@supabase/pg-delta 1.0.0-alpha.4 → 1.0.0-alpha.5

package/src/core/objects/table/changes/table.create.ts

@@ -84,6 +84,10 @@ export class CreateTable extends CreateTableChange {
           }
         }
       }
+
+      // Function dependencies from DEFAULT expressions are handled by pg_depend
+      // catalog constraints in the sort pipeline, which provides exact argument
+      // types and covers all expression contexts (not just column defaults).
     }
 
     return Array.from(dependencies);

package/src/core/objects/table/changes/table.drop.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Table, type TableProps } from "../table.model.ts";
 import { DropTable } from "./table.drop.ts";
 
@@ -26,9 +27,10 @@ const base: TableProps = {
 };
 
 describe.concurrent("table.drop", () => {
-  test("drop table basic", () => {
+  test("drop table basic", async () => {
     const t = new Table(base);
     const change = new DropTable({ table: t });
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toBe("DROP TABLE public.t");
   });
 });

package/src/core/objects/table/table.diff.test.ts

@@ -24,6 +24,11 @@ import {
 } from "./changes/table.alter.ts";
 import { CreateTable } from "./changes/table.create.ts";
 import { DropTable } from "./changes/table.drop.ts";
+import {
+  GrantTablePrivileges,
+  RevokeGrantOptionTablePrivileges,
+  RevokeTablePrivileges,
+} from "./changes/table.privilege.ts";
 import { diffTables } from "./table.diff.ts";
 import { Table, type TableProps } from "./table.model.ts";
 
@@ -708,4 +713,156 @@ describe.concurrent("table.diff", () => {
       notNullDropped.some((c) => c instanceof AlterTableAlterColumnDropNotNull),
     ).toBe(true);
   });
+
+  test("created table with privileges emits grant changes", () => {
+    const t = new Table({
+      ...base,
+      privileges: [
+        { grantee: "role_sel", privilege: "SELECT", grantable: false },
+        { grantee: "role_ins", privilege: "INSERT", grantable: true },
+      ],
+    });
+    const changes = diffTables(testContext, {}, { [t.stableId]: t });
+    expect(changes[0]).toBeInstanceOf(CreateTable);
+    expect(changes.some((c) => c instanceof GrantTablePrivileges)).toBe(true);
+  });
+
+  test("created table with default privilege revoke grant option", () => {
+    const defaultPrivilegeState = new DefaultPrivilegeState({});
+    defaultPrivilegeState.applyGrant("postgres", "r", "public", "role_a", [
+      { privilege: "SELECT", grantable: true },
+    ]);
+    const ctx = {
+      ...testContext,
+      defaultPrivilegeState,
+    };
+    const t = new Table({
+      ...base,
+      owner: "postgres",
+      privileges: [
+        { grantee: "role_a", privilege: "SELECT", grantable: false },
+      ],
+    });
+    const changes = diffTables(ctx, {}, { [t.stableId]: t });
+    expect(changes[0]).toBeInstanceOf(CreateTable);
+    expect(
+      changes.some((c) => c instanceof RevokeGrantOptionTablePrivileges),
+    ).toBe(true);
+  });
+
+  test("altered table privileges emit grant, revoke, and revoke grant option", () => {
+    const main = new Table({
+      ...base,
+      privileges: [
+        { grantee: "role_sel", privilege: "SELECT", grantable: false },
+        { grantee: "role_with_option", privilege: "SELECT", grantable: true },
+        { grantee: "role_removed", privilege: "SELECT", grantable: false },
+      ],
+    });
+    const branch = new Table({
+      ...base,
+      privileges: [
+        { grantee: "role_sel", privilege: "SELECT", grantable: true },
+        { grantee: "role_with_option", privilege: "SELECT", grantable: false },
+        { grantee: "role_new", privilege: "SELECT", grantable: false },
+      ],
+    });
+    const changes = diffTables(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof GrantTablePrivileges)).toBe(true);
+    expect(changes.some((c) => c instanceof RevokeTablePrivileges)).toBe(true);
+    expect(
+      changes.some((c) => c instanceof RevokeGrantOptionTablePrivileges),
+    ).toBe(true);
+  });
+
+  test("altered table privileges emit revokes before grants", () => {
+    const main = new Table({
+      ...base,
+      privileges: [
+        { grantee: "authenticated", privilege: "INSERT", grantable: false },
+        { grantee: "authenticated", privilege: "UPDATE", grantable: false },
+      ],
+    });
+    const branch = new Table({
+      ...base,
+      privileges: [
+        {
+          grantee: "authenticated",
+          privilege: "INSERT",
+          grantable: false,
+          columns: ["org_id", "name"],
+        },
+        {
+          grantee: "authenticated",
+          privilege: "UPDATE",
+          grantable: false,
+          columns: ["name"],
+        },
+      ],
+    });
+    const changes = diffTables(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    const privilegeChanges = changes.filter(
+      (c) =>
+        c instanceof GrantTablePrivileges ||
+        c instanceof RevokeTablePrivileges ||
+        c instanceof RevokeGrantOptionTablePrivileges,
+    );
+    expect(privilegeChanges.length).toBeGreaterThan(1);
+
+    const firstRevokeIndex = privilegeChanges.findIndex(
+      (c) => c instanceof RevokeTablePrivileges,
+    );
+    const firstGrantIndex = privilegeChanges.findIndex(
+      (c) => c instanceof GrantTablePrivileges,
+    );
+    expect(firstRevokeIndex).not.toBe(-1);
+    expect(firstGrantIndex).not.toBe(-1);
+    expect(firstRevokeIndex).toBeLessThan(firstGrantIndex);
+  });
+
+  test("storage params: set when added from null", () => {
+    const main = new Table(base);
+    const branch = new Table({
+      ...base,
+      options: ["autovacuum_enabled=false"],
+    });
+    const changes = diffTables(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof AlterTableSetStorageParams)).toBe(
+      true,
+    );
+    expect(changes.some((c) => c instanceof AlterTableResetStorageParams)).toBe(
+      false,
+    );
+  });
+
+  test("storage params: reset when removed to null", () => {
+    const main = new Table({
+      ...base,
+      options: ["fillfactor=90"],
+    });
+    const branch = new Table(base);
+    const changes = diffTables(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof AlterTableResetStorageParams)).toBe(
+      true,
+    );
+    expect(changes.some((c) => c instanceof AlterTableSetStorageParams)).toBe(
+      false,
+    );
+  });
 });

package/src/core/objects/table/table.diff.ts

@@ -1,10 +1,9 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
 import { diffObjects } from "../base.diff.ts";
 import {
   diffPrivileges,
-  groupPrivilegesByColumns,
+  emitColumnPrivilegeChanges,
 } from "../base.privilege-diff.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import { deepEqual } from "../utils.ts";
 import {
   AlterTableAddColumn,
@@ -202,12 +201,10 @@ function createAlterConstraintChange(mainTable: Table, branchTable: Table) {
  * @returns A list of changes to apply to main to make it match branch.
  */
 export function diffTables(
-  ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-  },
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
   main: Record<string, Table>,
   branch: Record<string, Table>,
 ): TableChange[] {
@@ -242,6 +239,19 @@ export function diffTables(
       changes.push(new AlterTableForceRowLevelSecurity({ table: branchTable }));
     }
 
+    // REPLICA IDENTITY: If non-default, emit ALTER TABLE ... REPLICA IDENTITY
+    if (branchTable.replica_identity !== "d") {
+      // Skip 'i' (USING INDEX) — handled by index changes
+      if (branchTable.replica_identity !== "i") {
+        changes.push(
+          new AlterTableSetReplicaIdentity({
+            table: branchTable,
+            mode: branchTable.replica_identity,
+          }),
+        );
+      }
+    }
+
     changes.push(
       ...createAlterConstraintChange(
         // Create a dummy table with no constraints do diff constraints against
@@ -277,104 +287,34 @@ export function diffTables(
       "table",
       branchTable.schema ?? "",
     );
+    const creatorFilteredDefaults =
+      branchTable.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
     const desiredPrivileges = branchTable.privileges;
     // Filter out owner privileges - owner always has ALL privileges implicitly
     // and shouldn't be compared. Use the table owner as the reference.
     const privilegeResults = diffPrivileges(
-      effectiveDefaults,
+      creatorFilteredDefaults,
       desiredPrivileges,
       branchTable.owner,
-      ctx.mainRoles,
     );
 
-    // Generate grant changes
-    for (const [grantee, result] of privilegeResults) {
-      if (result.grants.length > 0) {
-        const grantGroups = groupPrivilegesByColumns(result.grants);
-        for (const [, group] of grantGroups) {
-          for (const [grantable, privSet] of group.byGrant) {
-            const privileges = Array.from(privSet).map((priv) => ({
-              privilege: priv,
-              grantable,
-            }));
-            changes.push(
-              new GrantTablePrivileges({
-                table: branchTable,
-                grantee,
-                privileges,
-                columns: group.columns,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-      }
-
-      // Generate revoke changes
-      if (result.revokes.length > 0) {
-        const revokeGroups = groupPrivilegesByColumns(result.revokes);
-        for (const [, group] of revokeGroups) {
-          const allPrivileges = new Set<string>();
-          for (const [, privSet] of group.byGrant) {
-            for (const priv of privSet) {
-              allPrivileges.add(priv);
-            }
-          }
-          const privileges = Array.from(allPrivileges).map((priv) => ({
-            privilege: priv,
-            grantable: false,
-          }));
-          changes.push(
-            new RevokeTablePrivileges({
-              table: branchTable,
-              grantee,
-              privileges,
-              columns: group.columns,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke grant option changes
-      if (result.revokeGrantOption.length > 0) {
-        const revokeGrantGroups = new Map<
-          string,
-          { columns?: string[]; privileges: Set<string> }
-        >();
-        for (const r of result.revokeGrantOption) {
-          const originalPriv = effectiveDefaults.find(
-            (p) => p.grantee === grantee && p.privilege === r,
-          );
-          const key = originalPriv?.columns
-            ? originalPriv.columns.sort().join(",")
-            : "";
-          if (!revokeGrantGroups.has(key)) {
-            revokeGrantGroups.set(key, {
-              columns: originalPriv?.columns
-                ? [...originalPriv.columns]
-                : undefined,
-              privileges: new Set(),
-            });
-          }
-          const group = revokeGrantGroups.get(key);
-          if (!group) continue;
-          group.privileges.add(r);
-        }
-        for (const [, group] of revokeGrantGroups) {
-          const privilegeNames = Array.from(group.privileges);
-          changes.push(
-            new RevokeGrantOptionTablePrivileges({
-              table: branchTable,
-              grantee,
-              privilegeNames,
-              columns: group.columns,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-    }
+    changes.push(
+      ...(emitColumnPrivilegeChanges(
+        privilegeResults,
+        branchTable,
+        branchTable,
+        "table",
+        {
+          Grant: GrantTablePrivileges,
+          Revoke: RevokeTablePrivileges,
+          RevokeGrantOption: RevokeGrantOptionTablePrivileges,
+        },
+        effectiveDefaults,
+        ctx.version,
+      ) as TableChange[]),
+    );
   }
 
   for (const tableId of dropped) {
@@ -854,99 +794,23 @@ export function diffTables(
       mainTable.privileges,
       branchTable.privileges,
       branchTable.owner,
-      ctx.mainRoles,
     );
 
