@prisma-next/target-postgres 0.15.0 → 0.16.0-dev.2

package/src/core/migrations/planner-produced-postgres-migration.ts

@@ -15,7 +15,7 @@
  * Placeholder-bearing plans: `renderTypeScript()` always succeeds and embeds
  * `() => placeholder("slot")` at each stub. `operations`, in contrast, is
  * _not safe to enumerate_ on a stub-bearing plan — `DataTransformCall.toOp()`
- * throws `PN-MIG-2001` because a planner-stubbed closure cannot be lowered
+ * throws `MIGRATION.UNFILLED_PLACEHOLDER` because a planner-stubbed closure cannot be lowered
  * to a runtime op. Callers that know a plan may carry stubs must render to
  * `migration.ts`, let the user fill the slots, and re-load the edited
  * migration before enumerating ops. The walk-schema planner does not emit

package/src/core/migrations/planner-strategies.ts

@@ -35,6 +35,7 @@ import type {
 import { resolveValueSetValues } from '@prisma-next/family-sql/control';
 import type { TargetBoundComponentDescriptor } from '@prisma-next/framework-components/components';
 import type { SchemaDiffIssue } from '@prisma-next/framework-components/control';
+import { issueOutcome } from '@prisma-next/framework-components/control';
 import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
 import {
   type SqlStorage,
@@ -198,7 +199,7 @@ export const notNullBackfillCallStrategy: CallMigrationStrategy = (issues, ctx)
   const calls: PostgresOpFactoryCall[] = [];
 
   for (const issue of issues) {
-    if (issue.reason !== 'not-found') continue;
+    if (issueOutcome(issue) !== 'not-found') continue;
     const node = issueNode(issue);
     if (node === undefined || node.nodeKind !== RelationalSchemaNodeKind.column) continue;
     const expected = blindCast<
@@ -263,7 +264,7 @@ export const typeChangeCallStrategy: CallMigrationStrategy = (issues, ctx) => {
   const calls: PostgresOpFactoryCall[] = [];
 
   for (const issue of issues) {
-    if (issue.reason !== 'not-equal') continue;
+    if (issueOutcome(issue) !== 'not-equal') continue;
     const pair = columnNodePair(issue);
     if (pair === undefined) continue;
     const { expected, actual } = pair;
@@ -357,7 +358,7 @@ export const nullableTighteningCallStrategy: CallMigrationStrategy = (issues, ct
   const calls: PostgresOpFactoryCall[] = [];
 
   for (const issue of issues) {
-    if (issue.reason !== 'not-equal') continue;
+    if (issueOutcome(issue) !== 'not-equal') continue;
     const pair = columnNodePair(issue);
     if (pair === undefined) continue;
     const { expected, actual } = pair;
@@ -590,7 +591,7 @@ export const notNullAddColumnCallStrategy: CallMigrationStrategy = (issues, ctx)
   const mutableStorageTypes = ctx.storageTypes as Record<string, StorageTypeInstance>;
 
   for (const issue of issues) {
-    if (issue.reason !== 'not-found') continue;
+    if (issueOutcome(issue) !== 'not-found') continue;
     const node = issueNode(issue);
     if (node === undefined || node.nodeKind !== RelationalSchemaNodeKind.column) continue;
     const expected = blindCast<
@@ -685,8 +686,7 @@ function canUseSharedTemporaryDefaultStrategy(options: {
   }
 
   for (const foreignKey of table.foreignKeys) {
-    if (foreignKey.constraint === false || !foreignKey.source.columns.includes(columnName))
-      continue;
+    if (!foreignKey.source.columns.includes(columnName)) continue;
     if (!schemaLookup || !hasForeignKey(schemaLookup, foreignKey)) return false;
   }
 

package/src/core/migrations/planner.ts

@@ -21,6 +21,7 @@ import type {
   SchemaDiffIssue,
   SchemaOwnership,
 } from '@prisma-next/framework-components/control';
+import { issueOutcome } from '@prisma-next/framework-components/control';
 import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
 import type { SqlStorage } from '@prisma-next/sql-contract/types';
 import type { SqlSchemaIR } from '@prisma-next/sql-schema-ir/types';
@@ -211,7 +212,7 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
       options.policy.allowedOperationClasses.includes('destructive');
     const coalesced = coalesceSubtreeIssues(relationalDiffIssues);
     const owned = retainUnownedExtras(coalesced, options.ownership, options.contract);
-    const gated = strict ? owned : owned.filter((issue) => issue.reason !== 'not-expected');
+    const gated = strict ? owned : owned.filter((issue) => issueOutcome(issue) !== 'not-expected');
 
     // Namespace presence (`CREATE SCHEMA`) is a planner-only op-generation
     // concern stitched in here rather than inside the shared diff — verify
@@ -369,7 +370,7 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
       // 'not-equal' is unreachable for content-addressed policies: the wire name
       // encodes the body hash, so two policies sharing a local key (same name)
       // are always equal and isEqualTo never returns false.
-      if (issue.reason === 'not-found') {
+      if (issueOutcome(issue) === 'not-found') {
         const expected = issue.expected;
         PostgresPolicySchemaNode.assert(expected);
         // expected.namespaceId is the DDL schema name (resolved during projection);
@@ -381,7 +382,7 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
             expected.namespaceId,
           ),
         });
-      } else if (issue.reason === 'not-expected') {
+      } else if (issueOutcome(issue) === 'not-expected') {
         const actual = issue.actual;
         PostgresPolicySchemaNode.assert(actual);
         extra.push({
@@ -505,7 +506,7 @@ function retainUnownedExtras(
 ): readonly SchemaDiffIssue<SqlSchemaDiffNode>[] {
   if (ownership === undefined) return issues;
   return issues.filter((issue) => {
-    if (issue.reason !== 'not-expected') return true;
+    if (issueOutcome(issue) !== 'not-expected') return true;
     const node = issueNode(issue);
     if (node === undefined) return true;
     const coordinate = postgresNodeStorageCoordinate(node);

package/src/core/migrations/postgres-migration.ts

@@ -8,6 +8,7 @@ import type { SqlStorage } from '@prisma-next/sql-contract/types';
 import type { DdlColumn, DdlTableConstraint } from '@prisma-next/sql-relational-core/ast';
 import { errorPostgresMigrationStackMissing } from '../errors';
 import { PostgresContractView } from '../postgres-contract-view';
+import { PostgresRlsPolicy, type PostgresRlsPolicyInput } from '../postgres-rls-policy';
 import {
   AddCheckConstraintCall,
   AddColumnCall,
@@ -19,8 +20,10 @@ import {
   type AlterColumnTypeOptions,
   CreateIndexCall,
   CreateNativeEnumTypeCall,
+  CreatePostgresRlsPolicyCall,
   CreateSchemaCall,
   CreateTableCall,
+  DisableRowLevelSecurityCall,
   DropCheckConstraintCall,
   DropColumnCall,
   DropConstraintCall,
@@ -28,7 +31,10 @@ import {
   DropIndexCall,
   DropNativeEnumTypeCall,
   DropNotNullCall,
+  DropPostgresRlsPolicyCall,
   DropTableCall,
+  EnableRowLevelSecurityCall,
+  RenamePostgresRlsPolicyCall,
   SetDefaultCall,
   SetNotNullCall,
 } from './op-factory-call';
@@ -75,7 +81,7 @@ export abstract class PostgresMigration<
    * Materialized Postgres control adapter, created once per migration
    * instance from the injected stack. `undefined` only when the migration
    * was instantiated without a stack (test fixtures); `controlAdapterFor`
-   * throws a PN-MIG-2007 in that case to surface the misuse.
+   * throws a MIGRATION.POSTGRES_CONTROL_STACK_MISSING in that case to surface the misuse.
    */
   protected readonly controlAdapter: SqlControlAdapter<'postgres'> | undefined;
 
