@supabase/pg-delta 0.0.0 → 1.0.0-alpha.0

package/dist/core/objects/role/changes/role.base.js

@@ -0,0 +1,13 @@
+import { BaseChange } from "../../base.change.js";
+class BaseRoleChange extends BaseChange {
+    objectType = "role";
+}
+export class CreateRoleChange extends BaseRoleChange {
+    operation = "create";
+}
+export class AlterRoleChange extends BaseRoleChange {
+    operation = "alter";
+}
+export class DropRoleChange extends BaseRoleChange {
+    operation = "drop";
+}

package/dist/core/objects/role/changes/role.comment.d.ts

@@ -0,0 +1,23 @@
+import type { Role } from "../role.model.ts";
+import { CreateRoleChange, DropRoleChange } from "./role.base.ts";
+export type CommentRole = CreateCommentOnRole | DropCommentOnRole;
+export declare class CreateCommentOnRole extends CreateRoleChange {
+    readonly role: Role;
+    readonly scope: "comment";
+    constructor(props: {
+        role: Role;
+    });
+    get creates(): `comment:${string}`[];
+    get requires(): `role:${string}`[];
+    serialize(): string;
+}
+export declare class DropCommentOnRole extends DropRoleChange {
+    readonly role: Role;
+    readonly scope: "comment";
+    constructor(props: {
+        role: Role;
+    });
+    get drops(): `comment:${string}`[];
+    get requires(): (`comment:${string}` | `role:${string}`)[];
+    serialize(): string;
+}

package/dist/core/objects/role/changes/role.comment.js

@@ -0,0 +1,42 @@
+import { quoteLiteral } from "../../base.change.js";
+import { stableId } from "../../utils.js";
+import { CreateRoleChange, DropRoleChange } from "./role.base.js";
+export class CreateCommentOnRole extends CreateRoleChange {
+    role;
+    scope = "comment";
+    constructor(props) {
+        super();
+        this.role = props.role;
+    }
+    get creates() {
+        return [stableId.comment(this.role.stableId)];
+    }
+    get requires() {
+        return [this.role.stableId];
+    }
+    serialize() {
+        return [
+            "COMMENT ON ROLE",
+            this.role.name,
+            "IS",
+            quoteLiteral(this.role.comment),
+        ].join(" ");
+    }
+}
+export class DropCommentOnRole extends DropRoleChange {
+    role;
+    scope = "comment";
+    constructor(props) {
+        super();
+        this.role = props.role;
+    }
+    get drops() {
+        return [stableId.comment(this.role.stableId)];
+    }
+    get requires() {
+        return [stableId.comment(this.role.stableId), this.role.stableId];
+    }
+    serialize() {
+        return ["COMMENT ON ROLE", this.role.name, "IS NULL"].join(" ");
+    }
+}

package/dist/core/objects/role/changes/role.create.d.ts

@@ -0,0 +1,38 @@
+import type { Role } from "../role.model.ts";
+import { CreateRoleChange } from "./role.base.ts";
+/**
+ * Create a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-createrole.html
+ *
+ * Synopsis
+ * ```sql
+ * CREATE ROLE name [ [ WITH ] option [ ... ] ]
+ * where option can be:
+ *     SUPERUSER | NOSUPERUSER
+ *     | CREATEDB | NOCREATEDB
+ *     | CREATEROLE | NOCREATEROLE
+ *     | INHERIT | NOINHERIT
+ *     | LOGIN | NOLOGIN
+ *     | REPLICATION | NOREPLICATION
+ *     | BYPASSRLS | NOBYPASSRLS
+ *     | CONNECTION LIMIT connlimit
+ *     | [ ENCRYPTED ] PASSWORD 'password' | PASSWORD NULL
+ *     | VALID UNTIL 'timestamp'
+ *     | IN ROLE role_name [, ...]
+ *     | IN GROUP role_name [, ...]
+ *     | ROLE role_name [, ...]
+ *     | ADMIN role_name [, ...]
+ *     | USER role_name [, ...]
+ *     | SYSID uid
+ * ```
+ */
+export declare class CreateRole extends CreateRoleChange {
+    readonly role: Role;
+    readonly scope: "object";
+    constructor(props: {
+        role: Role;
+    });
+    get creates(): `role:${string}`[];
+    serialize(): string;
+}

