@intentius/chant-lexicon-sql 0.0.0-stage → 0.112.1

package/src/postgres/plan/schema.ts

@@ -0,0 +1,114 @@
+/**
+ * The two sides a Postgres diff compares: a build's output (the
+ * declarations), or what a live server's catalog prints. Both are parsed with
+ * the tag each object was declared with and brought to canonical form
+ * (`./normalize.ts`), so the diff compares like with like.
+ */
+
+import { readFileSync } from "node:fs";
+import type { Keyed } from "../../core/diff";
+import { previouslyIn } from "../../core/normalize";
+import type { LivePgObject } from "../live/catalog";
+import { liveProps } from "./deep";
+import { canonicalPgObject, type CanonicalPgObject } from "./normalize";
+import { identValue } from "../parser";
+
+/** A canonical object with what the diff needs besides: rename hints, how an index is created, a view's outputs. */
+export interface PgDiffObject extends CanonicalPgObject {
+  type: string;
+  /** `-- previously: <old name>` before the CREATE. */
+  previously?: string;
+  /** Per column, `-- previously: <old name>` on its line. */
+  columnPreviously: Record<string, string>;
+  /** The index is declared CONCURRENTLY. */
+  concurrently?: boolean;
+  /** A view's output columns, in order. */
+  outputs?: string[];
+  /** The tool another object belongs to (an ORM's revision table), when it is not chant's to change. */
+  foreign?: string;
+  /** The export name, against a server. */
+  exportName?: string;
+}
+
+export type PgSchemaObject = Keyed<PgDiffObject>;
+
+/** The rename hints in a statement: the object's (a comment before the CREATE) and each column's (a comment on its line). */
+export function renameHints(ddl: string): { previously?: string; columns: Record<string, string> } {
+  const lines = ddl.split("\n");
+  const createAt = lines.findIndex((l) => /\bCREATE\b/i.test(l.replace(/--.*$/, "")));
+  const before = lines.slice(0, Math.max(createAt, 0)).map((l) => l.trim()).filter((l) => l.startsWith("--"));
+  const columns: Record<string, string> = {};
+  for (const line of lines.slice(createAt + 1)) {
+    const m = /^\s*("(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)\b.*?(--.*)$/.exec(line);
+    if (!m) continue;
+    const prev = previouslyIn([m[2]!]);
+    if (prev) columns[identValue(m[1]!)] = identValue(prev);
+  }
+  const prev = previouslyIn(before);
+  return { ...(prev ? { previously: prev } : {}), columns };
+}
+
+/** One object, from its type and statements, in the diff's form. */
+export function diffObject(type: string, ddl: string, defaultSchema: string): PgDiffObject {
+  const props = liveProps({ type, statement: ddl } as LivePgObject);
+  const canonical = canonicalPgObject(type, props, defaultSchema);
+  const hints = renameHints(ddl);
+  const lineage = props.lineage as Array<{ output: string }> | undefined;
+  const declaredColumns = props.columns as unknown[] | undefined;
+  return {
+    ...canonical,
+    type,
+    ...(hints.previously ? { previously: identValue(hints.previously) } : {}),
+    columnPreviously: hints.columns,
+    ...(props.concurrently === true ? { concurrently: true } : {}),
+    ...(canonical.kind === "view" || canonical.kind === "materializedView"
+      ? { outputs: Array.isArray(declaredColumns) && declaredColumns.length > 0 ? (declaredColumns as string[]) : (lineage ?? []).map((e) => e.output) }
+      : {}),
+  };
+}
+
+interface OutputDoc {
+  dialect?: string;
+  postgresMajor?: number;
+  objects?: Array<{ export: string; type: string; ddl: string }>;
+}
+
+/** The objects a Postgres `chant build` output holds, keyed by export name. */
+export function pgSchemaFromBuildOutput(json: string, defaultSchema = "public"): PgSchemaObject[] {
+  const doc = JSON.parse(json) as OutputDoc;
+  if (doc.dialect !== "postgres" || !Array.isArray(doc.objects)) throw new Error('not a Postgres build output: expected { dialect: "postgres", objects: [...] }');
+  return doc.objects.map((o) => ({ key: o.export, canonical: { ...diffObject(o.type, o.ddl, defaultSchema), exportName: o.export } }));
+}
+
+/** The major a Postgres build recorded (`postgresMajor`), or undefined for output that predates the field. */
+export function pgBuildMajor(json: string): number | undefined {
+  const m = (JSON.parse(json) as OutputDoc).postgresMajor;
+  return typeof m === "number" ? m : undefined;
+}
+
+export function pgBuildFileMajor(path: string): number | undefined {
+  return pgBuildMajor(readFileSync(path, "utf-8"));
+}
+
+export function pgSchemaFromBuildFile(path: string, defaultSchema = "public"): PgSchemaObject[] {
+  return pgSchemaFromBuildOutput(readFileSync(path, "utf-8"), defaultSchema);
+}
+
+/** The identity an object has on a server: its kind's namespace and its qualified name. */
+export function qualifiedKey(o: { kind: string; schema?: string; name: string }): string {
+  const space = o.kind === "schema" ? "schema" : o.kind === "extension" ? "extension" : o.kind === "enum" || o.kind === "domain" ? "type" : "relation";
+  return `${space} ${o.schema ? `${o.schema}.` : ""}${o.name}`;
+}
+
+/** The declared objects re-keyed by qualified name, the only identity a server has. */
+export function keyedByQualifiedName(objects: readonly PgSchemaObject[]): PgSchemaObject[] {
+  return objects.map((o) => ({ key: qualifiedKey(o.canonical), canonical: { ...o.canonical, exportName: o.canonical.exportName ?? o.key } }));
+}
+
+/** What a server holds, in the diff's form, keyed by qualified name. */
+export function pgSchemaFromLive(live: readonly LivePgObject[], defaultSchema: string): PgSchemaObject[] {
+  return live.map((o) => {
+    const canonical = { ...diffObject(o.type, o.statement, defaultSchema), ...(o.foreign ? { foreign: o.foreign } : {}) };
+    return { key: qualifiedKey(canonical), canonical };
+  });
+}

