@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/core/objects/rls-policy/rls-policy.model.js

@@ -8,6 +8,22 @@ const RlsPolicyCommandSchema = z.enum([
     "d", // DELETE command
     "*", // ALL commands
 ]);
+const RlsPolicyReferencedRelationKindSchema = z.enum([
+    "table",
+    "view",
+    "materialized_view",
+    "foreign_table",
+]);
+const rlsPolicyReferencedRelationSchema = z.object({
+    kind: RlsPolicyReferencedRelationKindSchema,
+    schema: z.string(),
+    name: z.string(),
+});
+const rlsPolicyReferencedProcedureSchema = z.object({
+    schema: z.string(),
+    name: z.string(),
+    argument_types: z.array(z.string()),
+});
 const rlsPolicyPropsSchema = z.object({
     schema: z.string(),
     name: z.string(),
@@ -19,6 +35,8 @@ const rlsPolicyPropsSchema = z.object({
     with_check_expression: z.string().nullable(),
     owner: z.string(),
     comment: z.string().nullable(),
+    referenced_relations: z.array(rlsPolicyReferencedRelationSchema),
+    referenced_procedures: z.array(rlsPolicyReferencedProcedureSchema),
 });
 export class RlsPolicy extends BasePgModel {
     schema;
@@ -31,6 +49,23 @@ export class RlsPolicy extends BasePgModel {
     with_check_expression;
     owner;
     comment;
+    /**
+     * Tables / views / materialized views / foreign tables that
+     * `using_expression` / `with_check_expression` reference, sourced from
+     * `pg_depend` (`recordDependencyOnExpr` at policy creation). Drives
+     * ordering dependencies in `CreateRlsPolicy.requires`. Intentionally
+     * excluded from `dataFields` — it's derived from the expression text
+     * and changes lockstep with it.
+     */
+    referenced_relations;
+    /**
+     * Functions / procedures that `using_expression` / `with_check_expression`
+     * reference, sourced from `pg_depend` (refclassid = `pg_proc`). The
+     * argument-type signature comes straight from `pg_proc.proargtypes` via
+     * `format_type`, so it matches the signature the procedure extractor
+     * embeds in `stableId.procedure(...)`. Not part of `dataFields`.
+     */
+    referenced_procedures;
     constructor(props) {
         super();
         // Identity fields
@@ -45,6 +80,9 @@ export class RlsPolicy extends BasePgModel {
         this.with_check_expression = props.with_check_expression;
         this.owner = props.owner;
         this.comment = props.comment;
+        // Derived metadata (not part of equality)
+        this.referenced_relations = props.referenced_relations;
+        this.referenced_procedures = props.referenced_procedures;
     }
     get stableId() {
         return `rlsPolicy:${this.schema}.${this.table_name}.${this.name}`;
@@ -88,6 +126,59 @@ extension_table_oids as (
     d.refclassid = 'pg_extension'::regclass
     and d.classid = 'pg_class'::regclass
     and d.deptype = 'e'
+),
+policy_relation_deps as (
+  -- Relations referenced inside polqual / polwithcheck. PostgreSQL records
+  -- these via recordDependencyOnExpr(..., DEPENDENCY_NORMAL = 'n') at
+  -- CREATE POLICY time, so pg_depend is authoritative and we don't need to
