@supabase/pg-delta 1.0.0-alpha.2 → 1.0.0-alpha.20

package/dist/core/plan/sql-format/types.js

@@ -0,0 +1 @@
+export {};

package/dist/core/plan/sql-format/wrap.d.ts

@@ -0,0 +1,2 @@
+import type { NormalizedOptions } from "./types.ts";
+export declare function wrapStatement(statement: string, options: NormalizedOptions, noWrapPlaceholders: Set<string>): string;

package/dist/core/plan/sql-format/wrap.js

@@ -0,0 +1,165 @@
+import { indentString } from "./format-utils.js";
+import { isWordChar, walkSql } from "./sql-scanner.js";
+/**
+ * Keywords that are preferred break points when wrapping long lines.
+ * The wrapper will prefer to break just before one of these keywords
+ * rather than at an arbitrary whitespace position.
+ */
+const WRAP_PREFERRED_KEYWORDS = new Set([
+    "ADD",
+    "CHECK",
+    "CONNECTION",
+    "CONSTRAINT",
+    "DEFERRABLE",
+    "FOREIGN",
+    "HANDLER",
+    "INCLUDE",
+    "INITIALLY",
+    "INLINE",
+    "MATCH",
+    "NOT",
+    "ON",
+    "OPTIONS",
+    "PUBLICATION",
+    "REFERENCES",
+    "REFERENCING",
+    "SET",
+    "USING",
+    "VALIDATOR",
+    "WHERE",
+    "WITH",
+]);
+export function wrapStatement(statement, options, noWrapPlaceholders) {
+    const lines = statement.split(/\r?\n/);
+    const wrapped = [];
+    for (const line of lines) {
+        if (line.trim().startsWith("--")) {
+            wrapped.push(line);
+            continue;
+        }
+        if (hasNoWrapPlaceholder(line, noWrapPlaceholders)) {
+            wrapped.push(line);
+            continue;
+        }
+        wrapped.push(...wrapLine(line, options));
+    }
+    return wrapped.join("\n");
+}
+function hasNoWrapPlaceholder(line, placeholders) {
+    for (const token of placeholders) {
+        if (line.includes(token))
+            return true;
+    }
+    return false;
+}
+function wrapLine(line, options) {
+    const maxWidth = options.maxWidth;
+    if (maxWidth <= 0 || line.length <= maxWidth) {
+        return [line];
+    }
+    const indentMatch = line.match(/^\s*/);
+    const baseIndent = indentMatch ? indentMatch[0] : "";
+    const continuationIndent = `${baseIndent}${indentString(options.indent)}`;
+    let remaining = line;
+    const output = [];
+    while (remaining.length > maxWidth) {
+        const breakpoint = findWrapPosition(remaining, maxWidth);
+        if (breakpoint <= 0)
+            break;
+        const head = remaining.slice(0, breakpoint).trimEnd();
+        const tail = remaining.slice(breakpoint).trimStart();
+        output.push(head);
+        const next = `${continuationIndent}${tail}`;
+        if (next.length >= remaining.length) {
+            remaining = next;
+            break;
+        }
+        remaining = next;
+    }
+    output.push(remaining);
+    return output;
+}
+/** Words that should not be separated from the previous word when wrapping (e.g. CREATE PUBLICATION, COMMENT ON). */
+const KEEP_WITH_PREVIOUS = new Set([
+    "PUBLICATION",
+    "TABLE",
+    "VIEW",
+    "SCHEMA",
+    "INDEX",
+    "OR", // CREATE OR REPLACE
+    "ON", // COMMENT ON
+]);
+function getPreviousWord(text, beforeIndex) {
+    let end = beforeIndex - 1;
+    while (end >= 0 && (text[end] === " " || text[end] === "\t")) {
+        end -= 1;
+    }
+    if (end < 0 || !isWordChar(text[end]))
+        return null;
+    let start = end;
+    while (start > 0 && isWordChar(text[start - 1])) {
+        start -= 1;
+    }
+    return text.slice(start, end + 1).toUpperCase();
+}
+function findWrapPosition(text, maxWidth) {
+    /** Last whitespace at depth 0 (preferred — avoids splitting parenthesized expressions) */
+    let lastTopLevelWhitespace = -1;
+    /** Last whitespace at any depth (fallback when no depth-0 break exists) */
+    let lastAnyWhitespace = -1;
+    let lastKeywordBoundary = -1;
+    /** First (leftmost) top-level comma within maxWidth — break there so each clause gets its own line */
+    let firstComma = -1;
+    // Never break within the leading indent — that would produce an empty head line
+    const contentStart = text.search(/\S/);
+    if (contentStart < 0)
+        return -1; // all whitespace
+    walkSql(text, (index, char, depth) => {
+        if (index > maxWidth)
+            return false;
+        // Skip positions within leading indent
+        if (index < contentStart)
+            return true;
+        // Prefer breaking after the first top-level comma so comma-separated clauses (e.g. publication tables) each get their own line
+        if (char === "," && depth === 0 && firstComma < 0) {
+            firstComma = index + 1; // position after the comma
+        }
+        if (char === " " || char === "\t") {
+            lastAnyWhitespace = index;
+            if (depth === 0) {
+                lastTopLevelWhitespace = index;
+            }
+            // Check if the next word is a preferred keyword
+            const nextWordStart = index + 1;
+            if (nextWordStart < text.length && isWordChar(text[nextWordStart])) {
+                let wordEnd = nextWordStart + 1;
+                while (wordEnd < text.length && isWordChar(text[wordEnd])) {
+                    wordEnd += 1;
+                }
+                const word = text.slice(nextWordStart, wordEnd).toUpperCase();
+                if (WRAP_PREFERRED_KEYWORDS.has(word)) {
+                    // Don't break between CREATE and object type, COMMENT and ON, or ALL and ON (GRANT/REVOKE ALL ON)
+                    const prev = getPreviousWord(text, index);
+                    if (prev !== null &&
+                        ((prev === "CREATE" && KEEP_WITH_PREVIOUS.has(word)) ||
+                            ((prev === "COMMENT" || prev === "ALL") && word === "ON"))) {
+                        return true;
+                    }
+                    lastKeywordBoundary = index;
+                }
+            }
+        }
+        return true;
+    }, { trackDepth: true });
+    // Prefer: 1) comma, 2) keyword boundary, 3) depth-0 whitespace, 4) any whitespace
+    if (firstComma > 0 && firstComma <= maxWidth) {
+        return firstComma;
+    }
+    if (lastKeywordBoundary > 0 && lastKeywordBoundary <= maxWidth) {
+        return lastKeywordBoundary;
+    }
+    if (lastTopLevelWhitespace > 0) {
+        return lastTopLevelWhitespace;
+    }
+    return lastAnyWhitespace;
+}

