
@@ -1032,9 +1139,10 @@ function resolvePostgresCallControlPolicySubject(call, contract) {
 		})?.control;
 		return {
 			namespaceId,
-			...ifDefined("explicitNodeControlPolicy", tableControlPolicy),
-			table: callFields.tableName,
+			entityKind: "table",
+			entityName: callFields.tableName,
 			...ifDefined("column", callFields.columnName),
+			...ifDefined("explicitNodeControlPolicy", tableControlPolicy),
 			createsNewObject
 		};
 	}
@@ -1044,10 +1152,10 @@ function resolvePostgresCallControlPolicySubject(call, contract) {
 	};
 }
 /**
-* Node kinds that describe the absence of a whole, top-level Postgres
-* object — the same objects `createsNewTopLevelObject` recognises for calls.
-* Used by {@link resolvePostgresNodeIssueCreationFactoryName} to decide
-* whether a `tolerated` subject permits the issue to flow into the planner
+* Node kinds whose *absence* is the creation of a whole, top-level Postgres
+* object: a namespace, a table, or a native enum. Used by
+* {@link resolvePostgresNodeIssueCreationFactoryName} to decide whether a
+* `tolerated` subject permits the issue to flow into the planner
 * (create-if-absent) and to seed the suppressed-subject warning's
 * `factoryName` when the planner is skipped. RLS policy creation is not
 * listed here — policy issues never reach this issue-based partition (they
@@ -1056,13 +1164,15 @@ function resolvePostgresCallControlPolicySubject(call, contract) {
 */
 const POSTGRES_NODE_CREATION_FACTORY = Object.freeze({
 	[PostgresSchemaNodeKind.namespace]: "createSchema",
-	[PostgresSchemaNodeKind.table]: "createTable"
+	[PostgresSchemaNodeKind.table]: "createTable",
+	[PostgresSchemaNodeKind.nativeEnum]: "createNativeEnumType"
 });
 /**
 * A table `not-equal` issue whose `rlsEnabled` flips OFF→ON (expected on,
-* actual off) is enablement toward `ENABLE ROW LEVEL SECURITY` —
-* creation-class per `OBJECT_CREATION_FACTORIES` ('enableRowLevelSecurity'
-* is a member): enabling RLS establishes the fail-closed guard the declared
+* actual off) is enablement toward `ENABLE ROW LEVEL SECURITY`. It is
+* creation-class on the node side because `isEnablementCreationIssue` and
+* {@link resolvePostgresNodeIssueCreationFactoryName} treat this OFF→ON delta
+* as a creation: enabling RLS establishes the fail-closed guard the declared
 * policy set attaches to, the same grant `tolerated` extends to creating the
 * policies themselves. The opposite direction (`DISABLE`) is a modification
 * and stays managed-only. Keying on the actual delta (not just the expected
@@ -1087,15 +1197,25 @@ function resolvePostgresNodeIssueCreationFactoryName(issue) {
 * {@link SchemaDiffIssue}. Mirrors the resolution
 * `resolvePostgresCallControlPolicySubject` performs for a generated DDL
 * call, but works *off the issue* — so the planner can partition issues by
-* effective policy before the diff engine runs. `createsNewObject` is
-* derived from the node kind + reason: a `not-found` schema/table describes
-* a brand-new top-level object; everything else touches an existing object.
+* effective policy before the diff engine runs.
 *
-* A `not-expected` table carries no contract namespace coordinate (the live
-* table isn't claimed by any contract namespace), so the subject's
-* `namespaceId` falls back to {@link UNBOUND_NAMESPACE_ID} via
-* `resolveNamespaceIdForTable`'s own fallback — the call-side resolver does
-* the same for the `DropTableCall` it produces.
