@supabase/pg-delta 1.0.0-alpha.21 → 1.0.0-alpha.23

package/dist/core/objects/sequence/sequence.diff.js

@@ -1,5 +1,6 @@
 import { diffObjects } from "../base.diff.js";
 import { diffPrivileges, emitObjectPrivilegeChanges, } from "../base.privilege-diff.js";
+import { diffSecurityLabels } from "../security-label.types.js";
 import { AlterTableAlterColumnSetDefault } from "../table/changes/table.alter.js";
 import { hasNonAlterableChanges } from "../utils.js";
 import { AlterSequenceSetOptions, AlterSequenceSetOwnedBy, } from "./changes/sequence.alter.js";
@@ -7,6 +8,7 @@ import { CreateCommentOnSequence, DropCommentOnSequence, } from "./changes/seque
 import { CreateSequence } from "./changes/sequence.create.js";
 import { DropSequence } from "./changes/sequence.drop.js";
 import { GrantSequencePrivileges, RevokeGrantOptionSequencePrivileges, RevokeSequencePrivileges, } from "./changes/sequence.privilege.js";
+import { CreateSecurityLabelOnSequence, DropSecurityLabelOnSequence, } from "./changes/sequence.security-label.js";
 /**
  * Diff two sets of sequences from main and branch catalogs.
  *
@@ -14,9 +16,10 @@ import { GrantSequencePrivileges, RevokeGrantOptionSequencePrivileges, RevokeSeq
  * @param main - The sequences in the main catalog.
  * @param branch - The sequences in the branch catalog.
  * @param branchTables - The tables in the branch catalog (used to check if owning tables are being dropped).
+ * @param mainTables - The tables in the main catalog (used to detect when a same-name sequence will be cascade-dropped because its main-side owning table is going away).
  * @returns A list of changes to apply to main to make it match branch.
  */
-export function diffSequences(ctx, main, branch, branchTables = {}) {
+export function diffSequences(ctx, main, branch, branchTables = {}, mainTables = {}) {
     const { created, dropped, altered } = diffObjects(main, branch);
     const changes = [];
     for (const sequenceId of created) {
@@ -25,6 +28,12 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
         if (createdSeq.comment !== null) {
             changes.push(new CreateCommentOnSequence({ sequence: createdSeq }));
         }
+        for (const label of createdSeq.security_labels) {
+            changes.push(new CreateSecurityLabelOnSequence({
+                sequence: createdSeq,
+                securityLabel: label,
+            }));
+        }
         // If the created sequence is OWNED BY a column, emit an ALTER to set it
         if (createdSeq.owned_by_schema !== null &&
             createdSeq.owned_by_table !== null &&
@@ -89,9 +98,32 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
         // These require dropping and recreating the sequence
         const NON_ALTERABLE_FIELDS = ["persistence"];
         const nonAlterablePropsChanged = hasNonAlterableChanges(mainSequence, branchSequence, NON_ALTERABLE_FIELDS);
-        if (nonAlterablePropsChanged) {
-            // Replace the entire sequence (drop + create)
-            changes.push(new DropSequence({ sequence: mainSequence }), new CreateSequence({ sequence: branchSequence }));
+        // A sequence kept the same name (so it's "altered" in catalog terms),
+        // but its main-side owning table is going away from the plan (renamed
+        // away or simply dropped). PostgreSQL will cascade-drop the sequence
+        // alongside the table, leaving any later CREATE TABLE / column-default
+        // that depends on the sequence name pointing at nothing. Treat this
+        // like a non-alterable change so we recreate the sequence after the
+        // owning table is dropped.
+        const mainOwnedByTableId = mainSequence.owned_by_schema && mainSequence.owned_by_table
+            ? `table:${mainSequence.owned_by_schema}.${mainSequence.owned_by_table}`
+            : null;
+        const cascadeOrphanedByOwningTable = mainOwnedByTableId !== null &&
+            mainTables[mainOwnedByTableId] !== undefined &&
+            branchTables[mainOwnedByTableId] === undefined;
+        if (nonAlterablePropsChanged || cascadeOrphanedByOwningTable) {
+            // When the owning table is going away in this plan, PostgreSQL will
+            // cascade-drop the sequence as part of the DROP TABLE. Emitting an
+            // explicit DROP SEQUENCE here would (a) introduce an unbreakable
+            // DropSequence ↔ DropTable cycle on the catalog edges between the
+            // sequence and the dropped column, and (b) be redundant with the
+            // cascade. The CreateSequence below restores the sequence under its
+            // original name so any same-name reference in a later CREATE TABLE
+            // resolves correctly.
+            if (!cascadeOrphanedByOwningTable) {
+                changes.push(new DropSequence({ sequence: mainSequence }));
+            }
+            changes.push(new CreateSequence({ sequence: branchSequence }));
             // Re-apply OWNED BY if present on branch
             if (branchSequence.owned_by_schema !== null &&
                 branchSequence.owned_by_table !== null &&
@@ -205,6 +237,14 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
                     changes.push(new CreateCommentOnSequence({ sequence: branchSequence }));
                 }
             }
+            // SECURITY LABELS
+            changes.push(...diffSecurityLabels(mainSequence.security_labels, branchSequence.security_labels, (securityLabel) => new CreateSecurityLabelOnSequence({
+                sequence: branchSequence,
+                securityLabel,
+            }), (securityLabel) => new DropSecurityLabelOnSequence({
+                sequence: mainSequence,
+                securityLabel,
+            })));
             // PRIVILEGES
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.

