@prisma-next/adapter-postgres 0.14.0-dev.11 → 0.14.0-dev.13

package/dist/control.d.mts

@@ -1,12 +1,14 @@
+import { SchemaDiffIssue } from "@prisma-next/framework-components/control";
 import { AnyQueryAst, DdlNode, LoweredStatement, LowererContext, MarkerReadResult, SqlExecuteRequest } from "@prisma-next/sql-relational-core/ast";
 import { parsePostgresDefault, parsePostgresDefault as parsePostgresDefault$1 } from "@prisma-next/target-postgres/default-normalizer";
 import { normalizeSchemaNativeType, normalizeSchemaNativeType as normalizeSchemaNativeType$1 } from "@prisma-next/target-postgres/native-type-normalizer";
 import { SqlEscapeError, escapeLiteral, qualifyName, quoteIdentifier } from "@prisma-next/target-postgres/sql-utils";
+import { PostgresSchemaIR } from "@prisma-next/target-postgres/types";
 import { SqlControlAdapterDescriptor } from "@prisma-next/family-sql/control";
 import { PostgresDdlNode } from "@prisma-next/target-postgres/ddl";
-import { ContractMarkerRecord, LedgerEntryRecord } from "@prisma-next/contract/types";
+import { Contract, ContractMarkerRecord, LedgerEntryRecord } from "@prisma-next/contract/types";
 import { CodecRegistry } from "@prisma-next/framework-components/codec";
-import { SqlControlDriverInstance } from "@prisma-next/sql-contract/types";
+import { SqlControlDriverInstance, SqlStorage } from "@prisma-next/sql-contract/types";
 import { SqlControlAdapter } from "@prisma-next/family-sql/control-adapter";
 import { SqlSchemaIR } from "@prisma-next/sql-schema-ir/types";
 
@@ -41,6 +43,7 @@ declare class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
    * before comparison with contract native types.
    */
   readonly normalizeNativeType: typeof normalizeSchemaNativeType$1;
+  collectSchemaDiffIssues(contract: Contract<SqlStorage>, schema: SqlSchemaIR): readonly SchemaDiffIssue[];
   bootstrapControlTableQueries(): readonly DdlNode[];
   bootstrapSignMarkerQueries(): readonly DdlNode[];
   /**
@@ -148,7 +151,7 @@ declare class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
    * @param schema - Schema name to introspect when no contract is provided (defaults to 'public')
    * @returns Promise resolving to SqlSchemaIR representing the live database schema
    */
-  introspect(driver: SqlControlDriverInstance<'postgres'>, contract?: unknown, schema?: string): Promise<SqlSchemaIR>;
+  introspect(driver: SqlControlDriverInstance<'postgres'>, contract?: unknown, schema?: string): Promise<PostgresSchemaIR>;
   /**
    * Lists every non-system schema present in the connected database.
    * The introspection consumer (`verifyPostgresNamespacePresence`)

