@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/core/integrations/serialize/serialize.types.d.ts

@@ -1,2 +1,33 @@
 import type { Change } from "../../change.types.ts";
+/**
+ * Shared serialization options passed to `change.serialize(options)`.
+ *
+ * This is the global source of truth for serialize-option flags used by the
+ * integration serialization DSL and concrete change serializers.
+ *
+ * @category Integration
+ */
+export type SerializeOptions = {
+    /** Skip `AUTHORIZATION` when serializing schema creation. */
+    skipAuthorization?: boolean;
+    /** Skip `WITH SCHEMA ...` when serializing extension creation. */
+    skipSchema?: boolean;
+};
+/**
+ * Schema-specific view of {@link SerializeOptions}.
+ *
+ * @category Integration
+ */
+export type SchemaSerializeOptions = Pick<SerializeOptions, "skipAuthorization">;
+/**
+ * Extension-specific view of {@link SerializeOptions}.
+ *
+ * @category Integration
+ */
+export type ExtensionSerializeOptions = Pick<SerializeOptions, "skipSchema">;
+/**
+ * Compiled serializer function used during plan/declarative export rendering.
+ *
+ * @category Integration
+ */
 export type ChangeSerializer = (change: Change) => string | undefined;

package/dist/core/integrations/supabase.d.ts

@@ -7,4 +7,12 @@
  * - Skips authorization for schema creates owned by Supabase system roles
  */
 import type { IntegrationDSL } from "./integration-dsl.ts";
+/**
+ * To generate the emptyCatalog snapshot, run catalog-export against a fresh
+ * supabase/postgres container:
+ *
+ *   pgdelta catalog-export --target postgres://postgres:postgres@localhost:54322/postgres --output supabase-baseline.json
+ *
+ * Then import and assign the JSON content to the emptyCatalog field below.
+ */
 export declare const supabase: IntegrationDSL;

package/dist/core/integrations/supabase.js

@@ -13,6 +13,7 @@ const SUPABASE_SYSTEM_SCHEMAS = [
     "_supavisor",
     "auth",
     "cron",
+    "etl",
     "extensions",
     "graphql",
     "graphql_public",
@@ -53,41 +54,123 @@ const SUPABASE_SYSTEM_ROLES = [
     "supabase_storage_admin",
     "supabase_superuser",
 ];
+/**
+ * To generate the emptyCatalog snapshot, run catalog-export against a fresh
+ * supabase/postgres container:
+ *
+ *   pgdelta catalog-export --target postgres://postgres:postgres@localhost:54322/postgres --output supabase-baseline.json
+ *
+ * Then import and assign the JSON content to the emptyCatalog field below.
+ */
 export const supabase = {
+    // TODO: emptyCatalog: undefined -- populate by running catalog-export on a clean Supabase container
     filter: {
         or: [
+            // Include user schema CREATE operations (only schemas not in system list)
             {
                 and: [
                     {
-                        type: "schema",
+                        objectType: "schema",
                         operation: "create",
                         scope: "object",
                     },
                     {
                         not: {
-                            schema: [...SUPABASE_SYSTEM_SCHEMAS],
+                            // Schema objects have name, not schema — use schema/name
+                            "schema/name": [...SUPABASE_SYSTEM_SCHEMAS],
                         },
                     },
                 ],
             },
+            // Include extension CREATEs
             {
-                type: "extension",
+                objectType: "extension",
                 operation: "create",
                 scope: "object",
             },
+            // Include extension DROPs used to disable some extensions (eg: pg-net)
+            {
+                objectType: "extension",
+                operation: "drop",
+                scope: "object",
+            },
+            // Include user-attached triggers on tables in Supabase-managed schemas.
+            //
+            // Triggers live in the schema of the table they fire on, so a user
+            // trigger on `auth.users` reports `trigger/schema = auth` and is
+            // otherwise indistinguishable from Supabase's own triggers via the
+            // schema-level deny list. Triggers also have no real owner — pg-delta
+            // surfaces the parent table's owner as `trigger/owner`, which for
+            // `auth.users` and `storage.objects` is always a Supabase system role,
+            // so the owner-level deny list catches them too.
+            //
+            // The trigger function, however, is genuinely user-owned: a customer
+            // who wants to run code on an auth event creates a function in
+            // `public` (or any non-managed schema) and points the trigger at it.
+            // Supabase's own auth/storage triggers either come from extensions
+            // (already filtered out at extract time via `pg_depend`) or call
+            // functions inside the same managed schema, so `function_schema`
+            // outside the managed list is a reliable user-defined marker.
+            {
+                and: [
+                    { objectType: "trigger" },
+                    { "trigger/schema": [...SUPABASE_SYSTEM_SCHEMAS] },
+                    {
+                        not: {
+                            "trigger/function_schema": [...SUPABASE_SYSTEM_SCHEMAS],
+                        },
+                    },
+                    // Defensive fallback for dynamically-created pgmq queue /
+                    // archive tables. `pgmq.q_<name>` and `pgmq.a_<name>` are
+                    // materialized by `select pgmq.create('<name>')`, NOT by
+                    // `CREATE EXTENSION pgmq`, so emitting a user trigger against
+                    // them fails locally with
+                    // `relation "pgmq.q_<name>" does not exist`. On a healthy
+                    // install the trigger extractor's `extension_table_oids` join
+                    // (packages/pg-delta/src/core/objects/trigger/trigger.model.ts)
+                    // already drops these via the `pg_depend deptype='e'` row pgmq
+                    // records during `pgmq.create()`; this rule covers projects
+                    // where that row is missing (older pgmq, manual table
+                    // rewrites, `pg_dump`/restore that loses extension deps, ...).
+                    // pgmq 1.4.4 — the version Supabase Cloud currently ships —
+                    // does not record the dependency at all.
+                    {
+                        not: {
+                            and: [
+                                { "trigger/schema": "pgmq" },
+                                {
+                                    "trigger/table_name": { op: "regex", value: "^[qa]_" },
+                                },
+                            ],
+                        },
+                    },
+                ],
+            },
+            // Exclude system objects
             {
                 not: {
                     or: [
+                        // Objects in system schemas (*/schema matches table/schema, view/schema, etc.)
+                        {
+                            "*/schema": [...SUPABASE_SYSTEM_SCHEMAS],
+                        },
+                        // Schema objects whose own name is a system schema
                         {
-                            schema: [...SUPABASE_SYSTEM_SCHEMAS],
+                            "schema/name": [...SUPABASE_SYSTEM_SCHEMAS],
                         },
+                        // Objects owned by system roles (*/owner matches table/owner, schema/owner, etc.)
                         {
-                            owner: [...SUPABASE_SYSTEM_ROLES],
+                            "*/owner": [...SUPABASE_SYSTEM_ROLES],
                         },
+                        // Role objects whose own name is a system role
+                        {
+                            "role/name": [...SUPABASE_SYSTEM_ROLES],
+                        },
+                        // Membership changes for system roles
                         {
                             and: [
                                 {
-                                    type: "role",
+                                    objectType: "role",
                                     scope: "membership",
                                 },
                                 {
@@ -95,6 +178,129 @@ export const supabase = {
                                 },
                             ],
                         },
+                        // Platform-managed foreign data wrapper ACL.
+                        // `GRANT`/`REVOKE ... ON FOREIGN DATA WRAPPER` requires
+                        // superuser. On Supabase Cloud `postgres` has the elevated
+                        // rights to make this work, but the local Docker image does
+                        // not, so `supabase db reset` aborts with
+                        // `permission denied for foreign-data wrapper`. The
+                        // `*/owner` rule above already covers wrappers owned by
+                        // `supabase_admin`, but `pg_dump` rewrites OWNER TO clauses
+                        // to whoever the dump runs under, so after a restore the
+                        // FDW typically ends up owned by `postgres` and slips past
+                        // the owner gate. A non-superuser `postgres` still can't
+                        // grant on a FDW (this is true regardless of who owns the
+                        // wrapper locally), so the ACL diff is not user-replayable.
+                        // We don't apply the same blanket rule to `FOREIGN SERVER`:
+                        // server GRANT/REVOKE doesn't require superuser, and
+                        // user-created servers (e.g. a `dblink` server pointing to
+                        // a peer DB) carry legitimate user ACL that should
+                        // roundtrip — the existing `*/owner` rule already drops
+                        // platform-managed servers.
+                        {
+                            and: [
+                                { objectType: "foreign_data_wrapper" },
+                                { scope: "privilege" },
+                            ],
+                        },
+                        // Platform-managed foreign data wrappers — Wasm-based FDWs
+                        // (e.g. `clerk`, `clerk_oauth`) provisioned via the `wrappers`
+                        // extension. Supabase Cloud creates these as
+                        // `CREATE FOREIGN DATA WRAPPER clerk_oauth HANDLER
+                        // extensions.wasm_fdw_handler VALIDATOR
+                        // extensions.wasm_fdw_validator` at project creation; replaying
+                        // the DDL against a local image fails because the local
+                        // environment has no equivalent pre-step. We can't rely on the
+                        // FDW owner alone — after a dump/restore the owner is often
+                        // rewritten away from `supabase_admin` — so match on the shared
+                        // Wasm handler/validator (`extensions.wasm_fdw_handler` /
+                        // `extensions.wasm_fdw_validator`) instead.
+                        //
+                        // Matching the bare `extensions.*` namespace would be too broad:
+                        // contrib FDWs like `postgres_fdw` also install their
+                        // handler/validator into `extensions` on Supabase, and those ARE
+                        // available in the local image, so a user-created `postgres_fdw`
+                        // wrapper (and its servers/foreign tables/user mappings) must
+                        // still roundtrip. Keying on the `wasm_fdw_*` function names
+                        // targets only the platform Wasm wrappers.
+                        {
+                            and: [
+                                { objectType: "foreign_data_wrapper" },
+                                {
+                                    or: [
+                                        {
+                                            "foreign_data_wrapper/handler": {
+                                                op: "regex",
+                                                value: "^extensions\\.wasm_fdw_handler$",
+                                            },
+                                        },
+                                        {
+                                            "foreign_data_wrapper/validator": {
+                                                op: "regex",
+                                                value: "^extensions\\.wasm_fdw_validator$",
+                                            },
+                                        },
+                                    ],
+                                },
+                            ],
+                        },
+                        // Platform-managed Wasm FDW dependents (CLI-1470 follow-up).
+                        // Suppressing the wrapper DDL alone leaves `CREATE SERVER` /
+                        // `CREATE FOREIGN TABLE` / `CREATE USER MAPPING` that reference
+                        // a wrapper local Docker never provisions (`clerk_oauth`, etc.).
+                        // Match on the parent wrapper's Wasm handler/validator
+                        // (`extensions.wasm_fdw_handler` / `extensions.wasm_fdw_validator`,
+                        // joined at extract time) — the same discriminator used for the
+                        // wrapper itself above. A bare `extensions.*` match would also
+                        // drop user-created `postgres_fdw` servers/foreign tables/user
+                        // mappings (whose handler installs into `extensions` but which
+                        // the local image CAN provision), so keep it scoped to the Wasm
+                        // function names. Server _privilege_ scope is excluded here —
+                        // `GRANT/REVOKE ON SERVER` does not require superuser and remains
+                        // user-declarative state (see CLI-1469 companion test).
+                        {
+                            and: [
+                                { objectType: "server" },
+                                { not: { scope: "privilege" } },
+                                {
+                                    or: [
+                                        {
+                                            "{server,foreign_table,user_mapping}/wrapper_handler": {
+                                                op: "regex",
+                                                value: "^extensions\\.wasm_fdw_handler$",
+                                            },
+                                        },
+                                        {
+                                            "{server,foreign_table,user_mapping}/wrapper_validator": {
+                                                op: "regex",
+                                                value: "^extensions\\.wasm_fdw_validator$",
+                                            },
+                                        },
+                                    ],
+                                },
+                            ],
+                        },
+                        {
+                            and: [
+                                { objectType: ["foreign_table", "user_mapping"] },
+                                {
+                                    or: [
+                                        {
+                                            "{server,foreign_table,user_mapping}/wrapper_handler": {
+                                                op: "regex",
+                                                value: "^extensions\\.wasm_fdw_handler$",
+                                            },
+                                        },
+                                        {
+                                            "{server,foreign_table,user_mapping}/wrapper_validator": {
+                                                op: "regex",
+                                                value: "^extensions\\.wasm_fdw_validator$",
+                                            },
+                                        },
+                                    ],
+                                },
+                            ],
+                        },
                     ],
                 },
             },
@@ -103,14 +309,42 @@ export const supabase = {
     serialize: [
         {
             when: {
-                type: "schema",
+                objectType: "schema",
                 operation: "create",
                 scope: "object",
-                owner: [...SUPABASE_SYSTEM_ROLES],
+                "schema/owner": [...SUPABASE_SYSTEM_ROLES],
             },
             options: {
                 skipAuthorization: true,
             },
         },
+        // Extensions whose install script creates its own target schema cannot
+        // tolerate `CREATE EXTENSION … WITH SCHEMA <self>` against a fresh
+        // database: Postgres resolves WITH SCHEMA before running the extension's
+        // script, so the schema referenced by the clause does not exist yet.
+        // These extensions also install into schemas listed in
+        // SUPABASE_SYSTEM_SCHEMAS, so pg-delta filters their CREATE SCHEMA out
+        // of the declarative plan — nothing else will pre-create the schema.
+        // Emitting a bare `CREATE EXTENSION <name>` lets the extension's own
+        // install script create the schema it expects.
+        //
+        // Note: other extensions install into SUPABASE_SYSTEM_SCHEMAS too
+        // (`pg_graphql` → `graphql`, `supabase_vault` → `vault`,
+        // `uuid-ossp`/`pgcrypto`/`pg_net`/`pg_stat_statements` → `extensions`),
+        // but those schemas are created by the supabase/postgres image baseline
+        // and survive `DROP EXTENSION … CASCADE`, so `CREATE EXTENSION … WITH
+        // SCHEMA <schema>` finds the schema and succeeds. Only the three below
+        // have self-created schemas that are absent from the baseline.
+        {
+            when: {
+                objectType: "extension",
+                operation: "create",
+                scope: "object",
+                "extension/schema": ["pgmq", "pgsodium", "pgtle"],
+            },
+            options: {
+                skipSchema: true,
+            },
+        },
     ],
 };

package/dist/core/objects/aggregate/aggregate.diff.d.ts

@@ -1,10 +1,4 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { Aggregate } from "./aggregate.model.ts";
 import type { AggregateChange } from "./changes/aggregate.types.ts";
-export declare function diffAggregates(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Aggregate>, branch: Record<string, Aggregate>): AggregateChange[];
+export declare function diffAggregates(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Aggregate>, branch: Record<string, Aggregate>): AggregateChange[];

package/dist/core/objects/aggregate/aggregate.diff.js

@@ -1,11 +1,13 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../base.privilege-diff.js";
+import { diffSecurityLabels } from "../security-label.types.js";
 import { deepEqual, hasNonAlterableChanges } from "../utils.js";
 import { AlterAggregateChangeOwner } from "./changes/aggregate.alter.js";
 import { CreateCommentOnAggregate, DropCommentOnAggregate, } from "./changes/aggregate.comment.js";
 import { CreateAggregate } from "./changes/aggregate.create.js";
 import { DropAggregate } from "./changes/aggregate.drop.js";
 import { GrantAggregatePrivileges, RevokeAggregatePrivileges, RevokeGrantOptionAggregatePrivileges, } from "./changes/aggregate.privilege.js";
+import { CreateSecurityLabelOnAggregate, DropSecurityLabelOnAggregate, } from "./changes/aggregate.security-label.js";
 export function diffAggregates(ctx, main, branch) {
     const { created, dropped, altered } = diffObjects(main, branch);
     const changes = [];
@@ -23,54 +25,33 @@ export function diffAggregates(ctx, main, branch) {
         if (aggregate.comment !== null) {
             changes.push(new CreateCommentOnAggregate({ aggregate }));
         }
+        for (const label of aggregate.security_labels) {
+            changes.push(new CreateSecurityLabelOnAggregate({
+                aggregate,
+                securityLabel: label,
+            }));
+        }
         // PRIVILEGES: For created objects, compare against default privileges state
         // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
         // so objects are created with the default privileges state in effect.
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "aggregate", aggregate.schema ?? "");
+        const creatorFilteredDefaults = aggregate.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         // Filter out PUBLIC's built-in default EXECUTE privilege (PostgreSQL grants it automatically)
         // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
         // This prevents generating unnecessary "GRANT EXECUTE TO PUBLIC" statements
         const desiredPrivileges = filterPublicBuiltInDefaults("aggregate", aggregate.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the aggregate owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, aggregate.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [, list] of grantGroups) {
-                    changes.push(new GrantAggregatePrivileges({
-                        aggregate,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [, list] of revokeGroups) {
-                    changes.push(new RevokeAggregatePrivileges({
-                        aggregate,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionAggregatePrivileges({
-                    aggregate,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("aggregate", creatorFilteredDefaults), desiredPrivileges, aggregate.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, aggregate, aggregate, "aggregate", {
+            Grant: GrantAggregatePrivileges,
+            Revoke: RevokeAggregatePrivileges,
+            RevokeGrantOption: RevokeGrantOptionAggregatePrivileges,
+        }, ctx.version));
     }
     for (const aggregateId of dropped) {
         changes.push(new DropAggregate({ aggregate: main[aggregateId] }));
@@ -140,6 +121,14 @@ export function diffAggregates(ctx, main, branch) {
                 changes.push(new CreateCommentOnAggregate({ aggregate: branchAggregate }));
             }
         }
+        // SECURITY LABELS
+        changes.push(...diffSecurityLabels(mainAggregate.security_labels, branchAggregate.security_labels, (securityLabel) => new CreateSecurityLabelOnAggregate({
+            aggregate: branchAggregate,
+            securityLabel,
+        }), (securityLabel) => new DropSecurityLabelOnAggregate({
+            aggregate: mainAggregate,
+            securityLabel,
+        })));
         // PRIVILEGES
         // Filter out PUBLIC's built-in default EXECUTE privilege from main catalog
         // (PostgreSQL grants it automatically, so we shouldn't compare it)
@@ -148,39 +137,12 @@ export function diffAggregates(ctx, main, branch) {
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("aggregate", branchAggregate.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchAggregate.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [, list] of grantGroups) {
-                    changes.push(new GrantAggregatePrivileges({
-                        aggregate: branchAggregate,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [, list] of revokeGroups) {
-                    changes.push(new RevokeAggregatePrivileges({
-                        aggregate: mainAggregate,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionAggregatePrivileges({
-                    aggregate: mainAggregate,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchAggregate.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchAggregate, mainAggregate, "aggregate", {
+            Grant: GrantAggregatePrivileges,
+            Revoke: RevokeAggregatePrivileges,
+            RevokeGrantOption: RevokeGrantOptionAggregatePrivileges,
+        }, ctx.version));
     }
     return changes;
 }

package/dist/core/objects/aggregate/aggregate.model.d.ts

@@ -2,6 +2,7 @@ import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
+import { type SecurityLabelProps } from "../security-label.types.ts";
 declare const aggregatePropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
@@ -16,9 +17,9 @@ declare const aggregatePropsSchema: z.ZodObject<{
     return_type: z.ZodString;
     return_type_schema: z.ZodNullable<z.ZodString>;
     parallel_safety: z.ZodEnum<{
-        r: "r";
         u: "u";
         s: "s";
+        r: "r";
     }>;
     is_strict: z.ZodBoolean;
     transition_function: z.ZodString;
@@ -28,8 +29,8 @@ declare const aggregatePropsSchema: z.ZodObject<{
     final_function: z.ZodNullable<z.ZodString>;
     final_function_extra_args: z.ZodBoolean;
     final_function_modify: z.ZodNullable<z.ZodEnum<{
-        r: "r";
         s: "s";
+        r: "r";
         w: "w";
     }>>;
     combine_function: z.ZodNullable<z.ZodString>;
@@ -44,8 +45,8 @@ declare const aggregatePropsSchema: z.ZodObject<{
     moving_final_function: z.ZodNullable<z.ZodString>;
     moving_final_function_extra_args: z.ZodBoolean;
     moving_final_function_modify: z.ZodNullable<z.ZodEnum<{
-        r: "r";
         s: "s";
+        r: "r";
         w: "w";
     }>>;
     moving_initial_condition: z.ZodNullable<z.ZodString>;
@@ -56,8 +57,8 @@ declare const aggregatePropsSchema: z.ZodObject<{
     argument_types: z.ZodNullable<z.ZodArray<z.ZodString>>;
     all_argument_types: z.ZodNullable<z.ZodArray<z.ZodString>>;
     argument_modes: z.ZodNullable<z.ZodArray<z.ZodEnum<{
-        o: "o";
         i: "i";
+        o: "o";
         b: "b";
         v: "v";
         t: "t";
@@ -71,6 +72,10 @@ declare const aggregatePropsSchema: z.ZodObject<{
         grantable: z.ZodBoolean;
         columns: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     }, z.z.core.$strip>>;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
 }, z.z.core.$strip>;
 type AggregatePrivilegeProps = PrivilegeProps;
 type AggregateProps = z.infer<typeof aggregatePropsSchema>;
@@ -116,6 +121,7 @@ export declare class Aggregate extends BasePgModel {
     readonly owner: AggregateProps["owner"];
     readonly comment: AggregateProps["comment"];
     readonly privileges: AggregatePrivilegeProps[];
+    readonly security_labels: SecurityLabelProps[];
     constructor(props: AggregateProps);
     get stableId(): `aggregate:${string}`;
     get identityFields(): {
@@ -129,7 +135,7 @@ export declare class Aggregate extends BasePgModel {
         num_direct_args: number;
         return_type: string;
         return_type_schema: string | null;
-        parallel_safety: "r" | "u" | "s";
+        parallel_safety: "u" | "s" | "r";
         is_strict: boolean;
         transition_function: string;
         state_data_type: string;
@@ -137,7 +143,7 @@ export declare class Aggregate extends BasePgModel {
         state_data_space: number;
         final_function: string | null;
         final_function_extra_args: boolean;
-        final_function_modify: "r" | "s" | "w" | null;
+        final_function_modify: "s" | "r" | "w" | null;
         combine_function: string | null;
         serial_function: string | null;
         deserial_function: string | null;
@@ -149,7 +155,7 @@ export declare class Aggregate extends BasePgModel {
         moving_state_data_space: number | null;
         moving_final_function: string | null;
         moving_final_function_extra_args: boolean;
-        moving_final_function_modify: "r" | "s" | "w" | null;
+        moving_final_function_modify: "s" | "r" | "w" | null;
         moving_initial_condition: string | null;
         sort_operator: string | null;
         argument_count: number;
@@ -157,7 +163,7 @@ export declare class Aggregate extends BasePgModel {
         argument_names: string[] | null;
         argument_types: string[] | null;
         all_argument_types: string[] | null;
-        argument_modes: ("o" | "i" | "b" | "v" | "t")[] | null;
+        argument_modes: ("i" | "o" | "b" | "v" | "t")[] | null;
         argument_defaults: string | null;
         identity_arguments: string;
         owner: string;
@@ -168,6 +174,10 @@ export declare class Aggregate extends BasePgModel {
             grantable: boolean;
             columns?: string[] | null | undefined;
         }[];
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
 }
 export declare function extractAggregates(pool: Pool): Promise<Aggregate[]>;