@prisma/orm-target-postgres 0.16.0-dev.36

package/dist/control-policy-Cl3RRSPg-CT3QGpR3.mjs

@@ -0,0 +1,1257 @@
+import { r as quoteIdentifier } from "./sql-utils-BnBlQxyh-DaX9Nb7Z.mjs";
+import { d as isPostgresSchema } from "./postgres-schema-KSzLDONj-CsXGoY8b.mjs";
+import { n as PostgresSchemaNodeKind, o as postgresNodeEntityKind, r as PostgresTableSchemaNode, t as PostgresNativeEnumSchemaNode } from "./postgres-table-schema-node-BBkitBQh-DT1T5VWU.mjs";
+import { t as buildExpectedFormatType } from "./planner-sql-checks-DRc_78n8-C9nHOrvU.mjs";
+import { n as buildColumnTypeSql, t as buildColumnDefaultSql } from "./planner-ddl-builders-CbfICQfm-CxYiLrhX.mjs";
+import { C as DropNativeEnumTypeCall, D as EnableRowLevelSecurityCall, E as DropTableCall, I as postgresDefaultToDdlColumnDefault, M as SetNotNullCall, N as buildTargetDetails, O as RawSqlCall, S as DropIndexCall, _ as DisableRowLevelSecurityCall, a as AddNotNullColumnDirectCall, b as DropConstraintCall, c as AddUniqueCall, d as CreateIndexCall, f as CreateNativeEnumTypeCall, g as DataTransformCall, h as CreateTableCall, i as AddNativeEnumValueCall, j as SetDefaultCall, l as AlterColumnTypeCall, m as CreateSchemaCall, n as AddColumnCall, o as AddNotNullColumnWithTempDefaultCall, r as AddForeignKeyCall, s as AddPrimaryKeyCall, t as AddCheckConstraintCall, v as DropCheckConstraintCall, w as DropNotNullCall, x as DropDefaultCall, y as DropColumnCall } from "./op-factory-call-DifL68KT-Bo6pxs-R.mjs";
+import { n as resolveIdentityValue } from "./planner-identity-values-BmHn5C6U-BYBbUAyR.mjs";
+import { i as hasUniqueConstraint, n as hasForeignKey, t as buildSchemaLookupMap } from "./planner-schema-lookup-kMIVP2y--CdO4VlnF.mjs";
+import { blindCast } from "@prisma/orm-framework/utils/casts";
+import { UNBOUND_NAMESPACE_ID, entityAt } from "@prisma/orm-framework/components/ir";
+import { StorageTable } from "@prisma/orm-family-sql/contract/types";
+import { ifDefined } from "@prisma/orm-framework/utils/defined";
+import * as contractFree from "@prisma/orm-family-sql/relational-core/contract-free";
+import { issueOutcome, orderIssuesByDependencies } from "@prisma/orm-framework/components/control";
+import { resolveValueSetValues } from "@prisma/orm-family-sql/family/control";
+import { RelationalSchemaNodeKind, SqlSchemaIR } from "@prisma/orm-family-sql/schema-ir/types";
+import { InternalError } from "@prisma/orm-framework/utils/internal-error";
+import { notOk, ok } from "@prisma/orm-framework/utils/result";
+//#region ../../../3-targets/3-targets/postgres/dist/control-policy-Cl3RRSPg.mjs
+/**
+* The storage-`entries` coordinate `(entityKind, entityName)` a Postgres diff
+* node addresses — a table by its name, a native enum by its physical type
+* name. `undefined` for a node that is not a whole storage entity (a namespace,
+* a column, a policy). Lets ownership/subject resolution treat every entity kind
+* uniformly, the node self-describing its storage identity.
+*/
+function postgresNodeStorageCoordinate(node) {
+	if (PostgresTableSchemaNode.is(node)) {
+		const entityKind = postgresNodeEntityKind(node.nodeKind);
+		return entityKind === void 0 ? void 0 : {
+			entityKind,
+			entityName: node.name
+		};
+	}
+	if (PostgresNativeEnumSchemaNode.is(node)) {
+		const entityKind = postgresNodeEntityKind(node.nodeKind);
+		return entityKind === void 0 ? void 0 : {
+			entityKind,
+			entityName: node.typeName
+		};
+	}
+}
+/**
+* Reconstructs the `StorageColumn`-shaped fields the DDL builder functions
+* (`buildColumnTypeSql`, `buildExpectedFormatType`, `resolveIdentityValue`)
+* expect, from a column node's own stamped codec identity (`codecRef` /
+* `codecBaseNativeType` / `codecNamedType`, Decision 5) — never the
+* contract. The builders were written against `StorageColumn` and are
+* unchanged here; only the shape feeding them moves from the contract to
+* the node. An empty `storageTypes` catalog is passed alongside: the
+* node's fields are already resolved past any `typeRef` indirection, so no
+* live lookup is needed, and passing a non-empty catalog would risk a
+* false `typeRef` hit against an unrelated storage type.
+*/
+function columnLike(column) {
+	if (column.codecRef === void 0 || column.codecBaseNativeType === void 0) throw new InternalError(`columnLike: expected column "${column.name}" carries no codec identity — the expected tree must be derived via contractToSchemaIR for planning`);
+	return {
+		nativeType: column.codecBaseNativeType,
+		codecId: column.codecRef.codecId,
+		nullable: column.nullable,
+		...ifDefined("many", column.many ?? column.codecRef.many),
+		...ifDefined("typeParams", column.codecRef.typeParams !== void 0 ? blindCast(column.codecRef.typeParams) : void 0),
+		...column.codecNamedType ? { typeRef: "<resolved>" } : {},
+		...ifDefined("default", column.resolvedDefault)
+	};
+}
+/**
+* Builds the `CREATE TABLE` / `ADD COLUMN` DDL column for an expected column
+* node, resolving type rendering from the node's codec identity against the
+* codec hooks the caller holds — the same builder the pre-`plan(start, end)`
+* op-path called, so the output is byte-identical.
+*/
+function renderColumnDdl(name, column, codecHooks) {
+	const like = columnLike(column);
+	const typeSql = buildColumnTypeSql(like, codecHooks, {});
+	const ddlDefault = postgresDefaultToDdlColumnDefault(like.default);
+	return contractFree.col(name, typeSql, {
+		...!column.nullable ? { notNull: true } : {},
+		...ifDefined("default", ddlDefault),
+		...ifDefined("codecRef", column.codecRef)
+	});
+}
+/**
+* Builds the `ALTER COLUMN … TYPE` operands for an expected column node.
+*/
+function renderColumnAlterType(column, codecHooks) {
+	const like = columnLike(column);
+	return {
+		qualifiedTargetType: buildColumnTypeSql(like, codecHooks, {}, false),
+		formatTypeExpected: buildExpectedFormatType(like, codecHooks, {})
+	};
+}
+/**
+* Resolves the identity value (monoid neutral element) SQL literal used as
+* the temporary default when adding a NOT-NULL column with no contract
+* default (`notNullAddColumnCallStrategy`'s shared-temp-default backfill).
+* `null` when the column's type has no built-in/codec-provided identity
+* value.
+*/
+function resolveColumnTemporaryDefault(column, codecHooks) {
+	return resolveIdentityValue(columnLike(column), codecHooks, {});
+}
+/**
+* The column's `SET DEFAULT` clause SQL, resolved from a column-default
+* diff node. `''` when the node carries no resolved default.
+*/
+function renderColumnDefaultSql(defaultNode) {
+	if (defaultNode.resolved === void 0) return "";
+	return buildColumnDefaultSql(defaultNode.resolved, {
+		nativeType: defaultNode.nativeTypeContext ?? "",
+		...ifDefined("many", defaultNode.many)
+	});
+}
+/**
+* Look up a storage table by its explicit namespace coordinate. Returns
+* `undefined` when the namespace has no table by that name (or no such
+* namespace exists). Callers that get `undefined` MUST treat it as an
+* explicit conflict — never silently fall back to a global default
+* schema or a name-only walk, because that footgun would resolve a
+* stale or duplicate table name to whichever namespace the iteration
+* order surfaced first (a real data-loss hazard in multi-namespace
+* contracts where two namespaces can carry the same table name).
+*/
+function tableAt(storage, namespaceId, tableName) {
+	const ns = storage.namespaces[namespaceId];
+	if (ns === void 0) return void 0;
+	return ns.entries.table?.[tableName];
+}
+/**
+* Resolve the DDL schema name for a namespace coordinate. Postgres-aware
+* namespaces dispatch to their polymorphic `ddlSchemaName` override —
+* named schemas return their own id; the unbound singleton returns
+* `UNBOUND_NAMESPACE_ID`. Legacy single-namespace contracts whose
+* `__unbound__` slot is the framework-default `SqlUnboundNamespace`
+* (rather than the Postgres-aware `PostgresUnboundSchema`) flow the
+* coordinate through unchanged so downstream `qualifyTableName`
+* resolves polymorphically.
