@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/core/objects/sequence/changes/sequence.security-label.d.ts

@@ -0,0 +1,28 @@
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import type { Sequence } from "../sequence.model.ts";
+import { CreateSequenceChange, DropSequenceChange } from "./sequence.base.ts";
+export type SecurityLabelSequence = CreateSecurityLabelOnSequence | DropSecurityLabelOnSequence;
+export declare class CreateSecurityLabelOnSequence extends CreateSequenceChange {
+    readonly sequence: Sequence;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        sequence: Sequence;
+        securityLabel: SecurityLabelProps;
+    });
+    get creates(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): `sequence:${string}`[];
+    serialize(): string;
+}
+export declare class DropSecurityLabelOnSequence extends DropSequenceChange {
+    readonly sequence: Sequence;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        sequence: Sequence;
+        securityLabel: SecurityLabelProps;
+    });
+    get drops(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): (`securityLabel:${string}::provider:${string}` | `sequence:${string}`)[];
+    serialize(): string;
+}

package/dist/core/objects/sequence/changes/sequence.security-label.js

@@ -0,0 +1,61 @@
+import { quoteLiteral } from "../../base.change.js";
+import { stableId } from "../../utils.js";
+import { CreateSequenceChange, DropSequenceChange } from "./sequence.base.js";
+export class CreateSecurityLabelOnSequence extends CreateSequenceChange {
+    sequence;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.sequence = props.sequence;
+        this.securityLabel = props.securityLabel;
+    }
+    get creates() {
+        return [
+            stableId.securityLabel(this.sequence.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [this.sequence.stableId];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON SEQUENCE",
+            `${this.sequence.schema}.${this.sequence.name}`,
+            "IS",
+            quoteLiteral(this.securityLabel.label),
+        ].join(" ");
+    }
+}
+export class DropSecurityLabelOnSequence extends DropSequenceChange {
+    sequence;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.sequence = props.sequence;
+        this.securityLabel = props.securityLabel;
+    }
+    get drops() {
+        return [
+            stableId.securityLabel(this.sequence.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [
+            stableId.securityLabel(this.sequence.stableId, this.securityLabel.provider),
+            this.sequence.stableId,
+        ];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON SEQUENCE",
+            `${this.sequence.schema}.${this.sequence.name}`,
+            "IS NULL",
+        ].join(" ");
+    }
+}

package/dist/core/objects/sequence/changes/sequence.types.d.ts

@@ -3,4 +3,6 @@ import type { CommentSequence } from "./sequence.comment.ts";
 import type { CreateSequence } from "./sequence.create.ts";
 import type { DropSequence } from "./sequence.drop.ts";
 import type { SequencePrivilege } from "./sequence.privilege.ts";
-export type SequenceChange = AlterSequence | CommentSequence | CreateSequence | DropSequence | SequencePrivilege;
+import type { SecurityLabelSequence } from "./sequence.security-label.ts";
+/** Union of all sequence-related change variants (`objectType: "sequence"`). @category Change Types */
+export type SequenceChange = AlterSequence | CommentSequence | CreateSequence | DropSequence | SequencePrivilege | SecurityLabelSequence;

package/dist/core/objects/sequence/sequence.diff.d.ts

@@ -1,8 +1,9 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
+import { AlterTableAlterColumnSetDefault } from "../table/changes/table.alter.ts";
 import type { Table } from "../table/table.model.ts";
 import type { SequenceChange } from "./changes/sequence.types.ts";
 import type { Sequence } from "./sequence.model.ts";
+type SequenceOrColumnSetDefaultChange = AlterTableAlterColumnSetDefault | SequenceChange;
 /**
  * Diff two sets of sequences from main and branch catalogs.
  *
@@ -10,11 +11,8 @@ import type { Sequence } from "./sequence.model.ts";
  * @param main - The sequences in the main catalog.
  * @param branch - The sequences in the branch catalog.
  * @param branchTables - The tables in the branch catalog (used to check if owning tables are being dropped).
+ * @param mainTables - The tables in the main catalog (used to detect when a same-name sequence will be cascade-dropped because its main-side owning table is going away).
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffSequences(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Sequence>, branch: Record<string, Sequence>, branchTables?: Record<string, Table>): SequenceChange[];
+export declare function diffSequences(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Sequence>, branch: Record<string, Sequence>, branchTables?: Record<string, Table>, mainTables?: Record<string, Table>): SequenceOrColumnSetDefaultChange[];
+export {};

