@prisma-next/target-postgres 0.14.0-dev.80 → 0.14.0-dev.82

package/dist/{authoring-Bi9aa8zG.mjs → authoring-ChmUI_tC.mjs}

@@ -1,11 +1,13 @@
 import { a as PG_ENUM_CODEC_ID } from "./codec-ids-C_-Hj6bL.mjs";
 import { t as PostgresNativeEnum } from "./postgres-native-enum-BwVNf0Ku.mjs";
-import { _ as PostgresRlsEnablement, d as PostgresRlsEnablementSchema, f as PostgresRlsPolicySchema, g as PostgresRlsPolicy, m as PostgresRole, p as PostgresRoleSchema, u as PostgresNativeEnumSchema } from "./postgres-schema-DYATroNx.mjs";
-import { i as normalizePredicate, r as computeContentHash, t as formatRlsPolicyWireName } from "./wire-name-rHHtr1h0.mjs";
+import { _ as PostgresRlsEnablement, d as PostgresRlsEnablementSchema, f as PostgresRlsPolicySchema, g as PostgresRlsPolicy, m as PostgresRole, p as PostgresRoleSchema, u as PostgresNativeEnumSchema } from "./postgres-schema-ChBj22nX.mjs";
+import { a as normalizePredicate, i as computeContentHash, r as POLICY_OPERATION_PREDICATES, t as formatRlsPolicyWireName } from "./wire-name-DbQ9-2RC.mjs";
 import { UNBOUND_NAMESPACE_ID } from "@prisma-next/framework-components/ir";
+import { blindCast } from "@prisma-next/utils/casts";
 import { temporalAuthoringPresets } from "@prisma-next/family-sql/control";
 import { ifDefined } from "@prisma-next/utils/defined";
 import { modelAttribute } from "@prisma-next/psl-parser";
+import { assertDefined } from "@prisma-next/utils/assertions";
 //#region src/core/authoring.ts
 /**
 * `pg.enum(<ref>)` registers as an ordinary type constructor whose sole
@@ -35,38 +37,6 @@ const POLICY_KEYWORD_OPERATION = {
 	policy_delete: "delete",
 	policy_all: "all"
 };
-/**
-* Which predicate each RLS operation admits, mirroring Postgres: SELECT and
-* DELETE decide row visibility/eligibility with `USING` only; INSERT validates
-* the new row with `WITH CHECK` only; UPDATE and ALL take both. A predicate
-* outside this set is a load-time error (see {@link lowerRlsPolicyFromBlock}).
-*/
-const POLICY_OPERATION_PREDICATES = {
-	select: {
-		using: true,
-		withCheck: false
-	},
-	insert: {
-		using: false,
-		withCheck: true
-	},
-	update: {
-		using: true,
-		withCheck: true
-	},
-	delete: {
-		using: true,
-		withCheck: false
-	},
-	all: {
-		using: true,
-		withCheck: true
-	}
-};
-function readRefParam(block, key) {
-	const param = block.parameters[key];
-	return param?.kind === "ref" ? param.identifier : void 0;
-}
 function readValueParam(block, key) {
 	const param = block.parameters[key];
 	return param?.kind === "value" ? param.raw : void 0;
@@ -103,11 +73,38 @@ function unwrapQuotedString(raw) {
 	}
 	return result;
 }
+/**
+* Assembles a {@link PostgresRlsPolicy} from lowered inputs: normalizes the
+* predicates, computes the content-hash wire name, and constructs the frozen
+* entity. The single hash-assembly body shared by the PSL block lowering
+* ({@link lowerRlsPolicyFromBlock}) and the TS entity-handle lowering
+* ({@link postgresLowerEntityHandles}) so the two surfaces cannot drift.
+*/
+function buildRlsPolicyEntity(input) {
+	const wireHash = computeContentHash({
+		...ifDefined("using", input.using !== void 0 ? normalizePredicate(input.using) : void 0),
+		...ifDefined("withCheck", input.withCheck !== void 0 ? normalizePredicate(input.withCheck) : void 0),
+		roles: input.roles,
+		operation: input.operation,
+		permissive: true
+	});
+	return new PostgresRlsPolicy({
+		name: formatRlsPolicyWireName(input.prefix, wireHash),
+		prefix: input.prefix,
+		tableName: input.tableName,
+		namespaceId: input.namespaceId,
+		operation: input.operation,
+		roles: input.roles,
+		...ifDefined("using", input.using),
+		...ifDefined("withCheck", input.withCheck),
+		permissive: true
+	});
+}
 function lowerRlsPolicyFromBlock(block, ctx) {
 	const prefix = block.name;
 	const operation = POLICY_KEYWORD_OPERATION[block.keyword] ?? "select";
-	const targetModelName = readRefParam(block, "target") ?? "";
-	const tableName = targetModelName.charAt(0).toLowerCase() + targetModelName.slice(1);
+	const tableName = block.resolvedModelRefs?.["target"]?.tableName;
+	assertDefined(tableName, `lowerRlsPolicyFromBlock: policy "${block.name}" reached the factory without a resolved \`target\` ref; the interpreter resolves same-namespace model refs before invoking entity factories.`);
 	const roles = [...readListRefParams(block, "roles")].sort();
 	const usingRaw = readValueParam(block, "using");
 	const withCheckRaw = readValueParam(block, "withCheck");
@@ -124,22 +121,14 @@ function lowerRlsPolicyFromBlock(block, ctx) {
 	if (withCheckRaw !== void 0 && !support.withCheck) return rejectPredicate("withCheck");
 	const using = usingRaw !== void 0 ? unwrapQuotedString(usingRaw) : void 0;
 	const withCheck = withCheckRaw !== void 0 ? unwrapQuotedString(withCheckRaw) : void 0;
-	return new PostgresRlsPolicy({
-		name: formatRlsPolicyWireName(prefix, computeContentHash({
-			...ifDefined("using", using !== void 0 ? normalizePredicate(using) : void 0),
-			...ifDefined("withCheck", withCheck !== void 0 ? normalizePredicate(withCheck) : void 0),
-			roles,
-			operation,
-			permissive: true
-		})),
+	return buildRlsPolicyEntity({
 		prefix,
 		tableName,
 		namespaceId: block.namespaceId,
 		operation,
 		roles,
 		...ifDefined("using", using),
-		...ifDefined("withCheck", withCheck),
-		permissive: true
+		...ifDefined("withCheck", withCheck)
 	});
 }
 /**
@@ -568,7 +557,118 @@ const postgresAuthoringFieldPresets = {
 		}
 	}
 };
+/**
+* Postgres identifiers cap at 63 characters and the wire name appends a
+* 9-character `_<8hex>` suffix, so the authored prefix is bounded at 54.
+*/
+const RLS_POLICY_PREFIX_MAX_LENGTH = 54;
+/**
+* Resolves an entity handle's `target` ref to a table coordinate of this
+* contract, or throws the load-time diagnostic naming the handle: a
+* cross-space target is rejected (you cannot CREATE POLICY on a table
+* another space owns) and an unresolved target names the model.
+*/
+function requireLocalTarget(refs, subject) {
+	const target = refs["target"];
+	if (target !== void 0 && target.kind === "resolved") return {
+		namespaceId: target.namespaceId,
+		tableName: target.tableName
+	};
+	if (target !== void 0 && target.kind === "cross-space") throw new Error(`defineContract: ${subject} targets model "${target.modelName ?? target.tableName}", which lives in another contract space. Policies and rlsEnabled entries must target a model declared in this contract.`);
+	throw new Error(`defineContract: ${subject} targets model "${target?.modelName ?? "<anonymous>"}", which is not in the contract's models. Add the model to \`models\`.`);
+}
+/**
+* The SQL-family entity-handle batch lowering hook for the Postgres pack
+* (`SqlEntityHandleLoweringContribution`). Receives every `entities` handle
+* whose kind this pack registered — batch, so the cross-entity diagnostics
+* (duplicate prefix, policy without rlsEnabled, duplicate role) can see
+* sibling handles — and lowers them with the same keying and hash assembly
+* as the PSL path: `policy` keyed by prefix (wire name via
+* {@link buildRlsPolicyEntity}), `rls` keyed by table name, `role` keyed by
+* name and filed under the default namespace (roles are declared
+* contract-wide; PSL has no role block to set a precedent).
