@prisma-next/target-postgres 0.14.0-dev.8 → 0.14.0-dev.81

package/dist/postgres-native-enum-BwVNf0Ku.mjs

@@ -0,0 +1,45 @@
+import { freezeNode } from "@prisma-next/framework-components/ir";
+import { blindCast } from "@prisma-next/utils/casts";
+import { SqlNode } from "@prisma-next/sql-contract/types";
+//#region src/core/postgres-native-enum.ts
+function freezeMembers(members) {
+	return blindCast(Object.freeze([...members]));
+}
+/**
+* Postgres contract-IR class for a native enum type (`CREATE TYPE … AS ENUM (…)`).
+*
+* This is an authored, serialized Contract-IR entity — it is registered as an entity
+* kind, extends `SqlNode`, and is stored in `contract.json`. It is NOT a DiffableNode;
+* the schema-diff tree will use `PostgresNativeEnumSchemaNode` when the managed phase
+* builds it.
+*
+* A member is a value, not a name→value pair — matching `CREATE TYPE … AS ENUM
+* ('a', 'b')`, which has no separate member name.
+*
+* Target-only concept — no SQL-family abstract. Extends `SqlNode` directly,
+* frozen at construction via `freezeNode(this)`. The `kind: 'postgres-enum'`
+* discriminant is enumerable so it survives JSON. Lives at
+* `storage.namespaces[ns].entries.native_enum[HandleName]`; the entries key
+* (`native_enum`) is the entity-kind descriptor's `kind`, decoupled from this
+* node's own `kind` literal — the same shape as `table`/`StorageTable` and
+* `valueSet`/`StorageValueSet`.
+*/
+var PostgresNativeEnum = class extends SqlNode {
+	static is(node) {
+		return typeof node === "object" && node !== null && "kind" in node && node.kind === "postgres-enum";
+	}
+	kind = "postgres-enum";
+	typeName;
+	members;
+	constructor(input) {
+		super();
+		this.typeName = input.typeName;
+		this.members = freezeMembers(input.members);
+		if (input.control !== void 0) this.control = input.control;
+		freezeNode(this);
+	}
+};
+//#endregion
+export { PostgresNativeEnum as t };
+
+//# sourceMappingURL=postgres-native-enum-BwVNf0Ku.mjs.map

package/dist/postgres-native-enum-BwVNf0Ku.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-native-enum-BwVNf0Ku.mjs","names":[],"sources":["../src/core/postgres-native-enum.ts"],"sourcesContent":["import type { ControlPolicy } from '@prisma-next/contract/types';\nimport { freezeNode } from '@prisma-next/framework-components/ir';\nimport { SqlNode } from '@prisma-next/sql-contract/types';\nimport { blindCast } from '@prisma-next/utils/casts';\n\nexport interface PostgresNativeEnumInput<Members extends readonly string[] = readonly string[]> {\n  /** The Postgres type name (`CREATE TYPE <typeName> AS ENUM (…)`). */\n  readonly typeName: string;\n  /** Member values in declaration order — this is the Postgres enum sort order. */\n  readonly members: Members;\n  readonly control?: ControlPolicy;\n}\n\nfunction freezeMembers<Members extends readonly string[]>(members: Members): Members {\n  return blindCast<\n    Members,\n    'Object.freeze clones+freezes the tuple for immutability; the clone widens to readonly string[], but it holds exactly the values of members (already typed Members)'\n  >(Object.freeze([...members]));\n}\n\n/**\n * Postgres contract-IR class for a native enum type (`CREATE TYPE … AS ENUM (…)`).\n *\n * This is an authored, serialized Contract-IR entity — it is registered as an entity\n * kind, extends `SqlNode`, and is stored in `contract.json`. It is NOT a DiffableNode;\n * the schema-diff tree will use `PostgresNativeEnumSchemaNode` when the managed phase\n * builds it.\n *\n * A member is a value, not a name→value pair — matching `CREATE TYPE … AS ENUM\n * ('a', 'b')`, which has no separate member name.\n *\n * Target-only concept — no SQL-family abstract. Extends `SqlNode` directly,\n * frozen at construction via `freezeNode(this)`. The `kind: 'postgres-enum'`\n * discriminant is enumerable so it survives JSON. Lives at\n * `storage.namespaces[ns].entries.native_enum[HandleName]`; the entries key\n * (`native_enum`) is the entity-kind descriptor's `kind`, decoupled from this\n * node's own `kind` literal — the same shape as `table`/`StorageTable` and\n * `valueSet`/`StorageValueSet`.\n */\nexport class PostgresNativeEnum<\n  Members extends readonly string[] = readonly string[],\n> extends SqlNode {\n  static is(node: unknown): node is PostgresNativeEnum {\n    return (\n      typeof node === 'object' && node !== null && 'kind' in node && node.kind === 'postgres-enum'\n    );\n  }\n\n  override readonly kind = 'postgres-enum' as const;\n  readonly typeName: string;\n  readonly members: Members;\n  declare readonly control?: ControlPolicy;\n\n  constructor(input: PostgresNativeEnumInput<Members>) {\n    super();\n    this.typeName = input.typeName;\n    this.members = freezeMembers(input.members);\n    if (input.control !== undefined) this.control = input.control;\n    freezeNode(this);\n  }\n}\n"],"mappings":";;;;AAaA,SAAS,cAAiD,SAA2B;CACnF,OAAO,UAGL,OAAO,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AAC/B;;;;;;;;;;;;;;;;;;;;AAqBA,IAAa,qBAAb,cAEU,QAAQ;CAChB,OAAO,GAAG,MAA2C;EACnD,OACE,OAAO,SAAS,YAAY,SAAS,QAAQ,UAAU,QAAQ,KAAK,SAAS;CAEjF;CAEA,OAAyB;CACzB;CACA;CAGA,YAAY,OAAyC;EACnD,MAAM;EACN,KAAK,WAAW,MAAM;EACtB,KAAK,UAAU,cAAc,MAAM,OAAO;EAC1C,IAAI,MAAM,YAAY,KAAA,GAAW,KAAK,UAAU,MAAM;EACtD,WAAW,IAAI;CACjB;AACF"}

package/dist/postgres-rls-policy--CSddvMR.d.mts

@@ -0,0 +1,52 @@
+import { SqlNode } from "@prisma-next/sql-contract/types";
+
+//#region src/core/postgres-rls-policy.d.ts
+type RlsPolicyOperation = 'select' | 'insert' | 'update' | 'delete' | 'all';
+interface PostgresRlsPolicyInput {
+  /** Full wire name: `<prefix>_<8hex>`. Stored as-is; hashing is not this class's job. */
+  readonly name: string;
+  /** User-supplied prefix (the part before the `_<8hex>` suffix). */
+  readonly prefix: string;
+  /** Name of the table this policy attaches to, by name within the same schema. */
+  readonly tableName: string;
+  /** Namespace coordinate (schema name). Policies are schema-scoped. */
+  readonly namespaceId: string;
+  readonly operation: RlsPolicyOperation;
+  /** Sorted role names rendered in `TO <roles>`. Plain strings in this slice. */
+  readonly roles: readonly string[];
+  /** USING predicate SQL string, if present. */
+  readonly using?: string;
+  /** WITH CHECK predicate SQL string, if present. */
+  readonly withCheck?: string;
+  /** `true` = `AS PERMISSIVE`, `false` = `AS RESTRICTIVE`. */
+  readonly permissive: boolean;
+}
+/**
+ * Postgres contract-IR class for a row-level security policy (`CREATE POLICY … ON …`).
