@prisma-next/adapter-postgres 0.14.0-dev.2 → 0.14.0-dev.21

package/dist/{adapter-CwkcdpM_.mjs → adapter-BvM9axNH.mjs}

@@ -1,4 +1,4 @@
-import { n as renderLoweredSql, r as createPostgresBuiltinCodecLookup, t as PostgresControlAdapter } from "./control-adapter-Dspz5uKp.mjs";
+import { n as renderLoweredSql, r as createPostgresBuiltinCodecLookup, t as PostgresControlAdapter } from "./control-adapter-AffpjrYN.mjs";
 import { APP_SPACE_ID } from "@prisma-next/framework-components/control";
 import { isDdlNode } from "@prisma-next/sql-relational-core/ast";
 //#region src/core/adapter.ts
@@ -15,7 +15,8 @@ const defaultCapabilities = Object.freeze({
 		enums: true,
 		returning: true,
 		defaultInInsert: true,
-		lateral: true
+		lateral: true,
+		scalarList: true
 	}
 });
 var PostgresAdapterImpl = class {
@@ -62,4 +63,4 @@ function createPostgresAdapter(options) {
 //#endregion
 export { postgresRawCodecInferer as n, createPostgresAdapter as t };
 
-//# sourceMappingURL=adapter-CwkcdpM_.mjs.map
+//# sourceMappingURL=adapter-BvM9axNH.mjs.map

package/dist/adapter-BvM9axNH.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-BvM9axNH.mjs","names":[],"sources":["../src/core/adapter.ts"],"sourcesContent":["import type { CodecRegistry } from '@prisma-next/framework-components/codec';\nimport { APP_SPACE_ID } from '@prisma-next/framework-components/control';\nimport type {\n  Adapter,\n  AdapterProfile,\n  AnyQueryAst,\n  LowererContext,\n  RawSqlLiteral,\n  SqlQueryable,\n} from '@prisma-next/sql-relational-core/ast';\nimport { isDdlNode } from '@prisma-next/sql-relational-core/ast';\nimport type { RawCodecInferer } from '@prisma-next/sql-relational-core/expression';\nimport type { PostgresDdlNode } from '@prisma-next/target-postgres/ddl';\nimport { createPostgresBuiltinCodecLookup } from './codec-lookup';\nimport { PostgresControlAdapter } from './control-adapter';\nimport { renderLoweredSql } from './sql-renderer';\nimport type { PostgresAdapterOptions, PostgresContract, PostgresLoweredStatement } from './types';\n\nconst defaultCapabilities = Object.freeze({\n  postgres: {\n    orderBy: true,\n    limit: true,\n    lateral: true,\n    jsonAgg: true,\n    returning: true,\n    distinctOn: true,\n  },\n  sql: {\n    enums: true,\n    returning: true,\n    defaultInInsert: true,\n    lateral: true,\n    scalarList: true,\n  },\n});\n\nclass PostgresAdapterImpl\n  implements Adapter<AnyQueryAst, PostgresContract, PostgresLoweredStatement>\n{\n  // These fields make the adapter instance structurally compatible with RuntimeAdapterInstance<'sql', 'postgres'> without introducing a runtime-plane dependency.\n  readonly familyId = 'sql' as const;\n  readonly targetId = 'postgres' as const;\n\n  readonly profile: AdapterProfile<'postgres'>;\n  private readonly codecLookup: CodecRegistry;\n\n  constructor(options?: PostgresAdapterOptions) {\n    this.codecLookup = options?.codecLookup ?? createPostgresBuiltinCodecLookup();\n    const controlAdapter = new PostgresControlAdapter(this.codecLookup);\n    this.profile = Object.freeze({\n      id: options?.profileId ?? 'postgres/default@1',\n      target: 'postgres',\n      capabilities: defaultCapabilities,\n      readMarker: (queryable: SqlQueryable) =>\n        controlAdapter.readMarkerDiscriminated(\n          {\n            familyId: 'sql',\n            targetId: 'postgres',\n            query: async <Row = Record<string, unknown>>(\n              sql: string,\n              params?: readonly unknown[],\n            ) => {\n              const result = await queryable.query<Row>(sql, params);\n              return { rows: [...result.rows] };\n            },\n            close: async () => {},\n          },\n          APP_SPACE_ID,\n        ),\n    });\n  }\n\n  lower(\n    ast: AnyQueryAst | PostgresDdlNode,\n    context: LowererContext<PostgresContract>,\n  ): PostgresLoweredStatement {\n    if (isDdlNode(ast)) {\n      throw new Error(\n        'lower() does not lower DDL on the runtime adapter — DDL lowering is a control-plane concern handled by the control adapter.',\n      );\n    }\n    return renderLoweredSql(ast, context.contract, this.codecLookup);\n  }\n}\n\n/** Codec-id lookup for bare-literal interpolations used by `fns.raw` on a postgres client. Contributed as the descriptor's static `rawCodecInferer` slot. */\nexport const postgresRawCodecInferer: RawCodecInferer = {\n  inferCodec(value: RawSqlLiteral): string {\n    switch (typeof value) {\n      case 'number':\n        return Number.isSafeInteger(value) && value % 1 === 0 ? 'pg/int4' : 'pg/float8';\n      case 'bigint':\n        return 'pg/int8';\n      case 'string':\n        return 'pg/text';\n      case 'boolean':\n        return 'pg/bool';\n      case 'object':\n        if (value instanceof Uint8Array) return 'pg/bytea';\n    }\n    throw new Error(\n      'unsupported JS value type for raw-SQL interpolation: wrap this value in `param(...)` with an explicit codec',\n    );\n  },\n};\n\nexport function createPostgresAdapter(options?: PostgresAdapterOptions) {\n  return Object.freeze(new PostgresAdapterImpl(options));\n}\n"],"mappings":";;;;AAkBA,MAAM,sBAAsB,OAAO,OAAO;CACxC,UAAU;EACR,SAAS;EACT,OAAO;EACP,SAAS;EACT,SAAS;EACT,WAAW;EACX,YAAY;CACd;CACA,KAAK;EACH,OAAO;EACP,WAAW;EACX,iBAAiB;EACjB,SAAS;EACT,YAAY;CACd;AACF,CAAC;AAED,IAAM,sBAAN,MAEA;CAEE,WAAoB;CACpB,WAAoB;CAEpB;CACA;CAEA,YAAY,SAAkC;EAC5C,KAAK,cAAc,SAAS,eAAe,iCAAiC;EAC5E,MAAM,iBAAiB,IAAI,uBAAuB,KAAK,WAAW;EAClE,KAAK,UAAU,OAAO,OAAO;GAC3B,IAAI,SAAS,aAAa;GAC1B,QAAQ;GACR,cAAc;GACd,aAAa,cACX,eAAe,wBACb;IACE,UAAU;IACV,UAAU;IACV,OAAO,OACL,KACA,WACG;KAEH,OAAO,EAAE,MAAM,CAAC,IAAG,MADE,UAAU,MAAW,KAAK,MAAM,EAAA,CAC3B,IAAI,EAAE;IAClC;IACA,OAAO,YAAY,CAAC;GACtB,GACA,YACF;EACJ,CAAC;CACH;CAEA,MACE,KACA,SAC0B;EAC1B,IAAI,UAAU,GAAG,GACf,MAAM,IAAI,MACR,6HACF;EAEF,OAAO,iBAAiB,KAAK,QAAQ,UAAU,KAAK,WAAW;CACjE;AACF;;AAGA,MAAa,0BAA2C,EACtD,WAAW,OAA8B;CACvC,QAAQ,OAAO,OAAf;EACE,KAAK,UACH,OAAO,OAAO,cAAc,KAAK,KAAK,QAAQ,MAAM,IAAI,YAAY;EACtE,KAAK,UACH,OAAO;EACT,KAAK,UACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,KAAK,UACH,IAAI,iBAAiB,YAAY,OAAO;CAC5C;CACA,MAAM,IAAI,MACR,6GACF;AACF,EACF;AAEA,SAAgB,sBAAsB,SAAkC;CACtE,OAAO,OAAO,OAAO,IAAI,oBAAoB,OAAO,CAAC;AACvD"}

package/dist/adapter.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.mts","names":[],"sources":["../src/core/adapter.ts"],"mappings":";;;;;;cAmCM,mBAAA,YACO,OAAA,CAAQ,WAAA,EAAa,gBAAA,EAAkB,wBAAA;EAAA,SAGzC,QAAA;EAAA,SACA,QAAA;EAAA,SAEA,OAAA,EAAS,cAAA;EAAA,iBACD,WAAA;cAEL,OAAA,GAAU,sBAAA;EA0BtB,KAAA,CACE,GAAA,EAAK,WAAA,GAAc,eAAA,EACnB,OAAA,EAAS,cAAA,CAAe,gBAAA,IACvB,wBAAA;AAAA;;cAWQ,uBAAA,EAAyB,eAkBrC;AAAA,iBAEe,qBAAA,CAAsB,OAAA,GAAU,sBAAA,GAAsB,QAAA,CAAA,mBAAA"}
+{"version":3,"file":"adapter.d.mts","names":[],"sources":["../src/core/adapter.ts"],"mappings":";;;;;;cAoCM,mBAAA,YACO,OAAA,CAAQ,WAAA,EAAa,gBAAA,EAAkB,wBAAA;EAAA,SAGzC,QAAA;EAAA,SACA,QAAA;EAAA,SAEA,OAAA,EAAS,cAAA;EAAA,iBACD,WAAA;cAEL,OAAA,GAAU,sBAAA;EA0BtB,KAAA,CACE,GAAA,EAAK,WAAA,GAAc,eAAA,EACnB,OAAA,EAAS,cAAA,CAAe,gBAAA,IACvB,wBAAA;AAAA;;cAWQ,uBAAA,EAAyB,eAkBrC;AAAA,iBAEe,qBAAA,CAAsB,OAAA,GAAU,sBAAA,GAAsB,QAAA,CAAA,mBAAA"}

package/dist/adapter.mjs

@@ -1,2 +1,2 @@
-import { n as postgresRawCodecInferer, t as createPostgresAdapter } from "./adapter-CwkcdpM_.mjs";
+import { n as postgresRawCodecInferer, t as createPostgresAdapter } from "./adapter-BvM9axNH.mjs";
 export { createPostgresAdapter, postgresRawCodecInferer };

package/dist/{control-adapter-Dspz5uKp.mjs → control-adapter-AffpjrYN.mjs}

@@ -8,7 +8,9 @@ import { REFERENTIAL_ACTION_SQL } from "@prisma-next/sql-contract/referential-ac
 import { buildControlTableBootstrapQueries, buildSignMarkerBootstrapQueries, int4, int8, jsonb, pgTable, text, textArray, timestamptz } from "@prisma-next/target-postgres/contract-free";
 import { parsePostgresDefault } from "@prisma-next/target-postgres/default-normalizer";
 import { normalizeSchemaNativeType } from "@prisma-next/target-postgres/native-type-normalizer";
+import { diffPostgresRlsPolicies } from "@prisma-next/target-postgres/planner";
 import { escapeLiteral, quoteIdentifier } from "@prisma-next/target-postgres/sql-utils";
+import { PostgresRlsPolicy, PostgresRole, PostgresSchemaIR, isPostgresSchemaIR } from "@prisma-next/target-postgres/types";
 import { blindCast } from "@prisma-next/utils/casts";
 import { ifDefined } from "@prisma-next/utils/defined";
 import { createAstCodecRegistry, deriveParamMetadata, encodeParamsWithMetadata } from "@prisma-next/sql-runtime";
@@ -143,7 +145,7 @@ const POSTGRES_INFERRABLE_NATIVE_TYPES = new Set([
 	"bit",
 	"bit varying"
 ]);
-function renderTypedParam(index, codecId, codecLookup) {
+function renderTypedParam(index, codecId, codecLookup, many) {
 	if (codecId === void 0) return `$${index}`;
 	const meta = codecLookup.metaFor(codecId);
 	if (!(codecLookup.get(codecId) !== void 0 || meta !== void 0 || codecLookup.targetTypesFor(codecId) !== void 0)) throw new Error(`Postgres lowering: ParamRef carries codecId "${codecId}" but the assembled codec lookup has no entry for it. This usually indicates a missing extension pack in the runtime stack — register the pack that contributes this codec (e.g. \`extensionPacks: [pgvectorRuntime]\`), or use the codec directly from \`@prisma-next/target-postgres/codecs\` if it's a builtin.`);
@@ -151,7 +153,11 @@ function renderTypedParam(index, codecId, codecLookup) {
 	const sqlBlock = isRecord(dbRecord) ? dbRecord["sql"] : void 0;
 	const dialectBlock = isRecord(sqlBlock) ? sqlBlock["postgres"] : void 0;
 	const nativeType = isRecord(dialectBlock) ? dialectBlock["nativeType"] : void 0;
-	if (typeof nativeType === "string" && !POSTGRES_INFERRABLE_NATIVE_TYPES.has(nativeType)) return `$${index}::${nativeType}`;
+	if (typeof nativeType === "string") {
+		const arraySuffix = many ? "[]" : "";
+		if (!POSTGRES_INFERRABLE_NATIVE_TYPES.has(nativeType)) return `$${index}::${nativeType}${arraySuffix}`;
+		if (many) return `$${index}::${nativeType}${arraySuffix}`;
+	}
 	return `$${index}`;
 }
 function isRecord(value) {
@@ -497,12 +503,12 @@ function renderExpr(expr, contract, pim) {
 function renderParamRef(ref, pim) {
 	const index = pim.indexMap.get(ref);
 	if (index === void 0) throw new Error("ParamRef not found in index map");
-	if (ref.kind === "prepared-param-ref") return renderTypedParam(index, ref.codec.codecId, pim.codecLookup);
+	if (ref.kind === "prepared-param-ref") return renderTypedParam(index, ref.codec.codecId, pim.codecLookup, ref.codec.many);
 	if (ref.codec === void 0) throw runtimeError("RUNTIME.PARAM_REF_MISSING_CODEC", "Postgres renderer: ParamRef reached lowering without a bound CodecRef. Every column-bound ParamRef must carry a codec under the AST-bound codec contract. This usually indicates a builder path that constructed a ParamRef without threading the column codec.", {
 		paramIndex: index,
 		...ifDefined("name", ref.name)
 	});
-	return renderTypedParam(index, ref.codec.codecId, pim.codecLookup);
+	return renderTypedParam(index, ref.codec.codecId, pim.codecLookup, ref.codec.many);
 }
 function renderLiteral(expr) {
 	if (typeof expr.value === "string") return `'${escapeLiteral(expr.value)}'`;
@@ -664,6 +670,13 @@ var PostgresControlAdapter = class {
 	* before comparison with contract native types.
 	*/
 	normalizeNativeType = normalizeSchemaNativeType;
+	collectSchemaDiffIssues(contract, schema) {
+		if (!isPostgresSchemaIR(schema)) throw new Error(`RLS verification requires a PostgresSchemaIR; got ${schema.constructor?.name ?? typeof schema}`);
+		return diffPostgresRlsPolicies({
+			contract,
+			schema
+		});
+	}
 	bootstrapControlTableQueries() {
 		return buildControlTableBootstrapQueries();
 	}
@@ -889,18 +902,15 @@ var PostgresControlAdapter = class {
 		const declaredNamespaces = extractContractNamespaceIds(contract);
 		const ir = declaredNamespaces.length > 0 ? await this.introspectNamespaces(driver, declaredNamespaces) : await this.introspectSchema(driver, schema);
 		const existingSchemas = await this.listExistingSchemas(driver);
-		const annotations = ir.annotations ?? {};
-		const pg = annotations.pg ?? {};
-		return {
-			...ir,
-			annotations: {
-				...annotations,
-				pg: {
-					...pg,
-					existingSchemas
-				}
-			}
-		};
+		return new PostgresSchemaIR({
+			tables: ir.tables,
+			pgSchemaName: ir.pgSchemaName,
+			pgVersion: ir.pgVersion,
+			rlsPolicies: ir.rlsPolicies,
+			roles: ir.roles,
+			existingSchemas,
+			nativeEnumTypeNames: ir.nativeEnumTypeNames
+		});
 	}
 	/**
 	* Lists every non-system schema present in the connected database.
@@ -936,15 +946,22 @@ var PostgresControlAdapter = class {
 		for (const schema of uniqueSchemas) perSchema.push(await this.introspectSchema(driver, schema));
 		const mergedTables = {};
 		for (const ir of perSchema) for (const [tableName, table] of Object.entries(ir.tables)) mergedTables[tableName] = table;
-		const firstAnnotations = perSchema[0]?.annotations;
-		const firstPg = blindCast(firstAnnotations?.["pg"]) ?? {};
-		return {
+		const mergedRlsPolicies = [];
+		const mergedRoles = [];
+		for (const ir of perSchema) {
+			mergedRlsPolicies.push(...ir.rlsPolicies);
+			mergedRoles.push(...ir.roles);
+		}
+		const first = perSchema[0];
+		return new PostgresSchemaIR({
 			tables: mergedTables,
-			...ifDefined("annotations", {
-				...firstAnnotations,
-				pg: { ...firstPg }
-			})
-		};
+			pgSchemaName: first?.pgSchemaName ?? "public",
+			pgVersion: first?.pgVersion ?? "unknown",
+			rlsPolicies: mergedRlsPolicies,
+			roles: mergedRoles,
+			existingSchemas: first?.existingSchemas ?? ["public"],
+			nativeEnumTypeNames: first?.nativeEnumTypeNames ?? []
+		});
 	}
 	/**
 	* Introspects a single Postgres schema and returns a raw SqlSchemaIR
@@ -1105,11 +1122,14 @@ var PostgresControlAdapter = class {
 				else if (colRow.numeric_precision) nativeType = `${colRow.data_type}(${colRow.numeric_precision})`;
 				else nativeType = colRow.data_type;
 				else nativeType = colRow.udt_name || colRow.data_type;
+				const many = nativeType.endsWith("[]") ? true : void 0;
+				if (many) nativeType = normalizeSchemaNativeType(nativeType.slice(0, -2));
 				columns[colRow.column_name] = {
 					name: colRow.column_name,
 					nativeType,
 					nullable: colRow.is_nullable === "YES",
-					...ifDefined("default", colRow.column_default ?? void 0)
+					...ifDefined("default", colRow.column_default ?? void 0),
+					...ifDefined("many", many)
 				};
 			}
 			const pkRows = [...pksByTable.get(tableName) ?? []];
@@ -1207,14 +1227,45 @@ var PostgresControlAdapter = class {
          WHERE t.typtype = 'e'
            AND n.nspname = $1
          ORDER BY t.typname`, [schema])).rows.map((r) => r.typname);
-		return {
+		const policiesResult = await driver.query(`SELECT schemaname, tablename, policyname, cmd, roles, qual, with_check, permissive
+       FROM pg_catalog.pg_policies
+       WHERE schemaname = $1
+       ORDER BY tablename, policyname`, [schema]);
+		const rolesResult = await driver.query(`SELECT rolname
+       FROM pg_catalog.pg_roles
+       WHERE rolname NOT LIKE 'pg_%'
+         AND rolname != 'postgres'
+       ORDER BY rolname`);
+		const rlsPolicies = policiesResult.rows.map((row) => {
+			const operation = mapPgCmd(row.cmd);
+			const roles = [...new Set(parsePgNameArray(row.roles).map((r) => r.toLowerCase()))].sort();
+			const permissive = row.permissive.toUpperCase() === "PERMISSIVE";
+			const prefix = /^(.+)_([0-9a-f]{8})$/.exec(row.policyname)?.[1] ?? row.policyname;
+			return new PostgresRlsPolicy({
+				name: row.policyname,
+				prefix,
+				tableName: row.tablename,
+				namespaceId: row.schemaname,
+				operation,
+				roles,
+				...row.qual !== null ? { using: row.qual } : {},
+				...row.with_check !== null ? { withCheck: row.with_check } : {},
+				permissive
+			});
+		});
+		const roles = rolesResult.rows.map((row) => new PostgresRole({
+			name: row.rolname,
+			namespaceId: UNBOUND_NAMESPACE_ID
+		}));
+		return new PostgresSchemaIR({
 			tables,
-			annotations: { pg: {
-				schema,
-				version: await this.getPostgresVersion(driver),
-				...nativeEnumTypeNames.length > 0 && { nativeEnumTypeNames }
-			} }
-		};
+			pgSchemaName: schema,
+			pgVersion: await this.getPostgresVersion(driver),
+			rlsPolicies,
+			roles,
+			existingSchemas: [],
+			nativeEnumTypeNames
+		});
 	}
 	/**
 	* Gets the Postgres version from the database.
@@ -1224,6 +1275,37 @@ var PostgresControlAdapter = class {
 	}
 };
 /**
+* Normalises a `name[]` column value from `pg_policies.roles`.
+*
+* The `pg` client's type-parser registry handles `text[]` (OID 1009) but not
+* `name[]` (OID 1003). When the parser is absent the raw Postgres text-array
+* literal (`{role1,role2}`) is returned as a string instead of a JS array.
+* This function accepts either form and returns a plain string array.
+*/
+function parsePgNameArray(value) {
+	if (Array.isArray(value)) return value;
+	if (typeof value !== "string") return [];
+	const trimmed = value.trim();
+	if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) return [];
+	const inner = trimmed.slice(1, -1);
+	if (inner === "") return [];
+	return inner.split(",").map((s) => s.trim());
+}
+/**
+* Maps `pg_policies.cmd` text values to the `RlsPolicyOperation` union.
+* The `pg_policies` view renders the internal command code as an uppercase
+* English keyword; this function lowercases to match the IR type.
+*/
+function mapPgCmd(cmd) {
+	switch (cmd.toUpperCase()) {
+		case "SELECT": return "select";
+		case "INSERT": return "insert";
+		case "UPDATE": return "update";
+		case "DELETE": return "delete";
+		default: return "all";
+	}
+}
+/**
 * Extracts the namespace coordinate ids declared on a contract's storage,
 * or returns an empty array when no contract (or no storage / namespaces)
 * is present. Used by `PostgresControlAdapter.introspect` to decide
@@ -1238,6 +1320,7 @@ function extractContractNamespaceIds(contract) {
 	return Object.keys(namespaces);
 }
 function normalizeFormattedType(formattedType, dataType, udtName) {
+	if (formattedType.endsWith("[]")) return `${normalizeFormattedType(formattedType.slice(0, -2), dataType, udtName)}[]`;
 	if (formattedType === "integer") return "int4";
 	if (formattedType === "smallint") return "int2";
 	if (formattedType === "bigint") return "int8";
@@ -1383,6 +1466,16 @@ function extractQuotedLiterals(listBody) {
 function pgIsTextLikeNativeType(nativeType) {
 	return nativeType === "text" || nativeType === "varchar" || nativeType.startsWith("varchar(") || nativeType === "character varying" || nativeType.startsWith("character varying(") || nativeType === "char" || nativeType.startsWith("char(") || nativeType === "character" || nativeType.startsWith("character(");
 }
+function pgRenderArrayElement(el) {
+	if (el === null) return "NULL";
+	if (typeof el === "number" || typeof el === "boolean") return String(el);
+	if (typeof el === "string") return `'${escapeLiteral(el)}'`;
+	return `'${escapeLiteral(JSON.stringify(el))}'`;
+}
+function pgRenderArrayLiteral(elements) {
+	if (elements.length === 0) return "'{}'";
+	return `ARRAY[${elements.map(pgRenderArrayElement).join(", ")}]`;
+}
 function pgInlineLiteral(wire, nativeType) {
 	if (wire === null) return "NULL";
 	if (typeof wire === "boolean") return wire ? "true" : "false";
@@ -1401,6 +1494,7 @@ function pgInlineLiteral(wire, nativeType) {
 		return pgIsTextLikeNativeType(nativeType) ? quoted : `${quoted}::${nativeType}`;
 	}
 	if (wire instanceof Uint8Array) return `'\\x${Array.from(wire).map((b) => b.toString(16).padStart(2, "0")).join("")}'::${nativeType}`;
+	if (Array.isArray(wire) && nativeType.endsWith("[]")) return pgRenderArrayLiteral(wire);
 	if (typeof wire === "object") return `${`'${escapeLiteral(JSON.stringify(wire))}'`}::${nativeType}`;
 	throw new Error(`pgRenderDdlExecuteRequest: unexpected wire type "${typeof wire}" for native type "${nativeType}"`);
 }
@@ -1460,22 +1554,56 @@ function pgRenderCreateSchema(node) {
 }
 async function pgRenderAlterTable(node, codecLookup) {
 	const tableRef = node.schema ? `${quoteIdentifier(node.schema)}.${quoteIdentifier(node.table)}` : quoteIdentifier(node.table);
-	const actionVisitor = { async addColumn(action) {
-		return `ADD COLUMN ${await pgRenderDdlColumn(action.column, codecLookup)}`;
-	} };
+	const actionVisitor = {
+		async addColumn(action) {
+			return `ADD COLUMN ${await pgRenderDdlColumn(action.column, codecLookup)}`;
+		},
+		dropDefault(action) {
+			return Promise.resolve(`ALTER COLUMN ${quoteIdentifier(action.columnName)} DROP DEFAULT`);
+		}
+	};
 	return {
 		sql: `ALTER TABLE ${tableRef} ${(await Promise.all(node.actions.map((a) => a.accept(actionVisitor)))).join(", ")}`,
 		params: []
 	};
 }
+const POLICY_OPERATION_SQL = {
+	select: "SELECT",
+	insert: "INSERT",
+	update: "UPDATE",
+	delete: "DELETE",
+	all: "ALL"
+};
+function pgRenderCreatePolicy(node) {
+	const tableRef = `${quoteIdentifier(node.schema)}.${quoteIdentifier(node.table)}`;
+	const permissiveness = node.permissive ? "PERMISSIVE" : "RESTRICTIVE";
+	const command = POLICY_OPERATION_SQL[node.operation];
+	const roles = node.roles.length === 0 ? "PUBLIC" : node.roles.join(", ");
+	let sql = `CREATE POLICY ${quoteIdentifier(node.name)} ON ${tableRef} AS ${permissiveness} FOR ${command} TO ${roles}`;
+	if (node.using !== void 0) sql += ` USING (${node.using})`;
+	if (node.withCheck !== void 0) sql += ` WITH CHECK (${node.withCheck})`;
+	return {
+		sql,
+		params: []
+	};
+}
+function pgRenderDropPolicy(node) {
+	const tableRef = `${quoteIdentifier(node.schema)}.${quoteIdentifier(node.table)}`;
+	return {
+		sql: `DROP POLICY ${quoteIdentifier(node.name)} ON ${tableRef}`,
+		params: []
+	};
+}
 async function pgRenderDdlExecuteRequest(ast, codecLookup) {
 	return ast.accept({
 		createTable: (node) => pgRenderCreateTable(node, codecLookup),
 		createSchema: (node) => Promise.resolve(pgRenderCreateSchema(node)),
-		alterTable: (node) => pgRenderAlterTable(node, codecLookup)
+		alterTable: (node) => pgRenderAlterTable(node, codecLookup),
+		createPolicy: (node) => Promise.resolve(pgRenderCreatePolicy(node)),
+		dropPolicy: (node) => Promise.resolve(pgRenderDropPolicy(node))
 	});
 }
 //#endregion
 export { renderLoweredSql as n, createPostgresBuiltinCodecLookup as r, PostgresControlAdapter as t };
 
-//# sourceMappingURL=control-adapter-Dspz5uKp.mjs.map
+//# sourceMappingURL=control-adapter-AffpjrYN.mjs.map