@supabase/pg-delta 1.0.0-alpha.1 → 1.0.0-alpha.11

package/dist/core/objects/sequence/sequence.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, } from "../base.privilege-diff.js";
 import { hasNonAlterableChanges } from "../utils.js";
 import { AlterSequenceSetOptions, AlterSequenceSetOwnedBy, } from "./changes/sequence.alter.js";
 import { CreateCommentOnSequence, DropCommentOnSequence, } from "./changes/sequence.comment.js";
@@ -43,48 +43,18 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "sequence", createdSeq.schema ?? "");
+        const creatorFilteredDefaults = createdSeq.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = createdSeq.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the sequence owner as the reference.
-        // Superuser privileges are filtered inside diffPrivileges.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdSeq.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantSequencePrivileges({
-                        sequence: createdSeq,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeSequencePrivileges({
-                        sequence: createdSeq,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionSequencePrivileges({
-                    sequence: createdSeq,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, createdSeq.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdSeq, createdSeq, "sequence", {
+            Grant: GrantSequencePrivileges,
+            Revoke: RevokeSequencePrivileges,
+            RevokeGrantOption: RevokeGrantOptionSequencePrivileges,
+        }, ctx.version));
     }
     for (const sequenceId of dropped) {
         const sequence = main[sequenceId];
@@ -210,45 +180,12 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
             // PRIVILEGES
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            // Superuser privileges are filtered inside diffPrivileges.
-            const privilegeResults = diffPrivileges(mainSequence.privileges, branchSequence.privileges, branchSequence.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantSequencePrivileges({
-                            sequence: branchSequence,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeSequencePrivileges({
-                            sequence: mainSequence,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionSequencePrivileges({
-                        sequence: mainSequence,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(mainSequence.privileges, branchSequence.privileges, branchSequence.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchSequence, mainSequence, "sequence", {
+                Grant: GrantSequencePrivileges,
+                Revoke: RevokeSequencePrivileges,
+                RevokeGrantOption: RevokeGrantOptionSequencePrivileges,
+            }, ctx.version));
             // Note: Sequence renaming would also use ALTER SEQUENCE ... RENAME TO ...
             // But since our Sequence model uses 'name' as the identity field,
             // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/sequence/sequence.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
@@ -72,5 +72,5 @@ export declare class Sequence extends BasePgModel {
         owner: string;
     };
 }
-export declare function extractSequences(sql: Sql): Promise<Sequence[]>;
+export declare function extractSequences(pool: Pool): Promise<Sequence[]>;
 export {};

package/dist/core/objects/sequence/sequence.model.js

@@ -1,3 +1,4 @@
+import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
@@ -85,10 +86,8 @@ export class Sequence extends BasePgModel {
         };
     }
 }
-export async function extractSequences(sql) {
-    return sql.begin(async (sql) => {
-        await sql `set search_path = ''`;
-        const sequenceRows = await sql `
+export async function extractSequences(pool) {
+    const { rows: sequenceRows } = await pool.query(sql `
 with extension_sequence_oids as (
   select
     objid
@@ -133,7 +132,7 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(c.relacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(c.relacl, acldefault('S', c.relowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges,
   c.relowner::regrole::text as owner
@@ -160,10 +159,9 @@ from
       and di.deptype = 'i'
   )
 order by
-  1, 2;
-  `;
-        // Validate and parse each row using the Zod schema
-        const validatedRows = sequenceRows.map((row) => sequencePropsSchema.parse(row));
-        return validatedRows.map((row) => new Sequence(row));
-    });
+  1, 2
+  `);
+    // Validate and parse each row using the Zod schema
+    const validatedRows = sequenceRows.map((row) => sequencePropsSchema.parse(row));
+    return validatedRows.map((row) => new Sequence(row));
 }

package/dist/core/objects/subscription/changes/subscription.types.d.ts

@@ -2,4 +2,5 @@ import type { AlterSubscriptionDisable, AlterSubscriptionEnable, AlterSubscripti
 import type { CommentSubscription } from "./subscription.comment.ts";
 import type { CreateSubscription } from "./subscription.create.ts";
 import type { DropSubscription } from "./subscription.drop.ts";
+/** Union of all subscription-related change variants (`objectType: "subscription"`). @category Change Types */
 export type SubscriptionChange = CreateSubscription | DropSubscription | AlterSubscriptionSetConnection | AlterSubscriptionSetPublication | AlterSubscriptionEnable | AlterSubscriptionDisable | AlterSubscriptionSetOptions | AlterSubscriptionSetOwner | CommentSubscription;

