@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/core/objects/type/enum/enum.diff.js

@@ -1,10 +1,12 @@
 import { diffObjects } from "../../base.diff.js";
-import { diffPrivileges, filterPublicBuiltInDefaults, groupPrivilegesByGrantable, } from "../../base.privilege-diff.js";
+import { diffPrivileges, emitObjectPrivilegeChanges, filterPublicBuiltInDefaults, } from "../../base.privilege-diff.js";
+import { diffSecurityLabels } from "../../security-label.types.js";
 import { AlterEnumAddValue, AlterEnumChangeOwner, } from "./changes/enum.alter.js";
 import { CreateCommentOnEnum, DropCommentOnEnum, } from "./changes/enum.comment.js";
 import { CreateEnum } from "./changes/enum.create.js";
 import { DropEnum } from "./changes/enum.drop.js";
 import { GrantEnumPrivileges, RevokeEnumPrivileges, RevokeGrantOptionEnumPrivileges, } from "./changes/enum.privilege.js";
+import { CreateSecurityLabelOnEnum, DropSecurityLabelOnEnum, } from "./changes/enum.security-label.js";
 /**
  * Diff two sets of enums from main and branch catalogs.
  *
@@ -30,56 +32,33 @@ export function diffEnums(ctx, main, branch) {
         if (createdEnum.comment !== null) {
             changes.push(new CreateCommentOnEnum({ enum: createdEnum }));
         }
+        for (const label of createdEnum.security_labels) {
+            changes.push(new CreateSecurityLabelOnEnum({
+                enum: createdEnum,
+                securityLabel: label,
+            }));
+        }
         // PRIVILEGES: For created objects, compare against default privileges state
         // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
         // so objects are created with the default privileges state in effect.
         // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
         // needed to reach the final desired state.
         const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "enum", createdEnum.schema ?? "");
+        const creatorFilteredDefaults = createdEnum.owner !== ctx.currentUser
+            ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+            : effectiveDefaults;
         // Filter out PUBLIC's built-in default USAGE privilege (PostgreSQL grants it automatically)
         // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
         // This prevents generating unnecessary "GRANT USAGE TO PUBLIC" statements
         const desiredPrivileges = filterPublicBuiltInDefaults("enum", createdEnum.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use the enum owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, createdEnum.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantEnumPrivileges({
-                        enum: createdEnum,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeEnumPrivileges({
-                        enum: createdEnum,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionEnumPrivileges({
-                    enum: createdEnum,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("enum", creatorFilteredDefaults), desiredPrivileges, createdEnum.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, createdEnum, createdEnum, "enum", {
+            Grant: GrantEnumPrivileges,
+            Revoke: RevokeEnumPrivileges,
+            RevokeGrantOption: RevokeGrantOptionEnumPrivileges,
+        }, ctx.version));
     }
     for (const enumId of dropped) {
         changes.push(new DropEnum({ enum: main[enumId] }));
@@ -105,42 +84,16 @@ export function diffEnums(ctx, main, branch) {
                 changes.push(new CreateCommentOnEnum({ enum: branchEnum }));
             }
             const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "enum", branchEnum.schema ?? "");
+            const creatorFilteredDefaults = branchEnum.owner !== ctx.currentUser
+                ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+                : effectiveDefaults;
             const desiredPrivileges = filterPublicBuiltInDefaults("enum", branchEnum.privileges);
-            const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, branchEnum.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByGrantable(result.grants);
-                    for (const [grantable, list] of grantGroups) {
-                        void grantable;
-                        changes.push(new GrantEnumPrivileges({
-                            enum: branchEnum,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                    for (const [grantable, list] of revokeGroups) {
-                        void grantable;
-                        changes.push(new RevokeEnumPrivileges({
-                            enum: branchEnum,
-                            grantee,
-                            privileges: list,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                if (result.revokeGrantOption.length > 0) {
-                    changes.push(new RevokeGrantOptionEnumPrivileges({
-                        enum: branchEnum,
-                        grantee,
-                        privilegeNames: result.revokeGrantOption,
-                        version: ctx.version,
-                    }));
-                }
-            }
+            const privilegeResults = diffPrivileges(filterPublicBuiltInDefaults("enum", creatorFilteredDefaults), desiredPrivileges, branchEnum.owner);
+            changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchEnum, branchEnum, "enum", {
+                Grant: GrantEnumPrivileges,
+                Revoke: RevokeEnumPrivileges,
+                RevokeGrantOption: RevokeGrantOptionEnumPrivileges,
+            }, ctx.version));
             continue;
         }
         // OWNER
@@ -161,6 +114,14 @@ export function diffEnums(ctx, main, branch) {
                 changes.push(new CreateCommentOnEnum({ enum: branchEnum }));
             }
         }
+        // SECURITY LABELS
+        changes.push(...diffSecurityLabels(mainEnum.security_labels, branchEnum.security_labels, (securityLabel) => new CreateSecurityLabelOnEnum({
+            enum: branchEnum,
+            securityLabel,
+        }), (securityLabel) => new DropSecurityLabelOnEnum({
+            enum: mainEnum,
+            securityLabel,
+        })));
         // PRIVILEGES
         // Filter out PUBLIC's built-in default USAGE privilege from main catalog
         // (PostgreSQL grants it automatically, so we shouldn't compare it)
@@ -169,44 +130,12 @@ export function diffEnums(ctx, main, branch) {
         const branchPrivilegesFiltered = filterPublicBuiltInDefaults("enum", branchEnum.privileges);
         // Filter out owner privileges - owner always has ALL privileges implicitly
         // and shouldn't be compared. Use branch owner as the reference.
-        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchEnum.owner, ctx.mainRoles);
-        for (const [grantee, result] of privilegeResults) {
-            // Generate grant changes
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByGrantable(result.grants);
-                for (const [grantable, list] of grantGroups) {
-                    void grantable;
-                    changes.push(new GrantEnumPrivileges({
-                        enum: branchEnum,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-                for (const [grantable, list] of revokeGroups) {
-                    void grantable;
-                    changes.push(new RevokeEnumPrivileges({
-                        enum: mainEnum,
-                        grantee,
-                        privileges: list,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                changes.push(new RevokeGrantOptionEnumPrivileges({
-                    enum: mainEnum,
-                    grantee,
-                    privilegeNames: result.revokeGrantOption,
-                    version: ctx.version,
-                }));
-            }
-        }
+        const privilegeResults = diffPrivileges(mainPrivilegesFiltered, branchPrivilegesFiltered, branchEnum.owner);
+        changes.push(...emitObjectPrivilegeChanges(privilegeResults, branchEnum, mainEnum, "enum", {
+            Grant: GrantEnumPrivileges,
+            Revoke: RevokeEnumPrivileges,
+            RevokeGrantOption: RevokeGrantOptionEnumPrivileges,
+        }, ctx.version));
         // Note: Enum renaming would also use ALTER TYPE ... RENAME TO ...
         // But since our Enum model uses 'name' as the identity field,
         // a name change would be handled as drop + create by diffObjects()

package/dist/core/objects/type/enum/enum.model.d.ts

@@ -2,6 +2,7 @@ import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../../base.model.ts";
 import { type PrivilegeProps } from "../../base.privilege-diff.ts";
+import { type SecurityLabelProps } from "../../security-label.types.ts";
 /**
  * All properties exposed by CREATE TYPE AS ENUM statement are included in diff output.
  * https://www.postgresql.org/docs/current/sql-createtype.html
@@ -31,6 +32,10 @@ declare const enumPropsSchema: z.ZodObject<{
         grantable: z.ZodBoolean;
         columns: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     }, z.z.core.$strip>>;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
 }, z.z.core.$strip>;
 type EnumPrivilegeProps = PrivilegeProps;
 export type EnumProps = z.infer<typeof enumPropsSchema>;
@@ -41,6 +46,7 @@ export declare class Enum extends BasePgModel {
     readonly labels: EnumProps["labels"];
     readonly comment: EnumProps["comment"];
     readonly privileges: EnumPrivilegeProps[];
+    readonly security_labels: SecurityLabelProps[];
     constructor(props: EnumProps);
     get stableId(): `type:${string}`;
     get identityFields(): {
@@ -60,6 +66,10 @@ export declare class Enum extends BasePgModel {
             privilege: string;
             grantable: boolean;
         }[];
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
 }
 export declare function extractEnums(pool: Pool): Promise<Enum[]>;

package/dist/core/objects/type/enum/enum.model.js

@@ -2,6 +2,7 @@ import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
 import { BasePgModel } from "../../base.model.js";
 import { privilegePropsSchema, } from "../../base.privilege-diff.js";
+import { securityLabelPropsSchema, } from "../../security-label.types.js";
 const enumLabelSchema = z.object({
     sort_order: z.number(),
     label: z.string(),
@@ -27,6 +28,7 @@ const enumPropsSchema = z.object({
     labels: z.array(enumLabelSchema),
     comment: z.string().nullable(),
     privileges: z.array(privilegePropsSchema),
+    security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
 });
 export class Enum extends BasePgModel {
     schema;
@@ -35,6 +37,7 @@ export class Enum extends BasePgModel {
     labels;
     comment;
     privileges;
+    security_labels;
     constructor(props) {
         super();
         // Identity fields
@@ -45,6 +48,7 @@ export class Enum extends BasePgModel {
         this.labels = props.labels;
         this.comment = props.comment;
         this.privileges = props.privileges;
+        this.security_labels = props.security_labels ?? [];
     }
     get stableId() {
         return `type:${this.schema}.${this.name}`;
@@ -88,6 +92,7 @@ export class Enum extends BasePgModel {
             labels,
             comment: this.comment,
             privileges,
+            security_labels: this.security_labels,
         };
     }
 }
@@ -119,9 +124,22 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(t.typacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
-  ) as privileges
+  ) as privileges,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object('provider', sl.provider, 'label', sl.label)
+        order by sl.provider
+      )
+      from pg_catalog.pg_seclabel sl
+      where sl.objoid = t.oid
+        and sl.classoid = 'pg_type'::regclass
+        and sl.objsubid = 0
+    ),
+    '[]'::json
+  ) as security_labels
 from
   pg_catalog.pg_enum e
   inner join pg_catalog.pg_type t on t.oid = e.enumtypid
@@ -142,6 +160,7 @@ order by
                 labels: [],
                 comment: e.comment,
                 privileges: e.privileges,
+                security_labels: e.security_labels,
             };
         }
         grouped[key].labels.push({ sort_order: e.sort_order, label: e.label });

package/dist/core/objects/type/range/changes/range.alter.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../../integrations/serialize/serialize.types.ts";
 import type { Range } from "../range.model.ts";
 import { AlterRangeChange } from "./range.base.ts";
 /**
@@ -25,7 +26,7 @@ export declare class AlterRangeChangeOwner extends AlterRangeChange {
         owner: string;
     });
     get requires(): `type:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * Replace a range type by dropping and recreating it.

package/dist/core/objects/type/range/changes/range.alter.js

@@ -14,7 +14,7 @@ export class AlterRangeChangeOwner extends AlterRangeChange {
     get requires() {
         return [this.range.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return [
             "ALTER TYPE",
             `${this.range.schema}.${this.range.name}`,

package/dist/core/objects/type/range/changes/range.base.d.ts

@@ -2,7 +2,7 @@ import { BaseChange } from "../../../base.change.ts";
 import type { Range } from "../range.model.ts";
 declare abstract class BaseRangeChange extends BaseChange {
     abstract readonly range: Range;
-    abstract readonly scope: "object" | "comment" | "privilege";
+    abstract readonly scope: "object" | "comment" | "privilege" | "security_label";
     readonly objectType: "range";
 }
 export declare abstract class CreateRangeChange extends BaseRangeChange {

package/dist/core/objects/type/range/changes/range.comment.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../../integrations/serialize/serialize.types.ts";
 import type { Range } from "../range.model.ts";
 import { CreateRangeChange, DropRangeChange } from "./range.base.ts";
 /**
@@ -12,7 +13,7 @@ export declare class CreateCommentOnRange extends CreateRangeChange {
     });
     get creates(): `comment:${string}`[];
     get requires(): `type:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 export declare class DropCommentOnRange extends DropRangeChange {
     readonly range: Range;
@@ -22,5 +23,5 @@ export declare class DropCommentOnRange extends DropRangeChange {
     });
     get drops(): `comment:${string}`[];
     get requires(): (`comment:${string}` | `type:${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/type/range/changes/range.comment.js

@@ -14,7 +14,7 @@ export class CreateCommentOnRange extends CreateRangeChange {
     get requires() {
         return [this.range.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return [
             "COMMENT ON TYPE",
             `${this.range.schema}.${this.range.name}`,
@@ -37,7 +37,7 @@ export class DropCommentOnRange extends DropRangeChange {
     get requires() {
         return [stableId.comment(this.range.stableId), this.range.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return [
             "COMMENT ON TYPE",
             `${this.range.schema}.${this.range.name}`,

package/dist/core/objects/type/range/changes/range.create.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../../integrations/serialize/serialize.types.ts";
 import type { Range } from "../range.model.ts";
 import { CreateRangeChange } from "./range.base.ts";
 /**
@@ -27,5 +28,5 @@ export declare class CreateRange extends CreateRangeChange {
     });
     get creates(): `type:${string}`[];
     get requires(): string[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/type/range/changes/range.create.js

@@ -1,4 +1,4 @@
-import { isUserDefinedTypeSchema, parseProcedureReference, stableId, } from "../../../utils.js";
+import { isUserDefinedTypeSchema, parseProcedureReference, parseTypeString, stableId, } from "../../../utils.js";
 import { CreateRangeChange } from "./range.base.js";
 /**
  * Create a range type.
@@ -70,12 +70,15 @@ export class CreateRange extends CreateRangeChange {
         }
         return Array.from(dependencies);
     }
-    serialize() {
+    serialize(_options) {
         const name = `${this.range.schema}.${this.range.name}`;
         const prefix = ["CREATE TYPE", name, "AS RANGE"].join(" ");
         const opts = [];
-        // Required subtype
-        const subtypeQualified = this.range.subtype_schema && this.range.subtype_schema !== "pg_catalog"
+        // Required subtype (format_type may already return schema-qualified name)
+        const alreadyQualified = parseTypeString(this.range.subtype_str);
+        const subtypeQualified = !alreadyQualified &&
+            this.range.subtype_schema &&
+            this.range.subtype_schema !== "pg_catalog"
             ? `${this.range.subtype_schema}.${this.range.subtype_str}`
             : this.range.subtype_str;
         opts.push(`SUBTYPE = ${subtypeQualified}`);

package/dist/core/objects/type/range/changes/range.drop.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../../integrations/serialize/serialize.types.ts";
 import type { Range } from "../range.model.ts";
 import { DropRangeChange } from "./range.base.ts";
 /**
@@ -18,5 +19,5 @@ export declare class DropRange extends DropRangeChange {
     });
     get drops(): `type:${string}`[];
     get requires(): `type:${string}`[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/type/range/changes/range.drop.js

@@ -22,7 +22,7 @@ export class DropRange extends DropRangeChange {
     get requires() {
         return [this.range.stableId];
     }
-    serialize() {
+    serialize(_options) {
         return ["DROP TYPE", `${this.range.schema}.${this.range.name}`].join(" ");
     }
 }

package/dist/core/objects/type/range/changes/range.privilege.d.ts

@@ -1,3 +1,4 @@
+import type { SerializeOptions } from "../../../../integrations/serialize/serialize.types.ts";
 import type { Range } from "../range.model.ts";
 import { AlterRangeChange } from "./range.base.ts";
 export type RangePrivilege = GrantRangePrivileges | RevokeRangePrivileges | RevokeGrantOptionRangePrivileges;
@@ -34,7 +35,7 @@ export declare class GrantRangePrivileges extends AlterRangeChange {
     });
     get creates(): `acl:${string}::grantee:${string}`[];
     get requires(): (`role:${string}` | `type:${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * Revoke privileges on a range type.
@@ -71,7 +72,7 @@ export declare class RevokeRangePrivileges extends AlterRangeChange {
     });
     get drops(): `acl:${string}::grantee:${string}`[];
     get requires(): (`acl:${string}::grantee:${string}` | `role:${string}` | `type:${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }
 /**
  * Revoke grant option for privileges on a range type.
@@ -93,5 +94,5 @@ export declare class RevokeGrantOptionRangePrivileges extends AlterRangeChange {
         version?: number;
     });
     get requires(): (`acl:${string}::grantee:${string}` | `role:${string}` | `type:${string}`)[];
-    serialize(): string;
+    serialize(_options?: SerializeOptions): string;
 }

package/dist/core/objects/type/range/changes/range.privilege.js

@@ -33,7 +33,7 @@ export class GrantRangePrivileges extends AlterRangeChange {
     get requires() {
         return [this.range.stableId, stableId.role(this.grantee)];
     }
-    serialize() {
+    serialize(_options) {
         const hasGrantable = this.privileges.some((p) => p.grantable);
         const hasBase = this.privileges.some((p) => !p.grantable);
         if (hasGrantable && hasBase) {
@@ -87,7 +87,7 @@ export class RevokeRangePrivileges extends AlterRangeChange {
             stableId.role(this.grantee),
         ];
     }
-    serialize() {
+    serialize(_options) {
         const kindPrefix = getObjectKindPrefix("TYPE");
         const list = this.privileges.map((p) => p.privilege);
         const privSql = formatObjectPrivilegeList("TYPE", list, this.version);
@@ -122,7 +122,7 @@ export class RevokeGrantOptionRangePrivileges extends AlterRangeChange {
             stableId.role(this.grantee),
         ];
     }
-    serialize() {
+    serialize(_options) {
         const kindPrefix = getObjectKindPrefix("TYPE");
         const privSql = formatObjectPrivilegeList("TYPE", this.privilegeNames, this.version);
         const typeName = `${this.range.schema}.${this.range.name}`;

package/dist/core/objects/type/range/changes/range.security-label.d.ts

@@ -0,0 +1,28 @@
+import type { SecurityLabelProps } from "../../../security-label.types.ts";
+import type { Range } from "../range.model.ts";
+import { CreateRangeChange, DropRangeChange } from "./range.base.ts";
+export type SecurityLabelRange = CreateSecurityLabelOnRange | DropSecurityLabelOnRange;
+export declare class CreateSecurityLabelOnRange extends CreateRangeChange {
+    readonly range: Range;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        range: Range;
+        securityLabel: SecurityLabelProps;
+    });
+    get creates(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): `type:${string}`[];
+    serialize(): string;
+}
+export declare class DropSecurityLabelOnRange extends DropRangeChange {
+    readonly range: Range;
+    readonly securityLabel: SecurityLabelProps;
+    readonly scope: "security_label";
+    constructor(props: {
+        range: Range;
+        securityLabel: SecurityLabelProps;
+    });
+    get drops(): `securityLabel:${string}::provider:${string}`[];
+    get requires(): (`securityLabel:${string}::provider:${string}` | `type:${string}`)[];
+    serialize(): string;
+}

package/dist/core/objects/type/range/changes/range.security-label.js

@@ -0,0 +1,61 @@
+import { quoteLiteral } from "../../../base.change.js";
+import { stableId } from "../../../utils.js";
+import { CreateRangeChange, DropRangeChange } from "./range.base.js";
+export class CreateSecurityLabelOnRange extends CreateRangeChange {
+    range;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.range = props.range;
+        this.securityLabel = props.securityLabel;
+    }
+    get creates() {
+        return [
+            stableId.securityLabel(this.range.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [this.range.stableId];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON TYPE",
+            `${this.range.schema}.${this.range.name}`,
+            "IS",
+            quoteLiteral(this.securityLabel.label),
+        ].join(" ");
+    }
+}
+export class DropSecurityLabelOnRange extends DropRangeChange {
+    range;
+    securityLabel;
+    scope = "security_label";
+    constructor(props) {
+        super();
+        this.range = props.range;
+        this.securityLabel = props.securityLabel;
+    }
+    get drops() {
+        return [
+            stableId.securityLabel(this.range.stableId, this.securityLabel.provider),
+        ];
+    }
+    get requires() {
+        return [
+            stableId.securityLabel(this.range.stableId, this.securityLabel.provider),
+            this.range.stableId,
+        ];
+    }
+    serialize() {
+        return [
+            "SECURITY LABEL FOR",
+            this.securityLabel.provider,
+            "ON TYPE",
+            `${this.range.schema}.${this.range.name}`,
+            "IS NULL",
+        ].join(" ");
+    }
+}

package/dist/core/objects/type/range/changes/range.types.d.ts

@@ -3,4 +3,6 @@ import type { CommentRange } from "./range.comment.ts";
 import type { CreateRange } from "./range.create.ts";
 import type { DropRange } from "./range.drop.ts";
 import type { RangePrivilege } from "./range.privilege.ts";
-export type RangeChange = AlterRange | CommentRange | CreateRange | DropRange | RangePrivilege;
+import type { SecurityLabelRange } from "./range.security-label.ts";
+/** Union of all range-related change variants (`objectType: "range"`). @category Change Types */
+export type RangeChange = AlterRange | CommentRange | CreateRange | DropRange | RangePrivilege | SecurityLabelRange;

package/dist/core/objects/type/range/range.diff.d.ts

@@ -1,5 +1,4 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import type { RangeChange } from "./changes/range.types.ts";
 import type { Range } from "./range.model.ts";
 /**
@@ -10,9 +9,4 @@ import type { Range } from "./range.model.ts";
  * @param branch - The ranges in the branch catalog.
  * @returns A list of changes to apply to main to make it match branch.
  */
-export declare function diffRanges(ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-}, main: Record<string, Range>, branch: Record<string, Range>): RangeChange[];
+export declare function diffRanges(ctx: Pick<ObjectDiffContext, "version" | "currentUser" | "defaultPrivilegeState">, main: Record<string, Range>, branch: Record<string, Range>): RangeChange[];