@supabase/pg-delta 1.0.0-alpha.21 → 1.0.0-alpha.23

package/dist/core/objects/type/range/range.diff.js

@@ -1,11 +1,13 @@
 import { diffObjects } from "../../base.diff.js";
 import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
+import { diffSecurityLabels } from "../../security-label.types.js";
 import { hasNonAlterableChanges } from "../../utils.js";
 import { AlterRangeChangeOwner } from "./changes/range.alter.js";
 import { CreateCommentOnRange, DropCommentOnRange, } from "./changes/range.comment.js";
 import { CreateRange } from "./changes/range.create.js";
 import { DropRange } from "./changes/range.drop.js";
 import { GrantRangePrivileges, RevokeGrantOptionRangePrivileges, RevokeRangePrivileges, } from "./changes/range.privilege.js";
+import { CreateSecurityLabelOnRange, DropSecurityLabelOnRange, } from "./changes/range.security-label.js";
 /**
  * Diff two sets of range types from main and branch catalogs.
  *
@@ -31,6 +33,12 @@ export function diffRanges(ctx, main, branch) {
         if (createdRange.comment !== null) {
             changes.push(new CreateCommentOnRange({ range: createdRange }));
         }
+        for (const label of createdRange.security_labels) {
+            changes.push(new CreateSecurityLabelOnRange({
+                range: createdRange,
+                securityLabel: label,
+            }));
+        }
         // PRIVILEGES: For created objects, compare against default privileges state
         // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
         // so objects are created with the default privileges state in effect.
@@ -91,6 +99,14 @@ export function diffRanges(ctx, main, branch) {
                     changes.push(new CreateCommentOnRange({ range: branchRange }));
                 }
             }
+            // SECURITY LABELS
+            changes.push(...diffSecurityLabels(mainRange.security_labels, branchRange.security_labels, (securityLabel) => new CreateSecurityLabelOnRange({
+                range: branchRange,
+                securityLabel,
+            }), (securityLabel) => new DropSecurityLabelOnRange({
+                range: mainRange,
+                securityLabel,
+            })));
             // PRIVILEGES
             // Filter out PUBLIC's built-in default USAGE privilege from main catalog
             // (PostgreSQL grants it automatically, so we shouldn't compare it)

package/dist/core/objects/type/range/range.model.d.ts

@@ -2,6 +2,7 @@ import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../../base.model.ts";
 import { type PrivilegeProps } from "../../base.privilege-diff.ts";
+import { type SecurityLabelProps } from "../../security-label.types.ts";
 declare const rangePropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
@@ -22,6 +23,10 @@ declare const rangePropsSchema: z.ZodObject<{
         grantable: z.ZodBoolean;
         columns: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     }, z.z.core.$strip>>;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
 }, z.z.core.$strip>;
 type RangePrivilegeProps = PrivilegeProps;
 export type RangeProps = z.infer<typeof rangePropsSchema>;
@@ -40,6 +45,7 @@ export declare class Range extends BasePgModel {
     readonly subtype_opclass_schema: RangeProps["subtype_opclass_schema"];
     readonly subtype_opclass_name: RangeProps["subtype_opclass_name"];
     readonly privileges: RangePrivilegeProps[];
+    readonly security_labels: SecurityLabelProps[];
     constructor(props: RangeProps);
     get stableId(): `type:${string}`;
     get identityFields(): {
@@ -64,6 +70,10 @@ export declare class Range extends BasePgModel {
             grantable: boolean;
             columns?: string[] | null | undefined;
         }[];
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
 }
 /**

