@supabase/pg-delta 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/core/objects/collation/collation.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { extractVersion } from "../../context.js";
 import { BasePgModel } from "../base.model.js";
@@ -88,15 +89,13 @@ export class Collation extends BasePgModel {
         };
     }
 }
-export async function extractCollations(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const version = await extractVersion(sql);
-        const isPostgres17OrGreater = version >= 170000;
-        const isPostgres16OrGreater = version >= 160000;
-        let collations;
-        if (isPostgres17OrGreater) {
-            collations = await sql `
+export async function extractCollations(pool) {
+    const version = await extractVersion(pool);
+    const isPostgres17OrGreater = version >= 170000;
+    const isPostgres16OrGreater = version >= 160000;
+    let collationRows;
+    if (isPostgres17OrGreater) {
+        const result = await pool.query(sql `
       with extension_oids as (
         select
           objid
@@ -125,12 +124,13 @@ export async function extractCollations(sql) {
         where not c.collnamespace::regnamespace::text like any(array['pg\\_%', 'information\\_schema'])
         and e.objid is null
       order by
-        1, 2;
-  `;
-        }
-        else if (isPostgres16OrGreater) {
-            // On postgres 16 there colllocale column was named colliculocale
-            collations = await sql `
+        1, 2
+    `);
+        collationRows = result.rows;
+    }
+    else if (isPostgres16OrGreater) {
+        // On postgres 16 there colllocale column was named colliculocale
+        const result = await pool.query(sql `
       with extension_oids as (
         select
           objid
@@ -161,12 +161,13 @@ export async function extractCollations(sql) {
         and e.objid is null
         -- </EXCLUDE_INTERNAL>
       order by
-        1, 2;
-    `;
-        }
-        else {
-            // On postgres 15 icu_rules does not exist
-            collations = await sql `
+        1, 2
+    `);
+        collationRows = result.rows;
+    }
+    else {
+        // On postgres 15 icu_rules does not exist
+        const result = await pool.query(sql `
       with extension_oids as (
         select
           objid
@@ -197,11 +198,11 @@ export async function extractCollations(sql) {
         and e.objid is null
         -- </EXCLUDE_INTERNAL>
       order by
-        1, 2;
-    `;
-        }
-        // Validate and parse each row using the Zod schema
-        const validatedRows = collations.map((row) => collationPropsSchema.parse(row));
-        return validatedRows.map((row) => new Collation(row));
-    });
+        1, 2
+    `);
+        collationRows = result.rows;
+    }
+    // Validate and parse each row using the Zod schema
+    const validatedRows = collationRows.map((row) => collationPropsSchema.parse(row));
+    return validatedRows.map((row) => new Collation(row));
 }

package/dist/core/objects/diff-context.d.ts

@@ -0,0 +1,15 @@
+import type { DefaultPrivilegeState } from "./base.default-privileges.ts";
+import type { Role } from "./role/role.model.ts";
+/**
+ * Unified context built by `diffCatalogs` and passed to per-object diff
+ * functions.  Each diff declares only the keys it reads via
+ * `Pick<ObjectDiffContext, …>`, so every signature documents its actual
+ * requirements.  The full object is always assignable to every narrower Pick.
+ */
+export interface ObjectDiffContext {
+    version: number;
+    currentUser: string;
+    defaultPrivilegeState: DefaultPrivilegeState;
+    mainRoles: Record<string, Role>;
+    skipDefaultPrivilegeSubtraction?: boolean;
+}

package/dist/core/objects/diff-context.js

@@ -0,0 +1 @@
+export {};

package/dist/core/objects/domain/changes/domain.create.d.ts

@@ -24,7 +24,7 @@ export declare class CreateDomain extends CreateDomainChange {
     constructor(props: {
         domain: Domain;
     });
-    get creates(): `domain:${string}`[];
+    get creates(): (`constraint:${string}.${string}.${string}` | `domain:${string}`)[];
     get requires(): string[];
     serialize(): string;
 }