+*/
+function postgresLowerEntityHandles(input) {
+	const enablements = /* @__PURE__ */ new Map();
+	const roles = /* @__PURE__ */ new Map();
+	const policies = [];
+	const coordinateKey = (coordinate) => `${coordinate.namespaceId} ${coordinate.tableName}`;
+	for (const { handle, refs } of input.handles) switch (handle.entityKind) {
+		case "rls": {
+			const coordinate = requireLocalTarget(refs, "an rlsEnabled entry");
+			const key = coordinateKey(coordinate);
+			if (!enablements.has(key)) enablements.set(key, {
+				coordinate,
+				entity: new PostgresRlsEnablement({
+					tableName: coordinate.tableName,
+					namespaceId: coordinate.namespaceId
+				})
+			});
+			break;
+		}
+		case "role": {
+			const roleHandle = blindCast(handle);
+			if (roles.has(roleHandle.name)) throw new Error(`defineContract: role "${roleHandle.name}" is declared more than once in the entities list.`);
+			roles.set(roleHandle.name, new PostgresRole({
+				name: roleHandle.name,
+				namespaceId: UNBOUND_NAMESPACE_ID
+			}));
+			break;
+		}
+		case "policy": {
+			const policyHandle = blindCast(handle);
+			policies.push({
+				handle: policyHandle,
+				refs
+			});
+			break;
+		}
+		default: throw new Error(`defineContract: the postgres pack does not lower "${handle.entityKind}" handles from the entities list.`);
+	}
+	const rows = [];
+	const seenPrefixes = /* @__PURE__ */ new Set();
+	for (const { handle: policy, refs } of policies) {
+		const prefix = policy.name;
+		if (prefix.length > RLS_POLICY_PREFIX_MAX_LENGTH) throw new Error(`defineContract: policy prefix "${prefix}" exceeds the ${RLS_POLICY_PREFIX_MAX_LENGTH}-character maximum (Postgres identifiers cap at 63 characters and the wire name appends a 9-character hash suffix).`);
+		const coordinate = requireLocalTarget(refs, `policy "${prefix}"`);
+		if (!enablements.has(coordinateKey(coordinate))) {
+			const target = refs["target"];
+			throw new Error(`defineContract: policy "${prefix}" targets model "${target?.modelName ?? coordinate.tableName}", whose table is not RLS-enabled. Add rlsEnabled(<model>) to the entities list.`);
+		}
+		const prefixKey = `${coordinate.namespaceId} ${prefix}`;
+		if (seenPrefixes.has(prefixKey)) throw new Error(`defineContract: policy prefix "${prefix}" is declared more than once in namespace "${coordinate.namespaceId}". Policy prefixes must be unique per namespace.`);
+		seenPrefixes.add(prefixKey);
+		const roleNames = [...new Set(policy.roles.map((roleHandle) => roleHandle.name))].sort();
+		rows.push({
+			namespaceId: coordinate.namespaceId,
+			entityKind: "policy",
+			key: prefix,
+			entity: buildRlsPolicyEntity({
+				prefix,
+				tableName: coordinate.tableName,
+				namespaceId: coordinate.namespaceId,
+				operation: policy.operation,
+				roles: roleNames,
+				...ifDefined("using", policy.using),
+				...ifDefined("withCheck", policy.withCheck)
+			})
+		});
+	}
+	for (const { coordinate, entity } of enablements.values()) rows.push({
+		namespaceId: coordinate.namespaceId,
+		entityKind: "rls",
+		key: coordinate.tableName,
+		entity
+	});
+	for (const [name, entity] of roles) rows.push({
+		namespaceId: UNBOUND_NAMESPACE_ID,
+		entityKind: "role",
+		key: name,
+		entity
+	});
+	return rows;
+}
 //#endregion
-export { postgresAuthoringTypes as a, postgresAuthoringPslBlockDescriptors as i, postgresAuthoringFieldPresets as n, postgresAuthoringModelAttributes as r, postgresAuthoringEntityTypes as t };
+export { postgresAuthoringTypes as a, postgresAuthoringPslBlockDescriptors as i, postgresAuthoringFieldPresets as n, postgresLowerEntityHandles as o, postgresAuthoringModelAttributes as r, postgresAuthoringEntityTypes as t };
 
-//# sourceMappingURL=authoring-Bi9aa8zG.mjs.map
+//# sourceMappingURL=authoring-ChmUI_tC.mjs.map

package/dist/authoring-ChmUI_tC.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring-ChmUI_tC.mjs","names":[],"sources":["../src/core/authoring.ts"],"sourcesContent":["import { temporalAuthoringPresets } from '@prisma-next/family-sql/control';\nimport type {\n  AuthoringEntityContext,\n  AuthoringEntityTypeFactoryOutput,\n  AuthoringEntityTypeNamespace,\n  AuthoringFieldNamespace,\n  AuthoringModelAttributeContext,\n  AuthoringModelAttributeDescriptorNamespace,\n  AuthoringPslBlockDescriptorNamespace,\n  AuthoringTypeNamespace,\n  PslExtensionBlock,\n} from '@prisma-next/framework-components/authoring';\nimport { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';\nimport { modelAttribute } from '@prisma-next/psl-parser';\nimport type {\n  EntityHandleLoweringInput,\n  LoweredPackEntity,\n  ResolvedEntityHandleRef,\n  ResolvedPslModelRefs,\n} from '@prisma-next/sql-contract/entity-handle-lowering-hook';\nimport type { SqlValueSetDerivingEntityTypeOutput } from '@prisma-next/sql-contract/value-set-derivation-hook';\nimport { assertDefined } from '@prisma-next/utils/assertions';\nimport { blindCast } from '@prisma-next/utils/casts';\nimport { ifDefined } from '@prisma-next/utils/defined';\nimport { PG_ENUM_CODEC_ID } from './codec-ids';\nimport { PostgresNativeEnum } from './postgres-native-enum';\nimport { PostgresRlsEnablement, type PostgresRlsEnablementInput } from './postgres-rls-enablement';\nimport { PostgresRlsPolicy, type RlsPolicyOperation } from './postgres-rls-policy';\nimport { PostgresRole } from './postgres-role';\nimport {\n  PostgresNativeEnumSchema,\n  PostgresRlsEnablementSchema,\n  PostgresRlsPolicySchema,\n  PostgresRoleSchema,\n} from './postgres-validators';\nimport {\n  computeContentHash,\n  normalizePredicate,\n  POLICY_OPERATION_PREDICATES,\n} from './rls/canonicalize';\nimport { formatRlsPolicyWireName } from './rls/wire-name';\n\n/**\n * `pg.enum(<ref>)` registers as an ordinary type constructor whose sole\n * positional argument names a `native_enum` entity instead of carrying a\n * literal value. The interpreter resolves the ref to the `native_enum`\n * entity generically (driven by `entityRefArg`); the `pg/enum@1` codec\n * descriptor's `columnFromEntity` hook (see `codecs.ts`) converts that\n * entity into the column's `typeParams` and native type.\n */\nexport const postgresAuthoringTypes = {\n  pg: {\n    enum: {\n      kind: 'typeConstructor',\n      entityRefArg: { index: 0, entityKind: 'native_enum' },\n      output: {\n        codecId: PG_ENUM_CODEC_ID,\n      },\n    },\n  },\n} as const satisfies AuthoringTypeNamespace;\n\nexport interface RlsPolicyExtensionBlock extends PslExtensionBlock {\n  readonly namespaceId: string;\n  /**\n   * Model refs the family interpreter resolved from the block's descriptor-\n   * declared `refKind: 'model'` parameters before invoking this factory\n   * (keyed by parameter name). An unresolved required ref is the\n   * interpreter's diagnostic; the factory is never called with one missing.\n   */\n  readonly resolvedModelRefs?: ResolvedPslModelRefs;\n}\n\n/** A parsed `role` block annotated with its lexical namespace id by the interpreter. */\nexport interface RoleExtensionBlock extends PslExtensionBlock {\n  readonly namespaceId: string;\n}\n\n/**\n * Maps a `policy_<op>` keyword to the RLS operation it authors. The keyword\n * IS the operation (per the project's rejection of a `policy { operation = … }`\n * conditional block).