package/src/postgres/plan/server-normalize.ts

@@ -0,0 +1,123 @@
+/**
+ * The backstop for normalization against a live server: what the rules in
+ * `./normalize.ts` cannot see (a view's `SELECT *`, which the server expands;
+ * the parentheses it adds inside a check) is asked of the server itself.
+ *
+ * For each declared table or view whose expressions still differ from the
+ * server's, the declaration's expressions are created as a temporary object
+ * (`CREATE TEMP VIEW`, or a `CREATE TEMP TABLE` holding the columns' types,
+ * defaults and generated expressions and the checks) inside a transaction
+ * that is always rolled back, with a short `lock_timeout`, and read back with
+ * the same printers the catalog read uses. Nothing is left behind: Postgres
+ * DDL is transactional and a temporary object lives in the session's own
+ * schema. A server that refuses (no TEMP privilege, a lock not granted in
+ * time, an expression it rejects) leaves the rules' answer standing.
+ */
+
+import type { PostgresClient } from "../live/client";
+import { quoteIdent } from "../keywords";
+import { canonicalExpr, type CanonicalPgObject } from "./normalize";
+
+type Row = Record<string, unknown>;
+
+async function rolledBack<T>(client: PostgresClient, defaultSchema: string, body: () => Promise<T>): Promise<T | undefined> {
+  await client.query("BEGIN");
+  try {
+    await client.query("SET LOCAL lock_timeout = '1s'");
+    await client.query("SET LOCAL statement_timeout = '10s'");
+    await client.query(`SELECT pg_catalog.set_config('search_path', $1, true)`, [quoteIdent(defaultSchema)]);
+    return await body();
+  } catch {
+    return undefined;
+  } finally {
+    await client.query("ROLLBACK").catch(() => undefined);
+  }
+}
+
+const emptyPath = (client: PostgresClient) => client.query(`SELECT pg_catalog.set_config('search_path', '', true)`);
+
+/** A view's query as the server prints it, canonical, and its output columns. */
+async function viewQuery(client: PostgresClient, query: string, defaultSchema: string): Promise<{ query: string; outputs: string[] } | undefined> {
+  return rolledBack(client, defaultSchema, async () => {
+    await client.query(`CREATE TEMP VIEW chant_normalize AS ${query}`);
+    await emptyPath(client);
+    const [row] = await client.query<Row>(`SELECT pg_catalog.pg_get_viewdef('pg_temp.chant_normalize'::pg_catalog.regclass, true) AS def`);
+    const cols = await client.query<Row>(
+      `SELECT a.attname AS name FROM pg_catalog.pg_attribute a WHERE a.attrelid = 'pg_temp.chant_normalize'::pg_catalog.regclass AND a.attnum > 0 ORDER BY a.attnum`,
+    );
+    return { query: canonicalExpr(String(row?.def ?? "").trim().replace(/;$/, ""))!, outputs: cols.map((c) => String(c.name)) };
+  });
+}
+
+/** A table's defaults, generated expressions and checks as the server prints them, canonical. */
+async function tableExpressions(client: PostgresClient, o: CanonicalPgObject, defaultSchema: string): Promise<{ defaults: Map<string, string>; generated: Map<string, string>; checks: string[] } | undefined> {
+  const columns = o.columns.filter((c) => c.type !== undefined);
+  if (columns.length === 0) return undefined;
+  const defs = columns.map((c) => {
+    const type = /^(small|big)?serial$/.test(c.type!) ? c.type!.replace("serial", "int").replace("smallint", "smallint").replace(/^int$/, "integer") : c.type!;
+    const parts = [quoteIdent(c.name), type];
+    if (c.collate) parts.push(`COLLATE ${c.collate}`);
+    if (c.generated) {
+      const [kind, ...expr] = c.generated.split(" ");
