@supabase/pg-delta 1.0.0-alpha.4 → 1.0.0-alpha.5

package/dist/core/objects/domain/domain.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../base.privilege-diff.js";
 import { AlterDomainAddConstraint, AlterDomainChangeOwner, AlterDomainDropConstraint, AlterDomainDropDefault, AlterDomainDropNotNull, AlterDomainSetDefault, AlterDomainSetNotNull, AlterDomainValidateConstraint, } from "./changes/domain.alter.js";
 import { CreateCommentOnDomain, DropCommentOnDomain, } from "./changes/domain.comment.js";
 import { CreateDomain } from "./changes/domain.create.js";
@@ -50,50 +50,21 @@ export function diffDomains(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "domain", newDomain.schema ?? "");
+        const creatorFilteredDefaults = newDomain.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         // Filter out PUBLIC's built-in default USAGE privilege (PostgreSQL grants it automatically)
         // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
         // This prevents generating unnecessary "GRANT USAGE TO PUBLIC" statements
         const desiredPrivileges = filterPublicBuiltInDefaults("domain", newDomain.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the domain owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, newDomain.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantDomainPrivileges({
-                        domain: newDomain,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeDomainPrivileges({
-                        domain: newDomain,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionDomainPrivileges({
-                    domain: newDomain,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("domain", creatorFilteredDefaults), desiredPrivileges, newDomain.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, newDomain, newDomain, "domain", {
+            Grant: GrantDomainPrivileges,
+            Revoke: RevokeDomainPrivileges,
+            RevokeGrantOption: RevokeGrantOptionDomainPrivileges,
+        }, ctx.version));
     }
     for (const domainId of dropped) {
         changes.push(new DropDomain({ domain: main[domainId] }));
@@ -201,44 +172,12 @@ export function diffDomains(ctx, main, branch) {
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("domain", branchDomain.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchDomain.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantDomainPrivileges({
-                        domain: branchDomain,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeDomainPrivileges({
-                        domain: mainDomain,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionDomainPrivileges({
-                    domain: mainDomain,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchDomain.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchDomain, mainDomain, "domain", {
+            Grant: GrantDomainPrivileges,
+            Revoke: RevokeDomainPrivileges,
+            RevokeGrantOption: RevokeGrantOptionDomainPrivileges,
+        }, ctx.version));
     }
     return changes;
 }

package/dist/core/objects/domain/domain.model.js

@@ -150,7 +150,7 @@ export async function extractDomains(pool) {
               )
               order by x.grantee, x.privilege_type
             )
-            from lateral aclexplode(t.typacl) as x(grantor, grantee, privilege_type, is_grantable)
+            from lateral aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) as x(grantor, grantee, privilege_type, is_grantable)
           ), '[]'
         ) as privileges
       from

package/dist/core/objects/event-trigger/event-trigger.diff.d.ts

@@ -1,3 +1,4 @@
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { EventTriggerChange } from "./changes/event-trigger.types.ts";
 import type { EventTrigger } from "./event-trigger.model.ts";
 /**
@@ -8,6 +9,4 @@ import type { EventTrigger } from "./event-trigger.model.ts";
  * @param branch - The event triggers in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffEventTriggers(ctx: {
-    currentUser: string;
-}, main: Record<string, EventTrigger>, branch: Record<string, EventTrigger>): EventTriggerChange[];
+export declare function diffEventTriggers(ctx: Pick<ObjectDiffContext, "currentUser">, main: Record<string, EventTrigger>, branch: Record<string, EventTrigger>): EventTriggerChange[];

package/dist/core/objects/foreign-data-wrapper/foreign-data-wrapper/foreign-data-wrapper.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import type { ForeignDataWrapperChange } from "./changes/foreign-data-wrapper.types.ts";
 import type { ForeignDataWrapper } from "./foreign-data-wrapper.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { ForeignDataWrapper } from "./foreign-data-wrapper.model.ts";
  * @param branch - The foreign data wrappers in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffForeignDataWrappers(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, ForeignDataWrapper>, branch: Record<string, ForeignDataWrapper>): ForeignDataWrapperChange[];
+export declare function diffForeignDataWrappers(ctx: Pick<ObjectDiffContext, "version" | "currentUser">, main: Record<string, ForeignDataWrapper>, branch: Record<string, ForeignDataWrapper>): ForeignDataWrapperChange[];

package/dist/core/objects/foreign-data-wrapper/foreign-data-wrapper/foreign-data-wrapper.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
 import { AlterForeignDataWrapperChangeOwner, AlterForeignDataWrapperSetOptions, } from "./changes/foreign-data-wrapper.alter.js";
 import { CreateCommentOnForeignDataWrapper, DropCommentOnForeignDataWrapper, } from "./changes/foreign-data-wrapper.comment.js";
 import { CreateForeignDataWrapper } from "./changes/foreign-data-wrapper.create.js";
@@ -37,44 +37,12 @@ export function diffForeignDataWrappers(ctx, main, branch) {
         const effectiveDefaults = [];
         const desiredPrivileges = filterPublicBuiltInDefaults("foreign_data_wrapper", createdFdw.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdFdw.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantForeignDataWrapperPrivileges({
-                        foreignDataWrapper: createdFdw,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeForeignDataWrapperPrivileges({
-                        foreignDataWrapper: createdFdw,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionForeignDataWrapperPrivileges({
-                    foreignDataWrapper: createdFdw,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdFdw.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdFdw, createdFdw, "foreignDataWrapper", {
+            Grant: GrantForeignDataWrapperPrivileges,
+            Revoke: RevokeForeignDataWrapperPrivileges,
+            RevokeGrantOption: RevokeGrantOptionForeignDataWrapperPrivileges,
+        }, ctx.version));
     }
     for (const fdwId of dropped) {
         changes.push(new DropForeignDataWrapper({ foreignDataWrapper: main[fdwId] }));
@@ -133,44 +101,12 @@ export function diffForeignDataWrappers(ctx, main, branch) {
         // PRIVILEGES
         const mainPrivilegesFiltered = filterPublicBuiltInDefaults("foreign_data_wrapper", mainFdw.privileges);
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("foreign_data_wrapper", branchFdw.privileges);
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchFdw.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantForeignDataWrapperPrivileges({
-                        foreignDataWrapper: branchFdw,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeForeignDataWrapperPrivileges({
-                        foreignDataWrapper: mainFdw,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionForeignDataWrapperPrivileges({
-                    foreignDataWrapper: mainFdw,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchFdw.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchFdw, mainFdw, "foreignDataWrapper", {
+            Grant: GrantForeignDataWrapperPrivileges,
+            Revoke: RevokeForeignDataWrapperPrivileges,
+            RevokeGrantOption: RevokeGrantOptionForeignDataWrapperPrivileges,
+        }, ctx.version));
         // Note: FDW renaming would also use ALTER FOREIGN DATA WRAPPER ... RENAME TO ...
         // But since our ForeignDataWrapper model uses 'name' as the identity field,
         // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/foreign-data-wrapper/foreign-data-wrapper/foreign-data-wrapper.model.js

@@ -73,11 +73,11 @@ export async function extractForeignDataWrappers(pool) {
         fdw.fdwowner::regrole::text as owner,
         case
           when fdw.fdwhandler = 0 then null
-          else p_handler.pronamespace::regnamespace::text || '.' || quote_ident(p_handler.proname) || '(' || pg_get_function_identity_arguments(fdw.fdwhandler) || ')'
+          else p_handler.pronamespace::regnamespace::text || '.' || quote_ident(p_handler.proname)
         end as handler,
         case
           when fdw.fdwvalidator = 0 then null
-          else p_validator.pronamespace::regnamespace::text || '.' || quote_ident(p_validator.proname) || '(' || pg_get_function_identity_arguments(fdw.fdwvalidator) || ')'
+          else p_validator.pronamespace::regnamespace::text || '.' || quote_ident(p_validator.proname)
         end as validator,
         coalesce(fdw.fdwoptions, array[]::text[]) as options,
         obj_description(fdw.oid, 'pg_foreign_data_wrapper') as comment,