package/dist/control.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"control.d.mts","names":[],"sources":["../src/core/codec-lookup.ts","../src/core/control-adapter.ts","../src/exports/control.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;iBAWgB,gCAAA,IAAoC,aAAa;;;;;;;cC4EpD,sBAAA,YAAkC,iBAAA;EAAA,SACpC,QAAA;EAAA,SACA,QAAA;EAAA,iBAEQ,aAAA;cAEL,aAAA,EAAe,aAAA;;;;AAN7B;WAcW,gBAAA,SAAgB,sBAAA;;;;;;WAOhB,mBAAA,SAAmB,2BAAA;EAE5B,4BAAA,aAAyC,OAAA;EAIzC,0BAAA,aAAuC,OAAA;EAYY;;;;;;;;EAAnD,KAAA,CAAM,GAAA,EAAK,WAAA,GAAc,eAAA,EAAiB,OAAA,EAAS,cAAA,YAA0B,gBAAA;EAuD1E;;;;;;;EAjCG,qBAAA,CACJ,GAAA,EAAK,WAAA,GAAc,eAAA,EACnB,OAAA,GAAU,cAAA,YACT,OAAA,CAAQ,iBAAA;EAkHD;;;;;;;;EAvFJ,UAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,WACC,OAAA,CAAQ,oBAAA;EAKL,uBAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,WACC,OAAA,CAAQ,gBAAA;EAgQR;;;;;;EArPG,cAAA,CACJ,MAAA,EAAQ,wBAAA,eACP,OAAA,CAAQ,WAAA,SAAoB,oBAAA;EAAA,QAKjB,oBAAA;EAvHL;;;;;;EAgLH,UAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,YACC,OAAA,UAAiB,iBAAA;EAAA,QAKN,gBAAA;EApKL;;;;;EAwNH,YAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,UACA,WAAA;IAAA,SACW,WAAA;IAAA,SACA,WAAA;IAAA,SACA,UAAA;EAAA,IAEV,OAAA;EAoBG,UAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,UACA,WAAA;IAAA,SACW,WAAA;IAAA,SACA,WAAA;IAAA,SACA,UAAA;EAAA,IAEV,OAAA;EAnNkB;;;;EAsPf,YAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,UACA,YAAA,UACA,WAAA;IAAA,SACW,WAAA;IAAA,SACA,WAAA;IAAA,SACA,UAAA;EAAA,IAEV,OAAA;EAhOD;;;;EA8PI,gBAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,UACA,KAAA;IAAA,SACW,MAAA;IAAA,SACA,IAAA;IAAA,SACA,EAAA;IAAA,SACA,aAAA;IAAA,SACA,aAAA;IAAA,SACA,UAAA;EAAA,IAEV,OAAA;EAAA,QAiBW,+BAAA;EAAA,QA0BA,gBAAA;EA9RiB;;;;;;;;;;;;;;;;;;;;;;;;EAwVzB,UAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,QAAA,YACA,MAAA,YACC,OAAA,CAAQ,WAAA;EAnMT;;;;;;;;EAAA,QAiOY,mBAAA;EAlLD;;;;;;;EAAA,QAuMC,oBAAA;EAlKD;;;;;EAAA,QAqNC,gBAAA;EA/MX;;;EAAA,QAypBW,kBAAA;AAAA;;;cCtkCV,yBAAA,EAA2B,2BAA2B"}
+{"version":3,"file":"control.d.mts","names":[],"sources":["../src/core/codec-lookup.ts","../src/core/control-adapter.ts","../src/exports/control.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;iBAWgB,gCAAA,IAAoC,aAAa;;;;;;;cC0FpD,sBAAA,YAAkC,iBAAA;EAAA,SACpC,QAAA;EAAA,SACA,QAAA;EAAA,iBAEQ,aAAA;cAEL,aAAA,EAAe,aAAA;;;;AAN7B;WAcW,gBAAA,SAAgB,sBAAA;;;;;;WAOhB,mBAAA,SAAmB,2BAAA;EAE5B,uBAAA,CACE,QAAA,EAAU,QAAA,CAAS,UAAA,GACnB,MAAA,EAAQ,WAAA,YACE,eAAA;EASZ,4BAAA,aAAyC,OAAA;EAIzC,0BAAA,aAAuC,OAAA;EAAA;;;;;;;;EAYvC,KAAA,CAAM,GAAA,EAAK,WAAA,GAAc,eAAA,EAAiB,OAAA,EAAS,cAAA,YAA0B,gBAAA;EAyB1E;;;;;;;EAHG,qBAAA,CACJ,GAAA,EAAK,WAAA,GAAc,eAAA,EACnB,OAAA,GAAU,cAAA,YACT,OAAA,CAAQ,iBAAA;EAmDoB;;;;;;;;EAxBzB,UAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,WACC,OAAA,CAAQ,oBAAA;EAKL,uBAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,WACC,OAAA,CAAQ,gBAAA;EA+MD;;;;;;EApMJ,cAAA,CACJ,MAAA,EAAQ,wBAAA,eACP,OAAA,CAAQ,WAAA,SAAoB,oBAAA;EAAA,QAKjB,oBAAA;EApIgD;;;;;;EA6LxD,UAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,YACC,OAAA,UAAiB,iBAAA;EAAA,QAKN,gBAAA;EA/LF;;;;;EAmPN,YAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,UACA,WAAA;IAAA,SACW,WAAA;IAAA,SACA,WAAA;IAAA,SACA,UAAA;EAAA,IAEV,OAAA;EAoBG,UAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,UACA,WAAA;IAAA,SACW,WAAA;IAAA,SACA,WAAA;IAAA,SACA,UAAA;EAAA,IAEV,OAAA;EAtPoC;;;;EAyRjC,YAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,UACA,YAAA,UACA,WAAA;IAAA,SACW,WAAA;IAAA,SACA,WAAA;IAAA,SACA,UAAA;EAAA,IAEV,OAAA;EA/PI;;;;EA6RD,gBAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,KAAA,UACA,KAAA;IAAA,SACW,MAAA;IAAA,SACA,IAAA;IAAA,SACA,EAAA;IAAA,SACA,aAAA;IAAA,SACA,aAAA;IAAA,SACA,UAAA;EAAA,IAEV,OAAA;EAAA,QAiBW,+BAAA;EAAA,QA0BA,gBAAA;EA7SJ;;;;;;;;;;;;;;;;;;;;;;;;EAuWJ,UAAA,CACJ,MAAA,EAAQ,wBAAA,cACR,QAAA,YACA,MAAA,YACC,OAAA,CAAQ,gBAAA;EA5NE;;;;;;;;EAAA,QAsPC,mBAAA;EA1ND;;;;;;;EAAA,QA+OC,oBAAA;EArMD;;;;;EAAA,QA6PC,gBAAA;EA1NJ;;;EAAA,QA8sBI,kBAAA;AAAA;;;cC3oCV,yBAAA,EAA2B,2BAA2B"}

package/dist/control.mjs

@@ -1,4 +1,4 @@
-import { r as createPostgresBuiltinCodecLookup, t as PostgresControlAdapter } from "./control-adapter-Dspz5uKp.mjs";
+import { r as createPostgresBuiltinCodecLookup, t as PostgresControlAdapter } from "./control-adapter-DzXJMx3k.mjs";
 import { t as postgresAdapterDescriptorMeta } from "./descriptor-meta-DOgMfoqm.mjs";
 import { parsePostgresDefault } from "@prisma-next/target-postgres/default-normalizer";
 import { normalizeSchemaNativeType } from "@prisma-next/target-postgres/native-type-normalizer";

package/dist/runtime.mjs

@@ -1,4 +1,4 @@
-import { n as postgresRawCodecInferer, t as createPostgresAdapter } from "./adapter-CwkcdpM_.mjs";
+import { n as postgresRawCodecInferer, t as createPostgresAdapter } from "./adapter-BtKi7wFT.mjs";
 import { n as postgresQueryOperations, t as postgresAdapterDescriptorMeta } from "./descriptor-meta-DOgMfoqm.mjs";
 import { extractCodecLookup } from "@prisma-next/framework-components/control";
 import { postgresCodecRegistry } from "@prisma-next/target-postgres/codecs";

package/package.json

@@ -1,34 +1,35 @@
 {
   "name": "@prisma-next/adapter-postgres",
-  "version": "0.14.0-dev.11",
+  "version": "0.14.0-dev.13",
   "license": "Apache-2.0",
   "type": "module",
   "sideEffects": false,
   "dependencies": {
-    "@prisma-next/contract": "0.14.0-dev.11",
-    "@prisma-next/contract-authoring": "0.14.0-dev.11",
-    "@prisma-next/errors": "0.14.0-dev.11",
-    "@prisma-next/family-sql": "0.14.0-dev.11",
-    "@prisma-next/framework-components": "0.14.0-dev.11",
-    "@prisma-next/ids": "0.14.0-dev.11",
-    "@prisma-next/sql-contract": "0.14.0-dev.11",
-    "@prisma-next/sql-contract-psl": "0.14.0-dev.11",
-    "@prisma-next/sql-contract-ts": "0.14.0-dev.11",
-    "@prisma-next/sql-operations": "0.14.0-dev.11",
-    "@prisma-next/sql-relational-core": "0.14.0-dev.11",
-    "@prisma-next/sql-runtime": "0.14.0-dev.11",
-    "@prisma-next/sql-schema-ir": "0.14.0-dev.11",
-    "@prisma-next/target-postgres": "0.14.0-dev.11",
-    "@prisma-next/utils": "0.14.0-dev.11",
+    "@prisma-next/contract": "0.14.0-dev.13",
+    "@prisma-next/contract-authoring": "0.14.0-dev.13",
+    "@prisma-next/errors": "0.14.0-dev.13",
+    "@prisma-next/family-sql": "0.14.0-dev.13",
+    "@prisma-next/framework-components": "0.14.0-dev.13",
+    "@prisma-next/ids": "0.14.0-dev.13",
+    "@prisma-next/sql-contract": "0.14.0-dev.13",
+    "@prisma-next/sql-contract-psl": "0.14.0-dev.13",
+    "@prisma-next/sql-contract-ts": "0.14.0-dev.13",
+    "@prisma-next/sql-operations": "0.14.0-dev.13",
+    "@prisma-next/sql-relational-core": "0.14.0-dev.13",
+    "@prisma-next/sql-runtime": "0.14.0-dev.13",
+    "@prisma-next/sql-schema-ir": "0.14.0-dev.13",
+    "@prisma-next/target-postgres": "0.14.0-dev.13",
+    "@prisma-next/utils": "0.14.0-dev.13",
     "arktype": "^2.2.0"
   },
   "devDependencies": {
-    "@prisma-next/cli": "0.14.0-dev.11",
-    "@prisma-next/driver-postgres": "0.14.0-dev.11",
-    "@prisma-next/migration-tools": "0.14.0-dev.11",
-    "@prisma-next/test-utils": "0.14.0-dev.11",
-    "@prisma-next/tsconfig": "0.14.0-dev.11",
-    "@prisma-next/tsdown": "0.14.0-dev.11",
+    "@prisma-next/cli": "0.14.0-dev.13",
+    "@prisma-next/driver-postgres": "0.14.0-dev.13",
+    "@prisma-next/migration-tools": "0.14.0-dev.13",
+    "@prisma-next/psl-parser": "0.14.0-dev.13",
+    "@prisma-next/test-utils": "0.14.0-dev.13",
+    "@prisma-next/tsconfig": "0.14.0-dev.13",
+    "@prisma-next/tsdown": "0.14.0-dev.13",
     "pathe": "^2.0.3",
     "tsdown": "0.22.1",
     "typescript": "5.9.3",

package/src/core/control-adapter.ts

@@ -1,4 +1,8 @@
-import type { ContractMarkerRecord, LedgerEntryRecord } from '@prisma-next/contract/types';
+import type {
+  Contract,
+  ContractMarkerRecord,
+  LedgerEntryRecord,
+} from '@prisma-next/contract/types';
 import {
   parseMarkerRowSafely,
   rethrowMarkerReadError,
@@ -7,11 +11,11 @@ import {
 import type { SqlControlAdapter } from '@prisma-next/family-sql/control-adapter';
 import { parseContractMarkerRow } from '@prisma-next/family-sql/verify';
 import type { CodecLookup, CodecRegistry } from '@prisma-next/framework-components/codec';
-import { APP_SPACE_ID } from '@prisma-next/framework-components/control';
+import { APP_SPACE_ID, type SchemaDiffIssue } from '@prisma-next/framework-components/control';
 import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
 import { ledgerOriginFromStored } from '@prisma-next/migration-tools/ledger-origin';
 import { REFERENTIAL_ACTION_SQL } from '@prisma-next/sql-contract/referential-action-sql';
-import type { SqlControlDriverInstance } from '@prisma-next/sql-contract/types';
+import type { SqlControlDriverInstance, SqlStorage } from '@prisma-next/sql-contract/types';
 import type {
   AnyQueryAst,
   CodecRef,
@@ -46,13 +50,23 @@ import type {
   AddColumnAction,
   AlterTableActionVisitor,
   PostgresAlterTable,
+  PostgresCreatePolicy,
   PostgresCreateSchema,
   PostgresCreateTable,
   PostgresDdlNode,
+  PostgresDropPolicy,
+  RlsPolicyOperation,
 } from '@prisma-next/target-postgres/ddl';
 import { parsePostgresDefault } from '@prisma-next/target-postgres/default-normalizer';
 import { normalizeSchemaNativeType } from '@prisma-next/target-postgres/native-type-normalizer';
+import { diffPostgresRlsPolicies } from '@prisma-next/target-postgres/planner';
 import { escapeLiteral, quoteIdentifier } from '@prisma-next/target-postgres/sql-utils';
+import {
+  isPostgresSchemaIR,
+  PostgresRlsPolicy,
+  PostgresRole,
+  PostgresSchemaIR,
+} from '@prisma-next/target-postgres/types';
 import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { encodeControlQueryParams } from './control-codecs';
@@ -108,6 +122,18 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
    */
   readonly normalizeNativeType = normalizeSchemaNativeType;
 
+  collectSchemaDiffIssues(
+    contract: Contract<SqlStorage>,
+    schema: SqlSchemaIR,
+  ): readonly SchemaDiffIssue[] {
+    if (!isPostgresSchemaIR(schema)) {
+      throw new Error(
+        `RLS verification requires a PostgresSchemaIR; got ${(schema as { constructor?: { name?: string } }).constructor?.name ?? typeof schema}`,
+      );
+    }
+    return diffPostgresRlsPolicies({ contract, schema });
+  }
+
   bootstrapControlTableQueries(): readonly DdlNode[] {
     return buildControlTableBootstrapQueries();
   }
@@ -548,26 +574,22 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
     driver: SqlControlDriverInstance<'postgres'>,
     contract?: unknown,
     schema = 'public',
-  ): Promise<SqlSchemaIR> {
+  ): Promise<PostgresSchemaIR> {
     const declaredNamespaces = extractContractNamespaceIds(contract);
     const ir =
       declaredNamespaces.length > 0
         ? await this.introspectNamespaces(driver, declaredNamespaces)
         : await this.introspectSchema(driver, schema);
-    // Capture the list of non-system schemas so downstream planners
-    // (e.g. `verifyPostgresNamespacePresence`) can determine which
-    // contract-declared namespaces need a `CREATE SCHEMA` before the
-    // table DDL.
     const existingSchemas = await this.listExistingSchemas(driver);
-    const annotations = ir.annotations ?? {};
-    const pg = (annotations as { pg?: Record<string, unknown> }).pg ?? {};
-    return {
-      ...ir,
-      annotations: {
-        ...annotations,
-        pg: { ...pg, existingSchemas },
-      },
-    };
+    return new PostgresSchemaIR({
+      tables: ir.tables,
+      pgSchemaName: ir.pgSchemaName,
+      pgVersion: ir.pgVersion,
+      rlsPolicies: ir.rlsPolicies,
+      roles: ir.roles,
+      existingSchemas,
+      nativeEnumTypeNames: ir.nativeEnumTypeNames,
+    });
   }
 
   /**
@@ -602,7 +624,7 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
   private async introspectNamespaces(
     driver: SqlControlDriverInstance<'postgres'>,
     namespaceIds: readonly string[],
-  ): Promise<SqlSchemaIR> {
+  ): Promise<PostgresSchemaIR> {
     const resolvedSchemas: string[] = [];
     for (const id of namespaceIds) {
       if (id === UNBOUND_NAMESPACE_ID) {
@@ -619,7 +641,7 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
     // Walk schemas sequentially: every introspectSchema call shares the one
     // control connection, so a parallel walk only serialises behind the wire
     // protocol and trips pg's "already executing a query" deprecation.
-    const perSchema: SqlSchemaIR[] = [];
+    const perSchema: PostgresSchemaIR[] = [];
     for (const schema of uniqueSchemas) {
       perSchema.push(await this.introspectSchema(driver, schema));
     }
@@ -631,18 +653,23 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
       }
     }
 
-    const firstAnnotations = perSchema[0]?.annotations;
-    const firstPg =
-      blindCast<Record<string, unknown> | undefined, 'pg annotation envelope index slot'>(
-        firstAnnotations?.['pg'],
-      ) ?? {};
-    return {
+    const mergedRlsPolicies: PostgresRlsPolicy[] = [];
+    const mergedRoles: PostgresRole[] = [];
+    for (const ir of perSchema) {
+      mergedRlsPolicies.push(...ir.rlsPolicies);
+      mergedRoles.push(...ir.roles);
+    }
+
+    const first = perSchema[0];
+    return new PostgresSchemaIR({
       tables: mergedTables,
-      ...ifDefined('annotations', {
-        ...firstAnnotations,
-        pg: { ...firstPg },
-      }),
-    };
+      pgSchemaName: first?.pgSchemaName ?? 'public',
+      pgVersion: first?.pgVersion ?? 'unknown',
+      rlsPolicies: mergedRlsPolicies,
+      roles: mergedRoles,
+      existingSchemas: first?.existingSchemas ?? ['public'],
+      nativeEnumTypeNames: first?.nativeEnumTypeNames ?? [],
+    });
   }
 
   /**
@@ -653,7 +680,7 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
   private async introspectSchema(
     driver: SqlControlDriverInstance<'postgres'>,
     schema: string,
-  ): Promise<SqlSchemaIR> {
+  ): Promise<PostgresSchemaIR> {
     // Issue the schema-wide queries one at a time. A single control connection
     // serialises queries anyway, so Promise.all buys no parallelism here and
     // makes pg emit a "client is already executing a query" deprecation. One
@@ -1090,19 +1117,61 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
       [schema],
     );
     const nativeEnumTypeNames = nativeEnumResult.rows.map((r) => r.typname);
+    const policiesResult = await driver.query<{
+      schemaname: string;
+      tablename: string;
+      policyname: string;
+      cmd: string;
+      roles: string[];
+      qual: string | null;
+      with_check: string | null;
+      permissive: string;
+    }>(
+      `SELECT schemaname, tablename, policyname, cmd, roles, qual, with_check, permissive
+       FROM pg_catalog.pg_policies
+       WHERE schemaname = $1
+       ORDER BY tablename, policyname`,
+      [schema],
+    );
+    const rolesResult = await driver.query<{ rolname: string }>(
+      `SELECT rolname
+       FROM pg_catalog.pg_roles
+       WHERE rolname NOT LIKE 'pg_%'
+         AND rolname != 'postgres'
+       ORDER BY rolname`,
+    );
+    const rlsPolicies: PostgresRlsPolicy[] = policiesResult.rows.map((row) => {
+      const operation = mapPgCmd(row.cmd);
+      const roles = [...new Set(parsePgNameArray(row.roles).map((r) => r.toLowerCase()))].sort();
+      const permissive = row.permissive.toUpperCase() === 'PERMISSIVE';
+      const hashSuffixMatch = /^(.+)_([0-9a-f]{8})$/.exec(row.policyname);
+      const prefix = hashSuffixMatch?.[1] ?? row.policyname;
+      return new PostgresRlsPolicy({
+        name: row.policyname,
+        prefix,
+        tableName: row.tablename,
+        namespaceId: row.schemaname,
+        operation,
+        roles,
+        ...(row.qual !== null ? { using: row.qual } : {}),
+        ...(row.with_check !== null ? { withCheck: row.with_check } : {}),
+        permissive,
+      });
+    });
 
-    const annotations = {
-      pg: {
-        schema,
-        version: await this.getPostgresVersion(driver),
-        ...(nativeEnumTypeNames.length > 0 && { nativeEnumTypeNames }),
-      },
-    };
+    const roles: PostgresRole[] = rolesResult.rows.map(
+      (row) => new PostgresRole({ name: row.rolname, namespaceId: UNBOUND_NAMESPACE_ID }),
+    );
 
-    return {
+    return new PostgresSchemaIR({
       tables,
-      annotations,
-    };
+      pgSchemaName: schema,
+      pgVersion: await this.getPostgresVersion(driver),
+      rlsPolicies,
+      roles,
+      existingSchemas: [],
+      nativeEnumTypeNames,
+    });
   }
 
   /**
@@ -1117,6 +1186,52 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
   }
 }
 
+/**
+ * Normalises a `name[]` column value from `pg_policies.roles`.
+ *
+ * The `pg` client's type-parser registry handles `text[]` (OID 1009) but not
+ * `name[]` (OID 1003). When the parser is absent the raw Postgres text-array
+ * literal (`{role1,role2}`) is returned as a string instead of a JS array.
+ * This function accepts either form and returns a plain string array.
+ */
+function parsePgNameArray(value: unknown): string[] {
+  if (Array.isArray(value)) {
+    return value as string[];
+  }
+  if (typeof value !== 'string') {
+    return [];
+  }
+  const trimmed = value.trim();
+  if (!trimmed.startsWith('{') || !trimmed.endsWith('}')) {
+    return [];
+  }
+  const inner = trimmed.slice(1, -1);
+  if (inner === '') {
+    return [];
+  }
+  return inner.split(',').map((s) => s.trim());
+}
+
+/**
+ * Maps `pg_policies.cmd` text values to the `RlsPolicyOperation` union.
+ * The `pg_policies` view renders the internal command code as an uppercase
+ * English keyword; this function lowercases to match the IR type.
+ */
+function mapPgCmd(cmd: string): RlsPolicyOperation {
+  switch (cmd.toUpperCase()) {
+    case 'SELECT':
+      return 'select';
+    case 'INSERT':
+      return 'insert';
+    case 'UPDATE':
+      return 'update';
+    case 'DELETE':
+      return 'delete';
+    default:
+      return 'all';
+  }
+}
+
 /**
  * Extracts the namespace coordinate ids declared on a contract's storage,
  * or returns an empty array when no contract (or no storage / namespaces)
@@ -1532,6 +1647,37 @@ async function pgRenderAlterTable(
   };
 }
 
+const POLICY_OPERATION_SQL: Record<RlsPolicyOperation, string> = {
+  select: 'SELECT',
+  insert: 'INSERT',
+  update: 'UPDATE',
+  delete: 'DELETE',
+  all: 'ALL',
+};
+
+function pgRenderCreatePolicy(node: PostgresCreatePolicy): SqlExecuteRequest {
+  const tableRef = `${quoteIdentifier(node.schema)}.${quoteIdentifier(node.table)}`;
+  const permissiveness = node.permissive ? 'PERMISSIVE' : 'RESTRICTIVE';
+  const command = POLICY_OPERATION_SQL[node.operation];
+  const roles = node.roles.length === 0 ? 'PUBLIC' : node.roles.join(', ');
+  let sql = `CREATE POLICY ${quoteIdentifier(node.name)} ON ${tableRef} AS ${permissiveness} FOR ${command} TO ${roles}`;
+  if (node.using !== undefined) {
+    sql += ` USING (${node.using})`;
+  }
+  if (node.withCheck !== undefined) {
+    sql += ` WITH CHECK (${node.withCheck})`;
+  }
+  return { sql, params: [] };
+}
+
+function pgRenderDropPolicy(node: PostgresDropPolicy): SqlExecuteRequest {
+  const tableRef = `${quoteIdentifier(node.schema)}.${quoteIdentifier(node.table)}`;
+  return {
+    sql: `DROP POLICY ${quoteIdentifier(node.name)} ON ${tableRef}`,
+    params: [],
+  };
+}
+
 async function pgRenderDdlExecuteRequest(
   ast: PostgresDdlNode,
   codecLookup: CodecLookup,
@@ -1540,6 +1686,8 @@ async function pgRenderDdlExecuteRequest(
     createTable: (node: PostgresCreateTable) => pgRenderCreateTable(node, codecLookup),
     createSchema: (node: PostgresCreateSchema) => Promise.resolve(pgRenderCreateSchema(node)),
     alterTable: (node: PostgresAlterTable) => pgRenderAlterTable(node, codecLookup),
+    createPolicy: (node: PostgresCreatePolicy) => Promise.resolve(pgRenderCreatePolicy(node)),
+    dropPolicy: (node: PostgresDropPolicy) => Promise.resolve(pgRenderDropPolicy(node)),
   };
   return ast.accept(visitor);
 }