@supabase/pg-delta 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/core/objects/procedure/procedure.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../base.privilege-diff.js";
 import { deepEqual, hasNonAlterableChanges } from "../utils.js";
 import { AlterProcedureChangeOwner, AlterProcedureSetConfig, AlterProcedureSetLeakproof, AlterProcedureSetParallel, AlterProcedureSetSecurity, AlterProcedureSetStrictness, AlterProcedureSetVolatility, } from "./changes/procedure.alter.js";
 import { CreateCommentOnProcedure, DropCommentOnProcedure, } from "./changes/procedure.comment.js";
@@ -37,6 +37,9 @@ export function diffProcedures(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "procedure", proc.schema ?? "");
+        const creatorFilteredDefaults = proc.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         // Filter out PUBLIC's built-in default EXECUTE privilege (PostgreSQL grants it automatically)
         // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
         // This prevents generating unnecessary "GRANT EXECUTE TO PUBLIC" statements
@@ -44,44 +47,12 @@ export function diffProcedures(ctx, main, branch) {
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Note: we use the final owner (proc.owner), not the
         // current user, because ownership change happens before privilege diffing.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, proc.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantProcedurePrivileges({
-                        procedure: proc,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeProcedurePrivileges({
-                        procedure: proc,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionProcedurePrivileges({
-                    procedure: proc,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("procedure", creatorFilteredDefaults), desiredPrivileges, proc.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, proc, proc, "procedure", {
+            Grant: GrantProcedurePrivileges,
+            Revoke: RevokeProcedurePrivileges,
+            RevokeGrantOption: RevokeGrantOptionProcedurePrivileges,
+        }, ctx.version));
     }
     for (const procedureId of dropped) {
         changes.push(new DropProcedure({ procedure: main[procedureId] }));
@@ -238,44 +209,12 @@ export function diffProcedures(ctx, main, branch) {
             const branchPrivilegesFiltered = filterPublicBuiltInDefaults("procedure", branchProcedure.privileges);
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchProcedure.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantProcedurePrivileges({
-                            procedure: branchProcedure,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeProcedurePrivileges({
-                            procedure: mainProcedure,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionProcedurePrivileges({
-                        procedure: mainProcedure,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchProcedure.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchProcedure, mainProcedure, "procedure", {
+                Grant: GrantProcedurePrivileges,
+                Revoke: RevokeProcedurePrivileges,
+                RevokeGrantOption: RevokeGrantOptionProcedurePrivileges,
+            }, ctx.version));
         }
     }
     return changes;

package/dist/core/objects/procedure/procedure.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
@@ -6,24 +6,24 @@ declare const procedurePropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
     kind: z.ZodEnum<{
-        f: "f";
-        w: "w";
         a: "a";
+        w: "w";
         p: "p";
+        f: "f";
     }>;
     return_type: z.ZodString;
     return_type_schema: z.ZodString;
     language: z.ZodString;
     security_definer: z.ZodBoolean;
     volatility: z.ZodEnum<{
-        s: "s";
         i: "i";
+        s: "s";
         v: "v";
     }>;
     parallel_safety: z.ZodEnum<{
-        r: "r";
         u: "u";
         s: "s";
+        r: "r";
     }>;
     execution_cost: z.ZodNumber;
     result_rows: z.ZodNumber;
@@ -36,8 +36,8 @@ declare const procedurePropsSchema: z.ZodObject<{
     argument_types: z.ZodNullable<z.ZodArray<z.ZodString>>;
     all_argument_types: z.ZodNullable<z.ZodArray<z.ZodString>>;
     argument_modes: z.ZodNullable<z.ZodArray<z.ZodEnum<{
-        o: "o";
         i: "i";
+        o: "o";
         b: "b";
         v: "v";
         t: "t";
@@ -96,13 +96,13 @@ export declare class Procedure extends BasePgModel {
         name: string;
     };
     get dataFields(): {
-        kind: "f" | "w" | "a" | "p";
+        kind: "a" | "w" | "p" | "f";
         return_type: string;
         return_type_schema: string;
         language: string;
         security_definer: boolean;
-        volatility: "s" | "i" | "v";
-        parallel_safety: "r" | "u" | "s";
+        volatility: "i" | "s" | "v";
+        parallel_safety: "u" | "s" | "r";
         is_strict: boolean;
         leakproof: boolean;
         returns_set: boolean;
@@ -111,7 +111,7 @@ export declare class Procedure extends BasePgModel {
         argument_names: string[] | null;
         argument_types: string[] | null;
         all_argument_types: string[] | null;
-        argument_modes: ("o" | "i" | "b" | "v" | "t")[] | null;
+        argument_modes: ("i" | "o" | "b" | "v" | "t")[] | null;
         argument_defaults: string | null;
         source_code: string | null;
         binary_path: string | null;
@@ -128,5 +128,5 @@ export declare class Procedure extends BasePgModel {
         }[];
     };
 }
-export declare function extractProcedures(sql: Sql): Promise<Procedure[]>;
+export declare function extractProcedures(pool: Pool): Promise<Procedure[]>;
 export {};

