@supabase/pg-delta 0.0.0 → 1.0.0-alpha.0

package/dist/core/objects/table/table.diff.js

@@ -0,0 +1,668 @@
+import { diffObjects } from "../base.diff.js";
+import { diffPrivileges, groupPrivilegesByColumns, } from "../base.privilege-diff.js";
+import { deepEqual } from "../utils.js";
+import { AlterTableAddColumn, AlterTableAddConstraint, AlterTableAlterColumnDropDefault, AlterTableAlterColumnDropNotNull, AlterTableAlterColumnSetDefault, AlterTableAlterColumnSetNotNull, AlterTableAlterColumnType, AlterTableAttachPartition, AlterTableChangeOwner, AlterTableDetachPartition, AlterTableDisableRowLevelSecurity, AlterTableDropColumn, AlterTableDropConstraint, AlterTableEnableRowLevelSecurity, AlterTableForceRowLevelSecurity, AlterTableNoForceRowLevelSecurity, AlterTableResetStorageParams, AlterTableSetLogged, AlterTableSetReplicaIdentity, AlterTableSetStorageParams, AlterTableSetUnlogged, AlterTableValidateConstraint, } from "./changes/table.alter.js";
+import { CreateCommentOnColumn, CreateCommentOnConstraint, CreateCommentOnTable, DropCommentOnColumn, DropCommentOnConstraint, DropCommentOnTable, } from "./changes/table.comment.js";
+import { CreateTable } from "./changes/table.create.js";
+import { DropTable } from "./changes/table.drop.js";
+import { GrantTablePrivileges, RevokeGrantOptionTablePrivileges, RevokeTablePrivileges, } from "./changes/table.privilege.js";
+import { Table } from "./table.model.js";
+function createAlterConstraintChange(mainTable, branchTable) {
+    const changes = [];
+    // Note: Table renaming would also use ALTER TABLE ... RENAME TO ...
+    // But since our Table model uses 'name' as the identity field,
+    // a name change would be handled as drop + create by diffObjects()
+    // TABLE CONSTRAINTS
+    const mainByName = new Map((mainTable.constraints ?? []).map((c) => [c.name, c]));
+    const branchByName = new Map((branchTable.constraints ?? []).map((c) => [c.name, c]));
+    // Created constraints
+    for (const [name, c] of branchByName) {
+        // Skip constraint clones on partitions - they are automatically created when the parent constraint is created
+        if (c.is_partition_clone) {
+            continue;
+        }
+        if (!mainByName.has(name)) {
+            changes.push(new AlterTableAddConstraint({
+                table: branchTable,
+                constraint: c,
+            }));
+            if (!c.validated) {
+                changes.push(new AlterTableValidateConstraint({
+                    table: branchTable,
+                    constraint: c,
+                }));
+            }
+            // Add comment for newly created constraint
+            if (c.comment !== null) {
+                changes.push(new CreateCommentOnConstraint({
+                    table: branchTable,
+                    constraint: c,
+                }));
+            }
+        }
+    }
+    // Dropped constraints
+    for (const [name, c] of mainByName) {
+        // Skip constraint clones on partitions - they are automatically dropped when the parent constraint is dropped
+        if (c.is_partition_clone) {
+            continue;
+        }
+        if (!branchByName.has(name)) {
+            changes.push(new AlterTableDropConstraint({ table: mainTable, constraint: c }));
+        }
+    }
+    // Altered constraints -> drop + add
+    for (const [name, mainC] of mainByName) {
+        const branchC = branchByName.get(name);
+        if (!branchC)
+            continue;
+        // Skip constraint clones on partitions - they are automatically updated when the parent constraint is updated
+        if (mainC.is_partition_clone || branchC.is_partition_clone) {
+            continue;
+        }
+        const changed = mainC.constraint_type !== branchC.constraint_type ||
+            mainC.deferrable !== branchC.deferrable ||
+            mainC.initially_deferred !== branchC.initially_deferred ||
+            mainC.validated !== branchC.validated ||
+            mainC.is_local !== branchC.is_local ||
+            mainC.no_inherit !== branchC.no_inherit ||
+            JSON.stringify(mainC.key_columns) !==
+                JSON.stringify(branchC.key_columns) ||
+            JSON.stringify(mainC.foreign_key_columns) !==
+                JSON.stringify(branchC.foreign_key_columns) ||
