@prisma-next/target-postgres 0.14.0-dev.4 → 0.14.0-dev.41

package/src/contract-free/ddl.ts

@@ -2,9 +2,13 @@ import type { DdlColumn, DdlTableConstraint } from '@prisma-next/sql-relational-
 import {
   AddColumnAction,
   type AnyAlterTableAction,
+  DropDefaultAction,
   PostgresAlterTable,
+  PostgresCreatePolicy,
   PostgresCreateSchema,
   PostgresCreateTable,
+  PostgresDropPolicy,
+  type RlsPolicyOperation,
 } from '../core/ddl/nodes';
 
 /**
@@ -51,9 +55,17 @@ export function addColumnAction(column: DdlColumn): AddColumnAction {
   return new AddColumnAction(column);
 }
 
+/**
+ * Build a `DROP DEFAULT` action (`ALTER COLUMN "<name>" DROP DEFAULT`) for
+ * use inside {@link alterTable}. The renderer quotes the column name.
+ */
+export function dropDefaultAction(columnName: string): DropDefaultAction {
+  return new DropDefaultAction(columnName);
+}
+
 /**
  * Build a Postgres `ALTER TABLE` query node carrying one or more actions.
- * See {@link addColumnAction} for building actions.
+ * See {@link addColumnAction} / {@link dropDefaultAction} for building actions.
  */
 export function alterTable(options: {
   readonly table: string;
@@ -62,3 +74,35 @@ export function alterTable(options: {
 }): PostgresAlterTable {
   return new PostgresAlterTable(options);
 }
+
+/**
+ * Build a Postgres `CREATE POLICY` DDL node.
+ *
+ * Identifiers (`schema`, `table`, `name`) are quoted by the renderer.
+ * `using` and `withCheck` are emitted verbatim as predicate SQL — callers
+ * must supply safe, pre-validated SQL expressions.
+ */
+export function createPolicy(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly permissive: boolean;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: readonly string[];
+  readonly using?: string;
+  readonly withCheck?: string;
+}): PostgresCreatePolicy {
+  return new PostgresCreatePolicy(options);
+}
+
+/**
+ * Build a Postgres `DROP POLICY` DDL node.
+ * Identifiers (`schema`, `table`, `name`) are quoted by the renderer.
+ */
+export function dropPolicy(options: {
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+}): PostgresDropPolicy {
+  return new PostgresDropPolicy(options);
+}

package/src/core/authoring.ts

@@ -1,13 +1,94 @@
 import { temporalAuthoringPresets } from '@prisma-next/family-sql/control';
 import type {
+  AuthoringEntityContext,
   AuthoringEntityTypeNamespace,
   AuthoringFieldNamespace,
+  AuthoringPslBlockDescriptorNamespace,
   AuthoringTypeNamespace,
+  PslExtensionBlock,
 } from '@prisma-next/framework-components/authoring';
+import { PostgresRlsPolicy } from './postgres-rls-policy';
+import { PostgresRole, type PostgresRoleInput } from './postgres-role';
+import { PostgresRlsPolicySchema, PostgresRoleSchema } from './postgres-validators';
+import { computeContentHash, normalizePredicate } from './rls/canonicalize';
 
 export const postgresAuthoringTypes = {} as const satisfies AuthoringTypeNamespace;
 
-export const postgresAuthoringEntityTypes = {} as const satisfies AuthoringEntityTypeNamespace;
+export interface RlsPolicyExtensionBlock extends PslExtensionBlock {
+  readonly namespaceId: string;
+}
+
+function readRefParam(block: PslExtensionBlock, key: string): string | undefined {
+  const param = block.parameters[key];
+  return param?.kind === 'ref' ? param.identifier : undefined;
+}
+
+function readValueParam(block: PslExtensionBlock, key: string): string | undefined {
+  const param = block.parameters[key];
+  return param?.kind === 'value' ? param.raw : undefined;
+}
+
+function readListRefParams(block: PslExtensionBlock, key: string): string[] {
+  const param = block.parameters[key];
+  if (param?.kind !== 'list') return [];
+  return param.items.flatMap((item) => (item.kind === 'ref' ? [item.identifier] : []));
+}
+
+function unwrapQuotedString(raw: string): string {
+  if (raw.startsWith('"') && raw.endsWith('"') && raw.length >= 2) {
+    return raw.slice(1, -1).replace(/\\"/g, '"');
+  }
+  return raw;
+}
+
+function lowerRlsPolicyFromBlock(
+  block: RlsPolicyExtensionBlock,
+  _ctx: AuthoringEntityContext,
+): PostgresRlsPolicy {
+  const prefix = block.name;
+  const targetModelName = readRefParam(block, 'target') ?? '';
+  const tableName = targetModelName.charAt(0).toLowerCase() + targetModelName.slice(1);
+  const roles = [...readListRefParams(block, 'roles')].sort();
+  const using = unwrapQuotedString(readValueParam(block, 'using') ?? '');
+
+  const wireHash = computeContentHash({
+    using: normalizePredicate(using),
+    roles,
+    operation: 'select',
+    permissive: true,
+  });
+  const wireName = `${prefix}_${wireHash}`;
+
+  return new PostgresRlsPolicy({
+    name: wireName,
+    prefix,
+    tableName,
+    namespaceId: block.namespaceId,
+    operation: 'select',
+    roles,
+    using,
+    permissive: true,
+  });
+}
+
+export const postgresAuthoringEntityTypes = {
+  role: {
+    kind: 'entity',
+    discriminator: 'role',
+    validatorSchema: PostgresRoleSchema,
+    output: {
+      factory: (input: PostgresRoleInput): PostgresRole => new PostgresRole(input),
+    },
+  },
+  policy: {
+    kind: 'entity',
+    discriminator: 'policy',
+    validatorSchema: PostgresRlsPolicySchema,
+    output: {
+      factory: lowerRlsPolicyFromBlock,
+    },
+  },
+} as const satisfies AuthoringEntityTypeNamespace;
 
 /**
  * Field presets contributed by the Postgres target pack.
@@ -22,6 +103,39 @@ export const postgresAuthoringEntityTypes = {} as const satisfies AuthoringEntit
  * portability use `uuidString` / `id.uuidv4String` / `id.uuidv7String` from
  * the family pack instead.
  */
+/**
+ * PSL block descriptor for `policy_select`.
+ *
+ * The parser learns the block shape from this descriptor; lowering from
+ * `PslExtensionBlock` to `PostgresRlsPolicy` is wired in the PSL
+ * interpreter (a later dispatch). The `discriminator` matches
+ * `PostgresRlsPolicy.kind` so the parsed block node carries the same
+ * discriminant as the IR class it will lower to.
+ *
+ * The `roles` list uses `scope:'cross-space'` because same-namespace
+ * role ref resolution requires PSL namespace entries keyed by `refKind`
+ * (i.e. `'role'`), which in turn requires the role block discriminator to
+ * equal `'role'`. Aligning discriminator with refKind is tracked for
+ * slice 4 (cross-space roles). Until then cross-space passes validation
+ * unconditionally and the authored role names flow through unchanged.
+ */
+export const postgresAuthoringPslBlockDescriptors = {
+  policy_select: {
+    kind: 'pslBlock',
+    keyword: 'policy_select',
+    discriminator: 'policy',
+    name: { required: true },
+    parameters: {
+      target: { kind: 'ref', refKind: 'model', scope: 'same-namespace', required: true },
+      roles: {
+        kind: 'list',
+        of: { kind: 'ref', refKind: 'role', scope: 'cross-space' },
+      },
+      using: { kind: 'value', codecId: 'pg/text@1', required: true },
+    },
+  },
+} as const satisfies AuthoringPslBlockDescriptorNamespace;
+
 export const postgresAuthoringFieldPresets = {
   text: {
     kind: 'fieldPreset',

