@intentius/chant-lexicon-sql 0.115.0 → 0.117.0

package/src/postgres/plan/commands.ts

@@ -18,6 +18,10 @@ import { keyedByQualifiedName, pgBuildFileMajor, pgSchemaFromBuildFile, pgSchema
 import { serverNormalized } from "./server-normalize";
 import { POSTGRES_ENTITY_TYPES } from "../entity-types";
 import { migrationOpSuggestions } from "../migrate/handoff";
+import { POSTGRES_LATEST_MAJOR } from "../../spec/postgres-pin";
+import { ACCESS_MANAGED_KINDS } from "./normalize";
+import { declaredAccess, diffAccess, predictedAccess, targetKey } from "../access/acl";
+import { readLiveAccess } from "../access/live";
 
 export function emitPg(diff: PgSchemaDiff, json: boolean, title: string): number {
   console.log(json ? JSON.stringify(diff, null, 2) : renderPgDiff(diff, { title }));
@@ -69,6 +73,8 @@ export interface PgServerPlan {
   diff: PgSchemaDiff;
   /** The major the changes were classified for: the server's, else the one asked for. */
   major?: number;
+  /** The schemas the read was limited to; undefined is every schema. */
+  scope?: string[];
 }
 
 /**
@@ -83,29 +89,76 @@ export async function planAgainstClient(
   build: readonly PgSchemaObject[],
   options: { major?: number; environment?: string; readLive?: typeof readLiveSchema; serverNormalize?: typeof serverNormalized } = {},
 ): Promise<PgServerPlan> {
-  const declaredRaw = keyedByQualifiedName(build);
+  const managed = target.access === true;
+  const { kept, unmanaged } = accessScoped(keyedByQualifiedName(build), managed);
+  const declaredRaw = kept;
   const scope = scopeFor(
     target,
-    declaredRaw.map((o) => ({ type: POSTGRES_ENTITY_TYPES[o.canonical.kind], props: { name: o.canonical.name, ...(o.canonical.schema ? { schema: o.canonical.schema } : {}) } })),
+    declaredRaw.filter((o) => o.canonical.kind !== "role" && o.canonical.kind !== "grant" && o.canonical.kind !== "defaultPrivileges").map((o) => ({ type: POSTGRES_ENTITY_TYPES[o.canonical.kind], props: { name: o.canonical.name, ...(o.canonical.schema ? { schema: o.canonical.schema } : {}) } })),
   );
-  const liveObjects = markProviderOwned(await (options.readLive ?? readLiveSchema)(client, { schemas: scope }), target.provider);
+  const roles = declaredRaw.filter((o) => o.canonical.kind === "role").map((o) => o.canonical.name);
+  const liveObjects = markProviderOwned(await (options.readLive ?? readLiveSchema)(client, { schemas: scope, access: managed, roles }), target.provider);
   const live = pgSchemaFromLive(liveObjects, target.defaultSchema);
   const liveByKey = new Map(live.map((o) => [o.key, o]));
   const declared: PgSchemaObject[] = [];
   for (const o of declaredRaw) {
     const l = liveByKey.get(o.key);
-    if (l && differs(o, l) && (o.canonical.kind === "table" || o.canonical.kind === "view" || o.canonical.kind === "materializedView")) {
+    if (l && differs(o, l) && (o.canonical.kind === "table" || o.canonical.kind === "view" || o.canonical.kind === "materializedView" || o.canonical.kind === "trigger" || o.canonical.kind === "policy")) {
       declared.push({ ...o, canonical: { ...o.canonical, ...(await (options.serverNormalize ?? serverNormalized)(client, o.canonical, target.defaultSchema)) } });
     } else declared.push(o);
   }
   // The build's major, else the server's own when it differs, since the server is what takes the locks.
   const running = await serverMajor(client).catch(() => undefined);
   const major = running ?? options.major;
-  const diff = diffPgSchemas(live, declared, { major });
+  const diff = diffPgSchemas(live, declared, { major, access: false });
+  if (managed) {
+    const want = declaredAccess(declared, { major: major ?? POSTGRES_LATEST_MAJOR, ...(await currentRole(client)) });
+    const have = await readLiveAccess(client, want.targets, { ...(scope ? { schemas: scope } : {}), forRoles: want.forRoles, declaredDefaults: want.targets.filter((t) => t.kind === "default") });
+    // An object this plan creates is given what the server gives a new one.
+    const missing = want.targets.filter((t) => t.kind !== "default" && t.kind !== "column" && !have.present.has(targetKey(t)));
+    const now = new Map([...have.state, ...predictedAccess(missing, have)]);
+    const access = diffAccess(now, want.state, want.exportsOf);
+    if (access.length > 0) {
+      diff.changes.push(...access.map((a) => a.change));
+      diff.access = access;
+    }
+  } else if (unmanaged > 0) {
+    diff.hints.push(`${unmanaged} access declaration${unmanaged === 1 ? " is" : "s are"} not planned: ${options.environment ?? "this environment"}'s profile does not manage access (sql.profiles.<env>.access)`);
+  }
   if (running !== undefined && options.major !== undefined && running !== options.major) {
     diff.hints.push(`the build targets Postgres ${options.major} but ${options.environment ?? "the server"} runs Postgres ${running}; changes are classified for ${running}`);
   }
-  return { declared, live, liveObjects, diff, ...(major !== undefined ? { major } : {}) };
+  return { declared, live, liveObjects, diff, ...(major !== undefined ? { major } : {}), ...(scope ? { scope } : {}) };
+}
+
+/** The role a session runs as: the one whose own privileges owning an object gives, and whose default privileges apply. */
+async function currentRole(client: PostgresClient): Promise<{ self?: string }> {
+  const rows = await client.query<{ self: string }>("SELECT current_user AS self").catch(() => []);
+  return rows[0]?.self ? { self: rows[0].self } : {};
+}
+
+/**
+ * The declarations a plan compares: all of them where the profile manages
+ * access; otherwise none of the policies, roles, grants and default
+ * privileges, and no table's row-level security, so a project that manages
+ * access elsewhere is not affected. `unmanaged` counts what was left out.
+ */
+export function accessScoped(objects: readonly PgSchemaObject[], managed: boolean): { kept: PgSchemaObject[]; unmanaged: number } {
+  if (managed) return { kept: [...objects], unmanaged: 0 };
+  let unmanaged = 0;
+  const kept: PgSchemaObject[] = [];
+  for (const o of objects) {
+    if (ACCESS_MANAGED_KINDS.has(o.canonical.kind)) {
+      unmanaged++;
+      continue;
+    }
+    if (o.canonical.kind === "table" && (o.canonical.fields.rowSecurity || o.canonical.fields.forceRowSecurity)) {
+      unmanaged++;
+      const { rowSecurity: _r, forceRowSecurity: _f, ...fields } = o.canonical.fields;
+      kept.push({ ...o, canonical: { ...o.canonical, fields } });
+    } else kept.push(o);
+  }
+  return { kept, unmanaged };
 }
 
 /** The declared objects against the server, keys by qualified name and labels with the export name. */
@@ -115,8 +168,8 @@ export async function planPgAgainstServer(environment: string, buildFile: string
     const targeted = pgBuildFileMajor(buildFile) ?? (await projectMajor(options));
     const { declared, diff } = await planAgainstClient(client, target, pgSchemaFromBuildFile(buildFile, target.defaultSchema), { ...(targeted !== undefined ? { major: targeted } : {}), environment });
     const { migrationOps } = withMigrationOps(diff, declared, environment, target.defaultSchema);
-    const label = new Map(declared.map((o) => [o.key, `${o.canonical.exportName} (${o.key.split(" ")[1]})`]));
-    const changes = diff.changes.map((c) => ({ ...c, object: label.get(c.object) ?? c.object }));
+    const label = new Map(declared.map((o) => [o.key, `${o.canonical.exportName} (${o.key.slice(o.key.indexOf(" ") + 1)})`]));
+    const changes = diff.changes.map((c) => ({ ...c, object: label.get(c.object) ?? (c.object.startsWith("acl ") ? c.object.slice(4) : c.object) }));
     return { changes, hints: diff.hints, refused: changes.filter((c) => c.class === "expand"), ...(migrationOps ? { migrationOps } : {}) };
   } finally {
     await client.end();

package/src/postgres/plan/deep.ts

@@ -17,10 +17,12 @@ import { deepObservation, type DeepObservationResult, type DeepResourceObservati
 import type { UnobservedEntity } from "@intentius/chant/lexicon";
 import { bindPostgres, classifyPostgresFailure, type BindOptions } from "../live/bind";
 import { liveKey, readLiveSchema, type LivePgObject } from "../live/catalog";
-import { declaredAddress, scopeFor } from "../live/describe-resources";
+import { accessUnobserved, declaredAddress, scopeFor } from "../live/describe-resources";
 import * as tags from "../entities";
 import { POSTGRES_ENTITY_TYPES } from "../entity-types";
 import { canonicalPgObject, columnShape, sameConstraint, type CanonicalPgObject } from "./normalize";
+import { serverNormalized } from "./server-normalize";
+import type { PostgresClient } from "../live/client";
 
 type Props = Record<string, unknown>;
 
@@ -34,6 +36,13 @@ const TAG: Record<string, (s: TemplateStringsArray) => { props: object }> = {
   [POSTGRES_ENTITY_TYPES.enum]: tags.type,
   [POSTGRES_ENTITY_TYPES.domain]: tags.domain,
   [POSTGRES_ENTITY_TYPES.extension]: tags.extension,
+  [POSTGRES_ENTITY_TYPES.function]: tags.func,
+  [POSTGRES_ENTITY_TYPES.procedure]: tags.procedure,
+  [POSTGRES_ENTITY_TYPES.trigger]: tags.trigger,
+  [POSTGRES_ENTITY_TYPES.policy]: tags.policy,
+  [POSTGRES_ENTITY_TYPES.role]: tags.role,
+  [POSTGRES_ENTITY_TYPES.grant]: tags.grant,
+  [POSTGRES_ENTITY_TYPES.defaultPrivileges]: tags.grant,
 };
 
 /** The props of what the server printed, parsed with the declaration's tag. */
@@ -74,6 +83,40 @@ const PROP_OF_FIELD: Record<string, string[]> = {
   partitionBound: ["partitionBound"],
   inherits: ["inherits"],
   using: ["using"],
+  args: ["args"],
+  returns: ["returns", "returnsTable"],
+  language: ["language"],
+  body: ["body"],
+  link: ["link"],
+  securityDefiner: ["securityDefiner"],
+  set: ["set"],
+  transform: ["transform"],
+  volatility: ["volatility"],
+  strict: ["strict"],
+  leakproof: ["leakproof"],
+  parallel: ["parallel"],
+  cost: ["cost"],
+  rows: ["rows"],
+  support: ["support"],
+  window: ["window"],
+  constraint: ["constraint"],
+  timing: ["timing"],
+  events: ["events"],
+  forEach: ["forEach"],
+  when: ["when"],
+  function: ["function", "functionName"],
+  from: ["from"],
+  deferrable: ["deferrable"],
+  initiallyDeferred: ["initiallyDeferred"],
+  referencing: ["referencing"],
+  restrictive: ["permissive"],
+  command: ["command"],
+  roles: ["roles"],
+  check: ["check"],
+  attributes: ["options"],
+  connectionLimit: ["connectionLimit"],
+  rowSecurity: ["rowSecurity"],
+  forceRowSecurity: ["forceRowSecurity"],
 };
 
 /** Props keys that hold constraints, by constraint kind. */
@@ -150,39 +193,57 @@ export async function observeResourcesDeep(
   const unobserved: Record<string, UnobservedEntity> = {};
   let target;
   let live: LivePgObject[];
+  let client: PostgresClient;
   const declared = options.entityNames.map((name) => ({ name, entity: options.entities.get(name) }));
   try {
     const bound = await bindPostgres(options);
     target = bound.target;
+    client = bound.client;
     try {
       live = await readLiveSchema(bound.client, {
         schemas: scopeFor(target, declared.filter((x) => x.entity?.entityType.startsWith("Postgres::")).map((x) => ({ type: x.entity!.entityType, props: x.entity!.props }))),
+        access: target.access === true,
+        roles: declared.filter((x) => x.entity?.entityType === POSTGRES_ENTITY_TYPES.role).map((x) => String(x.entity!.props.name)),
       });
-    } finally {
+    } catch (err) {
       await bound.client.end();
+      throw err;
     }
   } catch (err) {
     const why = classifyPostgresFailure(err);
     for (const { name, entity } of declared) unobserved[name] = { type: entity?.entityType ?? "", reason: why.reason, detail: why.detail };
     return deepObservation({}, unobserved);
   }
-  const byKey = new Map(live.map((o) => [liveKey(o.type, o.schema, o.name), o]));
-  for (const { name, entity } of declared) {
-    if (!entity || !entity.entityType.startsWith("Postgres::")) {
-      unobserved[name] = { type: entity?.entityType ?? "", reason: "unsupported-kind" };
-      continue;
-    }
-    const { schema, name: objectName } = declaredAddress({ type: entity.entityType, props: entity.props }, target.defaultSchema);
-    const o = byKey.get(liveKey(entity.entityType, schema, objectName));
-    if (!o) continue;
-    try {
-      const lp = liveProps(o);
-      const d = canonicalPgObject(entity.entityType, entity.props, target.defaultSchema);
-      const l = canonicalPgObject(o.type, lp, target.defaultSchema);
-      resources[name] = { type: o.type, physicalId: o.oid, properties: inDeclaredVocabulary(entity.props, lp, d, l) };
-    } catch (err) {
-      unobserved[name] = { type: entity.entityType, reason: "read-failed", detail: `the server's definition does not parse: ${(err as Error).message}` };
+  try {
+    const byKey = new Map(live.map((o) => [liveKey(o.type, o.schema, o.name, o.signature), o]));
+    for (const { name, entity } of declared) {
+      if (!entity || !entity.entityType.startsWith("Postgres::")) {
+        unobserved[name] = { type: entity?.entityType ?? "", reason: "unsupported-kind" };
+        continue;
+      }
+      const why = accessUnobserved(entity.entityType, target.access === true);
+      if (why) {
+        unobserved[name] = { type: entity.entityType, ...why };
+        continue;
+      }
+      const { schema, name: objectName, signature } = declaredAddress({ type: entity.entityType, props: entity.props }, target.defaultSchema);
+      const o = byKey.get(liveKey(entity.entityType, schema, objectName, signature));
+      if (!o) continue;
+      try {
+        const lp = liveProps(o);
+        let d = canonicalPgObject(entity.entityType, entity.props, target.defaultSchema);
+        const l = canonicalPgObject(o.type, lp, target.defaultSchema);
+        // A trigger's WHEN and a policy's expressions as the server would print them, when the rules leave them different.
+        if ((d.kind === "trigger" && d.fields.when !== l.fields.when) || (d.kind === "policy" && (d.fields.using !== l.fields.using || d.fields.check !== l.fields.check))) {
+          d = await serverNormalized(client, d, target.defaultSchema);
+        }
+        resources[name] = { type: o.type, physicalId: o.oid, properties: inDeclaredVocabulary(entity.props, lp, d, l) };
+      } catch (err) {
+        unobserved[name] = { type: entity.entityType, reason: "read-failed", detail: `the server's definition does not parse: ${(err as Error).message}` };
+      }
     }
+  } finally {
+    await client.end();
   }
   return deepObservation(resources, unobserved);
 }

package/src/postgres/plan/diff.ts

@@ -16,14 +16,21 @@
 import { classifiedChange, type ChangeSet, type ClassifiedChange } from "../../core/classifier";
 import { matchByIdentity } from "../../core/diff";
 import { PG_CLASSIFIER_RULES, type PgChangeClass, type PgClassifierRuleId } from "./rules";
-import { sameConstraint, serialBase, type CanonicalColumn, type CanonicalConstraint } from "./normalize";
-import type { PgDiffObject, PgSchemaObject } from "./schema";
+import { ACCESS_KINDS, sameConstraint, serialBase, type CanonicalColumn, type CanonicalConstraint } from "./normalize";
+import { builtinEntries, declaredAccess, diffAccess, entryKey, targetKey, type AccessChange } from "../access/acl";
+import { pgNamespace, type PgDiffObject, type PgSchemaObject } from "./schema";
 import { POSTGRES_LATEST_MAJOR } from "../../spec/postgres-pin";
 import type { PostgresMigrationOpSuggestion } from "../migrate/handoff";
 
 /** What the diff needs to know beyond the two schemas: the server's major (`sql.postgresMajor`, else the newest pinned). */
 export interface PgDiffOptions {
   major?: number;
+  /**
+   * Whether to compare the access the two sides declare (grants, revokes,
+   * default privileges). On by default, for a diff between two builds; a plan
+   * against a server compares the server's access itself (`./commands.ts`).
+   */
+  access?: boolean;
 }
 
 export type PgChange = ClassifiedChange<PgClassifierRuleId, PgChangeClass>;
@@ -33,12 +40,14 @@ export interface PgSchemaDiff extends ChangeSet<PgChange> {
   refused: PgChange[];
   /** The `PostgresMigrationOp` to run for each refused column rename or type change (#3281). */
   migrationOps?: PostgresMigrationOpSuggestion[];
+  /** The access changes among `changes`, each with its GRANT, REVOKE or ALTER DEFAULT PRIVILEGES statements (#3681). */
+  access?: AccessChange[];
 }
 
 const change = (object: string, field: string, rule: PgClassifierRuleId, before?: unknown, after?: unknown, extra: Partial<PgChange> = {}): PgChange =>
   classifiedChange(PG_CLASSIFIER_RULES, object, field, rule, before, after, extra);
 
-const qualified = (o: PgDiffObject) => `${o.schema ? `${o.schema}.` : ""}${o.name}`;
+const qualified = (o: PgDiffObject) => `${o.schema ? `${o.schema}.` : ""}${o.name}${o.kind === "trigger" || o.kind === "policy" ? "" : (o.signature ?? "")}`;
 
 // ── Columns ────────────────────────────────────────────────────────────
 
@@ -258,7 +267,67 @@ function diffObject(key: string, before: PgDiffObject, after: PgDiffObject, out:
       field("columnComments", "SQLPG216");
       break;
     }
+    case "function":
+    case "procedure": {
+      // CREATE OR REPLACE cannot change the result, the OUT parameters, an input parameter's name, a removed default or a window function's kind.
+      const ba = (before.fields.args as string[] | undefined) ?? [];
+      const aa = (after.fields.args as string[] | undefined) ?? [];
+      const inputName = (a: string) => (/^(in|inout|variadic) /.test(a) ? a.split(" ")[1] : undefined);
+      const reasons: string[] = [];
+      // Between two builds, the same export with other parameter types is another function on the server.
+      if (before.signature !== after.signature) reasons.push(`the parameter types ${before.signature} -> ${after.signature}`);
+      if (!same(before.fields.returns, after.fields.returns)) reasons.push(`the result ${show(before.fields.returns) ?? "-"} -> ${show(after.fields.returns) ?? "-"}`);
+      const outs = (l: string[]) => l.filter((a) => /^(out|inout) /.test(a));
+      if (!same(outs(ba), outs(aa))) reasons.push("the output parameters");
+      if (ba.some((a, i) => aa[i] !== undefined && inputName(a) !== inputName(aa[i]!) && /^(in|inout|variadic) /.test(aa[i]!))) reasons.push("a parameter's name");
+      if (ba.some((a, i) => / default /.test(a) && aa[i] !== undefined && !/ default /.test(aa[i]!))) reasons.push("a parameter's default is removed");
+      if (!same(before.fields.window, after.fields.window)) reasons.push("WINDOW");
+      const definition = ["args", "returns", "language", "body", "link", "securityDefiner", "set", "transform", "volatility", "strict", "leakproof", "parallel", "cost", "rows", "support", "window"];
+      const changed = definition.filter((k) => !same(before.fields[k], after.fields[k]));
+      if (changed.length === 0 && reasons.length === 0) break;
+      if (changed.length === 0) changed.push("args");
+      const what = changed.join(", ");
+      if (reasons.length === 0) out.push(change(key, what, "SQLPG280", undefined, undefined, { note: `CREATE OR REPLACE ${after.kind.toUpperCase()}` }));
+      else if (before.dependents && before.dependents.length > 0) {
+        out.push(change(key, what, "SQLPG282", undefined, undefined, { note: `${reasons.join(", ")} changes, and ${before.dependents.join(", ")} depend${before.dependents.length === 1 ? "s" : ""} on it` }));
+      } else out.push(change(key, what, "SQLPG281", undefined, undefined, { note: `${reasons.join(", ")} changes, which CREATE OR REPLACE refuses` }));
+      break;
+    }
+    case "trigger": {
+      const definition = ["table", "constraint", "timing", "events", "forEach", "when", "function", "args", "from", "deferrable", "initiallyDeferred", "referencing"];
+      const changed = definition.filter((k) => !same(before.fields[k], after.fields[k]));
+      if (changed.length > 0) {
+        out.push(
+          change(key, changed.join(", "), "SQLPG284", changed.map((k) => `${k} ${show(before.fields[k]) ?? "-"}`).join("; "), changed.map((k) => `${k} ${show(after.fields[k]) ?? "-"}`).join("; "), after.fields.constraint || before.fields.constraint || !same(before.fields.table, after.fields.table) ? { note: "dropped and created in one transaction: a constraint trigger has no OR REPLACE, and OR REPLACE keeps a trigger on its table" } : {}),
+        );
+      }
+      break;
+    }
+    case "policy": {
+      // ALTER POLICY sets the roles, USING and WITH CHECK; the command and AS RESTRICTIVE are fixed, and neither expression can be taken away.
+      const definition = ["table", "restrictive", "command", "roles", "using", "check"];
+      const changed = definition.filter((k) => !same(before.fields[k], after.fields[k]));
+      if (changed.length === 0) break;
+      const recreate =
+        !same(before.fields.table, after.fields.table) ||
+        !same(before.fields.restrictive, after.fields.restrictive) ||
+        !same(before.fields.command, after.fields.command) ||
+        (before.fields.using !== undefined && after.fields.using === undefined) ||
+        (before.fields.check !== undefined && after.fields.check === undefined);
+      out.push(
+        change(key, changed.join(", "), "SQLPG291", changed.map((k) => `${k} ${show(before.fields[k]) ?? "-"}`).join("; "), changed.map((k) => `${k} ${show(after.fields[k]) ?? "-"}`).join("; "), recreate ? { note: "dropped and created in one transaction: ALTER POLICY cannot change its command, AS RESTRICTIVE or table, or take an expression away" } : {}),
+      );
+      break;
+    }
+    case "role":
+      field("attributes", "SQLPG294");
+      field("connectionLimit", "SQLPG294");
+      break;
     case "table":
+      if (!same(before.fields.rowSecurity, after.fields.rowSecurity) || !same(before.fields.forceRowSecurity, after.fields.forceRowSecurity)) {
+        const state = (o: PgDiffObject) => (o.fields.rowSecurity ? (o.fields.forceRowSecurity ? "enabled, forced" : "enabled") : o.fields.forceRowSecurity ? "disabled, forced" : "disabled");
+        out.push(change(key, "rowSecurity", "SQLPG293", state(before), state(after), after.fields.rowSecurity && !before.fields.rowSecurity ? { note: "with row-level security on, a role the table's policies do not let in sees no rows" } : {}));
+      }
       diffColumns(key, before, after, out, hints, false, major);
       diffConstraints(key, before, after, out, false);
       field("with", "SQLPG224");
@@ -288,17 +357,21 @@ function createdTables(matches: ReturnType<typeof matchByIdentity<PgDiffObject>>
  */
 export function matchPgObjects(before: readonly PgSchemaObject[], after: readonly PgSchemaObject[]): ReturnType<typeof matchByIdentity<PgDiffObject>> {
   return matchByIdentity(before, after, {
-    qualified: (o) => `${o.kind === "schema" ? "schema" : o.kind === "extension" ? "extension" : o.kind === "enum" || o.kind === "domain" ? "type" : "relation"} ${qualified(o)}`,
+    qualified: (o) => `${pgNamespace(o.kind)} ${o.schema ? `${o.schema}.` : ""}${o.name}${o.signature ?? ""}`,
     previously: (o) => o.previously,
     previousNames: (o, prev) => {
-      const space = o.kind === "schema" ? "schema" : o.kind === "extension" ? "extension" : o.kind === "enum" || o.kind === "domain" ? "type" : "relation";
-      return [`${space} ${prev}`, ...(o.schema && !prev.includes(".") ? [`${space} ${o.schema}.${prev}`] : [])];
+      const space = pgNamespace(o.kind);
+      const sig = o.signature ?? "";
+      return [`${space} ${prev}${sig}`, ...(o.schema && !prev.includes(".") ? [`${space} ${o.schema}.${prev}${sig}`] : [])];
     },
   });
 }
 
