feat(slice): opt-in AST-based dependency closure for pattern slices (prototype)

[pyramation]

Summary

Prototype for constructive-io/constructive-planning#1270 — do not merge as-is. Cherry-picking a change with PatternStrategy today requires hand-written globs covering its full dependency closure; undeclared dependencies (e.g. a PL/pgSQL body calling a function absent from the requires header) are silently left behind. This adds an opt-in closure mode to the slicer that parses each change's deploy SQL (pgsql AST + hydrated PL/pgSQL body walk via plpgsql-parser) and pulls the true transitive closure into the package, with a report of what was auto-included and why.

slicePlan({
  sourcePlan, outputDir,
  strategy: { type: 'pattern', slices: [
    { packageName: 'api', patterns: ['schemas/api/**'], closure: true }  // per-slice opt-in
  ]},
  defaultPackage: 'rest',
  closure: { moduleDir }  // root containing deploy/<change>.sql
});
// result.closureReport.autoIncluded:
//   [{ change: 'schemas/billing/functions/calc_total', package: 'api',
//      requiredBy: 'schemas/api/functions/get_totals', reason: 'ast', ref: 'billing.calc_total' }, ...]

• slice/refs.ts — extractSqlFacts(sql): created objects + schema-qualified references (tables/views, function calls incl. inside PL/pgSQL bodies, types, FK targets, trigger EXECUTE FUNCTION targets) + dynamicSql flag. Callers await loadModule() once (WASM parser).
• slice/closure.ts — buildAstEdges(graph, moduleDir): producer index (object → first plan change creating it) → change→change edges, intersected with plan-known changes; unresolvable refs reported, never guessed. expandClosures: BFS from each closure-enabled slice's seeds over declared requires ∪ AST edges; only pulls changes currently in the default package — deps claimed by another explicit slice stay put as ordinary cross-package deps.
• AST-discovered edges additionally feed package-level deps (control requires / deploy order) via a new optional extraEdges arg on buildPackageDependencies, but never plan requires lines (body refs are late-binding and may legitimately be mutually recursive).
• Report surfaces dynamicSqlChanges (EXECUTE — refs invisible to the AST) and unresolvedReferences (objects no plan change produces, e.g. installed modules).
• Default behavior unchanged: without SliceConfig.closure + a closure: true slice, nothing new runs.

New deps on @pgpmjs/core: @pgsql/traverse, plpgsql-parser (both already used elsewhere in the constructive ecosystem).

Tests: __tests__/slice/slice-closure.test.ts (9 tests) — headline case: cherry-picking schemas/api/** auto-pulls billing.calc_total → billing.invoices → billing schema purely from PL/pgSQL body references not declared in any requires header. Existing slice tests unchanged and passing.

Open question tracked in the issue: whether refs.ts should be replaced by a shared @pgsql/facts-style package extracted from constructive-db's transform-schemas classifier.

Link to Devin session: https://app.devin.ai/sessions/1aa52746e60c4df38ef2678d168269b9
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	plpgsql-parser@​18.2.1
	@​pgsql/​traverse@​18.3.0

View full report