@intentius/chant-lexicon-sql 0.124.45 → 0.124.48

package/src/postgres/live/catalog-kinds.ts

@@ -23,6 +23,7 @@ import { notExtensionOwned, scopeSql, type LivePgObject, type SchemaScope } from
 import { POSTGRES_ENTITY_TYPES } from "../entity-types";
 import { quoteIdent } from "../keywords";
 import { stripMarker } from "../../core/ownership";
+import { isSecretOption } from "../secret-options";
 
 type Row = Record<string, unknown>;
 
@@ -310,3 +311,225 @@ export async function readRoutineKinds(client: PostgresClient, scope: SchemaScop
   }
   return out;
 }
+
+/** An operator named by another's COMMUTATOR or NEGATOR, as `OPERATOR(schema.symbol)`. */
+const operatorRef = (column: string): string =>
+  `(SELECT 'OPERATOR(' || pg_catalog.quote_ident(rn.nspname) || '.' || r.oprname || ')' FROM pg_catalog.pg_operator r JOIN pg_catalog.pg_namespace rn ON rn.oid = r.oprnamespace WHERE r.oid = ${column})`;
+
+/**
+ * Operators: the ones a schema defines, not the server's own (oids below the
+ * first normal object id) or an extension's. Identified by name and operand
+ * types, `NONE` for a missing side (`DROP OPERATOR`'s spelling).
+ */
+export async function readOperators(client: PostgresClient, scope: SchemaScope): Promise<LivePgObject[]> {
+  const s = scopeSql("n.nspname", scope);
+  const rows = await client.query<Row>(
+    `SELECT o.oid::text AS oid, n.nspname AS schema, o.oprname AS name,
+            CASE WHEN o.oprleft <> 0 THEN pg_catalog.format_type(o.oprleft, NULL) END AS leftarg,
+            CASE WHEN o.oprright <> 0 THEN pg_catalog.format_type(o.oprright, NULL) END AS rightarg,
+            ${proc("o.oprcode::pg_catalog.regproc")} AS func, ${operatorRef("o.oprcom")} AS commutator, ${operatorRef("o.oprnegate")} AS negator,
+            ${proc("o.oprrest::pg_catalog.regproc")} AS restrict, ${proc("o.oprjoin::pg_catalog.regproc")} AS join_func,
+            o.oprcanhash AS hashes, o.oprcanmerge AS merges,
+            pg_catalog.obj_description(o.oid, 'pg_operator') AS comment, ${dependentsOf("pg_operator", "o.oid")} AS dependents
+     FROM pg_catalog.pg_operator o JOIN pg_catalog.pg_namespace n ON n.oid = o.oprnamespace
+     WHERE ${s.sql} AND o.oid >= 16384 AND ${notExtensionOwned("pg_operator", "o.oid")}
+     ORDER BY n.nspname ${C}, o.oprname ${C}, pg_catalog.format_type(o.oprleft, NULL) ${C} NULLS FIRST, pg_catalog.format_type(o.oprright, NULL) ${C} NULLS FIRST`,
+    s.params,
+  );
+  return rows.map((r) => {
+    const left = str(r.leftarg);
+    const right = str(r.rightarg);
+    const signature = `(${left ?? "NONE"},${right ?? "NONE"})`;
+    const name = `${quoteIdent(String(r.schema))}.${r.name}`;
+    const opts = [`FUNCTION = ${r.func}`];
+    if (left) opts.push(`LEFTARG = ${left}`);
+    if (right) opts.push(`RIGHTARG = ${right}`);
+    if (str(r.commutator)) opts.push(`COMMUTATOR = ${r.commutator}`);
+    if (str(r.negator)) opts.push(`NEGATOR = ${r.negator}`);
+    if (str(r.restrict)) opts.push(`RESTRICT = ${r.restrict}`);
+    if (str(r.join_func)) opts.push(`JOIN = ${r.join_func}`);
+    if (r.hashes === true) opts.push("HASHES");
+    if (r.merges === true) opts.push("MERGES");
+    return {
+      type: POSTGRES_ENTITY_TYPES.operator,
+      schema: String(r.schema),
+      name: String(r.name),
+      oid: String(r.oid),
+      signature,
+      ...withComment(r),
+      ...dependents(r),
+      statement: [`CREATE OPERATOR ${name} (${opts.join(", ")})`, ...commentOn(`OPERATOR ${name}${signature}`, r.comment)].join(";\n"),
+    };
+  });
+}
+
+/** An `OPTIONS (...)` clause from a catalog `text[]` of `name=value`, and the names left out because they hold a credential. */
+function optionsOf(raw: unknown): { clause: string; omitted: string[] } {
+  const kept: string[] = [];
+  const omitted: string[] = [];
+  for (const entry of (raw as string[] | null) ?? []) {
+    const at = entry.indexOf("=");
+    const name = at < 0 ? entry : entry.slice(0, at);
+    if (isSecretOption(name)) omitted.push(name);
+    else kept.push(`${quoteIdent(name)} ${literal(at < 0 ? "" : entry.slice(at + 1))}`);
+  }
+  return { clause: kept.length > 0 ? ` OPTIONS (${kept.join(", ")})` : "", omitted };