package/dist/core/objects/foreign-data-wrapper/foreign-table/foreign-table.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import type { ForeignTableChange } from "./changes/foreign-table.types.ts";
 import type { ForeignTable } from "./foreign-table.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { ForeignTable } from "./foreign-table.model.ts";
  * @param branch - The foreign tables in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffForeignTables(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, ForeignTable>, branch: Record<string, ForeignTable>): ForeignTableChange[];
+export declare function diffForeignTables(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, ForeignTable>, branch: Record<string, ForeignTable>): ForeignTableChange[];

package/dist/core/objects/foreign-data-wrapper/foreign-table/foreign-table.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
 import { AlterForeignTableAddColumn, AlterForeignTableAlterColumnDropDefault, AlterForeignTableAlterColumnDropNotNull, AlterForeignTableAlterColumnSetDefault, AlterForeignTableAlterColumnSetNotNull, AlterForeignTableAlterColumnType, AlterForeignTableChangeOwner, AlterForeignTableDropColumn, AlterForeignTableSetOptions, } from "./changes/foreign-table.alter.js";
 import { CreateCommentOnForeignTable, DropCommentOnForeignTable, } from "./changes/foreign-table.comment.js";
 import { CreateForeignTable } from "./changes/foreign-table.create.js";
@@ -32,45 +32,16 @@ export function diffForeignTables(ctx, main, branch) {
         }
         // PRIVILEGES: For created objects, compare against default privileges state
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "foreign_table", createdTable.schema ?? "");
+        const creatorFilteredDefaults = createdTable.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = filterPublicBuiltInDefaults("foreign_table", createdTable.privileges);
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdTable.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantForeignTablePrivileges({
-                        foreignTable: createdTable,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeForeignTablePrivileges({
-                        foreignTable: createdTable,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionForeignTablePrivileges({
-                    foreignTable: createdTable,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("foreign_table", creatorFilteredDefaults), desiredPrivileges, createdTable.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdTable, createdTable, "foreignTable", {
+            Grant: GrantForeignTablePrivileges,
+            Revoke: RevokeForeignTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionForeignTablePrivileges,
+        }, ctx.version));
     }
     for (const tableId of dropped) {
         changes.push(new DropForeignTable({ foreignTable: main[tableId] }));
@@ -180,44 +151,12 @@ export function diffForeignTables(ctx, main, branch) {
         // PRIVILEGES
         const mainPrivilegesFiltered = filterPublicBuiltInDefaults("foreign_table", mainTable.privileges);
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("foreign_table", branchTable.privileges);
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchTable.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantForeignTablePrivileges({
-                        foreignTable: branchTable,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeForeignTablePrivileges({
-                        foreignTable: mainTable,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionForeignTablePrivileges({
-                    foreignTable: mainTable,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchTable.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchTable, mainTable, "foreignTable", {
+            Grant: GrantForeignTablePrivileges,
+            Revoke: RevokeForeignTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionForeignTablePrivileges,
+        }, ctx.version));
         // Note: Foreign table renaming would also use ALTER FOREIGN TABLE ... RENAME TO ...
         // But since our ForeignTable model uses 'name' as the identity field,
         // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/foreign-data-wrapper/foreign-table/foreign-table.model.js

@@ -168,7 +168,7 @@ export async function extractForeignTables(pool) {
             from (
               -- one row for object ACL + one row per column ACL
               select null::name as attname, ft.oid as relacl_oid, (
-                select c_rel.relacl from pg_class c_rel where c_rel.oid = ft.oid
+                select COALESCE(c_rel.relacl, acldefault('r', c_rel.relowner)) from pg_class c_rel where c_rel.oid = ft.oid
               ) as acl
               union all
               select a2.attname, ft.oid as relacl_oid, a2.attacl