package/dist/core/objects/role/changes/role.create.js

@@ -0,0 +1,83 @@
+import { CreateRoleChange } from "./role.base.js";
+/**
+ * Create a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-createrole.html
+ *
+ * Synopsis
+ * ```sql
+ * CREATE ROLE name [ [ WITH ] option [ ... ] ]
+ * where option can be:
+ *     SUPERUSER | NOSUPERUSER
+ *     | CREATEDB | NOCREATEDB
+ *     | CREATEROLE | NOCREATEROLE
+ *     | INHERIT | NOINHERIT
+ *     | LOGIN | NOLOGIN
+ *     | REPLICATION | NOREPLICATION
+ *     | BYPASSRLS | NOBYPASSRLS
+ *     | CONNECTION LIMIT connlimit
+ *     | [ ENCRYPTED ] PASSWORD 'password' | PASSWORD NULL
+ *     | VALID UNTIL 'timestamp'
+ *     | IN ROLE role_name [, ...]
+ *     | IN GROUP role_name [, ...]
+ *     | ROLE role_name [, ...]
+ *     | ADMIN role_name [, ...]
+ *     | USER role_name [, ...]
+ *     | SYSID uid
+ * ```
+ */
+export class CreateRole extends CreateRoleChange {
+    role;
+    scope = "object";
+    constructor(props) {
+        super();
+        this.role = props.role;
+    }
+    get creates() {
+        return [this.role.stableId];
+    }
+    serialize() {
+        const parts = ["CREATE ROLE"];
+        // Add role name
+        parts.push(this.role.name);
+        // Add options (only non-default values)
+        const options = [];
+        // SUPERUSER (default is NOSUPERUSER)
+        if (this.role.is_superuser) {
+            options.push("SUPERUSER");
+        }
+        // CREATEDB (default is NOCREATEDB)
+        if (this.role.can_create_databases) {
+            options.push("CREATEDB");
+        }
+        // CREATEROLE (default is NOCREATEROLE)
+        if (this.role.can_create_roles) {
+            options.push("CREATEROLE");
+        }
+        // INHERIT (default is INHERIT, so only print if false)
+        if (!this.role.can_inherit) {
+            options.push("NOINHERIT");
+        }
+        // LOGIN (default is NOLOGIN)
+        if (this.role.can_login) {
+            options.push("LOGIN");
+        }
+        // REPLICATION (default is NOREPLICATION)
+        if (this.role.can_replicate) {
+            options.push("REPLICATION");
+        }
+        // BYPASSRLS (default is NOBYPASSRLS)
+        if (this.role.can_bypass_rls) {
+            options.push("BYPASSRLS");
+        }
+        // CONNECTION LIMIT
+        if (this.role.connection_limit !== null &&
+            this.role.connection_limit !== -1) {
+            options.push(`CONNECTION LIMIT ${this.role.connection_limit}`);
+        }
+        if (options.length > 0) {
+            parts.push("WITH", options.join(" "));
+        }
+        return parts.join(" ");
+    }
+}

package/dist/core/objects/role/changes/role.drop.d.ts

@@ -0,0 +1,22 @@
+import type { Role } from "../role.model.ts";
+import { DropRoleChange } from "./role.base.ts";
+/**
+ * Drop a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-droprole.html
+ *
+ * Synopsis
+ * ```sql
+ * DROP ROLE [ IF EXISTS ] name [, ...]
+ * ```
+ */
+export declare class DropRole extends DropRoleChange {
+    readonly role: Role;
+    readonly scope: "object";
+    constructor(props: {
+        role: Role;
+    });
+    get drops(): `role:${string}`[];
+    get requires(): `role:${string}`[];
+    serialize(): string;
+}

package/dist/core/objects/role/changes/role.drop.js

@@ -0,0 +1,28 @@
+import { DropRoleChange } from "./role.base.js";
+/**
+ * Drop a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-droprole.html
+ *
+ * Synopsis
+ * ```sql
+ * DROP ROLE [ IF EXISTS ] name [, ...]
+ * ```
+ */
+export class DropRole extends DropRoleChange {
+    role;
+    scope = "object";
+    constructor(props) {
+        super();
+        this.role = props.role;
+    }
+    get drops() {
+        return [this.role.stableId];
+    }
+    get requires() {
+        return [this.role.stableId];
+    }
+    serialize() {
+        return ["DROP ROLE", this.role.name].join(" ");
+    }
+}

package/dist/core/objects/role/changes/role.privilege.d.ts

@@ -0,0 +1,148 @@
+import type { Role } from "../role.model.ts";
+import { CreateRoleChange, DropRoleChange } from "./role.base.ts";
+export type RolePrivilege = GrantRoleMembership | RevokeRoleMembership | RevokeRoleMembershipOptions | GrantRoleDefaultPrivileges | RevokeRoleDefaultPrivileges;
+/**
+ * Grant role membership.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-grant.html
+ *
+ * Synopsis
+ * ```sql
+ * GRANT role_name [, ...] TO role_specification [, ...]
+ *     [ WITH ADMIN OPTION ]
+ *     [ GRANTED BY role_specification ]
+ * ```
+ */
+export declare class GrantRoleMembership extends CreateRoleChange {
+    readonly role: Role;
+    readonly member: string;
+    readonly options: {
+        admin: boolean;
+        inherit?: boolean | null;
+        set?: boolean | null;
+    };
+    readonly scope: "membership";
+    constructor(props: {
+        role: Role;
+        member: string;
+        options: {
+            admin: boolean;
+            inherit?: boolean | null;
+            set?: boolean | null;
+        };
+    });
+    get creates(): `membership:${string}->${string}`[];
+    get requires(): `role:${string}`[];
+    serialize(): string;
+}
+/**
+ * Revoke role membership.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ *
+ * Synopsis
+ * ```sql
+ * REVOKE [ ADMIN OPTION FOR ] role_name [, ...] FROM role_specification [, ...]
+ *     [ GRANTED BY role_specification ]
+ *     [ CASCADE | RESTRICT ]
+ * ```
+ */
+export declare class RevokeRoleMembership extends DropRoleChange {
+    readonly role: Role;
+    readonly member: string;
+    readonly scope: "membership";
+    constructor(props: {
+        role: Role;
+        member: string;
+    });
+    get drops(): `membership:${string}->${string}`[];
+    get requires(): (`role:${string}` | `membership:${string}->${string}`)[];
+    serialize(): string;
+}
+/**
+ * Revoke membership options for a role.
+ *
+ * This removes specific options (ADMIN, INHERIT, SET) from a role membership,
+ * but keeps the membership itself.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ */
+export declare class RevokeRoleMembershipOptions extends DropRoleChange {
+    readonly role: Role;
+    readonly member: string;
+    readonly admin?: boolean;
+    readonly inherit?: boolean;
+    readonly set?: boolean;
+    readonly scope: "membership";
+    constructor(props: {
+        role: Role;
+        member: string;
+        admin?: boolean;
+        inherit?: boolean;
+        set?: boolean;
+    });
+    get requires(): (`role:${string}` | `membership:${string}->${string}`)[];
+    serialize(): string;
+}
+/**
+ * Grant default privileges for a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html
+ */
+export declare class GrantRoleDefaultPrivileges extends CreateRoleChange {
+    readonly role: Role;
+    readonly inSchema: string | null;
+    readonly objtype: string;
+    readonly grantee: string;
+    readonly privileges: {
+        privilege: string;
+        grantable: boolean;
+    }[];
+    readonly version: number;
+    readonly scope: "default_privilege";
+    constructor(props: {
+        role: Role;
+        inSchema: string | null;
+        objtype: string;
+        grantee: string;
+        privileges: {
+            privilege: string;
+            grantable: boolean;
+        }[];
+        version: number;
+    });
+    get creates(): `defacl:${string}:${string}:${string}:grantee:${string}`[];
+    get requires(): (`schema:${string}` | `role:${string}`)[];
+    serialize(): string;
+}
+/**
+ * Revoke default privileges for a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html
+ */
+export declare class RevokeRoleDefaultPrivileges extends DropRoleChange {
+    readonly role: Role;
+    readonly inSchema: string | null;
+    readonly objtype: string;
+    readonly grantee: string;
+    readonly privileges: {
+        privilege: string;
+        grantable: boolean;
+    }[];
+    readonly version: number;
+    readonly scope: "default_privilege";
+    constructor(props: {
+        role: Role;
+        inSchema: string | null;
+        objtype: string;
+        grantee: string;
+        privileges: {
+            privilege: string;
+            grantable: boolean;
+        }[];
+        version: number;
+    });
+    get drops(): `defacl:${string}:${string}:${string}:grantee:${string}`[];
+    get requires(): (`schema:${string}` | `defacl:${string}:${string}:${string}:grantee:${string}` | `role:${string}`)[];
+    serialize(): string;
+}