package/dist/core/objects/procedure/procedure.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
@@ -162,10 +163,8 @@ export class Procedure extends BasePgModel {
         };
     }
 }
-export async function extractProcedures(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const procedureRows = await sql `
+export async function extractProcedures(pool) {
+    const { rows: procedureRows } = await pool.query(sql `
 with extension_oids as (
   select
     objid
@@ -223,7 +222,7 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(p.proacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(p.proacl, acldefault('f', p.proowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges
 from
@@ -235,10 +234,9 @@ from
   and e.objid is null
   and l.lanname not in ('c', 'internal')
 order by
-  1, 2;
-    `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = procedureRows.map((row) => procedurePropsSchema.parse(row));
-        return validatedRows.map((row) => new Procedure(row));
-    });
+  1, 2
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = procedureRows.map((row) => procedurePropsSchema.parse(row));
+    return validatedRows.map((row) => new Procedure(row));
 }

package/dist/core/objects/publication/changes/publication.alter.d.ts

@@ -13,15 +13,6 @@ export declare class AlterPublicationSetOptions extends AlterPublicationChange {
     get requires(): `publication:${string}`[];
     serialize(): string;
 }
-export declare class AlterPublicationSetForAllTables extends AlterPublicationChange {
-    readonly publication: Publication;
-    readonly scope: "object";
-    constructor(props: {
-        publication: Publication;
-    });
-    get requires(): `publication:${string}`[];
-    serialize(): string;
-}
 export declare class AlterPublicationSetList extends AlterPublicationChange {
     readonly publication: Publication;
     readonly scope: "object";

package/dist/core/objects/publication/changes/publication.alter.js

@@ -27,20 +27,6 @@ export class AlterPublicationSetOptions extends AlterPublicationChange {
         return `ALTER PUBLICATION ${this.publication.name} SET (${assignments.join(", ")})`;
     }
 }
-export class AlterPublicationSetForAllTables extends AlterPublicationChange {
-    publication;
-    scope = "object";
-    constructor(props) {
-        super();
-        this.publication = props.publication;
-    }
-    get requires() {
-        return [this.publication.stableId];
-    }
-    serialize() {
-        return `ALTER PUBLICATION ${this.publication.name} SET FOR ALL TABLES`;
-    }
-}
 export class AlterPublicationSetList extends AlterPublicationChange {
     publication;
     scope = "object";

package/dist/core/objects/publication/changes/publication.types.d.ts

@@ -1,5 +1,6 @@
-import type { AlterPublicationAddSchemas, AlterPublicationAddTables, AlterPublicationDropSchemas, AlterPublicationDropTables, AlterPublicationSetForAllTables, AlterPublicationSetList, AlterPublicationSetOptions, AlterPublicationSetOwner } from "./publication.alter.ts";
+import type { AlterPublicationAddSchemas, AlterPublicationAddTables, AlterPublicationDropSchemas, AlterPublicationDropTables, AlterPublicationSetList, AlterPublicationSetOptions, AlterPublicationSetOwner } from "./publication.alter.ts";
 import type { CommentPublication } from "./publication.comment.ts";
 import type { CreatePublication } from "./publication.create.ts";
 import type { DropPublication } from "./publication.drop.ts";
-export type PublicationChange = AlterPublicationAddSchemas | AlterPublicationAddTables | AlterPublicationDropSchemas | AlterPublicationDropTables | AlterPublicationSetForAllTables | AlterPublicationSetList | AlterPublicationSetOptions | AlterPublicationSetOwner | CommentPublication | CreatePublication | DropPublication;
+/** Union of all publication-related change variants (`objectType: "publication"`). @category Change Types */
+export type PublicationChange = AlterPublicationAddSchemas | AlterPublicationAddTables | AlterPublicationDropSchemas | AlterPublicationDropTables | AlterPublicationSetList | AlterPublicationSetOptions | AlterPublicationSetOwner | CommentPublication | CreatePublication | DropPublication;

