@vertz/codegen 0.2.14 → 0.2.16

package/dist/index.d.ts

@@ -16,6 +16,8 @@ interface CodegenTypescriptConfig {
 	publishable?: CodegenPublishableConfig;
 	/** Augmentable types for customer-specific type narrowing */
 	augmentableTypes?: string[];
+	/** Generate PostgreSQL RLS policies from rules.where() conditions. Default: false */
+	rls?: boolean;
 }
 interface CodegenConfig {
 	/** Generators to run. Default: ['typescript'] */
@@ -48,7 +50,30 @@ interface CodegenIR {
 	schemas: CodegenSchema[];
 	entities: CodegenEntityModule[];
 	auth: CodegenAuth;
+	access?: CodegenAccess;
 }
+interface CodegenAccess {
+	entities: CodegenAccessEntity[];
+	entitlements: string[];
+	whereClauses: CodegenWhereClause[];
+}
+interface CodegenAccessEntity {
+	name: string;
+	roles: string[];
+}
+interface CodegenWhereClause {
+	entitlement: string;
+	conditions: CodegenWhereCondition[];
+}
+type CodegenWhereCondition = {
+	kind: "marker";
+	column: string;
+	marker: "user.id" | "user.tenantId";
+} | {
+	kind: "literal";
+	column: string;
+	value: string | number | boolean;
+};
 interface CodegenModule {
 	name: string;
 	operations: CodegenOperation[];
@@ -148,6 +173,17 @@ interface CodegenEntityModule {
 	operations: CodegenEntityOperation[];
 	actions: CodegenEntityAction[];
 	relations?: CodegenRelation[];
+	tenantScoped?: boolean;
+	table?: string;
+	primaryKey?: string;
+	hiddenFields?: string[];
+	responseFields?: CodegenResolvedField[];
+	relationSelections?: Record<string, "all" | string[]>;
+	relationQueryConfig?: Record<string, {
+		allowWhere?: string[];
+		allowOrderBy?: string[];
+		maxLimit?: number;
+	}>;
 }
 interface CodegenEntityOperation {
 	kind: "list" | "get" | "create" | "update" | "delete";
@@ -265,6 +301,23 @@ declare class EntitySchemaGenerator implements Generator {
 	private generateEntitySchema;
 	private generateIndex;
 }
+interface EntitySchemaRelation {
+	type: "one" | "many";
+	entity: string;
+	selection: "all" | string[];
+	allowWhere: string[];
+	allowOrderBy: string[];
+	maxLimit?: number;
+}
+interface EntitySchemaManifestEntry {
+	table?: string;
+	primaryKey?: string;
+	tenantScoped: boolean;
+	hiddenFields: string[];
+	fields: string[];
+	relations: Record<string, EntitySchemaRelation>;
+}
+type EntitySchemaManifest = Record<string, EntitySchemaManifestEntry>;
 declare class EntitySdkGenerator implements Generator {
 	readonly name = "entity-sdk";
 	generate(ir: CodegenIR, _config: GeneratorConfig): GeneratedFile[];
@@ -316,4 +369,4 @@ declare function toPascalCase(input: string): string;
 declare function toCamelCase(input: string): string;
 declare function toKebabCase(input: string): string;
 declare function toSnakeCase(input: string): string;
-export { writeIncremental, validateCodegenConfig, toSnakeCase, toPascalCase, toKebabCase, toCamelCase, resolveCodegenConfig, renderImports, mergeImportsToPackageJson, mergeImports, jsonSchemaToTS, hashContent, generateRelationManifest, generate, formatWithBiome, defineCodegenConfig, createCodegenPipeline, adaptIR, StreamingConfig, SchemaNamingParts, SchemaAnnotations, ResolvedCodegenConfig, RelationManifestEntry, OperationSchemaRefs, OperationAuth, OAuthFlows, JsonSchema, IncrementalResult, IncrementalOptions, Import, HttpMethod, GeneratorName, GeneratorConfig, Generator, GeneratedFile, GenerateResult, FileFragment, EntityTypesGenerator, EntitySdkGenerator, EntitySchemaGenerator, ConversionResult, ConversionContext, CodegenTypescriptConfig, CodegenSchema, CodegenResolvedField, CodegenRelation, CodegenPublishableConfig, CodegenPipeline, CodegenOperation, CodegenModule, CodegenIR, CodegenEntityOperation, CodegenEntityModule, CodegenEntityAction, CodegenConfig, CodegenAuthScheme, CodegenAuth, ClientGenerator };
+export { writeIncremental, validateCodegenConfig, toSnakeCase, toPascalCase, toKebabCase, toCamelCase, resolveCodegenConfig, renderImports, mergeImportsToPackageJson, mergeImports, jsonSchemaToTS, hashContent, generateRelationManifest, generate, formatWithBiome, defineCodegenConfig, createCodegenPipeline, adaptIR, StreamingConfig, SchemaNamingParts, SchemaAnnotations, ResolvedCodegenConfig, RelationManifestEntry, OperationSchemaRefs, OperationAuth, OAuthFlows, JsonSchema, IncrementalResult, IncrementalOptions, Import, HttpMethod, GeneratorName, GeneratorConfig, Generator, GeneratedFile, GenerateResult, FileFragment, EntityTypesGenerator, EntitySdkGenerator, EntitySchemaRelation, EntitySchemaManifestEntry, EntitySchemaManifest, EntitySchemaGenerator, ConversionResult, ConversionContext, CodegenTypescriptConfig, CodegenSchema, CodegenResolvedField, CodegenRelation, CodegenPublishableConfig, CodegenPipeline, CodegenOperation, CodegenModule, CodegenIR, CodegenEntityOperation, CodegenEntityModule, CodegenEntityAction, CodegenConfig, CodegenAuthScheme, CodegenAuth, ClientGenerator };

package/dist/index.js

@@ -116,7 +116,63 @@ async function formatWithBiome(files) {
 }
 // src/generate.ts
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
+import { dirname as dirname4, join as join4, resolve as resolve4 } from "node:path";
+
+// src/generators/access-types-generator.ts
+var FILE_HEADER = `// Generated by @vertz/codegen — do not edit
+
+`;
+
+class AccessTypesGenerator {
+  name = "access-types";
+  generate(ir, _config) {
+    if (!ir.access || ir.access.entitlements.length === 0) {
+      return [];
+    }
+    return [
+      {
+        path: "access.d.ts",
+        content: renderAccessTypes(ir.access)
+      }
+    ];
+  }
+}
+function escapeStringLiteral(s) {
+  return s.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+function renderAccessTypes(access) {
+  const lines = [FILE_HEADER];
+  const registryEntries = access.entitlements.map((e) => `    '${escapeStringLiteral(e)}': true;`).join(`
+`);
+  lines.push("declare module '@vertz/server' {");
+  lines.push("  interface EntitlementRegistry {");
+  lines.push(registryEntries);
+  lines.push("  }");
+  lines.push("}");
+  lines.push("");
+  lines.push("declare module '@vertz/ui/auth' {");
+  lines.push("  interface EntitlementRegistry {");
+  lines.push(registryEntries);
+  lines.push("  }");
+  lines.push("}");
+  lines.push("");
+  const entitiesWithRoles = access.entities.filter((e) => e.roles.length > 0);
+  if (entitiesWithRoles.length > 0) {
+    const resourceUnion = entitiesWithRoles.map((e) => `'${escapeStringLiteral(e.name)}'`).join(" | ");
+    lines.push(`type ResourceType = ${resourceUnion};`);
+    lines.push("");
+    lines.push("type Role<T extends ResourceType> =");
+    entitiesWithRoles.forEach((entity, i) => {
+      const rolesUnion = entity.roles.map((r) => `'${escapeStringLiteral(r)}'`).join(" | ");
+      const prefix = i === 0 ? "  " : "  : ";
+      lines.push(`${prefix}T extends '${escapeStringLiteral(entity.name)}' ? ${rolesUnion}`);
+    });
+    lines.push("  : never;");
+    lines.push("");
+  }
+  return lines.join(`
+`);
+}
 
 // src/generators/client-generator.ts
 import { posix } from "node:path";
@@ -151,7 +207,7 @@ function generateRelationManifest(entities) {
 }
 
 // src/generators/client-generator.ts
-var FILE_HEADER = `// Generated by @vertz/codegen — do not edit
+var FILE_HEADER2 = `// Generated by @vertz/codegen — do not edit
 
 `;
 
