@supabase/pg-delta 1.0.0-alpha.4 → 1.0.0-alpha.6

package/dist/core/objects/table/changes/table.create.js

@@ -64,6 +64,9 @@ export class CreateTable extends CreateTableChange {
                     }
                 }
             }
+            // Function dependencies from DEFAULT expressions are handled by pg_depend
+            // catalog constraints in the sort pipeline, which provides exact argument
+            // types and covers all expression contexts (not just column defaults).
         }
         return Array.from(dependencies);
     }

package/dist/core/objects/table/table.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { TableChange } from "./changes/table.types.ts";
 import { Table } from "./table.model.ts";
 /**
@@ -10,9 +9,4 @@ import { Table } from "./table.model.ts";
  * @param branch - The tables in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffTables(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Table>, branch: Record<string, Table>): TableChange[];
+export declare function diffTables(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Table>, branch: Record<string, Table>): TableChange[];

package/dist/core/objects/table/table.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByColumns, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitColumnPrivilegeChanges, } from "../base.privilege-diff.js";
 import { deepEqual } from "../utils.js";
 import { AlterTableAddColumn, AlterTableAddConstraint, AlterTableAlterColumnDropDefault, AlterTableAlterColumnDropNotNull, AlterTableAlterColumnSetDefault, AlterTableAlterColumnSetNotNull, AlterTableAlterColumnType, AlterTableAttachPartition, AlterTableChangeOwner, AlterTableDetachPartition, AlterTableDisableRowLevelSecurity, AlterTableDropColumn, AlterTableDropConstraint, AlterTableEnableRowLevelSecurity, AlterTableForceRowLevelSecurity, AlterTableNoForceRowLevelSecurity, AlterTableResetStorageParams, AlterTableSetLogged, AlterTableSetReplicaIdentity, AlterTableSetStorageParams, AlterTableSetUnlogged, AlterTableValidateConstraint, } from "./changes/table.alter.js";
 import { CreateCommentOnColumn, CreateCommentOnConstraint, CreateCommentOnTable, DropCommentOnColumn, DropCommentOnConstraint, DropCommentOnTable, } from "./changes/table.comment.js";
@@ -149,6 +149,16 @@ export function diffTables(ctx, main, branch) {
         if (branchTable.force_row_security) {
             changes.push(new AlterTableForceRowLevelSecurity({ table: branchTable }));
         }
+        // REPLICA IDENTITY: If non-default, emit ALTER TABLE ... REPLICA IDENTITY
+        if (branchTable.replica_identity !== "d") {
+            // Skip 'i' (USING INDEX) — handled by index changes
+            if (branchTable.replica_identity !== "i") {
+                changes.push(new AlterTableSetReplicaIdentity({
+                    table: branchTable,
+                    mode: branchTable.replica_identity,
+                }));
+            }
+        }
         changes.push(...createAlterConstraintChange(
         // Create a dummy table with no constraints do diff constraints against
         new Table({
@@ -171,86 +181,18 @@ export function diffTables(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "table", branchTable.schema ?? "");
+        const creatorFilteredDefaults = branchTable.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = branchTable.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the table owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, branchTable.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByColumns(result.grants);
-                for (const [, group] of grantGroups) {
-                    for (const [grantable, privSet] of group.byGrant) {
-                        const privileges = Array.from(privSet).map((priv) => ({
-                            privilege: priv,
-                            grantable,
-                        }));
-                        changes.push(new GrantTablePrivileges({
-                            table: branchTable,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                for (const [, group] of revokeGroups) {
-                    const allPrivileges = new Set();
-                    for (const [, privSet] of group.byGrant) {
-                        for (const priv of privSet) {
-                            allPrivileges.add(priv);
-                        }
-                    }
-                    const privileges = Array.from(allPrivileges).map((priv) => ({
-                        privilege: priv,
-                        grantable: false,
-                    }));
-                    changes.push(new RevokeTablePrivileges({
-                        table: branchTable,
-                        grantee,
-                        privileges,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                const revokeGrantGroups = new Map();
-                for (const r of result.revokeGrantOption) {
-                    const originalPriv = effectiveDefaults.find((p) => p.grantee === grantee && p.privilege === r);
