@supabase/pg-delta 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/cli/utils/export-display.d.ts

@@ -0,0 +1,43 @@
+/**
+ * CLI helpers for declarative export: file tree, diff, and summary formatting.
+ */
+import type { FileEntry } from "../../core/export/types.ts";
+/**
+ * Ensure a relative file path does not escape the output directory.
+ * Uses Node.js path.resolve + startsWith as the canonical traversal check.
+ */
+export declare function assertSafePath(filePath: string, outputDir: string): void;
+interface FileDiffResult {
+    created: string[];
+    updated: string[];
+    deleted: string[];
+    unchanged: string[];
+}
+interface BuildFileTreeOptions {
+    /** When provided, leaf paths are prefixed with + / ~ / - and colorized (created / updated / deleted). */
+    diff?: FileDiffResult;
+    /** When true, only paths that are created, updated, or deleted are shown; unchanged are omitted. Includes diff.deleted in the tree. */
+    diffFocus?: boolean;
+}
+/**
+ * Build a directory tree string from file paths.
+ * Groups by directory, shows files as leaves with indentation.
+ * When options.diff is provided, leaf names are prefixed with + (created), ~ (updated), - (deleted) and colorized.
+ * When options.diffFocus is true, only changed paths (and their ancestors) are shown; unchanged files are omitted.
+ *
+ * @param files - Array of relative file paths (e.g. ["schemas/public/schema.sql", "schemas/public/tables/users.sql"])
+ * @param outputDir - Display name for the root (e.g. "declarative-schemas")
+ * @param options - Optional diff and diffFocus for symbols and filtering
+ */
+export declare function buildFileTree(files: string[], outputDir: string, options?: BuildFileTreeOptions): string;
+/**
+ * Compare existing output directory with new file set.
+ * Returns created, updated, deleted, and unchanged paths.
+ */
+export declare function computeFileDiff(outputDir: string, newFiles: FileEntry[]): Promise<FileDiffResult>;
+/**
+ * Format the created/deleted/updated summary with colors.
+ * In dry-run mode, uses "would create/delete/update" phrasing.
+ */
+export declare function formatExportSummary(diff: FileDiffResult, dryRun: boolean): string;
+export {};

package/dist/cli/utils/export-display.js

@@ -0,0 +1,202 @@
+/**
+ * CLI helpers for declarative export: file tree, diff, and summary formatting.
+ */
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import chalk from "chalk";
+// ============================================================================
+// Path safety
+// ============================================================================
+/**
+ * Ensure a relative file path does not escape the output directory.
+ * Uses Node.js path.resolve + startsWith as the canonical traversal check.
+ */
+export function assertSafePath(filePath, outputDir) {
+    const resolvedOutput = path.resolve(outputDir);
+    const resolvedFile = path.resolve(outputDir, filePath);
+    if (resolvedFile !== resolvedOutput &&
+        !resolvedFile.startsWith(resolvedOutput + path.sep)) {
+        throw new Error(`Export path traversal detected: '${filePath}' resolves outside output directory`);
+    }
+}
+function getFileStatus(path, diff) {
+    if (diff.created.includes(path))
+        return "created";
+    if (diff.updated.includes(path))
+        return "updated";
+    if (diff.deleted.includes(path))
+        return "deleted";
+    return "unchanged";
+}
+function formatLeafSegment(segment, status) {
+    switch (status) {
+        case "created":
+            return chalk.green(`+ ${segment}`);
+        case "updated":
+            return chalk.yellow(`~ ${segment}`);
+        case "deleted":
+            return chalk.red(`- ${segment}`);
+        default:
+            return chalk.dim(segment);
+    }
+}
+/**
+ * Build a directory tree string from file paths.
+ * Groups by directory, shows files as leaves with indentation.
+ * When options.diff is provided, leaf names are prefixed with + (created), ~ (updated), - (deleted) and colorized.
+ * When options.diffFocus is true, only changed paths (and their ancestors) are shown; unchanged files are omitted.
+ *
+ * @param files - Array of relative file paths (e.g. ["schemas/public/schema.sql", "schemas/public/tables/users.sql"])
+ * @param outputDir - Display name for the root (e.g. "declarative-schemas")
+ * @param options - Optional diff and diffFocus for symbols and filtering
+ */
+export function buildFileTree(files, outputDir, options) {
+    const { diff, diffFocus } = options ?? {};
+    let pathsToShow = files;
+    if (diffFocus && diff) {
+        const changed = new Set([
+            ...diff.created,
+            ...diff.updated,
+            ...diff.deleted,
+        ]);
+        pathsToShow = [...changed];
+        if (pathsToShow.length === 0) {
+            return chalk.dim("(no file changes)");
+        }
+    }
+    const tree = new Map();
+    for (const filePath of pathsToShow) {
+        const segments = filePath.split("/");
+        let parent = "";
+        for (let i = 0; i < segments.length; i++) {
+            const segment = segments[i];
+            const fullPath = parent ? `${parent}/${segment}` : segment;
+            let children = tree.get(parent);
+            if (!children) {
+                children = new Set();
+                tree.set(parent, children);
+            }
+            children.add(fullPath);
+            parent = fullPath;
+        }
+    }
+    const lines = [];
+    function emit(relPath, indent, isLast) {
+        const segment = relPath ? path.basename(relPath) : outputDir;
+        const prefix = indent === 0 ? "" : "  ".repeat(indent) + (isLast ? "└── " : "├── ");
+        const isLeaf = !tree.has(relPath);
+        const displaySegment = diff && isLeaf
+            ? formatLeafSegment(segment, getFileStatus(relPath, diff))
+            : segment;
+        lines.push(prefix + displaySegment);
+        const children = tree.get(relPath);
+        if (children) {
+            const sorted = [...children].sort((a, b) => path.basename(a).localeCompare(path.basename(b)));
+            for (let i = 0; i < sorted.length; i++) {
+                emit(sorted[i], indent + 1, i === sorted.length - 1);
+            }
+        }
+    }
+    emit("", 0, false);
+    return lines.join("\n");
+}
+// ============================================================================
+// File diff
+// ============================================================================
+/**
+ * Recursively collect relative paths of managed (.sql) files under a directory.
+ * Non-SQL files (README, .gitkeep, etc.) are intentionally excluded so they
+ * are never flagged as "deleted" during diff.
+ */
+async function collectExistingFiles(dir, base = "") {
+    const entries = await readdir(path.join(dir, base), { withFileTypes: true });
+    const files = [];
+    for (const e of entries) {
+        const rel = base ? `${base}/${e.name}` : e.name;
+        if (e.isFile() && e.name.endsWith(".sql")) {
+            files.push(rel);
+        }
+        else if (e.isDirectory()) {
+            files.push(...(await collectExistingFiles(dir, rel)));
+        }
+    }
+    return files;
+}
+/**
+ * Compare existing output directory with new file set.
+ * Returns created, updated, deleted, and unchanged paths.
+ */
+export async function computeFileDiff(outputDir, newFiles) {
+    const newPaths = new Set(newFiles.map((f) => f.path));
+    const newByPath = new Map(newFiles.map((f) => [f.path, f]));
+    let existingPaths = [];
+    try {
+        existingPaths = await collectExistingFiles(outputDir);
+    }
+    catch {
+        // Directory doesn't exist or not readable
+        return {
+            created: [...newPaths],
+            updated: [],
+            deleted: [],
+            unchanged: [],
+        };
+    }
+    const existingSet = new Set(existingPaths);
+    const created = [];
+    const updated = [];
+    const deleted = [];
+    const unchanged = [];
+    for (const p of newPaths) {
+        if (!existingSet.has(p)) {
+            created.push(p);
+        }
+        else {
+            const entry = newByPath.get(p);
+            if (!entry)
+                continue;
+            try {
+                const existingContent = await readFile(path.join(outputDir, p), "utf-8");
+                if (existingContent.trim() !== entry.sql.trim()) {
+                    updated.push(p);
+                }
+                else {
+                    unchanged.push(p);
+                }
+            }
+            catch {
+                updated.push(p);
+            }
+        }
+    }
+    for (const p of existingPaths) {
+        if (!newPaths.has(p)) {
+            deleted.push(p);
+        }
+    }
+    return { created, updated, deleted, unchanged };
+}
+// ============================================================================
+// Summary formatting
+// ============================================================================
+/**
+ * Format the created/deleted/updated summary with colors.
+ * In dry-run mode, uses "would create/delete/update" phrasing.
+ */
+export function formatExportSummary(diff, dryRun) {
+    const lines = [];
+    const verb = dryRun ? "Would" : "";
+    if (diff.created.length > 0) {
+        lines.push(chalk.green(`${verb ? `${verb} create` : "Created"}: ${diff.created.length} file(s)`));
+    }
+    if (diff.updated.length > 0) {
+        lines.push(chalk.yellow(`${verb ? `${verb} update` : "Updated"}: ${diff.updated.length} file(s)`));
+    }
+    if (diff.deleted.length > 0) {
+        lines.push(chalk.red(`${verb ? `${verb} delete` : "Deleted"}: ${diff.deleted.length} file(s)`));
+    }
+    if (diff.unchanged.length > 0 && !dryRun) {
+        lines.push(chalk.dim(`Unchanged: ${diff.unchanged.length} file(s)`));
+    }
+    return lines.length > 0 ? lines.join("\n") : "";
+}

package/dist/cli/utils/integrations.d.ts

@@ -1,14 +1,38 @@
 /**
  * Utilities for loading integrations from files.
  */
+import type { CatalogSnapshot } from "../../core/catalog.snapshot.ts";
+import type { FilterDSL } from "../../core/integrations/filter/dsl.ts";
 import type { IntegrationDSL } from "../../core/integrations/integration-dsl.ts";
+import type { SerializeDSL } from "../../core/integrations/serialize/dsl.ts";
 /**
- * Load an integration DSL from a file or core integration.
- * If the path ends with .json, treats it as a JSON file path directly.
- * Otherwise, tries to load from core integrations (TypeScript) first,
- * then falls back to treating as a JSON file path.
+ * Load an integration DSL, recursively resolving `extends` chains.
  *
- * @param nameOrPath - Integration name (e.g., "supabase") or file path (e.g., "./my-integration.json")
- * @returns The loaded IntegrationDSL
+ * When an integration has `extends`, the referenced integration(s) are loaded
+ * and merged: filters are AND-combined, serialize rules concatenated (base first),
+ * and emptyCatalog uses the most-specific value.
+ *
+ * Circular extends are detected and rejected with a descriptive error.
+ *
+ * @param nameOrPath - Integration name (e.g., "supabase") or file path
+ * @returns The fully resolved IntegrationDSL
  */
 export declare function loadIntegrationDSL(nameOrPath: string): Promise<IntegrationDSL>;
+interface ResolvedIntegrationOptions {
+    filter?: FilterDSL;
+    serialize?: SerializeDSL;
+    emptyCatalog?: CatalogSnapshot;
+}
+/**
+ * Load an integration (if provided) and merge its filter/serialize with CLI flags.
+ *
+ * - Filters are AND-combined (integration ∧ CLI flag)
+ * - Serialize rules are concatenated (integration first = higher priority)
+ * - emptyCatalog is extracted from the integration
+ */
+export declare function resolveIntegrationOptions(options: {
+    filter?: FilterDSL;
+    serialize?: SerializeDSL;
+    integration?: string;
+}): Promise<ResolvedIntegrationOptions>;
+export {};

