@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/core/objects/foreign-data-wrapper/foreign-table/changes/foreign-table.security-label.js

@@ -0,0 +1,61 @@
+import { quoteLiteral } from "../../../base.change.js";
+import { stableId } from "../../../utils.js";
+import { CreateForeignTableChange, DropForeignTableChange, } from "./foreign-table.base.js";
+export class CreateSecurityLabelOnForeignTable extends CreateForeignTableChange {
+    foreignTable;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.foreignTable = props.foreignTable;
+        this.securityLabel = props.securityLabel;
+    }
+    get creates() {
+        return [
+            stableId.securityLabel(this.foreignTable.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [this.foreignTable.stableId];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON FOREIGN TABLE",
+            `${this.foreignTable.schema}.${this.foreignTable.name}`,
+            "IS",
+            quoteLiteral(this.securityLabel.label),
+        ].join(" ");
+    }
+}
+export class DropSecurityLabelOnForeignTable extends DropForeignTableChange {
+    foreignTable;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.foreignTable = props.foreignTable;
+        this.securityLabel = props.securityLabel;
+    }
+    get drops() {
+        return [
+            stableId.securityLabel(this.foreignTable.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [
+            stableId.securityLabel(this.foreignTable.stableId, this.securityLabel.provider),
+            this.foreignTable.stableId,
+        ];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON FOREIGN TABLE",
+            `${this.foreignTable.schema}.${this.foreignTable.name}`,
+            "IS NULL",
+        ].join(" ");
+    }
+}

package/dist/core/objects/foreign-data-wrapper/foreign-table/changes/foreign-table.types.d.ts

@@ -3,4 +3,6 @@ import type { CommentForeignTable } from "./foreign-table.comment.ts";
 import type { CreateForeignTable } from "./foreign-table.create.ts";
 import type { DropForeignTable } from "./foreign-table.drop.ts";
 import type { ForeignTablePrivilege } from "./foreign-table.privilege.ts";
-export type ForeignTableChange = AlterForeignTable | CommentForeignTable | CreateForeignTable | DropForeignTable | ForeignTablePrivilege;
+import type { SecurityLabelForeignTable } from "./foreign-table.security-label.ts";
+/** Union of all foreign-table-related change variants (`objectType: "foreign_table"`). @category Change Types */
+export type ForeignTableChange = AlterForeignTable | CommentForeignTable | CreateForeignTable | DropForeignTable | ForeignTablePrivilege | SecurityLabelForeignTable;

package/dist/core/objects/foreign-data-wrapper/foreign-table/foreign-table.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import type { ForeignTableChange } from "./changes/foreign-table.types.ts";
 import type { ForeignTable } from "./foreign-table.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { ForeignTable } from "./foreign-table.model.ts";
  * @param branch - The foreign tables in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffForeignTables(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, ForeignTable>, branch: Record<string, ForeignTable>): ForeignTableChange[];
+export declare function diffForeignTables(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, ForeignTable>, branch: Record<string, ForeignTable>): ForeignTableChange[];

package/dist/core/objects/foreign-data-wrapper/foreign-table/foreign-table.diff.js