package/dist/core/objects/foreign-data-wrapper/server/server.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import type { ServerChange } from "./changes/server.types.ts";
 import type { Server } from "./server.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { Server } from "./server.model.ts";
  * @param branch - The servers in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffServers(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Server>, branch: Record<string, Server>): ServerChange[];
+export declare function diffServers(ctx: Pick<ObjectDiffContext, "version" | "currentUser">, main: Record<string, Server>, branch: Record<string, Server>): ServerChange[];

package/dist/core/objects/foreign-data-wrapper/server/server.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
 import { AlterServerChangeOwner, AlterServerSetOptions, AlterServerSetVersion, } from "./changes/server.alter.js";
 import { CreateCommentOnServer, DropCommentOnServer, } from "./changes/server.comment.js";
 import { CreateServer } from "./changes/server.create.js";
@@ -33,44 +33,12 @@ export function diffServers(ctx, main, branch) {
         // PRIVILEGES: Servers don't have default privileges
         const effectiveDefaults = [];
         const desiredPrivileges = filterPublicBuiltInDefaults("server", createdServer.privileges);
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdServer.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantServerPrivileges({
-                        server: createdServer,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeServerPrivileges({
-                        server: createdServer,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionServerPrivileges({
-                    server: createdServer,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdServer.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdServer, createdServer, "server", {
+            Grant: GrantServerPrivileges,
+            Revoke: RevokeServerPrivileges,
+            RevokeGrantOption: RevokeGrantOptionServerPrivileges,
+        }, ctx.version));
     }
     for (const serverId of dropped) {
         changes.push(new DropServer({ server: main[serverId] }));
@@ -121,44 +89,12 @@ export function diffServers(ctx, main, branch) {
         // PRIVILEGES
         const mainPrivilegesFiltered = filterPublicBuiltInDefaults("server", mainServer.privileges);
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("server", branchServer.privileges);
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchServer.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantServerPrivileges({
-                        server: branchServer,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeServerPrivileges({
-                        server: mainServer,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionServerPrivileges({
-                    server: mainServer,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchServer.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchServer, mainServer, "server", {
+            Grant: GrantServerPrivileges,
+            Revoke: RevokeServerPrivileges,
+            RevokeGrantOption: RevokeGrantOptionServerPrivileges,
+        }, ctx.version));
         // Note: Server renaming would also use ALTER SERVER ... RENAME TO ...
         // But since our Server model uses 'name' as the identity field,
         // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/language/language.diff.d.ts

@@ -1,5 +1,5 @@
 import type { Change } from "../../change.types.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { Language } from "./language.model.ts";
 /**
  * Diff two sets of languages from main and branch catalogs.
@@ -9,7 +9,4 @@ import type { Language } from "./language.model.ts";
  * @param branch - The languages in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffLanguages(ctx: {
-    version: number;
-    mainRoles?: Record<string, Role>;
-}, main: Record<string, Language>, branch: Record<string, Language>): Change[];
+export declare function diffLanguages(ctx: Pick<ObjectDiffContext, "version">, main: Record<string, Language>, branch: Record<string, Language>): Change[];

package/dist/core/objects/language/language.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../base.privilege-diff.js";
 import { hasNonAlterableChanges } from "../utils.js";
 import { AlterLanguageChangeOwner } from "./changes/language.alter.js";
 import { CreateCommentOnLanguage, DropCommentOnLanguage, } from "./changes/language.comment.js";
@@ -73,44 +73,12 @@ export function diffLanguages(ctx, main, branch) {
             const branchPrivilegesFiltered = filterPublicBuiltInDefaults("language", branchLanguage.privileges);
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchLanguage.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantLanguagePrivileges({
-                            language: branchLanguage,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeLanguagePrivileges({
-                            language: mainLanguage,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionLanguagePrivileges({
-                        language: mainLanguage,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchLanguage.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchLanguage, mainLanguage, "language", {
+                Grant: GrantLanguagePrivileges,
+                Revoke: RevokeLanguagePrivileges,
+                RevokeGrantOption: RevokeGrantOptionLanguagePrivileges,
+            }, ctx.version));
         }
     }
     return changes;