feat(pg-delta)!: clean-room rewrite, promoted to @supabase/pg-delta (BREAKING alpha)

.changeset/adp-owner-self-entry-roundtrip.md

@@ -0,0 +1,5 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Canonicalize the grantor's own default-privilege self-entry at extraction so `pg_default_acl` rows round-trip. For a PER-SCHEMA row, one built by explicit grants to the owner (`{owner=arwdDxtm/owner, other=…}`) and one built purely from grants to other roles (`{other=…}`, no owner entry) are behaviorally identical — Postgres re-adds the owner's `acldefault` entry to every new object at creation time regardless of the stored row. Previously the extractor emitted a spurious `revoked_default` marker for the owner whenever it was absent from the stored ACL, so re-exporting a replayed database produced a spurious `alter default privileges … revoke all … from <owner>` self-revoke. The owner's own revoked-default marker is now suppressed where its absence is a behavioral no-op (PUBLIC and other-role markers are unaffected; a partial owner self-reduction that differs from `acldefault` is still represented as a positive fact; a GLOBAL row where the owner's absence is a real revoke keeps its marker — see the companion global-self-revoke changeset).

.changeset/adp-owner-self-revoke-global.md

@@ -0,0 +1,5 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Extract a GLOBAL (cluster-wide) default-privilege owner self-revoke as a real `revoked_default` marker instead of silently dropping it. The previous canonicalization suppressed the grantor's own revoked-default marker unconditionally, which is only correct for per-schema rows (Postgres always re-merges the owner's `acldefault` entry at object creation) and for a bare global self-revoke with an empty stored ACL (the created object's relacl degenerates to NULL and the owner keeps its privileges). On a GLOBAL row that still carries other grantees (e.g. `alter default privileges for role alice revoke all on tables from alice; ... grant select on tables to bob` → `{bob=r/alice}`), Postgres uses the stored ACL verbatim at creation, so the owner really loses its own privileges — a genuine customization that must survive export/apply/reverse. The suppression is now conditional (per-schema and bare-empty-global stay no-ops; global-with-other-grantees emits the owner marker so the `revoke`/`grant` round-trips).

.changeset/agg-sig-render-prune-strict-labels-enum-guard.md

@@ -0,0 +1,11 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Several correctness and packaging fixes:
+
+- **Ordered-set aggregate metadata**: `COMMENT ON` / `SECURITY LABEL ON` an ordered-set or hypothetical-set aggregate now address it with the `agg(direct ORDER BY ordered)` signature (reusing the aggregate DDL's `aggSig`), instead of the flat argument list that PostgreSQL rejects at apply.
+- **`render` prunes stale segments**: re-rendering a plan to the same `--out` base now deletes the previous render's segment files (`<base>.sql` / `<base>_<n>.sql`) that the new render no longer produces, so a runner scanning the directory can no longer replay obsolete (possibly destructive) segments. Only render-owned files matching that naming scheme are touched; foreign files are left in place.
+- **`--strict-coverage` blocks unresolved security labels**: a valid `SECURITY LABEL` on an unsupported object (language / database / large object / tablespace) now escalates to a blocking diagnostic under `--strict-coverage`, matching `unmodeled_kind`, instead of silently producing an artifact that omits the label.
+- **Enum value-set rebuild guard**: removing or reordering enum values while a non-column dependent (a `DOMAIN` over the enum, a `COMPOSITE` attribute using it, or a `RANGE` over it) survives now fails loudly at plan time. The rebuild only migrates column dependents, so such objects would otherwise leave the final `DROP TYPE` failing at apply. Full migration of non-column dependents remains out of scope.
+- **ESM-only packaging**: removed the misleading `require` conditions from every `exports` entry. The package is `type: module` with a NodeNext build and ships no CommonJS output, so a `require` condition pointing at ESM was a false CJS signal (`ERR_REQUIRE_ESM` on Node <22). CommonJS consumers must use dynamic `import()`, or Node >=22 (which can `require()` ESM synchronously). ESM consumers are unaffected.

.changeset/apply-owner-shadow-guard-and-absent-verbose.md

@@ -0,0 +1,5 @@
+---
+"@supabase/pg-delta": patch
+---
+
+`schema apply` now (1) fails closed when an explicit `--shadow`'s connection role differs from the export's stamped default owner — the shadow would otherwise load omitted-`OWNER TO` objects as its own role and plan spurious ownership drift — and (2) treats a directory with no manifest default-owner record as verbose, honoring every explicit `OWNER TO` in the files instead of synthesizing a target default and pruning owner edges to it (which silently dropped an explicit owner change when the target object was owned by a different role).

.changeset/canonical-search-path.md

@@ -0,0 +1,20 @@
+---
+"@supabase/pg-delta": minor
+---
+
+Canonicalize the extraction session's `search_path` to `pg_catalog` (pg_dump
+convention). Postgres deparsers (`format_type`, `pg_get_*def`, `pg_get_expr`)
+path-relativize names, so any object visible on the session path previously came
+back UNQUALIFIED — meaning the same catalog extracted under different search_paths
+(e.g. a target database carrying `ALTER DATABASE … SET search_path`, versus a
+freshly-created shadow with the default path) produced DIFFERENT payloads and
+hashes, causing mass false drift in the shadow-vs-target compare and shifting
+routine stable-ids. Extraction now pins the deparse path so identical catalogs
+hash identically regardless of session/database/role path settings, and rendered
+DDL is fully schema-qualified.
+
+The plan preamble now also pins `search_path` to `pg_catalog` at apply time so
+rendered DDL resolves identically regardless of the applier role's defaults.
+
+`ENGINE_VERSION` is bumped to `0.2.0` (hash-invalidating): plan artifacts,
+snapshots, and baselines captured before this change must be regenerated.

.changeset/composite-attribute-order.md

@@ -0,0 +1,5 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Preserve composite type attribute order. The composite `CREATE TYPE … AS (…)` rule assembled attributes in encoded-id (name) order, silently reordering columns (e.g. `errors` before `wal`) on every reconstruction — a row-layout change that broke composite-returning dependents at body validation. The extractor now carries the declared attribute position (as the non-semantic `_position` payload key, excluded from hash/diff), and the composite create renders attributes in that order.

.changeset/concurrent-indexes-partitioned.md

@@ -0,0 +1,9 @@
+---
+"@supabase/pg-delta": patch
+---
+
+The `concurrentIndexes` serialize option no longer inserts `CONCURRENTLY` for
+indexes on partitioned tables. PostgreSQL rejects `CREATE INDEX CONCURRENTLY`
+on a partitioned table's parent index (relkind `p`), so such a plan failed at
+apply time. Those indexes are now created plainly (transactionally) while
+indexes on regular tables keep the concurrent, non-transactional path.

.changeset/createrole-self-grant-load.md

@@ -0,0 +1,5 @@
+---
+"@supabase/pg-delta": patch
+---
+
+`loadSqlFiles` enables `createrole_self_grant` on PG 16+ so a CREATEROLE non-superuser (Supabase `postgres`) can load `CREATE SCHEMA … AUTHORIZATION new_role`, and strips the resulting bootstrap memberships from the extracted fact base so plans do not emit a failing `GRANT … TO <applier> WITH ADMIN OPTION`. Assumed-schema seeding uses the same GUC on a dedicated pool client.

.changeset/drop-role-no-drop-owned-by.md

@@ -0,0 +1,12 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Fix role drop to no longer emit `DROP OWNED BY <role>` ahead of `DROP ROLE <role>`.
+`DROP OWNED BY` swept up anything the role owned outside the managed/projected
+view (objects the engine never extracted), silently destroying unmanaged data
+when applying the plan. Managed grants, default ACLs, and owned objects are
+already revoked/reassigned/dropped by their own plan actions before the role
+drop runs, so a plain `DROP ROLE` succeeds when everything is managed, and now
+Postgres fails loud ("role cannot be dropped because some objects depend on
+it") instead of silently destroying data when unmanaged ownership remains.

.changeset/enum-tempname-column-order.md

@@ -0,0 +1,7 @@
+---
+"@supabase/pg-delta": minor
+---
+
+Enum value-set rebuilds now pick a namespace- and length-safe temp name for the old enum: the collision check consults every occupant of the type namespace (enums/composites/ranges, domains, and the implicit row types of tables/views/matviews/foreign tables/sequences), and the generated identifier is clipped to ≤ 63 bytes so PostgreSQL never truncates it back onto an occupied name.
+
+Table `CREATE`s and schema exports now render columns in DECLARED order instead of alphabetical name order. Column position (`pg_attribute.attnum`) is captured at extract time as a non-semantic field, so a from-empty create/export reproduces the original `SELECT *`, positional-INSERT, and row-type layout; order-only differences on an existing table remain undiffed by design (the field is excluded from the fact hash and diff).

.changeset/export-constraint-on-deferred-column.md

@@ -0,0 +1,5 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Fix `schema export` folding a table constraint inline into `CREATE TABLE` when the column it references was deferred to a later `ALTER TABLE … ADD COLUMN` (a domain-typed column whose fold crosses the domain-create edge, or a generated column that never hints). The constraint fold pass bypassed the crossing guard for all constraints (to keep validated FKs to later-created tables foldable), which produced `CREATE TABLE … CONSTRAINT … UNIQUE (slug)` where `slug` was not yet a column, so the export failed to reload with `column "slug" named in key does not exist`. The guard now vetoes a constraint fold only when a same-table column of the fold target is deferred, while still tolerating crossings to other relations (an FK's referenced table, backing indexes/types elsewhere). Such constraints now render as standalone `ALTER TABLE … ADD CONSTRAINT`.

.changeset/export-default-owner.md

@@ -0,0 +1,25 @@
+---
+"@supabase/pg-delta": minor
+---
+
+`schema export` now serializes object ownership as `ALTER … OWNER TO` (an assumed
+role reference, consistent with how ACLs already round-trip) instead of dropping
+it at the default `--scope database`. Ownership is suppressed only for the
+resolved DEFAULT owner so exports stay human-readable: the default resolves
+`--default-owner <role|none>` (new flag) > the profile-declared default (Supabase
+→ `postgres`) > the database owner (`datdba`). `--default-owner none` emits every
+`OWNER TO` for maximum fidelity.
+
+Previously, database-scope exports dropped all ownership, so objects owned by a
+non-applier role (e.g. Supabase's `auth_admin`) reloaded applier-owned and then
+showed up as spurious `ALTER … OWNER TO` / `REVOKE … FROM postgres` drift. This
+now holds even when the database has extensions or assumed schemas present: the
+managed view is rebuilt to attach reference-only marks in that case, and the
+rebuild no longer silently re-prunes the retained owner references (which had made
+a real Supabase export emit zero `OWNER TO`).
+
+The export manifest stamps the resolved default owner (a role name, or `null` for
+a verbose export; a field-absent directory is treated as pre-feature). `schema
+apply` reconstructs the identical view and fails closed (exit 2) when the target
+connection role differs from a role-name default. Policy-based owner exclusion is
+unchanged.

.changeset/export-identity-sequence-name.md

@@ -0,0 +1,11 @@
+---
+"@supabase/pg-delta": patch
+---
+
+`schema export` now emits `SEQUENCE NAME` for identity columns whose implicit
+backing sequence name differs from the `<table>_<column>_seq` default (renamed
+sequences, or ones created via `SEQUENCE NAME`). Previously the export rendered
+a bare `GENERATED … AS IDENTITY`, so reload let PostgreSQL re-derive the default
+name and the next diff produced a spurious `ALTER SEQUENCE … RENAME`. Renamed
+identity sequences now round-trip cleanly; default-named identity columns stay
+bare so ordinary exports remain minimal.

.changeset/fix-owner-edge-policy-exclusion.md

@@ -0,0 +1,15 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Fix policy hard-exclusion laundering an excluded owner role back into the plan.
+`excludeFactsAndDescendants` no longer mints a dangling `owner -> role` edge for
+a role that THIS exclusion removes (it only preserves edges that were already
+dangling on input, the seed-rebuild case). Previously a policy-excluded role
+retained its owner edge, was auto-assumed in `plan.ts`, and re-emerged as
+`CREATE SCHEMA … AUTHORIZATION <role>` / `OWNER TO <role>` while silencing the
+missing-requirement guard. Now the guard correctly fires when a kept object's
+ACL (or ownership) references a policy-excluded role. Also fixes the
+"typo'd function body is caught by re-validation" test to opt into
+`strictFunctionBodies` (a user-routine body-lint is a warning by default under
+lenient function bodies).

.changeset/foreign-server-extension-subpartition-fixes.md

@@ -0,0 +1,11 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Fix five round-trip fidelity gaps in the planner:
+
+- Multi-level partitions keep their own `PARTITION BY` clause, so a partition that is itself partitioned can have sub-partitions attached.
+- Removing a foreign server `VERSION` (which has no `ALTER SERVER` grammar) now routes to a drop + recreate instead of crashing planning.
+- `ALTER EXTENSION … SET SCHEMA` is no longer emitted for non-relocatable extensions; relocation is planned as a drop + recreate in the new schema.
+- Zero-argument aggregate `COMMENT` / `SECURITY LABEL` targets render `name(*)` instead of the invalid `name()`.
+- Replacing a foreign server that has dependent foreign tables / user mappings now drops and recreates those children around the replace (the parent `DROP SERVER` does not cascade), instead of failing on the surviving dependents.

.changeset/in-place-alter-consumes-releases.md

@@ -0,0 +1,5 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Make in-place `ALTER` actions participate in the plan's dependency walk by declaring `consumes`/`releases` on four rule sites, so they no longer sort before the `CREATE` of a new dependency or after the `DROP` of an old one. Column `TYPE …` changes now consume the new column type and release the old one; `ALTER EXTENSION … SET SCHEMA` releases the old schema; sequence `OWNED BY` reassignment releases the old owning column; and `ALTER POLICY … TO` consumes newly-listed roles and releases removed roles. Previously each of these could be emitted against a not-yet-created target ("type/relation/policy does not exist") or block a same-plan `DROP` of the object it stopped referencing.

.changeset/issue-333-domain-enum-array-notvalid.md

@@ -0,0 +1,5 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Three planning fixes from issue #333: (1) a domain whose `baseType`/`collation` change is a drop+recreate — the planner now fails loud at plan time (instead of emitting a plan Postgres rejects at apply) when a surviving table column still depends on the domain, mirroring the existing in-use range-type guard. (2) An enum value-set rebuild (removal/reorder) migrated every dependent column with a scalar `col::text::<enum>` cast regardless of the column's own declared type; an `enum[]` column now casts correctly (`TYPE <enum>[] USING col::text[]::<enum>[]`) instead of erroring or silently narrowing to scalar. (3) A constraint's `validated` attribute going from `true` to `false` (VALIDATED → NOT VALID) threw `constraint cannot be de-validated in place` instead of planning a fix; it now replaces the constraint (`DROP CONSTRAINT` + `ADD CONSTRAINT … NOT VALID`), matching how `create()` already renders a fresh NOT VALID constraint.

.changeset/lenient-function-bodies.md

@@ -0,0 +1,7 @@
+---
+"@supabase/pg-delta": minor
+---
+
+`schema apply` (and the `loadSqlFiles` loader) now treat a USER routine whose body fails the post-load `check_function_bodies = on` re-validation as a loud WARNING instead of a fatal error. Postgres itself accepts such a function under `check_function_bodies = off` — which pg-delta's own apply executor emits in every plan preamble — so refusing to READ back a function pg-delta would happily WRITE was an asymmetry that blocked round-tripping any schema relying on check-off (legacy forward references, tolerated casts, etc.). The warning still flows through the diagnostics output loudly; the load now proceeds and apply faithfully materializes exactly what was declared. Pass `--strict-function-bodies` (loader option `strictFunctionBodies: true`) to restore the fatal gate for CI.
+
+Seeded/reference-only routine failures are unchanged (still a warning) and now carry the distinct `invalid_seeded_routine_body` code so they can be told apart from user-routine failures. Changing an assumed-schema routine (a new overload, or a `CREATE OR REPLACE` that alters the body of a seeded routine) still fails loud, because assumed-schema facts are reference-only in the diff and such a change would otherwise be a silent no-op.

.changeset/loader-snapshot-baseline-fixes.md

@@ -0,0 +1,9 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Three fixes to the SQL loader, snapshot metadata, and baseline subtraction:
+
+- **Loader:** `CREATE|ALTER|DROP USER MAPPING …` statements are no longer misclassified as cluster-global role DDL. The role-lifecycle scanners now use a `user(?!\s+mapping)` negative lookahead, so database-scope `schema apply` accepts (and `--skip-cluster-ddl` no longer strips) the user mappings pg-delta itself emits in foreign-data exports.
+- **Snapshots:** `pgdelta snapshot` now stamps the profile it was captured under (a declared id, `null` for a raw capture, or absent for pre-feature legacy snapshots — never folded into the digest). `drift` and `prove` reconcile that stamp against any `--profile` flag: an omitted flag adopts the stamped profile, a contradicting flag fails closed with an actionable error, and a legacy (un-stamped) snapshot keeps the previous behavior with a one-line note.
+- **Baseline subtraction:** `subtractBaseline` now compares each fact's outgoing-edge signature alongside its payload hash, so an equal-payload fact whose ownership/provenance edge changed (e.g. `OWNER` A→B) is no longer subtracted and pruned away invisibly. Owner→role edges to subtracted platform roles are retained as dangling assumed references so ownership still serializes.

.changeset/non-superuser-extract.md

@@ -0,0 +1,11 @@
+---
+"@supabase/pg-delta": patch
+---
+
+Fix `extract()` failing with `permission denied for table pg_user_mapping` when connecting as a non-superuser: user mappings now fall back to the world-readable `pg_user_mappings` view (with a warning diagnostic, since the view hides options the role isn't authorized on). Mappings whose options the view hides from the current role are skipped with that diagnostic instead of being recorded with fabricated empty options. `plan()` now refuses to plan changes touching a user mapping whose state was unreadable (and therefore unknown) on either side, instead of silently emitting a wrong CREATE/DROP USER MAPPING.
+
+The unreadable-user-mapping diagnostic now survives extension-handler profiles (e.g. Supabase) instead of being silently dropped by the handler-triggered fact-base rebuild. Snapshots now carry `FactBase.diagnostics` (excluded from the digest), so the `plan()` gate still fires when one side is a deserialized snapshot rather than a live extraction; old snapshots without this field simply remain ungated, same as before. The gate itself now also refuses a `DROP SERVER` or `DROP ROLE` that would implicitly destroy a hidden mapping, not just a direct change to the mapping itself.
+
+`pgdelta drift` now surfaces diagnostics carried by the snapshot side; the plan gate also covers replace-class server changes (`server.type`/`server.fdw`, which have no in-place ALTER and would otherwise silently drop-and-recreate the server, destroying an unreadable mapping's server, instead of throwing).
+
+`pgdelta prove` now surfaces diagnostics carried by the desired snapshot and annotates a passing proof with their count.