better-supabase 0.2.0 → 0.4.0

package/dist/{view-D1s0wa0T.d.ts → view-B64o81wp.d.ts}

@@ -1,7 +1,30 @@
-import { p as DbError } from "./result-CTkCZ6JA.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-TVia554c.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-CjHILk2w.js";
+import { p as DbError } from "./result-CqEsbgYs.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-C7MNQ1Ob.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-BAqQcwMW.js";
 import { JWTClaims, UserClaims } from "@supabase/server";
+//#region src/auth/actor.d.ts
+/** One level of an RFC 8693 `act` chain: who acts, and who acted before it. */
+interface ActClaim {
+  readonly sub: string;
+  readonly act?: ActClaim;
+  readonly [claim: string]: unknown;
+}
+/**
+ * The app acting for the user: the outermost `sub` of an RFC 8693 `act`
+ * chain (prior actors stay on `chain`), else the OAuth `client_id` of a
+ * Supabase OAuth server token.
+ */
+interface SessionActor {
+  readonly id: string;
+  readonly kind: "oauth-client";
+  readonly chain?: ActClaim;
+}
+/** What the user delegated to the actor: the token's OAuth `scope`. */
+interface SessionDelegation {
+  readonly scopes: readonly string[];
+  readonly chain?: ActClaim;
+}
+//#endregion
 //#region src/auth/view.d.ts
 /**
  * The verified caller as plain data: no token, no clients. Safe to return
@@ -12,13 +35,13 @@ type AuthSession<C = unknown, P = unknown> = {
   readonly user: UserClaims;
   /**
    * The verified JWT payload, including custom access token hook claims,
-   * typed and validated by `sb.claims(schema)`.
+   * typed and validated by `betterSupabase.claims(schema)`.
    */
   readonly claims: JWTClaims & C;
   /** Seconds since epoch, from the token's `exp`. */
   readonly expiresAt: number | null;
   /**
-   * `user_metadata` parsed by `sb.userMetadata(schema)`, for display.
+   * `user_metadata` parsed by `betterSupabase.userMetadata(schema)`, for display.
    * Absent without a schema or when the metadata fails it. Users
    * write this data with `auth.updateUser()`: never base access on it.
    */
@@ -29,6 +52,13 @@ type AuthSession<C = unknown, P = unknown> = {
   readonly amr: readonly AmrEntry[];
   /** Set when an admin acts as this user (the `act` claim), for a banner. */
   readonly impersonator?: Impersonator;
+  /**
+   * The OAuth client or agent acting for the user (`client_id`, or the
+   * outermost `sub` of the `act` chain), as PermDock's `actorOf` reads it.
+   */
+  readonly actor?: SessionActor;
+  /** The scopes the user granted `actor`, plus its `act` chain. Set only with `actor`. */
+  readonly delegation?: SessionDelegation;
 } | {
   readonly kind: "service";
   readonly keyName: string;
@@ -46,4 +76,4 @@ type AnonReason = Extract<AuthState, {
 /** Drops the token from an `AuthState`, leaving only serializable fields. */
 declare function toSession<C, P>(auth: AuthState<C, P>): AuthSession<C, P>;
 //#endregion
-export { toSession as n, AuthSession as t };
+export { SessionDelegation as a, SessionActor as i, toSession as n, ActClaim as r, AuthSession as t };

package/dist/{view-aOYizTeE.js → view-BrJI2LKp.js}

@@ -1,10 +1,17 @@
-import { g as impersonatorOf, n as amrOf, t as aalOf } from "./mfa-CpLfJSde.js";
+import { _ as delegationOf, g as actorOf, n as amrOf, t as aalOf, y as impersonatorOf } from "./mfa-byfjruR9.js";
 //#region src/auth/view.ts
 /** Drops the token from an `AuthState`, leaving only serializable fields. */
 function toSession(auth) {
 	switch (auth.kind) {
 		case "user": {
 			const impersonator = impersonatorOf(auth.claims);
+			const outcome = actorOf(auth.claims);
+			const actor = outcome.ok ? outcome.actor : void 0;
+			const scopes = actor ? delegationOf(auth.claims)?.scopes : void 0;
+			const delegation = actor && (scopes || actor.chain) ? {
+				scopes: scopes ?? [],
+				...actor.chain ? { chain: actor.chain } : {}