+}
+
+const omittedWarning = (omitted: readonly string[]): { warnings?: string[] } =>
+  omitted.length > 0 ? { warnings: [`the option${omitted.length === 1 ? "" : "s"} ${omitted.join(", ")} hold${omitted.length === 1 ? "s" : ""} a credential and ${omitted.length === 1 ? "is" : "are"} left out; the environment supplies it`] } : {};
+
+/**
+ * The kinds of object #3911 adds that belong to the database or hang off a
+ * table: extended statistics (printed by the server), foreign data wrappers
+ * and servers, and publications, each assembled from its catalog rows. A
+ * wrapper, server or publication is the database's, so the schema scope does
+ * not narrow it. A credential in an option is left out and said so.
+ */
+export async function readDatabaseKinds(client: PostgresClient, scope: SchemaScope): Promise<LivePgObject[]> {
+  const out: LivePgObject[] = [...(await readOperators(client, scope))];
+
+  const s = scopeSql("n.nspname", scope);
+  const stats = await client.query<Row>(
+    `SELECT e.oid::text AS oid, n.nspname AS schema, e.stxname AS name, pg_catalog.pg_get_statisticsobjdef(e.oid) AS def,
+            pg_catalog.obj_description(e.oid, 'pg_statistic_ext') AS comment
+     FROM pg_catalog.pg_statistic_ext e JOIN pg_catalog.pg_namespace n ON n.oid = e.stxnamespace
+     WHERE ${s.sql} AND ${notExtensionOwned("pg_statistic_ext", "e.oid")}
+     ORDER BY n.nspname ${C}, e.stxname ${C}`,
+    s.params,
+  );
+  for (const r of stats) {
+    const q = qname(String(r.schema), String(r.name));
+    out.push({
+      type: POSTGRES_ENTITY_TYPES.statistics,
+      schema: String(r.schema),
+      name: String(r.name),
+      oid: String(r.oid),
+      ...withComment(r),
+      statement: [String(r.def), ...commentOn(`STATISTICS ${q}`, r.comment)].join(";\n"),
+    });
+  }
+
+  const wrappers = await client.query<Row>(
+    `SELECT w.oid::text AS oid, w.fdwname AS name, ${proc("w.fdwhandler::pg_catalog.regproc")} AS handler, ${proc("w.fdwvalidator::pg_catalog.regproc")} AS validator,
+            w.fdwoptions AS options, pg_catalog.obj_description(w.oid, 'pg_foreign_data_wrapper') AS comment, ${dependentsOf("pg_foreign_data_wrapper", "w.oid")} AS dependents
+     FROM pg_catalog.pg_foreign_data_wrapper w
+     WHERE ${notExtensionOwned("pg_foreign_data_wrapper", "w.oid")}
+     ORDER BY w.fdwname ${C}`,
+  );
+  for (const r of wrappers) {
+    const name = quoteIdent(String(r.name));
+    const { clause, omitted } = optionsOf(r.options);
+    out.push({
+      type: POSTGRES_ENTITY_TYPES.foreignDataWrapper,
+      name: String(r.name),
+      oid: String(r.oid),
+      ...withComment(r),
+      ...dependents(r),
+      ...omittedWarning(omitted),
+      statement: [
+        `CREATE FOREIGN DATA WRAPPER ${name}${str(r.handler) ? ` HANDLER ${r.handler}` : ""}${str(r.validator) ? ` VALIDATOR ${r.validator}` : ""}${clause}`,
+        ...commentOn(`FOREIGN DATA WRAPPER ${name}`, r.comment),
+      ].join(";\n"),
+    });
+  }
+
+  const servers = await client.query<Row>(
+    `SELECT v.oid::text AS oid, v.srvname AS name, v.srvtype AS type, v.srvversion AS version, w.fdwname AS wrapper, v.srvoptions AS options,
+            pg_catalog.obj_description(v.oid, 'pg_foreign_server') AS comment, ${dependentsOf("pg_foreign_server", "v.oid")} AS dependents
+     FROM pg_catalog.pg_foreign_server v JOIN pg_catalog.pg_foreign_data_wrapper w ON w.oid = v.srvfdw
+     WHERE ${notExtensionOwned("pg_foreign_server", "v.oid")}
+     ORDER BY v.srvname ${C}`,
+  );
+  for (const r of servers) {
+    const name = quoteIdent(String(r.name));
+    const { clause, omitted } = optionsOf(r.options);
+    out.push({
+      type: POSTGRES_ENTITY_TYPES.foreignServer,
+      name: String(r.name),
+      oid: String(r.oid),
+      ...withComment(r),
+      ...dependents(r),
+      ...omittedWarning(omitted),
+      statement: [
+        `CREATE SERVER ${name}${str(r.type) ? ` TYPE ${literal(String(r.type))}` : ""}${str(r.version) ? ` VERSION ${literal(String(r.version))}` : ""} FOREIGN DATA WRAPPER ${quoteIdent(String(r.wrapper))}${clause}`,
+        ...commentOn(`SERVER ${name}`, r.comment),
+      ].join(";\n"),