+  -- re-parse the expression text. Covers regular tables, partitioned
+  -- tables, views, materialized views, and foreign tables — any relation
+  -- kind the policy can reference in a subquery.
+  select distinct
+    d.objid                 as policy_oid,
+    case ref_c.relkind
+      when 'r' then 'table'
+      when 'p' then 'table'
+      when 'v' then 'view'
+      when 'm' then 'materialized_view'
+      when 'f' then 'foreign_table'
+    end                     as ref_kind,
+    ref_ns.nspname          as ref_schema,
+    ref_c.relname           as ref_name
+  from
+    pg_depend d
+    join pg_policy p on p.oid = d.objid
+    join pg_class ref_c on ref_c.oid = d.refobjid
+    join pg_namespace ref_ns on ref_ns.oid = ref_c.relnamespace
+  where
+    d.classid = 'pg_policy'::regclass
+    and d.refclassid = 'pg_class'::regclass
+    and d.deptype = 'n'
+    and ref_c.relkind in ('r', 'p', 'v', 'm', 'f')
+    and d.refobjid <> p.polrelid
+),
+policy_procedure_deps as (
+  -- Functions / procedures referenced inside polqual / polwithcheck. Same
+  -- pg_depend mechanism as above, just refclassid = pg_proc. proargtypes
+  -- formatted via format_type(oid, null) matches the signature produced by
+  -- the procedure extractor (see procedure.model.ts), so stableId.procedure
+  -- on both sides of the diff lines up exactly.
+  select distinct
+    d.objid            as policy_oid,
+    ref_ns.nspname     as ref_schema,
+    ref_p.proname      as ref_name,
+    array(
+      select format_type(oid, null)
+      from unnest(ref_p.proargtypes) as oid
+    )                  as ref_argument_types
+  from
+    pg_depend d
+    join pg_proc ref_p on ref_p.oid = d.refobjid
+    join pg_namespace ref_ns on ref_ns.oid = ref_p.pronamespace
+  where
+    d.classid = 'pg_policy'::regclass
+    and d.refclassid = 'pg_proc'::regclass
+    and d.deptype = 'n'
 )
 select
   tc.relnamespace::regnamespace::text as schema,
@@ -107,7 +198,37 @@ select
   pg_get_expr(p.polqual, p.polrelid) as using_expression,
   pg_get_expr(p.polwithcheck, p.polrelid) as with_check_expression,
   tc.relowner::regrole::text as owner,
-  obj_description(p.oid, 'pg_policy') as comment
+  obj_description(p.oid, 'pg_policy') as comment,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object(
+          'kind', prd.ref_kind,
+          'schema', prd.ref_schema,
+          'name', prd.ref_name
+        )
+        order by prd.ref_schema, prd.ref_name
+      )
+      from policy_relation_deps prd
+      where prd.policy_oid = p.oid
+    ),
+    '[]'
+  ) as referenced_relations,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object(
+          'schema', ppd.ref_schema,
+          'name', ppd.ref_name,
+          'argument_types', ppd.ref_argument_types
+        )
+        order by ppd.ref_schema, ppd.ref_name, ppd.ref_argument_types
+      )
+      from policy_procedure_deps ppd
+      where ppd.policy_oid = p.oid
+    ),
+    '[]'
+  ) as referenced_procedures
 from
   pg_catalog.pg_policy p
   inner join pg_catalog.pg_class tc on tc.oid = p.polrelid

package/dist/core/objects/role/changes/role.alter.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { Role } from "../role.model.ts";
 import { AlterRoleChange } from "./role.base.ts";
 /**
@@ -46,7 +47,7 @@ export declare class AlterRoleSetOptions extends AlterRoleChange {
         options: string[];
     });
     get requires(): `role:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * ALTER ROLE ... SET/RESET configuration_parameter (single statement)
@@ -74,5 +75,5 @@ export declare class AlterRoleSetConfig extends AlterRoleChange {
         action: "reset_all";
     });
     get requires(): `role:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/role/changes/role.alter.js

@@ -16,7 +16,7 @@ export class AlterRoleSetOptions extends AlterRoleChange {
     get requires() {
         return [this.role.stableId];
     }
-    serialize() {
+    serialize(_options) {
         const parts = ["ALTER ROLE", this.role.name];
         return [...parts, "WITH", this.options.join(" ")].join(" ");
     }
@@ -41,7 +41,7 @@ export class AlterRoleSetConfig extends AlterRoleChange {
     get requires() {
         return [this.role.stableId];
     }
-    serialize() {
+    serialize(_options) {
         const head = ["ALTER ROLE", this.role.name].join(" ");
         if (this.action === "reset_all") {
             return `${head} RESET ALL`;

package/dist/core/objects/role/changes/role.base.d.ts

@@ -2,7 +2,7 @@ import { BaseChange } from "../../base.change.ts";
 import type { Role } from "../role.model.ts";
 declare abstract class BaseRoleChange extends BaseChange {
     abstract readonly role: Role;
-    abstract readonly scope: "object" | "comment" | "membership" | "default_privilege";
+    abstract readonly scope: "object" | "comment" | "membership" | "default_privilege" | "security_label";
     readonly objectType: "role";
 }
 export declare abstract class CreateRoleChange extends BaseRoleChange {

package/dist/core/objects/role/changes/role.comment.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { Role } from "../role.model.ts";
 import { CreateRoleChange, DropRoleChange } from "./role.base.ts";
 export type CommentRole = CreateCommentOnRole | DropCommentOnRole;
@@ -9,7 +10,7 @@ export declare class CreateCommentOnRole extends CreateRoleChange {
     });
     get creates(): `comment:${string}`[];
     get requires(): `role:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 export declare class DropCommentOnRole extends DropRoleChange {
     readonly role: Role;
@@ -19,5 +20,5 @@ export declare class DropCommentOnRole extends DropRoleChange {
     });
     get drops(): `comment:${string}`[];
     get requires(): (`comment:${string}` | `role:${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/role/changes/role.comment.js

@@ -14,7 +14,7 @@ export class CreateCommentOnRole extends CreateRoleChange {
     get requires() {
         return [this.role.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return [
             "COMMENT ON ROLE",
             this.role.name,
@@ -36,7 +36,7 @@ export class DropCommentOnRole extends DropRoleChange {
     get requires() {
         return [stableId.comment(this.role.stableId), this.role.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return ["COMMENT ON ROLE", this.role.name, "IS NULL"].join(" ");
     }
 }

package/dist/core/objects/role/changes/role.create.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { Role } from "../role.model.ts";
 import { CreateRoleChange } from "./role.base.ts";
 /**
@@ -34,5 +35,5 @@ export declare class CreateRole extends CreateRoleChange {
         role: Role;
     });
     get creates(): `role:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/role/changes/role.create.js

@@ -36,7 +36,7 @@ export class CreateRole extends CreateRoleChange {
     get creates() {
         return [this.role.stableId];
     }
-    serialize() {
+    serialize(_options) {
         const parts = ["CREATE ROLE"];
         // Add role name
         parts.push(this.role.name);

package/dist/core/objects/role/changes/role.drop.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { Role } from "../role.model.ts";
 import { DropRoleChange } from "./role.base.ts";
 /**
@@ -18,5 +19,5 @@ export declare class DropRole extends DropRoleChange {
     });
     get drops(): `role:${string}`[];
     get requires(): `role:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/role/changes/role.drop.js

@@ -22,7 +22,7 @@ export class DropRole extends DropRoleChange {
     get requires() {
         return [this.role.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return ["DROP ROLE", this.role.name].join(" ");
     }
 }

package/dist/core/objects/role/changes/role.privilege.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { Role } from "../role.model.ts";
 import { CreateRoleChange, DropRoleChange } from "./role.base.ts";
 export type RolePrivilege = GrantRoleMembership | RevokeRoleMembership | RevokeRoleMembershipOptions | GrantRoleDefaultPrivileges | RevokeRoleDefaultPrivileges;
@@ -33,7 +34,7 @@ export declare class GrantRoleMembership extends CreateRoleChange {
     });
     get creates(): `membership:${string}->${string}`[];
     get requires(): `role:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * Revoke role membership.
@@ -57,7 +58,7 @@ export declare class RevokeRoleMembership extends DropRoleChange {
     });
     get drops(): `membership:${string}->${string}`[];
     get requires(): (`role:${string}` | `membership:${string}->${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * Revoke membership options for a role.
@@ -82,7 +83,7 @@ export declare class RevokeRoleMembershipOptions extends DropRoleChange {
         set?: boolean;
     });
     get requires(): (`role:${string}` | `membership:${string}->${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * Grant default privileges for a role.
@@ -113,7 +114,7 @@ export declare class GrantRoleDefaultPrivileges extends CreateRoleChange {
     });
     get creates(): `defacl:${string}:${string}:${string}:grantee:${string}`[];
     get requires(): (`schema:${string}` | `role:${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * Revoke default privileges for a role.
@@ -144,5 +145,5 @@ export declare class RevokeRoleDefaultPrivileges extends DropRoleChange {
     });
     get drops(): `defacl:${string}:${string}:${string}:grantee:${string}`[];
     get requires(): (`schema:${string}` | `defacl:${string}:${string}:${string}:grantee:${string}` | `role:${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/role/changes/role.privilege.js

@@ -29,7 +29,7 @@ export class GrantRoleMembership extends CreateRoleChange {
     get requires() {
         return [this.role.stableId, stableId.role(this.member)];
     }
-    serialize() {
+    serialize(_options) {
         // On creation, only emit ADMIN OPTION; leave INHERIT/SET to defaults
         const opts = [];
         if (this.options.admin)
@@ -69,7 +69,7 @@ export class RevokeRoleMembership extends DropRoleChange {
             this.role.stableId,
         ];
     }
-    serialize() {
+    serialize(_options) {
         return `REVOKE ${this.role.name} FROM ${this.member}`;
     }
 }
@@ -103,7 +103,7 @@ export class RevokeRoleMembershipOptions extends DropRoleChange {
             this.role.stableId,
         ];
     }
-    serialize() {
+    serialize(_options) {
         const parts = [];
         if (this.admin)
             parts.push("ADMIN OPTION");
@@ -148,7 +148,7 @@ export class GrantRoleDefaultPrivileges extends CreateRoleChange {
             ...(this.inSchema ? [stableId.schema(this.inSchema)] : []),
         ];
     }
-    serialize() {
+    serialize(_options) {
         const scope = this.inSchema ? ` IN SCHEMA ${this.inSchema}` : "";
         const hasGrantable = this.privileges.some((p) => p.grantable);
         const hasBase = this.privileges.some((p) => !p.grantable);
@@ -195,7 +195,7 @@ export class RevokeRoleDefaultPrivileges extends DropRoleChange {
             ...(this.inSchema ? [stableId.schema(this.inSchema)] : []),
         ];
     }
-    serialize() {
+    serialize(_options) {
         const scope = this.inSchema ? ` IN SCHEMA ${this.inSchema}` : "";
         const grantOptionPrivs = this.privileges
             .filter((p) => p.grantable)

package/dist/core/objects/role/changes/role.security-label.d.ts

@@ -0,0 +1,28 @@
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import type { Role } from "../role.model.ts";
+import { CreateRoleChange, DropRoleChange } from "./role.base.ts";
+export type SecurityLabelRole = CreateSecurityLabelOnRole | DropSecurityLabelOnRole;
+export declare class CreateSecurityLabelOnRole extends CreateRoleChange {
+    readonly role: Role;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        role: Role;
+        securityLabel: SecurityLabelProps;
+    });
+    get creates(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): `role:${string}`[];
+    serialize(): string;
+}
+export declare class DropSecurityLabelOnRole extends DropRoleChange {
+    readonly role: Role;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        role: Role;
+        securityLabel: SecurityLabelProps;
+    });
+    get drops(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): (`securityLabel:${string}::provider:${string}` | `role:${string}`)[];
+    serialize(): string;
+}

package/dist/core/objects/role/changes/role.security-label.js

@@ -0,0 +1,61 @@
+import { quoteLiteral } from "../../base.change.js";
+import { stableId } from "../../utils.js";
+import { CreateRoleChange, DropRoleChange } from "./role.base.js";
+export class CreateSecurityLabelOnRole extends CreateRoleChange {
+    role;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.role = props.role;
+        this.securityLabel = props.securityLabel;
+    }
+    get creates() {
+        return [
+            stableId.securityLabel(this.role.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [this.role.stableId];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON ROLE",
+            this.role.name,
+            "IS",
+            quoteLiteral(this.securityLabel.label),
+        ].join(" ");
+    }
+}
+export class DropSecurityLabelOnRole extends DropRoleChange {
+    role;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.role = props.role;
+        this.securityLabel = props.securityLabel;
+    }
+    get drops() {
+        return [
+            stableId.securityLabel(this.role.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [
+            stableId.securityLabel(this.role.stableId, this.securityLabel.provider),
+            this.role.stableId,
+        ];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON ROLE",
+            this.role.name,
+            "IS NULL",
+        ].join(" ");
+    }
+}

package/dist/core/objects/role/changes/role.types.d.ts

@@ -3,4 +3,6 @@ import type { CommentRole } from "./role.comment.ts";
 import type { CreateRole } from "./role.create.ts";
 import type { DropRole } from "./role.drop.ts";
 import type { RolePrivilege } from "./role.privilege.ts";
-export type RoleChange = AlterRole | CommentRole | CreateRole | DropRole | RolePrivilege;
+import type { SecurityLabelRole } from "./role.security-label.ts";
+/** Union of all role-related change variants (`objectType: "role"`). @category Change Types */
+export type RoleChange = AlterRole | CommentRole | CreateRole | DropRole | RolePrivilege | SecurityLabelRole;

package/dist/core/objects/role/role.diff.js

@@ -1,9 +1,11 @@
 import { diffObjects } from "../base.diff.js";
+import { diffSecurityLabels } from "../security-label.types.js";
 import { AlterRoleSetConfig, AlterRoleSetOptions, } from "./changes/role.alter.js";
 import { CreateCommentOnRole, DropCommentOnRole, } from "./changes/role.comment.js";
 import { CreateRole } from "./changes/role.create.js";
 import { DropRole } from "./changes/role.drop.js";
 import { GrantRoleDefaultPrivileges, GrantRoleMembership, RevokeRoleDefaultPrivileges, RevokeRoleMembership, RevokeRoleMembershipOptions, } from "./changes/role.privilege.js";
+import { CreateSecurityLabelOnRole, DropSecurityLabelOnRole, } from "./changes/role.security-label.js";
 /**
  * Diff two sets of roles from main and branch catalogs.
  *
@@ -31,8 +33,21 @@ export function diffRoles(ctx, main, branch) {
         if (role.comment !== null) {
             changes.push(new CreateCommentOnRole({ role }));
         }
-        // MEMBERSHIPS: Grant memberships immediately after role creation
+        for (const label of role.security_labels) {
+            changes.push(new CreateSecurityLabelOnRole({
+                role,
+                securityLabel: label,
+            }));
+        }
+        // MEMBERSHIPS: Grant memberships immediately after role creation.
+        // Members are already deduplicated by the Role model constructor.
         for (const membership of role.members) {
+            // Skip memberships where the member is the grantor (auto-created by
+            // CREATE ROLE — re-granting them, especially WITH ADMIN OPTION, fails
+            // with "ADMIN option cannot be granted back to your own grantor").
+            if (membership.grantor === membership.member) {
+                continue;
+            }
             changes.push(new GrantRoleMembership({
                 role,
                 member: membership.member,
@@ -45,6 +60,8 @@ export function diffRoles(ctx, main, branch) {
         }
         // DEFAULT PRIVILEGES: Grant default privileges immediately after role creation
         for (const defaultPriv of role.default_privileges) {
+            if (defaultPriv.is_implicit)
+                continue;
             if (defaultPriv.privileges.length === 0)
                 continue;
             const grantGroups = new Map();
@@ -162,12 +179,27 @@ export function diffRoles(ctx, main, branch) {
                 changes.push(new CreateCommentOnRole({ role: branchRole }));
             }
         }
+        // SECURITY LABELS
+        changes.push(...diffSecurityLabels(mainRole.security_labels, branchRole.security_labels, (securityLabel) => new CreateSecurityLabelOnRole({
+            role: branchRole,
+            securityLabel,
+        }), (securityLabel) => new DropSecurityLabelOnRole({
+            role: mainRole,
+            securityLabel,
+        })));
         // MEMBERSHIPS
+        // Members are already deduplicated by the Role model constructor.
         const mainMembers = new Map(mainRole.members.map((m) => [m.member, m]));
         const branchMembers = new Map(branchRole.members.map((m) => [m.member, m]));
         // Find new members to grant
         for (const [member, membership] of branchMembers) {
             if (!mainMembers.has(member)) {
+                // Skip memberships where the member is the grantor (auto-created by
+                // CREATE ROLE — re-granting them fails with "ADMIN option cannot be
+                // granted back to your own grantor").
+                if (membership.grantor === membership.member) {
+                    continue;
+                }
                 changes.push(new GrantRoleMembership({
                     role: branchRole,
                     member: membership.member,
@@ -224,6 +256,11 @@ export function diffRoles(ctx, main, branch) {
                     }));
                 }
                 if (toGrant.admin || toGrant.inherit || toGrant.set) {
+                    // Skip granting options back to the grantor (same restriction as
+                    // for newly created roles).
+                    if (branchMembership.grantor === branchMembership.member) {
+                        continue;
+                    }
                     changes.push(new GrantRoleMembership({
                         role: branchRole,
                         member: branchMembership.member,

package/dist/core/objects/role/role.model.d.ts

@@ -1,6 +1,7 @@
 import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
+import { type SecurityLabelProps } from "../security-label.types.ts";
 declare const rolePropsSchema: z.ZodObject<{
     name: z.ZodString;
     is_superuser: z.ZodBoolean;
@@ -23,18 +24,23 @@ declare const rolePropsSchema: z.ZodObject<{
     default_privileges: z.ZodArray<z.ZodObject<{
         in_schema: z.ZodNullable<z.ZodString>;
         objtype: z.ZodEnum<{
+            n: "n";
             r: "r";
-            S: "S";
             f: "f";
+            S: "S";
             T: "T";
-            n: "n";
         }>;
         grantee: z.ZodString;
         privileges: z.ZodArray<z.ZodObject<{
             privilege: z.ZodString;
             grantable: z.ZodBoolean;
         }, z.z.core.$strip>>;
+        is_implicit: z.ZodBoolean;
     }, z.z.core.$strip>>;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
 }, z.z.core.$strip>;
 export type RoleProps = z.infer<typeof rolePropsSchema>;
 export declare class Role extends BasePgModel {
@@ -51,6 +57,7 @@ export declare class Role extends BasePgModel {
     readonly comment: RoleProps["comment"];
     readonly members: RoleProps["members"];
     readonly default_privileges: RoleProps["default_privileges"];
+    readonly security_labels: SecurityLabelProps[];
     constructor(props: RoleProps);
     get stableId(): `role:${string}`;
     get identityFields(): {
@@ -80,9 +87,13 @@ export declare class Role extends BasePgModel {
                 grantable: boolean;
             }[];
             in_schema: string | null;
-            objtype: "r" | "S" | "f" | "T" | "n";
+            objtype: "n" | "r" | "f" | "S" | "T";
             grantee: string;
         }[];
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
 }
 export declare function extractRoles(pool: Pool): Promise<Role[]>;