+			} : void 0;
 			return {
 				kind: "user",
 				user: auth.user,
@@ -13,7 +20,9 @@ function toSession(auth) {
 				...auth.profile === void 0 ? {} : { profile: auth.profile },
 				aal: aalOf(auth.claims),
 				amr: amrOf(auth.claims),
-				...impersonator ? { impersonator } : {}
+				...impersonator ? { impersonator } : {},
+				...actor ? { actor } : {},
+				...delegation ? { delegation } : {}
 			};
 		}
 		case "service": return {

package/dist/webhooks/index.d.ts

@@ -1,19 +1,20 @@
-import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { o as Result } from "../result-CTkCZ6JA.js";
-import { t as BetterSupabase } from "../define-e3zI4_4g.js";
-//#region src/webhooks/index.d.ts
-export interface VerifiedWebhook<T = unknown> {
+/// <reference lib="esnext.temporal" />
+import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { o as Result } from "../result-CqEsbgYs.js";
+import { t as BetterSupabase } from "../define-CRS2MRV3.js";
+//#region src/webhooks/verify.d.ts
+interface VerifiedWebhook<T = unknown> {
   readonly id: string;
-  readonly timestamp: Date;
+  readonly timestamp: Temporal.Instant;
   readonly payload: T;
   readonly body: string;
 }
-export interface VerifyOptions {
+interface VerifyOptions {
   /** Allowed clock skew in seconds. Defaults to 300. */
   readonly tolerance?: number;
-  readonly now?: () => number;
+  readonly now?: () => Temporal.Instant;
 }
-export type WebhookInput = Request | {
+type WebhookInput = Request | {
   readonly headers: Headers | Readonly<Record<string, string>>;
   readonly body: string;
 };
@@ -23,7 +24,7 @@ export declare function timingSafeEqual(a: string, b: string): boolean;
 export declare function signWebhook(secret: string, message: {
   readonly id: string;
   readonly body: string;
-  readonly timestamp?: Date;
+  readonly timestamp?: Temporal.Instant;
 }): Promise<Record<string, string>>;
 /**
  * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
@@ -41,13 +42,13 @@ interface HookUser {
   readonly user_metadata?: Readonly<Record<string, unknown>>;
   readonly [key: string]: unknown;
 }
-export interface AuthHookError {
+interface AuthHookError {
   readonly error: {
     readonly http_code: number;
     readonly message: string;
   };
 }
-export interface AuthHooks {
+interface AuthHooks {
   custom_access_token: {
     input: {
       readonly user_id: string;
@@ -116,7 +117,7 @@ export interface AuthHooks {
     output: Record<never, never>;
   };
 }
-export type AuthHookKind = keyof AuthHooks;
+type AuthHookKind = keyof AuthHooks;
 /** Rejects a hook with a status and message Supabase Auth passes to the client. */
 export declare function hookError(status: number, message: string): AuthHookError;
 /**
@@ -130,14 +131,14 @@ export declare function hookError(status: number, message: string): AuthHookErro
  * ```
  */
 export declare function authHook<K extends AuthHookKind>(_kind: K, secret: string | readonly string[], handler: (payload: AuthHooks[K]["input"], webhook: VerifiedWebhook<AuthHooks[K]["input"]>) => AuthHooks[K]["output"] | AuthHookError | Promise<AuthHooks[K]["output"] | AuthHookError>, options?: VerifyOptions): (request: Request) => Promise<Response>;
-export interface DatabaseWebhookPayload {
+interface DatabaseWebhookPayload {
   readonly type: "INSERT" | "UPDATE" | "DELETE";
   readonly table: string;
   readonly schema: string;
   readonly record: Readonly<Record<string, unknown>> | null;
   readonly old_record: Readonly<Record<string, unknown>> | null;
 }
-export interface DatabaseChange<R> {
+interface DatabaseChange<R> {
   readonly type: "INSERT" | "UPDATE" | "DELETE";
   readonly table: string;
   readonly record: R | null;
@@ -148,5 +149,6 @@ export declare function isDatabaseWebhook(value: unknown): value is DatabaseWebh
  * Reads a database webhook payload for `table` as an app-cased change.
