@supabase/pg-delta 1.0.0-alpha.1 → 1.0.0-alpha.11

package/src/cli/utils/resolve-input.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from "bun:test";
+import path from "node:path";
+import { isPostgresUrl, loadCatalogFromFile } from "./resolve-input.ts";
+
+describe("isPostgresUrl", () => {
+  test("returns true for postgres:// URL", () => {
+    expect(isPostgresUrl("postgres://user:pass@localhost:5432/db")).toBe(true);
+  });
+
+  test("returns true for postgresql:// URL", () => {
+    expect(isPostgresUrl("postgresql://localhost/db")).toBe(true);
+  });
+
+  test("returns false for file path", () => {
+    expect(isPostgresUrl("/path/to/catalog.json")).toBe(false);
+    expect(isPostgresUrl("catalog.json")).toBe(false);
+  });
+
+  test("returns false for other strings", () => {
+    expect(isPostgresUrl("")).toBe(false);
+    expect(isPostgresUrl("postgres")).toBe(false);
+  });
+});
+
+describe("loadCatalogFromFile", () => {
+  test("loads and deserializes catalog from JSON file", async () => {
+    const fixturePath = path.join(
+      import.meta.dir,
+      "../../core/fixtures/empty-catalogs/postgres-15-16-baseline.json",
+    );
+    const catalog = await loadCatalogFromFile(fixturePath);
+    expect(catalog).toBeDefined();
+    expect(catalog.version).toBeGreaterThan(0);
+    expect(typeof catalog.currentUser).toBe("string");
+    expect(catalog.schemas).toBeDefined();
+    expect(catalog.depends).toEqual(expect.any(Array));
+  });
+});

package/src/cli/utils/resolve-input.ts

@@ -0,0 +1,17 @@
+/**
+ * Shared utilities for resolving CLI --source/--target inputs that
+ * can be either a PostgreSQL connection URL or a catalog snapshot file path.
+ */
+
+import { readFile } from "node:fs/promises";
+import type { Catalog } from "../../core/catalog.model.ts";
+import { deserializeCatalog } from "../../core/catalog.snapshot.ts";
+
+export function isPostgresUrl(input: string): boolean {
+  return input.startsWith("postgres://") || input.startsWith("postgresql://");
+}
+
+export async function loadCatalogFromFile(path: string): Promise<Catalog> {
+  const json = await readFile(path, "utf-8");
+  return deserializeCatalog(JSON.parse(json));
+}

package/src/cli/utils.ts

@@ -0,0 +1,231 @@
+/**
+ * Shared utility functions for CLI commands.
+ */
+
+import { createInterface } from "node:readline";
+import type { CommandContext } from "@stricli/core";
+import chalk from "chalk";
+import type { Change } from "../core/change.types.ts";
+import type { DiffContext } from "../core/context.ts";
+import { groupChangesHierarchically } from "../core/plan/hierarchy.ts";
+import { type Plan, serializePlan } from "../core/plan/index.ts";
+import { classifyChangesRisk } from "../core/plan/risk.ts";
+import type { SqlFormatOptions } from "../core/plan/sql-format.ts";
+import { formatSqlScript } from "../core/plan/statements.ts";
+import { formatTree } from "./formatters/index.ts";
+
+// Re-export ApplyPlanResult type for convenience
+type ApplyPlanResult =
+  | { status: "invalid_plan"; message: string }
+  | { status: "fingerprint_mismatch"; current: string; expected: string }
+  | { status: "already_applied" }
+  | { status: "applied"; statements: number; warnings?: string[] }
+  | { status: "failed"; error: unknown; script: string };
+
+type PlanResult = {
+  plan: Plan;
+  sortedChanges: Change[];
+  ctx: DiffContext;
+};
+
+interface FormatPlanOptions {
+  disableColors?: boolean;
+  showUnsafeFlagSuggestion?: boolean;
+  sqlFormatOptions?: SqlFormatOptions;
+}
+
+/**
+ * Formats a plan result for display in various formats.
+ */
+export function formatPlanForDisplay(
+  planResult: PlanResult,
+  format: "tree" | "json" | "sql",
+  options: FormatPlanOptions = {},
+): { content: string; label: string } {
+  const { plan, sortedChanges, ctx } = planResult;
+  const risk = plan.risk ?? classifyChangesRisk(sortedChanges);
+  const planWithRisk = plan.risk ? plan : { ...plan, risk };
+
+  switch (format) {
+    case "sql": {
+      const content = [
+        `-- Risk: ${risk.level === "data_loss" ? `data-loss (${risk.statements.length})` : "safe"}`,
+        formatSqlScript(plan.statements, options.sqlFormatOptions),
+      ].join("\n");
+      return { content, label: "Migration script" };
+    }
+    case "json": {
+      const content = serializePlan(planWithRisk);
+      return { content, label: "Plan" };
+    }
+    default: {
+      const hierarchy = groupChangesHierarchically(ctx, sortedChanges);
+      const previousLevel = chalk.level;
+      if (options.disableColors) {
+        chalk.level = 0;
+      }
+      try {
+        let treeContent = formatTree(hierarchy);
+        if (risk.level === "data_loss") {
+          const warningLines = [
+            "",
+            chalk.yellow("⚠ Data-loss operations detected:"),
+            ...risk.statements.map((statement: string) =>
+              chalk.yellow(`- ${statement}`),
+            ),
+          ];
+          if (options.showUnsafeFlagSuggestion !== false) {
+            warningLines.push(
+              chalk.yellow(
+                "Use `--unsafe` to allow applying these operations.",
+              ),
+            );
+          }
+          const treeLines = treeContent.split("\n");
+          // Insert warning after the legend (at the end of the output)
+          // Find the legend line which contains "create", "alter", and "drop"
+          let insertIndex = treeLines.length;
+          const ansiPattern = new RegExp(
+            `${String.fromCharCode(27)}\\[[0-9;]*m`,
+            "g",
+          );
+          // Search from the end backwards for the legend
+          for (let i = treeLines.length - 1; i >= 0; i--) {
+            const line = treeLines[i];
+            const stripped = line.replace(ansiPattern, "").trim();
+            // Legend format: "+ create   ~ alter   - drop" (or variations)
+            if (
+              stripped.includes("create") &&
+              stripped.includes("alter") &&
+              stripped.includes("drop")
+            ) {
+              insertIndex = i + 1;
+              break;
+            }
+          }
+          // Fallback: if legend not found, append at the end
+          if (insertIndex === treeLines.length) {
+            insertIndex = treeLines.length;
+          }
+          treeLines.splice(insertIndex, 0, ...warningLines);
+          treeContent = treeLines.join("\n");
+        }
+        // add newline for nicer stdout when in tree mode
+        if (!treeContent.endsWith("\n")) {
+          treeContent = `${treeContent}\n`;
+        }
+        return { content: treeContent, label: "Human-readable plan" };
+      } finally {
+        if (options.disableColors) {
+          chalk.level = previousLevel;
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Validates plan risk and handles unsafe operations.
+ * Returns validation result with optional exit code.
+ */
+export function validatePlanRisk(
+  plan: Plan,
+  unsafe: boolean,
+  context: CommandContext,
+  options?: { suppressWarning?: boolean },
+): { valid: boolean; exitCode?: number } {
+  if (!unsafe) {
+    if (!plan.risk) {
+      context.process.stderr.write(
+        "Plan is missing risk metadata. Regenerate the plan with the current pgdelta or re-run with --unsafe to apply anyway.\n",
+      );
+      return { valid: false, exitCode: 1 };
+    }
+    if (plan.risk.level === "data_loss") {
+      if (!options?.suppressWarning) {
+        const warningLines = [
+          chalk.yellow("⚠ Data-loss operations detected:"),
+          ...plan.risk.statements.map((statement: string) =>
+            chalk.yellow(`- ${statement}`),
+          ),
+          chalk.yellow("Use `--unsafe` to allow applying these operations."),
+        ];
+        context.process.stderr.write(`${warningLines.join("\n")}\n`);
+      }
+      return { valid: false, exitCode: 1 };
+    }
+  }
+  return { valid: true };
+}
+
+/**
+ * Handles applyPlan results and writes appropriate output.
+ * Returns the exit code that should be set.
+ */
+export function handleApplyResult(
+  result: ApplyPlanResult,
+  context: CommandContext,
+): { exitCode: number } {
+  switch (result.status) {
+    case "invalid_plan":
+      context.process.stderr.write(`${result.message}\n`);
+      return { exitCode: 1 };
+    case "fingerprint_mismatch":
+      context.process.stderr.write(
+        "Target database does not match plan source fingerprint. Aborting.\n",
+      );
+      return { exitCode: 1 };
+    case "already_applied":
+      context.process.stdout.write(
+        "Plan already applied (target fingerprint matches desired state).\n",
+      );
+      return { exitCode: 0 };
+    case "failed": {
+      context.process.stderr.write(
+        `Failed to apply changes: ${result.error instanceof Error ? result.error.message : String(result.error)}\n`,
+      );
+      context.process.stderr.write(`Migration script:\n${result.script}\n`);
+      return { exitCode: 1 };
+    }
+    case "applied": {
+      context.process.stdout.write(
+        `Applying ${result.statements} changes to database...\n`,
+      );
+      context.process.stdout.write("Successfully applied all changes.\n");
+      if (result.warnings?.length) {
+        for (const warning of result.warnings) {
+          context.process.stderr.write(`Warning: ${warning}\n`);
+        }
+      }
+      return { exitCode: 0 };
+    }
+  }
+}
+
+/**
+ * Prompts user for confirmation using readline.
+ * Returns true for 'y'/'yes', false otherwise.
+ */
+export function promptConfirmation(
+  question: string,
+  context: CommandContext,
+): Promise<boolean> {
+  return new Promise((resolve) => {
+    // Access stdin/stdout from the process object
+    // Type assertion needed because CommandContext.process may not expose stdin in its type
+    const process = context.process as unknown as {
+      stdin: NodeJS.ReadableStream;
+      stdout: NodeJS.WritableStream;
+    };
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+
+    rl.question(question, (answer) => {
+      rl.close();
+      const normalized = answer.trim().toLowerCase();
+      resolve(normalized === "y" || normalized === "yes");
+    });
+  });
+}

package/src/core/catalog-export/index.ts

@@ -0,0 +1,20 @@
+/**
+ * Catalog export – programmatic API for extracting a database catalog
+ * and serializing it to a JSON snapshot.
+ *
+ * Use this subpath when you only need catalog export (e.g. Supabase CLI
+ * edge-runtime templates) without pulling in the full pg-delta API.
+ */
+
+export {
+  Catalog,
+  createEmptyCatalog,
+  extractCatalog,
+} from "../catalog.model.ts";
+export type { CatalogSnapshot } from "../catalog.snapshot.ts";
+export {
+  deserializeCatalog,
+  serializeCatalog,
+  stringifyCatalogSnapshot,
+} from "../catalog.snapshot.ts";
+export { createManagedPool } from "../postgres-config.ts";

package/src/core/catalog.diff.ts

@@ -0,0 +1,247 @@
+import debug from "debug";
+import type { Catalog } from "./catalog.model.ts";
+import { expandReplaceDependencies } from "./expand-replace-dependencies.ts";
+
+const debugCatalog = debug("pg-delta:catalog");
+
+import type { Change } from "./change.types.ts";
+import { diffAggregates } from "./objects/aggregate/aggregate.diff.ts";
+import { DefaultPrivilegeState } from "./objects/base.default-privileges.ts";
+import { diffCollations } from "./objects/collation/collation.diff.ts";
+import { diffDomains } from "./objects/domain/domain.diff.ts";
+import { diffEventTriggers } from "./objects/event-trigger/event-trigger.diff.ts";
+import { diffExtensions } from "./objects/extension/extension.diff.ts";
+import { diffForeignDataWrappers } from "./objects/foreign-data-wrapper/foreign-data-wrapper/foreign-data-wrapper.diff.ts";
+import { diffForeignTables } from "./objects/foreign-data-wrapper/foreign-table/foreign-table.diff.ts";
+import { diffServers } from "./objects/foreign-data-wrapper/server/server.diff.ts";
+import { diffUserMappings } from "./objects/foreign-data-wrapper/user-mapping/user-mapping.diff.ts";
+import { diffIndexes } from "./objects/index/index.diff.ts";
+import { diffMaterializedViews } from "./objects/materialized-view/materialized-view.diff.ts";
+import { diffProcedures } from "./objects/procedure/procedure.diff.ts";
+import { diffPublications } from "./objects/publication/publication.diff.ts";
+import { diffRlsPolicies } from "./objects/rls-policy/rls-policy.diff.ts";
+import {
+  GrantRoleDefaultPrivileges,
+  RevokeRoleDefaultPrivileges,
+} from "./objects/role/changes/role.privilege.ts";
+import { diffRoles } from "./objects/role/role.diff.ts";
+import { diffRules } from "./objects/rule/rule.diff.ts";
+import { diffSchemas } from "./objects/schema/schema.diff.ts";
+import { diffSequences } from "./objects/sequence/sequence.diff.ts";
+import { diffSubscriptions } from "./objects/subscription/subscription.diff.ts";
+import { diffTables } from "./objects/table/table.diff.ts";
+import { diffTriggers } from "./objects/trigger/trigger.diff.ts";
+import { diffCompositeTypes } from "./objects/type/composite-type/composite-type.diff.ts";
+import { diffEnums } from "./objects/type/enum/enum.diff.ts";
+import { diffRanges } from "./objects/type/range/range.diff.ts";
+import { stringifyWithBigInt } from "./objects/utils.ts";
+import { diffViews } from "./objects/view/view.diff.ts";
+
+type PrivilegeChange = Extract<Change, { scope: "privilege" }>;
+
+/**
+ * Get the stableId of the target object for a privilege change.
+ * Used to filter out redundant REVOKE statements for dropped objects.
+ */
+function getPrivilegeTargetStableId(change: PrivilegeChange): string {
+  switch (change.objectType) {
+    case "composite_type":
+      return change.compositeType.stableId;
+    case "domain":
+      return change.domain.stableId;
+    case "enum":
+      return change.enum.stableId;
+    case "language":
+      return change.language.stableId;
+    case "materialized_view":
+      return change.materializedView.stableId;
+    case "aggregate":
+      return change.aggregate.stableId;
+    case "procedure":
+      return change.procedure.stableId;
+    case "range":
+      return change.range.stableId;
+    case "schema":
+      return change.schema.stableId;
+    case "sequence":
+      return change.sequence.stableId;
+    case "table":
+      return change.table.stableId;
+    case "view":
+      return change.view.stableId;
+    case "foreign_data_wrapper":
+      return change.foreignDataWrapper.stableId;
+    case "server":
+      return change.server.stableId;
+    case "foreign_table":
+      return change.foreignTable.stableId;
+    default: {
+      const _exhaustive: never = change;
+      return _exhaustive;
+    }
+  }
+}
+
+export function diffCatalogs(
+  main: Catalog,
+  branch: Catalog,
+  options?: { role?: string; skipDefaultPrivilegeSubtraction?: boolean },
+) {
+  const changes: Change[] = [];
+
+  // Step 1: Diff roles first to get default privilege changes
+  const roleChanges = diffRoles(
+    { version: main.version },
+    main.roles,
+    branch.roles,
+  );
+  changes.push(...roleChanges);
+
+  // Step 2: Compute default privileges state from role changes
+  // This represents what defaults will be in effect after all ALTER DEFAULT PRIVILEGES
+  // Since ALTER DEFAULT PRIVILEGES runs before CREATE (via constraint spec),
+  // all created objects will use these final defaults.
+  //
+  // When skipDefaultPrivilegeSubtraction is true, we use an empty state so that
+  // getEffectiveDefaults always returns [] -- no privileges are subtracted and
+  // every GRANT is emitted explicitly.  This is needed for declarative export
+  // where the output must be self-contained regardless of statement execution order.
+  const defaultPrivilegeState = options?.skipDefaultPrivilegeSubtraction
+    ? new DefaultPrivilegeState({})
+    : new DefaultPrivilegeState(main.roles);
+  if (!options?.skipDefaultPrivilegeSubtraction) {
+    for (const change of roleChanges) {
+      if (change instanceof GrantRoleDefaultPrivileges) {
+        defaultPrivilegeState.applyGrant(
+          change.role.name,
+          change.objtype,
+          change.inSchema,
+          change.grantee,
+          change.privileges,
+        );
+      } else if (change instanceof RevokeRoleDefaultPrivileges) {
+        defaultPrivilegeState.applyRevoke(
+          change.role.name,
+          change.objtype,
+          change.inSchema,
+          change.grantee,
+          change.privileges,
+        );
+      }
+    }
+  }
+
+  // Step 3: Create context with default privileges state for object diffing
+  // Use the specified role for both default privilege lookups and owner comparisons if provided,
+  // otherwise use the login role (main.currentUser). This ensures that when SET ROLE is used
+  // in the migration, both default privileges and owner comparisons match what will actually
+  // happen during execution (objects will be created with the effective role as owner).
+  const effectiveUser = options?.role ?? main.currentUser;
+  const diffContext = {
+    version: main.version,
+    currentUser: effectiveUser,
+    defaultPrivilegeState,
+    mainRoles: main.roles,
+    skipDefaultPrivilegeSubtraction: options?.skipDefaultPrivilegeSubtraction,
+  };
+
+  // Step 4: Diff all other objects with default privileges context
+  changes.push(
+    ...diffAggregates(diffContext, main.aggregates, branch.aggregates),
+  );
+  changes.push(
+    ...diffCollations(diffContext, main.collations, branch.collations),
+  );
+  changes.push(
+    ...diffCompositeTypes(
+      diffContext,
+      main.compositeTypes,
+      branch.compositeTypes,
+    ),
+  );
+  changes.push(...diffDomains(diffContext, main.domains, branch.domains));
+  changes.push(...diffEnums(diffContext, main.enums, branch.enums));
+  changes.push(...diffExtensions(main.extensions, branch.extensions));
+  changes.push(
+    ...diffIndexes(main.indexes, branch.indexes, branch.indexableObjects),
+  );
+  changes.push(
+    ...diffMaterializedViews(
+      diffContext,
+      main.materializedViews,
+      branch.materializedViews,
+    ),
+  );
+  changes.push(
+    ...diffSubscriptions(diffContext, main.subscriptions, branch.subscriptions),
+  );
+  changes.push(
+    ...diffPublications(diffContext, main.publications, branch.publications),
+  );
+  changes.push(
+    ...diffProcedures(diffContext, main.procedures, branch.procedures),
+  );
+  changes.push(...diffRlsPolicies(main.rlsPolicies, branch.rlsPolicies));
+  changes.push(...diffSchemas(diffContext, main.schemas, branch.schemas));
+  changes.push(
+    ...diffSequences(
+      diffContext,
+      main.sequences,
+      branch.sequences,
+      branch.tables,
+    ),
+  );
+  changes.push(...diffTables(diffContext, main.tables, branch.tables));
+  changes.push(
+    ...diffTriggers(main.triggers, branch.triggers, branch.indexableObjects),
+  );
+  changes.push(
+    ...diffEventTriggers(diffContext, main.eventTriggers, branch.eventTriggers),
+  );
+  changes.push(...diffRules(main.rules, branch.rules));
+  changes.push(...diffRanges(diffContext, main.ranges, branch.ranges));
+  changes.push(...diffViews(diffContext, main.views, branch.views));
+  // Foreign Data Wrapper objects (in dependency order)
+  changes.push(
+    ...diffForeignDataWrappers(
+      diffContext,
+      main.foreignDataWrappers,
+      branch.foreignDataWrappers,
+    ),
+  );
+  changes.push(...diffServers(diffContext, main.servers, branch.servers));
+  changes.push(...diffUserMappings(main.userMappings, branch.userMappings));
+  changes.push(
+    ...diffForeignTables(diffContext, main.foreignTables, branch.foreignTables),
+  );
+
+  // Filter privilege REVOKEs for objects that are being dropped
+  // Avoid emitting redundant REVOKE statements for targets that will no longer exist.
+  const droppedObjectStableIds = new Set<string>();
+  for (const change of changes) {
+    if (change.operation === "drop" && change.scope === "object") {
+      for (const dep of change.requires) {
+        droppedObjectStableIds.add(dep);
+      }
+    }
+  }
+  let filteredChanges = changes.filter((change) => {
+    if (change.operation === "alter" && change.scope === "privilege") {
+      return !droppedObjectStableIds.has(getPrivilegeTargetStableId(change));
+    }
+    return true;
+  });
+
+  filteredChanges = expandReplaceDependencies({
+    changes: filteredChanges,
+    mainCatalog: main,
+    branchCatalog: branch,
+  });
+
+  debugCatalog(
+    "changes catalog diff: %O",
+    stringifyWithBigInt(filteredChanges, 2),
+  );
+
+  return filteredChanges;
+}