package/dist/core/objects/type/range/range.model.js

@@ -2,6 +2,7 @@ import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../../base.model.js";
 import { privilegePropsSchema, } from "../../base.privilege-diff.js";
+import { securityLabelPropsSchema, } from "../../security-label.types.js";
 const rangePropsSchema = z.object({
     schema: z.string(),
     name: z.string(),
@@ -21,6 +22,7 @@ const rangePropsSchema = z.object({
     subtype_opclass_schema: z.string().nullable(),
     subtype_opclass_name: z.string().nullable(),
     privileges: z.array(privilegePropsSchema),
+    security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
 });
 export class Range extends BasePgModel {
     schema;
@@ -37,6 +39,7 @@ export class Range extends BasePgModel {
     subtype_opclass_schema;
     subtype_opclass_name;
     privileges;
+    security_labels;
     constructor(props) {
         super();
         // Identity fields
@@ -55,6 +58,7 @@ export class Range extends BasePgModel {
         this.subtype_opclass_schema = props.subtype_opclass_schema;
         this.subtype_opclass_name = props.subtype_opclass_name;
         this.privileges = props.privileges;
+        this.security_labels = props.security_labels ?? [];
     }
     get stableId() {
         return `type:${this.schema}.${this.name}`;
@@ -79,6 +83,7 @@ export class Range extends BasePgModel {
             subtype_opclass_name: this.subtype_opclass_name,
             comment: this.comment,
             privileges: this.privileges,
+            security_labels: this.security_labels,
         };
     }
 }
@@ -142,7 +147,20 @@ select
       )
       from lateral aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
-  ) as privileges
+  ) as privileges,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object('provider', sl.provider, 'label', sl.label)
+        order by sl.provider
+      )
+      from pg_catalog.pg_seclabel sl
+      where sl.objoid = t.oid
+        and sl.classoid = 'pg_type'::regclass
+        and sl.objsubid = 0
+    ),
+    '[]'::json
+  ) as security_labels
 from pg_catalog.pg_range r
 join pg_catalog.pg_type t on t.oid = r.rngtypid
 join pg_catalog.pg_type subt on subt.oid = r.rngsubtype

package/dist/core/objects/utils.d.ts

@@ -20,7 +20,9 @@ export declare const stableId: {
     defacl(grantor: string, objtype: string, schema: string | null, grantee: string): `defacl:${string}:${string}:${string}:grantee:${string}`;
     column(schema: string, table: string, column: string): `column:${string}.${string}.${string}`;
     constraint(schema: string, table: string, constraint: string): `constraint:${string}.${string}.${string}`;
+    index(schema: string, table: string, indexName: string): `index:${string}.${string}.${string}`;
     comment(objectStableId: string): `comment:${string}`;
+    securityLabel(objectStableId: string, provider: string): `securityLabel:${string}::provider:${string}`;
     role(role: string): `role:${string}`;
     type(schema: string, name: string): `type:${string}.${string}`;
     collation(schema: string, name: string): `collation:${string}.${string}`;

package/dist/core/objects/utils.js

@@ -49,9 +49,15 @@ export const stableId = {
     constraint(schema, table, constraint) {
         return `constraint:${schema}.${table}.${constraint}`;
     },
+    index(schema, table, indexName) {
+        return `index:${schema}.${table}.${indexName}`;
+    },
     comment(objectStableId) {
         return `comment:${objectStableId}`;
     },
+    securityLabel(objectStableId, provider) {
+        return `securityLabel:${objectStableId}::provider:${provider}`;
+    },
     role(role) {
         return `role:${role}`;
     },

package/dist/core/objects/view/changes/view.base.d.ts

@@ -2,7 +2,7 @@ import { BaseChange } from "../../base.change.ts";
 import type { View } from "../view.model.ts";
 declare abstract class BaseViewChange extends BaseChange {
     abstract readonly view: View;
-    abstract readonly scope: "object" | "comment" | "privilege";
+    abstract readonly scope: "object" | "comment" | "privilege" | "security_label";
     readonly objectType: "view";
 }
 export declare abstract class CreateViewChange extends BaseViewChange {

package/dist/core/objects/view/changes/view.security-label.d.ts

@@ -0,0 +1,28 @@
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import type { View } from "../view.model.ts";
+import { CreateViewChange, DropViewChange } from "./view.base.ts";
+export type SecurityLabelView = CreateSecurityLabelOnView | DropSecurityLabelOnView;
+export declare class CreateSecurityLabelOnView extends CreateViewChange {
+    readonly view: View;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        view: View;
+        securityLabel: SecurityLabelProps;
+    });
+    get creates(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): `view:${string}`[];
+    serialize(): string;
+}
+export declare class DropSecurityLabelOnView extends DropViewChange {
+    readonly view: View;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        view: View;
+        securityLabel: SecurityLabelProps;
+    });
+    get drops(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): (`securityLabel:${string}::provider:${string}` | `view:${string}`)[];
+    serialize(): string;
+}

