@prisma-next/adapter-postgres 0.14.0-dev.5 → 0.14.0-dev.51

package/package.json

@@ -1,34 +1,35 @@
 {
   "name": "@prisma-next/adapter-postgres",
-  "version": "0.14.0-dev.5",
+  "version": "0.14.0-dev.51",
   "license": "Apache-2.0",
   "type": "module",
   "sideEffects": false,
   "dependencies": {
-    "@prisma-next/contract": "0.14.0-dev.5",
-    "@prisma-next/contract-authoring": "0.14.0-dev.5",
-    "@prisma-next/errors": "0.14.0-dev.5",
-    "@prisma-next/family-sql": "0.14.0-dev.5",
-    "@prisma-next/framework-components": "0.14.0-dev.5",
-    "@prisma-next/ids": "0.14.0-dev.5",
-    "@prisma-next/sql-contract": "0.14.0-dev.5",
-    "@prisma-next/sql-contract-psl": "0.14.0-dev.5",
-    "@prisma-next/sql-contract-ts": "0.14.0-dev.5",
-    "@prisma-next/sql-operations": "0.14.0-dev.5",
-    "@prisma-next/sql-relational-core": "0.14.0-dev.5",
-    "@prisma-next/sql-runtime": "0.14.0-dev.5",
-    "@prisma-next/sql-schema-ir": "0.14.0-dev.5",
-    "@prisma-next/target-postgres": "0.14.0-dev.5",
-    "@prisma-next/utils": "0.14.0-dev.5",
+    "@prisma-next/contract": "0.14.0-dev.51",
+    "@prisma-next/contract-authoring": "0.14.0-dev.51",
+    "@prisma-next/errors": "0.14.0-dev.51",
+    "@prisma-next/family-sql": "0.14.0-dev.51",
+    "@prisma-next/framework-components": "0.14.0-dev.51",
+    "@prisma-next/ids": "0.14.0-dev.51",
+    "@prisma-next/sql-contract": "0.14.0-dev.51",
+    "@prisma-next/sql-contract-psl": "0.14.0-dev.51",
+    "@prisma-next/sql-contract-ts": "0.14.0-dev.51",
+    "@prisma-next/sql-operations": "0.14.0-dev.51",
+    "@prisma-next/sql-relational-core": "0.14.0-dev.51",
+    "@prisma-next/sql-runtime": "0.14.0-dev.51",
+    "@prisma-next/sql-schema-ir": "0.14.0-dev.51",
+    "@prisma-next/target-postgres": "0.14.0-dev.51",
+    "@prisma-next/utils": "0.14.0-dev.51",
     "arktype": "^2.2.0"
   },
   "devDependencies": {
-    "@prisma-next/cli": "0.14.0-dev.5",
-    "@prisma-next/driver-postgres": "0.14.0-dev.5",
-    "@prisma-next/migration-tools": "0.14.0-dev.5",
-    "@prisma-next/test-utils": "0.14.0-dev.5",
-    "@prisma-next/tsconfig": "0.14.0-dev.5",
-    "@prisma-next/tsdown": "0.14.0-dev.5",
+    "@prisma-next/cli": "0.14.0-dev.51",
+    "@prisma-next/driver-postgres": "0.14.0-dev.51",
+    "@prisma-next/migration-tools": "0.14.0-dev.51",
+    "@prisma-next/psl-parser": "0.14.0-dev.51",
+    "@prisma-next/test-utils": "0.14.0-dev.51",
+    "@prisma-next/tsconfig": "0.14.0-dev.51",
+    "@prisma-next/tsdown": "0.14.0-dev.51",
     "pathe": "^2.0.3",
     "tsdown": "0.22.1",
     "typescript": "5.9.3",

package/src/core/adapter.ts

@@ -30,6 +30,7 @@ const defaultCapabilities = Object.freeze({
     returning: true,
     defaultInInsert: true,
     lateral: true,
+    scalarList: true,
   },
 });
 