\n */\nconst POLICY_KEYWORD_OPERATION: Readonly<Record<string, RlsPolicyOperation>> = {\n  policy_select: 'select',\n  policy_insert: 'insert',\n  policy_update: 'update',\n  policy_delete: 'delete',\n  policy_all: 'all',\n};\n\nfunction readValueParam(block: PslExtensionBlock, key: string): string | undefined {\n  const param = block.parameters[key];\n  return param?.kind === 'value' ? param.raw : undefined;\n}\n\nfunction readListRefParams(block: PslExtensionBlock, key: string): string[] {\n  const param = block.parameters[key];\n  if (param?.kind !== 'list') return [];\n  return param.items.flatMap((item) => (item.kind === 'ref' ? [item.identifier] : []));\n}\n\n/**\n * Unwraps a quoted PSL string argument, inverting the printer's\n * `escapePslString` escapes (`\\\\`, `\\\"`, `\\n`, `\\r`). An unknown escape\n * sequence is kept verbatim, matching the printer-side `unescapePslString`\n * convention.\n */\nfunction unwrapQuotedString(raw: string): string {\n  if (!(raw.startsWith('\"') && raw.endsWith('\"') && raw.length >= 2)) {\n    return raw;\n  }\n  const inner = raw.slice(1, -1);\n  let result = '';\n  for (let i = 0; i < inner.length; i++) {\n    if (inner[i] !== '\\\\' || i + 1 >= inner.length) {\n      result += inner[i];\n      continue;\n    }\n    const next = inner[i + 1];\n    if (next === '\\\\' || next === '\"') {\n      result += next;\n    } else if (next === 'n') {\n      result += '\\n';\n    } else if (next === 'r') {\n      result += '\\r';\n    } else {\n      result += '\\\\';\n      result += next;\n    }\n    i++;\n  }\n  return result;\n}\n\n/**\n * Assembles a {@link PostgresRlsPolicy} from lowered inputs: normalizes the\n * predicates, computes the content-hash wire name, and constructs the frozen\n * entity. The single hash-assembly body shared by the PSL block lowering\n * ({@link lowerRlsPolicyFromBlock}) and the TS entity-handle lowering\n * ({@link postgresLowerEntityHandles}) so the two surfaces cannot drift.\n */\nfunction buildRlsPolicyEntity(input: {\n  readonly prefix: string;\n  readonly tableName: string;\n  readonly namespaceId: string;\n  readonly operation: RlsPolicyOperation;\n  readonly roles: readonly string[];\n  readonly using?: string;\n  readonly withCheck?: string;\n}): PostgresRlsPolicy {\n  const wireHash = computeContentHash({\n    ...ifDefined('using', input.using !== undefined ? normalizePredicate(input.using) : undefined),\n    ...ifDefined(\n      'withCheck',\n      input.withCheck !== undefined ? normalizePredicate(input.withCheck) : undefined,\n    ),\n    roles: input.roles,\n    operation: input.operation,\n    permissive: true,\n  });\n\n  return new PostgresRlsPolicy({\n    name: formatRlsPolicyWireName(input.prefix, wireHash),\n    prefix: input.prefix,\n    tableName: input.tableName,\n    namespaceId: input.namespaceId,\n    operation: input.operation,\n    roles: input.roles,\n    ...ifDefined('using', input.using),\n    ...ifDefined('withCheck', input.withCheck),\n    permissive: true,\n  });\n}\n\nfunction lowerRlsPolicyFromBlock(\n  block: RlsPolicyExtensionBlock,\n  ctx: AuthoringEntityContext,\n): PostgresRlsPolicy | undefined {\n  const prefix = block.name;\n  const operation = POLICY_KEYWORD_OPERATION[block.keyword] ?? 'select';\n  // The interpreter resolves the descriptor-declared `target` model ref to\n  // its storage table name before invoking this factory (an unresolved or\n  // missing required ref is the interpreter's diagnostic), so a lookup miss\n  // here is structurally impossible.\n  const tableName = block.resolvedModelRefs?.['target']?.tableName;\n  assertDefined(\n    tableName,\n    `lowerRlsPolicyFromBlock: policy \"${block.name}\" reached the factory without a resolved \\`target\\` ref; the interpreter resolves same-namespace model refs before invoking entity factories.`,\n  );\n  const roles = [...readListRefParams(block, 'roles')].sort();\n\n  const usingRaw = readValueParam(block, 'using');\n  const withCheckRaw = readValueParam(block, 'withCheck');\n\n  // Reject a predicate the operation does not take (e.g. `using` on INSERT, or\n  // `withCheck` on SELECT/DELETE). The descriptor's param set already omits it,\n  // but the generic descriptor validator is not wired into the SQL-family\n  // interpreter, so the lowering enforces the per-operation predicate matrix\n  // directly — a wrong predicate is a load-time diagnostic, not a silent drop.\n  const support = POLICY_OPERATION_PREDICATES[operation];\n  const rejectPredicate = (predicate: 'using' | 'withCheck'): undefined => {\n    ctx.diagnostics?.push({\n      code: 'PSL_RLS_PREDICATE_NOT_FOR_OPERATION',\n      message: `\\`${block.keyword}\\` policy \"${block.name}\" does not take a \\`${predicate}\\` predicate; the ${operation.toUpperCase()} operation uses ${support.using ? '`using`' : '`withCheck`'}${support.using && support.withCheck ? ' and `withCheck`' : ' only'}.`,\n      sourceId: ctx.sourceId ?? 'unknown',\n      span: block.parameters[predicate]?.span ?? block.span,\n    });\n    return undefined;\n  };\n  if (usingRaw !== undefined && !support.using) return rejectPredicate('using');\n  if (withCheckRaw !== undefined && !support.withCheck) return rejectPredicate('withCheck');\n\n  const using = usingRaw !== undefined ? unwrapQuotedString(usingRaw) : undefined;\n  const withCheck = withCheckRaw !== undefined ? unwrapQuotedString(withCheckRaw) : undefined;\n\n  return buildRlsPolicyEntity({\n    prefix,\n    tableName,\n    namespaceId: block.namespaceId,\n    operation,\n    roles,\n    ...ifDefined('using', using),\n    ...ifDefined('withCheck', withCheck),\n  });\n}\n\n/**\n * Lowers a `native_enum { memberName = \"value\" … @@map(\"type_name\") }` block\n * into a {@link PostgresNativeEnum}. Members must be authored as explicit\n * `key = \"value\"` pairs — a bare (value-less) member is a diagnostic, not\n * accepted (authoring-design.md §2.1). The parsed `memberName` is only used\n * to duplicate-check and report diagnostics; the lowered entity carries just\n * the member values (a native enum is value-only — the member \"name\" isn't\n * a separate authoring concept from the value). `typeName` comes from\n * `@@map` or defaults to the block name verbatim.\n */\nfunction lowerNativeEnumFromBlock(\n  block: PslExtensionBlock,\n  ctx: AuthoringEntityContext,\n): PostgresNativeEnum | undefined {\n  const sourceId = ctx.sourceId ?? 'unknown';\n  const diagnostics = ctx.diagnostics;\n\n  const mapAttr = block.blockAttributes.find((a) => a.name === 'map');\n  let typeName = block.name;\n  if (mapAttr) {\n    const rawArg = mapAttr.args[0]?.value;\n    const mapped = rawArg !== undefined ? unwrapQuotedString(rawArg) : undefined;\n    if (mapped === undefined) {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_INVALID_MAP',\n        message: `native_enum \"${block.name}\" @@map attribute must have a quoted type-name argument`,\n        sourceId,\n        span: mapAttr.span,\n      });\n      return undefined;\n    }\n    typeName = mapped;\n  }\n\n  let memberError = false;\n  const seenValues = new Set<string>();\n  const members: string[] = [];\n  for (const [memberName, paramValue] of Object.entries(block.parameters)) {\n    if (paramValue.kind === 'bare') {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_BARE_MEMBER',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" has no value; members must be authored as \"${memberName} = \\\\\"value\\\\\"\"`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (paramValue.kind !