@@ -1,10 +1,12 @@
 import { diffObjects } from "../../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
+import { diffSecurityLabels } from "../../security-label.types.js";
 import { AlterForeignTableAddColumn, AlterForeignTableAlterColumnDropDefault, AlterForeignTableAlterColumnDropNotNull, AlterForeignTableAlterColumnSetDefault, AlterForeignTableAlterColumnSetNotNull, AlterForeignTableAlterColumnType, AlterForeignTableChangeOwner, AlterForeignTableDropColumn, AlterForeignTableSetOptions, } from "./changes/foreign-table.alter.js";
 import { CreateCommentOnForeignTable, DropCommentOnForeignTable, } from "./changes/foreign-table.comment.js";
 import { CreateForeignTable } from "./changes/foreign-table.create.js";
 import { DropForeignTable } from "./changes/foreign-table.drop.js";
 import { GrantForeignTablePrivileges, RevokeForeignTablePrivileges, RevokeGrantOptionForeignTablePrivileges, } from "./changes/foreign-table.privilege.js";
+import { CreateSecurityLabelOnForeignTable, DropSecurityLabelOnForeignTable, } from "./changes/foreign-table.security-label.js";
 /**
  * Diff two sets of foreign tables from main and branch catalogs.
  *
@@ -30,47 +32,24 @@ export function diffForeignTables(ctx, main, branch) {
         if (createdTable.comment !== null) {
             changes.push(new CreateCommentOnForeignTable({ foreignTable: createdTable }));
         }
+        for (const label of createdTable.security_labels) {
+            changes.push(new CreateSecurityLabelOnForeignTable({
+                foreignTable: createdTable,
+                securityLabel: label,
+            }));
+        }
         // PRIVILEGES: For created objects, compare against default privileges state
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "foreign_table", createdTable.schema ?? "");
+        const creatorFilteredDefaults = createdTable.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = filterPublicBuiltInDefaults("foreign_table", createdTable.privileges);
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdTable.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantForeignTablePrivileges({
-                        foreignTable: createdTable,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeForeignTablePrivileges({
-                        foreignTable: createdTable,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionForeignTablePrivileges({
-                    foreignTable: createdTable,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("foreign_table", creatorFilteredDefaults), desiredPrivileges, createdTable.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdTable, createdTable, "foreignTable", {
+            Grant: GrantForeignTablePrivileges,
+            Revoke: RevokeForeignTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionForeignTablePrivileges,
+        }, ctx.version));
     }
     for (const tableId of dropped) {
         changes.push(new DropForeignTable({ foreignTable: main[tableId] }));
@@ -177,47 +156,23 @@ export function diffForeignTables(ctx, main, branch) {
                 changes.push(new CreateCommentOnForeignTable({ foreignTable: branchTable }));
             }
         }
+        // SECURITY LABELS
+        changes.push(...diffSecurityLabels(mainTable.security_labels, branchTable.security_labels, (securityLabel) => new CreateSecurityLabelOnForeignTable({
+            foreignTable: branchTable,
+            securityLabel,
+        }), (securityLabel) => new DropSecurityLabelOnForeignTable({
+            foreignTable: mainTable,
+            securityLabel,
+        })));
         // PRIVILEGES
         const mainPrivilegesFiltered = filterPublicBuiltInDefaults("foreign_table", mainTable.privileges);
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("foreign_table", branchTable.privileges);
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchTable.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantForeignTablePrivileges({
-                        foreignTable: branchTable,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeForeignTablePrivileges({
-                        foreignTable: mainTable,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionForeignTablePrivileges({
-                    foreignTable: mainTable,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchTable.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchTable, mainTable, "foreignTable", {
+            Grant: GrantForeignTablePrivileges,
+            Revoke: RevokeForeignTablePrivileges,
+            RevokeGrantOption: RevokeGrantOptionForeignTablePrivileges,
+        }, ctx.version));
         // Note: Foreign table renaming would also use ALTER FOREIGN TABLE ... RENAME TO ...
         // But since our ForeignTable model uses 'name' as the identity field,
         // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/foreign-data-wrapper/foreign-table/foreign-table.model.d.ts

@@ -2,6 +2,7 @@ import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel, type TableLikeObject } from "../../base.model.ts";
 import { type PrivilegeProps } from "../../base.privilege-diff.ts";
+import { type SecurityLabelProps } from "../../security-label.types.ts";
 /**
  * All properties exposed by CREATE FOREIGN TABLE statement are included in diff output.
  * https://www.postgresql.org/docs/17/sql-createforeigntable.html
@@ -36,6 +37,10 @@ declare const foreignTablePropsSchema: z.ZodObject<{
         collation: z.ZodNullable<z.ZodString>;
         default: z.ZodNullable<z.ZodString>;
         comment: z.ZodNullable<z.ZodString>;
+        security_labels: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            provider: z.ZodString;
+            label: z.ZodString;
+        }, z.z.core.$strip>>>;
     }, z.z.core.$strip>>;
     privileges: z.ZodArray<z.ZodObject<{
         grantee: z.ZodString;
@@ -43,6 +48,12 @@ declare const foreignTablePropsSchema: z.ZodObject<{
         grantable: z.ZodBoolean;
         columns: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     }, z.z.core.$strip>>;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
+    wrapper_handler: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    wrapper_validator: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.z.core.$strip>;
 type ForeignTablePrivilegeProps = PrivilegeProps;
 export type ForeignTableProps = z.infer<typeof foreignTablePropsSchema>;
@@ -55,6 +66,9 @@ export declare class ForeignTable extends BasePgModel implements TableLikeObject
     readonly comment: ForeignTableProps["comment"];
     readonly columns: ForeignTableProps["columns"];
     readonly privileges: ForeignTablePrivilegeProps[];
+    readonly security_labels: SecurityLabelProps[];
+    readonly wrapper_handler: ForeignTableProps["wrapper_handler"];
+    readonly wrapper_validator: ForeignTableProps["wrapper_validator"];
     constructor(props: ForeignTableProps);
     get stableId(): `foreignTable:${string}`;
     get identityFields(): {
@@ -83,6 +97,10 @@ export declare class ForeignTable extends BasePgModel implements TableLikeObject
             collation: string | null;
             default: string | null;
             comment: string | null;
+            security_labels?: {
+                provider: string;
+                label: string;
+            }[] | undefined;
         }[];
         privileges: {
             grantee: string;
@@ -90,6 +108,10 @@ export declare class ForeignTable extends BasePgModel implements TableLikeObject
             grantable: boolean;
             columns?: string[] | null | undefined;
         }[];
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
     stableSnapshot(): {
         identity: {
@@ -100,6 +122,10 @@ export declare class ForeignTable extends BasePgModel implements TableLikeObject
             columns: {
                 [x: string]: unknown;
             }[];
+            security_labels: {
+                provider: string;
+                label: string;
+            }[];
             owner: string;
             server: string;
             options: string[] | null;
@@ -113,5 +139,16 @@ export declare class ForeignTable extends BasePgModel implements TableLikeObject
         };
     };
 }
+/**
+ * Extract `pg_foreign_table` rows into `ForeignTable` models.
+ *
+ * The returned models carry option values **verbatim** from
+ * `pg_foreign_table.ftoptions`, which means a wrapper that puts
+ * credentials at the table level (uncommon but possible) would expose
+ * them cleartext in memory. Always route through `extractCatalog`
+ * (which calls `normalizeCatalog`) before emitting options to any
+ * output channel — see CLI-1467 and
+ * `packages/pg-delta/src/core/objects/foreign-data-wrapper/sensitive-options.ts`.
+ */
 export declare function extractForeignTables(pool: Pool): Promise<ForeignTable[]>;
 export {};

package/dist/core/objects/foreign-data-wrapper/foreign-table/foreign-table.model.js