package/src/core/codec-lookup.ts

@@ -10,10 +10,11 @@ import { postgresCodecRegistry } from '@prisma-next/target-postgres/codecs';
  * Extension codecs (e.g. `pg/vector@1` from `@prisma-next/extension-pgvector`) are intentionally NOT included here: a bare adapter cannot see extensions. Stack-composed paths (`SqlControlAdapterDescriptor.create(stack)` / `SqlRuntimeAdapterDescriptor.create(stack)`) supply the broader, extension-inclusive registry at construction time.
  */
 export function createPostgresBuiltinCodecLookup(): CodecRegistry {
+  const descriptors = Array.from(postgresCodecRegistry.values());
   return extractCodecLookup([
     {
       id: 'postgres-builtin-codecs',
-      types: { codecTypes: { codecDescriptors: Array.from(postgresCodecRegistry.values()) } },
+      types: { codecTypes: { codecDescriptors: descriptors } },
     },
   ]);
 }

package/src/core/control-adapter.ts

@@ -28,15 +28,13 @@ import type {
 } from '@prisma-next/sql-relational-core/ast';
 import { isDdlNode } from '@prisma-next/sql-relational-core/ast';
 import type {
-  PrimaryKey,
+  PrimaryKeyInput,
   SqlCheckConstraintIRInput,
-  SqlColumnIR,
-  SqlForeignKeyIR,
-  SqlIndexIR,
+  SqlColumnIRInput,
+  SqlForeignKeyIRInput,
+  SqlIndexIRInput,
   SqlReferentialAction,
-  SqlSchemaIR,
-  SqlTableIR,
-  SqlUniqueIR,
+  SqlUniqueIRInput,
 } from '@prisma-next/sql-schema-ir/types';
 import {
   buildControlTableBootstrapQueries,
@@ -45,14 +43,25 @@ import {
 import type {
   AddColumnAction,
   AlterTableActionVisitor,
+  DropDefaultAction,
   PostgresAlterTable,
+  PostgresCreatePolicy,
   PostgresCreateSchema,
   PostgresCreateTable,
   PostgresDdlNode,
+  PostgresDropPolicy,
+  RlsPolicyOperation,
 } from '@prisma-next/target-postgres/ddl';
 import { parsePostgresDefault } from '@prisma-next/target-postgres/default-normalizer';
 import { normalizeSchemaNativeType } from '@prisma-next/target-postgres/native-type-normalizer';
 import { escapeLiteral, quoteIdentifier } from '@prisma-next/target-postgres/sql-utils';
+import {
+  PostgresDatabaseSchemaNode,
+  PostgresNamespaceSchemaNode,
+  PostgresPolicySchemaNode,
+  PostgresRoleSchemaNode,
+  PostgresTableSchemaNode,
+} from '@prisma-next/target-postgres/types';
 import { blindCast } from '@prisma-next/utils/casts';
 import { ifDefined } from '@prisma-next/utils/defined';
 import { encodeControlQueryParams } from './control-codecs';
@@ -548,26 +557,51 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
     driver: SqlControlDriverInstance<'postgres'>,
     contract?: unknown,
     schema = 'public',
-  ): Promise<SqlSchemaIR> {
+  ): Promise<PostgresDatabaseSchemaNode> {
     const declaredNamespaces = extractContractNamespaceIds(contract);
-    const ir =
+    const resolvedSchemas =
       declaredNamespaces.length > 0
-        ? await this.introspectNamespaces(driver, declaredNamespaces)
-        : await this.introspectSchema(driver, schema);
-    // Capture the list of non-system schemas so downstream planners
-    // (e.g. `verifyPostgresNamespacePresence`) can determine which
-    // contract-declared namespaces need a `CREATE SCHEMA` before the
-    // table DDL.
+        ? await this.resolveNamespaceSchemas(driver, declaredNamespaces)
+        : [schema];
+
+    // Walk schemas sequentially: every introspectSchema call shares the one
+    // control connection, so a parallel walk only serialises behind the wire
+    // protocol and trips pg's "already executing a query" deprecation.
+    const namespaces: Record<string, PostgresNamespaceSchemaNode> = {};
+    let pgVersion = 'unknown';
+    for (const resolved of resolvedSchemas) {
+      const { namespace, pgVersion: version } = await this.introspectSchema(driver, resolved);
+      namespaces[resolved] = namespace;
+      pgVersion = version;
+    }
+
+    const roles = await this.introspectRoles(driver);
     const existingSchemas = await this.listExistingSchemas(driver);
-    const annotations = ir.annotations ?? {};
-    const pg = (annotations as { pg?: Record<string, unknown> }).pg ?? {};
-    return {
-      ...ir,
-      annotations: {
-        ...annotations,
-        pg: { ...pg, existingSchemas },
-      },
-    };
+    return new PostgresDatabaseSchemaNode({
+      namespaces,
+      roles,
+      existingSchemas,
+      pgVersion,
+    });
+  }
+
+  /**
+   * Reads cluster-scoped database roles. Roles are not schema-qualified, so
+   * this is queried once for the whole database rather than per namespace.
+   */
+  private async introspectRoles(
+    driver: SqlControlDriverInstance<'postgres'>,
+  ): Promise<readonly PostgresRoleSchemaNode[]> {
+    const rolesResult = await driver.query<{ rolname: string }>(
+      `SELECT rolname
+       FROM pg_catalog.pg_roles
+       WHERE rolname NOT LIKE 'pg_%'
+         AND rolname != 'postgres'
+       ORDER BY rolname`,
+    );
+    return rolesResult.rows.map(
+      (row) => new PostgresRoleSchemaNode({ name: row.rolname, namespaceId: UNBOUND_NAMESPACE_ID }),
+    );
   }
 