== 'value') continue;\n\n    let jsonValue: unknown;\n    try {\n      jsonValue = JSON.parse(paramValue.raw);\n    } catch {\n      diagnostics?.push({\n        code: 'PSL_EXTENSION_INVALID_VALUE',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" value \"${paramValue.raw}\" is not valid JSON`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (typeof jsonValue !== 'string') {\n      diagnostics?.push({\n        code: 'PSL_EXTENSION_INVALID_VALUE',\n        message: `native_enum \"${block.name}\" member \"${memberName}\" value must be a string`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    if (seenValues.has(jsonValue)) {\n      diagnostics?.push({\n        code: 'PSL_NATIVE_ENUM_DUPLICATE_MEMBER_VALUE',\n        message: `native_enum \"${block.name}\": duplicate member value \"${jsonValue}\"`,\n        sourceId,\n        span: paramValue.span,\n      });\n      memberError = true;\n      continue;\n    }\n    seenValues.add(jsonValue);\n    members.push(jsonValue);\n  }\n\n  if (memberError) return undefined;\n\n  if (members.length === 0) {\n    diagnostics?.push({\n      code: 'PSL_NATIVE_ENUM_MISSING_MEMBERS',\n      message: `native_enum \"${block.name}\" must have at least one member`,\n      sourceId,\n      span: block.span,\n    });\n    return undefined;\n  }\n\n  // `control` stays unset — the effective grade is resolved at read time via `effectiveControlPolicy`, like `StorageTable`/`StorageColumn`.\n  return new PostgresNativeEnum({ typeName, members });\n}\n\n/**\n * `native_enum`'s entity-type factory output, checked separately from the assembled\n * `postgresAuthoringEntityTypes` map below: `deriveValueSet` is SQL-family surface\n * ({@link SqlValueSetDerivingEntityTypeOutput}), not part of the framework\n * `AuthoringEntityTypeFactoryOutput` shape, so folding it directly into the map's single\n * `satisfies AuthoringEntityTypeNamespace` check would trip an excess-property error. Checking it\n * here against the intersection of both shapes keeps it structurally valid against each without\n * widening the map's own check.\n */\nconst nativeEnumEntityTypeOutput = {\n  factory: lowerNativeEnumFromBlock,\n  deriveValueSet: (entity: PostgresNativeEnum) => ({\n    kind: 'valueSet' as const,\n    values: [...entity.members],\n  }),\n} satisfies AuthoringEntityTypeFactoryOutput<PslExtensionBlock, PostgresNativeEnum | undefined> &\n  SqlValueSetDerivingEntityTypeOutput;\n\n/**\n * Lowers a `role <name> {}` block into a {@link PostgresRole}. Roles are\n * cluster-scoped in Postgres, so the block must be declared inside\n * `namespace unbound { … }` — any other lexical namespace (a named schema,\n * or the default bucket top-level declarations resolve to) is a load-time\n * diagnostic. The lowered entity carries the unbound coordinate.\n */\nfunction lowerRoleFromBlock(\n  block: RoleExtensionBlock,\n  ctx: AuthoringEntityContext,\n): PostgresRole | undefined {\n  if (block.namespaceId !== UNBOUND_NAMESPACE_ID) {\n    ctx.diagnostics?.push({\n      code: 'PSL_ROLE_BLOCK_OUTSIDE_UNBOUND_NAMESPACE',\n      message: `\\`role\\` block \"${block.name}\" must be declared inside \\`namespace unbound { }\\`, not in namespace \"${block.namespaceId}\"`,\n      sourceId: ctx.sourceId ?? 'unknown',\n      span: block.span,\n    });\n    return undefined;\n  }\n  return new PostgresRole({ name: block.name, namespaceId: UNBOUND_NAMESPACE_ID });\n}\n\nexport const postgresAuthoringEntityTypes = {\n  role: {\n    kind: 'entity',\n    discriminator: 'role',\n    validatorSchema: PostgresRoleSchema,\n    output: {\n      factory: lowerRoleFromBlock,\n    },\n  },\n  rls: {\n    kind: 'entity',\n    discriminator: 'rls',\n    validatorSchema: PostgresRlsEnablementSchema,\n    output: {\n      factory: (input: PostgresRlsEnablementInput): PostgresRlsEnablement =>\n        new PostgresRlsEnablement(input),\n    },\n  },\n  policy: {\n    kind: 'entity',\n    discriminator: 'policy',\n    validatorSchema: PostgresRlsPolicySchema,\n    output: {\n      factory: lowerRlsPolicyFromBlock,\n    },\n  },\n  native_enum: {\n    kind: 'entity',\n    discriminator: 'native_enum',\n    validatorSchema: PostgresNativeEnumSchema,\n    output: nativeEnumEntityTypeOutput,\n  },\n} as const satisfies AuthoringEntityTypeNamespace;\n\n/**\n * Field presets contributed by the Postgres target pack.\n *\n * These mirror the PSL scalar-to-codec mapping used by the Postgres adapter\n * (see `createPostgresPslScalarTypeDescriptors`), so that authoring a field\n * via the TS callback surface (e.g. `field.int()`) and via the PSL scalar\n * surface (e.g. `Int`) lowers to byte-identical contracts.\n *\n * The `uuidNative` / `id.uuidv4Native` / `id.uuidv7Native` presets use the\n * native Postgres `uuid` type (codecId `pg/uuid@1`). For cross-target\n * portability use `uuidString` / `id.uuidv4String` / `id.uuidv7String` from\n * the family pack instead.\n */\n/**\n * Shared parameter descriptors for the five `policy_<op>` PSL block\n * keywords. All five share the `policy` discriminator — the parser\n * dispatches by keyword (see the framework's PSL-block SPI), and every\n * keyword's factory lowers to `PostgresRlsPolicy` via `lowerRlsPolicyFromBlock`.\n *\n * The `roles` list uses `scope:'cross-space'` because same-namespace\n * role ref resolution requires PSL namespace entries keyed by `refKind`\n * (i.e. `'role'`), which in turn requires the role block discriminator to\n * equal `'role'`. Aligning discriminator with refKind is tracked for\n * slice 4 (cross-space roles). Until then cross-space passes validation\n * unconditionally and the authored role names flow through unchanged.\n */\nconst policyTargetParam = {\n  kind: 'ref',\n  refKind: 'model',\n  scope: 'same-namespace',\n  required: true,\n} as const;\nconst policyRolesParam = {\n  kind: 'list',\n  of: { kind: 'ref', refKind: 'role', scope: 'cross-space' },\n} as const;\nconst policyPredicateParam = { kind: 'value', codecId: 'pg/text@1', required: true } as const;\n// A policy may only target an RLS-controlled model: the model named by\n// `target` must declare `@@rls`, or the load fails with a diagnostic naming\n// the model and the policy prefix.\nconst policyRequiresRls = { parameter: 'target', attribute: 'rls' } as const;\n\nexport const postgresAuthoringPslBlockDescriptors = {\n  // The predicate param set per keyword mirrors Postgres: SELECT/DELETE take\n  // USING only; INSERT takes WITH CHECK only; UPDATE/ALL take both. The\n  // per-operation predicate matrix is enforced in `lowerRlsPolicyFromBlock`\n  // (a wrong predicate for the operation is a load-time diagnostic there),\n  // since the generic descriptor validator is not wired into the SQL-family\n  // interpreter.