@supabase/pg-delta 1.0.0-alpha.24 → 1.0.0-alpha.26

package/dist/core/objects/foreign-data-wrapper/server/server.model.d.ts

@@ -58,5 +58,15 @@ export declare class Server extends BasePgModel {
         }[];
     };
 }
+/**
+ * Extract `pg_foreign_server` rows into `Server` models.
+ *
+ * The returned models carry option values **verbatim** from
+ * `pg_foreign_server.srvoptions`, which means cleartext secrets like
+ * `password` are present in memory. Always route through
+ * `extractCatalog` (which calls `normalizeCatalog`) before emitting
+ * options to any output channel — see CLI-1467 and
+ * `packages/pg-delta/src/core/objects/foreign-data-wrapper/sensitive-options.ts`.
+ */
 export declare function extractServers(pool: Pool): Promise<Server[]>;
 export {};

package/dist/core/objects/foreign-data-wrapper/server/server.model.js

@@ -64,6 +64,16 @@ export class Server extends BasePgModel {
         };
     }
 }
+/**
+ * Extract `pg_foreign_server` rows into `Server` models.
+ *
+ * The returned models carry option values **verbatim** from
+ * `pg_foreign_server.srvoptions`, which means cleartext secrets like
+ * `password` are present in memory. Always route through
+ * `extractCatalog` (which calls `normalizeCatalog`) before emitting
+ * options to any output channel — see CLI-1467 and
+ * `packages/pg-delta/src/core/objects/foreign-data-wrapper/sensitive-options.ts`.
+ */
 export async function extractServers(pool) {
     const { rows: serverRows } = await pool.query(sql `
       select

package/dist/core/objects/foreign-data-wrapper/user-mapping/changes/user-mapping.alter.js

@@ -1,4 +1,5 @@
 import { quoteLiteral } from "../../../base.change.js";
+import { redactOptionValue } from "../../sensitive-options.js";
 import { AlterUserMappingChange } from "./user-mapping.base.js";
 /**
  * ALTER USER MAPPING ... OPTIONS ( ADD | SET | DROP ... )
@@ -22,7 +23,9 @@ export class AlterUserMappingSetOptions extends AlterUserMappingChange {
                 optionParts.push(`DROP ${opt.option}`);
             }
             else {
-                const value = opt.value !== undefined ? quoteLiteral(opt.value) : "''";
+                const value = opt.value !== undefined
+                    ? quoteLiteral(redactOptionValue(opt.option, opt.value))
+                    : "''";
                 optionParts.push(`${opt.action} ${opt.option} ${value}`);
             }
         }

package/dist/core/objects/foreign-data-wrapper/user-mapping/changes/user-mapping.create.js

@@ -1,5 +1,6 @@
 import { quoteLiteral } from "../../../base.change.js";
 import { stableId } from "../../../utils.js";
+import { redactOptionValue } from "../../sensitive-options.js";
 import { CreateUserMappingChange } from "./user-mapping.base.js";
 /**
  * Create a user mapping.
@@ -39,9 +40,11 @@ export class CreateUserMapping extends CreateUserMappingChange {
         if (this.userMapping.options && this.userMapping.options.length > 0) {
             const optionPairs = [];
             for (let i = 0; i < this.userMapping.options.length; i += 2) {
-                if (i + 1 < this.userMapping.options.length) {
-                    optionPairs.push(`${this.userMapping.options[i]} ${quoteLiteral(this.userMapping.options[i + 1])}`);
-                }
+                const key = this.userMapping.options[i];
+                const value = this.userMapping.options[i + 1];
+                if (key === undefined || value === undefined)
+                    continue;
+                optionPairs.push(`${key} ${quoteLiteral(redactOptionValue(key, value))}`);
             }
             if (optionPairs.length > 0) {
                 parts.push(`OPTIONS (${optionPairs.join(", ")})`);

package/dist/core/objects/foreign-data-wrapper/user-mapping/user-mapping.model.d.ts

@@ -32,5 +32,15 @@ export declare class UserMapping extends BasePgModel {
         options: string[] | null;
     };
 }
+/**
+ * Extract `pg_user_mapping` rows into `UserMapping` models.
+ *
+ * The returned models carry option values **verbatim** from
+ * `pg_user_mapping.umoptions`, which means cleartext secrets like
+ * `password` are present in memory. Always route through
+ * `extractCatalog` (which calls `normalizeCatalog`) before emitting
+ * options to any output channel — see CLI-1467 and
+ * `packages/pg-delta/src/core/objects/foreign-data-wrapper/sensitive-options.ts`.
+ */
 export declare function extractUserMappings(pool: Pool): Promise<UserMapping[]>;
 export {};

package/dist/core/objects/foreign-data-wrapper/user-mapping/user-mapping.model.js