package/dist/cli/utils/integrations.js

@@ -10,16 +10,14 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { readFile } from "node:fs/promises";
+import { mergeIntegrations } from "../../core/integrations/merge.js";
 /**
- * Load an integration DSL from a file or core integration.
- * If the path ends with .json, treats it as a JSON file path directly.
- * Otherwise, tries to load from core integrations (TypeScript) first,
- * then falls back to treating as a JSON file path.
+ * Load a raw integration DSL from a file or core integration (without resolving extends).
  *
  * @param nameOrPath - Integration name (e.g., "supabase") or file path (e.g., "./my-integration.json")
- * @returns The loaded IntegrationDSL
+ * @returns The loaded IntegrationDSL (unresolved)
  */
-export async function loadIntegrationDSL(nameOrPath) {
+async function loadRawIntegrationDSL(nameOrPath) {
     // If path ends with .json, treat it as a JSON file path directly
     if (nameOrPath.endsWith(".json")) {
         const content = await readFile(nameOrPath, "utf-8");
@@ -42,3 +40,97 @@ export async function loadIntegrationDSL(nameOrPath) {
     const content = await readFile(nameOrPath, "utf-8");
     return JSON.parse(content);
 }
+/**
+ * Load a core integration DSL by name only (no file path fallback).
+ *
+ * Used for resolving `extends` chains, which only support core integration names
+ * (e.g., "supabase"), not file paths.
+ *
+ * @param name - Core integration name (e.g., "supabase")
+ * @returns The loaded IntegrationDSL (unresolved)
+ */
+async function loadCoreIntegrationDSL(name) {
+    try {
+        const module = await import(__rewriteRelativeImportExtension(`../../core/integrations/${name}.ts`));
+        if (name in module) {
+            return module[name];
+        }
+    }
+    catch {
+        // Module not found
+    }
+    throw new Error(`Unknown core integration: "${name}". extends only supports core integration names (e.g., "supabase").`);
+}
+/**
+ * Load an integration DSL, recursively resolving `extends` chains.
+ *
+ * When an integration has `extends`, the referenced integration(s) are loaded
+ * and merged: filters are AND-combined, serialize rules concatenated (base first),
+ * and emptyCatalog uses the most-specific value.
+ *
+ * Circular extends are detected and rejected with a descriptive error.
+ *
+ * @param nameOrPath - Integration name (e.g., "supabase") or file path
+ * @returns The fully resolved IntegrationDSL
+ */
+export async function loadIntegrationDSL(nameOrPath) {
+    return resolveIntegration(nameOrPath, new Set());
+}
+async function resolveIntegration(nameOrPath, visited, preloadedRaw) {
+    if (visited.has(nameOrPath)) {
+        throw new Error(`Circular extends detected: ${[...visited, nameOrPath].join(" → ")}`);
+    }
+    visited.add(nameOrPath);
+    const raw = preloadedRaw ?? (await loadRawIntegrationDSL(nameOrPath));
+    if (!raw.extends) {
+        return raw;
+    }
+    // Resolve base integrations (extends only supports core integration names)
+    const extendsArray = Array.isArray(raw.extends) ? raw.extends : [raw.extends];
+    const baseIntegrations = [];
+    for (const baseName of extendsArray) {
+        const baseRaw = await loadCoreIntegrationDSL(baseName);
+        baseIntegrations.push(await resolveIntegration(baseName, new Set(visited), baseRaw));
+    }
+    // Remove extends from the current integration before merging
+    const { extends: _, ...current } = raw;
+    // Merge: bases first (higher priority serialize), then current (most-specific)
+    return mergeIntegrations([...baseIntegrations, current]);
+}
+/**
+ * Load an integration (if provided) and merge its filter/serialize with CLI flags.
+ *
+ * - Filters are AND-combined (integration ∧ CLI flag)
+ * - Serialize rules are concatenated (integration first = higher priority)
+ * - emptyCatalog is extracted from the integration
+ */
+export async function resolveIntegrationOptions(options) {
+    if (!options.integration) {
+        return {
+            filter: options.filter,
+            serialize: options.serialize,
+        };
+    }
+    const integrationDSL = await loadIntegrationDSL(options.integration);
+    // AND-combine integration filter with CLI --filter
+    let filter;
+    if (integrationDSL.filter && options.filter) {
+        filter = { and: [integrationDSL.filter, options.filter] };
+    }
+    else {
+        filter = options.filter ?? integrationDSL.filter;
+    }
+    // Concatenate serialize rules (integration first = higher priority)
+    let serialize;
+    if (integrationDSL.serialize && options.serialize) {
+        serialize = [...integrationDSL.serialize, ...options.serialize];
+    }
+    else {
+        serialize = options.serialize ?? integrationDSL.serialize;
+    }
+    return {
+        filter,
+        serialize,
+        emptyCatalog: integrationDSL.emptyCatalog,
+    };
+}

package/dist/cli/utils/resolve-input.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Shared utilities for resolving CLI --source/--target inputs that
+ * can be either a PostgreSQL connection URL or a catalog snapshot file path.
+ */
+import type { Catalog } from "../../core/catalog.model.ts";
+export declare function isPostgresUrl(input: string): boolean;
+export declare function loadCatalogFromFile(path: string): Promise<Catalog>;

