@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/core/objects/table/table.diff.js

@@ -1,11 +1,13 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByColumns, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitColumnPrivilegeChanges, } from "../base.privilege-diff.js";
+import { diffSecurityLabels } from "../security-label.types.js";
 import { deepEqual } from "../utils.js";
-import { AlterTableAddColumn, AlterTableAddConstraint, AlterTableAlterColumnDropDefault, AlterTableAlterColumnDropNotNull, AlterTableAlterColumnSetDefault, AlterTableAlterColumnSetNotNull, AlterTableAlterColumnType, AlterTableAttachPartition, AlterTableChangeOwner, AlterTableDetachPartition, AlterTableDisableRowLevelSecurity, AlterTableDropColumn, AlterTableDropConstraint, AlterTableEnableRowLevelSecurity, AlterTableForceRowLevelSecurity, AlterTableNoForceRowLevelSecurity, AlterTableResetStorageParams, AlterTableSetLogged, AlterTableSetReplicaIdentity, AlterTableSetStorageParams, AlterTableSetUnlogged, AlterTableValidateConstraint, } from "./changes/table.alter.js";
+import { AlterTableAddColumn, AlterTableAddConstraint, AlterTableAlterColumnAddIdentity, AlterTableAlterColumnDropDefault, AlterTableAlterColumnDropIdentity, AlterTableAlterColumnDropNotNull, AlterTableAlterColumnSetDefault, AlterTableAlterColumnSetGenerated, AlterTableAlterColumnSetNotNull, AlterTableAlterColumnType, AlterTableAttachPartition, AlterTableChangeOwner, AlterTableDetachPartition, AlterTableDisableRowLevelSecurity, AlterTableDropColumn, AlterTableDropConstraint, AlterTableEnableRowLevelSecurity, AlterTableForceRowLevelSecurity, AlterTableNoForceRowLevelSecurity, AlterTableResetStorageParams, AlterTableSetLogged, AlterTableSetReplicaIdentity, AlterTableSetStorageParams, AlterTableSetUnlogged, AlterTableValidateConstraint, } from "./changes/table.alter.js";
 import { CreateCommentOnColumn, CreateCommentOnConstraint, CreateCommentOnTable, DropCommentOnColumn, DropCommentOnConstraint, DropCommentOnTable, } from "./changes/table.comment.js";
 import { CreateTable } from "./changes/table.create.js";
 import { DropTable } from "./changes/table.drop.js";
 import { GrantTablePrivileges, RevokeGrantOptionTablePrivileges, RevokeTablePrivileges, } from "./changes/table.privilege.js";
+import { CreateSecurityLabelOnColumn, CreateSecurityLabelOnTable, DropSecurityLabelOnColumn, DropSecurityLabelOnTable, } from "./changes/table.security-label.js";
 import { Table } from "./table.model.js";
 function createAlterConstraintChange(mainTable, branchTable) {
     const changes = [];
@@ -26,12 +28,6 @@ function createAlterConstraintChange(mainTable, branchTable) {
                 table: branchTable,
                 constraint: c,
             }));
-            if (!c.validated) {
-                changes.push(new AlterTableValidateConstraint({
-                    table: branchTable,
-                    constraint: c,
-                }));
-            }
             // Add comment for newly created constraint
             if (c.comment !== null) {
                 changes.push(new CreateCommentOnConstraint({
@@ -51,7 +47,7 @@ function createAlterConstraintChange(mainTable, branchTable) {
             changes.push(new AlterTableDropConstraint({ table: mainTable, constraint: c }));
         }
     }
-    // Altered constraints -> drop + add
+    // Altered constraints -> drop + add (or VALIDATE-only shortcut)
     for (const [name, mainC] of mainByName) {
         const branchC = branchByName.get(name);
         if (!branchC)
@@ -60,22 +56,57 @@ function createAlterConstraintChange(mainTable, branchTable) {
         if (mainC.is_partition_clone || branchC.is_partition_clone) {
             continue;
         }
-        const changed = mainC.constraint_type !== branchC.constraint_type ||
-            mainC.deferrable !== branchC.deferrable ||
-            mainC.initially_deferred !== branchC.initially_deferred ||
-            mainC.validated !== branchC.validated ||
-            mainC.is_local !== branchC.is_local ||
-            mainC.no_inherit !== branchC.no_inherit ||
-            JSON.stringify(mainC.key_columns) !==
-                JSON.stringify(branchC.key_columns) ||
-            JSON.stringify(mainC.foreign_key_columns) !==
-                JSON.stringify(branchC.foreign_key_columns) ||
-            mainC.foreign_key_table !== branchC.foreign_key_table ||
-            mainC.foreign_key_schema !== branchC.foreign_key_schema ||
-            mainC.on_update !== branchC.on_update ||
-            mainC.on_delete !== branchC.on_delete ||
-            mainC.match_type !== branchC.match_type ||
-            mainC.check_expression !== branchC.check_expression;
+        // Cheap scalar `===` checks first; only fall through to JSON.stringify
+        // on the array fields when every scalar has already matched.
+        const fieldsEqualExceptValidated = mainC.constraint_type === branchC.constraint_type &&
+            mainC.deferrable === branchC.deferrable &&
+            mainC.initially_deferred === branchC.initially_deferred &&
+            mainC.is_local === branchC.is_local &&
+            mainC.no_inherit === branchC.no_inherit &&
+            mainC.is_temporal === branchC.is_temporal &&
+            mainC.foreign_key_table === branchC.foreign_key_table &&
+            mainC.foreign_key_schema === branchC.foreign_key_schema &&
+            mainC.on_update === branchC.on_update &&
+            mainC.on_delete === branchC.on_delete &&
+            mainC.match_type === branchC.match_type &&
+            mainC.check_expression === branchC.check_expression &&
+            JSON.stringify(mainC.key_columns) ===
+                JSON.stringify(branchC.key_columns) &&
+            JSON.stringify(mainC.foreign_key_columns) ===
+                JSON.stringify(branchC.foreign_key_columns);
+        // Safe-migration shortcut: when the only difference is `validated`
+        // flipping from false to true, emit a single `ALTER TABLE ... VALIDATE
+        // CONSTRAINT` instead of drop+add. VALIDATE CONSTRAINT only takes
+        // SHARE UPDATE EXCLUSIVE (concurrent reads/writes proceed), whereas
+        // dropping and re-adding takes ACCESS EXCLUSIVE for the entire scan.
+        // Postgres has no reverse command, so `true -> false` must still go
+        // through drop+add below.
+        if (fieldsEqualExceptValidated &&
+            mainC.validated === false &&
+            branchC.validated === true) {
+            changes.push(new AlterTableValidateConstraint({
+                table: branchTable,
+                constraint: branchC,
+            }));
+            // VALIDATE preserves the constraint OID, so its comment is preserved
+            // too. Only emit a comment change if it actually differs.