\n  policy_select: {\n    kind: 'pslBlock',\n    keyword: 'policy_select',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: { target: policyTargetParam, roles: policyRolesParam, using: policyPredicateParam },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_delete: {\n    kind: 'pslBlock',\n    keyword: 'policy_delete',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: { target: policyTargetParam, roles: policyRolesParam, using: policyPredicateParam },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_insert: {\n    kind: 'pslBlock',\n    keyword: 'policy_insert',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_update: {\n    kind: 'pslBlock',\n    keyword: 'policy_update',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      using: policyPredicateParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  policy_all: {\n    kind: 'pslBlock',\n    keyword: 'policy_all',\n    discriminator: 'policy',\n    name: { required: true },\n    parameters: {\n      target: policyTargetParam,\n      roles: policyRolesParam,\n      using: policyPredicateParam,\n      withCheck: policyPredicateParam,\n    },\n    requiresModelAttribute: policyRequiresRls,\n  },\n  /**\n   * PSL block descriptor for `native_enum`.\n   *\n   * Reuses the existing variadic-block mechanism (the same shape the SQL\n   * family's `enum` block ships): the body is an open `memberName = \"value\"`\n   * list. `variadicParameters: true` opens the block to arbitrary keys\n   * beyond the declared (empty) `parameters` set — the lowering factory\n   * (`lowerNativeEnumFromBlock`) turns the variadic entries into ordered\n   * members and rejects a bare (value-less) member.\n   */\n  native_enum: {\n    kind: 'pslBlock',\n    keyword: 'native_enum',\n    discriminator: 'native_enum',\n    name: { required: true },\n    parameters: {},\n    variadicParameters: true,\n  },\n  /**\n   * PSL block descriptor for `role` (e.g. `role anon {}`). Name-only, no\n   * parameters and no body content. Declared inside `namespace unbound { }`\n   * — see {@link lowerRoleFromBlock} for the placement check and the\n   * coordinate the lowered entity carries.\n   */\n  role: {\n    kind: 'pslBlock',\n    keyword: 'role',\n    discriminator: 'role',\n    name: { required: true },\n    parameters: {},\n  },\n} as const satisfies AuthoringPslBlockDescriptorNamespace;\n\n/**\n * `@@` model attributes contributed by the Postgres target pack.\n *\n * `@@rls` is argument-less: presence marks the model's table\n * RLS-controlled. It lowers to a {@link PostgresRlsEnablement} marker in\n * the namespace's `entries.rls`, keyed by the model's table name — the\n * marker (never the policy set) is what drives\n * `ENABLE`/`DISABLE ROW LEVEL SECURITY` planning.\n */\nexport const postgresAuthoringModelAttributes = {\n  rls: {\n    kind: 'modelAttribute',\n    attribute: 'rls',\n    spec: modelAttribute('rls', {}),\n    lower: (_parsed: Record<never, never>, ctx: AuthoringModelAttributeContext) => ({\n      key: ctx.storageName,\n      entity: new PostgresRlsEnablement({\n        tableName: ctx.storageName,\n        namespaceId: ctx.namespaceId,\n      }),\n    }),\n  },\n} as const satisfies AuthoringModelAttributeDescriptorNamespace;\n\nexport const postgresAuthoringFieldPresets = {\n  text: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/text@1',\n      nativeType: 'text',\n    },\n  },\n  int: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/int4@1',\n      nativeType: 'int4',\n    },\n  },\n  bigint: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/int8@1',\n      nativeType: 'int8',\n    },\n  },\n  float: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/float8@1',\n      nativeType: 'float8',\n    },\n  },\n  decimal: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/numeric@1',\n      nativeType: 'numeric',\n    },\n  },\n  boolean: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/bool@1',\n      nativeType: 'bool',\n    },\n  },\n  json: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/jsonb@1',\n      nativeType: 'jsonb',\n    },\n  },\n  bytes: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/bytea@1',\n      nativeType: 'bytea',\n    },\n  },\n  dateTime: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/timestamptz@1',\n      nativeType: 'timestamptz',\n    },\n  },\n  temporal: /* @__PURE__ */ temporalAuthoringPresets({\n    codecId: 'pg/timestamptz@1',\n    nativeType: 'timestamptz',\n  }),\n  uuidNative: {\n    kind: 'fieldPreset',\n    output: {\n      codecId: 'pg/uuid@1',\n      nativeType: 'uuid',\n    },\n  },\n  id: {\n    uuidv4Native: {\n      kind: 'fieldPreset',\n      output: {\n        codecId: 'pg/uuid@1',\n        nativeType: 'uuid',\n        executionDefaults: {\n          onCreate: {\n            kind: 'generator',\n            id: 'uuidv4',\n          },\n        },\n        id: true,\n      },\n    },\n    uuidv7Native: {\n      kind: 'fieldPreset',\n      output: {\n        codecId: 'pg/uuid@1',\n        nativeType: 'uuid',\n        executionDefaults: {\n          onCreate: {\n            kind: 'generator',\n            id: 'uuidv7',\n          },\n        },\n        id: true,\n      },\n    },\n  },\n} as const satisfies AuthoringFieldNamespace;\n\n/**\n * Postgres identifiers cap at 63 characters and the wire name appends a\n * 9-character `_<8hex>` suffix, so the authored prefix is bounded at 54.\n */\nconst RLS_POLICY_PREFIX_MAX_LENGTH = 54;\n\ninterface RlsRoleHandleShape {\n  readonly entityKind: 'role';\n  readonly name: string;\n}\n\ninterface RlsPolicyHandleShape {\n  readonly entityKind: 'policy';\n  readonly operation: RlsPolicyOperation;\n  readonly name: string;\n  readonly roles: readonly { readonly name: string }[];\n  readonly using?: string;\n  readonly withCheck?: string;\n}\n\ninterface RlsTargetCoordinate {\n  readonly namespaceId: string;\n  readonly tableName: string;\n}\n\n/**\n * Resolves an entity handle's `target` ref to a table coordinate of this\n * contract, or throws the load-time diagnostic naming the handle: a\n * cross-space target is rejected (you cannot CREATE POLICY on a table\n * another space owns) and an unresolved target names the model.\n */\nfunction requireLocalTarget(\n  refs: Readonly<Record<string, ResolvedEntityHandleRef>>,\n  subject: string,\n): RlsTargetCoordinate {\n  const target = refs['target'];\n  if (target !== undefined && target.kind === 'resolved') {\n    return { namespaceId: target.namespaceId, tableName: target.tableName };\n  }\n  if (target !== undefined && target.kind === 'cross-space') {\n    throw new Error(\n      `defineContract: ${subject} targets model \"${target.modelName ?? target.tableName}\", which lives in another contract space. Policies and rlsEnabled entries must target a model declared in this contract.`,\n    );\n  }\n  throw new Error(\n    `defineContract: ${subject} targets model \"${target?.modelName ?? '<anonymous>'}\", which is not in the contract's models. Add the model to \\`models\\`.`,\n  );\n}\n\n/**\n * The SQL-family entity-handle batch lowering hook for the Postgres pack\n * (`SqlEntityHandleLoweringContribution`). Receives every `entities` handle\n * whose kind this pack registered — batch, so the cross-entity diagnostics\n * (duplicate prefix, policy without rlsEnabled, duplicate role) can see\n * sibling handles — and lowers them with the same keying and hash assembly\n * as the PSL path: `policy` keyed by prefix (wire name via\n * {@link buildRlsPolicyEntity}), `rls` keyed by table name, `role` keyed by\n * name and filed under the default namespace (roles are declared\n * contract-wide; PSL has no role block to set a precedent).