@prisma-next/target-postgres 0.14.0-dev.80 → 0.14.0-dev.81

package/src/core/authoring.ts

@@ -12,7 +12,15 @@ import type {
 } from '@prisma-next/framework-components/authoring';
 import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
 import { modelAttribute } from '@prisma-next/psl-parser';
+import type {
+  EntityHandleLoweringInput,
+  LoweredPackEntity,
+  ResolvedEntityHandleRef,
+  ResolvedPslModelRefs,
+} from '@prisma-next/sql-contract/entity-handle-lowering-hook';
 import type { SqlValueSetDerivingEntityTypeOutput } from '@prisma-next/sql-contract/value-set-derivation-hook';
+import { assertDefined } from '@prisma-next/utils/assertions';
+import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { PG_ENUM_CODEC_ID } from './codec-ids';
 import { PostgresNativeEnum } from './postgres-native-enum';
@@ -25,7 +33,11 @@ import {
   PostgresRlsPolicySchema,
   PostgresRoleSchema,
 } from './postgres-validators';
-import { computeContentHash, normalizePredicate } from './rls/canonicalize';
+import {
+  computeContentHash,
+  normalizePredicate,
+  POLICY_OPERATION_PREDICATES,
+} from './rls/canonicalize';
 import { formatRlsPolicyWireName } from './rls/wire-name';
 
 /**
@@ -50,6 +62,13 @@ export const postgresAuthoringTypes = {
 
 export interface RlsPolicyExtensionBlock extends PslExtensionBlock {
   readonly namespaceId: string;
+  /**
+   * Model refs the family interpreter resolved from the block's descriptor-
+   * declared `refKind: 'model'` parameters before invoking this factory
+   * (keyed by parameter name). An unresolved required ref is the
+   * interpreter's diagnostic; the factory is never called with one missing.
+   */
+  readonly resolvedModelRefs?: ResolvedPslModelRefs;
 }
 
 /** A parsed `role` block annotated with its lexical namespace id by the interpreter. */
@@ -70,27 +89,6 @@ const POLICY_KEYWORD_OPERATION: Readonly<Record<string, RlsPolicyOperation>> = {
   policy_all: 'all',
 };
 
-/**
- * Which predicate each RLS operation admits, mirroring Postgres: SELECT and
- * DELETE decide row visibility/eligibility with `USING` only; INSERT validates
- * the new row with `WITH CHECK` only; UPDATE and ALL take both. A predicate
- * outside this set is a load-time error (see {@link lowerRlsPolicyFromBlock}).
- */
-const POLICY_OPERATION_PREDICATES: Readonly<
-  Record<RlsPolicyOperation, { readonly using: boolean; readonly withCheck: boolean }>
-> = {
-  select: { using: true, withCheck: false },
-  insert: { using: false, withCheck: true },
-  update: { using: true, withCheck: true },
-  delete: { using: true, withCheck: false },
-  all: { using: true, withCheck: true },
-};
-
-function readRefParam(block: PslExtensionBlock, key: string): string | undefined {
-  const param = block.parameters[key];
-  return param?.kind === 'ref' ? param.identifier : undefined;
-}
-
 function readValueParam(block: PslExtensionBlock, key: string): string | undefined {
   const param = block.parameters[key];
   return param?.kind === 'value' ? param.raw : undefined;
@@ -135,14 +133,61 @@ function unwrapQuotedString(raw: string): string {
   return result;
 }
 
+/**
+ * Assembles a {@link PostgresRlsPolicy} from lowered inputs: normalizes the
+ * predicates, computes the content-hash wire name, and constructs the frozen
+ * entity. The single hash-assembly body shared by the PSL block lowering
+ * ({@link lowerRlsPolicyFromBlock}) and the TS entity-handle lowering
+ * ({@link postgresLowerEntityHandles}) so the two surfaces cannot drift.
+ */
+function buildRlsPolicyEntity(input: {
+  readonly prefix: string;
+  readonly tableName: string;
+  readonly namespaceId: string;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: readonly string[];
+  readonly using?: string;
+  readonly withCheck?: string;
+}): PostgresRlsPolicy {
+  const wireHash = computeContentHash({
+    ...ifDefined('using', input.using !== undefined ? normalizePredicate(input.using) : undefined),
+    ...ifDefined(
+      'withCheck',
+      input.withCheck !== undefined ? normalizePredicate(input.withCheck) : undefined,
+    ),
+    roles: input.roles,
+    operation: input.operation,
+    permissive: true,
+  });
+
+  return new PostgresRlsPolicy({
+    name: formatRlsPolicyWireName(input.prefix, wireHash),
+    prefix: input.prefix,
+    tableName: input.tableName,
+    namespaceId: input.namespaceId,
+    operation: input.operation,
+    roles: input.roles,
+    ...ifDefined('using', input.using),
+    ...ifDefined('withCheck', input.withCheck),
+    permissive: true,
+  });
+}
+
 function lowerRlsPolicyFromBlock(
   block: RlsPolicyExtensionBlock,
   ctx: AuthoringEntityContext,
 ): PostgresRlsPolicy | undefined {
   const prefix = block.name;
   const operation = POLICY_KEYWORD_OPERATION[block.keyword] ?? 'select';
-  const targetModelName = readRefParam(block, 'target') ?? '';
-  const tableName = targetModelName.charAt(0).toLowerCase() + targetModelName.slice(1);
+  // The interpreter resolves the descriptor-declared `target` model ref to
+  // its storage table name before invoking this factory (an unresolved or
+  // missing required ref is the interpreter's diagnostic), so a lookup miss
+  // here is structurally impossible.
+  const tableName = block.resolvedModelRefs?.['target']?.tableName;
+  assertDefined(
+    tableName,
+    `lowerRlsPolicyFromBlock: policy "${block.name}" reached the factory without a resolved \`target\` ref; the interpreter resolves same-namespace model refs before invoking entity factories.`,
+  );
   const roles = [...readListRefParams(block, 'roles')].sort();
 
   const usingRaw = readValueParam(block, 'using');
@@ -169,17 +214,7 @@ function lowerRlsPolicyFromBlock(
   const using = usingRaw !== undefined ? unwrapQuotedString(usingRaw) : undefined;
   const withCheck = withCheckRaw !== undefined ? unwrapQuotedString(withCheckRaw) : undefined;
 
-  const wireHash = computeContentHash({
-    ...ifDefined('using', using !== undefined ? normalizePredicate(using) : undefined),
-    ...ifDefined('withCheck', withCheck !== undefined ? normalizePredicate(withCheck) : undefined),
-    roles,
-    operation,
-    permissive: true,
-  });
-  const wireName = formatRlsPolicyWireName(prefix, wireHash);
-
-  return new PostgresRlsPolicy({
-    name: wireName,
+  return buildRlsPolicyEntity({
     prefix,
     tableName,
     namespaceId: block.namespaceId,
@@ -187,7 +222,6 @@ function lowerRlsPolicyFromBlock(
     roles,
     ...ifDefined('using', using),
     ...ifDefined('withCheck', withCheck),
-    permissive: true,
   });
 }
 