+    });
+  }
+
+  out.push(...(await readPublications(client)));
+  return out;
+}
+
+/** Publications. Column lists, row filters and schema members are 15's; they are read where the catalog has them. */
+async function readPublications(client: PostgresClient): Promise<LivePgObject[]> {
+  const has = async (catalog: string, column?: string): Promise<boolean> => {
+    const rows = await client.query<Row>(
+      column
+        ? `SELECT 1 AS x FROM pg_catalog.pg_attribute WHERE attrelid = to_regclass('pg_catalog.${catalog}') AND attname = '${column}' AND NOT attisdropped`
+        : `SELECT 1 AS x WHERE to_regclass('pg_catalog.${catalog}') IS NOT NULL`,
+    );
+    return rows.length > 0;
+  };
+  const columnLists = await has("pg_publication_rel", "prattrs");
+  const schemaMembers = await has("pg_publication_namespace");
+
+  const pubs = await client.query<Row>(
+    `SELECT p.oid::text AS oid, p.pubname AS name, p.puballtables AS alltables, p.pubinsert, p.pubupdate, p.pubdelete, p.pubtruncate,
+            pg_catalog.to_jsonb(p) AS def, pg_catalog.obj_description(p.oid, 'pg_publication') AS comment
+     FROM pg_catalog.pg_publication p
+     WHERE ${notExtensionOwned("pg_publication", "p.oid")}
+     ORDER BY p.pubname ${C}`,
+  );
+  const out: LivePgObject[] = [];
+  for (const r of pubs) {
+    const name = quoteIdent(String(r.name));
+    const d = (typeof r.def === "string" ? JSON.parse(r.def) : r.def) as Record<string, unknown>;
+    const tables = r.alltables
+      ? []
+      : await client.query<Row>(
+          `SELECT n.nspname AS schema, c.relname AS name,
+                  ${columnLists ? "ARRAY(SELECT pg_catalog.quote_ident(a.attname) FROM pg_catalog.pg_attribute a WHERE a.attrelid = r.prrelid AND a.attnum = ANY(r.prattrs::pg_catalog.int2[]) ORDER BY a.attnum)" : "NULL::text[]"} AS columns,
+                  ${columnLists ? "pg_catalog.pg_get_expr(r.prqual, r.prrelid)" : "NULL::text"} AS filter
+           FROM pg_catalog.pg_publication_rel r JOIN pg_catalog.pg_class c ON c.oid = r.prrelid JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+           WHERE r.prpubid = $1::oid ORDER BY n.nspname ${C}, c.relname ${C}`,
+          [String(r.oid)],
+        );
+    const schemas =
+      schemaMembers && !r.alltables
+        ? await client.query<Row>(
+            `SELECT n.nspname AS name FROM pg_catalog.pg_publication_namespace pn JOIN pg_catalog.pg_namespace n ON n.oid = pn.pnnspid WHERE pn.pnpubid = $1::oid ORDER BY n.nspname ${C}`,
+            [String(r.oid)],
+          )
+        : [];
+    const members = [
+      ...tables.map((t) => {
+        const columns = (t.columns as string[] | null) ?? [];
+        return `${qname(String(t.schema), String(t.name))}${columns.length > 0 ? ` (${columns.join(", ")})` : ""}${str(t.filter) ? ` WHERE (${t.filter})` : ""}`;
+      }),
+    ];
+    const clauses: string[] = [];
+    if (r.alltables) clauses.push("FOR ALL TABLES");
+    else if (members.length > 0 || schemas.length > 0) {
+      const parts: string[] = [];
+      if (members.length > 0) parts.push(`TABLE ${members.join(", ")}`);
+      if (schemas.length > 0) parts.push(`TABLES IN SCHEMA ${schemas.map((x) => quoteIdent(String(x.name))).join(", ")}`);
+      clauses.push(`FOR ${parts.join(", ")}`);
+    }
+    const publish = [r.pubinsert && "insert", r.pubupdate && "update", r.pubdelete && "delete", r.pubtruncate && "truncate"].filter(Boolean);
+    const options: string[] = [];
+    if (publish.length !== 4) options.push(`publish = ${literal(publish.join(", "))}`);
+    if (d.pubviaroot === true) options.push("publish_via_partition_root = true");
+    if (d.pubgencols !== undefined && d.pubgencols !== "n") options.push("publish_generated_columns = stored");
+    if (options.length > 0) clauses.push(`WITH (${options.join(", ")})`);
+    out.push({
+      type: POSTGRES_ENTITY_TYPES.publication,
+      name: String(r.name),
+      oid: String(r.oid),
+      ...withComment(r),
+      statement: [`CREATE PUBLICATION ${name}${clauses.length > 0 ? ` ${clauses.join(" ")}` : ""}`, ...commentOn(`PUBLICATION ${name}`, r.comment)].join(";\n"),
+    });
+  }
+  return out;
+}