package/dist/core/objects/domain/changes/domain.create.js

@@ -1,4 +1,4 @@
-import { isUserDefinedTypeSchema, stableId } from "../../utils.js";
+import { isUserDefinedTypeSchema, parseTypeString, stableId, } from "../../utils.js";
 import { CreateDomainChange } from "./domain.base.js";
 /**
  * Create a domain.
@@ -26,7 +26,13 @@ export class CreateDomain extends CreateDomainChange {
         this.domain = props.domain;
     }
     get creates() {
-        return [this.domain.stableId];
+        const creates = [this.domain.stableId];
+        for (const constraint of this.domain.constraints) {
+            if (constraint.check_expression && constraint.validated) {
+                creates.push(stableId.constraint(this.domain.schema, this.domain.name, constraint.name));
+            }
+        }
+        return creates;
     }
     get requires() {
         const dependencies = new Set();
@@ -58,7 +64,9 @@ export class CreateDomain extends CreateDomainChange {
         const domainName = `${this.domain.schema}.${this.domain.name}`;
         // Base type (use formatted string for type+typmod and add schema if needed)
         let baseType = this.domain.base_type_str;
-        if (this.domain.base_type_schema &&
+        const alreadyQualified = parseTypeString(baseType);
+        if (!alreadyQualified &&
+            this.domain.base_type_schema &&
             this.domain.base_type_schema !== "pg_catalog") {
             baseType = `${this.domain.base_type_schema}.${baseType}`;
         }

package/dist/core/objects/domain/changes/domain.types.d.ts

@@ -3,4 +3,5 @@ import type { CommentDomain } from "./domain.comment.ts";
 import type { CreateDomain } from "./domain.create.ts";
 import type { DropDomain } from "./domain.drop.ts";
 import type { DomainPrivilege } from "./domain.privilege.ts";
+/** Union of all domain-related change variants (`objectType: "domain"`). @category Change Types */
 export type DomainChange = AlterDomain | CommentDomain | CreateDomain | DropDomain | DomainPrivilege;

package/dist/core/objects/domain/domain.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { DomainChange } from "./changes/domain.types.ts";
 import type { Domain } from "./domain.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { Domain } from "./domain.model.ts";
  * @param branch - The domains in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffDomains(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Domain>, branch: Record<string, Domain>): DomainChange[];
+export declare function diffDomains(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Domain>, branch: Record<string, Domain>): DomainChange[];

package/dist/core/objects/domain/domain.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../base.privilege-diff.js";
 import { AlterDomainAddConstraint, AlterDomainChangeOwner, AlterDomainDropConstraint, AlterDomainDropDefault, AlterDomainDropNotNull, AlterDomainSetDefault, AlterDomainSetNotNull, AlterDomainValidateConstraint, } from "./changes/domain.alter.js";
 import { CreateCommentOnDomain, DropCommentOnDomain, } from "./changes/domain.comment.js";
 import { CreateDomain } from "./changes/domain.create.js";
@@ -50,50 +50,21 @@ export function diffDomains(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "domain", newDomain.schema ?? "");
+        const creatorFilteredDefaults = newDomain.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         // Filter out PUBLIC's built-in default USAGE privilege (PostgreSQL grants it automatically)
         // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
         // This prevents generating unnecessary "GRANT USAGE TO PUBLIC" statements
         const desiredPrivileges = filterPublicBuiltInDefaults("domain", newDomain.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the domain owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, newDomain.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantDomainPrivileges({
-                        domain: newDomain,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeDomainPrivileges({
-                        domain: newDomain,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionDomainPrivileges({
-                    domain: newDomain,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("domain", creatorFilteredDefaults), desiredPrivileges, newDomain.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, newDomain, newDomain, "domain", {
+            Grant: GrantDomainPrivileges,
+            Revoke: RevokeDomainPrivileges,
+            RevokeGrantOption: RevokeGrantOptionDomainPrivileges,
+        }, ctx.version));
     }
     for (const domainId of dropped) {
         changes.push(new DropDomain({ domain: main[domainId] }));
@@ -201,44 +172,12 @@ export function diffDomains(ctx, main, branch) {
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("domain", branchDomain.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchDomain.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantDomainPrivileges({
-                        domain: branchDomain,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeDomainPrivileges({
-                        domain: mainDomain,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionDomainPrivileges({
-                    domain: mainDomain,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchDomain.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchDomain, mainDomain, "domain", {
+            Grant: GrantDomainPrivileges,
+            Revoke: RevokeDomainPrivileges,
+            RevokeGrantOption: RevokeGrantOptionDomainPrivileges,
+        }, ctx.version));
     }
     return changes;
 }

package/dist/core/objects/domain/domain.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
@@ -99,5 +99,5 @@ export declare class Domain extends BasePgModel {
  * @param sql - The SQL client.
  * @returns A list of domains.
  */
-export declare function extractDomains(sql: Sql): Promise<Domain[]>;
+export declare function extractDomains(pool: Pool): Promise<Domain[]>;
 export {};

package/dist/core/objects/domain/domain.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
@@ -98,10 +99,8 @@ export class Domain extends BasePgModel {
  * @param sql - The SQL client.
  * @returns A list of domains.
  */
-export async function extractDomains(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const domainRows = await sql `
+export async function extractDomains(pool) {
+    const { rows: domainRows } = await pool.query(sql `
       with extension_oids as (
         select
           objid
@@ -151,7 +150,7 @@ export async function extractDomains(sql) {
               )
               order by x.grantee, x.privilege_type
             )
-            from lateral aclexplode(t.typacl) as x(grantor, grantee, privilege_type, is_grantable)
+            from lateral aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) as x(grantor, grantee, privilege_type, is_grantable)
           ), '[]'
         ) as privileges
       from
@@ -163,10 +162,9 @@ export async function extractDomains(sql) {
         and e.objid is null
         and t.typtype = 'd'
       order by
-        1, 2;
-    `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = domainRows.map((row) => domainPropsSchema.parse(row));
-        return validatedRows.map((row) => new Domain(row));
-    });
+        1, 2
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = domainRows.map((row) => domainPropsSchema.parse(row));
+    return validatedRows.map((row) => new Domain(row));
 }

package/dist/core/objects/event-trigger/changes/event-trigger.types.d.ts

@@ -2,4 +2,5 @@ import type { AlterEventTrigger } from "./event-trigger.alter.ts";
 import type { CommentEventTrigger } from "./event-trigger.comment.ts";
 import type { CreateEventTrigger } from "./event-trigger.create.ts";
 import type { DropEventTrigger } from "./event-trigger.drop.ts";
+/** Union of all event-trigger-related change variants (`objectType: "event_trigger"`). @category Change Types */
 export type EventTriggerChange = AlterEventTrigger | CommentEventTrigger | CreateEventTrigger | DropEventTrigger;

package/dist/core/objects/event-trigger/event-trigger.diff.d.ts

@@ -1,3 +1,4 @@
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { EventTriggerChange } from "./changes/event-trigger.types.ts";
 import type { EventTrigger } from "./event-trigger.model.ts";
 /**
@@ -8,6 +9,4 @@ import type { EventTrigger } from "./event-trigger.model.ts";
  * @param branch - The event triggers in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffEventTriggers(ctx: {
-    currentUser: string;
-}, main: Record<string, EventTrigger>, branch: Record<string, EventTrigger>): EventTriggerChange[];
+export declare function diffEventTriggers(ctx: Pick<ObjectDiffContext, "currentUser">, main: Record<string, EventTrigger>, branch: Record<string, EventTrigger>): EventTriggerChange[];

package/dist/core/objects/event-trigger/event-trigger.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const eventTriggerPropsSchema: z.ZodObject<{
@@ -41,5 +41,5 @@ export declare class EventTrigger extends BasePgModel {
         comment: string | null;
     };
 }
-export declare function extractEventTriggers(sql: Sql): Promise<EventTrigger[]>;
+export declare function extractEventTriggers(pool: Pool): Promise<EventTrigger[]>;
 export {};

package/dist/core/objects/event-trigger/event-trigger.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 const EventTriggerEnabledSchema = z.enum([
@@ -58,10 +59,8 @@ export class EventTrigger extends BasePgModel {
         };
     }
 }
-export async function extractEventTriggers(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const rows = await sql `
+export async function extractEventTriggers(pool) {
+    const { rows } = await pool.query(sql `
 with extension_oids as (
   select objid
   from pg_depend d
@@ -81,9 +80,8 @@ from pg_catalog.pg_event_trigger et
 join pg_catalog.pg_proc p on p.oid = et.evtfoid
 left join extension_oids e on e.objid = et.oid
 where e.objid is null
-order by 1;
-    `;
-        const validatedRows = rows.map((row) => eventTriggerPropsSchema.parse(row));
-        return validatedRows.map((row) => new EventTrigger(row));
-    });
+order by 1
+  `);
+    const validatedRows = rows.map((row) => eventTriggerPropsSchema.parse(row));
+    return validatedRows.map((row) => new EventTrigger(row));
 }

package/dist/core/objects/extension/changes/extension.types.d.ts

@@ -2,4 +2,5 @@ import type { AlterExtension } from "./extension.alter.ts";
 import type { CommentExtension } from "./extension.comment.ts";
 import type { CreateExtension } from "./extension.create.ts";
 import type { DropExtension } from "./extension.drop.ts";
+/** Union of all extension-related change variants (`objectType: "extension"`). @category Change Types */
 export type ExtensionChange = AlterExtension | CommentExtension | CreateExtension | DropExtension;

package/dist/core/objects/extension/extension.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 /**
@@ -48,5 +48,5 @@ export declare class Extension extends BasePgModel {
         comment: string | null;
     };
 }
-export declare function extractExtensions(sql: Sql): Promise<Extension[]>;
+export declare function extractExtensions(pool: Pool): Promise<Extension[]>;
 export {};

package/dist/core/objects/extension/extension.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 /**
@@ -65,10 +66,8 @@ export class Extension extends BasePgModel {
     }
 }
 // TODO: fetch extension dependencies so we can determine when to use CASCADE on creation
-export async function extractExtensions(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const extensionRows = await sql `
+export async function extractExtensions(pool) {
+    const { rows: extensionRows } = await pool.query(sql `
   with extension_rows as (
     select
       e.oid,
@@ -259,10 +258,9 @@ export async function extractExtensions(sql) {
     ) as members
   from extension_rows er
   order by
-    er.name;
-  `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = extensionRows.map((row) => extensionPropsSchema.parse(row));
-        return validatedRows.map((row) => new Extension(row));
-    });
+    er.name
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = extensionRows.map((row) => extensionPropsSchema.parse(row));
+    return validatedRows.map((row) => new Extension(row));
 }

package/dist/core/objects/foreign-data-wrapper/foreign-data-wrapper/changes/foreign-data-wrapper.types.d.ts

@@ -3,4 +3,5 @@ import type { CommentForeignDataWrapper } from "./foreign-data-wrapper.comment.t
 import type { CreateForeignDataWrapper } from "./foreign-data-wrapper.create.ts";
 import type { DropForeignDataWrapper } from "./foreign-data-wrapper.drop.ts";
 import type { ForeignDataWrapperPrivilege } from "./foreign-data-wrapper.privilege.ts";
+/** Union of all FDW wrapper-level change variants (`objectType: "foreign_data_wrapper"`). @category Change Types */
 export type ForeignDataWrapperChange = AlterForeignDataWrapper | CommentForeignDataWrapper | CreateForeignDataWrapper | DropForeignDataWrapper | ForeignDataWrapperPrivilege;

package/dist/core/objects/foreign-data-wrapper/foreign-data-wrapper/foreign-data-wrapper.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import type { ForeignDataWrapperChange } from "./changes/foreign-data-wrapper.types.ts";
 import type { ForeignDataWrapper } from "./foreign-data-wrapper.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { ForeignDataWrapper } from "./foreign-data-wrapper.model.ts";
  * @param branch - The foreign data wrappers in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffForeignDataWrappers(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, ForeignDataWrapper>, branch: Record<string, ForeignDataWrapper>): ForeignDataWrapperChange[];
+export declare function diffForeignDataWrappers(ctx: Pick<ObjectDiffContext, "version" | "currentUser">, main: Record<string, ForeignDataWrapper>, branch: Record<string, ForeignDataWrapper>): ForeignDataWrapperChange[];

package/dist/core/objects/foreign-data-wrapper/foreign-data-wrapper/foreign-data-wrapper.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
 import { AlterForeignDataWrapperChangeOwner, AlterForeignDataWrapperSetOptions, } from "./changes/foreign-data-wrapper.alter.js";
 import { CreateCommentOnForeignDataWrapper, DropCommentOnForeignDataWrapper, } from "./changes/foreign-data-wrapper.comment.js";
 import { CreateForeignDataWrapper } from "./changes/foreign-data-wrapper.create.js";
@@ -37,44 +37,12 @@ export function diffForeignDataWrappers(ctx, main, branch) {
         const effectiveDefaults = [];
         const desiredPrivileges = filterPublicBuiltInDefaults("foreign_data_wrapper", createdFdw.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdFdw.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantForeignDataWrapperPrivileges({
-                        foreignDataWrapper: createdFdw,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeForeignDataWrapperPrivileges({
-                        foreignDataWrapper: createdFdw,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionForeignDataWrapperPrivileges({
-                    foreignDataWrapper: createdFdw,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdFdw.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdFdw, createdFdw, "foreignDataWrapper", {
+            Grant: GrantForeignDataWrapperPrivileges,
+            Revoke: RevokeForeignDataWrapperPrivileges,
+            RevokeGrantOption: RevokeGrantOptionForeignDataWrapperPrivileges,
+        }, ctx.version));
     }
     for (const fdwId of dropped) {
         changes.push(new DropForeignDataWrapper({ foreignDataWrapper: main[fdwId] }));
@@ -133,44 +101,12 @@ export function diffForeignDataWrappers(ctx, main, branch) {
         // PRIVILEGES
         const mainPrivilegesFiltered = filterPublicBuiltInDefaults("foreign_data_wrapper", mainFdw.privileges);
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("foreign_data_wrapper", branchFdw.privileges);
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchFdw.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantForeignDataWrapperPrivileges({
-                        foreignDataWrapper: branchFdw,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeForeignDataWrapperPrivileges({
-                        foreignDataWrapper: mainFdw,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionForeignDataWrapperPrivileges({
-                    foreignDataWrapper: mainFdw,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchFdw.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchFdw, mainFdw, "foreignDataWrapper", {
+            Grant: GrantForeignDataWrapperPrivileges,
+            Revoke: RevokeForeignDataWrapperPrivileges,
+            RevokeGrantOption: RevokeGrantOptionForeignDataWrapperPrivileges,
+        }, ctx.version));
         // Note: FDW renaming would also use ALTER FOREIGN DATA WRAPPER ... RENAME TO ...
         // But since our ForeignDataWrapper model uses 'name' as the identity field,
         // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/foreign-data-wrapper/foreign-data-wrapper/foreign-data-wrapper.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../../base.model.ts";
 import { type PrivilegeProps } from "../../base.privilege-diff.ts";
@@ -55,5 +55,5 @@ export declare class ForeignDataWrapper extends BasePgModel {
         }[];
     };
 }
-export declare function extractForeignDataWrappers(sql: Sql): Promise<ForeignDataWrapper[]>;
+export declare function extractForeignDataWrappers(pool: Pool): Promise<ForeignDataWrapper[]>;
 export {};