package/dist/core/plan/sql-format.d.ts

@@ -0,0 +1,2 @@
+export { formatSqlStatements } from "./sql-format/index.ts";
+export type { SqlFormatOptions } from "./sql-format/types.ts";

package/dist/core/plan/sql-format.js

@@ -0,0 +1 @@
+export { formatSqlStatements } from "./sql-format/index.js";

package/dist/core/plan/ssl-config.d.ts

@@ -0,0 +1,32 @@
+/**
+ * SSL configuration parsing for PostgreSQL connection URLs.
+ *
+ * Supports sslmode and certificate paths (URL params or env). Used by plan,
+ * apply, and catalog-export when connecting to source/target databases.
+ */
+/** Parsed SSL options for the pg client plus URL with SSL params stripped (internal). */
+type SslConfig = {
+    ssl?: boolean | {
+        rejectUnauthorized: boolean;
+        ca?: string;
+        cert?: string;
+        key?: string;
+        /**
+         * Custom server identity check function.
+         * Used to skip hostname verification for verify-ca mode.
+         * Returns undefined to indicate success (no error).
+         */
+        checkServerIdentity?: () => undefined;
+    };
+    cleanedUrl: string;
+};
+/**
+ * Parse SSL configuration from a PostgreSQL connection URL.
+ * Supports sslmode (require, verify-ca, verify-full, prefer, disable).
+ * Certificates can be provided via:
+ * - Query string parameters (file paths): sslrootcert, sslcert, sslkey (preferred)
+ * - Environment variables (content): PGDELTA_SOURCE_SSLROOTCERT/SSLCERT/SSLKEY or PGDELTA_TARGET_SSLROOTCERT/SSLCERT/SSLKEY
+ * Returns SSL options for the postgres.js library and a cleaned URL without SSL-related query parameters.
+ */
+export declare function parseSslConfig(url: string, connectionType: "source" | "target"): Promise<SslConfig>;
+export {};