package/src/core/codecs.ts

@@ -4,7 +4,7 @@
  * Each codec ships as three artifacts:
  *
  * 1. A `PgXCodec` class extending {@link CodecImpl} that wraps the module-level encode/decode/encodeJson/decodeJson constants exported from `codec-helpers.ts` (the single source of truth for non-trivial runtime conversions; trivial identity passthroughs are inlined). 2. A `PgXDescriptor` class extending {@link CodecDescriptorImpl} declaring the codec id, traits, target types, params schema, meta, and (where applicable)
- * the emit-path `renderOutputType`. 3. A per-codec column helper (`pgXColumn`) that calls `descriptor.factory(...)` directly and packages the result into a {@link ColumnSpec} via the framework {@link column} packager. The helper is tied to its descriptor with `satisfies ColumnHelperFor` (and `ColumnHelperForStrict` where the resolved codec type is well-defined).
+ * the emit-path `renderOutputType`. 3. A per-codec column helper (`pgXColumn`) that calls `descriptor.factory(...)` directly and packages the result into a framework `ColumnSpec` via the framework {@link column} packager. The helper is tied to its descriptor with `satisfies ColumnHelperFor` (and `ColumnHelperForStrict` where the resolved codec type is well-defined).
  *
  * After TML-2357 this is the canonical source of Postgres codec metadata and runtime behaviour — the legacy `mkCodec` / `defineCodec` carriers (and the parallel `byScalar`/`codecDescriptorDefinitions`/ `codecDescriptorList` collection exports) retired with the deletion sweep.
  *
@@ -22,6 +22,7 @@ import {
   type ColumnHelperFor,
   type ColumnHelperForStrict,
   column,
+  renderTsLiteral,
   voidParamsSchema,
 } from '@prisma-next/framework-components/codec';
 import {
@@ -148,6 +149,9 @@ export class PgTextDescriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['text'] as const;
   override readonly meta = PG_TEXT_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgTextCodec {
     return () => new PgTextCodec(this);
   }
@@ -228,6 +232,9 @@ export class PgInt4Descriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['int4'] as const;
   override readonly meta = PG_INT4_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgInt4Codec {
     return () => new PgInt4Codec(this);
   }
@@ -267,6 +274,9 @@ export class PgInt2Descriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['int2'] as const;
   override readonly meta = PG_INT2_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgInt2Codec {
     return () => new PgInt2Codec(this);
   }
@@ -306,6 +316,9 @@ export class PgInt8Descriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['int8'] as const;
   override readonly meta = PG_INT8_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgInt8Codec {
     return () => new PgInt8Codec(this);
   }
@@ -345,6 +358,9 @@ export class PgFloat4Descriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['float4'] as const;
   override readonly meta = PG_FLOAT4_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgFloat4Codec {
     return () => new PgFloat4Codec(this);
   }
@@ -384,6 +400,9 @@ export class PgFloat8Descriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['float8'] as const;
   override readonly meta = PG_FLOAT8_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgFloat8Codec {
     return () => new PgFloat8Codec(this);
   }
@@ -423,6 +442,9 @@ export class PgBoolDescriptor extends CodecDescriptorImpl<void> {
   override readonly targetTypes = ['bool'] as const;
   override readonly meta = PG_BOOL_META;
   override readonly paramsSchema: StandardSchemaV1<void> = voidParamsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => PgBoolCodec {
     return () => new PgBoolCodec(this);
   }
@@ -968,6 +990,9 @@ export class PgCharDescriptor extends CodecDescriptorImpl<LengthParams> {
   override renderOutputType(params: LengthParams): string | undefined {
     return sqlCharDescriptor.renderOutputType(params);
   }
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(_params: LengthParams): (ctx: CodecInstanceContext) => SqlCharCodec {
     return () => new SqlCharCodec(this);
   }
@@ -989,6 +1014,9 @@ export class PgVarcharDescriptor extends CodecDescriptorImpl<LengthParams> {
   override renderOutputType(params: LengthParams): string | undefined {
     return sqlVarcharDescriptor.renderOutputType(params);
   }
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(_params: LengthParams): (ctx: CodecInstanceContext) => SqlVarcharCodec {
     return () => new SqlVarcharCodec(this);
   }
@@ -1012,6 +1040,9 @@ export class PgIntDescriptor extends CodecDescriptorImpl<void> {
   override readonly meta = PG_INT_META;
   override readonly traits = sqlIntDescriptor.traits;
   override readonly paramsSchema = sqlIntDescriptor.paramsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => SqlIntCodec {
     return () => new SqlIntCodec(this);
   }
@@ -1030,6 +1061,9 @@ export class PgFloatDescriptor extends CodecDescriptorImpl<void> {
   override readonly meta = PG_FLOAT_META;
   override readonly traits = sqlFloatDescriptor.traits;
   override readonly paramsSchema = sqlFloatDescriptor.paramsSchema;
+  override renderValueLiteral(value: JsonValue): string | undefined {
+    return renderTsLiteral(value);
+  }
   override factory(): (ctx: CodecInstanceContext) => SqlFloatCodec {
     return () => new SqlFloatCodec(this);
   }

package/src/core/ddl/nodes.ts

@@ -3,6 +3,7 @@ import {
   DdlNode,
   type DdlTableConstraint,
 } from '@prisma-next/sql-relational-core/ast';
+import type { RlsPolicyOperation } from '../rls/canonicalize';
 
 // ---------------------------------------------------------------------------
 // AlterTableAction — nested polymorphic hierarchy
@@ -10,6 +11,7 @@ import {
 
 export interface AlterTableActionVisitor<R> {
   addColumn(action: AddColumnAction): R;
+  dropDefault(action: DropDefaultAction): R;
 }
 
 export abstract class AlterTableAction {
@@ -32,7 +34,31 @@ export class AddColumnAction extends AlterTableAction {
   }
 }
 
-export type AnyAlterTableAction = AddColumnAction;
+export class DropDefaultAction extends AlterTableAction {
+  readonly kind = 'drop-default' as const;
+  readonly columnName: string;
+
+  constructor(columnName: string) {
+    super();
+    this.columnName = columnName;
+    Object.freeze(this);
+  }
+
+  override accept<R>(visitor: AlterTableActionVisitor<R>): R {
+    return visitor.dropDefault(this);
+  }
+}
+
+/**
+ * The set of ALTER TABLE subactions currently expressible as typed DDL.
+ *
+ * The remaining actions — SetDefault, SetNotNull, DropNotNull,
+ * AlterColumnType — are still emitted as raw SQL by `operations/columns.ts`
+ * and join this union as they are converted to typed DDL. Until then it is
+ * intentionally partial: only the ALTER subactions used by the
+ * already-converted ops (AddColumn, DropDefault) appear here.
+ */
+export type AnyAlterTableAction = AddColumnAction | DropDefaultAction;
 
 // ---------------------------------------------------------------------------
 // Top-level DDL visitor
@@ -42,6 +68,8 @@ export interface PostgresDdlVisitor<R> {
   createTable(node: PostgresCreateTable): R;
   createSchema(node: PostgresCreateSchema): R;
   alterTable(node: PostgresAlterTable): R;
+  createPolicy(node: PostgresCreatePolicy): R;
+  dropPolicy(node: PostgresDropPolicy): R;
 }
 
 export abstract class PostgresDdlNode extends DdlNode {
@@ -127,4 +155,68 @@ export class PostgresAlterTable extends PostgresDdlNode {
   }
 }
 
-export type AnyPostgresDdlNode = PostgresCreateTable | PostgresCreateSchema | PostgresAlterTable;
+export type { RlsPolicyOperation };
+
+export class PostgresCreatePolicy extends PostgresDdlNode {
+  readonly kind = 'create-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly permissive: boolean;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: ReadonlyArray<string>;
+  readonly using: string | undefined;
+  readonly withCheck: string | undefined;
+
+  constructor(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly name: string;
+    readonly permissive: boolean;
+    readonly operation: RlsPolicyOperation;
+    readonly roles: readonly string[];
+    readonly using?: string;
+    readonly withCheck?: string;
+  }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.permissive = options.permissive;
+    this.operation = options.operation;
+    this.roles = Object.freeze([...options.roles]);
+    this.using = options.using;
+    this.withCheck = options.withCheck;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.createPolicy(this);
+  }
+}
+
+export class PostgresDropPolicy extends PostgresDdlNode {
+  readonly kind = 'drop-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+
+  constructor(options: { readonly schema: string; readonly table: string; readonly name: string }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.dropPolicy(this);
+  }
+}
+
+export type AnyPostgresDdlNode =
+  | PostgresCreateTable
+  | PostgresCreateSchema
+  | PostgresAlterTable
+  | PostgresCreatePolicy
+  | PostgresDropPolicy;

package/src/core/default-normalizer.ts

@@ -1,4 +1,4 @@
-import type { ColumnDefault } from '@prisma-next/contract/types';
+import type { ColumnDefault, JsonValue } from '@prisma-next/contract/types';
 
 /**
  * Pre-compiled regex patterns for performance.
@@ -18,6 +18,13 @@ const FALSE_PATTERN = /^false$/i;
 const NUMERIC_PATTERN = /^-?\d+(\.\d+)?$/;
 const STRING_LITERAL_PATTERN = /^'((?:[^']|'')*)'(?:::(?:"[^"]+"|[\w\s]+)(?:\(\d+\))?)?$/;
 
+/**
+ * Matches a Postgres array literal default of the form `'{...}'::elemtype[]`.
+ * The literal body is captured in group 1; the cast (including `[]`) is optional.
+ * Examples: `'{}'::text[]`, `'{1,2}'::integer[]`, `'{}'`
+ */
+const ARRAY_LITERAL_PATTERN = /^'(\{.*\})'(?:::.+\[\])?$/;
+
 /**
  * Returns the canonical expression for a timestamp default function, or undefined
  * if the expression is not a recognized timestamp default.
@@ -51,6 +58,108 @@ function canonicalizeTimestampDefault(expr: string): string | undefined {
   return undefined;
 }
 
+type ArrayElementToken = { readonly value: string; readonly quoted: boolean };
+
+/**
+ * Splits a Postgres array literal body (without the enclosing braces) into its
+ * element tokens, honouring quoting. A comma only separates elements when it is
+ * outside double quotes; inside a quoted element a doubled quote (`""`) or a
+ * backslash-escaped quote (`\"`) is a literal quote, and a backslash escapes the
+ * next character. Returns undefined if the body is malformed (e.g. an unbalanced
+ * quote).
+ */
+function splitArrayElements(inner: string): readonly ArrayElementToken[] | undefined {
+  const tokens: ArrayElementToken[] = [];
+  let current = '';
+  let inQuotes = false;
+  let quoted = false;
+
+  for (let i = 0; i < inner.length; i++) {
+    const char = inner[i];
+    if (inQuotes) {
+      if (char === '\\') {
+        const next = inner[i + 1];
+        if (next === undefined) return undefined;
+        current += next;
+        i++;
+        continue;
+      }
+      if (char === '"') {
+        if (inner[i + 1] === '"') {
+          current += '"';
+          i++;
+          continue;
+        }
+        inQuotes = false;
+        continue;
+      }
+      current += char;
+      continue;
+    }
+    if (char === '"') {
+      inQuotes = true;
+      quoted = true;
+      continue;
+    }
+    if (char === ',') {
+      tokens.push({ value: current, quoted });
+      current = '';
+      quoted = false;
+      continue;
+    }
+    current += char;
+  }
+
+  if (inQuotes) return undefined;
+  tokens.push({ value: current, quoted });
+  return tokens;
+}
+
+/**
+ * Parses a Postgres array literal body (`{...}`) into a JS array of primitives.
+ * Returns undefined if the body cannot be reliably parsed.
+ *
+ * Handles:
+ * - `{}` → `[]`
+ * - `{elem1,elem2,...}` → `[elem1, elem2, ...]` with numeric and string element coercion
+ * - quoted elements that contain commas, doubled/escaped quotes, and the literal
+ *   strings `NULL`/`true`/`false` (a quoted token is always a string)
+ */
+function parseArrayLiteralBody(body: string): readonly JsonValue[] | undefined {
+  const inner = body.slice(1, -1).trim();
+  if (inner === '') return [];
+  const tokens = splitArrayElements(inner);
+  if (tokens === undefined) return undefined;
+  const result: JsonValue[] = [];
+  for (const token of tokens) {
+    if (token.quoted) {
+      // A quoted token is always a string — `"NULL"`, `"true"`, `"1"` are the
+      // literal text, never the keyword/number.
+      result.push(token.value);
+      continue;
+    }
+    const el = token.value.trim();
+    if (el.toUpperCase() === 'NULL') {
+      result.push(null);
+      continue;
+    }
+    if (el === 'true') {
+      result.push(true);
+      continue;
+    }
+    if (el === 'false') {
+      result.push(false);
+      continue;
+    }
+    if (NUMERIC_PATTERN.test(el)) {
+      result.push(Number(el));
+      continue;
+    }
+    return undefined;
+  }
+  return result;
+}
+
 /**
  * Parses a raw Postgres column default expression into a normalized ColumnDefault.
  * This enables semantic comparison between contract defaults and introspected schema defaults.
@@ -59,7 +168,7 @@ function canonicalizeTimestampDefault(expr: string): string | undefined {
  * keeping the introspection layer focused on faithful data capture.
  *
  * @param rawDefault - Raw default expression from information_schema.columns.column_default
- * @param nativeType - Native column type, used for type-aware parsing (bigint tagging, JSON detection)
+ * @param nativeType - Native column type, used for type-aware parsing (array, bigint, JSON)
  * @returns Normalized ColumnDefault or undefined if the expression cannot be parsed
  */
 export function parsePostgresDefault(
@@ -69,11 +178,22 @@ export function parsePostgresDefault(
   const trimmed = rawDefault.trim();
   const normalizedType = nativeType?.toLowerCase();
   const isBigInt = normalizedType === 'bigint' || normalizedType === 'int8';
+  const isArrayType = normalizedType?.endsWith('[]') ?? false;
 
   if (NEXTVAL_PATTERN.test(trimmed)) {
     return { kind: 'function', expression: 'autoincrement()' };
   }
 
+  if (isArrayType) {
+    const arrayMatch = trimmed.match(ARRAY_LITERAL_PATTERN);
+    if (arrayMatch?.[1] !== undefined) {
+      const parsed = parseArrayLiteralBody(arrayMatch[1]);
+      if (parsed !== undefined) {
+        return { kind: 'literal', value: parsed };
+      }
+    }
+  }
+
   const canonicalTimestamp = canonicalizeTimestampDefault(trimmed);
   if (canonicalTimestamp) {
     return { kind: 'function', expression: canonicalTimestamp };

package/src/core/descriptor-meta.ts

@@ -2,9 +2,11 @@ import type { CodecTypes } from '../exports/codec-types';
 import {
   postgresAuthoringEntityTypes,
   postgresAuthoringFieldPresets,
+  postgresAuthoringPslBlockDescriptors,
   postgresAuthoringTypes,
 } from './authoring';
 import { postgresTargetDescriptorMetaRuntime } from './descriptor-meta-runtime';
+import { postgresCreateNamespace } from './postgres-schema';
 
 const postgresTargetDescriptorMetaBase = {
   ...postgresTargetDescriptorMetaRuntime,
@@ -13,6 +15,8 @@ const postgresTargetDescriptorMetaBase = {
     type: postgresAuthoringTypes,
     field: postgresAuthoringFieldPresets,
     entityTypes: postgresAuthoringEntityTypes,
+    pslBlockDescriptors: postgresAuthoringPslBlockDescriptors,
+    createNamespace: postgresCreateNamespace,
   },
 } as const;
 

package/src/core/entity-kinds.ts

@@ -0,0 +1,16 @@
+import type { EntityKindDescriptor } from '@prisma-next/framework-components/ir';
+import { PostgresRlsPolicy, type PostgresRlsPolicyInput } from './postgres-rls-policy';
+import { PostgresRole, type PostgresRoleInput } from './postgres-role';
+import { PostgresRlsPolicySchema, PostgresRoleSchema } from './postgres-validators';
+
+export const policyEntityKind: EntityKindDescriptor<PostgresRlsPolicyInput, PostgresRlsPolicy> = {
+  kind: 'policy',
+  schema: PostgresRlsPolicySchema,
+  construct: (input) => new PostgresRlsPolicy(input),
+};
+
+export const roleEntityKind: EntityKindDescriptor<PostgresRoleInput, PostgresRole> = {
+  kind: 'role',
+  schema: PostgresRoleSchema,
+  construct: (input) => new PostgresRole(input),
+};

package/src/core/migrations/bound-schema.ts

@@ -0,0 +1,10 @@
+import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
+
+/**
+ * Maps a planner schema name to the contract-free DDL builder's optional
+ * `schema` field: the unbound sentinel becomes `undefined` (the builder omits
+ * the schema qualifier), every other name passes through.
+ */
+export function boundSchema(schemaName: string): string | undefined {
+  return schemaName === UNBOUND_NAMESPACE_ID ? undefined : schemaName;
+}