+* A whole storage entity (table or native enum) resolves generically off
+* {@link postgresNodeStorageCoordinate} — the node self-describes its
+* `(entityKind, entityName)`, so table and enum issues share one code path
+* with no per-kind branch. A sub-entity issue (a column/constraint drift
+* inside an owned table) carries no such coordinate on its own node, so it
+* falls back to reading the enclosing table name off the issue path.
+*
+* `createsNewObject` is delegated to {@link resolvePostgresNodeIssueCreationFactoryName}
+* in every branch below — that function already encodes exactly which
+* node-kind/reason combinations describe a brand-new top-level object
+* (a `not-found` table/enum, or an RLS-enablement `not-equal`).
+*
+* A `not-expected` (extra/dropped) entity carries no contract namespace
+* coordinate — the live object isn't claimed by any contract namespace — so
+* the subject's `namespaceId` falls back to {@link UNBOUND_NAMESPACE_ID} via
+* `resolveNamespaceIdForEntity`'s own fallback, matching how the call-side
+* resolver treats the `DropTableCall`/`DropNativeEnumTypeCall` it produces.
 *
 * A role node resolves against the `PostgresRole` contract entity at that
 * role's name (roles are root-level diff subjects, so the name is the
@@ -1127,6 +1247,21 @@ function resolvePostgresNodeIssueControlPolicySubject(issue, contract) {
 			createsNewObject: false
 		};
 	}
+	const coordinate = postgresNodeStorageCoordinate(node);
+	if (coordinate !== void 0) {
+		const namespaceId = resolveNamespaceIdForEntity(contract, coordinate, issue.path[1]);
+		const entityControl = entityAt(contract.storage, {
+			namespaceId,
+			...coordinate
+		})?.control;
+		return {
+			namespaceId,
+			...coordinate,
+			...ifDefined("column", issueColumnName(issue)),
+			...ifDefined("explicitNodeControlPolicy", entityControl),
+			createsNewObject: resolvePostgresNodeIssueCreationFactoryName(issue) !== void 0
+		};
+	}
 	const tableName = issue.path[2];
 	if (tableName === void 0) return void 0;
 	const ddlSchemaName = issue.path[1];
@@ -1136,16 +1271,16 @@ function resolvePostgresNodeIssueControlPolicySubject(issue, contract) {
 		entityKind: "table",
 		entityName: tableName
 	});
-	const createsNewObject = node.nodeKind === PostgresSchemaNodeKind.table && issue.reason === "not-found" || isEnablementCreationIssue(issue);
 	return {
 		namespaceId,
-		...ifDefined("explicitNodeControlPolicy", table?.control),
-		table: tableName,
+		entityKind: "table",
+		entityName: tableName,
 		...ifDefined("column", issueColumnName(issue)),
-		createsNewObject
+		...ifDefined("explicitNodeControlPolicy", table?.control),
+		createsNewObject: resolvePostgresNodeIssueCreationFactoryName(issue) !== void 0
 	};
 }
 //#endregion
-export { resolvePostgresNodeIssueCreationFactoryName as a, issueSchemaName as c, postgresPlannerStrategies as d, resolvePostgresNodeIssueControlPolicySubject as i, issueTableName as l, resolveNamespaceIdForDdlSchema as n, coalesceSubtreeIssues as o, resolvePostgresCallControlPolicySubject as r, issueNode as s, formatPostgresControlPolicySubjectLabel as t, planIssues as u };
+export { resolvePostgresNodeIssueCreationFactoryName as a, issueSchemaName as c, postgresNodeStorageCoordinate as d, resolvePostgresNodeIssueControlPolicySubject as i, planIssues as l, resolveNamespaceIdForDdlSchema as n, coalesceSubtreeIssues as o, resolvePostgresCallControlPolicySubject as r, issueNode as s, renderPostgresSuppression as t, postgresPlannerStrategies as u };
 
-//# sourceMappingURL=control-policy-BpmChlAK.mjs.map
+//# sourceMappingURL=control-policy-DKp0HKpY.mjs.map