@supabase/pg-delta 1.0.0-alpha.4 → 1.0.0-alpha.6

package/dist/core/objects/rls-policy/changes/rls-policy.alter.js

@@ -21,7 +21,7 @@ export class AlterRlsPolicySetRoles extends AlterRlsPolicyChange {
         const rolesSql = toPublic ? "PUBLIC" : targetRoles.join(", ");
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "TO",
@@ -48,7 +48,7 @@ export class AlterRlsPolicySetUsingExpression extends AlterRlsPolicyChange {
         const expr = this.usingExpression ?? "true";
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "USING",
@@ -75,7 +75,7 @@ export class AlterRlsPolicySetWithCheckExpression extends AlterRlsPolicyChange {
         const expr = this.withCheckExpression ?? "true";
         return [
             "ALTER POLICY",
-            `${this.policy.schema}.${this.policy.name}`,
+            this.policy.name,
             "ON",
             `${this.policy.schema}.${this.policy.table_name}`,
             "WITH CHECK",

package/dist/core/objects/rls-policy/rls-policy.model.d.ts

@@ -6,9 +6,9 @@ declare const rlsPolicyPropsSchema: z.ZodObject<{
     name: z.ZodString;
     table_name: z.ZodString;
     command: z.ZodEnum<{
+        a: "a";
         r: "r";
         w: "w";
-        a: "a";
         d: "d";
         "*": "*";
     }>;
@@ -39,7 +39,7 @@ export declare class RlsPolicy extends BasePgModel {
         name: string;
     };
     get dataFields(): {
-        command: "r" | "w" | "a" | "d" | "*";
+        command: "a" | "r" | "w" | "d" | "*";
         permissive: boolean;
         roles: string[];
         using_expression: string | null;

package/dist/core/objects/role/role.diff.js

@@ -31,8 +31,15 @@ export function diffRoles(ctx, main, branch) {
         if (role.comment !== null) {
             changes.push(new CreateCommentOnRole({ role }));
         }
-        // MEMBERSHIPS: Grant memberships immediately after role creation
+        // MEMBERSHIPS: Grant memberships immediately after role creation.
+        // Members are already deduplicated by the Role model constructor.
         for (const membership of role.members) {
+            // Skip memberships where the member is the grantor (auto-created by
+            // CREATE ROLE — re-granting them, especially WITH ADMIN OPTION, fails
+            // with "ADMIN option cannot be granted back to your own grantor").
+            if (membership.grantor === membership.member) {
+                continue;
+            }
             changes.push(new GrantRoleMembership({
                 role,
                 member: membership.member,
@@ -45,6 +52,8 @@ export function diffRoles(ctx, main, branch) {
         }
         // DEFAULT PRIVILEGES: Grant default privileges immediately after role creation
         for (const defaultPriv of role.default_privileges) {
+            if (defaultPriv.is_implicit)
+                continue;
             if (defaultPriv.privileges.length === 0)
                 continue;
             const grantGroups = new Map();
@@ -163,11 +172,18 @@ export function diffRoles(ctx, main, branch) {
             }
         }
         // MEMBERSHIPS
+        // Members are already deduplicated by the Role model constructor.
         const mainMembers = new Map(mainRole.members.map((m) => [m.member, m]));
         const branchMembers = new Map(branchRole.members.map((m) => [m.member, m]));
         // Find new members to grant
         for (const [member, membership] of branchMembers) {
             if (!mainMembers.has(member)) {
+                // Skip memberships where the member is the grantor (auto-created by
+                // CREATE ROLE — re-granting them fails with "ADMIN option cannot be
+                // granted back to your own grantor").
+                if (membership.grantor === membership.member) {
+                    continue;
+                }
                 changes.push(new GrantRoleMembership({
                     role: branchRole,
                     member: membership.member,
@@ -224,6 +240,11 @@ export function diffRoles(ctx, main, branch) {
                     }));
                 }
                 if (toGrant.admin || toGrant.inherit || toGrant.set) {
+                    // Skip granting options back to the grantor (same restriction as
+                    // for newly created roles).
+                    if (branchMembership.grantor === branchMembership.member) {
+                        continue;
+                    }
                     changes.push(new GrantRoleMembership({
                         role: branchRole,
                         member: branchMembership.member,