+*/
+function resolveDdlSchemaForNamespace(ctx, namespaceId) {
+	const namespace = ctx.toContract.storage.namespaces[namespaceId];
+	if (isPostgresSchema(namespace)) return namespace.ddlSchemaName(ctx.toContract.storage);
+	return namespaceId;
+}
+/**
+* Recovers the contract namespace id for a DDL schema name embedded in a
+* diff-issue path (`path[1]`). The strategies need the CONTRACT column/table
+* (for codec-hook reads and eligibility probes the retained subsystems still
+* run) even though the issue itself only carries the resolved DDL schema —
+* this is the reverse of `resolveDdlSchemaForNamespace`.
+*/
+function namespaceIdForDdlSchema(ctx, ddlSchemaName) {
+	return resolveNamespaceIdForDdlSchema(ctx.toContract, ddlSchemaName);
+}
+/** A `not-equal` column issue whose node pair is narrowed to `SqlColumnIR`. */
+function columnNodePair(issue) {
+	const node = issueNode(issue);
+	if (node === void 0 || node.nodeKind !== RelationalSchemaNodeKind.column) return void 0;
+	if (issue.expected === void 0 || issue.actual === void 0) return void 0;
+	return {
+		expected: blindCast(issue.expected),
+		actual: blindCast(issue.actual)
+	};
+}
+const notNullBackfillCallStrategy = (issues, ctx) => {
+	if (!ctx.policy.allowedOperationClasses.includes("data")) return { kind: "no_match" };
+	const matched = [];
+	const calls = [];
+	for (const issue of issues) {
+		if (issueOutcome(issue) !== "not-found") continue;
+		const node = issueNode(issue);
+		if (node === void 0 || node.nodeKind !== RelationalSchemaNodeKind.column) continue;
+		const expected = blindCast(issue.expected);
+		if (expected.nullable !== false || expected.resolvedDefault !== void 0) continue;
+		const ddlSchemaName = issueSchemaName(issue);
+		const tableName = issueTableName(issue);
+		if (ddlSchemaName === void 0 || tableName === void 0) continue;
+		const schemaName = emissionSchemaName(ctx, ddlSchemaName);
+		matched.push(issue);
+		const ddl = renderColumnDdl(expected.name, expected, ctx.codecHooks);
+		const nullableSpec = contractFree.col(ddl.name, ddl.type, { ...ddl.codecRef !== void 0 ? { codecRef: ddl.codecRef } : {} });
+		calls.push(new AddColumnCall(schemaName, tableName, nullableSpec), new DataTransformCall(`backfill-${tableName}-${expected.name}`, `backfill-${tableName}-${expected.name}:check`, `backfill-${tableName}-${expected.name}:run`), new SetNotNullCall(schemaName, tableName, expected.name));
+	}
+	if (matched.length === 0) return { kind: "no_match" };
+	return {
+		kind: "match",
+		issues: issues.filter((i) => !matched.includes(i)),
+		calls,
+		recipe: true
+	};
+};
+const SAFE_WIDENINGS = /* @__PURE__ */ new Set([
+	"int2→int4",
+	"int2→int8",
+	"int4→int8",
+	"float4→float8"
+]);
+/**
+* Handles `not-equal` column issues whose TYPE differs. `fromContract` is
+* only supplied by `migration plan` — for reconciliation (`db update` /
+* `db init`, `fromContract === null`) this strategy never fires, mirroring
+* the legacy `typeChangeCallStrategy`'s requirement of a prior contract:
+* `mapNodeIssueToCall`'s in-place ALTER covers reconciliation directly.
+*
+* A single node issue can carry BOTH type and nullability drift (Postgres
+* alters in place, so the differ emits one `not-equal` column issue where
+* the legacy coordinate walk emitted two: `type_mismatch` +
+* `nullability_mismatch`). When this strategy consumes the issue for its
+* type portion, it also emits whatever nullability delta the same node pair
+* carries — using the same construction `nullableTighteningCallStrategy` /
+* the mapper's direct dispatch would have used — so the issue is never
+* partially handled.
+*/
+const typeChangeCallStrategy = (issues, ctx) => {
+	if (ctx.fromContract === null) return { kind: "no_match" };
+	const dataAllowed = ctx.policy.allowedOperationClasses.includes("data");
+	const matched = [];
+	const calls = [];
+	for (const issue of issues) {
+		if (issueOutcome(issue) !== "not-equal") continue;
+		const pair = columnNodePair(issue);
+		if (pair === void 0) continue;
+		const { expected, actual } = pair;
+		if (!columnTypeChangedNativeOnly(expected, actual)) continue;
+		const fromType = actual.nativeType;
+		const toType = expected.nativeType;
+		const isSafeWidening = SAFE_WIDENINGS.has(`${fromType}→${toType}`);
+		if (!isSafeWidening && !dataAllowed) continue;
+		const ddlSchemaName = issueSchemaName(issue);
+		const tableName = issueTableName(issue);
+		if (ddlSchemaName === void 0 || tableName === void 0) continue;
+		const schemaName = emissionSchemaName(ctx, ddlSchemaName);
+		matched.push(issue);
+		const { qualifiedTargetType, formatTypeExpected } = renderColumnAlterType(expected, ctx.codecHooks);
+		const alterOpts = {
+			qualifiedTargetType,
+			formatTypeExpected,
+			rawTargetTypeForLabel: qualifiedTargetType
+		};
+		if (isSafeWidening) calls.push(new AlterColumnTypeCall(schemaName, tableName, expected.name, alterOpts));
+		else calls.push(new DataTransformCall(`typechange-${tableName}-${expected.name}`, `typechange-${tableName}-${expected.name}:check`, `typechange-${tableName}-${expected.name}:run`), new AlterColumnTypeCall(schemaName, tableName, expected.name, alterOpts));
+		if (expected.nullable !== actual.nullable) if (expected.nullable) calls.push(new DropNotNullCall(schemaName, tableName, expected.name));
+		else if (dataAllowed) calls.push(new DataTransformCall(`handle-nulls-${tableName}-${expected.name}`, `handle-nulls-${tableName}-${expected.name}:check`, `handle-nulls-${tableName}-${expected.name}:run`), new SetNotNullCall(schemaName, tableName, expected.name));
+		else calls.push(new SetNotNullCall(schemaName, tableName, expected.name));
+	}
+	if (matched.length === 0) return { kind: "no_match" };
+	return {
+		kind: "match",
+		issues: issues.filter((i) => !matched.includes(i)),
+		calls,
+		recipe: true
+	};
+};
+/**
+* Whether the raw (unresolved) native type differs — the SAME comparison
+* `typeChangeCallStrategy` always used (`fromColumn.nativeType !==
+* toColumn.nativeType`), which for the widenable numeric/float types
+* `SAFE_WIDENINGS` lists is identical to the resolved comparison
+* `columnTypeChanged` (in `issue-planner.ts`) performs.
+*/
+function columnTypeChangedNativeOnly(expected, actual) {
+	return expected.nativeType !== actual.nativeType;
+}
+/**
+* Handles `not-equal` column issues whose type did NOT change but
+* nullability tightened (contract requires NOT NULL, live column is
+* nullable). A type-changed issue's nullability delta (if any) is already
+* handled by `typeChangeCallStrategy`, which runs first — this strategy
+* only ever sees issues that strategy left behind.
+*/
+const nullableTighteningCallStrategy = (issues, ctx) => {
+	if (!ctx.policy.allowedOperationClasses.includes("data")) return { kind: "no_match" };
+	const matched = [];
+	const calls = [];
+	for (const issue of issues) {
+		if (issueOutcome(issue) !== "not-equal") continue;
+		const pair = columnNodePair(issue);
+		if (pair === void 0) continue;
+		const { expected, actual } = pair;
+		if (columnTypeChangedNativeOnly(expected, actual)) continue;
+		if (expected.nullable !== false || actual.nullable !== true) continue;
+		const ddlSchemaName = issueSchemaName(issue);
+		const tableName = issueTableName(issue);
+		if (ddlSchemaName === void 0 || tableName === void 0) continue;
+		const schemaName = emissionSchemaName(ctx, ddlSchemaName);
+		matched.push(issue);
+		calls.push(new DataTransformCall(`handle-nulls-${tableName}-${expected.name}`, `handle-nulls-${tableName}-${expected.name}:check`, `handle-nulls-${tableName}-${expected.name}:run`), new SetNotNullCall(schemaName, tableName, expected.name));
+	}
+	if (matched.length === 0) return { kind: "no_match" };
+	return {
+		kind: "match",
+		issues: issues.filter((i) => !matched.includes(i)),
+		calls,
+		recipe: true
+	};
+};
+/**
+* Collects every check constraint from a table in the contract storage.
