feat(pg-delta-next): orderless declarative apply, grouped export, formatting, redaction

[avallete]

What kind of change does this PR introduce?

Feature + fixes. This is the GREEN half of the TDD split: the source for the
next pg-delta engine. It is stacked on the tests PR #315 — its base is the
feat/pg-delta-next-tests branch, so the diff here is source-only and turns the
tests in #315 green.

Merge #315 first, then this PR.

What's in here

• The next-engine source: extraction (publications, foreign, sensitive options,
  scope, dependencies), planner (action-graph/emitter, policy/schema/table/type
  rules), frontends (sql-order shadow reorder, grouped export, SQL formatter),
  CLI commands, policy/supabase integration, and the pg-topo total-order change.
• Per-behavior changesets.

CI fixes (were failing on the combined branch)

• Type check (Cannot find module '@supabase/pg-topo'): sql-order.ts
  imports the optional @supabase/pg-topo peer. tsc resolves it via the
  package's types field (dist/*.d.ts), which is gitignored and not produced
  by bun install. Added a step to build @supabase/pg-topo before the type
  check; runtime continues to use the bun source export condition.
• Corpus PG14 (drop-publication-fk-chain-partial-membership,
  syntax error at or near "TABLE"): the inlined CREATE PUBLICATION … FOR
  clause repeated the TABLE keyword per relation (FOR TABLE a, TABLE b),
  valid only on PG15+. Now grouped under a single TABLE (and a single
  TABLES IN SCHEMA), valid on every supported version. Full corpus
  554 pass / 0 fail on postgres:14-alpine and postgres:17-alpine.

Restored docs

Restores docs/roadmap/** (6 files) that an earlier PR-shrinking commit removed.
The dogfooding harness and run artifacts remain removed.

[changeset-bot]

🦋 Changeset detected

Latest commit: da8ce04

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@supabase/pg-delta-next	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[avallete]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 73ee0b8e39

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 73ee0b8e39

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb4c83045d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

pg-toolbelt/packages/pg-delta-next/src/cli/commands/schema.ts

Lines 538 to 540 in a508db8

	const report = await apply(thePlan, tgt.pool, {
	...ctx.applyOptions, // baseline + handler-aware re-extract (from the profile)
	fingerprintGate: !force,

Re-extract unredacted state for unsafe schema apply

When schema apply --unsafe-show-secrets plans against a target that already contains FDW/server/user-mapping credentials or subscription conninfo, the source fingerprint is built from the unredacted targetResult, but the immediate apply still uses ctx.applyOptions.reextract, whose default extractor redacts secrets. Fresh evidence beyond the prior shadow/target extraction fix is that this apply() call does not wrap reextract with the same { redactSecrets }, so the fingerprint gate can abort unless --force is used even though the command opted into unredacted round-tripping.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

pg-toolbelt/packages/pg-delta-next/src/cli/commands/schema.ts

Lines 538 to 540 in aee1c38

	const report = await apply(thePlan, tgt.pool, {
	...ctx.applyOptions, // baseline + handler-aware re-extract (from the profile)
	fingerprintGate: !force,

Preserve unsafe-secret fingerprints during apply

When schema apply --unsafe-show-secrets runs against a target that already has any unredacted FDW/server/user-mapping option or subscription conninfo, the plan source fingerprint is computed from the unredacted targetResult.factBase, but this call still uses ctx.applyOptions.reextract, whose profile re-extractor defaults back to redaction. The fingerprint gate then compares a redacted re-extract to the unredacted plan fingerprint and rejects the one-shot apply unless the user disables the gate with --force.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

pg-toolbelt/packages/pg-delta-next/src/cli/commands/schema.ts

Line 102 in c8b505c

name: full.slice(dir.length + 1), // relative path from dir

Normalize --dir before deriving SQL file names

When --dir is passed with a trailing slash or a non-normalized segment, join(current, entry) normalizes full but this slice still uses the raw dir.length + 1, so the first character of every relative path is dropped. The corrupted name is then used by loadSqlFiles for lexicographic ordering, so raw-load paths (--no-reorder, missing pg-topo, or reorder barriers like ADP/session settings) can run files in the wrong order; for example 01_schema.sql becomes 1_schema.sql while 10_table.sql becomes 0_table.sql, causing the table file to be attempted before the schema. Compute the relative name from normalized paths (e.g. relative(resolve(dir), full)) instead of slicing the user-supplied string.

