@supabase/pg-delta 1.0.0-alpha.0 → 1.0.0-alpha.10

package/dist/core/integrations/supabase.js

@@ -0,0 +1,125 @@
+/**
+ * Supabase integration - filtering and serialization rules for Supabase databases.
+ *
+ * This integration:
+ * - Filters out Supabase system schemas and roles
+ * - Includes user schemas and extensions
+ * - Skips authorization for schema creates owned by Supabase system roles
+ */
+// Supabase system schemas that should be excluded
+const SUPABASE_SYSTEM_SCHEMAS = [
+    "_analytics",
+    "_realtime",
+    "_supavisor",
+    "auth",
+    "cron",
+    "extensions",
+    "graphql",
+    "graphql_public",
+    "information_schema",
+    "net",
+    "pgbouncer",
+    "pgmq",
+    "pgmq_public",
+    "pgsodium",
+    "pgsodium_masks",
+    "pgtle",
+    "realtime",
+    "storage",
+    "supabase_functions",
+    "supabase_migrations",
+    "vault",
+];
+// Supabase system roles that should be excluded
+const SUPABASE_SYSTEM_ROLES = [
+    "anon",
+    "authenticated",
+    "authenticator",
+    "cli_login_postgres",
+    "dashboard_user",
+    "pgbouncer",
+    "pgsodium_keyholder",
+    "pgsodium_keyiduser",
+    "pgsodium_keymaker",
+    "pgtle_admin",
+    "service_role",
+    "supabase_admin",
+    "supabase_auth_admin",
+    "supabase_etl_admin",
+    "supabase_functions_admin",
+    "supabase_read_only_user",
+    "supabase_realtime_admin",
+    "supabase_replication_admin",
+    "supabase_storage_admin",
+    "supabase_superuser",
+];
+/**
+ * To generate the emptyCatalog snapshot, run catalog-export against a fresh
+ * supabase/postgres container:
+ *
+ *   pgdelta catalog-export --target postgres://postgres:postgres@localhost:54322/postgres --output supabase-baseline.json
+ *
+ * Then import and assign the JSON content to the emptyCatalog field below.
+ */
+export const supabase = {
+    // TODO: emptyCatalog: undefined -- populate by running catalog-export on a clean Supabase container
+    filter: {
+        or: [
+            {
+                and: [
+                    {
+                        type: "schema",
+                        operation: "create",
+                        scope: "object",
+                    },
+                    {
+                        not: {
+                            schema: [...SUPABASE_SYSTEM_SCHEMAS],
+                        },
+                    },
+                ],
+            },
+            {
+                type: "extension",
+                operation: "create",
+                scope: "object",
+            },
+            {
+                not: {
+                    or: [
+                        {
+                            schema: [...SUPABASE_SYSTEM_SCHEMAS],
+                        },
+                        {
+                            owner: [...SUPABASE_SYSTEM_ROLES],
+                        },
+                        {
+                            and: [
+                                {
+                                    type: "role",
+                                    scope: "membership",
+                                },
+                                {
+                                    member: [...SUPABASE_SYSTEM_ROLES],
+                                },
+                            ],
+                        },
+                    ],
+                },
+            },
+        ],
+    },
+    serialize: [
+        {
+            when: {
+                type: "schema",
+                operation: "create",
+                scope: "object",
+                owner: [...SUPABASE_SYSTEM_ROLES],
+            },
+            options: {
+                skipAuthorization: true,
+            },
+        },
+    ],
+};

package/dist/core/objects/aggregate/aggregate.diff.d.ts

@@ -1,10 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { Aggregate } from "./aggregate.model.ts";
 import type { AggregateChange } from "./changes/aggregate.types.ts";
-export declare function diffAggregates(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Aggregate>, branch: Record<string, Aggregate>): AggregateChange[];
+export declare function diffAggregates(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Aggregate>, branch: Record<string, Aggregate>): AggregateChange[];

package/dist/core/objects/aggregate/aggregate.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../base.privilege-diff.js";
 import { deepEqual, hasNonAlterableChanges } from "../utils.js";
 import { AlterAggregateChangeOwner } from "./changes/aggregate.alter.js";
 import { CreateCommentOnAggregate, DropCommentOnAggregate, } from "./changes/aggregate.comment.js";
@@ -29,48 +29,21 @@ export function diffAggregates(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "aggregate", aggregate.schema ?? "");
+        const creatorFilteredDefaults = aggregate.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         // Filter out PUBLIC's built-in default EXECUTE privilege (PostgreSQL grants it automatically)
         // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
         // This prevents generating unnecessary "GRANT EXECUTE TO PUBLIC" statements
         const desiredPrivileges = filterPublicBuiltInDefaults("aggregate", aggregate.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the aggregate owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, aggregate.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [, list] of grantGroups) {
-                    changes.push(new GrantAggregatePrivileges({
-                        aggregate,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [, list] of revokeGroups) {
-                    changes.push(new RevokeAggregatePrivileges({
-                        aggregate,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionAggregatePrivileges({
-                    aggregate,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("aggregate", creatorFilteredDefaults), desiredPrivileges, aggregate.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, aggregate, aggregate, "aggregate", {
+            Grant: GrantAggregatePrivileges,
+            Revoke: RevokeAggregatePrivileges,
+            RevokeGrantOption: RevokeGrantOptionAggregatePrivileges,
+        }, ctx.version));
     }
     for (const aggregateId of dropped) {
         changes.push(new DropAggregate({ aggregate: main[aggregateId] }));
@@ -148,39 +121,12 @@ export function diffAggregates(ctx, main, branch) {
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("aggregate", branchAggregate.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchAggregate.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [, list] of grantGroups) {
-                    changes.push(new GrantAggregatePrivileges({
-                        aggregate: branchAggregate,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [, list] of revokeGroups) {
-                    changes.push(new RevokeAggregatePrivileges({
-                        aggregate: mainAggregate,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionAggregatePrivileges({
-                    aggregate: mainAggregate,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchAggregate.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchAggregate, mainAggregate, "aggregate", {
+            Grant: GrantAggregatePrivileges,
+            Revoke: RevokeAggregatePrivileges,
+            RevokeGrantOption: RevokeGrantOptionAggregatePrivileges,
+        }, ctx.version));
     }
     return changes;
 }

package/dist/core/objects/aggregate/aggregate.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
@@ -170,5 +170,5 @@ export declare class Aggregate extends BasePgModel {
         }[];
     };
 }
-export declare function extractAggregates(sql: Sql): Promise<Aggregate[]>;
+export declare function extractAggregates(pool: Pool): Promise<Aggregate[]>;
 export {};

package/dist/core/objects/aggregate/aggregate.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
@@ -208,10 +209,8 @@ export class Aggregate extends BasePgModel {
         };
     }
 }
-export async function extractAggregates(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const aggregateRows = await sql `
+export async function extractAggregates(pool) {
+    const { rows: aggregateRows } = await pool.query(sql `
 with extension_oids as (
   select
     objid
@@ -274,7 +273,7 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(p.proacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(p.proacl, acldefault('f', p.proowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges
 from
@@ -289,9 +288,8 @@ where
   and not p.pronamespace::regnamespace::text like any(array['pg\\_%', 'information\\_schema'])
   and e.objid is null
 order by
-  1, 2, 3;
-    `;
-        const validatedRows = aggregateRows.map((row) => aggregatePropsSchema.parse(row));
-        return validatedRows.map((row) => new Aggregate(row));
-    });
+  1, 2, 3
+  `);
+    const validatedRows = aggregateRows.map((row) => aggregatePropsSchema.parse(row));
+    return validatedRows.map((row) => new Aggregate(row));
 }

package/dist/core/objects/aggregate/changes/aggregate.create.js

@@ -183,7 +183,7 @@ export class CreateAggregate extends CreateAggregateChange {
             clauses.push(`SORTOP = ${formatOperator(this.aggregate.sort_operator)}`);
         }
         if (this.aggregate.parallel_safety !== "u") {
-            clauses.push(`PARALLEL ${formatParallel(this.aggregate.parallel_safety)}`);
+            clauses.push(`PARALLEL = ${formatParallel(this.aggregate.parallel_safety)}`);
         }
         if (this.aggregate.is_strict) {
             clauses.push("STRICT");

package/dist/core/objects/aggregate/changes/aggregate.drop.js

@@ -20,7 +20,7 @@ export class DropAggregate extends DropAggregateChange {
     serialize() {
         const signature = this.aggregate.identityArguments;
         const qualifiedName = `${this.aggregate.schema}.${this.aggregate.name}`;
-        const withArgs = signature.length > 0 ? `(${signature})` : "()";
+        const withArgs = signature.length > 0 ? `(${signature})` : "(*)";
         return `DROP AGGREGATE ${qualifiedName}${withArgs}`;
     }
 }

package/dist/core/objects/base.privilege-diff.d.ts

@@ -1,6 +1,6 @@
 import z from "zod";
 import type { Change } from "../change.types.ts";
-import type { Role } from "./role/role.model.ts";
+import type { BaseChange } from "./base.change.ts";
 /**
  * Privilege properties that all privilege objects share.
  */
@@ -19,17 +19,6 @@ interface PrivilegeDiffResult<T extends PrivilegeProps> {
     revokes: T[];
     revokeGrantOption: string[];
 }
-/**
- * Groups privileges by grantable flag for efficient SQL generation
- */
-export declare function groupPrivilegesByGrantable<T extends PrivilegeProps>(privileges: T[]): Map<boolean, T[]>;
-/**
- * Groups privileges by columns and grantable flag
- */
-export declare function groupPrivilegesByColumns<T extends PrivilegeProps>(privileges: T[]): Map<string, {
-    columns?: string[];
-    byGrant: Map<boolean, Set<string>>;
-}>;
 /**
  * Filters out PUBLIC's built-in default privileges that PostgreSQL automatically grants
  * when creating certain object types. This prevents generating unnecessary GRANT statements
@@ -50,5 +39,41 @@ export declare function filterPublicBuiltInDefaults<T extends PrivilegeProps>(ob
 /**
  * Generic privilege diffing function that works for any object type
  */
-export declare function diffPrivileges<T extends PrivilegeProps>(mainPrivileges: T[], branchPrivileges: T[], owner?: string, mainRoles?: Record<string, Role>): Map<string, PrivilegeDiffResult<T>>;
+export declare function diffPrivileges<T extends PrivilegeProps>(mainPrivileges: T[], branchPrivileges: T[], owner?: string): Map<string, PrivilegeDiffResult<T>>;
+/**
+ * Factory constructors for Grant / Revoke / RevokeGrantOption change classes.
+ * Every object type provides its own concrete classes.  The `any` props type
+ * is intentional: the helpers build props with a computed `[objectKey]` key
+ * whose name varies per object type, so no single concrete type can unify
+ * all call sites without an unsafe cast elsewhere.
+ */
+interface PrivilegeChangeFactories {
+    Grant: new (props: any) => BaseChange;
+    Revoke: new (props: any) => BaseChange;
+    RevokeGrantOption: new (props: any) => BaseChange;
+}
+/**
+ * Emit privilege changes for object-level privileges (schema, sequence,
+ * procedure, etc.).
+ *
+ * For each grantee in `privilegeResults` the function groups grants and revokes
+ * by the `grantable` flag and pushes one change per group.  Revoke-grant-option
+ * entries produce a single change carrying `privilegeNames`.
+ *
+ * `grantTarget` is the *branch* object (the desired state) while `revokeTarget`
+ * is the *main* object (the current state), so that GRANTs reference the
+ * newly-created/altered object and REVOKEs reference the existing one.
+ */
+export declare function emitObjectPrivilegeChanges(privilegeResults: Map<string, PrivilegeDiffResult<PrivilegeProps>>, grantTarget: unknown, revokeTarget: unknown, objectKey: string, factories: PrivilegeChangeFactories, version?: number): BaseChange[];
+/**
+ * Emit privilege changes for column-level privileges (table, view,
+ * materialized view).
+ *
+ * Like {@link emitObjectPrivilegeChanges} but groups by column set (via
+ * `groupPrivilegesByColumns`) instead of only by grantable.  For
+ * revoke-grant-option the column sets come from `sourcePrivileges` so that
+ * `REVOKE GRANT OPTION FOR` is emitted per column set that originally carried
+ * the privilege.
+ */
+export declare function emitColumnPrivilegeChanges(privilegeResults: Map<string, PrivilegeDiffResult<PrivilegeProps>>, grantTarget: unknown, revokeTarget: unknown, objectKey: string, factories: PrivilegeChangeFactories, sourcePrivileges: PrivilegeProps[], version?: number): BaseChange[];
 export {};

package/dist/core/objects/base.privilege-diff.js

@@ -1,5 +1,4 @@
 import z from "zod";
-import { stableId } from "./utils.js";
 /**
  * Privilege properties that all privilege objects share.
  */
@@ -81,7 +80,7 @@ function checkStillHasBase(targetPrivs, privilege, key) {
 /**
  * Groups privileges by grantable flag for efficient SQL generation
  */
-export function groupPrivilegesByGrantable(privileges) {
+function groupPrivilegesByGrantable(privileges) {
     const groups = new Map();
     for (const privilege of privileges) {
         const arr = groups.get(privilege.grantable) ?? [];
@@ -93,7 +92,7 @@ export function groupPrivilegesByGrantable(privileges) {
 /**
  * Groups privileges by columns and grantable flag
  */
-export function groupPrivilegesByColumns(privileges) {
+function groupPrivilegesByColumns(privileges) {
     const groups = new Map();
     for (const privilege of privileges) {
         const key = privilege.columns ? privilege.columns.sort().join(",") : "";
@@ -171,33 +170,17 @@ export function filterPublicBuiltInDefaults(objectType, privileges) {
 function filterOwnerPrivileges(privileges, owner) {
     return privileges.filter((p) => p.grantee !== owner);
 }
-/**
- * Filter out privileges for superuser roles, as PostgreSQL doesn't store
- * GRANTs to superusers in relacl (they already have all privileges implicitly).
- * Reference: https://www.postgresql.org/docs/current/role-attributes.html
- */
-function filterSuperuserPrivileges(privileges, mainRoles) {
-    if (!mainRoles)
-        return privileges;
-    return privileges.filter((priv) => {
-        const role = mainRoles[stableId.role(priv.grantee)];
-        return !role?.is_superuser;
-    });
-}
 /**
  * Generic privilege diffing function that works for any object type
  */
-export function diffPrivileges(mainPrivileges, branchPrivileges, owner, mainRoles) {
-    // Filter out superuser privileges from branch - PostgreSQL doesn't store GRANTs
-    // to superusers in relacl because they already have all privileges implicitly
-    const branchPrivilegesFiltered = filterSuperuserPrivileges(branchPrivileges, mainRoles);
+export function diffPrivileges(mainPrivileges, branchPrivileges, owner) {
     // Filter out owner privileges if owner is provided
     const mainFiltered = owner
         ? filterOwnerPrivileges(mainPrivileges, owner)
         : mainPrivileges;
     const branchFiltered = owner
-        ? filterOwnerPrivileges(branchPrivilegesFiltered, owner)
-        : branchPrivilegesFiltered;
+        ? filterOwnerPrivileges(branchPrivileges, owner)
+        : branchPrivileges;
     const mainByGrantee = groupPrivilegesByGrantee(mainFiltered);
     const branchByGrantee = groupPrivilegesByGrantee(branchFiltered);
     // Get all grantees
@@ -214,3 +197,102 @@ export function diffPrivileges(mainPrivileges, branchPrivileges, owner, mainRole
     }
     return results;
 }
+/**
+ * Emit privilege changes for object-level privileges (schema, sequence,
+ * procedure, etc.).
+ *
+ * For each grantee in `privilegeResults` the function groups grants and revokes
+ * by the `grantable` flag and pushes one change per group.  Revoke-grant-option
+ * entries produce a single change carrying `privilegeNames`.
+ *
+ * `grantTarget` is the *branch* object (the desired state) while `revokeTarget`
+ * is the *main* object (the current state), so that GRANTs reference the
+ * newly-created/altered object and REVOKEs reference the existing one.
+ */
+export function emitObjectPrivilegeChanges(privilegeResults, grantTarget, revokeTarget, objectKey, factories, version) {
+    const changes = [];
+    for (const [grantee, result] of privilegeResults) {
+        for (const [, revokes] of groupPrivilegesByGrantable(result.revokes)) {
+            changes.push(new factories.Revoke({
+                [objectKey]: revokeTarget,
+                privileges: revokes,
+                grantee,
+                version,
+            }));
+        }
+        if (result.revokeGrantOption.length > 0) {
+            changes.push(new factories.RevokeGrantOption({
+                [objectKey]: revokeTarget,
+                privilegeNames: result.revokeGrantOption,
+                grantee,
+                version,
+            }));
+        }
+        for (const [, grants] of groupPrivilegesByGrantable(result.grants)) {
+            changes.push(new factories.Grant({
+                [objectKey]: grantTarget,
+                privileges: grants,
+                grantee,
+                version,
+            }));
+        }
+    }
+    return changes;
+}
+/**
+ * Emit privilege changes for column-level privileges (table, view,
+ * materialized view).
+ *
+ * Like {@link emitObjectPrivilegeChanges} but groups by column set (via
+ * `groupPrivilegesByColumns`) instead of only by grantable.  For
+ * revoke-grant-option the column sets come from `sourcePrivileges` so that
+ * `REVOKE GRANT OPTION FOR` is emitted per column set that originally carried
+ * the privilege.
+ */
+export function emitColumnPrivilegeChanges(privilegeResults, grantTarget, revokeTarget, objectKey, factories, sourcePrivileges, version) {
+    const changes = [];
+    for (const [grantee, result] of privilegeResults) {
+        for (const [, group] of groupPrivilegesByColumns(result.revokes)) {
+            const allPrivileges = new Set();
+            for (const [, privSet] of group.byGrant) {
+                for (const priv of privSet) {
+                    allPrivileges.add(priv);
+                }
+            }
+            changes.push(new factories.Revoke({
+                [objectKey]: revokeTarget,
+                privileges: [...allPrivileges].map((p) => ({
+                    privilege: p,
+                    grantable: false,
+                })),
+                grantee,
+                columns: group.columns,
+                version,
+            }));
+        }
+        if (result.revokeGrantOption.length > 0) {
+            const sourcePrivsForGrantee = sourcePrivileges.filter((p) => p.grantee === grantee);
+            for (const [, group] of groupPrivilegesByColumns(sourcePrivsForGrantee.filter((p) => result.revokeGrantOption.includes(p.privilege)))) {
+                changes.push(new factories.RevokeGrantOption({
+                    [objectKey]: revokeTarget,
+                    privilegeNames: result.revokeGrantOption,
+                    grantee,
+                    columns: group.columns,
+                    version,
+                }));
+            }
+        }
+        for (const [, group] of groupPrivilegesByColumns(result.grants)) {
+            for (const [grantable, privSet] of group.byGrant) {
+                changes.push(new factories.Grant({
+                    [objectKey]: grantTarget,
+                    privileges: [...privSet].map((p) => ({ privilege: p, grantable })),
+                    grantee,
+                    columns: group.columns,
+                    version,
+                }));
+            }
+        }
+    }
+    return changes;
+}

package/dist/core/objects/base.privilege.d.ts

@@ -24,4 +24,5 @@ export declare function normalizePrivileges(privileges: PrivilegeProps[]): {
     grantee: string;
     privilege: string;
     grantable: boolean;
+    columns: string[] | null | undefined;
 }[];

package/dist/core/objects/base.privilege.js

@@ -149,7 +149,7 @@ export function getObjectKindPrefix(objectKind) {
         case "TYPE":
             return "ON TYPE";
         case "FOREIGN TABLE":
-            return "ON FOREIGN TABLE";
+            return "ON TABLE";
         default:
             return "ON";
     }
@@ -160,10 +160,17 @@ export function normalizePrivileges(privileges) {
         grantee: privilege.grantee,
         privilege: privilege.privilege,
         grantable: privilege.grantable,
+        columns: privilege.columns
+            ? [...privilege.columns].sort()
+            : privilege.columns,
     }))
         .sort((a, b) => {
         if (a.grantee !== b.grantee)
             return a.grantee.localeCompare(b.grantee);
-        return a.privilege.localeCompare(b.privilege);
+        if (a.privilege !== b.privilege)
+            return a.privilege.localeCompare(b.privilege);
+        const colA = a.columns?.join(",") ?? "";
+        const colB = b.columns?.join(",") ?? "";
+        return colA.localeCompare(colB);
     });
 }

package/dist/core/objects/collation/collation.diff.d.ts

@@ -1,3 +1,4 @@
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { CollationChange } from "./changes/collation.types.ts";
 import type { Collation } from "./collation.model.ts";
 /**
@@ -8,6 +9,4 @@ import type { Collation } from "./collation.model.ts";
  * @param branch - The collations in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffCollations(ctx: {
-    currentUser: string;
-}, main: Record<string, Collation>, branch: Record<string, Collation>): CollationChange[];
+export declare function diffCollations(ctx: Pick<ObjectDiffContext, "currentUser">, main: Record<string, Collation>, branch: Record<string, Collation>): CollationChange[];

package/dist/core/objects/collation/collation.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 /**
@@ -63,5 +63,5 @@ export declare class Collation extends BasePgModel {
         comment: string | null;
     };
 }
-export declare function extractCollations(sql: Sql): Promise<Collation[]>;
+export declare function extractCollations(pool: Pool): Promise<Collation[]>;
 export {};