\n */\nexport function postgresLowerEntityHandles(\n  input: EntityHandleLoweringInput,\n): readonly LoweredPackEntity[] {\n  const enablements = new Map<\n    string,\n    { coordinate: RlsTargetCoordinate; entity: PostgresRlsEnablement }\n  >();\n  const roles = new Map<string, PostgresRole>();\n  const policies: {\n    readonly handle: RlsPolicyHandleShape;\n    readonly refs: Readonly<Record<string, ResolvedEntityHandleRef>>;\n  }[] = [];\n  const coordinateKey = (coordinate: RlsTargetCoordinate): string =>\n    `${coordinate.namespaceId} ${coordinate.tableName}`;\n\n  for (const { handle, refs } of input.handles) {\n    switch (handle.entityKind) {\n      case 'rls': {\n        const coordinate = requireLocalTarget(refs, 'an rlsEnabled entry');\n        const key = coordinateKey(coordinate);\n        if (!enablements.has(key)) {\n          enablements.set(key, {\n            coordinate,\n            entity: new PostgresRlsEnablement({\n              tableName: coordinate.tableName,\n              namespaceId: coordinate.namespaceId,\n            }),\n          });\n        }\n        break;\n      }\n      case 'role': {\n        const roleHandle = blindCast<\n          RlsRoleHandleShape,\n          'role handles are constructed only by the postgres contract-builder role() constructor, which enforces this shape'\n        >(handle);\n        if (roles.has(roleHandle.name)) {\n          throw new Error(\n            `defineContract: role \"${roleHandle.name}\" is declared more than once in the entities list.`,\n          );\n        }\n        // Roles are cluster-scoped in Postgres, so they always land in the\n        // `__unbound__` namespace — identical to a PSL `role` block\n        // (`lowerRoleFromBlock`) and matching the `PostgresRole` class's own\n        // contract. The declaring surface (TS entities vs PSL) does not move\n        // the slot.\n        roles.set(\n          roleHandle.name,\n          new PostgresRole({ name: roleHandle.name, namespaceId: UNBOUND_NAMESPACE_ID }),\n        );\n        break;\n      }\n      case 'policy': {\n        const policyHandle = blindCast<\n          RlsPolicyHandleShape,\n          'policy handles are constructed only by the postgres contract-builder policy*() constructors, which enforce this shape'\n        >(handle);\n        policies.push({ handle: policyHandle, refs });\n        break;\n      }\n      default:\n        throw new Error(\n          `defineContract: the postgres pack does not lower \"${handle.entityKind}\" handles from the entities list.`,\n        );\n    }\n  }\n\n  const rows: LoweredPackEntity[] = [];\n  const seenPrefixes = new Set<string>();\n\n  for (const { handle: policy, refs } of policies) {\n    const prefix = policy.name;\n    if (prefix.length > RLS_POLICY_PREFIX_MAX_LENGTH) {\n      throw new Error(\n        `defineContract: policy prefix \"${prefix}\" exceeds the ${RLS_POLICY_PREFIX_MAX_LENGTH}-character maximum (Postgres identifiers cap at 63 characters and the wire name appends a 9-character hash suffix).`,\n      );\n    }\n    const coordinate = requireLocalTarget(refs, `policy \"${prefix}\"`);\n    if (!enablements.has(coordinateKey(coordinate))) {\n      const target = refs['target'];\n      throw new Error(\n        `defineContract: policy \"${prefix}\" targets model \"${target?.modelName ?? coordinate.tableName}\", whose table is not RLS-enabled. Add rlsEnabled(<model>) to the entities list.`,\n      );\n    }\n    const prefixKey = `${coordinate.namespaceId} ${prefix}`;\n    if (seenPrefixes.has(prefixKey)) {\n      throw new Error(\n        `defineContract: policy prefix \"${prefix}\" is declared more than once in namespace \"${coordinate.namespaceId}\". Policy prefixes must be unique per namespace.`,\n      );\n    }\n    seenPrefixes.add(prefixKey);\n\n    const roleNames = [...new Set(policy.roles.map((roleHandle) => roleHandle.name))].sort();\n    rows.push({\n      namespaceId: coordinate.namespaceId,\n      entityKind: 'policy',\n      key: prefix,\n      entity: buildRlsPolicyEntity({\n        prefix,\n        tableName: coordinate.tableName,\n        namespaceId: coordinate.namespaceId,\n        operation: policy.operation,\n        roles: roleNames,\n        ...ifDefined('using', policy.using),\n        ...ifDefined('withCheck', policy.withCheck),\n      }),\n    });\n  }\n\n  for (const { coordinate, entity } of enablements.values()) {\n    rows.push({\n      namespaceId: coordinate.namespaceId,\n      entityKind: 'rls',\n      key: coordinate.tableName,\n      entity,\n    });\n  }\n  for (const [name, entity] of roles) {\n    rows.push({ namespaceId: UNBOUND_NAMESPACE_ID, entityKind: 'role', key: name, entity });\n  }\n  return rows;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkDA,MAAa,yBAAyB,EACpC,IAAI,EACF,MAAM;CACJ,MAAM;CACN,cAAc;EAAE,OAAO;EAAG,YAAY;CAAc;CACpD,QAAQ,EACN,SAAS,iBACX;AACF,EACF,EACF;;;;;;AAuBA,MAAM,2BAAyE;CAC7E,eAAe;CACf,eAAe;CACf,eAAe;CACf,eAAe;CACf,YAAY;AACd;AAEA,SAAS,eAAe,OAA0B,KAAiC;CACjF,MAAM,QAAQ,MAAM,WAAW;CAC/B,OAAO,OAAO,SAAS,UAAU,MAAM,MAAM,KAAA;AAC/C;AAEA,SAAS,kBAAkB,OAA0B,KAAuB;CAC1E,MAAM,QAAQ,MAAM,WAAW;CAC/B,IAAI,OAAO,SAAS,QAAQ,OAAO,CAAC;CACpC,OAAO,MAAM,MAAM,SAAS,SAAU,KAAK,SAAS,QAAQ,CAAC,KAAK,UAAU,IAAI,CAAC,CAAE;AACrF;;;;;;;AAQA,SAAS,mBAAmB,KAAqB;CAC/C,IAAI,EAAE,IAAI,WAAW,IAAG,KAAK,IAAI,SAAS,IAAG,KAAK,IAAI,UAAU,IAC9D,OAAO;CAET,MAAM,QAAQ,IAAI,MAAM,GAAG,EAAE;CAC7B,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,IAAI,MAAM,OAAO,QAAQ,IAAI,KAAK,MAAM,QAAQ;GAC9C,UAAU,MAAM;GAChB;EACF;EACA,MAAM,OAAO,MAAM,IAAI;EACvB,IAAI,SAAS,QAAQ,SAAS,MAC5B,UAAU;OACL,IAAI,SAAS,KAClB,UAAU;OACL,IAAI,SAAS,KAClB,UAAU;OACL;GACL,UAAU;GACV,UAAU;EACZ;EACA;CACF;CACA,OAAO;AACT;;;;;;;;AASA,SAAS,qBAAqB,OAQR;CACpB,MAAM,WAAW,mBAAmB;EAClC,GAAG,UAAU,SAAS,MAAM,UAAU,KAAA,IAAY,mBAAmB,MAAM,KAAK,IAAI,KAAA,CAAS;EAC7F,GAAG,UACD,aACA,MAAM,cAAc,KAAA,IAAY,mBAAmB,MAAM,SAAS,IAAI,KAAA,CACxE;EACA,OAAO,MAAM;EACb,WAAW,MAAM;EACjB,YAAY;CACd,CAAC;CAED,OAAO,IAAI,kBAAkB;EAC3B,MAAM,wBAAwB,MAAM,QAAQ,QAAQ;EACpD,QAAQ,MAAM;EACd,WAAW,MAAM;EACjB,aAAa,MAAM;EACnB,WAAW,MAAM;EACjB,OAAO,MAAM;EACb,GAAG,UAAU,SAAS,MAAM,KAAK;EACjC,GAAG,UAAU,aAAa,MAAM,SAAS;EACzC,YAAY;CACd,CAAC;AACH;AAEA,SAAS,wBACP,OACA,KAC+B;CAC/B,MAAM,SAAS,MAAM;CACrB,MAAM,YAAY,yBAAyB,MAAM,YAAY;CAK7D,MAAM,YAAY,MAAM,oBAAoB,SAAS,EAAE;CACvD,cACE,WACA,oCAAoC,MAAM,KAAK,8IACjD;CACA,MAAM,QAAQ,CAAC,GAAG,kBAAkB,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK;CAE1D,MAAM,WAAW,eAAe,OAAO,OAAO;CAC9C,MAAM,eAAe,eAAe,OAAO,WAAW;CAOtD,MAAM,UAAU,4BAA4B;CAC5C,MAAM,mBAAmB,cAAgD;EACvE,IAAI,aAAa,KAAK;GACpB,MAAM;GACN,SAAS,KAAK,MAAM,QAAQ,aAAa,MAAM,KAAK,sBAAsB,UAAU,oBAAoB,UAAU,YAAY,EAAE,kBAAkB,QAAQ,QAAQ,YAAY,gBAAgB,QAAQ,SAAS,QAAQ,YAAY,qBAAqB,QAAQ;GAChQ,UAAU,IAAI,YAAY;GAC1B,MAAM,MAAM,WAAW,UAAU,EAAE,QAAQ,MAAM;EACnD,CAAC;CAEH;CACA,IAAI,aAAa,KAAA,KAAa,CAAC,QAAQ,OAAO,OAAO,gBAAgB,OAAO;CAC5E,IAAI,iBAAiB,KAAA,KAAa,CAAC,QAAQ,WAAW,OAAO,gBAAgB,WAAW;CAExF,MAAM,QAAQ,aAAa,KAAA,IAAY,mBAAmB,QAAQ,IAAI,KAAA;CACtE,MAAM,YAAY