@@ -166,10 +222,10 @@ class ClientGenerator {
   }
   generateClient(ir) {
     const entities = ir.entities ?? [];
-    const hasMutations = entities.some((e) => e.operations.some((op) => op.kind === "update" || op.kind === "delete"));
+    const hasMutations = entities.some((e) => e.operations.some((op) => op.kind === "create" || op.kind === "update" || op.kind === "delete"));
     const manifest = generateRelationManifest(entities);
     const hasRelations = manifest.some((entry) => Object.keys(entry.schema).length > 0);
-    const lines = [FILE_HEADER];
+    const lines = [FILE_HEADER2];
     if (entities.length > 0) {
       if (hasMutations) {
         lines.push("import { FetchClient, type OptimisticHandler } from '@vertz/fetch';");
@@ -224,7 +280,7 @@ class ClientGenerator {
       for (const entity of entities) {
         const pascal = toPascalCase(entity.entityName);
         const camel = toCamelCase(entity.entityName);
-        const entityHasMutations = entity.operations.some((op) => op.kind === "update" || op.kind === "delete");
+        const entityHasMutations = entity.operations.some((op) => op.kind === "create" || op.kind === "update" || op.kind === "delete");
         if (entityHasMutations) {
           lines.push(`    ${camel}: create${pascal}Sdk(client, optimistic),`);
         } else {
@@ -299,7 +355,7 @@ class ClientGenerator {
 }
 
 // src/generators/entity-schema-generator.ts
-var FILE_HEADER2 = `// Generated by @vertz/codegen — do not edit
+var FILE_HEADER3 = `// Generated by @vertz/codegen — do not edit
 
 `;
 var TYPE_MAP = {
@@ -334,7 +390,7 @@ class EntitySchemaGenerator {
     return files;
   }
   generateEntitySchema(entity, schemaOps, schemaActions) {
-    const lines = [FILE_HEADER2];
+    const lines = [FILE_HEADER3];
     lines.push("import { s } from '@vertz/schema';");
     lines.push("");
     for (const op of schemaOps) {
@@ -374,7 +430,7 @@ class EntitySchemaGenerator {
     };
   }
   generateIndex(entities) {
-    const lines = [FILE_HEADER2];
+    const lines = [FILE_HEADER3];
     for (const entity of entities) {
       const exports = [];
       const schemaOps = entity.operations.filter((op) => (op.kind === "create" || op.kind === "update") && op.resolvedFields && op.resolvedFields.length > 0);
@@ -396,8 +452,50 @@ class EntitySchemaGenerator {
   }
 }
 
+// src/generators/entity-schema-manifest-generator.ts
+function buildManifestEntry(entity) {
+  const fields = (entity.responseFields ?? []).map((f) => f.name);
+  const relations = {};
+  for (const rel of entity.relations ?? []) {
+    const selection = entity.relationSelections?.[rel.name] ?? "all";
+    const qc = entity.relationQueryConfig?.[rel.name];
+    relations[rel.name] = {
+      type: rel.type,
+      entity: rel.entity,
+      selection,
+      allowWhere: qc?.allowWhere ?? [],
+      allowOrderBy: qc?.allowOrderBy ?? [],
+      ...qc?.maxLimit !== undefined ? { maxLimit: qc.maxLimit } : {}
+    };
+  }
+  return {
+    ...entity.table !== undefined ? { table: entity.table } : {},
+    ...entity.primaryKey !== undefined ? { primaryKey: entity.primaryKey } : {},
+    tenantScoped: entity.tenantScoped ?? false,
+    hiddenFields: entity.hiddenFields ?? [],
+    fields,
+    relations
+  };
+}
+
+class EntitySchemaManifestGenerator {
+  name = "entity-schema-manifest";
+  generate(ir, _config) {
+    const manifest = {};
+    for (const entity of ir.entities) {
+      manifest[entity.entityName] = buildManifestEntry(entity);
+    }
+    return [
+      {
+        path: "entity-schema.json",
+        content: JSON.stringify(manifest, null, 2)
+      }
+    ];
+  }
+}
+
 // src/generators/entity-sdk-generator.ts
-var FILE_HEADER3 = `// Generated by @vertz/codegen — do not edit
+var FILE_HEADER4 = `// Generated by @vertz/codegen — do not edit
 