package/src/postgres/live/catalog.ts

@@ -53,7 +53,7 @@ import { MIGRATION_TRAILER_KEY } from "../migrate/names";
 import { isProviderOwned, providerData } from "../providers";
 import { FOREIGN_TABLES } from "../../core/foreign-tables";
 import type { PostgresProvider } from "../providers/types";
-import { readCollations, readRoutineKinds, readTypeKinds } from "./catalog-kinds";
+import { readCollations, readDatabaseKinds, readRoutineKinds, readTypeKinds } from "./catalog-kinds";
 
 /** The server's own schemas, never part of a declared schema. */
 export const SYSTEM_SCHEMAS = ["pg_catalog", "information_schema", "pg_toast"];
@@ -83,6 +83,8 @@ export interface LivePgObject {
   dependents?: string[];
   /** Why no declaration can hold this object; it is read so import can say it left it out. */
   unsupported?: string;
+  /** What was left out of an object that is otherwise read (an option that holds a credential), for import to say. */
+  warnings?: string[];
 }
 
 /** What {@link readLiveSchema} reads. */
@@ -629,6 +631,9 @@ export async function readLiveSchema(client: PostgresClient, scope: SchemaScope
   // Aggregates, casts and event triggers, after the functions they call (#3911).
   out.push(...(await readRoutineKinds(client, scope)));
 
+  // Extended statistics, foreign data wrappers and servers, and publications (#3911).
+  out.push(...(await readDatabaseKinds(client, scope)));
+
   // Triggers: the ones written by hand, not a foreign key's or a partition's clone of its parent's.
   {
     const rows = await client.query<Row>(