@@ -2,6 +2,7 @@ import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel, columnPropsSchema, } from "../../base.model.js";
 import { privilegePropsSchema, } from "../../base.privilege-diff.js";
+import { normalizeSecurityLabels, securityLabelPropsSchema, } from "../../security-label.types.js";
 /**
  * All properties exposed by CREATE FOREIGN TABLE statement are included in diff output.
  * https://www.postgresql.org/docs/17/sql-createforeigntable.html
@@ -21,6 +22,10 @@ const foreignTablePropsSchema = z.object({
     comment: z.string().nullable(),
     columns: z.array(columnPropsSchema),
     privileges: z.array(privilegePropsSchema),
+    security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
+    // Parent FDW handler/validator — filter metadata only, not in dataFields.
+    wrapper_handler: z.string().nullable().optional(),
+    wrapper_validator: z.string().nullable().optional(),
 });
 export class ForeignTable extends BasePgModel {
     schema;
@@ -31,6 +36,9 @@ export class ForeignTable extends BasePgModel {
     comment;
     columns;
     privileges;
+    security_labels;
+    wrapper_handler;
+    wrapper_validator;
     constructor(props) {
         super();
         // Identity fields
@@ -43,6 +51,9 @@ export class ForeignTable extends BasePgModel {
         this.comment = props.comment;
         this.columns = props.columns;
         this.privileges = props.privileges;
+        this.security_labels = props.security_labels ?? [];
+        this.wrapper_handler = props.wrapper_handler ?? null;
+        this.wrapper_validator = props.wrapper_validator ?? null;
     }
     get stableId() {
         return `foreignTable:${this.schema}.${this.name}`;
@@ -61,6 +72,7 @@ export class ForeignTable extends BasePgModel {
             comment: this.comment,
             columns: this.columns,
             privileges: this.privileges,
+            security_labels: this.security_labels,
         };
     }
     stableSnapshot() {
@@ -79,10 +91,22 @@ export class ForeignTable extends BasePgModel {
             data: {
                 ...this.dataFields,
                 columns: normalizeColumns(),
+                security_labels: normalizeSecurityLabels(this.security_labels),
             },
         };
     }
 }
+/**
+ * Extract `pg_foreign_table` rows into `ForeignTable` models.
+ *
+ * The returned models carry option values **verbatim** from
+ * `pg_foreign_table.ftoptions`, which means a wrapper that puts
+ * credentials at the table level (uncommon but possible) would expose
+ * them cleartext in memory. Always route through `extractCatalog`
+ * (which calls `normalizeCatalog`) before emitting options to any
+ * output channel — see CLI-1467 and
+ * `packages/pg-delta/src/core/objects/foreign-data-wrapper/sensitive-options.ts`.
+ */
 export async function extractForeignTables(pool) {
     const { rows: tableRows } = await pool.query(sql `
       with extension_oids as (
@@ -97,12 +121,22 @@ export async function extractForeignTables(pool) {
           c.relowner::regrole::text as owner,
           quote_ident(srv.srvname) as server,
           coalesce(ft.ftoptions, array[]::text[]) as options,
-          c.oid as oid
+          c.oid as oid,
+          case
+            when fdw.fdwhandler = 0 then null
+            else p_handler.pronamespace::regnamespace::text || '.' || quote_ident(p_handler.proname)
+          end as wrapper_handler,
+          case
+            when fdw.fdwvalidator = 0 then null
+            else p_validator.pronamespace::regnamespace::text || '.' || quote_ident(p_validator.proname)
+          end as wrapper_validator
         from
           pg_class c
           inner join pg_foreign_table ft on ft.ftrelid = c.oid
           inner join pg_foreign_server srv on srv.oid = ft.ftserver
           inner join pg_foreign_data_wrapper fdw on fdw.oid = srv.srvfdw
+          left join pg_catalog.pg_proc p_handler on p_handler.oid = fdw.fdwhandler
+          left join pg_catalog.pg_proc p_validator on p_validator.oid = fdw.fdwvalidator
           left outer join extension_oids e1 on c.oid = e1.objid
         where
           c.relkind = 'f'
@@ -116,6 +150,8 @@ export async function extractForeignTables(pool) {
         ft.owner,
         ft.server,
         ft.options,
+        ft.wrapper_handler,
+        ft.wrapper_validator,
         obj_description(ft.oid, 'pg_class') as comment,
         coalesce(json_agg(
           case when a.attname is not null then
@@ -168,7 +204,7 @@ export async function extractForeignTables(pool) {
             from (
               -- one row for object ACL + one row per column ACL
               select null::name as attname, ft.oid as relacl_oid, (
-                select c_rel.relacl from pg_class c_rel where c_rel.oid = ft.oid
+                select COALESCE(c_rel.relacl, acldefault('r', c_rel.relowner)) from pg_class c_rel where c_rel.oid = ft.oid
               ) as acl
               union all
               select a2.attname, ft.oid as relacl_oid, a2.attacl
@@ -181,14 +217,34 @@ export async function extractForeignTables(pool) {
             join lateral aclexplode(src.acl) as x(grantor, grantee, privilege_type, is_grantable) on true
             group by x.grantee, x.privilege_type
           ) as grp
-        ), '[]') as privileges
+        ), '[]') as privileges,
+        coalesce(
+          (
+            select json_agg(
+              json_build_object('provider', sl.provider, 'label', sl.label)
+              order by sl.provider
+            )
+            from pg_catalog.pg_seclabel sl
+            where sl.objoid = ft.oid
+              and sl.classoid = 'pg_class'::regclass
+              and sl.objsubid = 0
+          ),
+          '[]'::json
+        ) as security_labels
       from
         foreign_tables ft
         left join pg_attribute a on a.attrelid = ft.oid and a.attnum > 0 and not a.attisdropped
         left join pg_attrdef ad on a.attrelid = ad.adrelid and a.attnum = ad.adnum
         left join pg_type ty on ty.oid = a.atttypid
       group by
-        ft.oid, ft.schema, ft.name, ft.owner, ft.server, ft.options
+        ft.oid,
+        ft.schema,
+        ft.name,
+        ft.owner,
+        ft.server,
+        ft.options,
+        ft.wrapper_handler,
+        ft.wrapper_validator
       order by
         ft.schema, ft.name
   `);

