@everystack/cli 0.4.53 → 0.4.56

package/src/cli/schema-compile.ts

@@ -21,7 +21,8 @@
 
 import type { ModelDescriptor, FieldSpec, SequenceDescriptor } from '@everystack/model';
 import type { TableSchema, EnumType, SequenceSchema, UniqueConstraint, CheckConstraint, IndexSchema, ForeignKey } from './schema-introspect.js';
-import { nextvalSequence, type RenameMap } from './schema-diff.js';
+import { nextvalSequence, identityClause, type RenameMap } from './schema-diff.js';
+import { normalizeDeparsedExpr } from './deparse-normal.js';
 
 /** `authorId` -> `author_id`. SQL identifiers are snake_case. */
 export function toSnakeCase(name: string): string {
@@ -35,6 +36,23 @@ export function toSnakeCase(name: string): string {
  * two never disagree. Field keys are snake_cased to SQL columns; names are deterministic
  * (a composite unique by its columns, a check by its position) so they round-trip.
  */
+/**
+ * The generated index name — `<table>_<cols>_index`, the FALLBACK when the model declares none.
+ *
+ * Exported because `db:pull` needs the same answer to decide whether a live name is worth
+ * declaring: it renders `.name(...)` exactly when the database's name is NOT the one this would
+ * produce, so a greenfield model stays clean and an adopted one keeps every name it arrived with.
+ * One implementation, because two copies of a naming rule is how these surfaces drift — the same
+ * lesson policy equality already learned here.
+ *
+ * `table` is the BARE table name; `columns` are the SQL-side key texts (snake_cased plain
+ * entries, or verbatim expression text), which sanitize to identifier-safe parts.
+ */
+export function generatedIndexName(table: string, columns: string[]): string {
+  const parts = columns.map((c) => c.replace(/\W+/g, '_').replace(/^_+|_+$/g, ''));
+  return `${table}_${parts.join('_')}_index`;
+}
+
 export function modelConstraintSpecs(model: ModelDescriptor): { uniques: UniqueConstraint[]; checks: CheckConstraint[]; indexes: IndexSchema[] } {
   const uniques: UniqueConstraint[] = [];
   const checks: CheckConstraint[] = [];
@@ -46,7 +64,10 @@ export function modelConstraintSpecs(model: ModelDescriptor): { uniques: UniqueC
       const cols = con.columns.map(toSnakeCase);
       uniques.push({ name: `${model.table}_${cols.join('_')}_unique`, columns: cols });
     } else if (con.kind === 'check') {
-      checks.push({ name: `${model.table}_check_${checkIndex++}`, expr: con.predicate });
+      // Normalized like the live producer (schema-introspect): a model that transcribes a
+      // pulled predicate must compare equal to the database it came from, whichever of the
+      // two equivalent deparse spellings each side happens to hold. See deparse-normal.ts.
+      checks.push({ name: `${model.table}_check_${checkIndex++}`, expr: normalizeDeparsedExpr(con.predicate) });
     } else if (con.kind === 'index') {
       // Plain entries are field keys → snake_cased; raw sql`` entries (expressions,
       // DESC, opclass) pass verbatim — they are already SQL (Brick E).
@@ -56,15 +77,26 @@ export function modelConstraintSpecs(model: ModelDescriptor): { uniques: UniqueC
       // unique within the table for CREATE to succeed. The diff matches indexes by content
       // (entries + uniqueness + predicate + method + INCLUDE), never by name, so the suffix
       // never affects the round-trip. Raw entries sanitize to identifier-safe name parts.
-      const nameParts = cols.map((c) => c.replace(/\W+/g, '_').replace(/^_+|_+$/g, ''));
-      let name = `${model.table}_${nameParts.join('_')}_index`;
-      for (let n = 2; usedIndexNames.has(name); n++) name = `${model.table}_${nameParts.join('_')}_index_${n}`;
+      // A DECLARED name wins outright — the generated one is the fallback, never the default.
+      // An adopted database arrives with names its previous tooling chose, and rebuilding under
+      // ours renamed ~200 of one consumer's indexes: counts and definitions matched, so nothing
+      // failed loudly, but a planner regression test, runbooks, pg_stat_user_indexes history and
+      // REINDEX scripts all name indexes. The declared name is validated at declaration
+      // (IndexBuilder.name), never here.
+      let name = con.indexName ?? generatedIndexName(model.table, cols);
+      // The uniquifying suffix applies to GENERATED names only. A declared name is the
+      // operator's word about what the database calls this index; silently making it
+      // `..._2` would rename the very thing they declared to stop renaming.
+      if (con.indexName === undefined) {
+        for (let n = 2; usedIndexNames.has(name); n++) name = `${generatedIndexName(model.table, cols)}_${n}`;
+      }
       usedIndexNames.add(name);
       indexes.push({
         name,
+        ...(con.indexName !== undefined ? { nameDeclared: true } : {}),
         columns: cols,
         unique: con.isUnique,
-        ...(con.predicate ? { where: con.predicate } : {}),
+        ...(con.predicate ? { where: normalizeDeparsedExpr(con.predicate) } : {}),
         ...(con.method ? { using: con.method } : {}),
         ...(con.includeColumns?.length ? { include: con.includeColumns.map(toSnakeCase) } : {}),
       });
@@ -166,7 +198,11 @@ export function modelForeignKeys(model: ModelDescriptor): ForeignKey[] {
     const col = toSnakeCase(name);
     const targetPk = toSnakeCase(target.primaryKey[0] ?? 'id');
     out.push({
-      name: `${model.table}_${col}_${target.table}_${targetPk}_fk`,
+      // A DECLARED name wins; the generated one is the fallback. An adopted database keeps the
+      // FK names its previous tooling chose (`fk_rails_9a1b2c3d4e`) instead of being renamed
+      // wholesale by a rebuild the differ could not see. Validated at declaration.
+      name: field.spec.constraintName ?? generatedForeignKeyName(model.table, [col], target.table, [targetPk]),
+      ...(field.spec.constraintName !== undefined ? { nameDeclared: true } : {}),
       columns: [col],
       refTable: refTableName(target),
       refColumns: [targetPk],
@@ -180,7 +216,8 @@ export function modelForeignKeys(model: ModelDescriptor): ForeignKey[] {
     const cols = con.columns.map(toSnakeCase);
     const refCols = con.refColumns.map(toSnakeCase);
     out.push({
-      name: `${model.table}_${cols.join('_')}_${target.table}_${refCols.join('_')}_fk`,
+      name: con.constraintName ?? generatedForeignKeyName(model.table, cols, target.table, refCols),
+      ...(con.constraintName !== undefined ? { nameDeclared: true } : {}),
       columns: cols,
       refTable: refTableName(target),
       refColumns: refCols,
@@ -191,6 +228,18 @@ export function modelForeignKeys(model: ModelDescriptor): ForeignKey[] {
   return out;
 }
 
