feat(slice): opt-in AST-based dependency closure for pattern slices (on @pgsql/transform)

[pyramation]

Summary

Redo of the closed prototype #1469, now built on the published @pgsql/transform@18.3.0 (constructive-io/constructive-planning#1270 / #1271): cherry-picked pattern slices can pull in their TRUE transitive dependencies discovered from the SQL itself — function calls (incl. inside PL/pgSQL bodies), table/view/type references, FK targets — even when not declared in plan requires headers.

Opt-in only; default slicing behavior is unchanged:

slicePlan(plan, {
  strategy: { type: 'pattern', slices: [{ package: 'api', patterns: ['schemas/api/**'], closure: true }] },
  closure: { moduleDir }   // where deploy/ scripts live
});
// result.closure => { autoIncluded: [{ change, package, requiredBy, reason: 'requires'|'ast', ref? }],
//                     dynamicSqlChanges, unresolvedReferences }

vs #1469: refs.ts no longer hand-rolls AST walking — extractSqlFacts is now a thin change-level aggregation over classifyStatements from @pgsql/transform (dedupe across statements + drop self-created references). closure.ts builds change-level edges from the facts and feeds them into package dependency computation via a new optional extraEdges param on buildPackageDependencies.

Callers must await loadModule() (re-exported from plpgsql-parser) before slicing with closure enabled — the parser is WASM.

Tests: 33 slice tests pass (9 closure-specific). The two failing tests in __tests__/slice/slice-deploy-integration.test.ts require a live PostgreSQL and fail identically without this change.

Link to Devin session: https://app.devin.ai/sessions/1aa52746e60c4df38ef2678d168269b9
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	plpgsql-parser@​18.2.1

View full report

[devin-ai-integration]

Folded into #1470 per discussion — slicing moved out of core into the new @pgpmjs/slice package there.