@prisma-next/target-postgres 0.14.0-dev.9 → 0.14.0-dev.90

package/dist/resolve-ddl-schema-XyBaaenM.mjs

@@ -0,0 +1,22 @@
+import { t as DEFAULT_NAMESPACE_ID } from "./namespace-ids-xtp_ZY86.mjs";
+import { r as isPostgresSchema } from "./postgres-schema-Cm4DtiGA.mjs";
+import { UNBOUND_NAMESPACE_ID } from "@prisma-next/framework-components/ir";
+//#region src/core/migrations/resolve-ddl-schema.ts
+/**
+* Given the contract's storage and a namespace id, returns the live Postgres
+* DDL schema name that namespace maps to. A named Postgres namespace dispatches
+* to its `ddlSchemaName(storage)`; the unbound sentinel resolves to
+* `DEFAULT_NAMESPACE_ID` (the search-path default for offline planning); a
+* bare object payload (used by some tests) falls back to the namespace id
+* itself.
+*/
+function resolveDdlSchemaForNamespaceStorage(storage, namespaceId) {
+	if (namespaceId === UNBOUND_NAMESPACE_ID) return DEFAULT_NAMESPACE_ID;
+	const namespace = storage.namespaces[namespaceId];
+	if (namespace && isPostgresSchema(namespace)) return namespace.ddlSchemaName(storage);
+	return namespaceId;
+}
+//#endregion
+export { resolveDdlSchemaForNamespaceStorage as t };
+
+//# sourceMappingURL=resolve-ddl-schema-XyBaaenM.mjs.map

package/dist/resolve-ddl-schema-XyBaaenM.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-ddl-schema-XyBaaenM.mjs","names":[],"sources":["../src/core/migrations/resolve-ddl-schema.ts"],"sourcesContent":["import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';\nimport type { SqlStorage } from '@prisma-next/sql-contract/types';\nimport { DEFAULT_NAMESPACE_ID } from '../namespace-ids';\nimport { isPostgresSchema } from '../postgres-schema';\n\n/**\n * Given the contract's storage and a namespace id, returns the live Postgres\n * DDL schema name that namespace maps to. A named Postgres namespace dispatches\n * to its `ddlSchemaName(storage)`; the unbound sentinel resolves to\n * `DEFAULT_NAMESPACE_ID` (the search-path default for offline planning); a\n * bare object payload (used by some tests) falls back to the namespace id\n * itself.\n */\nexport function resolveDdlSchemaForNamespaceStorage(\n  storage: SqlStorage,\n  namespaceId: string,\n): string {\n  if (namespaceId === UNBOUND_NAMESPACE_ID) {\n    return DEFAULT_NAMESPACE_ID;\n  }\n  const namespace = storage.namespaces[namespaceId];\n  if (namespace && isPostgresSchema(namespace)) {\n    return namespace.ddlSchemaName(storage);\n  }\n  return namespaceId;\n}\n"],"mappings":";;;;;;;;;;;;AAaA,SAAgB,oCACd,SACA,aACQ;CACR,IAAI,gBAAgB,sBAClB,OAAO;CAET,MAAM,YAAY,QAAQ,WAAW;CACrC,IAAI,aAAa,iBAAiB,SAAS,GACzC,OAAO,UAAU,cAAc,OAAO;CAExC,OAAO;AACT"}

package/dist/rls-canonicalize.d.mts

@@ -0,0 +1,27 @@
+import { a as normalizePredicate, i as computeContentHash, n as POLICY_OPERATION_PREDICATES, r as RlsPolicyOperation, t as ContentHashParts } from "./canonicalize-D1F4vUnP.mjs";
+
+//#region src/core/rls/wire-name.d.ts
+interface RlsPolicyWireName {
+  /** The user-supplied part before the `_<8hex>` suffix. */
+  readonly prefix: string;
+  /** The 8-lowercase-hex content-hash suffix. */
+  readonly hash: string;
+}
+/**
+ * Assembles an RLS policy wire name from its user-supplied prefix and its
+ * 8-hex content-hash suffix. This module owns the `<prefix>_<hash>` format
+ * on both sides — construction here and parsing in
+ * {@link parseRlsPolicyWireName} — so the two never drift.
+ */
+declare function formatRlsPolicyWireName(prefix: string, hash: string): string;
+/**
+ * Splits an RLS policy wire name (`<prefix>_<8hex>`) into its prefix and
+ * content-hash suffix. Returns `undefined` when the name does not follow the
+ * wire-name shape (e.g. a policy created outside the toolchain) — callers
+ * treat such names as all-prefix. Consumed by introspection (prefix
+ * extraction) and by rename pairing (same hash, different prefix).
+ */
+declare function parseRlsPolicyWireName(name: string): RlsPolicyWireName | undefined;
+//#endregion
+export { type ContentHashParts, POLICY_OPERATION_PREDICATES, type RlsPolicyOperation, type RlsPolicyWireName, computeContentHash, formatRlsPolicyWireName, normalizePredicate, parseRlsPolicyWireName };
+//# sourceMappingURL=rls-canonicalize.d.mts.map

package/dist/rls-canonicalize.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-canonicalize.d.mts","names":[],"sources":["../src/core/rls/wire-name.ts"],"mappings":";;;UAAiB,iBAAA;;WAEN,MAAA;EAFM;EAAA,SAIN,IAAI;AAAA;;AAAA;AAWf;;;;iBAAgB,uBAAA,CAAwB,MAAA,UAAgB,IAAY;AAWpE;;;;AAAuE;;;AAAvE,iBAAgB,sBAAA,CAAuB,IAAA,WAAe,iBAAiB"}

package/dist/rls-canonicalize.mjs

@@ -0,0 +1,2 @@
+import { a as normalizePredicate, i as computeContentHash, n as parseRlsPolicyWireName, r as POLICY_OPERATION_PREDICATES, t as formatRlsPolicyWireName } from "./wire-name-DbQ9-2RC.mjs";
+export { POLICY_OPERATION_PREDICATES, computeContentHash, formatRlsPolicyWireName, normalizePredicate, parseRlsPolicyWireName };

package/dist/runtime.d.mts

@@ -1,6 +1,7 @@
+import { t as PostgresContractView } from "./postgres-contract-view-C9j5cqP0.mjs";
 import { AnyCodecDescriptor } from "@prisma-next/framework-components/codec";
-import { Namespace } from "@prisma-next/framework-components/ir";
-import { SqlNamespaceTablesInput, SqlStorage } from "@prisma-next/sql-contract/types";
+import { AnyEntityKindDescriptor, Namespace } from "@prisma-next/framework-components/ir";
+import { SqlNamespaceInput, SqlStorage } from "@prisma-next/sql-contract/types";
 import { SqlContractSerializerBase } from "@prisma-next/family-sql/ir";
 import { Contract } from "@prisma-next/contract/types";
 import { RuntimeTargetDescriptor, RuntimeTargetInstance } from "@prisma-next/framework-components/execution";
@@ -8,12 +9,9 @@ import { JsonObject } from "@prisma-next/utils/json";
 