package/dist/core/objects/sequence/sequence.diff.js

@@ -1,11 +1,14 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByGrantable, } from "../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, } from "../base.privilege-diff.js";
+import { diffSecurityLabels } from "../security-label.types.js";
+import { AlterTableAlterColumnSetDefault } from "../table/changes/table.alter.js";
 import { hasNonAlterableChanges } from "../utils.js";
 import { AlterSequenceSetOptions, AlterSequenceSetOwnedBy, } from "./changes/sequence.alter.js";
 import { CreateCommentOnSequence, DropCommentOnSequence, } from "./changes/sequence.comment.js";
 import { CreateSequence } from "./changes/sequence.create.js";
 import { DropSequence } from "./changes/sequence.drop.js";
 import { GrantSequencePrivileges, RevokeGrantOptionSequencePrivileges, RevokeSequencePrivileges, } from "./changes/sequence.privilege.js";
+import { CreateSecurityLabelOnSequence, DropSecurityLabelOnSequence, } from "./changes/sequence.security-label.js";
 /**
  * Diff two sets of sequences from main and branch catalogs.
  *
@@ -13,9 +16,10 @@ import { GrantSequencePrivileges, RevokeGrantOptionSequencePrivileges, RevokeSeq
  * @param main - The sequences in the main catalog.
  * @param branch - The sequences in the branch catalog.
  * @param branchTables - The tables in the branch catalog (used to check if owning tables are being dropped).
+ * @param mainTables - The tables in the main catalog (used to detect when a same-name sequence will be cascade-dropped because its main-side owning table is going away).
  * @returns A list of changes to apply to main to make it match branch.
  */
-export function diffSequences(ctx, main, branch, branchTables = {}) {
+export function diffSequences(ctx, main, branch, branchTables = {}, mainTables = {}) {
     const { created, dropped, altered } = diffObjects(main, branch);
     const changes = [];
     for (const sequenceId of created) {
@@ -24,6 +28,12 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
         if (createdSeq.comment !== null) {
             changes.push(new CreateCommentOnSequence({ sequence: createdSeq }));
         }
+        for (const label of createdSeq.security_labels) {
+            changes.push(new CreateSecurityLabelOnSequence({
+                sequence: createdSeq,
+                securityLabel: label,
+            }));
+        }
         // If the created sequence is OWNED BY a column, emit an ALTER to set it
         if (createdSeq.owned_by_schema !== null &&
             createdSeq.owned_by_table !== null &&
@@ -43,61 +53,39 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "sequence", createdSeq.schema ?? "");
+        const creatorFilteredDefaults = createdSeq.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         const desiredPrivileges = createdSeq.privileges;
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the sequence owner as the reference.
-        // Superuser privileges are filtered inside diffPrivileges.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdSeq.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantSequencePrivileges({
-                        sequence: createdSeq,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeSequencePrivileges({
-                        sequence: createdSeq,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionSequencePrivileges({
-                    sequence: createdSeq,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, createdSeq.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdSeq, createdSeq, "sequence", {
+            Grant: GrantSequencePrivileges,
+            Revoke: RevokeSequencePrivileges,
+            RevokeGrantOption: RevokeGrantOptionSequencePrivileges,
+        }, ctx.version));
     }
     for (const sequenceId of dropped) {
         const sequence = main[sequenceId];
-        // Skip generating DROP SEQUENCE if the sequence is owned by a table that's being dropped.
-        // PostgreSQL automatically drops sequences owned by tables when the table is dropped,
-        // so generating DROP SEQUENCE would cause an error (sequence doesn't exist).
+        // Skip generating DROP SEQUENCE if the sequence is owned by a table/column that's being dropped.
+        // PostgreSQL automatically cascades owned sequences when the owning table OR the owning
+        // column is dropped (via OWNED BY). Emitting DROP SEQUENCE in those cases would either
+        // fail at apply time (sequence already gone) or — in the column-drop case — create an
+        // unbreakable DropSequence ↔ AlterTableDropColumn cycle in the drop-phase sort graph.
         if (sequence.owned_by_schema &&
             sequence.owned_by_table &&
             sequence.owned_by_column) {
             const ownedByTableId = `table:${sequence.owned_by_schema}.${sequence.owned_by_table}`;
-            // If the owning table doesn't exist in branch catalog, it's being dropped
-            // and will auto-drop this sequence, so skip generating DROP SEQUENCE
-            if (!(ownedByTableId in branchTables)) {
+            const ownedByTable = branchTables[ownedByTableId];
+            // Owning table is dropped → PG auto-drops the owned sequence.
+            if (!ownedByTable) {
+                continue;
+            }
+            // Owning column is dropped (table survives) → PG still auto-drops the owned
+            // sequence as part of the column drop, so we must not emit DROP SEQUENCE.
+            const ownedByColumnExists = ownedByTable.columns?.some((col) => col.name === sequence.owned_by_column);
+            if (!ownedByColumnExists) {
                 continue;
             }
         }
@@ -108,18 +96,41 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
         const branchSequence = branch[sequenceId];
         // Check if non-alterable properties have changed
         // These require dropping and recreating the sequence
-        const NON_ALTERABLE_FIELDS = [
-            "data_type",
-            "persistence",
-        ];
+        const NON_ALTERABLE_FIELDS = ["persistence"];
         const nonAlterablePropsChanged = hasNonAlterableChanges(mainSequence, branchSequence, NON_ALTERABLE_FIELDS);
-        if (nonAlterablePropsChanged) {
-            // Replace the entire sequence (drop + create)
-            changes.push(new DropSequence({ sequence: mainSequence }), new CreateSequence({ sequence: branchSequence }));
+        // A sequence kept the same name (so it's "altered" in catalog terms),
+        // but its main-side owning table is going away from the plan (renamed
+        // away or simply dropped). PostgreSQL will cascade-drop the sequence
+        // alongside the table, leaving any later CREATE TABLE / column-default
+        // that depends on the sequence name pointing at nothing. Treat this
+        // like a non-alterable change so we recreate the sequence after the
+        // owning table is dropped.
+        const mainOwnedByTableId = mainSequence.owned_by_schema && mainSequence.owned_by_table
+            ? `table:${mainSequence.owned_by_schema}.${mainSequence.owned_by_table}`
+            : null;
+        const cascadeOrphanedByOwningTable = mainOwnedByTableId !== null &&
+            mainTables[mainOwnedByTableId] !== undefined &&
+            branchTables[mainOwnedByTableId] === undefined;
+        if (nonAlterablePropsChanged || cascadeOrphanedByOwningTable) {
+            // When the owning table is going away in this plan, PostgreSQL will
+            // cascade-drop the sequence as part of the DROP TABLE. Emitting an
+            // explicit DROP SEQUENCE here would (a) introduce an unbreakable
+            // DropSequence ↔ DropTable cycle on the catalog edges between the
+            // sequence and the dropped column, and (b) be redundant with the
+            // cascade. The CreateSequence below restores the sequence under its
+            // original name so any same-name reference in a later CREATE TABLE
+            // resolves correctly.
+            if (!cascadeOrphanedByOwningTable) {
+                changes.push(new DropSequence({ sequence: mainSequence }));
+            }
+            changes.push(new CreateSequence({ sequence: branchSequence }));
             // Re-apply OWNED BY if present on branch
             if (branchSequence.owned_by_schema !== null &&
                 branchSequence.owned_by_table !== null &&
                 branchSequence.owned_by_column !== null) {
+                const ownedByTableId = `table:${branchSequence.owned_by_schema}.${branchSequence.owned_by_table}`;
+                const ownedByTable = branchTables[ownedByTableId];
+                const ownedByColumn = ownedByTable?.columns?.find((column) => column.name === branchSequence.owned_by_column);
                 changes.push(new AlterSequenceSetOwnedBy({
                     sequence: branchSequence,
                     ownedBy: {
@@ -128,6 +139,14 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
                         column: branchSequence.owned_by_column,
                     },
                 }));
+                // Replacing an owned sequence with DROP ... CASCADE removes the column's
+                // existing nextval(...) default, so restore it after ownership is reattached.
+                if (ownedByTable && ownedByColumn && ownedByColumn.default !== null) {
+                    changes.push(new AlterTableAlterColumnSetDefault({
+                        table: ownedByTable,
+                        column: ownedByColumn,
+                    }));
+                }
             }
             else if (mainSequence.owned_by_schema !== null ||
                 mainSequence.owned_by_table !== null ||
@@ -141,7 +160,8 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
         }
         else {
             // Only alterable properties changed - emit ALTER for options/owner
-            const optionsChanged = mainSequence.increment !== branchSequence.increment ||
+            const optionsChanged = mainSequence.data_type !== branchSequence.data_type ||
+                mainSequence.increment !== branchSequence.increment ||
                 mainSequence.minimum_value !== branchSequence.minimum_value ||
                 mainSequence.maximum_value !== branchSequence.maximum_value ||
                 mainSequence.start_value !== branchSequence.start_value ||
@@ -149,6 +169,16 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
                 mainSequence.cycle_option !== branchSequence.cycle_option;
             if (optionsChanged) {
                 const options = [];
+                // `AS <type>` must come before any MIN/MAX/RESTART clauses per the
+                // PG ALTER SEQUENCE grammar. Valid types are smallint, integer,
+                // bigint — the same set CREATE SEQUENCE accepts — so the universe
+                // of legal transitions is closed. PG enforces last_value range at
+                // apply time when shrinking; that's the desired behavior because
+                // the previous Drop+Create path silently reset last_value to 1
+                // (data-loss bug, see Sentry SUPABASE-API-7RS).
+                if (mainSequence.data_type !== branchSequence.data_type) {
+                    options.push("AS", branchSequence.data_type);
+                }
                 if (mainSequence.increment !== branchSequence.increment) {
                     options.push("INCREMENT BY", String(branchSequence.increment));
                 }
@@ -207,48 +237,23 @@ export function diffSequences(ctx, main, branch, branchTables = {}) {
                     changes.push(new CreateCommentOnSequence({ sequence: branchSequence }));
                 }
             }
+            // SECURITY LABELS
+            changes.push(...diffSecurityLabels(mainSequence.security_labels, branchSequence.security_labels, (securityLabel) => new CreateSecurityLabelOnSequence({
+                sequence: branchSequence,
+                securityLabel,
+            }), (securityLabel) => new DropSecurityLabelOnSequence({
+                sequence: mainSequence,
+                securityLabel,
+            })));
             // PRIVILEGES
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            // Superuser privileges are filtered inside diffPrivileges.
-            const privilegeResults = diffPrivileges(mainSequence.privileges, branchSequence.privileges, branchSequence.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantSequencePrivileges({
-                            sequence: branchSequence,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeSequencePrivileges({
-                            sequence: mainSequence,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionSequencePrivileges({
-                        sequence: mainSequence,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(mainSequence.privileges, branchSequence.privileges, branchSequence.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchSequence, mainSequence, "sequence", {
+                Grant: GrantSequencePrivileges,
+                Revoke: RevokeSequencePrivileges,
+                RevokeGrantOption: RevokeGrantOptionSequencePrivileges,
+            }, ctx.version));
             // Note: Sequence renaming would also use ALTER SEQUENCE ... RENAME TO ...
             // But since our Sequence model uses 'name' as the identity field,
             // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/sequence/sequence.model.d.ts

@@ -2,6 +2,7 @@ import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
+import { type SecurityLabelProps } from "../security-label.types.ts";
 declare const sequencePropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
@@ -24,6 +25,10 @@ declare const sequencePropsSchema: z.ZodObject<{
         columns: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     }, z.z.core.$strip>>;
     owner: z.ZodString;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
 }, z.z.core.$strip>;
 type SequencePrivilegeProps = PrivilegeProps;
 export type SequenceProps = z.infer<typeof sequencePropsSchema>;
@@ -44,6 +49,7 @@ export declare class Sequence extends BasePgModel {
     readonly comment: SequenceProps["comment"];
     readonly privileges: SequencePrivilegeProps[];
     readonly owner: SequenceProps["owner"];
+    readonly security_labels: SecurityLabelProps[];
     constructor(props: SequenceProps);
     get stableId(): `sequence:${string}`;
     get identityFields(): {
@@ -70,6 +76,10 @@ export declare class Sequence extends BasePgModel {
             columns?: string[] | null | undefined;
         }[];
         owner: string;
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
 }
 export declare function extractSequences(pool: Pool): Promise<Sequence[]>;

package/dist/core/objects/sequence/sequence.model.js

@@ -2,6 +2,7 @@ import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
+import { securityLabelPropsSchema, } from "../security-label.types.js";
 const sequencePropsSchema = z.object({
     schema: z.string(),
     name: z.string(),
@@ -19,6 +20,7 @@ const sequencePropsSchema = z.object({
     comment: z.string().nullable(),
     privileges: z.array(privilegePropsSchema),
     owner: z.string(),
+    security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
 });
 export class Sequence extends BasePgModel {
     schema;
@@ -37,6 +39,7 @@ export class Sequence extends BasePgModel {
     comment;
     privileges;
     owner;
+    security_labels;
     constructor(props) {
         super();
         // Identity fields
@@ -57,6 +60,7 @@ export class Sequence extends BasePgModel {
         this.comment = props.comment;
         this.privileges = props.privileges;
         this.owner = props.owner;
+        this.security_labels = props.security_labels ?? [];
     }
     get stableId() {
         return `sequence:${this.schema}.${this.name}`;
@@ -83,6 +87,7 @@ export class Sequence extends BasePgModel {
             comment: this.comment,
             privileges: this.privileges,
             owner: this.owner,
+            security_labels: this.security_labels,
         };
     }
 }
@@ -132,10 +137,23 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(c.relacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(c.relacl, acldefault('S', c.relowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges,
-  c.relowner::regrole::text as owner
+  c.relowner::regrole::text as owner,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object('provider', sl.provider, 'label', sl.label)
+        order by sl.provider
+      )
+      from pg_catalog.pg_seclabel sl
+      where sl.objoid = c.oid
+        and sl.classoid = 'pg_class'::regclass
+        and sl.objsubid = 0
+    ),
+    '[]'::json
+  ) as security_labels
 from
   pg_catalog.pg_class c
   inner join pg_catalog.pg_sequence s on s.seqrelid = c.oid

package/dist/core/objects/subscription/changes/subscription.alter.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { Subscription } from "../subscription.model.ts";
 import { type SubscriptionSettableOption } from "../utils.ts";
 import { AlterSubscriptionChange } from "./subscription.base.ts";
@@ -7,7 +8,7 @@ export declare class AlterSubscriptionSetConnection extends AlterSubscriptionCha
     constructor(props: {
         subscription: Subscription;
     });
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 export declare class AlterSubscriptionSetPublication extends AlterSubscriptionChange {
     readonly subscription: Subscription;
@@ -15,7 +16,8 @@ export declare class AlterSubscriptionSetPublication extends AlterSubscriptionCh
     constructor(props: {
         subscription: Subscription;
     });
-    serialize(): string;
+    get nonTransactional(): boolean;
+    serialize(_options?: SerializeOptions): string;
 }
 export declare class AlterSubscriptionEnable extends AlterSubscriptionChange {
     readonly subscription: Subscription;
@@ -23,7 +25,7 @@ export declare class AlterSubscriptionEnable extends AlterSubscriptionChange {
     constructor(props: {
         subscription: Subscription;
     });
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 export declare class AlterSubscriptionDisable extends AlterSubscriptionChange {
     readonly subscription: Subscription;
@@ -31,7 +33,7 @@ export declare class AlterSubscriptionDisable extends AlterSubscriptionChange {
     constructor(props: {
         subscription: Subscription;
     });
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 export declare class AlterSubscriptionSetOptions extends AlterSubscriptionChange {
     readonly subscription: Subscription;
@@ -41,7 +43,7 @@ export declare class AlterSubscriptionSetOptions extends AlterSubscriptionChange
         subscription: Subscription;
         options: SubscriptionSettableOption[];
     });
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 export declare class AlterSubscriptionSetOwner extends AlterSubscriptionChange {
     readonly subscription: Subscription;
@@ -52,5 +54,5 @@ export declare class AlterSubscriptionSetOwner extends AlterSubscriptionChange {
         owner: string;
     });
     get requires(): `role:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/subscription/changes/subscription.alter.js

@@ -9,7 +9,7 @@ export class AlterSubscriptionSetConnection extends AlterSubscriptionChange {
         super();
         this.subscription = props.subscription;
     }
-    serialize() {
+    serialize(_options) {
         return `ALTER SUBSCRIPTION ${this.subscription.name} CONNECTION ${quoteLiteral(this.subscription.conninfo)}`;
     }
 }
@@ -20,7 +20,12 @@ export class AlterSubscriptionSetPublication extends AlterSubscriptionChange {
         super();
         this.subscription = props.subscription;
     }
-    serialize() {
+    // When the subscription is enabled, serialize() keeps the refresh = true
+    // default, which PostgreSQL rejects inside a transaction block.
+    get nonTransactional() {
+        return this.subscription.enabled;
+    }
+    serialize(_options) {
         const base = `ALTER SUBSCRIPTION ${this.subscription.name} SET PUBLICATION ${this.subscription.publications.join(", ")}`;
         if (!this.subscription.enabled) {
             return `${base} WITH (refresh = false)`;
@@ -35,7 +40,7 @@ export class AlterSubscriptionEnable extends AlterSubscriptionChange {
         super();
         this.subscription = props.subscription;
     }
-    serialize() {
+    serialize(_options) {
         return `ALTER SUBSCRIPTION ${this.subscription.name} ENABLE`;
     }
 }
@@ -46,7 +51,7 @@ export class AlterSubscriptionDisable extends AlterSubscriptionChange {
         super();
         this.subscription = props.subscription;
     }
-    serialize() {
+    serialize(_options) {
         return `ALTER SUBSCRIPTION ${this.subscription.name} DISABLE`;
     }
 }
@@ -59,7 +64,7 @@ export class AlterSubscriptionSetOptions extends AlterSubscriptionChange {
         this.subscription = props.subscription;
         this.options = props.options;
     }
-    serialize() {
+    serialize(_options) {
         const assignments = this.options.map((option) => formatSubscriptionOption(this.subscription, option));
         return `ALTER SUBSCRIPTION ${this.subscription.name} SET (${assignments.join(", ")})`;
     }
@@ -76,7 +81,7 @@ export class AlterSubscriptionSetOwner extends AlterSubscriptionChange {
     get requires() {
         return [stableId.role(this.owner)];
     }
-    serialize() {
+    serialize(_options) {
         return `ALTER SUBSCRIPTION ${this.subscription.name} OWNER TO ${this.owner}`;
     }
 }

package/dist/core/objects/subscription/changes/subscription.base.d.ts

@@ -2,7 +2,7 @@ import { BaseChange } from "../../base.change.ts";
 import type { Subscription } from "../subscription.model.ts";
 declare abstract class BaseSubscriptionChange extends BaseChange {
     abstract readonly subscription: Subscription;
-    abstract readonly scope: "object" | "comment";
+    abstract readonly scope: "object" | "comment" | "security_label";
     readonly objectType: "subscription";
 }
 export declare abstract class CreateSubscriptionChange extends BaseSubscriptionChange {

package/dist/core/objects/subscription/changes/subscription.comment.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
 import type { Subscription } from "../subscription.model.ts";
 import { CreateSubscriptionChange, DropSubscriptionChange } from "./subscription.base.ts";
 export type CommentSubscription = CreateCommentOnSubscription | DropCommentOnSubscription;
@@ -9,7 +10,7 @@ export declare class CreateCommentOnSubscription extends CreateSubscriptionChang
     });
     get creates(): `comment:${string}`[];
     get requires(): `subscription:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 export declare class DropCommentOnSubscription extends DropSubscriptionChange {
     readonly subscription: Subscription;
@@ -19,5 +20,5 @@ export declare class DropCommentOnSubscription extends DropSubscriptionChange {
     });
     get drops(): `comment:${string}`[];
     get requires(): (`comment:${string}` | `subscription:${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }