@prisma-next/target-postgres 0.14.0-dev.5 → 0.14.0-dev.50

package/src/core/ddl/nodes.ts

@@ -3,6 +3,7 @@ import {
   DdlNode,
   type DdlTableConstraint,
 } from '@prisma-next/sql-relational-core/ast';
+import type { RlsPolicyOperation } from '../rls/canonicalize';
 
 // ---------------------------------------------------------------------------
 // AlterTableAction — nested polymorphic hierarchy
@@ -10,6 +11,7 @@ import {
 
 export interface AlterTableActionVisitor<R> {
   addColumn(action: AddColumnAction): R;
+  dropDefault(action: DropDefaultAction): R;
 }
 
 export abstract class AlterTableAction {
@@ -32,7 +34,31 @@ export class AddColumnAction extends AlterTableAction {
   }
 }
 
-export type AnyAlterTableAction = AddColumnAction;
+export class DropDefaultAction extends AlterTableAction {
+  readonly kind = 'drop-default' as const;
+  readonly columnName: string;
+
+  constructor(columnName: string) {
+    super();
+    this.columnName = columnName;
+    Object.freeze(this);
+  }
+
+  override accept<R>(visitor: AlterTableActionVisitor<R>): R {
+    return visitor.dropDefault(this);
+  }
+}
+
+/**
+ * The set of ALTER TABLE subactions currently expressible as typed DDL.
+ *
+ * The remaining actions — SetDefault, SetNotNull, DropNotNull,
+ * AlterColumnType — are still emitted as raw SQL by `operations/columns.ts`
+ * and join this union as they are converted to typed DDL. Until then it is
+ * intentionally partial: only the ALTER subactions used by the
+ * already-converted ops (AddColumn, DropDefault) appear here.
+ */
+export type AnyAlterTableAction = AddColumnAction | DropDefaultAction;
 
 // ---------------------------------------------------------------------------
 // Top-level DDL visitor
@@ -42,6 +68,8 @@ export interface PostgresDdlVisitor<R> {
   createTable(node: PostgresCreateTable): R;
   createSchema(node: PostgresCreateSchema): R;
   alterTable(node: PostgresAlterTable): R;
+  createPolicy(node: PostgresCreatePolicy): R;
+  dropPolicy(node: PostgresDropPolicy): R;
 }
 
 export abstract class PostgresDdlNode extends DdlNode {
@@ -127,4 +155,68 @@ export class PostgresAlterTable extends PostgresDdlNode {
   }
 }
 
-export type AnyPostgresDdlNode = PostgresCreateTable | PostgresCreateSchema | PostgresAlterTable;
+export type { RlsPolicyOperation };
+
+export class PostgresCreatePolicy extends PostgresDdlNode {
+  readonly kind = 'create-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+  readonly permissive: boolean;
+  readonly operation: RlsPolicyOperation;
+  readonly roles: ReadonlyArray<string>;
+  readonly using: string | undefined;
+  readonly withCheck: string | undefined;
+
+  constructor(options: {
+    readonly schema: string;
+    readonly table: string;
+    readonly name: string;
+    readonly permissive: boolean;
+    readonly operation: RlsPolicyOperation;
+    readonly roles: readonly string[];
+    readonly using?: string;
+    readonly withCheck?: string;
+  }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.permissive = options.permissive;
+    this.operation = options.operation;
+    this.roles = Object.freeze([...options.roles]);
+    this.using = options.using;
+    this.withCheck = options.withCheck;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.createPolicy(this);
+  }
+}
+
+export class PostgresDropPolicy extends PostgresDdlNode {
+  readonly kind = 'drop-policy' as const;
+  readonly schema: string;
+  readonly table: string;
+  readonly name: string;
+
+  constructor(options: { readonly schema: string; readonly table: string; readonly name: string }) {
+    super();
+    this.schema = options.schema;
+    this.table = options.table;
+    this.name = options.name;
+    this.freeze();
+  }
+
+  override accept<R>(visitor: PostgresDdlVisitor<R>): R {
+    return visitor.dropPolicy(this);
+  }
+}
+
+export type AnyPostgresDdlNode =
+  | PostgresCreateTable
+  | PostgresCreateSchema
+  | PostgresAlterTable
+  | PostgresCreatePolicy
+  | PostgresDropPolicy;

package/src/core/default-normalizer.ts

@@ -1,4 +1,4 @@
-import type { ColumnDefault } from '@prisma-next/contract/types';
+import type { ColumnDefault, JsonValue } from '@prisma-next/contract/types';
 
 /**
  * Pre-compiled regex patterns for performance.
@@ -18,6 +18,13 @@ const FALSE_PATTERN = /^false$/i;
 const NUMERIC_PATTERN = /^-?\d+(\.\d+)?$/;
 const STRING_LITERAL_PATTERN = /^'((?:[^']|'')*)'(?:::(?:"[^"]+"|[\w\s]+)(?:\(\d+\))?)?$/;
 
+/**
+ * Matches a Postgres array literal default of the form `'{...}'::elemtype[]`.
+ * The literal body is captured in group 1; the cast (including `[]`) is optional.
+ * Examples: `'{}'::text[]`, `'{1,2}'::integer[]`, `'{}'`
+ */
+const ARRAY_LITERAL_PATTERN = /^'(\{.*\})'(?:::.+\[\])?$/;
+
 /**
  * Returns the canonical expression for a timestamp default function, or undefined
  * if the expression is not a recognized timestamp default.
@@ -51,6 +58,108 @@ function canonicalizeTimestampDefault(expr: string): string | undefined {
   return undefined;
 }
 
+type ArrayElementToken = { readonly value: string; readonly quoted: boolean };
+
+/**
+ * Splits a Postgres array literal body (without the enclosing braces) into its
+ * element tokens, honouring quoting. A comma only separates elements when it is
+ * outside double quotes; inside a quoted element a doubled quote (`""`) or a
+ * backslash-escaped quote (`\"`) is a literal quote, and a backslash escapes the
+ * next character. Returns undefined if the body is malformed (e.g. an unbalanced
+ * quote).
+ */
+function splitArrayElements(inner: string): readonly ArrayElementToken[] | undefined {
+  const tokens: ArrayElementToken[] = [];
+  let current = '';
+  let inQuotes = false;
+  let quoted = false;
+
+  for (let i = 0; i < inner.length; i++) {
+    const char = inner[i];
+    if (inQuotes) {
+      if (char === '\\') {
+        const next = inner[i + 1];
+        if (next === undefined) return undefined;
+        current += next;
+        i++;
+        continue;
+      }
+      if (char === '"') {
+        if (inner[i + 1] === '"') {
+          current += '"';
+          i++;
+          continue;
+        }
+        inQuotes = false;
+        continue;
+      }
+      current += char;
+      continue;
+    }
+    if (char === '"') {
+      inQuotes = true;
+      quoted = true;
+      continue;
+    }
+    if (char === ',') {
+      tokens.push({ value: current, quoted });
+      current = '';
+      quoted = false;
+      continue;
+    }
+    current += char;
+  }
+
+  if (inQuotes) return undefined;
+  tokens.push({ value: current, quoted });
+  return tokens;
+}
+
+/**
+ * Parses a Postgres array literal body (`{...}`) into a JS array of primitives.
+ * Returns undefined if the body cannot be reliably parsed.
+ *
+ * Handles:
+ * - `{}` → `[]`
+ * - `{elem1,elem2,...}` → `[elem1, elem2, ...]` with numeric and string element coercion
+ * - quoted elements that contain commas, doubled/escaped quotes, and the literal
+ *   strings `NULL`/`true`/`false` (a quoted token is always a string)
+ */
+function parseArrayLiteralBody(body: string): readonly JsonValue[] | undefined {
+  const inner = body.slice(1, -1).trim();
+  if (inner === '') return [];
+  const tokens = splitArrayElements(inner);
+  if (tokens === undefined) return undefined;
+  const result: JsonValue[] = [];
+  for (const token of tokens) {
+    if (token.quoted) {
+      // A quoted token is always a string — `"NULL"`, `"true"`, `"1"` are the
+      // literal text, never the keyword/number.
+      result.push(token.value);
+      continue;
+    }
+    const el = token.value.trim();
+    if (el.toUpperCase() === 'NULL') {
+      result.push(null);
+      continue;
+    }
+    if (el === 'true') {
+      result.push(true);
+      continue;
+    }
+    if (el === 'false') {
+      result.push(false);
+      continue;
+    }
+    if (NUMERIC_PATTERN.test(el)) {
+      result.push(Number(el));
+      continue;
+    }
+    return undefined;
+  }
+  return result;
+}
+
 /**
  * Parses a raw Postgres column default expression into a normalized ColumnDefault.
  * This enables semantic comparison between contract defaults and introspected schema defaults.
@@ -59,7 +168,7 @@ function canonicalizeTimestampDefault(expr: string): string | undefined {
  * keeping the introspection layer focused on faithful data capture.
  *
  * @param rawDefault - Raw default expression from information_schema.columns.column_default
- * @param nativeType - Native column type, used for type-aware parsing (bigint tagging, JSON detection)
+ * @param nativeType - Native column type, used for type-aware parsing (array, bigint, JSON)
  * @returns Normalized ColumnDefault or undefined if the expression cannot be parsed
  */
 export function parsePostgresDefault(
@@ -69,11 +178,22 @@ export function parsePostgresDefault(
   const trimmed = rawDefault.trim();
   const normalizedType = nativeType?.toLowerCase();
   const isBigInt = normalizedType === 'bigint' || normalizedType === 'int8';
+  const isArrayType = normalizedType?.endsWith('[]') ?? false;
 
   if (NEXTVAL_PATTERN.test(trimmed)) {
     return { kind: 'function', expression: 'autoincrement()' };
   }
 
+  if (isArrayType) {
+    const arrayMatch = trimmed.match(ARRAY_LITERAL_PATTERN);
+    if (arrayMatch?.[1] !== undefined) {
+      const parsed = parseArrayLiteralBody(arrayMatch[1]);
+      if (parsed !== undefined) {
+        return { kind: 'literal', value: parsed };
+      }
+    }
+  }
+
   const canonicalTimestamp = canonicalizeTimestampDefault(trimmed);
   if (canonicalTimestamp) {
     return { kind: 'function', expression: canonicalTimestamp };

package/src/core/descriptor-meta.ts

@@ -2,17 +2,22 @@ import type { CodecTypes } from '../exports/codec-types';
 import {
   postgresAuthoringEntityTypes,
   postgresAuthoringFieldPresets,
+  postgresAuthoringPslBlockDescriptors,
   postgresAuthoringTypes,
 } from './authoring';
 import { postgresTargetDescriptorMetaRuntime } from './descriptor-meta-runtime';
+import { DEFAULT_NAMESPACE_ID } from './namespace-ids';
+import { postgresCreateNamespace } from './postgres-schema';
 
 const postgresTargetDescriptorMetaBase = {
   ...postgresTargetDescriptorMetaRuntime,
-  defaultNamespaceId: 'public',
+  defaultNamespaceId: DEFAULT_NAMESPACE_ID,
   authoring: {
     type: postgresAuthoringTypes,
     field: postgresAuthoringFieldPresets,
     entityTypes: postgresAuthoringEntityTypes,
+    pslBlockDescriptors: postgresAuthoringPslBlockDescriptors,
+    createNamespace: postgresCreateNamespace,
   },
 } as const;
 

package/src/core/entity-kinds.ts

@@ -0,0 +1,30 @@
+import type { EntityKindDescriptor } from '@prisma-next/framework-components/ir';
+import { PostgresNativeEnum, type PostgresNativeEnumInput } from './postgres-native-enum';
+import { PostgresRlsPolicy, type PostgresRlsPolicyInput } from './postgres-rls-policy';
+import { PostgresRole, type PostgresRoleInput } from './postgres-role';
+import {
+  PostgresNativeEnumSchema,
+  PostgresRlsPolicySchema,
+  PostgresRoleSchema,
+} from './postgres-validators';
+
+export const policyEntityKind: EntityKindDescriptor<PostgresRlsPolicyInput, PostgresRlsPolicy> = {
+  kind: 'policy',
+  schema: PostgresRlsPolicySchema,
+  construct: (input) => new PostgresRlsPolicy(input),
+};
+
+export const roleEntityKind: EntityKindDescriptor<PostgresRoleInput, PostgresRole> = {
+  kind: 'role',
+  schema: PostgresRoleSchema,
+  construct: (input) => new PostgresRole(input),
+};
+
+export const nativeEnumEntityKind: EntityKindDescriptor<
+  PostgresNativeEnumInput,
+  PostgresNativeEnum
+> = {
+  kind: 'native_enum',
+  schema: PostgresNativeEnumSchema,
+  construct: (input) => new PostgresNativeEnum(input),
+};

package/src/core/migrations/bound-schema.ts

@@ -0,0 +1,10 @@
+import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
+
+/**
+ * Maps a planner schema name to the contract-free DDL builder's optional
+ * `schema` field: the unbound sentinel becomes `undefined` (the builder omits
+ * the schema qualifier), every other name passes through.
+ */
+export function boundSchema(schemaName: string): string | undefined {
+  return schemaName === UNBOUND_NAMESPACE_ID ? undefined : schemaName;
+}

package/src/core/migrations/column-ddl-rendering.ts

@@ -0,0 +1,117 @@
+import type { CodecControlHooks } from '@prisma-next/family-sql/control';
+import type { StorageColumn } from '@prisma-next/sql-contract/types';
+import type { DdlColumn } from '@prisma-next/sql-relational-core/ast';
+import * as contractFree from '@prisma-next/sql-relational-core/contract-free';
+import type { SqlColumnDefaultIR, SqlColumnIR } from '@prisma-next/sql-schema-ir/types';
+import { blindCast } from '@prisma-next/utils/casts';
+import { ifDefined } from '@prisma-next/utils/defined';
+import { postgresDefaultToDdlColumnDefault } from './op-factory-call';
+import { buildColumnDefaultSql, buildColumnTypeSql } from './planner-ddl-builders';
+import { resolveIdentityValue } from './planner-identity-values';
+import { buildExpectedFormatType } from './planner-sql-checks';
+
+/**
+ * Reconstructs the `StorageColumn`-shaped fields the DDL builder functions
+ * (`buildColumnTypeSql`, `buildExpectedFormatType`, `resolveIdentityValue`)
+ * expect, from a column node's own stamped codec identity (`codecRef` /
+ * `codecBaseNativeType` / `codecNamedType`, Decision 5) — never the
+ * contract. The builders were written against `StorageColumn` and are
+ * unchanged here; only the shape feeding them moves from the contract to
+ * the node. An empty `storageTypes` catalog is passed alongside: the
+ * node's fields are already resolved past any `typeRef` indirection, so no
+ * live lookup is needed, and passing a non-empty catalog would risk a
+ * false `typeRef` hit against an unrelated storage type.
+ */
+function columnLike(
+  column: SqlColumnIR,
+): Pick<
+  StorageColumn,
+  'nativeType' | 'codecId' | 'nullable' | 'many' | 'typeParams' | 'typeRef' | 'default'
+> {
+  if (column.codecRef === undefined || column.codecBaseNativeType === undefined) {
+    throw new Error(
+      `columnLike: expected column "${column.name}" carries no codec identity — the expected tree must be derived via contractToSchemaIR for planning`,
+    );
+  }
+  return {
+    nativeType: column.codecBaseNativeType,
+    codecId: column.codecRef.codecId,
+    nullable: column.nullable,
+    // `column.many` is unset on contract-derived columns (array-ness rides
+    // on the `nativeType` `[]` suffix there instead) — `codecRef.many`
+    // carries it. Hand-built/introspected columns set `column.many` directly.
+    ...ifDefined('many', column.many ?? column.codecRef.many),
+    ...ifDefined(
+      'typeParams',
+      column.codecRef.typeParams !== undefined
+        ? blindCast<
+            Record<string, unknown>,
+            'CodecRef.typeParams is JsonValue-shaped; the DDL builders only ever read it as the Record the contract column originally carried'
+          >(column.codecRef.typeParams)
+        : undefined,
+    ),
+    ...(column.codecNamedType ? { typeRef: '<resolved>' } : {}),
+    ...ifDefined('default', column.resolvedDefault),
+  };
+}
+
+/**
+ * Builds the `CREATE TABLE` / `ADD COLUMN` DDL column for an expected column
+ * node, resolving type rendering from the node's codec identity against the
+ * codec hooks the caller holds — the same builder the pre-`plan(start, end)`
+ * op-path called, so the output is byte-identical.
+ */
+export function renderColumnDdl(
+  name: string,
+  column: SqlColumnIR,
+  codecHooks: ReadonlyMap<string, CodecControlHooks>,
+): DdlColumn {
+  const like = columnLike(column);
+  const typeSql = buildColumnTypeSql(like, codecHooks, {});
+  const ddlDefault = postgresDefaultToDdlColumnDefault(like.default);
+  return contractFree.col(name, typeSql, {
+    ...(!column.nullable ? { notNull: true } : {}),
+    ...ifDefined('default', ddlDefault),
+    ...ifDefined('codecRef', column.codecRef),
+  });
+}
+
+/**
+ * Builds the `ALTER COLUMN … TYPE` operands for an expected column node.
+ */
+export function renderColumnAlterType(
+  column: SqlColumnIR,
+  codecHooks: ReadonlyMap<string, CodecControlHooks>,
+): { readonly qualifiedTargetType: string; readonly formatTypeExpected: string } {
+  const like = columnLike(column);
+  return {
+    qualifiedTargetType: buildColumnTypeSql(like, codecHooks, {}, false),
+    formatTypeExpected: buildExpectedFormatType(like, codecHooks, {}),
+  };
+}
+
+/**
+ * Resolves the identity value (monoid neutral element) SQL literal used as
+ * the temporary default when adding a NOT-NULL column with no contract
+ * default (`notNullAddColumnCallStrategy`'s shared-temp-default backfill).
+ * `null` when the column's type has no built-in/codec-provided identity
+ * value.
+ */
+export function resolveColumnTemporaryDefault(
+  column: SqlColumnIR,
+  codecHooks: ReadonlyMap<string, CodecControlHooks>,
+): string | null {
+  return resolveIdentityValue(columnLike(column), codecHooks, {});
+}
+
+/**
+ * The column's `SET DEFAULT` clause SQL, resolved from a column-default
+ * diff node. `''` when the node carries no resolved default.
+ */
+export function renderColumnDefaultSql(defaultNode: SqlColumnDefaultIR): string {
+  if (defaultNode.resolved === undefined) return '';
+  return buildColumnDefaultSql(defaultNode.resolved, {
+    nativeType: defaultNode.nativeTypeContext ?? '',
+    ...ifDefined('many', defaultNode.many),
+  });
+}

package/src/core/migrations/contract-to-postgres-database-schema-node.ts

@@ -0,0 +1,149 @@
+import type { ContractToSchemaIROptions } from '@prisma-next/family-sql/control';
+import { contractNamespaceToSchemaIR } from '@prisma-next/family-sql/control';
+import { UNBOUND_NAMESPACE_ID } from '@prisma-next/framework-components/ir';
+import { SqlForeignKeyIR } from '@prisma-next/sql-schema-ir/types';
+import { ifDefined } from '@prisma-next/utils/defined';
+import type { PostgresRlsPolicy } from '../postgres-rls-policy';
+import type { PostgresContract } from '../postgres-schema';
+import { isPostgresSchema } from '../postgres-schema';
+import { PostgresDatabaseSchemaNode } from '../schema-ir/postgres-database-schema-node';
+import { PostgresNamespaceSchemaNode } from '../schema-ir/postgres-namespace-schema-node';
+import { PostgresPolicySchemaNode } from '../schema-ir/postgres-policy-schema-node';
+import { PostgresRoleSchemaNode } from '../schema-ir/postgres-role-schema-node';
+import { PostgresTableSchemaNode } from '../schema-ir/postgres-table-schema-node';
+import { resolveDdlSchemaForNamespaceStorage } from './resolve-ddl-schema';
+
+function toPolicyNode(policy: PostgresRlsPolicy, namespaceId: string): PostgresPolicySchemaNode {
+  return new PostgresPolicySchemaNode({
+    name: policy.name,
+    prefix: policy.prefix,
+    tableName: policy.tableName,
+    namespaceId,
+    operation: policy.operation,
+    roles: [...policy.roles],
+    ...ifDefined('using', policy.using),
+    ...ifDefined('withCheck', policy.withCheck),
+    permissive: policy.permissive,
+  });
+}
+
+/**
+ * Projects a Postgres contract into the expected schema-diff tree: a
+ * `PostgresDatabaseSchemaNode` root holding one `PostgresNamespaceSchemaNode`
+ * per Postgres namespace, each holding its `PostgresTableSchemaNode`s with
+ * their `PostgresPolicySchemaNode`s, plus the database roles on the root.
+ *
+ * Not a duplicate of the family's `contractToSchemaIR`: that builds a flat,
+ * single `{ tables }` map (and throws on cross-namespace name collisions, with
+ * no RLS/role concept) for SQLite's single-schema world. This is the
+ * Postgres-specific *tree* shape — multi-schema, RLS-policy-aware, role-aware.
+ * It reuses the family's per-namespace table conversion (`contractNamespaceToSchemaIR`)
+ * for column/FK/index building and only adds the Postgres tree/policy/role shape.
+ *
+ * Tables are grouped by their owning namespace (resolved DDL schema name) so
+ * the tree mirrors Postgres's object hierarchy. The DDL schema name is
+ * resolved once per namespace.
+ *
+ * A policy that references a table absent from its namespace is a malformed
+ * contract — the loop throws rather than fabricating a stub table.
+ */
+export function contractToPostgresDatabaseSchemaNode(
+  contract: PostgresContract | null,
+  options: ContractToSchemaIROptions,
+): PostgresDatabaseSchemaNode {
+  if (contract === null) {
+    return new PostgresDatabaseSchemaNode({
+      namespaces: {},
+      roles: [],
+      existingSchemas: [],
+      pgVersion: '',
+    });
+  }
+
+  const namespaces: Record<string, PostgresNamespaceSchemaNode> = {};
+  const roles: PostgresRoleSchemaNode[] = [];
+  const ownedSchemas: string[] = [];
+
+  for (const ns of Object.values(contract.storage.namespaces)) {
+    if (!isPostgresSchema(ns)) continue;
+    const ddlSchema = resolveDdlSchemaForNamespaceStorage(contract.storage, ns.id);
+    ownedSchemas.push(ddlSchema);
+
+    // Convert only THIS namespace's tables (passing the full storage for
+    // type/value-set/enum resolution that spans namespaces), so the same table
+    // name can exist in two schemas without colliding in a bare-keyed record.
+    const sqlTables = contractNamespaceToSchemaIR(contract.storage, ns.id, options).tables;
+
+    const policiesByTable = new Map<string, PostgresPolicySchemaNode[]>();
+    for (const policy of Object.values(ns.policy)) {
+      const list = policiesByTable.get(policy.tableName) ?? [];
+      list.push(toPolicyNode(policy, ddlSchema));
+      policiesByTable.set(policy.tableName, list);
+    }
+
+    const tables: Record<string, PostgresTableSchemaNode> = {};
+    for (const tableName of Object.keys(ns.table)) {
+      const sqlTable = sqlTables[tableName];
+      if (sqlTable === undefined) continue;
+      // The family conversion stamps `referencedSchema` with the FK target's
+      // namespace id verbatim, which can be the unbound sentinel. Resolve it
+      // to the real live DDL schema here — introspected FKs already carry the
+      // live schema, so this is what lets an expected FK pair (by diff-node
+      // id) with its introspected counterpart.
+      const foreignKeys = sqlTable.foreignKeys.map(
+        (fk) =>
+          new SqlForeignKeyIR({
+            columns: fk.columns,
+            referencedTable: fk.referencedTable,
+            referencedColumns: fk.referencedColumns,
+            ...ifDefined('referencedSchema', fk.referencedSchema),
+            ...ifDefined('name', fk.name),
+            ...ifDefined('onDelete', fk.onDelete),
+            ...ifDefined('onUpdate', fk.onUpdate),
+            ...ifDefined('annotations', fk.annotations),
+            resolvedReferencedNamespace: resolveDdlSchemaForNamespaceStorage(
+              contract.storage,
+              fk.referencedSchema ?? UNBOUND_NAMESPACE_ID,
+            ),
+          }),
+      );
+      tables[tableName] = new PostgresTableSchemaNode({
+        name: sqlTable.name,
+        columns: sqlTable.columns,
+        foreignKeys,
+        uniques: sqlTable.uniques,
+        indexes: sqlTable.indexes,
+        ...ifDefined('primaryKey', sqlTable.primaryKey),
+        ...ifDefined('annotations', sqlTable.annotations),
+        ...ifDefined('checks', sqlTable.checks),
+        policies: policiesByTable.get(tableName) ?? [],
+      });
+    }
+
+    for (const [tableName, tablePolicies] of policiesByTable) {
+      if (!(tableName in tables)) {
+        const policyName = tablePolicies[0]?.name ?? '(unknown)';
+        throw new Error(
+          `contract-to-postgres-database-schema-node: policy "${policyName}" references table "${tableName}" not present in namespace "${ddlSchema}"`,
+        );
+      }
+    }
+
+    namespaces[ddlSchema] = new PostgresNamespaceSchemaNode({
+      schemaName: ddlSchema,
+      tables,
+      nativeEnumTypeNames: [],
+    });
+
+    for (const role of Object.values(ns.role)) {
+      roles.push(new PostgresRoleSchemaNode({ name: role.name, namespaceId: role.namespaceId }));
+    }
+  }
+
+  return new PostgresDatabaseSchemaNode({
+    namespaces,
+    roles,
+    existingSchemas: ownedSchemas,
+    pgVersion: '',
+  });
+}