package/dist/core/objects/role/role.model.d.ts

@@ -23,17 +23,18 @@ declare const rolePropsSchema: z.ZodObject<{
     default_privileges: z.ZodArray<z.ZodObject<{
         in_schema: z.ZodNullable<z.ZodString>;
         objtype: z.ZodEnum<{
+            n: "n";
             r: "r";
-            S: "S";
             f: "f";
+            S: "S";
             T: "T";
-            n: "n";
         }>;
         grantee: z.ZodString;
         privileges: z.ZodArray<z.ZodObject<{
             privilege: z.ZodString;
             grantable: z.ZodBoolean;
         }, z.z.core.$strip>>;
+        is_implicit: z.ZodBoolean;
     }, z.z.core.$strip>>;
 }, z.z.core.$strip>;
 export type RoleProps = z.infer<typeof rolePropsSchema>;
@@ -80,7 +81,7 @@ export declare class Role extends BasePgModel {
                 grantable: boolean;
             }[];
             in_schema: string | null;
-            objtype: "r" | "S" | "f" | "T" | "n";
+            objtype: "n" | "r" | "f" | "S" | "T";
             grantee: string;
         }[];
     };

package/dist/core/objects/role/role.model.js

@@ -13,6 +13,7 @@ const defaultPrivilegeSchema = z.object({
     objtype: z.enum(["r", "S", "f", "T", "n"]),
     grantee: z.string(),
     privileges: z.array(z.object({ privilege: z.string(), grantable: z.boolean() })),
+    is_implicit: z.boolean(),
 });
 const rolePropsSchema = z.object({
     name: z.string(),
@@ -58,7 +59,7 @@ export class Role extends BasePgModel {
         this.can_bypass_rls = props.can_bypass_rls;
         this.config = props.config;
         this.comment = props.comment;
-        this.members = props.members;
+        this.members = deduplicateMembers(props.members);
         this.default_privileges = props.default_privileges;
     }
     get stableId() {
@@ -77,13 +78,16 @@ export class Role extends BasePgModel {
                 Number(a.inherit_option ?? false) - Number(b.inherit_option ?? false) ||
                 Number(a.set_option ?? false) - Number(b.set_option ?? false));
         });
-        const sortedDefaultPrivs = [...this.default_privileges].map((dp) => ({
-            ...dp,
-            privileges: [...dp.privileges].sort((a, b) => {
-                return (a.privilege.localeCompare(b.privilege) ||
-                    Number(a.grantable) - Number(b.grantable));
-            }),
-        }));
+        const sortedDefaultPrivs = [...this.default_privileges].map((dp) => {
+            const { is_implicit: _, ...rest } = dp;
+            return {
+                ...rest,
+                privileges: [...dp.privileges].sort((a, b) => {
+                    return (a.privilege.localeCompare(b.privilege) ||
+                        Number(a.grantable) - Number(b.grantable));
+                }),
+            };
+        });
         sortedDefaultPrivs.sort((a, b) => {
             return ((a.in_schema ?? "").localeCompare(b.in_schema ?? "") ||
                 a.objtype.localeCompare(b.objtype) ||
@@ -105,6 +109,46 @@ export class Role extends BasePgModel {
         };
     }
 }
+/**
+ * Deduplicate members by member name.
+ *
+ * In PostgreSQL 16+, `pg_auth_members` can have multiple rows for the same
+ * (roleid, member) pair with different grantors. Merge them into a single
+ * entry per member, combining options with OR so the most permissive wins.
+ *
+ * When merging, prefer a non-self grantor (grantor !== member) so that
+ * downstream code can detect true self-grants (auto-created by CREATE ROLE)
+ * by checking `grantor === member`.
+ */
+function deduplicateMembers(members) {
+    const map = new Map();
+    for (const m of members) {
+        const existing = map.get(m.member);
+        if (existing) {
+            // admin_option is always boolean (non-nullable in schema)
+            existing.admin_option = existing.admin_option || m.admin_option;
+            // inherit_option and set_option are nullish (only available in PG 16+)
+            if (m.inherit_option != null) {
+                existing.inherit_option =
+                    (existing.inherit_option ?? false) || m.inherit_option;
+            }
+            if (m.set_option != null) {
+                existing.set_option = (existing.set_option ?? false) || m.set_option;
+            }
+            // Prefer a non-self grantor so diff can detect true self-grants.
+            // Once a non-self grantor is chosen the value is kept (the specific
+            // non-self grantor doesn't matter — only the self vs non-self
+            // distinction is used downstream).
+            if (existing.grantor === existing.member && m.grantor !== m.member) {
+                existing.grantor = m.grantor;
+            }
+        }
+        else {
+            map.set(m.member, { ...m });
+        }
+    }
+    return [...map.values()];
+}
 export async function extractRoles(pool) {
     // Check PostgreSQL version capabilities for membership options
     const { rows: capabilitiesRows } = await pool.query(sql `
@@ -172,13 +216,15 @@ export async function extractRoles(pool) {
                                     THEN 'PUBLIC'