 `;
 function toPascalCase2(s) {
@@ -418,7 +516,7 @@ class EntitySdkGenerator {
   }
   generateEntitySdk(entity, _basePath) {
     const pascal = toPascalCase2(entity.entityName);
-    const lines = [FILE_HEADER3];
+    const lines = [FILE_HEADER4];
     const createOpsWithMeta = entity.operations.filter((op) => op.kind === "create" && op.resolvedFields && op.resolvedFields.length > 0);
     const hasSchemaImports = createOpsWithMeta.length > 0;
     if (hasSchemaImports) {
@@ -431,7 +529,7 @@ class EntitySdkGenerator {
     }
     const hasTypes = entity.operations.some((op) => op.outputSchema || op.inputSchema);
     const hasListOp = entity.operations.some((op) => op.kind === "list");
-    const hasMutationOp = entity.operations.some((op) => op.kind === "update" || op.kind === "delete");
+    const hasMutationOp = entity.operations.some((op) => op.kind === "create" || op.kind === "update" || op.kind === "delete");
     if (hasTypes) {
       const typeImports = new Set;
       for (const op of entity.operations) {
@@ -447,6 +545,10 @@ class EntitySdkGenerator {
           typeImports.add(action.outputSchema);
       }
       lines.push(`import type { ${[...typeImports].join(", ")} } from '../types/${entity.entityName}';`);
+    }
+    const hasReadOp = entity.operations.some((op) => op.kind === "list" || op.kind === "get");
+    const needsFetchImport = hasTypes || hasMutationOp || hasListOp;
+    if (needsFetchImport) {
       const fetchImportParts = ["type FetchClient"];
       if (hasListOp)
         fetchImportParts.push("type ListResponse");
@@ -455,6 +557,8 @@ class EntitySdkGenerator {
       fetchImportParts.push("createDescriptor");
       if (hasMutationOp)
         fetchImportParts.push("createMutationDescriptor");
+      if (hasReadOp)
+        fetchImportParts.push("resolveVertzQL");
       lines.push(`import { ${fetchImportParts.join(", ")} } from '@vertz/fetch';`);
       lines.push("");
     }
@@ -469,23 +573,32 @@ class EntitySdkGenerator {
       const outputType = op.outputSchema ?? "unknown";
       const listOutput = op.kind === "list" ? `ListResponse<${outputType}>` : outputType;
       switch (op.kind) {
-        case "list":
+        case "list": {
           lines.push(`    list: Object.assign(`);
-          lines.push(`      (query?: Record<string, unknown>) => createDescriptor('GET', '${op.path}', () => client.get<${listOutput}>('${op.path}', { query }), query, { entityType: '${entity.entityName}', kind: 'list' as const }),`);
+          lines.push(`      (query?: Record<string, unknown>) => {`);
+          lines.push(`        const resolvedQuery = resolveVertzQL(query);`);
+          lines.push(`        return createDescriptor('GET', '${op.path}', () => client.get<${listOutput}>('${op.path}', { query: resolvedQuery }), resolvedQuery, { entityType: '${entity.entityName}', kind: 'list' as const });`);
+          lines.push(`      },`);
           lines.push(`      { url: '${op.path}', method: 'GET' as const },`);
           lines.push(`    ),`);
           break;
-        case "get":
+        }
+        case "get": {
+          const getPathExpr = `\`${op.path.replace(":id", "${id}")}\``;
           lines.push(`    get: Object.assign(`);
-          lines.push(`      (id: string) => createDescriptor('GET', \`${op.path.replace(":id", "${id}")}\`, () => client.get<${outputType}>(\`${op.path.replace(":id", "${id}")}\`), undefined, { entityType: '${entity.entityName}', kind: 'get' as const, id }),`);
+          lines.push(`      (id: string, options?: { select?: Record<string, true> }) => {`);
+          lines.push(`        const resolvedQuery = resolveVertzQL(options);`);
+          lines.push(`        return createDescriptor('GET', ${getPathExpr}, () => client.get<${outputType}>(${getPathExpr}, { query: resolvedQuery }), resolvedQuery, { entityType: '${entity.entityName}', kind: 'get' as const, id });`);
+          lines.push(`      },`);
           lines.push(`      { url: '${op.path}', method: 'GET' as const },`);
           lines.push(`    ),`);
           break;
+        }
         case "create":
           if (op.resolvedFields && op.resolvedFields.length > 0) {
             const schemaVarName = `${(op.inputSchema ?? "createInput").charAt(0).toLowerCase()}${(op.inputSchema ?? "createInput").slice(1)}Schema`;
             lines.push(`    create: Object.assign(`);
-            lines.push(`      (body: ${inputType}) => createDescriptor('POST', '${op.path}', () => client.post<${outputType}>('${op.path}', body)),`);
+            lines.push(`      (body: ${inputType}) => createMutationDescriptor('POST', '${op.path}', () => client.post<${outputType}>('${op.path}', body), { entityType: '${entity.entityName}', kind: 'create' as const, body }, optimistic),`);
             lines.push(`      {`);
             lines.push(`        url: '${op.path}',`);
             lines.push(`        method: 'POST' as const,`);
@@ -494,7 +607,7 @@ class EntitySdkGenerator {
             lines.push(`    ),`);
           } else {
             lines.push(`    create: Object.assign(`);
-            lines.push(`      (body: ${inputType}) => createDescriptor('POST', '${op.path}', () => client.post<${outputType}>('${op.path}', body)),`);
+            lines.push(`      (body: ${inputType}) => createMutationDescriptor('POST', '${op.path}', () => client.post<${outputType}>('${op.path}', body), { entityType: '${entity.entityName}', kind: 'create' as const, body }, optimistic),`);
             lines.push(`      { url: '${op.path}', method: 'POST' as const },`);
             lines.push(`    ),`);
           }
@@ -543,7 +656,7 @@ class EntitySdkGenerator {
     };
   }
   generateIndex(entities) {
-    const lines = [FILE_HEADER3];
+    const lines = [FILE_HEADER4];
     for (const entity of entities) {
       const pascal = toPascalCase2(entity.entityName);
       lines.push(`export { create${pascal}Sdk } from './${entity.entityName}';`);
@@ -554,7 +667,7 @@ class EntitySdkGenerator {
 }
 