@@ -101,7 +107,7 @@ export abstract class PostgresMigration<
   }
 
   /**
-   * Returns the materialized control adapter, or throws a PN-MIG-2007 naming
+   * Returns the materialized control adapter, or throws a MIGRATION.POSTGRES_CONTROL_STACK_MISSING naming
    * `operation` when the migration was constructed without a `ControlStack`.
    * Single home for the null-check that every DDL/DML method shares.
    */
@@ -420,4 +426,58 @@ export abstract class PostgresMigration<
   }): Promise<SqlMigrationPlanOperation<PostgresPlanTargetDetails>> {
     return installExtension(options, this.controlAdapterFor('installExtension'));
   }
+
+  protected enableRowLevelSecurity(options: {
+    readonly schema: string;
+    readonly table: string;
+  }): Promise<SqlMigrationPlanOperation<PostgresPlanTargetDetails>> {
+    return new EnableRowLevelSecurityCall(options.schema, options.table).toOp(
+      this.controlAdapterFor('enableRowLevelSecurity'),
+    );
+  }
+
+  protected disableRowLevelSecurity(options: {
+    readonly schema: string;
+    readonly table: string;
+  }): Promise<SqlMigrationPlanOperation<PostgresPlanTargetDetails>> {
+    return new DisableRowLevelSecurityCall(options.schema, options.table).toOp(
+      this.controlAdapterFor('disableRowLevelSecurity'),
+    );
+  }
+
+  protected createRlsPolicy(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly policy: PostgresRlsPolicyInput;
+  }): Promise<SqlMigrationPlanOperation<PostgresPlanTargetDetails>> {
+    return new CreatePostgresRlsPolicyCall(
+      options.schema,
+      options.table,
+      new PostgresRlsPolicy(options.policy),
+    ).toOp(this.controlAdapterFor('createRlsPolicy'));
+  }
+
+  protected dropRlsPolicy(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly policy: string;
+  }): Promise<SqlMigrationPlanOperation<PostgresPlanTargetDetails>> {
+    return new DropPostgresRlsPolicyCall(options.schema, options.table, options.policy).toOp(
+      this.controlAdapterFor('dropRlsPolicy'),
+    );
+  }
+
+  protected renameRlsPolicy(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly from: string;
+    readonly to: string;
+  }): Promise<SqlMigrationPlanOperation<PostgresPlanTargetDetails>> {
+    return new RenamePostgresRlsPolicyCall(
+      options.schema,
+      options.table,
+      options.from,
+      options.to,
+    ).toOp(this.controlAdapterFor('renameRlsPolicy'));
+  }
 }

package/src/core/migrations/runner.ts

@@ -137,7 +137,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
         frameworkComponents: options.frameworkComponents,
       });
       if (!schemaVerifyResult.ok) {
-        return runnerFailure('SCHEMA_VERIFY_FAILED', schemaVerifyResult.summary, {
+        return runnerFailure('MIGRATION.SCHEMA_VERIFY_FAILED', schemaVerifyResult.summary, {
           why: 'The resulting database schema does not satisfy the destination contract.',
           meta: {
             issues: schemaVerifyResult.schema.issues,
@@ -313,7 +313,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
       return okVoid();
     }
     return runnerFailure(
-      'LEGACY_MARKER_SHAPE',
+      'MIGRATION.LEGACY_MARKER_SHAPE',
       'Legacy marker-table shape detected on prisma_contract.marker (no `space` column). ' +
         'Prisma Next is in pre-1.0; the previous transitional auto-migration to the per-space-row schema has been removed. ' +
         'Drop `prisma_contract.marker` and re-run `dbInit` to reinitialise from a clean baseline.',
@@ -335,7 +335,8 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
     for (const step of steps) {
       const result = await driver.query(step.sql, step.params ?? []);
       if (!this.stepResultIsTrue(result.rows)) {
-        const code = phase === 'precheck' ? 'PRECHECK_FAILED' : 'POSTCHECK_FAILED';
+        const code =
+          phase === 'precheck' ? 'MIGRATION.PRECHECK_FAILED' : 'MIGRATION.POSTCHECK_FAILED';
         return runnerFailure(
           code,
           `Operation ${operation.id} failed during ${phase}: ${step.description}`,
@@ -363,7 +364,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
       } catch (error: unknown) {
         if (SqlQueryError.is(error)) {
           return runnerFailure(
-            'EXECUTION_FAILED',
+            'MIGRATION.EXECUTION_FAILED',
             `Operation ${operation.id} failed during execution: ${step.description}`,
             {
               why: error.message,
@@ -487,7 +488,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
     for (const operation of operations) {
       if (!allowedClasses.has(operation.operationClass)) {
         return runnerFailure(
-          'POLICY_VIOLATION',
+          'MIGRATION.POLICY_VIOLATION',
           `Operation ${operation.id} has class "${operation.operationClass}" which is not allowed by policy.`,
           {
             why: `Policy only allows: ${policy.allowedOperationClasses.join(', ')}.`,
@@ -517,7 +518,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
 
