@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/core/objects/view/view.diff.js

@@ -1,11 +1,47 @@
 import { diffObjects } from "../base.diff.js";
-import { diffPrivileges, groupPrivilegesByColumns, } from "../base.privilege-diff.js";
+import { normalizeColumns } from "../base.model.js";
+import { diffPrivileges, emitColumnPrivilegeChanges, } from "../base.privilege-diff.js";
+import { diffSecurityLabels } from "../security-label.types.js";
 import { deepEqual, hasNonAlterableChanges } from "../utils.js";
 import { AlterViewChangeOwner, AlterViewResetOptions, AlterViewSetOptions, } from "./changes/view.alter.js";
 import { CreateCommentOnView, DropCommentOnView, } from "./changes/view.comment.js";
 import { CreateView } from "./changes/view.create.js";
 import { DropView } from "./changes/view.drop.js";
 import { GrantViewPrivileges, RevokeGrantOptionViewPrivileges, RevokeViewPrivileges, } from "./changes/view.privilege.js";
+import { CreateSecurityLabelOnView, DropSecurityLabelOnView, } from "./changes/view.security-label.js";
+export function buildCreateViewChanges(ctx, view) {
+    const changes = [new CreateView({ view })];
+    // OWNER: If the view should be owned by someone other than the current user,
+    // emit ALTER VIEW ... OWNER TO after creation
+    if (view.owner !== ctx.currentUser) {
+        changes.push(new AlterViewChangeOwner({ view, owner: view.owner }));
+    }
+    if (view.comment !== null) {
+        changes.push(new CreateCommentOnView({ view }));
+    }
+    for (const label of view.security_labels) {
+        changes.push(new CreateSecurityLabelOnView({ view, securityLabel: label }));
+    }
+    // PRIVILEGES: For created objects, compare against default privileges state
+    // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
+    // so objects are created with the default privileges state in effect.
+    // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
+    // needed to reach the final desired state.
+    const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "view", view.schema ?? "");
+    const creatorFilteredDefaults = view.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
+    const desiredPrivileges = view.privileges;
+    // Filter out owner privileges - owner always has ALL privileges implicitly
+    // and shouldn't be compared. Use the view owner as the reference.
+    const privilegeResults = diffPrivileges(creatorFilteredDefaults, desiredPrivileges, view.owner);
+    changes.push(...emitColumnPrivilegeChanges(privilegeResults, view, view, "view", {
+        Grant: GrantViewPrivileges,
+        Revoke: RevokeViewPrivileges,
+        RevokeGrantOption: RevokeGrantOptionViewPrivileges,
+    }, effectiveDefaults, ctx.version));
+    return changes;
+}
 /**
  * Diff two sets of views from main and branch catalogs.
  *
@@ -18,103 +54,7 @@ export function diffViews(ctx, main, branch) {
     const { created, dropped, altered } = diffObjects(main, branch);
     const changes = [];
     for (const viewId of created) {
-        const v = branch[viewId];
-        changes.push(new CreateView({ view: v }));
-        // OWNER: If the view should be owned by someone other than the current user,
-        // emit ALTER VIEW ... OWNER TO after creation
-        if (v.owner !== ctx.currentUser) {
-            changes.push(new AlterViewChangeOwner({ view: v, owner: v.owner }));
-        }
-        if (v.comment !== null) {
-            changes.push(new CreateCommentOnView({ view: v }));
-        }
-        // PRIVILEGES: For created objects, compare against default privileges state
-        // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
-        // so objects are created with the default privileges state in effect.
-        // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
-        // needed to reach the final desired state.
-        const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(ctx.currentUser, "view", v.schema ?? "");
-        const desiredPrivileges = v.privileges;
-        // Filter out owner privileges - owner always has ALL privileges implicitly
-        // and shouldn't be compared. Use the view owner as the reference.
-        const privilegeResults = diffPrivileges(effectiveDefaults, desiredPrivileges, v.owner, ctx.mainRoles);
-        // Generate grant changes
-        for (const [grantee, result] of privilegeResults) {
-            if (result.grants.length > 0) {
-                const grantGroups = groupPrivilegesByColumns(result.grants);
-                for (const [, group] of grantGroups) {
-                    for (const [grantable, privSet] of group.byGrant) {
-                        const privileges = Array.from(privSet).map((priv) => ({
-                            privilege: priv,
-                            grantable,
-                        }));
-                        changes.push(new GrantViewPrivileges({
-                            view: v,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
-            // Generate revoke changes
-            if (result.revokes.length > 0) {
-                const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                for (const [, group] of revokeGroups) {
-                    const allPrivileges = new Set();
-                    for (const [, privSet] of group.byGrant) {
-                        for (const priv of privSet) {
-                            allPrivileges.add(priv);
-                        }
-                    }
-                    const privileges = Array.from(allPrivileges).map((priv) => ({
-                        privilege: priv,
-                        grantable: false,
-                    }));
-                    changes.push(new RevokeViewPrivileges({
-                        view: v,
-                        grantee,
-                        privileges,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-            // Generate revoke grant option changes
-            if (result.revokeGrantOption.length > 0) {
-                const revokeGrantGroups = new Map();
-                for (const r of result.revokeGrantOption) {
-                    // For revoke grant option, we need to find the columns from the effective defaults
-                    const originalPriv = effectiveDefaults.find((p) => p.grantee === grantee && p.privilege === r);
-                    const key = originalPriv?.columns
-                        ? originalPriv.columns.sort().join(",")
-                        : "";
-                    if (!revokeGrantGroups.has(key)) {
-                        revokeGrantGroups.set(key, {
-                            columns: originalPriv?.columns
-                                ? [...originalPriv.columns]
-                                : undefined,
-                            privileges: new Set(),
-                        });
-                    }
-                    const group = revokeGrantGroups.get(key);
-                    if (!group)
-                        continue;
-                    group.privileges.add(r);
-                }
-                for (const [, group] of revokeGrantGroups) {
-                    const privilegeNames = Array.from(group.privileges);
-                    changes.push(new RevokeGrantOptionViewPrivileges({
-                        view: v,
-                        grantee,
-                        privilegeNames,
-                        columns: group.columns,
-                        version: ctx.version,
-                    }));
-                }
-            }
-        }
+        changes.push(...buildCreateViewChanges(ctx, branch[viewId]));
     }
     for (const viewId of dropped) {
         changes.push(new DropView({ view: main[viewId] }));
@@ -138,7 +78,15 @@ export function diffViews(ctx, main, branch) {
             "partition_bound",
         ];
         const nonAlterablePropsChanged = hasNonAlterableChanges(mainView, branchView, NON_ALTERABLE_FIELDS, { options: deepEqual });
-        if (nonAlterablePropsChanged) {
+        // Normalize columns (strip position, sort by name) to match stableSnapshot().
+        // Position-only differences are safe to ignore here because column order in a
+        // view is determined by its definition, which is already checked above via
+        // NON_ALTERABLE_FIELDS - a position change always implies a definition change.
+        if (!deepEqual(normalizeColumns(mainView.columns), normalizeColumns(branchView.columns))) {
+            changes.push(new DropView({ view: mainView }));
+            changes.push(...buildCreateViewChanges(ctx, branchView));
+        }
+        else if (nonAlterablePropsChanged) {
             // Replace the entire view using CREATE OR REPLACE to avoid drop when possible
             changes.push(new CreateView({ view: branchView, orReplace: true }));
         }
@@ -179,91 +127,26 @@ export function diffViews(ctx, main, branch) {
                     changes.push(new CreateCommentOnView({ view: branchView }));
                 }
             }
+            // SECURITY LABELS
+            changes.push(...diffSecurityLabels(mainView.security_labels, branchView.security_labels, (securityLabel) => new CreateSecurityLabelOnView({
+                view: branchView,
+                securityLabel,
+            }), (securityLabel) => new DropSecurityLabelOnView({
+                view: mainView,
+                securityLabel,
+            })));
             // Note: View renaming would also use ALTER VIEW ... RENAME TO ...
             // But since our View model uses 'name' as the identity field,
             // a name change would be handled as drop + create by diffObjects()
             // PRIVILEGES (unified object and column privileges)
             // Filter out owner privileges - owner always has ALL privileges implicitly
             // and shouldn't be compared. Use branch owner as the reference.
-            const privilegeResults = diffPrivileges(mainView.privileges, branchView.privileges, branchView.owner, ctx.mainRoles);
-            for (const [grantee, result] of privilegeResults) {
-                // Generate grant changes
-                if (result.grants.length > 0) {
-                    const grantGroups = groupPrivilegesByColumns(result.grants);
-                    for (const [, group] of grantGroups) {
-                        for (const [grantable, privSet] of group.byGrant) {
-                            const privileges = Array.from(privSet).map((priv) => ({
-                                privilege: priv,
-                                grantable,
-                            }));
-                            changes.push(new GrantViewPrivileges({
-                                view: branchView,
-                                grantee,
-                                privileges,
-                                columns: group.columns,
-                                version: ctx.version,
-                            }));
-                        }
-                    }
-                }
-                // Generate revoke changes
-                if (result.revokes.length > 0) {
-                    const revokeGroups = groupPrivilegesByColumns(result.revokes);
-                    for (const [, group] of revokeGroups) {
-                        // Collapse all grantable groups into a single revoke (grantable: false)
-                        const allPrivileges = new Set();
-                        for (const [, privSet] of group.byGrant) {
-                            for (const priv of privSet) {
-                                allPrivileges.add(priv);
-                            }
-                        }
-                        const privileges = Array.from(allPrivileges).map((priv) => ({
-                            privilege: priv,
-                            grantable: false,
-                        }));
-                        changes.push(new RevokeViewPrivileges({
-                            view: mainView,
-                            grantee,
-                            privileges,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-                // Generate revoke grant option changes
-                if (result.revokeGrantOption.length > 0) {
-                    const revokeGrantGroups = new Map();
-                    for (const r of result.revokeGrantOption) {
-                        // For revoke grant option, we need to find the columns from the original privilege
-                        const originalPriv = mainView.privileges.find((p) => p.grantee === grantee && p.privilege === r);
-                        const key = originalPriv?.columns
-                            ? originalPriv.columns.sort().join(",")
-                            : "";
-                        if (!revokeGrantGroups.has(key)) {
-                            revokeGrantGroups.set(key, {
-                                columns: originalPriv?.columns
-                                    ? [...originalPriv.columns]
-                                    : undefined,
-                                privileges: new Set(),
-                            });
-                        }
-                        const group = revokeGrantGroups.get(key);
-                        if (!group)
-                            continue;
-                        group.privileges.add(r);
-                    }
-                    for (const [, group] of revokeGrantGroups) {
-                        const privilegeNames = Array.from(group.privileges);
-                        changes.push(new RevokeGrantOptionViewPrivileges({
-                            view: mainView,
-                            grantee,
-                            privilegeNames,
-                            columns: group.columns,
-                            version: ctx.version,
-                        }));
-                    }
-                }
-            }
+            const privilegeResults = diffPrivileges(mainView.privileges, branchView.privileges, branchView.owner);
+            changes.push(...emitColumnPrivilegeChanges(privilegeResults, branchView, mainView, "view", {
+                Grant: GrantViewPrivileges,
+                Revoke: RevokeViewPrivileges,
+                RevokeGrantOption: RevokeGrantOptionViewPrivileges,
+            }, mainView.privileges, ctx.version));
         }
     }
     return changes;

package/dist/core/objects/view/view.model.d.ts

@@ -2,6 +2,8 @@ import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel, type TableLikeObject } from "../base.model.ts";
 import { type PrivilegeProps } from "../base.privilege-diff.ts";
+import { type ExtractRetryOptions } from "../extract-with-retry.ts";
+import { type SecurityLabelProps } from "../security-label.types.ts";
 declare const viewPropsSchema: z.ZodObject<{
     schema: z.ZodString;
     name: z.ZodString;
@@ -14,10 +16,10 @@ declare const viewPropsSchema: z.ZodObject<{
     has_subclasses: z.ZodBoolean;
     is_populated: z.ZodBoolean;
     replica_identity: z.ZodEnum<{
-        f: "f";
         n: "n";
         i: "i";
         d: "d";
+        f: "f";
     }>;
     is_partition: z.ZodBoolean;
     options: z.ZodNullable<z.ZodArray<z.ZodString>>;
@@ -41,6 +43,10 @@ declare const viewPropsSchema: z.ZodObject<{
         collation: z.ZodNullable<z.ZodString>;
         default: z.ZodNullable<z.ZodString>;
         comment: z.ZodNullable<z.ZodString>;
+        security_labels: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            provider: z.ZodString;
+            label: z.ZodString;
+        }, z.z.core.$strip>>>;
     }, z.z.core.$strip>>;
     privileges: z.ZodArray<z.ZodObject<{
         grantee: z.ZodString;
@@ -48,6 +54,10 @@ declare const viewPropsSchema: z.ZodObject<{
         grantable: z.ZodBoolean;
         columns: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     }, z.z.core.$strip>>;
+    security_labels: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        provider: z.ZodString;
+        label: z.ZodString;
+    }, z.z.core.$strip>>>>;
 }, z.z.core.$strip>;
 type ViewPrivilegeProps = PrivilegeProps;
 export type ViewProps = z.infer<typeof viewPropsSchema>;
@@ -70,6 +80,7 @@ export declare class View extends BasePgModel implements TableLikeObject {
     readonly comment: ViewProps["comment"];
     readonly columns: ViewProps["columns"];
     readonly privileges: ViewPrivilegeProps[];
+    readonly security_labels: SecurityLabelProps[];
     constructor(props: ViewProps);
     get stableId(): `view:${string}`;
     get identityFields(): {
@@ -85,7 +96,7 @@ export declare class View extends BasePgModel implements TableLikeObject {
         has_triggers: boolean;
         has_subclasses: boolean;
         is_populated: boolean;
-        replica_identity: "f" | "n" | "i" | "d";
+        replica_identity: "n" | "i" | "d" | "f";
         is_partition: boolean;
         options: string[] | null;
         partition_bound: string | null;
@@ -108,6 +119,10 @@ export declare class View extends BasePgModel implements TableLikeObject {
             collation: string | null;
             default: string | null;
             comment: string | null;
+            security_labels?: {
+                provider: string;
+                label: string;
+            }[] | undefined;
         }[];
         privileges: {
             grantee: string;
@@ -115,6 +130,10 @@ export declare class View extends BasePgModel implements TableLikeObject {
             grantable: boolean;
             columns?: string[] | null | undefined;
         }[];
+        security_labels: {
+            provider: string;
+            label: string;
+        }[];
     };
     stableSnapshot(): {
         identity: {
@@ -123,7 +142,29 @@ export declare class View extends BasePgModel implements TableLikeObject {
         };
         data: {
             columns: {
-                [x: string]: unknown;
+                name: string;
+                data_type: string;
+                data_type_str: string;
+                is_custom_type: boolean;
+                custom_type_type: string | null;
+                custom_type_category: string | null;
+                custom_type_schema: string | null;
+                custom_type_name: string | null;
+                not_null: boolean;
+                is_identity: boolean;
+                is_identity_always: boolean;
+                is_generated: boolean;
+                collation: string | null;
+                default: string | null;
+                comment: string | null;
+                security_labels?: {
+                    provider: string;
+                    label: string;
+                }[] | undefined;
+            }[];
+            security_labels: {
+                provider: string;
+                label: string;
             }[];
             definition: string;
             row_security: boolean;
@@ -133,7 +174,7 @@ export declare class View extends BasePgModel implements TableLikeObject {
             has_triggers: boolean;
             has_subclasses: boolean;
             is_populated: boolean;
-            replica_identity: "f" | "n" | "i" | "d";
+            replica_identity: "n" | "i" | "d" | "f";
             is_partition: boolean;
             options: string[] | null;
             partition_bound: string | null;
@@ -148,5 +189,5 @@ export declare class View extends BasePgModel implements TableLikeObject {
         };
     };
 }
-export declare function extractViews(pool: Pool): Promise<View[]>;
+export declare function extractViews(pool: Pool, options?: ExtractRetryOptions): Promise<View[]>;
 export {};

package/dist/core/objects/view/view.model.js

@@ -1,7 +1,9 @@
 import { sql } from "@ts-safeql/sql-tag";
 import z from "zod";
-import { BasePgModel, columnPropsSchema, } from "../base.model.js";
+import { BasePgModel, columnPropsSchema, normalizeColumns, } from "../base.model.js";
 import { privilegePropsSchema, } from "../base.privilege-diff.js";
+import { extractWithDefinitionRetry, } from "../extract-with-retry.js";
+import { normalizeSecurityLabels, securityLabelPropsSchema, } from "../security-label.types.js";
 import { ReplicaIdentitySchema } from "../table/table.model.js";
 const viewPropsSchema = z.object({
     schema: z.string(),
@@ -22,6 +24,15 @@ const viewPropsSchema = z.object({
     comment: z.string().nullable(),
     columns: z.array(columnPropsSchema),
     privileges: z.array(privilegePropsSchema),
+    security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
+});
+// pg_get_viewdef(oid) can return NULL when the underlying view (or its
+// pg_rewrite row) is dropped between catalog scan and resolution, or under
+// transient catalog state during recovery. An unreadable view cannot be
+// diffed, so we accept NULL here and filter the row out at extraction time
+// rather than crashing the whole catalog parse with a ZodError.
+const viewRowSchema = viewPropsSchema.extend({
+    definition: z.string().nullable(),
 });
 export class View extends BasePgModel {
     schema;
@@ -42,6 +53,7 @@ export class View extends BasePgModel {
     comment;
     columns;
     privileges;
+    security_labels;
     constructor(props) {
         super();
         // Identity fields
@@ -64,6 +76,7 @@ export class View extends BasePgModel {
         this.comment = props.comment;
         this.columns = props.columns;
         this.privileges = props.privileges;
+        this.security_labels = props.security_labels ?? [];
     }
     get stableId() {
         return `view:${this.schema}.${this.name}`;
@@ -92,30 +105,27 @@ export class View extends BasePgModel {
             comment: this.comment,
             columns: this.columns,
             privileges: this.privileges,
+            security_labels: this.security_labels,
         };
     }
     stableSnapshot() {
-        const normalizeColumns = () => [...this.columns]
-            .map((col) => {
-            const { position: _pos, ...rest } = col;
-            return rest;
-        })
-            .sort((a, b) => {
-            const nameA = a.name ?? "";
-            const nameB = b.name ?? "";
-            return nameA.localeCompare(nameB);
-        });
         return {
             identity: this.identityFields,
             data: {
                 ...this.dataFields,
-                columns: normalizeColumns(),
+                columns: normalizeColumns(this.columns),
+                security_labels: normalizeSecurityLabels(this.security_labels),
             },
         };
     }
 }
-export async function extractViews(pool) {
-    const { rows: viewRows } = await pool.query(sql `
+export async function extractViews(pool, options) {
+    const viewRows = await extractWithDefinitionRetry({
+        label: "views",
+        options,
+        hasNullDefinition: (row) => row.definition === null,
+        query: async () => {
+            const result = await pool.query(sql `
 with extension_oids as (
   select
     objid
@@ -218,7 +228,7 @@ select
       from (
         -- one row for object ACL + one row per column ACL
         select null::name as attname, v.oid as relacl_oid, (
-          select c_rel.relacl from pg_class c_rel where c_rel.oid = v.oid
+          select COALESCE(c_rel.relacl, acldefault('r', c_rel.relowner)) from pg_class c_rel where c_rel.oid = v.oid
         ) as acl
         union all
         select a2.attname, v.oid as relacl_oid, a2.attacl
@@ -231,7 +241,20 @@ select
       join lateral aclexplode(src.acl) as x(grantor, grantee, privilege_type, is_grantable) on true
       group by x.grantee, x.privilege_type
     ) as grp
-  ), '[]') as privileges
+  ), '[]') as privileges,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object('provider', sl.provider, 'label', sl.label)
+        order by sl.provider
+      )
+      from pg_catalog.pg_seclabel sl
+      where sl.objoid = v.oid
+        and sl.classoid = 'pg_class'::regclass
+        and sl.objsubid = 0
+    ),
+    '[]'::json
+  ) as security_labels
 from
   views v
   left join pg_attribute a on a.attrelid = v.oid and a.attnum > 0 and not a.attisdropped
@@ -242,7 +265,9 @@ group by
 order by
   v.schema, v.name
   `);
-    // Validate and parse each row using the Zod schema
-    const validatedRows = viewRows.map((row) => viewPropsSchema.parse(row));
+            return result.rows.map((row) => viewRowSchema.parse(row));
+        },
+    });
+    const validatedRows = viewRows.filter((row) => row.definition !== null);
     return validatedRows.map((row) => new View(row));
 }

package/dist/core/plan/apply.d.ts

@@ -15,19 +15,28 @@ type ApplyPlanResult = {
 } | {
     status: "applied";
     statements: number;
+    units: number;
     warnings?: string[];
 } | {
     status: "failed";
     error: unknown;
     script: string;
+    /** 0-based index of the unit that failed; undefined if a session statement failed. */
+    failedUnitIndex?: number;
+    /** Number of units fully committed before the failure. */
+    completedUnits: number;
 };
 interface ApplyPlanOptions {
     verifyPostApply?: boolean;
 }
 type ConnectionInput = string | Pool;
 /**
- * Apply a plan's SQL statements to a target database with integrity checks.
+ * Apply a plan's migration units to a target database with integrity checks.
  * Validates fingerprints before and after application to ensure plan integrity.
+ *
+ * Units are applied in order on a single session: transactional units inside
+ * an explicit BEGIN/COMMIT, non-transactional units without a wrapper. A
+ * failure does not roll back units that already committed.
  */
 export declare function applyPlan(plan: Plan, source: ConnectionInput, target: ConnectionInput, options?: ApplyPlanOptions): Promise<ApplyPlanResult>;
 export {};