package/src/postgres/live/database-kinds.e2e.test.ts

@@ -0,0 +1,164 @@
+/**
+ * Extended statistics, foreign data wrappers, foreign servers and
+ * publications against a live server (#3911): applied as declared, they plan
+ * with no change and read back with no drift; a definition changed in the
+ * declaration is altered in place (SQLPG303) or dropped and created
+ * (SQLPG300); an import writes each back as the declaration it came from,
+ * which plans with no change.
+ *
+ * The server: a throwaway one at the pin, skipped cleanly when Docker is not
+ * available. A foreign data wrapper takes a superuser, which the throwaway
+ * server's user is.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { dockerAvailable, startTestPostgres, type TestPostgres } from "../testing/server";
+import { connectPostgres, type PostgresClient, type PostgresEndpoint } from "./client";
+import { readLiveSchema } from "./catalog";
+import { planPgAgainstServer } from "../plan/commands";
+import { observeResourcesDeep, liveProps } from "../plan/deep";
+import { postgresApply } from "../../op/activities/postgres-apply";
+import { objectsToIR } from "../import/ir";
+import { PostgresGenerator, postgresTemplates } from "../import/generator";
+import { declaredObjects } from "../apply/apply";
+
+const SCHEMA = "chant_e2e_3911b";
+const enabled = await dockerAvailable();
+const dir = mkdtempSync(join(tmpdir(), "chant-pg-database-kinds-"));
+let server: TestPostgres | undefined;
+let endpoint: PostgresEndpoint;
+let admin: PostgresClient;
+
+beforeAll(async () => {
+  if (!enabled) return;
+  server = await startTestPostgres();
+  endpoint = server.endpoint();
+  admin = await connectPostgres(endpoint);
+}, 600_000);
+
+afterAll(async () => {
+  await admin?.end();
+  await server?.stop();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+interface Obj {
+  export: string;
+  type: string;
+  ddl: string;
+  dependsOn?: string[];
+}
+
+const MARKER = { stack: "e2e3911b", env: "test" };
+const profile = () => ({
+  config: { ownership: MARKER, sql: { profiles: { e2e: { url: endpoint.url, password: { env: "PG_E2E_PASSWORD" }, schemas: [SCHEMA] } } } },
+  env: { PG_E2E_PASSWORD: endpoint.password ?? "" },
+});
+
+function writeBuild(file: string, objects: Obj[]): string {
+  const path = join(dir, file);
+  writeFileSync(path, JSON.stringify({ dialect: "postgres", postgresMajor: 18, objects: objects.map((o) => ({ dependsOn: [], ...o })) }));
+  return path;
+}
+
+const apply = (path: string) => postgresApply({ buildPath: path, environment: "e2e" }, undefined, { ...profile(), log: () => undefined });
+const plan = (path: string) => planPgAgainstServer("e2e", path, profile());
+
+const S = SCHEMA;
+interface Version {
+  /** The statistics' kinds. */
+  kinds: string;
+  /** The wrapper's options. */
+  fdwOptions: string;
+  /** The server's version and options. */
+  server: string;
+  /** The publication's tables and options. */
+  publication: string;
+}
+
+const objects = (v: Version): Obj[] => [
+  { export: "app", type: "Postgres::Schema", ddl: `CREATE SCHEMA ${S}` },
+  { export: "orders", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${S}.orders (id int PRIMARY KEY, user_id int, status text)` },
+  { export: "events", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${S}.events (id int PRIMARY KEY)` },
+  { export: "ordersStats", type: "Postgres::Statistics", dependsOn: ["orders"], ddl: `CREATE STATISTICS ${S}.orders_stats ${v.kinds} ON user_id, status FROM ${S}.orders;\nCOMMENT ON STATISTICS ${S}.orders_stats IS 'Correlated'` },
+  { export: "appFdw", type: "Postgres::ForeignDataWrapper", ddl: `CREATE FOREIGN DATA WRAPPER app_fdw_3911 ${v.fdwOptions};\nCOMMENT ON FOREIGN DATA WRAPPER app_fdw_3911 IS 'Remote'` },
+  { export: "replica", type: "Postgres::ForeignServer", dependsOn: ["appFdw"], ddl: `CREATE SERVER replica_3911 ${v.server} FOREIGN DATA WRAPPER app_fdw_3911 OPTIONS (host 'db.internal');\nCOMMENT ON SERVER replica_3911 IS 'The replica'` },
+  { export: "pub", type: "Postgres::Publication", dependsOn: ["orders", "events"], ddl: `CREATE PUBLICATION pub_3911 ${v.publication};\nCOMMENT ON PUBLICATION pub_3911 IS 'Order changes'` },
+];
+
+const V1: Version = {
+  kinds: "(dependencies)",
+  fdwOptions: "OPTIONS (debug 'true')",
+  server: "TYPE 'pg' VERSION '16'",
+  publication: `FOR TABLE ${S}.orders WITH (publish = 'insert, update')`,
+};
+// Each kind changed: the statistics' kinds (drop and create), the wrapper's options, the server's version and the publication's tables and options (in place).
+const V2: Version = {
+  kinds: "(ndistinct)",
+  fdwOptions: "OPTIONS (debug 'false', trace 'on')",
+  server: "TYPE 'pg' VERSION '17'",
+  publication: `FOR TABLE ${S}.events WITH (publish = 'insert')`,
+};
+
+describe.skipIf(!enabled)("statistics, foreign servers and publications on a live server", () => {
+  test("apply, plan, drift, change and import", async () => {
+    const v1 = writeBuild("v1.json", objects(V1));
+    const first = await apply(v1);
+    expect(first.failed).toEqual([]);
+    expect(first.applied.map((a) => [a.name, a.action])).toEqual([
+      [S, "created"],
+      [`${S}.orders`, "created"],
+      [`${S}.events`, "created"],
+      [`${S}.orders_stats`, "created"],
+      ["app_fdw_3911", "created"],
+      ["replica_3911", "created"],
+      ["pub_3911", "created"],
+    ]);
+
+    // As declared: no change, and no drift.
+    expect((await plan(v1)).changes).toEqual([]);
+    const declared = declaredObjects(JSON.stringify({ dialect: "postgres", objects: objects(V1).map((o) => ({ dependsOn: [], ...o })) }));
+    const entities = new Map(declared.map((o) => [o.exportName, { entityType: o.type, props: o.props }]));
+    const deep = await observeResourcesDeep({ environment: "e2e", entityNames: [...entities.keys()], entities, ...profile() });
+    expect(deep.unobserved ?? {}).toEqual({});
+
+    // Changed by hand: drift, in the plan.
+    await admin.query(`ALTER SERVER replica_3911 OPTIONS (SET host 'elsewhere')`);
+    expect((await plan(v1)).changes.map((c) => [c.object, c.field, c.rule])).toEqual([["replica (replica_3911)", "options", "SQLPG303"]]);
+    await admin.query(`ALTER SERVER replica_3911 OPTIONS (SET host 'db.internal')`);
+
+    // Changed in the declaration: the statistics are dropped and created; the rest altered in place.
+    const v2 = writeBuild("v2.json", objects(V2));
+    const planned = await plan(v2);
+    expect(planned.changes.map((c) => [c.object, c.rule])).toEqual([
+      [`ordersStats (${S}.orders_stats)`, "SQLPG300"],
+      ["appFdw (app_fdw_3911)", "SQLPG303"],
+      ["replica (replica_3911)", "SQLPG303"],
+      ["pub (pub_3911)", "SQLPG303"],
+      ["pub (pub_3911)", "SQLPG303"],
+      ["pub (pub_3911)", "SQLPG303"],
+    ]);
+    expect(planned.refused).toEqual([]);
+    const second = await apply(v2);
+    expect(second.failed).toEqual([]);
+    expect((await plan(v2)).changes).toEqual([]);
+    expect((await admin.query<{ n: number }>(`SELECT count(*)::int AS n FROM pg_publication_rel r JOIN pg_publication p ON p.oid = r.prpubid WHERE p.pubname = 'pub_3911'`))[0]!.n).toBe(1);
+
+    // Import: the server's own printing, written back as declarations that parse and plan with no change.
+    const live = await readLiveSchema(admin, { schemas: [S] });
+    for (const o of live) liveProps(o);
+    const ir = objectsToIR(live.map((o) => ({ type: o.type, ...(o.schema ? { schema: o.schema } : {}), name: o.name, ddl: o.statement })));
+    const [file] = new PostgresGenerator().generate(ir);
+    expect(file!.content).toContain("export const ordersStats = statistics`");
+    expect(file!.content).toContain("export const appFdw3911 = foreignDataWrapper`");
+    expect(file!.content).toContain("FOREIGN DATA WRAPPER ${appFdw3911}");
+    expect(file!.content).toContain("export const pub3911 = publication`");
+    const items = ir.resources.map((r) => ({ exportName: r.logicalId, type: r.type, ...(r.properties.schema ? { schema: String(r.properties.schema) } : {}), name: String(r.properties.name), ddl: String(r.properties.ddl) }));
+    const { order } = postgresTemplates(items);
+    const imported = writeBuild("imported.json", order.map((it) => ({ export: it.exportName, type: it.type, ddl: it.ddl })));
+    expect((await plan(imported)).changes).toEqual([]);
+  }, 600_000);
+});