     if (!marker) {
       return runnerFailure(
-        'MARKER_ORIGIN_MISMATCH',
+        'MIGRATION.MARKER_ORIGIN_MISMATCH',
         `Missing contract marker: expected origin storage hash ${origin.storageHash}.`,
         {
           meta: {
@@ -528,7 +529,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
     }
     if (marker.storageHash !== origin.storageHash) {
       return runnerFailure(
-        'MARKER_ORIGIN_MISMATCH',
+        'MIGRATION.MARKER_ORIGIN_MISMATCH',
         `Existing contract marker (${marker.storageHash}) does not match plan origin (${origin.storageHash}).`,
         {
           meta: {
@@ -540,7 +541,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
     }
     if (origin.profileHash && marker.profileHash !== origin.profileHash) {
       return runnerFailure(
-        'MARKER_ORIGIN_MISMATCH',
+        'MIGRATION.MARKER_ORIGIN_MISMATCH',
         `Existing contract marker profile hash (${marker.profileHash}) does not match plan origin profile hash (${origin.profileHash}).`,
         {
           meta: {
@@ -559,7 +560,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
   ): Result<void, SqlMigrationRunnerFailure> {
     if (destination.storageHash !== contract.storage.storageHash) {
       return runnerFailure(
-        'DESTINATION_CONTRACT_MISMATCH',
+        'MIGRATION.DESTINATION_CONTRACT_MISMATCH',
         `Plan destination storage hash (${destination.storageHash}) does not match provided contract storage hash (${contract.storage.storageHash}).`,
         {
           meta: {
@@ -575,7 +576,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
       destination.profileHash !== contract.profileHash
     ) {
       return runnerFailure(
-        'DESTINATION_CONTRACT_MISMATCH',
+        'MIGRATION.DESTINATION_CONTRACT_MISMATCH',
         `Plan destination profile hash (${destination.profileHash}) does not match provided contract profile hash (${contract.profileHash}).`,
         {
           meta: {
@@ -614,7 +615,7 @@ class PostgresMigrationRunner implements SqlMigrationRunner<PostgresPlanTargetDe
     });
     if (!updated) {
       return runnerFailure(
-        'MARKER_CAS_FAILURE',
+        'MIGRATION.MARKER_CAS_FAILURE',
         'Marker was modified by another process during migration execution.',
         {
           meta: {

package/src/core/migrations/verify-postgres-namespaces.ts

@@ -94,7 +94,6 @@ export function verifyPostgresNamespacePresence(input: {
     });
     issues.push({
       path: ['database', ddlName],
-      reason: 'not-found',
       expected: namespace,
     });
   }