+            mainC.foreign_key_table !== branchC.foreign_key_table ||
+            mainC.foreign_key_schema !== branchC.foreign_key_schema ||
+            mainC.on_update !== branchC.on_update ||
+            mainC.on_delete !== branchC.on_delete ||
+            mainC.match_type !== branchC.match_type ||
+            mainC.check_expression !== branchC.check_expression;
+        if (changed) {
+            changes.push(new AlterTableDropConstraint({
+                table: mainTable,
+                constraint: mainC,
+            }));
+            changes.push(new AlterTableAddConstraint({
+                table: branchTable,
+                constraint: branchC,
+            }));
+            if (!branchC.validated) {
+                changes.push(new AlterTableValidateConstraint({
+                    table: branchTable,
+                    constraint: branchC,
+                }));
+            }
+            // Ensure constraint comment is applied after re-creation
+            if (branchC.comment !== null) {
+                changes.push(new CreateCommentOnConstraint({
+                    table: branchTable,
+                    constraint: branchC,
+                }));
+            }
+        }
+        else {
+            // Comment-only change on constraint
+            if (mainC.comment !== branchC.comment) {
+                if (branchC.comment === null) {
+                    changes.push(new DropCommentOnConstraint({
+                        table: mainTable,
+                        constraint: mainC,
+                    }));
+                }
+                else {
+                    changes.push(new CreateCommentOnConstraint({
+                        table: branchTable,
+                        constraint: branchC,
+                    }));
+                }
+            }
+        }
+    }
+    return changes;
+}
+/**
+ * Diff two sets of tables from main and branch catalogs.
+ *
+ * @param ctx - Context containing version, currentUser, and defaultPrivilegeState
+ * @param main - The tables in the main catalog.
+ * @param branch - The tables in the branch catalog.
+ * @returns A list of changes to apply to main to make it match branch.
+ */
+export function diffTables(ctx, main, branch) {
+    const { created, dropped, altered } = diffObjects(main, branch);
+    const changes = [];
+    for (const tableId of created) {
+        changes.push(new CreateTable({ table: branch[tableId] }));
+        const branchTable = branch[tableId];
+        // OWNER: If the table should be owned by someone other than the current user,
+        // emit ALTER TABLE ... OWNER TO after creation
+        if (branchTable.owner !== ctx.currentUser) {
+            changes.push(new AlterTableChangeOwner({
+                table: branchTable,
+                owner: branchTable.owner,
+            }));
+        }
+        // ROW LEVEL SECURITY: If RLS should be enabled, emit ALTER TABLE ... ENABLE ROW LEVEL SECURITY
+        if (branchTable.row_security) {
+            changes.push(new AlterTableEnableRowLevelSecurity({ table: branchTable }));
+        }
+        // FORCE ROW LEVEL SECURITY: If force RLS should be enabled, emit ALTER TABLE ... FORCE ROW LEVEL SECURITY
+        if (branchTable.force_row_security) {
+            changes.push(new AlterTableForceRowLevelSecurity({ table: branchTable }));
+        }
+        changes.push(...createAlterConstraintChange(
+        // Create a dummy table with no constraints do diff constraints against
+        new Table({
+            ...branchTable,
+            constraints: [],
+        }), branchTable));
+        // Table comment on creation
+        if (branchTable.comment !== null && branchTable.comment !== undefined) {
+            changes.push(new CreateCommentOnTable({ table: branchTable }));
+        }
+        // Column comments on creation
+        for (const col of branchTable.columns) {
+            if (col.comment !== null && col.comment !== undefined) {
+                changes.push(new CreateCommentOnColumn({ table: branchTable, column: col }));
+            }
+        }
+        // PRIVILEGES: For created objects, compare against default privileges state
+        // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
+        // so objects are created with the default privileges state in effect.
+        // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
+        // needed to reach the final desired state.
+        const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "table", branchTable.schema ?? "");
+        const desiredPrivileges = branchTable.privileges;
+        // Filter out owner privileges - owner always has ALL privileges implicitly
+        // and shouldn't be compared. Use the table owner as the reference.
+        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, branchTable.owner, ctx.mainRoles);
+        // Generate grant changes
+        for (const [grantee, result] of privilegeResults) {
+            if (result.grants.length > 0) {
+                const grantGroups = groupPrivilegesByColumns(result.grants);
+                for (const [, group] of grantGroups) {
+                    for (const [grantable, privSet] of group.byGrant) {
+                        const privileges = Array.from(privSet).map((priv) => ({
+                            privilege: priv,
+                            grantable,
+                        }));
+                        changes.push(new GrantTablePrivileges({
+                            table: branchTable,
+                            grantee,
+                            privileges,
+                            columns: group.columns,
+                            version: ctx.version,
+                        }));
+                    }
+                }
+            }
+            // Generate revoke changes
+            if (result.revokes.length > 0) {
+                const revokeGroups = groupPrivilegesByColumns(result.revokes);
+                for (const [, group] of revokeGroups) {
+                    const allPrivileges = new Set();
+                    for (const [, privSet] of group.byGrant) {
+                        for (const priv of privSet) {
+                            allPrivileges.add(priv);
+                        }
+                    }
+                    const privileges = Array.from(allPrivileges).map((priv) => ({
+                        privilege: priv,
+                        grantable: false,
+                    }));
+                    changes.push(new RevokeTablePrivileges({
+                        table: branchTable,
+                        grantee,
+                        privileges,
+                        columns: group.columns,
+                        version: ctx.version,
+                    }));
+                }
+            }
+            // Generate revoke grant option changes
+            if (result.revokeGrantOption.length > 0) {
+                const revokeGrantGroups = new Map();
+                for (const r of result.revokeGrantOption) {
+                    const originalPriv = effectiveDefaults.find((p) => p.grantee === grantee && p.privilege === r);
+                    const key = originalPriv?.columns
+                        ? originalPriv.columns.sort().join(",")
+                        : "";
+                    if (!revokeGrantGroups.has(key)) {
+                        revokeGrantGroups.set(key, {
+                            columns: originalPriv?.columns
+                                ? [...originalPriv.columns]
+                                : undefined,
+                            privileges: new Set(),
+                        });
+                    }
+                    const group = revokeGrantGroups.get(key);
+                    if (!group)
+                        continue;
+                    group.privileges.add(r);
+                }
+                for (const [, group] of revokeGrantGroups) {
+                    const privilegeNames = Array.from(group.privileges);
+                    changes.push(new RevokeGrantOptionTablePrivileges({
+                        table: branchTable,
+                        grantee,
+                        privilegeNames,
+                        columns: group.columns,
+                        version: ctx.version,
+                    }));
+                }
+            }
+        }
+    }
+    for (const tableId of dropped) {
+        changes.push(new DropTable({ table: main[tableId] }));
+    }
+    for (const tableId of altered) {
+        const mainTable = main[tableId];
+        const branchTable = branch[tableId];
+        // Dangerous operations (drop+create) are not performed by this tool.
+        // Only emit safe ALTER statements below.