package/dist/core/objects/subscription/subscription.diff.d.ts

@@ -1,5 +1,4 @@
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { SubscriptionChange } from "./changes/subscription.types.ts";
 import type { Subscription } from "./subscription.model.ts";
-export declare function diffSubscriptions(ctx: {
-    currentUser: string;
-}, main: Record<string, Subscription>, branch: Record<string, Subscription>): SubscriptionChange[];
+export declare function diffSubscriptions(ctx: Pick<ObjectDiffContext, "currentUser">, main: Record<string, Subscription>, branch: Record<string, Subscription>): SubscriptionChange[];

package/dist/core/objects/subscription/subscription.model.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "postgres";
+import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 declare const subscriptionPropsSchema: z.ZodObject<{
@@ -76,5 +76,5 @@ export declare class Subscription extends BasePgModel {
         origin: "any" | "none";
     };
 }
-export declare function extractSubscriptions(sql: Sql): Promise<Subscription[]>;
+export declare function extractSubscriptions(pool: Pool): Promise<Subscription[]>;
 export {};

package/dist/core/objects/subscription/subscription.model.js

@@ -95,15 +95,22 @@ export class Subscription extends BasePgModel {
         };
     }
 }
-export async function extractSubscriptions(sql) {
-    return sql.begin(async (tx) => {
-        await tx `set search_path = ''`;
-        const version = await extractVersion(tx);
-        const isPostgres16OrGreater = version >= 160000;
-        const isPostgres17OrGreater = version >= 170000;
-        const isPostgres17_2OrGreater = version >= 170002; // failover added in 17.2 (170002)
-        const isPostgres17_3OrGreater = version >= 170003; // origin column added in 17.3
-        const rows = await tx `
+export async function extractSubscriptions(pool) {
+    const version = await extractVersion(pool);
+    const isPostgres16OrGreater = version >= 160000;
+    const isPostgres17OrGreater = version >= 170000;
+    const isPostgres17_2OrGreater = version >= 170002; // failover added in 17.2 (170002)
+    const isPostgres17_3OrGreater = version >= 170003; // origin column added in 17.3
+    // Build the query dynamically based on PostgreSQL version
+    const passwordRequiredExpr = isPostgres16OrGreater
+        ? "s.subpasswordrequired"
+        : "true";
+    const runAsOwnerExpr = isPostgres17OrGreater ? "s.subrunasowner" : "false";
+    const failoverExpr = isPostgres17_2OrGreater ? "s.subfailover" : "false";
+    const originExpr = isPostgres17_3OrGreater
+        ? "case s.suborigin when 'none' then 'none' else 'any' end"
+        : "'any'";
+    const queryText = `
       with extension_oids as (
         select objid
         from pg_depend d
@@ -130,9 +137,9 @@ export async function extractSubscriptions(sql) {
         end as streaming,
         (s.subtwophasestate <> 'd') as two_phase,
         s.subdisableonerr as disable_on_error,
-        ${isPostgres16OrGreater ? tx ` s.subpasswordrequired ` : tx ` true `} as password_required,
-        ${isPostgres17OrGreater ? tx ` s.subrunasowner ` : tx ` false `} as run_as_owner,
-        ${isPostgres17_2OrGreater ? tx ` s.subfailover ` : tx ` false `} as failover,
+        ${passwordRequiredExpr} as password_required,
+        ${runAsOwnerExpr} as run_as_owner,
+        ${failoverExpr} as failover,
         s.subconninfo as conninfo,
         case
           when s.subslotname is null then null
@@ -149,18 +156,16 @@ export async function extractSubscriptions(sql) {
           ),
           '[]'::json
         ) as publications,
-        ${isPostgres17_3OrGreater
-            ? tx ` case s.suborigin when 'none' then 'none' else 'any' end `
-            : tx ` 'any' `} as origin
+        ${originExpr} as origin
       from scoped_subscriptions s
       left join pg_replication_slots r
         on r.slot_name = s.subslotname
        and r.datoid = s.subdbid
       left join extension_oids e on e.objid = s.oid
       where e.objid is null
-      order by s.subname;
-    `;
-        const validated = rows.map((row) => subscriptionPropsSchema.parse(row));
-        return validated.map((row) => new Subscription(row));
-    });
+      order by s.subname
+  `;
+    const { rows } = await pool.query(queryText);
+    const validated = rows.map((row) => subscriptionPropsSchema.parse(row));
+    return validated.map((row) => new Subscription(row));
 }

package/dist/core/objects/table/changes/table.create.js

@@ -64,6 +64,9 @@ export class CreateTable extends CreateTableChange {
                     }
                 }
             }
+            // Function dependencies from DEFAULT expressions are handled by pg_depend
+            // catalog constraints in the sort pipeline, which provides exact argument
+            // types and covers all expression contexts (not just column defaults).
         }
         return Array.from(dependencies);
     }

package/dist/core/objects/table/changes/table.types.d.ts

@@ -3,4 +3,5 @@ import type { CommentTable } from "./table.comment.ts";
 import type { CreateTable } from "./table.create.ts";
 import type { DropTable } from "./table.drop.ts";
 import type { TablePrivilege } from "./table.privilege.ts";
+/** Union of all table-related change variants (`objectType: "table"`). @category Change Types */
 export type TableChange = AlterTable | CommentTable | CreateTable | DropTable | TablePrivilege;

package/dist/core/objects/table/table.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { TableChange } from "./changes/table.types.ts";
 import { Table } from "./table.model.ts";
 /**
@@ -10,9 +9,4 @@ import { Table } from "./table.model.ts";
  * @param branch - The tables in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffTables(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Table>, branch: Record<string, Table>): TableChange[];
+export declare function diffTables(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Table>, branch: Record<string, Table>): TableChange[];

package/dist/core/objects/table/table.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByColumns, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitColumnPrivilegeChanges, } from "../base.privilege-diff.js";
 import { deepEqual } from "../utils.js";
 import { AlterTableAddColumn, AlterTableAddConstraint, AlterTableAlterColumnDropDefault, AlterTableAlterColumnDropNotNull, AlterTableAlterColumnSetDefault, AlterTableAlterColumnSetNotNull, AlterTableAlterColumnType, AlterTableAttachPartition, AlterTableChangeOwner, AlterTableDetachPartition, AlterTableDisableRowLevelSecurity, AlterTableDropColumn, AlterTableDropConstraint, AlterTableEnableRowLevelSecurity, AlterTableForceRowLevelSecurity, AlterTableNoForceRowLevelSecurity, AlterTableResetStorageParams, AlterTableSetLogged, AlterTableSetReplicaIdentity, AlterTableSetStorageParams, AlterTableSetUnlogged, AlterTableValidateConstraint, } from "./changes/table.alter.js";
 import { CreateCommentOnColumn, CreateCommentOnConstraint, CreateCommentOnTable, DropCommentOnColumn, DropCommentOnConstraint, DropCommentOnTable, } from "./changes/table.comment.js";
@@ -149,6 +149,16 @@ export function diffTables(ctx, main, branch) {
         if (branchTable.force_row_security) {
             changes.push(new AlterTableForceRowLevelSecurity({ table: branchTable }));
         }
+        // REPLICA IDENTITY: If non-default, emit ALTER TABLE ... REPLICA IDENTITY
+        if (branchTable.replica_identity !== "d") {
+            // Skip 'i' (USING INDEX) — handled by index changes
+            if (branchTable.replica_identity !== "i") {
+                changes.push(new AlterTableSetReplicaIdentity({
+                    table: branchTable,
+                    mode: branchTable.replica_identity,
+                }));
+            }
+        }
         changes.push(...createAlterConstraintChange(
         // Create a dummy table with no constraints do diff constraints against
         new Table({
@@ -171,86 +181,18 @@ export function diffTables(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "table", branchTable.schema ?? "");
+        const creatorFilteredDefaults = branchTable.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = branchTable.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the table owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, branchTable.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByColumns(result.grants);
-                for (const [, group] of grantGroups) {
-                    for (const [grantable, privSet] of group.byGrant) {
-                        const privileges = Array.from(privSet).map((priv) => ({
-                            privilege: priv,
-                            grantable,
-                        }));
-                        changes.push(new GrantTablePrivileges({
-                            table: branchTable,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                for (const [, group] of revokeGroups) {
-                    const allPrivileges = new Set();
-                    for (const [, privSet] of group.byGrant) {
-                        for (const priv of privSet) {
-                            allPrivileges.add(priv);
-                        }
-                    }
-                    const privileges = Array.from(allPrivileges).map((priv) => ({
-                        privilege: priv,
-                        grantable: false,
-                    }));
-                    changes.push(new RevokeTablePrivileges({
-                        table: branchTable,
-                        grantee,
-                        privileges,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                const revokeGrantGroups = new Map();
-                for (const r of result.revokeGrantOption) {
-                    const originalPriv = effectiveDefaults.find((p) => p.grantee === grantee && p.privilege === r);
-                    const key = originalPriv?.columns
-                        ? originalPriv.columns.sort().join(",")
-                        : "";
-                    if (!revokeGrantGroups.has(key)) {
-                        revokeGrantGroups.set(key, {
-                            columns: originalPriv?.columns
-                                ? [...originalPriv.columns]
-                                : undefined,
-                            privileges: new Set(),
-                        });
-                    }
-                    const group = revokeGrantGroups.get(key);
-                    if (!group)
-                        continue;
-                    group.privileges.add(r);
-                }
-                for (const [, group] of revokeGrantGroups) {
-                    const privilegeNames = Array.from(group.privileges);
-                    changes.push(new RevokeGrantOptionTablePrivileges({
-                        table: branchTable,
-                        grantee,
-                        privilegeNames,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, branchTable.owner);
+        changes.push(...emitColumnPrivilegeChanges(privilegeResults, branchTable, branchTable, "table", {
+            Grant: GrantTablePrivileges,
+            Revoke: RevokeTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionTablePrivileges,
+        }, effectiveDefaults, ctx.version));
     }
     for (const tableId of dropped) {
         changes.push(new DropTable({ table: main[tableId] }));
@@ -584,85 +526,12 @@ export function diffTables(ctx, main, branch) {
         // PRIVILEGES (unified object and column privileges)
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainTable.privileges, branchTable.privileges, branchTable.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByColumns(result.grants);
-                for (const [, group] of grantGroups) {
-                    for (const [grantable, privSet] of group.byGrant) {
-                        const privileges = Array.from(privSet).map((priv) => ({
-                            privilege: priv,
-                            grantable,
-                        }));
-                        changes.push(new GrantTablePrivileges({
-                            table: branchTable,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                for (const [, group] of revokeGroups) {
-                    // Collapse all grantable groups into a single revoke (grantable: false)
-                    const allPrivileges = new Set();
-                    for (const [, privSet] of group.byGrant) {
-                        for (const priv of privSet) {
-                            allPrivileges.add(priv);
-                        }
-                    }
-                    const privileges = Array.from(allPrivileges).map((priv) => ({
-                        privilege: priv,
-                        grantable: false,
-                    }));
-                    changes.push(new RevokeTablePrivileges({
-                        table: mainTable,
-                        grantee,
-                        privileges,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                const revokeGrantGroups = new Map();
-                for (const r of result.revokeGrantOption) {
-                    // For revoke grant option, we need to find the columns from the original privilege
-                    const originalPriv = mainTable.privileges.find((p) => p.grantee === grantee && p.privilege === r);
-                    const key = originalPriv?.columns
-                        ? originalPriv.columns.sort().join(",")
-                        : "";
-                    if (!revokeGrantGroups.has(key)) {
-                        revokeGrantGroups.set(key, {
-                            columns: originalPriv?.columns
-                                ? [...originalPriv.columns]
-                                : undefined,
-                            privileges: new Set(),
-                        });
-                    }
-                    const group = revokeGrantGroups.get(key);
-                    if (!group)
-                        continue;
-                    group.privileges.add(r);
-                }
-                for (const [, group] of revokeGrantGroups) {
-                    const privilegeNames = Array.from(group.privileges);
-                    changes.push(new RevokeGrantOptionTablePrivileges({
-                        table: mainTable,
-                        grantee,
-                        privilegeNames,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-        }
+        const privilegeResults = diffPrivileges(mainTable.privileges, branchTable.privileges, branchTable.owner);
+        changes.push(...emitColumnPrivilegeChanges(privilegeResults, branchTable, mainTable, "table", {
+            Grant: GrantTablePrivileges,
+            Revoke: RevokeTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionTablePrivileges,
+        }, mainTable.privileges, ctx.version));
     }
     return changes;
 }