-export function diffPgSchemas(before: readonly PgSchemaObject[], after: readonly PgSchemaObject[], options: PgDiffOptions = {}): PgSchemaDiff {
+export function diffPgSchemas(beforeAll: readonly PgSchemaObject[], afterAll: readonly PgSchemaObject[], options: PgDiffOptions = {}): PgSchemaDiff {
   const major = options.major ?? POSTGRES_LATEST_MAJOR;
+  // Grants and default privileges are compared as the access they add up to, below, not one declaration against another.
+  const before = beforeAll.filter((o) => !ACCESS_KINDS.has(o.canonical.kind));
+  const after = afterAll.filter((o) => !ACCESS_KINDS.has(o.canonical.kind));
   const matches = matchPgObjects(before, after);
   const newTables = createdTables(matches);
   const changes: PgChange[] = [];
@@ -308,6 +381,10 @@ export function diffPgSchemas(before: readonly PgSchemaObject[], after: readonly
       const o = m.after.canonical;
       if (o.kind === "index" && !newTables.has(String(o.fields.table))) {
         changes.push(change(m.after.key, "index", o.concurrently ? "SQLPG240" : "SQLPG241", undefined, qualified(o)));
+      } else if (o.kind === "trigger" && !newTables.has(String(o.fields.table))) {
+        changes.push(change(m.after.key, "trigger", "SQLPG283", undefined, `${o.name}${o.signature ?? ""}`));
+      } else if (o.kind === "policy" && !newTables.has(String(o.fields.table))) {
+        changes.push(change(m.after.key, "policy", "SQLPG290", undefined, `${o.name}${o.signature ?? ""}`));
       } else changes.push(change(m.after.key, o.kind, "SQLPG200", undefined, qualified(o)));
     } else if (m.kind === "dropped") {
       const o = m.before.canonical;
@@ -315,9 +392,37 @@ export function diffPgSchemas(before: readonly PgSchemaObject[], after: readonly
         hints.push(`${m.before.key} is kept by ${o.foreign}; it is not chant's to drop and is left alone`);
         continue;
       }
+      if (o.kind === "role") {
+        hints.push(`role ${o.name} is no longer declared; a role is the cluster's and is never dropped`);
+        continue;
+      }
       const destructive = o.kind === "table" || o.kind === "materializedView" || o.kind === "sequence";
-      changes.push(change(m.before.key, o.kind, o.kind === "index" ? "SQLPG242" : "SQLPG270", qualified(o), undefined, destructive ? { destructive: true } : {}));
+      const rule = o.kind === "index" ? "SQLPG242" : o.kind === "trigger" ? "SQLPG285" : o.kind === "policy" ? "SQLPG292" : "SQLPG270";
+      changes.push(change(m.before.key, o.kind, rule, o.kind === "trigger" || o.kind === "policy" ? `${o.name}${o.signature ?? ""}` : qualified(o), undefined, destructive ? { destructive: true } : {}));
     } else diffObject(m.after.key, m.before.canonical, m.after.canonical, changes, hints, major);
   }
-  return { changes, hints, refused: changes.filter((c) => c.class === "expand") };
+  const access = options.access === false ? [] : buildAccessChanges(beforeAll, afterAll, major);
+  changes.push(...access.map((a) => a.change));
+  return { changes, hints, refused: changes.filter((c) => c.class === "expand"), ...(access.length > 0 ? { access } : {}) };
+}
+
+/**
+ * The access change between two builds: on what the newer build decides. An
+ * object only it declares starts from what Postgres gives a new one; an
+ * object only the older one declared is dropped with its privileges.
+ */
+function buildAccessChanges(before: readonly PgSchemaObject[], after: readonly PgSchemaObject[], major: number): AccessChange[] {
+  const b = declaredAccess(before, { major });
+  const a = declaredAccess(after, { major });
+  const decided = new Set(a.targets.map(targetKey));
+  const known = new Set(b.targets.map(targetKey));
+  const from = new Map([...b.state].filter(([, e]) => decided.has(targetKey(e.target))));
+  for (const t of a.targets) {
+    if (known.has(targetKey(t)) || t.kind === "default" || t.kind === "column") continue;
+    for (const e of builtinEntries(t.kind)) {
+      const key = entryKey(t, e.grantee);
+      from.set(key, { target: t, grantee: e.grantee, privileges: new Map([...(from.get(key)?.privileges ?? []), [e.privilege, false]]) });
+    }
+  }
+  return diffAccess(from, a.state, a.exportsOf);
 }