package/dist/core/objects/role/changes/role.privilege.js

@@ -0,0 +1,283 @@
+import { stableId } from "../../utils.js";
+import { CreateRoleChange, DropRoleChange } from "./role.base.js";
+/**
+ * Grant role membership.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-grant.html
+ *
+ * Synopsis
+ * ```sql
+ * GRANT role_name [, ...] TO role_specification [, ...]
+ *     [ WITH ADMIN OPTION ]
+ *     [ GRANTED BY role_specification ]
+ * ```
+ */
+export class GrantRoleMembership extends CreateRoleChange {
+    role;
+    member;
+    options;
+    scope = "membership";
+    constructor(props) {
+        super();
+        this.role = props.role;
+        this.member = props.member;
+        this.options = props.options;
+    }
+    get creates() {
+        return [stableId.membership(this.role.name, this.member)];
+    }
+    get requires() {
+        return [this.role.stableId, stableId.role(this.member)];
+    }
+    serialize() {
+        // On creation, only emit ADMIN OPTION; leave INHERIT/SET to defaults
+        const opts = [];
+        if (this.options.admin)
+            opts.push("ADMIN OPTION");
+        const withClause = opts.length > 0 ? ` WITH ${opts.join(" ")}` : "";
+        return `GRANT ${this.role.name} TO ${this.member}${withClause}`;
+    }
+}
+/**
+ * Revoke role membership.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ *
+ * Synopsis
+ * ```sql
+ * REVOKE [ ADMIN OPTION FOR ] role_name [, ...] FROM role_specification [, ...]
+ *     [ GRANTED BY role_specification ]
+ *     [ CASCADE | RESTRICT ]
+ * ```
+ */
+export class RevokeRoleMembership extends DropRoleChange {
+    role;
+    member;
+    scope = "membership";
+    constructor(props) {
+        super();
+        this.role = props.role;
+        this.member = props.member;
+    }
+    get drops() {
+        return [stableId.membership(this.role.name, this.member)];
+    }
+    get requires() {
+        return [
+            stableId.membership(this.role.name, this.member),
+            stableId.role(this.member),
+            this.role.stableId,
+        ];
+    }
+    serialize() {
+        return `REVOKE ${this.role.name} FROM ${this.member}`;
+    }
+}
+/**
+ * Revoke membership options for a role.
+ *
+ * This removes specific options (ADMIN, INHERIT, SET) from a role membership,
+ * but keeps the membership itself.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ */
+export class RevokeRoleMembershipOptions extends DropRoleChange {
+    role;
+    member;
+    admin;
+    inherit;
+    set;
+    scope = "membership";
+    constructor(props) {
+        super();
+        this.role = props.role;
+        this.member = props.member;
+        this.admin = props.admin;
+        this.inherit = props.inherit;
+        this.set = props.set;
+    }
+    get requires() {
+        return [
+            stableId.membership(this.role.name, this.member),
+            stableId.role(this.member),
+            this.role.stableId,
+        ];
+    }
+    serialize() {
+        const parts = [];
+        if (this.admin)
+            parts.push("ADMIN OPTION");
+        if (this.inherit)
+            parts.push("INHERIT OPTION");
+        if (this.set)
+            parts.push("SET OPTION");
+        return `REVOKE ${parts.join(" ")} FOR ${this.role.name} FROM ${this.member}`;
+    }
+}
+/**
+ * Grant default privileges for a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html
+ */
+export class GrantRoleDefaultPrivileges extends CreateRoleChange {
+    role;
+    inSchema;
+    objtype;
+    grantee;
+    privileges;
+    version;
+    scope = "default_privilege";
+    constructor(props) {
+        super();
+        this.role = props.role;
+        this.inSchema = props.inSchema;
+        this.objtype = props.objtype;
+        this.grantee = props.grantee;
+        this.privileges = props.privileges;
+        this.version = props.version;
+    }
+    get creates() {
+        return [
+            stableId.defacl(this.role.name, this.objtype, this.inSchema, this.grantee),
+        ];
+    }
+    get requires() {
+        return [
+            this.role.stableId,
+            stableId.role(this.grantee),
+            ...(this.inSchema ? [stableId.schema(this.inSchema)] : []),
+        ];
+    }
+    serialize() {
+        const scope = this.inSchema ? ` IN SCHEMA ${this.inSchema}` : "";
+        const hasGrantable = this.privileges.some((p) => p.grantable);
+        const hasBase = this.privileges.some((p) => !p.grantable);
+        if (hasGrantable && hasBase) {
+            throw new Error("GrantRoleDefaultPrivileges expects privileges with uniform grantable flag");
+        }
+        const withGrant = hasGrantable ? " WITH GRANT OPTION" : "";
+        const privSql = formatPrivilegeList(this.objtype, this.privileges.map((p) => p.privilege), this.version);
+        return `ALTER DEFAULT PRIVILEGES FOR ROLE ${this.role.name}${scope} GRANT ${privSql} ON ${objtypeToKeyword(this.objtype)} TO ${this.grantee}${withGrant}`;
+    }
+}
+/**
+ * Revoke default privileges for a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html
+ */
+export class RevokeRoleDefaultPrivileges extends DropRoleChange {
+    role;
+    inSchema;
+    objtype;
+    grantee;
+    privileges;
+    version;
+    scope = "default_privilege";
+    constructor(props) {
+        super();
+        this.role = props.role;
+        this.inSchema = props.inSchema;
+        this.objtype = props.objtype;
+        this.grantee = props.grantee;
+        this.privileges = props.privileges;
+        this.version = props.version;
+    }
+    get drops() {
+        return [
+            stableId.defacl(this.role.name, this.objtype, this.inSchema, this.grantee),
+        ];
+    }
+    get requires() {
+        return [
+            stableId.defacl(this.role.name, this.objtype, this.inSchema, this.grantee),
+            this.role.stableId,
+            stableId.role(this.grantee),
+            ...(this.inSchema ? [stableId.schema(this.inSchema)] : []),
+        ];
+    }
+    serialize() {
+        const scope = this.inSchema ? ` IN SCHEMA ${this.inSchema}` : "";
+        const grantOptionPrivs = this.privileges
+            .filter((p) => p.grantable)
+            .map((p) => p.privilege);
+        const basePrivs = this.privileges
+            .filter((p) => !p.grantable)
+            .map((p) => p.privilege);
+        const hasGrantOption = grantOptionPrivs.length > 0;
+        const hasBase = basePrivs.length > 0;
+        if (hasGrantOption && hasBase) {
+            throw new Error("AlterDefaultPrivilegesRevoke expects privileges from a single revoke kind");
+        }
+        if (hasGrantOption) {
+            const privSql = formatPrivilegeList(this.objtype, grantOptionPrivs, this.version);
+            return `ALTER DEFAULT PRIVILEGES FOR ROLE ${this.role.name}${scope} REVOKE GRANT OPTION FOR ${privSql} ON ${objtypeToKeyword(this.objtype)} FROM ${this.grantee}`;
+        }
+        const privSql = formatPrivilegeList(this.objtype, basePrivs, this.version);
+        return `ALTER DEFAULT PRIVILEGES FOR ROLE ${this.role.name}${scope} REVOKE ${privSql} ON ${objtypeToKeyword(this.objtype)} FROM ${this.grantee}`;
+    }
+}
+// Helper functions for default privileges
+function objtypeToKeyword(objtype) {
+    switch (objtype) {
+        case "r":
+            return "TABLES";
+        case "S":
+            return "SEQUENCES";
+        case "f":
+            return "ROUTINES";
+        case "T":
+            return "TYPES";
+        case "n":
+            return "SCHEMAS";
+        default:
+            return objtype;
+    }
+}
+function defaultPrivilegeUniverse(objtype, version) {
+    // Full privilege sets per object kind for ALTER DEFAULT PRIVILEGES
+    // Keep names aligned with pg_catalog privilege_type values
+    switch (objtype) {
+        case "r": {
+            // TABLES
+            // MAINTAIN exists on PostgreSQL >= 17
+            const includesMaintain = version >= 170000;
+            return [
+                "DELETE",
+                "INSERT",
+                ...(includesMaintain ? ["MAINTAIN"] : []),
+                "REFERENCES",
+                "SELECT",
+                "TRIGGER",
+                "TRUNCATE",
+                "UPDATE",
+            ];
+        }
+        case "S": // SEQUENCES
+            return ["SELECT", "UPDATE", "USAGE"].sort();
+        case "f": // ROUTINES (FUNCTIONS)
+            return ["EXECUTE"];
+        case "T": // TYPES
+            return ["USAGE"];
+        case "n": // SCHEMAS
+            return ["CREATE", "USAGE"].sort();
+        default:
+            return [];
+    }
+}
+function isFullPrivilegeSet(objtype, list, version) {
+    const uniqSorted = [...new Set(list)].sort();
+    const fullSorted = [...defaultPrivilegeUniverse(objtype, version)].sort();
+    if (uniqSorted.length !== fullSorted.length)
+        return false;
+    for (let i = 0; i < uniqSorted.length; i++) {
+        if (uniqSorted[i] !== fullSorted[i])
+            return false;
+    }
+    return true;
+}
+function formatPrivilegeList(objtype, list, version) {
+    const uniqSorted = [...new Set(list)].sort();
+    return isFullPrivilegeSet(objtype, uniqSorted, version)
+        ? "ALL"
+        : uniqSorted.join(", ");
+}

package/dist/core/objects/role/changes/role.types.d.ts

@@ -0,0 +1,6 @@
+import type { AlterRole } from "./role.alter.ts";
+import type { CommentRole } from "./role.comment.ts";
+import type { CreateRole } from "./role.create.ts";
+import type { DropRole } from "./role.drop.ts";
+import type { RolePrivilege } from "./role.privilege.ts";
+export type RoleChange = AlterRole | CommentRole | CreateRole | DropRole | RolePrivilege;

package/dist/core/objects/role/changes/role.types.js

@@ -0,0 +1 @@
+export {};