+            if (mainC.comment !== branchC.comment) {
+                if (branchC.comment === null) {
+                    changes.push(new DropCommentOnConstraint({
+                        table: mainTable,
+                        constraint: mainC,
+                    }));
+                }
+                else {
+                    changes.push(new CreateCommentOnConstraint({
+                        table: branchTable,
+                        constraint: branchC,
+                    }));
+                }
+            }
+            continue;
+        }
+        const changed = mainC.validated !== branchC.validated || !fieldsEqualExceptValidated;
         if (changed) {
             changes.push(new AlterTableDropConstraint({
                 table: mainTable,
@@ -85,12 +116,6 @@ function createAlterConstraintChange(mainTable, branchTable) {
                 table: branchTable,
                 constraint: branchC,
             }));
-            if (!branchC.validated) {
-                changes.push(new AlterTableValidateConstraint({
-                    table: branchTable,
-                    constraint: branchC,
-                }));
-            }
             // Ensure constraint comment is applied after re-creation
             if (branchC.comment !== null) {
                 changes.push(new CreateCommentOnConstraint({
@@ -149,9 +174,18 @@ export function diffTables(ctx, main, branch) {
         if (branchTable.force_row_security) {
             changes.push(new AlterTableForceRowLevelSecurity({ table: branchTable }));
         }
+        // REPLICA IDENTITY: If non-default, emit ALTER TABLE ... REPLICA IDENTITY
+        if (branchTable.replica_identity !== "d") {
+            changes.push(new AlterTableSetReplicaIdentity({
+                table: branchTable,
+                mode: branchTable.replica_identity,
+                indexName: branchTable.replica_identity_index,
+            }));
+        }
         changes.push(...createAlterConstraintChange(
         // Create a dummy table with no constraints do diff constraints against
         new Table({
+            // oxlint-disable-next-line typescript/no-misused-spread
             ...branchTable,
             constraints: [],
         }), branchTable));
@@ -165,92 +199,41 @@ export function diffTables(ctx, main, branch) {
                 changes.push(new CreateCommentOnColumn({ table: branchTable, column: col }));
             }
         }
+        // Table security labels on creation
+        for (const label of branchTable.security_labels) {
+            changes.push(new CreateSecurityLabelOnTable({
+                table: branchTable,
+                securityLabel: label,
+            }));
+        }
+        // Column security labels on creation
+        for (const col of branchTable.columns) {
+            for (const label of col.security_labels ?? []) {
+                changes.push(new CreateSecurityLabelOnColumn({
+                    table: branchTable,
+                    column: col,
+                    securityLabel: label,
+                }));
+            }
+        }
         // PRIVILEGES: For created objects, compare against default privileges state
         // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
         // so objects are created with the default privileges state in effect.
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "table", branchTable.schema ?? "");
+        const creatorFilteredDefaults = branchTable.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = branchTable.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the table owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, branchTable.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByColumns(result.grants);
-                for (const [, group] of grantGroups) {
-                    for (const [grantable, privSet] of group.byGrant) {
-                        const privileges = Array.from(privSet).map((priv) => ({
-                            privilege: priv,
-                            grantable,
-                        }));
-                        changes.push(new GrantTablePrivileges({
-                            table: branchTable,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                for (const [, group] of revokeGroups) {
-                    const allPrivileges = new Set();
-                    for (const [, privSet] of group.byGrant) {
-                        for (const priv of privSet) {
-                            allPrivileges.add(priv);
-                        }
-                    }
-                    const privileges = Array.from(allPrivileges).map((priv) => ({
-                        privilege: priv,
-                        grantable: false,
-                    }));
-                    changes.push(new RevokeTablePrivileges({
-                        table: branchTable,
-                        grantee,
-                        privileges,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                const revokeGrantGroups = new Map();
-                for (const r of result.revokeGrantOption) {
-                    const originalPriv = effectiveDefaults.find((p) => p.grantee === grantee && p.privilege === r);
-                    const key = originalPriv?.columns
-                        ? originalPriv.columns.sort().join(",")
-                        : "";
-                    if (!revokeGrantGroups.has(key)) {
-                        revokeGrantGroups.set(key, {
-                            columns: originalPriv?.columns
-                                ? [...originalPriv.columns]
-                                : undefined,
-                            privileges: new Set(),
-                        });
-                    }
-                    const group = revokeGrantGroups.get(key);
-                    if (!group)
-                        continue;
-                    group.privileges.add(r);
-                }
-                for (const [, group] of revokeGrantGroups) {
-                    const privilegeNames = Array.from(group.privileges);
-                    changes.push(new RevokeGrantOptionTablePrivileges({
-                        table: branchTable,
-                        grantee,
-                        privilegeNames,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, branchTable.owner);
+        changes.push(...emitColumnPrivilegeChanges(privilegeResults, branchTable, branchTable, "table", {
+            Grant: GrantTablePrivileges,
+            Revoke: RevokeTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionTablePrivileges,
+        }, effectiveDefaults, ctx.version));
     }
     for (const tableId of dropped) {
         changes.push(new DropTable({ table: main[tableId] }));
@@ -318,14 +301,20 @@ export function diffTables(ctx, main, branch) {
             }
         }
         // REPLICA IDENTITY
-        if (mainTable.replica_identity !== branchTable.replica_identity) {
-            // Skip when target is 'i' (USING INDEX) — handled by index changes
-            if (branchTable.replica_identity !== "i") {
-                changes.push(new AlterTableSetReplicaIdentity({
-                    table: mainTable,
-                    mode: branchTable.replica_identity,
-                }));
-            }
+        // Re-emit when the mode changes, or when staying in 'i' mode but pointing
+        // at a different index. The index named on the branch must already exist
+        // before this ALTER runs; AlterTableSetReplicaIdentity declares that
+        // dependency in its `requires`.