package/dist/core/objects/sequence/sequence.model.d.ts

@@ -2,6 +2,7 @@ import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
+import { type SecurityLabelProps } from "../security-label.types.ts";
 declare const sequencePropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
@@ -24,6 +25,10 @@ declare const sequencePropsSchema: z.ZodObject<{
         columns: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     }, z.z.core.$strip>>;
     owner: z.ZodString;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
 }, z.z.core.$strip>;
 type SequencePrivilegeProps = PrivilegeProps;
 export type SequenceProps = z.infer<typeof sequencePropsSchema>;
@@ -44,6 +49,7 @@ export declare class Sequence extends BasePgModel {
     readonly comment: SequenceProps["comment"];
     readonly privileges: SequencePrivilegeProps[];
     readonly owner: SequenceProps["owner"];
+    readonly security_labels: SecurityLabelProps[];
     constructor(props: SequenceProps);
     get stableId(): `sequence:${string}`;
     get identityFields(): {
@@ -70,6 +76,10 @@ export declare class Sequence extends BasePgModel {
             columns?: string[] | null | undefined;
         }[];
         owner: string;
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
 }
 export declare function extractSequences(pool: Pool): Promise<Sequence[]>;

package/dist/core/objects/sequence/sequence.model.js

@@ -2,6 +2,7 @@ import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
+import { securityLabelPropsSchema, } from "../security-label.types.js";
 const sequencePropsSchema = z.object({
     schema: z.string(),
     name: z.string(),
@@ -19,6 +20,7 @@ const sequencePropsSchema = z.object({
     comment: z.string().nullable(),
     privileges: z.array(privilegePropsSchema),
     owner: z.string(),
+    security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
 });
 export class Sequence extends BasePgModel {
     schema;
@@ -37,6 +39,7 @@ export class Sequence extends BasePgModel {
     comment;
     privileges;
     owner;
+    security_labels;
     constructor(props) {
         super();
         // Identity fields
@@ -57,6 +60,7 @@ export class Sequence extends BasePgModel {
         this.comment = props.comment;
         this.privileges = props.privileges;
         this.owner = props.owner;
+        this.security_labels = props.security_labels ?? [];
     }
     get stableId() {
         return `sequence:${this.schema}.${this.name}`;
@@ -83,6 +87,7 @@ export class Sequence extends BasePgModel {
             comment: this.comment,
             privileges: this.privileges,
             owner: this.owner,
+            security_labels: this.security_labels,
         };
     }
 }
@@ -135,7 +140,20 @@ select
       from lateral aclexplode(COALESCE(c.relacl, acldefault('S', c.relowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges,
-  c.relowner::regrole::text as owner
+  c.relowner::regrole::text as owner,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object('provider', sl.provider, 'label', sl.label)
+        order by sl.provider
+      )
+      from pg_catalog.pg_seclabel sl
+      where sl.objoid = c.oid
+        and sl.classoid = 'pg_class'::regclass
+        and sl.objsubid = 0
+    ),
+    '[]'::json
+  ) as security_labels
 from
   pg_catalog.pg_class c
   inner join pg_catalog.pg_sequence s on s.seqrelid = c.oid