,iBAAiB,KAAA,IAAY,mBAAmB,YAAY,IAAI,KAAA;CAElF,OAAO,qBAAqB;EAC1B;EACA;EACA,aAAa,MAAM;EACnB;EACA;EACA,GAAG,UAAU,SAAS,KAAK;EAC3B,GAAG,UAAU,aAAa,SAAS;CACrC,CAAC;AACH;;;;;;;;;;;AAYA,SAAS,yBACP,OACA,KACgC;CAChC,MAAM,WAAW,IAAI,YAAY;CACjC,MAAM,cAAc,IAAI;CAExB,MAAM,UAAU,MAAM,gBAAgB,MAAM,MAAM,EAAE,SAAS,KAAK;CAClE,IAAI,WAAW,MAAM;CACrB,IAAI,SAAS;EACX,MAAM,SAAS,QAAQ,KAAK,EAAE,EAAE;EAChC,MAAM,SAAS,WAAW,KAAA,IAAY,mBAAmB,MAAM,IAAI,KAAA;EACnE,IAAI,WAAW,KAAA,GAAW;GACxB,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK;IACpC;IACA,MAAM,QAAQ;GAChB,CAAC;GACD;EACF;EACA,WAAW;CACb;CAEA,IAAI,cAAc;CAClB,MAAM,6BAAa,IAAI,IAAY;CACnC,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,CAAC,YAAY,eAAe,OAAO,QAAQ,MAAM,UAAU,GAAG;EACvE,IAAI,WAAW,SAAS,QAAQ;GAC9B,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW,+CAA+C,WAAW;IACrH;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,WAAW,SAAS,SAAS;EAEjC,IAAI;EACJ,IAAI;GACF,YAAY,KAAK,MAAM,WAAW,GAAG;EACvC,QAAQ;GACN,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW,WAAW,WAAW,IAAI;IACrF;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,OAAO,cAAc,UAAU;GACjC,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,YAAY,WAAW;IAC3D;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,IAAI,WAAW,IAAI,SAAS,GAAG;GAC7B,aAAa,KAAK;IAChB,MAAM;IACN,SAAS,gBAAgB,MAAM,KAAK,6BAA6B,UAAU;IAC3E;IACA,MAAM,WAAW;GACnB,CAAC;GACD,cAAc;GACd;EACF;EACA,WAAW,IAAI,SAAS;EACxB,QAAQ,KAAK,SAAS;CACxB;CAEA,IAAI,aAAa,OAAO,KAAA;CAExB,IAAI,QAAQ,WAAW,GAAG;EACxB,aAAa,KAAK;GAChB,MAAM;GACN,SAAS,gBAAgB,MAAM,KAAK;GACpC;GACA,MAAM,MAAM;EACd,CAAC;EACD;CACF;CAGA,OAAO,IAAI,mBAAmB;EAAE;EAAU;CAAQ,CAAC;AACrD;;;;;;;;;;AAWA,MAAM,6BAA6B;CACjC,SAAS;CACT,iBAAiB,YAAgC;EAC/C,MAAM;EACN,QAAQ,CAAC,GAAG,OAAO,OAAO;CAC5B;AACF;;;;;;;;AAUA,SAAS,mBACP,OACA,KAC0B;CAC1B,IAAI,MAAM,gBAAgB,sBAAsB;EAC9C,IAAI,aAAa,KAAK;GACpB,MAAM;GACN,SAAS,mBAAmB,MAAM,KAAK,yEAAyE,MAAM,YAAY;GAClI,UAAU,IAAI,YAAY;GAC1B,MAAM,MAAM;EACd,CAAC;EACD;CACF;CACA,OAAO,IAAI,aAAa;EAAE,MAAM,MAAM;EAAM,aAAa;CAAqB,CAAC;AACjF;AAEA,MAAa,+BAA+B;CAC1C,MAAM;EACJ,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,SAAS,mBACX;CACF;CACA,KAAK;EACH,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,UAAU,UACR,IAAI,sBAAsB,KAAK,EACnC;CACF;CACA,QAAQ;EACN,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ,EACN,SAAS,wBACX;CACF;CACA,aAAa;EACX,MAAM;EACN,eAAe;EACf,iBAAiB;EACjB,QAAQ;CACV;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,oBAAoB;CACxB,MAAM;CACN,SAAS;CACT,OAAO;CACP,UAAU;AACZ;AACA,MAAM,mBAAmB;CACvB,MAAM;CACN,IAAI;EAAE,MAAM;EAAO,SAAS;EAAQ,OAAO;CAAc;AAC3D;AACA,MAAM,uBAAuB;CAAE,MAAM;CAAS,SAAS;CAAa,UAAU;AAAK;AAInF,MAAM,oBAAoB;CAAE,WAAW;CAAU,WAAW;AAAM;AAElE,MAAa,uCAAuC;CAOlD,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GAAE,QAAQ;GAAmB,OAAO;GAAkB,OAAO;EAAqB;EAC9F,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GAAE,QAAQ;GAAmB,OAAO;GAAkB,OAAO;EAAqB;EAC9F,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;CACA,eAAe;EACb,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;CACA,YAAY;EACV,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY;GACV,QAAQ;GACR,OAAO;GACP,OAAO;GACP,WAAW;EACb;EACA,wBAAwB;CAC1B;;;;;;;;;;;CAWA,aAAa;EACX,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY,CAAC;EACb,oBAAoB;CACtB;;;;;;;CAOA,MAAM;EACJ,MAAM;EACN,SAAS;EACT,eAAe;EACf,MAAM,EAAE,UAAU,KAAK;EACvB,YAAY,CAAC;CACf;AACF;;;;;;;;;;AAWA,MAAa,mCAAmC,EAC9C,KAAK;CACH,MAAM;CACN,WAAW;CACX,MAAM,eAAe,OAAO,CAAC,CAAC;CAC9B,QAAQ,SAA+B,SAAyC;EAC9E,KAAK,IAAI;EACT,QAAQ,IAAI,sBAAsB;GAChC,WAAW,IAAI;GACf,aAAa,IAAI;EACnB,CAAC;CACH;AACF,EACF;AAEA,MAAa,gCAAgC;CAC3C,MAAM;EACJ,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,KAAK;EACH,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,QAAQ;EACN,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,OAAO;EACL,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,SAAS;EACP,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,SAAS;EACP,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,MAAM;EACJ,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,OAAO;EACL,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,UAAU;EACR,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,UAA0B,yCAAyB;EACjD,SAAS;EACT,YAAY;CACd,CAAC;CACD,YAAY;EACV,MAAM;EACN,QAAQ;GACN,SAAS;GACT,YAAY;EACd;CACF;CACA,IAAI;EACF,cAAc;GACZ,MAAM;GACN,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,mBAAmB,EACjB,UAAU;KACR,MAAM;KACN,IAAI;IACN,EACF;IACA,IAAI;GACN;EACF;EACA,cAAc;GACZ,MAAM;GACN,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,mBAAmB,EACjB,UAAU;KACR,MAAM;KACN,IAAI;IACN,EACF;IACA,IAAI;GACN;EACF;CACF;AACF;;;;;AAMA,MAAM,+BAA+B;;;;;;;AA2BrC,SAAS,mBACP,MACA,SACqB;CACrB,MAAM,SAAS,KAAK;CACpB,IAAI,WAAW,KAAA,KAAa,OAAO,SAAS,YAC1C,OAAO;EAAE,aAAa,OAAO;EAAa,WAAW,OAAO;CAAU;CAExE,IAAI,WAAW,KAAA,KAAa,OAAO,SAAS,eAC1C,MAAM,IAAI,MACR,mBAAmB,QAAQ,kBAAkB,OAAO,aAAa,OAAO,UAAU,yHACpF;CAEF,MAAM,IAAI,MACR,mBAAmB,QAAQ,kBAAkB,QAAQ,aAAa,cAAc,uEAClF;AACF;;;;;;;;;;;;AAaA,SAAgB,2BACd,OAC8B;CAC9B,MAAM,8BAAc,IAAI,IAGtB;CACF,MAAM,wBAAQ,IAAI,IAA0B;CAC5C,MAAM,WAGA,CAAC;CACP,MAAM,iBAAiB,eACrB,GAAG,WAAW,YAAY,GAAG,WAAW;CAE1C,KAAK,MAAM,EAAE,QAAQ,UAAU,MAAM,SACnC,QAAQ,OAAO,YAAf;EACE,KAAK,OAAO;GACV,MAAM,aAAa,mBAAmB,MAAM,qBAAqB;GACjE,MAAM,MAAM,cAAc,UAAU;GACpC,IAAI,CAAC,YAAY,IAAI,GAAG,GACtB,YAAY,IAAI,KAAK;IACnB;IACA,QAAQ,IAAI,sBAAsB;KAChC,WAAW,WAAW;KACtB,aAAa,WAAW;IAC1B,CAAC;GACH,CAAC;GAEH;EACF;EACA,KAAK,QAAQ;GACX,MAAM,aAAa,UAGjB,MAAM;GACR,IAAI,MAAM,IAAI,WAAW,IAAI,GAC3B,MAAM,IAAI,MACR,yBAAyB,WAAW,KAAK,mDAC3C;GAOF,MAAM,IACJ,WAAW,MACX,IAAI,aAAa;IAAE,MAAM,WAAW;IAAM,aAAa;GAAqB,CAAC,CAC/E;GACA;EACF;EACA,KAAK,UAAU;GACb,MAAM,eAAe,UAGnB,MAAM;GACR,SAAS,KAAK;IAAE,QAAQ;IAAc;GAAK,CAAC;GAC5C;EACF;EACA,SACE,MAAM,IAAI,MACR,qDAAqD,OAAO,WAAW,kCACzE;CACJ;CAGF,MAAM,OAA4B,CAAC;CACnC,MAAM,+BAAe,IAAI,IAAY;CAErC,KAAK,MAAM,EAAE,QAAQ,QAAQ,UAAU,UAAU;EAC/C,MAAM,SAAS,OAAO;EACtB,IAAI,OAAO,SAAS,8BAClB,MAAM,IAAI,MACR,kCAAkC,OAAO,gBAAgB,6BAA6B,oHACxF;EAEF,MAAM,aAAa,mBAAmB,MAAM,WAAW,OAAO,EAAE;EAChE,IAAI,CAAC,YAAY,IAAI,cAAc,UAAU,CAAC,GAAG;GAC/C,MAAM,SAAS,KAAK;GACpB,MAAM,IAAI,MACR,2BAA2B,OAAO,mBAAmB,QAAQ,aAAa,WAAW,UAAU,iFACjG;EACF;EACA,MAAM,YAAY,GAAG,WAAW,YAAY,GAAG;EAC/C,IAAI,aAAa,IAAI,SAAS,GAC5B,MAAM,IAAI,MACR,kCAAkC,OAAO,6CAA6C,WAAW,YAAY,iDAC/G;EAEF,aAAa,IAAI,SAAS;EAE1B,MAAM,YAAY,CAAC,GAAG,IAAI,IAAI,OAAO,MAAM,KAAK,eAAe,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;EACvF,KAAK,KAAK;GACR,aAAa,WAAW;GACxB,YAAY;GACZ,KAAK;GACL,QAAQ,qBAAqB;IAC3B;IACA,WAAW,WAAW;IACtB,aAAa,WAAW;IACxB,WAAW,OAAO;IAClB,OAAO;IACP,GAAG,UAAU,SAAS,OAAO,KAAK;IAClC,GAAG,UAAU,aAAa,OAAO,SAAS;GAC5C,CAAC;EACH,CAAC;CACH;CAEA,KAAK,MAAM,EAAE,YAAY,YAAY,YAAY,OAAO,GACtD,KAAK,KAAK;EACR,aAAa,WAAW;EACxB,YAAY;EACZ,KAAK,WAAW;EAChB;CACF,CAAC;CAEH,KAAK,MAAM,CAAC,MAAM,WAAW,OAC3B,KAAK,KAAK;EAAE,aAAa;EAAsB,YAAY;EAAQ,KAAK;EAAM;CAAO,CAAC;CAExF,OAAO;AACT"}

package/dist/{canonicalize-CAbXtVtB.d.mts → canonicalize-D1F4vUnP.d.mts}

@@ -1,5 +1,16 @@
 //#region src/core/rls/canonicalize.d.ts
 type RlsPolicyOperation = 'select' | 'insert' | 'update' | 'delete' | 'all';
+/**
+ * Which predicate each RLS operation admits, mirroring Postgres: SELECT and
+ * DELETE decide row visibility/eligibility with `USING` only; INSERT
+ * validates the new row with `WITH CHECK` only; UPDATE and ALL take either
+ * or both. Single-homed here so the PSL lowering and the TS handle
+ * constructors enforce the same matrix.
+ */
+declare const POLICY_OPERATION_PREDICATES: Readonly<Record<RlsPolicyOperation, {
+  readonly using: boolean;
+  readonly withCheck: boolean;
+}>>;
 interface ContentHashParts {
   readonly using?: string;
   readonly withCheck?: string;
@@ -33,5 +44,5 @@ declare function normalizePredicate(sql: string): string;
  */
 declare function computeContentHash(parts: ContentHashParts): string;
 //#endregion
-export { normalizePredicate as i, RlsPolicyOperation as n, computeContentHash as r, ContentHashParts as t };
-//# sourceMappingURL=canonicalize-CAbXtVtB.d.mts.map
+export { normalizePredicate as a, computeContentHash as i, POLICY_OPERATION_PREDICATES as n, RlsPolicyOperation as r, ContentHashParts as t };
+//# sourceMappingURL=canonicalize-D1F4vUnP.d.mts.map

package/dist/canonicalize-D1F4vUnP.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize-D1F4vUnP.d.mts","names":[],"sources":["../src/core/rls/canonicalize.ts"],"mappings":";KAEY,kBAAA;AAAZ;;;;AAA8B;AAS9B;;AATA,cASa,2BAAA,EAA6B,QAAA,CACxC,MAAA,CAAO,kBAAA;EAAA,SAA+B,KAAA;EAAA,SAAyB,SAAA;AAAA;AAAA,UAShD,gBAAA;EAAA,SACN,KAAA;EAAA,SACA,SAAA;EAAA,SACA,KAAA;EAAA,SACA,SAAA,EAAW,kBAAkB;EAAA,SAC7B,UAAA;AAAA;;AAd+D;AAS1E;;;;;;;;;;;AAKqB;iBAiBL,kBAAA,CAAmB,GAAW;;;;AAAA;AAa9C;;;;AAA0D;iBAA1C,kBAAA,CAAmB,KAAuB,EAAhB,gBAAgB"}

package/dist/contract-free.d.mts

@@ -1,4 +1,4 @@
-import { a as DropDefaultAction, l as PostgresCreateSchema, r as AnyAlterTableAction, s as PostgresAlterTable, t as AddColumnAction, u as PostgresCreateTable } from "./nodes-Bc2N3tMy.mjs";
+import { a as DropDefaultAction, l as PostgresCreateSchema, r as AnyAlterTableAction, s as PostgresAlterTable, t as AddColumnAction, u as PostgresCreateTable } from "./nodes-Dv5eCSq9.mjs";
 import { t as PostgresTableSource } from "./table-source-BvFo7gVs.mjs";
 import { DdlColumn, DdlNode, DdlTableConstraint, SelectAst } from "@prisma-next/sql-relational-core/ast";
 import { CfExpr, ColumnDescriptor, ColumnSchema, TableHandle } from "@prisma-next/sql-relational-core/contract-free";

package/dist/contract-free.mjs

@@ -1,6 +1,6 @@
 import { _ as PG_TEXT_ARRAY_CODEC_ID, d as PG_INT8_CODEC_ID, m as PG_JSONB_CODEC_ID, u as PG_INT4_CODEC_ID, v as PG_TEXT_CODEC_ID, y as PG_TIMESTAMPTZ_CODEC_ID } from "./codec-ids-C_-Hj6bL.mjs";
-import { l as PostgresTableSource } from "./postgres-schema-DYATroNx.mjs";
-import { C as rlsPolicyExistsAst, D as toRegclass, E as tablePrimaryKeyAst, S as rlsEnabledAst, T as tableIsEmptyAst, _ as extensionExistsAst, a as createSchema, f as columnDefaultAst, g as constraintExistsAst, h as columnTypeAst, l as dropDefaultAction, m as columnNullabilityAst, o as createTable, p as columnExistsAst, r as alterTable, t as addColumnAction, v as indexExistsAst, w as tableExistsAst, x as noNullValuesAst } from "./ddl-BQzITB_e.mjs";
+import { l as PostgresTableSource } from "./postgres-schema-ChBj22nX.mjs";
+import { C as rlsPolicyExistsAst, D as toRegclass, E as tablePrimaryKeyAst, S as rlsEnabledAst, T as tableIsEmptyAst, _ as extensionExistsAst, a as createSchema, f as columnDefaultAst, g as constraintExistsAst, h as columnTypeAst, l as dropDefaultAction, m as columnNullabilityAst, o as createTable, p as columnExistsAst, r as alterTable, t as addColumnAction, v as indexExistsAst, w as tableExistsAst, x as noNullValuesAst } from "./ddl-eBZav_MS.mjs";
 import { col, fn, lit, table } from "@prisma-next/sql-relational-core/contract-free";
 import { APP_SPACE_ID } from "@prisma-next/framework-components/control";
 //#region src/contract-free/columns.ts

package/dist/{control-policy-5LE2kwfb.mjs → control-policy-BfQLCrha.mjs}

@@ -1,8 +1,8 @@
-import { r as isPostgresSchema } from "./postgres-schema-DYATroNx.mjs";
+import { r as isPostgresSchema } from "./postgres-schema-ChBj22nX.mjs";
 import { i as quoteIdentifier } from "./sql-utils-SU4FDvIV.mjs";
 import { n as PostgresNativeEnumSchemaNode, o as postgresNodeEntityKind, r as PostgresSchemaNodeKind, t as PostgresTableSchemaNode } from "./postgres-table-schema-node-D6LvInCe.mjs";
-import { A as SetDefaultCall, C as DropNativeEnumTypeCall, D as EnableRowLevelSecurityCall, E as DropTableCall, M as postgresDefaultToDdlColumnDefault, N as buildTargetDetails, O as RawSqlCall, S as DropIndexCall, _ as DisableRowLevelSecurityCall, a as AddNotNullColumnDirectCall, b as DropConstraintCall, c as AddUniqueCall, d as CreateIndexCall, f as CreateNativeEnumTypeCall, g as DataTransformCall, h as CreateTableCall, i as AddNativeEnumValueCall, j as SetNotNullCall, l as AlterColumnTypeCall, m as CreateSchemaCall, n as AddColumnCall, o as AddNotNullColumnWithTempDefaultCall, r as AddForeignKeyCall, s as AddPrimaryKeyCall, t as AddCheckConstraintCall, v as DropCheckConstraintCall, w as DropNotNullCall, x as DropDefaultCall, y as DropColumnCall } from "./op-factory-call-D6yu-PlS.mjs";
-import { t as buildExpectedFormatType } from "./planner-sql-checks-CDXn2uaS.mjs";
+import { A as SetDefaultCall, C as DropNativeEnumTypeCall, D as EnableRowLevelSecurityCall, E as DropTableCall, M as postgresDefaultToDdlColumnDefault, N as buildTargetDetails, O as RawSqlCall, S as DropIndexCall, _ as DisableRowLevelSecurityCall, a as AddNotNullColumnDirectCall, b as DropConstraintCall, c as AddUniqueCall, d as CreateIndexCall, f as CreateNativeEnumTypeCall, g as DataTransformCall, h as CreateTableCall, i as AddNativeEnumValueCall, j as SetNotNullCall, l as AlterColumnTypeCall, m as CreateSchemaCall, n as AddColumnCall, o as AddNotNullColumnWithTempDefaultCall, r as AddForeignKeyCall, s as AddPrimaryKeyCall, t as AddCheckConstraintCall, v as DropCheckConstraintCall, w as DropNotNullCall, x as DropDefaultCall, y as DropColumnCall } from "./op-factory-call-Dwsb1xzl.mjs";
+import { t as buildExpectedFormatType } from "./planner-sql-checks-Cx0ATsPc.mjs";
 import { n as buildColumnTypeSql, t as buildColumnDefaultSql } from "./planner-ddl-builders-BKlmGDJl.mjs";
 import { n as resolveIdentityValue } from "./planner-identity-values-CJPha2Sz.mjs";
 import { i as hasUniqueConstraint, n as hasForeignKey, t as buildSchemaLookupMap } from "./planner-schema-lookup-CiVaAQP-.mjs";
@@ -1282,4 +1282,4 @@ function resolvePostgresNodeIssueControlPolicySubject(issue, contract) {
 //#endregion
 export { resolvePostgresNodeIssueCreationFactoryName as a, issueSchemaName as c, postgresNodeStorageCoordinate as d, resolvePostgresNodeIssueControlPolicySubject as i, planIssues as l, resolveNamespaceIdForDdlSchema as n, coalesceSubtreeIssues as o, resolvePostgresCallControlPolicySubject as r, issueNode as s, renderPostgresSuppression as t, postgresPlannerStrategies as u };
 
-//# sourceMappingURL=control-policy-5LE2kwfb.mjs.map
+//# sourceMappingURL=control-policy-BfQLCrha.mjs.map