+        const replicaIdentityChanged = mainTable.replica_identity !== branchTable.replica_identity ||
+            (branchTable.replica_identity === "i" &&
+                mainTable.replica_identity_index !==
+                    branchTable.replica_identity_index);
+        if (replicaIdentityChanged) {
+            changes.push(new AlterTableSetReplicaIdentity({
+                table: mainTable,
+                mode: branchTable.replica_identity,
+                indexName: branchTable.replica_identity_index,
+            }));
         }
         // OWNER
         if (mainTable.owner !== branchTable.owner) {
@@ -343,6 +332,14 @@ export function diffTables(ctx, main, branch) {
                 changes.push(new CreateCommentOnTable({ table: branchTable }));
             }
         }
+        // TABLE SECURITY LABELS
+        changes.push(...diffSecurityLabels(mainTable.security_labels, branchTable.security_labels, (securityLabel) => new CreateSecurityLabelOnTable({
+            table: branchTable,
+            securityLabel,
+        }), (securityLabel) => new DropSecurityLabelOnTable({
+            table: mainTable,
+            securityLabel,
+        })));
         // PARTITION ATTACH/DETACH
         const mainIsPartition = Boolean(mainTable.parent_schema && mainTable.parent_name);
         const branchIsPartition = Boolean(branchTable.parent_schema && branchTable.parent_name);
@@ -439,6 +436,17 @@ export function diffTables(ctx, main, branch) {
                         partitionNotNullChanged &&
                         parentBranchCol.not_null === branchCol.not_null);
                 }
+                case "identity": {
+                    const parentIdentityChanged = parentMainCol.is_identity !== parentBranchCol.is_identity ||
+                        parentMainCol.is_identity_always !==
+                            parentBranchCol.is_identity_always;
+                    const partitionIdentityChanged = mainCol.is_identity !== branchCol.is_identity ||
+                        mainCol.is_identity_always !== branchCol.is_identity_always;
+                    return (parentIdentityChanged &&
+                        partitionIdentityChanged &&
+                        parentBranchCol.is_identity === branchCol.is_identity &&
+                        parentBranchCol.is_identity_always === branchCol.is_identity_always);
+                }
             }
         };
         // Helper to check if parent has the same column add/drop
@@ -497,14 +505,39 @@ export function diffTables(ctx, main, branch) {
             const branchCol = branchCols.get(name);
             if (!branchCol)
                 continue;
+            const columnTypeChanged = mainCol.data_type_str !== branchCol.data_type_str;
+            const columnCollationChanged = mainCol.collation !== branchCol.collation;
+            const needsDefaultSafeFlow = columnTypeChanged && mainCol.default !== null;
             // TYPE or COLLATION change
-            if (mainCol.data_type_str !== branchCol.data_type_str ||
-                mainCol.collation !== branchCol.collation) {
+            if (columnTypeChanged || columnCollationChanged) {
                 // Skip if parent has the same type/collation change
                 if (!parentHasSameColumnPropertyChange(name, "type")) {
+                    if (needsDefaultSafeFlow) {
+                        changes.push(new AlterTableAlterColumnDropDefault({
+                            table: branchTable,
+                            column: branchCol,
+                        }));
+                    }
                     changes.push(new AlterTableAlterColumnType({
                         table: branchTable,
                         column: branchCol,
+                        previousColumn: mainCol,
+                    }));
+                    if (needsDefaultSafeFlow && branchCol.default !== null) {
+                        changes.push(new AlterTableAlterColumnSetDefault({
+                            table: branchTable,
+                            column: branchCol,
+                        }));
+                    }
+                }
+            }
+            // PostgreSQL rejects SET DEFAULT while the column still has identity metadata,
+            // so identity removal must lead the IDENTITY -> serial/default transition.
+            if (mainCol.is_identity && !branchCol.is_identity) {
+                if (!parentHasSameColumnPropertyChange(name, "identity")) {
+                    changes.push(new AlterTableAlterColumnDropIdentity({
+                        table: branchTable,
+                        column: branchCol,
                     }));
                 }
             }
@@ -512,6 +545,10 @@ export function diffTables(ctx, main, branch) {
             if (mainCol.default !== branchCol.default) {
                 // Skip if parent has the same default change
                 if (!parentHasSameColumnPropertyChange(name, "default")) {
+                    if (needsDefaultSafeFlow) {
+                        // Defaults were already dropped/re-set in the type-change flow above.
+                        continue;
+                    }
                     if (branchCol.default === null) {
                         // Drop default value
                         changes.push(new AlterTableAlterColumnDropDefault({
@@ -523,9 +560,14 @@ export function diffTables(ctx, main, branch) {
                         // Set new default value
                         const isGeneratedColumn = branchCol.is_generated;
                         const isPostgresLowerThan17 = ctx.version < 170000;
-                        if (isGeneratedColumn && isPostgresLowerThan17) {
+                        const generatedStatusChanged = mainCol.is_generated !== branchCol.is_generated;
+                        if (isGeneratedColumn &&
+                            (isPostgresLowerThan17 || generatedStatusChanged)) {
                             // For generated columns in < PostgreSQL 17, we need to drop and recreate
-                            // instead of using SET EXPRESSION AS for computed columns
+                            // instead of using SET EXPRESSION AS for computed columns. We also
+                            // need to recreate the column when switching between regular and
+                            // generated states because SET EXPRESSION only applies to existing
+                            // generated columns.
                             // cf: https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=5d06e99a3
                             // cf: https://www.postgresql.org/docs/release/17.0/
                             // > Allow ALTER TABLE to change a column's generation expression
@@ -548,6 +590,30 @@ export function diffTables(ctx, main, branch) {
                     }
                 }
             }
+            // Serial-like defaults have to be cleared before ADD GENERATED AS IDENTITY,
+            // while mode-only flips stay in-place on an existing identity column.