package/dist/core/objects/subscription/changes/subscription.base.d.ts

@@ -2,7 +2,7 @@ import { BaseChange } from "../../base.change.ts";
 import type { Subscription } from "../subscription.model.ts";
 declare abstract class BaseSubscriptionChange extends BaseChange {
     abstract readonly subscription: Subscription;
-    abstract readonly scope: "object" | "comment";
+    abstract readonly scope: "object" | "comment" | "security_label";
     readonly objectType: "subscription";
 }
 export declare abstract class CreateSubscriptionChange extends BaseSubscriptionChange {

package/dist/core/objects/subscription/changes/subscription.security-label.d.ts

@@ -0,0 +1,28 @@
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import type { Subscription } from "../subscription.model.ts";
+import { CreateSubscriptionChange, DropSubscriptionChange } from "./subscription.base.ts";
+export type SecurityLabelSubscription = CreateSecurityLabelOnSubscription | DropSecurityLabelOnSubscription;
+export declare class CreateSecurityLabelOnSubscription extends CreateSubscriptionChange {
+    readonly subscription: Subscription;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        subscription: Subscription;
+        securityLabel: SecurityLabelProps;
+    });
+    get creates(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): `subscription:${string}`[];
+    serialize(): string;
+}
+export declare class DropSecurityLabelOnSubscription extends DropSubscriptionChange {
+    readonly subscription: Subscription;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        subscription: Subscription;
+        securityLabel: SecurityLabelProps;
+    });
+    get drops(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): (`securityLabel:${string}::provider:${string}` | `subscription:${string}`)[];
+    serialize(): string;
+}

package/dist/core/objects/subscription/changes/subscription.security-label.js

@@ -0,0 +1,61 @@
+import { quoteLiteral } from "../../base.change.js";
+import { stableId } from "../../utils.js";
+import { CreateSubscriptionChange, DropSubscriptionChange, } from "./subscription.base.js";
+export class CreateSecurityLabelOnSubscription extends CreateSubscriptionChange {
+    subscription;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.subscription = props.subscription;
+        this.securityLabel = props.securityLabel;
+    }
+    get creates() {
+        return [
+            stableId.securityLabel(this.subscription.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [this.subscription.stableId];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON SUBSCRIPTION",
+            this.subscription.name,
+            "IS",
+            quoteLiteral(this.securityLabel.label),
+        ].join(" ");
+    }
+}
+export class DropSecurityLabelOnSubscription extends DropSubscriptionChange {
+    subscription;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.subscription = props.subscription;
+        this.securityLabel = props.securityLabel;
+    }
+    get drops() {
+        return [
+            stableId.securityLabel(this.subscription.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [
+            stableId.securityLabel(this.subscription.stableId, this.securityLabel.provider),
+            this.subscription.stableId,
+        ];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON SUBSCRIPTION",
+            this.subscription.name,
+            "IS NULL",
+        ].join(" ");
+    }
+}

package/dist/core/objects/subscription/changes/subscription.types.d.ts

@@ -2,5 +2,6 @@ import type { AlterSubscriptionDisable, AlterSubscriptionEnable, AlterSubscripti
 import type { CommentSubscription } from "./subscription.comment.ts";
 import type { CreateSubscription } from "./subscription.create.ts";
 import type { DropSubscription } from "./subscription.drop.ts";
+import type { SecurityLabelSubscription } from "./subscription.security-label.ts";
 /** Union of all subscription-related change variants (`objectType: "subscription"`). @category Change Types */
-export type SubscriptionChange = CreateSubscription | DropSubscription | AlterSubscriptionSetConnection | AlterSubscriptionSetPublication | AlterSubscriptionEnable | AlterSubscriptionDisable | AlterSubscriptionSetOptions | AlterSubscriptionSetOwner | CommentSubscription;
+export type SubscriptionChange = CreateSubscription | DropSubscription | AlterSubscriptionSetConnection | AlterSubscriptionSetPublication | AlterSubscriptionEnable | AlterSubscriptionDisable | AlterSubscriptionSetOptions | AlterSubscriptionSetOwner | CommentSubscription | SecurityLabelSubscription;

package/dist/core/objects/subscription/subscription.diff.js

@@ -1,9 +1,11 @@
 import { diffObjects } from "../base.diff.js";
+import { diffSecurityLabels } from "../security-label.types.js";
 import { hasNonAlterableChanges } from "../utils.js";
 import { AlterSubscriptionDisable, AlterSubscriptionEnable, AlterSubscriptionSetConnection, AlterSubscriptionSetOptions, AlterSubscriptionSetOwner, AlterSubscriptionSetPublication, } from "./changes/subscription.alter.js";
 import { CreateCommentOnSubscription, DropCommentOnSubscription, } from "./changes/subscription.comment.js";
 import { CreateSubscription } from "./changes/subscription.create.js";
 import { DropSubscription } from "./changes/subscription.drop.js";
+import { CreateSecurityLabelOnSubscription, DropSecurityLabelOnSubscription, } from "./changes/subscription.security-label.js";
 const NON_ALTERABLE_FIELDS = [
     "two_phase",
 ];
@@ -35,6 +37,12 @@ export function diffSubscriptions(ctx, main, branch) {
         if (subscription.comment !== null) {
             changes.push(new CreateCommentOnSubscription({ subscription }));
         }
+        for (const label of subscription.security_labels) {
+            changes.push(new CreateSecurityLabelOnSubscription({
+                subscription,
+                securityLabel: label,
+            }));
+        }
     }
     for (const id of dropped) {
         changes.push(new DropSubscription({ subscription: main[id] }));
@@ -162,6 +170,14 @@ export function diffSubscriptions(ctx, main, branch) {
                 }));
             }
         }
+        // SECURITY LABELS
+        changes.push(...diffSecurityLabels(mainSubscription.security_labels, branchSubscription.security_labels, (securityLabel) => new CreateSecurityLabelOnSubscription({
+            subscription: branchSubscription,
+            securityLabel,
+        }), (securityLabel) => new DropSecurityLabelOnSubscription({
+            subscription: mainSubscription,
+            securityLabel,
+        })));
     }
     return changes;
 }

package/dist/core/objects/subscription/subscription.model.d.ts

@@ -1,6 +1,7 @@
 import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
+import { type SecurityLabelProps } from "../security-label.types.ts";
 declare const subscriptionPropsSchema: z.ZodObject<{
     name: z.ZodString;
     raw_name: z.ZodString;
@@ -28,6 +29,10 @@ declare const subscriptionPropsSchema: z.ZodObject<{
         any: "any";
         none: "none";
     }>;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
 }, z.z.core.$strip>;
 export type SubscriptionProps = z.infer<typeof subscriptionPropsSchema>;
 export declare class Subscription extends BasePgModel {
@@ -50,6 +55,7 @@ export declare class Subscription extends BasePgModel {
     readonly synchronous_commit: SubscriptionProps["synchronous_commit"];
     readonly publications: SubscriptionProps["publications"];
     readonly origin: SubscriptionProps["origin"];
+    readonly security_labels: SecurityLabelProps[];
     constructor(props: SubscriptionProps);
     get stableId(): `subscription:${string}`;
     get identityFields(): {
@@ -74,6 +80,10 @@ export declare class Subscription extends BasePgModel {
         synchronous_commit: string;
         publications: string[];
         origin: "any" | "none";
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
 }
 export declare function extractSubscriptions(pool: Pool): Promise<Subscription[]>;