+* Returns an empty array when the table has no checks or the table is absent.
+*/
+function collectContractChecks(storage, namespaceId, tableName) {
+	const ns = storage.namespaces[namespaceId];
+	const tableRaw = ns !== void 0 ? ns.entries.table?.[tableName] : void 0;
+	if (!(tableRaw instanceof StorageTable)) return [];
+	const checks = tableRaw.checks;
+	if (!checks || checks.length === 0) return [];
+	return checks.map((c) => ({
+		name: c.name,
+		column: c.column,
+		permittedValues: resolveValueSetValues(c.valueSet, storage, `check "${c.name}" on "${tableName}"`)
+	}));
+}
+/**
+* Compares two value arrays as unordered sets.
+*/
+function checkValueSetsEqual(a, b) {
+	if (a.length !== b.length) return false;
+	const bSet = new Set(b);
+	return a.every((v) => bSet.has(v));
+}
+/**
+* Plans check-constraint migrations for `enumType`-authored columns.
+*
+* Walks every namespace's tables in the target contract (the check nodes'
+* resolved `permittedValues` are ultimately sourced from the same
+* contract-declared value sets, so walking the contract directly is the
+* simplest faithful port — the strategy's decisions never depend on which
+* ISSUES happen to be in the input list, only on the contract + live schema
+* shapes). For each table that carries `checks`, diffs the contract-expected
+* checks against the live schema's checks:
+*
+* - Check in contract, absent from live DB → `AddCheckConstraintCall`.
+* - Check in live DB, absent from contract → `DropCheckConstraintCall`.
+* - Check on both sides but value sets differ → `DropCheckConstraintCall`
+*   then `AddCheckConstraintCall` (drop + recreate; a check predicate cannot
+*   be altered in place).
+*
+* Consumes every `sql-check-constraint` issue on a table this walk handles
+* (not-found/not-expected/not-equal), leaving check issues on tables with
+* NO contract checks to `mapNodeIssueToCall`'s `not-expected` fallback.
+*/
+const checkConstraintPlanCallStrategy = (issues, ctx) => {
+	const calls = [];
+	const handledIssueKeys = /* @__PURE__ */ new Set();
+	for (const [namespaceId, ns] of Object.entries(ctx.toContract.storage.namespaces)) for (const tableName of Object.keys(ns.entries.table ?? {})) {
+		const contractChecks = collectContractChecks(ctx.toContract.storage, namespaceId, tableName);
+		if (contractChecks.length === 0) continue;
+		const liveChecks = ctx.schema.tables[tableName]?.checks ?? [];
+		const ddlSchema = resolveDdlSchemaForNamespace(ctx, namespaceId);
+		for (const contractCheck of contractChecks) {
+			const liveCheck = liveChecks.find((c) => c.name === contractCheck.name);
+			const issueKey = `${tableName} ${contractCheck.name}`;
+			if (!liveCheck) {
+				calls.push(new AddCheckConstraintCall(ddlSchema, tableName, contractCheck.name, contractCheck.column, contractCheck.permittedValues));
+				handledIssueKeys.add(issueKey);
+			} else if (!checkValueSetsEqual(contractCheck.permittedValues, liveCheck.permittedValues)) {
+				calls.push(new DropCheckConstraintCall(ddlSchema, tableName, contractCheck.name), new AddCheckConstraintCall(ddlSchema, tableName, contractCheck.name, contractCheck.column, contractCheck.permittedValues));
+				handledIssueKeys.add(issueKey);
+			} else handledIssueKeys.add(issueKey);
+		}
+		for (const liveCheck of liveChecks) if (!contractChecks.some((c) => c.name === liveCheck.name)) {
+			const issueKey = `${tableName} ${liveCheck.name}`;
+			calls.push(new DropCheckConstraintCall(ddlSchema, tableName, liveCheck.name));
+			handledIssueKeys.add(issueKey);
+		}
+	}
+	if (calls.length === 0 && handledIssueKeys.size === 0) return { kind: "no_match" };
+	return {
+		kind: "match",
+		issues: issues.filter((issue) => {
+			const node = issueNode(issue);
+			if (node === void 0 || node.nodeKind !== RelationalSchemaNodeKind.check) return true;
+			const tableName = issueTableName(issue);
+			if (tableName === void 0) return true;
+			const checkName = blindCast(node).name;
+			return !handledIssueKeys.has(`${tableName} ${checkName}`);
+		}),
+		calls
+	};
+};
+/**
+* Dispatches codec-typed storage types through their codec's
+* `planTypeOperations` hook (the authoritative source for codec-driven DDL
+* such as custom type creation). Codec extension/type ops are not modeled as
+* diff nodes — this strategy drives entirely off `ctx.toContract.storage.types`
+* + codec hooks, consuming nothing from the node issue list (there is no
+* node-vocabulary equivalent of `type_missing` / `enum_values_changed`).
+*/
+const storageTypePlanCallStrategy = (issues, ctx) => {
+	const storageTypes = ctx.toContract.storage.types ?? {};
+	if (Object.keys(storageTypes).length === 0) return { kind: "no_match" };
+	const calls = [];
+	for (const [typeName, typeInstance] of Object.entries(storageTypes).sort(([a], [b]) => a.localeCompare(b))) {
+		const codecInstance = typeInstance;
+		const hook = ctx.codecHooks.get(codecInstance.codecId);
+		if (!hook?.planTypeOperations) continue;
+		const planResult = hook.planTypeOperations({
+			typeName,
+			typeInstance: codecInstance,
+			contract: ctx.toContract,
+			schema: ctx.schema,
+			schemaName: ctx.schemaName,
+			policy: ctx.policy
+		});
+		if (!planResult) continue;
+		for (const op of planResult.operations) calls.push(new RawSqlCall({
+			...op,
+			target: {
+				id: op.target.id,
+				details: buildTargetDetails("type", typeName, ctx.schemaName)
+			}
+		}));
+	}
+	if (calls.length === 0) return { kind: "no_match" };
+	return {
+		kind: "match",
+		issues,
+		calls
+	};
+};
+/**
+* Handles `not-found` column issues for NOT NULL columns without a contract
+* default. Replaces the legacy `buildAddColumnItem` non-default branches.
+*
+* Two shapes:
+*  - Shared-temp-default safe: emit a single atomic composite op (add
+*    nullable → backfill identity value → `SET NOT NULL` → `DROP DEFAULT`).
+*    The temp-default value is resolved from the column node's `codecRef`
+*    (`resolveColumnTemporaryDefault`, wrapping `resolveIdentityValue`).
+*  - Empty-table guarded: emit a hand-built op with a `tableIsEmptyCheck`
+*    precheck so the failure message is "table is not empty" rather than the
+*    raw PG NOT NULL violation.
+*
+* "Normal" not-found column cases (nullable or has a contract default) are
+* left for `mapNodeIssueToCall`'s default `AddColumnCall` emission.
