@supabase/pg-delta 1.0.0-alpha.0 → 1.0.0-alpha.10

package/dist/core/objects/publication/publication.diff.js

@@ -1,6 +1,6 @@
 import { diffObjects } from "../base.diff.js";
 import { deepEqual } from "../utils.js";
-import { AlterPublicationAddSchemas, AlterPublicationAddTables, AlterPublicationDropSchemas, AlterPublicationDropTables, AlterPublicationSetForAllTables, AlterPublicationSetOptions, AlterPublicationSetOwner, } from "./changes/publication.alter.js";
+import { AlterPublicationAddSchemas, AlterPublicationAddTables, AlterPublicationDropSchemas, AlterPublicationDropTables, AlterPublicationSetOptions, AlterPublicationSetOwner, } from "./changes/publication.alter.js";
 import { CreateCommentOnPublication, DropCommentOnPublication, } from "./changes/publication.comment.js";
 import { CreatePublication } from "./changes/publication.create.js";
 import { DropPublication } from "./changes/publication.drop.js";
@@ -52,21 +52,16 @@ export function diffPublications(ctx, main, branch) {
         let handledObjectLists = false;
         if (mainPublication.all_tables !== branchPublication.all_tables) {
             handledObjectLists = true;
-            if (branchPublication.all_tables) {
-                changes.push(new AlterPublicationSetForAllTables({
+            // Changing the all_tables mode requires DROP + CREATE because
+            // ALTER PUBLICATION does not support SET ALL TABLES.
+            changes.push(new DropPublication({ publication: mainPublication }));
+            changes.push(new CreatePublication({ publication: branchPublication }));
+            if (branchPublication.comment !== null) {
+                changes.push(new CreateCommentOnPublication({
                     publication: branchPublication,
                 }));
             }
-            else {
-                changes.push(new DropPublication({ publication: mainPublication }));
-                changes.push(new CreatePublication({ publication: branchPublication }));
-                if (branchPublication.comment !== null) {
-                    changes.push(new CreateCommentOnPublication({
-                        publication: branchPublication,
-                    }));
-                }
-                continue;
-            }
+            continue;
         }
         if (!handledObjectLists && !branchPublication.all_tables) {
             const tableDiff = diffPublicationTables(mainPublication.tables, branchPublication.tables);

package/dist/core/objects/publication/publication.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const publicationTablePropsSchema: z.ZodObject<{
@@ -92,5 +92,5 @@ export declare class Publication extends BasePgModel {
 /**
  * Extract all logical replication publications from the database.
  */
-export declare function extractPublications(sql: Sql): Promise<Publication[]>;
+export declare function extractPublications(pool: Pool): Promise<Publication[]>;
 export {};

package/dist/core/objects/publication/publication.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 const publicationTablePropsSchema = z.object({
@@ -104,10 +105,8 @@ export class Publication extends BasePgModel {
 /**
  * Extract all logical replication publications from the database.
  */
-export async function extractPublications(sql) {
-    return sql.begin(async (tx) => {
-        await tx `set search_path = ''`;
-        const rows = await tx `
+export async function extractPublications(pool) {
+    const { rows } = await pool.query(sql `
       with extension_oids as (
         select objid
         from pg_depend d
@@ -178,9 +177,8 @@ export async function extractPublications(sql) {
       from pg_publication p
       left join extension_oids e on e.objid = p.oid
       where e.objid is null
-      order by 1;
-    `;
-        const validated = rows.map((row) => publicationPropsSchema.parse(row));
-        return validated.map((row) => new Publication(row));
-    });
+      order by 1
+  `);
+    const validated = rows.map((row) => publicationPropsSchema.parse(row));
+    return validated.map((row) => new Publication(row));
 }

package/dist/core/objects/rls-policy/changes/rls-policy.alter.js

@@ -21,7 +21,7 @@ export class AlterRlsPolicySetRoles extends AlterRlsPolicyChange {
         const rolesSql = toPublic ? "PUBLIC" : targetRoles.join(", ");
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "TO",
@@ -48,7 +48,7 @@ export class AlterRlsPolicySetUsingExpression extends AlterRlsPolicyChange {
         const expr = this.usingExpression ?? "true";
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "USING",
@@ -75,7 +75,7 @@ export class AlterRlsPolicySetWithCheckExpression extends AlterRlsPolicyChange {
         const expr = this.withCheckExpression ?? "true";
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "WITH CHECK",

package/dist/core/objects/rls-policy/rls-policy.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const rlsPolicyPropsSchema: z.ZodObject<{
@@ -48,5 +48,5 @@ export declare class RlsPolicy extends BasePgModel {
         comment: string | null;
     };
 }
-export declare function extractRlsPolicies(sql: Sql): Promise<RlsPolicy[]>;
+export declare function extractRlsPolicies(pool: Pool): Promise<RlsPolicy[]>;
 export {};

package/dist/core/objects/rls-policy/rls-policy.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 const RlsPolicyCommandSchema = z.enum([
@@ -67,10 +68,8 @@ export class RlsPolicy extends BasePgModel {
         };
     }
 }
-export async function extractRlsPolicies(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const policyRows = await sql `
+export async function extractRlsPolicies(pool) {
+    const { rows: policyRows } = await pool.query(sql `
 with extension_policy_oids as (
   select
     objid
@@ -118,10 +117,9 @@ from
   and e_policy.objid is null
   and e_table.objid is null
 order by
-  1, 2;
-    `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = policyRows.map((row) => rlsPolicyPropsSchema.parse(row));
-        return validatedRows.map((row) => new RlsPolicy(row));
-    });
+  1, 2
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = policyRows.map((row) => rlsPolicyPropsSchema.parse(row));
+    return validatedRows.map((row) => new RlsPolicy(row));
 }

package/dist/core/objects/role/role.diff.js

@@ -31,8 +31,15 @@ export function diffRoles(ctx, main, branch) {
         if (role.comment !== null) {
             changes.push(new CreateCommentOnRole({ role }));
         }
-        // MEMBERSHIPS: Grant memberships immediately after role creation
+        // MEMBERSHIPS: Grant memberships immediately after role creation.
+        // Members are already deduplicated by the Role model constructor.
         for (const membership of role.members) {
+            // Skip memberships where the member is the grantor (auto-created by
+            // CREATE ROLE — re-granting them, especially WITH ADMIN OPTION, fails
+            // with "ADMIN option cannot be granted back to your own grantor").
+            if (membership.grantor === membership.member) {
+                continue;
+            }
             changes.push(new GrantRoleMembership({
                 role,
                 member: membership.member,
@@ -45,6 +52,8 @@ export function diffRoles(ctx, main, branch) {
         }
         // DEFAULT PRIVILEGES: Grant default privileges immediately after role creation
         for (const defaultPriv of role.default_privileges) {
+            if (defaultPriv.is_implicit)
+                continue;
             if (defaultPriv.privileges.length === 0)
                 continue;
             const grantGroups = new Map();
@@ -163,11 +172,18 @@ export function diffRoles(ctx, main, branch) {
             }
         }
         // MEMBERSHIPS
+        // Members are already deduplicated by the Role model constructor.
         const mainMembers = new Map(mainRole.members.map((m) => [m.member, m]));
         const branchMembers = new Map(branchRole.members.map((m) => [m.member, m]));
         // Find new members to grant
         for (const [member, membership] of branchMembers) {
             if (!mainMembers.has(member)) {
+                // Skip memberships where the member is the grantor (auto-created by
+                // CREATE ROLE — re-granting them fails with "ADMIN option cannot be
+                // granted back to your own grantor").
+                if (membership.grantor === membership.member) {
+                    continue;
+                }
                 changes.push(new GrantRoleMembership({
                     role: branchRole,
                     member: membership.member,
@@ -224,6 +240,11 @@ export function diffRoles(ctx, main, branch) {
                     }));
                 }
                 if (toGrant.admin || toGrant.inherit || toGrant.set) {
+                    // Skip granting options back to the grantor (same restriction as
+                    // for newly created roles).
+                    if (branchMembership.grantor === branchMembership.member) {
+                        continue;
+                    }
                     changes.push(new GrantRoleMembership({
                         role: branchRole,
                         member: branchMembership.member,