package/dist/core/objects/subscription/subscription.model.js

@@ -1,6 +1,7 @@
 import z from "zod";
 import { extractVersion } from "../../context.js";
 import { BasePgModel } from "../base.model.js";
+import { securityLabelPropsSchema, } from "../security-label.types.js";
 const subscriptionPropsSchema = z.object({
     name: z.string(),
     raw_name: z.string(),
@@ -21,6 +22,7 @@ const subscriptionPropsSchema = z.object({
     synchronous_commit: z.string(),
     publications: z.array(z.string()),
     origin: z.enum(["any", "none"]),
+    security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
 });
 export class Subscription extends BasePgModel {
     name;
@@ -42,6 +44,7 @@ export class Subscription extends BasePgModel {
     synchronous_commit;
     publications;
     origin;
+    security_labels;
     constructor(props) {
         super();
         this.name = props.name;
@@ -63,6 +66,7 @@ export class Subscription extends BasePgModel {
         this.synchronous_commit = props.synchronous_commit;
         this.publications = [...props.publications].sort((a, b) => a.localeCompare(b));
         this.origin = props.origin;
+        this.security_labels = props.security_labels ?? [];
     }
     get stableId() {
         return `subscription:${this.name}`;
@@ -92,6 +96,7 @@ export class Subscription extends BasePgModel {
             synchronous_commit: this.synchronous_commit,
             publications: this.publications,
             origin: this.origin,
+            security_labels: this.security_labels,
         };
     }
 }
@@ -156,7 +161,20 @@ export async function extractSubscriptions(pool) {
           ),
           '[]'::json
         ) as publications,
-        ${originExpr} as origin
+        ${originExpr} as origin,
+        coalesce(
+          (
+            select json_agg(
+              json_build_object('provider', sl.provider, 'label', sl.label)
+              order by sl.provider
+            )
+            from pg_catalog.pg_seclabel sl
+            where sl.objoid = s.oid
+              and sl.classoid = 'pg_subscription'::regclass
+              and sl.objsubid = 0
+          ),
+          '[]'::json
+        ) as security_labels
       from scoped_subscriptions s
       left join pg_replication_slots r
         on r.slot_name = s.subslotname

package/dist/core/objects/table/changes/table.alter.d.ts

@@ -216,16 +216,27 @@ export declare class AlterTableValidateConstraint extends AlterTableChange {
 }
 /**
  * ALTER TABLE ... REPLICA IDENTITY ...
+ *
+ * When `mode === "i"` (USING INDEX), `indexName` is the name of the index to
+ * use. The extractor populates `Table.replica_identity_index` from
+ * `pg_index.indisreplident` whenever `Table.replica_identity` is `'i'`, so
+ * callers that source their props from a `Table` instance can rely on the
+ * pair being consistent. The non-null assertions in `requires` / `serialize`
+ * below are justified by that data invariant — the same pattern the FK
+ * branch of `AlterTableAddConstraint` uses for `foreign_key_columns!` /
+ * `foreign_key_table!` / `foreign_key_schema!`.
  */
 export declare class AlterTableSetReplicaIdentity extends AlterTableChange {
     readonly table: Table;
     readonly mode: "d" | "n" | "f" | "i";
+    readonly indexName: string | null;
     readonly scope: "object";
     constructor(props: {
         table: Table;
         mode: "d" | "n" | "f" | "i";
+        indexName?: string | null;
     });
-    get requires(): `table:${string}`[];
+    get requires(): string[];
     serialize(_options?: SerializeOptions): string;
 }
 /**