 //#region src/core/postgres-contract-serializer.d.ts
 declare class PostgresContractSerializer extends SqlContractSerializerBase<Contract<SqlStorage>> {
-  constructor();
-  protected get defaultNamespaceId(): string;
-  protected hydrateSqlNamespaceEntry(nsId: string, raw: Namespace | Record<string, unknown>): Namespace | SqlNamespaceTablesInput;
+  constructor(extraPackEntityKinds?: readonly AnyEntityKindDescriptor[]);
+  protected hydrateSqlNamespaceEntry(nsId: string, raw: Record<string, unknown>): Namespace | SqlNamespaceInput;
   serializeContract(contract: Contract<SqlStorage>): JsonObject;
-  private serializePostgresNamespace;
-  private serializeJsonValue;
 }
 //#endregion
 //#region src/exports/runtime.d.ts
@@ -28,5 +26,5 @@ declare const postgresRuntimeTargetDescriptor: RuntimeTargetDescriptor<'sql', 'p
   readonly codecs: () => readonly AnyCodecDescriptor[];
 };
 //#endregion
-export { PostgresContractSerializer, PostgresRuntimeTargetInstance, postgresRuntimeTargetDescriptor as default };
+export { PostgresContractSerializer, PostgresContractView, PostgresRuntimeTargetInstance, postgresRuntimeTargetDescriptor as default };
 //# sourceMappingURL=runtime.d.mts.map

package/dist/runtime.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.mts","names":[],"sources":["../src/core/postgres-contract-serializer.ts","../src/exports/runtime.ts"],"mappings":";;;;;;;;;cAkEa,0BAAA,SAAmC,yBAAA,CAA0B,QAAA,CAAS,UAAA;;gBAM1D,kBAAA;EAAA,UAIJ,wBAAA,CACjB,IAAA,UACA,GAAA,EAAK,SAAA,GAAY,MAAA,oBAChB,SAAA,GAAY,uBAAA;EA0BN,iBAAA,CAAkB,QAAA,EAAU,QAAA,CAAS,UAAA,IAAc,UAAA;EAAA,QAuCpD,0BAAA;EAAA,QAyBA,kBAAA;AAAA;;;UChKO,6BAAA,SAAsC,qBAAqB;;;;;ADyD5E;;cCjDM,+BAAA,EAAiC,uBAAA,oBAGrC,6BAAA;EAAA,SAES,MAAA,iBAAuB,kBAAA;AAAA"}
+{"version":3,"file":"runtime.d.mts","names":[],"sources":["../src/core/postgres-contract-serializer.ts","../src/exports/runtime.ts"],"mappings":";;;;;;;;;;cA0Ea,0BAAA,SAAmC,yBAAA,CAA0B,QAAA,CAAS,UAAA;cACrE,oBAAA,YAA+B,uBAAA;EAAA,UAWxB,wBAAA,CACjB,IAAA,UACA,GAAA,EAAK,MAAA,oBACJ,SAAA,GAAY,iBAAA;EAyBN,iBAAA,CAAkB,QAAA,EAAU,QAAA,CAAS,UAAA,IAAc,UAAA;AAAA;;;UCxG7C,6BAAA,SAAsC,qBAAqB;;;;;ADgE5E;;cCxDM,+BAAA,EAAiC,uBAAA,oBAGrC,6BAAA;EAAA,SAES,MAAA,iBAAuB,kBAAA;AAAA"}

package/dist/runtime.mjs

@@ -1,5 +1,5 @@
-import { n as postgresTargetDescriptorMetaRuntime } from "./descriptor-meta-CpGygXpI.mjs";
-import { t as PostgresContractSerializer } from "./postgres-contract-serializer-k3TAcPMY.mjs";
+import { t as postgresTargetDescriptorMetaRuntime } from "./descriptor-meta-runtime-UwYdV8fD.mjs";
+import { n as PostgresContractSerializer, t as PostgresContractView } from "./postgres-contract-view-DM8sN1Ot.mjs";
 //#region src/exports/runtime.ts
 /**
 * Target-postgres deliberately does NOT import `SqlRuntimeTargetDescriptor` from `@prisma-next/sql-runtime`. The target package is a control-plane residence and must not pull the SQL execution-plane package into its dependency closure. The runtime descriptor here is shaped to satisfy the framework's `RuntimeTargetDescriptor` plus the structural `SqlStaticContributions` (`codecs:` returning a descriptor list) that
@@ -18,6 +18,6 @@ const postgresRuntimeTargetDescriptor = {
 	}
 };
 //#endregion
-export { PostgresContractSerializer, postgresRuntimeTargetDescriptor as default };
+export { PostgresContractSerializer, PostgresContractView, postgresRuntimeTargetDescriptor as default };
 
 //# sourceMappingURL=runtime.mjs.map

package/dist/runtime.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.mjs","names":[],"sources":["../src/exports/runtime.ts"],"sourcesContent":["import type { AnyCodecDescriptor } from '@prisma-next/framework-components/codec';\nimport type {\n  RuntimeTargetDescriptor,\n  RuntimeTargetInstance,\n} from '@prisma-next/framework-components/execution';\nimport { postgresTargetDescriptorMetaRuntime } from '../core/descriptor-meta-runtime';\n\nexport { PostgresContractSerializer } from '../core/postgres-contract-serializer';\n\nexport interface PostgresRuntimeTargetInstance extends RuntimeTargetInstance<'sql', 'postgres'> {}\n\n/**\n * Target-postgres deliberately does NOT import `SqlRuntimeTargetDescriptor` from `@prisma-next/sql-runtime`. The target package is a control-plane residence and must not pull the SQL execution-plane package into its dependency closure. The runtime descriptor here is shaped to satisfy the framework's `RuntimeTargetDescriptor` plus the structural `SqlStaticContributions` (`codecs:` returning a descriptor list) that\n * `@prisma-next/sql-runtime` consumers narrow to at composition time.\n *\n * The target itself contributes no codecs — postgres-specific codecs ship from the postgres adapter and from extension packs (pgvector, arktype-json, etc.).\n */\nconst postgresRuntimeTargetDescriptor: RuntimeTargetDescriptor<\n  'sql',\n  'postgres',\n  PostgresRuntimeTargetInstance\n> & {\n  readonly codecs: () => readonly AnyCodecDescriptor[];\n} = {\n  ...postgresTargetDescriptorMetaRuntime,\n  codecs: () => [],\n  create(): PostgresRuntimeTargetInstance {\n    return {\n      familyId: 'sql',\n      targetId: 'postgres',\n    };\n  },\n};\n\nexport default postgresRuntimeTargetDescriptor;\n"],"mappings":";;;;;;;;;AAiBA,MAAM,kCAMF;CACF,GAAG;CACH,cAAc,CAAC;CACf,SAAwC;EACtC,OAAO;GACL,UAAU;GACV,UAAU;EACZ;CACF;AACF"}
+{"version":3,"file":"runtime.mjs","names":[],"sources":["../src/exports/runtime.ts"],"sourcesContent":["import type { AnyCodecDescriptor } from '@prisma-next/framework-components/codec';\nimport type {\n  RuntimeTargetDescriptor,\n  RuntimeTargetInstance,\n} from '@prisma-next/framework-components/execution';\nimport { postgresTargetDescriptorMetaRuntime } from '../core/descriptor-meta-runtime';\n\nexport { PostgresContractSerializer } from '../core/postgres-contract-serializer';\nexport { PostgresContractView } from '../core/postgres-contract-view';\n\nexport interface PostgresRuntimeTargetInstance extends RuntimeTargetInstance<'sql', 'postgres'> {}\n\n/**\n * Target-postgres deliberately does NOT import `SqlRuntimeTargetDescriptor` from `@prisma-next/sql-runtime`. The target package is a control-plane residence and must not pull the SQL execution-plane package into its dependency closure. The runtime descriptor here is shaped to satisfy the framework's `RuntimeTargetDescriptor` plus the structural `SqlStaticContributions` (`codecs:` returning a descriptor list) that\n * `@prisma-next/sql-runtime` consumers narrow to at composition time.\n *\n * The target itself contributes no codecs — postgres-specific codecs ship from the postgres adapter and from extension packs (pgvector, arktype-json, etc.).\n */\nconst postgresRuntimeTargetDescriptor: RuntimeTargetDescriptor<\n  'sql',\n  'postgres',\n  PostgresRuntimeTargetInstance\n> & {\n  readonly codecs: () => readonly AnyCodecDescriptor[];\n} = {\n  ...postgresTargetDescriptorMetaRuntime,\n  codecs: () => [],\n  create(): PostgresRuntimeTargetInstance {\n    return {\n      familyId: 'sql',\n      targetId: 'postgres',\n    };\n  },\n};\n\nexport default postgresRuntimeTargetDescriptor;\n"],"mappings":";;;;;;;;;AAkBA,MAAM,kCAMF;CACF,GAAG;CACH,cAAc,CAAC;CACf,SAAwC;EACtC,OAAO;GACL,UAAU;GACV,UAAU;EACZ;CACF;AACF"}

