
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@prisma-next/target-postgres
Advanced tools
Postgres target pack for Prisma Next.
Provides the Postgres target descriptor (SqlControlTargetDescriptor) for CLI config. The target descriptor includes capabilities and type information directly as properties, as well as factories for creating migration planners and runners.
SqlControlTargetDescriptor for use in CLI configuration filesmigrations.createPlanner() to create Postgres-specific migration plannersmigrations.createRunner() to create Postgres-specific migration runnersmigrations.contractToSchema() which converts a contract's SqlStorage to SqlSchemaIR via the SQL family's contractToSchemaIR. Used by migration plan for offline planning without a database connectionnextval(...), now()) when verifying the post-apply schemaframeworkComponents), verifies each dependency against the live schema, and only emits install operations when required. The runner reuses the same metadata for post-apply verification, so there are no hardcoded extension mappings—database dependencies stay component-owned.storage.types and emits type operations before table creation when supported by the policyThis package spans multiple planes:
src/exports/control.ts): Control plane entry point that exports SqlControlTargetDescriptor for config filessrc/exports/runtime.ts): Runtime entry point for target-specific runtime code (future)src/exports/pack.ts): Pure data surface for contract builder workflowsdb initThis package provides the Postgres implementation of the SQL migration planner/runner used by prisma-next db init:
src/core/migrations/planner.ts): produces an additive-only MigrationPlan to bring the database schema in line with a destination contract. Extra unrelated schema is tolerated; non-additive mismatches (type/nullability/constraint incompatibilities) surface as structured conflicts. Storage type operations (from codec-owned hooks) are emitted before table operations when storage.types are present. The planner respects the contract's foreignKeys configuration: when foreignKeys.constraints is false, FK constraint operations are skipped; when foreignKeys.indexes is false, FK-backing indexes are omitted. See ADR 161. The planner also emits ON DELETE and ON UPDATE referential action clauses when specified on foreign keys (see ADR 166).src/core/migrations/runner.ts): executes a plan under an advisory lock, verifies the post-state schema, then writes the contract marker and appends a ledger entry in the prisma_contract schema.For the CLI orchestration, see packages/1-framework/3-tooling/cli/src/commands/db-init.ts.
import postgres from '@prisma-next/target-postgres/control';
import sqlFamilyDescriptor from '@prisma-next/family-sql/control';
import postgresAdapter from '@prisma-next/adapter-postgres/control';
import postgresDriver from '@prisma-next/driver-postgres/control';
// postgres is a SqlControlTargetDescriptor with:
// - kind: 'target'
// - familyId: 'sql'
// - targetId: 'postgres'
// - id: 'postgres'
// - version: '0.0.1'
// - capabilities, types, operations (directly on descriptor)
// - migrations.createPlanner(): creates a Postgres migration planner
// - migrations.createRunner(): creates a Postgres migration runner
// Create family instance with target, adapter, and driver
const family = sqlFamilyDescriptor.create({
target: postgres,
adapter: postgresAdapter,
driver: postgresDriver,
extensions: [],
});
// Include the active framework components so planner/runner can resolve
// component-owned database dependencies (e.g., extension installs).
const frameworkComponents = [postgres, postgresAdapter];
// Create planner and runner from target descriptor
const planner = postgres.migrations.createPlanner(family);
const runner = postgres.migrations.createRunner(family);
// Plan and execute migrations
const planResult = planner.plan({ contract, schema, policy, frameworkComponents });
if (planResult.kind === 'success') {
const executeResult = await runner.execute({
plan: planResult.plan,
driver,
destinationContract: contract,
policy,
frameworkComponents,
});
if (!executeResult.ok) {
// Handle structured failure (e.g., EXECUTION_FAILED, PRECHECK_FAILED)
console.error(executeResult.failure.code, executeResult.failure.summary);
}
} else {
// Handle planner failure (e.g., unsupportedOperation)
console.error(planResult.conflicts);
}
import postgresPack from '@prisma-next/target-postgres/pack';
import pgvector from '@prisma-next/extension-pgvector/pack';
import sqlFamily from '@prisma-next/family-sql/pack';
import { defineContract } from '@prisma-next/sql-contract-ts/contract-builder';
export const contract = defineContract({
family: sqlFamily,
target: postgresPack,
extensionPacks: { pgvector },
});
Pack refs are pure JSON-friendly objects that make TypeScript contract authoring work in both emit and no-emit workflows without requiring separate manifest files.
This package provides both control and runtime entry points for the Postgres target. All declarative fields (version, capabilities, types, operations) are defined directly on the descriptor, so the published entry points never touch the filesystem. The ./pack entry point provides a pure pack ref for contract authoring. The runtime entry point will provide target-specific runtime functionality in the future.
Both the planner and runner return structured results instead of throwing:
Planner returns PlannerResult with either:
kind: 'success' with a MigrationPlankind: 'failure' with a list of PlannerConflict objects (e.g., unsupportedOperation, policyViolation)Runner returns MigrationRunnerResult (Result<MigrationRunnerSuccessValue, MigrationRunnerFailure>) with either:
ok: true with operation countsok: false with a MigrationRunnerFailure containing error code, summary, and metadataRunner error codes include: EXECUTION_FAILED, PRECHECK_FAILED, POSTCHECK_FAILED, SCHEMA_VERIFY_FAILED, POLICY_VIOLATION, MARKER_ORIGIN_MISMATCH, DESTINATION_CONTRACT_MISMATCH.
See @prisma-next/family-sql/control README for full error code documentation.
@prisma-next/family-sql: SQL family types (SqlControlTargetDescriptor, SqlControlFamilyInstance)@prisma-next/framework-components: Control plane types via ./control (ControlTargetInstance)@prisma-next/sql-contract: Pack types (TargetPackRef)arktype: Runtime validationDependents:
./control: Control plane entry point for SqlControlTargetDescriptor./runtime: Runtime entry point for target-specific runtime code (future)./pack: Pure pack ref for defineContract({ family, target: postgresPack, ... })This package ships a mix of fast planner unit tests and slower runner integration tests that require a dev Postgres instance (via @prisma/dev).
pnpm --filter @prisma-next/target-postgres test): runs all tests including integration teststest/migrations/planner.behavior.test.ts: Planner unit tests (classification, conflicts, dependency ops)test/migrations/planner.fk-config.test.ts: Planner unit tests for FK constraint/index configuration combinationstest/migrations/planner.referential-actions.test.ts: Planner unit tests for ON DELETE/ON UPDATE DDL emissiontest/migrations/planner.integration.test.ts: Planner integration teststest/migrations/runner.*.integration.test.ts: Runner integration tests (basic, errors, idempotency, policy)pnpm --filter @prisma-next/target-postgres test
FAQs
Postgres target pack for Prisma Next
The npm package @prisma-next/target-postgres receives a total of 8,867 weekly downloads. As such, @prisma-next/target-postgres popularity was classified as popular.
We found that @prisma-next/target-postgres demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.