package/dist/core/objects/table/changes/table.alter.js

@@ -302,18 +302,35 @@ export class AlterTableValidateConstraint extends AlterTableChange {
 }
 /**
  * ALTER TABLE ... REPLICA IDENTITY ...
+ *
+ * When `mode === "i"` (USING INDEX), `indexName` is the name of the index to
+ * use. The extractor populates `Table.replica_identity_index` from
+ * `pg_index.indisreplident` whenever `Table.replica_identity` is `'i'`, so
+ * callers that source their props from a `Table` instance can rely on the
+ * pair being consistent. The non-null assertions in `requires` / `serialize`
+ * below are justified by that data invariant — the same pattern the FK
+ * branch of `AlterTableAddConstraint` uses for `foreign_key_columns!` /
+ * `foreign_key_table!` / `foreign_key_schema!`.
  */
 export class AlterTableSetReplicaIdentity extends AlterTableChange {
     table;
     mode;
+    indexName;
     scope = "object";
     constructor(props) {
         super();
         this.table = props.table;
         this.mode = props.mode;
+        this.indexName = props.indexName ?? null;
     }
     get requires() {
-        return [this.table.stableId];
+        const reqs = [this.table.stableId];
+        if (this.mode === "i") {
+            reqs.push(stableId.index(this.table.schema, this.table.name, 
+            // biome-ignore lint/style/noNonNullAssertion: mode 'i' implies the extractor populated replica_identity_index
+            this.indexName));
+        }
+        return reqs;
     }
     serialize(_options) {
         const clause = this.mode === "d"
@@ -322,7 +339,8 @@ export class AlterTableSetReplicaIdentity extends AlterTableChange {
                 ? "NOTHING"
                 : this.mode === "f"
                     ? "FULL"
-                    : "DEFAULT"; // 'i' (USING INDEX) is handled via index changes; fallback to DEFAULT
+                    : // biome-ignore lint/style/noNonNullAssertion: mode 'i' implies the extractor populated replica_identity_index
+                        `USING INDEX ${this.indexName}`;
         return [
             "ALTER TABLE",
             `${this.table.schema}.${this.table.name}`,

package/dist/core/objects/table/changes/table.base.d.ts

@@ -2,7 +2,7 @@ import { BaseChange } from "../../base.change.ts";
 import type { Table } from "../table.model.ts";
 declare abstract class BaseTableChange extends BaseChange {
     abstract readonly table: Table;
-    abstract readonly scope: "object" | "comment" | "privilege";
+    abstract readonly scope: "object" | "comment" | "privilege" | "security_label";
     readonly objectType: "table";
 }
 export declare abstract class CreateTableChange extends BaseTableChange {

package/dist/core/objects/table/changes/table.security-label.d.ts

@@ -0,0 +1,63 @@
+import type { ColumnProps } from "../../base.model.ts";
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import type { Table } from "../table.model.ts";
+import { CreateTableChange, DropTableChange } from "./table.base.ts";
+export type SecurityLabelTable = CreateSecurityLabelOnTable | DropSecurityLabelOnTable | CreateSecurityLabelOnColumn | DropSecurityLabelOnColumn;
+/**
+ * SECURITY LABEL FOR <provider> ON TABLE <schema>.<table> IS <literal>
+ */
+export declare class CreateSecurityLabelOnTable extends CreateTableChange {
+    readonly table: Table;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        table: Table;
+        securityLabel: SecurityLabelProps;
+    });
+    get creates(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): `table:${string}`[];
+    serialize(): string;
+}
+export declare class DropSecurityLabelOnTable extends DropTableChange {
+    readonly table: Table;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        table: Table;
+        securityLabel: SecurityLabelProps;
+    });
+    get drops(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): (`securityLabel:${string}::provider:${string}` | `table:${string}`)[];
+    serialize(): string;
+}
+/**
+ * SECURITY LABEL FOR <provider> ON COLUMN <schema>.<table>.<column> IS <literal>
+ */
+export declare class CreateSecurityLabelOnColumn extends CreateTableChange {
+    readonly table: Table;
+    readonly column: ColumnProps;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        table: Table;
+        column: ColumnProps;
+        securityLabel: SecurityLabelProps;
+    });
+    get creates(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): `column:${string}.${string}.${string}`[];
+    serialize(): string;
+}
+export declare class DropSecurityLabelOnColumn extends DropTableChange {
+    readonly table: Table;
+    readonly column: ColumnProps;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        table: Table;
+        column: ColumnProps;
+        securityLabel: SecurityLabelProps;
+    });
+    get drops(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): (`column:${string}.${string}.${string}` | `securityLabel:${string}::provider:${string}`)[];
+    serialize(): string;
+}