+      parts.push(`GENERATED ALWAYS AS (${expr.join(" ")}) ${kind === "virtual" ? "VIRTUAL" : "STORED"}`);
+    } else if (c.default !== undefined) parts.push(`DEFAULT ${c.default}`);
+    return parts.join(" ");
+  });
+  const checks = o.constraints.filter((c) => c.kind === "CHECK").map((c, i) => `CONSTRAINT chant_check_${String(i).padStart(4, "0")} ${c.body.replace(/^check /, "CHECK (").replace(/( no inherit| not enforced)*$/, ")$&")}`);
+  return rolledBack(client, defaultSchema, async () => {
+    await client.query(`CREATE TEMP TABLE chant_normalize (${[...defs, ...checks].join(", ")})`);
+    await emptyPath(client);
+    const cols = await client.query<Row>(
+      `SELECT a.attname AS name, a.attgenerated AS generated, pg_catalog.pg_get_expr(d.adbin, d.adrelid, true) AS expr
+       FROM pg_catalog.pg_attribute a LEFT JOIN pg_catalog.pg_attrdef d ON d.adrelid = a.attrelid AND d.adnum = a.attnum
+       WHERE a.attrelid = 'pg_temp.chant_normalize'::pg_catalog.regclass AND a.attnum > 0 AND NOT a.attisdropped`,
+    );
+    const cons = await client.query<Row>(
+      `SELECT c.conname AS name, pg_catalog.pg_get_constraintdef(c.oid, true) AS def FROM pg_catalog.pg_constraint c
+       WHERE c.conrelid = 'pg_temp.chant_normalize'::pg_catalog.regclass AND c.contype = 'c' ORDER BY c.conname`,
+    );
+    const defaults = new Map<string, string>();
+    const generated = new Map<string, string>();
+    for (const r of cols) {
+      if (r.expr === null || r.expr === undefined) continue;
+      if (r.generated === "s" || r.generated === "v") generated.set(String(r.name), `${r.generated === "s" ? "stored" : "virtual"} ${canonicalExpr(String(r.expr))}`);
+      else defaults.set(String(r.name), canonicalExpr(String(r.expr))!);
+    }
+    const printed = cons.map((r) => String(r.def).replace(/^CHECK /, "")).map((d) => canonicalExpr(d)!);
+    return { defaults, generated, checks: printed };
+  });
+}
+
+/**
+ * The declared object with its expressions in the server's own printing,
+ * when the server answers; the object unchanged otherwise. Only the
+ * expressions are touched: everything else stays the rules'.
+ */
+export async function serverNormalized<T extends CanonicalPgObject & { outputs?: string[] }>(client: PostgresClient, o: T, defaultSchema: string): Promise<T> {
+  if ((o.kind === "view" || o.kind === "materializedView") && typeof o.fields.query === "string") {
+    const q = await viewQuery(client, o.fields.query, defaultSchema);
+    // A declared column list names the outputs; otherwise the server's names do (`SELECT *` expanded).
+    return q === undefined ? o : { ...o, fields: { ...o.fields, query: q.query }, ...(o.fields.columns === undefined ? { outputs: q.outputs } : {}) };
+  }
+  if (o.kind === "table") {
+    const e = await tableExpressions(client, o, defaultSchema);
+    if (!e) return o;
+    let i = 0;
+    return {
+      ...o,
+      columns: o.columns.map((c) => ({
+        ...c,
+        ...(c.default !== undefined && e.defaults.has(c.name) && !/^(small|big)?serial$/.test(c.type ?? "") ? { default: e.defaults.get(c.name) } : {}),
+        ...(c.generated !== undefined && e.generated.has(c.name) ? { generated: e.generated.get(c.name) } : {}),
+      })),
+      constraints: o.constraints.map((c) => {
+        if (c.kind !== "CHECK") return c;
+        const printed = e.checks[i++];
+        if (printed === undefined) return c;
+        const tail = /( no inherit| not enforced)*$/.exec(c.body)?.[0] ?? "";
+        return { ...c, body: `check ${printed}${tail}` };
+      }),
+    };
+  }
+  return o;
+}