+*/
+const notNullAddColumnCallStrategy = (issues, ctx) => {
+	const matched = [];
+	const calls = [];
+	const schemaLookups = buildSchemaLookupMap(ctx.schema);
+	const mutableCodecHooks = ctx.codecHooks;
+	const mutableStorageTypes = ctx.storageTypes;
+	for (const issue of issues) {
+		if (issueOutcome(issue) !== "not-found") continue;
+		const node = issueNode(issue);
+		if (node === void 0 || node.nodeKind !== RelationalSchemaNodeKind.column) continue;
+		const expected = blindCast(issue.expected);
+		if (expected.nullable !== false || expected.resolvedDefault !== void 0) continue;
+		const ddlSchemaName = issueSchemaName(issue);
+		const tableName = issueTableName(issue);
+		if (ddlSchemaName === void 0 || tableName === void 0) continue;
+		const namespaceId = namespaceIdForDdlSchema(ctx, ddlSchemaName);
+		const schemaName = namespaceId === UNBOUND_NAMESPACE_ID ? UNBOUND_NAMESPACE_ID : ddlSchemaName;
+		const contractTable = tableAt(ctx.toContract.storage, namespaceId, tableName);
+		const column = contractTable?.columns[expected.name];
+		if (!contractTable || !column) continue;
+		const schemaTable = ctx.schema.tables[tableName];
+		if (!schemaTable) continue;
+		const temporaryDefault = resolveColumnTemporaryDefault(expected, ctx.codecHooks);
+		const schemaLookup = schemaLookups.get(tableName);
+		const canUseSharedTempDefault = temporaryDefault !== null && canUseSharedTemporaryDefaultStrategy({
+			table: contractTable,
+			schemaTable,
+			schemaLookup,
+			columnName: expected.name
+		});
+		matched.push(issue);
+		if (canUseSharedTempDefault && temporaryDefault !== null) {
+			calls.push(new AddNotNullColumnWithTempDefaultCall({
+				schemaName,
+				tableName,
+				columnName: expected.name,
+				column,
+				codecHooks: mutableCodecHooks,
+				storageTypes: mutableStorageTypes,
+				temporaryDefault
+			}));
+			continue;
+		}
+		calls.push(new AddNotNullColumnDirectCall(schemaName, tableName, expected.name, renderColumnDdl(expected.name, expected, ctx.codecHooks)));
+	}
+	if (matched.length === 0) return { kind: "no_match" };
+	return {
+		kind: "match",
+		issues: issues.filter((i) => !matched.includes(i)),
+		calls
+	};
+};
+function canUseSharedTemporaryDefaultStrategy(options) {
+	const { table, schemaTable, schemaLookup, columnName } = options;
+	if (table.primaryKey?.columns.includes(columnName) && !schemaTable.primaryKey) return false;
+	for (const unique of table.uniques) {
+		if (!unique.columns.includes(columnName)) continue;
+		if (!schemaLookup || !hasUniqueConstraint(schemaLookup, unique.columns)) return false;
+	}
+	for (const foreignKey of table.foreignKeys) {
+		if (!foreignKey.source.columns.includes(columnName)) continue;
+		if (!schemaLookup || !hasForeignKey(schemaLookup, foreignKey)) return false;
+	}
+	return true;
+}
+/**
+* Ordered list of Postgres planner strategies, shared by `migration plan`
+* and `db update` / `db init`. The issue planner runs each strategy in
+* order, letting it consume any issues it handles, and routes whatever's
+* left through `mapNodeIssueToCall`. Behavior diverges purely on
+* `policy.allowedOperationClasses`:
+*
+* - When `'data'` is allowed (`migration plan`), the data-safe strategies
+*   (`notNullBackfillCallStrategy`, `typeChangeCallStrategy`,
+*   `nullableTighteningCallStrategy`) consume their matching issues and emit
+*   `DataTransformCall` placeholders or recipe ops.
+*
+* - When `'data'` is not allowed (`db update` / `db init`), the
+*   placeholder-emitting strategies short-circuit to `no_match`, leaving
+*   the issue for the downstream strategies (`storageTypePlanCallStrategy`,
+*   `notNullAddColumnCallStrategy`) or the `mapNodeIssueToCall` default to
+*   handle with direct DDL.
+*
+* Codec-typed storage type entries are dispatched through
+* `storageTypePlanCallStrategy`.
+*/
+const postgresPlannerStrategies = [
+	notNullBackfillCallStrategy,
+	typeChangeCallStrategy,
+	nullableTighteningCallStrategy,
+	checkConstraintPlanCallStrategy,
+	storageTypePlanCallStrategy,
+	notNullAddColumnCallStrategy
+];
+/**
+* Deterministic name for the element-non-null CHECK constraint on a scalar-array
+* column. Distinct `_elem_not_null` suffix avoids collision with the enum
+* value-set `_check` constraints. Re-emitting the same schema produces the same
+* name, so `pg_get_constraintdef`-based verify sees no drift.
+*/
+function elementNonNullCheckName(tableName, columnName) {
+	return `${tableName}_${columnName}_elem_not_null`;
+}
+/**
+* Predicate enforcing that a scalar-array column carries no NULL element. The
+* array column itself may be NULL (container nullability is the column's NOT NULL
+* clause); `array_position` over a NULL array yields NULL, which a CHECK treats
+* as satisfied, so a nullable array column is unaffected.
+*/
+function elementNonNullCheckExpression(columnName) {
+	return `array_position(${quoteIdentifier(columnName)}, NULL) IS NULL`;
+}
+function issueConflict(kind, summary, location) {
+	return {
+		kind,
+		summary,
+		why: "Use `migration new` to author a custom migration for this change.",
+		...location ? { location } : {}
+	};
+}
+/**
+* Classifies calls into DDL sequencing buckets. The order matches the
+* legacy walk-schema planner's emission order so `db init` and `db update`
+* produce byte-identical plans for the shared shape (deps → drops → tables
+* → columns → alters → PKs → uniques → indexes → FKs).
+*
+* `dropType` (DROP TYPE for a managed native enum) is its own bucket, ordered
+* after the general drop bucket: a type can only be dropped once every table
+* whose column uses it is gone. A column→enum edge would make this precise,
+* but `coalesceSubtreeIssues` removes the column issue under a whole-table
+* drop, so the edge never reaches the graph; the coarse bucket stands in until
+* that edge lands (the coordinate work is a later slice).
+*/
+function classifyCall(call) {
+	switch (call.factoryName) {
+		case "createExtension":
+		case "createSchema":
+		case "createNativeEnumType":
+		case "addNativeEnumValue": return "dep";
+		case "dropNativeEnumType": return "dropType";
+		case "dropTable":
+		case "dropColumn":
+		case "dropConstraint":
+		case "dropCheckConstraint":
+		case "dropIndex":
+		case "dropDefault": return "drop";
+		case "addCheckConstraint": return "unique";
+		case "createTable": return "table";
+		case "enableRowLevelSecurity":
+		case "disableRowLevelSecurity": return "rlsEnable";
+		case "createRlsPolicy": return "rlsPolicy";
+		case "dropRlsPolicy": return "drop";
+		case "addColumn": return "column";
+		case "alterColumnType":
+		case "setNotNull":
+		case "dropNotNull":
+		case "setDefault": return "alter";
+		case "addPrimaryKey": return "primaryKey";
+		case "addUnique": return "unique";
+		case "createIndex":
+		case "renameIndex": return "index";
+		case "addForeignKey": return "foreignKey";
+		case "rawSql":
+			if (call.op?.target?.details?.objectType === "type") return "dep";
+			return "alter";
+		default: return "alter";
+	}
+}
+const DEFAULT_POLICY = { allowedOperationClasses: [
+	"additive",
+	"widening",
+	"destructive",
+	"data"
+] };
+function emptySchemaIR() {
+	return new SqlSchemaIR({ tables: {} });
+}
+function conflictKindForCall(call) {
+	switch (call.factoryName) {
+		case "alterColumnType": return "typeMismatch";
+		case "setNotNull":
+		case "dropNotNull": return "nullabilityConflict";
+		case "addForeignKey":
+		case "dropConstraint": return "foreignKeyConflict";
+		case "createIndex":
+		case "renameIndex":
+		case "dropIndex": return "indexIncompatible";
+		case "createRlsPolicy":
+		case "dropRlsPolicy":
+		case "renameRlsPolicy": return "rlsPolicyIncompatible";
+		default: return "missingButNonAdditive";
+	}
+}
+function locationForCall(call) {
+	const anyCall = call;
+	const location = {};
+	if (anyCall.tableName) {
+		location.entityKind = "table";
+		location.entityName = anyCall.tableName;
+	} else if (anyCall.typeName) {
+		location.entityKind = "native_enum";
+		location.entityName = anyCall.typeName;
+	}
+	if (anyCall.columnName) location.column = anyCall.columnName;
+	if (anyCall.indexName) location.index = anyCall.indexName;
+	else if (anyCall.newIndexName) location.index = anyCall.newIndexName;
+	if (anyCall.constraintName) location.constraint = anyCall.constraintName;
+	if (anyCall.policyName) location.rlsPolicy = anyCall.policyName;
+	else if (anyCall.policy?.name) location.rlsPolicy = anyCall.policy.name;
+	else if (anyCall.newPolicyName) location.rlsPolicy = anyCall.newPolicyName;
+	return Object.keys(location).length > 0 ? location : void 0;
+}
+function conflictForDisallowedCall(call, allowed) {
+	const summary = `Operation "${call.label}" requires class "${call.operationClass}", but policy allows only: ${allowed.join(", ")}`;
+	const location = locationForCall(call);
+	return {
+		kind: conflictKindForCall(call),
+		summary,
+		why: "Use `migration new` to author a custom migration for this change.",
+		...location ? { location } : {}
+	};
+}
+/** The diff node an issue concerns — expected when present, else the actual (extra) node. */
+function issueNode(issue) {
+	const node = issue.expected ?? issue.actual;
+	if (node === void 0) return void 0;
+	return blindCast(node);
+}
+/** DDL schema segment of a table-or-descendant issue path: `[database, ddlSchema, table, …]`. */
+function issueSchemaName(issue) {
+	return issue.path[1];
+}
+/** Table segment of a table-or-descendant issue path: `[database, ddlSchema, table, …]`. */
+function issueTableName(issue) {
+	return issue.path[2];
+}
+/** Column name embedded in a column/default issue path segment (`column:<name>`). */
+function issueColumnName(issue) {
+	const segment = issue.path[3];
+	if (segment === void 0 || !segment.startsWith("column:")) return void 0;
+	return segment.slice(7);
+}
+/**
+* The DDL schema name to use when EMITTING an op against `ddlSchemaName` (the
+* diff tree's resolved physical schema, `issueSchemaName(issue)`). The
+* unbound namespace's diff-tree identity resolves to `public` (a concrete
+* physical default the differ needs in order to compare its tree against
+* introspection — `resolveDdlSchemaForNamespaceStorage`), but DDL EMISSION
+* must stay unqualified so the live connection's `search_path` resolves it
+* at runtime (`boundSchema`). Recovers the logical namespace id via the
+* contract and substitutes the unbound sentinel back in when it resolves
+* there; every other namespace's `ddlSchemaName` already agrees between the
+* two resolution paths, so it passes through unchanged.
+*/
+function emissionSchemaName(ctx, ddlSchemaName) {
+	return resolveNamespaceIdForDdlSchema(ctx.toContract, ddlSchemaName) === UNBOUND_NAMESPACE_ID ? UNBOUND_NAMESPACE_ID : ddlSchemaName;
+}
+/**
+* Whether a column node is a scalar-array (`many: true`) column. The family
+* converter (`contractToSchemaIR`'s `convertColumn`) never stamps `many` on
+* the derived node — array-ness is folded into the `[]` suffix on
+* `nativeType` instead — so the node-derived check reads the suffix; `.many`
+* is still checked first for nodes a caller stamps directly (e.g. hand-built
+* test fixtures, or an adapter that populates it at introspection).
+*/
+function isManyColumn(column) {
+	return column.many === true || column.nativeType.endsWith("[]");
+}
+/** Whether the expected/actual native type (resolved, or raw+many fallback) differs — mirrors `SqlColumnIR.isEqualTo`'s type comparison. */
+function columnTypeChanged(expected, actual) {
+	if (expected.resolvedNativeType !== void 0 && actual.resolvedNativeType !== void 0) return expected.resolvedNativeType !== actual.resolvedNativeType;
+	return expected.nativeType !== actual.nativeType || Boolean(expected.many) !== Boolean(actual.many);
+}
+/**
+* The generic differ is total: a missing/extra table (or column) emits an
+* issue for itself AND for every node in its subtree. `CreateTable`/`DropTable`
+* and `AddColumn`/`DropColumn` already account for the whole subtree, so the
+* nested issues are redundant — coalescing drops any issue whose path is a
+* strict descendant of a `not-found`/`not-expected` issue's path. Run over the
+* relational subset ONLY (policy issues and synthesized namespace issues are
+* handled on their own paths, never coalesced against tables).
+*/
+function coalesceSubtreeIssues(issues) {
+	const collapsingPaths = issues.filter((issue) => issueOutcome(issue) !== "not-equal").map((issue) => issue.path);
+	if (collapsingPaths.length === 0) return issues;
+	return issues.filter((issue) => !collapsingPaths.some((ancestor) => isStrictDescendantPath(issue.path, ancestor)));
+}
+function isStrictDescendantPath(path, ancestor) {
+	if (path.length <= ancestor.length) return false;
+	for (let i = 0; i < ancestor.length; i += 1) if (path[i] !== ancestor[i]) return false;
+	return true;
+}
+function fkSpecFromNode(fk, tableName) {
+	return {
+		name: fk.name ?? `${tableName}_${fk.columns.join("_")}_fkey`,
+		columns: [...fk.columns],
+		references: {
+			schema: fk.referencedSchema ?? "",
+			table: fk.referencedTable,
+			columns: [...fk.referencedColumns]
+		},
+		...ifDefined("onDelete", fk.onDelete),
+		...ifDefined("onUpdate", fk.onUpdate)
+	};
+}
+/**
+* Builds the `CreateTable` + child `CreateIndex` / `AddForeignKey` / `AddUnique`
+* calls for a newly-expected table, reading only the table node's children. The
+* PK and element-non-null CHECKs go inline as table constraints; indexes
+* (declared + FK-backing, already merged and ordered at derivation) and the
+* FK / unique constraints are separate calls (re-bucketed downstream). Every
+* column's DDL is resolved from its `codecRef` via `renderColumnDdl`.
+*/
+function buildCreateTableCallsFromNode(schemaName, ddlSchemaName, table, codecHooks) {
+	const ddlColumns = Object.values(table.columns).map((c) => renderColumnDdl(c.name, c, codecHooks));
+	const primaryKeyConstraints = table.primaryKey ? [contractFree.primaryKey([...table.primaryKey.columns], { ...ifDefined("name", table.primaryKey.name) })] : [];
+	const elementNonNullChecks = Object.values(table.columns).filter((c) => isManyColumn(c)).map((c) => contractFree.checkExpression(elementNonNullCheckName(table.name, c.name), elementNonNullCheckExpression(c.name)));
+	const allTableConstraints = [...primaryKeyConstraints, ...elementNonNullChecks];
+	const calls = [new CreateTableCall(schemaName, table.name, ddlColumns, allTableConstraints.length > 0 ? allTableConstraints : void 0)];
+	for (const index of table.indexes) calls.push(createIndexCallFromNode(index, schemaName, table.name));
+	for (const fk of table.foreignKeys) calls.push(new AddForeignKeyCall(schemaName, table.name, fkSpecFromNode(fk, table.name)));
+	for (const unique of table.uniques) {
+		const constraintName = unique.name ?? `${table.name}_${unique.columns.join("_")}_key`;
+		calls.push(new AddUniqueCall(schemaName, table.name, constraintName, [...unique.columns]));
+	}
+	if (table.rlsEnabled) calls.push(new EnableRowLevelSecurityCall(ddlSchemaName, table.name));
+	return calls;
+}
+function nodeConflict(kind, message) {
+	return issueConflict(kind, message);
+}
+/**
+* True when `actualMembers` (the live database's ordered members) is a
+* strict, order-preserving prefix of `expectedMembers` (the contract's) —
+* the database already carries every contract member, in declaration
+* order, and the contract declares at least one member the database still
+* lacks. Any other relationship — a renamed value, a removed value, a
+* reordering, or the database holding members the contract lacks — is not
+* a suffix append.
+*/
+function isNativeEnumSuffixAppend(actualMembers, expectedMembers) {
+	if (actualMembers.length >= expectedMembers.length) return false;
+	return actualMembers.every((member, index) => member === expectedMembers[index]);
+}
+/** Operator-worded refusal for a native-enum member change beyond a suffix append (design ruling — tests match this verbatim). */
+function nativeEnumMemberChangeRefusal(options) {
+	return `Native enum type "${options.ddlSchemaName}"."${options.typeName}" changed beyond appending new values (contract declares [${options.expectedMembers.join(", ")}], database has [${options.actualMembers.join(", ")}]). Prisma Next does not modify a native enum's existing values (rename, removal, reorder) — see https://pris.ly/d/postgres-native-enums. Author the change manually with \`migration new\`.`;
+}
+/**
+* Managed native-enum issue -> op lowering. A missing declared type creates
+* it; an unclaimed live type drops it (ownership-scoped upstream by
+* `retainUnownedExtras`, destructiveness gated by the operation-class
+* policy); a paired member-value mismatch lowers to one `ALTER TYPE ... ADD
+* VALUE` per appended member when the database's members are a strict,
+* order-preserving prefix of the contract's — any other change (rename,
+* removal, reorder, or the database holding members the contract lacks) is
+* refused with a NAMED diagnostic, never a silent no-op and never a
+* drop-and-recreate.
+*/
+function mapNativeEnumNodeIssue(issue, ctx) {
+	const ddlSchemaName = issueSchemaName(issue);
+	if (ddlSchemaName === void 0) return notOk(nodeConflict("unsupportedOperation", `Enum issue has no schema in its path: ${issue.path.join("/")}`));
+	const schemaName = emissionSchemaName(ctx, ddlSchemaName);
+	if (issueOutcome(issue) === "not-found") {
+		const expected = blindCast(issue.expected);
+		return ok([new CreateNativeEnumTypeCall(schemaName, expected.typeName, expected.members)]);
+	}
+	if (issueOutcome(issue) === "not-expected") return ok([new DropNativeEnumTypeCall(schemaName, blindCast(issue.actual).typeName)]);
+	const expected = blindCast(issue.expected);
+	const actual = blindCast(issue.actual);
+	if (isNativeEnumSuffixAppend(actual.members, expected.members)) return ok(expected.members.slice(actual.members.length).map((value) => new AddNativeEnumValueCall(schemaName, expected.typeName, value)));
+	return notOk(nodeConflict("unsupportedOperation", nativeEnumMemberChangeRefusal({
+		ddlSchemaName,
+		typeName: expected.typeName,
+		expectedMembers: expected.members,
+		actualMembers: actual.members
+	})));
+}
+function mapTableNodeIssue(issue, schemaName, ddlSchemaName, codecHooks) {
+	if (issueOutcome(issue) === "not-found") return ok(buildCreateTableCallsFromNode(schemaName, ddlSchemaName, blindCast(issue.expected), codecHooks));
+	if (issueOutcome(issue) === "not-expected") return ok([new DropTableCall(schemaName, blindCast(issue.actual).name)]);
+	const expected = blindCast(issue.expected);
+	const actual = blindCast(issue.actual);
+	if (expected.rlsEnabled && !actual.rlsEnabled) return ok([new EnableRowLevelSecurityCall(ddlSchemaName, expected.name)]);
+	if (!expected.rlsEnabled && actual.rlsEnabled) return ok([new DisableRowLevelSecurityCall(ddlSchemaName, expected.name)]);
+	return notOk(nodeConflict("unsupportedOperation", `unhandled table-attribute drift on "${expected.name}": table not-equal with no rlsEnabled delta (a second table attribute drifted)`));
+}
+function mapColumnNodeIssue(issue, schemaName, tableName, codecHooks) {
+	if (issueOutcome(issue) === "not-found") {
+		const column = blindCast(issue.expected);
+		return ok([new AddColumnCall(schemaName, tableName, renderColumnDdl(column.name, column, codecHooks))]);
+	}
+	if (issueOutcome(issue) === "not-expected") return ok([new DropColumnCall(schemaName, tableName, blindCast(issue.actual).name)]);
+	const expected = blindCast(issue.expected);
+	const actual = blindCast(issue.actual);
+	const calls = [];
+	if (columnTypeChanged(expected, actual)) {
+		const { qualifiedTargetType, formatTypeExpected } = renderColumnAlterType(expected, codecHooks);
+		calls.push(new AlterColumnTypeCall(schemaName, tableName, expected.name, {
+			qualifiedTargetType,
+			formatTypeExpected,
+			rawTargetTypeForLabel: qualifiedTargetType
+		}));
+	}
+	if (expected.nullable !== actual.nullable) calls.push(expected.nullable ? new DropNotNullCall(schemaName, tableName, expected.name) : new SetNotNullCall(schemaName, tableName, expected.name));
+	return ok(calls);
+}
+function mapColumnDefaultNodeIssue(issue, schemaName, tableName, columnName) {
+	if (issueOutcome(issue) === "not-expected") return ok([new DropDefaultCall(schemaName, tableName, columnName)]);
+	if (issue.expected === void 0) return ok([]);
+	const defaultSql = renderColumnDefaultSql(blindCast(issue.expected));
+	if (!defaultSql) return ok([]);
+	return ok([new SetDefaultCall(schemaName, tableName, columnName, defaultSql, issueOutcome(issue) === "not-equal" ? "widening" : "additive")]);
+}
+function mapPrimaryKeyNodeIssue(issue, schemaName, tableName) {
+	if (issueOutcome(issue) === "not-found") {
+		const pk = blindCast(issue.expected);
+		return ok([new AddPrimaryKeyCall(schemaName, tableName, pk.name ?? `${tableName}_pkey`, [...pk.columns])]);
+	}
+	if (issueOutcome(issue) === "not-expected") return ok([new DropConstraintCall(schemaName, tableName, blindCast(issue.actual).name ?? `${tableName}_pkey`, "primaryKey")]);
+	return notOk(nodeConflict("indexIncompatible", issue.path.join("/")));
+}
+function mapForeignKeyNodeIssue(issue, schemaName, tableName) {
+	if (issueOutcome(issue) === "not-found") return ok([new AddForeignKeyCall(schemaName, tableName, fkSpecFromNode(blindCast(issue.expected), tableName))]);
+	if (issueOutcome(issue) === "not-expected") {
+		const fk = blindCast(issue.actual);
+		return ok([new DropConstraintCall(schemaName, tableName, fk.name ?? `${tableName}_${fk.columns.join("_")}_fkey`, "foreignKey")]);
+	}
+	return notOk(nodeConflict("foreignKeyConflict", issue.path.join("/")));
+}
+function mapUniqueNodeIssue(issue, schemaName, tableName) {
+	if (issueOutcome(issue) === "not-found") {
+		const unique = blindCast(issue.expected);
+		return ok([new AddUniqueCall(schemaName, tableName, unique.name ?? `${tableName}_${unique.columns.join("_")}_key`, [...unique.columns])]);
+	}
+	if (issueOutcome(issue) === "not-expected") {
+		const unique = blindCast(issue.actual);
+		return ok([new DropConstraintCall(schemaName, tableName, unique.name ?? `${tableName}_${unique.columns.join("_")}_key`, "unique")]);
+	}
+	return notOk(nodeConflict("indexIncompatible", issue.path.join("/")));
+}
+/**
+* The CreateIndexCall for a name-identified index node: the node's own name
+* verbatim, its element list (column tuple or opaque expression), and the
+* unique/type/options/where attributes carried through.
+*/
+function createIndexCallFromNode(index, schemaName, tableName) {
+	const extras = {};
+	if (index.type !== void 0) extras.type = index.type;
+	if (index.options !== void 0) extras.options = index.options;
+	if (index.where !== void 0) extras.where = index.where;
+	if (index.unique) extras.unique = true;
+	return new CreateIndexCall(schemaName, tableName, index.name, index.columns !== void 0 ? { columns: [...index.columns] } : { expression: index.expression ?? "" }, extras);
+}
+function mapIndexNodeIssue(issue, schemaName, tableName) {
+	if (issueOutcome(issue) === "not-found") return ok([createIndexCallFromNode(blindCast(issue.expected), schemaName, tableName)]);
+	if (issueOutcome(issue) === "not-expected") return ok([new DropIndexCall(schemaName, tableName, blindCast(issue.actual).name)]);
+	return notOk(nodeConflict("indexIncompatible", issue.path.join("/")));
+}
+function mapCheckNodeIssue(issue, schemaName, tableName) {
+	if (issueOutcome(issue) === "not-expected") return ok([new DropCheckConstraintCall(schemaName, tableName, blindCast(issue.actual).name)]);
+	return notOk(nodeConflict("unsupportedOperation", `Check constraint drift on "${tableName}" — handled by checkConstraintPlanCallStrategy: ${issue.path.join("/")}`));
+}
+/**
+* Maps one node-typed diff issue to its migration call(s), dispatching on the
+* node's `nodeKind` and the issue's presence-derived `issueOutcome`, reading
+* nodes and resolving column DDL from `codecRef` via `column-ddl-rendering.ts`.
+*/
+function mapNodeIssueToCall(issue, ctx) {
+	const node = issueNode(issue);
+	if (node === void 0) return notOk(nodeConflict("unsupportedOperation", `Issue carries neither an expected nor an actual node: ${issue.path.join("/")}`));
+	if (node.nodeKind === PostgresSchemaNodeKind.namespace) {
+		if (issueOutcome(issue) !== "not-found") return notOk(nodeConflict("unsupportedOperation", `Unexpected namespace drift: ${issue.path.join("/")}`));
+		return ok([new CreateSchemaCall(blindCast(issue.expected).schemaName)]);
+	}
+	if (node.nodeKind === PostgresSchemaNodeKind.nativeEnum) return mapNativeEnumNodeIssue(issue, ctx);
+	const ddlSchemaName = issueSchemaName(issue);
+	const tableName = issueTableName(issue);
+	if (ddlSchemaName === void 0 || tableName === void 0) return notOk(nodeConflict("unsupportedOperation", `Issue has no schema/table in its path: ${issue.path.join("/")}`));
+	const schemaName = emissionSchemaName(ctx, ddlSchemaName);
+	switch (node.nodeKind) {
+		case PostgresSchemaNodeKind.table: return mapTableNodeIssue(issue, schemaName, ddlSchemaName, ctx.codecHooks);
+		case RelationalSchemaNodeKind.column: return mapColumnNodeIssue(issue, schemaName, tableName, ctx.codecHooks);
+		case RelationalSchemaNodeKind.columnDefault: {
+			const columnName = issueColumnName(issue);
+			if (columnName === void 0) return notOk(nodeConflict("unsupportedOperation", `Default issue has no column in its path: ${issue.path.join("/")}`));
+			return mapColumnDefaultNodeIssue(issue, schemaName, tableName, columnName);
+		}
+		case RelationalSchemaNodeKind.primaryKey: return mapPrimaryKeyNodeIssue(issue, schemaName, tableName);
+		case RelationalSchemaNodeKind.foreignKey: return mapForeignKeyNodeIssue(issue, schemaName, tableName);
+		case RelationalSchemaNodeKind.unique: return mapUniqueNodeIssue(issue, schemaName, tableName);
+		case RelationalSchemaNodeKind.index: return mapIndexNodeIssue(issue, schemaName, tableName);
+		case RelationalSchemaNodeKind.check: return mapCheckNodeIssue(issue, schemaName, tableName);
+		default: return notOk(nodeConflict("unsupportedOperation", `Unhandled node kind: ${node.nodeKind}`));
+	}
+}
+/**
+* Runs the ordered strategy list over the node-typed diff issues, maps
+* leftover issues via {@link mapNodeIssueToCall}, applies operation-class
+* policy gating, and buckets calls into the fixed DDL emission order (dep →
+* drop → table → column → recipe → alter → primaryKey → unique → index →
+* foreignKey).
+*/
+function planIssues(options) {
+	const policyProvided = options.policy !== void 0;
+	const policy = options.policy ?? DEFAULT_POLICY;
+	const schema = options.schema ?? emptySchemaIR();
+	const frameworkComponents = options.frameworkComponents ?? [];
+	const context = {
+		toContract: options.toContract,
+		fromContract: options.fromContract,
+		schemaName: options.schemaName,
+		codecHooks: options.codecHooks,
+		storageTypes: options.storageTypes,
+		schema,
+		policy,
+		frameworkComponents
+	};
+	const strategies = options.strategies ?? postgresPlannerStrategies;
+	let remaining = options.issues;
+	const recipeCalls = [];
+	const bucketablePatternCalls = [];
+	for (const strategy of strategies) {
+		const result = strategy(remaining, context);
+		if (result.kind === "match") {
+			remaining = result.issues;
+			if (result.recipe) recipeCalls.push(...result.calls);
+			else bucketablePatternCalls.push(...result.calls);
+		}
+	}
+	const sorted = orderIssuesByDependencies(remaining);
+	const defaultCalls = [];
+	const conflicts = [];
+	for (const issue of sorted) {
+		const result = mapNodeIssueToCall(issue, context);
+		if (result.ok) defaultCalls.push(...result.value);
+		else conflicts.push(result.failure);
+	}
+	const allowed = policy.allowedOperationClasses;
+	let gatedDefault = defaultCalls;
+	let gatedRecipe = recipeCalls;
+	let gatedBucketable = bucketablePatternCalls;
+	if (policyProvided) {
+		const keepIfAllowed = (bucket) => (call) => {
+			if (allowed.includes(call.operationClass)) {
+				bucket.push(call);
+				return;
+			}
+			conflicts.push(conflictForDisallowedCall(call, allowed));
+		};
+		const gatedDefaultBucket = [];
+		const gatedRecipeBucket = [];
+		const gatedBucketableBucket = [];
+		defaultCalls.forEach(keepIfAllowed(gatedDefaultBucket));
+		recipeCalls.forEach(keepIfAllowed(gatedRecipeBucket));
+		bucketablePatternCalls.forEach(keepIfAllowed(gatedBucketableBucket));
+		gatedDefault = gatedDefaultBucket;
+		gatedRecipe = gatedRecipeBucket;
+		gatedBucketable = gatedBucketableBucket;
+	}
+	if (conflicts.length > 0) return notOk(conflicts);
+	const combinedBucketable = [...gatedDefault, ...gatedBucketable];
+	const byCategory = (cat) => combinedBucketable.filter((c) => classifyCall(c) === cat);
+	return ok({ calls: [
+		...byCategory("dep"),
+		...byCategory("drop"),
+		...byCategory("dropType"),
+		...byCategory("table"),
+		...byCategory("column"),
+		...gatedRecipe,
+		...byCategory("alter"),
+		...byCategory("primaryKey"),
+		...byCategory("unique"),
+		...byCategory("index"),
+		...byCategory("foreignKey"),
+		...byCategory("rlsEnable")
+	] });
+}
+/**
+* Factory calls that create a whole, previously-absent top-level storage
+* object. Used to decide whether `tolerated` permits a call (it only allows
+* creating absent objects, never modifying existing ones).
+*
+* Deliberately an explicit, closed set rather than a `factoryName`
+* create/alter/drop classification: it answers exactly one yes/no question
+* and is fail-closed. Any call not listed here — including future or
+* extension-contributed factories — is treated as NOT object-creation, so it
+* is suppressed under `tolerated` rather than permissively emitted.
+*
+* Lists the creation factories that actually reach the call-side resolver
+* (`resolvePostgresCallControlPolicySubject`) — today only RLS policy
+* creation, from `planPostgresSchemaDiff`. Every other whole-object create
+* (table, schema, native enum, and RLS enablement) is constructed inside
+* `planIssues` and graded on the node side by
+* `resolvePostgresNodeIssueCreationFactoryName`, so none of them are listed
+* here.
+*/
+const OBJECT_CREATION_FACTORIES = /* @__PURE__ */ new Set(["createRlsPolicy"]);
+function createsNewTopLevelObject(call) {
+	return OBJECT_CREATION_FACTORIES.has(call.factoryName);
+}
+function ddlSchemaNameForNamespace(contract, namespaceId) {
+	const namespace = contract.storage.namespaces[namespaceId];
+	return isPostgresSchema(namespace) ? namespace.ddlSchemaName(contract.storage) : namespaceId;
+}
+/**
+* Resolve the namespace a declared storage entity lives in by walking every
+* namespace for one whose `entries` map actually contains the coordinate —
+* a table by its name, a native enum by its physical type name (see
+* {@link postgresNodeStorageCoordinate}). When `ddlSchemaName` is given, the
+* match must also land in that DDL schema (disambiguates same-named entities
+* declared under different namespaces); when omitted, the first namespace
+* that declares the entity wins. Falls back to {@link UNBOUND_NAMESPACE_ID}
+* when no namespace declares it — e.g. an extra/dropped entity the contract
+* doesn't claim at all.
+*/
+function resolveNamespaceIdForEntity(contract, coordinate, ddlSchemaName) {
+	for (const namespaceId of Object.keys(contract.storage.namespaces)) {
+		if (!entityAt(contract.storage, {
+			namespaceId,
+			...coordinate
+		})) continue;
+		if (ddlSchemaName === void 0 || ddlSchemaNameForNamespace(contract, namespaceId) === ddlSchemaName) return namespaceId;
+	}
+	return UNBOUND_NAMESPACE_ID;
+}
+function resolveNamespaceIdForTable(contract, tableName, ddlSchemaName) {
+	return resolveNamespaceIdForEntity(contract, {
+		entityKind: "table",
+		entityName: tableName
+	}, ddlSchemaName);
+}
+function resolveNamespaceIdForDdlSchema(contract, ddlSchemaName) {
+	for (const namespaceId of Object.keys(contract.storage.namespaces)) {
+		const ns = contract.storage.namespaces[namespaceId];
+		if (isPostgresSchema(ns) && ns.ddlSchemaName(contract.storage) === ddlSchemaName) return namespaceId;
+		if (namespaceId === ddlSchemaName) return namespaceId;
+	}
+	return UNBOUND_NAMESPACE_ID;
+}
+function postgresCallFields(call) {
+	return {
+		...ifDefined("schemaName", "schemaName" in call ? call.schemaName : void 0),
+		...ifDefined("tableName", "tableName" in call ? call.tableName : void 0),
+		...ifDefined("columnName", "columnName" in call ? call.columnName : void 0)
+	};
+}
+function formatSuppressionSubjectLabel(subject, contract) {
+	if (subject === void 0) return "unknown";
+	const ddlSchema = ddlSchemaNameForNamespace(contract, subject.namespaceId);
+	if (subject.entityKind !== void 0 && subject.entityName !== void 0) {
+		const entityLabel = `${subject.entityKind} "${ddlSchema}.${subject.entityName}"`;
+		return subject.rlsPolicy !== void 0 ? `RLS policy "${subject.rlsPolicy}" on ${entityLabel}` : entityLabel;
+	}
+	return `namespace "${ddlSchema}"`;
+}
+function postgresSuppressionSummary(subjectLabel, subject, policy) {
+	const namespace = subject?.namespaceId ?? "unknown";
+	const declared = subject?.explicitNodeControlPolicy;
+	if (policy === "external" && declared === "managed") return `control policy suppressed: ${subjectLabel} — namespace '${namespace}' has effective control 'external' but declared 'managed'`;
+	return `control policy suppressed: ${subjectLabel} — namespace '${namespace}' has effective control '${policy}'${declared ? ` but declared '${declared}'` : ""}`;
+}
+/**
+* Render one family {@link SuppressionRecord} into a target `SqlPlannerConflict`.
+* The family decides *that* a subject is suppressed and hands over the raw
+* coordinate + policy; the label, message, and location are rendered here,
+* driven entirely by the subject's own `(entityKind, entityName)` coordinate
+* — no target-owned table-vs-enum vocabulary.
+*/
+function renderPostgresSuppression(record, contract) {
+	const subject = record.subject;
+	return {
+		kind: "controlPolicySuppressedCall",
+		summary: postgresSuppressionSummary(formatSuppressionSubjectLabel(subject, contract), subject, record.policy),
+		location: {
+			...ifDefined("namespaceId", subject?.namespaceId),
+			...ifDefined("entityKind", subject?.entityKind),
+			...ifDefined("entityName", subject?.entityName),
+			...ifDefined("column", subject?.column),
+			...ifDefined("rlsPolicy", subject?.rlsPolicy)
+		},
+		meta: {
+			controlPolicy: record.policy,
+			...ifDefined("factoryName", record.factoryName),
+			...ifDefined("rlsPolicy", subject?.rlsPolicy),
+			...ifDefined("declaredControlPolicy", subject?.explicitNodeControlPolicy)
+		}
+	};
+}
+function resolvePostgresCallControlPolicySubject(call, contract) {
+	const callFields = postgresCallFields(call);
+	const createsNewObject = createsNewTopLevelObject(call);
+	if (call.factoryName === "createSchema" && callFields.schemaName) return {
+		namespaceId: resolveNamespaceIdForDdlSchema(contract, callFields.schemaName),
+		createsNewObject
+	};
+	if (callFields.tableName) {
+		const namespaceId = resolveNamespaceIdForTable(contract, callFields.tableName, callFields.schemaName);
+		const tableControlPolicy = entityAt(contract.storage, {
+			namespaceId,
+			entityKind: "table",
+			entityName: callFields.tableName
+		})?.control;
+		return {
+			namespaceId,
+			entityKind: "table",
+			entityName: callFields.tableName,
+			...ifDefined("column", callFields.columnName),
+			...ifDefined("explicitNodeControlPolicy", tableControlPolicy),
+			createsNewObject
+		};
+	}
+	if (callFields.schemaName) return {
+		namespaceId: resolveNamespaceIdForDdlSchema(contract, callFields.schemaName),
+		createsNewObject
+	};
+}
+/**
+* Node kinds whose *absence* is the creation of a whole, top-level Postgres
+* object: a namespace, a table, or a native enum. Used by
+* {@link resolvePostgresNodeIssueCreationFactoryName} to decide whether a
+* `tolerated` subject permits the issue to flow into the planner
+* (create-if-absent) and to seed the suppressed-subject warning's
+* `factoryName` when the planner is skipped. RLS policy creation is not
+* listed here — policy issues never reach this issue-based partition (they
+* are routed to `planPostgresSchemaDiff` and gated via the call-based
+* {@link resolvePostgresCallControlPolicySubject} instead).
+*/
+const POSTGRES_NODE_CREATION_FACTORY = Object.freeze({
+	[PostgresSchemaNodeKind.namespace]: "createSchema",
+	[PostgresSchemaNodeKind.table]: "createTable",
+	[PostgresSchemaNodeKind.nativeEnum]: "createNativeEnumType"
+});
+/**
+* A table `not-equal` issue whose `rlsEnabled` flips OFF→ON (expected on,
+* actual off) is enablement toward `ENABLE ROW LEVEL SECURITY`. It is
+* creation-class on the node side because `isEnablementCreationIssue` and
+* {@link resolvePostgresNodeIssueCreationFactoryName} treat this OFF→ON delta
+* as a creation: enabling RLS establishes the fail-closed guard the declared
+* policy set attaches to, the same grant `tolerated` extends to creating the
+* policies themselves. The opposite direction (`DISABLE`) is a modification
+* and stays managed-only. Keying on the actual delta (not just the expected
+* bit) keeps this correct if a second table attribute ever joins
+* `isEqualTo`: a not-equal with no `rlsEnabled` delta is not enablement, so
+* it is not admitted as creation-class here.
+*/
+function isEnablementCreationIssue(issue) {
+	if (issueOutcome(issue) !== "not-equal") return false;
+	const { expected, actual } = issue;
+	return expected !== void 0 && actual !== void 0 && PostgresTableSchemaNode.is(expected) && PostgresTableSchemaNode.is(actual) && expected.rlsEnabled === true && actual.rlsEnabled === false;
+}
+function resolvePostgresNodeIssueCreationFactoryName(issue) {
+	if (isEnablementCreationIssue(issue)) return "enableRowLevelSecurity";
+	if (issueOutcome(issue) !== "not-found") return void 0;
+	const node = issue.expected ?? issue.actual;
+	if (node === void 0) return void 0;
+	return POSTGRES_NODE_CREATION_FACTORY[node.nodeKind];
+}
+/**
+* Resolves the control-policy subject for a node-typed {@link SchemaDiffIssue}
+* (the issue-side mirror of `resolvePostgresCallControlPolicySubject`).
+* Storage entities resolve off their node coordinate; a sub-entity issue
+* resolves off the enclosing table read from the issue path; an unclaimed
+* extra falls back to the unbound coordinate. A role always resolves
+* `'external'` — roles are referenced, never owned.
+*/
+function resolvePostgresNodeIssueControlPolicySubject(issue, contract) {
+	const node = issue.expected ?? issue.actual;
+	if (node === void 0) return void 0;
+	if (node.nodeKind === PostgresSchemaNodeKind.namespace) return {
+		namespaceId: resolveNamespaceIdForDdlSchema(contract, blindCast(node).schemaName),
+		createsNewObject: issueOutcome(issue) === "not-found"
+	};
+	if (node.nodeKind === PostgresSchemaNodeKind.role) {
+		const roleName = issue.path[1];
+		return {
+			namespaceId: UNBOUND_NAMESPACE_ID,
+			explicitNodeControlPolicy: (roleName === void 0 ? void 0 : entityAt(contract.storage, {
+				namespaceId: UNBOUND_NAMESPACE_ID,
+				entityKind: "role",
+				entityName: roleName
+			}))?.control ?? "external",
+			createsNewObject: false
+		};
+	}
+	const coordinate = postgresNodeStorageCoordinate(node);
+	if (coordinate !== void 0) {
+		const namespaceId = resolveNamespaceIdForEntity(contract, coordinate, issue.path[1]);
+		const entityControl = entityAt(contract.storage, {
+			namespaceId,
+			...coordinate
+		})?.control;
+		return {
+			namespaceId,
+			...coordinate,
+			...ifDefined("column", issueColumnName(issue)),
+			...ifDefined("explicitNodeControlPolicy", entityControl),
+			createsNewObject: resolvePostgresNodeIssueCreationFactoryName(issue) !== void 0
+		};
+	}
+	const tableName = issue.path[2];
+	if (tableName === void 0) return void 0;
+	const ddlSchemaName = issue.path[1];
+	const namespaceId = resolveNamespaceIdForTable(contract, tableName, ddlSchemaName);
+	const table = entityAt(contract.storage, {
+		namespaceId,
+		entityKind: "table",
+		entityName: tableName
+	});
+	return {
+		namespaceId,
+		entityKind: "table",
+		entityName: tableName,
+		...ifDefined("column", issueColumnName(issue)),
+		...ifDefined("explicitNodeControlPolicy", table?.control),
+		createsNewObject: resolvePostgresNodeIssueCreationFactoryName(issue) !== void 0
+	};
+}
+//#endregion
+export { planIssues as a, renderPostgresSuppression as c, resolvePostgresNodeIssueControlPolicySubject as d, resolvePostgresNodeIssueCreationFactoryName as f, issueSchemaName as i, resolveNamespaceIdForDdlSchema as l, conflictForDisallowedCall as n, postgresNodeStorageCoordinate as o, issueNode as r, postgresPlannerStrategies as s, coalesceSubtreeIssues as t, resolvePostgresCallControlPolicySubject as u };
+
+//# sourceMappingURL=control-policy-Cl3RRSPg-CT3QGpR3.mjs.map