+        // Only alterable properties changed - check each one
+        // PERSISTENCE (LOGGED/UNLOGGED)
+        if (mainTable.persistence !== branchTable.persistence) {
+            if (branchTable.persistence === "u" && mainTable.persistence === "p") {
+                changes.push(new AlterTableSetUnlogged({ table: mainTable }));
+            }
+            else if (branchTable.persistence === "p" &&
+                mainTable.persistence === "u") {
+                changes.push(new AlterTableSetLogged({ table: mainTable }));
+            }
+        }
+        // ROW LEVEL SECURITY
+        if (mainTable.row_security !== branchTable.row_security) {
+            if (branchTable.row_security) {
+                changes.push(new AlterTableEnableRowLevelSecurity({ table: mainTable }));
+            }
+            else {
+                changes.push(new AlterTableDisableRowLevelSecurity({ table: mainTable }));
+            }
+        }
+        // FORCE ROW LEVEL SECURITY
+        if (mainTable.force_row_security !== branchTable.force_row_security) {
+            if (branchTable.force_row_security) {
+                changes.push(new AlterTableForceRowLevelSecurity({ table: mainTable }));
+            }
+            else {
+                changes.push(new AlterTableNoForceRowLevelSecurity({ table: mainTable }));
+            }
+        }
+        // STORAGE PARAMS (WITH (...))
+        if (!deepEqual(mainTable.options, branchTable.options)) {
+            const mainOpts = mainTable.options ?? [];
+            const branchOpts = branchTable.options ?? [];
+            // Always set branch options when provided
+            if (branchOpts.length > 0) {
+                changes.push(new AlterTableSetStorageParams({
+                    table: mainTable,
+                    options: branchOpts,
+                }));
+            }
+            // Reset any params that are present in main but absent in branch
+            if (mainOpts.length > 0) {
+                const mainNames = new Set(mainOpts.map((opt) => opt.split("=")[0]));
+                const branchNames = new Set(branchOpts.map((opt) => opt.split("=")[0]));
+                const removed = [];
+                for (const name of mainNames) {
+                    if (!branchNames.has(name))
+                        removed.push(name);
+                }
+                if (removed.length > 0) {
+                    changes.push(new AlterTableResetStorageParams({
+                        table: mainTable,
+                        params: removed,
+                    }));
+                }
+            }
+        }
+        // REPLICA IDENTITY
+        if (mainTable.replica_identity !== branchTable.replica_identity) {
+            // Skip when target is 'i' (USING INDEX) — handled by index changes
+            if (branchTable.replica_identity !== "i") {
+                changes.push(new AlterTableSetReplicaIdentity({
+                    table: mainTable,
+                    mode: branchTable.replica_identity,
+                }));
+            }
+        }
+        // OWNER
+        if (mainTable.owner !== branchTable.owner) {
+            changes.push(new AlterTableChangeOwner({
+                table: mainTable,
+                owner: branchTable.owner,
+            }));
+        }
+        // TABLE COMMENT (create/drop when comment changes)
+        if (mainTable.comment !== branchTable.comment) {
+            if (branchTable.comment === null) {
+                changes.push(new DropCommentOnTable({ table: mainTable }));
+            }
+            else {
+                changes.push(new CreateCommentOnTable({ table: branchTable }));
+            }
+        }
+        // PARTITION ATTACH/DETACH
+        const mainIsPartition = Boolean(mainTable.parent_schema && mainTable.parent_name);
+        const branchIsPartition = Boolean(branchTable.parent_schema && branchTable.parent_name);
+        // Helper to resolve parent table from catalogs
+        const resolveParent = (catalog, schema, name) => catalog[`table:${schema}.${name}`];
+        if (!mainIsPartition && branchIsPartition) {
+            const table = resolveParent(branch, branchTable.parent_schema, branchTable.parent_name);
+            if (table) {
+                changes.push(new AlterTableAttachPartition({ table, partition: branchTable }));
+            }
+        }
+        else if (mainIsPartition && !branchIsPartition) {
+            const table = resolveParent(main, mainTable.parent_schema, mainTable.parent_name);
+            if (table) {
+                changes.push(new AlterTableDetachPartition({ table, partition: mainTable }));
+            }
+        }
+        else if (mainIsPartition && branchIsPartition) {
+            const parentChanged = mainTable.parent_schema !== branchTable.parent_schema ||
+                mainTable.parent_name !== branchTable.parent_name;
+            const boundChanged = mainTable.partition_bound !== branchTable.partition_bound;
+            if (parentChanged || boundChanged) {
+                const oldParent = resolveParent(main, mainTable.parent_schema, mainTable.parent_name);
+                if (oldParent) {
+                    changes.push(new AlterTableDetachPartition({
+                        table: oldParent,
+                        partition: mainTable,
+                    }));
+                }
+                const newParent = resolveParent(branch, branchTable.parent_schema, branchTable.parent_name);