package/src/postgres/live/describe-resources.ts

@@ -34,6 +34,14 @@ interface Bound {
   byKey: Map<string, LivePgObject>;
 }
 
+/** The entity types that belong to the database, not a schema. */
+const UNPLACED: ReadonlySet<string> = new Set([
+  POSTGRES_ENTITY_TYPES.eventTrigger,
+  POSTGRES_ENTITY_TYPES.foreignDataWrapper,
+  POSTGRES_ENTITY_TYPES.foreignServer,
+  POSTGRES_ENTITY_TYPES.publication,
+]);
+
 /**
  * The schema and name a declared entity is created as; a bare name is in the
  * default schema. A routine's parameter types and a trigger's table tell it
@@ -41,7 +49,7 @@ interface Bound {
  */
 export function declaredAddress(entity: { type: string; props: Record<string, unknown> }, defaultSchema: string): { schema?: string; name: string; signature?: string } {
   const name = String(entity.props.name ?? "");
-  if (entity.type === POSTGRES_ENTITY_TYPES.schema || entity.type === POSTGRES_ENTITY_TYPES.extension || entity.type === POSTGRES_ENTITY_TYPES.role || entity.type === POSTGRES_ENTITY_TYPES.eventTrigger) return { name };
+  if (entity.type === POSTGRES_ENTITY_TYPES.schema || entity.type === POSTGRES_ENTITY_TYPES.extension || entity.type === POSTGRES_ENTITY_TYPES.role || UNPLACED.has(entity.type)) return { name };
   // A cast is named by its two types, as the catalog prints them.
   if (entity.type === POSTGRES_ENTITY_TYPES.cast) return { name: canonicalPgObject(entity.type, entity.props, defaultSchema).name };
   const schema = typeof entity.props.schema === "string" ? entity.props.schema : identValue(defaultSchema);
@@ -49,6 +57,7 @@ export function declaredAddress(entity: { type: string; props: Record<string, un
     entity.type === POSTGRES_ENTITY_TYPES.function ||
     entity.type === POSTGRES_ENTITY_TYPES.procedure ||
     entity.type === POSTGRES_ENTITY_TYPES.aggregate ||
+    entity.type === POSTGRES_ENTITY_TYPES.operator ||
     entity.type === POSTGRES_ENTITY_TYPES.trigger ||
     entity.type === POSTGRES_ENTITY_TYPES.policy
   ) {
@@ -79,7 +88,7 @@ export function scopeFor(target: PostgresTarget, entities: ReadonlyArray<{ type:
   if (entities.length === 0) return undefined;
   const out = new Set<string>([target.defaultSchema]);
   // The schema alone: the rest of an address (a routine's parameter types) needs props a caller may not have.
-  const unplaced = new Set<string>([POSTGRES_ENTITY_TYPES.extension, POSTGRES_ENTITY_TYPES.role, POSTGRES_ENTITY_TYPES.cast, POSTGRES_ENTITY_TYPES.eventTrigger]);
+  const unplaced = new Set<string>([POSTGRES_ENTITY_TYPES.extension, POSTGRES_ENTITY_TYPES.role, POSTGRES_ENTITY_TYPES.cast, ...UNPLACED]);
   for (const e of entities) {
     if (e.type === POSTGRES_ENTITY_TYPES.schema) out.add(String(e.props.name ?? ""));
     else if (!unplaced.has(e.type)) out.add(typeof e.props.schema === "string" ? e.props.schema : identValue(target.defaultSchema));

package/src/postgres/live/undeclarable.e2e.test.ts

@@ -1,10 +1,12 @@
 /**
  * Import against a real Postgres server never leaves an object out without a
  * word (#3911): a database holding a rewrite rule, an encoding conversion, an
- * access method and a shell type beside a table fails the import, which
- * names all four; with `skipUndeclarable` the rest is imported and the four
- * are warnings. A composite type, an aggregate, a collation, a cast and an
- * event trigger are declared kinds, so they are imported, not refused. What
+ * access method, a shell type, a user mapping and a subscription (the last
+ * two carry credentials) beside a table fails the import, which names all
+ * six; with `skipUndeclarable` the rest is imported and the six are warnings.
+ * A composite type, an aggregate, a collation, a cast, an event trigger, a
+ * foreign data wrapper, a foreign server and a publication are declared
+ * kinds, so they are imported, not refused. What
  * an extension brings (hstore's casts and operators) is the extension's, and
  * is not refused.
  *
@@ -36,6 +38,11 @@ CREATE RULE users_notify AS ON INSERT TO app.users DO ALSO NOTIFY users;
 CREATE CONVERSION app.latin1_utf8 FOR 'LATIN1' TO 'UTF8' FROM iso8859_1_to_utf8;
 CREATE ACCESS METHOD heap2 TYPE TABLE HANDLER heap_tableam_handler;
 CREATE TYPE app.later;
+CREATE FOREIGN DATA WRAPPER app_fdw;
+CREATE SERVER app_remote FOREIGN DATA WRAPPER app_fdw OPTIONS (host 'db.internal');
+CREATE USER MAPPING FOR PUBLIC SERVER app_remote OPTIONS (user 'reader');
+CREATE PUBLICATION app_pub FOR TABLE app.users;
+CREATE SUBSCRIPTION app_sub CONNECTION 'host=127.0.0.1 dbname=elsewhere' PUBLICATION elsewhere WITH (connect = false);
 `;
 
 beforeAll(async () => {
@@ -58,7 +65,7 @@ const profile = () => ({
   env: { PG_UD_PASSWORD: server!.endpoint("source").password },
 });
 