package/dist/core/objects/publication/publication.diff.d.ts

@@ -1,5 +1,4 @@
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { PublicationChange } from "./changes/publication.types.ts";
 import type { Publication } from "./publication.model.ts";
-export declare function diffPublications(ctx: {
-    currentUser: string;
-}, main: Record<string, Publication>, branch: Record<string, Publication>): PublicationChange[];
+export declare function diffPublications(ctx: Pick<ObjectDiffContext, "currentUser">, main: Record<string, Publication>, branch: Record<string, Publication>): PublicationChange[];

package/dist/core/objects/publication/publication.diff.js

@@ -1,6 +1,6 @@
 import { diffObjects } from "../base.diff.js";
 import { deepEqual } from "../utils.js";
-import { AlterPublicationAddSchemas, AlterPublicationAddTables, AlterPublicationDropSchemas, AlterPublicationDropTables, AlterPublicationSetForAllTables, AlterPublicationSetOptions, AlterPublicationSetOwner, } from "./changes/publication.alter.js";
+import { AlterPublicationAddSchemas, AlterPublicationAddTables, AlterPublicationDropSchemas, AlterPublicationDropTables, AlterPublicationSetOptions, AlterPublicationSetOwner, } from "./changes/publication.alter.js";
 import { CreateCommentOnPublication, DropCommentOnPublication, } from "./changes/publication.comment.js";
 import { CreatePublication } from "./changes/publication.create.js";
 import { DropPublication } from "./changes/publication.drop.js";
@@ -52,21 +52,16 @@ export function diffPublications(ctx, main, branch) {
         let handledObjectLists = false;
         if (mainPublication.all_tables !== branchPublication.all_tables) {
             handledObjectLists = true;
-            if (branchPublication.all_tables) {
-                changes.push(new AlterPublicationSetForAllTables({
+            // Changing the all_tables mode requires DROP + CREATE because
+            // ALTER PUBLICATION does not support SET ALL TABLES.
+            changes.push(new DropPublication({ publication: mainPublication }));
+            changes.push(new CreatePublication({ publication: branchPublication }));
+            if (branchPublication.comment !== null) {
+                changes.push(new CreateCommentOnPublication({
                     publication: branchPublication,
                 }));
             }
-            else {
-                changes.push(new DropPublication({ publication: mainPublication }));
-                changes.push(new CreatePublication({ publication: branchPublication }));
-                if (branchPublication.comment !== null) {
-                    changes.push(new CreateCommentOnPublication({
-                        publication: branchPublication,
-                    }));
-                }
-                continue;
-            }
+            continue;
         }
         if (!handledObjectLists && !branchPublication.all_tables) {
             const tableDiff = diffPublicationTables(mainPublication.tables, branchPublication.tables);

package/dist/core/objects/publication/publication.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const publicationTablePropsSchema: z.ZodObject<{
@@ -92,5 +92,5 @@ export declare class Publication extends BasePgModel {
 /**
  * Extract all logical replication publications from the database.
  */
-export declare function extractPublications(sql: Sql): Promise<Publication[]>;
+export declare function extractPublications(pool: Pool): Promise<Publication[]>;
 export {};