-    for (const [grantee, result] of privilegeResults) {
-      // Generate grant changes
-      if (result.grants.length > 0) {
-        const grantGroups = groupPrivilegesByColumns(result.grants);
-        for (const [, group] of grantGroups) {
-          for (const [grantable, privSet] of group.byGrant) {
-            const privileges = Array.from(privSet).map((priv) => ({
-              privilege: priv,
-              grantable,
-            }));
-            changes.push(
-              new GrantTablePrivileges({
-                table: branchTable,
-                grantee,
-                privileges,
-                columns: group.columns,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-      }
-
-      // Generate revoke changes
-      if (result.revokes.length > 0) {
-        const revokeGroups = groupPrivilegesByColumns(result.revokes);
-        for (const [, group] of revokeGroups) {
-          // Collapse all grantable groups into a single revoke (grantable: false)
-          const allPrivileges = new Set<string>();
-          for (const [, privSet] of group.byGrant) {
-            for (const priv of privSet) {
-              allPrivileges.add(priv);
-            }
-          }
-          const privileges = Array.from(allPrivileges).map((priv) => ({
-            privilege: priv,
-            grantable: false,
-          }));
-          changes.push(
-            new RevokeTablePrivileges({
-              table: mainTable,
-              grantee,
-              privileges,
-              columns: group.columns,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke grant option changes
-      if (result.revokeGrantOption.length > 0) {
-        const revokeGrantGroups = new Map<
-          string,
-          { columns?: string[]; privileges: Set<string> }
-        >();
-        for (const r of result.revokeGrantOption) {
-          // For revoke grant option, we need to find the columns from the original privilege
-          const originalPriv = mainTable.privileges.find(
-            (p) => p.grantee === grantee && p.privilege === r,
-          );
-          const key = originalPriv?.columns
-            ? originalPriv.columns.sort().join(",")
-            : "";
-          if (!revokeGrantGroups.has(key)) {
-            revokeGrantGroups.set(key, {
-              columns: originalPriv?.columns
-                ? [...originalPriv.columns]
-                : undefined,
-              privileges: new Set(),
-            });
-          }
-          const group = revokeGrantGroups.get(key);
-          if (!group) continue;
-          group.privileges.add(r);
-        }
-        for (const [, group] of revokeGrantGroups) {
-          const privilegeNames = Array.from(group.privileges);
-          changes.push(
-            new RevokeGrantOptionTablePrivileges({
-              table: mainTable,
-              grantee,
-              privilegeNames,
-              columns: group.columns,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-    }
+    changes.push(
+      ...(emitColumnPrivilegeChanges(
+        privilegeResults,
+        branchTable,
+        mainTable,
+        "table",
+        {
+          Grant: GrantTablePrivileges,
+          Revoke: RevokeTablePrivileges,
+          RevokeGrantOption: RevokeGrantOptionTablePrivileges,
+        },
+        mainTable.privileges,
+        ctx.version,
+      ) as TableChange[]),
+    );
   }
 
   return changes;

package/src/core/objects/table/table.model.ts

@@ -428,7 +428,7 @@ select
       from (
         -- one row for object ACL + one row per column ACL
         select null::name as attname, t.oid as relacl_oid, (
-          select c_rel.relacl from pg_class c_rel where c_rel.oid = t.oid
+          select COALESCE(c_rel.relacl, acldefault('r', c_rel.relowner)) from pg_class c_rel where c_rel.oid = t.oid
         ) as acl
         union all
         select a2.attname, t.oid as relacl_oid, a2.attacl

package/src/core/objects/trigger/changes/trigger.alter.test.ts

@@ -1,19 +1,21 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Trigger, type TriggerProps } from "../trigger.model.ts";
 import { ReplaceTrigger } from "./trigger.alter.ts";
 
 describe.concurrent("trigger", () => {
   describe("alter", () => {
-    test("replace trigger", () => {
+    test("replace trigger", async () => {
       const props: Omit<TriggerProps, "enabled"> = {
         schema: "public",
         name: "test_trigger",
         table_name: "test_table",
+        table_relkind: "r",
         function_schema: "public",
         function_name: "test_function",
         trigger_type: 1 << 4, // UPDATE (1<<4) = 16, AFTER is default (0), STATEMENT is default (0)
         is_internal: false,
-        deferrable: true,
+        deferrable: false,
         initially_deferred: false,
         argument_count: 0,
         column_numbers: null,
@@ -28,7 +30,7 @@ describe.concurrent("trigger", () => {
         is_on_partitioned_table: false,
         owner: "test",
         definition:
-          "CREATE TRIGGER test_trigger AFTER UPDATE ON public.test_table DEFERRABLE EXECUTE FUNCTION public.test_function()",
+          "CREATE TRIGGER test_trigger AFTER UPDATE ON public.test_table EXECUTE FUNCTION public.test_function()",
         comment: null,
       };
       const branch = new Trigger({
@@ -38,8 +40,10 @@ describe.concurrent("trigger", () => {
 
       const change = new ReplaceTrigger({ trigger: branch });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
-        "CREATE OR REPLACE TRIGGER test_trigger AFTER UPDATE ON public.test_table DEFERRABLE EXECUTE FUNCTION public.test_function()",
+        "CREATE OR REPLACE TRIGGER test_trigger AFTER UPDATE ON public.test_table EXECUTE FUNCTION public.test_function()",
       );
     });
   });

package/src/core/objects/trigger/changes/trigger.create.test.ts

@@ -1,13 +1,15 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Trigger } from "../trigger.model.ts";
 import { CreateTrigger } from "./trigger.create.ts";
 