@@ -44,6 +44,16 @@ export class UserMapping extends BasePgModel {
         };
     }
 }
+/**
+ * Extract `pg_user_mapping` rows into `UserMapping` models.
+ *
+ * The returned models carry option values **verbatim** from
+ * `pg_user_mapping.umoptions`, which means cleartext secrets like
+ * `password` are present in memory. Always route through
+ * `extractCatalog` (which calls `normalizeCatalog`) before emitting
+ * options to any output channel — see CLI-1467 and
+ * `packages/pg-delta/src/core/objects/foreign-data-wrapper/sensitive-options.ts`.
+ */
 export async function extractUserMappings(pool) {
     const { rows: mappingRows } = await pool.query(sql `
       select

package/dist/core/objects/rls-policy/rls-policy.model.d.ts

@@ -3,9 +3,9 @@ import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const rlsPolicyReferencedRelationSchema: z.ZodObject<{
     kind: z.ZodEnum<{
+        table: "table";
         foreign_table: "foreign_table";
         materialized_view: "materialized_view";
-        table: "table";
         view: "view";
     }>;
     schema: z.ZodString;
@@ -37,9 +37,9 @@ declare const rlsPolicyPropsSchema: z.ZodObject<{
     comment: z.ZodNullable<z.ZodString>;
     referenced_relations: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
+            table: "table";
             foreign_table: "foreign_table";
             materialized_view: "materialized_view";
-            table: "table";
             view: "view";
         }>;
         schema: z.ZodString;

package/dist/core/objects/table/table.diff.js

@@ -28,12 +28,6 @@ function createAlterConstraintChange(mainTable, branchTable) {
                 table: branchTable,
                 constraint: c,
             }));
-            if (!c.validated) {
-                changes.push(new AlterTableValidateConstraint({
-                    table: branchTable,
-                    constraint: c,
-                }));
-            }
             // Add comment for newly created constraint
             if (c.comment !== null) {
                 changes.push(new CreateCommentOnConstraint({
@@ -53,7 +47,7 @@ function createAlterConstraintChange(mainTable, branchTable) {
             changes.push(new AlterTableDropConstraint({ table: mainTable, constraint: c }));
         }
     }
-    // Altered constraints -> drop + add
+    // Altered constraints -> drop + add (or VALIDATE-only shortcut)
     for (const [name, mainC] of mainByName) {
         const branchC = branchByName.get(name);
         if (!branchC)
@@ -62,23 +56,57 @@ function createAlterConstraintChange(mainTable, branchTable) {
         if (mainC.is_partition_clone || branchC.is_partition_clone) {
             continue;
         }
-        const changed = mainC.constraint_type !== branchC.constraint_type ||
-            mainC.deferrable !== branchC.deferrable ||
-            mainC.initially_deferred !== branchC.initially_deferred ||
-            mainC.validated !== branchC.validated ||
-            mainC.is_local !== branchC.is_local ||
-            mainC.no_inherit !== branchC.no_inherit ||
-            mainC.is_temporal !== branchC.is_temporal ||
-            JSON.stringify(mainC.key_columns) !==
-                JSON.stringify(branchC.key_columns) ||
-            JSON.stringify(mainC.foreign_key_columns) !==
-                JSON.stringify(branchC.foreign_key_columns) ||
-            mainC.foreign_key_table !== branchC.foreign_key_table ||
-            mainC.foreign_key_schema !== branchC.foreign_key_schema ||
-            mainC.on_update !== branchC.on_update ||
-            mainC.on_delete !== branchC.on_delete ||
-            mainC.match_type !== branchC.match_type ||
-            mainC.check_expression !== branchC.check_expression;
+        // Cheap scalar `===` checks first; only fall through to JSON.stringify
+        // on the array fields when every scalar has already matched.
+        const fieldsEqualExceptValidated = mainC.constraint_type === branchC.constraint_type &&
+            mainC.deferrable === branchC.deferrable &&
+            mainC.initially_deferred === branchC.initially_deferred &&
+            mainC.is_local === branchC.is_local &&
+            mainC.no_inherit === branchC.no_inherit &&
+            mainC.is_temporal === branchC.is_temporal &&
+            mainC.foreign_key_table === branchC.foreign_key_table &&
+            mainC.foreign_key_schema === branchC.foreign_key_schema &&
+            mainC.on_update === branchC.on_update &&
+            mainC.on_delete === branchC.on_delete &&
+            mainC.match_type === branchC.match_type &&
+            mainC.check_expression === branchC.check_expression &&
+            JSON.stringify(mainC.key_columns) ===
+                JSON.stringify(branchC.key_columns) &&
+            JSON.stringify(mainC.foreign_key_columns) ===
+                JSON.stringify(branchC.foreign_key_columns);
+        // Safe-migration shortcut: when the only difference is `validated`
+        // flipping from false to true, emit a single `ALTER TABLE ... VALIDATE
+        // CONSTRAINT` instead of drop+add. VALIDATE CONSTRAINT only takes
+        // SHARE UPDATE EXCLUSIVE (concurrent reads/writes proceed), whereas
+        // dropping and re-adding takes ACCESS EXCLUSIVE for the entire scan.
+        // Postgres has no reverse command, so `true -> false` must still go
+        // through drop+add below.
+        if (fieldsEqualExceptValidated &&
+            mainC.validated === false &&
+            branchC.validated === true) {
+            changes.push(new AlterTableValidateConstraint({
+                table: branchTable,
+                constraint: branchC,
+            }));
+            // VALIDATE preserves the constraint OID, so its comment is preserved
+            // too. Only emit a comment change if it actually differs.
+            if (mainC.comment !== branchC.comment) {
+                if (branchC.comment === null) {
+                    changes.push(new DropCommentOnConstraint({
+                        table: mainTable,
+                        constraint: mainC,
+                    }));
+                }
+                else {
+                    changes.push(new CreateCommentOnConstraint({
+                        table: branchTable,
+                        constraint: branchC,
+                    }));
+                }
+            }
+            continue;
+        }
+        const changed = mainC.validated !== branchC.validated || !fieldsEqualExceptValidated;
         if (changed) {
             changes.push(new AlterTableDropConstraint({
                 table: mainTable,
@@ -88,12 +116,6 @@ function createAlterConstraintChange(mainTable, branchTable) {
                 table: branchTable,
                 constraint: branchC,
             }));
-            if (!branchC.validated) {
-                changes.push(new AlterTableValidateConstraint({
-                    table: branchTable,
-                    constraint: branchC,
-                }));
-            }
             // Ensure constraint comment is applied after re-creation
             if (branchC.comment !== null) {
                 changes.push(new CreateCommentOnConstraint({
@@ -163,6 +185,7 @@ export function diffTables(ctx, main, branch) {
         changes.push(...createAlterConstraintChange(
         // Create a dummy table with no constraints do diff constraints against
         new Table({
+            // oxlint-disable-next-line typescript/no-misused-spread
             ...branchTable,
             constraints: [],
         }), branchTable));

package/dist/core/objects/table/table.model.js

@@ -292,8 +292,13 @@ select
           'no_inherit', c.connoinherit,
           'is_temporal', coalesce((to_jsonb(c)->>'conperiod')::boolean, false),
 
-          -- NEW: propagated-to-partition tagging (PG15+)
-          'is_partition_clone', (c.conparentid <> 0::oid),
+          -- Inherited from a parent (partition or classical inheritance).
+          -- coninhcount > 0 is the canonical signal across every constraint
+          -- kind. We previously used conparentid <> 0, but PostgreSQL only
+          -- populates conparentid for PK / UNIQUE / FK on partitions; CHECK
+          -- constraints on partitions always have conparentid = 0 and were
+          -- being re-emitted on every child, failing apply with 42710.
+          'is_partition_clone', (c.coninhcount > 0),
           'parent_constraint_schema', case when c.conparentid <> 0::oid then pc.connamespace::regnamespace::text end,
           'parent_constraint_name',   case when c.conparentid <> 0::oid then quote_ident(pc.conname) end,
           'parent_table_schema',      case when c.conparentid <> 0::oid then pc_rel.relnamespace::regnamespace::text end,

package/dist/core/plan/hierarchy.js

@@ -262,7 +262,7 @@ function addClusterChange(cluster, change) {
             break;
         default: {
             const _exhaustive = objectType;
-            throw new Error(`Unhandled object type: ${_exhaustive}`);
+            throw new Error(`Unhandled object type: ${JSON.stringify(_exhaustive)}`);
         }
     }
 }
@@ -303,7 +303,7 @@ function addChildChange(schema, change) {
             break;
         default: {
             const _exhaustive = parentType;
-            throw new Error(`Unhandled parent type: ${_exhaustive}`);
+            throw new Error(`Unhandled parent type: ${JSON.stringify(_exhaustive)}`);
         }
     }
     const objectType = change.objectType;
@@ -351,7 +351,7 @@ function addChildChange(schema, change) {
             break;
         default: {
             const _exhaustive = objectType;
-            throw new Error(`Unhandled object type: ${_exhaustive}`);
+            throw new Error(`Unhandled object type: ${JSON.stringify(_exhaustive)}`);
         }
     }
 }
@@ -482,7 +482,7 @@ function addSchemaLevelChange(schema, change, enrichment) {
             break;
         default: {
             const _exhaustive = objectType;
-            throw new Error(`Unhandled object type: ${_exhaustive}`);
+            throw new Error(`Unhandled object type: ${JSON.stringify(_exhaustive)}`);
         }
     }
 }

package/dist/core/postgres-config.d.ts

@@ -30,6 +30,13 @@ export declare function connectWithRetry<T>(opts: {
     maxBackoffMs?: number;
     sleep?: (ms: number) => Promise<void>;
 }): Promise<T>;
+/**
+ * Race `connect()` against a `timeoutMs` rejection and clear the timer when
+ * either side wins. If the timer is left running after a fast connect, the
+ * pending `setTimeout` keeps the event loop alive and the process hangs for
+ * the rest of `timeoutMs`.
+ */
+export declare function connectWithTimeout<T>(connect: () => Promise<T>, timeoutMs: number, label: "source" | "target"): Promise<T>;
 /**
  * Options for creating a Pool with event listeners.
  */

package/dist/core/postgres-config.js

@@ -180,6 +180,24 @@ export async function connectWithRetry(opts) {
     // Unreachable: loop either returns or throws.
     throw lastError;
 }
+/**
+ * Race `connect()` against a `timeoutMs` rejection and clear the timer when
+ * either side wins. If the timer is left running after a fast connect, the
+ * pending `setTimeout` keeps the event loop alive and the process hangs for
+ * the rest of `timeoutMs`.
+ */
+export function connectWithTimeout(connect, timeoutMs, label) {
+    let timer;
+    return Promise.race([
+        connect(),
+        new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`Connection to ${label} database timed out after ${timeoutMs}ms. ` +
+                `The server may require SSL, use an invalid certificate, or be unreachable.`)), timeoutMs);
+        }),
+    ]).finally(() => {
+        clearTimeout(timer);
+    });
+}
 /**
  * Create a Pool with custom type handlers and optional event listeners.
  *
@@ -347,11 +365,7 @@ export async function createManagedPool(url, options) {
     const timeoutMs = DEFAULT_CONNECT_TIMEOUT_MS;
     try {
         const client = await connectWithRetry({
-            connect: () => Promise.race([
-                pool.connect(),
-                new Promise((_, reject) => setTimeout(() => reject(new Error(`Connection to ${label} database timed out after ${timeoutMs}ms. ` +
-                    `The server may require SSL, use an invalid certificate, or be unreachable.`)), timeoutMs)),
-            ]),
+            connect: () => connectWithTimeout(() => pool.connect(), timeoutMs, label),
         });
         client.release();
     }

package/dist/core/sort/debug-visualization.js

@@ -139,7 +139,7 @@ export function printDebugGraph(phaseChanges, graphData, edges, dependencyRows,
         const mermaidDiagram = generateMermaidDiagram(phaseChanges, graphData, edges, requirementSets, dependenciesByReferencedId);
         debugGraph("\n==== Mermaid (cycle detected) ====\n%s\n==== end ====", mermaidDiagram);
     }
-    catch (_error) {
+    catch {
         // ignore debug printing errors
     }
 }

package/dist/core/sort/topological-sort.js

@@ -5,7 +5,7 @@
  */
 export function performStableTopologicalSort(nodeCount, edges) {
     const adjacencyList = Array.from({ length: nodeCount }, () => new Set());
-    const inDegreeCounts = new Array(nodeCount).fill(0);
+    const inDegreeCounts = Array.from({ length: nodeCount }, () => 0);
     for (const [sourceIndex, targetIndex] of edges) {
         if (!adjacencyList[sourceIndex].has(targetIndex)) {
             adjacencyList[sourceIndex].add(targetIndex);
@@ -51,7 +51,7 @@ export function findCycle(nodeCount, edges) {
         adjacencyList[sourceIndex].push(targetIndex);
     }
     // 0 = unvisited, 1 = visiting, 2 = completed
-    const visitState = new Array(nodeCount).fill(0);
+    const visitState = Array.from({ length: nodeCount }, () => 0);
     const pathStack = [];
     let cycleNodeIndexes = null;
     const depthFirstSearch = (nodeIndex) => {

package/package.json

@@ -1,7 +1,33 @@
 {
   "name": "@supabase/pg-delta",
-  "version": "1.0.0-alpha.24",
+  "version": "1.0.0-alpha.26",
   "description": "PostgreSQL migrations made easy",
+  "keywords": [
+    "diff",
+    "migrations",
+    "pg",
+    "pg-delta",
+    "pgdelta",
+    "postgres"
+  ],
+  "homepage": "https://github.com/supabase/pg-toolbelt",
+  "bugs": "https://github.com/supabase/pg-toolbelt/issues",
+  "license": "MIT",
+  "author": "Supabase",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/supabase/pg-toolbelt.git",
+    "directory": "packages/pg-delta"
+  },
+  "bin": {
+    "pgdelta": "./dist/cli/bin/cli.js"
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -36,40 +62,12 @@
       "default": "./dist/core/catalog-export/index.js"
     }
   },
-  "bin": {
-    "pgdelta": "./dist/cli/bin/cli.js"
-  },
-  "files": [
-    "dist",
-    "src",
-    "README.md",
-    "LICENSE"
-  ],
-  "keywords": [
-    "pg",
-    "postgres",
-    "migrations",
-    "diff",
-    "pg-delta",
-    "pgdelta"
-  ],
-  "author": "Supabase",
-  "license": "MIT",
-  "homepage": "https://github.com/supabase/pg-toolbelt",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/supabase/pg-toolbelt.git",
-    "directory": "packages/pg-delta"
-  },
-  "bugs": "https://github.com/supabase/pg-toolbelt/issues",
-  "engines": {
-    "node": ">=20.0.0"
-  },
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
     "check-types": "tsc --noEmit",
     "docs": "typedoc",
-    "format-and-lint": "biome check . --error-on-warnings",
+    "format-and-lint": "oxfmt --check . && oxlint --deny-warnings",
+    "format-and-lint:fix": "oxfmt . && oxlint --fix",
     "knip": "knip",
     "pgdelta": "bun src/cli/bin/cli.ts",
     "sync-base-images": "bun scripts/sync-supabase-base-images.ts",
@@ -77,12 +75,12 @@
     "test:unit": "bun run test src/",
     "test:integration": "bun run test tests/",
     "update-empty-baseline": "bun scripts/update-empty-catalog-baseline.ts",
-    "version": "changeset version && bun install --no-frozen-lockfile && bun run format-and-lint --write"
+    "version": "changeset version && bun install --no-frozen-lockfile && bun run format-and-lint:fix"
   },
   "dependencies": {
     "@stricli/core": "^1.2.4",
-    "@ts-safeql/sql-tag": "^0.2.0",
     "@supabase/pg-topo": "^1.0.0-alpha.1",
+    "@ts-safeql/sql-tag": "^0.2.0",
     "chalk": "^5.6.2",
     "debug": "^4.3.7",
     "pg": "^8.17.2",
@@ -103,5 +101,8 @@
     "testcontainers": "^11.10.0",
     "typedoc": "^0.28.17",
     "typescript": "^5.9.3"
+  },
+  "engines": {
+    "node": ">=20.0.0"
   }
 }

package/src/core/catalog.model.ts

@@ -22,12 +22,13 @@ import {
 } from "./objects/extension/extension.model.ts";
 import {
   extractForeignDataWrappers,
-  type ForeignDataWrapper,
+  ForeignDataWrapper,
 } from "./objects/foreign-data-wrapper/foreign-data-wrapper/foreign-data-wrapper.model.ts";
 import {
   extractForeignTables,
-  type ForeignTable,
+  ForeignTable,
 } from "./objects/foreign-data-wrapper/foreign-table/foreign-table.model.ts";
+import { redactSensitiveOptionPairs } from "./objects/foreign-data-wrapper/sensitive-options.ts";
 import {
   extractServers,
   Server,
@@ -181,9 +182,8 @@ let _pg1516Baseline: Catalog | null = null;
 let _pg17Baseline: Catalog | null = null;
 
 async function loadBaselineJson(): Promise<Record<string, unknown>> {
-  const mod = await import(
-    "./fixtures/empty-catalogs/postgres-15-16-baseline.json"
-  );
+  const mod =
+    await import("./fixtures/empty-catalogs/postgres-15-16-baseline.json");
   return mod.default as Record<string, unknown>;
 }
 
@@ -255,10 +255,12 @@ export async function createEmptyCatalog(
 ): Promise<Catalog> {
   if (version >= 170000) {
     const baseline = await getPg17Baseline();
+    // oxlint-disable-next-line typescript/no-misused-spread
     return new Catalog({ ...baseline, version, currentUser });
   }
   if (version >= 150000) {
     const baseline = await getPg1516Baseline();
+    // oxlint-disable-next-line typescript/no-misused-spread
     return new Catalog({ ...baseline, version, currentUser });
   }
 
@@ -421,29 +423,56 @@ function listToRecord<T extends BasePgModel>(list: T[]) {
 }
 
 function normalizeCatalog(catalog: Catalog): Catalog {
+  const foreignDataWrappers = mapRecord(
+    catalog.foreignDataWrappers,
+    (fdw) =>
+      new ForeignDataWrapper({
+        name: fdw.name,
+        owner: fdw.owner,
+        handler: fdw.handler,
+        validator: fdw.validator,
+        options: redactSensitiveOptionPairs(fdw.options),
+        comment: fdw.comment,
+        privileges: fdw.privileges,
+      }),
+  );
+
   const servers = mapRecord(catalog.servers, (server) => {
-    const maskedOptions = maskOptions(server.options);
     return new Server({
       name: server.name,
       owner: server.owner,
       foreign_data_wrapper: server.foreign_data_wrapper,
       type: server.type,
       version: server.version,
-      options: maskedOptions,
+      options: redactSensitiveOptionPairs(server.options),
       comment: server.comment,
       privileges: server.privileges,
     });
   });
 
   const userMappings = mapRecord(catalog.userMappings, (mapping) => {
-    const maskedOptions = maskOptions(mapping.options);
     return new UserMapping({
       user: mapping.user,
       server: mapping.server,
-      options: maskedOptions,
+      options: redactSensitiveOptionPairs(mapping.options),
     });
   });
 
+  const foreignTables = mapRecord(
+    catalog.foreignTables,
+    (foreignTable) =>
+      new ForeignTable({
+        schema: foreignTable.schema,
+        name: foreignTable.name,
+        owner: foreignTable.owner,
+        server: foreignTable.server,
+        columns: foreignTable.columns,
+        options: redactSensitiveOptionPairs(foreignTable.options),
+        comment: foreignTable.comment,
+        privileges: foreignTable.privileges,
+      }),
+  );
+
   const subscriptions = mapRecord(catalog.subscriptions, (subscription) => {
     return new Subscription({
       name: subscription.name,
@@ -490,10 +519,10 @@ function normalizeCatalog(catalog: Catalog): Catalog {
     rules: catalog.rules,
     ranges: catalog.ranges,
     views: catalog.views,
-    foreignDataWrappers: catalog.foreignDataWrappers,
+    foreignDataWrappers,
     servers,
     userMappings,
-    foreignTables: catalog.foreignTables,
+    foreignTables,
     depends: catalog.depends,
     indexableObjects: catalog.indexableObjects,
     version: catalog.version,
@@ -501,18 +530,6 @@ function normalizeCatalog(catalog: Catalog): Catalog {
   });
 }
 
-function maskOptions(options: string[] | null): string[] | null {
-  if (!options || options.length === 0) return options;
-  const masked: string[] = [];
-  for (let i = 0; i < options.length; i += 2) {
-    const key = options[i];
-    const value = options[i + 1];
-    if (key === undefined || value === undefined) continue;
-    masked.push(key, `__OPTION_${key.toUpperCase()}__`);
-  }
-  return masked.length > 0 ? masked : null;
-}
-
 function mapRecord<TValue, TResult>(
   record: Record<string, TValue>,
   mapper: (value: TValue) => TResult,

package/src/core/catalog.snapshot.test.ts

@@ -294,6 +294,7 @@ describe("catalog snapshot serde", () => {
 
     const sourceCatalog = await createEmptyCatalog(160000, "postgres");
     const targetCatalog = await createEmptyCatalog(160000, "postgres");
+    // oxlint-disable-next-line typescript/no-misused-spread
     const source = { ...sourceCatalog };
 
     expect(source instanceof Catalog).toBe(false);