@supabase/pg-delta 1.0.0-alpha.0 → 1.0.0-alpha.10

package/dist/core/objects/schema/schema.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, } from "../base.privilege-diff.js";
 import { AlterSchemaChangeOwner } from "./changes/schema.alter.js";
 import { CreateCommentOnSchema, DropCommentOnSchema, } from "./changes/schema.comment.js";
 import { CreateSchema } from "./changes/schema.create.js";
@@ -29,47 +29,18 @@ export function diffSchemas(ctx, main, branch) {
         // needed to reach the final desired state.
         // Note: Schemas don't have a schema property, so we pass empty string
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "schema", "");
+        const creatorFilteredDefaults = sc.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = sc.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the schema owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, sc.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantSchemaPrivileges({
-                        schema: sc,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeSchemaPrivileges({
-                        schema: sc,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionSchemaPrivileges({
-                    schema: sc,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, sc.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, sc, sc, "schema", {
+            Grant: GrantSchemaPrivileges,
+            Revoke: RevokeSchemaPrivileges,
+            RevokeGrantOption: RevokeGrantOptionSchemaPrivileges,
+        }, ctx.version));
     }
     for (const schemaId of dropped) {
         changes.push(new DropSchema({ schema: main[schemaId] }));
@@ -96,44 +67,12 @@ export function diffSchemas(ctx, main, branch) {
         // PRIVILEGES
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainSchema.privileges, branchSchema.privileges, branchSchema.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantSchemaPrivileges({
-                        schema: branchSchema,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeSchemaPrivileges({
-                        schema: mainSchema,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionSchemaPrivileges({
-                    schema: mainSchema,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainSchema.privileges, branchSchema.privileges, branchSchema.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchSchema, mainSchema, "schema", {
+            Grant: GrantSchemaPrivileges,
+            Revoke: RevokeSchemaPrivileges,
+            RevokeGrantOption: RevokeGrantOptionSchemaPrivileges,
+        }, ctx.version));
         // Note: Schema renaming would also use ALTER SCHEMA ... RENAME TO ...
         // But since our Schema model uses 'schema' as the identity field,
         // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/schema/schema.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
@@ -43,5 +43,5 @@ export declare class Schema extends BasePgModel {
         }[];
     };
 }
-export declare function extractSchemas(sql: Sql): Promise<Schema[]>;
+export declare function extractSchemas(pool: Pool): Promise<Schema[]>;
 export {};

package/dist/core/objects/schema/schema.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
@@ -44,10 +45,8 @@ export class Schema extends BasePgModel {
         };
     }
 }
-export async function extractSchemas(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const schemaRows = await sql `
+export async function extractSchemas(pool) {
+    const { rows: schemaRows } = await pool.query(sql `
     with extension_oids as (
       select
         objid
@@ -71,7 +70,7 @@ export async function extractSchemas(sql) {
             )
             order by x.grantee, x.privilege_type
           )
-          from lateral aclexplode(nspacl) as x(grantor, grantee, privilege_type, is_grantable)
+          from lateral aclexplode(COALESCE(nspacl, acldefault('n', nspowner))) as x(grantor, grantee, privilege_type, is_grantable)
         ), '[]'
       ) as privileges
     from
@@ -82,10 +81,9 @@ export async function extractSchemas(sql) {
       and e.objid is null
       -- </EXCLUDE_INTERNAL>
     order by
-      1;
-  `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = schemaRows.map((row) => schemaPropsSchema.parse(row));
-        return validatedRows.map((row) => new Schema(row));
-    });
+      1
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = schemaRows.map((row) => schemaPropsSchema.parse(row));
+    return validatedRows.map((row) => new Schema(row));
 }

package/dist/core/objects/sequence/sequence.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { Table } from "../table/table.model.ts";
 import type { SequenceChange } from "./changes/sequence.types.ts";
 import type { Sequence } from "./sequence.model.ts";
@@ -12,9 +11,4 @@ import type { Sequence } from "./sequence.model.ts";
  * @param branchTables - The tables in the branch catalog (used to check if owning tables are being dropped).
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffSequences(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Sequence>, branch: Record<string, Sequence>, branchTables?: Record<string, Table>): SequenceChange[];
+export declare function diffSequences(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Sequence>, branch: Record<string, Sequence>, branchTables?: Record<string, Table>): SequenceChange[];