+                if (newParent) {
+                    changes.push(new AlterTableAttachPartition({
+                        table: newParent,
+                        partition: branchTable,
+                    }));
+                }
+            }
+        }
+        changes.push(...createAlterConstraintChange(mainTable, branchTable));
+        // COLUMNS
+        const mainCols = new Map(mainTable.columns.map((c) => [c.name, c]));
+        const branchCols = new Map(branchTable.columns.map((c) => [c.name, c]));
+        // Helper to get parent tables if this is a partition
+        // PostgreSQL automatically propagates column changes from parent to partitions,
+        // so we should skip changes on partitions when the parent has the same change
+        const getParentTables = () => {
+            if (!branchIsPartition ||
+                !branchTable.parent_schema ||
+                !branchTable.parent_name) {
+                return { parentMain: null, parentBranch: null };
+            }
+            const parentBranch = resolveParent(branch, branchTable.parent_schema, branchTable.parent_name);
+            const parentMain = resolveParent(main, branchTable.parent_schema, branchTable.parent_name);
+            return {
+                parentMain: parentMain ?? null,
+                parentBranch: parentBranch ?? null,
+            };
+        };
+        // Helper to check if parent has the same column property change
+        const parentHasSameColumnPropertyChange = (columnName, property) => {
+            const { parentMain, parentBranch } = getParentTables();
+            if (!parentMain || !parentBranch) {
+                return false;
+            }
+            const parentMainCol = parentMain.columns.find((c) => c.name === columnName);
+            const parentBranchCol = parentBranch.columns.find((c) => c.name === columnName);
+            const branchCol = branchCols.get(columnName);
+            const mainCol = mainCols.get(columnName);
+            if (!parentMainCol || !parentBranchCol || !branchCol || !mainCol) {
+                return false;
+            }
+            switch (property) {
+                case "type": {
+                    const parentTypeChanged = parentMainCol.data_type_str !== parentBranchCol.data_type_str ||
+                        parentMainCol.collation !== parentBranchCol.collation;
+                    const partitionTypeChanged = mainCol.data_type_str !== branchCol.data_type_str ||
+                        mainCol.collation !== branchCol.collation;
+                    return (parentTypeChanged &&
+                        partitionTypeChanged &&
+                        parentBranchCol.data_type_str === branchCol.data_type_str &&
+                        parentBranchCol.collation === branchCol.collation);
+                }
+                case "default": {
+                    const parentDefaultChanged = parentMainCol.default !== parentBranchCol.default;
+                    const partitionDefaultChanged = mainCol.default !== branchCol.default;
+                    return (parentDefaultChanged &&
+                        partitionDefaultChanged &&
+                        parentBranchCol.default === branchCol.default);
+                }
+                case "not_null": {
+                    const parentNotNullChanged = parentMainCol.not_null !== parentBranchCol.not_null;
+                    const partitionNotNullChanged = mainCol.not_null !== branchCol.not_null;
+                    return (parentNotNullChanged &&
+                        partitionNotNullChanged &&
+                        parentBranchCol.not_null === branchCol.not_null);
+                }
+            }
+        };
+        // Helper to check if parent has the same column add/drop
+        const shouldSkipColumnAddDropOnPartition = (columnName, changeType) => {
+            const { parentMain, parentBranch } = getParentTables();
+            if (!parentMain || !parentBranch) {
+                return false;
+            }
+            const parentMainHasCol = parentMain.columns.some((c) => c.name === columnName);
+            const parentBranchHasCol = parentBranch.columns.some((c) => c.name === columnName);
+            if (changeType === "add") {
+                // Check if parent also has this column added and final states match
+                if (!parentMainHasCol && parentBranchHasCol) {
+                    const parentBranchCol = parentBranch.columns.find((c) => c.name === columnName);
+                    const branchCol = branchCols.get(columnName);
+                    return (parentBranchCol !== undefined &&
+                        branchCol !== undefined &&
+                        parentBranchCol.data_type_str === branchCol.data_type_str &&
+                        parentBranchCol.collation === branchCol.collation &&
+                        parentBranchCol.default === branchCol.default &&
+                        parentBranchCol.not_null === branchCol.not_null);
+                }
+            }
+            else {
+                // changeType === "drop"
+                // If parent is dropping the column, skip on partition
+                return parentMainHasCol && !parentBranchHasCol;
+            }
+            return false;
+        };
+        // Added columns
+        for (const [name, col] of branchCols) {
+            if (!mainCols.has(name)) {
+                // Skip if this is a partition and parent has the same column added