package/dist/cli/utils/resolve-input.js

@@ -0,0 +1,13 @@
+/**
+ * Shared utilities for resolving CLI --source/--target inputs that
+ * can be either a PostgreSQL connection URL or a catalog snapshot file path.
+ */
+import { readFile } from "node:fs/promises";
+import { deserializeCatalog } from "../../core/catalog.snapshot.js";
+export function isPostgresUrl(input) {
+    return input.startsWith("postgres://") || input.startsWith("postgresql://");
+}
+export async function loadCatalogFromFile(path) {
+    const json = await readFile(path, "utf-8");
+    return deserializeCatalog(JSON.parse(json));
+}

package/dist/cli/utils.d.ts

@@ -5,6 +5,7 @@ import type { CommandContext } from "@stricli/core";
 import type { Change } from "../core/change.types.ts";
 import type { DiffContext } from "../core/context.ts";
 import { type Plan } from "../core/plan/index.ts";
+import type { SqlFormatOptions } from "../core/plan/sql-format.ts";
 type ApplyPlanResult = {
     status: "invalid_plan";
     message: string;
@@ -31,6 +32,7 @@ type PlanResult = {
 interface FormatPlanOptions {
     disableColors?: boolean;
     showUnsafeFlagSuggestion?: boolean;
+    sqlFormatOptions?: SqlFormatOptions;
 }
 /**
  * Formats a plan result for display in various formats.

package/dist/cli/utils.js

@@ -19,7 +19,7 @@ export function formatPlanForDisplay(planResult, format, options = {}) {
         case "sql": {
             const content = [
                 `-- Risk: ${risk.level === "data_loss" ? `data-loss (${risk.statements.length})` : "safe"}`,
-                formatSqlScript(plan.statements),
+                formatSqlScript(plan.statements, options.sqlFormatOptions),
             ].join("\n");
             return { content, label: "Migration script" };
         }

package/dist/core/catalog-export/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Catalog export – programmatic API for extracting a database catalog
+ * and serializing it to a JSON snapshot.
+ *
+ * Use this subpath when you only need catalog export (e.g. Supabase CLI
+ * edge-runtime templates) without pulling in the full pg-delta API.
+ */
+export { Catalog, createEmptyCatalog, extractCatalog, } from "../catalog.model.ts";
+export type { CatalogSnapshot } from "../catalog.snapshot.ts";
+export { deserializeCatalog, serializeCatalog, stringifyCatalogSnapshot, } from "../catalog.snapshot.ts";
+export { createManagedPool } from "../postgres-config.ts";

package/dist/core/catalog-export/index.js

@@ -0,0 +1,10 @@
+/**
+ * Catalog export – programmatic API for extracting a database catalog
+ * and serializing it to a JSON snapshot.
+ *
+ * Use this subpath when you only need catalog export (e.g. Supabase CLI
+ * edge-runtime templates) without pulling in the full pg-delta API.
+ */
+export { Catalog, createEmptyCatalog, extractCatalog, } from "../catalog.model.js";
+export { deserializeCatalog, serializeCatalog, stringifyCatalogSnapshot, } from "../catalog.snapshot.js";
+export { createManagedPool } from "../postgres-config.js";

package/dist/core/catalog.diff.d.ts

@@ -2,4 +2,5 @@ import type { Catalog } from "./catalog.model.ts";
 import type { Change } from "./change.types.ts";
 export declare function diffCatalogs(main: Catalog, branch: Catalog, options?: {
     role?: string;
+    skipDefaultPrivilegeSubtraction?: boolean;
 }): Change[];