package/dist/core/objects/sequence/sequence.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, } from "../base.privilege-diff.js";
 import { hasNonAlterableChanges } from "../utils.js";
 import { AlterSequenceSetOptions, AlterSequenceSetOwnedBy, } from "./changes/sequence.alter.js";
 import { CreateCommentOnSequence, DropCommentOnSequence, } from "./changes/sequence.comment.js";
@@ -43,48 +43,18 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "sequence", createdSeq.schema ?? "");
+        const creatorFilteredDefaults = createdSeq.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = createdSeq.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the sequence owner as the reference.
-        // Superuser privileges are filtered inside diffPrivileges.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdSeq.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantSequencePrivileges({
-                        sequence: createdSeq,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeSequencePrivileges({
-                        sequence: createdSeq,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionSequencePrivileges({
-                    sequence: createdSeq,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, createdSeq.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdSeq, createdSeq, "sequence", {
+            Grant: GrantSequencePrivileges,
+            Revoke: RevokeSequencePrivileges,
+            RevokeGrantOption: RevokeGrantOptionSequencePrivileges,
+        }, ctx.version));
     }
     for (const sequenceId of dropped) {
         const sequence = main[sequenceId];
@@ -210,45 +180,12 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
             // PRIVILEGES
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            // Superuser privileges are filtered inside diffPrivileges.
-            const privilegeResults = diffPrivileges(mainSequence.privileges, branchSequence.privileges, branchSequence.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantSequencePrivileges({
-                            sequence: branchSequence,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeSequencePrivileges({
-                            sequence: mainSequence,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionSequencePrivileges({
-                        sequence: mainSequence,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(mainSequence.privileges, branchSequence.privileges, branchSequence.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchSequence, mainSequence, "sequence", {
+                Grant: GrantSequencePrivileges,
+                Revoke: RevokeSequencePrivileges,
+                RevokeGrantOption: RevokeGrantOptionSequencePrivileges,
+            }, ctx.version));
             // Note: Sequence renaming would also use ALTER SEQUENCE ... RENAME TO ...
             // But since our Sequence model uses 'name' as the identity field,
             // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/sequence/sequence.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
@@ -72,5 +72,5 @@ export declare class Sequence extends BasePgModel {
         owner: string;
     };
 }
-export declare function extractSequences(sql: Sql): Promise<Sequence[]>;
+export declare function extractSequences(pool: Pool): Promise<Sequence[]>;
 export {};

package/dist/core/objects/sequence/sequence.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
@@ -85,10 +86,8 @@ export class Sequence extends BasePgModel {
         };
     }
 }
-export async function extractSequences(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const sequenceRows = await sql `
+export async function extractSequences(pool) {
+    const { rows: sequenceRows } = await pool.query(sql `
 with extension_sequence_oids as (
   select
     objid
@@ -133,7 +132,7 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(c.relacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(c.relacl, acldefault('S', c.relowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges,
   c.relowner::regrole::text as owner
@@ -160,10 +159,9 @@ from
       and di.deptype = 'i'
   )
 order by
-  1, 2;
-  `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = sequenceRows.map((row) => sequencePropsSchema.parse(row));
-        return validatedRows.map((row) => new Sequence(row));
-    });
+  1, 2
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = sequenceRows.map((row) => sequencePropsSchema.parse(row));
+    return validatedRows.map((row) => new Sequence(row));
 }

package/dist/core/objects/subscription/subscription.diff.d.ts

@@ -1,5 +1,4 @@
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { SubscriptionChange } from "./changes/subscription.types.ts";
 import type { Subscription } from "./subscription.model.ts";
-export declare function diffSubscriptions(ctx: {
-    currentUser: string;
-}, main: Record<string, Subscription>, branch: Record<string, Subscription>): SubscriptionChange[];
+export declare function diffSubscriptions(ctx: Pick<ObjectDiffContext, "currentUser">, main: Record<string, Subscription>, branch: Record<string, Subscription>): SubscriptionChange[];

package/dist/core/objects/subscription/subscription.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const subscriptionPropsSchema: z.ZodObject<{
@@ -76,5 +76,5 @@ export declare class Subscription extends BasePgModel {
         origin: "any" | "none";
     };
 }
-export declare function extractSubscriptions(sql: Sql): Promise<Subscription[]>;
+export declare function extractSubscriptions(pool: Pool): Promise<Subscription[]>;
 export {};