                                     ELSE s.grantee::regrole::text
                             END,
-                          'privileges', s.privileges
+                          'privileges', s.privileges,
+                          'is_implicit', s.is_implicit
                         )
                         ORDER BY s.defaclnamespace NULLS FIRST,
                                   s.defaclobjtype,
                                   s.grantee
                       )
                 FROM (
+                  -- Explicit entries from pg_default_acl
                   SELECT
                     d.defaclnamespace,
                     d.defaclobjtype,
@@ -189,12 +235,41 @@ export async function extractRoles(pool) {
                         'grantable',  x.is_grantable
                       )
                       ORDER BY x.privilege_type, x.is_grantable
-                    ) AS privileges
+                    ) AS privileges,
+                    false AS is_implicit
                   FROM pg_default_acl d
                   CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
                     AS x(grantor, grantee, privilege_type, is_grantable)
                   WHERE d.defaclrole = r.oid
                   GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                  UNION ALL
+                  -- Implicit defaults from acldefault() for objtypes without a
+                  -- global pg_default_acl entry.  PostgreSQL applies these implicit
+                  -- defaults (e.g. PUBLIC gets EXECUTE on functions) when no
+                  -- explicit ALTER DEFAULT PRIVILEGES has been issued.  Including
+                  -- them lets the diff detect REVOKEs of implicit grants.
+                  SELECT
+                    0 AS defaclnamespace,
+                    v.t::"char" AS defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges,
+                    true AS is_implicit
+                  FROM (VALUES ('r'), ('S'), ('f'), ('T'), ('n')) AS v(t)
+                  CROSS JOIN LATERAL aclexplode(acldefault(v.t::"char", r.oid))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE NOT EXISTS (
+                    SELECT 1 FROM pg_default_acl d2
+                    WHERE d2.defaclrole     = r.oid
+                      AND d2.defaclobjtype  = v.t::"char"
+                      AND d2.defaclnamespace = 0
+                  )
+                  GROUP BY v.t, x.grantee
                 ) AS s
               ),
               '[]'
@@ -263,13 +338,15 @@ export async function extractRoles(pool) {
                                     THEN 'PUBLIC'
                                     ELSE s.grantee::regrole::text
                             END,
-                          'privileges', s.privileges
+                          'privileges', s.privileges,
+                          'is_implicit', s.is_implicit
                         )
                         ORDER BY s.defaclnamespace NULLS FIRST,
                                   s.defaclobjtype,
                                   s.grantee
                       )
                 FROM (
+                  -- Explicit entries from pg_default_acl
                   SELECT
                     d.defaclnamespace,
                     d.defaclobjtype,
@@ -280,12 +357,41 @@ export async function extractRoles(pool) {
                         'grantable',  x.is_grantable
                       )
                       ORDER BY x.privilege_type, x.is_grantable
-                    ) AS privileges
+                    ) AS privileges,
+                    false AS is_implicit
                   FROM pg_default_acl d
                   CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
                     AS x(grantor, grantee, privilege_type, is_grantable)
                   WHERE d.defaclrole = r.oid
                   GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                  UNION ALL
+                  -- Implicit defaults from acldefault() for objtypes without a
+                  -- global pg_default_acl entry.  PostgreSQL applies these implicit
+                  -- defaults (e.g. PUBLIC gets EXECUTE on functions) when no
+                  -- explicit ALTER DEFAULT PRIVILEGES has been issued.  Including
+                  -- them lets the diff detect REVOKEs of implicit grants.
+                  SELECT
+                    0 AS defaclnamespace,
+                    v.t::"char" AS defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges,
+                    true AS is_implicit
+                  FROM (VALUES ('r'), ('S'), ('f'), ('T'), ('n')) AS v(t)
+                  CROSS JOIN LATERAL aclexplode(acldefault(v.t::"char", r.oid))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE NOT EXISTS (
+                    SELECT 1 FROM pg_default_acl d2
+                    WHERE d2.defaclrole     = r.oid
+                      AND d2.defaclobjtype  = v.t::"char"
+                      AND d2.defaclnamespace = 0
+                  )
+                  GROUP BY v.t, x.grantee
                 ) AS s
               ),
               '[]'