package/dist/core/objects/publication/publication.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 const publicationTablePropsSchema = z.object({
@@ -104,10 +105,8 @@ export class Publication extends BasePgModel {
 /**
  * Extract all logical replication publications from the database.
  */
-export async function extractPublications(sql) {
-    return sql.begin(async (tx) => {
-        await tx `set search_path = ''`;
-        const rows = await tx `
+export async function extractPublications(pool) {
+    const { rows } = await pool.query(sql `
       with extension_oids as (
         select objid
         from pg_depend d
@@ -178,9 +177,8 @@ export async function extractPublications(sql) {
       from pg_publication p
       left join extension_oids e on e.objid = p.oid
       where e.objid is null
-      order by 1;
-    `;
-        const validated = rows.map((row) => publicationPropsSchema.parse(row));
-        return validated.map((row) => new Publication(row));
-    });
+      order by 1
+  `);
+    const validated = rows.map((row) => publicationPropsSchema.parse(row));
+    return validated.map((row) => new Publication(row));
 }

package/dist/core/objects/rls-policy/changes/rls-policy.alter.js

@@ -21,7 +21,7 @@ export class AlterRlsPolicySetRoles extends AlterRlsPolicyChange {
         const rolesSql = toPublic ? "PUBLIC" : targetRoles.join(", ");
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "TO",
@@ -48,7 +48,7 @@ export class AlterRlsPolicySetUsingExpression extends AlterRlsPolicyChange {
         const expr = this.usingExpression ?? "true";
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "USING",
@@ -75,7 +75,7 @@ export class AlterRlsPolicySetWithCheckExpression extends AlterRlsPolicyChange {
         const expr = this.withCheckExpression ?? "true";
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "WITH CHECK",

package/dist/core/objects/rls-policy/changes/rls-policy.types.d.ts

@@ -2,4 +2,5 @@ import type { AlterRlsPolicy } from "./rls-policy.alter.ts";
 import type { CommentRlsPolicy } from "./rls-policy.comment.ts";
 import type { CreateRlsPolicy } from "./rls-policy.create.ts";
 import type { DropRlsPolicy } from "./rls-policy.drop.ts";
+/** Union of all RLS policy-related change variants (`objectType: "rls_policy"`). @category Change Types */
 export type RlsPolicyChange = AlterRlsPolicy | CommentRlsPolicy | CreateRlsPolicy | DropRlsPolicy;

package/dist/core/objects/rls-policy/rls-policy.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const rlsPolicyPropsSchema: z.ZodObject<{
@@ -6,9 +6,9 @@ declare const rlsPolicyPropsSchema: z.ZodObject<{
     name: z.ZodString;
     table_name: z.ZodString;
     command: z.ZodEnum<{
+        a: "a";
         r: "r";
         w: "w";
-        a: "a";
         d: "d";
         "*": "*";
     }>;
@@ -39,7 +39,7 @@ export declare class RlsPolicy extends BasePgModel {
         name: string;
     };
     get dataFields(): {
-        command: "r" | "w" | "a" | "d" | "*";
+        command: "a" | "r" | "w" | "d" | "*";
         permissive: boolean;
         roles: string[];
         using_expression: string | null;
@@ -48,5 +48,5 @@ export declare class RlsPolicy extends BasePgModel {
         comment: string | null;
     };
 }
-export declare function extractRlsPolicies(sql: Sql): Promise<RlsPolicy[]>;
+export declare function extractRlsPolicies(pool: Pool): Promise<RlsPolicy[]>;
 export {};

package/dist/core/objects/rls-policy/rls-policy.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 const RlsPolicyCommandSchema = z.enum([
@@ -67,10 +68,8 @@ export class RlsPolicy extends BasePgModel {
         };
     }
 }
-export async function extractRlsPolicies(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const policyRows = await sql `
+export async function extractRlsPolicies(pool) {
+    const { rows: policyRows } = await pool.query(sql `
 with extension_policy_oids as (
   select
     objid
@@ -118,10 +117,9 @@ from
   and e_policy.objid is null
   and e_table.objid is null
 order by
-  1, 2;
-    `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = policyRows.map((row) => rlsPolicyPropsSchema.parse(row));
-        return validatedRows.map((row) => new RlsPolicy(row));
-    });
+  1, 2
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = policyRows.map((row) => rlsPolicyPropsSchema.parse(row));
+    return validatedRows.map((row) => new RlsPolicy(row));
 }