package/dist/core/catalog.diff.js

@@ -1,5 +1,6 @@
 import debug from "debug";
 import { expandReplaceDependencies } from "./expand-replace-dependencies.js";
+import { normalizePostDiffCycles } from "./post-diff-cycle-breaking.js";
 const debugCatalog = debug("pg-delta:catalog");
 import { diffAggregates } from "./objects/aggregate/aggregate.diff.js";
 import { DefaultPrivilegeState } from "./objects/base.default-privileges.js";
@@ -29,6 +30,48 @@ import { diffEnums } from "./objects/type/enum/enum.diff.js";
 import { diffRanges } from "./objects/type/range/range.diff.js";
 import { stringifyWithBigInt } from "./objects/utils.js";
 import { diffViews } from "./objects/view/view.diff.js";
+/**
+ * Get the stableId of the target object for a privilege change.
+ * Used to filter out redundant REVOKE statements for dropped objects.
+ */
+function getPrivilegeTargetStableId(change) {
+    switch (change.objectType) {
+        case "composite_type":
+            return change.compositeType.stableId;
+        case "domain":
+            return change.domain.stableId;
+        case "enum":
+            return change.enum.stableId;
+        case "language":
+            return change.language.stableId;
+        case "materialized_view":
+            return change.materializedView.stableId;
+        case "aggregate":
+            return change.aggregate.stableId;
+        case "procedure":
+            return change.procedure.stableId;
+        case "range":
+            return change.range.stableId;
+        case "schema":
+            return change.schema.stableId;
+        case "sequence":
+            return change.sequence.stableId;
+        case "table":
+            return change.table.stableId;
+        case "view":
+            return change.view.stableId;
+        case "foreign_data_wrapper":
+            return change.foreignDataWrapper.stableId;
+        case "server":
+            return change.server.stableId;
+        case "foreign_table":
+            return change.foreignTable.stableId;
+        default: {
+            const _exhaustive = change;
+            return _exhaustive;
+        }
+    }
+}
 export function diffCatalogs(main, branch, options) {
     const changes = [];
     // Step 1: Diff roles first to get default privilege changes
@@ -38,13 +81,22 @@ export function diffCatalogs(main, branch, options) {
     // This represents what defaults will be in effect after all ALTER DEFAULT PRIVILEGES
     // Since ALTER DEFAULT PRIVILEGES runs before CREATE (via constraint spec),
     // all created objects will use these final defaults.
-    const defaultPrivilegeState = new DefaultPrivilegeState(main.roles);
-    for (const change of roleChanges) {
-        if (change instanceof GrantRoleDefaultPrivileges) {
-            defaultPrivilegeState.applyGrant(change.role.name, change.objtype, change.inSchema, change.grantee, change.privileges);
-        }
-        else if (change instanceof RevokeRoleDefaultPrivileges) {
-            defaultPrivilegeState.applyRevoke(change.role.name, change.objtype, change.inSchema, change.grantee, change.privileges);
+    //
+    // When skipDefaultPrivilegeSubtraction is true, we use an empty state so that
+    // getEffectiveDefaults always returns [] -- no privileges are subtracted and
+    // every GRANT is emitted explicitly.  This is needed for declarative export
+    // where the output must be self-contained regardless of statement execution order.
+    const defaultPrivilegeState = options?.skipDefaultPrivilegeSubtraction
+        ? new DefaultPrivilegeState({})
+        : new DefaultPrivilegeState(main.roles);
+    if (!options?.skipDefaultPrivilegeSubtraction) {
+        for (const change of roleChanges) {
+            if (change instanceof GrantRoleDefaultPrivileges) {
+                defaultPrivilegeState.applyGrant(change.role.name, change.objtype, change.inSchema, change.grantee, change.privileges);
+            }
+            else if (change instanceof RevokeRoleDefaultPrivileges) {
+                defaultPrivilegeState.applyRevoke(change.role.name, change.objtype, change.inSchema, change.grantee, change.privileges);
+            }
         }
     }
     // Step 3: Create context with default privileges state for object diffing
@@ -58,25 +110,26 @@ export function diffCatalogs(main, branch, options) {
         currentUser: effectiveUser,
         defaultPrivilegeState,
         mainRoles: main.roles,
+        skipDefaultPrivilegeSubtraction: options?.skipDefaultPrivilegeSubtraction,
     };
     // Step 4: Diff all other objects with default privileges context
     changes.push(...diffAggregates(diffContext, main.aggregates, branch.aggregates));
-    changes.push(...diffCollations({ currentUser: effectiveUser }, main.collations, branch.collations));
+    changes.push(...diffCollations(diffContext, main.collations, branch.collations));
     changes.push(...diffCompositeTypes(diffContext, main.compositeTypes, branch.compositeTypes));
     changes.push(...diffDomains(diffContext, main.domains, branch.domains));
     changes.push(...diffEnums(diffContext, main.enums, branch.enums));
     changes.push(...diffExtensions(main.extensions, branch.extensions));
     changes.push(...diffIndexes(main.indexes, branch.indexes, branch.indexableObjects));
     changes.push(...diffMaterializedViews(diffContext, main.materializedViews, branch.materializedViews));
-    changes.push(...diffSubscriptions({ currentUser: effectiveUser }, main.subscriptions, branch.subscriptions));
-    changes.push(...diffPublications({ currentUser: effectiveUser }, main.publications, branch.publications));
+    changes.push(...diffSubscriptions(diffContext, main.subscriptions, branch.subscriptions));
+    changes.push(...diffPublications(diffContext, main.publications, branch.publications));
     changes.push(...diffProcedures(diffContext, main.procedures, branch.procedures));
     changes.push(...diffRlsPolicies(main.rlsPolicies, branch.rlsPolicies));
     changes.push(...diffSchemas(diffContext, main.schemas, branch.schemas));
     changes.push(...diffSequences(diffContext, main.sequences, branch.sequences, branch.tables));
     changes.push(...diffTables(diffContext, main.tables, branch.tables));
     changes.push(...diffTriggers(main.triggers, branch.triggers, branch.indexableObjects));
-    changes.push(...diffEventTriggers({ currentUser: effectiveUser }, main.eventTriggers, branch.eventTriggers));
+    changes.push(...diffEventTriggers(diffContext, main.eventTriggers, branch.eventTriggers));
     changes.push(...diffRules(main.rules, branch.rules));
     changes.push(...diffRanges(diffContext, main.ranges, branch.ranges));
     changes.push(...diffViews(diffContext, main.views, branch.views));
@@ -97,51 +150,19 @@ export function diffCatalogs(main, branch, options) {
     }
     let filteredChanges = changes.filter((change) => {
         if (change.operation === "alter" && change.scope === "privilege") {
-            switch (change.objectType) {
-                case "composite_type":
-                    return !droppedObjectStableIds.has(change.compositeType.stableId);
-                case "domain":
-                    return !droppedObjectStableIds.has(change.domain.stableId);
-                case "enum":
-                    return !droppedObjectStableIds.has(change.enum.stableId);
-                case "language":
-                    return !droppedObjectStableIds.has(change.language.stableId);
-                case "materialized_view":
-                    return !droppedObjectStableIds.has(change.materializedView.stableId);
-                case "aggregate":
-                    return !droppedObjectStableIds.has(change.aggregate.stableId);
-                case "procedure":
-                    return !droppedObjectStableIds.has(change.procedure.stableId);
-                case "range":
-                    return !droppedObjectStableIds.has(change.range.stableId);
-                case "schema":
-                    return !droppedObjectStableIds.has(change.schema.stableId);
-                case "sequence":
-                    return !droppedObjectStableIds.has(change.sequence.stableId);
-                case "table":
-                    return !droppedObjectStableIds.has(change.table.stableId);
-                case "view":
-                    return !droppedObjectStableIds.has(change.view.stableId);
-                case "foreign_data_wrapper":
-                    return !droppedObjectStableIds.has(change.foreignDataWrapper.stableId);
-                case "server":
-                    return !droppedObjectStableIds.has(change.server.stableId);
-                case "foreign_table":
-                    return !droppedObjectStableIds.has(change.foreignTable.stableId);
-                default: {
-                    // exhaustiveness check
-                    const _exhaustive = change;
-                    return _exhaustive;
-                }
-            }
+            return !droppedObjectStableIds.has(getPrivilegeTargetStableId(change));
         }
         return true;
     });
-    filteredChanges = expandReplaceDependencies({
+    const expandedDependencies = expandReplaceDependencies({
         changes: filteredChanges,
         mainCatalog: main,
         branchCatalog: branch,
     });
+    filteredChanges = normalizePostDiffCycles({
+        changes: expandedDependencies.changes,
+        replacedTableIds: expandedDependencies.replacedTableIds,
+    });
     debugCatalog("changes catalog diff: %O", stringifyWithBigInt(filteredChanges, 2));
     return filteredChanges;
 }