package/dist/core/objects/role/role.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const rolePropsSchema: z.ZodObject<{
@@ -34,6 +34,7 @@ declare const rolePropsSchema: z.ZodObject<{
             privilege: z.ZodString;
             grantable: z.ZodBoolean;
         }, z.z.core.$strip>>;
+        is_implicit: z.ZodBoolean;
     }, z.z.core.$strip>>;
 }, z.z.core.$strip>;
 export type RoleProps = z.infer<typeof rolePropsSchema>;
@@ -85,5 +86,5 @@ export declare class Role extends BasePgModel {
         }[];
     };
 }
-export declare function extractRoles(sql: Sql): Promise<Role[]>;
+export declare function extractRoles(pool: Pool): Promise<Role[]>;
 export {};

package/dist/core/objects/role/role.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 const membershipInfoSchema = z.object({
@@ -12,6 +13,7 @@ const defaultPrivilegeSchema = z.object({
     objtype: z.enum(["r", "S", "f", "T", "n"]),
     grantee: z.string(),
     privileges: z.array(z.object({ privilege: z.string(), grantable: z.boolean() })),
+    is_implicit: z.boolean(),
 });
 const rolePropsSchema = z.object({
     name: z.string(),
@@ -57,7 +59,7 @@ export class Role extends BasePgModel {
         this.can_bypass_rls = props.can_bypass_rls;
         this.config = props.config;
         this.comment = props.comment;
-        this.members = props.members;
+        this.members = deduplicateMembers(props.members);
         this.default_privileges = props.default_privileges;
     }
     get stableId() {
@@ -76,13 +78,16 @@ export class Role extends BasePgModel {
                 Number(a.inherit_option ?? false) - Number(b.inherit_option ?? false) ||
                 Number(a.set_option ?? false) - Number(b.set_option ?? false));
         });
-        const sortedDefaultPrivs = [...this.default_privileges].map((dp) => ({
-            ...dp,
-            privileges: [...dp.privileges].sort((a, b) => {
-                return (a.privilege.localeCompare(b.privilege) ||
-                    Number(a.grantable) - Number(b.grantable));
-            }),
-        }));
+        const sortedDefaultPrivs = [...this.default_privileges].map((dp) => {
+            const { is_implicit: _, ...rest } = dp;
+            return {
+                ...rest,
+                privileges: [...dp.privileges].sort((a, b) => {
+                    return (a.privilege.localeCompare(b.privilege) ||
+                        Number(a.grantable) - Number(b.grantable));
+                }),
+            };
+        });
         sortedDefaultPrivs.sort((a, b) => {
             return ((a.in_schema ?? "").localeCompare(b.in_schema ?? "") ||
                 a.objtype.localeCompare(b.objtype) ||
@@ -104,11 +109,49 @@ export class Role extends BasePgModel {
         };
     }
 }
-export async function extractRoles(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        // Check PostgreSQL version capabilities for membership options
-        const [capabilities] = await sql `
+/**
+ * Deduplicate members by member name.
+ *
+ * In PostgreSQL 16+, `pg_auth_members` can have multiple rows for the same
+ * (roleid, member) pair with different grantors. Merge them into a single
+ * entry per member, combining options with OR so the most permissive wins.
+ *
+ * When merging, prefer a non-self grantor (grantor !== member) so that
+ * downstream code can detect true self-grants (auto-created by CREATE ROLE)
+ * by checking `grantor === member`.
+ */
+function deduplicateMembers(members) {
+    const map = new Map();
+    for (const m of members) {
+        const existing = map.get(m.member);
+        if (existing) {
+            // admin_option is always boolean (non-nullable in schema)
+            existing.admin_option = existing.admin_option || m.admin_option;
+            // inherit_option and set_option are nullish (only available in PG 16+)
+            if (m.inherit_option != null) {
+                existing.inherit_option =
+                    (existing.inherit_option ?? false) || m.inherit_option;
+            }
+            if (m.set_option != null) {
+                existing.set_option = (existing.set_option ?? false) || m.set_option;
+            }
+            // Prefer a non-self grantor so diff can detect true self-grants.
+            // Once a non-self grantor is chosen the value is kept (the specific
+            // non-self grantor doesn't matter — only the self vs non-self
+            // distinction is used downstream).
+            if (existing.grantor === existing.member && m.grantor !== m.member) {
+                existing.grantor = m.grantor;
+            }
+        }
+        else {
+            map.set(m.member, { ...m });
+        }
+    }
+    return [...map.values()];
+}
+export async function extractRoles(pool) {
+    // Check PostgreSQL version capabilities for membership options