package/dist/core/objects/role/changes/role.types.d.ts

@@ -3,4 +3,5 @@ import type { CommentRole } from "./role.comment.ts";
 import type { CreateRole } from "./role.create.ts";
 import type { DropRole } from "./role.drop.ts";
 import type { RolePrivilege } from "./role.privilege.ts";
+/** Union of all role-related change variants (`objectType: "role"`). @category Change Types */
 export type RoleChange = AlterRole | CommentRole | CreateRole | DropRole | RolePrivilege;

package/dist/core/objects/role/role.diff.js

@@ -31,8 +31,15 @@ export function diffRoles(ctx, main, branch) {
         if (role.comment !== null) {
             changes.push(new CreateCommentOnRole({ role }));
         }
-        // MEMBERSHIPS: Grant memberships immediately after role creation
+        // MEMBERSHIPS: Grant memberships immediately after role creation.
+        // Members are already deduplicated by the Role model constructor.
         for (const membership of role.members) {
+            // Skip memberships where the member is the grantor (auto-created by
+            // CREATE ROLE — re-granting them, especially WITH ADMIN OPTION, fails
+            // with "ADMIN option cannot be granted back to your own grantor").
+            if (membership.grantor === membership.member) {
+                continue;
+            }
             changes.push(new GrantRoleMembership({
                 role,
                 member: membership.member,
@@ -45,6 +52,8 @@ export function diffRoles(ctx, main, branch) {
         }
         // DEFAULT PRIVILEGES: Grant default privileges immediately after role creation
         for (const defaultPriv of role.default_privileges) {
+            if (defaultPriv.is_implicit)
+                continue;
             if (defaultPriv.privileges.length === 0)
                 continue;
             const grantGroups = new Map();
@@ -163,11 +172,18 @@ export function diffRoles(ctx, main, branch) {
             }
         }
         // MEMBERSHIPS
+        // Members are already deduplicated by the Role model constructor.
         const mainMembers = new Map(mainRole.members.map((m) => [m.member, m]));
         const branchMembers = new Map(branchRole.members.map((m) => [m.member, m]));
         // Find new members to grant
         for (const [member, membership] of branchMembers) {
             if (!mainMembers.has(member)) {
+                // Skip memberships where the member is the grantor (auto-created by
+                // CREATE ROLE — re-granting them fails with "ADMIN option cannot be
+                // granted back to your own grantor").
+                if (membership.grantor === membership.member) {
+                    continue;
+                }
                 changes.push(new GrantRoleMembership({
                     role: branchRole,
                     member: membership.member,
@@ -224,6 +240,11 @@ export function diffRoles(ctx, main, branch) {
                     }));
                 }
                 if (toGrant.admin || toGrant.inherit || toGrant.set) {
+                    // Skip granting options back to the grantor (same restriction as
+                    // for newly created roles).
+                    if (branchMembership.grantor === branchMembership.member) {
+                        continue;
+                    }
                     changes.push(new GrantRoleMembership({
                         role: branchRole,
                         member: branchMembership.member,

package/dist/core/objects/role/role.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const rolePropsSchema: z.ZodObject<{
@@ -23,17 +23,18 @@ declare const rolePropsSchema: z.ZodObject<{
     default_privileges: z.ZodArray<z.ZodObject<{
         in_schema: z.ZodNullable<z.ZodString>;
         objtype: z.ZodEnum<{
+            n: "n";
             r: "r";
-            S: "S";
             f: "f";
+            S: "S";
             T: "T";
-            n: "n";
         }>;
         grantee: z.ZodString;
         privileges: z.ZodArray<z.ZodObject<{
             privilege: z.ZodString;
             grantable: z.ZodBoolean;
         }, z.z.core.$strip>>;
+        is_implicit: z.ZodBoolean;
     }, z.z.core.$strip>>;
 }, z.z.core.$strip>;
 export type RoleProps = z.infer<typeof rolePropsSchema>;
@@ -80,10 +81,10 @@ export declare class Role extends BasePgModel {
                 grantable: boolean;
             }[];
             in_schema: string | null;
-            objtype: "r" | "S" | "f" | "T" | "n";
+            objtype: "n" | "r" | "f" | "S" | "T";
             grantee: string;
         }[];
     };
 }
-export declare function extractRoles(sql: Sql): Promise<Role[]>;
+export declare function extractRoles(pool: Pool): Promise<Role[]>;
 export {};