 // src/generators/entity-types-generator.ts
-var FILE_HEADER4 = `// Generated by @vertz/codegen — do not edit
+var FILE_HEADER5 = `// Generated by @vertz/codegen — do not edit
 
 `;
 var TS_TYPE_MAP = {
@@ -586,7 +699,7 @@ class EntityTypesGenerator {
     return files;
   }
   generateEntityTypes(entity) {
-    const lines = [FILE_HEADER4];
+    const lines = [FILE_HEADER5];
     const emitted = new Set;
     for (const op of entity.operations) {
       if (op.inputSchema && !emitted.has(op.inputSchema)) {
@@ -657,7 +770,7 @@ ${props};
 }`;
   }
   generateIndex(entities) {
-    const lines = [FILE_HEADER4];
+    const lines = [FILE_HEADER5];
     for (const entity of entities) {
       lines.push(`export * from './${entity.entityName}';`);
     }
@@ -666,9 +779,177 @@ ${props};
   }
 }
 
+// src/generators/rls-policy-generator.ts
+var FILE_HEADER6 = `-- Generated by @vertz/codegen — do not edit
+
+`;
+var VALID_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+
+class RlsPolicyGenerator {
+  name = "rls-policies";
+  generate(ir, _config) {
+    if (!ir.access || ir.access.whereClauses.length === 0) {
+      return [];
+    }
+    return [
+      {
+        path: "rls-policies.sql",
+        content: renderPolicies(ir.access)
+      }
+    ];
+  }
+}
+function quoteIdentifier(name) {
+  if (!VALID_IDENTIFIER.test(name)) {
+    return `"${name.replace(/"/g, '""')}"`;
+  }
+  return name;
+}
+function renderCondition(condition) {
+  const column = quoteIdentifier(toSnakeCase(condition.column));
+  if (condition.kind === "marker") {
+    if (condition.marker === "user.id") {
+      return `${column} = current_setting('app.user_id')::UUID`;
+    }
+    return `${column} = current_setting('app.tenant_id')::UUID`;
+  }
+  if (typeof condition.value === "string") {
+    const escaped = condition.value.replace(/'/g, "''");
+    return `${column} = '${escaped}'`;
+  }
+  return `${column} = ${condition.value}`;
+}
+function renderPolicies(access) {
+  const lines = [FILE_HEADER6];
+  for (const clause of access.whereClauses) {
+    const colonIdx = clause.entitlement.indexOf(":");
+    const entity = colonIdx >= 0 ? clause.entitlement.slice(0, colonIdx) : clause.entitlement;
+    const action = colonIdx >= 0 ? clause.entitlement.slice(colonIdx + 1) : "";
+    const tableName = quoteIdentifier(`${toSnakeCase(entity)}s`);
+    const policyName = quoteIdentifier(`${toSnakeCase(entity)}_${toSnakeCase(action)}`.replace(/^_+|_+$/g, ""));
+    lines.push(`-- Entitlement: ${clause.entitlement}`);
+    const using = clause.conditions.map(renderCondition).join(" AND ");
+    lines.push(`CREATE POLICY ${policyName} ON ${tableName} FOR ALL`);
+    lines.push(`  USING (${using});`);
+    lines.push("");
+  }
+  return lines.join(`
+`);
+}
+
+// src/generators/router-augmentation-generator.ts
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { dirname as dirname2, extname, join as join2, relative, resolve as resolve2, sep } from "node:path";
+var FILE_HEADER7 = `// Generated by @vertz/codegen — do not edit
+
+`;
+var CANDIDATE_ROUTE_FILES = [
+  ["src", "router.ts"],
+  ["src", "router.tsx"],
+  ["src", "ui", "router.ts"],
+  ["src", "ui", "router.tsx"]
+];
+var SOURCE_EXTENSIONS = new Set([".ts", ".tsx"]);
+var EXPORTED_ROUTES_PATTERN = /export\s+const\s+routes\b/m;
+var REEXPORTED_ROUTES_PATTERN = /const\s+routes\b[\s\S]*?export\s*\{\s*routes\b/m;
+
+class RouterAugmentationGenerator {
+  name = "router-augmentation";
+  generate(_ir, config) {
+    const projectRoot = findProjectRoot(config.outputDir);
+    if (!projectRoot)
+      return [];
+    const routeModulePath = findRouteModule(projectRoot);
+    if (!routeModulePath)
+      return [];
+    return [
+      {
+        path: "router.d.ts",
+        content: renderRouterAugmentation(routeModulePath, config.outputDir)
+      }
+    ];
+  }
+}
+function findProjectRoot(outputDir) {
+  let current = resolve2(outputDir);
+  while (true) {
+    if (existsSync(join2(current, "package.json"))) {
+      return current;
+    }
+    const parent = dirname2(current);
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+}
+function findRouteModule(projectRoot) {
+  for (const candidate of CANDIDATE_ROUTE_FILES) {
+    const candidatePath = join2(projectRoot, ...candidate);
+    if (existsSync(candidatePath) && fileExportsRoutes(candidatePath)) {
+      return candidatePath;
+    }
+  }
+  return scanForRouteModule(join2(projectRoot, "src"));
+}
+function scanForRouteModule(dir) {
+  if (!existsSync(dir))
+    return null;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = join2(dir, entry.name);
+    if (entry.isDirectory()) {
+      const nested = scanForRouteModule(fullPath);
+      if (nested) {
+        return nested;
+      }
+      continue;
+    }
+    if (!entry.isFile())
+      continue;
+    const extension = extname(entry.name);
+    if (extension === ".d.ts" || !SOURCE_EXTENSIONS.has(extension))
+      continue;
+    if (fileExportsRoutes(fullPath)) {
+      return fullPath;
+    }
+  }
+  return null;
+}
+function fileExportsRoutes(filePath) {
+  const source = readFileSync(filePath, "utf-8");
+  if (!source.includes("defineRoutes("))
+    return false;
+  return EXPORTED_ROUTES_PATTERN.test(source) || REEXPORTED_ROUTES_PATTERN.test(source);
+}
+function renderRouterAugmentation(routeModulePath, outputDir) {
+  const importPath = toImportPath(relative(resolve2(outputDir), routeModulePath));
+  return [
+    FILE_HEADER7,
+    "import type { InferRouteMap, TypedRouter, UnwrapSignals } from '@vertz/ui';",
+    `import type { routes } from '${importPath}';`,
+    "",
+    "type AppRouteMap = InferRouteMap<typeof routes>;",
+    "",
+    "declare module '@vertz/ui' {",
+    "  export function useRouter(): UnwrapSignals<TypedRouter<AppRouteMap>>;",
+    "}",
+    "",
+    "declare module '@vertz/ui/router' {",
+    "  export function useRouter(): UnwrapSignals<TypedRouter<AppRouteMap>>;",
+    "}",
+    ""
+  ].join(`
+`);
+}
+function toImportPath(pathToModule) {
+  const normalized = pathToModule.split(sep).join("/");
+  const withoutExtension = normalized.replace(/\.[^.]+$/, "");
+  return withoutExtension.startsWith(".") ? withoutExtension : `./${withoutExtension}`;
+}
+
 // src/incremental.ts
 import { mkdir as mkdir2, readdir, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname2, join as join2, relative, resolve as resolve2 } from "node:path";
+import { dirname as dirname3, join as join3, relative as relative2, resolve as resolve3 } from "node:path";
 
 // src/hasher.ts
 import { createHash } from "node:crypto";
@@ -686,11 +967,11 @@ async function collectFiles(dir, baseDir) {
     return results;
   }
   for (const entry of entries) {
-    const fullPath = join2(dir, entry.name);
+    const fullPath = join3(dir, entry.name);
     if (entry.isDirectory()) {
       results.push(...await collectFiles(fullPath, baseDir));
     } else if (entry.isFile()) {
-      results.push(relative(baseDir, fullPath));
+      results.push(relative2(baseDir, fullPath));
     }
   }
   return results;
@@ -702,12 +983,12 @@ async function writeIncremental(files, outputDir, options) {
   await mkdir2(outputDir, { recursive: true });
   const generatedPaths = new Set(files.map((f) => f.path));
   for (const file of files) {
-    const filePath = join2(outputDir, file.path);
-    const resolvedPath = resolve2(filePath);
-    if (!resolvedPath.startsWith(resolve2(outputDir))) {
+    const filePath = join3(outputDir, file.path);
+    const resolvedPath = resolve3(filePath);
+    if (!resolvedPath.startsWith(resolve3(outputDir))) {
       throw new Error(`Generated file path "${file.path}" escapes output directory`);
     }
-    const dir = dirname2(filePath);
+    const dir = dirname3(filePath);
     await mkdir2(dir, { recursive: true });
     let existingContent;
     try {
@@ -724,7 +1005,7 @@ async function writeIncremental(files, outputDir, options) {
     const existingFiles = await collectFiles(outputDir, outputDir);
     for (const existing of existingFiles) {
       if (!generatedPaths.has(existing)) {
-        await rm2(join2(outputDir, existing), { force: true });
+        await rm2(join3(outputDir, existing), { force: true });
         removed.push(existing);
       }
     }
@@ -834,20 +1115,57 @@ function adaptIR(appIR) {
       };
     });
     const resolvedRelations = entity.relations.filter((r) => !!r.type && !!r.entity).map((r) => ({ name: r.name, type: r.type, entity: r.entity }));
+    const relationSelections = {};
+    const relationQueryConfig = {};
+    for (const rel of entity.relations) {
+      relationSelections[rel.name] = rel.selection;
+      if (rel.allowWhere || rel.allowOrderBy || rel.maxLimit !== undefined) {
+        relationQueryConfig[rel.name] = {
+          ...rel.allowWhere ? { allowWhere: rel.allowWhere } : {},
+          ...rel.allowOrderBy ? { allowOrderBy: rel.allowOrderBy } : {},
+          ...rel.maxLimit !== undefined ? { maxLimit: rel.maxLimit } : {}
+        };
+      }
+    }
+    let entityResponseFields;
+    const respRef = entity.modelRef.schemaRefs.response;
+    if (respRef?.kind === "inline") {
+      entityResponseFields = respRef.resolvedFields?.map((f) => ({
+        name: f.name,
+        tsType: f.tsType,
+        optional: f.optional
+      }));
+    }
     return {
       entityName: entity.name,
       operations,
       actions,
-      relations: resolvedRelations.length > 0 ? resolvedRelations : undefined
+      relations: resolvedRelations.length > 0 ? resolvedRelations : undefined,
+      tenantScoped: entity.tenantScoped,
+      table: entity.table,
+      primaryKey: entity.modelRef.primaryKey,
+      hiddenFields: entity.modelRef.hiddenFields,
+      responseFields: entityResponseFields,
+      relationSelections: Object.keys(relationSelections).length > 0 ? relationSelections : undefined,
+      relationQueryConfig: Object.keys(relationQueryConfig).length > 0 ? relationQueryConfig : undefined
     };
   });
+  const access = appIR.access ? {
+    entities: appIR.access.entities.map((e) => ({ name: e.name, roles: e.roles })),
+    entitlements: appIR.access.entitlements,
+    whereClauses: (appIR.access.whereClauses ?? []).map((wc) => ({
+      entitlement: wc.entitlement,
+      conditions: wc.conditions.map((c) => ({ ...c }))
+    }))
+  } : undefined;
   return {
     basePath: appIR.app.basePath,
     version: appIR.app.version,
     modules: [],
     schemas: allSchemas,
     entities,
-    auth: { schemes: [] }
+    auth: { schemes: [] },
+    access
   };
 }
 
@@ -863,6 +1181,16 @@ function runTypescriptGenerator(ir, _config) {
   files.push(...entitySdkGen.generate(ir, generatorConfig));
   const clientGen = new ClientGenerator;
   files.push(...clientGen.generate(ir, generatorConfig));
+  const routerAugmentationGen = new RouterAugmentationGenerator;
+  files.push(...routerAugmentationGen.generate(ir, generatorConfig));
+  const accessTypesGen = new AccessTypesGenerator;
+  files.push(...accessTypesGen.generate(ir, generatorConfig));
+  const entitySchemaManifestGen = new EntitySchemaManifestGenerator;
+  files.push(...entitySchemaManifestGen.generate(ir, generatorConfig));
+  if (_config.typescript?.rls) {
+    const rlsPolicyGen = new RlsPolicyGenerator;
+    files.push(...rlsPolicyGen.generate(ir, generatorConfig));
+  }
   return files;
 }
 function generateSync(ir, config) {
@@ -889,10 +1217,10 @@ async function mergeImportsToPackageJson(files, outputDir) {
   const imports = generated.imports;
   if (!imports || Object.keys(imports).length === 0)
     return false;
-  const projectRoot = await findProjectRoot(resolve3(outputDir));
+  const projectRoot = await findProjectRoot2(resolve4(outputDir));
   if (!projectRoot)
     return false;
-  const pkgPath = join3(projectRoot, "package.json");
+  const pkgPath = join4(projectRoot, "package.json");
   const raw = await readFile3(pkgPath, "utf-8");
   const pkg = JSON.parse(raw);
   const existing = pkg.imports;
@@ -904,15 +1232,15 @@ async function mergeImportsToPackageJson(files, outputDir) {
 `, "utf-8");
   return true;
 }
-async function findProjectRoot(startDir) {
+async function findProjectRoot2(startDir) {
   let dir = startDir;
-  const root = dirname3(dir);
+  const root = dirname4(dir);
   while (dir !== root) {
     try {
-      await readFile3(join3(dir, "package.json"), "utf-8");
+      await readFile3(join4(dir, "package.json"), "utf-8");
       return dir;
     } catch {
-      dir = dirname3(dir);
+      dir = dirname4(dir);
     }
   }
   return null;
@@ -932,12 +1260,12 @@ async function generate(appIR, config) {
   } else {
     await mkdir3(config.outputDir, { recursive: true });
     for (const file of files) {
-      const filePath = join3(config.outputDir, file.path);
-      const resolvedPath = resolve3(filePath);
-      if (!resolvedPath.startsWith(resolve3(config.outputDir))) {
+      const filePath = join4(config.outputDir, file.path);
+      const resolvedPath = resolve4(filePath);
+      if (!resolvedPath.startsWith(resolve4(config.outputDir))) {
         throw new Error(`Generated file path "${file.path}" escapes output directory`);
       }
-      const dir = dirname3(filePath);
+      const dir = dirname4(filePath);
       await mkdir3(dir, { recursive: true });
       await writeFile3(filePath, file.content, "utf-8");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vertz/codegen",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "type": "module",
   "license": "MIT",
   "description": "Vertz code generation — internal, no stability guarantee",
@@ -27,7 +27,7 @@
     "typecheck": "tsc --noEmit -p tsconfig.typecheck.json"
   },
   "dependencies": {
-    "@vertz/compiler": "^0.2.13"
+    "@vertz/compiler": "^0.2.15"
   },
   "devDependencies": {
     "@types/node": "^25.3.1",