package/dist/core/objects/rule/rule.model.d.ts

@@ -13,10 +13,10 @@ declare const rulePropsSchema: z.ZodObject<{
     table_name: z.ZodString;
     relation_kind: z.ZodEnum<{
         r: "r";
-        f: "f";
         v: "v";
         m: "m";
         p: "p";
+        f: "f";
     }>;
     event: z.ZodEnum<{
         DELETE: "DELETE";

package/dist/core/objects/schema/schema.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { SchemaChange } from "./changes/schema.types.ts";
 import type { Schema } from "./schema.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { Schema } from "./schema.model.ts";
  * @param branch - The schemas in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffSchemas(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Schema>, branch: Record<string, Schema>): SchemaChange[];
+export declare function diffSchemas(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Schema>, branch: Record<string, Schema>): SchemaChange[];

package/dist/core/objects/schema/schema.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, } from "../base.privilege-diff.js";
 import { AlterSchemaChangeOwner } from "./changes/schema.alter.js";
 import { CreateCommentOnSchema, DropCommentOnSchema, } from "./changes/schema.comment.js";
 import { CreateSchema } from "./changes/schema.create.js";
@@ -29,47 +29,18 @@ export function diffSchemas(ctx, main, branch) {
         // needed to reach the final desired state.
         // Note: Schemas don't have a schema property, so we pass empty string
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "schema", "");
+        const creatorFilteredDefaults = sc.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = sc.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the schema owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, sc.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantSchemaPrivileges({
-                        schema: sc,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeSchemaPrivileges({
-                        schema: sc,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionSchemaPrivileges({
-                    schema: sc,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, sc.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, sc, sc, "schema", {
+            Grant: GrantSchemaPrivileges,
+            Revoke: RevokeSchemaPrivileges,
+            RevokeGrantOption: RevokeGrantOptionSchemaPrivileges,
+        }, ctx.version));
     }
     for (const schemaId of dropped) {
         changes.push(new DropSchema({ schema: main[schemaId] }));
@@ -96,44 +67,12 @@ export function diffSchemas(ctx, main, branch) {
         // PRIVILEGES
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainSchema.privileges, branchSchema.privileges, branchSchema.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantSchemaPrivileges({
-                        schema: branchSchema,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeSchemaPrivileges({
-                        schema: mainSchema,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionSchemaPrivileges({
-                    schema: mainSchema,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainSchema.privileges, branchSchema.privileges, branchSchema.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchSchema, mainSchema, "schema", {
+            Grant: GrantSchemaPrivileges,
+            Revoke: RevokeSchemaPrivileges,
+            RevokeGrantOption: RevokeGrantOptionSchemaPrivileges,
+        }, ctx.version));
         // Note: Schema renaming would also use ALTER SCHEMA ... RENAME TO ...
         // But since our Schema model uses 'schema' as the identity field,
         // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/schema/schema.model.js

@@ -70,7 +70,7 @@ export async function extractSchemas(pool) {
             )
             order by x.grantee, x.privilege_type
           )
-          from lateral aclexplode(nspacl) as x(grantor, grantee, privilege_type, is_grantable)
+          from lateral aclexplode(COALESCE(nspacl, acldefault('n', nspowner))) as x(grantor, grantee, privilege_type, is_grantable)
         ), '[]'
       ) as privileges
     from

package/dist/core/objects/sequence/sequence.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { Table } from "../table/table.model.ts";
 import type { SequenceChange } from "./changes/sequence.types.ts";
 import type { Sequence } from "./sequence.model.ts";
@@ -12,9 +11,4 @@ import type { Sequence } from "./sequence.model.ts";
  * @param branchTables - The tables in the branch catalog (used to check if owning tables are being dropped).
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffSequences(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Sequence>, branch: Record<string, Sequence>, branchTables?: Record<string, Table>): SequenceChange[];
+export declare function diffSequences(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Sequence>, branch: Record<string, Sequence>, branchTables?: Record<string, Table>): SequenceChange[];

package/dist/core/objects/sequence/sequence.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, } from "../base.privilege-diff.js";
 import { hasNonAlterableChanges } from "../utils.js";
 import { AlterSequenceSetOptions, AlterSequenceSetOwnedBy, } from "./changes/sequence.alter.js";
 import { CreateCommentOnSequence, DropCommentOnSequence, } from "./changes/sequence.comment.js";
@@ -43,48 +43,18 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "sequence", createdSeq.schema ?? "");
+        const creatorFilteredDefaults = createdSeq.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = createdSeq.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the sequence owner as the reference.
-        // Superuser privileges are filtered inside diffPrivileges.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdSeq.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantSequencePrivileges({
-                        sequence: createdSeq,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeSequencePrivileges({
-                        sequence: createdSeq,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionSequencePrivileges({
-                    sequence: createdSeq,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, createdSeq.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdSeq, createdSeq, "sequence", {
+            Grant: GrantSequencePrivileges,
+            Revoke: RevokeSequencePrivileges,
+            RevokeGrantOption: RevokeGrantOptionSequencePrivileges,
+        }, ctx.version));
     }
     for (const sequenceId of dropped) {
         const sequence = main[sequenceId];
@@ -210,45 +180,12 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
             // PRIVILEGES
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            // Superuser privileges are filtered inside diffPrivileges.
-            const privilegeResults = diffPrivileges(mainSequence.privileges, branchSequence.privileges, branchSequence.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantSequencePrivileges({
-                            sequence: branchSequence,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeSequencePrivileges({
-                            sequence: mainSequence,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionSequencePrivileges({
-                        sequence: mainSequence,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(mainSequence.privileges, branchSequence.privileges, branchSequence.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchSequence, mainSequence, "sequence", {
+                Grant: GrantSequencePrivileges,
+                Revoke: RevokeSequencePrivileges,
+                RevokeGrantOption: RevokeGrantOptionSequencePrivileges,
+            }, ctx.version));
             // Note: Sequence renaming would also use ALTER SEQUENCE ... RENAME TO ...
             // But since our Sequence model uses 'name' as the identity field,
             // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/sequence/sequence.model.js

@@ -132,7 +132,7 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(c.relacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(c.relacl, acldefault('S', c.relowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges,
   c.relowner::regrole::text as owner

package/dist/core/objects/subscription/subscription.diff.d.ts

@@ -1,5 +1,4 @@
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { SubscriptionChange } from "./changes/subscription.types.ts";
 import type { Subscription } from "./subscription.model.ts";
-export declare function diffSubscriptions(ctx: {
-    currentUser: string;
-}, main: Record<string, Subscription>, branch: Record<string, Subscription>): SubscriptionChange[];
+export declare function diffSubscriptions(ctx: Pick<ObjectDiffContext, "currentUser">, main: Record<string, Subscription>, branch: Record<string, Subscription>): SubscriptionChange[];