-                    const key = originalPriv?.columns
-                        ? originalPriv.columns.sort().join(",")
-                        : "";
-                    if (!revokeGrantGroups.has(key)) {
-                        revokeGrantGroups.set(key, {
-                            columns: originalPriv?.columns
-                                ? [...originalPriv.columns]
-                                : undefined,
-                            privileges: new Set(),
-                        });
-                    }
-                    const group = revokeGrantGroups.get(key);
-                    if (!group)
-                        continue;
-                    group.privileges.add(r);
-                }
-                for (const [, group] of revokeGrantGroups) {
-                    const privilegeNames = Array.from(group.privileges);
-                    changes.push(new RevokeGrantOptionTablePrivileges({
-                        table: branchTable,
-                        grantee,
-                        privilegeNames,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, branchTable.owner);
+        changes.push(...emitColumnPrivilegeChanges(privilegeResults, branchTable, branchTable, "table", {
+            Grant: GrantTablePrivileges,
+            Revoke: RevokeTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionTablePrivileges,
+        }, effectiveDefaults, ctx.version));
     }
     for (const tableId of dropped) {
         changes.push(new DropTable({ table: main[tableId] }));
@@ -584,85 +526,12 @@ export function diffTables(ctx, main, branch) {
         // PRIVILEGES (unified object and column privileges)
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainTable.privileges, branchTable.privileges, branchTable.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByColumns(result.grants);
-                for (const [, group] of grantGroups) {
-                    for (const [grantable, privSet] of group.byGrant) {
-                        const privileges = Array.from(privSet).map((priv) => ({
-                            privilege: priv,
-                            grantable,
-                        }));
-                        changes.push(new GrantTablePrivileges({
-                            table: branchTable,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                for (const [, group] of revokeGroups) {
-                    // Collapse all grantable groups into a single revoke (grantable: false)
-                    const allPrivileges = new Set();
-                    for (const [, privSet] of group.byGrant) {
-                        for (const priv of privSet) {
-                            allPrivileges.add(priv);
-                        }
-                    }
-                    const privileges = Array.from(allPrivileges).map((priv) => ({
-                        privilege: priv,
-                        grantable: false,
-                    }));
-                    changes.push(new RevokeTablePrivileges({
-                        table: mainTable,
-                        grantee,
-                        privileges,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                const revokeGrantGroups = new Map();
-                for (const r of result.revokeGrantOption) {
-                    // For revoke grant option, we need to find the columns from the original privilege
-                    const originalPriv = mainTable.privileges.find((p) => p.grantee === grantee && p.privilege === r);
-                    const key = originalPriv?.columns
-                        ? originalPriv.columns.sort().join(",")
-                        : "";
-                    if (!revokeGrantGroups.has(key)) {
-                        revokeGrantGroups.set(key, {
-                            columns: originalPriv?.columns
-                                ? [...originalPriv.columns]
-                                : undefined,
-                            privileges: new Set(),
-                        });
-                    }
-                    const group = revokeGrantGroups.get(key);
-                    if (!group)
-                        continue;
-                    group.privileges.add(r);
-                }
-                for (const [, group] of revokeGrantGroups) {
-                    const privilegeNames = Array.from(group.privileges);
-                    changes.push(new RevokeGrantOptionTablePrivileges({
-                        table: mainTable,
-                        grantee,
-                        privilegeNames,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-        }
+        const privilegeResults = diffPrivileges(mainTable.privileges, branchTable.privileges, branchTable.owner);
+        changes.push(...emitColumnPrivilegeChanges(privilegeResults, branchTable, mainTable, "table", {
+            Grant: GrantTablePrivileges,
+            Revoke: RevokeTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionTablePrivileges,
+        }, mainTable.privileges, ctx.version));
     }
     return changes;
 }