package/dist/core/objects/view/changes/view.security-label.js

@@ -0,0 +1,61 @@
+import { quoteLiteral } from "../../base.change.js";
+import { stableId } from "../../utils.js";
+import { CreateViewChange, DropViewChange } from "./view.base.js";
+export class CreateSecurityLabelOnView extends CreateViewChange {
+    view;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.view = props.view;
+        this.securityLabel = props.securityLabel;
+    }
+    get creates() {
+        return [
+            stableId.securityLabel(this.view.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [this.view.stableId];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON VIEW",
+            `${this.view.schema}.${this.view.name}`,
+            "IS",
+            quoteLiteral(this.securityLabel.label),
+        ].join(" ");
+    }
+}
+export class DropSecurityLabelOnView extends DropViewChange {
+    view;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.view = props.view;
+        this.securityLabel = props.securityLabel;
+    }
+    get drops() {
+        return [
+            stableId.securityLabel(this.view.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [
+            stableId.securityLabel(this.view.stableId, this.securityLabel.provider),
+            this.view.stableId,
+        ];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON VIEW",
+            `${this.view.schema}.${this.view.name}`,
+            "IS NULL",
+        ].join(" ");
+    }
+}

package/dist/core/objects/view/changes/view.types.d.ts

@@ -3,5 +3,6 @@ import type { CommentView } from "./view.comment.ts";
 import type { CreateView } from "./view.create.ts";
 import type { DropView } from "./view.drop.ts";
 import type { ViewPrivilege } from "./view.privilege.ts";
+import type { SecurityLabelView } from "./view.security-label.ts";
 /** Union of all view-related change variants (`objectType: "view"`). @category Change Types */
-export type ViewChange = AlterView | CommentView | CreateView | DropView | ViewPrivilege;
+export type ViewChange = AlterView | CommentView | CreateView | DropView | ViewPrivilege | SecurityLabelView;

package/dist/core/objects/view/view.diff.js

@@ -1,12 +1,14 @@
 import { diffObjects } from "../base.diff.js";
 import { normalizeColumns } from "../base.model.js";
 import { diffPrivileges, emitColumnPrivilegeChanges, } from "../base.privilege-diff.js";
+import { diffSecurityLabels } from "../security-label.types.js";
 import { deepEqual, hasNonAlterableChanges } from "../utils.js";
 import { AlterViewChangeOwner, AlterViewResetOptions, AlterViewSetOptions, } from "./changes/view.alter.js";
 import { CreateCommentOnView, DropCommentOnView, } from "./changes/view.comment.js";
 import { CreateView } from "./changes/view.create.js";
 import { DropView } from "./changes/view.drop.js";
 import { GrantViewPrivileges, RevokeGrantOptionViewPrivileges, RevokeViewPrivileges, } from "./changes/view.privilege.js";
+import { CreateSecurityLabelOnView, DropSecurityLabelOnView, } from "./changes/view.security-label.js";
 /**
  * Diff two sets of views from main and branch catalogs.
  *
@@ -28,6 +30,9 @@ export function diffViews(ctx, main, branch) {
         if (view.comment !== null) {
             changes.push(new CreateCommentOnView({ view }));
         }
+        for (const label of view.security_labels) {
+            changes.push(new CreateSecurityLabelOnView({ view, securityLabel: label }));
+        }
         // PRIVILEGES: For created objects, compare against default privileges state
         // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
         // so objects are created with the default privileges state in effect.
@@ -121,6 +126,14 @@ export function diffViews(ctx, main, branch) {
                     changes.push(new CreateCommentOnView({ view: branchView }));
                 }
             }
+            // SECURITY LABELS
+            changes.push(...diffSecurityLabels(mainView.security_labels, branchView.security_labels, (securityLabel) => new CreateSecurityLabelOnView({
+                view: branchView,
+                securityLabel,
+            }), (securityLabel) => new DropSecurityLabelOnView({
+                view: mainView,
+                securityLabel,
+            })));
             // Note: View renaming would also use ALTER VIEW ... RENAME TO ...
             // But since our View model uses 'name' as the identity field,
             // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/view/view.model.d.ts