package/src/core/psl-infer/infer-psl-contract.ts

@@ -162,6 +162,15 @@ type ForeignKeyResolution = {
   readonly extraRelationsByTable: ReadonlyMap<string, readonly RelationField[]>;
   /** Synthetic field-name maps for cross-space-referenced pack tables, merged into `fieldNamesByTable`. */
   readonly crossSpaceFieldNamesByTable: ReadonlyMap<string, TableColumnFieldNameMap>;
+  /** Dangling foreign keys dropped per host table, kept so the model can explain the drop. */
+  readonly danglingForeignKeysByTable: ReadonlyMap<string, readonly DanglingForeignKeyInfo[]>;
+};
+
+/** A foreign key dropped because its target lives outside the introspected scope. */
+type DanglingForeignKeyInfo = {
+  readonly columns: readonly string[];
+  readonly referencedSchema: string | undefined;
+  readonly referencedTable: string;
 };
 
 /**
@@ -198,6 +207,7 @@ function resolveForeignKeys(
   const resultTables: Record<string, SqlTableIR> = {};
   const extraRelationsByTable = new Map<string, RelationField[]>();
   const crossSpaceFieldNamesByTable = new Map<string, TableColumnFieldNameMap>();
+  const danglingForeignKeysByTable = new Map<string, DanglingForeignKeyInfo[]>();
 
   for (const [tableName, table] of Object.entries(tables)) {
     const keptForeignKeys: SqlForeignKeyIR[] = [];
@@ -248,9 +258,22 @@ function resolveForeignKeys(
 
       // Not a pack-owned coordinate: keep the foreign key if the referenced
       // table survived introspection (local), otherwise drop it while keeping
-      // the scalar column (dangling).
+      // the scalar column (dangling) — recording it so the model can explain
+      // the drop instead of the relation vanishing without a trace.
       if (tables[fk.referencedTable] !== undefined) {
         keptForeignKeys.push(fk);
+      } else {
+        const dangling: DanglingForeignKeyInfo = {
+          columns: fk.columns,
+          referencedSchema: fk.referencedSchema,
+          referencedTable: fk.referencedTable,
+        };
+        const existingDangling = danglingForeignKeysByTable.get(tableName);
+        if (existingDangling) {
+          existingDangling.push(dangling);
+        } else {
+          danglingForeignKeysByTable.set(tableName, [dangling]);
+        }
       }
     }
 
@@ -260,7 +283,12 @@ function resolveForeignKeys(
         : new SqlTableIR({ ...table, foreignKeys: keptForeignKeys });
   }
 
-  return { tables: resultTables, extraRelationsByTable, crossSpaceFieldNamesByTable };
+  return {
+    tables: resultTables,
+    extraRelationsByTable,
+    crossSpaceFieldNamesByTable,
+    danglingForeignKeysByTable,
+  };
 }
 
 /**
@@ -405,6 +433,7 @@ export function inferPostgresPslContract(
     tables: resolvedTables,
     extraRelationsByTable,
     crossSpaceFieldNamesByTable,
+    danglingForeignKeysByTable,
   } = resolveForeignKeys(tables, owners);
   const schemaIR = new SqlSchemaIR({ tables: resolvedTables });
 
@@ -437,6 +466,7 @@ export function inferPostgresPslContract(
     {
       extraRelationsByTable,
       crossSpaceFieldNamesByTable,
+      danglingForeignKeysByTable,
     },
     wrapNamespaceName,
   );
@@ -447,12 +477,13 @@ export function buildPslDocumentAst(
   options: PslPrinterOptions,
   foreignKeyExtras: Pick<
     ForeignKeyResolution,
-    'extraRelationsByTable' | 'crossSpaceFieldNamesByTable'
+    'extraRelationsByTable' | 'crossSpaceFieldNamesByTable' | 'danglingForeignKeysByTable'
   >,
   namespaceName?: string,
 ): PslDocumentAst {
   const { typeMap, defaultMapping, parseRawDefault: rawDefaultParser } = options;
-  const { extraRelationsByTable, crossSpaceFieldNamesByTable } = foreignKeyExtras;
+  const { extraRelationsByTable, crossSpaceFieldNamesByTable, danglingForeignKeysByTable } =
+    foreignKeyExtras;
 
   const modelNames = buildTopLevelNameMap(
     Object.keys(schemaIR.tables),
@@ -508,6 +539,7 @@ export function buildPslDocumentAst(
           ...(relationsByTable.get(table.name) ?? []),
           ...(extraRelationsByTable.get(table.name) ?? []),
         ],
+        danglingForeignKeysByTable.get(table.name) ?? [],
       ),
     );
   }
@@ -642,6 +674,7 @@ function buildModel(
   defaultMapping: DefaultMappingOptions | undefined,
   rawDefaultParser: PslPrinterOptions['parseRawDefault'],
   relationFields: readonly RelationField[],
+  danglingForeignKeys: readonly DanglingForeignKeyInfo[],
 ): PslModel {
   const { name: modelName, map: mapName } = toModelName(table.name);
   const fieldNameMap = fieldNamesByTable.get(table.name);
@@ -719,13 +752,23 @@ function buildModel(
     modelAttributes.push(buildMapAttribute('model', mapName));
   }
 
-  // Surface introspection advisory: tables without a primary key cannot serve
-  // as the right-hand side of a `findUnique`-style query downstream, so the
-  // user should add an `@id`. This warning is part of the emitted SQL output
-  // and is asserted byte-for-byte, so keep the exact wording.
-  const comment = table.primaryKey
-    ? undefined
-    : '// WARNING: This table has no primary key in the database';
+  // Surface introspection advisories the user would otherwise have no way to
+  // discover from the emitted PSL alone. Both warnings are part of the
+  // emitted SQL output and are asserted byte-for-byte, so keep the exact
+  // wording; a table hitting both is combined onto the single comment line
+  // `PslModel.comment` supports.
+  const warnings: string[] = [];
+  if (!table.primaryKey) {
+    // Tables without a primary key cannot serve as the right-hand side of a
+    // `findUnique`-style query downstream, so the user should add an `@id`.
+    warnings.push('This table has no primary key in the database');
+  }
+  if (danglingForeignKeys.length > 0) {
+    warnings.push(
+      buildDanglingForeignKeyWarning(danglingForeignKeys, fieldNamesByTable, table.name),
+    );
+  }
+  const comment = warnings.length > 0 ? `// WARNING: ${warnings.join(' ')}` : undefined;
 
   return {
     kind: 'model',
@@ -737,6 +780,35 @@ function buildModel(
   };
 }
 
+/**
+ * Explains a foreign key `resolveForeignKeys` dropped as dangling: the
+ * database enforces it, but its target lives outside the introspected
+ * schema, so infer has no model to point a relation at. The suggested fix
+ * targets the common cause — an unconfigured extension pack's schema
+ * (e.g. Supabase's `auth`).
+ */
+function buildDanglingForeignKeyWarning(
+  danglingForeignKeys: readonly DanglingForeignKeyInfo[],
+  fieldNamesByTable: ReadonlyMap<string, TableColumnFieldNameMap>,
+  tableName: string,
+): string {
+  const descriptions = danglingForeignKeys.map((fk) => {
+    const fieldNames = fk.columns.map((columnName) =>
+      resolveColumnFieldName(fieldNamesByTable, tableName, columnName),
+    );
+    const target =
+      fk.referencedSchema !== undefined
+        ? `${fk.referencedSchema}.${fk.referencedTable}`
+        : fk.referencedTable;
+    return `"${fieldNames.join(', ')}" -> "${target}"`;
+  });
+  return (
+    `Foreign key ${descriptions.join(', ')} exists in the database, but its target schema is ` +
+    'outside the introspected scope, so no relation field was generated. If the target schema ' +
+    'is described by an extension pack, add it to extensionPacks and re-run infer.'
+  );
+}
+
 function buildScalarField(
   column: SqlColumnIR,
   table: SqlTableIR,
@@ -799,7 +871,32 @@ function buildScalarField(
     attributes.push(buildSimpleConstraintFieldAttribute('id', singlePkConstraintName));
   }
 
-  if (column.default !== undefined) {
+  if (
+    column.default === undefined &&
+    column.resolvedDefault?.kind === 'function' &&
+    column.resolvedDefault.expression === 'autoincrement()'
+  ) {
+    // An identity column: a `resolvedDefault` with no raw `default` is the
+    // only introspected shape the control adapter produces for
+    // `GENERATED ... AS IDENTITY` (Postgres reports no `column_default`;
+    // the adapter stamps `autoincrement()` directly). There is no
+    // `identity` field on the column IR — this pairing is the marker.
+    attributes.push(parseDefaultAttributeString('@default(autoincrement())'));
+  } else if (column.many === true && column.resolvedDefault?.kind === 'literal') {
+    // A list column's default must print from `resolvedDefault`: the raw SQL
+    // text (e.g. `'{}'::text[]`) only parses to `dbgenerated(...)`, which the
+    // interpreter rejects on a list column (lists accept literal defaults
+    // only). PSL literal-list elements are string/number/boolean only, so a
+    // resolved value holding anything else has no spelling — the default is
+    // then omitted, which verify reports as a live-only "extra", not a
+    // false mismatch.
+    const formatted = Array.isArray(column.resolvedDefault.value)
+      ? formatPslListLiteralValue(column.resolvedDefault.value)
+      : undefined;
+    if (formatted !== undefined) {
+      attributes.push(parseDefaultAttributeString(`@default(${formatted})`));
+    }
+  } else if (column.default !== undefined) {
     const parsed = parseColumnDefault(column.default, column.nativeType, rawDefaultParser);
     if (parsed) {
       const result = mapDefault(parsed, defaultMapping);
@@ -989,6 +1086,27 @@ function escapePslString(value: string): string {
     .replace(/\r/g, '\\r');
 }
 
+/**
+ * Formats a resolved literal-default array as PSL literal-list syntax
+ * (`[1, 2, 3]`, `["a", "b"]`, `[]`). PSL's list-literal grammar only accepts
+ * string/number/boolean elements, so any other element (e.g. `null`, a
+ * nested array/object) makes the value unrepresentable and this returns
+ * `undefined`.
+ */
+function formatPslListLiteralValue(elements: readonly unknown[]): string | undefined {
+  const parts: string[] = [];
+  for (const element of elements) {
+    if (typeof element === 'string') {
+      parts.push(`"${escapePslString(element)}"`);
+    } else if (typeof element === 'number' || typeof element === 'boolean') {
+      parts.push(String(element));
+    } else {
+      return undefined;
+    }
+  }
+  return `[${parts.join(', ')}]`;
+}
+
 /**
  * Resolves a `SqlColumnIR.default` value into a normalized {@link ColumnDefault}.
  *

package/src/core/schema-ir/postgres-policy-schema-node.ts

@@ -1,6 +1,6 @@
-import type { DiffableNode } from '@prisma-next/framework-components/control';
+import type { DiffableNode, SchemaNodeRef } from '@prisma-next/framework-components/control';
 import { freezeNode } from '@prisma-next/framework-components/ir';
-import { assertNode, SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
+import { assertNode, defineNonEnumerable, SqlSchemaIRNode } from '@prisma-next/sql-schema-ir/types';
 import { blindCast } from '@prisma-next/utils/casts';
 import type { RlsPolicyOperation } from '../postgres-rls-policy';
 import { PostgresSchemaNodeKind } from './schema-node-kinds';
@@ -23,6 +23,13 @@ export interface PostgresPolicySchemaNodeInput {
   readonly withCheck?: string;
   /** `true` = `AS PERMISSIVE`, `false` = `AS RESTRICTIVE`. */
   readonly permissive: boolean;
+  /**
+   * This policy's table node, plus one entry per role it grants to — each
+   * as the root-anchored chain the differ pairs siblings with. Stamped by
+   * the derivation, which holds the parent (database/namespace) context.
+   * Never compared by `isEqualTo`.
+   */
+  readonly dependsOn?: readonly SchemaNodeRef[];
 }
 
 /**
@@ -48,6 +55,8 @@ export class PostgresPolicySchemaNode extends SqlSchemaIRNode implements Diffabl
   declare readonly using?: string;
   declare readonly withCheck?: string;
   readonly permissive: boolean;
+  /** See {@link PostgresPolicySchemaNodeInput.dependsOn}. Non-enumerable so it stays out of JSON and structural equality, matching `SqlColumnIR.codecRef`. */
+  declare readonly dependsOn?: readonly SchemaNodeRef[];
 
   constructor(input: PostgresPolicySchemaNodeInput) {
     super();
@@ -60,6 +69,7 @@ export class PostgresPolicySchemaNode extends SqlSchemaIRNode implements Diffabl
     if (input.using !== undefined) this.using = input.using;
     if (input.withCheck !== undefined) this.withCheck = input.withCheck;
     this.permissive = input.permissive;
+    defineNonEnumerable(this, 'dependsOn', input.dependsOn);
     freezeNode(this);
   }
 

package/src/exports/codecs.ts

@@ -2,6 +2,7 @@ export type {
   PgBitDescriptor,
   PgBoolDescriptor,
   PgCharDescriptor,
+  PgDateDescriptor,
   PgEnumCodec,
   PgEnumDescriptor,
   PgFloat4Descriptor,
@@ -29,6 +30,7 @@ export {
   pgBitColumn,
   pgBoolColumn,
   pgCharColumn,
+  pgDateColumn,
   pgEnumDescriptor,
   pgFloat4Column,
   pgFloat8Column,

package/src/exports/control.ts

@@ -9,6 +9,7 @@ import type {
 import type { StorageColumn } from '@prisma-next/sql-contract/types';
 import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
+import { postgresResolveDefault } from '../core/default-normalizer';
 import { postgresTargetDescriptorMeta } from '../core/descriptor-meta';
 import { contractToPostgresDatabaseSchemaNode } from '../core/migrations/contract-to-postgres-database-schema-node';
 import { diffPostgresSchema } from '../core/migrations/diff-database-schema';
@@ -64,6 +65,7 @@ const postgresTargetDescriptor: SqlControlTargetDescriptor<'postgres', PostgresP
           annotationNamespace: 'pg',
           ...ifDefined('expandNativeType', expander),
           renderDefault: postgresRenderDefault,
+          resolveDefault: postgresResolveDefault,
         });
       },
     },

package/src/exports/default-normalizer.ts

@@ -1 +1 @@
-export { parsePostgresDefault } from '../core/default-normalizer';
+export { parsePostgresDefault, postgresResolveDefault } from '../core/default-normalizer';

package/src/exports/op-factory-call.ts

@@ -10,9 +10,11 @@ export {
   CreateExtensionCall,
   CreateIndexCall,
   CreateNativeEnumTypeCall,
+  CreatePostgresRlsPolicyCall,
   CreateSchemaCall,
   CreateTableCall,
   DataTransformCall,
+  DisableRowLevelSecurityCall,
   DropCheckConstraintCall,
   DropColumnCall,
   DropConstraintCall,
@@ -20,8 +22,11 @@ export {
   DropIndexCall,
   DropNativeEnumTypeCall,
   DropNotNullCall,
+  DropPostgresRlsPolicyCall,
   DropTableCall,
+  EnableRowLevelSecurityCall,
   RawSqlCall,
+  RenamePostgresRlsPolicyCall,
   SetDefaultCall,
   SetNotNullCall,
 } from '../core/migrations/op-factory-call';

package/src/exports/types.ts

@@ -40,4 +40,5 @@ export {
   PostgresTableSchemaNode,
   type PostgresTableSchemaNodeInput,
 } from '../core/schema-ir/postgres-table-schema-node';
+export { PostgresSchemaNodeKind } from '../core/schema-ir/schema-node-kinds';
 export type { PostgresColumnDefault } from '../core/types';