package/dist/core/objects/table/table.model.d.ts

@@ -3,19 +3,19 @@ import z from "zod";
 import { BasePgModel, type TableLikeObject } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
 export declare const ReplicaIdentitySchema: z.ZodEnum<{
-    f: "f";
     n: "n";
     i: "i";
     d: "d";
+    f: "f";
 }>;
 declare const tableConstraintPropsSchema: z.ZodObject<{
     name: z.ZodString;
     constraint_type: z.ZodEnum<{
-        f: "f";
         u: "u";
         t: "t";
-        p: "p";
         c: "c";
+        p: "p";
+        f: "f";
         x: "x";
     }>;
     deferrable: z.ZodBoolean;
@@ -38,24 +38,24 @@ declare const tableConstraintPropsSchema: z.ZodObject<{
     foreign_key_effective_schema: z.ZodNullable<z.ZodString>;
     foreign_key_effective_table: z.ZodNullable<z.ZodString>;
     on_update: z.ZodNullable<z.ZodEnum<{
-        r: "r";
         n: "n";
         a: "a";
+        r: "r";
         d: "d";
         c: "c";
     }>>;
     on_delete: z.ZodNullable<z.ZodEnum<{
-        r: "r";
         n: "n";
         a: "a";
+        r: "r";
         d: "d";
         c: "c";
     }>>;
     match_type: z.ZodNullable<z.ZodEnum<{
-        f: "f";
         u: "u";
         s: "s";
         p: "p";
+        f: "f";
     }>>;
     check_expression: z.ZodNullable<z.ZodString>;
     owner: z.ZodString;
@@ -79,10 +79,10 @@ declare const tablePropsSchema: z.ZodObject<{
     has_subclasses: z.ZodBoolean;
     is_populated: z.ZodBoolean;
     replica_identity: z.ZodEnum<{
-        f: "f";
         n: "n";
         i: "i";
         d: "d";
+        f: "f";
     }>;
     is_partition: z.ZodBoolean;
     options: z.ZodNullable<z.ZodArray<z.ZodString>>;
@@ -113,11 +113,11 @@ declare const tablePropsSchema: z.ZodObject<{
     constraints: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         constraint_type: z.ZodEnum<{
-            f: "f";
             u: "u";
             t: "t";
-            p: "p";
             c: "c";
+            p: "p";
+            f: "f";
             x: "x";
         }>;
         deferrable: z.ZodBoolean;
@@ -140,24 +140,24 @@ declare const tablePropsSchema: z.ZodObject<{
         foreign_key_effective_schema: z.ZodNullable<z.ZodString>;
         foreign_key_effective_table: z.ZodNullable<z.ZodString>;
         on_update: z.ZodNullable<z.ZodEnum<{
-            r: "r";
             n: "n";
             a: "a";
+            r: "r";
             d: "d";
             c: "c";
         }>>;
         on_delete: z.ZodNullable<z.ZodEnum<{
-            r: "r";
             n: "n";
             a: "a";
+            r: "r";
             d: "d";
             c: "c";
         }>>;
         match_type: z.ZodNullable<z.ZodEnum<{
-            f: "f";
             u: "u";
             s: "s";
             p: "p";
+            f: "f";
         }>>;
         check_expression: z.ZodNullable<z.ZodString>;
         owner: z.ZodString;
@@ -206,7 +206,7 @@ export declare class Table extends BasePgModel implements TableLikeObject {
         persistence: "u" | "t" | "p";
         row_security: boolean;
         force_row_security: boolean;
-        replica_identity: "f" | "n" | "i" | "d";
+        replica_identity: "n" | "i" | "d" | "f";
         options: string[] | null;
         parent_schema: string | null;
         parent_name: string | null;
@@ -233,7 +233,7 @@ export declare class Table extends BasePgModel implements TableLikeObject {
         }[];
         constraints: {
             name: string;
-            constraint_type: "f" | "u" | "t" | "p" | "c" | "x";
+            constraint_type: "u" | "t" | "c" | "p" | "f" | "x";
             deferrable: boolean;
             initially_deferred: boolean;
             validated: boolean;
@@ -253,9 +253,9 @@ export declare class Table extends BasePgModel implements TableLikeObject {
             foreign_key_parent_table: string | null;
             foreign_key_effective_schema: string | null;
             foreign_key_effective_table: string | null;
-            on_update: "r" | "n" | "a" | "d" | "c" | null;
-            on_delete: "r" | "n" | "a" | "d" | "c" | null;
-            match_type: "f" | "u" | "s" | "p" | null;
+            on_update: "n" | "a" | "r" | "d" | "c" | null;
+            on_delete: "n" | "a" | "r" | "d" | "c" | null;
+            match_type: "u" | "s" | "p" | "f" | null;
             check_expression: string | null;
             owner: string;
             definition: string;
@@ -294,7 +294,7 @@ export declare class Table extends BasePgModel implements TableLikeObject {
             options: string[] | null;
             constraints: {
                 name: string;
-                constraint_type: "f" | "u" | "t" | "p" | "c" | "x";
+                constraint_type: "u" | "t" | "c" | "p" | "f" | "x";
                 deferrable: boolean;
                 initially_deferred: boolean;
                 validated: boolean;
@@ -314,9 +314,9 @@ export declare class Table extends BasePgModel implements TableLikeObject {
                 foreign_key_parent_table: string | null;
                 foreign_key_effective_schema: string | null;
                 foreign_key_effective_table: string | null;
-                on_update: "r" | "n" | "a" | "d" | "c" | null;
-                on_delete: "r" | "n" | "a" | "d" | "c" | null;
-                match_type: "f" | "u" | "s" | "p" | null;
+                on_update: "n" | "a" | "r" | "d" | "c" | null;
+                on_delete: "n" | "a" | "r" | "d" | "c" | null;
+                match_type: "u" | "s" | "p" | "f" | null;
                 check_expression: string | null;
                 owner: string;
                 definition: string;
@@ -326,11 +326,12 @@ export declare class Table extends BasePgModel implements TableLikeObject {
                 grantee: string;
                 privilege: string;
                 grantable: boolean;
+                columns: string[] | null | undefined;
             }[];
             persistence: "u" | "t" | "p";
             row_security: boolean;
             force_row_security: boolean;
-            replica_identity: "f" | "n" | "i" | "d";
+            replica_identity: "n" | "i" | "d" | "f";
             parent_schema: string | null;
             parent_name: string | null;
             partition_bound: string | null;