-const NAMED = ["rule app.users_notify ON users", "conversion app.latin1_utf8", "access method heap2", "base type app.later"];
+const NAMED = ["rule app.users_notify ON users", "conversion app.latin1_utf8", "access method heap2", "base type app.later", "user mapping for public on server app_remote", "subscription app_sub"];
 
 describe.skipIf(!enabled)("importing a database with objects chant cannot declare", () => {
   test("fails, naming every one of them", async () => {
@@ -75,7 +82,7 @@ describe.skipIf(!enabled)("importing a database with objects chant cannot declar
   test("with skipUndeclarable, imports the rest and lists them as warnings", async () => {
     const ir = await exportResources({ environment: "src", skipUndeclarable: true, ...profile() });
     expect(ir.resources.map((r) => r.properties.name)).toEqual(
-      expect.arrayContaining(["users", "hstore", "add2", "pair_text", "on_ddl", "pair", "total", "ci", "(app.pair AS text)", "audit_ddl"]),
+      expect.arrayContaining(["users", "hstore", "add2", "pair_text", "on_ddl", "pair", "total", "ci", "(app.pair AS text)", "audit_ddl", "app_fdw", "app_remote", "app_pub"]),
     );
     const left = (ir.warnings ?? []).filter((w) => w.includes("is left out (--skip-undeclarable)"));
     expect(left.map((w) => w.split(" is left out")[0]).sort()).toEqual([...NAMED].sort());

package/src/postgres/migrate/backfill.ts

@@ -169,6 +169,8 @@ export interface VerifyResult {
   mismatched: number;
   /** Rows whose new column is NULL. */
   nulls: number;
+  /** A rename with a type change: rows whose old column differs from `reverse` over the new one. */
+  unreversed?: number;
   /** The sum of a 64-bit hash of every new value, and of every value the expression gives. */
   checksum: string;
   expected: string;
@@ -201,6 +203,7 @@ export async function verifyMigration(run: MigrationRun): Promise<VerifyResult>
       exec(
         `SELECT count(*)::text AS rows, count(*) FILTER (WHERE ${nw} IS DISTINCT FROM (${o.expression}))::text AS mismatched,
                 count(*) FILTER (WHERE ${nw} IS NULL)::text AS nulls,
+                ${o.reverse !== undefined ? `count(*) FILTER (WHERE (${o.reverse}) IS DISTINCT FROM ${col(n.source)})::text` : "'0'"} AS unreversed,
                 COALESCE(sum(pg_catalog.hashtextextended(${nw}::text, 0)), 0)::text AS checksum,
                 COALESCE(sum(pg_catalog.hashtextextended((${o.expression})::text, 0)), 0)::text AS expected
          FROM ${n.qualifiedTable}`,
@@ -211,6 +214,14 @@ export async function verifyMigration(run: MigrationRun): Promise<VerifyResult>
   if (r.mismatched > 0 || r.checksum !== r.expected) {
     throw new MigrationVerificationError(n.key, { state: o.state, ...r }, `${r.mismatched} of ${r.rows} row(s) have ${n.newColumn} different from ${o.expression} (checksums ${r.checksum} and ${r.expected})`);
   }
+  const unreversed = Number(row?.unreversed ?? 0);
+  if (o.reverse !== undefined && unreversed > 0) {
+    throw new MigrationVerificationError(
+      n.key,
+      { state: o.state, ...r, unreversed },
+      `${unreversed} of ${r.rows} row(s) have ${n.source} different from ${o.reverse}, which must give the old value back from the new one (it would write ${n.source} wrongly for a writer of ${n.column})`,
+    );
+  }
   if (requiresNotNull(o.column, o.carried) && r.nulls > 0) {
     throw new MigrationVerificationError(n.key, { state: o.state, ...r }, `${r.nulls} of ${r.rows} row(s) have ${n.newColumn} NULL, and ${n.column} is declared NOT NULL or is in the primary key`);
   }
@@ -222,12 +233,13 @@ export async function verifyMigration(run: MigrationRun): Promise<VerifyResult>
     o.carried.length > 0 || o.views.length > 0
       ? `; ${o.carried.map((c) => `${c.kind} ${c.name}${c.target !== c.name ? ` (as ${c.target})` : ""}`).join(", ") || "no index or constraint"} carried over${o.views.length > 0 ? `, view(s) ${o.views.map((v) => v.name).join(", ")} made again at the switch` : ""}`
       : "";
-  const summary = `${n.key}: ${r.rows} row(s), ${n.newColumn} equal to ${o.expression} in every one (checksum ${r.checksum})${carried}`;
+  const summary = `${n.key}: ${r.rows} row(s), ${n.newColumn} equal to ${o.expression} in every one (checksum ${r.checksum})${o.reverse !== undefined ? `, ${n.source} equal to ${o.reverse} in every one` : ""}${carried}`;
   run.log(`-- ${summary}`);
   return {
     state: o.state,
     planDigest: computePlanDigest("postgres-migration", { plan: migrationPlanSubject(o), table: o.oid, column: o.newColumn.attnum, verified: { mismatched: 0 } }),
     ...r,
+    ...(o.reverse !== undefined ? { unreversed } : {}),
     summary,
   };
 }