+    const { rows: capabilitiesRows } = await pool.query(sql `
       select
         exists (
           select 1
@@ -122,23 +165,25 @@ export async function extractRoles(sql) {
           where attrelid = 'pg_auth_members'::regclass
             and attname = 'set_option'
         ) as has_set
-    `;
-        const roleRows = capabilities?.has_inherit && capabilities?.has_set
-            ? await sql `
+  `);
+    const capabilities = capabilitiesRows[0];
+    let roleRows;
+    if (capabilities?.has_inherit && capabilities?.has_set) {
+        const result = await pool.query(sql `
           WITH role_memberships AS (
-            SELECT 
+            SELECT
               r.rolname AS role_name,
               json_agg(
                 json_build_object(
                   'member',   m.rolname,
                   'grantor',  g.rolname,
                   'admin_option',   am.admin_option,
-                  'inherit_option', am.inherit_option,   -- PG16+
-                  'set_option',     am.set_option        -- PG16+
+                  'inherit_option', am.inherit_option,
+                  'set_option',     am.set_option
                 )
               ) FILTER (WHERE m.rolname IS NOT NULL) AS members
             FROM pg_catalog.pg_roles r
-            LEFT JOIN pg_auth_members am ON am.roleid = r.oid       -- roles that are members of this role
+            LEFT JOIN pg_auth_members am ON am.roleid = r.oid
             LEFT JOIN pg_roles m          ON m.oid = am.member
             LEFT JOIN pg_roles g          ON g.oid = am.grantor
             GROUP BY r.rolname
@@ -171,13 +216,15 @@ export async function extractRoles(sql) {
                                     THEN 'PUBLIC'
                                     ELSE s.grantee::regrole::text
                             END,
-                          'privileges', s.privileges
+                          'privileges', s.privileges,
+                          'is_implicit', s.is_implicit
                         )
                         ORDER BY s.defaclnamespace NULLS FIRST,
                                   s.defaclobjtype,
                                   s.grantee
                       )
                 FROM (
+                  -- Explicit entries from pg_default_acl
                   SELECT
                     d.defaclnamespace,
                     d.defaclobjtype,
@@ -188,12 +235,41 @@ export async function extractRoles(sql) {
                         'grantable',  x.is_grantable
                       )
                       ORDER BY x.privilege_type, x.is_grantable
-                    ) AS privileges
+                    ) AS privileges,
+                    false AS is_implicit
                   FROM pg_default_acl d
                   CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
                     AS x(grantor, grantee, privilege_type, is_grantable)
                   WHERE d.defaclrole = r.oid
                   GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                  UNION ALL
+                  -- Implicit defaults from acldefault() for objtypes without a
+                  -- global pg_default_acl entry.  PostgreSQL applies these implicit
+                  -- defaults (e.g. PUBLIC gets EXECUTE on functions) when no
+                  -- explicit ALTER DEFAULT PRIVILEGES has been issued.  Including
+                  -- them lets the diff detect REVOKEs of implicit grants.
+                  SELECT
+                    0 AS defaclnamespace,
+                    v.t::"char" AS defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges,
+                    true AS is_implicit
+                  FROM (VALUES ('r'), ('S'), ('f'), ('T'), ('n')) AS v(t)
+                  CROSS JOIN LATERAL aclexplode(acldefault(v.t::"char", r.oid))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE NOT EXISTS (
+                    SELECT 1 FROM pg_default_acl d2
+                    WHERE d2.defaclrole     = r.oid
+                      AND d2.defaclobjtype  = v.t::"char"
+                      AND d2.defaclnamespace = 0
+                  )
+                  GROUP BY v.t, x.grantee
                 ) AS s
               ),
               '[]'
@@ -201,9 +277,7 @@ export async function extractRoles(sql) {
           FROM pg_catalog.pg_roles r
           LEFT JOIN role_memberships rm ON rm.role_name = r.rolname
           WHERE
-            -- 1) drop built-in/internal roles (anything starting with pg_)
             r.rolname !~ '^pg_'
-            -- 2) drop roles directly tracked as extension members in pg_shdepend (if any)
             AND NOT EXISTS (
               SELECT 1
               FROM pg_catalog.pg_shdepend d
@@ -212,24 +286,26 @@ export async function extractRoles(sql) {
                 AND d.refclassid  = 'pg_extension'::regclass
                 AND d.deptype     IN ('e','x')
             )
-          ORDER BY 1;
-      `
-            : await sql `
+          ORDER BY 1
+    `);
+        roleRows = result.rows;
+    }
+    else {
+        const result = await pool.query(sql `
           WITH role_memberships AS (
-            SELECT 
+            SELECT
               r.rolname AS role_name,
               json_agg(
                 json_build_object(
                   'member',         m.rolname,
                   'grantor',        g.rolname,
                   'admin_option',   am.admin_option,
-                  -- PG15: these columns don't exist; emit them as nulls
                   'inherit_option', NULL,
                   'set_option',     NULL
                 )
               ) FILTER (WHERE m.rolname IS NOT NULL) AS members
             FROM pg_catalog.pg_roles r
-            LEFT JOIN pg_auth_members am ON am.roleid = r.oid       -- roles that are members of this role
+            LEFT JOIN pg_auth_members am ON am.roleid = r.oid
             LEFT JOIN pg_roles m          ON m.oid = am.member
             LEFT JOIN pg_roles g          ON g.oid = am.grantor
             GROUP BY r.rolname
@@ -262,13 +338,15 @@ export async function extractRoles(sql) {
                                     THEN 'PUBLIC'
                                     ELSE s.grantee::regrole::text
                             END,
-                          'privileges', s.privileges
+                          'privileges', s.privileges,
+                          'is_implicit', s.is_implicit
                         )
                         ORDER BY s.defaclnamespace NULLS FIRST,
                                   s.defaclobjtype,
                                   s.grantee
                       )
                 FROM (
+                  -- Explicit entries from pg_default_acl
                   SELECT
                     d.defaclnamespace,
                     d.defaclobjtype,
@@ -279,12 +357,41 @@ export async function extractRoles(sql) {
                         'grantable',  x.is_grantable
                       )
                       ORDER BY x.privilege_type, x.is_grantable
-                    ) AS privileges
+                    ) AS privileges,
+                    false AS is_implicit
                   FROM pg_default_acl d
                   CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
                     AS x(grantor, grantee, privilege_type, is_grantable)
                   WHERE d.defaclrole = r.oid
                   GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                  UNION ALL
+                  -- Implicit defaults from acldefault() for objtypes without a
+                  -- global pg_default_acl entry.  PostgreSQL applies these implicit
+                  -- defaults (e.g. PUBLIC gets EXECUTE on functions) when no
+                  -- explicit ALTER DEFAULT PRIVILEGES has been issued.  Including
+                  -- them lets the diff detect REVOKEs of implicit grants.
+                  SELECT
+                    0 AS defaclnamespace,
+                    v.t::"char" AS defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges,
+                    true AS is_implicit
+                  FROM (VALUES ('r'), ('S'), ('f'), ('T'), ('n')) AS v(t)
+                  CROSS JOIN LATERAL aclexplode(acldefault(v.t::"char", r.oid))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE NOT EXISTS (
+                    SELECT 1 FROM pg_default_acl d2
+                    WHERE d2.defaclrole     = r.oid
+                      AND d2.defaclobjtype  = v.t::"char"
+                      AND d2.defaclnamespace = 0
+                  )
+                  GROUP BY v.t, x.grantee
                 ) AS s
               ),
               '[]'
@@ -292,9 +399,7 @@ export async function extractRoles(sql) {
           FROM pg_catalog.pg_roles r
           LEFT JOIN role_memberships rm ON rm.role_name = r.rolname
           WHERE
-            -- drop built-in/internal roles
             r.rolname !~ '^pg_'
-            -- drop roles directly tracked as extension members in pg_shdepend (if any)
             AND NOT EXISTS (
               SELECT 1
               FROM pg_catalog.pg_shdepend d
@@ -303,10 +408,11 @@ export async function extractRoles(sql) {
                 AND d.refclassid  = 'pg_extension'::regclass
                 AND d.deptype     IN ('e','x')
             )
-          ORDER BY 1;
-      `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = roleRows.map((row) => rolePropsSchema.parse(row));
-        return validatedRows.map((row) => new Role(row));
-    });
+          ORDER BY 1
+    `);
+        roleRows = result.rows;
+    }
+    // Validate and parse each row using the Zod schema
+    const validatedRows = roleRows.map((row) => rolePropsSchema.parse(row));
+    return validatedRows.map((row) => new Role(row));
 }

package/dist/core/objects/rule/rule.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const RuleEnabledStateSchema: z.ZodEnum<{
@@ -68,5 +68,5 @@ export declare class Rule extends BasePgModel {
     };
     get relationStableId(): string;
 }
-export declare function extractRules(sql: Sql): Promise<Rule[]>;
+export declare function extractRules(pool: Pool): Promise<Rule[]>;
 export {};

package/dist/core/objects/rule/rule.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { stableId } from "../utils.js";
@@ -81,10 +82,8 @@ export class Rule extends BasePgModel {
         }
     }
 }
-export async function extractRules(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const ruleRows = await sql `
+export async function extractRules(pool) {
+    const { rows: ruleRows } = await pool.query(sql `
       WITH extension_rule_oids AS (
         SELECT
           objid
@@ -148,9 +147,8 @@ export async function extractRules(sql) {
         AND e_rel.objid IS NULL
         AND r.rulename <> '_RETURN'
       ORDER BY
-        1, 3, 2;
-    `;
-        const validatedRows = ruleRows.map((row) => rulePropsSchema.parse(row));
-        return validatedRows.map((row) => new Rule(row));
-    });
+        1, 3, 2
+  `);
+    const validatedRows = ruleRows.map((row) => rulePropsSchema.parse(row));
+    return validatedRows.map((row) => new Rule(row));
 }

package/dist/core/objects/schema/schema.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { SchemaChange } from "./changes/schema.types.ts";
 import type { Schema } from "./schema.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { Schema } from "./schema.model.ts";
  * @param branch - The schemas in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffSchemas(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Schema>, branch: Record<string, Schema>): SchemaChange[];
+export declare function diffSchemas(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Schema>, branch: Record<string, Schema>): SchemaChange[];