package/src/postgres/providers/aurora.ts

@@ -0,0 +1,45 @@
+import { rds } from "./rds";
+import { words, type ProviderData } from "./types";
+
+/**
+ * Amazon Aurora PostgreSQL. Roles and refused statements are RDS's (Aurora
+ * uses the same master-user model). The extension list is the table
+ * "Extensions supported for Aurora PostgreSQL 18" on the Aurora release-notes
+ * page, read 2026-10-03; package names were mapped to extension names as in
+ * rds.ts (h3-pg is `h3`, pgvector is `vector`, pg_roaringbitmap is
+ * `roaringbitmap`). Aurora adds apg_plan_mgmt, aurora_stat_utils, aws_ml,
+ * pg_ad_mapping and pg_columnmask.
+ */
+export const aurora: ProviderData = {
+  ...rds,
+  provider: "aurora",
+  label: "Amazon Aurora PostgreSQL",
+  sources: [
+    {
+      url: "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Extensions.html",
+      readOn: "2026-10-03",
+      covers: "allowedExtensions (Aurora PostgreSQL 18 table)",
+    },
+    ...rds.sources.filter((s) => s.covers !== "allowedExtensions (major 18 table)"),
+  ],
+  allowedExtensions: words(`
+    address_standardizer address_standardizer_data_us amcheck apg_plan_mgmt aurora_stat_utils auto_explain autoinc
+    aws_commons aws_lambda aws_ml aws_s3 bloom bool_plperl btree_gin btree_gist citext cube dblink dict_int dict_xsyn
+    earthdistance fuzzystrmatch h3 h3_postgis hll hstore hstore_plperl hypopg insert_username intagg intarray ip4r isn
+    jsonb_plperl lo log_fdw ltree moddatetime mysql_fdw oracle_fdw orafce pg_ad_mapping pg_bigm pg_buffercache
+    pg_columnmask pg_cron pg_freespacemap pg_hint_plan pg_partman pg_prewarm pg_proctab pg_repack pg_similarity
+    pg_stat_statements pg_tle pg_trgm pg_visibility pgaudit pgcrypto pgdam pglogical pgrouting pgrowlocks pgstattuple
+    pgtap plcoffee plls plperl plpgsql plprofiler pltcl plv8 postgis postgis_raster postgis_tiger_geocoder
+    postgis_topology postgres_fdw prefix rdkit rds_activity_stream rds_tools refint roaringbitmap seg sslinfo
+    tablefunc tcn tds_fdw tsm_system_rows tsm_system_time unaccent uuid-ossp vector wal2json
+  `),
+  providerExtensions: [
+    "apg_plan_mgmt", "aurora_stat_utils", "aws_commons", "aws_lambda", "aws_ml", "aws_s3", "log_fdw",
+    "pg_ad_mapping", "pg_columnmask", "pgdam", "rds_activity_stream", "rds_tools",
+  ],
+  toCheck: [
+    "per-release differences inside major 18, and the other majors' tables",
+    "pgdam and pg_columnmask were listed by the page with no description read",
+    ...rds.toCheck.filter((t) => !t.startsWith("per-major")),
+  ],
+};

package/src/postgres/providers/azure.ts

@@ -0,0 +1,54 @@
+import { words, COMMON_REFUSED, type ProviderData } from "./types";
+
+/**
+ * Azure Database for PostgreSQL flexible server. The extension list is "List
+ * of extensions and modules by name", the entries available on major 18,
+ * read 2026-10-03. Besides being on that list, an extension must be allow-
+ * listed in the server's `azure.extensions` parameter before CREATE EXTENSION
+ * succeeds, and some also need `shared_preload_libraries`; that is server
+ * configuration, not something the list says, so it is not modelled.
+ * Roles are the three the access-control page names: azure_pg_admin (the
+ * pseudo-superuser the administrator belongs to), azuresu (Microsoft's
+ * control-plane superuser) and the administrator role the customer names.
+ */
+export const azure: ProviderData = {
+  provider: "azure",
+  label: "Azure Database for PostgreSQL flexible server",
+  sources: [
+    {
+      url: "https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions",
+      readOn: "2026-10-03",
+      covers: "allowedExtensions (entries with a major 18 version)",
+    },
+    {
+      url: "https://learn.microsoft.com/en-us/azure/postgresql/security/security-access-control",
+      readOn: "2026-10-03",
+      covers: "reservedRoles (azure_pg_admin, azuresu); the public schema is owned by azure_pg_admin",
+    },
+  ],
+  reservedRoles: ["azure_pg_admin", "azuresu"],
+  reservedSchemas: [],
+  allowedExtensions: words(`
+    address_standardizer address_standardizer_data_us age amcheck anon auto_explain azure_ai azure_storage bloom
+    btree_gin btree_gist citext credcheck cube dblink dict_int dict_xsyn earthdistance fuzzystrmatch hll hstore hypopg
+    intagg intarray ip4r isn lo login_hook ltree oracle_fdw orafce pageinspect pgaudit pg_buffercache pg_cron pgcrypto
+    pg_diskann pg_failover_slots pg_freespacemap pg_hint_plan pg_ivm pglogical pg_partman pg_partman_bgw pg_prewarm
+    pg_repack pgrouting pgrowlocks pg_squeeze pg_stat_statements pgstattuple pg_trgm pg_visibility plpgsql
+    plpgsql_check plv8 pointcloud postgis postgis_raster postgis_sfcgal postgis_tiger_geocoder postgis_topology
+    postgres_fdw postgres_protobuf rdkit semver session_variable sslinfo tablefunc tdigest tds_fdw temporal_tables
+    timescaledb topn tsm_system_rows tsm_system_time unaccent uuid-ossp vector wal2json
+  `),
+  extensionListComplete: true,
+  providerExtensions: ["azure_ai", "azure_storage", "pg_diskann"],
+  refusedStatements: [
+    ...COMMON_REFUSED,
+    { id: "alter-azure-pg-admin", pattern: /^(ALTER|DROP) (ROLE|USER) "?AZURE_PG_ADMIN"?\b/, reason: "azure_pg_admin is a system-managed restricted role and cannot be modified" },
+    { id: "grant-to-azure-pg-admin", pattern: /^GRANT\b.*\bTO "?AZURE_PG_ADMIN"?\b/, reason: "azure_pg_admin is a system-managed restricted role; granting membership in it is refused" },
+  ],
+  toCheck: [
+    "the azure.extensions allowlist parameter and shared_preload_libraries needs: https://learn.microsoft.com/en-us/azure/postgresql/extensions/how-to-allow-extensions (the page rendered no body)",
+    "reservedSchemas: none read from a page: https://learn.microsoft.com/en-us/azure/postgresql/security/security-access-control",
+    "wal2json and pg_partman_bgw are logical-decoding or background-worker modules that may not take CREATE EXTENSION: https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions",
+    "older majors' lists",
+  ],
+};