  * Returns `null` for other tables or payloads that aren't database webhooks.
  */
-export declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(sb: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
-//#endregion
+export declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
+//#endregion
+export type { AuthHookError, AuthHookKind, AuthHooks, DatabaseChange, DatabaseWebhookPayload, VerifiedWebhook, VerifyOptions, WebhookInput };

package/dist/webhooks/index.js

@@ -1,2 +1,2 @@
-import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-DMipjhSP.js";
+import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-Bh_Jf_-l.js";
 export { authHook, databaseChange, hookError, isDatabaseWebhook, signWebhook, timingSafeEqual, verifySharedSecret, verifyWebhook };

package/dist/{webhooks-DMipjhSP.js → webhooks-Bh_Jf_-l.js}

@@ -1,26 +1,45 @@
-import { n as dbError } from "./errors-Bl3rkOzo.js";
-import { i as ok, n as err } from "./result-DWXatkd6.js";
-import { s as toApp } from "./shared-_6-uPL7E.js";
-//#region src/webhooks/index.ts
-const encoder = new TextEncoder();
+import { n as dbError } from "./errors-L0xK41y_.js";
+import { n as nowInstant, r as optionalTemporal } from "./temporal-BwshQk0W.js";
+import { n as temporalMissing } from "./temporal-required-CBNHT6ni.js";
+import { i as ok, n as err } from "./result-Bj6yt33D.js";
+import { i as toBase64, r as fromBase64 } from "./base64-D2gsioCY.js";
+import { s as toApp } from "./shared-DnoCdMDr.js";
+//#region src/webhooks/verify.ts
+const encoder = /* @__PURE__ */ new TextEncoder();
 /** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
 function secretBytes(secret) {
 	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
 	try {
-		return Uint8Array.from(atob(raw), (char) => char.charCodeAt(0));
+		return fromBase64(raw);
 	} catch {
 		throw new TypeError("Webhook secret is not valid base64");
 	}
 }
+/** Secrets come from configuration, so a handful of keys suffice. */
+const keys = /* @__PURE__ */ new Map();
+function keyFor(secret) {
+	let key = keys.get(secret);
+	if (!key) {
+		key = crypto.subtle.importKey("raw", secretBytes(secret), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["sign", "verify"]);
+		if (keys.size < 16) {
+			keys.set(secret, key);
+			key.catch(() => keys.delete(secret));
+		}
+	}
+	return key;
+}
 async function signature(secret, content) {
-	const key = await crypto.subtle.importKey("raw", secretBytes(secret), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(content)));
-	let binary = "";
-	for (const byte of mac) binary += String.fromCharCode(byte);
-	return btoa(binary);
+	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", await keyFor(secret), encoder.encode(content))));
+}
+function decodeSignature(value) {
+	try {
+		return fromBase64(value);
+	} catch {
+		return;
+	}
 }
 /** Constant-time string comparison. */
 function timingSafeEqual(a, b) {
@@ -37,7 +56,7 @@ function header(headers, name) {
 const unauthorized = (code, message) => dbError("unauthorized", message, { code });
 /** Headers for a signed Standard Webhooks request. */
 async function signWebhook(secret, message) {
-	const timestamp = String(Math.floor((message.timestamp ?? /* @__PURE__ */ new Date()).getTime() / 1e3));
+	const timestamp = String(Math.floor((message.timestamp ?? nowInstant()).epochMilliseconds / 1e3));
 	return {
 		"webhook-id": message.id,
 		"webhook-timestamp": timestamp,
@@ -51,29 +70,31 @@ async function signWebhook(secret, message) {
 */
 async function verifyWebhook(input, secrets, options = {}) {
 	const headers = input.headers;
-	const body = input instanceof Request ? await input.text() : input.body;
 	const id = header(headers, "webhook-id");
 	const timestamp = header(headers, "webhook-timestamp");
 	const signatures = header(headers, "webhook-signature");
 	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
 	const seconds = Number(timestamp);
 	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
-	const now = (options.now?.() ?? Date.now()) / 1e3;
+	const namespace = optionalTemporal();
+	if (namespace === void 0) return err(temporalMissing());
+	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
 	const tolerance = options.tolerance ?? 300;
 	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
 	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
-	const content = `${id}.${timestamp}.${body}`;
-	const offered = signatures.split(" ").map((entry) => entry.split(",")).filter(([version, value]) => version === "v1" && value).map(([, value]) => value);
+	const body = input instanceof Request ? await input.text() : input.body;
+	const content = encoder.encode(`${id}.${timestamp}.${body}`);
+	const offered = signatures.split(" ").map((entry) => entry.split(",")).filter(([version, value]) => version === "v1" && value).flatMap(([, value]) => decodeSignature(value) ?? []);
 	let valid = false;
 	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
-		const expected = await signature(secret, content);
-		for (const candidate of offered) if (timingSafeEqual(candidate, expected)) valid = true;
+		const key = await keyFor(secret);
+		for (const candidate of offered) if (await crypto.subtle.verify("HMAC", key, candidate, content)) valid = true;
 	}
 	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
 	try {
 		return ok({
 			id,
-			timestamp: /* @__PURE__ */ new Date(seconds * 1e3),
+			timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
 			payload: JSON.parse(body),
 			body
 		});
@@ -125,8 +146,8 @@ function isDatabaseWebhook(value) {
 * Reads a database webhook payload for `table` as an app-cased change.
 * Returns `null` for other tables or payloads that aren't database webhooks.
 */
-function databaseChange(sb, table, payload) {
-	const meta = sb.meta.tables[table];
+function databaseChange(betterSupabase, table, payload) {
+	const meta = betterSupabase.meta.tables[table];
 	if (!meta || !isDatabaseWebhook(payload) || payload.table !== meta.name || payload.schema !== meta.schema) return null;
 	return {
 		type: payload.type,

package/package.json

@@ -1,8 +1,10 @@
 {
   "name": "better-supabase",
-  "version": "0.2.0",
-  "description": "Strongly typed Supabase: generated schema, typed repositories, plugins, auth glue and framework integrations, with a CLI from day one.",
+  "version": "0.4.0",
+  "description": "Strongly typed Supabase: generated schema, typed repositories, plugins, auth glue, framework integrations and the better-supabase CLI.",
   "keywords": [
+    "cli",
+    "codegen",
     "hono",
     "mcp",
     "nextjs",
@@ -47,6 +49,10 @@
       "types": "./dist/config/index.d.ts",
       "default": "./dist/config/index.js"
     },
+    "./cli": {
+      "types": "./dist/cli/index.d.ts",
+      "default": "./dist/cli/index.js"
+    },
     "./client": {
       "types": "./dist/client/index.d.ts",
       "default": "./dist/client/index.js"
@@ -160,14 +166,14 @@
       "types": "./dist/plugins/validation/index.d.ts",
       "default": "./dist/plugins/validation/index.js"
     },
+    "./sql": {
+      "types": "./dist/sql/index.d.ts",
+      "default": "./dist/sql/index.js"
+    },
     "./testing": {
       "types": "./dist/testing/index.d.ts",
       "default": "./dist/testing/index.js"
     },
-    "./cli": {
-      "types": "./dist/cli/index.d.ts",
-      "default": "./dist/cli/index.js"
-    },
     "./schemas/*.json": "./schemas/*.json",
     "./package.json": "./package.json"
   },
@@ -177,53 +183,67 @@
   },
   "dependencies": {
     "@standard-schema/spec": "1.1.0",
-    "@supabase/middleware": "0.6.0",
-    "@supabase/postgrest-typegen": "0.2.2",
-    "@supabase/server": "1.8.1",
+    "@supabase/middleware": "1.0.0",
+    "@supabase/postgrest-js": "2.117.2",
+    "@supabase/postgrest-typegen": "0.3.1",
+    "@supabase/server": "1.9.0",
     "@supabase/ssr": "0.12.7"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
     "@better-supabase/ox-config": "0.0.0",
     "@better-supabase/typescript-config": "0.0.0",
-    "@effect/platform-node": "4.0.0-rc.117",
+    "@clack/prompts": "1.8.1",
+    "@effect/platform-node": "4.0.0",
     "@opentelemetry/api": "1.9.1",
     "@orpc/server": "2.0.0-beta.40",
-    "@supabase/config": "0.10.0",
+    "@supabase/config": "0.11.1",
     "@supabase/supabase-js": "2.117.2",
+    "@t3-oss/env-core": "0.13.11",
     "@tanstack/query-core": "5.104.0",
     "@tanstack/react-query": "5.104.0",
-    "@types/node": "24.19.0",
+    "@types/node": "26.6.3",
     "@types/pg": "8.23.1",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "@valibot/to-json-schema": "1.8.0",
-    "@vitest/coverage-v8": "5.0.2",
-    "effect": "4.0.0-rc.117",
-    "hono": "4.13.10",
-    "next": "16.3.7",
+    "@vitest/coverage-v8": "5.0.3",
+    "ajv": "8.20.0",
+    "ajv-formats": "3.0.1",
+    "c12": "4.0.0-rc.2",
+    "citty": "0.2.2",
+    "diff": "9.0.0",
+    "effect": "4.0.0",
+    "fastest-levenshtein": "1.0.16",
+    "hono": "4.13.12",
+    "next": "16.3.8",
     "oxfmt": "0.71.0",
     "oxlint": "1.86.0",
-    "pg": "8.23.0",
+    "pg": "8.23.1",
     "publint": "0.3.24",
     "react": "19.3.0",
     "react-dom": "19.3.0",
+    "smol-toml": "1.9.0",
+    "temporal-polyfill": "1.0.5",
+    "tinyexec": "1.3.1",
     "tsdown": "0.23.0",
     "typescript": "7.0.2",
     "valibot": "1.5.0",
-    "vitest": "5.0.2",
+    "vitest": "5.0.3",
     "zod": "4.6.5"
   },
   "peerDependencies": {
     "@opentelemetry/api": ">=1.9",
     "@orpc/server": ">=2.0.0-0",
-    "@supabase/config": ">=0.9.0 <0.11",
+    "@supabase/config": ">=0.9.0 <0.12",
     "@supabase/supabase-js": "^2.116.0",
     "@tanstack/query-core": "^5",
     "hono": ">=4",
     "next": ">=16",
+    "oxfmt": ">=0.66",
     "pg": ">=8",
-    "react": "^19"
+    "react": "^19",
+    "temporal-polyfill": ">=1"
   },
   "peerDependenciesMeta": {
     "@opentelemetry/api": {
@@ -244,11 +264,17 @@
     "next": {
       "optional": true
     },
+    "oxfmt": {
+      "optional": true
+    },
     "pg": {
       "optional": true
     },
     "react": {
       "optional": true
+    },
+    "temporal-polyfill": {
+      "optional": true
     }
   },
   "engines": {
@@ -258,8 +284,10 @@
     "bench": "node tests/next/next.bench.ts",
     "build": "tsdown",
     "check:publish": "publint && pnpm pack --out pack.tgz && attw --profile esm-only pack.tgz && rm -f pack.tgz",
+    "gen:fixtures": "node scripts/gen-fixtures.ts",
     "lint": "oxlint",
-    "test": "vitest run --coverage",
-    "typecheck": "tsc --noEmit --checkers 4"
+    "test": "vitest run --project unit --coverage",
+    "transit": "true",
+    "typecheck": "tsc --noEmit"
   }
 }

package/schemas/config-v1.json

@@ -67,7 +67,7 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "timestamptz": { "enum": ["string", "date"], "default": "string" },
+        "timestamptz": { "enum": ["string", "instant"], "default": "string" },
         "int8": { "enum": ["number", "string", "bigint"], "default": "number" },
         "numeric": { "enum": ["number", "string"], "default": "number" }
       }
@@ -283,6 +283,36 @@