package/dist/core/objects/foreign-data-wrapper/sensitive-options.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Sensitive-option redaction for foreign-data-wrapper objects.
+ *
+ * Foreign servers (`pg_foreign_server.srvoptions`) and user mappings
+ * (`pg_user_mapping.umoptions`) store libpq/FDW credentials in cleartext.
+ * Any code path that emits these option values verbatim — plan SQL, catalog
+ * snapshots, declarative export, fingerprints — leaks the credentials to
+ * disk, stdout, CI logs, and version control.
+ *
+ * The redaction policy is **allowlist-based**: replace every option value
+ * with `__OPTION_<KEY>__` unless the option key appears in
+ * {@link SAFE_OPTION_KEYS}. Failure mode of a missing entry is "the plan
+ * shows the placeholder instead of the real value" — annoying, but safe;
+ * a denylist's failure mode was secrets leaking, which is the bug we are
+ * fixing (CLI-1467).
+ *
+ * Match is case-insensitive but exact — substrings do not match, so an
+ * option key like `password_validator_extension` will be redacted unless
+ * explicitly allowlisted. When a new wrapper introduces a non-credential
+ * key we want to surface in plans, add it here.
+ */
+export declare function redactOptionValue(key: string, value: string): string;
+/**
+ * Redact non-allowlisted values in a flat `[key, value, key, value, ...]`
+ * options array — the shape used by the {@link Server},
+ * {@link UserMapping}, {@link ForeignDataWrapper}, and {@link ForeignTable}
+ * models.
+ *
+ * Returns `null` for `null` input, and otherwise returns an array of the
+ * same length as the input with sensitive values replaced.
+ */
+export declare function redactSensitiveOptionPairs(options: readonly string[] | null): string[] | null;