package/dist/schema-ir-annotations.d.mts

@@ -0,0 +1,15 @@
+import { SqlStorage } from "@prisma-next/sql-contract/types";
+
+//#region src/core/migrations/resolve-ddl-schema.d.ts
+/**
+ * Given the contract's storage and a namespace id, returns the live Postgres
+ * DDL schema name that namespace maps to. A named Postgres namespace dispatches
+ * to its `ddlSchemaName(storage)`; the unbound sentinel resolves to
+ * `DEFAULT_NAMESPACE_ID` (the search-path default for offline planning); a
+ * bare object payload (used by some tests) falls back to the namespace id
+ * itself.
+ */
+declare function resolveDdlSchemaForNamespaceStorage(storage: SqlStorage, namespaceId: string): string;
+//#endregion
+export { resolveDdlSchemaForNamespaceStorage };
+//# sourceMappingURL=schema-ir-annotations.d.mts.map

package/dist/schema-ir-annotations.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-ir-annotations.d.mts","names":[],"sources":["../src/core/migrations/resolve-ddl-schema.ts"],"mappings":";;;;;AAaA;;;;;;iBAAgB,mCAAA,CACd,OAAA,EAAS,UAAU,EACnB,WAAA"}

package/dist/schema-ir-annotations.mjs

@@ -0,0 +1,2 @@
+import { t as resolveDdlSchemaForNamespaceStorage } from "./resolve-ddl-schema-XyBaaenM.mjs";
+export { resolveDdlSchemaForNamespaceStorage };

package/dist/{sql-utils-DcfMz4MQ.mjs → sql-utils-SU4FDvIV.mjs}

@@ -59,6 +59,15 @@ function qualifyName(schemaName, objectName) {
 	return `${quoteIdentifier(schemaName)}.${quoteIdentifier(objectName)}`;
 }
 /**
+* Quotes a possibly dot-qualified name segment-by-segment:
+* `order_status` -> `"order_status"`, `auth.aal_level` -> `"auth"."aal_level"`.
+* A single-segment name round-trips to exactly {@link quoteIdentifier}; whole-
+* string quoting (`"auth.aal_level"`) would be one wrong identifier.
+*/
+function quoteQualifiedName(name) {
+	return name.split(".").map((segment) => quoteIdentifier(segment)).join(".");
+}
+/**
 * Validates that an enum value doesn't exceed PostgreSQL's label length limit.
 *
 * PostgreSQL enum labels have a maximum length of NAMEDATALEN-1 (63 bytes by default).
@@ -70,9 +79,9 @@ function qualifyName(schemaName, objectName) {
 * @throws {SqlEscapeError} If the value exceeds the maximum length
 */
 function validateEnumValueLength(value, enumTypeName) {
-	if (value.length > MAX_IDENTIFIER_LENGTH) throw new SqlEscapeError(`Enum value "${value.slice(0, 20)}..." for type "${enumTypeName}" exceeds PostgreSQL's ${MAX_IDENTIFIER_LENGTH}-character label limit`, value, "literal");
+	if (new TextEncoder().encode(value).length > MAX_IDENTIFIER_LENGTH) throw new SqlEscapeError(`Enum value "${value.slice(0, 20)}..." for type "${enumTypeName}" exceeds PostgreSQL's ${MAX_IDENTIFIER_LENGTH}-byte label limit`, value, "literal");
 }
 //#endregion
-export { validateEnumValueLength as a, quoteIdentifier as i, escapeLiteral as n, qualifyName as r, SqlEscapeError as t };
+export { quoteQualifiedName as a, quoteIdentifier as i, escapeLiteral as n, validateEnumValueLength as o, qualifyName as r, SqlEscapeError as t };
 
-//# sourceMappingURL=sql-utils-DcfMz4MQ.mjs.map
+//# sourceMappingURL=sql-utils-SU4FDvIV.mjs.map