+                if (shouldSkipColumnAddDropOnPartition(name, "add")) {
+                    continue;
+                }
+                changes.push(new AlterTableAddColumn({ table: branchTable, column: col }));
+                if (col.comment !== null && col.comment !== undefined) {
+                    changes.push(new CreateCommentOnColumn({ table: branchTable, column: col }));
+                }
+            }
+        }
+        // Dropped columns
+        for (const [name, col] of mainCols) {
+            if (!branchCols.has(name)) {
+                // Skip if this is a partition and parent has the same column dropped
+                if (shouldSkipColumnAddDropOnPartition(name, "drop")) {
+                    continue;
+                }
+                changes.push(new AlterTableDropColumn({ table: mainTable, column: col }));
+            }
+        }
+        // Altered columns
+        for (const [name, mainCol] of mainCols) {
+            const branchCol = branchCols.get(name);
+            if (!branchCol)
+                continue;
+            // TYPE or COLLATION change
+            if (mainCol.data_type_str !== branchCol.data_type_str ||
+                mainCol.collation !== branchCol.collation) {
+                // Skip if parent has the same type/collation change
+                if (!parentHasSameColumnPropertyChange(name, "type")) {
+                    changes.push(new AlterTableAlterColumnType({
+                        table: branchTable,
+                        column: branchCol,
+                    }));
+                }
+            }
+            // DEFAULT change
+            if (mainCol.default !== branchCol.default) {
+                // Skip if parent has the same default change
+                if (!parentHasSameColumnPropertyChange(name, "default")) {
+                    if (branchCol.default === null) {
+                        // Drop default value
+                        changes.push(new AlterTableAlterColumnDropDefault({
+                            table: branchTable,
+                            column: branchCol,
+                        }));
+                    }
+                    else {
+                        // Set new default value
+                        const isGeneratedColumn = branchCol.is_generated;
+                        const isPostgresLowerThan17 = ctx.version < 170000;
+                        if (isGeneratedColumn && isPostgresLowerThan17) {
+                            // For generated columns in < PostgreSQL 17, we need to drop and recreate
+                            // instead of using SET EXPRESSION AS for computed columns
+                            // cf: https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=5d06e99a3
+                            // cf: https://www.postgresql.org/docs/release/17.0/
+                            // > Allow ALTER TABLE to change a column's generation expression
+                            changes.push(new AlterTableDropColumn({
+                                table: mainTable,
+                                column: mainCol,
+                            }));
+                            changes.push(new AlterTableAddColumn({
+                                table: branchTable,
+                                column: branchCol,
+                            }));
+                        }
+                        else {
+                            // Use standard SET DEFAULT or SET EXPRESSION AS for newer PostgreSQL versions
+                            changes.push(new AlterTableAlterColumnSetDefault({
+                                table: branchTable,
+                                column: branchCol,
+                            }));
+                        }
+                    }
+                }
+            }
+            // NOT NULL change
+            if (mainCol.not_null !== branchCol.not_null) {
+                // Skip if parent has the same NOT NULL change
+                if (!parentHasSameColumnPropertyChange(name, "not_null")) {
+                    if (branchCol.not_null) {
+                        changes.push(new AlterTableAlterColumnSetNotNull({
+                            table: branchTable,
+                            column: branchCol,
+                        }));
+                    }
+                    else {
+                        changes.push(new AlterTableAlterColumnDropNotNull({
+                            table: branchTable,
+                            column: branchCol,
+                        }));
+                    }
+                }
+            }
+            // COMMENT change on column
+            // Note: Comments are NOT automatically propagated from parent to partitions,
+            // so we should NOT skip comment changes even if parent has the same change
+            if (mainCol.comment !== branchCol.comment) {
+                if (branchCol.comment === null) {
+                    changes.push(new DropCommentOnColumn({ table: mainTable, column: mainCol }));
+                }
+                else {
+                    changes.push(new CreateCommentOnColumn({
+                        table: branchTable,
+                        column: branchCol,
+                    }));
+                }
+            }
+        }
+        // PRIVILEGES (unified object and column privileges)
+        // Filter out owner privileges - owner always has ALL privileges implicitly
+        // and shouldn't be compared. Use branch owner as the reference.
+        const privilegeResults = diffPrivileges(mainTable.privileges, branchTable.privileges, branchTable.owner, ctx.mainRoles);
+        for (const [grantee, result] of privilegeResults) {
+            // Generate grant changes
+            if (result.grants.length > 0) {
+                const grantGroups = groupPrivilegesByColumns(result.grants);
+                for (const [, group] of grantGroups) {
+                    for (const [grantable, privSet] of group.byGrant) {
+                        const privileges = Array.from(privSet).map((priv) => ({
+                            privilege: priv,
+                            grantable,
+                        }));
+                        changes.push(new GrantTablePrivileges({
+                            table: branchTable,
+                            grantee,
+                            privileges,
+                            columns: group.columns,
+                            version: ctx.version,
+                        }));
+                    }
+                }
+            }
+            // Generate revoke changes
+            if (result.revokes.length > 0) {
+                const revokeGroups = groupPrivilegesByColumns(result.revokes);
+                for (const [, group] of revokeGroups) {
+                    // Collapse all grantable groups into a single revoke (grantable: false)
+                    const allPrivileges = new Set();
+                    for (const [, privSet] of group.byGrant) {
+                        for (const priv of privSet) {
+                            allPrivileges.add(priv);
+                        }
+                    }
+                    const privileges = Array.from(allPrivileges).map((priv) => ({
+                        privilege: priv,
+                        grantable: false,
+                    }));
+                    changes.push(new RevokeTablePrivileges({
+                        table: mainTable,
+                        grantee,
+                        privileges,
+                        columns: group.columns,
+                        version: ctx.version,
+                    }));
+                }
+            }
+            // Generate revoke grant option changes
+            if (result.revokeGrantOption.length > 0) {
+                const revokeGrantGroups = new Map();
+                for (const r of result.revokeGrantOption) {
+                    // For revoke grant option, we need to find the columns from the original privilege
+                    const originalPriv = mainTable.privileges.find((p) => p.grantee === grantee && p.privilege === r);
+                    const key = originalPriv?.columns
+                        ? originalPriv.columns.sort().join(",")
+                        : "";
+                    if (!revokeGrantGroups.has(key)) {
+                        revokeGrantGroups.set(key, {
+                            columns: originalPriv?.columns
+                                ? [...originalPriv.columns]
+                                : undefined,
+                            privileges: new Set(),
+                        });
+                    }
+                    const group = revokeGrantGroups.get(key);
+                    if (!group)
+                        continue;
+                    group.privileges.add(r);
+                }
+                for (const [, group] of revokeGrantGroups) {
+                    const privilegeNames = Array.from(group.privileges);
+                    changes.push(new RevokeGrantOptionTablePrivileges({
+                        table: mainTable,
+                        grantee,
+                        privilegeNames,
+                        columns: group.columns,
+                        version: ctx.version,
+                    }));
+                }
+            }
+        }
+    }
+    return changes;
+}