package/src/postgres/providers/cloud-sql.ts

@@ -0,0 +1,42 @@
+import { words, COMMON_REFUSED, type ProviderData } from "./types";
+
+/**
+ * Google Cloud SQL for PostgreSQL. The extension list is the tables on
+ * "Configure PostgreSQL extensions" (PostGIS, data type, language and
+ * miscellaneous groups), read 2026-10-03. Names are the `CREATE EXTENSION`
+ * names: the page's pgAudit is `pgaudit`, pgTAP is `pgtap`, pgvector is
+ * `vector`. The page says a customer cannot create their own extensions.
+ * Roles are the `cloudsql*` names the Cloud SQL users page lists.
+ */
+export const cloudSql: ProviderData = {
+  provider: "cloud-sql",
+  label: "Google Cloud SQL for PostgreSQL",
+  sources: [
+    { url: "https://cloud.google.com/sql/docs/postgres/extensions", readOn: "2026-10-03", covers: "allowedExtensions, superuser requirement" },
+    { url: "https://cloud.google.com/sql/docs/postgres/users", readOn: "2026-10-03", covers: "reservedRoles (the cloudsql* roles)" },
+  ],
+  reservedRoles: [
+    "cloudsqlsuperuser", "cloudsqladmin", "cloudsqlagent", "cloudsqlconnpooladmin", "cloudsqliamgroup",
+    "cloudsqliamgroupserviceaccount", "cloudsqliamgroupuser", "cloudsqliamserviceaccount", "cloudsqliamuser",
+    "cloudsqlimportexport", "cloudsqlinactiveuser", "cloudsqllogical", "cloudsqlobservability", "cloudsqlreplica",
+  ],
+  reservedSchemas: [],
+  allowedExtensions: words(`
+    address_standardizer address_standardizer_data_us amcheck auto_explain autoinc bloom btree_gin btree_gist chkpass
+    citext cube dblink dict_int earthdistance fuzzystrmatch google_ml_integration google_read_only_session hll hstore
+    insert_username intagg intarray ip4r isn lo ltree moddatetime oracle_fdw orafce pageinspect pg_background pg_bigm
+    pg_buffercache pg_cron pg_freespacemap pg_hint_plan pg_ivm pg_partman pg_prewarm pg_proctab pg_qualstats pg_repack
+    pg_similarity pg_squeeze pg_stat_statements pg_textsearch pg_trgm pg_visibility pg_wait_sampling pgaudit pgcrypto
+    pgfincore pglogical pgrowlocks pgstattuple pgtap pgtt plpgsql plpgsql_check plv8 postgis postgis_raster
+    postgis_sfcgal postgis_tiger_geocoder postgis_topology postgres_fdw prefix rdkit roaringbitmap sslinfo tablefunc
+    tcn tds_fdw temporal_tables tsm_system_rows tsm_system_time unaccent uuid-ossp vector
+  `),
+  extensionListComplete: true,
+  providerExtensions: ["google_ml_integration", "google_read_only_session"],
+  refusedStatements: COMMON_REFUSED,
+  toCheck: [
+    "anon (the page lists postgresql_anonymizer; the CREATE EXTENSION name was not read): https://cloud.google.com/sql/docs/postgres/extensions",
+    "the list is for the newest major; older majors drop some entries",
+    "reservedSchemas: no page read names a schema Cloud SQL owns: https://cloud.google.com/sql/docs/postgres/users",
+  ],
+};

package/src/postgres/providers/index.ts

@@ -0,0 +1,90 @@
+/**
+ * Managed-provider knowledge for the Postgres dialect (#3282): which roles
+ * and schemas a provider owns, which extensions it lets a customer create,
+ * and which statements it refuses. See ./types.ts for what a list means and
+ * how stale one can be.
+ */
+
+import { aurora } from "./aurora";
+import { azure } from "./azure";
+import { cloudSql } from "./cloud-sql";
+import { neon } from "./neon";
+import { rds } from "./rds";
+import { supabase } from "./supabase";
+import { POSTGRES_PROVIDERS, type PostgresProvider, type ProviderData, type RefusedStatement } from "./types";
+
+export { POSTGRES_PROVIDERS, COMMON_REFUSED } from "./types";
+export type { PostgresProvider, ProviderData, ProviderSource, RefusedStatement, ProviderSetting } from "./types";
+
+const DATA: Record<PostgresProvider, ProviderData> = {
+  rds,
+  aurora,
+  "cloud-sql": cloudSql,
+  azure,
+  neon,
+  supabase,
+};
+
+/** The data for one provider. */
+export function providerData(provider: PostgresProvider): ProviderData {
+  return DATA[provider];
+}
+
+export const isPostgresProvider = (v: unknown): v is PostgresProvider =>
+  typeof v === "string" && (POSTGRES_PROVIDERS as readonly string[]).includes(v);
+
+/** Role and schema names fold to lower case unless quoted; the lists are lower case. */
+const fold = (name: string) => name.toLowerCase();
+
+/**
+ * Whether the provider lets a customer create the extension. `undefined` when
+ * the provider's list is partial and does not name it: the answer is unknown,
+ * not no.
+ */
+export function providerAllowsExtension(provider: PostgresProvider, name: string): boolean | undefined {
+  const data = DATA[provider];
+  if (data.allowedExtensions.includes(fold(name))) return true;
+  return data.extensionListComplete ? false : undefined;
+}
+
+/** A live object as import or describe sees it: its kind and name, schema-less for roles, schemas and extensions. */
+export interface LiveObjectRef {
+  kind: "role" | "schema" | "extension";
+  name: string;
+}
+
+/**
+ * Whether the provider owns a live object, so import and describe can read it
+ * as foreign (not the project's to declare or change). A role or schema the
+ * provider created, an extension the provider installs, or a `pg_` built-in
+ * role. Names are compared case-folded.
+ */
+export function isProviderOwned(provider: PostgresProvider, object: LiveObjectRef): boolean {
+  const data = DATA[provider];
+  const name = fold(object.name);
+  switch (object.kind) {
+    case "role":
+      return data.reservedRoles.includes(name) || name.startsWith("pg_");
+    case "schema":
+      return data.reservedSchemas.includes(name);
+    case "extension":
+      return data.providerExtensions.includes(name);
+  }
+}
+
+/** Reduce a statement to what the refused-statement patterns match: comments and strings removed, upper case, whitespace collapsed. */
+export function normalizeStatement(sql: string): string {
+  return sql
+    .replace(/\/\*[\s\S]*?\*\//g, " ")
+    .replace(/--[^\n]*/g, " ")
+    .replace(/'(?:[^']|'')*'/g, "''")
+    .replace(/\s+/g, " ")
+    .trim()
+    .toUpperCase();
+}
+
+/** The refused-statement entry a statement matches on the provider, if any. */
+export function refusedStatement(provider: PostgresProvider, sql: string): RefusedStatement | undefined {
+  const text = normalizeStatement(sql);
+  return DATA[provider].refusedStatements.find((r) => r.pattern.test(text));
+}