           "description": "The tenant id column of that table.",
           "type": "string",
           "default": "id"
+        },
+        "permdock": {
+          "description": "With a PermDock manifest, read PermDock's memberships for this scope instead of better_supabase.memberships; false keeps the kit's table.",
+          "oneOf": [
+            { "const": false },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "scope": { "type": "string", "default": "organization" }
+              }
+            }
+          ]
+        }
+      }
+    },
+    "permdock": {
+      "description": "Where PermDock's JSON outputs are.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "manifest": {
+          "description": "What `permdock supabase inspect --out` writes.",
+          "type": "string",
+          "default": "permdock.manifest.json"
+        },
+        "catalog": {
+          "description": "What `permdock catalog` writes.",
+          "type": "string",
+          "default": "permissions.catalog.json"
         }
       }
     },

package/schemas/doctor-report-v1.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://unpkg.com/better-supabase/schemas/doctor-report-v1.json",
   "title": "better-supabase doctor report",
-  "description": "Output of `better-supabase doctor --format json`.",
+  "description": "Output of `better-supabase doctor --json`.",
   "type": "object",
   "additionalProperties": false,
   "required": ["$schema", "version", "tool", "summary", "findings"],
@@ -42,6 +42,12 @@
               "BS106",
               "BS107",
               "BS108",
+              "BS109",
+              "BS110",
+              "BS111",
+              "BS112",
+              "BS113",
+              "BS114",
               "BS200",
               "BS204",
               "BS205",
@@ -52,6 +58,15 @@
               "BS210",
               "BS211",
               "BS212",
+              "BS213",
+              "BS214",
+              "BS215",
+              "BS216",
+              "BS217",
+              "BS218",
+              "BS219",
+              "BS220",
+              "BS221",
               "BS301",
               "BS302",
               "BS303",
@@ -65,6 +80,7 @@
               "BS405",
               "BS406",
               "BS407",
+              "BS408",
               "BS501",
               "BS502"
             ]

package/schemas/snapshot-v2.json

@@ -690,6 +690,12 @@
                 "additionalProperties": {
                   "type": "string"
                 }
+              },
+              "execute": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
               }
             }
           }
@@ -901,6 +907,12 @@
               },
               "partial": {
                 "type": "boolean"
+              },
+              "method": {
+                "type": "string"
+              },
+              "predicate": {
+                "type": ["string", "null"]
               }
             }
           }
@@ -996,6 +1008,29 @@
             }
           }
         },
+        "columnGrants": {
+          "description": "Column-level insert and update grants to anon and authenticated. Absent in snapshots taken before they were introspected.",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["column", "role", "privileges"],
+            "properties": {
+              "column": {
+                "type": "string"
+              },
+              "role": {
+                "type": "string"
+              },
+              "privileges": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
         "large": {
           "description": "Postgres estimates at least 10,000 rows; the unbounded-read lint rule reads it.",
           "const": true