package/dist/{sql-utils-DcfMz4MQ.mjs.map → sql-utils-SU4FDvIV.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"sql-utils-DcfMz4MQ.mjs","names":[],"sources":["../src/core/sql-utils.ts"],"sourcesContent":["/**\n * Shared SQL utility functions for the Postgres target.\n *\n * These functions handle safe SQL identifier and literal escaping\n * with security validations to prevent injection and encoding issues.\n *\n * They live in `target-postgres` because both the control adapter (used at\n * emit time) and the runtime adapter (used at execute time) need the same\n * escaping/validation behavior, and the target package is the natural shared\n * home that both adapters can depend on without crossing planes.\n */\n\nexport class SqlEscapeError extends Error {\n  constructor(\n    message: string,\n    public readonly value: string,\n    public readonly kind: 'identifier' | 'literal',\n  ) {\n    super(message);\n    this.name = 'SqlEscapeError';\n  }\n}\n\nconst MAX_IDENTIFIER_LENGTH = 63;\n\n/**\n * Validates and quotes a PostgreSQL identifier (table, column, type, schema names).\n *\n * Security validations:\n * - Rejects null bytes which could cause truncation or unexpected behavior\n * - Rejects empty identifiers\n * - Warns on identifiers exceeding PostgreSQL's 63-character limit\n *\n * @throws {SqlEscapeError} If the identifier contains null bytes or is empty\n */\nexport function quoteIdentifier(identifier: string): string {\n  if (identifier.length === 0) {\n    throw new SqlEscapeError('Identifier cannot be empty', identifier, 'identifier');\n  }\n  if (identifier.includes('\\0')) {\n    throw new SqlEscapeError(\n      'Identifier cannot contain null bytes',\n      identifier.replace(/\\0/g, '\\\\0'),\n      'identifier',\n    );\n  }\n  if (identifier.length > MAX_IDENTIFIER_LENGTH) {\n    console.warn(\n      `Identifier \"${identifier.slice(0, 20)}...\" exceeds PostgreSQL's ${MAX_IDENTIFIER_LENGTH}-character limit and will be truncated`,\n    );\n  }\n  return `\"${identifier.replace(/\"/g, '\"\"')}\"`;\n}\n\n/**\n * Escapes a string literal for safe use in SQL statements.\n *\n * Security validations:\n * - Rejects null bytes which could cause truncation or unexpected behavior\n *\n * Note: This assumes PostgreSQL's `standard_conforming_strings` is ON (default since PG 9.1).\n * Backslashes are treated as literal characters, not escape sequences.\n *\n * @throws {SqlEscapeError} If the value contains null bytes\n */\nexport function escapeLiteral(value: string): string {\n  if (value.includes('\\0')) {\n    throw new SqlEscapeError(\n      'Literal value cannot contain null bytes',\n      value.replace(/\\0/g, '\\\\0'),\n      'literal',\n    );\n  }\n  return value.replace(/'/g, \"''\");\n}\n\n/**\n * Builds a qualified name (schema.object) with proper quoting.\n */\nexport function qualifyName(schemaName: string, objectName: string): string {\n  return `${quoteIdentifier(schemaName)}.${quoteIdentifier(objectName)}`;\n}\n\n/**\n * Validates that an enum value doesn't exceed PostgreSQL's label length limit.\n *\n * PostgreSQL enum labels have a maximum length of NAMEDATALEN-1 (63 bytes by default).\n * Unlike identifiers, enum labels that exceed this limit cause an error rather than\n * silent truncation.\n *\n * @param value - The enum value to validate\n * @param enumTypeName - Name of the enum type (for error messages)\n * @throws {SqlEscapeError} If the value exceeds the maximum length\n */\nexport function validateEnumValueLength(value: string, enumTypeName: string): void {\n  if (value.length > MAX_IDENTIFIER_LENGTH) {\n    throw new SqlEscapeError(\n      `Enum value \"${value.slice(0, 20)}...\" for type \"${enumTypeName}\" exceeds PostgreSQL's ` +\n        `${MAX_IDENTIFIER_LENGTH}-character label limit`,\n      value,\n      'literal',\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAYA,IAAa,iBAAb,cAAoC,MAAM;CAGtB;CACA;CAHlB,YACE,SACA,OACA,MACA;EACA,MAAM,OAAO;EAHG,KAAA,QAAA;EACA,KAAA,OAAA;EAGhB,KAAK,OAAO;CACd;AACF;AAEA,MAAM,wBAAwB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,YAA4B;CAC1D,IAAI,WAAW,WAAW,GACxB,MAAM,IAAI,eAAe,8BAA8B,YAAY,YAAY;CAEjF,IAAI,WAAW,SAAS,IAAI,GAC1B,MAAM,IAAI,eACR,wCACA,WAAW,QAAQ,OAAO,KAAK,GAC/B,YACF;CAEF,IAAI,WAAW,SAAS,uBACtB,QAAQ,KACN,eAAe,WAAW,MAAM,GAAG,EAAE,EAAE,4BAA4B,sBAAsB,uCAC3F;CAEF,OAAO,IAAI,WAAW,QAAQ,MAAM,MAAI,EAAE;AAC5C;;;;;;;;;;;;AAaA,SAAgB,cAAc,OAAuB;CACnD,IAAI,MAAM,SAAS,IAAI,GACrB,MAAM,IAAI,eACR,2CACA,MAAM,QAAQ,OAAO,KAAK,GAC1B,SACF;CAEF,OAAO,MAAM,QAAQ,MAAM,IAAI;AACjC;;;;AAKA,SAAgB,YAAY,YAAoB,YAA4B;CAC1E,OAAO,GAAG,gBAAgB,UAAU,EAAE,GAAG,gBAAgB,UAAU;AACrE;;;;;;;;;;;;AAaA,SAAgB,wBAAwB,OAAe,cAA4B;CACjF,IAAI,MAAM,SAAS,uBACjB,MAAM,IAAI,eACR,eAAe,MAAM,MAAM,GAAG,EAAE,EAAE,iBAAiB,aAAa,yBAC3D,sBAAsB,yBAC3B,OACA,SACF;AAEJ"}
+{"version":3,"file":"sql-utils-SU4FDvIV.mjs","names":[],"sources":["../src/core/sql-utils.ts"],"sourcesContent":["/**\n * Shared SQL utility functions for the Postgres target.\n *\n * These functions handle safe SQL identifier and literal escaping\n * with security validations to prevent injection and encoding issues.\n *\n * They live in `target-postgres` because both the control adapter (used at\n * emit time) and the runtime adapter (used at execute time) need the same\n * escaping/validation behavior, and the target package is the natural shared\n * home that both adapters can depend on without crossing planes.\n */\n\nexport class SqlEscapeError extends Error {\n  constructor(\n    message: string,\n    public readonly value: string,\n    public readonly kind: 'identifier' | 'literal',\n  ) {\n    super(message);\n    this.name = 'SqlEscapeError';\n  }\n}\n\nconst MAX_IDENTIFIER_LENGTH = 63;\n\n/**\n * Validates and quotes a PostgreSQL identifier (table, column, type, schema names).\n *\n * Security validations:\n * - Rejects null bytes which could cause truncation or unexpected behavior\n * - Rejects empty identifiers\n * - Warns on identifiers exceeding PostgreSQL's 63-character limit\n *\n * @throws {SqlEscapeError} If the identifier contains null bytes or is empty\n */\nexport function quoteIdentifier(identifier: string): string {\n  if (identifier.length === 0) {\n    throw new SqlEscapeError('Identifier cannot be empty', identifier, 'identifier');\n  }\n  if (identifier.includes('\\0')) {\n    throw new SqlEscapeError(\n      'Identifier cannot contain null bytes',\n      identifier.replace(/\\0/g, '\\\\0'),\n      'identifier',\n    );\n  }\n  if (identifier.length > MAX_IDENTIFIER_LENGTH) {\n    console.warn(\n      `Identifier \"${identifier.slice(0, 20)}...\" exceeds PostgreSQL's ${MAX_IDENTIFIER_LENGTH}-character limit and will be truncated`,\n    );\n  }\n  return `\"${identifier.replace(/\"/g, '\"\"')}\"`;\n}\n\n/**\n * Escapes a string literal for safe use in SQL statements.\n *\n * Security validations:\n * - Rejects null bytes which could cause truncation or unexpected behavior\n *\n * Note: This assumes PostgreSQL's `standard_conforming_strings` is ON (default since PG 9.1).\n * Backslashes are treated as literal characters, not escape sequences.\n *\n * @throws {SqlEscapeError} If the value contains null bytes\n */\nexport function escapeLiteral(value: string): string {\n  if (value.includes('\\0')) {\n    throw new SqlEscapeError(\n      'Literal value cannot contain null bytes',\n      value.replace(/\\0/g, '\\\\0'),\n      'literal',\n    );\n  }\n  return value.replace(/'/g, \"''\");\n}\n\n/**\n * Builds a qualified name (schema.object) with proper quoting.\n */\nexport function qualifyName(schemaName: string, objectName: string): string {\n  return `${quoteIdentifier(schemaName)}.${quoteIdentifier(objectName)}`;\n}\n\n/**\n * Quotes a possibly dot-qualified name segment-by-segment:\n * `order_status` -> `\"order_status\"`, `auth.aal_level` -> `\"auth\".\"aal_level\"`.\n * A single-segment name round-trips to exactly {@link quoteIdentifier}; whole-\n * string quoting (`\"auth.aal_level\"`) would be one wrong identifier.\n */\nexport function quoteQualifiedName(name: string): string {\n  return name\n    .split('.')\n    .map((segment) => quoteIdentifier(segment))\n    .join('.');\n}\n\n/**\n * Validates that an enum value doesn't exceed PostgreSQL's label length limit.\n *\n * PostgreSQL enum labels have a maximum length of NAMEDATALEN-1 (63 bytes by default).\n * Unlike identifiers, enum labels that exceed this limit cause an error rather than\n * silent truncation.\n *\n * @param value - The enum value to validate\n * @param enumTypeName - Name of the enum type (for error messages)\n * @throws {SqlEscapeError} If the value exceeds the maximum length\n */\nexport function validateEnumValueLength(value: string, enumTypeName: string): void {\n  if (new TextEncoder().encode(value).length > MAX_IDENTIFIER_LENGTH) {\n    throw new SqlEscapeError(\n      `Enum value \"${value.slice(0, 20)}...\" for type \"${enumTypeName}\" exceeds PostgreSQL's ` +\n        `${MAX_IDENTIFIER_LENGTH}-byte label limit`,\n      value,\n      'literal',\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAYA,IAAa,iBAAb,cAAoC,MAAM;CAGtB;CACA;CAHlB,YACE,SACA,OACA,MACA;EACA,MAAM,OAAO;EAHG,KAAA,QAAA;EACA,KAAA,OAAA;EAGhB,KAAK,OAAO;CACd;AACF;AAEA,MAAM,wBAAwB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,YAA4B;CAC1D,IAAI,WAAW,WAAW,GACxB,MAAM,IAAI,eAAe,8BAA8B,YAAY,YAAY;CAEjF,IAAI,WAAW,SAAS,IAAI,GAC1B,MAAM,IAAI,eACR,wCACA,WAAW,QAAQ,OAAO,KAAK,GAC/B,YACF;CAEF,IAAI,WAAW,SAAS,uBACtB,QAAQ,KACN,eAAe,WAAW,MAAM,GAAG,EAAE,EAAE,4BAA4B,sBAAsB,uCAC3F;CAEF,OAAO,IAAI,WAAW,QAAQ,MAAM,MAAI,EAAE;AAC5C;;;;;;;;;;;;AAaA,SAAgB,cAAc,OAAuB;CACnD,IAAI,MAAM,SAAS,IAAI,GACrB,MAAM,IAAI,eACR,2CACA,MAAM,QAAQ,OAAO,KAAK,GAC1B,SACF;CAEF,OAAO,MAAM,QAAQ,MAAM,IAAI;AACjC;;;;AAKA,SAAgB,YAAY,YAAoB,YAA4B;CAC1E,OAAO,GAAG,gBAAgB,UAAU,EAAE,GAAG,gBAAgB,UAAU;AACrE;;;;;;;AAQA,SAAgB,mBAAmB,MAAsB;CACvD,OAAO,KACJ,MAAM,GAAG,CAAC,CACV,KAAK,YAAY,gBAAgB,OAAO,CAAC,CAAC,CAC1C,KAAK,GAAG;AACb;;;;;;;;;;;;AAaA,SAAgB,wBAAwB,OAAe,cAA4B;CACjF,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,SAAS,uBAC3C,MAAM,IAAI,eACR,eAAe,MAAM,MAAM,GAAG,EAAE,EAAE,iBAAiB,aAAa,yBAC3D,sBAAsB,oBAC3B,OACA,SACF;AAEJ"}

package/dist/sql-utils.d.mts

@@ -42,6 +42,13 @@ declare function escapeLiteral(value: string): string;
  * Builds a qualified name (schema.object) with proper quoting.
  */
 declare function qualifyName(schemaName: string, objectName: string): string;
+/**
+ * Quotes a possibly dot-qualified name segment-by-segment:
+ * `order_status` -> `"order_status"`, `auth.aal_level` -> `"auth"."aal_level"`.
+ * A single-segment name round-trips to exactly {@link quoteIdentifier}; whole-
+ * string quoting (`"auth.aal_level"`) would be one wrong identifier.
+ */
+declare function quoteQualifiedName(name: string): string;
 /**
  * Validates that an enum value doesn't exceed PostgreSQL's label length limit.
  *
@@ -55,5 +62,5 @@ declare function qualifyName(schemaName: string, objectName: string): string;
  */
 declare function validateEnumValueLength(value: string, enumTypeName: string): void;
 //#endregion
-export { SqlEscapeError, escapeLiteral, qualifyName, quoteIdentifier, validateEnumValueLength };
+export { SqlEscapeError, escapeLiteral, qualifyName, quoteIdentifier, quoteQualifiedName, validateEnumValueLength };
 //# sourceMappingURL=sql-utils.d.mts.map

package/dist/sql-utils.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-utils.d.mts","names":[],"sources":["../src/core/sql-utils.ts"],"mappings":";;AAYA;;;;;;;;;;cAAa,cAAA,SAAuB,KAAK;EAAA,SAGrB,KAAA;EAAA,SACA,IAAA;cAFhB,OAAA,UACgB,KAAA,UACA,IAAA;AAAA;;;AAmB8B;AA8BlD;;;;AAA2C;AAc3C;;iBA5CgB,eAAA,CAAgB,UAAkB;;AA4CgB;AAelE;;;;AAA2E;;;;;iBA7B3D,aAAA,CAAc,KAAa;;;;iBAc3B,WAAA,CAAY,UAAA,UAAoB,UAAkB;;;;;;;;;;;;iBAelD,uBAAA,CAAwB,KAAA,UAAe,YAAoB"}
+{"version":3,"file":"sql-utils.d.mts","names":[],"sources":["../src/core/sql-utils.ts"],"mappings":";;AAYA;;;;;;;;;;cAAa,cAAA,SAAuB,KAAK;EAAA,SAGrB,KAAA;EAAA,SACA,IAAA;cAFhB,OAAA,UACgB,KAAA,UACA,IAAA;AAAA;;;AAmB8B;AA8BlD;;;;AAA2C;AAc3C;;iBA5CgB,eAAA,CAAgB,UAAkB;;AA4CgB;AAUlE;;;;AAA+C;AAkB/C;;;;iBA1CgB,aAAA,CAAc,KAAa;;;;iBAc3B,WAAA,CAAY,UAAA,UAAoB,UAAkB;;;;;;;iBAUlD,kBAAA,CAAmB,IAAY;;;;;;;;;;;;iBAkB/B,uBAAA,CAAwB,KAAA,UAAe,YAAoB"}

package/dist/sql-utils.mjs

@@ -1,2 +1,2 @@
-import { a as validateEnumValueLength, i as quoteIdentifier, n as escapeLiteral, r as qualifyName, t as SqlEscapeError } from "./sql-utils-DcfMz4MQ.mjs";
-export { SqlEscapeError, escapeLiteral, qualifyName, quoteIdentifier, validateEnumValueLength };
+import { a as quoteQualifiedName, i as quoteIdentifier, n as escapeLiteral, o as validateEnumValueLength, r as qualifyName, t as SqlEscapeError } from "./sql-utils-SU4FDvIV.mjs";
+export { SqlEscapeError, escapeLiteral, qualifyName, quoteIdentifier, quoteQualifiedName, validateEnumValueLength };