@@ -2,6 +2,8 @@ import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel, type TableLikeObject } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
+import { type ExtractRetryOptions } from "../extract-with-retry.ts";
+import { type SecurityLabelProps } from "../security-label.types.ts";
 declare const viewPropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
@@ -41,6 +43,10 @@ declare const viewPropsSchema: z.ZodObject<{
         collation: z.ZodNullable<z.ZodString>;
         default: z.ZodNullable<z.ZodString>;
         comment: z.ZodNullable<z.ZodString>;
+        security_labels: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            provider: z.ZodString;
+            label: z.ZodString;
+        }, z.z.core.$strip>>>;
     }, z.z.core.$strip>>;
     privileges: z.ZodArray<z.ZodObject<{
         grantee: z.ZodString;
@@ -48,6 +54,10 @@ declare const viewPropsSchema: z.ZodObject<{
         grantable: z.ZodBoolean;
         columns: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     }, z.z.core.$strip>>;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
 }, z.z.core.$strip>;
 type ViewPrivilegeProps = PrivilegeProps;
 export type ViewProps = z.infer<typeof viewPropsSchema>;
@@ -70,6 +80,7 @@ export declare class View extends BasePgModel implements TableLikeObject {
     readonly comment: ViewProps["comment"];
     readonly columns: ViewProps["columns"];
     readonly privileges: ViewPrivilegeProps[];
+    readonly security_labels: SecurityLabelProps[];
     constructor(props: ViewProps);
     get stableId(): `view:${string}`;
     get identityFields(): {
@@ -108,6 +119,10 @@ export declare class View extends BasePgModel implements TableLikeObject {
             collation: string | null;
             default: string | null;
             comment: string | null;
+            security_labels?: {
+                provider: string;
+                label: string;
+            }[] | undefined;
         }[];
         privileges: {
             grantee: string;
@@ -115,6 +130,10 @@ export declare class View extends BasePgModel implements TableLikeObject {
             grantable: boolean;
             columns?: string[] | null | undefined;
         }[];
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
     stableSnapshot(): {
         identity: {
@@ -138,6 +157,14 @@ export declare class View extends BasePgModel implements TableLikeObject {
                 collation: string | null;
                 default: string | null;
                 comment: string | null;
+                security_labels?: {
+                    provider: string;
+                    label: string;
+                }[] | undefined;
+            }[];
+            security_labels: {
+                provider: string;
+                label: string;
             }[];
             definition: string;
             row_security: boolean;
@@ -162,5 +189,5 @@ export declare class View extends BasePgModel implements TableLikeObject {
         };
     };
 }
-export declare function extractViews(pool: Pool): Promise<View[]>;
+export declare function extractViews(pool: Pool, options?: ExtractRetryOptions): Promise<View[]>;
 export {};

package/dist/core/objects/view/view.model.js

@@ -2,6 +2,8 @@ import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel, columnPropsSchema, normalizeColumns, } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
+import { extractWithDefinitionRetry, } from "../extract-with-retry.js";
+import { normalizeSecurityLabels, securityLabelPropsSchema, } from "../security-label.types.js";
 import { ReplicaIdentitySchema } from "../table/table.model.js";
 const viewPropsSchema = z.object({
     schema: z.string(),
@@ -22,6 +24,15 @@ const viewPropsSchema = z.object({
     comment: z.string().nullable(),
     columns: z.array(columnPropsSchema),
     privileges: z.array(privilegePropsSchema),
+    security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
+});
+// pg_get_viewdef(oid) can return NULL when the underlying view (or its
+// pg_rewrite row) is dropped between catalog scan and resolution, or under
+// transient catalog state during recovery. An unreadable view cannot be
+// diffed, so we accept NULL here and filter the row out at extraction time
+// rather than crashing the whole catalog parse with a ZodError.
+const viewRowSchema = viewPropsSchema.extend({
+    definition: z.string().nullable(),
 });
 export class View extends BasePgModel {
     schema;
@@ -42,6 +53,7 @@ export class View extends BasePgModel {
     comment;
     columns;
     privileges;
+    security_labels;
     constructor(props) {
         super();
         // Identity fields
@@ -64,6 +76,7 @@ export class View extends BasePgModel {
         this.comment = props.comment;
         this.columns = props.columns;
         this.privileges = props.privileges;
+        this.security_labels = props.security_labels ?? [];
     }
     get stableId() {
         return `view:${this.schema}.${this.name}`;
@@ -92,6 +105,7 @@ export class View extends BasePgModel {
             comment: this.comment,
             columns: this.columns,
             privileges: this.privileges,
+            security_labels: this.security_labels,
         };
     }
     stableSnapshot() {
@@ -100,12 +114,18 @@ export class View extends BasePgModel {
             data: {
                 ...this.dataFields,
                 columns: normalizeColumns(this.columns),
+                security_labels: normalizeSecurityLabels(this.security_labels),
             },
         };
     }
 }
-export async function extractViews(pool) {
-    const { rows: viewRows } = await pool.query(sql `
+export async function extractViews(pool, options) {
+    const viewRows = await extractWithDefinitionRetry({
+        label: "views",
+        options,
+        hasNullDefinition: (row) => row.definition === null,
+        query: async () => {
+            const result = await pool.query(sql `
 with extension_oids as (
   select
     objid
@@ -221,7 +241,20 @@ select
       join lateral aclexplode(src.acl) as x(grantor, grantee, privilege_type, is_grantable) on true
       group by x.grantee, x.privilege_type
     ) as grp
-  ), '[]') as privileges
+  ), '[]') as privileges,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object('provider', sl.provider, 'label', sl.label)
+        order by sl.provider
+      )
+      from pg_catalog.pg_seclabel sl
+      where sl.objoid = v.oid
+        and sl.classoid = 'pg_class'::regclass
+        and sl.objsubid = 0
+    ),
+    '[]'::json
+  ) as security_labels
 from
   views v
   left join pg_attribute a on a.attrelid = v.oid and a.attnum > 0 and not a.attisdropped
@@ -232,7 +265,9 @@ group by
 order by
   v.schema, v.name
   `);
-    // Validate and parse each row using the Zod schema
-    const validatedRows = viewRows.map((row) => viewPropsSchema.parse(row));
+            return result.rows.map((row) => viewRowSchema.parse(row));
+        },
+    });
+    const validatedRows = viewRows.filter((row) => row.definition !== null);
     return validatedRows.map((row) => new View(row));
 }

package/dist/core/plan/create.js

@@ -62,7 +62,9 @@ export async function createPlan(source, target, options = {}) {
         }
         const resolved = await resolvePool(input, label);
         pools.push(resolved);
-        return extractCatalog(resolved.pool);
+        return extractCatalog(resolved.pool, {
+            extractRetries: options.extractRetries,
+        });
     };
     const pools = [];
     try {

package/dist/core/plan/sql-format/fixtures.js

@@ -806,6 +806,7 @@ const schema = new Schema({
     owner: "admin",
     comment: "application schema",
     privileges: [],
+    security_labels: [],
 });
 const extension = new Extension({
     name: "pgcrypto",

package/dist/core/plan/types.d.ts

@@ -141,5 +141,13 @@ export interface CreatePlanOptions {
      * the output must be self-contained and not rely on statement execution order.
      */
     skipDefaultPrivilegeSubtraction?: boolean;
+    /**
+     * Number of retry attempts for catalog extractors when `pg_get_*def()`
+     * returns NULL for at least one row (a transient race with concurrent DDL).
+     * Total attempts is `extractRetries + 1`. When undefined, the value is read
+     * from the `PGDELTA_EXTRACT_RETRIES` environment variable, falling back to
+     * a default of 1 (i.e. the first attempt plus one retry, 2 attempts total).
+     */
+    extractRetries?: number;
 }
 export {};

package/dist/core/{post-diff-cycle-breaking.d.ts → post-diff-normalization.d.ts}

@@ -1,4 +1,5 @@
 import type { Change } from "./change.types.ts";
+import type { Table } from "./objects/table/table.model.ts";
 /**
  * Apply structural rewrites to the change list that are only obvious once
  * every object diff has been collected. This pass does NOT prevent dependency
@@ -19,11 +20,17 @@ import type { Change } from "./change.types.ts";
  *   produced when `diffTables()` and `expandReplaceDependencies()` both
  *   emit the same constraint operation for a replaced table. Last write
  *   wins so the expansion's emission survives.
+ * - Re-emits `ALTER TABLE ... REPLICA IDENTITY USING INDEX <idx>` after any
+ *   `DropIndex(idx) + CreateIndex(idx)` pair where `idx` is the replica
+ *   identity index of a branch table — Postgres silently clears the marker
+ *   when the underlying index is dropped, and `CREATE INDEX` cannot restore
+ *   it.
  *
  * Object-local PostgreSQL semantics (for example owned-sequence cascades)
  * stay in the corresponding `diff*` function instead of this pass.
  */
-export declare function normalizePostDiffCycles({ changes, replacedTableIds, }: {
+export declare function normalizePostDiffChanges({ changes, replacedTableIds, branchTables, }: {
     changes: Change[];
     replacedTableIds?: ReadonlySet<string>;
+    branchTables?: Record<string, Table>;
 }): Change[];