---

pg-toolbelt/packages/pg-delta-next/src/frontends/load-sql-files.ts

Line 610 in c8b505c

const result = await extractShadow(shadow, { source: "sqlFiles" });

Filter preexisting shared roles from shadow extracts

In the default databaseScratch mode, a shadow database can live on a cluster that already has non-pg_ roles unrelated to the declarative files; the before/after leak check only verifies those roles did not change, but this extraction still includes them in the desired fact base. If the target cluster lacks one of those preexisting shadow roles, schema apply will plan to create it even though no input .sql file declared it; subtract the pre-load shared-role snapshot or otherwise reject a non-isolated shadow cluster with extra roles before returning the extracted state.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[avallete]

On the two review-body P2s in the latest Codex summary (no inline threads):

• Normalize --dir before deriving SQL file names (schema.ts:102): fixed in a1ea93d. collectSqlFiles now uses relative(resolve(dir), full) instead of slicing the raw --dir string, so a trailing slash no longer drops the first character of every name (which corrupted raw-load lexicographic order). Covered by collect-sql-files.test.ts (RED→GREEN, tested with and without a trailing slash).

• Filter preexisting shared roles from shadow extracts (load-sql-files.ts:610): deferred, with rationale. This is pre-existing behavior (not introduced by this PR): in databaseScratch mode the shadow extract includes any non-pg_ roles already on the cluster, so if the target lacks one, apply plans a spurious CREATE ROLE. The safe fix is genuinely risky — subtracting role facts collides with owner/membership edges in the diff path (the connection role owns the shadow objects), and outright rejecting a shared cluster with extra roles breaks common CI setups. It is also lower severity (an extra role, not a destructive drop) and is fully sidestepped by the --isolated-shadow mode this PR added (and the docs recommend). Happy to take it on as a focused follow-up if you want it, but it felt disproportionate to fold into this PR.

🤖 Addressed by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a1ea93d032

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

pg-toolbelt/packages/pg-delta-next/src/policy/supabase.ts

Lines 402 to 405 in 2ed1baf

	{ kind: ["acl", "comment", "securityLabel"] },
	{
	any: [
	{ target: { schema: [...SUPABASE_SYSTEM_SCHEMAS] } },

Keep metadata on included Supabase triggers

This blanket satellite exclusion also catches metadata for objects that an earlier include rule deliberately keeps, such as a user trigger on auth.users whose function is in public. A COMMENT ON TRIGGER fact has kind comment and target schema auth, so it is pruned while the trigger remains managed; export/plan then silently drops the user's trigger comment. Exclude satellites only when their target is actually excluded/reference-only, or add a matching include for satellites of the included trigger.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject schema-neutral SQL-only apply dirs

This guard still treats any tokenized statement as a non-empty desired schema, so a wrong directory containing only schema-neutral SQL such as SELECT 1; or SET statement_timeout = 0; passes the check, loads an empty shadow, and then plans from the live target to an empty desired state. Because the fingerprint source is the same live target, the gate can pass and schema apply can drop every managed object; validate that the loaded shadow produced at least one managed fact or require an explicit empty-desired mode.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Fail on malformed export manifests

When .pgdelta-export.json exists but is malformed or unreadable, this catch returns undefined, so schema apply --dir silently falls back to the CLI/default profile and redaction mode. For a --profile supabase or --unsafe-show-secrets export with a truncated/merged manifest, that bypasses the safety metadata and can reintroduce the raw-profile destructive behavior or redact real credentials to placeholders; distinguish a missing manifest from an invalid one and abort on the latter.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Include dollar signs in identifier scans

PostgreSQL allows dollar signs in unquoted identifiers after the first character, but this scanner stops the name before $. With --format-options, valid statements like CREATE SERVER srv$1 FOREIGN DATA WRAPPER ... or CREATE MATERIALIZED VIEW public.v$1 AS ... are sliced with the $1 portion before the first clause and sliceClauses() drops it, so the formatted SQL targets srv/public.v instead of srv$1/public.v$1; include $ when scanning unquoted identifiers without treating it as a dollar quote inside identifiers.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Split by-object files across dependency gaps

Because this unconditionally appends every action for the same object path into one file, the default by-object export can create file-level cycles that the raw loader cannot break. For example, a valid mutual-FK state with CREATE a, CREATE b REFERENCES a, then ALTER a ADD CONSTRAINT ... REFERENCES b is exported as a.sql containing CREATE a plus the later constraint and b.sql containing CREATE b; loadSqlFiles/schema apply --no-reorder wraps each file atomically, so a.sql rolls back waiting for b and b.sql rolls back waiting for a. Split non-consecutive runs, as ordered layout does, or otherwise avoid grouping plan steps across dependency gaps.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

pg-toolbelt/packages/pg-delta-next/src/frontends/load-sql-files.ts

Lines 352 to 355 in 29ffa2e

	SELECT count(*)::int AS n FROM pg_class c
	JOIN pg_namespace n ON n.oid = c.relnamespace
	WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
	AND n.nspname NOT LIKE 'pg\\_%'`);

Reject shadows with schema-only leftovers

With a reused shadow that contains only an empty user schema, function, type, or other managed object not represented in pg_class, this emptiness check still passes because it counts only relation rows. The stale object is then included in the extracted desired state even if no input file declares it, so schema apply can create or preserve state from a previous run; verify emptiness via extraction or include all managed catalogs while excluding built-ins like public.

---

pg-toolbelt/packages/pg-delta-next/src/frontends/load-sql-files.ts

Lines 437 to 438 in 29ffa2e

	next.push(file);
	}

Preserve session-setting files as load barriers

When a file containing SET search_path, SET ROLE, or SET SESSION AUTHORIZATION initially fails, pushing it into next lets later files run in the same round after that file's transaction rolled back the setting. For lexicographic files like 00_set_and_create.sql, 01_schema.sql, and 02_unqualified_create.sql, the third file can create objects under the wrong schema/role before the setting file succeeds in round 2; session-setting files need a prefix-preserving barrier or hard failure instead of ordinary defer-and-retry.

---

pg-toolbelt/packages/pg-delta-next/src/extract/foreign.ts

Lines 88 to 91 in 29ffa2e

	FROM pg_user_mapping u
	JOIN pg_foreign_server s ON s.oid = u.umserver
	LEFT JOIN pg_roles r ON r.oid = u.umuser
	ORDER BY s.srvname, 2`)) {

Filter mappings whose server was not extracted

This query extracts every user mapping even when its foreign server was omitted by the server extractor's extension-member filtering. If an extension/platform supplies a server that is not extracted, a user mapping for it is pushed with parent: { kind: "server", ... }, and buildFactBase aborts with a missing parent before policy can filter it; either retain the server as reference-only or skip mappings whose server is outside the extracted view.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Treat schema-scoped default ACL rows as additive

For IN SCHEMA default-privilege rows, PostgreSQL stores only privileges to add to the global/hard-wired defaults, not a full replacement ACL (docs: https://www.postgresql.org/docs/current/catalog-pg-default-acl.html). Comparing every row to acldefault() makes a normal ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT SELECT ON TABLES TO reader look like it also revoked the owner's built-in table privileges, because the per-schema defaclacl has no owner row; the UNION below then synthesizes an empty owner marker and export/apply emits REVOKE ALL ... FROM owner for future objects. Use an empty baseline for non-global entries and reserve acldefault() comparison for global rows.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve built-in grants when dropping grant-option deviations

When the removed default-privilege fact only added grant option to a built-in grant, e.g. ALTER DEFAULT PRIVILEGES GRANT EXECUTE ON FUNCTIONS TO PUBLIC WITH GRANT OPTION, the desired default state now has no fact because plain PUBLIC EXECUTE equals the built-in default. Dropping the source fact with REVOKE ALL removes the base EXECUTE privilege too, so future functions end up with no PUBLIC execute instead of just losing the grant option; this path needs to revoke only the grant option or otherwise restore the built-in grant after removing the deviation.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Reset session settings after raw shadow loads

When a declarative file contains session-level SET ROLE, SET SESSION AUTHORIZATION, or SET search_path, the raw loader runs all files on one pooled client and only resets check_function_bodies before releasing it. A successful SET ROLE persists after COMMIT, so body validation and the post-load extraction can run under the wrong role/search path (or leak that state to the next pool user), which can hide catalog details such as foreign user-mapping options or produce permission failures; reset these session settings before validation/release or isolate them from extraction.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4b0144050d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Seed ambient target roles before loading the shadow

In the default --scope database path with a separate shadow cluster, declarative SQL that grants to or assigns ownership to a role that exists on the target but not on the shadow still fails during loadSqlFiles (e.g. GRANT SELECT ON app.t TO app_user raises “role does not exist”). The target roles are only collected later in assumedTargetRoles, so the planner can treat them as ambient but the shadow never gets far enough to extract the desired ACL/owner state; extract/seed ambient target roles before loading, or otherwise make the shadow able to resolve target-local role names.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Drop shadow-owner default ACLs in database scope

When schema apply runs in the default database scope against a shadow connected as a different role than the target applier, a plain CREATE TABLE in the SQL files extracts an implicit owner ACL for the shadow login. This projection removes the role facts/owner edges but leaves that ACL fact behind, so planning can try to REVOKE/GRANT privileges for the shadow-only grantee (or fail the missing-role guard) even though ownership is explicitly unmanaged in this scope; database scope needs to discard or normalize implicit owner ACLs that only come from the shadow owner while preserving authored grants to real target roles.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Extract snapshots with the selected profile

When a plan is produced with an integration profile such as --profile supabase, the desired snapshot used by prove is still produced here with the raw core extractor, so the snapshot lacks profile handler metadata such as managedBy edges that the profiled plan/proof path expects. In that scenario prove --profile supabase compares a handler-projected clone against a raw desired snapshot and can report false drift for operational extension objects; snapshot needs to accept/stamp the profile or prove must reject snapshots that were not captured with the plan's profile.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5ab860ba7b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Apply profile filters before dropping owner edges

In the default --scope database path, these lines strip role facts and owner edges before plan() gets to run the selected profile's resolveView. That breaks owner-based profile filters such as the Supabase system-role rule in policy/supabase.ts, so schema apply --profile supabase can treat target-only platform objects outside the system schemas but owned by supabase_admin/other system roles as managed drift and plan drops for them. Apply the profile/policy projection while the owner edges are still present, then project database scope afterward.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve reference-only facts when projecting scope

Fresh evidence after the earlier reference-only export fix: this database-scope projection rebuilds the fact base via excludeFactsAndDescendants, which drops fb.referenceOnly for all surviving facts. During schema export --profile supabase with the default database scope, any surviving user role (for example postgres) makes this path run, so assumed-platform parents like auth.users lose their reference-only marker before exportSqlFiles can seed them into the pristine baseline, and the export can emit Supabase platform objects as managed CREATEs; carry the surviving referenceOnly set through the scope projection.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Do not classify USER MAPPING as role DDL

These role aliases also match valid CREATE/ALTER/DROP USER MAPPING statements because USER is followed by a word boundary before MAPPING. In default database scope, a directory/export that includes an FDW user mapping is therefore rejected as CREATE ROLE (or stripped by --skip-cluster-ddl), even though the mapping is database-local state that should be loaded against ambient roles; exclude USER MAPPING from these role-DDL patterns.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d393d1d4b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Track nested block comments in the SQL scanner

When --format-options processes valid PostgreSQL SQL with nested block comments, this state machine exits the comment at the first inner */ instead of tracking nesting. Tokens/commas in the rest of the outer comment are then treated as real SQL; for example CREATE TABLE t (a int /* outer /* inner */ , b int */ , c int) is formatted with b int */ outside the comment, producing invalid or semantically different DDL. Track block-comment depth here like the other literal/comment masking code does.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Let co-located shadows clean up on apply failure

When schema apply provisions a co-located shadow and the apply report is failed, the branch above calls process.exit(1), which exits without unwinding this finally; the same pattern applies to other post-provision process.exit gates. That leaves the newly created pgdelta_shadow_* database behind even though --keep-shadow was not requested, so use a return/throw or set process.exitCode so this cleanup runs before the command exits.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Reject isolated mode for co-located shadows

When --isolated-shadow is passed without --shadow, this line disables the shared-object leak check even though the shadow was just created co-located on the target cluster. The static cluster-DDL scan only recognizes direct role DDL, so a file can still run dynamic cluster changes (for example a DO block that CREATE ROLEs); with mode: "isolatedCluster" those target-cluster role/membership mutations are no longer detected. Reject --isolated-shadow unless an explicit dedicated --shadow is supplied, or keep databaseScratch mode for co-located shadows.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

pg-toolbelt/packages/pg-delta-next/src/frontends/load-sql-files.ts

Lines 138 to 140 in da8ce04

	if (sql[i] === "'" && sql[i + 1] === "'") i += 2;
	else if (sql[i] === "'") {
	i++;

Keep E-string escapes inside the masked literal

When a declarative file contains a PostgreSQL escape string (E'...') with an escaped quote, this scanner treats the \' quote as the end of the literal because it only recognizes doubled quotes. The remaining literal text is then scanned as real SQL, so a valid statement such as SELECT E'not\\'; COMMIT;'; can be rejected as transaction control, counted as extra statements for non-transactional files, or stripped by --skip-cluster-ddl; handle E-string backslash escapes here like the formatter scanner does.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Recheck for an empty desired state after skipping cluster DDL

When schema apply --scope database --skip-cluster-ddl is pointed at a directory whose only executable statements are role/membership DDL, the pre-skip hasExecutableSql guard passes, then this branch strips every statement and continues with an empty shadow. The fingerprint source is still the live target, so the resulting plan can apply destructive drops for all managed database objects; abort or re-run the non-empty/managed-fact check after stripClusterDdl removes statements.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Revoke missing built-in default privileges before granting subsets

For a default-privilege fact that represents a built-in grantee with only a subset of its hard-wired default privileges, such as ALTER DEFAULT PRIVILEGES REVOKE UPDATE ON TABLES FROM owner, this create path only issues GRANT statements for the remaining privileges. Starting from a pristine database where the owner already has the full built-in table default, those grants are no-ops and the revoked privilege remains in effect for future objects; reset/revoke the built-in grant first when rendering a subset deviation.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Mark inlined descendants as recreated by the parent replace

When a replaced parent create inlines a descendant via alsoProduces, this branch skips the duplicate standalone recreate but does not add the child to recreatedByReplace, so later set-deltas on that child still emit against the freshly recreated object. For example, replacing a partitioned table while changing an identity column's recorded sequence name produces CREATE TABLE ... AS IDENTITY and then ALTER SEQUENCE old_seq RENAME TO new_seq; old_seq was already dropped with the table, so the plan fails. Record these inlined children as recreated before recursing so their old set-deltas are suppressed.

Useful? React with 👍 / 👎.