package/dist/types.d.mts

@@ -1,141 +1,5 @@
-import { t as PostgresTableSource } from "./table-source-BvFo7gVs.mjs";
+import { a as PostgresNamespaceSchemaNode, c as PostgresTableSchemaNodeInput, d as PostgresNativeEnumSchemaNode, f as PostgresNativeEnumSchemaNodeInput, i as PostgresRoleSchemaNodeInput, l as PostgresPolicySchemaNode, n as PostgresDatabaseSchemaNodeInput, o as PostgresNamespaceSchemaNodeInput, r as PostgresRoleSchemaNode, s as PostgresTableSchemaNode, t as PostgresDatabaseSchemaNode, u as PostgresPolicySchemaNodeInput } from "./postgres-database-schema-node-CJv5bfbs.mjs";
+import { n as PostgresRlsPolicyInput, r as RlsPolicyOperation, t as PostgresRlsPolicy } from "./postgres-rls-policy--CSddvMR.mjs";
 import { t as PostgresColumnDefault } from "./types-BDKkx8MA.mjs";
-import { NamespaceBase } from "@prisma-next/framework-components/ir";
-import { CfExpr } from "@prisma-next/sql-relational-core/contract-free";
-import { SqlNamespaceEntries, SqlNamespaceTablesInput, SqlStorage, StorageTable, StorageValueSet } from "@prisma-next/sql-contract/types";
-
-//#region src/core/postgres-schema.d.ts
-interface PostgresSchemaInput {
-  readonly id: string;
-  readonly entries: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
-}
-/**
- * Postgres target `Namespace` concretion — a Postgres schema (`CREATE
- * SCHEMA …`). Each Postgres `SqlStorage` carries a
- * `namespaces: Record<NamespaceId, PostgresSchema>` map populated by
- * the Postgres PSL interpreter from `namespace { … }` AST buckets.
- *
- * `entries` holds entity-kind maps (`table`, `valueSet`). Qualifier
- * emission is the rendering seam: DDL / SQL emission asks the namespace
- * for its qualifier (`"<schema>"`) or for a qualified table name
- * (`"<schema>"."<table>"`) and consumes the result polymorphically.
- * The unbound singleton below overrides these methods to elide the
- * prefix entirely — call sites stay polymorphic and never branch on
- * `id === UNBOUND_NAMESPACE_ID`.
- */
-declare class PostgresSchema extends NamespaceBase {
-  /**
-   * Stable singleton reference for the late-bound slot. Materialised
-   * lazily below the singleton subclass declaration so the static
-   * initialiser sees the subclass before assigning. Consumers always
-   * reach for `PostgresSchema.unbound` (or `PostgresUnboundSchema.instance`
-   * — same identity).
-   */
-  static unbound: PostgresUnboundSchema;
-  readonly kind: 'schema';
-  readonly id: string;
-  readonly entries: SqlNamespaceEntries;
-  constructor(input: PostgresSchemaInput);
-  get table(): Readonly<Record<string, StorageTable>>;
-  get valueSet(): Readonly<Record<string, StorageValueSet>> | undefined;
-  /**
-   * The bare schema qualifier as it would appear in a rendered SQL
-   * fragment (already quoted). The unbound-schema singleton overrides
-   * this to return `''`.
-   */
-  qualifier(): string;
-  /**
-   * Qualify a table name with the schema prefix
-   * (`"<schema>"."<table>"`). The unbound-schema singleton overrides
-   * this to emit just `"<table>"` so the resolved DDL is unqualified
-   * and `search_path` decides where the object lands at runtime.
-   */
-  qualifyTable(tableName: string): string;
-  /**
-   * Render a SQL string-literal containing the qualified-name form
-   * suitable for `to_regclass(...)` arguments (e.g. `'"public"."user"'`).
-   * The unbound singleton overrides this to elide the schema prefix
-   * (`'"user"'`) so `search_path` resolves the object at runtime.
-   */
-  regclassLiteral(name: string): string;
-  /**
-   * Render a SQL expression that evaluates to this namespace's schema
-   * name at runtime, ready to drop into a `WHERE table_schema = …` /
-   * `WHERE n.nspname = …` clause. Named schemas emit a quoted SQL
-   * literal (`'public'`); the unbound singleton overrides this to emit
-   * `current_schema()` so catalog queries match whichever schema the
-   * connection's `search_path` resolved at runtime.
-   */
-  schemaSqlExpression(): string;
-  /**
-   * Typed-AST counterpart of {@link schemaSqlExpression}: the expression a
-   * builder-built catalog check compares `n.nspname` / `table_schema`
-   * against. Named schemas bind the schema name as a text parameter; the
-   * unbound singleton overrides this to the opaque `current_schema()`
-   * expression so the live connection's `search_path` decides at runtime.
-   */
-  schemaFilterExpression(): CfExpr;
-  /**
-   * Typed-AST counterpart of {@link qualifyTable}: the FROM source a
-   * builder-built check uses to address a user table in this namespace.
-   * Named schemas qualify (`"schema"."table"`); the unbound singleton
-   * overrides this to leave the table unqualified so `search_path`
-   * resolves it at runtime.
-   */
-  tableSource(tableName: string, alias?: string): PostgresTableSource;
-  /**
-   * The bare schema name a DDL planner should target when emitting
-   * statements that need to identify this namespace in the live
-   * database (e.g. `CREATE TABLE "<ddlSchemaName>"."<table>" …`,
-   * catalog filters, planner conflict lookups). Named schemas resolve
-   * to their own id. The `PostgresUnboundSchema` singleton inherits
-   * this and returns `UNBOUND_NAMESPACE_ID` — callers that dispatch
-   * through `qualifyTableName` route through the polymorphic
-   * `PostgresUnboundSchema` overrides and produce unqualified
-   * (search-path-resolved) output automatically.
-   */
-  ddlSchemaName(_storage: SqlStorage): string;
-}
-/**
- * Singleton subclass for the reserved sentinel namespace id
- * (`UNBOUND_NAMESPACE_ID`) — the late-bound Postgres slot whose binding
- * the connection's `search_path` resolves at runtime. Overrides
- * qualifier emission to elide the schema prefix; call sites that consume
- * `qualifier()` / `qualifyTable()` get unqualified output without
- * branching on the namespace id.
- *
- * This is the target-side materialization of "the framework provides
- * affordances; targets implement specifics": the framework names the
- * sentinel; Postgres decides what late-bound means here (the table
- * name, naked — the schema is supplied by the live connection's
- * `search_path`).
- *
- * `ddlSchemaName` is inherited from `PostgresSchema` and returns
- * `UNBOUND_NAMESPACE_ID`. Downstream helpers such as `qualifyTableName`
- * route through the polymorphic factory and produce unqualified output
- * automatically.
- */
-declare class PostgresUnboundSchema extends PostgresSchema {
-  static readonly instance: PostgresUnboundSchema;
-  constructor(input?: PostgresSchemaInput);
-  qualifier(): string;
-  qualifyTable(tableName: string): string;
-  schemaSqlExpression(): string;
-  schemaFilterExpression(): CfExpr;
-  tableSource(tableName: string, alias?: string): PostgresTableSource;
-}
-/**
- * Target-supplied `Namespace` factory the Postgres target plumbs
- * through `defineContract({ createNamespace })` and the SQL PSL
- * interpreter. Returns the unbound singleton for the framework
- * sentinel and a fresh `PostgresSchema` for any other coordinate.
- *
- * The factory has no per-call state — every named id deterministically
- * maps to a distinct schema instance — so callers can pass it through
- * by reference and trust the resulting `SqlStorage.namespaces` map to
- * be value-stable for a given input set.
- */
-declare function postgresCreateNamespace(input: SqlNamespaceTablesInput): PostgresSchema;
-//#endregion
-export { type PostgresColumnDefault, PostgresSchema, PostgresUnboundSchema, postgresCreateNamespace };
-//# sourceMappingURL=types.d.mts.map
+import { a as postgresCreateNamespace, c as PostgresRlsEnablement, d as PostgresNativeEnumInput, i as isPostgresSchema, l as PostgresRlsEnablementInput, n as PostgresSchema, o as PostgresRole, r as PostgresUnboundSchema, s as PostgresRoleInput, t as PostgresContract, u as PostgresNativeEnum } from "./postgres-schema-DKq6s1P3.mjs";
+export { type PostgresColumnDefault, type PostgresContract, PostgresDatabaseSchemaNode, type PostgresDatabaseSchemaNodeInput, PostgresNamespaceSchemaNode, type PostgresNamespaceSchemaNodeInput, PostgresNativeEnum, type PostgresNativeEnumInput, PostgresNativeEnumSchemaNode, type PostgresNativeEnumSchemaNodeInput, PostgresPolicySchemaNode, type PostgresPolicySchemaNodeInput, PostgresRlsEnablement, type PostgresRlsEnablementInput, PostgresRlsPolicy, type PostgresRlsPolicyInput, PostgresRole, type PostgresRoleInput, PostgresRoleSchemaNode, type PostgresRoleSchemaNodeInput, PostgresSchema, PostgresTableSchemaNode, type PostgresTableSchemaNodeInput, PostgresUnboundSchema, type RlsPolicyOperation, isPostgresSchema, postgresCreateNamespace };

package/dist/types.mjs

@@ -1,2 +1,5 @@
-import { i as postgresCreateNamespace, n as PostgresUnboundSchema, t as PostgresSchema } from "./postgres-schema-COGZ1ark.mjs";
-export { PostgresSchema, PostgresUnboundSchema, postgresCreateNamespace };
+import { t as PostgresNativeEnum } from "./postgres-native-enum-BwVNf0Ku.mjs";
+import { _ as PostgresRlsEnablement, g as PostgresRlsPolicy, i as postgresCreateNamespace, m as PostgresRole, n as PostgresUnboundSchema, r as isPostgresSchema, t as PostgresSchema } from "./postgres-schema-Cm4DtiGA.mjs";
+import { n as PostgresNativeEnumSchemaNode, t as PostgresTableSchemaNode } from "./postgres-table-schema-node-D6LvInCe.mjs";
+import { i as PostgresDatabaseSchemaNode, n as PostgresPolicySchemaNode, r as PostgresNamespaceSchemaNode, t as PostgresRoleSchemaNode } from "./postgres-role-schema-node-Cm-j0ZGM.mjs";
+export { PostgresDatabaseSchemaNode, PostgresNamespaceSchemaNode, PostgresNativeEnum, PostgresNativeEnumSchemaNode, PostgresPolicySchemaNode, PostgresRlsEnablement, PostgresRlsPolicy, PostgresRole, PostgresRoleSchemaNode, PostgresSchema, PostgresTableSchemaNode, PostgresUnboundSchema, isPostgresSchema, postgresCreateNamespace };

package/dist/wire-name-DbQ9-2RC.mjs

@@ -0,0 +1,104 @@
+import { createHash } from "node:crypto";
+//#region src/core/rls/canonicalize.ts
+/**
+* Which predicate each RLS operation admits, mirroring Postgres: SELECT and
+* DELETE decide row visibility/eligibility with `USING` only; INSERT
+* validates the new row with `WITH CHECK` only; UPDATE and ALL take either
+* or both. Single-homed here so the PSL lowering and the TS handle
+* constructors enforce the same matrix.
+*/
+const POLICY_OPERATION_PREDICATES = {
+	select: {
+		using: true,
+		withCheck: false
+	},
+	insert: {
+		using: false,
+		withCheck: true
+	},
+	update: {
+		using: true,
+		withCheck: true
+	},
+	delete: {
+		using: true,
+		withCheck: false
+	},
+	all: {
+		using: true,
+		withCheck: true
+	}
+};
+/**
+* Stabilizes an authored predicate for hashing: trim, and collapse runs of
+* internal whitespace to a single space.
+*
+* This is deliberately minimal. The content hash is the equivalence relation
+* for a policy, and the wire name (prefix + hash) is the only thing ever
+* compared — we never recompute the hash from an introspected policy body, so
+* there is no need to match Postgres's reprinted form. Minimal normalization
+* also protects the no-collision property: aggressive rewriting (lowercasing,
+* paren-stripping, cast-alias folding) risks collapsing two distinct predicates
+* onto one hash. Out-of-band alteration of a hashed policy is unsupported.
+*
+* The normalizer is a stability commitment: any change re-suffixes all wire names.
+*/
+function normalizePredicate(sql) {
+	return sql.replace(/\s+/g, " ").trim();
+}
+/**
+* Returns the first 8 lowercase hex characters of the SHA-256 digest over the
+* canonical content tuple for an RLS policy:
+*
+*   [normalize(using), normalize(withCheck), sortedRoles, operation, permissive]
+*
+* Schema and table are excluded (they are orthogonal to policy equivalence).
+* Uses `JSON.stringify` for a deterministic encoding.
+*/
+function computeContentHash(parts) {
+	const using = normalizePredicate(parts.using ?? "");
+	const withCheck = normalizePredicate(parts.withCheck ?? "");
+	const roles = [...new Set(parts.roles)].sort();
+	const permissive = parts.permissive ? "permissive" : "restrictive";
+	const tuple = JSON.stringify([
+		using,
+		withCheck,
+		roles,
+		parts.operation,
+		permissive
+	]);
+	return createHash("sha256").update(tuple).digest("hex").slice(0, 8);
+}
+//#endregion
+//#region src/core/rls/wire-name.ts
+const WIRE_NAME_PATTERN = /^(.+)_([0-9a-f]{8})$/;
+/**
+* Assembles an RLS policy wire name from its user-supplied prefix and its
+* 8-hex content-hash suffix. This module owns the `<prefix>_<hash>` format
+* on both sides — construction here and parsing in
+* {@link parseRlsPolicyWireName} — so the two never drift.
+*/
+function formatRlsPolicyWireName(prefix, hash) {
+	return `${prefix}_${hash}`;
+}
+/**
+* Splits an RLS policy wire name (`<prefix>_<8hex>`) into its prefix and
+* content-hash suffix. Returns `undefined` when the name does not follow the
+* wire-name shape (e.g. a policy created outside the toolchain) — callers
+* treat such names as all-prefix. Consumed by introspection (prefix
+* extraction) and by rename pairing (same hash, different prefix).
+*/
+function parseRlsPolicyWireName(name) {
+	const match = WIRE_NAME_PATTERN.exec(name);
+	const prefix = match?.[1];
+	const hash = match?.[2];
+	if (prefix === void 0 || hash === void 0) return void 0;
+	return {
+		prefix,
+		hash
+	};
+}
+//#endregion
+export { normalizePredicate as a, computeContentHash as i, parseRlsPolicyWireName as n, POLICY_OPERATION_PREDICATES as r, formatRlsPolicyWireName as t };
+
+//# sourceMappingURL=wire-name-DbQ9-2RC.mjs.map

package/dist/wire-name-DbQ9-2RC.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-name-DbQ9-2RC.mjs","names":[],"sources":["../src/core/rls/canonicalize.ts","../src/core/rls/wire-name.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nexport type RlsPolicyOperation = 'select' | 'insert' | 'update' | 'delete' | 'all';\n\n/**\n * Which predicate each RLS operation admits, mirroring Postgres: SELECT and\n * DELETE decide row visibility/eligibility with `USING` only; INSERT\n * validates the new row with `WITH CHECK` only; UPDATE and ALL take either\n * or both. Single-homed here so the PSL lowering and the TS handle\n * constructors enforce the same matrix.\n */\nexport const POLICY_OPERATION_PREDICATES: Readonly<\n  Record<RlsPolicyOperation, { readonly using: boolean; readonly withCheck: boolean }>\n> = {\n  select: { using: true, withCheck: false },\n  insert: { using: false, withCheck: true },\n  update: { using: true, withCheck: true },\n  delete: { using: true, withCheck: false },\n  all: { using: true, withCheck: true },\n};\n\nexport interface ContentHashParts {\n  readonly using?: string;\n  readonly withCheck?: string;\n  readonly roles: readonly string[];\n  readonly operation: RlsPolicyOperation;\n  readonly permissive: boolean;\n}\n\n/**\n * Stabilizes an authored predicate for hashing: trim, and collapse runs of\n * internal whitespace to a single space.\n *\n * This is deliberately minimal. The content hash is the equivalence relation\n * for a policy, and the wire name (prefix + hash) is the only thing ever\n * compared — we never recompute the hash from an introspected policy body, so\n * there is no need to match Postgres's reprinted form. Minimal normalization\n * also protects the no-collision property: aggressive rewriting (lowercasing,\n * paren-stripping, cast-alias folding) risks collapsing two distinct predicates\n * onto one hash. Out-of-band alteration of a hashed policy is unsupported.\n *\n * The normalizer is a stability commitment: any change re-suffixes all wire names.\n */\nexport function normalizePredicate(sql: string): string {\n  return sql.replace(/\\s+/g, ' ').trim();\n}\n\n/**\n * Returns the first 8 lowercase hex characters of the SHA-256 digest over the\n * canonical content tuple for an RLS policy:\n *\n *   [normalize(using), normalize(withCheck), sortedRoles, operation, permissive]\n *\n * Schema and table are excluded (they are orthogonal to policy equivalence).\n * Uses `JSON.stringify` for a deterministic encoding.\n */\nexport function computeContentHash(parts: ContentHashParts): string {\n  const using = normalizePredicate(parts.using ?? '');\n  const withCheck = normalizePredicate(parts.withCheck ?? '');\n  const roles = [...new Set(parts.roles)].sort();\n  const permissive = parts.permissive ? 'permissive' : 'restrictive';\n\n  const tuple = JSON.stringify([using, withCheck, roles, parts.operation, permissive]);\n  return createHash('sha256').update(tuple).digest('hex').slice(0, 8);\n}\n","export interface RlsPolicyWireName {\n  /** The user-supplied part before the `_<8hex>` suffix. */\n  readonly prefix: string;\n  /** The 8-lowercase-hex content-hash suffix. */\n  readonly hash: string;\n}\n\nconst WIRE_NAME_PATTERN = /^(.+)_([0-9a-f]{8})$/;\n\n/**\n * Assembles an RLS policy wire name from its user-supplied prefix and its\n * 8-hex content-hash suffix. This module owns the `<prefix>_<hash>` format\n * on both sides — construction here and parsing in\n * {@link parseRlsPolicyWireName} — so the two never drift.\n */\nexport function formatRlsPolicyWireName(prefix: string, hash: string): string {\n  return `${prefix}_${hash}`;\n}\n\n/**\n * Splits an RLS policy wire name (`<prefix>_<8hex>`) into its prefix and\n * content-hash suffix. Returns `undefined` when the name does not follow the\n * wire-name shape (e.g. a policy created outside the toolchain) — callers\n * treat such names as all-prefix. Consumed by introspection (prefix\n * extraction) and by rename pairing (same hash, different prefix).\n */\nexport function parseRlsPolicyWireName(name: string): RlsPolicyWireName | undefined {\n  const match = WIRE_NAME_PATTERN.exec(name);\n  const prefix = match?.[1];\n  const hash = match?.[2];\n  if (prefix === undefined || hash === undefined) return undefined;\n  return { prefix, hash };\n}\n"],"mappings":";;;;;;;;;AAWA,MAAa,8BAET;CACF,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAM;CACxC,QAAQ;EAAE,OAAO;EAAO,WAAW;CAAK;CACxC,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAK;CACvC,QAAQ;EAAE,OAAO;EAAM,WAAW;CAAM;CACxC,KAAK;EAAE,OAAO;EAAM,WAAW;CAAK;AACtC;;;;;;;;;;;;;;;AAwBA,SAAgB,mBAAmB,KAAqB;CACtD,OAAO,IAAI,QAAQ,QAAQ,GAAG,CAAC,CAAC,KAAK;AACvC;;;;;;;;;;AAWA,SAAgB,mBAAmB,OAAiC;CAClE,MAAM,QAAQ,mBAAmB,MAAM,SAAS,EAAE;CAClD,MAAM,YAAY,mBAAmB,MAAM,aAAa,EAAE;CAC1D,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CAC7C,MAAM,aAAa,MAAM,aAAa,eAAe;CAErD,MAAM,QAAQ,KAAK,UAAU;EAAC;EAAO;EAAW;EAAO,MAAM;EAAW;CAAU,CAAC;CACnF,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;AACpE;;;ACzDA,MAAM,oBAAoB;;;;;;;AAQ1B,SAAgB,wBAAwB,QAAgB,MAAsB;CAC5E,OAAO,GAAG,OAAO,GAAG;AACtB;;;;;;;;AASA,SAAgB,uBAAuB,MAA6C;CAClF,MAAM,QAAQ,kBAAkB,KAAK,IAAI;CACzC,MAAM,SAAS,QAAQ;CACvB,MAAM,OAAO,QAAQ;CACrB,IAAI,WAAW,KAAA,KAAa,SAAS,KAAA,GAAW,OAAO,KAAA;CACvD,OAAO;EAAE;EAAQ;CAAK;AACxB"}

package/package.json

@@ -1,35 +1,38 @@
 {
   "name": "@prisma-next/target-postgres",
-  "version": "0.14.0-dev.9",
+  "version": "0.14.0-dev.90",
   "license": "Apache-2.0",
   "type": "module",
   "sideEffects": false,
   "description": "Postgres target pack for Prisma Next",
   "dependencies": {
-    "@prisma-next/cli": "0.14.0-dev.9",
-    "@prisma-next/contract": "0.14.0-dev.9",
-    "@prisma-next/errors": "0.14.0-dev.9",
-    "@prisma-next/family-sql": "0.14.0-dev.9",
-    "@prisma-next/framework-components": "0.14.0-dev.9",
-    "@prisma-next/migration-tools": "0.14.0-dev.9",
-    "@prisma-next/ts-render": "0.14.0-dev.9",
-    "@prisma-next/sql-contract": "0.14.0-dev.9",
-    "@prisma-next/sql-errors": "0.14.0-dev.9",
-    "@prisma-next/sql-operations": "0.14.0-dev.9",
-    "@prisma-next/sql-relational-core": "0.14.0-dev.9",
-    "@prisma-next/sql-schema-ir": "0.14.0-dev.9",
-    "@prisma-next/utils": "0.14.0-dev.9",
+    "@prisma-next/cli": "0.14.0-dev.90",
+    "@prisma-next/contract": "0.14.0-dev.90",
+    "@prisma-next/errors": "0.14.0-dev.90",
+    "@prisma-next/family-sql": "0.14.0-dev.90",
+    "@prisma-next/framework-components": "0.14.0-dev.90",
+    "@prisma-next/migration-tools": "0.14.0-dev.90",
+    "@prisma-next/psl-parser": "0.14.0-dev.90",
+    "@prisma-next/sql-contract": "0.14.0-dev.90",
+    "@prisma-next/sql-errors": "0.14.0-dev.90",
+    "@prisma-next/sql-operations": "0.14.0-dev.90",
+    "@prisma-next/sql-relational-core": "0.14.0-dev.90",
+    "@prisma-next/sql-schema-ir": "0.14.0-dev.90",
+    "@prisma-next/ts-render": "0.14.0-dev.90",
+    "@prisma-next/utils": "0.14.0-dev.90",
     "@standard-schema/spec": "^1.1.0",
-    "arktype": "^2.2.0",
+    "arktype": "^2.2.2",
     "pathe": "^2.0.3"
   },
   "devDependencies": {
-    "@prisma-next/test-utils": "0.14.0-dev.9",
-    "@prisma-next/tsconfig": "0.14.0-dev.9",
-    "@prisma-next/tsdown": "0.14.0-dev.9",
-    "tsdown": "0.22.1",
+    "@prisma-next/psl-printer": "0.14.0-dev.90",
+    "@prisma-next/sql-contract-psl": "0.14.0-dev.90",
+    "@prisma-next/test-utils": "0.14.0-dev.90",
+    "@prisma-next/tsconfig": "0.14.0-dev.90",
+    "@prisma-next/tsdown": "0.14.0-dev.90",
+    "tsdown": "0.22.3",
     "typescript": "5.9.3",
-    "vitest": "4.1.8"
+    "vitest": "4.1.10"
   },
   "peerDependencies": {
     "typescript": ">=5.9"
@@ -53,6 +56,7 @@
     "./data-transform": "./dist/data-transform.mjs",
     "./ddl": "./dist/ddl.mjs",
     "./default-normalizer": "./dist/default-normalizer.mjs",
+    "./diff-database-schema": "./dist/diff-database-schema.mjs",
     "./errors": "./dist/errors.mjs",
     "./issue-planner": "./dist/issue-planner.mjs",
     "./migration": "./dist/migration.mjs",
@@ -68,7 +72,9 @@
     "./planner-target-details": "./dist/planner-target-details.mjs",
     "./render-ops": "./dist/render-ops.mjs",
     "./render-typescript": "./dist/render-typescript.mjs",
+    "./rls-canonicalize": "./dist/rls-canonicalize.mjs",
     "./runtime": "./dist/runtime.mjs",
+    "./schema-ir-annotations": "./dist/schema-ir-annotations.mjs",
     "./sql-utils": "./dist/sql-utils.mjs",
     "./types": "./dist/types.mjs",
     "./package.json": "./package.json"