@supabase/pg-delta 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/core/objects/role/role.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 const membershipInfoSchema = z.object({
@@ -12,6 +13,7 @@ const defaultPrivilegeSchema = z.object({
     objtype: z.enum(["r", "S", "f", "T", "n"]),
     grantee: z.string(),
     privileges: z.array(z.object({ privilege: z.string(), grantable: z.boolean() })),
+    is_implicit: z.boolean(),
 });
 const rolePropsSchema = z.object({
     name: z.string(),
@@ -57,7 +59,7 @@ export class Role extends BasePgModel {
         this.can_bypass_rls = props.can_bypass_rls;
         this.config = props.config;
         this.comment = props.comment;
-        this.members = props.members;
+        this.members = deduplicateMembers(props.members);
         this.default_privileges = props.default_privileges;
     }
     get stableId() {
@@ -76,13 +78,16 @@ export class Role extends BasePgModel {
                 Number(a.inherit_option ?? false) - Number(b.inherit_option ?? false) ||
                 Number(a.set_option ?? false) - Number(b.set_option ?? false));
         });
-        const sortedDefaultPrivs = [...this.default_privileges].map((dp) => ({
-            ...dp,
-            privileges: [...dp.privileges].sort((a, b) => {
-                return (a.privilege.localeCompare(b.privilege) ||
-                    Number(a.grantable) - Number(b.grantable));
-            }),
-        }));
+        const sortedDefaultPrivs = [...this.default_privileges].map((dp) => {
+            const { is_implicit: _, ...rest } = dp;
+            return {
+                ...rest,
+                privileges: [...dp.privileges].sort((a, b) => {
+                    return (a.privilege.localeCompare(b.privilege) ||
+                        Number(a.grantable) - Number(b.grantable));
+                }),
+            };
+        });
         sortedDefaultPrivs.sort((a, b) => {
             return ((a.in_schema ?? "").localeCompare(b.in_schema ?? "") ||
                 a.objtype.localeCompare(b.objtype) ||
@@ -104,11 +109,49 @@ export class Role extends BasePgModel {
         };
     }
 }
-export async function extractRoles(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        // Check PostgreSQL version capabilities for membership options
-        const [capabilities] = await sql `
+/**
+ * Deduplicate members by member name.
+ *
+ * In PostgreSQL 16+, `pg_auth_members` can have multiple rows for the same
+ * (roleid, member) pair with different grantors. Merge them into a single
+ * entry per member, combining options with OR so the most permissive wins.
+ *
+ * When merging, prefer a non-self grantor (grantor !== member) so that
+ * downstream code can detect true self-grants (auto-created by CREATE ROLE)
+ * by checking `grantor === member`.
+ */
+function deduplicateMembers(members) {
+    const map = new Map();
+    for (const m of members) {
+        const existing = map.get(m.member);
+        if (existing) {
+            // admin_option is always boolean (non-nullable in schema)
+            existing.admin_option = existing.admin_option || m.admin_option;
+            // inherit_option and set_option are nullish (only available in PG 16+)
+            if (m.inherit_option != null) {
+                existing.inherit_option =
+                    (existing.inherit_option ?? false) || m.inherit_option;
+            }
+            if (m.set_option != null) {
+                existing.set_option = (existing.set_option ?? false) || m.set_option;
+            }
+            // Prefer a non-self grantor so diff can detect true self-grants.
+            // Once a non-self grantor is chosen the value is kept (the specific
+            // non-self grantor doesn't matter — only the self vs non-self
+            // distinction is used downstream).
+            if (existing.grantor === existing.member && m.grantor !== m.member) {
+                existing.grantor = m.grantor;
+            }
+        }
+        else {
+            map.set(m.member, { ...m });
+        }
+    }
+    return [...map.values()];
+}
+export async function extractRoles(pool) {
+    // Check PostgreSQL version capabilities for membership options
+    const { rows: capabilitiesRows } = await pool.query(sql `
       select
         exists (
           select 1
@@ -122,23 +165,25 @@ export async function extractRoles(sql) {
           where attrelid = 'pg_auth_members'::regclass
             and attname = 'set_option'
         ) as has_set
-    `;
-        const roleRows = capabilities?.has_inherit && capabilities?.has_set
-            ? await sql `
+  `);
+    const capabilities = capabilitiesRows[0];
+    let roleRows;
+    if (capabilities?.has_inherit && capabilities?.has_set) {
+        const result = await pool.query(sql `
           WITH role_memberships AS (
-            SELECT 
+            SELECT
               r.rolname AS role_name,
               json_agg(
                 json_build_object(
                   'member',   m.rolname,
                   'grantor',  g.rolname,
                   'admin_option',   am.admin_option,
-                  'inherit_option', am.inherit_option,   -- PG16+
-                  'set_option',     am.set_option        -- PG16+
+                  'inherit_option', am.inherit_option,
+                  'set_option',     am.set_option
                 )
               ) FILTER (WHERE m.rolname IS NOT NULL) AS members
             FROM pg_catalog.pg_roles r
-            LEFT JOIN pg_auth_members am ON am.roleid = r.oid       -- roles that are members of this role
+            LEFT JOIN pg_auth_members am ON am.roleid = r.oid
             LEFT JOIN pg_roles m          ON m.oid = am.member
             LEFT JOIN pg_roles g          ON g.oid = am.grantor
             GROUP BY r.rolname
@@ -171,13 +216,15 @@ export async function extractRoles(sql) {
                                     THEN 'PUBLIC'
                                     ELSE s.grantee::regrole::text
                             END,
-                          'privileges', s.privileges
+                          'privileges', s.privileges,
+                          'is_implicit', s.is_implicit
                         )
                         ORDER BY s.defaclnamespace NULLS FIRST,
                                   s.defaclobjtype,
                                   s.grantee
                       )
                 FROM (
+                  -- Explicit entries from pg_default_acl
                   SELECT
                     d.defaclnamespace,
                     d.defaclobjtype,
@@ -188,12 +235,41 @@ export async function extractRoles(sql) {
                         'grantable',  x.is_grantable
                       )
                       ORDER BY x.privilege_type, x.is_grantable
-                    ) AS privileges
+                    ) AS privileges,
+                    false AS is_implicit
                   FROM pg_default_acl d
                   CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
                     AS x(grantor, grantee, privilege_type, is_grantable)
                   WHERE d.defaclrole = r.oid
                   GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                  UNION ALL
+                  -- Implicit defaults from acldefault() for objtypes without a
+                  -- global pg_default_acl entry.  PostgreSQL applies these implicit
+                  -- defaults (e.g. PUBLIC gets EXECUTE on functions) when no
+                  -- explicit ALTER DEFAULT PRIVILEGES has been issued.  Including
+                  -- them lets the diff detect REVOKEs of implicit grants.
+                  SELECT
+                    0 AS defaclnamespace,
+                    v.t::"char" AS defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges,
+                    true AS is_implicit
+                  FROM (VALUES ('r'), ('S'), ('f'), ('T'), ('n')) AS v(t)
+                  CROSS JOIN LATERAL aclexplode(acldefault(v.t::"char", r.oid))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE NOT EXISTS (
+                    SELECT 1 FROM pg_default_acl d2
+                    WHERE d2.defaclrole     = r.oid
+                      AND d2.defaclobjtype  = v.t::"char"
+                      AND d2.defaclnamespace = 0
+                  )
+                  GROUP BY v.t, x.grantee
                 ) AS s
               ),
               '[]'
@@ -201,9 +277,7 @@ export async function extractRoles(sql) {
           FROM pg_catalog.pg_roles r
           LEFT JOIN role_memberships rm ON rm.role_name = r.rolname
           WHERE
-            -- 1) drop built-in/internal roles (anything starting with pg_)
             r.rolname !~ '^pg_'
-            -- 2) drop roles directly tracked as extension members in pg_shdepend (if any)
             AND NOT EXISTS (
               SELECT 1
               FROM pg_catalog.pg_shdepend d
@@ -212,24 +286,26 @@ export async function extractRoles(sql) {
                 AND d.refclassid  = 'pg_extension'::regclass
                 AND d.deptype     IN ('e','x')
             )
-          ORDER BY 1;
-      `
-            : await sql `
+          ORDER BY 1
+    `);
+        roleRows = result.rows;
+    }
+    else {
+        const result = await pool.query(sql `
           WITH role_memberships AS (
-            SELECT 
+            SELECT
               r.rolname AS role_name,
               json_agg(
                 json_build_object(
                   'member',         m.rolname,
                   'grantor',        g.rolname,
                   'admin_option',   am.admin_option,
-                  -- PG15: these columns don't exist; emit them as nulls
                   'inherit_option', NULL,
                   'set_option',     NULL
                 )
               ) FILTER (WHERE m.rolname IS NOT NULL) AS members
             FROM pg_catalog.pg_roles r
-            LEFT JOIN pg_auth_members am ON am.roleid = r.oid       -- roles that are members of this role
+            LEFT JOIN pg_auth_members am ON am.roleid = r.oid
             LEFT JOIN pg_roles m          ON m.oid = am.member
             LEFT JOIN pg_roles g          ON g.oid = am.grantor
             GROUP BY r.rolname
@@ -262,13 +338,15 @@ export async function extractRoles(sql) {
                                     THEN 'PUBLIC'
                                     ELSE s.grantee::regrole::text
                             END,
-                          'privileges', s.privileges
+                          'privileges', s.privileges,
+                          'is_implicit', s.is_implicit
                         )
                         ORDER BY s.defaclnamespace NULLS FIRST,
                                   s.defaclobjtype,
                                   s.grantee
                       )
                 FROM (
+                  -- Explicit entries from pg_default_acl
                   SELECT
                     d.defaclnamespace,
                     d.defaclobjtype,
@@ -279,12 +357,41 @@ export async function extractRoles(sql) {
                         'grantable',  x.is_grantable
                       )
                       ORDER BY x.privilege_type, x.is_grantable
-                    ) AS privileges
+                    ) AS privileges,
+                    false AS is_implicit
                   FROM pg_default_acl d
                   CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
                     AS x(grantor, grantee, privilege_type, is_grantable)
                   WHERE d.defaclrole = r.oid
                   GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                  UNION ALL
+                  -- Implicit defaults from acldefault() for objtypes without a
+                  -- global pg_default_acl entry.  PostgreSQL applies these implicit
+                  -- defaults (e.g. PUBLIC gets EXECUTE on functions) when no
+                  -- explicit ALTER DEFAULT PRIVILEGES has been issued.  Including
+                  -- them lets the diff detect REVOKEs of implicit grants.
+                  SELECT
+                    0 AS defaclnamespace,
+                    v.t::"char" AS defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges,
+                    true AS is_implicit
+                  FROM (VALUES ('r'), ('S'), ('f'), ('T'), ('n')) AS v(t)
+                  CROSS JOIN LATERAL aclexplode(acldefault(v.t::"char", r.oid))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE NOT EXISTS (
+                    SELECT 1 FROM pg_default_acl d2
+                    WHERE d2.defaclrole     = r.oid
+                      AND d2.defaclobjtype  = v.t::"char"
+                      AND d2.defaclnamespace = 0
+                  )
+                  GROUP BY v.t, x.grantee
                 ) AS s
               ),
               '[]'
@@ -292,9 +399,7 @@ export async function extractRoles(sql) {
           FROM pg_catalog.pg_roles r
           LEFT JOIN role_memberships rm ON rm.role_name = r.rolname
           WHERE
-            -- drop built-in/internal roles
             r.rolname !~ '^pg_'
-            -- drop roles directly tracked as extension members in pg_shdepend (if any)
             AND NOT EXISTS (
               SELECT 1
               FROM pg_catalog.pg_shdepend d
@@ -303,10 +408,11 @@ export async function extractRoles(sql) {
                 AND d.refclassid  = 'pg_extension'::regclass
                 AND d.deptype     IN ('e','x')
             )
-          ORDER BY 1;
-      `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = roleRows.map((row) => rolePropsSchema.parse(row));
-        return validatedRows.map((row) => new Role(row));
-    });
+          ORDER BY 1
+    `);
+        roleRows = result.rows;
+    }
+    // Validate and parse each row using the Zod schema
+    const validatedRows = roleRows.map((row) => rolePropsSchema.parse(row));
+    return validatedRows.map((row) => new Role(row));
 }

package/dist/core/objects/rule/changes/rule.types.d.ts

@@ -2,4 +2,5 @@ import type { ReplaceRule, SetRuleEnabledState } from "./rule.alter.ts";
 import type { CreateCommentOnRule, DropCommentOnRule } from "./rule.comment.ts";
 import type { CreateRule } from "./rule.create.ts";
 import type { DropRule } from "./rule.drop.ts";
+/** Union of all rule-related change variants (`objectType: "rule"`). @category Change Types */
 export type RuleChange = CreateRule | DropRule | ReplaceRule | SetRuleEnabledState | CreateCommentOnRule | DropCommentOnRule;

package/dist/core/objects/rule/rule.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const RuleEnabledStateSchema: z.ZodEnum<{
@@ -13,10 +13,10 @@ declare const rulePropsSchema: z.ZodObject<{
     table_name: z.ZodString;
     relation_kind: z.ZodEnum<{
         r: "r";
-        f: "f";
         v: "v";
         m: "m";
         p: "p";
+        f: "f";
     }>;
     event: z.ZodEnum<{
         DELETE: "DELETE";
@@ -68,5 +68,5 @@ export declare class Rule extends BasePgModel {
     };
     get relationStableId(): string;
 }
-export declare function extractRules(sql: Sql): Promise<Rule[]>;
+export declare function extractRules(pool: Pool): Promise<Rule[]>;
 export {};

package/dist/core/objects/rule/rule.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { stableId } from "../utils.js";
@@ -81,10 +82,8 @@ export class Rule extends BasePgModel {
         }
     }
 }
-export async function extractRules(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const ruleRows = await sql `
+export async function extractRules(pool) {
+    const { rows: ruleRows } = await pool.query(sql `
       WITH extension_rule_oids AS (
         SELECT
           objid
@@ -148,9 +147,8 @@ export async function extractRules(sql) {
         AND e_rel.objid IS NULL
         AND r.rulename <> '_RETURN'
       ORDER BY
-        1, 3, 2;
-    `;
-        const validatedRows = ruleRows.map((row) => rulePropsSchema.parse(row));
-        return validatedRows.map((row) => new Rule(row));
-    });
+        1, 3, 2
+  `);
+    const validatedRows = ruleRows.map((row) => rulePropsSchema.parse(row));
+    return validatedRows.map((row) => new Rule(row));
 }

package/dist/core/objects/schema/changes/schema.types.d.ts

@@ -3,4 +3,5 @@ import type { CommentSchema } from "./schema.comment.ts";
 import type { CreateSchema } from "./schema.create.ts";
 import type { DropSchema } from "./schema.drop.ts";
 import type { SchemaPrivilege } from "./schema.privilege.ts";
+/** Union of all schema-related change variants (`objectType: "schema"`). @category Change Types */
 export type SchemaChange = AlterSchema | CommentSchema | CreateSchema | DropSchema | SchemaPrivilege;

package/dist/core/objects/schema/schema.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { SchemaChange } from "./changes/schema.types.ts";
 import type { Schema } from "./schema.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { Schema } from "./schema.model.ts";
  * @param branch - The schemas in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffSchemas(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Schema>, branch: Record<string, Schema>): SchemaChange[];
+export declare function diffSchemas(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Schema>, branch: Record<string, Schema>): SchemaChange[];

package/dist/core/objects/schema/schema.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, } from "../base.privilege-diff.js";
 import { AlterSchemaChangeOwner } from "./changes/schema.alter.js";
 import { CreateCommentOnSchema, DropCommentOnSchema, } from "./changes/schema.comment.js";
 import { CreateSchema } from "./changes/schema.create.js";
@@ -29,47 +29,18 @@ export function diffSchemas(ctx, main, branch) {
         // needed to reach the final desired state.
         // Note: Schemas don't have a schema property, so we pass empty string
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "schema", "");
+        const creatorFilteredDefaults = sc.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = sc.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the schema owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, sc.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantSchemaPrivileges({
-                        schema: sc,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeSchemaPrivileges({
-                        schema: sc,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionSchemaPrivileges({
-                    schema: sc,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, sc.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, sc, sc, "schema", {
+            Grant: GrantSchemaPrivileges,
+            Revoke: RevokeSchemaPrivileges,
+            RevokeGrantOption: RevokeGrantOptionSchemaPrivileges,
+        }, ctx.version));
     }
     for (const schemaId of dropped) {
         changes.push(new DropSchema({ schema: main[schemaId] }));
@@ -96,44 +67,12 @@ export function diffSchemas(ctx, main, branch) {
         // PRIVILEGES
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainSchema.privileges, branchSchema.privileges, branchSchema.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantSchemaPrivileges({
-                        schema: branchSchema,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeSchemaPrivileges({
-                        schema: mainSchema,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionSchemaPrivileges({
-                    schema: mainSchema,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainSchema.privileges, branchSchema.privileges, branchSchema.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchSchema, mainSchema, "schema", {
+            Grant: GrantSchemaPrivileges,
+            Revoke: RevokeSchemaPrivileges,
+            RevokeGrantOption: RevokeGrantOptionSchemaPrivileges,
+        }, ctx.version));
         // Note: Schema renaming would also use ALTER SCHEMA ... RENAME TO ...
         // But since our Schema model uses 'schema' as the identity field,
         // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/schema/schema.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
@@ -43,5 +43,5 @@ export declare class Schema extends BasePgModel {
         }[];
     };
 }
-export declare function extractSchemas(sql: Sql): Promise<Schema[]>;
+export declare function extractSchemas(pool: Pool): Promise<Schema[]>;
 export {};

package/dist/core/objects/schema/schema.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
@@ -44,10 +45,8 @@ export class Schema extends BasePgModel {
         };
     }
 }
-export async function extractSchemas(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const schemaRows = await sql `
+export async function extractSchemas(pool) {
+    const { rows: schemaRows } = await pool.query(sql `
     with extension_oids as (
       select
         objid
@@ -71,7 +70,7 @@ export async function extractSchemas(sql) {
             )
             order by x.grantee, x.privilege_type
           )
-          from lateral aclexplode(nspacl) as x(grantor, grantee, privilege_type, is_grantable)
+          from lateral aclexplode(COALESCE(nspacl, acldefault('n', nspowner))) as x(grantor, grantee, privilege_type, is_grantable)
         ), '[]'
       ) as privileges
     from
@@ -82,10 +81,9 @@ export async function extractSchemas(sql) {
       and e.objid is null
       -- </EXCLUDE_INTERNAL>
     order by
-      1;
-  `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = schemaRows.map((row) => schemaPropsSchema.parse(row));
-        return validatedRows.map((row) => new Schema(row));
-    });
+      1
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = schemaRows.map((row) => schemaPropsSchema.parse(row));
+    return validatedRows.map((row) => new Schema(row));
 }

package/dist/core/objects/sequence/changes/sequence.types.d.ts

@@ -3,4 +3,5 @@ import type { CommentSequence } from "./sequence.comment.ts";
 import type { CreateSequence } from "./sequence.create.ts";
 import type { DropSequence } from "./sequence.drop.ts";
 import type { SequencePrivilege } from "./sequence.privilege.ts";
+/** Union of all sequence-related change variants (`objectType: "sequence"`). @category Change Types */
 export type SequenceChange = AlterSequence | CommentSequence | CreateSequence | DropSequence | SequencePrivilege;

package/dist/core/objects/sequence/sequence.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { Table } from "../table/table.model.ts";
 import type { SequenceChange } from "./changes/sequence.types.ts";
 import type { Sequence } from "./sequence.model.ts";
@@ -12,9 +11,4 @@ import type { Sequence } from "./sequence.model.ts";
  * @param branchTables - The tables in the branch catalog (used to check if owning tables are being dropped).
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffSequences(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Sequence>, branch: Record<string, Sequence>, branchTables?: Record<string, Table>): SequenceChange[];
+export declare function diffSequences(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Sequence>, branch: Record<string, Sequence>, branchTables?: Record<string, Table>): SequenceChange[];