package/src/core/catalog.model.test.ts

@@ -0,0 +1,122 @@
+import { describe, expect, test } from "bun:test";
+import { createEmptyCatalog } from "./catalog.model.ts";
+
+describe("createEmptyCatalog", () => {
+  test("PG < 15 returns a minimal catalog with only a public schema", async () => {
+    const catalog = await createEmptyCatalog(140000, "myuser");
+
+    // version and currentUser forwarded
+    expect(catalog.version).toBe(140000);
+    expect(catalog.currentUser).toBe("myuser");
+
+    // public schema owned by the provided currentUser (pre-PG15 behavior)
+    const publicSchema = catalog.schemas["schema:public"];
+    expect(publicSchema).toBeDefined();
+    expect(publicSchema.owner).toBe("myuser");
+
+    // everything else is empty
+    expect(Object.keys(catalog.schemas)).toEqual(["schema:public"]);
+    const emptyRecords = [
+      catalog.aggregates,
+      catalog.collations,
+      catalog.compositeTypes,
+      catalog.domains,
+      catalog.enums,
+      catalog.extensions,
+      catalog.procedures,
+      catalog.indexes,
+      catalog.materializedViews,
+      catalog.subscriptions,
+      catalog.publications,
+      catalog.rlsPolicies,
+      catalog.roles,
+      catalog.sequences,
+      catalog.tables,
+      catalog.triggers,
+      catalog.eventTriggers,
+      catalog.rules,
+      catalog.ranges,
+      catalog.views,
+      catalog.foreignDataWrappers,
+      catalog.servers,
+      catalog.userMappings,
+      catalog.foreignTables,
+      catalog.indexableObjects,
+    ];
+    for (const record of emptyRecords) {
+      expect(record).toEqual({});
+    }
+    expect(catalog.depends).toEqual([]);
+  });
+
+  test("PG 15-16 returns a full baseline catalog from snapshot", async () => {
+    const catalog = await createEmptyCatalog(160004, "admin_user");
+
+    // version and currentUser forwarded (not hardcoded from JSON)
+    expect(catalog.version).toBe(160004);
+    expect(catalog.currentUser).toBe("admin_user");
+
+    // public schema with pg_database_owner (PG 15+ default) and ACLs
+    const publicSchema = catalog.schemas["schema:public"];
+    expect(publicSchema.owner).toBe("pg_database_owner");
+    expect(publicSchema.privileges.length).toBeGreaterThan(0);
+
+    // plpgsql extension pre-installed
+    expect(catalog.extensions["extension:plpgsql"]).toBeDefined();
+    expect(catalog.extensions["extension:plpgsql"].name).toBe("plpgsql");
+
+    // postgres superuser role with default privileges
+    const role = catalog.roles["role:postgres"];
+    expect(role.name).toBe("postgres");
+    expect(role.is_superuser).toBe(true);
+    expect(role.default_privileges.length).toBeGreaterThan(0);
+
+    // no MAINTAIN privilege (PG 17+ only)
+    const relPrivs = role.default_privileges.find(
+      (dp) => dp.objtype === "r" && dp.grantee === "postgres",
+    );
+    expect(relPrivs).toBeDefined();
+    expect(relPrivs?.privileges.map((p) => p.privilege)).not.toContain(
+      "MAINTAIN",
+    );
+
+    // dependency graph populated
+    expect(catalog.depends.length).toBeGreaterThan(0);
+  });
+
+  test("PG 17 baseline adds MAINTAIN privilege to default relation grants", async () => {
+    const catalog = await createEmptyCatalog(170009, "admin_user");
+
+    // version and currentUser forwarded
+    expect(catalog.version).toBe(170009);
+    expect(catalog.currentUser).toBe("admin_user");
+
+    // same baseline objects as PG 15-16
+    expect(catalog.extensions["extension:plpgsql"]).toBeDefined();
+    expect(catalog.roles["role:postgres"]).toBeDefined();
+    expect(catalog.depends.length).toBeGreaterThan(0);
+
+    // MAINTAIN privilege present and in alphabetical order
+    const relPrivs = catalog.roles["role:postgres"].default_privileges.find(
+      (dp) => dp.objtype === "r" && dp.grantee === "postgres",
+    );
+    expect(relPrivs).toBeDefined();
+    const privNames = relPrivs?.privileges.map((p) => p.privilege) ?? [];
+    expect(privNames).toContain("MAINTAIN");
+    expect(privNames).toEqual([...privNames].sort());
+  });
+
+  test("PG 17 patching does not mutate the cached PG 15-16 baseline", async () => {
+    // force PG 17 baseline to be built first
+    await createEmptyCatalog(170000, "postgres");
+
+    const pg16 = await createEmptyCatalog(160000, "postgres");
+    const relPrivs = pg16.roles["role:postgres"].default_privileges.find(
+      (dp) => dp.objtype === "r" && dp.grantee === "postgres",
+    );
+    expect(relPrivs).toBeDefined();
+    expect(relPrivs?.privileges.map((p) => p.privilege)).not.toContain(
+      "MAINTAIN",
+    );
+  });
+});