package/dist/core/plan/ssl-config.js

@@ -0,0 +1,115 @@
+/**
+ * SSL configuration parsing for PostgreSQL connection URLs.
+ *
+ * Supports sslmode and certificate paths (URL params or env). Used by plan,
+ * apply, and catalog-export when connecting to source/target databases.
+ */
+import { readFile } from "node:fs/promises";
+/**
+ * Parse SSL configuration from a PostgreSQL connection URL.
+ * Supports sslmode (require, verify-ca, verify-full, prefer, disable).
+ * Certificates can be provided via:
+ * - Query string parameters (file paths): sslrootcert, sslcert, sslkey (preferred)
+ * - Environment variables (content): PGDELTA_SOURCE_SSLROOTCERT/SSLCERT/SSLKEY or PGDELTA_TARGET_SSLROOTCERT/SSLCERT/SSLKEY
+ * Returns SSL options for the postgres.js library and a cleaned URL without SSL-related query parameters.
+ */
+export async function parseSslConfig(url, connectionType) {
+    const urlObj = new URL(url);
+    const sslmode = urlObj.searchParams.get("sslmode");
+    const sslrootcert = urlObj.searchParams.get("sslrootcert");
+    const sslcert = urlObj.searchParams.get("sslcert");
+    const sslkey = urlObj.searchParams.get("sslkey");
+    // Remove SSL-related query parameters since we parse them ourselves
+    urlObj.searchParams.delete("sslmode");
+    urlObj.searchParams.delete("sslrootcert");
+    urlObj.searchParams.delete("sslcert");
+    urlObj.searchParams.delete("sslkey");
+    const cleanedUrl = urlObj.toString();
+    // Handle different SSL modes
+    if (sslmode === "disable") {
+        return { cleanedUrl, ssl: false };
+    }
+    if (sslmode === "require" ||
+        sslmode === "prefer" ||
+        sslmode === "verify-ca" ||
+        sslmode === "verify-full") {
+        // Helper function to get certificate value: query param (file path) takes precedence over env var (content)
+        const getCertValue = async (queryParam, envVarName) => {
+            // Prefer query parameter (file path)
+            if (queryParam) {
+                try {
+                    return await readFile(queryParam, "utf-8");
+                }
+                catch (error) {
+                    throw new Error(`Failed to read certificate file '${queryParam}': ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            // Fallback to environment variable (content)
+            const envValue = process.env[envVarName];
+            return envValue || undefined;
+        };
+        const hasExplicitVerification = sslmode === "verify-ca" || sslmode === "verify-full";
+        // Get CA certificate value.
+        // - verify-ca/verify-full: check query param first, then env var
+        // - require/prefer: only check query param (libpq backward compatibility
+        //   requires an explicit root CA *file*, not a global env var)
+        const caEnvVar = connectionType === "source"
+            ? "PGDELTA_SOURCE_SSLROOTCERT"
+            : "PGDELTA_TARGET_SSLROOTCERT";
+        let caValue;
+        if (sslrootcert) {
+            // Explicit file path in query param — always honour it
+            caValue = await getCertValue(sslrootcert, caEnvVar);
+        }
+        else if (hasExplicitVerification) {
+            // verify-ca / verify-full without file path — fall back to env var
+            caValue = await getCertValue(null, caEnvVar);
+        }
+        // require/prefer without sslrootcert: no CA cert, no verification
+        // Determine if we should verify the CA chain
+        //   From PostgreSQL docs: "if a root CA file exists, the behavior of sslmode=require
+        //   will be the same as that of verify-ca"
+        const hasLibpqCompatibility = (sslmode === "require" || sslmode === "prefer") && caValue !== undefined;
+        const shouldVerifyCa = hasExplicitVerification || hasLibpqCompatibility;
+        // Determine if we should verify hostname
+        // - verify-full: verify both CA and hostname
+        // - verify-ca: verify CA only (skip hostname)
+        // - require/prefer with CA (libpq compat): behaves like verify-ca (skip hostname)
+        const shouldVerifyHostname = sslmode === "verify-full";
+        const ssl = {
+            rejectUnauthorized: shouldVerifyCa,
+        };
+        // Add CA certificate if verifying
+        if (shouldVerifyCa && caValue) {
+            ssl.ca = caValue;
+        }
+        // For verify-ca and libpq compatibility mode: skip hostname verification
+        // This matches PostgreSQL semantics where verify-ca only checks the CA chain
+        if (shouldVerifyCa && !shouldVerifyHostname) {
+            ssl.checkServerIdentity = () => undefined;
+        }
+        // Get client certificate (optional, for mutual TLS)
+        const certEnvVar = connectionType === "source"
+            ? "PGDELTA_SOURCE_SSLCERT"
+            : "PGDELTA_TARGET_SSLCERT";
+        const certValue = await getCertValue(sslcert, certEnvVar);
+        if (certValue) {
+            ssl.cert = certValue;
+        }
+        // Get client key (optional, for mutual TLS, required if cert is provided)
+        const keyEnvVar = connectionType === "source"
+            ? "PGDELTA_SOURCE_SSLKEY"
+            : "PGDELTA_TARGET_SSLKEY";
+        const keyValue = await getCertValue(sslkey, keyEnvVar);
+        if (keyValue) {
+            ssl.key = keyValue;
+        }
+        // Warn if cert is provided without key (or vice versa)
+        if ((ssl.cert && !ssl.key) || (!ssl.cert && ssl.key)) {
+            throw new Error("Both client certificate and key must be provided together for mutual TLS");
+        }
+        return { ssl, cleanedUrl };
+    }
+    // No sslmode specified or invalid value - explicitly disable SSL
+    return { cleanedUrl, ssl: false };
+}

package/dist/core/plan/statements.d.ts

@@ -1,8 +1,9 @@
 /**
  * SQL script formatting utilities.
  */
+import { type SqlFormatOptions } from "./sql-format.ts";
 /**
  * Format an array of SQL statements into a single script string.
  * Statements are joined with double newlines and the script ends with a semicolon.
  */
-export declare function formatSqlScript(statements: string[]): string;
+export declare function formatSqlScript(statements: string[], options?: SqlFormatOptions): string;

package/dist/core/plan/statements.js

@@ -1,13 +1,17 @@
 /**
  * SQL script formatting utilities.
  */
+import { formatSqlStatements } from "./sql-format.js";
 const STATEMENT_DELIMITER = ";\n\n";
 /**
  * Format an array of SQL statements into a single script string.
  * Statements are joined with double newlines and the script ends with a semicolon.
  */
-export function formatSqlScript(statements) {
+export function formatSqlScript(statements, options) {
     if (statements.length === 0)
         return "";
-    return `${statements.join(STATEMENT_DELIMITER)};`;
+    const formatted = options
+        ? formatSqlStatements(statements, options)
+        : statements;
+    return `${formatted.join(STATEMENT_DELIMITER)};`;
 }

package/dist/core/plan/types.d.ts

@@ -3,10 +3,7 @@
  */
 import z from "zod";
 import type { Change } from "../change.types.ts";
-import type { FilterDSL } from "../integrations/filter/dsl.ts";
-import type { ChangeFilter } from "../integrations/filter/filter.types.ts";
-import type { SerializeDSL } from "../integrations/serialize/dsl.ts";
-import type { ChangeSerializer } from "../integrations/serialize/serialize.types.ts";
+import type { Integration } from "../integrations/integration.types.ts";
 export type PlanRisk = {
     level: "safe";
 } | {
@@ -133,10 +130,16 @@ export type Plan = z.infer<typeof PlanSchema>;
  */
 export interface CreatePlanOptions {
     /** Filter - either FilterDSL (stored in plan) or ChangeFilter function (not stored) */
-    filter?: FilterDSL | ChangeFilter;
+    filter?: Integration["filter"];
     /** Serialize - either SerializeDSL (stored in plan) or ChangeSerializer function (not stored) */
-    serialize?: SerializeDSL | ChangeSerializer;
+    serialize?: Integration["serialize"];
     /** Role to use when executing the migration (SET ROLE will be added to statements) */
     role?: string;
+    /**
+     * When true, don't subtract privileges covered by ALTER DEFAULT PRIVILEGES
+     * from explicit GRANTs during diffing. Use this for declarative export where
+     * the output must be self-contained and not rely on statement execution order.
+     */
+    skipDefaultPrivilegeSubtraction?: boolean;
 }
 export {};