package/dist/core/objects/table/table.model.js

@@ -397,7 +397,7 @@ select
       from (
         -- one row for object ACL + one row per column ACL
         select null::name as attname, t.oid as relacl_oid, (
-          select c_rel.relacl from pg_class c_rel where c_rel.oid = t.oid
+          select COALESCE(c_rel.relacl, acldefault('r', c_rel.relowner)) from pg_class c_rel where c_rel.oid = t.oid
         ) as acl
         union all
         select a2.attname, t.oid as relacl_oid, a2.attacl

package/dist/core/objects/trigger/changes/trigger.create.js

@@ -45,10 +45,8 @@ export class CreateTrigger extends CreateTriggerChange {
         // Table dependency
         dependencies.add(stableId.table(this.trigger.schema, this.trigger.table_name));
         // Function dependency
-        // Note: We can't build the exact procedure stableId without argument types.
-        // The trigger definition contains the full function call, but parsing it would be complex.
-        // For now, we rely on pg_depend extraction for procedure dependencies.
-        // If needed, we could parse the trigger definition to extract the full function signature.
+        // Trigger functions always have signature () RETURNS trigger, so no arguments.
+        dependencies.add(stableId.procedure(this.trigger.function_schema, this.trigger.function_name));
         // Owner dependency
         dependencies.add(stableId.role(this.trigger.owner));
         return Array.from(dependencies);

package/dist/core/objects/trigger/trigger.model.d.ts

@@ -5,6 +5,13 @@ declare const triggerPropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
     table_name: z.ZodString;
+    table_relkind: z.ZodEnum<{
+        r: "r";
+        v: "v";
+        m: "m";
+        p: "p";
+        f: "f";
+    }>;
     function_schema: z.ZodString;
     function_name: z.ZodString;
     trigger_type: z.ZodNumber;
@@ -37,6 +44,7 @@ export declare class Trigger extends BasePgModel {
     readonly schema: TriggerProps["schema"];
     readonly name: TriggerProps["name"];
     readonly table_name: TriggerProps["table_name"];
+    readonly table_relkind: TriggerProps["table_relkind"];
     readonly function_schema: TriggerProps["function_schema"];
     readonly function_name: TriggerProps["function_name"];
     readonly trigger_type: TriggerProps["trigger_type"];

package/dist/core/objects/trigger/trigger.model.js

@@ -7,10 +7,18 @@ const TriggerEnabledSchema = z.enum([
     "R", // REPLICA - trigger fires only in "replica" mode
     "A", // ALWAYS - trigger fires regardless of replication mode
 ]);
+const TriggerTableRelkindSchema = z.enum([
+    "r", // ordinary table
+    "p", // partitioned table
+    "f", // foreign table
+    "v", // view
+    "m", // materialized view
+]);
 const triggerPropsSchema = z.object({
     schema: z.string(),
     name: z.string(),
     table_name: z.string(),
+    table_relkind: TriggerTableRelkindSchema,
     function_schema: z.string(),
     function_name: z.string(),
     trigger_type: z.number(),
@@ -37,6 +45,7 @@ export class Trigger extends BasePgModel {
     schema;
     name;
     table_name;
+    table_relkind;
     function_schema;
     function_name;
     trigger_type;
@@ -64,6 +73,7 @@ export class Trigger extends BasePgModel {
         this.schema = props.schema;
         this.name = props.name;
         this.table_name = props.table_name;
+        this.table_relkind = props.table_relkind;
         // Data fields
         this.function_schema = props.function_schema;
         this.function_name = props.function_name;
@@ -150,6 +160,7 @@ export async function extractTriggers(pool) {
         tc.relnamespace::regnamespace::text as schema,
         quote_ident(t.tgname)               as name,
         quote_ident(tc.relname)             as table_name,
+        tc.relkind                          as table_relkind,
 
         fc.pronamespace::regnamespace::text as function_schema,
         quote_ident(fc.proname)             as function_name,

package/dist/core/objects/type/composite-type/composite-type.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import type { CompositeTypeChange } from "./changes/composite-type.types.ts";
 import type { CompositeType } from "./composite-type.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { CompositeType } from "./composite-type.model.ts";
  * @param branch - The composite types in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffCompositeTypes(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, CompositeType>, branch: Record<string, CompositeType>): CompositeTypeChange[];
+export declare function diffCompositeTypes(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, CompositeType>, branch: Record<string, CompositeType>): CompositeTypeChange[];

package/dist/core/objects/type/composite-type/composite-type.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
 import { deepEqual, hasNonAlterableChanges } from "../../utils.js";
 import { AlterCompositeTypeAddAttribute, AlterCompositeTypeAlterAttributeType, AlterCompositeTypeChangeOwner, AlterCompositeTypeDropAttribute, } from "./changes/composite-type.alter.js";
 import { CreateCommentOnCompositeType, CreateCommentOnCompositeTypeAttribute, DropCommentOnCompositeType, DropCommentOnCompositeTypeAttribute, } from "./changes/composite-type.comment.js";
@@ -47,50 +47,21 @@ export function diffCompositeTypes(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "composite_type", ct.schema ?? "");
+        const creatorFilteredDefaults = ct.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         // Filter out PUBLIC's built-in default USAGE privilege (PostgreSQL grants it automatically)
         // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
         // This prevents generating unnecessary "GRANT USAGE TO PUBLIC" statements
         const desiredPrivileges = filterPublicBuiltInDefaults("composite_type", ct.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the composite type owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, ct.owner);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantCompositeTypePrivileges({
-                        compositeType: ct,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeCompositeTypePrivileges({
-                        compositeType: ct,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionCompositeTypePrivileges({
-                    compositeType: ct,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("composite_type", creatorFilteredDefaults), desiredPrivileges, ct.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, ct, ct, "compositeType", {
+            Grant: GrantCompositeTypePrivileges,
+            Revoke: RevokeCompositeTypePrivileges,
+            RevokeGrantOption: RevokeGrantOptionCompositeTypePrivileges,
+        }, ctx.version));
     }
     for (const compositeTypeId of dropped) {
         changes.push(new DropCompositeType({ compositeType: main[compositeTypeId] }));
@@ -203,44 +174,12 @@ export function diffCompositeTypes(ctx, main, branch) {
             const branchPrivilegesFiltered = filterPublicBuiltInDefaults("composite_type", branchCompositeType.privileges);
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchCompositeType.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantCompositeTypePrivileges({
-                            compositeType: branchCompositeType,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeCompositeTypePrivileges({
-                            compositeType: mainCompositeType,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionCompositeTypePrivileges({
-                        compositeType: mainCompositeType,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchCompositeType.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchCompositeType, mainCompositeType, "compositeType", {
+                Grant: GrantCompositeTypePrivileges,
+                Revoke: RevokeCompositeTypePrivileges,
+                RevokeGrantOption: RevokeGrantOptionCompositeTypePrivileges,
+            }, ctx.version));
             // Note: Composite type renaming would also use ALTER TYPE ... RENAME TO ...
             // But since our CompositeType model uses 'name' as the identity field,
             // a name change would be handled as drop + create by diffObjects()