+ *
+ * This is an authored, serialized Contract-IR entity — it is registered as an entity
+ * kind, extends `SqlNode`, and is stored in `contract.json`. It is NOT a DiffableNode;
+ * the schema-diff tree uses `PostgresPolicySchemaNode` for that role.
+ *
+ * Target-only concept — no SQL-family abstract. Extends `SqlNode` directly.
+ * Frozen at construction via `freezeNode(this)`. The `kind: 'policy'`
+ * discriminant is enumerable (overrides SqlNode's non-enumerable `'sql'`) so it
+ * survives JSON serialization and enables dispatch. The literal matches the
+ * entries key (one-string rule: node.kind === entries key === entity kind).
+ */
+declare class PostgresRlsPolicy extends SqlNode {
+  readonly kind: "policy";
+  readonly name: string;
+  readonly prefix: string;
+  readonly tableName: string;
+  readonly namespaceId: string;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: readonly string[];
+  readonly using?: string;
+  readonly withCheck?: string;
+  readonly permissive: boolean;
+  constructor(input: PostgresRlsPolicyInput);
+}
+//#endregion
+export { PostgresRlsPolicyInput as n, RlsPolicyOperation as r, PostgresRlsPolicy as t };
+//# sourceMappingURL=postgres-rls-policy--CSddvMR.d.mts.map

package/dist/postgres-rls-policy--CSddvMR.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-rls-policy--CSddvMR.d.mts","names":[],"sources":["../src/core/postgres-rls-policy.ts"],"mappings":";;;KAGY,kBAAA;AAAA,UAEK,sBAAA;EAFL;EAAA,SAID,IAAA;;WAEA,MAAA;EANmB;EAAA,SAQnB,SAAA;EAN4B;EAAA,SAQ5B,WAAA;EAAA,SACA,SAAA,EAAW,kBAAkB;EAP7B;EAAA,SASA,KAAA;EALA;EAAA,SAOA,KAAA;EAJA;EAAA,SAMA,SAAA;EAJA;EAAA,SAMA,UAAA;AAAA;;;AAAU;AAgBrB;;;;;;;;;;cAAa,iBAAA,SAA0B,OAAA;EAAA,SACnB,IAAA;EAAA,SACT,IAAA;EAAA,SACA,MAAA;EAAA,SACA,SAAA;EAAA,SACA,WAAA;EAAA,SACA,SAAA,EAAW,kBAAA;EAAA,SACX,KAAA;EAAA,SACQ,KAAA;EAAA,SACA,SAAA;EAAA,SACR,UAAA;cAEG,KAAA,EAAO,sBAAA;AAAA"}

package/dist/postgres-role-schema-node-Cm-j0ZGM.mjs

@@ -0,0 +1,190 @@
+import { r as PostgresSchemaNodeKind } from "./postgres-table-schema-node-D6LvInCe.mjs";
+import { freezeNode } from "@prisma-next/framework-components/ir";
+import { blindCast } from "@prisma-next/utils/casts";
+import { SqlSchemaIRNode, assertNode } from "@prisma-next/sql-schema-ir/types";
+//#region src/core/schema-ir/postgres-database-schema-node.ts
+/**
+* The root of the Postgres schema-diff tree: one node per database.
+*
+* `id` is the fixed sentinel `'database'` — the root has no siblings and
+* the value is never emitted into migration paths. `isEqualTo` is identity
+* (roots always share the `'database'` id). `children()` yields the namespace
+* nodes followed by the role nodes — both are root-level diff subjects. The
+* differ pairs siblings by `(nodeKind, id)`, so a role and a namespace may
+* share a name without colliding.
+*/
+var PostgresDatabaseSchemaNode = class PostgresDatabaseSchemaNode extends SqlSchemaIRNode {
+	nodeKind = PostgresSchemaNodeKind.database;
+	namespaces;
+	roles;
+	existingSchemas;
+	pgVersion;
+	constructor(input) {
+		super();
+		this.namespaces = Object.freeze({ ...input.namespaces });
+		this.roles = Object.freeze([...input.roles]);
+		this.existingSchemas = Object.freeze([...input.existingSchemas]);
+		this.pgVersion = input.pgVersion;
+		freezeNode(this);
+	}
+	get id() {
+		return "database";
+	}
+	isEqualTo(other) {
+		return this.id === other.id;
+	}
+	children() {
+		return [...Object.values(this.namespaces), ...this.roles];
+	}
+	static is(node) {
+		return node.nodeKind === PostgresSchemaNodeKind.database;
+	}
+	static assert(node) {
+		assertNode(node, "PostgresDatabaseSchemaNode", PostgresDatabaseSchemaNode.is);
+	}
+};
+//#endregion
+//#region src/core/schema-ir/postgres-namespace-schema-node.ts
+/**
+* One-per-Postgres-schema diff-tree node. Groups the tables belonging to a
+* single namespace. Per-schema consumers (the relational planner,
+* toSchemaView) read this node's `tables` field structurally via
+* `blindCast`/`SqlSchemaIRNode` — not through a static `SqlSchemaIR`
+* assignment — because `nodeKind` carries this node's own literal
+* (`postgres-namespace`), distinct from `SqlSchemaIR`'s own (`sql-schema`).
+*
+* `id` is the schema name; `isEqualTo` is identity on it; `children()` returns
+* the table nodes plus `nativeEnums`.
+*
+* `nativeEnums` is the diff-tree representation of native enum types the
+* differ pairs — the sole enum carrier, built directly by both sides: the
+* expected (contract-projected) side and introspection alike hand in
+* `PostgresNativeEnumSchemaNode`s.
+*/
+var PostgresNamespaceSchemaNode = class PostgresNamespaceSchemaNode extends SqlSchemaIRNode {
+	nodeKind = PostgresSchemaNodeKind.namespace;
+	schemaName;
+	tables;
+	nativeEnums;
+	constructor(input) {
+		super();
+		this.schemaName = input.schemaName;
+		this.tables = Object.freeze({ ...input.tables });
+		this.nativeEnums = Object.freeze([...input.nativeEnums ?? []]);
+		freezeNode(this);
+	}
+	get id() {
+		return this.schemaName;
+	}
+	isEqualTo(other) {
+		return this.id === other.id;
+	}
+	children() {
+		return [...Object.values(this.tables), ...this.nativeEnums];
+	}
+	static is(node) {
+		return node.nodeKind === PostgresSchemaNodeKind.namespace;
+	}
+	static assert(node) {
+		assertNode(node, "PostgresNamespaceSchemaNode", PostgresNamespaceSchemaNode.is);
+	}
+};
+//#endregion
+//#region src/core/schema-ir/postgres-policy-schema-node.ts
+/**
+* Schema-diff leaf node for a Postgres row-level security policy.
+*
+* This is a derived, transient node walked by the differ — it is NEVER serialized.
+* Built by project-from-contract and project-from-database from their respective
+* `PostgresRlsPolicy` contract entities / introspected rows.
+*
+* `id` is the wire name (`<prefix>_<sha256(body)[0..8]>`), so name-equality is
+* body-equality. `isEqualTo` compares names only — never byte-compare predicate
+* bodies, because Postgres reprints them.
+*/
+var PostgresPolicySchemaNode = class PostgresPolicySchemaNode extends SqlSchemaIRNode {
+	nodeKind = PostgresSchemaNodeKind.policy;
+	name;
+	prefix;
+	tableName;
+	namespaceId;
+	operation;
+	roles;
+	permissive;
+	constructor(input) {
+		super();
+		this.name = input.name;
+		this.prefix = input.prefix;
+		this.tableName = input.tableName;
+		this.namespaceId = input.namespaceId;
+		this.operation = input.operation;
+		this.roles = Object.freeze([...input.roles]);
+		if (input.using !== void 0) this.using = input.using;
+		if (input.withCheck !== void 0) this.withCheck = input.withCheck;
+		this.permissive = input.permissive;
+		freezeNode(this);
+	}
+	get id() {
+		return this.name;
+	}
+	children() {
+		return [];
+	}
+	isEqualTo(other) {
+		const node = blindCast(other);
+		PostgresPolicySchemaNode.assert(node);
+		return this.id === node.id;
+	}
+	static is(node) {
+		return node.nodeKind === PostgresSchemaNodeKind.policy;
+	}
+	static assert(node) {
+		assertNode(node, "PostgresPolicySchemaNode", PostgresPolicySchemaNode.is);
+	}
+};
+//#endregion
+//#region src/core/schema-ir/postgres-role-schema-node.ts
+/**
+* Schema-diff leaf node for a Postgres database role.
+*
+* This is a derived, transient node walked by the differ — it is NEVER serialized.
+* Built by project-from-contract and project-from-database from their respective
+* `PostgresRole` contract entities / introspected rows.
+*
+* Roles are cluster-scoped, so `id` is the bare role name. The differ pairs
+* siblings by `(nodeKind, id)`, so a role and a namespace may share a name
+* (role `public`, schema `public`) without colliding. `isEqualTo` compares
+* ids — name-equality is role-equality for cluster-scoped objects.
+*/
+var PostgresRoleSchemaNode = class PostgresRoleSchemaNode extends SqlSchemaIRNode {
+	nodeKind = PostgresSchemaNodeKind.role;
+	name;
+	namespaceId;
+	constructor(input) {
+		super();
+		this.name = input.name;
+		this.namespaceId = input.namespaceId;
+		freezeNode(this);
+	}
+	get id() {
+		return this.name;
+	}
+	children() {
+		return [];
+	}
+	isEqualTo(other) {
+		const node = blindCast(other);
+		PostgresRoleSchemaNode.assert(node);
+		return this.id === node.id;
+	}
+	static is(node) {
+		return node.nodeKind === PostgresSchemaNodeKind.role;
+	}
+	static assert(node) {
+		assertNode(node, "PostgresRoleSchemaNode", PostgresRoleSchemaNode.is);
+	}
+};
+//#endregion
+export { PostgresDatabaseSchemaNode as i, PostgresPolicySchemaNode as n, PostgresNamespaceSchemaNode as r, PostgresRoleSchemaNode as t };
+
+//# sourceMappingURL=postgres-role-schema-node-Cm-j0ZGM.mjs.map

package/dist/postgres-role-schema-node-Cm-j0ZGM.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-role-schema-node-Cm-j0ZGM.mjs","names":[],"sources":["../src/core/schema-ir/postgres-database-schema-node.ts","../src/core/schema-ir/postgres-namespace-schema-node.ts","../src/core/schema-ir/postgres-policy-schema-node.ts","../src/core/schema-ir/postgres-role-schema-node.ts"],"sourcesContent":["import type { DiffableNode } from '@prisma-next/framework-components/control';\nimport { freezeNode } from '@prisma-next/framework-components/ir';\nimport { assertNode, SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';\nimport type { PostgresNamespaceSchemaNode } from './postgres-namespace-schema-node';\nimport type { PostgresRoleSchemaNode } from './postgres-role-schema-node';\nimport { PostgresSchemaNodeKind } from './schema-node-kinds';\n\nexport interface PostgresDatabaseSchemaNodeInput {\n  readonly namespaces: Readonly<Record<string, PostgresNamespaceSchemaNode>>;\n  readonly roles: readonly PostgresRoleSchemaNode[];\n  readonly existingSchemas: readonly string[];\n  readonly pgVersion: string;\n}\n\n/**\n * The root of the Postgres schema-diff tree: one node per database.\n *\n * `id` is the fixed sentinel `'database'` — the root has no siblings and\n * the value is never emitted into migration paths. `isEqualTo` is identity\n * (roots always share the `'database'` id). `children()` yields the namespace\n * nodes followed by the role nodes — both are root-level diff subjects. The\n * differ pairs siblings by `(nodeKind, id)`, so a role and a namespace may\n * share a name without colliding.\n */\nexport class PostgresDatabaseSchemaNode extends SqlSchemaIRNode implements DiffableNode {\n  override readonly nodeKind = PostgresSchemaNodeKind.database;\n\n  readonly namespaces: Readonly<Record<string, PostgresNamespaceSchemaNode>>;\n  readonly roles: readonly PostgresRoleSchemaNode[];\n  readonly existingSchemas: readonly string[];\n  readonly pgVersion: string;\n\n  constructor(input: PostgresDatabaseSchemaNodeInput) {\n    super();\n    this.namespaces = Object.freeze({ ...input.namespaces });\n    this.roles = Object.freeze([...input.roles]);\n    this.existingSchemas = Object.freeze([...input.existingSchemas]);\n    this.pgVersion = input.pgVersion;\n    freezeNode(this);\n  }\n\n  get id(): string {\n    return 'database';\n  }\n\n  isEqualTo(other: DiffableNode): boolean {\n    return this.id === other.id;\n  }\n\n  children(): readonly DiffableNode[] {\n    return [...Object.values(this.namespaces), ...this.roles];\n  }\n\n  static is(node: SqlSchemaIRNode): node is PostgresDatabaseSchemaNode {\n    return node.nodeKind === PostgresSchemaNodeKind.database;\n  }\n\n  static assert(node: SqlSchemaIRNode): asserts node is PostgresDatabaseSchemaNode {\n    assertNode(node, 'PostgresDatabaseSchemaNode', PostgresDatabaseSchemaNode.is);\n  }\n}\n","import type { DiffableNode } from '@prisma-next/framework-components/control';\nimport { freezeNode } from '@prisma-next/framework-components/ir';\nimport { assertNode, SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';\nimport type { PostgresNativeEnumSchemaNode } from './postgres-native-enum-schema-node';\nimport type { PostgresTableSchemaNode } from './postgres-table-schema-node';\nimport { PostgresSchemaNodeKind } from './schema-node-kinds';\n\nexport interface PostgresNamespaceSchemaNodeInput {\n  readonly schemaName: string;\n  readonly tables: Readonly<Record<string, PostgresTableSchemaNode>>;\n  /**\n   * The native-enum diff nodes belonging to this namespace, member values in\n   * `pg_enum.enumsortorder` (declaration) order. The expected\n   * (contract-projected) side attaches each node's `control` (the contract\n   * entity's grade); introspection builds nodes with no `control`.\n   */\n  readonly nativeEnums?: readonly PostgresNativeEnumSchemaNode[];\n}\n\n/**\n * One-per-Postgres-schema diff-tree node. Groups the tables belonging to a\n * single namespace. Per-schema consumers (the relational planner,\n * toSchemaView) read this node's `tables` field structurally via\n * `blindCast`/`SqlSchemaIRNode` — not through a static `SqlSchemaIR`\n * assignment — because `nodeKind` carries this node's own literal\n * (`postgres-namespace`), distinct from `SqlSchemaIR`'s own (`sql-schema`).\n *\n * `id` is the schema name; `isEqualTo` is identity on it; `children()` returns\n * the table nodes plus `nativeEnums`.\n *\n * `nativeEnums` is the diff-tree representation of native enum types the\n * differ pairs — the sole enum carrier, built directly by both sides: the\n * expected (contract-projected) side and introspection alike hand in\n * `PostgresNativeEnumSchemaNode`s.\n */\nexport class PostgresNamespaceSchemaNode extends SqlSchemaIRNode implements DiffableNode {\n  override readonly nodeKind = PostgresSchemaNodeKind.namespace;\n\n  readonly schemaName: string;\n  readonly tables: Readonly<Record<string, PostgresTableSchemaNode>>;\n  readonly nativeEnums: readonly PostgresNativeEnumSchemaNode[];\n\n  constructor(input: PostgresNamespaceSchemaNodeInput) {\n    super();\n    this.schemaName = input.schemaName;\n    this.tables = Object.freeze({ ...input.tables });\n    this.nativeEnums = Object.freeze([...(input.nativeEnums ?? [])]);\n    freezeNode(this);\n  }\n\n  get id(): string {\n    return this.schemaName;\n  }\n\n  isEqualTo(other: DiffableNode): boolean {\n    return this.id === other.id;\n  }\n\n  children(): readonly DiffableNode[] {\n    return [...Object.values(this.tables), ...this.nativeEnums];\n  }\n\n  static is(node: SqlSchemaIRNode): node is PostgresNamespaceSchemaNode {\n    return node.nodeKind === PostgresSchemaNodeKind.namespace;\n  }\n\n  static assert(node: SqlSchemaIRNode): asserts node is PostgresNamespaceSchemaNode {\n    assertNode(node, 'PostgresNamespaceSchemaNode', PostgresNamespaceSchemaNode.is);\n  }\n}\n","import type { DiffableNode } from '@prisma-next/framework-components/control';\nimport { freezeNode } from '@prisma-next/framework-components/ir';\nimport { assertNode, SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';\nimport { blindCast } from '@prisma-next/utils/casts';\nimport type { RlsPolicyOperation } from '../postgres-rls-policy';\nimport { PostgresSchemaNodeKind } from './schema-node-kinds';\n\nexport interface PostgresPolicySchemaNodeInput {\n  /** Full wire name: `<prefix>_<8hex>`. */\n  readonly name: string;\n  /** User-supplied prefix (the part before the `_<8hex>` suffix). */\n  readonly prefix: string;\n  /** Name of the table this policy attaches to, by name within the same schema. */\n  readonly tableName: string;\n  /** Namespace coordinate (schema name). */\n  readonly namespaceId: string;\n  readonly operation: RlsPolicyOperation;\n  /** Sorted role names rendered in `TO <roles>`. */\n  readonly roles: readonly string[];\n  /** USING predicate SQL string, if present. */\n  readonly using?: string;\n  /** WITH CHECK predicate SQL string, if present. */\n  readonly withCheck?: string;\n  /** `true` = `AS PERMISSIVE`, `false` = `AS RESTRICTIVE`. */\n  readonly permissive: boolean;\n}\n\n/**\n * Schema-diff leaf node for a Postgres row-level security policy.\n *\n * This is a derived, transient node walked by the differ — it is NEVER serialized.\n * Built by project-from-contract and project-from-database from their respective\n * `PostgresRlsPolicy` contract entities / introspected rows.\n *\n * `id` is the wire name (`<prefix>_<sha256(body)[0..8]>`), so name-equality is\n * body-equality. `isEqualTo` compares names only — never byte-compare predicate\n * bodies, because Postgres reprints them.\n */\nexport class PostgresPolicySchemaNode extends SqlSchemaIRNode implements DiffableNode {\n  override readonly nodeKind = PostgresSchemaNodeKind.policy;\n\n  readonly name: string;\n  readonly prefix: string;\n  readonly tableName: string;\n  readonly namespaceId: string;\n  readonly operation: RlsPolicyOperation;\n  readonly roles: readonly string[];\n  declare readonly using?: string;\n  declare readonly withCheck?: string;\n  readonly permissive: boolean;\n\n  constructor(input: PostgresPolicySchemaNodeInput) {\n    super();\n    this.name = input.name;\n    this.prefix = input.prefix;\n    this.tableName = input.tableName;\n    this.namespaceId = input.namespaceId;\n    this.operation = input.operation;\n    this.roles = Object.freeze([...input.roles]);\n    if (input.using !== undefined) this.using = input.using;\n    if (input.withCheck !== undefined) this.withCheck = input.withCheck;\n    this.permissive = input.permissive;\n    freezeNode(this);\n  }\n\n  get id(): string {\n    return this.name;\n  }\n\n  children(): readonly DiffableNode[] {\n    return [];\n  }\n\n  isEqualTo(other: DiffableNode): boolean {\n    const node = blindCast<\n      SqlSchemaIRNode,\n      'every diff-tree node the differ pairs is a SqlSchemaIRNode; the guard rejects non-policy kinds'\n    >(other);\n    PostgresPolicySchemaNode.assert(node);\n    return this.id === node.id;\n  }\n\n  static is(node: SqlSchemaIRNode): node is PostgresPolicySchemaNode {\n    return node.nodeKind === PostgresSchemaNodeKind.policy;\n  }\n\n  static assert(node: SqlSchemaIRNode | undefined): asserts node is PostgresPolicySchemaNode {\n    assertNode(node, 'PostgresPolicySchemaNode', PostgresPolicySchemaNode.is);\n  }\n}\n","import type { DiffableNode } from '@prisma-next/framework-components/control';\nimport { freezeNode } from '@prisma-next/framework-components/ir';\nimport { assertNode, SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';\nimport { blindCast } from '@prisma-next/utils/casts';\nimport { PostgresSchemaNodeKind } from './schema-node-kinds';\n\nexport interface PostgresRoleSchemaNodeInput {\n  readonly name: string;\n  /**\n   * Namespace coordinate. Roles are cluster-scoped; callers pass\n   * `UNBOUND_NAMESPACE_ID` from `@prisma-next/framework-components/ir`.\n   */\n  readonly namespaceId: string;\n}\n\n/**\n * Schema-diff leaf node for a Postgres database role.\n *\n * This is a derived, transient node walked by the differ — it is NEVER serialized.\n * Built by project-from-contract and project-from-database from their respective\n * `PostgresRole` contract entities / introspected rows.\n *\n * Roles are cluster-scoped, so `id` is the bare role name. The differ pairs\n * siblings by `(nodeKind, id)`, so a role and a namespace may share a name\n * (role `public`, schema `public`) without colliding. `isEqualTo` compares\n * ids — name-equality is role-equality for cluster-scoped objects.\n */\nexport class PostgresRoleSchemaNode extends SqlSchemaIRNode implements DiffableNode {\n  override readonly nodeKind = PostgresSchemaNodeKind.role;\n\n  readonly name: string;\n  readonly namespaceId: string;\n\n  constructor(input: PostgresRoleSchemaNodeInput) {\n    super();\n    this.name = input.name;\n    this.namespaceId = input.namespaceId;\n    freezeNode(this);\n  }\n\n  get id(): string {\n    return this.name;\n  }\n\n  children(): readonly DiffableNode[] {\n    return [];\n  }\n\n  isEqualTo(other: DiffableNode): boolean {\n    const node = blindCast<\n      SqlSchemaIRNode,\n      'every diff-tree node the differ pairs is a SqlSchemaIRNode; the guard rejects non-role kinds'\n    >(other);\n    PostgresRoleSchemaNode.assert(node);\n    return this.id === node.id;\n  }\n\n  static is(node: SqlSchemaIRNode): node is PostgresRoleSchemaNode {\n    return node.nodeKind === PostgresSchemaNodeKind.role;\n  }\n\n  static assert(node: SqlSchemaIRNode): asserts node is PostgresRoleSchemaNode {\n    assertNode(node, 'PostgresRoleSchemaNode', PostgresRoleSchemaNode.is);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,IAAa,6BAAb,MAAa,mCAAmC,gBAAwC;CACtF,WAA6B,uBAAuB;CAEpD;CACA;CACA;CACA;CAEA,YAAY,OAAwC;EAClD,MAAM;EACN,KAAK,aAAa,OAAO,OAAO,EAAE,GAAG,MAAM,WAAW,CAAC;EACvD,KAAK,QAAQ,OAAO,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC;EAC3C,KAAK,kBAAkB,OAAO,OAAO,CAAC,GAAG,MAAM,eAAe,CAAC;EAC/D,KAAK,YAAY,MAAM;EACvB,WAAW,IAAI;CACjB;CAEA,IAAI,KAAa;EACf,OAAO;CACT;CAEA,UAAU,OAA8B;EACtC,OAAO,KAAK,OAAO,MAAM;CAC3B;CAEA,WAAoC;EAClC,OAAO,CAAC,GAAG,OAAO,OAAO,KAAK,UAAU,GAAG,GAAG,KAAK,KAAK;CAC1D;CAEA,OAAO,GAAG,MAA2D;EACnE,OAAO,KAAK,aAAa,uBAAuB;CAClD;CAEA,OAAO,OAAO,MAAmE;EAC/E,WAAW,MAAM,8BAA8B,2BAA2B,EAAE;CAC9E;AACF;;;;;;;;;;;;;;;;;;;ACzBA,IAAa,8BAAb,MAAa,oCAAoC,gBAAwC;CACvF,WAA6B,uBAAuB;CAEpD;CACA;CACA;CAEA,YAAY,OAAyC;EACnD,MAAM;EACN,KAAK,aAAa,MAAM;EACxB,KAAK,SAAS,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;EAC/C,KAAK,cAAc,OAAO,OAAO,CAAC,GAAI,MAAM,eAAe,CAAC,CAAE,CAAC;EAC/D,WAAW,IAAI;CACjB;CAEA,IAAI,KAAa;EACf,OAAO,KAAK;CACd;CAEA,UAAU,OAA8B;EACtC,OAAO,KAAK,OAAO,MAAM;CAC3B;CAEA,WAAoC;EAClC,OAAO,CAAC,GAAG,OAAO,OAAO,KAAK,MAAM,GAAG,GAAG,KAAK,WAAW;CAC5D;CAEA,OAAO,GAAG,MAA4D;EACpE,OAAO,KAAK,aAAa,uBAAuB;CAClD;CAEA,OAAO,OAAO,MAAoE;EAChF,WAAW,MAAM,+BAA+B,4BAA4B,EAAE;CAChF;AACF;;;;;;;;;;;;;;AC/BA,IAAa,2BAAb,MAAa,iCAAiC,gBAAwC;CACpF,WAA6B,uBAAuB;CAEpD;CACA;CACA;CACA;CACA;CACA;CAGA;CAEA,YAAY,OAAsC;EAChD,MAAM;EACN,KAAK,OAAO,MAAM;EAClB,KAAK,SAAS,MAAM;EACpB,KAAK,YAAY,MAAM;EACvB,KAAK,cAAc,MAAM;EACzB,KAAK,YAAY,MAAM;EACvB,KAAK,QAAQ,OAAO,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC;EAC3C,IAAI,MAAM,UAAU,KAAA,GAAW,KAAK,QAAQ,MAAM;EAClD,IAAI,MAAM,cAAc,KAAA,GAAW,KAAK,YAAY,MAAM;EAC1D,KAAK,aAAa,MAAM;EACxB,WAAW,IAAI;CACjB;CAEA,IAAI,KAAa;EACf,OAAO,KAAK;CACd;CAEA,WAAoC;EAClC,OAAO,CAAC;CACV;CAEA,UAAU,OAA8B;EACtC,MAAM,OAAO,UAGX,KAAK;EACP,yBAAyB,OAAO,IAAI;EACpC,OAAO,KAAK,OAAO,KAAK;CAC1B;CAEA,OAAO,GAAG,MAAyD;EACjE,OAAO,KAAK,aAAa,uBAAuB;CAClD;CAEA,OAAO,OAAO,MAA6E;EACzF,WAAW,MAAM,4BAA4B,yBAAyB,EAAE;CAC1E;AACF;;;;;;;;;;;;;;;AC9DA,IAAa,yBAAb,MAAa,+BAA+B,gBAAwC;CAClF,WAA6B,uBAAuB;CAEpD;CACA;CAEA,YAAY,OAAoC;EAC9C,MAAM;EACN,KAAK,OAAO,MAAM;EAClB,KAAK,cAAc,MAAM;EACzB,WAAW,IAAI;CACjB;CAEA,IAAI,KAAa;EACf,OAAO,KAAK;CACd;CAEA,WAAoC;EAClC,OAAO,CAAC;CACV;CAEA,UAAU,OAA8B;EACtC,MAAM,OAAO,UAGX,KAAK;EACP,uBAAuB,OAAO,IAAI;EAClC,OAAO,KAAK,OAAO,KAAK;CAC1B;CAEA,OAAO,GAAG,MAAuD;EAC/D,OAAO,KAAK,aAAa,uBAAuB;CAClD;CAEA,OAAO,OAAO,MAA+D;EAC3E,WAAW,MAAM,0BAA0B,uBAAuB,EAAE;CACtE;AACF"}

package/dist/{postgres-schema-COGZ1ark.mjs → postgres-schema-ChBj22nX.mjs}

@@ -1,11 +1,151 @@
-import { _ as PG_TEXT_CODEC_ID } from "./codec-ids-BvytN2P8.mjs";
-import { n as escapeLiteral } from "./sql-utils-DcfMz4MQ.mjs";
+import { v as PG_TEXT_CODEC_ID } from "./codec-ids-C_-Hj6bL.mjs";
+import { t as PostgresNativeEnum } from "./postgres-native-enum-BwVNf0Ku.mjs";
+import { n as escapeLiteral } from "./sql-utils-SU4FDvIV.mjs";
 import { TableSource } from "@prisma-next/sql-relational-core/ast";
+import { UNBOUND_NAMESPACE_ID, freezeNode, hydrateNamespaceEntities } from "@prisma-next/framework-components/ir";
 import { blindCast } from "@prisma-next/utils/casts";
+import { type } from "arktype";
+import { SqlNamespaceBase, SqlNode } from "@prisma-next/sql-contract/types";
 import { ifDefined } from "@prisma-next/utils/defined";
-import { NamespaceBase, UNBOUND_NAMESPACE_ID, freezeNode, hydrateNamespaceEntities } from "@prisma-next/framework-components/ir";
+import { invariant } from "@prisma-next/utils/assertions";
 import { composeSqlEntityKinds } from "@prisma-next/sql-contract/entity-kinds";
 import { cfExpr } from "@prisma-next/sql-relational-core/contract-free";
+//#region src/core/postgres-rls-enablement.ts
+/**
+* Postgres contract-IR marker for `@@rls` on a model: the table named here is
+* RLS-controlled (`ENABLE ROW LEVEL SECURITY` is driven by this marker, never
+* by the policy set).
+*
+* This is an authored, serialized Contract-IR entity — it is registered as an
+* entity kind, extends `SqlNode`, and is stored in `contract.json` under
+* `entries.rls[tableName]`. Target-only concept — no SQL-family abstract.
+* Frozen at construction via `freezeNode(this)`. The `kind: 'rls'`
+* discriminant is enumerable so it survives JSON serialization; the literal
+* matches the entries key (one-string rule).
+*/
+var PostgresRlsEnablement = class extends SqlNode {
+	kind = "rls";
+	tableName;
+	namespaceId;
+	constructor(input) {
+		super();
+		this.tableName = input.tableName;
+		this.namespaceId = input.namespaceId;
+		freezeNode(this);
+	}
+};
+//#endregion
+//#region src/core/postgres-rls-policy.ts
+/**
+* Postgres contract-IR class for a row-level security policy (`CREATE POLICY … ON …`).
+*
+* This is an authored, serialized Contract-IR entity — it is registered as an entity
+* kind, extends `SqlNode`, and is stored in `contract.json`. It is NOT a DiffableNode;
+* the schema-diff tree uses `PostgresPolicySchemaNode` for that role.
+*
+* Target-only concept — no SQL-family abstract. Extends `SqlNode` directly.
+* Frozen at construction via `freezeNode(this)`. The `kind: 'policy'`
+* discriminant is enumerable (overrides SqlNode's non-enumerable `'sql'`) so it
+* survives JSON serialization and enables dispatch. The literal matches the
+* entries key (one-string rule: node.kind === entries key === entity kind).
+*/
+var PostgresRlsPolicy = class extends SqlNode {
+	kind = "policy";
+	name;
+	prefix;
+	tableName;
+	namespaceId;
+	operation;
+	roles;
+	permissive;
+	constructor(input) {
+		super();
+		this.name = input.name;
+		this.prefix = input.prefix;
+		this.tableName = input.tableName;
+		this.namespaceId = input.namespaceId;
+		this.operation = input.operation;
+		this.roles = Object.freeze([...input.roles]);
+		if (input.using !== void 0) this.using = input.using;
+		if (input.withCheck !== void 0) this.withCheck = input.withCheck;
+		this.permissive = input.permissive;
+		freezeNode(this);
+	}
+};
+//#endregion
+//#region src/core/postgres-role.ts
+/**
+* Roles are referenced by the contract but never owned — the framework
+* issues no `CREATE`/`DROP ROLE`, so a role's effective governance is always
+* `external`: a missing declared role fails verify, an extra live role is
+* tolerated, and the planner emits zero role DDL. `external` is the only
+* value a role's control can ever carry.
+*/
+const ROLE_DEFAULT_CONTROL_POLICY = "external";
+/**
+* Postgres contract-IR class for a database role (`CREATE ROLE …`).
+*
+* This is an authored, serialized Contract-IR entity — it is registered as an entity
+* kind, extends `SqlNode`, and is stored in `contract.json`. It is NOT a DiffableNode;
+* the schema-diff tree uses `PostgresRoleSchemaNode` for that role.
+*
+* Roles are cluster-scoped, so their namespace coordinate is always
+* `UNBOUND_NAMESPACE_ID`. Target-only concept — no SQL-family abstract.
+* Extends `SqlNode` directly, frozen at construction via `freezeNode(this)`.
+* The `kind: 'role'` discriminant is enumerable so it survives JSON.
+* Matches the entries key (one-string rule).
+*
+* `control` always carries a value (never omitted): it defaults to
+* {@link ROLE_DEFAULT_CONTROL_POLICY} in the constructor, so both a
+* freshly-authored role and one hydrated from an older `contract.json`
+* lacking the field resolve the same way — the control-policy resolver
+* reads it directly off the entity instead of special-casing role issues.
+*/
+var PostgresRole = class extends SqlNode {
+	kind = "role";
+	name;
+	namespaceId;
+	control;
+	constructor(input) {
+		super();
+		this.name = input.name;
+		this.namespaceId = input.namespaceId;
+		this.control = input.control ?? "external";
+		freezeNode(this);
+	}
+};
+//#endregion
+//#region src/core/postgres-validators.ts
+const PostgresRoleSchema = type({
+	kind: "'role'",
+	name: "string",
+	namespaceId: "string",
+	"control?": "'external'"
+});
+const PostgresRlsPolicySchema = type({
+	kind: "'policy'",
+	name: "string",
+	prefix: "string",
+	tableName: "string",
+	namespaceId: "string",
+	operation: "'select' | 'insert' | 'update' | 'delete' | 'all'",
+	roles: type.string.array().readonly(),
+	"using?": "string",
+	"withCheck?": "string",
+	permissive: "boolean"
+});
+const PostgresRlsEnablementSchema = type({
+	kind: "'rls'",
+	tableName: "string",
+	namespaceId: "string"
+});
+const PostgresNativeEnumSchema = type({
+	kind: "'postgres-enum'",
+	typeName: "string",
+	members: type.string.array().readonly(),
+	"control?": "'managed' | 'tolerated' | 'external' | 'observed'"
+});
+//#endregion
 //#region src/core/ast/table-source.ts
 var PostgresTableSource = class extends TableSource {
 	schema;
@@ -19,6 +159,28 @@ var PostgresTableSource = class extends TableSource {
 	}
 };
 //#endregion
+//#region src/core/entity-kinds.ts
+const policyEntityKind = {
+	kind: "policy",
+	schema: PostgresRlsPolicySchema,
+	construct: (input) => new PostgresRlsPolicy(input)
+};
+const roleEntityKind = {
+	kind: "role",
+	schema: PostgresRoleSchema,
+	construct: (input) => new PostgresRole(input)
+};
+const rlsEnablementEntityKind = {
+	kind: "rls",
+	schema: PostgresRlsEnablementSchema,
+	construct: (input) => new PostgresRlsEnablement(input)
+};
+const nativeEnumEntityKind = {
+	kind: "native_enum",
+	schema: PostgresNativeEnumSchema,
+	construct: (input) => new PostgresNativeEnum(input)
+};
+//#endregion
 //#region src/core/postgres-schema.ts
 /**
 * Postgres target `Namespace` concretion — a Postgres schema (`CREATE
@@ -34,7 +196,7 @@ var PostgresTableSource = class extends TableSource {
 * prefix entirely — call sites stay polymorphic and never branch on
 * `id === UNBOUND_NAMESPACE_ID`.
 */
-var PostgresSchema = class extends NamespaceBase {
+var PostgresSchema = class extends SqlNamespaceBase {
 	/**
 	* Stable singleton reference for the late-bound slot. Materialised
 	* lazily below the singleton subclass declaration so the static
@@ -48,13 +210,28 @@ var PostgresSchema = class extends NamespaceBase {
 	constructor(input) {
 		super();
 		this.id = input.id;
-		const dispatched = hydrateNamespaceEntities(input.entries, composeSqlEntityKinds(), "carry");
+		const dispatched = hydrateNamespaceEntities(input.entries, composeSqlEntityKinds([
+			policyEntityKind,
+			roleEntityKind,
+			rlsEnablementEntityKind,
+			nativeEnumEntityKind
+		]), "carry");
+		const nativeEnumSlot = dispatched["native_enum"];
+		if (nativeEnumSlot !== void 0) {
+			const rekeyed = {};
+			for (const [handle, entity] of Object.entries(nativeEnumSlot)) {
+				const physicalName = PostgresNativeEnum.is(entity) ? entity.typeName : handle;
+				invariant(!Object.hasOwn(rekeyed, physicalName), `PostgresSchema "${input.id}": two native_enum entities resolve to the same physical type name "${physicalName}". Give them distinct @@map type names.`);
+				rekeyed[physicalName] = entity;
+			}
+			dispatched["native_enum"] = Object.freeze(rekeyed);
+		}
 		const valueSetRaw = dispatched["valueSet"];
-		const withPresence = valueSetRaw !== void 0 && Object.keys(valueSetRaw).length === 0 ? {
+		const entriesInput = { ...valueSetRaw !== void 0 && Object.keys(valueSetRaw).length === 0 ? {
 			...dispatched,
 			valueSet: void 0
-		} : dispatched;
-		this.entries = Object.freeze(blindCast(withPresence));
+		} : dispatched };
+		this.entries = Object.freeze(blindCast(entriesInput));
 		Object.defineProperty(this, "kind", {
 			value: "schema",
 			writable: false,
@@ -69,6 +246,15 @@ var PostgresSchema = class extends NamespaceBase {
 	get valueSet() {
 		return this.entries.valueSet;
 	}
+	get policy() {
+		return this.entries.policy ?? Object.freeze({});
+	}
+	get role() {
+		return this.entries.role ?? Object.freeze({});
+	}
+	get rls() {
+		return this.entries.rls ?? Object.freeze({});
+	}
 	/**
 	* The bare schema qualifier as it would appear in a rendered SQL
 	* fragment (already quoted). The unbound-schema singleton overrides
@@ -216,7 +402,10 @@ function isPostgresSchema(ns) {
 * The factory has no per-call state — every named id deterministically
 * maps to a distinct schema instance — so callers can pass it through
 * by reference and trust the resulting `SqlStorage.namespaces` map to
-* be value-stable for a given input set.
+* be value-stable for a given input set. Native-enum column type names are
+* schema-qualified earlier, at column construction, via the target's
+* `authoring.qualifyColumnType` hook (`postgresQualifyColumnType`), so this
+* factory just materialises the namespace from already-qualified entries.
 */
 function postgresCreateNamespace(input) {
 	const schemaInput = {
@@ -230,6 +419,6 @@ function postgresCreateNamespace(input) {
 	return new PostgresSchema(schemaInput);
 }
 //#endregion
-export { PostgresTableSource as a, postgresCreateNamespace as i, PostgresUnboundSchema as n, isPostgresSchema as r, PostgresSchema as t };
+export { PostgresRlsEnablement as _, nativeEnumEntityKind as a, roleEntityKind as c, PostgresRlsEnablementSchema as d, PostgresRlsPolicySchema as f, PostgresRlsPolicy as g, ROLE_DEFAULT_CONTROL_POLICY as h, postgresCreateNamespace as i, PostgresTableSource as l, PostgresRole as m, PostgresUnboundSchema as n, policyEntityKind as o, PostgresRoleSchema as p, isPostgresSchema as r, rlsEnablementEntityKind as s, PostgresSchema as t, PostgresNativeEnumSchema as u };
 
-//# sourceMappingURL=postgres-schema-COGZ1ark.mjs.map
+//# sourceMappingURL=postgres-schema-ChBj22nX.mjs.map