@supabase/pg-delta 1.0.0-alpha.4 → 1.0.0-alpha.6

package/dist/core/objects/type/composite-type/composite-type.model.d.ts

@@ -13,10 +13,10 @@ declare const compositeTypePropsSchema: z.ZodObject<{
     has_subclasses: z.ZodBoolean;
     is_populated: z.ZodBoolean;
     replica_identity: z.ZodEnum<{
-        f: "f";
         n: "n";
         i: "i";
         d: "d";
+        f: "f";
     }>;
     is_partition: z.ZodBoolean;
     options: z.ZodNullable<z.ZodArray<z.ZodString>>;
@@ -82,7 +82,7 @@ export declare class CompositeType extends BasePgModel implements TableLikeObjec
         has_triggers: boolean;
         has_subclasses: boolean;
         is_populated: boolean;
-        replica_identity: "f" | "n" | "i" | "d";
+        replica_identity: "n" | "i" | "d" | "f";
         is_partition: boolean;
         options: string[] | null;
         partition_bound: string | null;
@@ -129,7 +129,7 @@ export declare class CompositeType extends BasePgModel implements TableLikeObjec
             has_triggers: boolean;
             has_subclasses: boolean;
             is_populated: boolean;
-            replica_identity: "f" | "n" | "i" | "d";
+            replica_identity: "n" | "i" | "d" | "f";
             is_partition: boolean;
             options: string[] | null;
             partition_bound: string | null;

package/dist/core/objects/type/composite-type/composite-type.model.js

@@ -136,6 +136,7 @@ export async function extractCompositeTypes(pool) {
           c.relowner::regrole::text           AS owner,
           obj_description(c.reltype, 'pg_type') AS comment,
           c.relacl                            AS relacl,    -- used by privileges LATERAL
+          c.relowner                          AS relowner,
           c.oid                                AS oid
         FROM pg_catalog.pg_class c
         LEFT JOIN extension_oids e ON c.reltype = e.objid
@@ -173,7 +174,7 @@ export async function extractCompositeTypes(pool) {
                 )
                 ORDER BY x.grantee, x.privilege_type
               ) AS privileges
-        FROM LATERAL aclexplode(ct.relacl) AS x(grantor, grantee, privilege_type, is_grantable)
+        FROM LATERAL aclexplode(COALESCE(ct.relacl, acldefault('T', ct.relowner))) AS x(grantor, grantee, privilege_type, is_grantable)
       ) priv ON TRUE
 
       -- columns as a per-row LATERAL subquery (so no GROUP BY needed)

package/dist/core/objects/type/enum/enum.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import type { EnumChange } from "./changes/enum.types.ts";
 import type { Enum } from "./enum.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { Enum } from "./enum.model.ts";
  * @param branch - The enums in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffEnums(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Enum>, branch: Record<string, Enum>): EnumChange[];
+export declare function diffEnums(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Enum>, branch: Record<string, Enum>): EnumChange[];

package/dist/core/objects/type/enum/enum.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
 import { AlterEnumAddValue, AlterEnumChangeOwner, } from "./changes/enum.alter.js";
 import { CreateCommentOnEnum, DropCommentOnEnum, } from "./changes/enum.comment.js";
 import { CreateEnum } from "./changes/enum.create.js";
@@ -36,50 +36,21 @@ export function diffEnums(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "enum", createdEnum.schema ?? "");
+        const creatorFilteredDefaults = createdEnum.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         // Filter out PUBLIC's built-in default USAGE privilege (PostgreSQL grants it automatically)
         // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
         // This prevents generating unnecessary "GRANT USAGE TO PUBLIC" statements
         const desiredPrivileges = filterPublicBuiltInDefaults("enum", createdEnum.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the enum owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdEnum.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantEnumPrivileges({
-                        enum: createdEnum,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeEnumPrivileges({
-                        enum: createdEnum,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionEnumPrivileges({
-                    enum: createdEnum,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("enum", creatorFilteredDefaults), desiredPrivileges, createdEnum.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdEnum, createdEnum, "enum", {
+            Grant: GrantEnumPrivileges,
+            Revoke: RevokeEnumPrivileges,
+            RevokeGrantOption: RevokeGrantOptionEnumPrivileges,
+        }, ctx.version));
     }
     for (const enumId of dropped) {
         changes.push(new DropEnum({ enum: main[enumId] }));
@@ -105,42 +76,16 @@ export function diffEnums(ctx, main, branch) {
                 changes.push(new CreateCommentOnEnum({ enum: branchEnum }));
             }
             const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "enum", branchEnum.schema ?? "");
+            const creatorFilteredDefaults = branchEnum.owner !== ctx.currentUser
+                ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+                : effectiveDefaults;
             const desiredPrivileges = filterPublicBuiltInDefaults("enum", branchEnum.privileges);
-            const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, branchEnum.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantEnumPrivileges({
-                            enum: branchEnum,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeEnumPrivileges({
-                            enum: branchEnum,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionEnumPrivileges({
-                        enum: branchEnum,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("enum", creatorFilteredDefaults), desiredPrivileges, branchEnum.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchEnum, branchEnum, "enum", {
+                Grant: GrantEnumPrivileges,
+                Revoke: RevokeEnumPrivileges,
+                RevokeGrantOption: RevokeGrantOptionEnumPrivileges,
+            }, ctx.version));
             continue;
         }
         // OWNER
@@ -169,44 +114,12 @@ export function diffEnums(ctx, main, branch) {
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("enum", branchEnum.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchEnum.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantEnumPrivileges({
-                        enum: branchEnum,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeEnumPrivileges({
-                        enum: mainEnum,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionEnumPrivileges({
-                    enum: mainEnum,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchEnum.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchEnum, mainEnum, "enum", {
+            Grant: GrantEnumPrivileges,
+            Revoke: RevokeEnumPrivileges,
+            RevokeGrantOption: RevokeGrantOptionEnumPrivileges,
+        }, ctx.version));
         // Note: Enum renaming would also use ALTER TYPE ... RENAME TO ...
         // But since our Enum model uses 'name' as the identity field,
         // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/type/enum/enum.model.js

@@ -119,7 +119,7 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(t.typacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges
 from

package/dist/core/objects/type/range/changes/range.create.js

@@ -1,4 +1,4 @@
-import { isUserDefinedTypeSchema, parseProcedureReference, stableId, } from "../../../utils.js";
+import { isUserDefinedTypeSchema, parseProcedureReference, parseTypeString, stableId, } from "../../../utils.js";
 import { CreateRangeChange } from "./range.base.js";
 /**
  * Create a range type.
@@ -74,8 +74,11 @@ export class CreateRange extends CreateRangeChange {
         const name = `${this.range.schema}.${this.range.name}`;
         const prefix = ["CREATE TYPE", name, "AS RANGE"].join(" ");
         const opts = [];
-        // Required subtype
-        const subtypeQualified = this.range.subtype_schema && this.range.subtype_schema !== "pg_catalog"
+        // Required subtype (format_type may already return schema-qualified name)
+        const alreadyQualified = parseTypeString(this.range.subtype_str);
+        const subtypeQualified = !alreadyQualified &&
+            this.range.subtype_schema &&
+            this.range.subtype_schema !== "pg_catalog"
             ? `${this.range.subtype_schema}.${this.range.subtype_str}`
             : this.range.subtype_str;
         opts.push(`SUBTYPE = ${subtypeQualified}`);

package/dist/core/objects/type/range/range.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import type { RangeChange } from "./changes/range.types.ts";
 import type { Range } from "./range.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { Range } from "./range.model.ts";
  * @param branch - The ranges in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffRanges(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Range>, branch: Record<string, Range>): RangeChange[];
+export declare function diffRanges(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Range>, branch: Record<string, Range>): RangeChange[];

package/dist/core/objects/type/range/range.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
 import { hasNonAlterableChanges } from "../../utils.js";
 import { AlterRangeChangeOwner } from "./changes/range.alter.js";
 import { CreateCommentOnRange, DropCommentOnRange, } from "./changes/range.comment.js";
@@ -37,50 +37,21 @@ export function diffRanges(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "range", createdRange.schema ?? "");
+        const creatorFilteredDefaults = createdRange.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         // Filter out PUBLIC's built-in default USAGE privilege (PostgreSQL grants it automatically)
         // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
         // This prevents generating unnecessary "GRANT USAGE TO PUBLIC" statements
         const desiredPrivileges = filterPublicBuiltInDefaults("range", createdRange.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the range owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdRange.owner);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantRangePrivileges({
-                        range: createdRange,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeRangePrivileges({
-                        range: createdRange,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionRangePrivileges({
-                    range: createdRange,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("range", creatorFilteredDefaults), desiredPrivileges, createdRange.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdRange, createdRange, "range", {
+            Grant: GrantRangePrivileges,
+            Revoke: RevokeRangePrivileges,
+            RevokeGrantOption: RevokeGrantOptionRangePrivileges,
+        }, ctx.version));
     }
     for (const id of dropped) {
         changes.push(new DropRange({ range: main[id] }));
@@ -128,44 +99,12 @@ export function diffRanges(ctx, main, branch) {
             const branchPrivilegesFiltered = filterPublicBuiltInDefaults("range", branchRange.privileges);
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchRange.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantRangePrivileges({
-                            range: branchRange,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeRangePrivileges({
-                            range: mainRange,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionRangePrivileges({
-                        range: mainRange,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchRange.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchRange, mainRange, "range", {
+                Grant: GrantRangePrivileges,
+                Revoke: RevokeRangePrivileges,
+                RevokeGrantOption: RevokeGrantOptionRangePrivileges,
+            }, ctx.version));
         }
     }
     return changes;

package/dist/core/objects/type/range/range.model.js

@@ -140,7 +140,7 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(t.typacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges
 from pg_catalog.pg_range r

package/dist/core/objects/view/view.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { ViewChange } from "./changes/view.types.ts";
 import type { View } from "./view.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { View } from "./view.model.ts";
  * @param branch - The views in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffViews(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, View>, branch: Record<string, View>): ViewChange[];
+export declare function diffViews(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, View>, branch: Record<string, View>): ViewChange[];

package/dist/core/objects/view/view.diff.js

@@ -1,5 +1,5 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByColumns, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitColumnPrivilegeChanges, } from "../base.privilege-diff.js";
 import { deepEqual, hasNonAlterableChanges } from "../utils.js";
 import { AlterViewChangeOwner, AlterViewResetOptions, AlterViewSetOptions, } from "./changes/view.alter.js";
 import { CreateCommentOnView, DropCommentOnView, } from "./changes/view.comment.js";
@@ -34,87 +34,18 @@ export function diffViews(ctx, main, branch) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "view", v.schema ?? "");
+        const creatorFilteredDefaults = v.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = v.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the view owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, v.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByColumns(result.grants);
-                for (const [, group] of grantGroups) {
-                    for (const [grantable, privSet] of group.byGrant) {
-                        const privileges = Array.from(privSet).map((priv) => ({
-                            privilege: priv,
-                            grantable,
-                        }));
-                        changes.push(new GrantViewPrivileges({
-                            view: v,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                for (const [, group] of revokeGroups) {
-                    const allPrivileges = new Set();
-                    for (const [, privSet] of group.byGrant) {
-                        for (const priv of privSet) {
-                            allPrivileges.add(priv);
-                        }
-                    }
-                    const privileges = Array.from(allPrivileges).map((priv) => ({
-                        privilege: priv,
-                        grantable: false,
-                    }));
-                    changes.push(new RevokeViewPrivileges({
-                        view: v,
-                        grantee,
-                        privileges,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                const revokeGrantGroups = new Map();
-                for (const r of result.revokeGrantOption) {
-                    // For revoke grant option, we need to find the columns from the effective defaults
-                    const originalPriv = effectiveDefaults.find((p) => p.grantee === grantee && p.privilege === r);
-                    const key = originalPriv?.columns
-                        ? originalPriv.columns.sort().join(",")
-                        : "";
-                    if (!revokeGrantGroups.has(key)) {
-                        revokeGrantGroups.set(key, {
-                            columns: originalPriv?.columns
-                                ? [...originalPriv.columns]
-                                : undefined,
-                            privileges: new Set(),
-                        });
-                    }
-                    const group = revokeGrantGroups.get(key);
-                    if (!group)
-                        continue;
-                    group.privileges.add(r);
-                }
-                for (const [, group] of revokeGrantGroups) {
-                    const privilegeNames = Array.from(group.privileges);
-                    changes.push(new RevokeGrantOptionViewPrivileges({
-                        view: v,
-                        grantee,
-                        privilegeNames,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, v.owner);
+        changes.push(...emitColumnPrivilegeChanges(privilegeResults, v, v, "view", {
+            Grant: GrantViewPrivileges,
+            Revoke: RevokeViewPrivileges,
+            RevokeGrantOption: RevokeGrantOptionViewPrivileges,
+        }, effectiveDefaults, ctx.version));
     }
     for (const viewId of dropped) {
         changes.push(new DropView({ view: main[viewId] }));
@@ -185,85 +116,12 @@ export function diffViews(ctx, main, branch) {
             // PRIVILEGES (unified object and column privileges)
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            const privilegeResults = diffPrivileges(mainView.privileges, branchView.privileges, branchView.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByColumns(result.grants);
-                    for (const [, group] of grantGroups) {
-                        for (const [grantable, privSet] of group.byGrant) {
-                            const privileges = Array.from(privSet).map((priv) => ({
-                                privilege: priv,
-                                grantable,
-                            }));
-                            changes.push(new GrantViewPrivileges({
-                                view: branchView,
-                                grantee,
-                                privileges,
-                                columns: group.columns,
-                                version: ctx.version,
-                            }));
-                        }
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                    for (const [, group] of revokeGroups) {
-                        // Collapse all grantable groups into a single revoke (grantable: false)
-                        const allPrivileges = new Set();
-                        for (const [, privSet] of group.byGrant) {
-                            for (const priv of privSet) {
-                                allPrivileges.add(priv);
-                            }
-                        }
-                        const privileges = Array.from(allPrivileges).map((priv) => ({
-                            privilege: priv,
-                            grantable: false,
-                        }));
-                        changes.push(new RevokeViewPrivileges({
-                            view: mainView,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    const revokeGrantGroups = new Map();
-                    for (const r of result.revokeGrantOption) {
-                        // For revoke grant option, we need to find the columns from the original privilege
-                        const originalPriv = mainView.privileges.find((p) => p.grantee === grantee && p.privilege === r);
-                        const key = originalPriv?.columns
-                            ? originalPriv.columns.sort().join(",")
-                            : "";
-                        if (!revokeGrantGroups.has(key)) {
-                            revokeGrantGroups.set(key, {
-                                columns: originalPriv?.columns
-                                    ? [...originalPriv.columns]
-                                    : undefined,
-                                privileges: new Set(),
-                            });
-                        }
-                        const group = revokeGrantGroups.get(key);
-                        if (!group)
-                            continue;
-                        group.privileges.add(r);
-                    }
-                    for (const [, group] of revokeGrantGroups) {
-                        const privilegeNames = Array.from(group.privileges);
-                        changes.push(new RevokeGrantOptionViewPrivileges({
-                            view: mainView,
-                            grantee,
-                            privilegeNames,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
+            const privilegeResults = diffPrivileges(mainView.privileges, branchView.privileges, branchView.owner);
+            changes.push(...emitColumnPrivilegeChanges(privilegeResults, branchView, mainView, "view", {
+                Grant: GrantViewPrivileges,
+                Revoke: RevokeViewPrivileges,
+                RevokeGrantOption: RevokeGrantOptionViewPrivileges,
+            }, mainView.privileges, ctx.version));
         }
     }
     return changes;