better-supabase 0.2.0 → 0.3.0

package/README.md

@@ -4,7 +4,7 @@
 
 [![npm](https://img.shields.io/npm/v/better-supabase)](https://www.npmjs.com/package/better-supabase)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/ScaleDockHQ/better-supabase/blob/main/LICENSE)
-![TypeScript](https://img.shields.io/badge/TypeScript-5.9%20%7C%206%20%7C%207-3178c6.svg)
+![TypeScript](https://img.shields.io/badge/TypeScript-6%20%7C%207-3178c6.svg)
 
 `better-supabase gen` extends `supabase gen types` with relation cardinality, unique keys, CHECK unions and typed jsonb. The generated `schema` gives every table a typed repository that compiles to one PostgREST request, returns a `Result` instead of throwing, and runs as the caller so RLS always applies.
 
@@ -12,13 +12,15 @@
 
 ```bash
 pnpm add better-supabase @supabase/supabase-js
-pnpm add -D pg
+pnpm add -D @better-supabase/cli pg
 ```
 
-ESM only. Node 24 or later for the CLI; the runtime entries run on every WinterTC runtime (Node, Deno, Bun, Workers, Supabase Edge Functions). TypeScript 5.9, 6 and 7 are tested.
+ESM only. The CLI ships as [`@better-supabase/cli`](https://www.npmjs.com/package/@better-supabase/cli), always at the same version as `better-supabase`, and needs Node 24 or later; the runtime entries run on every WinterTC runtime (Node, Deno, Bun, Workers, Supabase Edge Functions). TypeScript 6 and 7 are tested.
 
 ## Quick start
 
+Or start with `npx @better-supabase/cli init`, which detects your frameworks and prints the install command.
+
 ```bash
 supabase start
 pnpm better-supabase init   # config, src/lib/supabase.ts and framework glue
@@ -26,20 +28,20 @@ pnpm better-supabase gen    # database.types.ts and generated.ts
 ```
 
 ```ts
-import { createClient } from '@supabase/supabase-js';
-import { defineSupabase } from 'better-supabase';
+import { createClient } from "@supabase/supabase-js";
+import { defineSupabase } from "better-supabase";
 
-import { schema } from './lib/supabase/generated.ts';
+import { schema } from "./lib/supabase/generated.ts";
 
 export const sb = defineSupabase(schema);
 
 const db = sb.connect(createClient(url, publishableKey));
 
 const result = await db.customers.findMany({
-  select: ['id', 'name'],
-  where: { status: 'active', notes: { some: { kind: 'call' } } },
-  include: { organization: { select: ['name'] } },
-  orderBy: { name: 'asc' },
+  select: ["id", "name"],
+  where: { status: "active", notes: { some: { kind: "call" } } },
+  include: { organization: { select: ["name"] } },
+  orderBy: { name: "asc" },
   limit: 20,
 });
 if (!result.ok) return result; // DbError: kind, message, status, code
@@ -47,27 +49,28 @@ if (!result.ok) return result; // DbError: kind, message, status, code
 
 ## Subpaths
 
-| Import | What it gives you |
-| --- | --- |
-| `better-supabase` | `defineSupabase`, repositories, `Result`, `DbError`, `SPEC_PINS` |
-| `better-supabase/config` | `defineConfig` and generators for `better-supabase.config.ts` |
-| `better-supabase/client` | Browser repositories that follow the session |
-| `better-supabase/react` | Provider, typed hooks and the server session |
-| `better-supabase/query` | TanStack Query options with table-based invalidation |
-| `better-supabase/server` | Repositories bound to the caller, admin and acting-as identities |
-| `better-supabase/postgres` | The same repositories over direct Postgres |
-| `better-supabase/ssr` | The `@supabase/ssr` cookie format for any framework |
-| `better-supabase/next`, `/next/image` | Proxy, Server Components, route handlers, server actions, Storage images |
-| `better-supabase/hono`, `/orpc`, `/edge` | Framework adapters |
-| `better-supabase/mcp` | MCP servers whose tools run as the signed-in user |
-| `better-supabase/jobs` | Supabase Queues jobs, idempotency keys and a webhook inbox |
-| `better-supabase/list` | Search, facets, sorting and pagination from one definition |
-| `better-supabase/storage`, `/realtime` | Typed bucket paths and broadcast topics |
-| `better-supabase/env` | Validated Supabase settings |
-| `better-supabase/events`, `/webhooks`, `/openapi`, `/otel` | CloudEvents, Standard Webhooks, OpenAPI 3.1 and OpenTelemetry |
-| `better-supabase/plugins/*` | Timestamps, soft delete, tenant, actor, validation and runtime rules |
-| `better-supabase/lint` | Editor rules for unbounded reads and unscoped deletes |
-| `better-supabase/testing` | `asUser`, `localAuth`, typed seeds and conformance kits |
+| Import                                                     | What it gives you                                                        |
+| ---------------------------------------------------------- | ------------------------------------------------------------------------ |
+| `better-supabase`                                          | `defineSupabase`, repositories, `Result`, `DbError`, `SPEC_PINS`         |
+| `better-supabase/config`                                   | `defineConfig` and generators for `better-supabase.config.ts`            |
+| `better-supabase/client`                                   | Browser repositories that follow the session                             |
+| `better-supabase/react`                                    | Provider, typed hooks and the server session                             |
+| `better-supabase/query`                                    | TanStack Query options with table-based invalidation                     |
+| `better-supabase/server`                                   | Repositories bound to the caller, admin and acting-as identities         |
+| `better-supabase/postgres`                                 | The same repositories over direct Postgres                               |
+| `better-supabase/ssr`                                      | The `@supabase/ssr` cookie format for any framework                      |
+| `better-supabase/next`, `/next/image`                      | Proxy, Server Components, route handlers, server actions, Storage images |
+| `better-supabase/hono`, `/orpc`, `/edge`                   | Framework adapters                                                       |
+| `better-supabase/mcp`                                      | MCP servers whose tools run as the signed-in user                        |
+| `better-supabase/jobs`                                     | Supabase Queues jobs, idempotency keys and a webhook inbox               |
+| `better-supabase/list`                                     | Search, facets, sorting and pagination from one definition               |
+| `better-supabase/storage`, `/realtime`                     | Typed bucket paths and broadcast topics                                  |
+| `better-supabase/env`                                      | Validated Supabase settings                                              |
+| `better-supabase/events`, `/webhooks`, `/openapi`, `/otel` | CloudEvents, Standard Webhooks, OpenAPI 3.1 and OpenTelemetry            |
+| `better-supabase/plugins/*`                                | Timestamps, soft delete, tenant, actor, validation and runtime rules     |
+| `better-supabase/sql`                                      | The SQL kit modules and read-set compiler behind `better-supabase sql`   |
+| `better-supabase/lint`                                     | Editor rules for unbounded reads and unscoped deletes                    |
+| `better-supabase/testing`                                  | `asUser`, `localAuth`, typed seeds and conformance kits                  |
 
 ## For AI agents
 

package/dist/base64-CQeB1eSf.js

@@ -0,0 +1,42 @@
+//#region src/core/base64.ts
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/** Standard base64 (RFC 4648 section 4) of `input`, with padding. */
+function toBase64(input) {
+	const bytes = typeof input === "string" ? encoder.encode(input) : input;
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary);
+}
+/** Bytes of standard or URL-safe base64, padded or not. Throws on invalid input. */
+function fromBase64(text) {
+	const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
+	const binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+	return bytes;
+}
+/** URL-safe base64 (RFC 4648 section 5) of `input`, without padding. */
+function toBase64Url(input) {
+	return toBase64(input).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+/** UTF-8 text of base64 or base64url. Throws on invalid input. */
+function base64ToText(text) {
+	return decoder.decode(fromBase64(text));
+}
+/**
+* The payload of a JWT, decoded without verifying the signature. Only for
+* reading claims such as `exp` from a token that is verified elsewhere.
+*/
+function decodeJwtPayload(token) {
+	const part = token.split(".")[1];
+	if (!part) return void 0;
+	try {
+		const parsed = JSON.parse(base64ToText(part));
+		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { toBase64Url as a, toBase64 as i, decodeJwtPayload as n, fromBase64 as r, base64ToText as t };

package/dist/client/index.d.ts

@@ -1,2 +1,2 @@
-import { a as BrowserOptions, i as BrowserAuth, n as AuthUser, o as createBrowser, r as BetterBrowser, t as AuthSnapshot } from "../index-D4v7sncu.js";
+import { a as BrowserOptions, i as BrowserAuth, n as AuthUser, o as createBrowser, r as BetterBrowser, t as AuthSnapshot } from "../index-UJ-LUxtI.js";
 export { AuthSnapshot, AuthUser, BetterBrowser, BrowserAuth, BrowserOptions, createBrowser };

package/dist/client/index.js

@@ -1,5 +1,6 @@
-import { a as parseEnv, n as EnvValidationError } from "../env-BEToab0I.js";
-import { t as createQueries } from "../query-ChvDbsDE.js";
+import { n as decodeJwtPayload } from "../base64-CQeB1eSf.js";
+import { EnvValidationError, parseEnv } from "../env/index.js";
+import { t as createQueries } from "../query-BdKLTPlj.js";
 import { createBrowserClient } from "@supabase/ssr";
 import { createClient } from "@supabase/supabase-js";
 //#region src/client/index.ts
@@ -13,20 +14,9 @@ const SIGNED_OUT = {
 	user: null,
 	claims: null
 };
-function decodeClaims(token) {
-	const part = token.split(".")[1];
-	if (!part) return {};
-	try {
-		const bytes = Uint8Array.from(atob(part.replace(/-/g, "+").replace(/_/g, "/")), (char) => char.charCodeAt(0));
-		const parsed = JSON.parse(new TextDecoder().decode(bytes));
-		return typeof parsed === "object" && parsed !== null ? parsed : {};
-	} catch {
-		return {};
-	}
-}
 function snapshotOf(session) {
 	if (!session) return SIGNED_OUT;
-	const claims = decodeClaims(session.access_token);
+	const claims = decodeJwtPayload(session.access_token) ?? {};
 	const role = typeof claims["role"] === "string" ? claims["role"] : session.user.role;
 	return {
 		status: "signed-in",

package/dist/{compiler-CZ9nIuqy.d.ts → compiler-2zqGzxVZ.d.ts}

@@ -1,5 +1,5 @@
-import { g as Operation } from "./executor-CGdNQ27g.js";
-import { i as PostgrestPlan } from "./postgrest-cAEQ_IQN.js";
+import { g as Operation } from "./executor-DynmIWhq.js";
+import { i as PostgrestPlan } from "./postgrest-DmBlevh-.js";
 //#region src/core/compiler.d.ts
 /**
  * Turns an IR operation into something a backend runs. An `Executor` for a

package/dist/config/index.d.ts

@@ -1,3 +1,4 @@
-import { A as defineConfig, C as SourceConfig, D as TimestampsConfig, E as TenantConfig, F as ValibotGeneratorOptions, I as valibot, L as JsonSchemaGeneratorOptions, M as resolveJsonSchema, N as ZodGeneratorOptions, O as VectorDistance, P as zod, R as buildJsonSchema, S as SoftDeleteConfig, T as TableConfig, _ as Privilege, a as ClaimsConfig, b as ResolvedExpose, c as EntitlementsConfig, d as Generator, f as GeneratorInput, g as PluginFlagsConfig, h as OpenApiConfig, i as CONFIG_SCHEMA_URL, j as resolveConfig, k as VectorSearchConfig, l as ExposeConfig, m as JsonTypeConfig, n as BetterSupabaseConfig, o as CodecsConfig, p as JsonSchemaSource, r as BucketConfig, s as DoctorConfig, t as ActorConfig, u as GeneratedFile, v as RealtimeConfig, w as SqlConfig, x as SeedConfig, y as ResolvedConfig, z as jsonSchema } from "../index-DOsjFvMf.js";
-import { a as Casing } from "../types-C83v5SQz.js";
-export { ActorConfig, BetterSupabaseConfig, BucketConfig, CONFIG_SCHEMA_URL, type Casing, ClaimsConfig, CodecsConfig, DoctorConfig, EntitlementsConfig, ExposeConfig, GeneratedFile, Generator, GeneratorInput, type JsonSchemaGeneratorOptions, JsonSchemaSource, JsonTypeConfig, OpenApiConfig, PluginFlagsConfig, Privilege, RealtimeConfig, ResolvedConfig, ResolvedExpose, SeedConfig, SoftDeleteConfig, SourceConfig, SqlConfig, TableConfig, TenantConfig, TimestampsConfig, type ValibotGeneratorOptions, VectorDistance, VectorSearchConfig, type ZodGeneratorOptions, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, valibot, zod };
+import { a as Casing } from "../types-DONv9SHN.js";
+import { $ as GeneratorMetadata, A as VectorSearchConfig, B as CatalogFunction, C as SoftDeleteConfig, D as TenantConfig, E as TableConfig, F as CatalogCheck, G as CatalogTable, H as CatalogGrant, I as CatalogColumn, J as ExtrasFunction, K as CatalogTrigger, L as CatalogColumnGrant, M as resolveConfig, N as resolveJsonSchema, O as TimestampsConfig, P as Catalog, Q as ForeignKeyAction, R as CatalogEnum, S as SeedConfig, T as SqlConfig, U as CatalogIndex, V as CatalogFunctionArg, W as CatalogPolicy, X as ExtrasHookFunction, Y as ExtrasHook, Z as ExtrasTable, _ as PluginFlagsConfig, a as ClaimsConfig, b as ResolvedConfig, c as EntitlementsConfig, d as Generator, et as Snapshot, f as GeneratorInput, g as PermdockPathsConfig, h as OpenApiConfig, i as CONFIG_SCHEMA_URL, j as defineConfig, k as VectorDistance, l as ExposeConfig, m as JsonTypeConfig, n as BetterSupabaseConfig, nt as SnapshotExtras, o as CodecsConfig, p as JsonSchemaSource, q as CatalogUnique, r as BucketConfig, s as DoctorConfig, t as ActorConfig, tt as SnapshotBucket, u as GeneratedFile, v as Privilege, w as SourceConfig, x as ResolvedExpose, y as RealtimeConfig, z as CatalogForeignKey } from "../config-C1CYcm6o.js";
+import { a as JsonSchemaGeneratorOptions, c as DEFAULT_CLAIMS, i as valibot, l as tenantClaimPaths, n as zod, o as buildJsonSchema, r as ValibotGeneratorOptions, s as jsonSchema, t as ZodGeneratorOptions } from "../index-Cf-D2jk1.js";
+export { type ActorConfig, type BetterSupabaseConfig, type BucketConfig, CONFIG_SCHEMA_URL, type Casing, type Catalog, type CatalogCheck, type CatalogColumn, type CatalogColumnGrant, type CatalogEnum, type CatalogForeignKey, type CatalogFunction, type CatalogFunctionArg, type CatalogGrant, type CatalogIndex, type CatalogPolicy, type CatalogTable, type CatalogTrigger, type CatalogUnique, type ClaimsConfig, type CodecsConfig, DEFAULT_CLAIMS, type DoctorConfig, type EntitlementsConfig, type ExposeConfig, type ExtrasFunction, type ExtrasHook, type ExtrasHookFunction, type ExtrasTable, type ForeignKeyAction, type GeneratedFile, type Generator, type GeneratorInput, type GeneratorMetadata, type JsonSchemaGeneratorOptions, type JsonSchemaSource, type JsonTypeConfig, type OpenApiConfig, type PermdockPathsConfig, type PluginFlagsConfig, type Privilege, type RealtimeConfig, type ResolvedConfig, type ResolvedExpose, type SeedConfig, type Snapshot, type SnapshotBucket, type SnapshotExtras, type SoftDeleteConfig, type SourceConfig, type SqlConfig, type TableConfig, type TenantConfig, type TimestampsConfig, type ValibotGeneratorOptions, type VectorDistance, type VectorSearchConfig, type ZodGeneratorOptions, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, tenantClaimPaths, valibot, zod };

package/dist/config/index.js

@@ -1,3 +1,5 @@
-import { n as jsonSchema, t as buildJsonSchema } from "../json-schema-BpYqkCKf.js";
-import { a as zod, i as resolveJsonSchema, n as defineConfig, o as valibot, r as resolveConfig, t as CONFIG_SCHEMA_URL } from "../config-ClDXmVtY.js";
-export { CONFIG_SCHEMA_URL, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, valibot, zod };
+import { i as tenantClaimPaths, t as DEFAULT_CLAIMS } from "../claims-CoTobNC-.js";
+import { i as resolveJsonSchema, n as defineConfig, r as resolveConfig, t as CONFIG_SCHEMA_URL } from "../config-Be4GwsqI.js";
+import { n as jsonSchema, t as buildJsonSchema } from "../json-schema--aOXAGfU.js";
+import { n as valibot, t as zod } from "../config-DOsGYSiT.js";
+export { CONFIG_SCHEMA_URL, DEFAULT_CLAIMS, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, tenantClaimPaths, valibot, zod };

package/dist/config-Be4GwsqI.js

@@ -0,0 +1,129 @@
+import { t as DEFAULT_CLAIMS } from "./claims-CoTobNC-.js";
+//#region src/config/config.ts
+/** The JSON Schema document for a `json[...].schema` entry. */
+function resolveJsonSchema(source) {
+	const standard = source["~standard"];
+	if (standard === void 0) return source;
+	const jsonSchema = standard.jsonSchema;
+	if (typeof jsonSchema?.input !== "function") throw new TypeError("json[...].schema: this Standard Schema library does not implement Standard JSON Schema; pass a JSON Schema object instead");
+	return jsonSchema.input({ target: "draft-2020-12" });
+}
+function entitlementsOf(config = {}) {
+	const customer = config.customer ?? "organizations.stripe_customer_id";
+	const dot = customer.lastIndexOf(".");
+	if (dot <= 0) throw new TypeError(`entitlements.customer must be "table.column", got "${customer}"`);
+	return {
+		table: customer.slice(0, dot),
+		column: customer.slice(dot + 1),
+		key: config.key ?? "id",
+		permdock: config.permdock === false ? false : { scope: config.permdock?.scope ?? "organization" }
+	};
+}
+function vectorSearchOf(config = {}) {
+	return Object.entries(config).map(([table, entry]) => typeof entry === "string" ? {
+		table,
+		column: entry,
+		distance: "cosine"
+	} : {
+		table,
+		column: entry.column,
+		distance: entry.distance ?? "cosine"
+	});
+}
+const CONFIG_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/config-v1.json";
+/** Identity helper that types `better-supabase.config.ts`. */
+function defineConfig(config) {
+	return config;
+}
+function pick(value, defaults) {
+	if (value === void 0 || value === false) return void 0;
+	if (value === true) return defaults;
+	return {
+		...defaults,
+		...value
+	};
+}
+function resolveExpose(entry) {
+	if (Array.isArray(entry)) return {
+		anon: [],
+		authenticated: entry
+	};
+	const roles = entry;
+	return {
+		anon: roles.anon ?? [],
+		authenticated: roles.authenticated ?? []
+	};
+}
+/** Applies defaults. Paths stay relative to `root`. */
+function resolveConfig(config, root) {
+	const output = config.output ?? "src/lib/supabase/generated.ts";
+	return {
+		root,
+		source: config.source ?? {},
+		schemas: config.schemas ?? ["public"],
+		casing: config.casing ?? "snake",
+		tables: config.tables ?? {},
+		output,
+		databaseTypesOutput: output.replace(/[^/]+$/, "database.types.ts"),
+		postgrestVersion: config.postgrestVersion ?? "13",
+		json: config.json ?? {},
+		codecs: {
+			timestamptz: config.codecs?.timestamptz ?? "string",
+			int8: config.codecs?.int8 ?? "number",
+			numeric: config.codecs?.numeric ?? "number"
+		},
+		sensitive: config.sensitive ?? [],
+		storagePaths: config.storagePaths ?? {},
+		expose: Object.fromEntries(Object.entries(config.expose ?? {}).map(([table, entry]) => [table, resolveExpose(entry)])),
+		readSets: config.readSets ?? [],
+		generators: config.generators ?? [],
+		plugins: {
+			timestamps: pick(config.plugins?.timestamps, {
+				createdAt: "created_at",
+				updatedAt: "updated_at"
+			}),
+			softDelete: pick(config.plugins?.softDelete, { column: "deleted_at" }),
+			tenant: pick(config.plugins?.tenant, { column: "organization_id" }),
+			actor: pick(config.plugins?.actor, {
+				createdBy: "created_by",
+				updatedBy: "updated_by"
+			})
+		},
+		claims: {
+			...DEFAULT_CLAIMS,
+			...config.claims
+		},
+		buckets: config.buckets ?? {},
+		topics: config.topics ?? {},
+		realtime: { tables: config.realtime?.tables ?? [] },
+		entitlements: entitlementsOf(config.entitlements),
+		permdock: {
+			manifest: config.permdock?.manifest ?? "permdock.manifest.json",
+			catalog: config.permdock?.catalog ?? "permissions.catalog.json"
+		},
+		vectorSearch: vectorSearchOf(config.vectorSearch),
+		sql: {
+			dir: config.sql?.dir ?? "supabase/schemas",
+			prefix: config.sql?.prefix ?? "900_better_supabase",
+			testsDir: config.sql?.testsDir ?? "supabase/tests",
+			kit: config.sql?.kit ?? []
+		},
+		seed: {
+			entry: config.seed?.entry ?? "supabase/seed.ts",
+			output: config.seed?.output ?? "supabase/seeds/000_better_supabase.sql"
+		},
+		openapi: {
+			entry: config.openapi?.entry ?? "src/lib/openapi.ts",
+			output: config.openapi?.output ?? "openapi.json"
+		},
+		doctor: {
+			ignore: config.doctor?.ignore ?? [],
+			strict: config.doctor?.strict ?? false,
+			sources: config.doctor?.sources ?? ["src/**/*.{ts,tsx}"],
+			policyHelperLimit: config.doctor?.policyHelperLimit ?? 5,
+			...config.doctor?.claimsLimit === void 0 ? {} : { claimsLimit: config.doctor.claimsLimit }
+		}
+	};
+}
+//#endregion
+export { resolveJsonSchema as i, defineConfig as n, resolveConfig as r, CONFIG_SCHEMA_URL as t };

package/dist/{index-DOsjFvMf.d.ts → config-C1CYcm6o.d.ts}

@@ -1,6 +1,7 @@
-import { A as SchemaMeta, a as Casing, b as PermdockBucketPolicy, i as BucketPolicyName } from "./types-C83v5SQz.js";
-import { GeneratorMetadata, Queryable } from "@supabase/postgrest-typegen";
-//#region src/cli/introspect/types.d.ts
+/// <reference lib="esnext.temporal" />
+import { A as SchemaMeta, a as Casing, b as PermdockBucketPolicy, i as BucketPolicyName } from "./types-DONv9SHN.js";
+import { GeneratorMetadata } from "@supabase/postgrest-typegen";
+//#region src/config/snapshot.d.ts
 /**
  * What `better-supabase introspect` reads from Postgres. `generator` is the
  * `@supabase/postgrest-typegen` contract (the same metadata behind
@@ -72,6 +73,8 @@ interface ExtrasFunction {
   readonly securityDefiner: boolean;
   /** `set` options, e.g. `{ statement_timeout: '5s' }`. */
   readonly settings: Readonly<Record<string, string>>;
+  /** Which of `anon` and `authenticated` may execute it. Absent in older snapshots. */
+  readonly execute?: readonly string[];
 }
 interface ExtrasTable {
   /** Table oid, matching `GeneratorMetadata.tables[].id`. */
@@ -91,6 +94,8 @@ interface ExtrasTable {
   readonly policies: readonly CatalogPolicy[];
   readonly triggers: readonly CatalogTrigger[];
   readonly grants: readonly CatalogGrant[];
+  /** Absent in snapshots taken before column grants were introspected. */
+  readonly columnGrants?: readonly CatalogColumnGrant[];
   /** Postgres estimates at least `LARGE_TABLE_ROWS` rows; the `unbounded-read` lint reads it. */
   readonly large?: true;
 }
@@ -109,6 +114,10 @@ interface CatalogIndex {
   readonly unique: boolean;
   readonly primary: boolean;
   readonly partial: boolean;
+  /** Access method (`btree`, `gin`, `gist`, ...). Absent in older snapshots. */
+  readonly method?: string;
+  /** The `where` of a partial index, as Postgres prints it. Absent in older snapshots. */
+  readonly predicate?: string | null;
 }
 interface CatalogPolicy {
   readonly name: string;
@@ -134,6 +143,12 @@ interface CatalogGrant {
   readonly role: string;
   readonly privileges: readonly string[];
 }
+/** A column-level `insert` or `update` grant to `anon` or `authenticated`. */
+interface CatalogColumnGrant {
+  readonly column: string;
+  readonly role: string;
+  readonly privileges: readonly string[];
+}
 interface SnapshotBucket {
   readonly id: string;
   readonly public: boolean;
@@ -175,6 +190,8 @@ interface CatalogTable {
   readonly policies: readonly CatalogPolicy[];
   readonly triggers: readonly CatalogTrigger[];
   readonly grants: readonly CatalogGrant[];
+  /** Absent in snapshots taken before column grants were introspected. */
+  readonly columnGrants?: readonly CatalogColumnGrant[];
 }
 interface CatalogColumn {
   readonly name: string;
@@ -237,49 +254,7 @@ interface CatalogFunctionArg {
   readonly hasDefault: boolean;
 }
 //#endregion
-//#region src/generators/shared.d.ts
-/** What field planning reads: the metadata and the typed-jsonb config. */
-interface SchemaSource {
-  readonly meta: SchemaMeta;
-  readonly config: {
-    readonly json: Readonly<Record<string, unknown>>;
-  };
-}
-//#endregion
-//#region src/generators/json-schema.d.ts
-interface JsonSchemaGeneratorOptions {
-  /** Output path relative to the project root. Defaults to `<output>.schema.json`. */
-  readonly output?: string;
-  /** `$id` of the document. */
-  readonly id?: string;
-}
-type JsonSchema = Record<string, unknown>;
-/** JSON Schema (2020-12) `$defs` for every table: `customersRow`, `customersInsert`, ... */
-declare function buildJsonSchema(input: SchemaSource, id?: string): JsonSchema;
-/** Writes the JSON Schema document; `createOpenApi` reuses the same `$defs`. */
-declare function jsonSchema(options?: JsonSchemaGeneratorOptions): Generator;
-//#endregion
-//#region src/generators/valibot.d.ts
-interface ValibotGeneratorOptions {
-  /** Output path relative to the project root. Defaults to `<output>.valibot.ts`. */
-  readonly output?: string;
-  /** Schemas for typed jsonb columns: `{ 'customers.metadata': './schemas.ts#metadata' }`. */
-  readonly json?: Readonly<Record<string, string>>;
-}
-/** Valibot schemas for every table's Row, Insert and Update shape. */
-declare function valibot(options?: ValibotGeneratorOptions): Generator;
-//#endregion
-//#region src/generators/zod.d.ts
-interface ZodGeneratorOptions {
-  /** Output path relative to the project root. Defaults to `<output>.zod.ts`. */
-  readonly output?: string;
-  /** Schemas for typed jsonb columns: `{ 'customers.metadata': './schemas.ts#metadata' }`. */
-  readonly json?: Readonly<Record<string, string>>;
-}
-/** Zod 4 schemas for every table's Row, Insert and Update shape. */
-declare function zod(options?: ZodGeneratorOptions): Generator;
-//#endregion
-//#region src/config/index.d.ts
+//#region src/config/config.d.ts
 /**
  * Where codegen reads the database from. Without any of these, `$DATABASE_URL`
  * and then the local stack (`supabase start`) are used.
@@ -423,8 +398,11 @@ interface DoctorConfig {
  * `numeric` as numbers.
  */
 interface CodecsConfig {
-  /** `'date'` decodes `timestamptz`/`timestamp` columns to `Date`. */
-  readonly timestamptz?: "string" | "date";
+  /**
+   * `'instant'` decodes `timestamptz` columns to `Temporal.Instant` and
+   * `timestamp` columns to `Temporal.PlainDateTime`.
+   */
+  readonly timestamptz?: "string" | "instant";
   /** `'bigint'` or `'string'` read `int8` exactly (above 2^53). */
   readonly int8?: "number" | "string" | "bigint";
   /** `'string'` reads `numeric` exactly. */
@@ -475,6 +453,22 @@ interface EntitlementsConfig {
   readonly customer?: string;
   /** The tenant id column of that table. Defaults to `id`. */
   readonly key?: string;
+  /**
+   * With a PermDock manifest, `has_entitlement` and `feature_claims` read
+   * PermDock's memberships (`member_<scope>_ids()` and
+   * `member_<scope>_ids_for(user)`) instead of `better_supabase.memberships`.
+   * `scope` is the PermDock scope tenants are (default `organization`);
+   * `false` keeps the kit's memberships table.
+   */
+  readonly permdock?: false | {
+    readonly scope?: string;
+  };
+}
+interface PermdockPathsConfig {
+  /** What `permdock supabase inspect --out` writes. Defaults to `permdock.manifest.json`. */
+  readonly manifest?: string;
+  /** What `permdock catalog` writes. Defaults to `permissions.catalog.json`. */
+  readonly catalog?: string;
 }
 /** pgvector distance: `<=>` (cosine), `<->` (l2) or `<#>` (negative inner product). */
 type VectorDistance = "cosine" | "l2" | "inner_product";
@@ -555,6 +549,8 @@ interface BetterSupabaseConfig {
   readonly topics?: Readonly<Record<string, string>>;
   readonly realtime?: RealtimeConfig;
   readonly entitlements?: EntitlementsConfig;
+  /** Where PermDock's JSON outputs are, for doctor, `gen` and the SQL kit. */
+  readonly permdock?: PermdockPathsConfig;
   /**
    * Embedding columns, keyed by `table` or `schema.table`. The
    * `vector-search` SQL kit module writes `search_<table>(query, k)` for each,
@@ -596,7 +592,11 @@ interface ResolvedConfig {
     readonly table: string;
     readonly column: string;
     readonly key: string;
+    readonly permdock: false | {
+      readonly scope: string;
+    };
   };
+  readonly permdock: Required<PermdockPathsConfig>;
   readonly vectorSearch: readonly {
     readonly table: string;
     readonly column: string;
@@ -615,4 +615,4 @@ declare function defineConfig(config: BetterSupabaseConfig): BetterSupabaseConfi
 /** Applies defaults. Paths stay relative to `root`. */
 declare function resolveConfig(config: BetterSupabaseConfig, root: string): ResolvedConfig;
 //#endregion
-export { ExtrasFunction as $, defineConfig as A, Catalog as B, SourceConfig as C, TimestampsConfig as D, TenantConfig as E, ValibotGeneratorOptions as F, CatalogFunction as G, CatalogColumn as H, valibot as I, CatalogIndex as J, CatalogFunctionArg as K, JsonSchemaGeneratorOptions as L, resolveJsonSchema as M, ZodGeneratorOptions as N, VectorDistance as O, zod as P, CatalogUnique as Q, buildJsonSchema as R, SoftDeleteConfig as S, TableConfig as T, CatalogEnum as U, CatalogCheck as V, CatalogForeignKey as W, CatalogTable as X, CatalogPolicy as Y, CatalogTrigger as Z, Privilege as _, ClaimsConfig as a, SnapshotBucket as at, ResolvedExpose as b, EntitlementsConfig as c, Queryable as ct, Generator as d, ExtrasHook as et, GeneratorInput as f, PluginFlagsConfig as g, OpenApiConfig as h, CONFIG_SCHEMA_URL as i, Snapshot as it, resolveConfig as j, VectorSearchConfig as k, ExposeConfig as l, JsonTypeConfig as m, BetterSupabaseConfig as n, ExtrasTable as nt, CodecsConfig as o, SnapshotExtras as ot, JsonSchemaSource as p, CatalogGrant as q, BucketConfig as r, ForeignKeyAction as rt, DoctorConfig as s, GeneratorMetadata as st, ActorConfig as t, ExtrasHookFunction as tt, GeneratedFile as u, RealtimeConfig as v, SqlConfig as w, SeedConfig as x, ResolvedConfig as y, jsonSchema as z };
+export { GeneratorMetadata as $, VectorSearchConfig as A, CatalogFunction as B, SoftDeleteConfig as C, TenantConfig as D, TableConfig as E, CatalogCheck as F, CatalogTable as G, CatalogGrant as H, CatalogColumn as I, ExtrasFunction as J, CatalogTrigger as K, CatalogColumnGrant as L, resolveConfig as M, resolveJsonSchema as N, TimestampsConfig as O, Catalog as P, ForeignKeyAction as Q, CatalogEnum as R, SeedConfig as S, SqlConfig as T, CatalogIndex as U, CatalogFunctionArg as V, CatalogPolicy as W, ExtrasHookFunction as X, ExtrasHook as Y, ExtrasTable as Z, PluginFlagsConfig as _, ClaimsConfig as a, ResolvedConfig as b, EntitlementsConfig as c, Generator as d, Snapshot as et, GeneratorInput as f, PermdockPathsConfig as g, OpenApiConfig as h, CONFIG_SCHEMA_URL as i, defineConfig as j, VectorDistance as k, ExposeConfig as l, JsonTypeConfig as m, BetterSupabaseConfig as n, SnapshotExtras as nt, CodecsConfig as o, JsonSchemaSource as p, CatalogUnique as q, BucketConfig as r, DoctorConfig as s, ActorConfig as t, SnapshotBucket as tt, GeneratedFile as u, Privilege as v, SourceConfig as w, ResolvedExpose as x, RealtimeConfig as y, CatalogForeignKey as z };