+/**
+ * The generated FK constraint name — `<table>_<cols>_<target>_<refcols>_fk`, drizzle's shape and
+ * the FALLBACK when the model declares none.
+ *
+ * Exported for the same reason {@link generatedIndexName} is: `db:pull` needs the same answer to
+ * decide whether a live name is worth declaring, and two copies of a naming rule is how these
+ * surfaces drift.
+ */
+export function generatedForeignKeyName(table: string, columns: string[], refTable: string, refColumns: string[]): string {
+  return `${table}_${columns.join('_')}_${refTable}_${refColumns.join('_')}_fk`;
+}
+
 /**
  * The referenced table's name as the FK should carry it — schema-qualified for a non-public
  * target (`auth.users`), bare for a public one (`uploads`). A cross-schema FK (auth → auth, or
@@ -284,8 +333,13 @@ function serialDefault(table: string, sqlName: string): string {
 export function fieldColumnSql(sqlName: string, spec: FieldSpec, inlinePrimaryKey: boolean): string {
   const serial = SERIAL_DDL[spec.type];
   let s = `"${sqlName}" ${serial ?? pgType(spec)}`;
+  // An identity column's auto-value is the column's own property, not a default — the clause
+  // has to ride the CREATE, because there is no expression a later SET DEFAULT could carry.
+  if (spec.identity) s += ` ${identityClause(spec.identity)}`;
   if (inlinePrimaryKey) s += ' PRIMARY KEY';
-  const def = serial ? null : defaultExpr(spec);
+  // Identity and DEFAULT are mutually exclusive in Postgres (`CREATE TABLE` refuses both), and
+  // identity is the one that carries the auto-value — so it wins and the default is dropped.
+  const def = serial || spec.identity ? null : defaultExpr(spec);
   // A `defaultSql` nextval draws from an EXISTING sequence, possibly owned by a table
   // created later in the same migration — held out of the column line (compileMigration
   // re-attaches it as a trailing SET DEFAULT). Never the serial shorthand: that would
@@ -461,15 +515,22 @@ export function compileTableSchema(model: ModelDescriptor, opts: { schema?: stri
   const columns = entries.map(([name, field]) => {
     const sqlName = toSnakeCase(name);
     const isSerial = field.spec.type in SERIAL_DDL;
+    const identity = field.spec.identity;
     return {
       name: sqlName,
       type: pgType(field.spec),
-      notNull: field.spec.isNotNull || isSerial,
+      // Postgres makes an identity column NOT NULL, exactly as it does a serial one — so the
+      // IR says so, or an unchanged identity column diffs to a spurious SET NOT NULL.
+      notNull: field.spec.isNotNull || isSerial || identity != null,
       // The deparser qualifies the sequence only when its schema is off the search_path,
       // so a public table's sequence stays bare and a package-schema one is qualified.
+      // An identity column has NO pg_attrdef row, so its IR default is null on both sides.
       default: isSerial
         ? serialDefault(schema === 'public' ? model.table : `${schema}.${model.table}`, sqlName)
-        : defaultExpr(field.spec),
+        : identity
+          ? null
+          : defaultExpr(field.spec),
+      ...(identity ? { identity } : {}),
     };
   });
 