+            if ((!mainCol.is_identity && branchCol.is_identity) ||
+                (mainCol.is_identity &&
+                    branchCol.is_identity &&
+                    mainCol.is_identity_always !== branchCol.is_identity_always)) {
+                // Skip if parent has the same identity change
+                if (!parentHasSameColumnPropertyChange(name, "identity")) {
+                    if (!mainCol.is_identity && branchCol.is_identity) {
+                        changes.push(new AlterTableAlterColumnAddIdentity({
+                            table: branchTable,
+                            column: branchCol,
+                        }));
+                    }
+                    else if (mainCol.is_identity &&
+                        branchCol.is_identity &&
+                        mainCol.is_identity_always !== branchCol.is_identity_always) {
+                        changes.push(new AlterTableAlterColumnSetGenerated({
+                            table: branchTable,
+                            column: branchCol,
+                        }));
+                    }
+                }
+            }
             // NOT NULL change
             if (mainCol.not_null !== branchCol.not_null) {
                 // Skip if parent has the same NOT NULL change
@@ -580,89 +646,38 @@ export function diffTables(ctx, main, branch) {
                     }));
                 }
             }
+            // SECURITY LABELS on column
+            changes.push(...diffSecurityLabels(mainCol.security_labels ?? [], branchCol.security_labels ?? [], (securityLabel) => new CreateSecurityLabelOnColumn({
+                table: branchTable,
+                column: branchCol,
+                securityLabel,
+            }), (securityLabel) => new DropSecurityLabelOnColumn({
+                table: mainTable,
+                column: mainCol,
+                securityLabel,
+            })));
         }
-        // PRIVILEGES (unified object and column privileges)
-        // Filter out owner privileges - owner always has ALL privileges implicitly
-        // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainTable.privileges, branchTable.privileges, branchTable.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByColumns(result.grants);
-                for (const [, group] of grantGroups) {
-                    for (const [grantable, privSet] of group.byGrant) {
-                        const privileges = Array.from(privSet).map((priv) => ({
-                            privilege: priv,
-                            grantable,
-                        }));
-                        changes.push(new GrantTablePrivileges({
-                            table: branchTable,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                for (const [, group] of revokeGroups) {
-                    // Collapse all grantable groups into a single revoke (grantable: false)
-                    const allPrivileges = new Set();
-                    for (const [, privSet] of group.byGrant) {
-                        for (const priv of privSet) {
-                            allPrivileges.add(priv);
-                        }
-                    }
-                    const privileges = Array.from(allPrivileges).map((priv) => ({
-                        privilege: priv,
-                        grantable: false,
-                    }));
-                    changes.push(new RevokeTablePrivileges({
-                        table: mainTable,
-                        grantee,
-                        privileges,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                const revokeGrantGroups = new Map();
-                for (const r of result.revokeGrantOption) {
-                    // For revoke grant option, we need to find the columns from the original privilege
-                    const originalPriv = mainTable.privileges.find((p) => p.grantee === grantee && p.privilege === r);
-                    const key = originalPriv?.columns
-                        ? originalPriv.columns.sort().join(",")
-                        : "";
-                    if (!revokeGrantGroups.has(key)) {
-                        revokeGrantGroups.set(key, {
-                            columns: originalPriv?.columns
-                                ? [...originalPriv.columns]
-                                : undefined,
-                            privileges: new Set(),
-                        });
-                    }
-                    const group = revokeGrantGroups.get(key);
-                    if (!group)
-                        continue;
-                    group.privileges.add(r);
-                }
-                for (const [, group] of revokeGrantGroups) {
-                    const privilegeNames = Array.from(group.privileges);
-                    changes.push(new RevokeGrantOptionTablePrivileges({
-                        table: mainTable,
-                        grantee,
-                        privilegeNames,
-                        columns: group.columns,
-                        version: ctx.version,
+        // Added columns with security labels (for created columns on existing tables)
+        for (const [name, col] of branchCols) {
+            if (!mainCols.has(name)) {
+                for (const label of col.security_labels ?? []) {
+                    changes.push(new CreateSecurityLabelOnColumn({
+                        table: branchTable,
+                        column: col,
+                        securityLabel: label,
                     }));
                 }
             }
         }
+        // PRIVILEGES (unified object and column privileges)
+        // Filter out owner privileges - owner always has ALL privileges implicitly
+        // and shouldn't be compared. Use branch owner as the reference.
+        const privilegeResults = diffPrivileges(mainTable.privileges, branchTable.privileges, branchTable.owner);
+        changes.push(...emitColumnPrivilegeChanges(privilegeResults, branchTable, mainTable, "table", {
+            Grant: GrantTablePrivileges,
+            Revoke: RevokeTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionTablePrivileges,
+        }, mainTable.privileges, ctx.version));
     }
     return changes;
 }