package/dist/core/objects/subscription/subscription.model.js

@@ -95,15 +95,22 @@ export class Subscription extends BasePgModel {
         };
     }
 }
-export async function extractSubscriptions(sql) {
-    return sql.begin(async (tx) => {
-        await tx `set search_path = ''`;
-        const version = await extractVersion(tx);
-        const isPostgres16OrGreater = version >= 160000;
-        const isPostgres17OrGreater = version >= 170000;
-        const isPostgres17_2OrGreater = version >= 170002; // failover added in 17.2 (170002)
-        const isPostgres17_3OrGreater = version >= 170003; // origin column added in 17.3
-        const rows = await tx `
+export async function extractSubscriptions(pool) {
+    const version = await extractVersion(pool);
+    const isPostgres16OrGreater = version >= 160000;
+    const isPostgres17OrGreater = version >= 170000;
+    const isPostgres17_2OrGreater = version >= 170002; // failover added in 17.2 (170002)
+    const isPostgres17_3OrGreater = version >= 170003; // origin column added in 17.3
+    // Build the query dynamically based on PostgreSQL version
+    const passwordRequiredExpr = isPostgres16OrGreater
+        ? "s.subpasswordrequired"
+        : "true";
+    const runAsOwnerExpr = isPostgres17OrGreater ? "s.subrunasowner" : "false";
+    const failoverExpr = isPostgres17_2OrGreater ? "s.subfailover" : "false";
+    const originExpr = isPostgres17_3OrGreater
+        ? "case s.suborigin when 'none' then 'none' else 'any' end"
+        : "'any'";
+    const queryText = `
       with extension_oids as (
         select objid
         from pg_depend d
@@ -130,9 +137,9 @@ export async function extractSubscriptions(sql) {
         end as streaming,
         (s.subtwophasestate <> 'd') as two_phase,
         s.subdisableonerr as disable_on_error,
-        ${isPostgres16OrGreater ? tx ` s.subpasswordrequired ` : tx ` true `} as password_required,
-        ${isPostgres17OrGreater ? tx ` s.subrunasowner ` : tx ` false `} as run_as_owner,
-        ${isPostgres17_2OrGreater ? tx ` s.subfailover ` : tx ` false `} as failover,
+        ${passwordRequiredExpr} as password_required,
+        ${runAsOwnerExpr} as run_as_owner,
+        ${failoverExpr} as failover,
         s.subconninfo as conninfo,
         case
           when s.subslotname is null then null
@@ -149,18 +156,16 @@ export async function extractSubscriptions(sql) {
           ),
           '[]'::json
         ) as publications,
-        ${isPostgres17_3OrGreater
-            ? tx ` case s.suborigin when 'none' then 'none' else 'any' end `
-            : tx ` 'any' `} as origin
+        ${originExpr} as origin
       from scoped_subscriptions s
       left join pg_replication_slots r
         on r.slot_name = s.subslotname
        and r.datoid = s.subdbid
       left join extension_oids e on e.objid = s.oid
       where e.objid is null
-      order by s.subname;
-    `;
-        const validated = rows.map((row) => subscriptionPropsSchema.parse(row));
-        return validated.map((row) => new Subscription(row));
-    });
+      order by s.subname
+  `;
+    const { rows } = await pool.query(queryText);
+    const validated = rows.map((row) => subscriptionPropsSchema.parse(row));
+    return validated.map((row) => new Subscription(row));
 }

package/dist/core/objects/table/changes/table.create.js

@@ -64,6 +64,9 @@ export class CreateTable extends CreateTableChange {
                     }
                 }
             }
+            // Function dependencies from DEFAULT expressions are handled by pg_depend
+            // catalog constraints in the sort pipeline, which provides exact argument
+            // types and covers all expression contexts (not just column defaults).
         }
         return Array.from(dependencies);
     }

package/dist/core/objects/table/table.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { TableChange } from "./changes/table.types.ts";
 import { Table } from "./table.model.ts";
 /**
@@ -10,9 +9,4 @@ import { Table } from "./table.model.ts";
  * @param branch - The tables in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffTables(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Table>, branch: Record<string, Table>): TableChange[];
+export declare function diffTables(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Table>, branch: Record<string, Table>): TableChange[];