@@ -486,7 +547,9 @@ export function compileTableSchema(model: ModelDescriptor, opts: { schema?: stri
   const fieldChecks = entries.flatMap(([name, field]) => {
     const col = toSnakeCase(name);
     const pred = fieldCheckPredicate(col, field.spec);
-    return pred ? [{ name: `${model.table}_${col}_check`, expr: pred }] : [];
+    // Through the same funnel as every other predicate: a `z.enum([...])` compiles to an
+    // IN-list, which is exactly the shape whose deparse is unstable across a dump/restore.
+    return pred ? [{ name: `${model.table}_${col}_check`, expr: normalizeDeparsedExpr(pred) }] : [];
   });
   const checks = [...fieldChecks, ...tableConstraints.checks];
 

package/src/cli/schema-diff.ts

@@ -41,7 +41,7 @@ import type {
 export type ConstraintSpec =
   | { type: 'unique'; name: string; columns: string[] }
   | { type: 'check'; name: string; expr: string }
-  | { type: 'foreignKey'; name: string; columns: string[]; refTable: string; refColumns: string[]; onDelete?: string; onUpdate?: string };
+  | { type: 'foreignKey'; name: string; columns: string[]; refTable: string; refColumns: string[]; onDelete?: string; onUpdate?: string; nameDeclared?: boolean };
 
 export type SchemaChange =
   | { kind: 'createTable'; table: string; schema: TableSchema }
@@ -51,6 +51,16 @@ export type SchemaChange =
   | { kind: 'setNotNull'; table: string; column: string; notNull: boolean }
   /** `expr: null` means DROP DEFAULT. */
   | { kind: 'setDefault'; table: string; column: string; expr: string | null }
+  /**
+   * `GENERATED … AS IDENTITY` added, changed, or removed. `identity: null` means DROP IDENTITY,
+   * which destroys the backing sequence's counter — so it is gated with the other removals.
+   *
+   * `from` is the live side, and it is load-bearing rather than informational: Postgres has
+   * ADD GENERATED (which refuses a column that already has one) and SET GENERATED (which
+   * refuses a column that does not), with no idempotent spelling of either. The emitter picks
+   * from `from`, so it can only ever emit the one statement that applies.
+   */
+  | { kind: 'setIdentity'; table: string; column: string; identity: 'always' | 'byDefault' | null; from: 'always' | 'byDefault' | null }
   /** A type change → real `ALTER COLUMN ... TYPE`. `risk` decides USING + a data-loss warning. */
   | { kind: 'alterType'; table: string; column: string; from: string; to: string; risk: TypeChangeRisk }
   | { kind: 'addConstraint'; table: string; constraint: ConstraintSpec }
@@ -90,6 +100,17 @@ export type SchemaChange =
   | { kind: 'createIndex'; table: string; name: string; columns: string[]; unique: boolean; where?: string; using?: string; include?: string[] }
   /** A standalone index present in the DB but no longer declared → `DROP INDEX` (a removal — gated). */
   | { kind: 'dropIndex'; table: string; name: string }
+  /** A content-identical index the model names differently → `ALTER INDEX … RENAME TO` (B3). */
+  | { kind: 'renameIndex'; table: string; from: string; to: string }
+  /** A content-identical FK the model names differently → `ALTER TABLE … RENAME CONSTRAINT` (A8). */
+  | { kind: 'renameConstraint'; table: string; from: string; to: string }
+  /**
+   * A live index REDEFINED under the same name (predicate/method/keys changed) → `DROP INDEX`
+   * ordered BEFORE its create. Distinct from `dropIndex`, which is a removal: this one loses
+   * nothing, the create immediately follows, and gating it behind `--allow-drops` would hold
+   * back half of a pair that can only fail apart.
+   */
+  | { kind: 'redefineIndex'; table: string; name: string }
   /** A declared standalone sequence missing live → `CREATE SEQUENCE`, before any table. */
   | { kind: 'createSequence'; sequence: SequenceSchema }
   /** A declared sequence whose live properties differ — a NOTICE, never a silent ALTER (it holds state). */
@@ -340,6 +361,10 @@ export function diffSchema(desired: SchemaSnapshot, current: SchemaSnapshot, ren
   const dropConstraints: SchemaChange[] = [];
   const addConstraints: SchemaChange[] = [];
   const createIndexes: SchemaChange[] = [];
+  /** Catalog-only renames — indexes (B3) and FK constraints (A8). */
+  const catalogRenames: SchemaChange[] = [];
+  /** Same-name index redefinitions — their DROP must precede the CREATE that replaces it. */
+  const redefineIndexes: SchemaChange[] = [];
   const dropIndexes: SchemaChange[] = [];
   const dropColumns: SchemaChange[] = [];
   const dropTables: SchemaChange[] = [];
@@ -441,8 +466,8 @@ export function diffSchema(desired: SchemaSnapshot, current: SchemaSnapshot, ren
     alters.push(...cd.alters);
     dropColumns.push(...cd.dropColumns);
     notices.push(...cd.notices);
-    diffConstraints(d, c, dropConstraints, addConstraints, alters);
-    diffIndexes(d, c, createIndexes, dropIndexes);
+    diffConstraints(d, c, dropConstraints, addConstraints, alters, catalogRenames);
+    diffIndexes(d, c, createIndexes, dropIndexes, catalogRenames, redefineIndexes);
   }
 
   // Sweep the POST-RENAME view: a renamed-away old name is not a drop.
@@ -497,7 +522,11 @@ export function diffSchema(desired: SchemaSnapshot, current: SchemaSnapshot, ren
     ...moveTables,
     ...renameTables,
     ...creates, ...renameColumns, ...addColumns, ...alters, ...trailingDefaults,
-    ...dropConstraints, ...addConstraints, ...createIndexes,
+    // Renames are catalog-only and precede the creates, so a declared name freed by renaming an
+    // existing object is never claimed by a fresh CREATE first.
+    // redefineIndexes immediately precede createIndexes: PostgreSQL has no CREATE OR REPLACE
+    // INDEX, so the old one must be gone before its replacement claims the name.
+    ...catalogRenames, ...dropConstraints, ...addConstraints, ...redefineIndexes, ...createIndexes,
     ...dropColumns, ...dropIndexes, ...dropTables,
     ...e.drops, ...notices, ...e.notices, ...sequenceNotices,
   ];
@@ -526,18 +555,52 @@ export function indexKey(ix: IndexSchema): string {
 }
 
 /**
- * Diff standalone indexes by content, not name: an index with the same columns, uniqueness, and
- * partial predicate is the same index whatever it's called, so a pulled index (whose DB name we
- * didn't choose) re-generates clean. A dropped index is a removal, gated like the others.
+ * Diff standalone indexes by CONTENT — an index with the same key entries, uniqueness, predicate,
+ * method and INCLUDE is the same index whatever it is called, so a pulled index re-generates
+ * clean rather than churning drop/create.
+ *
+ * B3: matching by content is right, being BLIND to the name was not. A content match that
+ * disagrees on the name is the SAME index under a different name, which is exactly an
+ * `ALTER INDEX … RENAME TO` — cheap, non-destructive, and it converges in one apply. Previously
+ * the difference produced no statement at all, so a rebuild silently renamed ~200 of one
+ * consumer's indexes and every gate stayed green: counts matched, definitions matched, and
+ * nothing compared the names.
+ *
+ * A rename is emitted only when the DECLARED name is deliberate. A model that declares no name
+ * gets the generated fallback, and renaming a database to match a name nobody chose would be
+ * churn — worse, it would fight any adopted database forever.
  */
-function diffIndexes(d: TableSchema, c: TableSchema, creates: SchemaChange[], drops: SchemaChange[]): void {
+function diffIndexes(
+  d: TableSchema,
+  c: TableSchema,
+  creates: SchemaChange[],
+  drops: SchemaChange[],
+  renames: SchemaChange[] = [],
+  redefines: SchemaChange[] = [],
+): void {
   const desiredByKey = new Map(d.indexes.map((ix) => [indexKey(ix), ix]));
   const currentByKey = new Map(c.indexes.map((ix) => [indexKey(ix), ix]));
+  // A same-NAME index whose CONTENT changed is a redefinition, not a removal, and PostgreSQL has
+  // no CREATE OR REPLACE INDEX — it must drop first. Reported by GridironDB: a full unique index
+  // became two partial ones, the new partial index derived the SAME generated name as the live
+  // one, and the emitted order was CREATE then DROP, so the create failed with "already exists".
+  // Worse without `--allow-drops`: the drop was held back as a comment and the create was emitted
+  // anyway, a pair that can only fail. Constraints already got this right (dropConstraints
+  // precede addConstraints); indexes did not, and that inconsistency was the bug.
+  const desiredNames = new Set([...desiredByKey.values()].filter((ix) => !currentByKey.has(indexKey(ix))).map((ix) => ix.name));
   for (const [k, ix] of currentByKey) {
-    if (!desiredByKey.has(k)) drops.push({ kind: 'dropIndex', table: d.table, name: ix.name });
+    if (desiredByKey.has(k)) continue;
+    // Redefinition: something DESIRED wants this exact name and does not exist yet.
+    if (desiredNames.has(ix.name)) redefines.push({ kind: 'redefineIndex', table: d.table, name: ix.name });
+    else drops.push({ kind: 'dropIndex', table: d.table, name: ix.name });
   }
   for (const [k, ix] of desiredByKey) {
-    if (!currentByKey.has(k)) creates.push(createIndexChange(d.table, ix));
+    const live = currentByKey.get(k);
+    if (!live) {
+      creates.push(createIndexChange(d.table, ix));
+    } else if (ix.nameDeclared && live.name !== ix.name) {
+      renames.push({ kind: 'renameIndex', table: d.table, from: live.name, to: ix.name });
+    }
   }
 }
 
@@ -597,6 +660,11 @@ function columnAlters(table: string, desired: ColumnSchema, source: ColumnSchema
   if (desired.type !== source.type) into.push({ kind: 'alterType', table, column: desired.name, from: source.type, to: desired.type, risk: classifyTypeChange(source.type, desired.type) });
   if (desired.notNull !== source.notNull) into.push({ kind: 'setNotNull', table, column: desired.name, notNull: desired.notNull });
   if (normalizeDefault(desired.default) !== normalizeDefault(source.default)) into.push({ kind: 'setDefault', table, column: desired.name, expr: desired.default });
+  // Emitted AFTER setDefault deliberately: Postgres refuses ADD GENERATED on a column that
+  // still holds a default, which is exactly the shape of a serial → identity migration.
+  if ((desired.identity ?? null) !== (source.identity ?? null)) {
+    into.push({ kind: 'setIdentity', table, column: desired.name, identity: desired.identity ?? null, from: source.identity ?? null });
+  }
 }
 
 function diffColumns(d: TableSchema, c: TableSchema, tableRenames: Record<string, string>): ColumnDiff {
@@ -655,7 +723,7 @@ function diffColumns(d: TableSchema, c: TableSchema, tableRenames: Record<string
 function tableConstraintSpecs(t: TableSchema): ConstraintSpec[] {
   return [
     ...t.uniques.map((u): ConstraintSpec => ({ type: 'unique', name: u.name, columns: u.columns })),
-    ...t.foreignKeys.map((fk): ConstraintSpec => ({ type: 'foreignKey', name: fk.name, columns: fk.columns, refTable: fk.refTable, refColumns: fk.refColumns, onDelete: fk.onDelete, onUpdate: fk.onUpdate })),
+    ...t.foreignKeys.map((fk): ConstraintSpec => ({ type: 'foreignKey', name: fk.name, columns: fk.columns, refTable: fk.refTable, refColumns: fk.refColumns, onDelete: fk.onDelete, onUpdate: fk.onUpdate, ...(fk.nameDeclared ? { nameDeclared: true } : {}) })),
   ];
 }
 
@@ -689,7 +757,7 @@ function diffChecks(d: TableSchema, c: TableSchema, dropConstraints: SchemaChang
   }
 }
 
-function diffConstraints(d: TableSchema, c: TableSchema, dropConstraints: SchemaChange[], addConstraints: SchemaChange[], alters: SchemaChange[]): void {
+function diffConstraints(d: TableSchema, c: TableSchema, dropConstraints: SchemaChange[], addConstraints: SchemaChange[], alters: SchemaChange[], renames: SchemaChange[] = []): void {
   // Multiset-match uniques and FKs by content: a desired constraint that finds a
   // same-content current one is unchanged (whatever either is named); an unmatched
   // desired is an add; a leftover current is dropped by its real name. A *changed*
@@ -703,8 +771,19 @@ function diffConstraints(d: TableSchema, c: TableSchema, dropConstraints: Schema
   }
   for (const des of tableConstraintSpecs(d)) {
     const bucket = currentByKey.get(constraintContentKey(des));
-    if (bucket?.length) bucket.pop();
-    else addConstraints.push({ kind: 'addConstraint', table: d.table, constraint: des });
+    if (bucket?.length) {
+      // A8, the FK half of B3: matching by content is right, being BLIND to the name was not.
+      // A content match whose DECLARED name disagrees is the same constraint under a different
+      // name — an ALTER TABLE … RENAME CONSTRAINT, not silence. Measured: a live
+      // `fk_rails_9a1b2c3d4e` against a compiled `kids_parent_id_parents_id_fk` produced ZERO
+      // changes, so a rebuild renamed every FK and no gate noticed.
+      const matched = bucket.pop()!;
+      if (des.type === 'foreignKey' && des.nameDeclared && matched.name !== des.name) {
+        renames.push({ kind: 'renameConstraint', table: d.table, from: matched.name, to: des.name });
+      }
+    } else {
+      addConstraints.push({ kind: 'addConstraint', table: d.table, constraint: des });
+    }
   }
   for (const bucket of currentByKey.values()) {
     for (const cur of bucket) dropConstraints.push({ kind: 'dropConstraint', table: d.table, name: cur.name });
@@ -737,6 +816,15 @@ const enumLiteral = (value: string): string => `'${value.replace(/'/g, "''")}'`;
  * column), or null. CREATE/ADD COLUMN must use the shorthand — it creates the backing
  * sequence, which a bare `DEFAULT nextval(...)` would reference before it exists.
  */
+/**
+ * The `GENERATED … AS IDENTITY` clause text. ONE definition, read by this emitter and by the
+ * greenfield compiler (`fieldColumnSql`) — two copies of a clause spelling is how the CREATE
+ * and the ALTER paths drift into producing different columns from the same declaration.
+ */
+export function identityClause(kind: 'always' | 'byDefault'): string {
+  return `GENERATED ${kind === 'always' ? 'ALWAYS' : 'BY DEFAULT'} AS IDENTITY`;
+}
+
 function serialSpelling(col: ColumnSchema, table: string): string | null {
   // ONLY the column's own conventional sequence is a serial declaration — the shorthand
   // creates a sequence, so spelling it for a foreign `nextval` would mint a duplicate
@@ -752,6 +840,9 @@ function serialSpelling(col: ColumnSchema, table: string): string | null {
 function columnSql(col: ColumnSchema, table: string): string {
   const serial = serialSpelling(col, table);
   let s = `${quote(col.name)} ${serial ?? col.type}`;
+  // The auto-value is the column's own property, not a default — it rides the CREATE/ADD
+  // COLUMN or the rebuilt column has none at all, and every INSERT that omits it fails.
+  if (col.identity) s += ` ${identityClause(col.identity)}`;
   // A foreign-sequence default is held out — diffSchema appends the trailing SET DEFAULT
   // (after every create), so the CREATE never references a sequence that doesn't exist yet.
   if (!serial && col.default != null && !isForeignSequenceDefault(table, col)) s += ` DEFAULT ${col.default}`;
@@ -822,6 +913,20 @@ function emitOne(change: SchemaChange, opts: EmitOptions): string {
       return change.expr == null
         ? `ALTER TABLE ${change.table} ALTER COLUMN ${quote(change.column)} DROP DEFAULT;`
         : `ALTER TABLE ${change.table} ALTER COLUMN ${quote(change.column)} SET DEFAULT ${change.expr};`;
+    case 'setIdentity': {
+      const head = `ALTER TABLE ${change.table} ALTER COLUMN ${quote(change.column)}`;
+      // DROP IDENTITY takes the backing sequence with it, and a sequence's counter is state no
+      // re-run recovers — so it warns and is held with the other removals unless --allow-drops.
+      if (change.identity == null) {
+        return `-- WARNING: DROP IDENTITY on ${quote(change.column)} (${change.table}) DROPS the backing sequence and its counter; the column keeps its rows but gains no auto-value.\n${head} DROP IDENTITY;`;
+      }
+      // A column that already has an identity takes SET GENERATED (ADD would refuse it); one
+      // that has none takes ADD GENERATED (SET would refuse it). Neither has an IF-NOT-EXISTS
+      // spelling, so the live side decides — that is what `from` is carried for.
+      return change.from == null
+        ? `${head} ADD ${identityClause(change.identity)};`
+        : `${head} SET GENERATED ${change.identity === 'always' ? 'ALWAYS' : 'BY DEFAULT'};`;
+    }
     case 'alterType': {
       const setType = `ALTER TABLE ${change.table} ALTER COLUMN ${quote(change.column)} SET DATA TYPE ${change.to}`;
       if (change.risk === 'safe') return `${setType};`;
@@ -884,6 +989,20 @@ function emitOne(change: SchemaChange, opts: EmitOptions): string {
       const schema = change.table.includes('.') ? `${change.table.split('.')[0]}.` : '';
       return `DROP INDEX ${schema}${quote(change.name)};`;
     }
+    case 'renameConstraint':
+      // Catalog-only and instant — the constraint and its backing index keep their identity.
+      return `ALTER TABLE ${change.table} RENAME CONSTRAINT ${quote(change.from)} TO ${quote(change.to)};`;
+    case 'redefineIndex': {
+      // Same statement as a removal; a DIFFERENT decision, which is why it is a different kind.
+      const schema = change.table.includes('.') ? `${change.table.split('.')[0]}.` : '';
+      return `DROP INDEX ${schema}${quote(change.name)};`;
+    }
+    case 'renameIndex': {
+      // Non-destructive and instant — a catalog rename, no rebuild. The schema qualifier comes
+      // from the table; ALTER INDEX takes it on the OLD name only.
+      const schema = change.table.includes('.') ? `${change.table.split('.')[0]}.` : '';
+      return `ALTER INDEX ${schema}${quote(change.from)} RENAME TO ${quote(change.to)};`;
+    }
     case 'enumValuesChanged':
       return `-- NOTICE: enum ${quote(change.name)} values changed ([${change.from.join(', ')}] → [${change.to.join(', ')}]) in a way Postgres can't apply in place (a removal, reorder, or rename). ADD VALUE only appends; reshaping an enum needs a manual type swap (create new type, ALTER COLUMN ... TYPE using a cast, drop old).`;
     case 'createSequence':

package/src/cli/schema-fingerprint.ts

@@ -26,7 +26,9 @@
  *    — it is not a database fact.
  *  - FUNCTIONS are excluded — they belong to the derived layer, whose own
  *    content hashes (derived-introspect) cover them. Base fingerprint + derived
- *    manifest together are the full schema state.
+ *    manifest together are the full schema state. One caveat the report carries:
+ *    a function's OWNER is in the derived hash only when the model DECLARES it,
+ *    so an undeclared owner is covered by neither and is named as unfingerprinted.
  *  - Expressions (column defaults, check predicates, partial-index WHERE) hash
  *    through the SAME normalizers the diff uses (`normalizeDefault` /
  *    `normalizeCheck`), applied to both sides in `canonicalizeState`. Without
@@ -41,8 +43,10 @@
  * Coverage is partial and SAYS SO: `UNFINGERPRINTED_SQL` enumerates what the
  * base fingerprint does not see (triggers — drift-checked separately by the
  * reconciler's provenance — domains, composite types, foreign/partitioned
- * tables, extensions) so partial coverage reads as a report, never as
+ * tables, extensions, SEQUENCE ACLs, and the OWNER of a SECURITY DEFINER
+ * function that declares none) so partial coverage reads as a report, never as
  * "covered everything". Standalone sequences left this list in v3: covered.
+ * Sequence ACLs and the schema posture are scheduled to leave it at v11.
  */
 
 import { createHash } from 'node:crypto';
@@ -110,7 +114,7 @@ import { normalizeDefault, normalizeCheck, indexKey } from './schema-diff.js';
 // it from the canonical form AND the reconciler leaves it alone, before and after. Restrictive
 // policies are never subsumed (they AND, so removing one would WIDEN), and the rule must match
 // exactly including the effective WITH CHECK.
-export const FINGERPRINT_VERSION = 9;
+export const FINGERPRINT_VERSION = 10;
 
 // ---------------------------------------------------------------------------
 // Canonical form.
@@ -326,9 +330,12 @@ export function fingerprintLive(
 
 /**
  * Objects outside both the base fingerprint (this module) and the derived
- * manifest (derived-introspect): standalone sequences (serial-owned ones are
- * column defaults, already fingerprinted), triggers, domains, composite
- * types, foreign tables, partitioned tables, and installed extensions.
+ * manifest (derived-introspect): standalone sequences, triggers, domains, composite
+ * types, foreign tables, partitioned tables, installed extensions — sequence
+ * ACLs, whose SHAPE is fingerprinted (a serial sequence rides its column default)
+ * while the PRIVILEGES on it are not — and identity columns, which the models can
+ * now say and the builder now builds, but which the hash does not yet cover.
+ * Both of those last two enter the hash at v11.
  */
 export const UNFINGERPRINTED_SQL = `
 SELECT 'trigger' AS kind, n.nspname || '.' || c.relname || '.' || t.tgname AS identity
@@ -354,6 +361,52 @@ JOIN pg_namespace n ON n.oid = c.relnamespace
 WHERE c.relkind IN ('f', 'p')
   AND n.nspname NOT IN ('pg_catalog', 'information_schema') AND n.nspname NOT LIKE 'pg_%'
 UNION ALL
+-- A6/B4, the interim before v11. A serial/identity sequence's SHAPE is fingerprinted (it rides
+-- the column default), but its ACL is not — and that ACL is load-bearing: a role that may INSERT
+-- into the table and holds nothing on the sequence fails every INSERT with "permission denied for
+-- sequence". Only sequences that actually CARRY an ACL are named; an ungranted one has nothing
+-- unfingerprinted to say. Enters the hash at v11, batched with the schema posture.
+SELECT 'sequence ACL', n.nspname || '.' || c.relname
+FROM pg_class c
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE c.relkind = 'S' AND c.relacl IS NOT NULL
+  AND n.nspname NOT IN ('pg_catalog', 'information_schema') AND n.nspname NOT LIKE 'pg_%'
+  AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = c.oid AND d.deptype = 'e')
+UNION ALL
+-- B5. A SECURITY DEFINER function executes with its OWNER's rights, so ownership is a privilege
+-- boundary. It is hashed ONLY WHEN DECLARED (derived-source's hashSourceContent prefixes the
+-- owner, so an object without one hashes byte-identically to before the feature existed), and
+-- the base fingerprint never sees functions at all. An UNDECLARED owner is therefore covered by
+-- nothing: it can change and every gate stays green. Named here so partial coverage is visible.
+--
+-- The identity carries the owner so the report SAYS who it is — "unfingerprinted" without the
+-- value is the shape of finding that gets skimmed past. SQL cannot know which functions declare
+-- an owner, so the caller filters the declared ones out (see computeFingerprintStatus).
+SELECT 'function owner', n.nspname || '.' || p.proname || ' → ' || pg_get_userbyid(p.proowner)
+FROM pg_proc p
+JOIN pg_namespace n ON n.oid = p.pronamespace
+WHERE p.prosecdef
+  AND n.nspname NOT IN ('pg_catalog', 'information_schema') AND n.nspname NOT LIKE 'pg_%'
+  AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = p.oid AND d.deptype = 'e')
+UNION ALL
+-- A14, the interim before v11. A column's GENERATED … AS IDENTITY is now READ, DECLARED and
+-- BUILT, but it is not yet hashed: the fingerprint's coverage is a version contract, and a
+-- property entering the hash inside a version makes two operators on different CLI builds
+-- disagree about the same database. So it is named here until v11 carries it, batched with the
+-- sequence ACLs and the schema posture. The gap is real and narrow: an identity that is silently
+-- dropped or flipped ALWAYS to BY DEFAULT leaves every fingerprint gate green. db:generate sees
+-- it (the differ compares it), and the round-trip oracle's pg_dump comparison catches it.
+SELECT 'identity column',
+       n.nspname || '.' || c.relname || '.' || a.attname ||
+       ' → ' || CASE a.attidentity WHEN 'a' THEN 'always' ELSE 'by default' END
+FROM pg_attribute a
+JOIN pg_class c ON c.oid = a.attrelid
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE a.attidentity IN ('a', 'd')
+  AND a.attnum > 0 AND NOT a.attisdropped
+  AND n.nspname NOT IN ('pg_catalog', 'information_schema') AND n.nspname NOT LIKE 'pg_%'
+  AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = c.oid AND d.deptype = 'e')
+UNION ALL
 SELECT 'extension', e.extname
 FROM pg_extension e
 WHERE e.extname <> 'plpgsql'