 describe("trigger", () => {
-  test("create", () => {
+  test("create", async () => {
     const trigger = new Trigger({
       schema: "public",
       name: "test_trigger",
       table_name: "test_table",
+      table_relkind: "r",
       function_schema: "public",
       function_name: "test_function",
       trigger_type: (1 << 1) | (1 << 2) | (1 << 0), // BEFORE (1<<1) | INSERT (1<<2) | ROW (1<<0) = 7
@@ -36,6 +38,8 @@ describe("trigger", () => {
       trigger,
     });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       "CREATE TRIGGER test_trigger BEFORE INSERT ON public.test_table FOR EACH ROW EXECUTE FUNCTION public.test_function()",
     );

package/src/core/objects/trigger/changes/trigger.create.ts

@@ -60,10 +60,13 @@ export class CreateTrigger extends CreateTriggerChange {
     );
 
     // Function dependency
-    // Note: We can't build the exact procedure stableId without argument types.
-    // The trigger definition contains the full function call, but parsing it would be complex.
-    // For now, we rely on pg_depend extraction for procedure dependencies.
-    // If needed, we could parse the trigger definition to extract the full function signature.
+    // Trigger functions always have signature () RETURNS trigger, so no arguments.
+    dependencies.add(
+      stableId.procedure(
+        this.trigger.function_schema,
+        this.trigger.function_name,
+      ),
+    );
 
     // Owner dependency
     dependencies.add(stableId.role(this.trigger.owner));

package/src/core/objects/trigger/changes/trigger.drop.test.ts

@@ -1,13 +1,15 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Trigger } from "../trigger.model.ts";
 import { DropTrigger } from "./trigger.drop.ts";
 
 describe("trigger", () => {
-  test("drop", () => {
+  test("drop", async () => {
     const trigger = new Trigger({
       schema: "public",
       name: "test_trigger",
       table_name: "test_table",
+      table_relkind: "r",
       function_schema: "public",
       function_name: "test_function",
       trigger_type: 66,
@@ -36,6 +38,8 @@ describe("trigger", () => {
       trigger,
     });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       "DROP TRIGGER test_trigger ON public.test_table",
     );

package/src/core/objects/trigger/trigger.diff.test.ts

@@ -17,6 +17,7 @@ const base: Omit<
   schema: "public",
   name: "trg",
   table_name: "t",
+  table_relkind: "r",
   function_schema: "public",
   trigger_type: 1,
   enabled: "O",

package/src/core/objects/trigger/trigger.model.ts

@@ -10,10 +10,19 @@ const TriggerEnabledSchema = z.enum([
   "A", // ALWAYS - trigger fires regardless of replication mode
 ]);
 
+const TriggerTableRelkindSchema = z.enum([
+  "r", // ordinary table
+  "p", // partitioned table
+  "f", // foreign table
+  "v", // view
+  "m", // materialized view
+]);
+
 const triggerPropsSchema = z.object({
   schema: z.string(),
   name: z.string(),
   table_name: z.string(),
+  table_relkind: TriggerTableRelkindSchema,
   function_schema: z.string(),
   function_name: z.string(),
   trigger_type: z.number(),
@@ -43,6 +52,7 @@ export class Trigger extends BasePgModel {
   public readonly schema: TriggerProps["schema"];
   public readonly name: TriggerProps["name"];
   public readonly table_name: TriggerProps["table_name"];
+  public readonly table_relkind: TriggerProps["table_relkind"];
   public readonly function_schema: TriggerProps["function_schema"];
   public readonly function_name: TriggerProps["function_name"];
   public readonly trigger_type: TriggerProps["trigger_type"];
@@ -72,6 +82,7 @@ export class Trigger extends BasePgModel {
     this.schema = props.schema;
     this.name = props.name;
     this.table_name = props.table_name;
+    this.table_relkind = props.table_relkind;
 
     // Data fields
     this.function_schema = props.function_schema;
@@ -164,6 +175,7 @@ export async function extractTriggers(pool: Pool): Promise<Trigger[]> {
         tc.relnamespace::regnamespace::text as schema,
         quote_ident(t.tgname)               as name,
         quote_ident(tc.relname)             as table_name,
+        tc.relkind                          as table_relkind,
 
         fc.pronamespace::regnamespace::text as function_schema,
         quote_ident(fc.proname)             as function_name,