package/dist/core/post-diff-cycle-breaking.d.ts

@@ -0,0 +1,29 @@
+import type { Catalog } from "./catalog.model.ts";
+import type { Change } from "./change.types.ts";
+/**
+ * Normalize change-list cycles that only become apparent after all object
+ * diffs have been collected.
+ *
+ * This pass intentionally handles whole-plan interactions only:
+ * - If replace expansion added `DropTable(T)+CreateTable(T)`, targeted
+ *   `AlterTableDropColumn(T.*)` / `AlterTableDropConstraint(T.*)` changes are
+ *   redundant and create an unbreakable drop-phase cycle, so we elide them.
+ * - When the same `DropTable+CreateTable` pair is present, the expansion
+ *   also emits one `AlterTableAddConstraint` / `AlterTableValidateConstraint`
+ *   / `CreateCommentOnConstraint` per branch constraint, which may collide
+ *   with the same change already emitted by `diffTables()` (for example on a
+ *   shape flip or a new constraint). We dedupe these keeping only the last
+ *   occurrence so the expansion's emission survives and the diffTables
+ *   duplicate is removed.
+ * - If two dropped tables reference each other via FK, we insert dedicated
+ *   `AlterTableDropConstraint` changes and teach the paired `DropTable`
+ *   changes not to claim those FK stable IDs.
+ *
+ * Object-local PostgreSQL semantics (for example owned-sequence cascades) stay
+ * in the corresponding `diff*` function instead of this pass.
+ */
+export declare function normalizePostDiffCycles({ changes, mainCatalog, replacedTableIds, }: {
+    changes: Change[];
+    mainCatalog: Catalog;
+    replacedTableIds?: ReadonlySet<string>;
+}): Change[];

package/dist/core/post-diff-cycle-breaking.js

@@ -0,0 +1,209 @@
+import { AlterTableAddConstraint, AlterTableDropColumn, AlterTableDropConstraint, AlterTableValidateConstraint, } from "./objects/table/changes/table.alter.js";
+import { CreateCommentOnConstraint } from "./objects/table/changes/table.comment.js";
+import { DropTable } from "./objects/table/changes/table.drop.js";
+import { stableId } from "./objects/utils.js";
+function constraintStableId(table, constraintName) {
+    return stableId.constraint(table.schema, table.name, constraintName);
+}
+/**
+ * Yield FK constraints on `table` whose referenced table is also dropped in the
+ * final plan. Self-references are left alone because the sort phase already
+ * handles the resulting self-loop correctly.
+ */
+function* iterCrossDropFkConstraints(table, droppedSet) {
+    for (const constraint of table.constraints) {
+        if (constraint.constraint_type !== "f")
+            continue;
+        if (constraint.is_partition_clone)
+            continue;
+        if (!constraint.foreign_key_schema || !constraint.foreign_key_table) {
+            continue;
+        }
+        const referencedId = stableId.table(constraint.foreign_key_schema, constraint.foreign_key_table);
+        if (referencedId === table.stableId)
+            continue;
+        if (!droppedSet.has(referencedId))
+            continue;
+        yield { constraint, referencedId };
+    }
+}
+function isSupersededByTableReplacement(change, replacedTableIds) {
+    if (!(change instanceof AlterTableDropColumn) &&
+        !(change instanceof AlterTableDropConstraint)) {
+        return false;
+    }
+    return replacedTableIds.has(change.table.stableId);
+}
+/**
+ * Drop earlier duplicates of `AlterTableAddConstraint` /
+ * `AlterTableValidateConstraint` / `CreateCommentOnConstraint` targeting
+ * replaced tables, keeping only the last occurrence of each
+ * `(changeType, table.stableId, constraint.name)`.
+ *
+ * When `expandReplaceDependencies()` promotes a table to a full
+ * `DropTable + CreateTable` pair, it also emits one
+ * `AlterTableAddConstraint` (plus optional `VALIDATE CONSTRAINT` /
+ * `COMMENT ON CONSTRAINT`) per branch constraint. If `diffTables()` already
+ * emitted the same change for a shape flip or a new constraint on that
+ * table, the plan ends up with two identical `ALTER TABLE ... ADD
+ * CONSTRAINT ...` statements and PostgreSQL fails at apply time with
+ * `constraint "..." for relation "..." already exists`. Because
+ * `expandReplaceDependencies()` appends its additions after the original
+ * `diffTables()` output, the last occurrence is the expansion's emission —
+ * keeping it preserves correctness while removing the duplicate.
+ */
+function dropReplacedTableDuplicateConstraintChanges(changes, replacedTableIds) {
+    if (replacedTableIds.size === 0)
+        return changes;
+    const keyFor = (change) => {
+        if (!(change instanceof AlterTableAddConstraint) &&
+            !(change instanceof AlterTableValidateConstraint) &&
+            !(change instanceof CreateCommentOnConstraint)) {
+            return null;
+        }
+        if (!replacedTableIds.has(change.table.stableId))
+            return null;
+        const tag = change instanceof AlterTableAddConstraint
+            ? "add"
+            : change instanceof AlterTableValidateConstraint
+                ? "validate"
+                : "comment";
+        return `${tag}:${constraintStableId(change.table, change.constraint.name)}`;
+    };
+    const seen = new Set();
+    const reversedKept = [];
+    let mutated = false;
+    // Walk backwards: the first encounter of each key corresponds to its LAST
+    // occurrence in the original order. `expandReplaceDependencies()` appends
+    // additions after the original changes, so "last wins" keeps the
+    // expansion's emission and drops the earlier diffTables duplicate.
+    for (let i = changes.length - 1; i >= 0; i--) {
+        const change = changes[i];
+        const key = keyFor(change);
+        if (key !== null) {
+            if (seen.has(key)) {
+                mutated = true;
+                continue;
+            }
+            seen.add(key);
+        }
+        reversedKept.push(change);
+    }
+    return mutated ? reversedKept.reverse() : changes;
+}
+function collectExplicitConstraintDropIds(changes) {
+    const explicitConstraintDropIds = new Set();
+    for (const change of changes) {
+        if (!(change instanceof AlterTableDropConstraint))
+            continue;
+        explicitConstraintDropIds.add(constraintStableId(change.table, change.constraint.name));
+    }
+    return explicitConstraintDropIds;
+}
+function hasSameEntries(left, right) {
+    if (left.size !== right.size)
+        return false;
+    for (const value of left) {
+        if (!right.has(value))
+            return false;
+    }
+    return true;
+}
+/**
+ * Normalize change-list cycles that only become apparent after all object
+ * diffs have been collected.
+ *
+ * This pass intentionally handles whole-plan interactions only:
+ * - If replace expansion added `DropTable(T)+CreateTable(T)`, targeted
+ *   `AlterTableDropColumn(T.*)` / `AlterTableDropConstraint(T.*)` changes are
+ *   redundant and create an unbreakable drop-phase cycle, so we elide them.
+ * - When the same `DropTable+CreateTable` pair is present, the expansion
+ *   also emits one `AlterTableAddConstraint` / `AlterTableValidateConstraint`
+ *   / `CreateCommentOnConstraint` per branch constraint, which may collide
+ *   with the same change already emitted by `diffTables()` (for example on a
+ *   shape flip or a new constraint). We dedupe these keeping only the last
+ *   occurrence so the expansion's emission survives and the diffTables
+ *   duplicate is removed.
+ * - If two dropped tables reference each other via FK, we insert dedicated
+ *   `AlterTableDropConstraint` changes and teach the paired `DropTable`
+ *   changes not to claim those FK stable IDs.
+ *
+ * Object-local PostgreSQL semantics (for example owned-sequence cascades) stay
+ * in the corresponding `diff*` function instead of this pass.
+ */
+export function normalizePostDiffCycles({ changes, mainCatalog, replacedTableIds = new Set(), }) {
+    const dedupedChanges = dropReplacedTableDuplicateConstraintChanges(changes, replacedTableIds);
+    const structurallyNormalizedChanges = replacedTableIds.size === 0
+        ? dedupedChanges
+        : dedupedChanges.filter((change) => !isSupersededByTableReplacement(change, replacedTableIds));
+    const dropTableChanges = structurallyNormalizedChanges.filter((change) => change instanceof DropTable);
+    if (dropTableChanges.length < 2) {
+        return structurallyNormalizedChanges;
+    }
+    const droppedSet = new Set(dropTableChanges.map((change) => change.table.stableId));
+    const droppedFkTargets = new Map();
+    for (const dropTableChange of dropTableChanges) {
+        const mainTable = mainCatalog.tables[dropTableChange.table.stableId] ??
+            dropTableChange.table;
+        const targets = new Set();
+        for (const { referencedId } of iterCrossDropFkConstraints(mainTable, droppedSet)) {
+            targets.add(referencedId);
+        }
+        droppedFkTargets.set(mainTable.stableId, targets);
+    }
+    const explicitConstraintDropIds = collectExplicitConstraintDropIds(structurallyNormalizedChanges);
+    const injectedConstraintDropsByTableId = new Map();
+    const externallyDroppedConstraintsByTableId = new Map();
+    let didMutate = structurallyNormalizedChanges !== changes;
+    for (const dropTableChange of dropTableChanges) {
+        const mainTable = mainCatalog.tables[dropTableChange.table.stableId] ??
+            dropTableChange.table;
+        const externallyDroppedConstraints = new Set(dropTableChange.externallyDroppedConstraints);
+        for (const { constraint, referencedId } of iterCrossDropFkConstraints(mainTable, droppedSet)) {
+            const isMutual = droppedFkTargets.get(referencedId)?.has(mainTable.stableId) === true;
+            if (!isMutual)
+                continue;
+            const droppedConstraintStableId = constraintStableId(mainTable, constraint.name);
+            externallyDroppedConstraints.add(constraint.name);
+            if (!explicitConstraintDropIds.has(droppedConstraintStableId)) {
+                const injectedDrop = new AlterTableDropConstraint({
+                    table: mainTable,
+                    constraint,
+                });
+                const existingDrops = injectedConstraintDropsByTableId.get(mainTable.stableId) ?? [];
+                existingDrops.push(injectedDrop);
+                injectedConstraintDropsByTableId.set(mainTable.stableId, existingDrops);
+                explicitConstraintDropIds.add(droppedConstraintStableId);
+                didMutate = true;
+            }
+        }
+        if (!hasSameEntries(dropTableChange.externallyDroppedConstraints, externallyDroppedConstraints)) {
+            externallyDroppedConstraintsByTableId.set(mainTable.stableId, externallyDroppedConstraints);
+            didMutate = true;
+        }
+    }
+    if (!didMutate) {
+        return changes;
+    }
+    const normalizedChanges = [];
+    for (const change of structurallyNormalizedChanges) {
+        if (!(change instanceof DropTable)) {
+            normalizedChanges.push(change);
+            continue;
+        }
+        const injectedConstraintDrops = injectedConstraintDropsByTableId.get(change.table.stableId) ?? [];
+        if (injectedConstraintDrops.length > 0) {
+            normalizedChanges.push(...injectedConstraintDrops);
+        }
+        const externallyDroppedConstraints = externallyDroppedConstraintsByTableId.get(change.table.stableId);
+        if (!externallyDroppedConstraints) {
+            normalizedChanges.push(change);
+            continue;
+        }
+        normalizedChanges.push(new DropTable({
+            table: change.table,
+            externallyDroppedConstraints,
+        }));
+    }
+    return normalizedChanges;
+}