   /**
@@ -593,16 +627,16 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
   }
 
   /**
-   * Walks every declared namespace, resolving `UNBOUND_NAMESPACE_ID` to
-   * the connection's `current_schema()`, and merges the per-schema results
-   * into a single `SqlSchemaIR`. The merged `tables` map is flat (keyed by
-   * table name) so callers that look up by `tableName` see every contract
-   * table regardless of which namespace it lives in.
+   * Resolves the declared namespace ids to their live DDL schema names,
+   * mapping `UNBOUND_NAMESPACE_ID` to the connection's `current_schema()`
+   * and de-duplicating. The caller introspects one namespace node per
+   * resolved schema — there is no flat cross-schema merge, so two schemas
+   * holding a same-named table no longer collide.
    */
-  private async introspectNamespaces(
+  private async resolveNamespaceSchemas(
     driver: SqlControlDriverInstance<'postgres'>,
     namespaceIds: readonly string[],
-  ): Promise<SqlSchemaIR> {
+  ): Promise<readonly string[]> {
     const resolvedSchemas: string[] = [];
     for (const id of namespaceIds) {
       if (id === UNBOUND_NAMESPACE_ID) {
@@ -614,46 +648,19 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
         resolvedSchemas.push(id);
       }
     }
-    const uniqueSchemas = Array.from(new Set(resolvedSchemas));
-
-    // Walk schemas sequentially: every introspectSchema call shares the one
-    // control connection, so a parallel walk only serialises behind the wire
-    // protocol and trips pg's "already executing a query" deprecation.
-    const perSchema: SqlSchemaIR[] = [];
-    for (const schema of uniqueSchemas) {
-      perSchema.push(await this.introspectSchema(driver, schema));
-    }
-
-    const mergedTables: Record<string, SqlTableIR> = {};
-    for (const ir of perSchema) {
-      for (const [tableName, table] of Object.entries(ir.tables)) {
-        mergedTables[tableName] = table;
-      }
-    }
-
-    const firstAnnotations = perSchema[0]?.annotations;
-    const firstPg =
-      blindCast<Record<string, unknown> | undefined, 'pg annotation envelope index slot'>(
-        firstAnnotations?.['pg'],
-      ) ?? {};
-    return {
-      tables: mergedTables,
-      ...ifDefined('annotations', {
-        ...firstAnnotations,
-        pg: { ...firstPg },
-      }),
-    };
+    return Array.from(new Set(resolvedSchemas));
   }
 
   /**
-   * Introspects a single Postgres schema and returns a raw SqlSchemaIR
-   * containing only the tables in that schema. Used by `introspect` as
+   * Introspects a single Postgres schema and returns the namespace node for
+   * that schema (its tables, their policies, and its native enum type names),
+   * alongside the cluster-scoped Postgres version. Used by `introspect` as
    * the per-namespace walk.
    */
   private async introspectSchema(
     driver: SqlControlDriverInstance<'postgres'>,
     schema: string,
-  ): Promise<SqlSchemaIR> {
+  ): Promise<{ readonly namespace: PostgresNamespaceSchemaNode; readonly pgVersion: string }> {
     // Issue the schema-wide queries one at a time. A single control connection
     // serialises queries anyway, so Promise.all buys no parallelism here and
     // makes pg emit a "client is already executing a query" deprecation. One
@@ -895,13 +902,24 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
       constraints.add(row.constraint_name);
     }
 
-    const tables: Record<string, SqlTableIR> = {};
+    const tableInputs: Record<
+      string,
+      {
+        name: string;
+        columns: Record<string, SqlColumnIRInput>;
+        primaryKey?: PrimaryKeyInput;
+        foreignKeys: readonly SqlForeignKeyIRInput[];
+        uniques: readonly SqlUniqueIRInput[];
+        indexes: readonly SqlIndexIRInput[];
+        checks?: SqlCheckConstraintIRInput[];
+      }
+    > = {};
 
     for (const tableRow of tablesResult.rows) {
       const tableName = tableRow.table_name;
 
       // Process columns for this table
-      const columns: Record<string, SqlColumnIR> = {};
+      const columns: Record<string, SqlColumnIRInput> = {};
       for (const colRow of columnsByTable.get(tableName) ?? []) {
         let nativeType = colRow.udt_name;
         const formattedType = colRow.formatted_type
@@ -927,11 +945,36 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
           nativeType = colRow.udt_name || colRow.data_type;
         }
 
+        // Postgres reports array columns as data_type='ARRAY'; the element type
+        // is the `nativeType` string minus the trailing `[]`. Strip the suffix,
+        // normalize the element type to the canonical form (e.g. `integer` →
+        // `int4`), and record `many: true` so introspection consumers (verifier,
+        // psl-contract-infer) can reconstruct the full array type as needed.
+        const many = nativeType.endsWith('[]') ? true : undefined;
+        if (many) {
+          nativeType = normalizeSchemaNativeType(nativeType.slice(0, -2));
+        }
+
+        // Resolved values comparable against the contract-derived expected
+        // side: the normalized full native type (`[]` appended for arrays)
+        // and the structured parse of the raw default. Raw fields stay
+        // untouched alongside — the relational walk still reads and
+        // normalizes them itself.
+        const resolvedNativeType = `${normalizeSchemaNativeType(nativeType)}${many ? '[]' : ''}`;
+        const rawDefault = colRow.column_default ?? undefined;
         columns[colRow.column_name] = {
           name: colRow.column_name,
           nativeType,
           nullable: colRow.is_nullable === 'YES',
-          ...ifDefined('default', colRow.column_default ?? undefined),
+          ...ifDefined('default', rawDefault),
+          ...ifDefined('many', many),
+          resolvedNativeType,
+          ...ifDefined(
+            'resolvedDefault',
+            rawDefault !== undefined
+              ? parsePostgresDefault(rawDefault, resolvedNativeType)
+              : undefined,
+          ),
         };
       }
 
@@ -940,7 +983,7 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
       const primaryKeyColumns = pkRows
         .sort((a, b) => a.ordinal_position - b.ordinal_position)
         .map((row) => row.column_name);
-      const primaryKey: PrimaryKey | undefined =
+      const primaryKey: PrimaryKeyInput | undefined =
         primaryKeyColumns.length > 0
           ? {
               columns: primaryKeyColumns,
@@ -978,7 +1021,7 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
           });
         }
       }
-      const foreignKeys: readonly SqlForeignKeyIR[] = Array.from(foreignKeysMap.values()).map(
+      const foreignKeys: readonly SqlForeignKeyIRInput[] = Array.from(foreignKeysMap.values()).map(
         (fk) => ({
           columns: Object.freeze([...fk.columns]) as readonly string[],
           referencedTable: fk.referencedTable,
@@ -1008,7 +1051,7 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
           });
         }
       }
-      const uniques: readonly SqlUniqueIR[] = Array.from(uniquesMap.values()).map((uq) => ({
+      const uniques: readonly SqlUniqueIRInput[] = Array.from(uniquesMap.values()).map((uq) => ({
         columns: Object.freeze([...uq.columns]) as readonly string[],
         name: uq.name,
       }));
@@ -1046,7 +1089,7 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
           });
         }
       }
-      const indexes: readonly SqlIndexIR[] = Array.from(indexesMap.values()).map((idx) => ({
+      const indexes: readonly SqlIndexIRInput[] = Array.from(indexesMap.values()).map((idx) => ({
         columns: Object.freeze([...idx.columns]) as readonly string[],
         name: idx.name,
         unique: idx.unique,
@@ -1069,7 +1112,7 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
         }
       }
 
-      tables[tableName] = {
+      tableInputs[tableName] = {
         name: tableName,
         columns,
         ...ifDefined('primaryKey', primaryKey),
@@ -1090,19 +1133,61 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
       [schema],
     );
     const nativeEnumTypeNames = nativeEnumResult.rows.map((r) => r.typname);
+    const policiesResult = await driver.query<{
+      schemaname: string;
+      tablename: string;
+      policyname: string;
+      cmd: string;
+      roles: string[];
+      qual: string | null;
+      with_check: string | null;
+      permissive: string;
+    }>(
+      `SELECT schemaname, tablename, policyname, cmd, roles, qual, with_check, permissive
+       FROM pg_catalog.pg_policies
+       WHERE schemaname = $1
+       ORDER BY tablename, policyname`,
+      [schema],
+    );
+    const policiesByTable = new Map<string, PostgresPolicySchemaNode[]>();
+    for (const row of policiesResult.rows) {
+      const operation = mapPgCmd(row.cmd);
+      const policyRoles = [
+        ...new Set(parsePgNameArray(row.roles).map((r) => r.toLowerCase())),
+      ].sort();
+      const permissive = row.permissive.toUpperCase() === 'PERMISSIVE';
+      const hashSuffixMatch = /^(.+)_([0-9a-f]{8})$/.exec(row.policyname);
+      const prefix = hashSuffixMatch?.[1] ?? row.policyname;
+      const policy = new PostgresPolicySchemaNode({
+        name: row.policyname,
+        prefix,
+        tableName: row.tablename,
+        namespaceId: row.schemaname,
+        operation,
+        roles: policyRoles,
+        ...(row.qual !== null ? { using: row.qual } : {}),
+        ...(row.with_check !== null ? { withCheck: row.with_check } : {}),
+        permissive,
+      });
+      const list = policiesByTable.get(row.tablename) ?? [];
+      list.push(policy);
+      policiesByTable.set(row.tablename, list);
+    }
 
-    const annotations = {
-      pg: {
-        schema,
-        version: await this.getPostgresVersion(driver),
-        ...(nativeEnumTypeNames.length > 0 && { nativeEnumTypeNames }),
-      },
-    };
+    const tables: Record<string, PostgresTableSchemaNode> = {};
+    for (const [tableName, input] of Object.entries(tableInputs)) {
+      tables[tableName] = new PostgresTableSchemaNode({
+        ...input,
+        policies: policiesByTable.get(tableName) ?? [],
+      });
+    }
 
-    return {
+    const namespace = new PostgresNamespaceSchemaNode({
+      schemaName: schema,
       tables,
-      annotations,
-    };
+      nativeEnumTypeNames,
+    });
+    return { namespace, pgVersion: await this.getPostgresVersion(driver) };
   }
 
   /**
@@ -1117,6 +1202,52 @@ export class PostgresControlAdapter implements SqlControlAdapter<'postgres'> {
   }
 }
 
+/**
+ * Normalises a `name[]` column value from `pg_policies.roles`.
+ *
+ * The `pg` client's type-parser registry handles `text[]` (OID 1009) but not
+ * `name[]` (OID 1003). When the parser is absent the raw Postgres text-array
+ * literal (`{role1,role2}`) is returned as a string instead of a JS array.
+ * This function accepts either form and returns a plain string array.
+ */
+function parsePgNameArray(value: unknown): string[] {
+  if (Array.isArray(value)) {
+    return value as string[];
+  }
+  if (typeof value !== 'string') {
+    return [];
+  }
+  const trimmed = value.trim();
+  if (!trimmed.startsWith('{') || !trimmed.endsWith('}')) {
+    return [];
+  }
+  const inner = trimmed.slice(1, -1);
+  if (inner === '') {
+    return [];
+  }
+  return inner.split(',').map((s) => s.trim());
+}
+
+/**
+ * Maps `pg_policies.cmd` text values to the `RlsPolicyOperation` union.
+ * The `pg_policies` view renders the internal command code as an uppercase
+ * English keyword; this function lowercases to match the IR type.
+ */
+function mapPgCmd(cmd: string): RlsPolicyOperation {
+  switch (cmd.toUpperCase()) {
+    case 'SELECT':
+      return 'select';
+    case 'INSERT':
+      return 'insert';
+    case 'UPDATE':
+      return 'update';
+    case 'DELETE':
+      return 'delete';
+    default:
+      return 'all';
+  }
+}
+
 /**
  * Extracts the namespace coordinate ids declared on a contract's storage,
  * or returns an empty array when no contract (or no storage / namespaces)
@@ -1133,6 +1264,9 @@ function extractContractNamespaceIds(contract: unknown): readonly string[] {
 }
 
 function normalizeFormattedType(formattedType: string, dataType: string, udtName: string): string {
+  if (formattedType.endsWith('[]')) {
+    return `${normalizeFormattedType(formattedType.slice(0, -2), dataType, udtName)}[]`;
+  }
   if (formattedType === 'integer') {
     return 'int4';
   }
@@ -1376,6 +1510,18 @@ function pgIsTextLikeNativeType(nativeType: string): boolean {
   );
 }
 