package/dist/core/objects/foreign-data-wrapper/sensitive-options.js

@@ -0,0 +1,129 @@
+/**
+ * Sensitive-option redaction for foreign-data-wrapper objects.
+ *
+ * Foreign servers (`pg_foreign_server.srvoptions`) and user mappings
+ * (`pg_user_mapping.umoptions`) store libpq/FDW credentials in cleartext.
+ * Any code path that emits these option values verbatim — plan SQL, catalog
+ * snapshots, declarative export, fingerprints — leaks the credentials to
+ * disk, stdout, CI logs, and version control.
+ *
+ * The redaction policy is **allowlist-based**: replace every option value
+ * with `__OPTION_<KEY>__` unless the option key appears in
+ * {@link SAFE_OPTION_KEYS}. Failure mode of a missing entry is "the plan
+ * shows the placeholder instead of the real value" — annoying, but safe;
+ * a denylist's failure mode was secrets leaking, which is the bug we are
+ * fixing (CLI-1467).
+ *
+ * Match is case-insensitive but exact — substrings do not match, so an
+ * option key like `password_validator_extension` will be redacted unless
+ * explicitly allowlisted. When a new wrapper introduces a non-credential
+ * key we want to surface in plans, add it here.
+ */
+const SAFE_OPTION_KEYS = new Set([
+    // libpq connection params (non-credential subset).
+    //   https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS
+    "host",
+    "hostaddr",
+    "port",
+    "dbname",
+    "user",
+    "sslmode",
+    "sslcompression",
+    "sslcert",
+    "sslkey",
+    "sslrootcert",
+    "sslcrl",
+    "sslcrldir",
+    "sslsni",
+    "requirepeer",
+    "krbsrvname",
+    "gsslib",
+    "sspi",
+    "gssencmode",
+    "gssdelegation",
+    "channel_binding",
+    "target_session_attrs",
+    "application_name",
+    "fallback_application_name",
+    "connect_timeout",
+    "client_encoding",
+    "options",
+    "keepalives",
+    "keepalives_idle",
+    "keepalives_interval",
+    "keepalives_count",
+    "tcp_user_timeout",
+    "replication",
+    "load_balance_hosts",
+    // postgres_fdw behavior tuning.
+    //   https://www.postgresql.org/docs/current/postgres-fdw.html#POSTGRES-FDW-OPTIONS-CONNECTION
+    "use_remote_estimate",
+    "fdw_startup_cost",
+    "fdw_tuple_cost",
+    "fetch_size",
+    "batch_size",
+    "async_capable",
+    "analyze_sampling",
+    "parallel_commit",
+    "parallel_abort",
+    "extensions",
+    "updatable",
+    "truncatable",
+    "schema_name",
+    "table_name",
+    "column_name",
+    // Common shape for table-like FDWs (file_fdw, cloud-storage wrappers).
+    "schema",
+    "database",
+    "table",
+    "format",
+    "header",
+    "delimiter",
+    "quote",
+    "escape",
+    "encoding",
+    "compression",
+    // Cloud / Supabase Wrappers non-credential shape.
+    //   https://github.com/supabase/wrappers
+    "region",
+    "endpoint",
+    "bucket",
+    "prefix",
+    "location",
+    "project_id",
+    "dataset_id",
+    "dataset",
+    "workspace",
+    "organization",
+    "api_version",
+]);
+function redactedOptionPlaceholder(key) {
+    return `__OPTION_${key.toUpperCase()}__`;
+}
+export function redactOptionValue(key, value) {
+    return SAFE_OPTION_KEYS.has(key.toLowerCase())
+        ? value
+        : redactedOptionPlaceholder(key);
+}
+/**
+ * Redact non-allowlisted values in a flat `[key, value, key, value, ...]`
+ * options array — the shape used by the {@link Server},
+ * {@link UserMapping}, {@link ForeignDataWrapper}, and {@link ForeignTable}
+ * models.
+ *
+ * Returns `null` for `null` input, and otherwise returns an array of the
+ * same length as the input with sensitive values replaced.
+ */
+export function redactSensitiveOptionPairs(options) {
+    if (options === null)
+        return null;
+    const result = [];
+    for (let i = 0; i < options.length; i += 2) {
+        const key = options[i];
+        const value = options[i + 1];
+        if (key === undefined || value === undefined)
+            continue;
+        result.push(key, redactOptionValue(key, value));
+    }
+    return result;
+}

package/dist/core/objects/foreign-data-wrapper/server/changes/server.alter.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../../integrations/serialize/serialize.types.ts";
 import type { Server } from "../server.model.ts";
 import { AlterServerChange } from "./server.base.ts";
 /**
@@ -25,7 +26,7 @@ export declare class AlterServerChangeOwner extends AlterServerChange {
         owner: string;
     });
     get requires(): (`role:${string}` | `server:${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * ALTER SERVER ... VERSION ...
@@ -39,7 +40,7 @@ export declare class AlterServerSetVersion extends AlterServerChange {
         version: string | null;
     });
     get requires(): `server:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * ALTER SERVER ... OPTIONS ( ADD | SET | DROP ... )
@@ -61,5 +62,5 @@ export declare class AlterServerSetOptions extends AlterServerChange {
         }>;
     });
     get requires(): `server:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }