@everystack/cli 0.4.53 → 0.4.56

package/src/cli/schema-introspect.ts

@@ -15,6 +15,7 @@
 
 import { IGNORED_SCHEMAS, coerceBool, type QueryRunner } from './authz-contract.js';
 import { INTROSPECTION_SESSION, type SessionRunner } from './session.js';
+import { normalizeDeparsedExpr } from './deparse-normal.js';
 
 // ---------------------------------------------------------------------------
 // The data-layer snapshot — the structured shape both producers target.
@@ -28,10 +29,23 @@ export interface ColumnSchema {
   notNull: boolean;
   /** The DEFAULT expression (deparsed), or null. e.g. `now()`, `gen_random_uuid()`, `'draft'::text`. */
   default: string | null;
+  /**
+   * `GENERATED ALWAYS AS IDENTITY` / `GENERATED BY DEFAULT AS IDENTITY`, absent on a plain column.
+   *
+   * An identity column's auto-value lives in `pg_attribute.attidentity`, NOT in a default — so a
+   * read that only collects `pg_attrdef` sees a bare `bigint` and a rebuild produces a column with
+   * no auto-value at all. Every INSERT that omits the column then fails on NOT NULL. Measured on a
+   * consumer's `refresh_tokens.id`: token issuance died on a database built from the models.
+   *
+   * Identity implies NOT NULL in Postgres, so `notNull` is always true alongside it.
+   */
+  identity?: 'always' | 'byDefault';
 }
 
 export interface ForeignKey {
   name: string;
+  /** The name was DECLARED, not generated — see {@link IndexSchema.nameDeclared}, same rule. */
+  nameDeclared?: boolean;
   columns: string[];
   refTable: string;
   refColumns: string[];
@@ -54,6 +68,16 @@ export interface CheckConstraint {
 /** A standalone index (NOT one backing a PK or UNIQUE constraint — those are excluded). */
 export interface IndexSchema {
   name: string;
+  /**
+   * The name was DECLARED by the model, not generated from the columns.
+   *
+   * Declared-side only: introspection never sets it (the database has a name but no opinion
+   * about whether anyone chose it), and it is absent from `indexKey`, so content matching and
+   * the fingerprint are untouched. The diff reads it to decide whether a name difference is an
+   * intended `ALTER INDEX … RENAME TO` or just the generated fallback, which must never rename
+   * an adopted database to a name nobody chose.
+   */
+  nameDeclared?: boolean;
   /** Canonical key text per position: a plain column name, or anything richer verbatim —
    *  `lower(email)`, `created_at DESC`, `title text_pattern_ops` (Brick E: expression
    *  indexes, direction, and opclass are IDENTITY, not noise). Default ASC is stripped. */
@@ -126,6 +150,9 @@ SELECT
   format_type(a.atttypid, a.atttypmod) AS type,
   a.attnotnull AS not_null,
   pg_get_expr(d.adbin, d.adrelid) AS "default",
+  -- 'a' = GENERATED ALWAYS AS IDENTITY, 'd' = GENERATED BY DEFAULT, '' = a plain column.
+  -- An identity column carries NO pg_attrdef row, so without this the auto-value is invisible.
+  a.attidentity AS identity,
   a.attnum AS position
 FROM pg_attribute a
 JOIN pg_class c ON c.oid = a.attrelid
@@ -301,9 +328,19 @@ export interface ColumnRow {
   type: unknown;
   not_null: unknown;
   default: unknown;
+  /** `pg_attribute.attidentity` — 'a', 'd', or '' / absent on a read that predates the column. */
+  identity?: unknown;
   position: unknown;
 }
 
+/** `attidentity` → the IR's spelling. Anything else (including '') is a plain column. */
+export function identityKind(attidentity: unknown): 'always' | 'byDefault' | undefined {
+  const c = attidentity == null ? '' : String(attidentity);
+  if (c === 'a') return 'always';
+  if (c === 'd') return 'byDefault';
+  return undefined;
+}
+
 /**
  * Drop a precision qualifier that only restates the default.
  *
@@ -333,6 +370,7 @@ export { canonicalColumnType };
 
 export function columnRowToDescriptor(row: ColumnRow): { table: string; column: ColumnSchema; position: number } {
   const def = row.default == null ? null : String(row.default);
+  const identity = identityKind(row.identity);
   return {
     table: `${row.schema}.${row.table}`,
     position: Number(row.position),
@@ -341,6 +379,9 @@ export function columnRowToDescriptor(row: ColumnRow): { table: string; column:
       type: canonicalColumnType(String(row.type)),
       notNull: coerceBool(row.not_null),
       default: def && def.length > 0 ? def : null,
+      // Omitted, never `undefined`-valued: the key is absent on a plain column so every
+      // structural comparison of a pre-identity snapshot against a fresh one stays equal.
+      ...(identity ? { identity } : {}),
     },
   };
 }
@@ -409,9 +450,12 @@ export function constraintRowToDescriptor(row: ConstraintRow): ConstraintDescrip
       onUpdate: action('UPDATE'),
     };
   }
-  // check — keep the predicate text inside the outer CHECK ( ... )
+  // check — keep the predicate text inside the outer CHECK ( ... ), normalized.
+  // `pg_get_expr` output is NOT a fixed point under re-parse: dump a CHECK and restore it
+  // and the same server deparses it differently (measured 2026-08-10, PG13-18 alike). A
+  // restored clone would then fingerprint differently from the database it was cloned from.
   const m = def.match(/^CHECK\s*\((.*)\)$/s);
-  return { table, name: row.name, kind: 'check', expr: m ? m[1].trim() : def };
+  return { table, name: row.name, kind: 'check', expr: normalizeDeparsedExpr(m ? m[1].trim() : def) };
 }
 
 // ---------------------------------------------------------------------------
@@ -491,6 +535,9 @@ export function parseIndexDefinition(definition: string): Omit<IndexSchema, 'nam
   let where = whereMatch ? whereMatch[1].trim() : '';
   // pg_get_indexdef wraps the predicate in one pair of parens — strip it.
   if (where.startsWith('(') && parenGroup(where, 0) === where.slice(1, -1)) where = where.slice(1, -1).trim();
+  // Same fixed-point failure as CHECK predicates: a partial index's WHERE survives a
+  // dump/restore as different text for the same predicate. Normalize at the producer.
+  where = normalizeDeparsedExpr(where);
   return {
     columns,
     unique: /^CREATE\s+UNIQUE\s+INDEX/i.test(definition),
@@ -504,7 +551,10 @@ export function parseIndexDefinition(definition: string): Omit<IndexSchema, 'nam
  *  a legacy row without one keeps the old plain-columns path, so fixtures stay valid.
  *  `is_unique`/`predicate`/`method` row fields take precedence over the parsed text. */
 export function indexRowToDescriptor(row: IndexRow): { table: string; index: IndexSchema } {
-  const pred = row.predicate == null ? '' : String(row.predicate);
+  // The row's own `predicate` column takes precedence over the parsed definition text, so
+  // it is the producer that must normalize — normalizing only the parse path left the
+  // predicate unstable across a dump/restore and the fingerprint with it.
+  const pred = row.predicate == null ? '' : normalizeDeparsedExpr(String(row.predicate));
   const table = `${row.schema}.${row.table}`;
   const base = { name: row.name, unique: coerceBool(row.is_unique), ...(pred ? { where: pred } : {}) };
 

package/src/cli/schema-source.ts

@@ -55,12 +55,23 @@ function strLiteral(value: string): string {
   return `'${value.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
 }
 
-/** A `.default(<v>)` argument literal for a value default (the JSON forms drizzle accepts). */
-function defaultValueLiteral(value: unknown): string {
+/**
+ * A `.default(<v>)` argument literal for a value default (the JSON forms drizzle accepts).
+ *
+ * `builder` is the drizzle column builder the value is a default FOR, because the accepted
+ * TYPE of the literal depends on it: drizzle's `numeric`/`decimal` take a STRING, since an
+ * arbitrary-precision default routed through a JS number is lossy by construction. A pulled
+ * model renders `field.numeric(4, 2).default(0.15)` — the model vocabulary accepting a number
+ * there is fine — and passing that straight through produced `.default(0.15)`, which fails
+ * `tsc --strict` with TS2345 and blocked a consumer from adopting the generated artifact.
+ */
+function defaultValueLiteral(value: unknown, builder?: string): string {
   if (typeof value === 'string') return strLiteral(value);
   if (typeof value === 'boolean') return value ? 'true' : 'false';
   if (value === null) return 'null';
-  if (typeof value === 'number') return String(value);
+  if (typeof value === 'number') {
+    return builder === 'numeric' || builder === 'decimal' ? strLiteral(String(value)) : String(value);
+  }
   // Arrays / objects: a JSON literal is valid TS for jsonb defaults.
   return JSON.stringify(value);
 }
@@ -130,6 +141,18 @@ function baseColumnSource(columnName: string, spec: FieldSpec): { call: string;
   }
 }
 
+/**
+ * Whether the drizzle builder for this column carries `generatedAlwaysAsIdentity`.
+ *
+ * Only the integer family does (`PgIntColumnBaseBuilder`). A `field.pgType('smallint')`
+ * identity column compiles to `customType`, which has no identity builder — the DDL still
+ * carries the clause (that comes from the compiler, not from here), so the DATABASE is right
+ * and only the generated TS type is imprecise: it will ask for a value the database supplies.
+ */
+function identitySupported(builder?: string): boolean {
+  return builder === 'integer' || builder === 'bigint' || builder === 'smallint';
+}
+
 /** The hoisted const name for an enum type. `status` → `statusEnum`. */
 function enumConstName(enumName: string): string {
   return `${toCamelCase(enumName)}Enum`;
@@ -159,15 +182,22 @@ function columnModifiers(
   spec: FieldSpec,
   isComposite: boolean,
   modelsByDescriptor: Map<ModelDescriptor, { camel: string }>,
+  ctx: { builder?: string; self?: ModelDescriptor; usedTypes?: Set<string> } = {},
 ): string {
   let s = '';
   if (spec.isArray) s += '.array()';
-  if (spec.isNotNull) s += '.notNull()';
+  // Identity comes FIRST and takes `.notNull()` with it: drizzle's builder sets notNull and
+  // hasDefault itself, and `hasDefault` is what makes the column OPTIONAL on insert. Without
+  // it the generated type demands an `id` the database supplies — which is how a correct
+  // database still fails to compile at the call site.
+  const identity = identitySupported(ctx.builder) ? spec.identity : undefined;
+  if (identity) s += identity === 'always' ? '.generatedAlwaysAsIdentity()' : '.generatedByDefaultAsIdentity()';
+  else if (spec.isNotNull) s += '.notNull()';
   if (spec.isUnique) s += '.unique()';
 
   if (spec.defaultKind === 'now') s += '.defaultNow()';
   else if (spec.defaultKind === 'random') s += '.defaultRandom()';
-  else if (spec.defaultKind === 'value') s += `.default(${defaultValueLiteral(spec.default)})`;
+  else if (spec.defaultKind === 'value') s += `.default(${defaultValueLiteral(spec.default, ctx.builder)})`;
   else if (spec.defaultKind === 'sql') s += `.default(sql.raw(${strLiteral(String(spec.default))}))`;
 
   if (spec.isPrimaryKey && !isComposite) s += '.primaryKey()';
@@ -181,7 +211,17 @@ function columnModifiers(
       if (spec.onDelete) opts.push(`onDelete: ${strLiteral(spec.onDelete)}`);
       if (spec.onUpdate) opts.push(`onUpdate: ${strLiteral(spec.onUpdate)}`);
       const optsText = opts.length ? `, { ${opts.join(', ')} }` : '';
-      s += `.references(() => ${entry.camel}.${parentPk}${optsText})`;
+      // A SELF-referential FK needs drizzle's documented return-type annotation. Without it
+      // the table's own initializer references itself, TypeScript cannot infer it, and under
+      // `strict` it is TS7022 + TS7024 — which does not merely warn: the whole table
+      // degrades to `any`, so every query against it silently loses type safety in a project
+      // that otherwise builds. A reference to ANOTHER table infers fine and is left alone.
+      if (ctx.self && target === ctx.self) {
+        ctx.usedTypes?.add('AnyPgColumn');
+        s += `.references((): AnyPgColumn => ${entry.camel}.${parentPk}${optsText})`;
+      } else {
+        s += `.references(() => ${entry.camel}.${parentPk}${optsText})`;
+      }
     }
     // A reference to a model OUTSIDE the emitted set (a cross-schema FK) is omitted —
     // the runtime + relations never needed it; the DB constraint stays unmanaged.
@@ -333,6 +373,9 @@ export function compileDrizzleSource(allModels: ModelDescriptor[], _opts: Compil
 
   // --- Track which pg-core builders + drizzle-orm symbols are used ----------
   const pgCoreBuilders = new Set<string>();
+  // TYPE-only imports from pg-core (today: AnyPgColumn, for self-referential FKs). Kept apart
+  // from the value imports so the emitted `import type` line carries no runtime cost.
+  const pgCoreTypes = new Set<string>();
   // Only when something actually lands in `public` — an all-non-public model set would
   // otherwise import a builder it never calls.
   if (models.some((m) => m.schema === 'public')) pgCoreBuilders.add('pgTable');
@@ -353,7 +396,7 @@ export function compileDrizzleSource(allModels: ModelDescriptor[], _opts: Compil
       const { call, builder: pgBuilder } = baseColumnSource(toSnakeCase(key), spec);
       pgCoreBuilders.add(pgBuilder);
       if (spec.defaultKind === 'sql') pgCoreBuilders.add('sql'); // imported from 'drizzle-orm', handled below
-      const mods = columnModifiers(spec, isComposite, modelsByDescriptor);
+      const mods = columnModifiers(spec, isComposite, modelsByDescriptor, { builder: pgBuilder, self: model, usedTypes: pgCoreTypes });
       if (spec.isDeprecated) {
         // The contract phase (decision 13): the column stays in the database and
         // stays readable; the strikethrough warns new code away at author time.
@@ -457,7 +500,7 @@ export function compileDrizzleSource(allModels: ModelDescriptor[], _opts: Compil
       pgCoreBuilders.add(pgBuilder);
       // Only .array()/.notNull() can appear — defineView/defineMaterializedView
       // reject every table-structural modifier at define time.
-      const mods = columnModifiers(spec, true, modelsByDescriptor);
+      const mods = columnModifiers(spec, true, modelsByDescriptor, { builder: pgBuilder });
       colLines.push(`  ${key}: ${call}${mods},`);
     }
     const cols = `{\n${colLines.join('\n')}\n}`;
@@ -501,6 +544,9 @@ export function compileDrizzleSource(allModels: ModelDescriptor[], _opts: Compil
 
   const importLines: string[] = [];
   importLines.push(`import { ${pgCoreNames.join(', ')} } from 'drizzle-orm/pg-core';`);
+  if (pgCoreTypes.size) {
+    importLines.push(`import type { ${[...pgCoreTypes].sort().join(', ')} } from 'drizzle-orm/pg-core';`);
+  }
 
   const drizzleOrmNames: string[] = [];
   if (anyRelations) drizzleOrmNames.push('relations');

package/src/cli/security-audit.ts

@@ -43,6 +43,12 @@ export interface FunctionDescriptor {
    * A SECURITY DEFINER function owned by such a role is the maximum blast radius.
    */
   ownerBypassesRls?: boolean;
+  /**
+   * SUPERUSER (or rds_superuser member) specifically — the portable half of ownership.
+   * A scoped operator is often BYPASSRLS by design, so `ownerBypassesRls` alone cannot tell
+   * a correct design from a function left owned by the build identity. This can.
+   */
+  ownerIsSuperuser?: boolean;
 }
 
 export interface FunctionFinding {
@@ -86,12 +92,40 @@ export interface Waivers {
   secdef?: Record<string, string>;
   /** `schema.view` -> declared public column allowlist. */
   publicColumns?: Record<string, string[]>;
+  /** schema name -> justification for leaving it broadly writable. Same rule: no bare opt-out. */
+  schema?: Record<string, string>;
+}
+
+/**
+ * A schema and the two facts that decide whether it is a shadowing surface: who can CREATE in
+ * it, and what privileged code resolves through it.
+ */
+export interface SchemaDescriptor {
+  schema: string;
+  /** Grantees holding CREATE on the schema. `PUBLIC` is the pseudo-role entry. */
+  createGrantees: string[];
+  /** SECURITY DEFINER functions living in it. */
+  definerFunctions: number;
+  /** …of which carry no `SET search_path`. */
+  unpinnedDefinerFunctions: number;
+}
+
+export interface SchemaFinding {
+  /** The schema name — the waiver-match key. */
+  key: string;
+  schema: string;
+  severity: Severity;
+  reasons: string[];
+  waived: boolean;
+  waiverReason?: string;
 }
 
 export interface AuditReport {
   functions: FunctionFinding[];
   views: ViewFinding[];
-  /** Counts across both invariants, excluding waived. */
+  /** Writable-schema findings — absent when no schema ACLs were supplied (static path). */
+  schemas: SchemaFinding[];
+  /** Counts across every invariant, excluding waived. */
   red: number;
   warn: number;
 }
@@ -181,6 +215,68 @@ export function classifyFunction(
   return { key, schema: fn.schema, name: fn.name, returnType: fn.returnType, returnClass, severity, reasons, waived: false };
 }
 
+/**
+ * A10(ii) — the PRECONDITION leg: can an untrusted role CREATE in a schema that privileged code
+ * resolves through?
+ *
+ * The audit already flags an unpinned SECURITY DEFINER function and an owner that bypasses RLS.
+ * Both are about the privileged code. Neither says whether an attacker can actually plant
+ * anything for it to resolve to, and that is what separates latent debt from a live chain. A
+ * consumer asked for exactly this after finding `PUBLIC` holding CREATE on `public` across every
+ * dump-adopted database (the pre-PG15 default; PG15 removed it, so a database everystack BUILDS
+ * is hardened and one it ADOPTS is not).
+ *
+ * Tiering, and the reason it is not simply "red when SECDEF is present":
+ *
+ *   - writable by a broad role, with an UNPINNED definer function in the same schema → RED.
+ *     That is the whole chain: plant a shadow object, the unpinned function resolves through it
+ *     and runs it with the owner's rights.
+ *   - writable by a broad role, everything else → WARN. Pinning the definer functions defends
+ *     that specific chain and does NOT make the schema safe: a PUBLIC-writable schema on a
+ *     search path threatens EVERY privileged session resolving through it, including
+ *     everystack's own build/reconcile credential executing DDL with `public` on its path. A
+ *     shadow object planted there hijacks the builder, which outranks any SECDEF owner. This is
+ *     why the finding does not require a definer function to fire.
+ *
+ * Only BROAD grantees count. A named operator role holding CREATE is how schemas get built.
+ */
+export function classifySchema(schema: SchemaDescriptor, waivers: Waivers = {}): SchemaFinding {
+  const key = schema.schema;
+  const reasons: string[] = [];
+  let severity: Severity = 'ok';
+  const broad = schema.createGrantees.filter((g) => BROAD_ROLES.has(g.toLowerCase())).sort();
+
+  if (broad.length > 0) {
+    const who = broad.join(', ');
+    if (schema.unpinnedDefinerFunctions > 0) {
+      reasons.push(
+        `${who} can CREATE in schema "${key}", which holds ${schema.unpinnedDefinerFunctions} unpinned SECURITY DEFINER function(s) — `
+        + `that is a complete search_path hijack chain: plant a shadow object, the unpinned function resolves through it and runs it with the owner's rights. `
+        + `REVOKE CREATE ON SCHEMA ${key} FROM ${who}, and pin those functions.`,
+      );
+      severity = 'red';
+    } else {
+      reasons.push(
+        `${who} can CREATE in schema "${key}" — the pre-PG15 default, which PG15 removed. No unpinned SECURITY DEFINER function is here, `
+        + `but a writable schema on a search path threatens every privileged session that resolves through it, including the build credential `
+        + `running DDL. REVOKE CREATE ON SCHEMA ${key} FROM ${who}.`,
+      );
+      severity = raise(severity, 'warn');
+    }
+  }
+
+  const waiverReason = waivers.schema?.[key];
+  if (waiverReason !== undefined) {
+    if (typeof waiverReason === 'string' && waiverReason.trim().length > 0) {
+      return { key, schema: key, severity: 'ok', reasons, waived: true, waiverReason };
+    }
+    reasons.push('waiver present but missing a justification string — a waiver must explain why the schema is safe');
+    severity = raise(severity, 'red');
+  }
+
+  return { key, schema: key, severity, reasons, waived: false };
+}
+
 /** Apply Invariant B to a single view/projection. */
 export function classifyView(view: ViewDescriptor, waivers: Waivers = {}): ViewFinding {
   const key = `${view.schema}.${view.name}`;
@@ -225,18 +321,51 @@ export function audit(
   functions: FunctionDescriptor[],
   views: ViewDescriptor[],
   waivers: Waivers = {},
+  schemas: SchemaDescriptor[] = [],
 ): AuditReport {
   const fnFindings = functions.map((f) => classifyFunction(f, waivers));
   const viewFindings = views.map((v) => classifyView(v, waivers));
-  const all: { severity: Severity }[] = [...fnFindings, ...viewFindings];
+  // Empty by default: the STATIC path parses migration SQL and cannot know a schema ACL, and a
+  // silent `ok` there would be a claim the parser is not entitled to make.
+  const schemaFindings = schemas.map((s) => classifySchema(s, waivers));
+  const all: { severity: Severity }[] = [...fnFindings, ...viewFindings, ...schemaFindings];
   return {
     functions: fnFindings,
     views: viewFindings,
+    schemas: schemaFindings,
     red: all.filter((f) => f.severity === 'red').length,
     warn: all.filter((f) => f.severity === 'warn').length,
   };
 }
 
+/**
+ * Build the schema descriptors from a live authz contract — the catalog path's adapter.
+ *
+ * `schemaAcls` absent means the read never ran, and the audit must then say nothing about
+ * schemas rather than report every one of them as clean.
+ */
+export function schemaDescriptorsFromContract(
+  schemaAcls: Record<string, Record<string, string[]>> | undefined,
+  functions: readonly { name: string; securityDefiner: boolean; hasSearchPath: boolean }[],
+): SchemaDescriptor[] {
+  if (!schemaAcls) return [];
+  const schemaOf = (qualified: string): string => qualified.split('.').slice(0, -1).join('.') || 'public';
+  return Object.entries(schemaAcls)
+    .map(([schema, grants]) => {
+      const here = functions.filter((f) => f.securityDefiner && schemaOf(f.name) === schema);
+      return {
+        schema,
+        createGrantees: Object.entries(grants)
+          .filter(([, privileges]) => privileges.includes('CREATE'))
+          .map(([grantee]) => grantee)
+          .sort(),
+        definerFunctions: here.length,
+        unpinnedDefinerFunctions: here.filter((f) => !f.hasSearchPath).length,
+      };
+    })
+    .sort((a, b) => a.schema.localeCompare(b.schema));
+}
+
 function raise(current: Severity, next: Severity): Severity {
   const rank: Record<Severity, number> = { ok: 0, warn: 1, red: 2 };
   return rank[next] > rank[current] ? next : current;

package/src/cli/security-catalog.ts

@@ -43,7 +43,20 @@ SELECT
       WHERE m.member = p.proowner AND g.rolname = 'rds_superuser'
     )
     FROM pg_roles r WHERE r.oid = p.proowner
-  ) AS owner_bypasses_rls
+  ) AS owner_bypasses_rls,
+  -- SUPERUSER specifically, split out from owner_bypasses_rls. A deliberately-scoped
+  -- operator role is commonly BYPASSRLS by design, so the combined flag reads true for
+  -- the correct design AND for a function accidentally left owned by the build identity --
+  -- identical value, wildly different blast radius. This is the portable half: it separates
+  -- a scoped operator from a superuser without comparing a role NAME, which legitimately
+  -- differs between a dev machine, a deployed master and a normalized operator.
+  (
+    SELECT r.rolsuper OR EXISTS (
+      SELECT 1 FROM pg_auth_members m JOIN pg_roles g ON g.oid = m.roleid
+      WHERE m.member = p.proowner AND g.rolname = 'rds_superuser'
+    )
+    FROM pg_roles r WHERE r.oid = p.proowner
+  ) AS owner_is_superuser
 FROM pg_proc p
 JOIN pg_namespace n ON n.oid = p.pronamespace
 JOIN pg_type t ON t.oid = p.prorettype
@@ -124,6 +137,7 @@ interface FunctionRow {
   has_search_path: unknown;
   owner?: unknown;
   owner_bypasses_rls?: unknown;
+  owner_is_superuser?: unknown;
 }
 
 /** Map a pg_proc row to a descriptor, computing a precise return class. */
@@ -147,6 +161,7 @@ export function catalogFunctionToDescriptor(row: FunctionRow): FunctionDescripto
     hasSearchPath: truthy(row.has_search_path),
     owner: row.owner != null ? String(row.owner) : undefined,
     ownerBypassesRls: row.owner_bypasses_rls != null ? truthy(row.owner_bypasses_rls) : undefined,
+    ownerIsSuperuser: row.owner_is_superuser != null ? truthy(row.owner_is_superuser) : undefined,
   };
 }
 
@@ -155,9 +170,9 @@ export function catalogFunctionToDescriptor(row: FunctionRow): FunctionDescripto
  * every `introspectContract(runner, contractFunctionRow, FUNCTIONS_SQL)` call
  * site uses this instead of keeping its own copy.
  */
-export const contractFunctionRow = (row: any): { schema: string; name: string; securityDefiner: boolean; hasSearchPath: boolean; owner?: string; ownerBypassesRls?: boolean } => {
+export const contractFunctionRow = (row: any): { schema: string; name: string; securityDefiner: boolean; hasSearchPath: boolean; owner?: string; ownerBypassesRls?: boolean; ownerIsSuperuser?: boolean } => {
   const d = catalogFunctionToDescriptor(row);
-  return { schema: d.schema, name: d.name, securityDefiner: d.securityDefiner, hasSearchPath: d.hasSearchPath, owner: d.owner, ownerBypassesRls: d.ownerBypassesRls };
+  return { schema: d.schema, name: d.name, securityDefiner: d.securityDefiner, hasSearchPath: d.hasSearchPath, owner: d.owner, ownerBypassesRls: d.ownerBypassesRls, ownerIsSuperuser: d.ownerIsSuperuser };
 };
 
 interface RelationRow {

package/src/cli/state-apply.ts

@@ -115,6 +115,10 @@ const ADDITIVE_MATCHERS: RegExp[] = [
   // Relaxing nullability and setting a default add capability; they remove nothing.
   /^ALTER\s+TABLE\s+[\s\S]+?\sALTER\s+COLUMN\s+[\s\S]+?\sDROP\s+NOT\s+NULL\b/,
   /^ALTER\s+TABLE\s+[\s\S]+?\sALTER\s+COLUMN\s+[\s\S]+?\sSET\s+DEFAULT\b/,
+  // Giving a column an auto-value adds capability and removes nothing. Its sibling
+  // `SET GENERATED ALWAYS` is deliberately NOT here — it starts REFUSING client-supplied
+  // values, so a human reads it as `unclassified` rather than being told it is safe.
+  /^ALTER\s+TABLE\s+[\s\S]+?\sALTER\s+COLUMN\s+[\s\S]+?\sADD\s+GENERATED\b/,
 ];
 
 /**
@@ -195,7 +199,9 @@ export function classifyDestructive(
   const narrowings: string[] = [];
   const strips: string[] = [];
   for (const statement of executable) {
-    if (/\bDROP\s+(TABLE|COLUMN|TYPE)\b/.test(statement)) drops.push(statement);
+    // DROP IDENTITY is a drop: it takes the backing sequence and its counter with it, and a
+    // counter is state no re-run reconstructs. The column's rows survive; its auto-value does not.
+    if (/\bDROP\s+(TABLE|COLUMN|TYPE|IDENTITY)\b/.test(statement)) drops.push(statement);
     else if (/\bSET DATA TYPE\b/.test(statement) && /\bUSING\b/.test(statement)) narrowings.push(statement);
     else if (opts.declaredGrantees) {
       // Only classified when the caller supplied the declared side — without it there is
@@ -347,6 +353,9 @@ export interface StateSyncOptions extends StateApplyOptions {
   allowDrops?: boolean;
   /** Standalone sequences — the verify re-diff must see the same declared state as the plan. */
   sequences?: SequenceDescriptor[];
+  /** Extensions the modules declare — the re-generated stream must carry them too, or a
+   *  verify-after re-plan disagrees with the plan that was applied. */
+  extensions?: string[];
 }
 
 export interface StateSyncOutcome {
@@ -406,7 +415,7 @@ export async function applyStateAndVerify(
   }
 
   const remaining = classifyGeneratedStatements(
-    generateMigrationSql(models, snapshot, { allowDrops: options.allowDrops, liveAuthz: contract, sequences: options.sequences }),
+    generateMigrationSql(models, snapshot, { allowDrops: options.allowDrops, liveAuthz: contract, sequences: options.sequences, extensions: options.extensions }),
   ).executable;
 
   return {