@@ -635,3 +669,186 @@ export const postgresAuthoringFieldPresets = {
     },
   },
 } as const satisfies AuthoringFieldNamespace;
+
+/**
+ * Postgres identifiers cap at 63 characters and the wire name appends a
+ * 9-character `_<8hex>` suffix, so the authored prefix is bounded at 54.
+ */
+const RLS_POLICY_PREFIX_MAX_LENGTH = 54;
+
+interface RlsRoleHandleShape {
+  readonly entityKind: 'role';
+  readonly name: string;
+}
+
+interface RlsPolicyHandleShape {
+  readonly entityKind: 'policy';
+  readonly operation: RlsPolicyOperation;
+  readonly name: string;
+  readonly roles: readonly { readonly name: string }[];
+  readonly using?: string;
+  readonly withCheck?: string;
+}
+
+interface RlsTargetCoordinate {
+  readonly namespaceId: string;
+  readonly tableName: string;
+}
+
+/**
+ * Resolves an entity handle's `target` ref to a table coordinate of this
+ * contract, or throws the load-time diagnostic naming the handle: a
+ * cross-space target is rejected (you cannot CREATE POLICY on a table
+ * another space owns) and an unresolved target names the model.
+ */
+function requireLocalTarget(
+  refs: Readonly<Record<string, ResolvedEntityHandleRef>>,
+  subject: string,
+): RlsTargetCoordinate {
+  const target = refs['target'];
+  if (target !== undefined && target.kind === 'resolved') {
+    return { namespaceId: target.namespaceId, tableName: target.tableName };
+  }
+  if (target !== undefined && target.kind === 'cross-space') {
+    throw new Error(
+      `defineContract: ${subject} targets model "${target.modelName ?? target.tableName}", which lives in another contract space. Policies and rlsEnabled entries must target a model declared in this contract.`,
+    );
+  }
+  throw new Error(
+    `defineContract: ${subject} targets model "${target?.modelName ?? '<anonymous>'}", which is not in the contract's models. Add the model to \`models\`.`,
+  );
+}
+
+/**
+ * The SQL-family entity-handle batch lowering hook for the Postgres pack
+ * (`SqlEntityHandleLoweringContribution`). Receives every `entities` handle
+ * whose kind this pack registered — batch, so the cross-entity diagnostics
+ * (duplicate prefix, policy without rlsEnabled, duplicate role) can see
+ * sibling handles — and lowers them with the same keying and hash assembly
+ * as the PSL path: `policy` keyed by prefix (wire name via
+ * {@link buildRlsPolicyEntity}), `rls` keyed by table name, `role` keyed by
+ * name and filed under the default namespace (roles are declared
+ * contract-wide; PSL has no role block to set a precedent).
+ */
+export function postgresLowerEntityHandles(
+  input: EntityHandleLoweringInput,
+): readonly LoweredPackEntity[] {
+  const enablements = new Map<
+    string,
+    { coordinate: RlsTargetCoordinate; entity: PostgresRlsEnablement }
+  >();
+  const roles = new Map<string, PostgresRole>();
+  const policies: {
+    readonly handle: RlsPolicyHandleShape;
+    readonly refs: Readonly<Record<string, ResolvedEntityHandleRef>>;
+  }[] = [];
+  const coordinateKey = (coordinate: RlsTargetCoordinate): string =>
+    `${coordinate.namespaceId} ${coordinate.tableName}`;
+
+  for (const { handle, refs } of input.handles) {
+    switch (handle.entityKind) {
+      case 'rls': {
+        const coordinate = requireLocalTarget(refs, 'an rlsEnabled entry');
+        const key = coordinateKey(coordinate);
+        if (!enablements.has(key)) {
+          enablements.set(key, {
+            coordinate,
+            entity: new PostgresRlsEnablement({
+              tableName: coordinate.tableName,
+              namespaceId: coordinate.namespaceId,
+            }),
+          });
+        }
+        break;
+      }
+      case 'role': {
+        const roleHandle = blindCast<
+          RlsRoleHandleShape,
+          'role handles are constructed only by the postgres contract-builder role() constructor, which enforces this shape'
+        >(handle);
+        if (roles.has(roleHandle.name)) {
+          throw new Error(
+            `defineContract: role "${roleHandle.name}" is declared more than once in the entities list.`,
+          );
+        }
+        // Roles are cluster-scoped in Postgres, so they always land in the
+        // `__unbound__` namespace — identical to a PSL `role` block
+        // (`lowerRoleFromBlock`) and matching the `PostgresRole` class's own
+        // contract. The declaring surface (TS entities vs PSL) does not move
+        // the slot.
+        roles.set(
+          roleHandle.name,
+          new PostgresRole({ name: roleHandle.name, namespaceId: UNBOUND_NAMESPACE_ID }),
+        );
+        break;
+      }
+      case 'policy': {
+        const policyHandle = blindCast<
+          RlsPolicyHandleShape,
+          'policy handles are constructed only by the postgres contract-builder policy*() constructors, which enforce this shape'
+        >(handle);
+        policies.push({ handle: policyHandle, refs });
+        break;
+      }
+      default:
+        throw new Error(
+          `defineContract: the postgres pack does not lower "${handle.entityKind}" handles from the entities list.`,
+        );
+    }
+  }
+
+  const rows: LoweredPackEntity[] = [];
+  const seenPrefixes = new Set<string>();
+
+  for (const { handle: policy, refs } of policies) {
+    const prefix = policy.name;
+    if (prefix.length > RLS_POLICY_PREFIX_MAX_LENGTH) {
+      throw new Error(
+        `defineContract: policy prefix "${prefix}" exceeds the ${RLS_POLICY_PREFIX_MAX_LENGTH}-character maximum (Postgres identifiers cap at 63 characters and the wire name appends a 9-character hash suffix).`,
+      );
+    }
+    const coordinate = requireLocalTarget(refs, `policy "${prefix}"`);
+    if (!enablements.has(coordinateKey(coordinate))) {
+      const target = refs['target'];
+      throw new Error(
+        `defineContract: policy "${prefix}" targets model "${target?.modelName ?? coordinate.tableName}", whose table is not RLS-enabled. Add rlsEnabled(<model>) to the entities list.`,
+      );
+    }
+    const prefixKey = `${coordinate.namespaceId} ${prefix}`;
+    if (seenPrefixes.has(prefixKey)) {
+      throw new Error(
+        `defineContract: policy prefix "${prefix}" is declared more than once in namespace "${coordinate.namespaceId}". Policy prefixes must be unique per namespace.`,
+      );
+    }
+    seenPrefixes.add(prefixKey);
+
+    const roleNames = [...new Set(policy.roles.map((roleHandle) => roleHandle.name))].sort();
+    rows.push({
+      namespaceId: coordinate.namespaceId,
+      entityKind: 'policy',
+      key: prefix,
+      entity: buildRlsPolicyEntity({
+        prefix,
+        tableName: coordinate.tableName,
+        namespaceId: coordinate.namespaceId,
+        operation: policy.operation,
+        roles: roleNames,
+        ...ifDefined('using', policy.using),
+        ...ifDefined('withCheck', policy.withCheck),
+      }),
+    });
+  }
+
+  for (const { coordinate, entity } of enablements.values()) {
+    rows.push({
+      namespaceId: coordinate.namespaceId,
+      entityKind: 'rls',
+      key: coordinate.tableName,
+      entity,
+    });
+  }
+  for (const [name, entity] of roles) {
+    rows.push({ namespaceId: UNBOUND_NAMESPACE_ID, entityKind: 'role', key: name, entity });
+  }
+  return rows;
+}

package/src/core/descriptor-meta.ts

@@ -5,6 +5,7 @@ import {
   postgresAuthoringModelAttributes,
   postgresAuthoringPslBlockDescriptors,
   postgresAuthoringTypes,
+  postgresLowerEntityHandles,
 } from './authoring';
 import { postgresQualifyColumnType } from './codecs';
 import { postgresTargetDescriptorMetaRuntime } from './descriptor-meta-runtime';
@@ -22,6 +23,7 @@ const postgresTargetDescriptorMetaBase = {
     modelAttributes: postgresAuthoringModelAttributes,
     createNamespace: postgresCreateNamespace,
     qualifyColumnType: postgresQualifyColumnType,
+    lowerEntityHandles: postgresLowerEntityHandles,
   },
 } as const;
 

package/src/core/rls/canonicalize.ts

@@ -2,6 +2,23 @@ import { createHash } from 'node:crypto';
 
 export type RlsPolicyOperation = 'select' | 'insert' | 'update' | 'delete' | 'all';
 
+/**
+ * Which predicate each RLS operation admits, mirroring Postgres: SELECT and
+ * DELETE decide row visibility/eligibility with `USING` only; INSERT
+ * validates the new row with `WITH CHECK` only; UPDATE and ALL take either
+ * or both. Single-homed here so the PSL lowering and the TS handle
+ * constructors enforce the same matrix.
+ */
+export const POLICY_OPERATION_PREDICATES: Readonly<
+  Record<RlsPolicyOperation, { readonly using: boolean; readonly withCheck: boolean }>
+> = {
+  select: { using: true, withCheck: false },
+  insert: { using: false, withCheck: true },
+  update: { using: true, withCheck: true },
+  delete: { using: true, withCheck: false },
+  all: { using: true, withCheck: true },
+};
+
 export interface ContentHashParts {
   readonly using?: string;
   readonly withCheck?: string;

package/src/exports/rls-canonicalize.ts

@@ -2,6 +2,11 @@ export {
   type ContentHashParts,
   computeContentHash,
   normalizePredicate,
+  POLICY_OPERATION_PREDICATES,
   type RlsPolicyOperation,
 } from '../core/rls/canonicalize';
-export { parseRlsPolicyWireName, type RlsPolicyWireName } from '../core/rls/wire-name';
+export {
+  formatRlsPolicyWireName,
+  parseRlsPolicyWireName,
+  type RlsPolicyWireName,
+} from '../core/rls/wire-name';

package/dist/authoring-Bi9aa8zG.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"authoring-Bi9aa8zG.mjs","names":[],"sources":["../src/core/authoring.ts"],"sourcesContent":["import { temporalAuthoringPresets } from '@prisma-next/family-sql/control';\nimport type {\n  AuthoringEntityContext,\n  AuthoringEntityTypeFactoryOutput,\n  AuthoringEntityTypeNamespace,\n  AuthoringFieldNamespace,\n  AuthoringModelAttributeContext,\n  AuthoringModelAttributeDescriptorNamespace,\n  AuthoringPslBlockDescriptorNamespace,\n  AuthoringTypeNamespace,\n  PslExtensionBlock,\n} from '@prisma-next/framework-components/authoring';\nimport { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';\nimport { modelAttribute } from '@prisma-next/psl-parser';\nimport type { SqlValueSetDerivingEntityTypeOutput } from '@prisma-next/sql-contract/value-set-derivation-hook';\nimport { ifDefined } from '@prisma-next/utils/defined';\nimport { PG_ENUM_CODEC_ID } from './codec-ids';\nimport { PostgresNativeEnum } from './postgres-native-enum';\nimport { PostgresRlsEnablement, type PostgresRlsEnablementInput } from './postgres-rls-enablement';\nimport { PostgresRlsPolicy, type RlsPolicyOperation } from './postgres-rls-policy';\nimport { PostgresRole } from './postgres-role';\nimport {\n  PostgresNativeEnumSchema,\n  PostgresRlsEnablementSchema,\n  PostgresRlsPolicySchema,\n  PostgresRoleSchema,\n} from './postgres-validators';\nimport { computeContentHash, normalizePredicate } from './rls/canonicalize';\nimport { formatRlsPolicyWireName } from './rls/wire-name';\n\n/**\n * `pg.enum(<ref>)` registers as an ordinary type constructor whose sole\n * positional argument names a `native_enum` entity instead of carrying a\n * literal value. The interpreter resolves the ref to the `native_enum`\n * entity generically (driven by `entityRefArg`); the `pg/enum@1` codec\n * descriptor's `columnFromEntity` hook (see `codecs.ts`) converts that\n * entity into the column's `typeParams` and native type.\n */\nexport const postgresAuthoringTypes = {\n  pg: {\n    enum: {\n      kind: 'typeConstructor',\n      entityRefArg: { index: 0, entityKind: 'native_enum' },\n      output: {\n        codecId: PG_ENUM_CODEC_ID,\n      },\n    },\n  },\n} as const satisfies AuthoringTypeNamespace;\n\nexport interface RlsPolicyExtensionBlock extends PslExtensionBlock {\n  readonly namespaceId: string;\n}\n\n/** A parsed `role` block annotated with its lexical namespace id by the interpreter. */\nexport interface RoleExtensionBlock extends PslExtensionBlock {\n  readonly namespaceId: string;\n}\n\n/**\n * Maps a `policy_<op>` keyword to the RLS operation it authors. The keyword\n * IS the operation (per the project's rejection of a `policy { operation = … }`\n * conditional block).\n */\nconst POLICY_KEYWORD_OPERATION: Readonly<Record<string, RlsPolicyOperation>> = {\n  policy_select: 'select',\n  policy_insert: 'insert',\n  policy_update: 'update',\n  policy_delete: 'delete',\n  policy_all: 'all',\n};\n\n/**\n * Which predicate each RLS operation admits, mirroring Postgres: SELECT and\n * DELETE decide row visibility/eligibility with `USING` only; INSERT validates\n * the new row with `WITH CHECK` only; UPDATE and ALL take both. A predicate\n * outside this set is a load-time error (see {@link lowerRlsPolicyFromBlock}).\n */\nconst POLICY_OPERATION_PREDICATES: Readonly<\n  Record<RlsPolicyOperation, { readonly using: boolean; readonly withCheck: boolean }>\n> = {\n  select: { using: true, withCheck: false },\n  insert: { using: false, withCheck: true },\n  update: { using: true, withCheck: true },\n  delete: { using: true, withCheck: false },\n  all: { using: true, withCheck: true },\n};\n\nfunction readRefParam(block: PslExtensionBlock, key: string): string | undefined {\n  const param = block.parameters[key];\n  return param?.kind === 'ref' ? param.identifier : undefined;\n}\n\nfunction readValueParam(block: PslExtensionBlock, key: string): string | undefined {\n  const param = block.parameters[key];\n  return param?.kind === 'value' ? param.raw : undefined;\n}\n\nfunction readListRefParams(block: PslExtensionBlock, key: string): string[] {\n  const param = block.parameters[key];\n  if (param?.kind !== 'list') return [];\n  return param.items.flatMap((item) => (item.kind === 'ref' ? [item.identifier] : []));\n}\n\n/**\n * Unwraps a quoted PSL string argument, inverting the printer's\n * `escapePslString` escapes (`\\\\`, `\\\"`, `\\n`, `\\r`). An unknown escape\n * sequence is kept verbatim, matching the printer-side `unescapePslString`\n * convention.\n */\nfunction unwrapQuotedString(raw: string): string {\n  if (!(raw.startsWith('\"') && raw.endsWith('\"') && raw.length >= 2)) {\n    return raw;\n  }\n  const inner = raw.slice(1, -1);\n  let result = '';\n  for (let i = 0; i < inner.length; i++) {\n    if (inner[i] !== '\\\\' || i + 1 >= inner.length) {\n      result += inner[i];\n      continue;\n    }\n    const next = inner[i + 1];\n    if (next === '\\\\' || next === '\"') {\n      result += next;\n    } else if (next === 'n') {\n      result += '\\n';\n    } else if (next === 'r') {\n      result += '\\r';\n    } else {\n      result += '\\\\';\n      result += next;\n    }\n    i++;\n  }\n  return result;\n}\n\nfunction lowerRlsPolicyFromBlock(\n  block: RlsPolicyExtensionBlock,\n  ctx: AuthoringEntityContext,\n): PostgresRlsPolicy | undefined {\n  const prefix = block.name;\n  const operation = POLICY_KEYWORD_OPERATION[block.keyword] ?? 'select';\n  const targetModelName = readRefParam(block, 'target') ?? '';\n  const tableName = targetModelName.charAt(0).toLowerCase() + targetModelName.slice(1);\n  const roles = [...readListRefParams(block, 'roles')].sort();\n\n  const usingRaw = readValueParam(block, 'using');\n  const withCheckRaw = readValueParam(block, 'withCheck');\n\n  // Reject a predicate the operation does not take (e.g. `using` on INSERT, or\n  // `withCheck` on SELECT/DELETE). The descriptor's param set already omits it,\n  // but the generic descriptor validator is not wired into the SQL-family\n  // interpreter, so the lowering enforces the per-operation predicate matrix\n  // directly — a wrong predicate is a load-time diagnostic, not a silent drop.\n  const support = POLICY_OPERATION_PREDICATES[operation];\n  const rejectPredicate = (predicate: 'using' | 'withCheck'): undefined => {\n    ctx.diagnostics?.push({\n      code: 'PSL_RLS_PREDICATE_NOT_FOR_OPERATION',\n      message: `\\`${block.keyword}\\` policy \"${block.name}\" does not take a \\`${predicate}\\` predicate; the ${operation.toUpperCase()} operation uses ${support.using ? '`using`' : '`withCheck`'}${support.using && support.withCheck ? ' and `withCheck`' : ' only'}.`,\n      sourceId: ctx.sourceId ?? 'unknown',\n      span: block.parameters[predicate]?.span ?? block.span,\n    });\n    return undefined;\n  };\n  if (usingRaw !== undefined && !support.using) return rejectPredicate('using');\n  if (withCheckRaw !== undefined && !support.withCheck) return rejectPredicate('withCheck');\n\n  const using = usingRaw !== undefined ? unwrapQuotedString(usingRaw) : undefined;\n  const withCheck = withCheckRaw !== undefined ? unwrapQuotedString(withCheckRaw) : undefined;\n\n  const wireHash = computeContentHash({\n    ...ifDefined('using', using !== undefined ? normalizePredicate(using) : undefined),\n    ...ifDefined('withCheck', withCheck !== undefined ? normalizePredicate(withCheck) : undefined),\n    roles,\n    operation,\n    permissive: true,\n  });\n  const wireName = formatRlsPolicyWireName(prefix, wireHash);\n\n  return new PostgresRlsPolicy({\n    name: wireName,\n    prefix,\n    tableName,\n    namespaceId: block.namespaceId,\n    operation,\n    roles,\n    ...ifDefined('using', using),\n    ...ifDefined('withCheck', withCheck),\n    permissive: true,\n  });\n}\n\n/**\n * Lowers a `native_enum { memberName = \"value\" … @@map(\"type_name\") }` block\n * into a {@link PostgresNativeEnum}. Members must be authored as explicit\n * `key = \"value\"` pairs — a bare (value-less) member is a diagnostic, not\n * accepted (authoring-design.md §2.1). The parsed `memberName` is only used\n * to duplicate-check and report diagnostics; the lowered entity carries just\n * the member values (a native enum is value-only — the member \"name\" isn't\n * a separate authoring concept from the value). `typeName` comes from\n * `@@map` or defaults to the block name verbatim.\n */\nfunction lowerNativeEnumFromBlock(\n  block: PslExtensionBlock,\n  ctx: AuthoringEntityContext,\n): PostgresNativeEnum | undefined {\n  const sourceId = ctx.sourceId ?? 'unknown';\n  const diagnostics = ctx.diagnostics;\n\n  const mapAttr = block.blockAttributes.find((a) => a.name === 'map');\n  let typeName = block.name;\n  if (mapAttr) {\n    const rawArg = mapAttr.args[0]?.value;\n    const mapped = rawArg !== undefined ? unwrapQuotedString(rawArg) : undefined;\n    if (mapped === undefined) {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_INVALID_MAP',\n        message: `native_enum \"${block.name}\" @@map attribute must have a quoted type-name argument`,\n        sourceId,\n        span: mapAttr.span,\n      });\n      return undefined;\n    }\n    typeName = mapped;\n  }\n\n  let memberError = false;\n  const seenValues = new Set<string>();\n  const members: string[] = [];\n  for (const [memberName, paramValue] of Object.entries(block.parameters)) {\n    if (paramValue.kind === 'bare') {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_BARE_MEMBER',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" has no value; members must be authored as \"${memberName} = \\\\\"value\\\\\"\"`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (paramValue.kind !== 'value') continue;\n\n    let jsonValue: unknown;\n    try {\n      jsonValue = JSON.parse(paramValue.raw);\n    } catch {\n      diagnostics?.push({\n        code: 'PSL_EXTENSION_INVALID_VALUE',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" value \"${paramValue.raw}\" is not valid JSON`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (typeof jsonValue !== 'string') {\n      diagnostics?.push({\n        code: 'PSL_EXTENSION_INVALID_VALUE',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" value must be a string`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (seenValues.has(jsonValue)) {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_DUPLICATE_MEMBER_VALUE',\n        message: `native_enum \"${block.name}\": duplicate member value \"${jsonValue}\"`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    seenValues.add(jsonValue);\n    members.push(jsonValue);\n  }\n\n  if (memberError) return undefined;\n\n  if (members.length === 0) {\n    diagnostics?.push({\n      code: 'PSL_NATIVE_ENUM_MISSING_MEMBERS',\n      message: `native_enum \"${block.name}\" must have at least one member`,\n      sourceId,\n      span: block.span,\n    });\n    return undefined;\n  }\n\n  // `control` stays unset — the effective grade is resolved at read time via `effectiveControlPolicy`, like `StorageTable`/`StorageColumn`.\n  return new PostgresNativeEnum({ typeName, members });\n}\n\n/**\n * `native_enum`'s entity-type factory output, checked separately from the assembled\n * `postgresAuthoringEntityTypes` map below: `deriveValueSet` is SQL-family surface\n * ({@link SqlValueSetDerivingEntityTypeOutput}), not part of the framework\n * `AuthoringEntityTypeFactoryOutput` shape, so folding it directly into the map's single\n * `satisfies AuthoringEntityTypeNamespace` check would trip an excess-property error. Checking it\n * here against the intersection of both shapes keeps it structurally valid against each without\n * widening the map's own check.\n */\nconst nativeEnumEntityTypeOutput = {\n  factory: lowerNativeEnumFromBlock,\n  deriveValueSet: (entity: PostgresNativeEnum) => ({\n    kind: 'valueSet' as const,\n    values: [...entity.members],\n  }),\n} satisfies AuthoringEntityTypeFactoryOutput<PslExtensionBlock, PostgresNativeEnum | undefined> &\n  SqlValueSetDerivingEntityTypeOutput;\n\n/**\n * Lowers a `role <name> {}` block into a {@link PostgresRole}. Roles are\n * cluster-scoped in Postgres, so the block must be declared inside\n * `namespace unbound { … }` — any other lexical namespace (a named schema,\n * or the default bucket top-level declarations resolve to) is a load-time\n * diagnostic. The lowered entity carries the unbound coordinate.\n */\nfunction lowerRoleFromBlock(\n  block: RoleExtensionBlock,\n  ctx: AuthoringEntityContext,\n): PostgresRole | undefined {\n  if (block.namespaceId !== UNBOUND_NAMESPACE_ID) {\n    ctx.diagnostics?.push({\n      code: 'PSL_ROLE_BLOCK_OUTSIDE_UNBOUND_NAMESPACE',\n      message: `\\`role\\` block \"${block.name}\" must be declared inside \\`namespace unbound { }\\`, not in namespace \"${block.namespaceId}\"`,\n      sourceId: ctx.sourceId ?? 'unknown',\n      span: block.span,\n    });\n    return undefined;\n  }\n  return new PostgresRole({ name: block.name, namespaceId: UNBOUND_NAMESPACE_ID });\n}\n\nexport const postgresAuthoringEntityTypes = {\n  role: {\n    kind: 'entity',\n    discriminator: 'role',\n    validatorSchema: PostgresRoleSchema,\n    output: {\n      factory: lowerRoleFromBlock,\n    },\n  },\n  rls: {\n    kind: 'entity',\n    discriminator: 'rls',\n    validatorSchema: PostgresRlsEnablementSchema,\n    output: {\n      factory: (input: PostgresRlsEnablementInput): PostgresRlsEnablement =>\n        new PostgresRlsEnablement(input),\n    },\n  },\n  policy: {\n    kind: 'entity',\n    discriminator: 'policy',\n    validatorSchema: PostgresRlsPolicySchema,\n    output: {\n      factory: lowerRlsPolicyFromBlock,\n    },\n  },\n  native_enum: {\n    kind: 'entity',\n    discriminator: 'native_enum',\n    validatorSchema: PostgresNativeEnumSchema,\n    output: nativeEnumEntityTypeOutput,\n  },\n} as const satisfies AuthoringEntityTypeNamespace;\n\n/**\n * Field presets contributed by the Postgres target pack.\n *\n * These mirror the PSL scalar-to-codec mapping used by the Postgres adapter\n * (see `createPostgresPslScalarTypeDescriptors`), so that authoring a field\n * via the TS callback surface (e.g. `field.int()`) and via the PSL scalar\n * surface (e.g. `Int`) lowers to byte-identical contracts.\n *\n * The `uuidNative` / `id.uuidv4Native` / `id.uuidv7Native` presets use the\n * native Postgres `uuid` type (codecId `pg/uuid@1`). For cross-target\n * portability use `uuidString` / `id.uuidv4String` / `id.uuidv7String` from\n * the family pack instead.\n */\n/**\n * Shared parameter descriptors for the five `policy_<op>` PSL block\n * keywords. All five share the `policy` discriminator — the parser\n * dispatches by keyword (see the framework's PSL-block SPI), and every\n * keyword's factory lowers to `PostgresRlsPolicy` via `lowerRlsPolicyFromBlock`.\n *\n * The `roles` list uses `scope:'cross-space'` because same-namespace\n * role ref resolution requires PSL namespace entries keyed by `refKind`\n * (i.e. `'role'`), which in turn requires the role block discriminator to\n * equal `'role'`. Aligning discriminator with refKind is tracked for\n * slice 4 (cross-space roles). Until then cross-space passes validation\n * unconditionally and the authored role names flow through unchanged.\n */\nconst policyTargetParam = {\n  kind: 'ref',\n  refKind: 'model',\n  scope: 'same-namespace',\n  required: true,\n} as const;\nconst policyRolesParam = {\n  kind: 'list',\n  of: { kind: 'ref', refKind: 'role', scope: 'cross-space' },\n} as const;\nconst policyPredicateParam = { kind: 'value', codecId: 'pg/text@1', required: true } as const;\n// A policy may only target an RLS-controlled model: the model named by\n// `target` must declare `@@rls`, or the load fails with a diagnostic naming\n// the model and the policy prefix.\nconst policyRequiresRls = { parameter: 'target', attribute: 'rls' } as const;\n\nexport const postgresAuthoringPslBlockDescriptors = {\n  // The predicate param set per keyword mirrors Postgres: SELECT/DELETE take\n  // USING only; INSERT takes WITH CHECK only; UPDATE/ALL take both. The\n  // per-operation predicate matrix is enforced in `lowerRlsPolicyFromBlock`\n  // (a wrong predicate for the operation is a load-time diagnostic there),\n  // since the generic descriptor validator is not wired into the SQL-family\n  // interpreter.\n  policy_select: {\n    kind: 'pslBlock',\n    keyword: 'policy_select',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: { target: policyTargetParam, roles: policyRolesParam, using: policyPredicateParam },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_delete: {\n    kind: 'pslBlock',\n    keyword: 'policy_delete',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: { target: policyTargetParam, roles: policyRolesParam, using: policyPredicateParam },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_insert: {\n    kind: 'pslBlock',\n    keyword: 'policy_insert',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_update: {\n    kind: 'pslBlock',\n    keyword: 'policy_update',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      using: policyPredicateParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_all: {\n    kind: 'pslBlock',\n    keyword: 'policy_all',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      using: policyPredicateParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  /**\n   * PSL block descriptor for `native_enum`.\n   *\n   * Reuses the existing variadic-block mechanism (the same shape the SQL\n   * family's `enum` block ships): the body is an open `memberName = \"value\"`\n   * list. `variadicParameters: true` opens the block to arbitrary keys\n   * beyond the declared (empty) `parameters` set — the lowering factory\n   * (`lowerNativeEnumFromBlock`) turns the variadic entries into ordered\n   * members and rejects a bare (value-less) member.\n   */\n  native_enum: {\n    kind: 'pslBlock',\n    keyword: 'native_enum',\n    discriminator: 'native_enum',\n    name: { required: true },\n    parameters: {},\n    variadicParameters: true,\n  },\n  /**\n   * PSL block descriptor for `role` (e.g. `role anon {}`). Name-only, no\n   * parameters and no body content. Declared inside `namespace unbound { }`\n   * — see {@link lowerRoleFromBlock} for the placement check and the\n   * coordinate the lowered entity carries.\n   */\n  role: {\n    kind: 'pslBlock',\n    keyword: 'role',\n    discriminator: 'role',\n    name: { required: true },\n    parameters: {},\n  },\n} as const satisfies AuthoringPslBlockDescriptorNamespace;\n\n/**\n * `@@` model attributes contributed by the Postgres target pack.\n *\n * `@@rls` is argument-less: presence marks the model's table\n * RLS-controlled. It lowers to a {@link PostgresRlsEnablement} marker in\n * the namespace's `entries.rls`, keyed by the model's table name — the\n * marker (never the policy set) is what drives\n * `ENABLE`/`DISABLE ROW LEVEL SECURITY` planning.\n */\nexport const postgresAuthoringModelAttributes = {\n  rls: {\n    kind: 'modelAttribute',\n    attribute: 'rls',\n    spec: modelAttribute('rls', {}),\n    lower: (_parsed: Record<never, never>, ctx: AuthoringModelAttributeContext) => ({\n      key: ctx.storageName,\n      entity: new PostgresRlsEnablement({\n        tableName: ctx.storageName,\n        namespaceId: ctx.namespaceId,\n      }),\n    }),\n  },\n} as const satisfies AuthoringModelAttributeDescriptorNamespace;\n\nexport const postgresAuthoringFieldPresets = {\n  text: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/text@1',\n      nativeType: 'text',\n    },\n  },\n  int: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/int4@1',\n      nativeType: 'int4',\n    },\n  },\n  bigint: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/int8@1',\n      nativeType: 'int8',\n    },\n  },\n  float: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/float8@1',\n      nativeType: 'float8',\n    },\n  },\n  decimal: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/numeric@1',\n      nativeType: 'numeric',\n    },\n  },\n  boolean: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/bool@1',\n      nativeType: 'bool',\n    },\n  },\n  json: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/jsonb@1',\n      nativeType: 'jsonb',\n    },\n  },\n  bytes: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/bytea@1',\n      nativeType: 'bytea',\n    },\n  },\n  dateTime: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/timestamptz@1',\n      nativeType: 'timestamptz',\n    },\n  },\n  temporal: /* @__PURE__ */ temporalAuthoringPresets({\n    codecId: 'pg/timestamptz@1',\n    nativeType: 'timestamptz',\n  }),\n  uuidNative: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/uuid@1',\n      nativeType: 'uuid',\n    },\n  },\n  id: {\n    uuidv4Native: {\n      kind: 'fieldPreset',\n      output: {\n        codecId: 'pg/uuid@1',\n        nativeType: 'uuid',\n        executionDefaults: {\n          onCreate: {\n            kind: 'generator',\n            id: 'uuidv4',\n          },\n        },\n        id: true,\n      },\n    },\n    uuidv7Native: {\n      kind: 'fieldPreset',\n      output: {\n        codecId: 'pg/uuid@1',\n        nativeType: 'uuid',\n        executionDefaults: {\n          onCreate: {\n            kind: 'generator',\n            id: 'uuidv7',\n          },\n        },\n        id: true,\n      },\n    },\n  },\n} as const satisfies AuthoringFieldNamespace;\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,MAAa,yBAAyB,EACpC,IAAI,EACF,MAAM;CACJ,MAAM;CACN,cAAc;EAAE,OAAO;EAAG,YAAY;CAAc;CACpD,QAAQ,EACN,SAAS,iBACX;AACF,EACF,EACF;;;;;;AAgBA,MAAM,2BAAyE;CAC7E,eAAe;CACf,eAAe;CACf,eAAe;CACf,eAAe;CACf,YAAY;AACd;;;;;;;AAQA,MAAM,8BAEF;CACF,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAM;CACxC,QAAQ;EAAE,OAAO;EAAO,WAAW;CAAK;CACxC,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAK;CACvC,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAM;CACxC,KAAK;EAAE,OAAO;EAAM,WAAW;CAAK;AACtC;AAEA,SAAS,aAAa,OAA0B,KAAiC;CAC/E,MAAM,QAAQ,MAAM,WAAW;CAC/B,OAAO,OAAO,SAAS,QAAQ,MAAM,aAAa,KAAA;AACpD;AAEA,SAAS,eAAe,OAA0B,KAAiC;CACjF,MAAM,QAAQ,MAAM,WAAW;CAC/B,OAAO,OAAO,SAAS,UAAU,MAAM,MAAM,KAAA;AAC/C;AAEA,SAAS,kBAAkB,OAA0B,KAAuB;CAC1E,MAAM,QAAQ,MAAM,WAAW;CAC/B,IAAI,OAAO,SAAS,QAAQ,OAAO,CAAC;CACpC,OAAO,MAAM,MAAM,SAAS,SAAU,KAAK,SAAS,QAAQ,CAAC,KAAK,UAAU,IAAI,CAAC,CAAE;AACrF;;;;;;;AAQA,SAAS,mBAAmB,KAAqB;CAC/C,IAAI,EAAE,IAAI,WAAW,IAAG,KAAK,IAAI,SAAS,IAAG,KAAK,IAAI,UAAU,IAC9D,OAAO;CAET,MAAM,QAAQ,IAAI,MAAM,GAAG,EAAE;CAC7B,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,IAAI,MAAM,OAAO,QAAQ,IAAI,KAAK,MAAM,QAAQ;GAC9C,UAAU,MAAM;GAChB;EACF;EACA,MAAM,OAAO,MAAM,IAAI;EACvB,IAAI,SAAS,QAAQ,SAAS,MAC5B,UAAU;OACL,IAAI,SAAS,KAClB,UAAU;OACL,IAAI,SAAS,KAClB,UAAU;OACL;GACL,UAAU;GACV,UAAU;EACZ;EACA;CACF;CACA,OAAO;AACT;AAEA,SAAS,wBACP,OACA,KAC+B;CAC/B,MAAM,SAAS,MAAM;CACrB,MAAM,YAAY,yBAAyB,MAAM,YAAY;CAC7D,MAAM,kBAAkB,aAAa,OAAO,QAAQ,KAAK;CACzD,MAAM,YAAY,gBAAgB,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,gBAAgB,MAAM,CAAC;CACnF,MAAM,QAAQ,CAAC,GAAG,kBAAkB,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK;CAE1D,MAAM,WAAW,eAAe,OAAO,OAAO;CAC9C,MAAM,eAAe,eAAe,OAAO,WAAW;CAOtD,MAAM,UAAU,4BAA4B;CAC5C,MAAM,mBAAmB,cAAgD;EACvE,IAAI,aAAa,KAAK;GACpB,MAAM;GACN,SAAS,KAAK,MAAM,QAAQ,aAAa,MAAM,KAAK,sBAAsB,UAAU,oBAAoB,UAAU,YAAY,EAAE,kBAAkB,QAAQ,QAAQ,YAAY,gBAAgB,QAAQ,SAAS,QAAQ,YAAY,qBAAqB,QAAQ;GAChQ,UAAU,IAAI,YAAY;GAC1B,MAAM,MAAM,WAAW,UAAU,EAAE,QAAQ,MAAM;EACnD,CAAC;CAEH;CACA,IAAI,aAAa,KAAA,KAAa,CAAC,QAAQ,OAAO,OAAO,gBAAgB,OAAO;CAC5E,IAAI,iBAAiB,KAAA,KAAa,CAAC,QAAQ,WAAW,OAAO,gBAAgB,WAAW;CAExF,MAAM,QAAQ,aAAa,KAAA,IAAY,mBAAmB,QAAQ,IAAI,KAAA;CACtE,MAAM,YAAY,iBAAiB,KAAA,IAAY,mBAAmB,YAAY,IAAI,KAAA;CAWlF,OAAO,IAAI,kBAAkB;EAC3B,MAHe,wBAAwB,QAPxB,mBAAmB;GAClC,GAAG,UAAU,SAAS,UAAU,KAAA,IAAY,mBAAmB,KAAK,IAAI,KAAA,CAAS;GACjF,GAAG,UAAU,aAAa,cAAc,KAAA,IAAY,mBAAmB,SAAS,IAAI,KAAA,CAAS;GAC7F;GACA;GACA,YAAY;EACd,CACwD,CAGzC;EACb;EACA;EACA,aAAa,MAAM;EACnB;EACA;EACA,GAAG,UAAU,SAAS,KAAK;EAC3B,GAAG,UAAU,aAAa,SAAS;EACnC,YAAY;CACd,CAAC;AACH;;;;;;;;;;;AAYA,SAAS,yBACP,OACA,KACgC;CAChC,MAAM,WAAW,IAAI,YAAY;CACjC,MAAM,cAAc,IAAI;CAExB,MAAM,UAAU,MAAM,gBAAgB,MAAM,MAAM,EAAE,SAAS,KAAK;CAClE,IAAI,WAAW,MAAM;CACrB,IAAI,SAAS;EACX,MAAM,SAAS,QAAQ,KAAK,EAAE,EAAE;EAChC,MAAM,SAAS,WAAW,KAAA,IAAY,mBAAmB,MAAM,IAAI,KAAA;EACnE,IAAI,WAAW,KAAA,GAAW;GACxB,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK;IACpC;IACA,MAAM,QAAQ;GAChB,CAAC;GACD;EACF;EACA,WAAW;CACb;CAEA,IAAI,cAAc;CAClB,MAAM,6BAAa,IAAI,IAAY;CACnC,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,CAAC,YAAY,eAAe,OAAO,QAAQ,MAAM,UAAU,GAAG;EACvE,IAAI,WAAW,SAAS,QAAQ;GAC9B,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW,+CAA+C,WAAW;IACrH;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,WAAW,SAAS,SAAS;EAEjC,IAAI;EACJ,IAAI;GACF,YAAY,KAAK,MAAM,WAAW,GAAG;EACvC,QAAQ;GACN,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW,WAAW,WAAW,IAAI;IACrF;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,OAAO,cAAc,UAAU;GACjC,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW;IAC3D;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,WAAW,IAAI,SAAS,GAAG;GAC7B,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,6BAA6B,UAAU;IAC3E;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,WAAW,IAAI,SAAS;EACxB,QAAQ,KAAK,SAAS;CACxB;CAEA,IAAI,aAAa,OAAO,KAAA;CAExB,IAAI,QAAQ,WAAW,GAAG;EACxB,aAAa,KAAK;GAChB,MAAM;GACN,SAAS,gBAAgB,MAAM,KAAK;GACpC;GACA,MAAM,MAAM;EACd,CAAC;EACD;CACF;CAGA,OAAO,IAAI,mBAAmB;EAAE;EAAU;CAAQ,CAAC;AACrD;;;;;;;;;;AAWA,MAAM,6BAA6B;CACjC,SAAS;CACT,iBAAiB,YAAgC;EAC/C,MAAM;EACN,QAAQ,CAAC,GAAG,OAAO,OAAO;CAC5B;AACF;;;;;;;;AAUA,SAAS,mBACP,OACA,KAC0B;CAC1B,IAAI,MAAM,gBAAgB,sBAAsB;EAC9C,IAAI,aAAa,KAAK;GACpB,MAAM;GACN,SAAS,mBAAmB,MAAM,KAAK,yEAAyE,MAAM,YAAY;GAClI,UAAU,IAAI,YAAY;GAC1B,MAAM,MAAM;EACd,CAAC;EACD;CACF;CACA,OAAO,IAAI,aAAa;EAAE,MAAM,MAAM;EAAM,aAAa;CAAqB,CAAC;AACjF;AAEA,MAAa,+BAA+B;CAC1C,MAAM;EACJ,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,SAAS,mBACX;CACF;CACA,KAAK;EACH,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,UAAU,UACR,IAAI,sBAAsB,KAAK,EACnC;CACF;CACA,QAAQ;EACN,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,SAAS,wBACX;CACF;CACA,aAAa;EACX,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ;CACV;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,oBAAoB;CACxB,MAAM;CACN,SAAS;CACT,OAAO;CACP,UAAU;AACZ;AACA,MAAM,mBAAmB;CACvB,MAAM;CACN,IAAI;EAAE,MAAM;EAAO,SAAS;EAAQ,OAAO;CAAc;AAC3D;AACA,MAAM,uBAAuB;CAAE,MAAM;CAAS,SAAS;CAAa,UAAU;AAAK;AAInF,MAAM,oBAAoB;CAAE,WAAW;CAAU,WAAW;AAAM;AAElE,MAAa,uCAAuC;CAOlD,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GAAE,QAAQ;GAAmB,OAAO;GAAkB,OAAO;EAAqB;EAC9F,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GAAE,QAAQ;GAAmB,OAAO;GAAkB,OAAO;EAAqB;EAC9F,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;CACA,YAAY;EACV,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;;;;;;;;;;;CAWA,aAAa;EACX,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY,CAAC;EACb,oBAAoB;CACtB;;;;;;;CAOA,MAAM;EACJ,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY,CAAC;CACf;AACF;;;;;;;;;;AAWA,MAAa,mCAAmC,EAC9C,KAAK;CACH,MAAM;CACN,WAAW;CACX,MAAM,eAAe,OAAO,CAAC,CAAC;CAC9B,QAAQ,SAA+B,SAAyC;EAC9E,KAAK,IAAI;EACT,QAAQ,IAAI,sBAAsB;GAChC,WAAW,IAAI;GACf,aAAa,IAAI;EACnB,CAAC;CACH;AACF,EACF;AAEA,MAAa,gCAAgC;CAC3C,MAAM;EACJ,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,KAAK;EACH,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,QAAQ;EACN,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,OAAO;EACL,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,SAAS;EACP,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,SAAS;EACP,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,MAAM;EACJ,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,OAAO;EACL,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,UAAU;EACR,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,UAA0B,yCAAyB;EACjD,SAAS;EACT,YAAY;CACd,CAAC;CACD,YAAY;EACV,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,IAAI;EACF,cAAc;GACZ,MAAM;GACN,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,mBAAmB,EACjB,UAAU;KACR,MAAM;KACN,IAAI;IACN,EACF;IACA,IAAI;GACN;EACF;EACA,cAAc;GACZ,MAAM;GACN,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,mBAAmB,EACjB,UAAU;KACR,MAAM;KACN,IAAI;IACN,EACF;IACA,IAAI;GACN;EACF;CACF;AACF"}

package/dist/canonicalize-CAbXtVtB.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonicalize-CAbXtVtB.d.mts","names":[],"sources":["../src/core/rls/canonicalize.ts"],"mappings":";KAEY,kBAAA;AAAA,UAEK,gBAAA;EAAA,SACN,KAAA;EAAA,SACA,SAAA;EAAA,SACA,KAAA;EAAA,SACA,SAAA,EAAW,kBAAkB;EAAA,SAC7B,UAAA;AAAA;;;;;;;;;;AAAU;AAiBrB;;;;iBAAgB,kBAAA,CAAmB,GAAW;AAa9C;;;;AAA0D;;;;;AAA1D,iBAAgB,kBAAA,CAAmB,KAAuB,EAAhB,gBAAgB"}

package/dist/descriptor-meta-DzL6vXAz.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"descriptor-meta-DzL6vXAz.mjs","names":[],"sources":["../src/core/descriptor-meta.ts"],"sourcesContent":["import type { CodecTypes } from '../exports/codec-types';\nimport {\n  postgresAuthoringEntityTypes,\n  postgresAuthoringFieldPresets,\n  postgresAuthoringModelAttributes,\n  postgresAuthoringPslBlockDescriptors,\n  postgresAuthoringTypes,\n} from './authoring';\nimport { postgresQualifyColumnType } from './codecs';\nimport { postgresTargetDescriptorMetaRuntime } from './descriptor-meta-runtime';\nimport { DEFAULT_NAMESPACE_ID } from './namespace-ids';\nimport { postgresCreateNamespace } from './postgres-schema';\n\nconst postgresTargetDescriptorMetaBase = {\n  ...postgresTargetDescriptorMetaRuntime,\n  defaultNamespaceId: DEFAULT_NAMESPACE_ID,\n  authoring: {\n    type: postgresAuthoringTypes,\n    field: postgresAuthoringFieldPresets,\n    entityTypes: postgresAuthoringEntityTypes,\n    pslBlockDescriptors: postgresAuthoringPslBlockDescriptors,\n    modelAttributes: postgresAuthoringModelAttributes,\n    createNamespace: postgresCreateNamespace,\n    qualifyColumnType: postgresQualifyColumnType,\n  },\n} as const;\n\nexport const postgresTargetDescriptorMeta: typeof postgresTargetDescriptorMetaBase & {\n  readonly __codecTypes?: CodecTypes;\n} = postgresTargetDescriptorMetaBase;\n"],"mappings":";;;;;AA2BA,MAAa,+BAET;CAfF,GAAG;CACH,oBAAoB;CACpB,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,qBAAqB;EACrB,iBAAiB;EACjB,iBAAiB;EACjB,mBAAmB;CACrB;AAKE"}

package/dist/wire-name-rHHtr1h0.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"wire-name-rHHtr1h0.mjs","names":[],"sources":["../src/core/rls/canonicalize.ts","../src/core/rls/wire-name.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nexport type RlsPolicyOperation = 'select' | 'insert' | 'update' | 'delete' | 'all';\n\nexport interface ContentHashParts {\n  readonly using?: string;\n  readonly withCheck?: string;\n  readonly roles: readonly string[];\n  readonly operation: RlsPolicyOperation;\n  readonly permissive: boolean;\n}\n\n/**\n * Stabilizes an authored predicate for hashing: trim, and collapse runs of\n * internal whitespace to a single space.\n *\n * This is deliberately minimal. The content hash is the equivalence relation\n * for a policy, and the wire name (prefix + hash) is the only thing ever\n * compared — we never recompute the hash from an introspected policy body, so\n * there is no need to match Postgres's reprinted form. Minimal normalization\n * also protects the no-collision property: aggressive rewriting (lowercasing,\n * paren-stripping, cast-alias folding) risks collapsing two distinct predicates\n * onto one hash. Out-of-band alteration of a hashed policy is unsupported.\n *\n * The normalizer is a stability commitment: any change re-suffixes all wire names.\n */\nexport function normalizePredicate(sql: string): string {\n  return sql.replace(/\\s+/g, ' ').trim();\n}\n\n/**\n * Returns the first 8 lowercase hex characters of the SHA-256 digest over the\n * canonical content tuple for an RLS policy:\n *\n *   [normalize(using), normalize(withCheck), sortedRoles, operation, permissive]\n *\n * Schema and table are excluded (they are orthogonal to policy equivalence).\n * Uses `JSON.stringify` for a deterministic encoding.\n */\nexport function computeContentHash(parts: ContentHashParts): string {\n  const using = normalizePredicate(parts.using ?? '');\n  const withCheck = normalizePredicate(parts.withCheck ?? '');\n  const roles = [...new Set(parts.roles)].sort();\n  const permissive = parts.permissive ? 'permissive' : 'restrictive';\n\n  const tuple = JSON.stringify([using, withCheck, roles, parts.operation, permissive]);\n  return createHash('sha256').update(tuple).digest('hex').slice(0, 8);\n}\n","export interface RlsPolicyWireName {\n  /** The user-supplied part before the `_<8hex>` suffix. */\n  readonly prefix: string;\n  /** The 8-lowercase-hex content-hash suffix. */\n  readonly hash: string;\n}\n\nconst WIRE_NAME_PATTERN = /^(.+)_([0-9a-f]{8})$/;\n\n/**\n * Assembles an RLS policy wire name from its user-supplied prefix and its\n * 8-hex content-hash suffix. This module owns the `<prefix>_<hash>` format\n * on both sides — construction here and parsing in\n * {@link parseRlsPolicyWireName} — so the two never drift.\n */\nexport function formatRlsPolicyWireName(prefix: string, hash: string): string {\n  return `${prefix}_${hash}`;\n}\n\n/**\n * Splits an RLS policy wire name (`<prefix>_<8hex>`) into its prefix and\n * content-hash suffix. Returns `undefined` when the name does not follow the\n * wire-name shape (e.g. a policy created outside the toolchain) — callers\n * treat such names as all-prefix. Consumed by introspection (prefix\n * extraction) and by rename pairing (same hash, different prefix).\n */\nexport function parseRlsPolicyWireName(name: string): RlsPolicyWireName | undefined {\n  const match = WIRE_NAME_PATTERN.exec(name);\n  const prefix = match?.[1];\n  const hash = match?.[2];\n  if (prefix === undefined || hash === undefined) return undefined;\n  return { prefix, hash };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0BA,SAAgB,mBAAmB,KAAqB;CACtD,OAAO,IAAI,QAAQ,QAAQ,GAAG,CAAC,CAAC,KAAK;AACvC;;;;;;;;;;AAWA,SAAgB,mBAAmB,OAAiC;CAClE,MAAM,QAAQ,mBAAmB,MAAM,SAAS,EAAE;CAClD,MAAM,YAAY,mBAAmB,MAAM,aAAa,EAAE;CAC1D,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CAC7C,MAAM,aAAa,MAAM,aAAa,eAAe;CAErD,MAAM,QAAQ,KAAK,UAAU;EAAC;EAAO;EAAW;EAAO,MAAM;EAAW;CAAU,CAAC;CACnF,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;AACpE;;;ACxCA,MAAM,oBAAoB;;;;;;;AAQ1B,SAAgB,wBAAwB,QAAgB,MAAsB;CAC5E,OAAO,GAAG,OAAO,GAAG;AACtB;;;;;;;;AASA,SAAgB,uBAAuB,MAA6C;CAClF,MAAM,QAAQ,kBAAkB,KAAK,IAAI;CACzC,MAAM,SAAS,QAAQ;CACvB,MAAM,OAAO,QAAQ;CACrB,IAAI,WAAW,KAAA,KAAa,SAAS,KAAA,GAAW,OAAO,KAAA;CACvD,OAAO;EAAE;EAAQ;CAAK;AACxB"}