package/src/postgres/providers/neon.ts

@@ -0,0 +1,45 @@
+import { words, COMMON_REFUSED, type ProviderData } from "./types";
+
+/**
+ * Neon. The extension list is the "Postgres extensions" table, the entries
+ * with a PG18 version (entries marked `-` for PG18, such as plv8, rum and
+ * pg_search, are left out), read 2026-10-03. Table names were mapped to
+ * `CREATE EXTENSION` names where the page says so: pgvector is `vector`,
+ * pg_roaringbitmap is `roaringbitmap`. wal2json is a decoder plugin the page
+ * says needs no CREATE EXTENSION, so it is not listed. Reserved roles are
+ * the "Reserved role names" list plus neon_service, which the roles page
+ * describes as internal.
+ */
+export const neon: ProviderData = {
+  provider: "neon",
+  label: "Neon",
+  sources: [
+    { url: "https://neon.com/docs/extensions/pg-extensions", readOn: "2026-10-03", covers: "allowedExtensions (PG18 column)" },
+    { url: "https://neon.com/docs/manage/roles", readOn: "2026-10-03", covers: "reservedRoles, neon_superuser, internal roles" },
+    { url: "https://neon.com/docs/reference/compatibility", readOn: "2026-10-03", covers: "no superuser, no tablespaces" },
+  ],
+  reservedRoles: ["neon_superuser", "cloud_admin", "zenith_admin", "neon_service"],
+  reservedSchemas: [],
+  allowedExtensions: words(`
+    address_standardizer address_standardizer_data_us anon autoinc bloom btree_gin btree_gist citext cube dblink
+    dict_int earthdistance fuzzystrmatch h3 h3_postgis hll hstore hypopg insert_username intagg intarray ip4r isn
+    lakebase_text lakebase_tokenizer lakebase_vector lo ltree moddatetime neon neon_utils pg_cron pg_graphql
+    pg_hashids pg_hint_plan pg_ivm pg_jsonschema pg_partman pg_prewarm pg_repack pg_session_jwt pg_stat_statements
+    pg_tiktoken pg_trgm pg_uuidv7 pgcrypto pgjwt pgrag pgrouting pgrowlocks pgstattuple pgtap pgx_ulid plpgsql
+    plpgsql_check postgis postgis_raster postgis_sfcgal postgis_tiger_geocoder postgis_topology postgres_fdw prefix
+    rdkit refint roaringbitmap seg semver tablefunc tcn timescaledb tsm_system_rows tsm_system_time unaccent
+    uuid-ossp vector xml2
+  `),
+  extensionListComplete: true,
+  providerExtensions: ["neon", "neon_utils", "pg_session_jwt", "lakebase_text", "lakebase_tokenizer", "lakebase_vector"],
+  refusedStatements: [
+    ...COMMON_REFUSED,
+    { id: "create-tablespace", pattern: /^CREATE TABLESPACE\b/, reason: "Neon does not support tablespaces" },
+    { id: "alter-neon-superuser", pattern: /^(ALTER|DROP) (ROLE|USER) "?NEON_SUPERUSER"?\b/, reason: "neon_superuser is not intended to be modified" },
+  ],
+  toCheck: [
+    "reservedSchemas: none read from a page: https://neon.com/docs/manage/roles",
+    "pg_repack needs a paid plan and Neon Support to enable, pg_ivm is not available for new installs: https://neon.com/docs/extensions/pg-extensions",
+    "older majors' columns",
+  ],
+};

package/src/postgres/providers/providers.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, test } from "vitest";
+import {
+  POSTGRES_PROVIDERS,
+  isProviderOwned,
+  providerAllowsExtension,
+  providerData,
+  refusedStatement,
+  normalizeStatement,
+  type PostgresProvider,
+} from "./index";
+
+describe("every provider's data", () => {
+  test.each(POSTGRES_PROVIDERS)("%s cites a page and the date it was read, and its lists are lower case and unique", (p) => {
+    const d = providerData(p);
+    expect(d.provider).toBe(p);
+    expect(d.sources.length).toBeGreaterThan(0);
+    for (const s of d.sources) {
+      expect(s.url).toMatch(/^https:\/\//);
+      expect(s.readOn).toMatch(/^2026-10-03$/);
+    }
+    for (const list of [d.reservedRoles, d.reservedSchemas, d.allowedExtensions, d.providerExtensions]) {
+      expect(list.every((n) => n === n.toLowerCase())).toBe(true);
+      expect(new Set(list).size).toBe(list.length);
+    }
+    expect(d.allowedExtensions.length).toBeGreaterThan(10);
+    for (const t of d.toCheck) expect(t.length).toBeGreaterThan(0);
+  });
+
+  test("every provider refuses what needs a superuser", () => {
+    for (const p of POSTGRES_PROVIDERS) {
+      expect(refusedStatement(p, "CREATE ROLE admin SUPERUSER")?.id).toBe("superuser-role");
+      expect(refusedStatement(p, "copy t from program 'curl x'")?.id).toBe("copy-program");
+      expect(refusedStatement(p, "CREATE TABLE t (a int)")).toBeUndefined();
+    }
+  });
+});
+
+interface Fixture {
+  provider: PostgresProvider;
+  allowed: string[];
+  refused: string[];
+  ownedRole: string;
+  ownedExtension: string;
+  ownedSchema?: string;
+  refusedStatement?: [string, string];
+}
+
+const FIXTURES: Fixture[] = [
+  {
+    provider: "rds",
+    allowed: ["pg_stat_statements", "pgcrypto", "vector", "postgis", "aws_s3"],
+    refused: ["pg_squeeze", "pg_ivm", "timescaledb"],
+    ownedRole: "rds_superuser",
+    ownedExtension: "aws_s3",
+    refusedStatement: ["CREATE TABLESPACE fast LOCATION '/ssd'", "create-tablespace-location"],
+  },
+  {
+    provider: "aurora",
+    allowed: ["pg_stat_statements", "apg_plan_mgmt", "aws_ml", "vector", "pgaudit"],
+    refused: ["pg_squeeze", "timescaledb"],
+    ownedRole: "rdsadmin",
+    ownedExtension: "apg_plan_mgmt",
+  },
+  {
+    provider: "cloud-sql",
+    allowed: ["pg_trgm", "vector", "uuid-ossp", "pgaudit", "postgis"],
+    refused: ["aws_s3", "timescaledb"],
+    ownedRole: "cloudsqlsuperuser",
+    ownedExtension: "google_ml_integration",
+  },
+  {
+    provider: "azure",
+    allowed: ["pg_trgm", "vector", "azure_ai", "timescaledb", "uuid-ossp"],
+    refused: ["aws_s3", "pg_stat_monitor"],
+    ownedRole: "azure_pg_admin",
+    ownedExtension: "azure_storage",
+    refusedStatement: ["GRANT dba TO azure_pg_admin", "grant-to-azure-pg-admin"],
+  },
+  {
+    provider: "neon",
+    allowed: ["pg_trgm", "vector", "neon", "pg_graphql", "timescaledb"],
+    refused: ["pg_squeeze", "plv8", "wal2json"],
+    ownedRole: "neon_superuser",
+    ownedExtension: "neon_utils",
+    refusedStatement: ["create tablespace t location '/x'", "create-tablespace"],
+  },
+  {
+    provider: "supabase",
+    allowed: ["pg_graphql", "vector", "pgtap", "uuid-ossp"],
+    refused: [],
+    ownedRole: "supabase_admin",
+    ownedExtension: "pg_net",
+    ownedSchema: "auth",
+  },
+];
+
+describe.each(FIXTURES)("$provider", (f) => {
+  test("allows the extensions its page lists", () => {
+    for (const e of f.allowed) expect(providerAllowsExtension(f.provider, e), e).toBe(true);
+  });
+
+  test("an extension its page does not list is refused, or unknown when the list is partial", () => {
+    for (const e of f.refused) expect(providerAllowsExtension(f.provider, e), e).toBe(false);
+    const partial = !providerData(f.provider).extensionListComplete;
+    expect(providerAllowsExtension(f.provider, "not_an_extension")).toBe(partial ? undefined : false);
+  });
+
+  test("reads its own roles, schemas and extensions as provider-owned, and a customer's as not", () => {
+    expect(isProviderOwned(f.provider, { kind: "role", name: f.ownedRole })).toBe(true);
+    expect(isProviderOwned(f.provider, { kind: "role", name: f.ownedRole.toUpperCase() })).toBe(true);
+    expect(isProviderOwned(f.provider, { kind: "role", name: "pg_monitor" })).toBe(true);
+    expect(isProviderOwned(f.provider, { kind: "role", name: "app_owner" })).toBe(false);
+    expect(isProviderOwned(f.provider, { kind: "extension", name: f.ownedExtension })).toBe(true);
+    expect(isProviderOwned(f.provider, { kind: "extension", name: "pgcrypto" })).toBe(false);
+    expect(isProviderOwned(f.provider, { kind: "schema", name: "app" })).toBe(false);
+    if (f.ownedSchema) expect(isProviderOwned(f.provider, { kind: "schema", name: f.ownedSchema })).toBe(true);
+  });
+
+  if (f.refusedStatement) {
+    test("refuses its own statements", () => {
+      expect(refusedStatement(f.provider, f.refusedStatement![0])?.id).toBe(f.refusedStatement![1]);
+    });
+  }
+});
+
+describe("normalizeStatement", () => {
+  test("drops comments and string contents, collapses whitespace and upper-cases", () => {
+    expect(normalizeStatement("/* x */ alter   system -- c\n set a = 'ALTER SYSTEM'")).toBe("ALTER SYSTEM SET A = ''");
+  });
+  test("a string that names a refused statement does not match", () => {
+    expect(refusedStatement("rds", "COMMENT ON TABLE t IS 'ALTER SYSTEM is refused'")).toBeUndefined();
+  });
+  test("ALTER SYSTEM is refused", () => {
+    expect(refusedStatement("neon", "ALTER SYSTEM SET work_mem = '1GB'")?.id).toBe("alter-system");
+  });
+});