@supabase/pg-delta 1.0.0-alpha.0 → 1.0.0-alpha.10

package/dist/core/objects/table/table.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByColumns, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitColumnPrivilegeChanges, } from "../base.privilege-diff.js";
 import { deepEqual } from "../utils.js";
 import { AlterTableAddColumn, AlterTableAddConstraint, AlterTableAlterColumnDropDefault, AlterTableAlterColumnDropNotNull, AlterTableAlterColumnSetDefault, AlterTableAlterColumnSetNotNull, AlterTableAlterColumnType, AlterTableAttachPartition, AlterTableChangeOwner, AlterTableDetachPartition, AlterTableDisableRowLevelSecurity, AlterTableDropColumn, AlterTableDropConstraint, AlterTableEnableRowLevelSecurity, AlterTableForceRowLevelSecurity, AlterTableNoForceRowLevelSecurity, AlterTableResetStorageParams, AlterTableSetLogged, AlterTableSetReplicaIdentity, AlterTableSetStorageParams, AlterTableSetUnlogged, AlterTableValidateConstraint, } from "./changes/table.alter.js";
 import { CreateCommentOnColumn, CreateCommentOnConstraint, CreateCommentOnTable, DropCommentOnColumn, DropCommentOnConstraint, DropCommentOnTable, } from "./changes/table.comment.js";
@@ -149,6 +149,16 @@ export function diffTables(ctx, main, branch) {
         if (branchTable.force_row_security) {
             changes.push(new AlterTableForceRowLevelSecurity({ table: branchTable }));
         }
+        // REPLICA IDENTITY: If non-default, emit ALTER TABLE ... REPLICA IDENTITY
+        if (branchTable.replica_identity !== "d") {
+            // Skip 'i' (USING INDEX) — handled by index changes
+            if (branchTable.replica_identity !== "i") {
+                changes.push(new AlterTableSetReplicaIdentity({
+                    table: branchTable,
+                    mode: branchTable.replica_identity,
+                }));
+            }
+        }
         changes.push(...createAlterConstraintChange(
         // Create a dummy table with no constraints do diff constraints against
         new Table({
@@ -171,86 +181,18 @@ export function diffTables(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "table", branchTable.schema ?? "");
+        const creatorFilteredDefaults = branchTable.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = branchTable.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the table owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, branchTable.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByColumns(result.grants);
-                for (const [, group] of grantGroups) {
-                    for (const [grantable, privSet] of group.byGrant) {
-                        const privileges = Array.from(privSet).map((priv) => ({
-                            privilege: priv,
-                            grantable,
-                        }));
-                        changes.push(new GrantTablePrivileges({
-                            table: branchTable,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                for (const [, group] of revokeGroups) {
-                    const allPrivileges = new Set();
-                    for (const [, privSet] of group.byGrant) {
-                        for (const priv of privSet) {
-                            allPrivileges.add(priv);
-                        }
-                    }
-                    const privileges = Array.from(allPrivileges).map((priv) => ({
-                        privilege: priv,
-                        grantable: false,
-                    }));
-                    changes.push(new RevokeTablePrivileges({
-                        table: branchTable,
-                        grantee,
-                        privileges,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                const revokeGrantGroups = new Map();
-                for (const r of result.revokeGrantOption) {
-                    const originalPriv = effectiveDefaults.find((p) => p.grantee === grantee && p.privilege === r);
-                    const key = originalPriv?.columns
-                        ? originalPriv.columns.sort().join(",")
-                        : "";
-                    if (!revokeGrantGroups.has(key)) {
-                        revokeGrantGroups.set(key, {
-                            columns: originalPriv?.columns
-                                ? [...originalPriv.columns]
-                                : undefined,
-                            privileges: new Set(),
-                        });
-                    }
-                    const group = revokeGrantGroups.get(key);
-                    if (!group)
-                        continue;
-                    group.privileges.add(r);
-                }
-                for (const [, group] of revokeGrantGroups) {
-                    const privilegeNames = Array.from(group.privileges);
-                    changes.push(new RevokeGrantOptionTablePrivileges({
-                        table: branchTable,
-                        grantee,
-                        privilegeNames,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, branchTable.owner);
+        changes.push(...emitColumnPrivilegeChanges(privilegeResults, branchTable, branchTable, "table", {
+            Grant: GrantTablePrivileges,
+            Revoke: RevokeTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionTablePrivileges,
+        }, effectiveDefaults, ctx.version));
     }
     for (const tableId of dropped) {
         changes.push(new DropTable({ table: main[tableId] }));
@@ -584,85 +526,12 @@ export function diffTables(ctx, main, branch) {
         // PRIVILEGES (unified object and column privileges)
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainTable.privileges, branchTable.privileges, branchTable.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByColumns(result.grants);
-                for (const [, group] of grantGroups) {
-                    for (const [grantable, privSet] of group.byGrant) {
-                        const privileges = Array.from(privSet).map((priv) => ({
-                            privilege: priv,
-                            grantable,
-                        }));
-                        changes.push(new GrantTablePrivileges({
-                            table: branchTable,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                for (const [, group] of revokeGroups) {
-                    // Collapse all grantable groups into a single revoke (grantable: false)
-                    const allPrivileges = new Set();
-                    for (const [, privSet] of group.byGrant) {
-                        for (const priv of privSet) {
-                            allPrivileges.add(priv);
-                        }
-                    }
-                    const privileges = Array.from(allPrivileges).map((priv) => ({
-                        privilege: priv,
-                        grantable: false,
-                    }));
-                    changes.push(new RevokeTablePrivileges({
-                        table: mainTable,
-                        grantee,
-                        privileges,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                const revokeGrantGroups = new Map();
-                for (const r of result.revokeGrantOption) {
-                    // For revoke grant option, we need to find the columns from the original privilege
-                    const originalPriv = mainTable.privileges.find((p) => p.grantee === grantee && p.privilege === r);
-                    const key = originalPriv?.columns
-                        ? originalPriv.columns.sort().join(",")
-                        : "";
-                    if (!revokeGrantGroups.has(key)) {
-                        revokeGrantGroups.set(key, {
-                            columns: originalPriv?.columns
-                                ? [...originalPriv.columns]
-                                : undefined,
-                            privileges: new Set(),
-                        });
-                    }
-                    const group = revokeGrantGroups.get(key);
-                    if (!group)
-                        continue;
-                    group.privileges.add(r);
-                }
-                for (const [, group] of revokeGrantGroups) {
-                    const privilegeNames = Array.from(group.privileges);
-                    changes.push(new RevokeGrantOptionTablePrivileges({
-                        table: mainTable,
-                        grantee,
-                        privilegeNames,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-        }
+        const privilegeResults = diffPrivileges(mainTable.privileges, branchTable.privileges, branchTable.owner);
+        changes.push(...emitColumnPrivilegeChanges(privilegeResults, branchTable, mainTable, "table", {
+            Grant: GrantTablePrivileges,
+            Revoke: RevokeTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionTablePrivileges,
+        }, mainTable.privileges, ctx.version));
     }
     return changes;
 }

package/dist/core/objects/table/table.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel, type TableLikeObject } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
@@ -12,6 +12,7 @@ declare const tableConstraintPropsSchema: z.ZodObject<{
     name: z.ZodString;
     constraint_type: z.ZodEnum<{
         u: "u";
+        t: "t";
         c: "c";
         p: "p";
         f: "f";
@@ -113,6 +114,7 @@ declare const tablePropsSchema: z.ZodObject<{
         name: z.ZodString;
         constraint_type: z.ZodEnum<{
             u: "u";
+            t: "t";
             c: "c";
             p: "p";
             f: "f";
@@ -231,7 +233,7 @@ export declare class Table extends BasePgModel implements TableLikeObject {
         }[];
         constraints: {
             name: string;
-            constraint_type: "u" | "c" | "p" | "f" | "x";
+            constraint_type: "u" | "t" | "c" | "p" | "f" | "x";
             deferrable: boolean;
             initially_deferred: boolean;
             validated: boolean;
@@ -292,7 +294,7 @@ export declare class Table extends BasePgModel implements TableLikeObject {
             options: string[] | null;
             constraints: {
                 name: string;
-                constraint_type: "u" | "c" | "p" | "f" | "x";
+                constraint_type: "u" | "t" | "c" | "p" | "f" | "x";
                 deferrable: boolean;
                 initially_deferred: boolean;
                 validated: boolean;
@@ -324,6 +326,7 @@ export declare class Table extends BasePgModel implements TableLikeObject {
                 grantee: string;
                 privilege: string;
                 grantable: boolean;
+                columns: string[] | null | undefined;
             }[];
             persistence: "u" | "t" | "p";
             row_security: boolean;
@@ -337,5 +340,5 @@ export declare class Table extends BasePgModel implements TableLikeObject {
         };
     };
 }
-export declare function extractTables(sql: Sql): Promise<Table[]>;
+export declare function extractTables(pool: Pool): Promise<Table[]>;
 export {};

package/dist/core/objects/table/table.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel, columnPropsSchema, normalizeColumns, } from "../base.model.js";
 import { normalizePrivileges } from "../base.privilege.js";
@@ -32,6 +33,7 @@ const tableConstraintPropsSchema = z.object({
         "c", // CHECK constraint
         "f", // FOREIGN KEY constraint
         "p", // PRIMARY KEY constraint
+        "t", // TRIGGER constraint
         "u", // UNIQUE constraint
         "x", // EXCLUDE constraint
     ]),
@@ -182,10 +184,8 @@ export class Table extends BasePgModel {
         };
     }
 }
-export async function extractTables(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const tableRows = await sql `
+export async function extractTables(pool) {
+    const { rows: tableRows } = await pool.query(sql `
 with extension_oids as (
   select objid
   from pg_depend d
@@ -339,6 +339,8 @@ select
       and de.refclassid = 'pg_extension'::regclass
 
       where c.conrelid = t.oid
+        -- Skip constraint triggers and PG18 NOT NULL constraints; they are modeled elsewhere
+        and c.contype not in ('t', 'n')
         and not c.connamespace::regnamespace::text like any(array['pg\\_%', 'information\\_schema'])
         and de.objid is null
     ),
@@ -395,7 +397,7 @@ select
       from (
         -- one row for object ACL + one row per column ACL
         select null::name as attname, t.oid as relacl_oid, (
-          select c_rel.relacl from pg_class c_rel where c_rel.oid = t.oid
+          select COALESCE(c_rel.relacl, acldefault('r', c_rel.relowner)) from pg_class c_rel where c_rel.oid = t.oid
         ) as acl
         union all
         select a2.attname, t.oid as relacl_oid, a2.attacl
@@ -417,10 +419,9 @@ from
 group by
   t.oid, t.schema, t.name, t.persistence, t.row_security, t.force_row_security, t.has_indexes, t.has_rules, t.has_triggers, t.has_subclasses, t.is_populated, t.replica_identity, t.is_partition, t.options, t.partition_bound, t.partition_by, t.owner, t.parent_schema, t.parent_name
 order by
-  t.schema, t.name;
-    `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = tableRows.map((row) => tablePropsSchema.parse(row));
-        return validatedRows.map((row) => new Table(row));
-    });
+  t.schema, t.name
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = tableRows.map((row) => tablePropsSchema.parse(row));
+    return validatedRows.map((row) => new Table(row));
 }

package/dist/core/objects/trigger/changes/trigger.alter.js

@@ -1,5 +1,7 @@
+import { quoteLiteral } from "../../base.change.js";
 import { AlterTriggerChange } from "./trigger.base.js";
 import { CreateTrigger } from "./trigger.create.js";
+import { DropTrigger } from "./trigger.drop.js";
 /**
  * Replace a trigger by dropping and recreating it.
  * This is used when properties that cannot be altered via ALTER TRIGGER change.
@@ -17,6 +19,27 @@ export class ReplaceTrigger extends AlterTriggerChange {
         return [this.trigger.stableId];
     }
     serialize() {
+        if (this.trigger.isConstraintTrigger) {
+            const dropChange = new DropTrigger({ trigger: this.trigger });
+            const createChange = new CreateTrigger({
+                trigger: this.trigger,
+                indexableObject: this.indexableObject,
+                orReplace: false,
+            });
+            const commentSql = this.trigger.comment !== null
+                ? [
+                    "COMMENT ON TRIGGER",
+                    this.trigger.name,
+                    "ON",
+                    `${this.trigger.schema}.${this.trigger.table_name}`,
+                    "IS",
+                    quoteLiteral(this.trigger.comment),
+                ].join(" ")
+                : null;
+            return [dropChange.serialize(), createChange.serialize(), commentSql]
+                .filter(Boolean)
+                .join(";\n");
+        }
         const createChange = new CreateTrigger({
             trigger: this.trigger,
             indexableObject: this.indexableObject,

package/dist/core/objects/trigger/changes/trigger.create.js

@@ -45,17 +45,16 @@ export class CreateTrigger extends CreateTriggerChange {
         // Table dependency
         dependencies.add(stableId.table(this.trigger.schema, this.trigger.table_name));
         // Function dependency
-        // Note: We can't build the exact procedure stableId without argument types.
-        // The trigger definition contains the full function call, but parsing it would be complex.
-        // For now, we rely on pg_depend extraction for procedure dependencies.
-        // If needed, we could parse the trigger definition to extract the full function signature.
+        // Trigger functions always have signature () RETURNS trigger, so no arguments.
+        dependencies.add(stableId.procedure(this.trigger.function_schema, this.trigger.function_name));
         // Owner dependency
         dependencies.add(stableId.role(this.trigger.owner));
         return Array.from(dependencies);
     }
     serialize() {
         let definition = this.trigger.definition.trim();
-        definition = definition.replace(/^CREATE\s+(?:OR\s+REPLACE\s+)?/i, `CREATE ${this.orReplace ? "OR REPLACE " : ""}`);
+        const isConstraintTrigger = this.trigger.isConstraintTrigger;
+        definition = definition.replace(/^CREATE\s+(?:OR\s+REPLACE\s+)?/i, `CREATE ${this.orReplace && !isConstraintTrigger ? "OR REPLACE " : ""}`);
         return definition;
     }
 }

package/dist/core/objects/trigger/trigger.model.d.ts

@@ -1,10 +1,17 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const triggerPropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
     table_name: z.ZodString;
+    table_relkind: z.ZodEnum<{
+        r: "r";
+        v: "v";
+        m: "m";
+        p: "p";
+        f: "f";
+    }>;
     function_schema: z.ZodString;
     function_name: z.ZodString;
     trigger_type: z.ZodNumber;
@@ -37,6 +44,7 @@ export declare class Trigger extends BasePgModel {
     readonly schema: TriggerProps["schema"];
     readonly name: TriggerProps["name"];
     readonly table_name: TriggerProps["table_name"];
+    readonly table_relkind: TriggerProps["table_relkind"];
     readonly function_schema: TriggerProps["function_schema"];
     readonly function_name: TriggerProps["function_name"];
     readonly trigger_type: TriggerProps["trigger_type"];
@@ -59,6 +67,7 @@ export declare class Trigger extends BasePgModel {
     readonly definition: TriggerProps["definition"];
     readonly comment: TriggerProps["comment"];
     constructor(props: TriggerProps);
+    get isConstraintTrigger(): boolean;
     get stableId(): `trigger:${string}`;
     get identityFields(): {
         schema: string;
@@ -88,5 +97,5 @@ export declare class Trigger extends BasePgModel {
         comment: string | null;
     };
 }
-export declare function extractTriggers(sql: Sql): Promise<Trigger[]>;
+export declare function extractTriggers(pool: Pool): Promise<Trigger[]>;
 export {};

package/dist/core/objects/trigger/trigger.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 const TriggerEnabledSchema = z.enum([
@@ -6,10 +7,18 @@ const TriggerEnabledSchema = z.enum([
     "R", // REPLICA - trigger fires only in "replica" mode
     "A", // ALWAYS - trigger fires regardless of replication mode
 ]);
+const TriggerTableRelkindSchema = z.enum([
+    "r", // ordinary table
+    "p", // partitioned table
+    "f", // foreign table
+    "v", // view
+    "m", // materialized view
+]);
 const triggerPropsSchema = z.object({
     schema: z.string(),
     name: z.string(),
     table_name: z.string(),
+    table_relkind: TriggerTableRelkindSchema,
     function_schema: z.string(),
     function_name: z.string(),
     trigger_type: z.number(),
@@ -36,6 +45,7 @@ export class Trigger extends BasePgModel {
     schema;
     name;
     table_name;
+    table_relkind;
     function_schema;
     function_name;
     trigger_type;
@@ -63,6 +73,7 @@ export class Trigger extends BasePgModel {
         this.schema = props.schema;
         this.name = props.name;
         this.table_name = props.table_name;
+        this.table_relkind = props.table_relkind;
         // Data fields
         this.function_schema = props.function_schema;
         this.function_name = props.function_name;
@@ -86,6 +97,9 @@ export class Trigger extends BasePgModel {
         this.definition = props.definition;
         this.comment = props.comment;
     }
+    get isConstraintTrigger() {
+        return /^CREATE\s+CONSTRAINT\s+TRIGGER/i.test(this.definition.trim());
+    }
     get stableId() {
         return `trigger:${this.schema}.${this.table_name}.${this.name}`;
     }
@@ -121,10 +135,8 @@ export class Trigger extends BasePgModel {
         };
     }
 }
-export async function extractTriggers(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const triggerRows = await sql `
+export async function extractTriggers(pool) {
+    const { rows: triggerRows } = await pool.query(sql `
       with extension_trigger_oids as (
         select objid
         from pg_depend d
@@ -148,6 +160,7 @@ export async function extractTriggers(sql) {
         tc.relnamespace::regnamespace::text as schema,
         quote_ident(t.tgname)               as name,
         quote_ident(tc.relname)             as table_name,
+        tc.relkind                          as table_relkind,
 
         fc.pronamespace::regnamespace::text as function_schema,
         quote_ident(fc.proname)             as function_name,
@@ -226,10 +239,9 @@ export async function extractTriggers(sql) {
         and e_function.objid is null
         and not t.tgisinternal
 
-      order by 1, 2;
-    `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = triggerRows.map((row) => triggerPropsSchema.parse(row));
-        return validatedRows.map((row) => new Trigger(row));
-    });
+      order by 1, 2
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = triggerRows.map((row) => triggerPropsSchema.parse(row));
+    return validatedRows.map((row) => new Trigger(row));
 }

package/dist/core/objects/type/composite-type/composite-type.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import type { CompositeTypeChange } from "./changes/composite-type.types.ts";
 import type { CompositeType } from "./composite-type.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { CompositeType } from "./composite-type.model.ts";
  * @param branch - The composite types in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffCompositeTypes(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, CompositeType>, branch: Record<string, CompositeType>): CompositeTypeChange[];
+export declare function diffCompositeTypes(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, CompositeType>, branch: Record<string, CompositeType>): CompositeTypeChange[];

package/dist/core/objects/type/composite-type/composite-type.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
 import { deepEqual, hasNonAlterableChanges } from "../../utils.js";
 import { AlterCompositeTypeAddAttribute, AlterCompositeTypeAlterAttributeType, AlterCompositeTypeChangeOwner, AlterCompositeTypeDropAttribute, } from "./changes/composite-type.alter.js";
 import { CreateCommentOnCompositeType, CreateCommentOnCompositeTypeAttribute, DropCommentOnCompositeType, DropCommentOnCompositeTypeAttribute, } from "./changes/composite-type.comment.js";
@@ -47,50 +47,21 @@ export function diffCompositeTypes(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "composite_type", ct.schema ?? "");
+        const creatorFilteredDefaults = ct.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         // Filter out PUBLIC's built-in default USAGE privilege (PostgreSQL grants it automatically)
         // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
         // This prevents generating unnecessary "GRANT USAGE TO PUBLIC" statements
         const desiredPrivileges = filterPublicBuiltInDefaults("composite_type", ct.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the composite type owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, ct.owner);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantCompositeTypePrivileges({
-                        compositeType: ct,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeCompositeTypePrivileges({
-                        compositeType: ct,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionCompositeTypePrivileges({
-                    compositeType: ct,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("composite_type", creatorFilteredDefaults), desiredPrivileges, ct.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, ct, ct, "compositeType", {
+            Grant: GrantCompositeTypePrivileges,
+            Revoke: RevokeCompositeTypePrivileges,
+            RevokeGrantOption: RevokeGrantOptionCompositeTypePrivileges,
+        }, ctx.version));
     }
     for (const compositeTypeId of dropped) {
         changes.push(new DropCompositeType({ compositeType: main[compositeTypeId] }));
@@ -203,44 +174,12 @@ export function diffCompositeTypes(ctx, main, branch) {
             const branchPrivilegesFiltered = filterPublicBuiltInDefaults("composite_type", branchCompositeType.privileges);
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchCompositeType.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantCompositeTypePrivileges({
-                            compositeType: branchCompositeType,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeCompositeTypePrivileges({
-                            compositeType: mainCompositeType,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionCompositeTypePrivileges({
-                        compositeType: mainCompositeType,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchCompositeType.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchCompositeType, mainCompositeType, "compositeType", {
+                Grant: GrantCompositeTypePrivileges,
+                Revoke: RevokeCompositeTypePrivileges,
+                RevokeGrantOption: RevokeGrantOptionCompositeTypePrivileges,
+            }, ctx.version));
             // Note: Composite type renaming would also use ALTER TYPE ... RENAME TO ...
             // But since our CompositeType model uses 'name' as the identity field,
             // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/type/composite-type/composite-type.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel, type TableLikeObject } from "../../base.model.ts";
 import { type PrivilegeProps } from "../../base.privilege-diff.ts";
@@ -144,5 +144,5 @@ export declare class CompositeType extends BasePgModel implements TableLikeObjec
         };
     };
 }
-export declare function extractCompositeTypes(sql: Sql): Promise<CompositeType[]>;
+export declare function extractCompositeTypes(pool: Pool): Promise<CompositeType[]>;
 export {};