better-supabase 0.1.0 → 0.3.0

package/README.md

@@ -4,7 +4,7 @@
 
 [![npm](https://img.shields.io/npm/v/better-supabase)](https://www.npmjs.com/package/better-supabase)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/ScaleDockHQ/better-supabase/blob/main/LICENSE)
-![TypeScript](https://img.shields.io/badge/TypeScript-5.9%20%7C%206%20%7C%207-3178c6.svg)
+![TypeScript](https://img.shields.io/badge/TypeScript-6%20%7C%207-3178c6.svg)
 
 `better-supabase gen` extends `supabase gen types` with relation cardinality, unique keys, CHECK unions and typed jsonb. The generated `schema` gives every table a typed repository that compiles to one PostgREST request, returns a `Result` instead of throwing, and runs as the caller so RLS always applies.
 
@@ -12,13 +12,15 @@
 
 ```bash
 pnpm add better-supabase @supabase/supabase-js
-pnpm add -D pg
+pnpm add -D @better-supabase/cli pg
 ```
 
-ESM only. Node 24 or later for the CLI; the runtime entries run on every WinterTC runtime (Node, Deno, Bun, Workers, Supabase Edge Functions). TypeScript 5.9, 6 and 7 are tested.
+ESM only. The CLI ships as [`@better-supabase/cli`](https://www.npmjs.com/package/@better-supabase/cli), always at the same version as `better-supabase`, and needs Node 24 or later; the runtime entries run on every WinterTC runtime (Node, Deno, Bun, Workers, Supabase Edge Functions). TypeScript 6 and 7 are tested.
 
 ## Quick start
 
+Or start with `npx @better-supabase/cli init`, which detects your frameworks and prints the install command.
+
 ```bash
 supabase start
 pnpm better-supabase init   # config, src/lib/supabase.ts and framework glue
@@ -26,20 +28,20 @@ pnpm better-supabase gen    # database.types.ts and generated.ts
 ```
 
 ```ts
-import { createClient } from '@supabase/supabase-js';
-import { defineSupabase } from 'better-supabase';
+import { createClient } from "@supabase/supabase-js";
+import { defineSupabase } from "better-supabase";
 
-import { schema } from './lib/supabase/generated.ts';
+import { schema } from "./lib/supabase/generated.ts";
 
 export const sb = defineSupabase(schema);
 
 const db = sb.connect(createClient(url, publishableKey));
 
 const result = await db.customers.findMany({
-  select: ['id', 'name'],
-  where: { status: 'active', notes: { some: { kind: 'call' } } },
-  include: { organization: { select: ['name'] } },
-  orderBy: { name: 'asc' },
+  select: ["id", "name"],
+  where: { status: "active", notes: { some: { kind: "call" } } },
+  include: { organization: { select: ["name"] } },
+  orderBy: { name: "asc" },
   limit: 20,
 });
 if (!result.ok) return result; // DbError: kind, message, status, code
@@ -47,27 +49,28 @@ if (!result.ok) return result; // DbError: kind, message, status, code
 
 ## Subpaths
 
-| Import | What it gives you |
-| --- | --- |
-| `better-supabase` | `defineSupabase`, repositories, `Result`, `DbError`, `SPEC_PINS` |
-| `better-supabase/config` | `defineConfig` and generators for `better-supabase.config.ts` |
-| `better-supabase/client` | Browser repositories that follow the session |
-| `better-supabase/react` | Provider, typed hooks and the server session |
-| `better-supabase/query` | TanStack Query options with table-based invalidation |
-| `better-supabase/server` | Repositories bound to the caller, admin and acting-as identities |
-| `better-supabase/postgres` | The same repositories over direct Postgres |
-| `better-supabase/ssr` | The `@supabase/ssr` cookie format for any framework |
-| `better-supabase/next`, `/next/image` | Proxy, Server Components, route handlers, server actions, Storage images |
-| `better-supabase/hono`, `/orpc`, `/edge` | Framework adapters |
-| `better-supabase/mcp` | MCP servers whose tools run as the signed-in user |
-| `better-supabase/jobs` | Supabase Queues jobs, idempotency keys and a webhook inbox |
-| `better-supabase/list` | Search, facets, sorting and pagination from one definition |
-| `better-supabase/storage`, `/realtime` | Typed bucket paths and broadcast topics |
-| `better-supabase/env` | Validated Supabase settings |
-| `better-supabase/events`, `/webhooks`, `/openapi`, `/otel` | CloudEvents, Standard Webhooks, OpenAPI 3.1 and OpenTelemetry |
-| `better-supabase/plugins/*` | Timestamps, soft delete, tenant, actor, validation and runtime rules |
-| `better-supabase/lint` | Editor rules for unbounded reads and unscoped deletes |
-| `better-supabase/testing` | `asUser`, `localAuth`, typed seeds and conformance kits |
+| Import                                                     | What it gives you                                                        |
+| ---------------------------------------------------------- | ------------------------------------------------------------------------ |
+| `better-supabase`                                          | `defineSupabase`, repositories, `Result`, `DbError`, `SPEC_PINS`         |
+| `better-supabase/config`                                   | `defineConfig` and generators for `better-supabase.config.ts`            |
+| `better-supabase/client`                                   | Browser repositories that follow the session                             |
+| `better-supabase/react`                                    | Provider, typed hooks and the server session                             |
+| `better-supabase/query`                                    | TanStack Query options with table-based invalidation                     |
+| `better-supabase/server`                                   | Repositories bound to the caller, admin and acting-as identities         |
+| `better-supabase/postgres`                                 | The same repositories over direct Postgres                               |
+| `better-supabase/ssr`                                      | The `@supabase/ssr` cookie format for any framework                      |
+| `better-supabase/next`, `/next/image`                      | Proxy, Server Components, route handlers, server actions, Storage images |
+| `better-supabase/hono`, `/orpc`, `/edge`                   | Framework adapters                                                       |
+| `better-supabase/mcp`                                      | MCP servers whose tools run as the signed-in user                        |
+| `better-supabase/jobs`                                     | Supabase Queues jobs, idempotency keys and a webhook inbox               |
+| `better-supabase/list`                                     | Search, facets, sorting and pagination from one definition               |
+| `better-supabase/storage`, `/realtime`                     | Typed bucket paths and broadcast topics                                  |
+| `better-supabase/env`                                      | Validated Supabase settings                                              |
+| `better-supabase/events`, `/webhooks`, `/openapi`, `/otel` | CloudEvents, Standard Webhooks, OpenAPI 3.1 and OpenTelemetry            |
+| `better-supabase/plugins/*`                                | Timestamps, soft delete, tenant, actor, validation and runtime rules     |
+| `better-supabase/sql`                                      | The SQL kit modules and read-set compiler behind `better-supabase sql`   |
+| `better-supabase/lint`                                     | Editor rules for unbounded reads and unscoped deletes                    |
+| `better-supabase/testing`                                  | `asUser`, `localAuth`, typed seeds and conformance kits                  |
 
 ## For AI agents
 

package/dist/base64-CQeB1eSf.js

@@ -0,0 +1,42 @@
+//#region src/core/base64.ts
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/** Standard base64 (RFC 4648 section 4) of `input`, with padding. */
+function toBase64(input) {
+	const bytes = typeof input === "string" ? encoder.encode(input) : input;
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary);
+}
+/** Bytes of standard or URL-safe base64, padded or not. Throws on invalid input. */
+function fromBase64(text) {
+	const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
+	const binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+	return bytes;
+}
+/** URL-safe base64 (RFC 4648 section 5) of `input`, without padding. */
+function toBase64Url(input) {
+	return toBase64(input).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+/** UTF-8 text of base64 or base64url. Throws on invalid input. */
+function base64ToText(text) {
+	return decoder.decode(fromBase64(text));
+}
+/**
+* The payload of a JWT, decoded without verifying the signature. Only for
+* reading claims such as `exp` from a token that is verified elsewhere.
+*/
+function decodeJwtPayload(token) {
+	const part = token.split(".")[1];
+	if (!part) return void 0;
+	try {
+		const parsed = JSON.parse(base64ToText(part));
+		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { toBase64Url as a, toBase64 as i, decodeJwtPayload as n, fromBase64 as r, base64ToText as t };

package/dist/claims-CoTobNC-.js

@@ -0,0 +1,25 @@
+//#region src/core/claims.ts
+const DEFAULT_CLAIMS = {
+	tenant: "tenant_id",
+	scope: "tenant",
+	features: "features"
+};
+/** The configured claim names, with defaults for the ones codegen left out. */
+function claimsOf(meta) {
+	return {
+		...DEFAULT_CLAIMS,
+		...meta?.claims
+	};
+}
+/** Where the active tenant is read from: the top-level claim, then `app_metadata`. */
+function tenantClaimPaths(tenant = DEFAULT_CLAIMS.tenant) {
+	return [tenant, `app_metadata.${tenant}`];
+}
+/** The string at a dotted claim path, if any. */
+function claimAt(claims, path) {
+	let value = claims;
+	for (const segment of path.split(".")) value = typeof value === "object" && value !== null ? value[segment] : void 0;
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+//#endregion
+export { tenantClaimPaths as i, claimAt as n, claimsOf as r, DEFAULT_CLAIMS as t };

package/dist/client/index.d.ts

@@ -1,2 +1,2 @@
-import { a as BrowserOptions, i as BrowserAuth, n as AuthUser, o as createBrowser, r as BetterBrowser, t as AuthSnapshot } from "../index-Sw43J8HG.js";
+import { a as BrowserOptions, i as BrowserAuth, n as AuthUser, o as createBrowser, r as BetterBrowser, t as AuthSnapshot } from "../index-UJ-LUxtI.js";
 export { AuthSnapshot, AuthUser, BetterBrowser, BrowserAuth, BrowserOptions, createBrowser };

package/dist/client/index.js

@@ -1,5 +1,6 @@
-import { a as parseEnv, n as EnvValidationError } from "../env-BEToab0I.js";
-import { t as createQueries } from "../query-ChvDbsDE.js";
+import { n as decodeJwtPayload } from "../base64-CQeB1eSf.js";
+import { EnvValidationError, parseEnv } from "../env/index.js";
+import { t as createQueries } from "../query-BdKLTPlj.js";
 import { createBrowserClient } from "@supabase/ssr";
 import { createClient } from "@supabase/supabase-js";
 //#region src/client/index.ts
@@ -13,20 +14,9 @@ const SIGNED_OUT = {
 	user: null,
 	claims: null
 };
-function decodeClaims(token) {
-	const part = token.split(".")[1];
-	if (!part) return {};
-	try {
-		const bytes = Uint8Array.from(atob(part.replace(/-/g, "+").replace(/_/g, "/")), (char) => char.charCodeAt(0));
-		const parsed = JSON.parse(new TextDecoder().decode(bytes));
-		return typeof parsed === "object" && parsed !== null ? parsed : {};
-	} catch {
-		return {};
-	}
-}
 function snapshotOf(session) {
 	if (!session) return SIGNED_OUT;
-	const claims = decodeClaims(session.access_token);
+	const claims = decodeJwtPayload(session.access_token) ?? {};
 	const role = typeof claims["role"] === "string" ? claims["role"] : session.user.role;
 	return {
 		status: "signed-in",

package/dist/{compiler-DL18ukPe.d.ts → compiler-2zqGzxVZ.d.ts}

@@ -1,5 +1,5 @@
-import { g as Operation } from "./executor-Bazhgsgq.js";
-import { i as PostgrestPlan } from "./postgrest-Dm-vhY6R.js";
+import { g as Operation } from "./executor-DynmIWhq.js";
+import { i as PostgrestPlan } from "./postgrest-DmBlevh-.js";
 //#region src/core/compiler.d.ts
 /**
  * Turns an IR operation into something a backend runs. An `Executor` for a

package/dist/config/index.d.ts

@@ -1,3 +1,4 @@
-import { A as resolveConfig, C as SqlConfig, D as VectorDistance, E as TimestampsConfig, F as valibot, I as JsonSchemaGeneratorOptions, L as buildJsonSchema, M as ZodGeneratorOptions, N as zod, O as VectorSearchConfig, P as ValibotGeneratorOptions, R as jsonSchema, S as SourceConfig, T as TenantConfig, _ as RealtimeConfig, a as CodecsConfig, b as SeedConfig, c as ExposeConfig, d as GeneratorInput, f as JsonSchemaSource, g as Privilege, h as PluginFlagsConfig, i as CONFIG_SCHEMA_URL, j as resolveJsonSchema, k as defineConfig, l as GeneratedFile, m as OpenApiConfig, n as BetterSupabaseConfig, o as DoctorConfig, p as JsonTypeConfig, r as BucketConfig, s as EntitlementsConfig, t as ActorConfig, u as Generator, v as ResolvedConfig, w as TableConfig, x as SoftDeleteConfig, y as ResolvedExpose } from "../index-BD6wKthp.js";
-import { i as Casing } from "../types-C2fslP1z.js";
-export { ActorConfig, BetterSupabaseConfig, BucketConfig, CONFIG_SCHEMA_URL, type Casing, CodecsConfig, DoctorConfig, EntitlementsConfig, ExposeConfig, GeneratedFile, Generator, GeneratorInput, type JsonSchemaGeneratorOptions, JsonSchemaSource, JsonTypeConfig, OpenApiConfig, PluginFlagsConfig, Privilege, RealtimeConfig, ResolvedConfig, ResolvedExpose, SeedConfig, SoftDeleteConfig, SourceConfig, SqlConfig, TableConfig, TenantConfig, TimestampsConfig, type ValibotGeneratorOptions, VectorDistance, VectorSearchConfig, type ZodGeneratorOptions, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, valibot, zod };
+import { a as Casing } from "../types-DONv9SHN.js";
+import { $ as GeneratorMetadata, A as VectorSearchConfig, B as CatalogFunction, C as SoftDeleteConfig, D as TenantConfig, E as TableConfig, F as CatalogCheck, G as CatalogTable, H as CatalogGrant, I as CatalogColumn, J as ExtrasFunction, K as CatalogTrigger, L as CatalogColumnGrant, M as resolveConfig, N as resolveJsonSchema, O as TimestampsConfig, P as Catalog, Q as ForeignKeyAction, R as CatalogEnum, S as SeedConfig, T as SqlConfig, U as CatalogIndex, V as CatalogFunctionArg, W as CatalogPolicy, X as ExtrasHookFunction, Y as ExtrasHook, Z as ExtrasTable, _ as PluginFlagsConfig, a as ClaimsConfig, b as ResolvedConfig, c as EntitlementsConfig, d as Generator, et as Snapshot, f as GeneratorInput, g as PermdockPathsConfig, h as OpenApiConfig, i as CONFIG_SCHEMA_URL, j as defineConfig, k as VectorDistance, l as ExposeConfig, m as JsonTypeConfig, n as BetterSupabaseConfig, nt as SnapshotExtras, o as CodecsConfig, p as JsonSchemaSource, q as CatalogUnique, r as BucketConfig, s as DoctorConfig, t as ActorConfig, tt as SnapshotBucket, u as GeneratedFile, v as Privilege, w as SourceConfig, x as ResolvedExpose, y as RealtimeConfig, z as CatalogForeignKey } from "../config-C1CYcm6o.js";
+import { a as JsonSchemaGeneratorOptions, c as DEFAULT_CLAIMS, i as valibot, l as tenantClaimPaths, n as zod, o as buildJsonSchema, r as ValibotGeneratorOptions, s as jsonSchema, t as ZodGeneratorOptions } from "../index-Cf-D2jk1.js";
+export { type ActorConfig, type BetterSupabaseConfig, type BucketConfig, CONFIG_SCHEMA_URL, type Casing, type Catalog, type CatalogCheck, type CatalogColumn, type CatalogColumnGrant, type CatalogEnum, type CatalogForeignKey, type CatalogFunction, type CatalogFunctionArg, type CatalogGrant, type CatalogIndex, type CatalogPolicy, type CatalogTable, type CatalogTrigger, type CatalogUnique, type ClaimsConfig, type CodecsConfig, DEFAULT_CLAIMS, type DoctorConfig, type EntitlementsConfig, type ExposeConfig, type ExtrasFunction, type ExtrasHook, type ExtrasHookFunction, type ExtrasTable, type ForeignKeyAction, type GeneratedFile, type Generator, type GeneratorInput, type GeneratorMetadata, type JsonSchemaGeneratorOptions, type JsonSchemaSource, type JsonTypeConfig, type OpenApiConfig, type PermdockPathsConfig, type PluginFlagsConfig, type Privilege, type RealtimeConfig, type ResolvedConfig, type ResolvedExpose, type SeedConfig, type Snapshot, type SnapshotBucket, type SnapshotExtras, type SoftDeleteConfig, type SourceConfig, type SqlConfig, type TableConfig, type TenantConfig, type TimestampsConfig, type ValibotGeneratorOptions, type VectorDistance, type VectorSearchConfig, type ZodGeneratorOptions, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, tenantClaimPaths, valibot, zod };

package/dist/config/index.js

@@ -1,3 +1,5 @@
-import { n as jsonSchema, t as buildJsonSchema } from "../json-schema-BbwO2mZg.js";
-import { a as zod, i as resolveJsonSchema, n as defineConfig, o as valibot, r as resolveConfig, t as CONFIG_SCHEMA_URL } from "../config-D-aR2ZoN.js";
-export { CONFIG_SCHEMA_URL, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, valibot, zod };
+import { i as tenantClaimPaths, t as DEFAULT_CLAIMS } from "../claims-CoTobNC-.js";
+import { i as resolveJsonSchema, n as defineConfig, r as resolveConfig, t as CONFIG_SCHEMA_URL } from "../config-Be4GwsqI.js";
+import { n as jsonSchema, t as buildJsonSchema } from "../json-schema--aOXAGfU.js";
+import { n as valibot, t as zod } from "../config-DOsGYSiT.js";
+export { CONFIG_SCHEMA_URL, DEFAULT_CLAIMS, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, tenantClaimPaths, valibot, zod };

package/dist/config-Be4GwsqI.js

@@ -0,0 +1,129 @@
+import { t as DEFAULT_CLAIMS } from "./claims-CoTobNC-.js";
+//#region src/config/config.ts
+/** The JSON Schema document for a `json[...].schema` entry. */
+function resolveJsonSchema(source) {
+	const standard = source["~standard"];
+	if (standard === void 0) return source;
+	const jsonSchema = standard.jsonSchema;
+	if (typeof jsonSchema?.input !== "function") throw new TypeError("json[...].schema: this Standard Schema library does not implement Standard JSON Schema; pass a JSON Schema object instead");
+	return jsonSchema.input({ target: "draft-2020-12" });
+}
+function entitlementsOf(config = {}) {
+	const customer = config.customer ?? "organizations.stripe_customer_id";
+	const dot = customer.lastIndexOf(".");
+	if (dot <= 0) throw new TypeError(`entitlements.customer must be "table.column", got "${customer}"`);
+	return {
+		table: customer.slice(0, dot),
+		column: customer.slice(dot + 1),
+		key: config.key ?? "id",
+		permdock: config.permdock === false ? false : { scope: config.permdock?.scope ?? "organization" }
+	};
+}
+function vectorSearchOf(config = {}) {
+	return Object.entries(config).map(([table, entry]) => typeof entry === "string" ? {
+		table,
+		column: entry,
+		distance: "cosine"
+	} : {
+		table,
+		column: entry.column,
+		distance: entry.distance ?? "cosine"
+	});
+}
+const CONFIG_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/config-v1.json";
+/** Identity helper that types `better-supabase.config.ts`. */
+function defineConfig(config) {
+	return config;
+}
+function pick(value, defaults) {
+	if (value === void 0 || value === false) return void 0;
+	if (value === true) return defaults;
+	return {
+		...defaults,
+		...value
+	};
+}
+function resolveExpose(entry) {
+	if (Array.isArray(entry)) return {
+		anon: [],
+		authenticated: entry
+	};
+	const roles = entry;
+	return {
+		anon: roles.anon ?? [],
+		authenticated: roles.authenticated ?? []
+	};
+}
+/** Applies defaults. Paths stay relative to `root`. */
+function resolveConfig(config, root) {
+	const output = config.output ?? "src/lib/supabase/generated.ts";
+	return {
+		root,
+		source: config.source ?? {},
+		schemas: config.schemas ?? ["public"],
+		casing: config.casing ?? "snake",
+		tables: config.tables ?? {},
+		output,
+		databaseTypesOutput: output.replace(/[^/]+$/, "database.types.ts"),
+		postgrestVersion: config.postgrestVersion ?? "13",
+		json: config.json ?? {},
+		codecs: {
+			timestamptz: config.codecs?.timestamptz ?? "string",
+			int8: config.codecs?.int8 ?? "number",
+			numeric: config.codecs?.numeric ?? "number"
+		},
+		sensitive: config.sensitive ?? [],
+		storagePaths: config.storagePaths ?? {},
+		expose: Object.fromEntries(Object.entries(config.expose ?? {}).map(([table, entry]) => [table, resolveExpose(entry)])),
+		readSets: config.readSets ?? [],
+		generators: config.generators ?? [],
+		plugins: {
+			timestamps: pick(config.plugins?.timestamps, {
+				createdAt: "created_at",
+				updatedAt: "updated_at"
+			}),
+			softDelete: pick(config.plugins?.softDelete, { column: "deleted_at" }),
+			tenant: pick(config.plugins?.tenant, { column: "organization_id" }),
+			actor: pick(config.plugins?.actor, {
+				createdBy: "created_by",
+				updatedBy: "updated_by"
+			})
+		},
+		claims: {
+			...DEFAULT_CLAIMS,
+			...config.claims
+		},
+		buckets: config.buckets ?? {},
+		topics: config.topics ?? {},
+		realtime: { tables: config.realtime?.tables ?? [] },
+		entitlements: entitlementsOf(config.entitlements),
+		permdock: {
+			manifest: config.permdock?.manifest ?? "permdock.manifest.json",
+			catalog: config.permdock?.catalog ?? "permissions.catalog.json"
+		},
+		vectorSearch: vectorSearchOf(config.vectorSearch),
+		sql: {
+			dir: config.sql?.dir ?? "supabase/schemas",
+			prefix: config.sql?.prefix ?? "900_better_supabase",
+			testsDir: config.sql?.testsDir ?? "supabase/tests",
+			kit: config.sql?.kit ?? []
+		},
+		seed: {
+			entry: config.seed?.entry ?? "supabase/seed.ts",
+			output: config.seed?.output ?? "supabase/seeds/000_better_supabase.sql"
+		},
+		openapi: {
+			entry: config.openapi?.entry ?? "src/lib/openapi.ts",
+			output: config.openapi?.output ?? "openapi.json"
+		},
+		doctor: {
+			ignore: config.doctor?.ignore ?? [],
+			strict: config.doctor?.strict ?? false,
+			sources: config.doctor?.sources ?? ["src/**/*.{ts,tsx}"],
+			policyHelperLimit: config.doctor?.policyHelperLimit ?? 5,
+			...config.doctor?.claimsLimit === void 0 ? {} : { claimsLimit: config.doctor.claimsLimit }
+		}
+	};
+}
+//#endregion
+export { resolveJsonSchema as i, defineConfig as n, resolveConfig as r, CONFIG_SCHEMA_URL as t };

package/dist/{index-BD6wKthp.d.ts → config-C1CYcm6o.d.ts}

@@ -1,6 +1,7 @@
-import { E as SchemaMeta, i as Casing } from "./types-C2fslP1z.js";
-import { GeneratorMetadata, Queryable } from "@supabase/postgrest-typegen";
-//#region src/cli/introspect/types.d.ts
+/// <reference lib="esnext.temporal" />
+import { A as SchemaMeta, a as Casing, b as PermdockBucketPolicy, i as BucketPolicyName } from "./types-DONv9SHN.js";
+import { GeneratorMetadata } from "@supabase/postgrest-typegen";
+//#region src/config/snapshot.d.ts
 /**
  * What `better-supabase introspect` reads from Postgres. `generator` is the
  * `@supabase/postgrest-typegen` contract (the same metadata behind
@@ -57,6 +58,8 @@ interface ExtrasHookFunction extends ExtrasFunction {
   readonly publicExecute: boolean;
   /** Of the same roles, those with `usage` on its schema. */
   readonly schemaUsage: readonly string[];
+  /** The function body (`pg_proc.prosrc`). Absent in snapshots that predate it. */
+  readonly source?: string;
 }
 /** A function as doctor needs it for RLS checks, in any schema. */
 interface ExtrasFunction {
@@ -70,6 +73,8 @@ interface ExtrasFunction {
   readonly securityDefiner: boolean;
   /** `set` options, e.g. `{ statement_timeout: '5s' }`. */
   readonly settings: Readonly<Record<string, string>>;
+  /** Which of `anon` and `authenticated` may execute it. Absent in older snapshots. */
+  readonly execute?: readonly string[];
 }
 interface ExtrasTable {
   /** Table oid, matching `GeneratorMetadata.tables[].id`. */
@@ -89,6 +94,8 @@ interface ExtrasTable {
   readonly policies: readonly CatalogPolicy[];
   readonly triggers: readonly CatalogTrigger[];
   readonly grants: readonly CatalogGrant[];
+  /** Absent in snapshots taken before column grants were introspected. */
+  readonly columnGrants?: readonly CatalogColumnGrant[];
   /** Postgres estimates at least `LARGE_TABLE_ROWS` rows; the `unbounded-read` lint reads it. */
   readonly large?: true;
 }
@@ -107,6 +114,10 @@ interface CatalogIndex {
   readonly unique: boolean;
   readonly primary: boolean;
   readonly partial: boolean;
+  /** Access method (`btree`, `gin`, `gist`, ...). Absent in older snapshots. */
+  readonly method?: string;
+  /** The `where` of a partial index, as Postgres prints it. Absent in older snapshots. */
+  readonly predicate?: string | null;
 }
 interface CatalogPolicy {
   readonly name: string;
@@ -132,6 +143,12 @@ interface CatalogGrant {
   readonly role: string;
   readonly privileges: readonly string[];
 }
+/** A column-level `insert` or `update` grant to `anon` or `authenticated`. */
+interface CatalogColumnGrant {
+  readonly column: string;
+  readonly role: string;
+  readonly privileges: readonly string[];
+}
 interface SnapshotBucket {
   readonly id: string;
   readonly public: boolean;
@@ -173,6 +190,8 @@ interface CatalogTable {
   readonly policies: readonly CatalogPolicy[];
   readonly triggers: readonly CatalogTrigger[];
   readonly grants: readonly CatalogGrant[];
+  /** Absent in snapshots taken before column grants were introspected. */
+  readonly columnGrants?: readonly CatalogColumnGrant[];
 }
 interface CatalogColumn {
   readonly name: string;
@@ -235,49 +254,7 @@ interface CatalogFunctionArg {
   readonly hasDefault: boolean;
 }
 //#endregion
-//#region src/generators/shared.d.ts
-/** What field planning reads: the metadata and the typed-jsonb config. */
-interface SchemaSource {
-  readonly meta: SchemaMeta;
-  readonly config: {
-    readonly json: Readonly<Record<string, unknown>>;
-  };
-}
-//#endregion
-//#region src/generators/json-schema.d.ts
-interface JsonSchemaGeneratorOptions {
-  /** Output path relative to the project root. Defaults to `<output>.schema.json`. */
-  readonly output?: string;
-  /** `$id` of the document. */
-  readonly id?: string;
-}
-type JsonSchema = Record<string, unknown>;
-/** JSON Schema (2020-12) `$defs` for every table: `customersRow`, `customersInsert`, ... */
-declare function buildJsonSchema(input: SchemaSource, id?: string): JsonSchema;
-/** Writes the JSON Schema document; `createOpenApi` reuses the same `$defs`. */
-declare function jsonSchema(options?: JsonSchemaGeneratorOptions): Generator;
-//#endregion
-//#region src/generators/valibot.d.ts
-interface ValibotGeneratorOptions {
-  /** Output path relative to the project root. Defaults to `<output>.valibot.ts`. */
-  readonly output?: string;
-  /** Schemas for typed jsonb columns: `{ 'customers.metadata': './schemas.ts#metadata' }`. */
-  readonly json?: Readonly<Record<string, string>>;
-}
-/** Valibot schemas for every table's Row, Insert and Update shape. */
-declare function valibot(options?: ValibotGeneratorOptions): Generator;
-//#endregion
-//#region src/generators/zod.d.ts
-interface ZodGeneratorOptions {
-  /** Output path relative to the project root. Defaults to `<output>.zod.ts`. */
-  readonly output?: string;
-  /** Schemas for typed jsonb columns: `{ 'customers.metadata': './schemas.ts#metadata' }`. */
-  readonly json?: Readonly<Record<string, string>>;
-}
-/** Zod 4 schemas for every table's Row, Insert and Update shape. */
-declare function zod(options?: ZodGeneratorOptions): Generator;
-//#endregion
-//#region src/config/index.d.ts
+//#region src/config/config.d.ts
 /**
  * Where codegen reads the database from. Without any of these, `$DATABASE_URL`
  * and then the local stack (`supabase start`) are used.
@@ -337,8 +314,18 @@ interface SoftDeleteConfig {
 }
 interface TenantConfig {
   readonly column?: string;
-  /** JWT claim holding the tenant id. */
-  readonly claim?: string;
+}
+/**
+ * Claim names shared by the SQL kit, codegen and the runtime defaults. They
+ * follow PermDock's claim contract.
+ */
+interface ClaimsConfig {
+  /** Top-level claim holding the active tenant id. Defaults to `tenant_id`. */
+  readonly tenant?: string;
+  /** `scope` of the tenant entries `membership_claims()` writes. Defaults to `tenant`. */
+  readonly scope?: string;
+  /** Claim holding plan features per tenant (`{ [tenantId]: string[] }`). Defaults to `features`. */
+  readonly features?: string;
 }
 interface ActorConfig {
   readonly createdBy?: string;
@@ -355,8 +342,8 @@ interface BucketConfig {
   readonly public?: boolean;
   /** Path template with `{placeholders}`, e.g. `{orgId}/{customerId}/logo.webp`. */
   readonly path: string;
-  /** Generated storage policy. */
-  readonly policy?: "tenant" | "owner" | "public" | "none";
+  /** Generated storage policy, or a PermDock policy (`{ permdock, scope }`). */
+  readonly policy?: BucketPolicyName | PermdockBucketPolicy;
   readonly fileSizeLimit?: string;
   readonly allowedMimeTypes?: readonly string[];
 }
@@ -397,6 +384,13 @@ interface DoctorConfig {
    * asks for an inlinable `language sql stable` function. Defaults to 5.
    */
   readonly policyHelperLimit?: number;
+  /**
+   * The BS405 limit in bytes. With a `permdock.config.ts` it is PermDock's
+   * budget for `memberships` plus `attrs` (default 1024, matching
+   * `supabase.hook.budget`) and the whole token keeps 2048. Without one it
+   * limits the whole token's claims (default 2048).
+   */
+  readonly claimsLimit?: number;
 }
 /**
  * Runtime types for columns whose JSON form loses information. Defaults
@@ -404,8 +398,11 @@ interface DoctorConfig {
  * `numeric` as numbers.
  */
 interface CodecsConfig {
-  /** `'date'` decodes `timestamptz`/`timestamp` columns to `Date`. */
-  readonly timestamptz?: "string" | "date";
+  /**
+   * `'instant'` decodes `timestamptz` columns to `Temporal.Instant` and
+   * `timestamp` columns to `Temporal.PlainDateTime`.
+   */
+  readonly timestamptz?: "string" | "instant";
   /** `'bigint'` or `'string'` read `int8` exactly (above 2^53). */
   readonly int8?: "number" | "string" | "bigint";
   /** `'string'` reads `numeric` exactly. */
@@ -456,6 +453,22 @@ interface EntitlementsConfig {
   readonly customer?: string;
   /** The tenant id column of that table. Defaults to `id`. */
   readonly key?: string;
+  /**
+   * With a PermDock manifest, `has_entitlement` and `feature_claims` read
+   * PermDock's memberships (`member_<scope>_ids()` and
+   * `member_<scope>_ids_for(user)`) instead of `better_supabase.memberships`.
+   * `scope` is the PermDock scope tenants are (default `organization`);
+   * `false` keeps the kit's memberships table.
+   */
+  readonly permdock?: false | {
+    readonly scope?: string;
+  };
+}
+interface PermdockPathsConfig {
+  /** What `permdock supabase inspect --out` writes. Defaults to `permdock.manifest.json`. */
+  readonly manifest?: string;
+  /** What `permdock catalog` writes. Defaults to `permissions.catalog.json`. */
+  readonly catalog?: string;
 }
 /** pgvector distance: `<=>` (cosine), `<->` (l2) or `<#>` (negative inner product). */
 type VectorDistance = "cosine" | "l2" | "inner_product";
@@ -530,11 +543,14 @@ interface BetterSupabaseConfig {
   readonly generators?: readonly Generator[];
   /** Enables plugin flags in the generated metadata. */
   readonly plugins?: PluginFlagsConfig;
+  readonly claims?: ClaimsConfig;
   readonly buckets?: Readonly<Record<string, BucketConfig>>;
   /** Realtime topic templates: `{ notifications: 'org:{orgId}:notifications' }`. */
   readonly topics?: Readonly<Record<string, string>>;
   readonly realtime?: RealtimeConfig;
   readonly entitlements?: EntitlementsConfig;
+  /** Where PermDock's JSON outputs are, for doctor, `gen` and the SQL kit. */
+  readonly permdock?: PermdockPathsConfig;
   /**
    * Embedding columns, keyed by `table` or `schema.table`. The
    * `vector-search` SQL kit module writes `search_<table>(query, k)` for each,
@@ -570,12 +586,17 @@ interface ResolvedConfig {
     readonly tenant: Required<TenantConfig> | undefined;
     readonly actor: Required<ActorConfig> | undefined;
   };
+  readonly claims: Required<ClaimsConfig>;
   readonly buckets: Readonly<Record<string, BucketConfig>>;
   readonly entitlements: {
     readonly table: string;
     readonly column: string;
     readonly key: string;
+    readonly permdock: false | {
+      readonly scope: string;
+    };
   };
+  readonly permdock: Required<PermdockPathsConfig>;
   readonly vectorSearch: readonly {
     readonly table: string;
     readonly column: string;
@@ -586,7 +607,7 @@ interface ResolvedConfig {
   readonly sql: Required<SqlConfig>;
   readonly seed: Required<SeedConfig>;
   readonly openapi: Required<OpenApiConfig>;
-  readonly doctor: Required<DoctorConfig>;
+  readonly doctor: Required<Omit<DoctorConfig, "claimsLimit">> & Pick<DoctorConfig, "claimsLimit">;
 }
 declare const CONFIG_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/config-v1.json";
 /** Identity helper that types `better-supabase.config.ts`. */
@@ -594,4 +615,4 @@ declare function defineConfig(config: BetterSupabaseConfig): BetterSupabaseConfi
 /** Applies defaults. Paths stay relative to `root`. */
 declare function resolveConfig(config: BetterSupabaseConfig, root: string): ResolvedConfig;
 //#endregion
-export { ExtrasHook as $, resolveConfig as A, CatalogCheck as B, SqlConfig as C, VectorDistance as D, TimestampsConfig as E, valibot as F, CatalogFunctionArg as G, CatalogEnum as H, JsonSchemaGeneratorOptions as I, CatalogPolicy as J, CatalogGrant as K, buildJsonSchema as L, ZodGeneratorOptions as M, zod as N, VectorSearchConfig as O, ValibotGeneratorOptions as P, ExtrasFunction as Q, jsonSchema as R, SourceConfig as S, TenantConfig as T, CatalogForeignKey as U, CatalogColumn as V, CatalogFunction as W, CatalogTrigger as X, CatalogTable as Y, CatalogUnique as Z, RealtimeConfig as _, CodecsConfig as a, SnapshotExtras as at, SeedConfig as b, ExposeConfig as c, GeneratorInput as d, ExtrasHookFunction as et, JsonSchemaSource as f, Privilege as g, PluginFlagsConfig as h, CONFIG_SCHEMA_URL as i, SnapshotBucket as it, resolveJsonSchema as j, defineConfig as k, GeneratedFile as l, OpenApiConfig as m, BetterSupabaseConfig as n, ForeignKeyAction as nt, DoctorConfig as o, GeneratorMetadata as ot, JsonTypeConfig as p, CatalogIndex as q, BucketConfig as r, Snapshot as rt, EntitlementsConfig as s, Queryable as st, ActorConfig as t, ExtrasTable as tt, Generator as u, ResolvedConfig as v, TableConfig as w, SoftDeleteConfig as x, ResolvedExpose as y, Catalog as z };
+export { GeneratorMetadata as $, VectorSearchConfig as A, CatalogFunction as B, SoftDeleteConfig as C, TenantConfig as D, TableConfig as E, CatalogCheck as F, CatalogTable as G, CatalogGrant as H, CatalogColumn as I, ExtrasFunction as J, CatalogTrigger as K, CatalogColumnGrant as L, resolveConfig as M, resolveJsonSchema as N, TimestampsConfig as O, Catalog as P, ForeignKeyAction as Q, CatalogEnum as R, SeedConfig as S, SqlConfig as T, CatalogIndex as U, CatalogFunctionArg as V, CatalogPolicy as W, ExtrasHookFunction as X, ExtrasHook as Y, ExtrasTable as Z, PluginFlagsConfig as _, ClaimsConfig as a, ResolvedConfig as b, EntitlementsConfig as c, Generator as d, Snapshot as et, GeneratorInput as f, PermdockPathsConfig as g, OpenApiConfig as h, CONFIG_SCHEMA_URL as i, defineConfig as j, VectorDistance as k, ExposeConfig as l, JsonTypeConfig as m, BetterSupabaseConfig as n, SnapshotExtras as nt, CodecsConfig as o, JsonSchemaSource as p, CatalogUnique as q, BucketConfig as r, DoctorConfig as s, ActorConfig as t, SnapshotBucket as tt, GeneratedFile as u, Privilege as v, SourceConfig as w, ResolvedExpose as x, RealtimeConfig as y, CatalogForeignKey as z };