+function pgRenderArrayElement(el: unknown): string {
+  if (el === null) return 'NULL';
+  if (typeof el === 'number' || typeof el === 'boolean') return String(el);
+  if (typeof el === 'string') return `'${escapeLiteral(el)}'`;
+  return `'${escapeLiteral(JSON.stringify(el))}'`;
+}
+
+function pgRenderArrayLiteral(elements: unknown[]): string {
+  if (elements.length === 0) return "'{}'";
+  return `ARRAY[${elements.map(pgRenderArrayElement).join(', ')}]`;
+}
+
 function pgInlineLiteral(wire: unknown, nativeType: string): string {
   if (wire === null) return 'NULL';
   if (typeof wire === 'boolean') return wire ? 'true' : 'false';
@@ -1407,6 +1553,9 @@ function pgInlineLiteral(wire: unknown, nativeType: string): string {
       .join('');
     return `'\\x${hex}'::${nativeType}`;
   }
+  if (Array.isArray(wire) && nativeType.endsWith('[]')) {
+    return pgRenderArrayLiteral(wire);
+  }
   if (typeof wire === 'object') {
     const quoted = `'${escapeLiteral(JSON.stringify(wire))}'`;
     return `${quoted}::${nativeType}`;
@@ -1477,6 +1626,9 @@ function pgRenderDdlConstraint(constraint: DdlTableConstraint): string {
     }
     return sql;
   }
+  if (constraint.kind === 'check-expression') {
+    return `CONSTRAINT ${quoteIdentifier(constraint.name)} CHECK (${constraint.expression})`;
+  }
   const cols = constraint.columns.map(quoteIdentifier).join(', ');
   if (constraint.name !== undefined) {
     return `CONSTRAINT ${quoteIdentifier(constraint.name)} UNIQUE (${cols})`;
@@ -1524,6 +1676,9 @@ async function pgRenderAlterTable(
       const colFragment = await pgRenderDdlColumn(action.column, codecLookup);
       return `ADD COLUMN ${colFragment}`;
     },
+    dropDefault(action: DropDefaultAction): Promise<string> {
+      return Promise.resolve(`ALTER COLUMN ${quoteIdentifier(action.columnName)} DROP DEFAULT`);
+    },
   };
   const actionSqls = await Promise.all(node.actions.map((a) => a.accept(actionVisitor)));
   return {
@@ -1532,6 +1687,37 @@ async function pgRenderAlterTable(
   };
 }
 
+const POLICY_OPERATION_SQL: Record<RlsPolicyOperation, string> = {
+  select: 'SELECT',
+  insert: 'INSERT',
+  update: 'UPDATE',
+  delete: 'DELETE',
+  all: 'ALL',
+};
+
+function pgRenderCreatePolicy(node: PostgresCreatePolicy): SqlExecuteRequest {
+  const tableRef = `${quoteIdentifier(node.schema)}.${quoteIdentifier(node.table)}`;
+  const permissiveness = node.permissive ? 'PERMISSIVE' : 'RESTRICTIVE';
+  const command = POLICY_OPERATION_SQL[node.operation];
+  const roles = node.roles.length === 0 ? 'PUBLIC' : node.roles.join(', ');
+  let sql = `CREATE POLICY ${quoteIdentifier(node.name)} ON ${tableRef} AS ${permissiveness} FOR ${command} TO ${roles}`;
+  if (node.using !== undefined) {
+    sql += ` USING (${node.using})`;
+  }
+  if (node.withCheck !== undefined) {
+    sql += ` WITH CHECK (${node.withCheck})`;
+  }
+  return { sql, params: [] };
+}
+
+function pgRenderDropPolicy(node: PostgresDropPolicy): SqlExecuteRequest {
+  const tableRef = `${quoteIdentifier(node.schema)}.${quoteIdentifier(node.table)}`;
+  return {
+    sql: `DROP POLICY ${quoteIdentifier(node.name)} ON ${tableRef}`,
+    params: [],
+  };
+}
+
 async function pgRenderDdlExecuteRequest(
   ast: PostgresDdlNode,
   codecLookup: CodecLookup,
@@ -1540,6 +1726,8 @@ async function pgRenderDdlExecuteRequest(
     createTable: (node: PostgresCreateTable) => pgRenderCreateTable(node, codecLookup),
     createSchema: (node: PostgresCreateSchema) => Promise.resolve(pgRenderCreateSchema(node)),
     alterTable: (node: PostgresAlterTable) => pgRenderAlterTable(node, codecLookup),
+    createPolicy: (node: PostgresCreatePolicy) => Promise.resolve(pgRenderCreatePolicy(node)),
+    dropPolicy: (node: PostgresDropPolicy) => Promise.resolve(pgRenderDropPolicy(node)),
   };
   return ast.accept(visitor);
 }

package/src/core/descriptor-meta.ts

@@ -172,6 +172,7 @@ export const postgresAdapterDescriptorMeta = {
       returning: true,
       defaultInInsert: true,
       lateral: true,
+      scalarList: true,
     },
   },
   types: {